10 hands-on IP Services scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. IP Services configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Daily CCNA troubleshooting lab (repair-focused). Inside clients cannot reach an external destination even though PAT appears configured. Diagnose by reading the NAT table and interface roles, discover that translation isn’t triggering because the NAT boundary is undefined, and restore outbound reachability by correctly marking both sides.
A branch LAN’s clients can’t obtain IP addresses even though the DHCP server at the hub is up and reachable. Diagnose where the broadcast-to-unicast relay path breaks and restore end-to-end DHCP lease delivery while preserving the rest of the clean, working design.
Stand up a small enterprise-style network where routers forward device logs and SNMP notifications to a central collector. You will configure SSH management, verify reachability from end hosts, and implement Syslog + SNMP on multiple routers so the network is observable from a single collector host.
Deploy an authenticated NTP hierarchy with a router acting as the trusted NTP server and two network devices as clients. Validate reachability from user hosts and confirm that clients securely synchronize to the server.
Deploy a centralized DHCP service across subnets using DHCP relay (ip helper-address). A branch client on a switched LAN requests an address from a DHCP server that resides at HQ. You will configure the relay on the branch gateway, create a DHCP pool for the remote subnet on the HQ router, verify the client lease and default gateway, and test end-to-end connectivity.
Turn a branch router into a DHCP server for a user LAN. You'll design a clean pool with exclusions, set the default gateway and DNS server, and verify a host lease and end-to-end reachability across a small routed core.
Deploy dynamic NAT on an enterprise edge so multiple inside clients share a pool of public IPs. You will configure an ACL to match inside sources, build a public NAT pool, bind the ACL to the pool, and correctly mark inside/outside interfaces. Validate from end hosts and confirm on-demand translations on the edge router.
Deploy a single-edge router performing static one-to-one NAT so an inside host has a fixed public address. You will mark inside/outside interfaces, create the static NAT mapping, and verify reachability to an internet host and the translation table. The lab is intentionally small but enterprise-clean, with a routed inside transit, an access switch for the user LAN, and an external host representing the internet.
Intermediate CCNA lab focused on named extended ACLs. You will permit a specific business flow (HTTP from the branch client to a data center web server) while denying ICMP to that server, apply the ACL inbound on the branch LAN interface, and validate from real endpoints. The baseline provides static routing and full connectivity; your task is to implement a readable, ordered named extended ACL with a remark and bind it correctly so the intended policy is enforced.
Deploy an extended ACL inbound near the source to allow HTTP from a client VLAN to a server while blocking ICMP to that same server. The lab uses router-on-a-stick over a hardened access switch with a routed transit to a core router hosting the server VLAN. You will implement, verify from endpoints, and troubleshoot matching by protocol, port, destination, and placement/direction.
IP services is the CCNA exam domain covering the infrastructure that sits alongside routing and switching and makes a network usable: handing out addresses, translating between private and public space, keeping clocks aligned, and getting logs and telemetry somewhere useful. Individually each is a short configuration. Together they are what turns a topology that forwards packets into a network you can actually run.
These labs build each service on real Cisco IOS and then make you prove it end to end. You'll configure DHCP pools with exclusions and options, relay requests across a router with ip helper-address so a client can find a server it cannot broadcast to, translate with static NAT, dynamic NAT pools and PAT overload, sync time with NTP, and forward events with syslog and SNMP. The verification is the interesting part — a DHCP pool that exists but never issues a lease, or a NAT translation that appears in the table but never returns traffic, both look correct in the running-config. Grading checks the service actually does its job rather than that the commands are present.
A DHCP client broadcasts, and a router does not forward broadcasts. ip helper-address turns that broadcast into a unicast aimed at the real server, which is how one server can address many subnets — and why forgetting it produces a client with no address and a server with no logs.
NAT maps addresses one-to-one; PAT (NAT overload) maps many inside addresses to one outside address by also translating the port number, which is what nearly every internet edge actually does. The labs configure both so the distinction is practical rather than definitional.
DHCP including relay, NAT and PAT, NTP, syslog, SNMP, and basic quality-of-service concepts. The labs here cover the configurable ones hands-on.
Study the theory behind these labs — the concept explainer and step-by-step guides.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.