74 hands-on Troubleshooting scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Fault-finding practice for CCNA and CCNP.
Included with a subscription
Deploy a centralized DHCP service across subnets using DHCP relay (ip helper-address). A branch client on a switched LAN requests an address from a DHCP server that resides at HQ. You will configure the relay on the branch gateway, create a DHCP pool for the remote subnet on the HQ router, verify the client lease and default gateway, and test end-to-end connectivity.
Advanced CCNA OSPF troubleshooting capstone on Cisco Modeling Labs (CML-Free). A three-router, two-host enterprise-style topology is pre-broken with multiple independent OSPF faults. Your job: diagnose and fix them so adjacencies form across areas and the end hosts can reach each other. The final solution forwards end-to-end and adheres to clean OSPF hygiene.
Advanced Layer-2 security capstone. Neither PC on the access switch can get an address, and the help desk has already 'checked the DHCP server'. You get the symptoms and the requirements — no fault list. Work from show output to find every misconfiguration across the switch and the router, repair them, and prove both hosts recover. Several faults are layered: fixing the first one changes the symptom without ending the outage.
Advanced discovery and monitoring capstone, run as a fault hunt. The NMS has stopped seeing this site: neighbours are missing from the topology map, no traps are arriving, and syslog went quiet — while every device is reachable and pingable. You get symptoms and the required end state — no fault list. Faults span both routers and the switch they all peer through, and more than one of them leaves the monitoring configuration looking complete.
Advanced IP addressing capstone, run as a fault hunt. A branch build has been handed over and nothing quite works: one LAN cannot reach its gateway, a transit link behaves as though the two ends are on different networks, one router will not accept traffic on a point-to-point link, and two devices answer to the same loopback. You get symptoms and the required end state — no fault list. Every fault is an addressing decision that looks plausible until it is checked against the mask.
Advanced NTP capstone, run as a fault hunt. Two branch routers disagree about the time and neither will sync, despite both being configured for NTP and able to ping each other. You get symptoms and the required end state — no fault list. Faults sit on both devices, and two of them make NTP fail while the configuration reads as though it should work — including a restriction pointing at something that was never created.
Advanced secure-access capstone, run as a fault hunt. A hardening change was rolled back badly overnight: the edge router is reachable but the management plane is wide open in several different ways at once, and an SSH key cannot even be generated. You get symptoms and the required end state — no fault list. Everything is on one device, so the work is knowing which pieces of a management-plane build depend on each other rather than hunting across a topology.
Advanced static-routing capstone, run as a fault hunt. Two suites were cut over last night and now Suite-B is unreachable, Suite-A gets replies only sometimes, and one client cannot even reach its own gateway. Nothing was written down. You get symptoms and the required end state — no fault list. The faults span both routers and the access switch, and the routing table being present does not mean it is right.
Advanced BGP capstone, run as a fault hunt. The hub lost its upstream service route overnight and the branch cannot see hub prefixes either. Sessions are not all down, which is what makes it interesting: one peering never establishes, one establishes and carries nothing, and one prefix is never originated at all. You get symptoms and the required end state — no fault list. Faults span all three routers, and one of them is not in BGP at all.
Advanced EIGRP capstone, run as a fault hunt. The branch LAN has disappeared from the network, one router sees only half its neighbours, and the routing process looks healthy on every device. Nothing was recorded. You get symptoms and the required end state — no fault list. Faults span all three routers, and two of them leave EIGRP running perfectly while doing nothing useful.
Troubleshoot classic static routing and connectivity issues in a 3-router, 2-site network. Faults seeded include a missing return route, wrong next-hop/mask, and a missing/misconfigured default route. Learners must identify and correct Layer 3 faults to restore end-to-end reachability between branch clients.
Troubleshoot and repair a pre-broken HSRP gateway on a single shared LAN. Two routers (R1, R2) and two clients (PC1, PC2) connect to a single L2 switch (SW1) in VLAN 10. The hosts intermittently lose gateway reachability because both routers act active due to seeded faults. Use show commands to diagnose, then correct HSRP so both routers share one virtual IP and R1 deterministically wins active.
Advanced CCNP troubleshooting lab: a pair of Layer-2 switches are connected by a two-link EtherChannel intended to carry VLAN 90 between access hosts. The starter configuration ships broken on purpose: the inter-switch bundle won’t form due to incompatible aggregation modes, and a trunk allow-list drift on one side prunes VLAN 90. Diagnose with IOS show commands, correct the EtherChannel mode so LACP forms the Port-channel, and restore trunk policy so same-VLAN hosts can communicate.
