Cisco CML lab archive — every past daily CCNA & CCNP lab

CCNA Foundations Day 1: L3 & IP Addressing

Beginner CCNA lab focusing on IPv4 addressing and basic Layer 3 verification on a small branch network. You will assign IP addresses to router interfaces, confirm end-host default gateways, and verify connected reachability using host-based pings. You will also learn to read 'show ip interface brief' and 'show ip route' to confirm operational state before any routing beyond directly-connected networks is configured.

Archive preview only

CCNA Foundations: L2 Day 7 — VLANs, Trunks & Port Security

Deploy VLANs, hardened 802.1Q trunks, router-on-a-stick inter-VLAN routing, and sticky port security in a compact branch topology. Verify from real hosts and troubleshoot common misconfigurations.

Archive preview only

CCNA Foundations Series: Layer 2 Day 6

Deploy and troubleshoot VLANs, 802.1Q trunks, and port security in a realistic small-branch ROAS design. You will stand up VLANs 10/20/99 with a hardened trunk native VLAN 999, configure sticky port security on access ports, correct a misassigned VLAN, and resolve an err-disabled port caused by a port security violation. Finish by verifying end-to-end host connectivity across VLANs.

Archive preview only

Standard ACL: Permit Host & Subnet, Deny Others

Beginner CCNA ACL lab on a compact 5-node CML-Free topology. You will configure static routing end-to-end, implement source NAT (PAT) at the source edge, and then build a standard numbered ACL near the destination to allow a single NATed host and a specific subnet while denying all others. You will validate with pings from end hosts, observe ACL hit counters and NAT translations, and troubleshoot common mistakes such as ACL placement, wildcard masks, and pre-/post-NAT address matching.

Secure Router VTY with ACL: Only Management Host Allowed

Configure a standard IPv4 ACL and bind it to the VTY lines on the HQ router so only the dedicated management host can SSH to it. Confirm that regular routed traffic between sites is unaffected, and prove both a permitted and a denied management attempt.

CCNA: Named ACLs & Editing by Sequence Number

Hands-on ACL practice using named standard and extended ACLs, applied with correct placement and direction, edited by sequence number, and verified with counters and end-host tests. The lab adds a realistic NAT edge to expose order-of-operations pitfalls without obscuring data-plane ACL effects.

ACL App Filter: Permit SSH/HTTP, Block Telnet/ICMP

Build a two-router, one-access-switch lab with a client and a server. Establish basic IP connectivity with static routing, then implement an extended IPv4 ACL inbound on the client-facing interface to permit SSH and HTTP to the server while denying Telnet and ICMP echo. Validate from the client and review ACL hit counters for proof.

CCNA: ACL Placement – Std Near Dest, Ext Near Source

Dual-router Branch/HQ lab with a branch client and an HQ server. You will apply an extended IPv4 ACL inbound near the source on the Branch LAN to block specific traffic (TCP/80) while permitting others (ICMP), and a standard IPv4 ACL outbound near the destination on the HQ LAN to admit only the approved source. Validate from real hosts, confirm ACL hitcounts, and keep inter-site connectivity via static routes over a /30 transit.

ACL Logging & Order: Correct Permit/Deny Sequencing

Three-router static-routing lab with two Linux endpoints. An extended IPv4 ACL is intentionally misordered inbound near the source, causing Telnet to be permitted unexpectedly. Learners must observe first-match behavior via hit counters, enable buffered logging to see ACL log entries, and then correct the ACL sequence so Telnet is blocked while SSH and ICMP are permitted. All routers include a complete SSH management plane. The final solution forwards end-to-end and is enterprise-clean.

ACL Segmentation Policy on Multi-LAN Router

Deploy and verify multiple IPv4 ACLs on a single router that terminates three distinct LANs (Client, Server, and Management). You will place an extended ACL inbound on the Client interface to allow only specific services to the Server and block access to Management, a standard ACL outbound on the Management interface to enforce destination-side protection by source, and a VTY access-class to restrict router SSH to the Management subnet only. Validate with end-host tests that permitted flows succeed while denied flows are provably blocked, and use ACL hit counts and logs to troubleshoot.