Practice labs

CCNA & CCNP practice labs — hands-on Cisco CML scenarios

Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.

Browse by theme: all practice topics or certification tracks.

Browse by track & topic
AdvancedLocked

Lab 8: L3 EtherChannel + Static Routing

Build a routed LACP EtherChannel (Port-channel 8) between two iol-xe routers and route real inter-LAN traffic using static routes. Two parallel physical links (Ethernet0/0 and Ethernet0/1) on each router are bundled into a single Layer-3 Port-channel with a /30 transit. Each router serves a local /24 LAN with an alpine host. Validate that Po8 is up/up, static routes are present, and end-to-end host pings succeed across the aggregated uplink.

CCNA & CCNP45 min5 objectives

IntermediateLocked

DHCP: Verify Leases, Pools and Conflicts

Hands-on IOS DHCP server practice focused on validating pool state, inspecting conflicts, and fixing a real address conflict caused by a legacy static host on the LAN. You will verify server-side leases and exclusions, observe a conflict entry, then permanently exclude the static IP and clear the stale conflict so a client can obtain a clean address.

CCNA45 min5 objectives

BeginnerFree2026-07-02

Spanning Tree Fundamentals: Root Election & Port Roles

Beginner CCNA lab on a redundant two-switch Layer-2 loop with two parallel uplinks. You will enable Rapid-PVST+, set a deterministic root-bridge priority so SW1 becomes the root for VLAN 1, and verify port roles (root/designated/alternate) and loop prevention. Two Alpine hosts in VLAN 1 validate end-to-end connectivity without any routing or SVIs.

CCNA45 min5 objectives

Free with an account

AdvancedLocked

Root Guard on Designated Ports

Advanced Rapid-PVST+ and Root Guard implementation on a three-switch triangle with a real loop. SW1 is the intentional root for VLAN 90 and protects its designated ports with Root Guard to prevent root re-parenting. Two Alpine hosts on VLAN 90 verify end-to-end forwarding remains stable even if a superior BPDU appears downstream.

CCNA & CCNP50 min7 objectives

IntermediateLocked

STP Lab 7: Rapid-PVST+ Migration on Triangle Loop

Migrate a three-switch triangle from legacy PVST to Rapid-PVST+ without changing the existing root or blocked port. SW1 remains the deterministic root for VLAN 70 (priority 4096). Verify protocol mode, link types (point-to-point vs edge), and end-to-end host reachability, then observe the faster reconvergence behavior of Rapid-PVST+.

CCNA & CCNP45 min5 objectives

IntermediateLocked

STP 4: Port Priority Tie-Break on Parallel Links

Guide Rapid-PVST+ to prefer a specific parallel trunk by tuning the sender’s port priority on the root bridge. Two ioll2-xe switches (SW1, SW2) form a physical loop via two equal-speed trunks. A third L2 switch (SW3) extends the user VLAN to a second closet. One Alpine host attaches to SW1 and another to SW3 in VLAN 40 (10.1.40.0/24). You will: force SW1 to be the root for VLAN 40, lower the port priority on SW1’s Gi0/2 (Ethernet0/1) to break the tie so SW2 selects its Gi0/2 as the Root Port, enable PortFast and BPDU Guard on host-facing ports, and verify with show spanning-tree outputs and host pings.

CCNA55 min6 objectives

IntermediateLocked

STP Lab 6: BPDU Guard — Protecting the Edge

Continue the STP series on a three-switch triangle with a real loop. SW1 is the deterministic root for VLAN 60, and access ports already use PortFast. In this lab you will harden the edge by enabling BPDU Guard on the two host-facing access ports on SW2 and SW3, while leaving the inter-switch trunks untouched. Verify with show commands that BPDU Guard is active only on the edge and that hosts still communicate normally.

CCNA35 min5 objectives

AdvancedLocked

STP 10: Spanning Tree Troubleshooting Capstone

Advanced Rapid-PVST+ troubleshooting on a 3-switch triangle with a real Layer-2 loop. Two deliberate faults are seeded: an unintended root bridge wins VLAN 100 due to a mis-set/default priority, and PortFast/BPDU Guard are mistakenly applied on an inter-switch trunk. Two Alpine hosts in VLAN 100 verify user impact. Your job: use show commands to diagnose, then restore the correct root and remove edge features from the trunk while preserving them on access ports.

CCNA & CCNP70 min5 objectives

IntermediateLocked

STP 3: Path Cost — Choose the Forwarding Link (VLAN 30)

Engineer which trunk forwards by tuning STP path cost in a 3-switch triangle. Force SW1 as the VLAN 30 root at a deterministic priority, enable Rapid-PVST+, harden edge ports with PortFast and BPDU Guard, and raise the STP cost on SW3’s direct uplink to SW1 so SW3 prefers the longer, indirect path via SW2. Verify the resulting root port, alternate (blocked) port, and host reachability across the chosen path.

CCNA55 min5 objectives

AdvancedLocked

STP Lab 8: Per-VLAN Load Balancing Across Two Roots

Use Rapid-PVST+ to elect different root bridges per VLAN across two parallel trunks, spreading VLAN 80 and VLAN 81 across distinct physical links without modifying path cost or port priority. Validate independent per-VLAN trees and confirm hosts in VLAN 80 can communicate over the surviving path. Includes a drift-check to diagnose/restore trunk allow-lists.

CCNA & CCNP65 min6 objectives

IntermediateLocked

STP 5: PortFast on Access Ports (VLAN 50 Triangle)

Configure PortFast correctly on access ports in a triangle switch loop while maintaining normal STP protection on inter-switch trunks. Force SW1 as the root for VLAN 50 and verify that only edge ports are fast-tracked. Observe the difference in host convergence with and without PortFast.

CCNA45 min5 objectives

BeginnerLocked

STP 2: Controlling the Root Bridge with Priority

Beginner CCNA STP lab on a three-switch triangle with two hosts in VLAN 20. You will deliberately control the Spanning Tree root election using the root primary/secondary macros so SW1 is the active root and SW2 is the standby. The baseline already provides VLANs and trunks; your job is to set root priorities deterministically and verify the resulting roles and port states without introducing any Layer-3.

CCNA35 min5 objectives

What's unlocked, and what's free

Subscription access, and the labs that need none.

A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately; the subscription is the only plan.

Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.