How to Get Cisco CML Free: Download, Install, 5-Node Limit

What CML-Free actually is

CML-Free is Cisco's no-cost, single-user edition of Cisco Modeling Labs. In Cisco's own words it "does not require a license subscription, and there's nothing to buy" — you do not need a Smart Licensing account, and there is no trial clock. Cisco's documentation is explicit that the instance keeps working after the 'days remaining' counter reaches zero, which is the question most people actually have.

The limit is five nodes running at once. That is the real constraint, and it is a node-count limit rather than a time limit or a feature paywall — the software itself is the same product. Everything below is written around that number.

What you need to run it: CML system requirements

CML asks your hardware for one unusual thing: two layers of virtualization at once. The appliance is a guest of your hypervisor, and inside it every router and switch is a KVM guest again. So the host CPU has to be x86-64 with Intel VT-x or AMD-V enabled in firmware, and the hypervisor has to pass those extensions through to the appliance. Get that pass-through wrong and the symptom is specific and confusing: CML boots normally, the web UI answers, and not one node ever reaches a console. Apple Silicon cannot satisfy this at all, because the reference-platform images are x86-64 binaries and an M-series Mac is ARM.

Size memory by adding up the topology rather than by trusting a single headline figure. A node reserves its memory the moment it starts and holds it whether or not it is doing anything, so the appliance needs the sum of everything you intend to run at once plus the controller's own footprint on top — which is why the node types you pick show up directly in the bill. Two practical notes. The hypervisor takes the appliance's memory from what is free on the host right now, not from what is printed on the spec sheet, so close things before you measure. And Cisco publishes per-release minimums in the CML installation guide: treat them as a floor for the software, not as a target for the labs you actually want to run, and check them for the version you are downloading rather than a number someone quoted from an older release.

Disk and CPU are the easier two. The reference-platform images are the bulk of the storage, and each running node stacks a per-node overlay disk on top of them, so an appliance disk that has filled up presents as nodes failing to start rather than as anything that mentions disk. Put the appliance on an SSD if you have one — node images are read off disk at every lab start, and that read is most of the wait. Cores mostly buy boot and convergence speed rather than capacity: a handful of modern cores runs a five-node CCNA topology comfortably, and adding more will not raise the node ceiling.

# --- On the host, before you download anything ---

# Linux: vmx (Intel) or svm (AMD). Any count above 0 means the CPU exposes it;
# a 0 means it is switched off in BIOS/UEFI, or the CPU does not have it.
$ grep -c -E '(vmx|svm)' /proc/cpuinfo
8

# Windows: the firmware flag, plus a check that nothing already owns the
# virtualization extensions -- Hyper-V, WSL2 and Core Isolation all can.
systeminfo | findstr /C:"Virtualization Enabled In Firmware" /C:"Hyper-V"

# --- Inside the appliance, once the setup wizard has finished ---
$ ssh sysadmin@192.168.1.50

# A 0 here is the whole problem: nested virtualization never reached the
# appliance, so CML itself runs and its nodes never will. That is fixed in
# the hypervisor's VM settings, not anywhere in CML.
sysadmin@cml-controller:~$ grep -c -E '(vmx|svm)' /proc/cpuinfo
8

# What is genuinely left to hand to nodes, and whether there is room for the
# reference-platform images plus a per-node overlay for each running device.
sysadmin@cml-controller:~$ free -h
sysadmin@cml-controller:~$ df -h /var/lib/libvirt/images

How to get it: the actual steps

1. Create or sign in to a Cisco.com account at id.cisco.com. Complete the profile, including the address fields — an incomplete profile is a common reason the download is not offered, and the resulting error does not say so.

2. Go to Cisco's Software Central and find the Cisco Modeling Labs downloads. With a valid account the CML-Free files are available without any purchase or entitlement.

3. Download the deployment you want: an OVA if you are running it inside VMware, or the bare-metal installer if you are dedicating a machine to it.

4. Download the reference platform ISO as well. This is a separate file from the installer, and it is the one people skip — see the next section for what happens when you do.

5. Deploy the appliance, work through the initial setup wizard, then copy the refplat ISO onto the appliance so the node definitions have images to boot.

