CCNA & CCNP practice labs — hands-on Cisco CML scenarios

Secure-Access Troubleshooting Capstone: SSH VTY Fix

Advanced secure-access capstone, run as a fault hunt. A hardening change was rolled back badly overnight: the edge router is reachable but the management plane is wide open in several different ways at once, and an SSH key cannot even be generated. You get symptoms and the required end state — no fault list. Everything is on one device, so the work is knowing which pieces of a management-plane build depend on each other rather than hunting across a topology.

CCNA40 min5 objectives

SSH-Only Management: Disabling Telnet on R1

Harden a Cisco IOS router so remote management is allowed only via SSH. You will remove Telnet from the VTY lines, keep local authentication, and add an idle-session timeout. Verify success from a Linux ADMIN host by confirming SSH works and Telnet is refused.

CCNA25 min6 objectives

AAA Authentication with a Local User Database

Harden R1’s management plane by moving SSH login authentication and exec authorization under the IOS AAA framework using the local user database. You will start from a secure SSH-only baseline that still uses login local, enable aaa new-model, define default AAA methods that point at local, and bind VTY lines to AAA. Success is proven by authenticating from the ADMIN host over SSH and landing at the user’s privilege level.

CCNA35 min4 objectives

AAA Named Method Lists with Fallback (VTY vs Console)

Harden a single Cisco IOS router’s management plane using AAA named method lists applied per-line. Create VTY-AUTH (local then enable) to protect remote SSH access without lockout risk, and CONSOLE-AUTH (local only) to secure the console independently. Verify using show/run sections and test SSH from the ADMIN workstation.

CCNA40 min5 objectives

CCNA: Console and VTY Line Hardening

Harden the console and VTY lines on a single Cisco IOS router so idle sessions close automatically and every access path requires authentication. You will configure login local on both console and VTY, set 5-minute exec timeouts, enable logging synchronous on the console, and restrict VTY to SSH. Verification uses show outputs; grading evaluates the deterministic running-config.

CCNA35 min5 objectives

CCNA: SSH Access Fundamentals on R1

Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.

CCNA35 min4 objectives

Free with an account

Privilege Levels for Tiered CLI Access

Harden a single IOS router’s management plane and create tiered CLI access using custom privilege levels. Build two local accounts: a full admin (level 15) and a junior operator (level 5). Elevate only specific exec commands to level 5 so the operator can run them without gaining full configuration rights. Verify behavior from a Linux admin workstation over SSH.

CCNA45 min6 objectives

Static Routing Capstone: Two Sites Over a /30 WAN

Advanced static-routing capstone, run as a fault hunt. Two suites were cut over last night and now Suite-B is unreachable, Suite-A gets replies only sometimes, and one client cannot even reach its own gateway. Nothing was written down. You get symptoms and the required end state — no fault list. The faults span both routers and the access switch, and the routing table being present does not mean it is right.

CCNA65 min5 objectives

VRRP: Tune Advertisements to 3 Seconds

Advanced CCNP VRRP lab: standardize the VRRP advertisement interval to 3 seconds on a shared user VLAN. Two IOS routers (R1, R2) and two hosts connect to a single access switch on VLAN 10 (10.0.10.0/24). Both routers share VRRP group 1 and the same virtual IP 10.0.10.254 so hosts keep one default gateway. R1 is the master via priority 110; both routers explicitly set 'vrrp 1 timers advertise 3' to enforce a consistent master advertisement rate and backup master-down detection window. Verify with 'show vrrp' (Advertisement interval 3.000 sec) and host pings to the VIP.

CCNA & CCNP45 min5 objectives

VRRP Object Tracking for Uplink Failover

Configure VRRP with interface object tracking so the virtual gateway fails over when the active router loses its upstream link, avoiding black-holing. The site LAN (VLAN 10) uses a single virtual default gateway (10.0.10.254) shared by two IOS routers (R1, R2). A separate access switch (SW) bridges the LAN. Both routers uplink via Ethernet0/1 to a second switch (CORE) on VLAN 99 to represent the upstream path. R1 is the intended VRRP master (priority 110). You will create a track object that monitors R1's uplink (Ethernet0/1) and decrements its VRRP priority by 20 if the link fails, allowing R2 to preemptively take over as master. The lab grades the deterministic VRRP configuration: common group and virtual IP on both routers, R1 priority 110, the global track object, and the 'vrrp 1 track 1 decrement 20' tie-in on R1.

CCNA & CCNP40 min5 objectives

VRRP Load-Sharing with Two Groups

Advanced VRRP on a single VLAN: configure two VRRP groups on R1/R2 so each router is Master for one group and Backup for the other, distributing host egress while preserving gateway redundancy.

CCNA & CCNP45 min4 objectives

AS-Path Filtering: Accept Only Neighbor’s Own Routes

Advanced CCNP BGP policy lab focusing on inbound AS-path filtering at the edge. You will build a simple eBGP chain (AS 65003 — AS 65002 — AS 65001), originate prefixes from the two upstream routers, confirm that the edge learns multiple routes, then enforce a policy on the edge (R1) to accept only routes originated by its directly connected eBGP neighbor (AS 65002) while rejecting routes that transited AS 65003. Verification relies entirely on R1’s BGP table and AS-path regular-expression queries.

CCNP45 min5 objectives