How to Get Cisco CML for Free (and What the Free Tier Can Do)

The CML free tier

Cisco provides a free tier of CML aimed at learners, with a small limit on the number of nodes you can run at once and a subset of reference images. Because the limits change over time, check Cisco's official CML page for the current node count and how to sign up — but the important thing is that it exists and is enough to build meaningful CCNA-scale topologies (a few routers and switches with end hosts).

The free-tier images typically include the lightweight IOL and IOL-L2 images, which are ideal for routing and switching practice because they run many nodes on modest hardware.

Other free options

If you can't run CML yet, Cisco's Packet Tracer is free through the Networking Academy and is a fine place to learn the CLI and core concepts, and GNS3 is free if you're willing to supply and manage images yourself. Each has trade-offs we cover in our comparison guides.

Build real labs on the free tier

Once you have CML (free tier or paid), you still need something to practice. Goldfish Networks labs are deliberately built on CML free-tier images, so they run on a free CML instance — import one, build it on real Cisco IOS, and grade your configuration against the answer key. Start with the free sample lab to see the whole loop.

A worked example: build and verify a two-router static-routing lab

The fastest way to prove your free-tier CML instance works is a two-router lab that a real network would use. Connect R1 and R2 over a /30 point-to-point link (10.0.12.0/30, giving exactly two usable addresses, .1 and .2) and give each router a LAN. R1's LAN is 192.168.1.0/24 and R2's LAN is 192.168.2.0/24. Each router knows its own directly connected networks automatically; the only thing missing is a route to the other side's LAN, which you supply with a single static route pointing at the far router's link address.

The interesting part is what the router does with that next-hop address. A static route written with only a next hop (not an exit interface) forces the router to do a recursive lookup: it must first resolve 10.0.12.2 to an actual outgoing interface by consulting the routing table again, then resolve that next hop's Layer 2 address via ARP. Writing the route as interface-only (for example 'ip route 192.168.2.0 255.255.255.0 g0/0') skips the recursion but then relies on proxy-ARP on the far end, which is why the next-hop form is generally preferred on Ethernet links.

After configuring both sides, verify from the control plane before you ever ping. 'show ip route' should list the remote LAN as an 'S' (static) entry with the correct next hop, and 'show ip route 192.168.2.0' should confirm the recursion resolved to a connected interface. Only then does an end-to-end ping actually test data-plane reachability rather than masking a routing mistake.

R1(config)# interface g0/0
R1(config-if)#  ip address 10.0.12.1 255.255.255.252
R1(config-if)#  no shutdown
R1(config-if)# interface g0/1
R1(config-if)#  ip address 192.168.1.1 255.255.255.0
R1(config-if)#  no shutdown
R1(config-if)# exit
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.12.2

! (mirror on R2: link .2, LAN 192.168.2.1, static back to 192.168.1.0/24)

R1# show ip route static
S    192.168.2.0/24 [1/0] via 10.0.12.2
R1# ping 192.168.2.1 source 192.168.1.1
!!!!! Success rate is 100 percent (5/5)

Stretching a small node budget without making the lab unrealistic

The free tier's node cap is a design constraint, not a wall — you just have to spend nodes where they teach you something. The biggest saver is to stop dedicating a whole host node to every LAN. A loopback interface on a router simulates an attached subnet perfectly well for routing practice, so you can advertise 10.10.10.0/24 as a 'LAN' without burning a node on a PC. One caveat to expect: OSPF advertises a loopback as a /32 host route by default regardless of the mask you configure, so if you want the real prefix to appear in neighbors' tables, set 'ip ospf network point-to-point' on that loopback.

Addressing choices also stretch the budget and keep the math honest. Remember that usable hosts equal 2^(host bits) − 2 for normal subnets, because the all-zeros network and all-ones broadcast are reserved — a /24 yields 254, a /30 yields 2. The exception is the /31, which under RFC 3021 gives you 2 usable addresses with no wasted broadcast, making it ideal for point-to-point router links when you want to conserve address space in a design you will actually explain on an exam.

Finally, pick the right node type. IOL and IOL-L2 run as lightweight processes rather than full VMs, so you can fit several routers and switches into the same RAM that a couple of heavier IOSv/IOSvL2 nodes would consume. The trade-off is that IOL images model the control plane, not real switching-ASIC hardware features, so certain data-plane behaviors (some QoS, SPAN, and platform-specific commands) are approximated or absent. For CCNA-scale routing, switching, VLAN, and first-hop-redundancy practice that limitation almost never gets in the way.