76 hands-on Switching scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Switching configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Daily CCNA troubleshooting lab focused on Spanning Tree root bridge selection. A fully working campus access/distribution triangle forwards traffic, but the wrong switch is root for VLAN 10 and VLAN 20, forcing an inefficient path. Diagnose with show commands and repair by influencing the election without creating a loop.
A compact two-switch, two-host CML lab focused on troubleshooting an 802.1Q trunk. One VLAN traverses the trunk, another does not. Learners must read trunk state on both ends, compare against the intended design, and correct the mismatch without disrupting the working VLAN. Includes a second subtle trunk hygiene fault (native VLAN mismatch) that must be standardized.
Harden a dual-stack access segment with IPv6 RA Guard so only the legitimate router can advertise a default gateway. You will start from a working IPv4 baseline with IPv6 SLAAC enabled, then implement and verify RA Guard on the access switch. The solution must keep end-to-end IPv4/IPv6 reachability while blocking rogue Router Advertisements from a malicious host.
Bring together core campus redundancy skills in one focused day: elect a deterministic STP root on the intended distribution switch, form a working LACP EtherChannel between distribution and access, harden edge with PortFast/BPDU Guard, and stand up an HSRP virtual gateway that the VLAN 10 users actually use. The starter is intentionally mis-tuned across layers so you must build or repair it end-to-end.
Troubleshoot and fix an LACP EtherChannel between campus switches so both physical members bundle and the trunk reliably carries VLAN 10. Two independent faults are seeded: an intra-bundle trunk mismatch on one switch and an administratively down member on the other. Learners diagnose with show commands, align trunk attributes, and verify end-to-end host reachability.
Hands-on CCNA EtherChannel repair lab. Two uplinks between a distribution and an access switch are intended to form a single port-channel trunk carrying VLAN 10. The starter ships with a real mode mismatch across the bundle and an allow-list error, so the Port-channel stays down and hosts cannot talk. Learners diagnose the symptom and standardize on one protocol family (PAgP, LACP, or Static) and correct trunking so VLAN 10 forwards end-to-end.
Bundle two parallel switch uplinks into a single Port-Channel using LACP so that Spanning Tree no longer blocks one link. You will convert two existing 802.1Q trunks into one logical trunk, verify both member links are active in the Port-Channel, and confirm end-to-end host reachability.
Harden the campus access edge by enabling PortFast and BPDU Guard only on host-facing access ports while keeping redundant switch-to-switch trunks loop-free with STP. Validate instant host link-up and demonstrate that a rogue BPDU errdisables the port instead of changing the topology.
Migrate a small campus from legacy PVST+ to Rapid-PVST+ across all switches, harden trunks, mark edge ports, and verify sub-second RSTP behaviours. A three-switch triangle with redundant trunks carries VLAN 10 to two hosts so you can validate end-to-end and observe convergence when a trunk flaps.
Build a redundant campus triangle with two distribution switches and one access switch. Implement PVST+ per-VLAN root tuning so VLAN 10 forwards over DSW1 while VLAN 20 forwards over DSW2. Verify that each VLAN chooses a different root and that the blocked uplink differs per VLAN, while end hosts in each VLAN can still reach their local SVI gateway IP.
Influence a downstream access switch’s STP root-port choice using per-interface path cost and port priority. You will make the access switch prefer the non-default uplink so that the intended link forwards while the other becomes the alternate/blocking path. Validate with show commands and end-to-end host pings.
Designate an intentional STP root bridge and backup for a campus user VLAN across a redundant three-switch triangle. You will verify correct root election and port roles and confirm end-to-end host connectivity while preventing Layer-2 loops.
Advanced Layer-2 security capstone. Neither PC on the access switch can get an address, and the help desk has already 'checked the DHCP server'. You get the symptoms and the requirements — no fault list. Work from show output to find every misconfiguration across the switch and the router, repair them, and prove both hosts recover. Several faults are layered: fixing the first one changes the symptom without ending the outage.
Harden Dynamic ARP Inspection (DAI) on an access switch by enabling additional packet validation checks: source MAC, destination MAC, and IP sanity. The uplink toward the DHCP server/gateway is trusted, access ports are untrusted. DHCP Snooping and baseline DAI are already enabled for VLAN 10; your task is to add the global DAI validation knobs and verify the change deterministically via show commands.
Harden the campus access edge by isolating same-switch hosts using protected ports. You will configure switchport protected on both host-facing access interfaces so PC1 and PC2 cannot communicate at Layer 2, while all endpoints still reach the default gateway R1. This is a deterministic Layer-2 security control that mimics lightweight private-VLAN isolation on a single switch. Focus is on SW1 only; R1 and hosts are pre-provisioned.
Harden the Layer-2 access edge by enabling Dynamic ARP Inspection (DAI) on a single access switch. DHCP Snooping is already in place and the uplink toward the DHCP server/gateway is trusted. Your job: enable DAI for VLAN 10 and trust the uplink so ARP on host-facing ports is validated against the DHCP Snooping bindings.
