247 hands-on CCNA scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Aligned to the CCNA certification track — exam-ready configuration and troubleshooting practice.
Included with a subscription
Advanced CCNA troubleshooting capstone: a user on VLAN 10 can reach the gateway but not a remote server. Two independent faults exist on different layers; fixing either alone does not restore end-to-end reachability. Diagnose the full path, implement the minimal, design-aligned repair on each device, and prove bi-directional traffic works.
Troubleshoot a branch network where an ACL intended to block Telnet ended up blocking everything because it was never applied, and the branch router also lacks a route to the server. Diagnose from the client’s perspective, verify hop-by-hop reachability, and then place the ACL where it will see the traffic while preserving the intended deny. Finish by restoring end-to-end connectivity for all traffic except Telnet to the server.
Daily CCNA troubleshooting lab (repair-focused). Inside clients cannot reach an external destination even though PAT appears configured. Diagnose by reading the NAT table and interface roles, discover that translation isn’t triggering because the NAT boundary is undefined, and restore outbound reachability by correctly marking both sides.
A branch LAN’s clients can’t obtain IP addresses even though the DHCP server at the hub is up and reachable. Diagnose where the broadcast-to-unicast relay path breaks and restore end-to-end DHCP lease delivery while preserving the rest of the clean, working design.
Daily CCNA troubleshooting repair lab. Two routers share a /30 transit link and both run OSPF process 1 with explicit router-ids. IP connectivity over the transit is fine, but the OSPF adjacency never forms and remote routes are missing. Your job: work the neighbour state without changing working addressing or adding static routes. Bring the OSPF peering to FULL so the branch LAN appears on the core router.
Daily CCNA troubleshooting lab focused on Spanning Tree root bridge selection. A fully working campus access/distribution triangle forwards traffic, but the wrong switch is root for VLAN 10 and VLAN 20, forcing an inefficient path. Diagnose with show commands and repair by influencing the election without creating a loop.
A compact two-switch, two-host CML lab focused on troubleshooting an 802.1Q trunk. One VLAN traverses the trunk, another does not. Learners must read trunk state on both ends, compare against the intended design, and correct the mismatch without disrupting the working VLAN. Includes a second subtle trunk hygiene fault (native VLAN mismatch) that must be standardized.
Build an enterprise-clean dual-stack site end-to-end. IPv4 is complete and forwarding on day start; you will deploy IPv6 across the same topology. Enable IPv6 routing, assign prefixes, bring up OSPFv3 with explicit router-ids, keep the access LAN autoconfiguring via SLAAC with stateless DHCPv6 for DNS, and enforce an IPv6 ACL to allow one client flow to the server while denying another. Verify from the hosts and troubleshoot like a real operator.
A dual-stack enterprise tri-router line with two LANs and end hosts. IPv4 routing is healthy and end-to-end; IPv6 addressing is present but end-to-end IPv6 fails. Work from operational state only to isolate and correct the broken IPv6 control/forwarding plane without changing what already works. The graded end-state requires IPv6 forwarding enabled on all routers, OSPFv3 process 10 in area 0 with an explicit unique router-id on every router, and per-interface activation on all required links so the hosts can ping6 across the WAN.
Harden a dual-stack access segment with IPv6 RA Guard so only the legitimate router can advertise a default gateway. You will start from a working IPv4 baseline with IPv6 SLAAC enabled, then implement and verify RA Guard on the access switch. The solution must keep end-to-end IPv4/IPv6 reachability while blocking rogue Router Advertisements from a malicious host.
Build a dual-stack branch-to-datacenter topology with IPv6 static routing in place. Implement a named IPv6 ACL on the server-facing interface that permits an approved client while denying an unapproved source, and explicitly permits Neighbor Discovery (ND) so the LAN continues to function. Verify that the allowed source can reach the server over IPv6 while the unapproved source fails, without disrupting IPv6 neighbor resolution.
Deploy a stateless DHCPv6 service on a remote router and relay client Information-Requests from a branch LAN across a routed core to that server. IPv4 is already fully functional; your job is to build the IPv6 DHCPv6 relay path and confirm clients receive DNS/domain options while keeping IPv6 addressing via SLAAC.
Build a compact branch LAN where IPv6 hosts already form SLAAC addresses from router advertisements, then add stateless DHCPv6 to supply DNS server and domain-name. You will keep SLAAC for addressing, flip the RA 'other-config' flag so hosts know to ask, and bind an IPv6 DHCP pool with DNS options to the user LAN. IPv4 is prebuilt as a baseline and must keep forwarding. Verify from hosts and the router’s IPv6 DHCP/ND views.
Build a compact dual-stack enterprise topology where IPv4 is already forwarding end-to-end using OSPFv2. Your task is to bring up IPv6 routing in parallel using OSPFv3 with explicit router-ids, proving that IPv6 control/data planes operate independently from IPv4. Verify both protocols resolve separately and that an IPv4 control-plane failure does not impact IPv6 forwarding.
