Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse by theme: all practice topics or certification tracks.
19 labs match your filters.
Harden the Layer-2 access edge by enabling DHCP Snooping on a single access switch and placing the trust boundary only toward the legitimate DHCP server/gateway. Validate with show commands and end-host connectivity.
Enable Cisco Discovery Protocol (CDP) on R1 to map directly-connected Cisco neighbors while suppressing CDP advertisements on the untrusted management-edge interface. Routers are directly cabled for true CDP adjacency and also share a common management LAN via SW1 alongside an Alpine MGMT host.
Beginner CCNA lab (1 of 10) focused on configuring and verifying IPv4 interface addressing on Cisco IOS routers. Learners assign given /24 addresses to two router interfaces and validate directly-connected reachability. No routing protocols or static routes are configured in this lab.
Beginner CCNA NTP lab. Two IOS routers share a single /30 link with no routing. Configure R1 as an authoritative NTP master at stratum 3 and point R2 to R1 as its NTP server. Verify using show ntp associations, show ntp status, and show clock. Emphasis: deterministic config — grading checks the presence of ntp master 3 on R1 and ntp server 10.0.0.1 on R2, not live convergence.
Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.
Build your first external BGP (eBGP) peering between two routers in different autonomous systems over a /30 point-to-point link and exchange one /24 prefix from each side using Loopback0. The topology is intentionally small yet realistic, with two edge routers (AS 65001 and AS 65002) and three Alpine hosts for basic reachability checks and operator context. You will configure deterministic BGP neighbors, originate prefixes with exact-match network statements, and validate reachability and route installation using standard IOS and Linux tools. This is Lab 1 of 10 in the CCNP-aligned BGP Fundamentals series and sets the foundation for later labs on iBGP, route filtering, and path selection.
Bring up EIGRP in AS 100 between two routers over a /30 transit and advertise a single LAN. Verify the first adjacency forms and that R2 learns R1's LAN via EIGRP. Includes realistic end hosts on a shared LAN for path testing.
Build a fault-tolerant default gateway on a single LAN using HSRP. Two routers share one virtual IP so a host keeps the same default route even if one router fails. You will configure basic HSRP group 1 with a shared VIP, verify active/standby roles, and confirm the host can ping the virtual gateway.
Beginner CCNA lab that builds a static Layer-2 EtherChannel (mode on) between two ioll2-xe switches using two parallel links as members of Port-channel1. The Port-channel is configured as an access port in VLAN 10 so that two hosts, one on each switch, can communicate without spanning-tree blocking a parallel path. Learners deploy and verify the bundle, then validate end-to-end host connectivity.
Beginner CCNA lab on a redundant two-switch Layer-2 loop with two parallel uplinks. You will enable Rapid-PVST+, set a deterministic root-bridge priority so SW1 becomes the root for VLAN 1, and verify port roles (root/designated/alternate) and loop prevention. Two Alpine hosts in VLAN 1 validate end-to-end connectivity without any routing or SVIs.
Build a single-scope DHCP server on an IOS-XE router and verify two Alpine Linux clients lease addresses dynamically across a pure Layer-2 switch. Configure only the canonical pool (network + default-router). Verify leases from the router and from each client.
Build a small but realistic edge topology and configure static one-to-one NAT on R1 so the inside host PC-A (192.168.10.10) always translates to 203.0.113.3. Validate bidirectional reachability with an upstream ISP router and a public server one hop further. Verify translation state and counters on R1 and connectivity from both ends.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately any more; anything bought before that change stays yours permanently, subscription or not.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.