60 hands-on CCNP scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Focused CCNP configuration and troubleshooting practice for CCNA and CCNP.
Advanced CCNP management-plane troubleshooting on a single IOS router. You inherit a pre-broken remote-management config where SSH access is completely failing despite a hostname, domain name, and local admin user. Two independent VTY faults are seeded: the wrong transport and an incorrect login method. Your job is to diagnose with show commands, fix both issues, and validate SSH access from the ADMIN workstation.
Configure VRRP with interface object tracking so the virtual gateway fails over when the active router loses its upstream link, avoiding black-holing. The site LAN (VLAN 10) uses a single virtual default gateway (10.0.10.254) shared by two IOS routers (R1, R2). A separate access switch (SW) bridges the LAN. Both routers uplink via Ethernet0/1 to a second switch (CORE) on VLAN 99 to represent the upstream path. R1 is the intended VRRP master (priority 110). You will create a track object that monitors R1's uplink (Ethernet0/1) and decrements its VRRP priority by 20 if the link fails, allowing R2 to preemptively take over as master. The lab grades the deterministic VRRP configuration: common group and virtual IP on both routers, R1 priority 110, the global track object, and the 'vrrp 1 track 1 decrement 20' tie-in on R1.
Advanced CCNP VRRP lab: standardize the VRRP advertisement interval to 3 seconds on a shared user VLAN. Two IOS routers (R1, R2) and two hosts connect to a single access switch on VLAN 10 (10.0.10.0/24). Both routers share VRRP group 1 and the same virtual IP 10.0.10.254 so hosts keep one default gateway. R1 is the master via priority 110; both routers explicitly set 'vrrp 1 timers advertise 3' to enforce a consistent master advertisement rate and backup master-down detection window. Verify with 'show vrrp' (Advertisement interval 3.000 sec) and host pings to the VIP.
Advanced CCNP BGP policy lab focusing on inbound AS-path filtering at the edge. You will build a simple eBGP chain (AS 65003 — AS 65002 — AS 65001), originate prefixes from the two upstream routers, confirm that the edge learns multiple routes, then enforce a policy on the edge (R1) to accept only routes originated by its directly connected eBGP neighbor (AS 65002) while rejecting routes that transited AS 65003. Verification relies entirely on R1’s BGP table and AS-path regular-expression queries.
In this advanced CCNP BGP lab, you will steer a single router's outbound path choice using Cisco's Weight attribute, the very first BGP best-path tiebreaker. R1 (AS 65001) peers eBGP with two ISPs (R2 in AS 65002 and R3 in AS 65003). Both ISPs advertise the same prefix 172.16.50.0/24. Your job is to make R1 prefer the R3 path using the neighbor weight command and verify the outcome using IOS and Linux tools.
In this CCNP-level lab (BGP Fundamentals Lab 4/10), you will build a small, realistic transit-AS scenario: an external route learned by R1 via eBGP from AS 65003 must be carried across iBGP to R2 inside AS 65001. You will intentionally encounter the classic iBGP next-hop problem (R2 sees an unreachable next-hop for 172.16.30.0/24) and fix it on R1 with neighbor next-hop-self. iBGP peering runs over Loopback0 addresses with reachability provided by OSPF area 0 between R1 and R2. Two hosts validate end-to-end data-plane reachability and routing control-plane state.
Configure eBGP between two routers and originate select connected /24s using the exact-match 'network ... mask' command. Verify that only the intended prefixes are advertised and learned by the neighbor, and use host-based tests to confirm reachability to the advertised networks. This beginner CCNP lab reinforces that the BGP network statement only advertises a route if an exact match exists in the RIB, and that the 'mask' keyword is mandatory for non-classful advertisements.
Advanced CCNP BGP lab: Build parallel eBGP sessions between two ASes over primary and backup /30 links. Originate a service prefix from AS 65001 and influence AS 65002's inbound path by applying outbound AS-path prepending on the backup session only. Validate best-path selection and next-hop on the neighbor, and confirm reachability from hosts.
Build an internal BGP (iBGP) peering between two IOS routers in the same AS over stable Loopback0 addresses, with OSPF providing loopback reachability. Each router originates a /24 from Loopback1 into BGP, and next-hop/peering behavior is validated from end hosts. This lab emphasizes the deterministic neighbor configuration (remote-as, update-source Loopback0, router-id) and exact-match network origination, supported by a minimal, secure OSPF core.
