Cisco CML lab archive — every past daily CCNA & CCNP lab

CCNA: SSH Access Fundamentals on R1

Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.

SSH-Only Management: Disabling Telnet on R1

Harden a Cisco IOS router so remote management is allowed only via SSH. You will remove Telnet from the VTY lines, keep local authentication, and add an idle-session timeout. Verify success from a Linux ADMIN host by confirming SSH works and Telnet is refused.

CCNA: Console and VTY Line Hardening

Harden the console and VTY lines on a single Cisco IOS router so idle sessions close automatically and every access path requires authentication. You will configure login local on both console and VTY, set 5-minute exec timeouts, enable logging synchronous on the console, and restrict VTY to SSH. Verification uses show outputs; grading evaluates the deterministic running-config.

Privilege Levels for Tiered CLI Access

Harden a single IOS router’s management plane and create tiered CLI access using custom privilege levels. Build two local accounts: a full admin (level 15) and a junior operator (level 5). Elevate only specific exec commands to level 5 so the operator can run them without gaining full configuration rights. Verify behavior from a Linux admin workstation over SSH.

AAA Named Method Lists with Fallback (VTY vs Console)

Harden a single Cisco IOS router’s management plane using AAA named method lists applied per-line. Create VTY-AUTH (local then enable) to protect remote SSH access without lockout risk, and CONSOLE-AUTH (local only) to secure the console independently. Verify using show/run sections and test SSH from the ADMIN workstation.

AAA Authentication with a Local User Database

Harden R1’s management plane by moving SSH login authentication and exec authorization under the IOS AAA framework using the local user database. You will start from a secure SSH-only baseline that still uses login local, enable aaa new-model, define default AAA methods that point at local, and bind VTY lines to AAA. Success is proven by authenticating from the ADMIN host over SSH and landing at the user’s privilege level.

CCNA Day 7: Layer 3 Static Routing Capstone

Build a realistic two-site branch topology with two edge routers linked over a /30 WAN and two isolated LANs on a shared L2 access switch. Configure static routes plus a default route at each edge so both LANs reach each other bidirectionally. Verify end-to-end from hosts and use show commands to confirm the routing tables.

Archive preview only

VRRP Object Tracking for Uplink Failover

Configure VRRP with interface object tracking so the virtual gateway fails over when the active router loses its upstream link, avoiding black-holing. The site LAN (VLAN 10) uses a single virtual default gateway (10.0.10.254) shared by two IOS routers (R1, R2). A separate access switch (SW) bridges the LAN. Both routers uplink via Ethernet0/1 to a second switch (CORE) on VLAN 99 to represent the upstream path. R1 is the intended VRRP master (priority 110). You will create a track object that monitors R1's uplink (Ethernet0/1) and decrements its VRRP priority by 20 if the link fails, allowing R2 to preemptively take over as master. The lab grades the deterministic VRRP configuration: common group and virtual IP on both routers, R1 priority 110, the global track object, and the 'vrrp 1 track 1 decrement 20' tie-in on R1.

VRRP: Tune Advertisements to 3 Seconds

Advanced CCNP VRRP lab: standardize the VRRP advertisement interval to 3 seconds on a shared user VLAN. Two IOS routers (R1, R2) and two hosts connect to a single access switch on VLAN 10 (10.0.10.0/24). Both routers share VRRP group 1 and the same virtual IP 10.0.10.254 so hosts keep one default gateway. R1 is the master via priority 110; both routers explicitly set 'vrrp 1 timers advertise 3' to enforce a consistent master advertisement rate and backup master-down detection window. Verify with 'show vrrp' (Advertisement interval 3.000 sec) and host pings to the VIP.

VRRP Load-Sharing with Two Groups

Advanced VRRP on a single VLAN: configure two VRRP groups on R1/R2 so each router is Master for one group and Backup for the other, distributing host egress while preserving gateway redundancy.

AS-Path Filtering: Accept Only Neighbor’s Own Routes

Advanced CCNP BGP policy lab focusing on inbound AS-path filtering at the edge. You will build a simple eBGP chain (AS 65003 — AS 65002 — AS 65001), originate prefixes from the two upstream routers, confirm that the edge learns multiple routes, then enforce a policy on the edge (R1) to accept only routes originated by its directly connected eBGP neighbor (AS 65002) while rejecting routes that transited AS 65003. Verification relies entirely on R1’s BGP table and AS-path regular-expression queries.