VRRP: Tune Advertisements to 3 Seconds
Advanced CCNP VRRP lab: standardize the VRRP advertisement interval to 3 seconds on a shared user VLAN. Two IOS routers (R1, R2) and two hosts connect to a single access switch on VLAN 10 (10.0.10.0/24). Both routers share VRRP group 1 and the same virtual IP 10.0.10.254 so hosts keep one default gateway. R1 is the master via priority 110; both routers explicitly set 'vrrp 1 timers advertise 3' to enforce a consistent master advertisement rate and backup master-down detection window. Verify with 'show vrrp' (Advertisement interval 3.000 sec) and host pings to the VIP.
VRRP Load-Sharing with Two Groups
Advanced VRRP on a single VLAN: configure two VRRP groups on R1/R2 so each router is Master for one group and Backup for the other, distributing host egress while preserving gateway redundancy.
VRRP Object Tracking for Uplink Failover
Configure VRRP with interface object tracking so the virtual gateway fails over when the active router loses its upstream link, avoiding black-holing. The site LAN (VLAN 10) uses a single virtual default gateway (10.0.10.254) shared by two IOS routers (R1, R2). A separate access switch (SW) bridges the LAN. Both routers uplink via Ethernet0/1 to a second switch (CORE) on VLAN 99 to represent the upstream path. R1 is the intended VRRP master (priority 110). You will create a track object that monitors R1's uplink (Ethernet0/1) and decrements its VRRP priority by 20 if the link fails, allowing R2 to preemptively take over as master. The lab grades the deterministic VRRP configuration: common group and virtual IP on both routers, R1 priority 110, the global track object, and the 'vrrp 1 track 1 decrement 20' tie-in on R1.
First-Hop Redundancy Troubleshooting
Troubleshoot and repair a pre-broken HSRP gateway on a single shared LAN. Two routers (R1, R2) and two clients (PC1, PC2) connect to a single L2 switch (SW1) in VLAN 10. The hosts intermittently lose gateway reachability because both routers act active due to seeded faults. Use show commands to diagnose, then correct HSRP so both routers share one virtual IP and R1 deterministically wins active.
Moving to HSRP Version 2
Migrate a single-subnet LAN from HSRP version 1 assumptions to HSRP version 2, enabling group numbers above 255. Configure HSRPv2 on two routers that share one virtual default gateway IP so hosts retain gateway resilience without reconfiguration.
Securing HSRP with MD5
Harden an HSRP virtual default gateway with MD5 authentication so only trusted routers can participate. You’ll secure an existing HSRP group on two IOS routers that share a user VLAN via a single L2 switch. Validate the authentication state on both routers and confirm the endpoint still reaches the virtual IP.
Tuning HSRP Timers for Faster Failover
Configure HSRP on two routers with a shared virtual gateway and speed up failover by tightening hello/hold timers to 1/3 seconds. Validate deterministic active/standby selection and confirm timer settings via show commands.
Load-Sharing with Two HSRP Groups
Implement two HSRP groups on a single VLAN so each router is Active for one group and Standby for the other. Two hosts split default gateways across the two virtual IPs for deterministic load-sharing with redundancy.
VRRP — The Open-Standard Alternative
Replace HSRP with open-standard VRRP to provide a shared virtual gateway on a single access VLAN. Configure VRRP group 1 with a common virtual IP and deterministic master/backup roles via priority and preempt. Validate using show vrrp commands and end-host pings.
Lab 8: L3 EtherChannel + Static Routing
Build a routed LACP EtherChannel (Port-channel 8) between two iol-xe routers and route real inter-LAN traffic using static routes. Two parallel physical links (Ethernet0/0 and Ethernet0/1) on each router are bundled into a single Layer-3 Port-channel with a /30 transit. Each router serves a local /24 LAN with an alpine host. Validate that Po8 is up/up, static routes are present, and end-to-end host pings succeed across the aggregated uplink.
EtherChannel Load Balancing with LACP (VLAN 60)
Build a two-link LACP EtherChannel between two layer-2 switches as an access port for VLAN 60, then tune the global load-balancing algorithm to src-dst-ip so traffic distributes more evenly. Verify Po6 status, the hashing method, and end-to-end host reachability.
L3 Routed EtherChannel Between Two Routers (LACP)
Build a Layer-3 EtherChannel between two IOS XE routers using LACP active/active. Two parallel router links are bundled into Port-channel5, which carries a /30 transit. R2 hosts a loopback; R1 installs a static route to reach it. Validate that the Port-channel holds the IP (members do not), that the bundle is up and uses both links, and that pings across the /30 and to the loopback succeed. Emphasis: deterministic EtherChannel configuration and Layer-3 port-channel practices.
EtherChannel Consistency: Repair a Mode Mismatch
Advanced CCNP troubleshooting lab: a pair of Layer-2 switches are connected by a two-link EtherChannel intended to carry VLAN 90 between access hosts. The starter configuration ships broken on purpose: the inter-switch bundle won’t form due to incompatible aggregation modes, and a trunk allow-list drift on one side prunes VLAN 90. Diagnose with IOS show commands, correct the EtherChannel mode so LACP forms the Port-channel, and restore trunk policy so same-VLAN hosts can communicate.
