Free with an account, no subscription. Download the package, build it in CML, then upload your config for a score.
Browse by theme: all practice topics or certification tracks.
Build a fault-tolerant default gateway on a single LAN using HSRP. Two routers share one virtual IP so a host keeps the same default route even if one router fails. You will configure basic HSRP group 1 with a shared VIP, verify active/standby roles, and confirm the host can ping the virtual gateway.
Beginner CCNA lab that builds a static Layer-2 EtherChannel (mode on) between two ioll2-xe switches using two parallel links as members of Port-channel1. The Port-channel is configured as an access port in VLAN 10 so that two hosts, one on each switch, can communicate without spanning-tree blocking a parallel path. Learners deploy and verify the bundle, then validate end-to-end host connectivity.
Beginner CCNA lab on a redundant two-switch Layer-2 loop with two parallel uplinks. You will enable Rapid-PVST+, set a deterministic root-bridge priority so SW1 becomes the root for VLAN 1, and verify port roles (root/designated/alternate) and loop prevention. Two Alpine hosts in VLAN 1 validate end-to-end connectivity without any routing or SVIs.
Build a single-scope DHCP server on an IOS-XE router and verify two Alpine Linux clients lease addresses dynamically across a pure Layer-2 switch. Configure only the canonical pool (network + default-router). Verify leases from the router and from each client.
Build a small but realistic edge topology and configure static one-to-one NAT on R1 so the inside host PC-A (192.168.10.10) always translates to 203.0.113.3. Validate bidirectional reachability with an upstream ISP router and a public server one hop further. Verify translation state and counters on R1 and connectivity from both ends.
Configure inter-VLAN routing using router-on-a-stick with one router, one Layer-2 switch, and two hosts. Build VLAN 10 and VLAN 20, trunk the router uplink, create subinterfaces for each VLAN, and verify that hosts can now reach each other across VLANs.
Hands-on fundamentals with Cisco port security on host-facing access ports. Build a small two-switch campus with a trunk, place two Linux hosts in the same user VLAN, then enable port security with the explicit defaults (maximum 1, violation shutdown) on both host ports. Verify secure-up state and baseline host connectivity.
Build a static 802.1Q trunk between two Layer-2 switches to carry VLANs 10 and 20. Map hosts to access ports, verify trunk encapsulation and allowed VLANs, demonstrate same-VLAN reachability across the trunk, and confirm inter-VLAN isolation. Then simulate an allow-list drift fault, diagnose with show commands, and restore service.
Beginner CCNA ACL lab on a compact 5-node CML-Free topology. You will configure static routing end-to-end, implement source NAT (PAT) at the source edge, and then build a standard numbered ACL near the destination to allow a single NATed host and a specific subnet while denying all others. You will validate with pings from end hosts, observe ACL hit counters and NAT translations, and troubleshoot common mistakes such as ACL placement, wildcard masks, and pre-/post-NAT address matching.
Hands-on CCNA lab to practice creating VLANs on a single Layer-2 switch and assigning access ports. You will segment a flat network into two VLANs, place hosts into the right VLAN, and verify that intra-VLAN pings succeed while inter-VLAN pings fail (no routing present). Includes realistic verification and troubleshooting.
Hands-on CCNA static routing lab: build a small hub-and-spoke with two stub routers and a hub router. Configure default routes on the spokes and specific static routes on the hub so two user LANs reach each other end-to-end. Validate from real hosts and practice first-hop and return-path troubleshooting.
Hands-on CCNA beginner lab: build a 3-router chain with end hosts, enable OSPFv2 area 0, form full adjacencies, advertise loopbacks and LANs, verify route propagation end-to-end, and intentionally create then resolve an OSPF area mismatch on a transit segment.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately; the subscription is the only plan.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.