Install the reference platform images (the step everyone misses)

CML boots every device from a node definition plus a disk image. The node definitions ship with the appliance; the images arrive separately, in the reference platform ISO. Until those images are installed a node definition has nothing to boot — so an imported lab loads its topology perfectly, and then the routers and switches refuse to start. If your first import comes up with nodes that will not boot, or a node type flagged as having no image, this is almost always the reason.

The CML-Free refplat ISO includes IOL, IOL-L2 and ASAv, plus Ubuntu, Alpine Linux and a desktop image. IOL and IOL-L2 are the important pair for CCNA work: they run as processes rather than full virtual machines, so several of them fit in the RAM a couple of heavier IOSv nodes would consume.

In CML you can confirm an image is present for each definition under Tools → Node and Image Definitions (the exact menu path moves between versions). On a fresh install this is usually a matter of enabling what the ISO already provided rather than sourcing anything yourself.

# 1. Is the appliance reachable at the address the setup wizard printed?
$ ping -c 3 192.168.1.50
64 bytes from 192.168.1.50: icmp_seq=1 ttl=64 time=0.421 ms
64 bytes from 192.168.1.50: icmp_seq=2 ttl=64 time=0.388 ms
3 packets transmitted, 3 received, 0% packet loss

# 2. Is the web UI answering? The appliance ships a self-signed cert, hence -k,
#    and -L to follow the redirect to the login page. -L so a release that
#    redirects / to a login route still reports 200 rather than a redirect code.
$ curl -k -sL -o /dev/null -w '%{http_code}' https://192.168.1.50/
200

# 3. Are the reference-platform images actually on the controller?
#    Log in with the system account you created during the setup wizard.
#    On a CML 2.x controller the installed images live here:
$ ssh sysadmin@192.168.1.50
sysadmin@cml-controller:~$ ls /var/lib/libvirt/images/virl-base-images/
alpine-base   asav-...   desktop-...   iol-xe-...   ioll2-xe-...   ubuntu-...

# An empty or missing directory is the whole problem: the node definitions
# are there, but there is no disk image for them to boot.

Five nodes goes further than it sounds

Two node types do not count against the limit at all: unmanaged switches and external connectors are unlimited. An unmanaged switch is the right way to join several devices onto one segment without spending a node on it, and an external connector is how you reach the outside world — neither costs you anything from your five.

The next biggest saver is to stop dedicating a host node to every LAN. A loopback interface represents an attached subnet perfectly well for routing practice, so you can advertise 10.10.10.0/24 as a 'LAN' without spending a node on a PC. One behaviour to expect: OSPF advertises a loopback as a /32 host route regardless of the mask you configured, so set 'ip ospf network point-to-point' on that loopback if you want the real prefix to appear in your neighbours' tables.

Choose the light node types. IOL and IOL-L2 model the control plane rather than switching-ASIC hardware, so a few platform-specific behaviours (some QoS, SPAN, certain hardware commands) are approximated or absent. For CCNA-scale routing, switching, VLAN and first-hop-redundancy practice that limitation almost never gets in the way — and it is what lets five nodes be a real topology instead of two routers and a ping.

What CML-Free will not do

It is worth knowing the edges before building a plan around it. Telemetry collection is always on and cannot be disabled. Support is community-only — there is no commercial support entitlement. The image set is smaller than the paid editions', so heavier and more specialised platforms are not included. And the five-node cap is a hard ceiling, not a soft one: a sixth node will not start.

CML also ships as a virtual appliance rather than a desktop application, so it always runs inside a hypervisor. VMware Workstation (Windows/Linux) or Fusion (macOS) are the supported personal hosts, and both are now free for personal use. VirtualBox is not a supported CML host — plan on VMware or a bare-metal machine.

Labs that fit inside the free tier

A five-node cap is only a problem if the labs you want to run were designed without it in mind. Every Goldfish Networks lab is built to fit: across the whole published catalogue no lab exceeds five counted nodes, and every one uses only IOL, IOL-L2 and Alpine — all three included in the CML-Free reference platform. There is nothing extra to source and no lab that needs a paid edition to import and boot.

That constraint is the design, not a workaround for it: import a lab in one click, build it on real Cisco IOS, then upload your configuration and get per-requirement pass/fail against the answer key. Start with the free sample lab to see the whole loop before committing to anything.