268 hands-on CCNA scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Aligned to the CCNA certification track — exam-ready configuration and troubleshooting practice.
Included with a subscription
Branch staff cannot work: no workstation on the user LAN holds an address. By design, clients there lease from the hub router's scope and the two sites route to each other statically. Find why no lease arrives; change nothing else.
A regional retailer's branch lost core access after last night's maintenance window. Users reach their gateway and the routers ping across the transit, but no OSPF neighbour appears and the branch LAN is missing from the core's table. The documented design is OSPF process 1, area 0 on both routers. Restore the adjacency without changing addressing or adding static routes.
A campus triangle of one distribution and two access switches carries VLAN 10 and VLAN 20. After an access-switch replacement, users report slower cross-campus response: hosts still reach each other, and the layer 2 path no longer matches a design that roots both VLANs at SW-CAMPUS-DIST1.
Your team supports a small campus access layer: two switches, one 802.1Q trunk. The help desk reports VLAN 20 users cannot reach their peers while VLAN 10 users can, and both ends read up and trunking. Campus design: VLANs 10 and 20 are the only VLANs any trunk carries; every trunk's native VLAN is 999.
Free with an account
Build an enterprise-clean dual-stack site end-to-end. IPv4 is complete and forwarding on day start; you will deploy IPv6 across the same topology. Enable IPv6 routing, assign prefixes, bring up OSPFv3 with explicit router-ids, keep the access LAN autoconfiguring via SLAAC with stateless DHCPv6 for DNS, and enforce an IPv6 ACL to allow one client flow to the server while denying another. Verify from the hosts and troubleshoot like a real operator.
A dual-stack enterprise tri-router line with two LANs and end hosts. IPv4 routing is healthy and end-to-end; IPv6 addressing is present but end-to-end IPv6 fails. Work from operational state only to isolate and correct the broken IPv6 control/forwarding plane without changing what already works. The graded end-state requires IPv6 forwarding enabled on all routers, OSPFv3 process 10 in area 0 with an explicit unique router-id on every router, and per-interface activation on all required links so the hosts can ping6 across the WAN.
Harden a dual-stack access segment with IPv6 RA Guard so only the legitimate router can advertise a default gateway. You will start from a working IPv4 baseline with IPv6 SLAAC enabled, then implement and verify RA Guard on the access switch. The solution must keep end-to-end IPv4/IPv6 reachability while blocking rogue Router Advertisements from a malicious host.
Build a dual-stack branch-to-datacenter topology with IPv6 static routing in place. Implement a named IPv6 ACL on the server-facing interface that permits an approved client while denying an unapproved source, and explicitly permits Neighbor Discovery (ND) so the LAN continues to function. Verify that the allowed source can reach the server over IPv6 while the unapproved source fails, without disrupting IPv6 neighbor resolution.
Deploy a stateless DHCPv6 service on a remote router and relay client Information-Requests from a branch LAN across a routed core to that server. IPv4 is already fully functional; your job is to build the IPv6 DHCPv6 relay path and confirm clients receive DNS/domain options while keeping IPv6 addressing via SLAAC.
Build a compact branch LAN where IPv6 hosts already form SLAAC addresses from router advertisements, then add stateless DHCPv6 to supply DNS server and domain-name. You will keep SLAAC for addressing, flip the RA 'other-config' flag so hosts know to ask, and bind an IPv6 DHCP pool with DNS options to the user LAN. IPv4 is prebuilt as a baseline and must keep forwarding. Verify from hosts and the router’s IPv6 DHCP/ND views.
Build a compact dual-stack enterprise topology where IPv4 is already forwarding end-to-end using OSPFv2. Your task is to bring up IPv6 routing in parallel using OSPFv3 with explicit router-ids, proving that IPv6 control/data planes operate independently from IPv4. Verify both protocols resolve separately and that an IPv4 control-plane failure does not impact IPv6 forwarding.
Daily CCNA IPv6 lab: build OSPFv3 across a three-router triangle with dual-stack links and real end hosts. IPv4 OSPFv2 is pre-built and forwarding end-to-end as the baseline. Your tasks: bring R3 into OSPFv3 with an explicit router-id and enable it per-interface, activate OSPFv3 on R1’s R3-facing interface, then steer the preferred IPv6 path by adjusting interface cost. Verify neighbor state, routes, and end-to-end IPv6 reachability from host to host.