EtherChannel Troubleshooting Capstone (L2 LACP)
Advanced CCNP EtherChannel troubleshooting capstone on Cisco IOS L2 switches. Two ioll2-xe switches are joined by two parallel links intended to bundle as one LACP Port-channel. The lab ships pre-broken with two independent faults on SW1: the parallel links are placed into different channel-groups and their switchport L2 parameters are inconsistent. Learners must use show commands to diagnose, then correct both faults so Port-channel 100 bundles both members as an access link for VLAN 100, restoring host-to-host reachability.
Lab 7: EtherChannel + Rapid-PVST — One Logical Link
Build an LACP Layer-2 EtherChannel between SW1 and SW2 so Rapid-PVST+ treats two parallel links as one logical Port-channel 7. Without EtherChannel, STP will block one of the two access links. With LACP active on both members and Port-channel 7 as an access port in VLAN 70, STP shows a single forwarding interface (Po7) and both physical links forward as one logical channel. Two hosts in VLAN 70 verify end-to-end connectivity.
STP Lab 7: Rapid-PVST+ Migration on Triangle Loop
Migrate a three-switch triangle from legacy PVST to Rapid-PVST+ without changing the existing root or blocked port. SW1 remains the deterministic root for VLAN 70 (priority 4096). Verify protocol mode, link types (point-to-point vs edge), and end-to-end host reachability, then observe the faster reconvergence behavior of Rapid-PVST+.
STP 10: Spanning Tree Troubleshooting Capstone
Advanced Rapid-PVST+ troubleshooting on a 3-switch triangle with a real Layer-2 loop. Two deliberate faults are seeded: an unintended root bridge wins VLAN 100 due to a mis-set/default priority, and PortFast/BPDU Guard are mistakenly applied on an inter-switch trunk. Two Alpine hosts in VLAN 100 verify user impact. Your job: use show commands to diagnose, then restore the correct root and remove edge features from the trunk while preserving them on access ports.
STP Lab 8: Per-VLAN Load Balancing Across Two Roots
Use Rapid-PVST+ to elect different root bridges per VLAN across two parallel trunks, spreading VLAN 80 and VLAN 81 across distinct physical links without modifying path cost or port priority. Validate independent per-VLAN trees and confirm hosts in VLAN 80 can communicate over the surviving path. Includes a drift-check to diagnose/restore trunk allow-lists.
Root Guard on Designated Ports
Advanced Rapid-PVST+ and Root Guard implementation on a three-switch triangle with a real loop. SW1 is the intentional root for VLAN 90 and protects its designated ports with Root Guard to prevent root re-parenting. Two Alpine hosts on VLAN 90 verify end-to-end forwarding remains stable even if a superior BPDU appears downstream.
OSPF Network Types: DR/BDR, Broadcast vs P2P
Hands-on CCNP OSPF lab comparing broadcast and point-to-point network types. Three routers share a multi-access Ethernet via an access switch to observe DR/BDR election, manipulate interface priorities, and then convert to point-to-point. Includes a user LAN behind R1 and realistic troubleshooting: neighbor stuck in 2-Way due to type mismatch, area mismatch isolating a router, and incorrect interface priority preventing desired DR/BDR roles.
OSPFv2 Multi-Area with ABR Summarization (Redundant Core)
Deploy a 5-node OSPFv2 lab featuring a redundant area 0 triangle (R1–R2–R3) and an ABR (R3) connecting to area 1 with branch networks on R4. A client on R1’s area 0 LAN validates reachability to branch loopback networks summarized by the ABR. You will set explicit router-ids from Loopback0, use passive-interface default, advertise R4’s loopbacks as /24s using ip ospf network point-to-point, and summarize area 1 into a /23 on the ABR. Verify FULL adjacencies, a single O IA summary on R1, and end-to-end connectivity. Troubleshoot an introduced area mismatch and interface/addressing issues.
OSPF Stub vs Totally-Stubby: Fault & Recovery
Deploy a compact enterprise multi-area OSPF with a backbone (area 0) and one branch area (area 10). You will configure area 10 as a stub, then transition it to a totally-stubby area from the ABR, validate reduced LSDB and routing tables, and simulate an operational fault (area mismatch) to diagnose adjacency loss and restore full transit. The lab uses three routers and two hosts to verify end-to-end reachability and real-world outcomes.
OSPF Inter-Area Summarization with ABR Area Range
Build a 5-node CML lab to design OSPFv2 across two areas with an ABR that summarizes non-backbone routes using area range. Validate adjacencies, end-to-end reachability, and that the backbone learns a single summary in place of specific inter-area routes. Intentionally introduce an area mismatch, diagnose why the adjacency does not form, and repair it.
OSPF MD5 Authentication: Backbone Integrity and Area Mismatch
Deploy OSPFv2 with MD5 authentication on backbone links, deliberately trigger and diagnose an area mismatch adjacency failure, then fix it and restore end-to-end reachability between two branch hosts in a compact three-router topology.
