247 hands-on CCNA scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Aligned to the CCNA certification track — exam-ready configuration and troubleshooting practice.
Included with a subscription
Migrate a single-subnet LAN from HSRP version 1 assumptions to HSRP version 2, enabling group numbers above 255. Configure HSRPv2 on two routers that share one virtual default gateway IP so hosts retain gateway resilience without reconfiguration.
Implement two HSRP groups on a single VLAN so each router is Active for one group and Standby for the other. Two hosts split default gateways across the two virtual IPs for deterministic load-sharing with redundancy.
Configure HSRP on two routers with a shared virtual gateway and speed up failover by tightening hello/hold timers to 1/3 seconds. Validate deterministic active/standby selection and confirm timer settings via show commands.
Advanced CCNP troubleshooting lab: a pair of Layer-2 switches are connected by a two-link EtherChannel intended to carry VLAN 90 between access hosts. The starter configuration ships broken on purpose: the inter-switch bundle won’t form due to incompatible aggregation modes, and a trunk allow-list drift on one side prunes VLAN 90. Diagnose with IOS show commands, correct the EtherChannel mode so LACP forms the Port-channel, and restore trunk policy so same-VLAN hosts can communicate.
Advanced EtherChannel capstone, run as a fault hunt. The uplink bundle between two access switches is not passing traffic and the hosts either side cannot reach each other. Some members are up, the bundle is not, and nothing was recorded. You get symptoms and the required end state — no fault list. Both ends of a bundle have to agree about several things at once, and only one end was touched during the change — so comparing them is the exercise.
Build a two-link LACP EtherChannel between SW1 and SW2 and convert the Port-channel into an 802.1Q trunk that explicitly carries VLANs 40 and 41. Validate end-to-end host reachability across VLAN 40 and confirm the trunk’s allowed VLAN list and switchport mode on the logical port-channel. Emphasis: deterministic EtherChannel configuration on member interfaces, correct trunking on the Port-channel, and verification with IOS show commands.
Beginner CCNA lab that builds a static Layer-2 EtherChannel (mode on) between two ioll2-xe switches using two parallel links as members of Port-channel1. The Port-channel is configured as an access port in VLAN 10 so that two hosts, one on each switch, can communicate without spanning-tree blocking a parallel path. Learners deploy and verify the bundle, then validate end-to-end host connectivity.
Free with an account
Build a Layer-2 PAgP EtherChannel between two ioll2-xe switches (SW1 and SW2) using a desirable/auto pairing on two parallel links. Bundle Ethernet0/0 and Ethernet0/1 into Port-channel 3, make the port-channel a VLAN 30 access interface on both switches, and verify with show etherchannel summary, show pagp neighbor, show pagp counters, and end-to-end host pings in VLAN 30.
Build a two-link LACP EtherChannel between two layer-2 switches as an access port for VLAN 60, then tune the global load-balancing algorithm to src-dst-ip so traffic distributes more evenly. Verify Po6 status, the hashing method, and end-to-end host reachability.
Build a two-link LACP EtherChannel between SW1 and SW2 using an active/passive pairing. The logical Port-channel2 carries VLAN 20 as an access link so two hosts on opposite switches can communicate. Verify with show etherchannel summary, show lacp neighbor, and host-to-host pings.
Build an LACP Layer-2 EtherChannel between SW1 and SW2 so Rapid-PVST+ treats two parallel links as one logical Port-channel 7. Without EtherChannel, STP will block one of the two access links. With LACP active on both members and Port-channel 7 as an access port in VLAN 70, STP shows a single forwarding interface (Po7) and both physical links forward as one logical channel. Two hosts in VLAN 70 verify end-to-end connectivity.
Build a Layer-3 EtherChannel between two IOS XE routers using LACP active/active. Two parallel router links are bundled into Port-channel5, which carries a /30 transit. R2 hosts a loopback; R1 installs a static route to reach it. Validate that the Port-channel holds the IP (members do not), that the bundle is up and uses both links, and that pings across the /30 and to the loopback succeed. Emphasis: deterministic EtherChannel configuration and Layer-3 port-channel practices.
Build a routed LACP EtherChannel (Port-channel 8) between two iol-xe routers and route real inter-LAN traffic using static routes. Two parallel physical links (Ethernet0/0 and Ethernet0/1) on each router are bundled into a single Layer-3 Port-channel with a /30 transit. Each router serves a local /24 LAN with an alpine host. Validate that Po8 is up/up, static routes are present, and end-to-end host pings succeed across the aggregated uplink.
