CCNA labs — hands-on Cisco practice — Page 8

dot1Q Subinterfaces: The Router Side

Practice creating 802.1Q subinterfaces on a single router uplink to deliver inter-VLAN routing using router-on-a-stick. The Layer-2 switch is already fully configured with VLAN 10 and VLAN 20, access ports for two hosts, and a working 802.1Q trunk to the router. Your job: leave the router's physical Ethernet0/0 unnumbered and add exactly two subinterfaces with the correct encapsulation tags and gateway IPs so hosts can reach their gateways and each other.

CCNA35 min4 objectives

Router-on-a-Stick Troubleshooting Capstone

Advanced CCNA capstone: diagnose and repair a fully-broken three-VLAN router-on-a-stick deployment. One iol-xe router uplinks by 802.1Q trunk to a pure layer-2 ioll2-xe switch, with three alpine PCs on their own access VLANs (10 Sales, 20 Voice, 30 CCTV); after a recent switch and router change, inter-VLAN connectivity is broken or intermittent across all three VLANs. Trace VLAN intent end-to-end from each host through the trunk to the router's subinterfaces, repair whatever faults you find, and verify with end-host pings/traceroutes and IOS show commands.

CCNA68 min5 objectives

Diagnosing a Broken Router-on-a-Stick

Advanced CCNA troubleshooting lab on a router-on-a-stick design. VLAN 10 users can reach their gateway and other hosts, but VLAN 20 users cannot reach their gateway or any resources in VLAN 10. Methodically trace L2/L3 intent end-to-end - from the access ports through the trunks up to the router subinterfaces - to isolate the first-hop failure and implement fixes that restore inter-VLAN routing while maintaining enterprise trunk hardening and clean configurations.

CCNA60 min5 objectives

Scaling to Three VLANs: Adding a Department

Extend a working two-VLAN router-on-a-stick design to a third VLAN (Guest) without breaking Sales and Engineering. Add one router subinterface, one switch VLAN + access port, and update the switch trunk’s allowed-VLAN list safely using 'add' so existing VLANs remain transported.

CCNA55 min5 objectives

Native VLAN on a Router-on-a-Stick Trunk

Build and verify inter-VLAN routing using router-on-a-stick with a native (untagged) VLAN on the trunk. Configure one router (subinterfaces only), one Layer-2 access switch (VLANs, access ports, and a single 802.1Q trunk), and two end hosts in different VLANs. The management VLAN 99 rides untagged as the trunk's native VLAN, so the router subinterface must use 'encapsulation dot1Q 99 native' and the switch trunk must match 'switchport trunk native vlan 99'. Verify from Linux hosts and IOS 'show' commands, then practice troubleshooting common native-VLAN faults.

CCNA50 min4 objectives

Multi-Dept Campus Inter-VLAN with Router-on-a-Stick

Design and implement a three-department campus edge using a single router-on-a-stick to provide inter-VLAN routing for Sales (VLAN 10), Engineering (VLAN 20), and Servers (VLAN 30). Map the addressing plan directly to router subinterfaces and build an 802.1Q trunk on the access switch. Verify end-to-end reachability and troubleshoot an allow-list drift scenario.

CCNA55 min5 objectives

Router-on-a-Stick Fundamentals: Two VLANs, One Trunk

Configure inter-VLAN routing using router-on-a-stick with one router, one Layer-2 switch, and two hosts. Build VLAN 10 and VLAN 20, trunk the router uplink, create subinterfaces for each VLAN, and verify that hosts can now reach each other across VLANs.

CCNA45 min5 objectives

Free with an account

Switch Trunk and Access Ports for Router-on-a-Stick

Configure the Layer-2 switch side of a router-on-a-stick design. A single IOS router already provides inter-VLAN routing on Ethernet0/0.10 (10.0.10.1/24) and Ethernet0/0.20 (10.0.20.1/24). Bring up VLAN transport by creating VLANs on the switch, assigning host access ports, and converting the router-facing link into an 802.1Q trunk that carries VLANs 10 and 20. Validate with show commands on the switch and with cross-VLAN pings from the hosts.

CCNA30 min4 objectives

Selective Inter-VLAN Reachability: Guest Isolation

Build a router-on-a-stick design with three VLANs (SALES, HR, GUEST) on a single router and single access switch, then enforce guest isolation using a single extended ACL applied inbound on the Guest subinterface. SALES and HR can reach each other; GUEST can reach only its default gateway and is blocked from internal subnets. The lab focuses on correct 802.1Q tagging, trunking, access port assignments, ACL placement/order, and end-host verification.

CCNA55 min5 objectives

Three-VLAN Router-on-a-Stick: Build, