Goldfish Networks wordmark
Topic

Security practice labs

18 hands-on Security scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Security configuration and troubleshooting practice for CCNA and CCNP.

Included with a subscription

AdvancedDailyNewLocked

CCNA Break/Fix: The ACL That Blocks Too Much

Troubleshoot a branch network where an ACL intended to block Telnet ended up blocking everything because it was never applied, and the branch router also lacks a route to the server. Diagnose from the client’s perspective, verify hop-by-hop reachability, and then place the ACL where it will see the traffic while preserving the intended deny. Finish by restoring end-to-end connectivity for all traffic except Telnet to the server.

CCNA65 min4 objectives

AdvancedDailyLocked

CCNA: Secure Branch Edge Capstone (ACL/PAT/DHCP/SSH)

One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.

CCNA90 min5 objectives

IntermediateDailyLocked

CCNA Foundations: NTP — Authenticated Time Sync (Client/Server)

Deploy an authenticated NTP hierarchy with a router acting as the trusted NTP server and two network devices as clients. Validate reachability from user hosts and confirm that clients securely synchronize to the server.

CCNA55 min5 objectives

IntermediateDailyLocked

CCNA Foundations: Named ACLs — Readable Rules & Editing by Sequence

Intermediate CCNA lab focused on named extended ACLs. You will permit a specific business flow (HTTP from the branch client to a data center web server) while denying ICMP to that server, apply the ACL inbound on the branch LAN interface, and validate from real endpoints. The baseline provides static routing and full connectivity; your task is to implement a readable, ordered named extended ACL with a remark and bind it correctly so the intended policy is enforced.

CCNA55 min5 objectives

IntermediateDailyLocked

CCNA: Extended ACLs — Match Protocol, Port, Destination

Deploy an extended ACL inbound near the source to allow HTTP from a client VLAN to a server while blocking ICMP to that same server. The lab uses router-on-a-stick over a hardened access switch with a routed transit to a core router hosting the server VLAN. You will implement, verify from endpoints, and troubleshoot matching by protocol, port, destination, and placement/direction.

CCNA65 min5 objectives

BeginnerDailyLocked

CCNA Foundations: Standard ACLs — Filter Traffic by Source

Build a compact two-router, three-host topology. Implement a numbered standard ACL on the destination router to permit Client-A and deny Client-B from reaching a protected server based solely on source subnet. Verify from the end hosts that permitted traffic succeeds and denied traffic fails, and practice correct ACL placement and direction.

CCNA40 min4 objectives

AdvancedLocked

SNMPv3 AuthPriv Monitoring

Harden the monitoring plane by replacing cleartext SNMPv2c with authenticated and encrypted SNMPv3 (authPriv) on R1. You will create a v3 group that requires privacy and a user with SHA authentication and AES-128 encryption, then verify the configuration. The flat management LAN avoids routing complexity so you can focus on the security mechanics of SNMPv3.

CCNA35 min5 objectives

IntermediateLocked

Restricting NTP with an access-group

Configure a Cisco IOS router as an authoritative NTP master and restrict which clients it will serve using an NTP access-group with a standard ACL. One shared LAN (no routing) connects three routers through a Layer-2 switch. Only R2 is authorized to receive time from R1; R3 is denied. Learners deploy, verify, and troubleshoot the access-group behavior.

CCNA40 min5 objectives

IntermediateLocked

Securing NTP with MD5 Authentication

Configure NTP MD5 authentication so a client (R2) synchronizes only to a trusted, authenticated master (R1). R1 is already an authoritative clock (ntp master 3). You will enable NTP authentication on both routers, define and trust key 1, and bind the key on R2's ntp server statement. Verification focuses on authenticated associations and status; actual time lock may take minutes and is not graded.

CCNA35 min4 objectives

BeginnerLocked

Enable Secret and Password Encryption on R1

Harden privileged access on a single IOS router by configuring a hashed enable secret, creating a local admin user with privilege 15 and a secret, and enabling service password-encryption. Verify that privileged access requires the secret and that the running-config contains no cleartext passwords.

CCNA30 min4 objectives

IntermediateLocked

CCNA: Console and VTY Line Hardening

Harden the console and VTY lines on a single Cisco IOS router so idle sessions close automatically and every access path requires authentication. You will configure login local on both console and VTY, set 5-minute exec timeouts, enable logging synchronous on the console, and restrict VTY to SSH. Verification uses show outputs; grading evaluates the deterministic running-config.

