59 hands-on Troubleshooting scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Troubleshooting configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Advanced CCNA troubleshooting capstone: a user on VLAN 10 can reach the gateway but not a remote server. Two independent faults exist on different layers; fixing either alone does not restore end-to-end reachability. Diagnose the full path, implement the minimal, design-aligned repair on each device, and prove bi-directional traffic works.
Troubleshoot a branch network where an ACL intended to block Telnet ended up blocking everything because it was never applied, and the branch router also lacks a route to the server. Diagnose from the client’s perspective, verify hop-by-hop reachability, and then place the ACL where it will see the traffic while preserving the intended deny. Finish by restoring end-to-end connectivity for all traffic except Telnet to the server.
Daily CCNA troubleshooting lab (repair-focused). Inside clients cannot reach an external destination even though PAT appears configured. Diagnose by reading the NAT table and interface roles, discover that translation isn’t triggering because the NAT boundary is undefined, and restore outbound reachability by correctly marking both sides.
A branch LAN’s clients can’t obtain IP addresses even though the DHCP server at the hub is up and reachable. Diagnose where the broadcast-to-unicast relay path breaks and restore end-to-end DHCP lease delivery while preserving the rest of the clean, working design.
Daily CCNA troubleshooting repair lab. Two routers share a /30 transit link and both run OSPF process 1 with explicit router-ids. IP connectivity over the transit is fine, but the OSPF adjacency never forms and remote routes are missing. Your job: work the neighbour state without changing working addressing or adding static routes. Bring the OSPF peering to FULL so the branch LAN appears on the core router.
Daily CCNA troubleshooting lab focused on Spanning Tree root bridge selection. A fully working campus access/distribution triangle forwards traffic, but the wrong switch is root for VLAN 10 and VLAN 20, forcing an inefficient path. Diagnose with show commands and repair by influencing the election without creating a loop.
A compact two-switch, two-host CML lab focused on troubleshooting an 802.1Q trunk. One VLAN traverses the trunk, another does not. Learners must read trunk state on both ends, compare against the intended design, and correct the mismatch without disrupting the working VLAN. Includes a second subtle trunk hygiene fault (native VLAN mismatch) that must be standardized.
A dual-stack enterprise tri-router line with two LANs and end hosts. IPv4 routing is healthy and end-to-end; IPv6 addressing is present but end-to-end IPv6 fails. Work from operational state only to isolate and correct the broken IPv6 control/forwarding plane without changing what already works. The graded end-state requires IPv6 forwarding enabled on all routers, OSPFv3 process 10 in area 0 with an explicit unique router-id on every router, and per-interface activation on all required links so the hosts can ping6 across the WAN.
Troubleshoot and fix an LACP EtherChannel between campus switches so both physical members bundle and the trunk reliably carries VLAN 10. Two independent faults are seeded: an intra-bundle trunk mismatch on one switch and an administratively down member on the other. Learners diagnose with show commands, align trunk attributes, and verify end-to-end host reachability.
Deploy a centralized DHCP service across subnets using DHCP relay (ip helper-address). A branch client on a switched LAN requests an address from a DHCP server that resides at HQ. You will configure the relay on the branch gateway, create a DHCP pool for the remote subnet on the HQ router, verify the client lease and default gateway, and test end-to-end connectivity.
Advanced CCNA OSPF troubleshooting capstone on Cisco Modeling Labs (CML-Free). A three-router, two-host enterprise-style topology is pre-broken with multiple independent OSPF faults. Your job: diagnose and fix them so adjacencies form across areas and the end hosts can reach each other. The final solution forwards end-to-end and adheres to clean OSPF hygiene.
Advanced Layer-2 security capstone. Neither PC on the access switch can get an address, and the help desk has already 'checked the DHCP server'. You get the symptoms and the requirements — no fault list. Work from show output to find every misconfiguration across the switch and the router, repair them, and prove both hosts recover. Several faults are layered: fixing the first one changes the symptom without ending the outage.
Advanced discovery and monitoring capstone, run as a fault hunt. The NMS has stopped seeing this site: neighbours are missing from the topology map, no traps are arriving, and syslog went quiet — while every device is reachable and pingable. You get symptoms and the required end state — no fault list. Faults span both routers and the switch they all peer through, and more than one of them leaves the monitoring configuration looking complete.
Advanced IP addressing capstone, run as a fault hunt. A branch build has been handed over and nothing quite works: one LAN cannot reach its gateway, a transit link behaves as though the two ends are on different networks, one router will not accept traffic on a point-to-point link, and two devices answer to the same loopback. You get symptoms and the required end state — no fault list. Every fault is an addressing decision that looks plausible until it is checked against the mask.
