Layer-2 Trunk EtherChannel Carrying Multiple VLANs
Build a two-link LACP EtherChannel between SW1 and SW2 and convert the Port-channel into an 802.1Q trunk that explicitly carries VLANs 40 and 41. Validate end-to-end host reachability across VLAN 40 and confirm the trunk’s allowed VLAN list and switchport mode on the logical port-channel. Emphasis: deterministic EtherChannel configuration on member interfaces, correct trunking on the Port-channel, and verification with IOS show commands.
DHCP Troubleshooting Capstone: Branch Relay
Advanced CCNA troubleshooting capstone for centralized DHCP across a relay. A centralized IOS-XE router (DHCP-SRV) serves the branch LAN behind BR-RTR via ip helper-address. The lab imports in a deliberately broken state: the DHCP pool scope and gateway are misconfigured on the server, and the relay configuration is missing on BR-RTR. Learners must diagnose using show outputs and Linux tools, fix all three discrepancies, and verify that two Alpine clients dynamically receive usable leases and can reach DHCP-SRV.
Lab 3: Full DHCP Pool — Gateway, DNS, Domain, Lease
Configure an IOS-XE router as a DHCP server delivering a complete, production-grade option set (gateway, DNS servers, domain suffix, explicit 8-hour lease) to two Alpine Linux clients over a pure L2 access switch. Validate that clients obtain dynamic addresses in-scope and that /etc/resolv.conf reflects the delivered DNS and domain options. The graded outcome is the deterministic router DHCP configuration — not the clients’ dynamic addresses.
NAT Troubleshooting Capstone: Interface Role + ACL
Advanced CCNA NAT/PAT troubleshooting on a compact 5-node CML-Free topology. A pre-broken edge (R1) sits between a private LAN and an ISP transit. Learners diagnose why inside-to-outside traffic never translates: the NAT interface roles are incorrect and the ACL referenced by NAT does not match the actual inside subnet. Fix both independently to restore translations, then verify from hosts and with IOS show commands.
Inside, Outside & the Translation Table
Configure static one-to-one NAT for two inside hosts on R1, mark inside/outside interfaces correctly, and read the four-column NAT translation table (inside local/global, outside local/global). Verify from both sides and relate observed traffic to table entries.
PAT onto the Outside Interface (SOHO Edge)
Implement and verify interface-based PAT (overload) on a single-edge SOHO router. Inside hosts on 192.168.10.0/24 share the router’s lone public IP (203.0.113.1) on its outside interface. Validate NAT translations, ACL matches, and simultaneous host access, and practice troubleshooting common misconfigurations (inside/outside role reversal, ACL selection errors).
CCNA Port Security: Maximum Secure MACs on Access Ports
Deploy and verify port security maximum settings on host-facing access ports in a pure Layer-2 campus with two access switches uplinked to a distribution switch. You will raise the allowed secure MAC count to 2 on each user port to support a PC and a potential downstream device (e.g., a dock), then verify with show commands. No Layer-3, SVIs, or routing are used; focus purely on access VLANs, trunks, and the port-security maximum behavior.
ACL App Filter: Permit SSH/HTTP, Block Telnet/ICMP
Build a two-router, one-access-switch lab with a client and a server. Establish basic IP connectivity with static routing, then implement an extended IPv4 ACL inbound on the client-facing interface to permit SSH and HTTP to the server while denying Telnet and ICMP echo. Validate from the client and review ACL hit counters for proof.
CCNA Static Routing: Floating Static Route as Backup Path
Deploy primary static routes between two branch LANs via a hub router and add a higher-AD floating static for a direct inter-branch backup. Verify end-to-end reachability, simulate a hub outage to trigger automatic failover, then restore the primary path. Includes realistic addressing, unique /30 transits, and host-based verification.
