Practice labsCCNA & CCNP practice labs — hands-on Cisco CML scenarios
Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse the 19 free labsBrowse by theme: all practice topics or certification tracks.
Browse by track & topic
Harden a single-site management LAN by replacing insecure Telnet with SSH-only access on the router. You will generate RSA keys, define a domain name, create a local admin user with a secret, force SSHv2, and restrict VTY lines to SSH with local login. Validate success from an admin workstation and confirm Telnet is refused. The topology is intentionally simple: one router, one access switch, and two hosts on a dedicated management VLAN.
CCNA45 min5 objectives
View details
Deploy an authenticated NTP hierarchy with a router acting as the trusted NTP server and two network devices as clients. Validate reachability from user hosts and confirm that clients securely synchronize to the server.
CCNA55 min5 objectives
View details
Harden the access layer against rogue DHCP servers by enabling DHCP snooping on an L2 access switch and trusting only the legitimate server-facing port. You will validate that client access ports remain untrusted and that rogue DHCP offers are dropped while legitimate offers are permitted.
CCNA55 min5 objectives
View details
Deploy a centralized DHCP service across subnets using DHCP relay (ip helper-address). A branch client on a switched LAN requests an address from a DHCP server that resides at HQ. You will configure the relay on the branch gateway, create a DHCP pool for the remote subnet on the HQ router, verify the client lease and default gateway, and test end-to-end connectivity.
CCNA55 min5 objectives
View details
Turn a branch router into a DHCP server for a user LAN. You'll design a clean pool with exclusions, set the default gateway and DNS server, and verify a host lease and end-to-end reachability across a small routed core.
CCNA55 min5 objectives
View details
Deploy Port Address Translation (NAT overload) on an enterprise edge so two inside clients share a single public IPv4 address to reach an external HTTP service on an ISP router. You will designate inside/outside, build the NAT selection ACL, configure the overload rule, and verify simultaneous flows and translations from the end hosts.
CCNA55 min5 objectives
View details
Deploy dynamic NAT on an enterprise edge so multiple inside clients share a pool of public IPs. You will configure an ACL to match inside sources, build a public NAT pool, bind the ACL to the pool, and correctly mark inside/outside interfaces. Validate from end hosts and confirm on-demand translations on the edge router.
CCNA55 min5 objectives
View details
Deploy a single-edge router performing static one-to-one NAT so an inside host has a fixed public address. You will mark inside/outside interfaces, create the static NAT mapping, and verify reachability to an internet host and the translation table. The lab is intentionally small but enterprise-clean, with a routed inside transit, an access switch for the user LAN, and an external host representing the internet.
CCNA55 min4 objectives
View details
Harden SSH access to a production router by allowing only a designated management workstation to connect. You will apply a standard ACL to the router's VTY lines with access-class, verify that the permitted host can SSH in, and confirm that a second host on the same LAN is refused. End-to-end IP forwarding is pre-built with static routes so the focus stays on management-plane control.
CCNA40 min4 objectives
View details
Intermediate CCNA lab focused on named extended ACLs. You will permit a specific business flow (HTTP from the branch client to a data center web server) while denying ICMP to that server, apply the ACL inbound on the branch LAN interface, and validate from real endpoints. The baseline provides static routing and full connectivity; your task is to implement a readable, ordered named extended ACL with a remark and bind it correctly so the intended policy is enforced.
CCNA55 min5 objectives
View details
Deploy an extended ACL inbound near the source to allow HTTP from a client VLAN to a server while blocking ICMP to that same server. The lab uses router-on-a-stick over a hardened access switch with a routed transit to a core router hosting the server VLAN. You will implement, verify from endpoints, and troubleshoot matching by protocol, port, destination, and placement/direction.
CCNA65 min5 objectives
View details
Build a compact two-router, three-host topology. Implement a numbered standard ACL on the destination router to permit Client-A and deny Client-B from reaching a protected server based solely on source subnet. Verify from the end hosts that permitted traffic succeeds and denied traffic fails, and practice correct ACL placement and direction.
CCNA40 min4 objectives
View details
What's unlocked, and what's free
Subscription access, and the labs that need none.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately any more; anything bought before that change stays yours permanently, subscription or not.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.
