Cisco lab guides
Every guide in CCNA exam order. Open a domain to study it, or search to jump straight to a protocol.
Not sure where to begin? The CCNA study hub explains what each domain covers and in what order. Want the quick command reference instead of a walkthrough? Browse the Cisco command cheat sheets. Ready to configure? Try the CCNA labs.
1 Network Fundamentals · 4 guides
Addressing and the subnet math every later topic is built on. Start here if you are new.
Subnetting & IP Addressing
Master IPv4/IPv6 addressing and subnet by hand — the skill the whole exam rests on.
- How to Subnet with VLSM (No Calculator)Subnet by hand for the exam: the host formula and largest-first allocation.
- How to Configure IPv6 Addressing on CiscoEnable unicast-routing, assign static and EUI-64 addresses, and verify link-local.
- How to Configure a Loopback Interface on CiscoA /32 that never goes down: a stable router-id for OSPF and BGP.
- The Best Subnet Calculator (and Why You Should Still Subnet by Hand)Which calculator to use, and why the exam still demands hand subnetting.
2 Network Access · 9 guides
Switching: VLANs, trunks, spanning tree and link bundling — how one campus network stays separated and loop-free.
VLANs, Trunking & Inter-VLAN Routing
Segment the LAN, carry VLANs across trunks, and route between them.
- How to Configure VLANs on a Cisco SwitchCreate, name, and assign a VLAN to an access port — with verification.
- How to Configure an 802.1Q Trunk Between Cisco SwitchesSet trunk mode, restrict the allowed VLANs, match the native VLAN, verify.
- How to Configure the Native VLAN on a Cisco Trunk (and Avoid Mismatches)Match the native VLAN on both trunk ends and stop VLAN hopping.
- Router-on-a-Stick: Inter-VLAN Routing on CiscoRoute between VLANs with one trunk and a router subinterface per VLAN.
- How to Configure Inter-VLAN Routing with SVIs on a Layer 3 SwitchRoute between VLANs on a Layer 3 switch using SVIs instead of a router.
- How to Give a Cisco Switch a Management IP (SVI + Default Gateway)Give a switch an SVI and default gateway so you can SSH in.
Spanning Tree (STP)
Keep a redundant switched network loop-free — root bridges, port roles, and edge protection.
EtherChannel
Bundle links into one logical channel — more bandwidth, faster failover.
3 IP Connectivity · 15 guides
Routing: how a packet gets from one network to another, by hand first and then dynamically with OSPF.
Static & Default Routing
Steer traffic by hand — static routes, default routes, and floating backups.
OSPF
From a first adjacency to multi-area design — the CCNA's flagship routing protocol.
- How to Configure Single-Area OSPF on CiscoEnable OSPFv2, advertise networks into area 0, and verify the adjacency.
- How to Configure Multi-Area OSPF on CiscoSplit OSPF into areas, build the ABR, and read the O IA routes.
- How to Configure OSPF Authentication on Cisco (MD5)Add MD5 keys to OSPF and get the adjacency back to FULL.
- OSPF Neighbor Not Forming: Troubleshooting Stuck StatesRead the stuck state, then find the mismatch that keeps an OSPF adjacency down.
EIGRP
Cisco's advanced distance-vector protocol — neighbors, metrics, and the topology table.
BGP
From a first eBGP session to path policy — the protocol that routes between ASes.
- How to Configure eBGP Peering on CiscoPeer with a neighbor in another AS and get the session Established.
- BGP Neighbor States: Why a Session Sticks in Idle or ActiveRead Idle and Active correctly, then find what keeps a BGP session down.
- BGP Network Statement Not Advertising a Route? The Exact-Match RuleWhy a BGP network line originates nothing, and how to prove and fix the mismatch.
- iBGP Update-Source and Next-Hop-Self on CiscoPeer iBGP over loopbacks and make external next hops reachable.
- BGP Best Path Selection: Weight, Local Preference, AS-PathSteer BGP with weight, local preference and AS-path prepending.
- BGP Prefix-List and AS-Path Filtering on CiscoControl which BGP routes you send and accept with prefix-lists and AS-path filters.
First-Hop Redundancy (HSRP & VRRP)
Give hosts a resilient default gateway that survives a router failure.
4 IP Services · 9 guides
The services a working network runs on — addressing hosts, translating addresses, keeping time, staying reachable.
NAT & PAT
Translate private addresses to public — static NAT and PAT overload.
- How to Configure Static NAT on Cisco (One-to-One + Port Forwarding)Map an internal server to a fixed public IP, plus port forwarding.
- How to Configure NAT Overload (PAT) on CiscoShare one public IP across a whole LAN with NAT overload.
- NAT Not Working on a Cisco Router: Inside, Outside and ACL ChecksFind why NAT isn't translating: interface roles, the ACL and the return path.
DHCP
Hand out addresses automatically — server pools and cross-subnet relay.
Network Services & Management
Keep the network observable — time, discovery, logging, and monitoring.
- How to Configure NTP on a Cisco RouterPoint a router at an NTP server, authenticate it, and verify sync.
- How to Configure CDP and LLDP on CiscoDiscover neighbors with CDP and LLDP, and lock discovery down on untrusted ports.
- How to Configure Syslog on a Cisco RouterSend logs to a central host with accurate timestamps and severity thresholds.
- How to Configure SNMP on a Cisco Router (v2c and v3)v2c communities versus secure v3 authPriv, trap setup, and verification.
5 Security Fundamentals · 8 guides
Filtering traffic and locking down the devices themselves.
Access Control Lists (ACLs)
Filter traffic by source, destination, and port — standard, extended, and named.
