Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse by theme: all practice topics or certification tracks.
Migrate a single-subnet LAN from HSRP version 1 assumptions to HSRP version 2, enabling group numbers above 255. Configure HSRPv2 on two routers that share one virtual default gateway IP so hosts retain gateway resilience without reconfiguration.
Troubleshoot and repair a pre-broken HSRP gateway on a single shared LAN. Two routers (R1, R2) and two clients (PC1, PC2) connect to a single L2 switch (SW1) in VLAN 10. The hosts intermittently lose gateway reachability because both routers act active due to seeded faults. Use show commands to diagnose, then correct HSRP so both routers share one virtual IP and R1 deterministically wins active.
Build a fault-tolerant default gateway on a single LAN using HSRP. Two routers share one virtual IP so a host keeps the same default route even if one router fails. You will configure basic HSRP group 1 with a shared VIP, verify active/standby roles, and confirm the host can ping the virtual gateway.
Free with an account
Implement HSRP with interface tracking so the virtual gateway fails over when the active router loses its upstream link. Two routers (R1, R2) share a user LAN via SW with a single virtual default gateway for the PC, and both uplink to a separate CORE switch. The learner adds HSRP group 1 with a virtual IP, priority/preempt on R1, and tracks R1's uplink to drive deterministic failover.
Build a two-link LACP EtherChannel between two layer-2 switches as an access port for VLAN 60, then tune the global load-balancing algorithm to src-dst-ip so traffic distributes more evenly. Verify Po6 status, the hashing method, and end-to-end host reachability.
Beginner CCNA lab that builds a static Layer-2 EtherChannel (mode on) between two ioll2-xe switches using two parallel links as members of Port-channel1. The Port-channel is configured as an access port in VLAN 10 so that two hosts, one on each switch, can communicate without spanning-tree blocking a parallel path. Learners deploy and verify the bundle, then validate end-to-end host connectivity.
Free with an account
Build an LACP Layer-2 EtherChannel between SW1 and SW2 so Rapid-PVST+ treats two parallel links as one logical Port-channel 7. Without EtherChannel, STP will block one of the two access links. With LACP active on both members and Port-channel 7 as an access port in VLAN 70, STP shows a single forwarding interface (Po7) and both physical links forward as one logical channel. Two hosts in VLAN 70 verify end-to-end connectivity.
Build a Layer-3 EtherChannel between two IOS XE routers using LACP active/active. Two parallel router links are bundled into Port-channel5, which carries a /30 transit. R2 hosts a loopback; R1 installs a static route to reach it. Validate that the Port-channel holds the IP (members do not), that the bundle is up and uses both links, and that pings across the /30 and to the loopback succeed. Emphasis: deterministic EtherChannel configuration and Layer-3 port-channel practices.
Advanced CCNP troubleshooting lab: a pair of Layer-2 switches are connected by a two-link EtherChannel intended to carry VLAN 90 between access hosts. The starter configuration ships broken on purpose: the inter-switch bundle won’t form due to incompatible aggregation modes, and a trunk allow-list drift on one side prunes VLAN 90. Diagnose with IOS show commands, correct the EtherChannel mode so LACP forms the Port-channel, and restore trunk policy so same-VLAN hosts can communicate.
Advanced EtherChannel capstone, run as a fault hunt. The uplink bundle between two access switches is not passing traffic and the hosts either side cannot reach each other. Some members are up, the bundle is not, and nothing was recorded. You get symptoms and the required end state — no fault list. Both ends of a bundle have to agree about several things at once, and only one end was touched during the change — so comparing them is the exercise.
Build a two-link LACP EtherChannel between SW1 and SW2 using an active/passive pairing. The logical Port-channel2 carries VLAN 20 as an access link so two hosts on opposite switches can communicate. Verify with show etherchannel summary, show lacp neighbor, and host-to-host pings.
Build a Layer-2 PAgP EtherChannel between two ioll2-xe switches (SW1 and SW2) using a desirable/auto pairing on two parallel links. Bundle Ethernet0/0 and Ethernet0/1 into Port-channel 3, make the port-channel a VLAN 30 access interface on both switches, and verify with show etherchannel summary, show pagp neighbor, show pagp counters, and end-to-end host pings in VLAN 30.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately; the subscription is the only plan.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.