CCNA35 min5 objectives

IntermediateLocked

AAA Authentication with a Local User Database

Harden R1’s management plane by moving SSH login authentication and exec authorization under the IOS AAA framework using the local user database. You will start from a secure SSH-only baseline that still uses login local, enable aaa new-model, define default AAA methods that point at local, and bind VTY lines to AAA. Success is proven by authenticating from the ADMIN host over SSH and landing at the user’s privilege level.

CCNA35 min4 objectives

AdvancedLocked

AAA Named Method Lists with Fallback (VTY vs Console)

Harden a single Cisco IOS router’s management plane using AAA named method lists applied per-line. Create VTY-AUTH (local then enable) to protect remote SSH access without lockout risk, and CONSOLE-AUTH (local only) to secure the console independently. Verify using show/run sections and test SSH from the ADMIN workstation.

CCNA40 min5 objectives

IntermediateLocked

Securing HSRP with MD5

Harden an HSRP virtual default gateway with MD5 authentication so only trusted routers can participate. You’ll secure an existing HSRP group on two IOS routers that share a user VLAN via a single L2 switch. Validate the authentication state on both routers and confirm the endpoint still reaches the virtual IP.

CCNA & CCNP35 min4 objectives

IntermediateLocked

CCNA: ACL Placement – Std Near Dest, Ext Near Source

Dual-router Branch/HQ lab with a branch client and an HQ server. You will apply an extended IPv4 ACL inbound near the source on the Branch LAN to block specific traffic (TCP/80) while permitting others (ICMP), and a standard IPv4 ACL outbound near the destination on the HQ LAN to admit only the approved source. Validate from real hosts, confirm ACL hitcounts, and keep inter-site connectivity via static routes over a /30 transit.

CCNA55 min4 objectives

IntermediateLocked

ACL Wildcard Masks: Match Host, Subnet, and Range

Hands-on CCNA ACL practice using standard ACLs and wildcard masks to allow a single host, a contiguous range, and an entire subnet while proving a deny. You will place the ACL near the destination, order statements correctly, verify with end-host pings and ACL counters, and troubleshoot common mistakes.

CCNA55 min5 objectives

IntermediateLocked

ACL App Filter: Permit SSH/HTTP, Block Telnet/ICMP

Build a two-router, one-access-switch lab with a client and a server. Establish basic IP connectivity with static routing, then implement an extended IPv4 ACL inbound on the client-facing interface to permit SSH and HTTP to the server while denying Telnet and ICMP echo. Validate from the client and review ACL hit counters for proof.

CCNA55 min5 objectives

AdvancedLocked

ACL Segmentation Policy on Multi-LAN Router

Deploy and verify multiple IPv4 ACLs on a single router that terminates three distinct LANs (Client, Server, and Management). You will place an extended ACL inbound on the Client interface to allow only specific services to the Server and block access to Management, a standard ACL outbound on the Management interface to enforce destination-side protection by source, and a VTY access-class to restrict router SSH to the Management subnet only. Validate with end-host tests that permitted flows succeed while denied flows are provably blocked, and use ACL hit counts and logs to troubleshoot.

CCNA70 min5 objectives

Practicing network security on Cisco Modeling Labs

Why it matters, and what these labs cover.

Network security at CCNA and CCNP level is mostly not cryptography — it is denying what should be denied, hardening what is exposed, and making sure the device itself cannot be walked into. The commands are short. Getting them right is not, because security failures are silent: an ACL in the wrong direction still permits traffic, a VTY line with no access-class still accepts a session, and nothing on the device will warn you.

These labs cover the practical control set on real Cisco IOS: standard and extended ACLs for traffic policy and their placement rules, access-class to lock down VTY access, SSH replacing telnet with proper key generation and transport limits, AAA and privilege levels, port security to bound what can appear on an access port, and the layer-2 protections — DHCP snooping and dynamic ARP inspection — that stop an attacker on the access layer from becoming the default gateway. Every lab is verified with real traffic tests as well as show output, and graded per requirement, so a policy that happens to permit the right traffic for the wrong reason still gets caught.

Frequently asked questions

Where should an ACL be placed?

A standard ACL goes as close to the destination as possible, because it can only match source addresses and would otherwise block too much. An extended ACL goes close to the source, so the unwanted traffic is dropped before it crosses the network. Several labs are built around getting this wrong and seeing what happens.

Do the labs cover layer-2 attacks?

Yes — port security, DHCP snooping with trusted and untrusted ports, and dynamic ARP inspection, which together cover the access-layer attacks the CCNA expects you to be able to mitigate.

Is this enough for a security certification?

These map to the security objectives inside the CCNA and CCNP enterprise tracks. A dedicated security certification goes considerably deeper into firewalls, VPNs and identity, which these labs do not attempt to cover.

Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.