CCNA certification labs — Page 3

Enable Secret and Password Encryption on R1

Harden privileged access on a single IOS router by configuring a hashed enable secret, creating a local admin user with privilege 15 and a secret, and enabling service password-encryption. Verify that privileged access requires the secret and that the running-config contains no cleartext passwords.

AAA Named Method Lists with Fallback (VTY vs Console)

Harden a single Cisco IOS router’s management plane using AAA named method lists applied per-line. Create VTY-AUTH (local then enable) to protect remote SSH access without lockout risk, and CONSOLE-AUTH (local only) to secure the console independently. Verify using show/run sections and test SSH from the ADMIN workstation.

CCNA: Console and VTY Line Hardening

Harden the console and VTY lines on a single Cisco IOS router so idle sessions close automatically and every access path requires authentication. You will configure login local on both console and VTY, set 5-minute exec timeouts, enable logging synchronous on the console, and restrict VTY to SSH. Verification uses show outputs; grading evaluates the deterministic running-config.

SSH-Only Management: Disabling Telnet on R1

Harden a Cisco IOS router so remote management is allowed only via SSH. You will remove Telnet from the VTY lines, keep local authentication, and add an idle-session timeout. Verify success from a Linux ADMIN host by confirming SSH works and Telnet is refused.

Privilege Levels for Tiered CLI Access

Harden a single IOS router’s management plane and create tiered CLI access using custom privilege levels. Build two local accounts: a full admin (level 15) and a junior operator (level 5). Elevate only specific exec commands to level 5 so the operator can run them without gaining full configuration rights. Verify behavior from a Linux admin workstation over SSH.

AAA Authentication with a Local User Database

Harden R1’s management plane by moving SSH login authentication and exec authorization under the IOS AAA framework using the local user database. You will start from a secure SSH-only baseline that still uses login local, enable aaa new-model, define default AAA methods that point at local, and bind VTY lines to AAA. Success is proven by authenticating from the ADMIN host over SSH and landing at the user’s privilege level.

CCNA: SSH Access Fundamentals on R1

Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.

Secure-Access Troubleshooting Capstone: SSH VTY Fix

Advanced CCNP management-plane troubleshooting on a single IOS router. You inherit a pre-broken remote-management config where SSH access is completely failing despite a hostname, domain name, and local admin user. Two independent VTY faults are seeded: the wrong transport and an incorrect login method. Your job is to diagnose with show commands, fix both issues, and validate SSH access from the ADMIN workstation.

CCNA Day 7: Layer 3 Static Routing Capstone

Build a realistic two-site branch topology with two edge routers linked over a /30 WAN and two isolated LANs on a shared L2 access switch. Configure static routes plus a default route at each edge so both LANs reach each other bidirectionally. Verify end-to-end from hosts and use show commands to confirm the routing tables.

Archive preview only

EIGRP Wildcard Masks: Enabling the Right Interfaces

Build a two-router, two-LAN EIGRP domain and practice precise wildcard-masked network statements so only the intended interfaces participate. R1 has an extra LAN on Ethernet0/2 (172.16.99.0/24) that must be excluded from EIGRP. Validate with show commands and end-host pings that the correct LANs are exchanged and the excluded LAN is not advertised.

EIGRP Metric: Steering Paths by Tuning Delay

Tune EIGRP path selection by manipulating cumulative delay. Three routers (R1-R2-R3) form EIGRP 100 adjacencies over three /30 point-to-point links. R3 originates 192.168.30.0/24 on Loopback0. You will enable EIGRP and then increase delay on R1’s direct link to R3 so R1 prefers the indirect path via R2 to reach 192.168.30.0/24. Two Alpine hosts validate end-to-end reachability and path choice.

EIGRP Fundamentals: First Adjacency & Route Exchange

Bring up EIGRP in AS 100 between two routers over a /30 transit and advertise a single LAN. Verify the first adjacency forms and that R2 learns R1's LAN via EIGRP. Includes realistic end hosts on a shared LAN for path testing.