Advanced EtherChannel capstone, run as a fault hunt. The uplink bundle between two access switches is not passing traffic and the hosts either side cannot reach each other. Some members are up, the bundle is not, and nothing was recorded. You get symptoms and the required end state — no fault list. Both ends of a bundle have to agree about several things at once, and only one end was touched during the change — so comparing them is the exercise.
Hands-on IOS DHCP server practice focused on validating pool state, inspecting conflicts, and fixing a real address conflict caused by a legacy static host on the LAN. You will verify server-side leases and exclusions, observe a conflict entry, then permanently exclude the static IP and clear the stale conflict so a client can obtain a clean address.
Advanced Rapid-PVST+ troubleshooting on a 3-switch triangle with a real Layer-2 loop. Two deliberate faults are seeded: an unintended root bridge wins VLAN 100 due to a mis-set/default priority, and PortFast/BPDU Guard are mistakenly applied on an inter-switch trunk. Two Alpine hosts in VLAN 100 verify user impact. Your job: use show commands to diagnose, then restore the correct root and remove edge features from the trunk while preserving them on access ports.
Advanced CCNA troubleshooting capstone for centralized DHCP across a relay. A centralized IOS-XE router (DHCP-SRV) serves the branch LAN behind BR-RTR via ip helper-address. The lab imports in a deliberately broken state: the DHCP pool scope and gateway are misconfigured on the server, and the relay configuration is missing on BR-RTR. Learners must diagnose using show outputs and Linux tools, fix all three discrepancies, and verify that two Alpine clients dynamically receive usable leases and can reach DHCP-SRV.
Advanced NAT capstone, run as a fault hunt. Inside hosts cannot reach the internet, the translation table stays empty, and one host cannot even reach its own gateway. The lab is called NAT, which is the trap: not every fault here is a NAT fault. You get symptoms and the required end state — no fault list. Faults span the router, the switch and the path beyond, and fixing the translation alone will not restore service.
Hands-on static routing lab in a small branch–WAN–branch triangle. You will configure recursive, directly-attached, and fully-specified static routes to enable end-to-end reachability between two hosts across three routers. You will learn how next-hop resolution works, how it appears in show ip route, and how to troubleshoot when static routes don’t resolve or forward as expected.
Advanced ACL and NAT capstone, run as a fault hunt. A branch site was cut over last night and the policy does not behave: the flow that should be blocked gets through, other traffic does not come back at all, and nobody recorded what changed. You get symptoms and the required end state — no fault list. The faults span all three routers and include a shadowed ACE and a policy applied on the wrong side of NAT, so translated addresses hide the very hosts the rules name. Expect fixing the first one to change the symptom rather than clear it.
Hands-on CCNP OSPF lab comparing broadcast and point-to-point network types. Three routers share a multi-access Ethernet via an access switch to observe DR/BDR election, manipulate interface priorities, and then convert to point-to-point. Includes a user LAN behind R1 and realistic troubleshooting: neighbor stuck in 2-Way due to type mismatch, area mismatch isolating a router, and incorrect interface priority preventing desired DR/BDR roles.
Advanced CCNA capstone: diagnose and repair a fully-broken three-VLAN router-on-a-stick deployment. One iol-xe router uplinks by 802.1Q trunk to a pure layer-2 ioll2-xe switch, with three alpine PCs on their own access VLANs (10 Sales, 20 Voice, 30 CCTV); after a recent switch and router change, inter-VLAN connectivity is broken or intermittent across all three VLANs. Trace VLAN intent end-to-end from each host through the trunk to the router's subinterfaces, repair whatever faults you find, and verify with end-host pings/traceroutes and IOS show commands.
Advanced CCNA troubleshooting lab on a router-on-a-stick design. VLAN 10 users can reach their gateway and other hosts, but VLAN 20 users cannot reach their gateway or any resources in VLAN 10. Methodically trace L2/L3 intent end-to-end - from the access ports through the trunks up to the router subinterfaces - to isolate the first-hop failure and implement fixes that restore inter-VLAN routing while maintaining enterprise trunk hardening and clean configurations.
Advanced CCNA switching capstone centered on restoring end-to-end VLAN 20 transport across three Layer-2 switches using 802.1Q trunks. The starter ships intentionally broken: after a simulated maintenance window, two Alpine hosts in VLAN 20 can no longer reach each other across the inter-switch trunks. Learners diagnose with show interfaces trunk, show interfaces switchport, and show vlan brief, then identify and correct the trunking faults in the right order and verify with host pings.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.