220 hands-on CCNA scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. CCNA configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Stand up HSRP on two routers sharing a single user VLAN so campus hosts point to a resilient virtual default gateway. You will configure HSRP on both routers, make one router the active forwarder, and verify failover from the end hosts.
Troubleshoot and fix an LACP EtherChannel between campus switches so both physical members bundle and the trunk reliably carries VLAN 10. Two independent faults are seeded: an intra-bundle trunk mismatch on one switch and an administratively down member on the other. Learners diagnose with show commands, align trunk attributes, and verify end-to-end host reachability.
Daily CCNA campus-redundancy lab focused on EtherChannel scale-out and hashing. Two distribution switches are joined by three parallel trunk links. Two links are already bundled with LACP into a trunking port-channel; the third is a plain trunk currently STP-blocked and wasting capacity. Add the spare link to the existing bundle on both sides and change the global hashing method so multiple flows can actually use multiple member links. End-to-end switching must continue to work for the users VLAN.
Hands-on CCNA EtherChannel repair lab. Two uplinks between a distribution and an access switch are intended to form a single port-channel trunk carrying VLAN 10. The starter ships with a real mode mismatch across the bundle and an allow-list error, so the Port-channel stays down and hosts cannot talk. Learners diagnose the symptom and standardize on one protocol family (PAgP, LACP, or Static) and correct trunking so VLAN 10 forwards end-to-end.
Bundle two parallel switch uplinks into a single Port-Channel using LACP so that Spanning Tree no longer blocks one link. You will convert two existing 802.1Q trunks into one logical trunk, verify both member links are active in the Port-Channel, and confirm end-to-end host reachability.
Harden a small campus Layer-2 triangle so a downstream access switch cannot become root. You will verify DSW1 is already the STP root for VLAN 20, then apply Root Guard on each distribution switch’s access-facing trunk to the access layer. Confirm steady-state reachability between users and that a superior BPDU would put those ports into root-inconsistent instead of re-rooting the campus.
Harden the campus access edge by enabling PortFast and BPDU Guard only on host-facing access ports while keeping redundant switch-to-switch trunks loop-free with STP. Validate instant host link-up and demonstrate that a rogue BPDU errdisables the port instead of changing the topology.
Migrate a small campus from legacy PVST+ to Rapid-PVST+ across all switches, harden trunks, mark edge ports, and verify sub-second RSTP behaviours. A three-switch triangle with redundant trunks carries VLAN 10 to two hosts so you can validate end-to-end and observe convergence when a trunk flaps.
Build a redundant campus triangle with two distribution switches and one access switch. Implement PVST+ per-VLAN root tuning so VLAN 10 forwards over DSW1 while VLAN 20 forwards over DSW2. Verify that each VLAN chooses a different root and that the blocked uplink differs per VLAN, while end hosts in each VLAN can still reach their local SVI gateway IP.
Influence a downstream access switch’s STP root-port choice using per-interface path cost and port priority. You will make the access switch prefer the non-default uplink so that the intended link forwards while the other becomes the alternate/blocking path. Validate with show commands and end-to-end host pings.
Designate an intentional STP root bridge and backup for a campus user VLAN across a redundant three-switch triangle. You will verify correct root election and port roles and confirm end-to-end host connectivity while preventing Layer-2 loops.
One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.
Stand up a small enterprise-style network where routers forward device logs and SNMP notifications to a central collector. You will configure SSH management, verify reachability from end hosts, and implement Syslog + SNMP on multiple routers so the network is observable from a single collector host.
Harden a single-site management LAN by replacing insecure Telnet with SSH-only access on the router. You will generate RSA keys, define a domain name, create a local admin user with a secret, force SSHv2, and restrict VTY lines to SSH with local login. Validate success from an admin workstation and confirm Telnet is refused. The topology is intentionally simple: one router, one access switch, and two hosts on a dedicated management VLAN.
Deploy an authenticated NTP hierarchy with a router acting as the trusted NTP server and two network devices as clients. Validate reachability from user hosts and confirm that clients securely synchronize to the server.
Harden the access layer against rogue DHCP servers by enabling DHCP snooping on an L2 access switch and trusting only the legitimate server-facing port. You will validate that client access ports remain untrusted and that rogue DHCP offers are dropped while legitimate offers are permitted.
Deploy a centralized DHCP service across subnets using DHCP relay (ip helper-address). A branch client on a switched LAN requests an address from a DHCP server that resides at HQ. You will configure the relay on the branch gateway, create a DHCP pool for the remote subnet on the HQ router, verify the client lease and default gateway, and test end-to-end connectivity.
Turn a branch router into a DHCP server for a user LAN. You'll design a clean pool with exclusions, set the default gateway and DNS server, and verify a host lease and end-to-end reachability across a small routed core.
Deploy Port Address Translation (NAT overload) on an enterprise edge so two inside clients share a single public IPv4 address to reach an external HTTP service on an ISP router. You will designate inside/outside, build the NAT selection ACL, configure the overload rule, and verify simultaneous flows and translations from the end hosts.
Deploy dynamic NAT on an enterprise edge so multiple inside clients share a pool of public IPs. You will configure an ACL to match inside sources, build a public NAT pool, bind the ACL to the pool, and correctly mark inside/outside interfaces. Validate from end hosts and confirm on-demand translations on the edge router.
Deploy a single-edge router performing static one-to-one NAT so an inside host has a fixed public address. You will mark inside/outside interfaces, create the static NAT mapping, and verify reachability to an internet host and the translation table. The lab is intentionally small but enterprise-clean, with a routed inside transit, an access switch for the user LAN, and an external host representing the internet.
Harden SSH access to a production router by allowing only a designated management workstation to connect. You will apply a standard ACL to the router's VTY lines with access-class, verify that the permitted host can SSH in, and confirm that a second host on the same LAN is refused. End-to-end IP forwarding is pre-built with static routes so the focus stays on management-plane control.
Intermediate CCNA lab focused on named extended ACLs. You will permit a specific business flow (HTTP from the branch client to a data center web server) while denying ICMP to that server, apply the ACL inbound on the branch LAN interface, and validate from real endpoints. The baseline provides static routing and full connectivity; your task is to implement a readable, ordered named extended ACL with a remark and bind it correctly so the intended policy is enforced.
Deploy an extended ACL inbound near the source to allow HTTP from a client VLAN to a server while blocking ICMP to that same server. The lab uses router-on-a-stick over a hardened access switch with a routed transit to a core router hosting the server VLAN. You will implement, verify from endpoints, and troubleshoot matching by protocol, port, destination, and placement/direction.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.