60 hands-on CCNA scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Focused CCNA configuration and troubleshooting practice for CCNA and CCNP.
Configure two Cisco IOS routers as symmetric-active NTP peers over a single /30 link. R1 is an authoritative clock (ntp master 4) and both routers form a symmetric peer relationship with ntp peer. Learn how peer mode differs from client/server, and how to verify and troubleshoot associations without relying on Internet sources.
Beginner CCNA NTP lab. Two IOS routers share a single /30 link with no routing. Configure R1 as an authoritative NTP master at stratum 3 and point R2 to R1 as its NTP server. Verify using show ntp associations, show ntp status, and show clock. Emphasis: deterministic config — grading checks the presence of ntp master 3 on R1 and ntp server 10.0.0.1 on R2, not live convergence.
Harden privileged access on a single IOS router by configuring a hashed enable secret, creating a local admin user with privilege 15 and a secret, and enabling service password-encryption. Verify that privileged access requires the secret and that the running-config contains no cleartext passwords.
Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.
Harden a single IOS router’s management plane and create tiered CLI access using custom privilege levels. Build two local accounts: a full admin (level 15) and a junior operator (level 5). Elevate only specific exec commands to level 5 so the operator can run them without gaining full configuration rights. Verify behavior from a Linux admin workstation over SSH.
Harden a Cisco IOS router so remote management is allowed only via SSH. You will remove Telnet from the VTY lines, keep local authentication, and add an idle-session timeout. Verify success from a Linux ADMIN host by confirming SSH works and Telnet is refused.
Harden the console and VTY lines on a single Cisco IOS router so idle sessions close automatically and every access path requires authentication. You will configure login local on both console and VTY, set 5-minute exec timeouts, enable logging synchronous on the console, and restrict VTY to SSH. Verification uses show outputs; grading evaluates the deterministic running-config.
Build a realistic two-site branch topology with two edge routers linked over a /30 WAN and two isolated LANs on a shared L2 access switch. Configure static routes plus a default route at each edge so both LANs reach each other bidirectionally. Verify end-to-end from hosts and use show commands to confirm the routing tables.
Archive preview only
Tune EIGRP path selection by manipulating cumulative delay. Three routers (R1-R2-R3) form EIGRP 100 adjacencies over three /30 point-to-point links. R3 originates 192.168.30.0/24 on Loopback0. You will enable EIGRP and then increase delay on R1’s direct link to R3 so R1 prefers the indirect path via R2 to reach 192.168.30.0/24. Two Alpine hosts validate end-to-end reachability and path choice.
Build and verify EIGRP on a small routed topology while marking the user-facing LAN interface as passive. You will advertise the LAN into EIGRP without forming an adjacency on that segment, preventing rogue neighbors and reducing control-plane noise. Focus on deterministic EIGRP configuration, wildcard-based network inclusion, and verification using show commands.
Build a two-router, two-LAN EIGRP domain and practice precise wildcard-masked network statements so only the intended interfaces participate. R1 has an extra LAN on Ethernet0/2 (172.16.99.0/24) that must be excluded from EIGRP. Validate with show commands and end-host pings that the correct LANs are exchanged and the excluded LAN is not advertised.
Bring up EIGRP in AS 100 between two routers over a /30 transit and advertise a single LAN. Verify the first adjacency forms and that R2 learns R1's LAN via EIGRP. Includes realistic end hosts on a shared LAN for path testing.
Troubleshoot classic static routing and connectivity issues in a 3-router, 2-site network. Faults seeded include a missing return route, wrong next-hop/mask, and a missing/misconfigured default route. Learners must identify and correct Layer 3 faults to restore end-to-end reachability between branch clients.
Archive preview only
Intermediate CCNA lab focused on HSRP preempt behavior. Two routers share a virtual default gateway on a single user VLAN. The baseline already has HSRP group 1 with R1 at higher priority, but HSRP doesn't preempt by default — if R1 reboots, R2 stays active even after R1 returns. The learner enables preempt on R1 so it deterministically reclaims the active role whenever it's up, keeping the intended primary in control. Verification uses show standby on routers and basic host pings to the virtual gateway.
Set HSRP priority to deterministically choose the active default gateway on a shared LAN. Two IOS routers (R1, R2) and one access switch serve a small user LAN with a single virtual gateway IP. By default R2 becomes active due to its higher interface IP; raise R1’s HSRP priority so it becomes the designated active router for group 1 while hosts keep a single virtual gateway.
Build a fault-tolerant default gateway on a single LAN using HSRP. Two routers share one virtual IP so a host keeps the same default route even if one router fails. You will configure basic HSRP group 1 with a shared VIP, verify active/standby roles, and confirm the host can ping the virtual gateway.
Implement HSRP with interface tracking so the virtual gateway fails over when the active router loses its upstream link. Two routers (R1, R2) share a user LAN via SW with a single virtual default gateway for the PC, and both uplink to a separate CORE switch. The learner adds HSRP group 1 with a virtual IP, priority/preempt on R1, and tracks R1's uplink to drive deterministic failover.
Build a two-link LACP EtherChannel between SW1 and SW2 using an active/passive pairing. The logical Port-channel2 carries VLAN 20 as an access link so two hosts on opposite switches can communicate. Verify with show etherchannel summary, show lacp neighbor, and host-to-host pings.
Build a two-link LACP EtherChannel between SW1 and SW2 and convert the Port-channel into an 802.1Q trunk that explicitly carries VLANs 40 and 41. Validate end-to-end host reachability across VLAN 40 and confirm the trunk’s allowed VLAN list and switchport mode on the logical port-channel. Emphasis: deterministic EtherChannel configuration on member interfaces, correct trunking on the Port-channel, and verification with IOS show commands.
Beginner CCNA lab that builds a static Layer-2 EtherChannel (mode on) between two ioll2-xe switches using two parallel links as members of Port-channel1. The Port-channel is configured as an access port in VLAN 10 so that two hosts, one on each switch, can communicate without spanning-tree blocking a parallel path. Learners deploy and verify the bundle, then validate end-to-end host connectivity.
Build a Layer-2 PAgP EtherChannel between two ioll2-xe switches (SW1 and SW2) using a desirable/auto pairing on two parallel links. Bundle Ethernet0/0 and Ethernet0/1 into Port-channel 3, make the port-channel a VLAN 30 access interface on both switches, and verify with show etherchannel summary, show pagp neighbor, show pagp counters, and end-to-end host pings in VLAN 30.
Hands-on IOS DHCP server practice focused on validating pool state, inspecting conflicts, and fixing a real address conflict caused by a legacy static host on the LAN. You will verify server-side leases and exclusions, observe a conflict entry, then permanently exclude the static IP and clear the stale conflict so a client can obtain a clean address.
Beginner CCNA lab on a redundant two-switch Layer-2 loop with two parallel uplinks. You will enable Rapid-PVST+, set a deterministic root-bridge priority so SW1 becomes the root for VLAN 1, and verify port roles (root/designated/alternate) and loop prevention. Two Alpine hosts in VLAN 1 validate end-to-end connectivity without any routing or SVIs.
Configure PortFast correctly on access ports in a triangle switch loop while maintaining normal STP protection on inter-switch trunks. Force SW1 as the root for VLAN 50 and verify that only edge ports are fast-tracked. Observe the difference in host convergence with and without PortFast.
Looking for something else? Browse the full lab archive or see today's daily lab.