Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse the 19 free labsBrowse by theme: all practice topics or certification tracks.
Build a compact dual-stack enterprise topology where IPv4 is already forwarding end-to-end using OSPFv2. Your task is to bring up IPv6 routing in parallel using OSPFv3 with explicit router-ids, proving that IPv6 control/data planes operate independently from IPv4. Verify both protocols resolve separately and that an IPv4 control-plane failure does not impact IPv6 forwarding.
Daily CCNA IPv6 lab: build OSPFv3 across a three-router triangle with dual-stack links and real end hosts. IPv4 OSPFv2 is pre-built and forwarding end-to-end as the baseline. Your tasks: bring R3 into OSPFv3 with an explicit router-id and enable it per-interface, activate OSPFv3 on R1’s R3-facing interface, then steer the preferred IPv6 path by adjusting interface cost. Verify neighbor state, routes, and end-to-end IPv6 reachability from host to host.
Deploy single-area OSPFv3 between two routers so IPv6 LANs reach end-to-end. The IPv4 side is already forwarding with static routes. Your job: enable OSPFv3 with explicit router-ids and activate it per-interface on both the transit and LAN links, then verify the neighbor forms over link-local and routes are learned.
Build a compact branch-to-edge topology that is dual-stack for IPv4 and intentionally incomplete for IPv6. IPv4 is fully working as a baseline. Your job: enable IPv6 forwarding on both routers, replace specific IPv6 routes at the branch with a single default (::/0) toward the edge, and add a specific IPv6 return route on the edge back to the branch LAN. Verify the branch host reaches the edge-side resources over IPv6 while the IPv4 plane remains stable.
Dual-stack enterprise lab with two routers, a shared access switch, and two hosts in separate VLANs. IPv4 is fully working via static routes in the starter. Your task is to add IPv6 static routes on both routers so the clients can communicate end-to-end over IPv6. Learn why a link-local next hop on a point-to-point link requires specifying the exit interface.
Single-site IPv4/IPv6 lab where IPv4 is already working. You will enable IPv6 routing on the router and place a single /64 on the user LAN so two hosts autoconfigure via SLAAC. Then verify each host’s chosen IPv6 address and the learned default route via the router’s link-local address, and test end-to-end IPv6 connectivity.
A focused, enterprise-clean IPv6 day in a progressive CCNA series. You will enable IPv6 on a single user LAN, assign a deterministic link-local gateway, and observe Neighbor Discovery (ND) in action. IPv4 is already working; your job is to turn on IPv6 unicast routing, add a global unicast /64 to the gateway interface, and set an explicit link-local address so hosts learn a predictable next-hop. You will verify SLAAC-derived host addresses, default routes learned via RA, and ND neighbor tables on the router, and then test by pinging both the router’s link-local and global addresses from the hosts.
Bring IPv6 up alongside the already-working IPv4 baseline. You will enable IPv6 unicast routing on both routers, put a unique 2001:db8::/64 on each site LAN, put a /127 on the router-to-router transit, and address the dual-homed workstation on both of the LANs it is plugged into plus its IPv6 default route. Verify that IPv6 reaches both on-link gateways and, through the default route, the near router's transit address — while the far router's transit address stays unreachable over IPv6 and reachable over IPv4, because no IPv6 routing between the sites exists yet.
Bring together core campus redundancy skills in one focused day: elect a deterministic STP root on the intended distribution switch, form a working LACP EtherChannel between distribution and access, harden edge with PortFast/BPDU Guard, and stand up an HSRP virtual gateway that the VLAN 10 users actually use. The starter is intentionally mis-tuned across layers so you must build or repair it end-to-end.
Build gateway resiliency on a campus user LAN using VRRP between two edge routers. You will configure a VRRP group with a shared virtual IP, set a higher priority on the intended master, and prove failover from the end hosts without changing the default gateway. Includes full SSH management on routers, a clean L2 access switch, and two clients using the VRRP VIP.
Daily CCNA campus-redundancy lab focusing on HSRP preemption and interface tracking. You will refine an already-working HSRP default gateway so it follows real network health: fail to the standby when the preferred router loses its upstream, and preempt back when it recovers. The topology is an enterprise-clean small site with two distribution routers sharing a user VLAN through a Layer-2 access switch, each with its own point-to-point uplink to a core router. The starter works in steady state but suffers a blackhole during uplink failures and never reclaims Active without preemption. Your job is to add preempt and tracking on the correct router/interface and verify end-to-end forwarding under failover and failback.
Stand up HSRP on two routers sharing a single user VLAN so campus hosts point to a resilient virtual default gateway. You will configure HSRP on both routers, make one router the active forwarder, and verify failover from the end hosts.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately any more; anything bought before that change stays yours permanently, subscription or not.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.