Harden the Layer-2 access edge by enabling DHCP Snooping on a single access switch and placing the trust boundary only toward the legitimate DHCP server/gateway. Validate with show commands and end-host connectivity.
Free with an account
Harden the Layer-2 access edge by deploying a unified trust boundary for DHCP Snooping and Dynamic ARP Inspection (DAI) on a single access switch. R1 is both the default gateway and DHCP server for VLAN 10. You will enable DHCP Snooping and DAI globally for VLAN 10 and set the same uplink interface as trusted for both features, leaving host-facing access ports untrusted. This lab emphasizes the dependency and synergy between DHCP Snooping and DAI for blocking rogue DHCP/ARP activity. Grade scope: SW1 config only.
Harden the Layer-2 access edge by rate-limiting DHCP messages on untrusted ports. SW1 already has DHCP snooping enabled for VLAN 10 with the uplink trusted. Your task is to apply a per-interface rate limit on the host-facing access ports to blunt DHCP starvation attacks while leaving the trusted uplink unlimited.
Layer 2 Security Hardening, Lab 9/10. You will enable automatic errdisable recovery on a campus access switch so ports shut down by Layer-2 security (Dynamic ARP Inspection, DHCP rate-limit, or storm control) can return to service automatically after a safe interval. The switch already enforces DHCP snooping with a correct trust boundary, DAI validation, and broadcast/multicast/unicast storm-control with shutdown actions. Your job: turn on errdisable auto-recovery for arp-inspection, dhcp-rate-limit, and storm-control, and set the interval to 60 seconds. Verify with show errdisable recovery.
Advanced CCNP troubleshooting lab: a pair of Layer-2 switches are connected by a two-link EtherChannel intended to carry VLAN 90 between access hosts. The starter configuration ships broken on purpose: the inter-switch bundle won’t form due to incompatible aggregation modes, and a trunk allow-list drift on one side prunes VLAN 90. Diagnose with IOS show commands, correct the EtherChannel mode so LACP forms the Port-channel, and restore trunk policy so same-VLAN hosts can communicate.
Beginner CCNA lab that builds a static Layer-2 EtherChannel (mode on) between two ioll2-xe switches using two parallel links as members of Port-channel1. The Port-channel is configured as an access port in VLAN 10 so that two hosts, one on each switch, can communicate without spanning-tree blocking a parallel path. Learners deploy and verify the bundle, then validate end-to-end host connectivity.
Free with an account
Advanced EtherChannel capstone, run as a fault hunt. The uplink bundle between two access switches is not passing traffic and the hosts either side cannot reach each other. Some members are up, the bundle is not, and nothing was recorded. You get symptoms and the required end state — no fault list. Both ends of a bundle have to agree about several things at once, and only one end was touched during the change — so comparing them is the exercise.
Build a Layer-2 PAgP EtherChannel between two ioll2-xe switches (SW1 and SW2) using a desirable/auto pairing on two parallel links. Bundle Ethernet0/0 and Ethernet0/1 into Port-channel 3, make the port-channel a VLAN 30 access interface on both switches, and verify with show etherchannel summary, show pagp neighbor, show pagp counters, and end-to-end host pings in VLAN 30.
Switching is the layer most networks actually break at. Routing tends to fail loudly and get fixed; a switched access layer fails quietly — a port in the wrong VLAN, a trunk that pruned the VLAN it was carrying, a spanning-tree topology that technically converged but put the root bridge in a wardrobe. The frustrating part is that every one of those looks fine in the running-config. You find them by knowing which show command exposes the lie.
These labs put a real switched topology in front of you in Cisco Modeling Labs, built on Cisco IOS-L2 images. You'll work through the access layer end to end: VLAN creation and port assignment, 802.1Q trunking and the allowed list, the native VLAN, EtherChannel bundling, spanning-tree root placement and port roles, PortFast and BPDU Guard on edge ports, and port security to pin a MAC to a port. Verification is the point as much as configuration — show vlan brief, show interfaces trunk, show spanning-tree, show etherchannel summary, show port-security — because that is the loop you will run on real gear. Upload your export and every requirement is graded against the answer key, so a topology that merely looks converged doesn't pass as one that is.
VLANs and access ports, 802.1Q trunking and allowed VLAN lists, the native VLAN, inter-VLAN routing, EtherChannel, spanning tree (root election, port roles, PortFast, BPDU Guard, Rapid-PVST), and layer-2 security including port security, DHCP snooping and dynamic ARP inspection.
Cisco IOL-L2 from the CML free tier, so there is nothing extra to license. Each lab imports as a YAML package and boots switches running real Cisco IOS, not a simulator.
No. The pure layer-2 labs stand alone. Once you want traffic to move between VLANs you'll need a little routing, and the inter-VLAN routing labs introduce exactly as much as you need at that point.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.