55 hands-on Cisco IOS scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Cisco IOS configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Advanced NTP capstone, run as a fault hunt. Two branch routers disagree about the time and neither will sync, despite both being configured for NTP and able to ping each other. You get symptoms and the required end state — no fault list. Faults sit on both devices, and two of them make NTP fail while the configuration reads as though it should work — including a restriction pointing at something that was never created.
Configure a Cisco IOS router as an authoritative NTP master and restrict which clients it will serve using an NTP access-group with a standard ACL. One shared LAN (no routing) connects three routers through a Layer-2 switch. Only R2 is authorized to receive time from R1; R3 is denied. Learners deploy, verify, and troubleshoot the access-group behavior.
Harden privileged access on a single IOS router by configuring a hashed enable secret, creating a local admin user with privilege 15 and a secret, and enabling service password-encryption. Verify that privileged access requires the secret and that the running-config contains no cleartext passwords.
Advanced secure-access capstone, run as a fault hunt. A hardening change was rolled back badly overnight: the edge router is reachable but the management plane is wide open in several different ways at once, and an SSH key cannot even be generated. You get symptoms and the required end state — no fault list. Everything is on one device, so the work is knowing which pieces of a management-plane build depend on each other rather than hunting across a topology.
Harden a single IOS router’s management plane and create tiered CLI access using custom privilege levels. Build two local accounts: a full admin (level 15) and a junior operator (level 5). Elevate only specific exec commands to level 5 so the operator can run them without gaining full configuration rights. Verify behavior from a Linux admin workstation over SSH.
Harden a single Cisco IOS router’s management plane using AAA named method lists applied per-line. Create VTY-AUTH (local then enable) to protect remote SSH access without lockout risk, and CONSOLE-AUTH (local only) to secure the console independently. Verify using show/run sections and test SSH from the ADMIN workstation.
Harden R1’s management plane by moving SSH login authentication and exec authorization under the IOS AAA framework using the local user database. You will start from a secure SSH-only baseline that still uses login local, enable aaa new-model, define default AAA methods that point at local, and bind VTY lines to AAA. Success is proven by authenticating from the ADMIN host over SSH and landing at the user’s privilege level.
Harden a Cisco IOS router so remote management is allowed only via SSH. You will remove Telnet from the VTY lines, keep local authentication, and add an idle-session timeout. Verify success from a Linux ADMIN host by confirming SSH works and Telnet is refused.
Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.
Free with an account
Build a Layer-3 EtherChannel between two IOS XE routers using LACP active/active. Two parallel router links are bundled into Port-channel5, which carries a /30 transit. R2 hosts a loopback; R1 installs a static route to reach it. Validate that the Port-channel holds the IP (members do not), that the bundle is up and uses both links, and that pings across the /30 and to the loopback succeed. Emphasis: deterministic EtherChannel configuration and Layer-3 port-channel practices.
Hands-on IOS DHCP server practice focused on validating pool state, inspecting conflicts, and fixing a real address conflict caused by a legacy static host on the LAN. You will verify server-side leases and exclusions, observe a conflict entry, then permanently exclude the static IP and clear the stale conflict so a client can obtain a clean address.
Guide Rapid-PVST+ to prefer a specific parallel trunk by tuning the sender’s port priority on the root bridge. Two ioll2-xe switches (SW1, SW2) form a physical loop via two equal-speed trunks. A third L2 switch (SW3) extends the user VLAN to a second closet. One Alpine host attaches to SW1 and another to SW3 in VLAN 40 (10.1.40.0/24). You will: force SW1 to be the root for VLAN 40, lower the port priority on SW1’s Gi0/2 (Ethernet0/1) to break the tie so SW2 selects its Gi0/2 as the Root Port, enable PortFast and BPDU Guard on host-facing ports, and verify with show spanning-tree outputs and host pings.
Configure an IOS router as a DHCP server and have another IOS router obtain its uplink address dynamically via DHCP on a shared LAN. Validate the lease from both the client and server perspectives and test reachability from attached hosts.
Advanced CCNA troubleshooting capstone for centralized DHCP across a relay. A centralized IOS-XE router (DHCP-SRV) serves the branch LAN behind BR-RTR via ip helper-address. The lab imports in a deliberately broken state: the DHCP pool scope and gateway are misconfigured on the server, and the relay configuration is missing on BR-RTR. Learners must diagnose using show outputs and Linux tools, fix all three discrepancies, and verify that two Alpine clients dynamically receive usable leases and can reach DHCP-SRV.
Configure a Cisco IOS router as a DHCP server with a general LAN pool and a per-host manual binding (reservation) so that CLIENT-A always receives 172.20.10.5 based on its MAC, while CLIENT-B receives a normal dynamic address from the same subnet. Verify with router show commands and Linux host tools. Focus strictly on DHCP: pool scope, excluded addresses, options, and a hardware-address-tied manual binding.
Build a central DHCP service on an IOS-XE router and service two branch departments across a routed hop via DHCP relay. Configure two DHCP pools (SALES and SUPPORT) with proper options and excluded ranges on the HQ server, and enable ip helper-address on both branch LAN interfaces so clients obtain leases from the correct pool. Verify leases and bindings using Linux and IOS show commands, and confirm return-path reachability with prebuilt static routes.
Configure an IOS-XE router as a DHCP server delivering a complete, production-grade option set (gateway, DNS servers, domain suffix, explicit 8-hour lease) to two Alpine Linux clients over a pure L2 access switch. Validate that clients obtain dynamic addresses in-scope and that /etc/resolv.conf reflects the delivered DNS and domain options. The graded outcome is the deterministic router DHCP configuration — not the clients’ dynamic addresses.
Configure a centralized DHCP server on an IOS-XE router and relay DHCP from a remote branch LAN using ip helper-address on a branch router. Verify leases, helper configuration, and end-host reachability across a routed path.
Build and verify two independent DHCP address pools on a single Cisco IOS router, each serving a different LAN. Two Alpine Linux clients obtain leases from their respective pools via directly attached access switches. You will configure the pools, excluded addresses, default gateways, DNS, and domain names, then verify with IOS show commands and Linux tools. The focus is deterministic router DHCP configuration; clients lease dynamically and are verified rather than graded.
Configure an IOS-XE router as a DHCP server with a correctly scoped pool and an excluded-address range that protects the gateway and a reserved static server (.10). Two Alpine clients obtain addresses dynamically from the remaining range (starting at .11). Verify leases, confirm the excluded count, and ensure the reserved static never appears as a DHCP binding.
Build a single-scope DHCP server on an IOS-XE router and verify two Alpine Linux clients lease addresses dynamically across a pure Layer-2 switch. Configure only the canonical pool (network + default-router). Verify leases from the router and from each client.
Free with an account
Operate, observe, and clear Cisco IOS PAT translations on an internet edge. You will configure a standard PAT overload on R1, generate multiple concurrent sessions from an inside host, read translation/state counters, and clear single and all entries to see how the table repopulates immediately under live traffic.
Build a small but realistic edge topology and configure static one-to-one NAT on R1 so the inside host PC-A (192.168.10.10) always translates to 203.0.113.3. Validate bidirectional reachability with an upstream ISP router and a public server one hop further. Verify translation state and counters on R1 and connectivity from both ends.
Free with an account
Configure static PAT (port forwarding) on a Cisco IOS edge router so an outside client can reach an inside HTTP service on TCP/8080 using a dedicated public IP that is not the router's interface. Validate using curl from the outside host and NAT show commands on the router.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.