Deploy single-area OSPFv3 between two routers so IPv6 LANs reach end-to-end. The IPv4 side is already forwarding with static routes. Your job: enable OSPFv3 with explicit router-ids and activate it per-interface on both the transit and LAN links, then verify the neighbor forms over link-local and routes are learned.
Build a compact branch-to-edge topology that is dual-stack for IPv4 and intentionally incomplete for IPv6. IPv4 is fully working as a baseline. Your job: enable IPv6 forwarding on both routers, replace specific IPv6 routes at the branch with a single default (::/0) toward the edge, and add a specific IPv6 return route on the edge back to the branch LAN. Verify the branch host reaches the edge-side resources over IPv6 while the IPv4 plane remains stable.
Dual-stack enterprise lab with two routers, a shared access switch, and two hosts in separate VLANs. IPv4 is fully working via static routes in the starter. Your task is to add IPv6 static routes on both routers so the clients can communicate end-to-end over IPv6. Learn why a link-local next hop on a point-to-point link requires specifying the exit interface.
Single-site IPv4/IPv6 lab where IPv4 is already working. You will enable IPv6 routing on the router and place a single /64 on the user LAN so two hosts autoconfigure via SLAAC. Then verify each host’s chosen IPv6 address and the learned default route via the router’s link-local address, and test end-to-end IPv6 connectivity.
A focused, enterprise-clean IPv6 day in a progressive CCNA series. You will enable IPv6 on a single user LAN, assign a deterministic link-local gateway, and observe Neighbor Discovery (ND) in action. IPv4 is already working; your job is to turn on IPv6 unicast routing, add a global unicast /64 to the gateway interface, and set an explicit link-local address so hosts learn a predictable next-hop. You will verify SLAAC-derived host addresses, default routes learned via RA, and ND neighbor tables on the router, and then test by pinging both the router’s link-local and global addresses from the hosts.
Bring IPv6 up alongside the already-working IPv4 baseline. You will enable IPv6 unicast routing on both routers, put a unique 2001:db8::/64 on each site LAN, put a /127 on the router-to-router transit, and address the dual-homed workstation on both of the LANs it is plugged into plus its IPv6 default route. Verify that IPv6 reaches both on-link gateways and, through the default route, the near router's transit address — while the far router's transit address stays unreachable over IPv6 and reachable over IPv4, because no IPv6 routing between the sites exists yet.
Bring together core campus redundancy skills in one focused day: elect a deterministic STP root on the intended distribution switch, form a working LACP EtherChannel between distribution and access, harden edge with PortFast/BPDU Guard, and stand up an HSRP virtual gateway that the VLAN 10 users actually use. The starter is intentionally mis-tuned across layers so you must build or repair it end-to-end.
Build gateway resiliency on a campus user LAN using VRRP between two edge routers. You will configure a VRRP group with a shared virtual IP, set a higher priority on the intended master, and prove failover from the end hosts without changing the default gateway. Includes full SSH management on routers, a clean L2 access switch, and two clients using the VRRP VIP.
Daily CCNA campus-redundancy lab focusing on HSRP preemption and interface tracking. You will refine an already-working HSRP default gateway so it follows real network health: fail to the standby when the preferred router loses its upstream, and preempt back when it recovers. The topology is an enterprise-clean small site with two distribution routers sharing a user VLAN through a Layer-2 access switch, each with its own point-to-point uplink to a core router. The starter works in steady state but suffers a blackhole during uplink failures and never reclaims Active without preemption. Your job is to add preempt and tracking on the correct router/interface and verify end-to-end forwarding under failover and failback.
Stand up HSRP on two routers sharing a single user VLAN so campus hosts point to a resilient virtual default gateway. You will configure HSRP on both routers, make one router the active forwarder, and verify failover from the end hosts.
Troubleshoot and fix an LACP EtherChannel between campus switches so both physical members bundle and the trunk reliably carries VLAN 10. Two independent faults are seeded: an intra-bundle trunk mismatch on one switch and an administratively down member on the other. Learners diagnose with show commands, align trunk attributes, and verify end-to-end host reachability.
Daily CCNA campus-redundancy lab focused on EtherChannel scale-out and hashing. Two distribution switches are joined by three parallel trunk links. Two links are already bundled with LACP into a trunking port-channel; the third is a plain trunk currently STP-blocked and wasting capacity. Add the spare link to the existing bundle on both sides and change the global hashing method so multiple flows can actually use multiple member links. End-to-end switching must continue to work for the users VLAN.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, see today's daily lab, or follow the CCNA study path.