Advanced CCNP capstone on a compact 3-router, 2-host CML-Free topology. Restore end-to-end reachability to a remote advertised network by diagnosing and correcting two independent BGP issues on the hub router. The design intentionally combines an eBGP edge (R2–R1) with iBGP over loopbacks (R1–R3 with OSPF reachability) so learners validate neighbor formation, next-hop reachability, and route propagation end-to-end.
Deploy eBGP between two routers and precisely control which locally-originated networks are advertised to a neighbor using an outbound prefix-list. R1 originates four /24 loopback routes but advertises only two to R2. Verify using IOS show commands and basic host reachability checks.
Build your first external BGP (eBGP) peering between two routers in different autonomous systems over a /30 point-to-point link and exchange one /24 prefix from each side using Loopback0. The topology is intentionally small yet realistic, with two edge routers (AS 65001 and AS 65002) and three Alpine hosts for basic reachability checks and operator context. You will configure deterministic BGP neighbors, originate prefixes with exact-match network statements, and validate reachability and route installation using standard IOS and Linux tools. This is Lab 1 of 10 in the CCNP-aligned BGP Fundamentals series and sets the foundation for later labs on iBGP, route filtering, and path selection.
Advanced CCNP-level EIGRP troubleshooting on a 3-router triangle with seeded faults: an AS mismatch on R3 and a missing network statement on R1 prevent a full-mesh of adjacencies and block reachability to a loopback LAN. Learners diagnose using show commands and repair the configuration to restore end-to-end reachability.
Implement classic EIGRP manual summarization on R1 to collapse four contiguous /24 loopback routes into a single /22 summary toward R2, reducing R2’s routing table entries while preserving reachability.
Inject a static default route from an edge router into an EIGRP domain so internal routers and hosts gain internet reachability. You will verify the D*EX 0.0.0.0/0 on the internal router and validate end-to-end connectivity from a branch host through the edge to an ISP-side server.
Configure a classic hub-and-spoke EIGRP domain where the single-homed branch (R2) is made an EIGRP stub, limiting query scope while still advertising its LAN. Validate that R1 flags R2 as a stub neighbor, routes still exchange, and query behavior is scoped appropriately.
Build a 3-router EIGRP domain where R1 reaches R3’s loopback over two paths (direct and via R2). You will tune interface delay so the indirect path becomes the successor and the direct path remains a feasible successor, then enable variance to install both unequal-cost paths in R1’s routing table. Two Alpine hosts validate end-to-end reachability while router show commands confirm unequal-cost load sharing.
Harden EIGRP adjacencies with MD5 authentication between two iol-xe routers over a /30 transit, then validate that only trusted peers form neighbors. You will configure a key chain, bind it to the transit interface, and enable EIGRP (AS 100) to exchange two user LANs. Verification includes neighbor state, key chain presence, and end-to-end host reachability.
Configure HSRP on two routers with a shared virtual gateway and speed up failover by tightening hello/hold timers to 1/3 seconds. Validate deterministic active/standby selection and confirm timer settings via show commands.
Replace HSRP with open-standard VRRP to provide a shared virtual gateway on a single access VLAN. Configure VRRP group 1 with a common virtual IP and deterministic master/backup roles via priority and preempt. Validate using show vrrp commands and end-host pings.
Troubleshoot and repair a pre-broken HSRP gateway on a single shared LAN. Two routers (R1, R2) and two clients (PC1, PC2) connect to a single L2 switch (SW1) in VLAN 10. The hosts intermittently lose gateway reachability because both routers act active due to seeded faults. Use show commands to diagnose, then correct HSRP so both routers share one virtual IP and R1 deterministically wins active.
Harden an HSRP virtual default gateway with MD5 authentication so only trusted routers can participate. You’ll secure an existing HSRP group on two IOS routers that share a user VLAN via a single L2 switch. Validate the authentication state on both routers and confirm the endpoint still reaches the virtual IP.
Implement two HSRP groups on a single VLAN so each router is Active for one group and Standby for the other. Two hosts split default gateways across the two virtual IPs for deterministic load-sharing with redundancy.
Migrate a single-subnet LAN from HSRP version 1 assumptions to HSRP version 2, enabling group numbers above 255. Configure HSRPv2 on two routers that share one virtual default gateway IP so hosts retain gateway resilience without reconfiguration.
Looking for something else? Browse the full lab archive or see today's daily lab.