Hands-on IOS DHCP server practice focused on validating pool state, inspecting conflicts, and fixing a real address conflict caused by a legacy static host on the LAN. You will verify server-side leases and exclusions, observe a conflict entry, then permanently exclude the static IP and clear the stale conflict so a client can obtain a clean address.
Beginner CCNA lab on a redundant two-switch Layer-2 loop with two parallel uplinks. You will enable Rapid-PVST+, set a deterministic root-bridge priority so SW1 becomes the root for VLAN 1, and verify port roles (root/designated/alternate) and loop prevention. Two Alpine hosts in VLAN 1 validate end-to-end connectivity without any routing or SVIs.
Free with an account
Guide Rapid-PVST+ to prefer a specific parallel trunk by tuning the sender’s port priority on the root bridge. Two ioll2-xe switches (SW1, SW2) form a physical loop via two equal-speed trunks. A third L2 switch (SW3) extends the user VLAN to a second closet. One Alpine host attaches to SW1 and another to SW3 in VLAN 40 (10.1.40.0/24). You will: force SW1 to be the root for VLAN 40, lower the port priority on SW1’s Gi0/2 (Ethernet0/1) to break the tie so SW2 selects its Gi0/2 as the Root Port, enable PortFast and BPDU Guard on host-facing ports, and verify with show spanning-tree outputs and host pings.
Continue the STP series on a three-switch triangle with a real loop. SW1 is the deterministic root for VLAN 60, and access ports already use PortFast. In this lab you will harden the edge by enabling BPDU Guard on the two host-facing access ports on SW2 and SW3, while leaving the inter-switch trunks untouched. Verify with show commands that BPDU Guard is active only on the edge and that hosts still communicate normally.
Migrate a three-switch triangle from legacy PVST to Rapid-PVST+ without changing the existing root or blocked port. SW1 remains the deterministic root for VLAN 70 (priority 4096). Verify protocol mode, link types (point-to-point vs edge), and end-to-end host reachability, then observe the faster reconvergence behavior of Rapid-PVST+.
Advanced Rapid-PVST+ and Root Guard implementation on a three-switch triangle with a real loop. SW1 is the intentional root for VLAN 90 and protects its designated ports with Root Guard to prevent root re-parenting. Two Alpine hosts on VLAN 90 verify end-to-end forwarding remains stable even if a superior BPDU appears downstream.
Advanced Rapid-PVST+ troubleshooting on a 3-switch triangle with a real Layer-2 loop. Two deliberate faults are seeded: an unintended root bridge wins VLAN 100 due to a mis-set/default priority, and PortFast/BPDU Guard are mistakenly applied on an inter-switch trunk. Two Alpine hosts in VLAN 100 verify user impact. Your job: use show commands to diagnose, then restore the correct root and remove edge features from the trunk while preserving them on access ports.
Use Rapid-PVST+ to elect different root bridges per VLAN across two parallel trunks, spreading VLAN 80 and VLAN 81 across distinct physical links without modifying path cost or port priority. Validate independent per-VLAN trees and confirm hosts in VLAN 80 can communicate over the surviving path. Includes a drift-check to diagnose/restore trunk allow-lists.
Beginner CCNA STP lab on a three-switch triangle with two hosts in VLAN 20. You will deliberately control the Spanning Tree root election using the root primary/secondary macros so SW1 is the active root and SW2 is the standby. The baseline already provides VLANs and trunks; your job is to set root priorities deterministically and verify the resulting roles and port states without introducing any Layer-3.
Configure PortFast correctly on access ports in a triangle switch loop while maintaining normal STP protection on inter-switch trunks. Force SW1 as the root for VLAN 50 and verify that only edge ports are fast-tracked. Observe the difference in host convergence with and without PortFast.
Engineer which trunk forwards by tuning STP path cost in a 3-switch triangle. Force SW1 as the VLAN 30 root at a deterministic priority, enable Rapid-PVST+, harden edge ports with PortFast and BPDU Guard, and raise the STP cost on SW3’s direct uplink to SW1 so SW3 prefers the longer, indirect path via SW2. Verify the resulting root port, alternate (blocked) port, and host reachability across the chosen path.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.