Hands-on CCNA and CCNP practice labs — OSPF, VLANs, ACLs, routing, NAT and more, each a real Cisco Modeling Labs scenario you build and grade against the answer key.
Browse the 19 free labsBrowse by theme: all practice topics or certification tracks.
Advanced CCNA OSPF troubleshooting capstone on Cisco Modeling Labs (CML-Free). A three-router, two-host enterprise-style topology is pre-broken with multiple independent OSPF faults. Your job: diagnose and fix them so adjacencies form across areas and the end hosts can reach each other. The final solution forwards end-to-end and adheres to clean OSPF hygiene.
Deploy OSPFv2 across a small branch-to-edge topology, mark user-LAN interfaces passive, and originate a default route at the edge so branch hosts learn O*E2 and can reach an internet-facing host. You will implement, verify, and troubleshoot OSPF passive interfaces and default-information originate.
A compact, enterprise-clean, 5-node CML lab that builds on OSPF multi-area design. You will enable OSPF across a small core–ABR–branch topology, advertise multiple branch networks in area 10, and summarize them at the ABR using 'area range'. You will verify that specific inter-area routes are replaced by a single summary in area 0 while preserving end-to-end reachability between hosts.
Build and verify a compact, enterprise-clean multi-area OSPF network with an ABR. Configure area 0 and a non-backbone area, advertise loopbacks and LANs, enforce OSPF hygiene (passive LANs, explicit router-ids), and verify O IA inter-area routes from the endpoints.
Build a 5-node triangle OSPF topology with a branch and a data center connected by two paths: a direct link and an indirect path via a core router. Implement OSPFv2 with clean hygiene (router-ids, passive on LANs), then influence path selection by adjusting interface cost so branch-to-DC traffic prefers the core path. Verify the chosen path from the end hosts using traceroute and confirm symmetric routing by validating the reverse path.
Three IOS routers share a true broadcast multi-access segment through a Layer-2 switch. You will deploy OSPFv2, influence the DR/BDR election using interface priorities, and verify full adjacencies to the DR. An alpine client behind RTR-HQ-R3 must reach loopbacks on RTR-HQ-R1 and RTR-HQ-R2 via OSPF-learned routes. The lab emphasizes proper multi-access deployment hygiene (router-ids, passive default, interface selection) and realistic verification from the end host.
Build a two-router OSPFv2 lab, assign deterministic router-ids using loopbacks, form a clean adjacency from Down through Exchange to FULL, and verify neighbor state and router-ids. End-to-end reachability is validated from real hosts across an enterprise-clean topology.
Bring up OSPFv2 adjacency between two branch routers over a point-to-point /30, advertise each site’s user LAN and router loopback in area 0, and verify end-to-end pings succeed from the hosts. The baseline ships with addressing and SSH management ready; you will enable and tune OSPF only.
Harden Cisco IOS edge interfaces by disabling CDP/LLDP toward untrusted endpoints while keeping discovery active on trusted infrastructure links. Routers share a management LAN with a server and form a direct router-to-router adjacency for CDP/LLDP. The learner enables discovery globally, selectively suppresses it on the client-facing edge, and verifies the outcome with show commands.
Advanced Layer-2 security capstone. Neither PC on the access switch can get an address, and the help desk has already 'checked the DHCP server'. You get the symptoms and the requirements — no fault list. Work from show output to find every misconfiguration across the switch and the router, repair them, and prove both hosts recover. Several faults are layered: fixing the first one changes the symptom without ending the outage.
Harden Dynamic ARP Inspection (DAI) on an access switch by enabling additional packet validation checks: source MAC, destination MAC, and IP sanity. The uplink toward the DHCP server/gateway is trusted, access ports are untrusted. DHCP Snooping and baseline DAI are already enabled for VLAN 10; your task is to add the global DAI validation knobs and verify the change deterministically via show commands.
Layer 2 Security Hardening, Lab 9/10. You will enable automatic errdisable recovery on a campus access switch so ports shut down by Layer-2 security (Dynamic ARP Inspection, DHCP rate-limit, or storm control) can return to service automatically after a safe interval. The switch already enforces DHCP snooping with a correct trust boundary, DAI validation, and broadcast/multicast/unicast storm-control with shutdown actions. Your job: turn on errdisable auto-recovery for arp-inspection, dhcp-rate-limit, and storm-control, and set the interval to 60 seconds. Verify with show errdisable recovery.
A subscription unlocks every lab on this page for as long as it's active — the whole daily back catalogue, not just the labs published after you join, plus every series lab. Bundles and study paths aren't sold separately any more; anything bought before that change stays yours permanently, subscription or not.
Free labs need no subscription at all: every lab you can build and grade without one is the sample, plus the opening lab of each series.