Hands-on CCNA and CCNP practice labs across OSPF, VLANs, ACLs, routing, NAT, security, and more — each a real Cisco Modeling Labs scenario you build in your own CML and grade against the answer key. Filter by topic, track, and difficulty. A subscription unlocks every daily lab published since you joined while it's active; earlier labs unlock permanently with a bundle.
Prefer to browse by theme? See all practice topics or certification tracks.
65 labs match your filters.
Configure a standard IPv4 ACL and bind it to the VTY lines on the HQ router so only the dedicated management host can SSH to it. Confirm that regular routed traffic between sites is unaffected, and prove both a permitted and a denied management attempt.
Hands-on ACL practice using named standard and extended ACLs, applied with correct placement and direction, edited by sequence number, and verified with counters and end-host tests. The lab adds a realistic NAT edge to expose order-of-operations pitfalls without obscuring data-plane ACL effects.
Build a two-router, one-access-switch lab with a client and a server. Establish basic IP connectivity with static routing, then implement an extended IPv4 ACL inbound on the client-facing interface to permit SSH and HTTP to the server while denying Telnet and ICMP echo. Validate from the client and review ACL hit counters for proof.
Three-router static-routing lab with two Linux endpoints. An extended IPv4 ACL is intentionally misordered inbound near the source, causing Telnet to be permitted unexpectedly. Learners must observe first-match behavior via hit counters, enable buffered logging to see ACL log entries, and then correct the ACL sequence so Telnet is blocked while SSH and ICMP are permitted. All routers include a complete SSH management plane. The final solution forwards end-to-end and is enterprise-clean.
Dual-router Branch/HQ lab with a branch client and an HQ server. You will apply an extended IPv4 ACL inbound near the source on the Branch LAN to block specific traffic (TCP/80) while permitting others (ICMP), and a standard IPv4 ACL outbound near the destination on the HQ LAN to admit only the approved source. Validate from real hosts, confirm ACL hitcounts, and keep inter-site connectivity via static routes over a /30 transit.
Hands-on CCNA ACL practice using standard ACLs and wildcard masks to allow a single host, a contiguous range, and an entire subnet while proving a deny. You will place the ACL near the destination, order statements correctly, verify with end-host pings and ACL counters, and troubleshoot common mistakes.
Deploy and verify multiple IPv4 ACLs on a single router that terminates three distinct LANs (Client, Server, and Management). You will place an extended ACL inbound on the Client interface to allow only specific services to the Server and block access to Management, a standard ACL outbound on the Management interface to enforce destination-side protection by source, and a VTY access-class to restrict router SSH to the Management subnet only. Validate with end-host tests that permitted flows succeed while denied flows are provably blocked, and use ACL hit counts and logs to troubleshoot.
Advanced CCNA L2 troubleshooting in a compact branch. Some PCs can't reach their default gateway or other departments across two switches and a router-on-a-stick gateway, and your monitoring system has flagged a switching/trunking problem on the path. Validation is performed from the endpoints (Alpine hosts) using pings and ARP, and trunks are hardened with a non-default native VLAN.
Build and verify an 802.1Q trunk between two access switches that cleanly transports VLAN 10 end-to-end while intentionally pruning VLAN 20. You will configure access ports, create VLANs, set a hardened dot1Q trunk with a non-default native VLAN, and validate host reachability and isolation from endpoints.
Configure VLANs and 802.1Q trunks across two access switches with a router-on-a-stick gateway. Intentionally misconfigure the native VLAN and trunk allow-list to observe loss of intra-VLAN connectivity, detect the mismatch using switch warnings and show commands, and then remediate to restore user reachability. Validates VLAN segmentation, trunking symmetry, and troubleshooting skills for CCNA candidates.
Build VLANs across two access switches with an 802.1Q trunk and a router uplink. Verify that hosts in the same VLAN can communicate (even across switches) while hosts in different VLANs cannot. Then troubleshoot a failure caused by a trunk allow-list misconfiguration.
Configure a two-switch access layer with data and voice VLANs on access ports and an 802.1Q trunk between switches. Add a router-on-a-stick gateway for VLAN 10/20. Verify VLAN placement, trunk status, and observe a connectivity failure caused by an allow-list misconfiguration on the inter-switch trunk—then correct it to restore intra-VLAN reachability.