Daily CCNA IPv6 lab: build OSPFv3 across a three-router triangle with dual-stack links and real end hosts. IPv4 OSPFv2 is pre-built and forwarding end-to-end as the baseline. Your tasks: bring R3 into OSPFv3 with an explicit router-id and enable it per-interface, activate OSPFv3 on R1’s R3-facing interface, then steer the preferred IPv6 path by adjusting interface cost. Verify neighbor state, routes, and end-to-end IPv6 reachability from host to host.
Deploy single-area OSPFv3 between two routers so IPv6 LANs reach end-to-end. The IPv4 side is already forwarding with static routes. Your job: enable OSPFv3 with explicit router-ids and activate it per-interface on both the transit and LAN links, then verify the neighbor forms over link-local and routes are learned.
Build a compact branch-to-edge topology that is dual-stack for IPv4 and intentionally incomplete for IPv6. IPv4 is fully working as a baseline. Your job: enable IPv6 forwarding on both routers, replace specific IPv6 routes at the branch with a single default (::/0) toward the edge, and add a specific IPv6 return route on the edge back to the branch LAN. Verify the branch host reaches the edge-side resources over IPv6 while the IPv4 plane remains stable.
Dual-stack enterprise lab with two routers, a shared access switch, and two hosts in separate VLANs. IPv4 is fully working via static routes in the starter. Your task is to add IPv6 static routes on both routers so the clients can communicate end-to-end over IPv6. Learn why a link-local next hop on a point-to-point link requires specifying the exit interface.
Single-site IPv4/IPv6 lab where IPv4 is already working. You will enable IPv6 routing on the router and place a single /64 on the user LAN so two hosts autoconfigure via SLAAC. Then verify each host’s chosen IPv6 address and the learned default route via the router’s link-local address, and test end-to-end IPv6 connectivity.
A focused, enterprise-clean IPv6 day in a progressive CCNA series. You will enable IPv6 on a single user LAN, assign a deterministic link-local gateway, and observe Neighbor Discovery (ND) in action. IPv4 is already working; your job is to turn on IPv6 unicast routing, add a global unicast /64 to the gateway interface, and set an explicit link-local address so hosts learn a predictable next-hop. You will verify SLAAC-derived host addresses, default routes learned via RA, and ND neighbor tables on the router, and then test by pinging both the router’s link-local and global addresses from the hosts.
Bring IPv6 up alongside the already-working IPv4 baseline. You will enable IPv6 unicast routing on both routers, put a unique 2001:db8::/64 on each site LAN, put a /127 on the router-to-router transit, and address the dual-homed workstation on both of the LANs it is plugged into plus its IPv6 default route. Verify that IPv6 reaches both on-link gateways and, through the default route, the near router's transit address — while the far router's transit address stays unreachable over IPv6 and reachable over IPv4, because no IPv6 routing between the sites exists yet.
Bring together core campus redundancy skills in one focused day: elect a deterministic STP root on the intended distribution switch, form a working LACP EtherChannel between distribution and access, harden edge with PortFast/BPDU Guard, and stand up an HSRP virtual gateway that the VLAN 10 users actually use. The starter is intentionally mis-tuned across layers so you must build or repair it end-to-end.
Build gateway resiliency on a campus user LAN using VRRP between two edge routers. You will configure a VRRP group with a shared virtual IP, set a higher priority on the intended master, and prove failover from the end hosts without changing the default gateway. Includes full SSH management on routers, a clean L2 access switch, and two clients using the VRRP VIP.
Daily CCNA campus-redundancy lab focusing on HSRP preemption and interface tracking. You will refine an already-working HSRP default gateway so it follows real network health: fail to the standby when the preferred router loses its upstream, and preempt back when it recovers. The topology is an enterprise-clean small site with two distribution routers sharing a user VLAN through a Layer-2 access switch, each with its own point-to-point uplink to a core router. The starter works in steady state but suffers a blackhole during uplink failures and never reclaims Active without preemption. Your job is to add preempt and tracking on the correct router/interface and verify end-to-end forwarding under failover and failback.
The CCNA exam rewards one thing above all: comfort on the command line. You can memorize the difference between a broadcast and a collision domain, but you pass — and keep the job the cert helps you land — by being able to configure VLANs, OSPF, ACLs, and static routing quickly and correctly, and to troubleshoot them when they break. These CCNA-aligned labs are built to give you that muscle memory.
Every lab in this track is a free-tier Cisco Modeling Labs topology you import in one click and build on real Cisco IOS — VLANs and trunking, inter-VLAN routing, single-area OSPFv2, standard and extended ACLs, static and default routing, and the day-two troubleshooting the exam loves. Build each one, verify it with the same show commands the exam expects, then upload your CML export for grading against the answer key so you know it's genuinely correct. Do a lab a day and the CCNA objectives stop being a reading list and become reps you can perform under time pressure.
They cover the hands-on configuration and troubleshooting objectives thoroughly, which is where most candidates are weakest. Pair them with a theory resource for the conceptual and subnetting questions and you have both halves of the exam covered.
No — just your own Cisco Modeling Labs instance. Every lab is a YAML package built on CML free-tier images (IOL/IOL-L2) that imports in one click.
Start with VLANs and static routing to get comfortable on the CLI, then move to OSPF and ACLs, then the troubleshooting labs. The daily cadence is designed so each lab builds on the last.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.