IntermediatePublished 2026-10-26
CCNP Site-to-Site VPN: Internet Access Beside the Tunnel
Today's daily lab
Included with a subscription.
Subscribe to unlockHQ's IPsec tunnel to the branch works, but HQ users cannot reach the internet. Add PAT on the HQ router without breaking the tunnel.
Learning objectives
- Translate HQ's LAN to the router's public address with PAT
- Exempt the branch-bound traffic from translation
- Verify both the internet and the tunnel still work
Troubleshooting focus
- Internet works but the branch went dark: VPN traffic is being translated
- No translations at all: check the inside and outside interfaces
Topology
Subscribe to see the full topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Found a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.