Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse by theme: all practice topics or certification tracks.
65 labs match your filters.
Advanced static-routing capstone, run as a fault hunt. Two suites were cut over last night and now Suite-B is unreachable, Suite-A gets replies only sometimes, and one client cannot even reach its own gateway. Nothing was written down. You get symptoms and the required end state — no fault list. The faults span both routers and the access switch, and the routing table being present does not mean it is right.
Troubleshoot classic static routing and connectivity issues in a 3-router, 2-site network. Faults seeded include a missing return route, wrong next-hop/mask, and a missing/misconfigured default route. Learners must identify and correct Layer 3 faults to restore end-to-end reachability between branch clients.
Hands-on static routing lab in a small branch–WAN–branch triangle. You will configure recursive, directly-attached, and fully-specified static routes to enable end-to-end reachability between two hosts across three routers. You will learn how next-hop resolution works, how it appears in show ip route, and how to troubleshoot when static routes don’t resolve or forward as expected.
Advanced ACL and NAT capstone, run as a fault hunt. A branch site was cut over last night and the policy does not behave: the flow that should be blocked gets through, other traffic does not come back at all, and nobody recorded what changed. You get symptoms and the required end state — no fault list. The faults span all three routers and include a shadowed ACE and a policy applied on the wrong side of NAT, so translated addresses hide the very hosts the rules name. Expect fixing the first one to change the symptom rather than clear it.
Deploy router-on-a-stick inter-VLAN routing across a compact branch topology with a distribution and access switch, a hardened 802.1Q trunk, and two user VLANs. Configure VLANs and access/trunk ports, build router subinterfaces, verify end-to-end user reachability, and troubleshoot trunk/native-VLAN/subinterface mismatches.
Deploy a numbered extended ACL on a router-on-a-stick topology to allow HTTP from a single approved client to a web server while denying all other TCP attempts to that server from the same user VLAN. Apply the ACL inbound near the source, verify with real client traffic, and troubleshoot using ACL hit counts and test flows.
Hands-on CCNP OSPF lab comparing broadcast and point-to-point network types. Three routers share a multi-access Ethernet via an access switch to observe DR/BDR election, manipulate interface priorities, and then convert to point-to-point. Includes a user LAN behind R1 and realistic troubleshooting: neighbor stuck in 2-Way due to type mismatch, area mismatch isolating a router, and incorrect interface priority preventing desired DR/BDR roles.
Advanced CCNA troubleshooting lab on a router-on-a-stick design. VLAN 10 users can reach their gateway and other hosts, but VLAN 20 users cannot reach their gateway or any resources in VLAN 10. Methodically trace L2/L3 intent end-to-end - from the access ports through the trunks up to the router subinterfaces - to isolate the first-hop failure and implement fixes that restore inter-VLAN routing while maintaining enterprise trunk hardening and clean configurations.
Build and verify a three-VLAN router-on-a-stick design: one IOS router provides inter-VLAN routing via 802.1Q subinterfaces to a single Layer-2 access switch, with three Alpine hosts in VLANs 10, 20, and 30. The starter environment does not yet forward traffic correctly between all three VLANs, so you will apply a disciplined router-switch-host verification method to diagnose and fix the problem, then briefly break and restore one VLAN's connectivity before finishing with an enterprise-clean, hardened trunk.
Build a router-on-a-stick design with three VLANs (SALES, HR, GUEST) on a single router and single access switch, then enforce guest isolation using a single extended ACL applied inbound on the Guest subinterface. SALES and HR can reach each other; GUEST can reach only its default gateway and is blocked from internal subnets. The lab focuses on correct 802.1Q tagging, trunking, access port assignments, ACL placement/order, and end-host verification.
Advanced CCNA switching capstone centered on restoring end-to-end VLAN 20 transport across three Layer-2 switches using 802.1Q trunks. The starter ships intentionally broken: after a simulated maintenance window, two Alpine hosts in VLAN 20 can no longer reach each other across the inter-switch trunks. Learners diagnose with show interfaces trunk, show interfaces switchport, and show vlan brief, then identify and correct the trunking faults in the right order and verify with host pings.
Build a 5-node edge/DMZ topology. Implement a named extended ACL on the EDGE router to allow only TCP/80, TCP/443, and ICMP echo from the Inside LAN to a DMZ web server, deny all other traffic to that server with logging, and still permit general traffic elsewhere. Apply the ACL inbound on the EDGE inside LAN interface. Harden router SSH management with a standard ACL. Verify with wget, ping, and an intentionally denied SSH attempt that increments the deny log counter.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately; the subscription is the only plan.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.