Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse by theme: all practice topics or certification tracks.
A regional retailer's branch lost core access after last night's maintenance window. Users reach their gateway and the routers ping across the transit, but no OSPF neighbour appears and the branch LAN is missing from the core's table. The documented design is OSPF process 1, area 0 on both routers. Restore the adjacency without changing addressing or adding static routes.
A campus triangle of one distribution and two access switches carries VLAN 10 and VLAN 20. After an access-switch replacement, users report slower cross-campus response: hosts still reach each other, and the layer 2 path no longer matches a design that roots both VLANs at SW-CAMPUS-DIST1.
Your team supports a small campus access layer: two switches, one 802.1Q trunk. The help desk reports VLAN 20 users cannot reach their peers while VLAN 10 users can, and both ends read up and trunking. Campus design: VLANs 10 and 20 are the only VLANs any trunk carries; every trunk's native VLAN is 999.
Free with an account
Build an enterprise-clean dual-stack site end-to-end. IPv4 is complete and forwarding on day start; you will deploy IPv6 across the same topology. Enable IPv6 routing, assign prefixes, bring up OSPFv3 with explicit router-ids, keep the access LAN autoconfiguring via SLAAC with stateless DHCPv6 for DNS, and enforce an IPv6 ACL to allow one client flow to the server while denying another. Verify from the hosts and troubleshoot like a real operator.
A dual-stack enterprise tri-router line with two LANs and end hosts. IPv4 routing is healthy and end-to-end; IPv6 addressing is present but end-to-end IPv6 fails. Work from operational state only to isolate and correct the broken IPv6 control/forwarding plane without changing what already works. The graded end-state requires IPv6 forwarding enabled on all routers, OSPFv3 process 10 in area 0 with an explicit unique router-id on every router, and per-interface activation on all required links so the hosts can ping6 across the WAN.
Harden a dual-stack access segment with IPv6 RA Guard so only the legitimate router can advertise a default gateway. You will start from a working IPv4 baseline with IPv6 SLAAC enabled, then implement and verify RA Guard on the access switch. The solution must keep end-to-end IPv4/IPv6 reachability while blocking rogue Router Advertisements from a malicious host.
Build a dual-stack branch-to-datacenter topology with IPv6 static routing in place. Implement a named IPv6 ACL on the server-facing interface that permits an approved client while denying an unapproved source, and explicitly permits Neighbor Discovery (ND) so the LAN continues to function. Verify that the allowed source can reach the server over IPv6 while the unapproved source fails, without disrupting IPv6 neighbor resolution.
Deploy a stateless DHCPv6 service on a remote router and relay client Information-Requests from a branch LAN across a routed core to that server. IPv4 is already fully functional; your job is to build the IPv6 DHCPv6 relay path and confirm clients receive DNS/domain options while keeping IPv6 addressing via SLAAC.
Build a compact branch LAN where IPv6 hosts already form SLAAC addresses from router advertisements, then add stateless DHCPv6 to supply DNS server and domain-name. You will keep SLAAC for addressing, flip the RA 'other-config' flag so hosts know to ask, and bind an IPv6 DHCP pool with DNS options to the user LAN. IPv4 is prebuilt as a baseline and must keep forwarding. Verify from hosts and the router’s IPv6 DHCP/ND views.
Build a compact dual-stack enterprise topology where IPv4 is already forwarding end-to-end using OSPFv2. Your task is to bring up IPv6 routing in parallel using OSPFv3 with explicit router-ids, proving that IPv6 control/data planes operate independently from IPv4. Verify both protocols resolve separately and that an IPv4 control-plane failure does not impact IPv6 forwarding.
Daily CCNA IPv6 lab: build OSPFv3 across a three-router triangle with dual-stack links and real end hosts. IPv4 OSPFv2 is pre-built and forwarding end-to-end as the baseline. Your tasks: bring R3 into OSPFv3 with an explicit router-id and enable it per-interface, activate OSPFv3 on R1’s R3-facing interface, then steer the preferred IPv6 path by adjusting interface cost. Verify neighbor state, routes, and end-to-end IPv6 reachability from host to host.
Deploy single-area OSPFv3 between two routers so IPv6 LANs reach end-to-end. The IPv4 side is already forwarding with static routes. Your job: enable OSPFv3 with explicit router-ids and activate it per-interface on both the transit and LAN links, then verify the neighbor forms over link-local and routes are learned.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately; the subscription is the only plan.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.