Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse the 19 free labsBrowse by theme: all practice topics or certification tracks.
Troubleshoot and fix an LACP EtherChannel between campus switches so both physical members bundle and the trunk reliably carries VLAN 10. Two independent faults are seeded: an intra-bundle trunk mismatch on one switch and an administratively down member on the other. Learners diagnose with show commands, align trunk attributes, and verify end-to-end host reachability.
Daily CCNA campus-redundancy lab focused on EtherChannel scale-out and hashing. Two distribution switches are joined by three parallel trunk links. Two links are already bundled with LACP into a trunking port-channel; the third is a plain trunk currently STP-blocked and wasting capacity. Add the spare link to the existing bundle on both sides and change the global hashing method so multiple flows can actually use multiple member links. End-to-end switching must continue to work for the users VLAN.
Hands-on CCNA EtherChannel repair lab. Two uplinks between a distribution and an access switch are intended to form a single port-channel trunk carrying VLAN 10. The starter ships with a real mode mismatch across the bundle and an allow-list error, so the Port-channel stays down and hosts cannot talk. Learners diagnose the symptom and standardize on one protocol family (PAgP, LACP, or Static) and correct trunking so VLAN 10 forwards end-to-end.
Bundle two parallel switch uplinks into a single Port-Channel using LACP so that Spanning Tree no longer blocks one link. You will convert two existing 802.1Q trunks into one logical trunk, verify both member links are active in the Port-Channel, and confirm end-to-end host reachability.
Harden a small campus Layer-2 triangle so a downstream access switch cannot become root. You will verify DSW1 is already the STP root for VLAN 20, then apply Root Guard on each distribution switch’s access-facing trunk to the access layer. Confirm steady-state reachability between users and that a superior BPDU would put those ports into root-inconsistent instead of re-rooting the campus.
Harden the campus access edge by enabling PortFast and BPDU Guard only on host-facing access ports while keeping redundant switch-to-switch trunks loop-free with STP. Validate instant host link-up and demonstrate that a rogue BPDU errdisables the port instead of changing the topology.
Migrate a small campus from legacy PVST+ to Rapid-PVST+ across all switches, harden trunks, mark edge ports, and verify sub-second RSTP behaviours. A three-switch triangle with redundant trunks carries VLAN 10 to two hosts so you can validate end-to-end and observe convergence when a trunk flaps.
Build a redundant campus triangle with two distribution switches and one access switch. Implement PVST+ per-VLAN root tuning so VLAN 10 forwards over DSW1 while VLAN 20 forwards over DSW2. Verify that each VLAN chooses a different root and that the blocked uplink differs per VLAN, while end hosts in each VLAN can still reach their local SVI gateway IP.
Influence a downstream access switch’s STP root-port choice using per-interface path cost and port priority. You will make the access switch prefer the non-default uplink so that the intended link forwards while the other becomes the alternate/blocking path. Validate with show commands and end-to-end host pings.
Designate an intentional STP root bridge and backup for a campus user VLAN across a redundant three-switch triangle. You will verify correct root election and port roles and confirm end-to-end host connectivity while preventing Layer-2 loops.
One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.
Stand up a small enterprise-style network where routers forward device logs and SNMP notifications to a central collector. You will configure SSH management, verify reachability from end hosts, and implement Syslog + SNMP on multiple routers so the network is observable from a single collector host.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately any more; anything bought before that change stays yours permanently, subscription or not.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.