Advanced NTP capstone, run as a fault hunt. Two branch routers disagree about the time and neither will sync, despite both being configured for NTP and able to ping each other. You get symptoms and the required end state — no fault list. Faults sit on both devices, and two of them make NTP fail while the configuration reads as though it should work — including a restriction pointing at something that was never created.
Advanced secure-access capstone, run as a fault hunt. A hardening change was rolled back badly overnight: the edge router is reachable but the management plane is wide open in several different ways at once, and an SSH key cannot even be generated. You get symptoms and the required end state — no fault list. Everything is on one device, so the work is knowing which pieces of a management-plane build depend on each other rather than hunting across a topology.
Advanced static-routing capstone, run as a fault hunt. Two suites were cut over last night and now Suite-B is unreachable, Suite-A gets replies only sometimes, and one client cannot even reach its own gateway. Nothing was written down. You get symptoms and the required end state — no fault list. The faults span both routers and the access switch, and the routing table being present does not mean it is right.
Advanced BGP capstone, run as a fault hunt. The hub lost its upstream service route overnight and the branch cannot see hub prefixes either. Sessions are not all down, which is what makes it interesting: one peering never establishes, one establishes and carries nothing, and one prefix is never originated at all. You get symptoms and the required end state — no fault list. Faults span all three routers, and one of them is not in BGP at all.
Advanced EIGRP capstone, run as a fault hunt. The branch LAN has disappeared from the network, one router sees only half its neighbours, and the routing process looks healthy on every device. Nothing was recorded. You get symptoms and the required end state — no fault list. Faults span all three routers, and two of them leave EIGRP running perfectly while doing nothing useful.
Troubleshoot classic static routing and connectivity issues in a 3-router, 2-site network. Faults seeded include a missing return route, wrong next-hop/mask, and a missing/misconfigured default route. Learners must identify and correct Layer 3 faults to restore end-to-end reachability between branch clients.
Troubleshoot and repair a pre-broken HSRP gateway on a single shared LAN. Two routers (R1, R2) and two clients (PC1, PC2) connect to a single L2 switch (SW1) in VLAN 10. The hosts intermittently lose gateway reachability because both routers act active due to seeded faults. Use show commands to diagnose, then correct HSRP so both routers share one virtual IP and R1 deterministically wins active.
Advanced EtherChannel capstone, run as a fault hunt. The uplink bundle between two access switches is not passing traffic and the hosts either side cannot reach each other. Some members are up, the bundle is not, and nothing was recorded. You get symptoms and the required end state — no fault list. Both ends of a bundle have to agree about several things at once, and only one end was touched during the change — so comparing them is the exercise.
Advanced CCNP troubleshooting lab: a pair of Layer-2 switches are connected by a two-link EtherChannel intended to carry VLAN 90 between access hosts. The starter configuration ships broken on purpose: the inter-switch bundle won’t form due to incompatible aggregation modes, and a trunk allow-list drift on one side prunes VLAN 90. Diagnose with IOS show commands, correct the EtherChannel mode so LACP forms the Port-channel, and restore trunk policy so same-VLAN hosts can communicate.
Hands-on IOS DHCP server practice focused on validating pool state, inspecting conflicts, and fixing a real address conflict caused by a legacy static host on the LAN. You will verify server-side leases and exclusions, observe a conflict entry, then permanently exclude the static IP and clear the stale conflict so a client can obtain a clean address.
Configuration labs teach you to build a network that works. They do not teach you what to do at 2am with a network that used to work. Troubleshooting is a different skill: forming a hypothesis, choosing the one command that will disprove it fastest, and resisting the urge to change three things at once. It is also the skill both the CCNA and CCNP exams weight heavily, and the one candidates practise least, because a broken lab is much harder to author than a working one.
Every lab here ships with deliberate faults already in the running-config — you import a network that is genuinely broken and your job is to find out why. The faults are the ones that actually occur: a native VLAN mismatch, a trunk missing the VLAN it needs to carry, an OSPF area or timer mismatch, an ACL applied in the wrong direction, a NAT pool that doesn't cover the inside network, a next-hop that isn't reachable, a shutdown interface nobody mentions. You work them the way you would in production — show and debug to narrow it down, one change at a time — then upload the repaired config, and the grader checks the network reaches the intended end state rather than just that you typed something plausible.
They are built into the starter configuration you import, so the lab is broken from the first boot exactly as a production network would be. Nothing tells you which device is at fault — finding that out is the exercise.
Yes. Once you submit, the node-by-node solution reveals, so you can compare the fix you made against the intended one — including the cases where you found a different valid repair.
Each lab lists its troubleshooting focus up front, so you know which area the fault lives in without being told the answer. That keeps the exercise honest while stopping a single missed detail from costing you an evening.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.