- How to Configure a Standard ACL on Cisco (with Examples)Filter on source address only — wildcard masks, placement, and the implicit deny.
- How to Configure an Extended ACL on Cisco (with Examples)Filter by source, destination, protocol and port — and where to apply it.
- How to Configure a Named ACL on Cisco (and Edit It by Sequence Number)Name your ACLs, then insert and delete entries by sequence number.
- How to Restrict SSH/Telnet Access with a VTY access-class ACLUse a VTY access-class ACL so only your management subnet can log in.
Device Security & SSH
Lock down management access and harden the switch edge.
- How to Configure SSH on a Cisco Router or SwitchDomain name, RSA key, local user, and vty lines locked to SSHv2.
- SSH to Cisco Gear from a Mac or Linux Terminal (No PuTTY Needed)Reach Cisco gear from Terminal with built-in OpenSSH — plus legacy-cipher fixes.
- How to Configure Port Security on a Cisco SwitchLimit MAC addresses per port, learn them sticky, and pick a violation mode.
- How to Configure DHCP Snooping and Dynamic ARP InspectionBlock rogue DHCP servers, then stop ARP poisoning with Dynamic ARP Inspection.
Set up your lab first · 24
Pick a lab platform, get it running, and choose a terminal — none of the topics above are much use until you have something to configure.
- Cisco CML vs Packet Tracer: Real IOS vs SimulatedSimulated IOS versus the real thing — which tool fits CCNA and CCNP study.
- GNS3 vs Cisco CML: DIY and Free vs Official and EasyBoth run real IOS: GNS3 is free but DIY, CML is official and turnkey.
- Packet Tracer vs GNS3: Free Simulator vs Real ImagesTwo free tools: Packet Tracer trades away fidelity, GNS3 trades away setup time.
- How to Get Cisco CML Free: Download, Install, 5-Node LimitGet the free 5-node CML tier: download, install, and lab inside the limit.
- How to Import a Lab into Cisco Modeling Labs (CML)Import a .yaml topology, boot the nodes, and fix nodes that will not start.
- The Best Way to Practice CCNA Hands-On (Without Buying Gear)Build real CCNA skills without buying gear — virtual labs and daily graded reps.
- EVE-NG vs Cisco CML: Which Network Emulator Should You Use?Community emulator versus Cisco's official one — images, setup, cost, and support.
- Cisco DevNet Sandbox: Free Cisco Labs in the CloudFree cloud Cisco gear for API and automation practice — not CCNA drilling.
- PuTTY vs Tera Term vs SecureCRT for Cisco Serial & SSHSerial console, SSH, logging and scripting compared — and which to install first.
- How to Back Up and Export a Cisco Modeling Labs (CML) LabExport a CML topology to portable .yaml — and why you extract configs first.
- Wireshark for CCNA: Capturing Packets in Your LabWhere to capture in your lab, how to filter, and which packets matter.
- VirtualBox for Network Labs: Free Virtualization for EVE-NG & GNS3The free hypervisor that hosts EVE-NG or GNS3 at home — and its limits.
- VMware Workstation for Cisco Labs (Now Free for Personal Use)The free-for-personal-use hypervisor CML expects, compared against VirtualBox.
- Proxmox VE for Network Labs: A Free Home-Lab Server for CML, EVE-NG & GNS3A free bare-metal hypervisor for always-on labs bigger than your laptop.
- The Best Home Lab Setup for CCNA (Hardware, RAM & Options)RAM is the bottleneck: laptop, mini-PC, or cloud — plus the Apple Silicon catch.
- Anki for CCNA: Spaced Repetition That Beats the Forgetting CurveSpaced repetition for the rote facts labs will not teach: ports, distances, defaults.
- How to Download Cisco Packet Tracer for Free (via NetAcad)Enroll in NetAcad, download Packet Tracer free, and know when to leave it.
- How to Configure AAA Local Authentication on Cisco IOSTurn on AAA, write per-line method lists, and keep a way back into the router.
- How to Configure OSPFv3 for IPv6 on Cisco IOSWhat OSPFv2 habits break on IPv6, and the per-interface config that replaces them.
- How to Configure SLAAC and DHCPv6 on Cisco IOSThe A, O and M flags decide how an IPv6 host gets its address — and its DNS.
- Cannot Ping Between VLANs: Find the Inter-VLAN BreakWork the path from host to trunk to gateway and find where inter-VLAN traffic dies.
- DHCP Not Assigning Addresses: Same Subnet or RelaySame-subnet and relayed DHCP fail for different reasons. Split the problem first.
- Spanning Tree Loop: Find the Storm and the Wrong RootContain the storm first, then find which switch is root and what is blocking.
- Packet Tracer Alternatives for CCNA and CCNP StudyWhich emulator replaces Packet Tracer, who each one suits, and what it costs you.
Guides — FAQ
Are the guides free?
Yes — every guide is free to read, no account needed. They're the how-to layer around the graded labs, and a free account opens the first lab of every bundle, so you can configure what you just read and have it graded.
Do the guides work with Packet Tracer, or only CML?
The protocol how-tos are platform-agnostic Cisco IOS — they work in Cisco Modeling Labs, GNS3, EVE-NG, or Packet Tracer. A few setup guides are CML-specific, and each says so up front.
Which guide should I start with for the CCNA?
If you're new, start with a lab-platform setup guide (how to get CML running free), then work the protocol how-tos in study order — VLANs and subnetting first, then routing (static, OSPF), then services and security.
How are guides different from the concept explainers?
A concept explainer answers “what is X and why” in plain English; a guide is the hands-on “how to configure X on Cisco IOS,” step by step, pointing you at a graded lab to practice on.
Read it, then prove it
Build the lab in CML and have your config graded. Free account, no card.