Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse by theme: all practice topics or certification tracks.
Build and verify EIGRP on a small routed topology while marking the user-facing LAN interface as passive. You will advertise the LAN into EIGRP without forming an adjacency on that segment, preventing rogue neighbors and reducing control-plane noise. Focus on deterministic EIGRP configuration, wildcard-based network inclusion, and verification using show commands.
Tune EIGRP path selection by manipulating cumulative delay. Three routers (R1-R2-R3) form EIGRP 100 adjacencies over three /30 point-to-point links. R3 originates 192.168.30.0/24 on Loopback0. You will enable EIGRP and then increase delay on R1’s direct link to R3 so R1 prefers the indirect path via R2 to reach 192.168.30.0/24. Two Alpine hosts validate end-to-end reachability and path choice.
Build a 3-router EIGRP domain where R1 reaches R3’s loopback over two paths (direct and via R2). You will tune interface delay so the indirect path becomes the successor and the direct path remains a feasible successor, then enable variance to install both unequal-cost paths in R1’s routing table. Two Alpine hosts validate end-to-end reachability while router show commands confirm unequal-cost load sharing.
Build a two-router, two-LAN EIGRP domain and practice precise wildcard-masked network statements so only the intended interfaces participate. R1 has an extra LAN on Ethernet0/2 (172.16.99.0/24) that must be excluded from EIGRP. Validate with show commands and end-host pings that the correct LANs are exchanged and the excluded LAN is not advertised.
Harden EIGRP adjacencies with MD5 authentication between two iol-xe routers over a /30 transit, then validate that only trusted peers form neighbors. You will configure a key chain, bind it to the transit interface, and enable EIGRP (AS 100) to exchange two user LANs. Verification includes neighbor state, key chain presence, and end-to-end host reachability.
Troubleshoot classic static routing and connectivity issues in a 3-router, 2-site network. Faults seeded include a missing return route, wrong next-hop/mask, and a missing/misconfigured default route. Learners must identify and correct Layer 3 faults to restore end-to-end reachability between branch clients.
Set HSRP priority to deterministically choose the active default gateway on a shared LAN. Two IOS routers (R1, R2) and one access switch serve a small user LAN with a single virtual gateway IP. By default R2 becomes active due to its higher interface IP; raise R1’s HSRP priority so it becomes the designated active router for group 1 while hosts keep a single virtual gateway.
Intermediate CCNA lab focused on HSRP preempt behavior. Two routers share a virtual default gateway on a single user VLAN. The baseline already has HSRP group 1 with R1 at higher priority, but HSRP doesn't preempt by default — if R1 reboots, R2 stays active even after R1 returns. The learner enables preempt on R1 so it deterministically reclaims the active role whenever it's up, keeping the intended primary in control. Verification uses show standby on routers and basic host pings to the virtual gateway.
Harden an HSRP virtual default gateway with MD5 authentication so only trusted routers can participate. You’ll secure an existing HSRP group on two IOS routers that share a user VLAN via a single L2 switch. Validate the authentication state on both routers and confirm the endpoint still reaches the virtual IP.
Configure HSRP on two routers with a shared virtual gateway and speed up failover by tightening hello/hold timers to 1/3 seconds. Validate deterministic active/standby selection and confirm timer settings via show commands.
Implement two HSRP groups on a single VLAN so each router is Active for one group and Standby for the other. Two hosts split default gateways across the two virtual IPs for deterministic load-sharing with redundancy.
Replace HSRP with open-standard VRRP to provide a shared virtual gateway on a single access VLAN. Configure VRRP group 1 with a common virtual IP and deterministic master/backup roles via priority and preempt. Validate using show vrrp commands and end-host pings.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately; the subscription is the only plan.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.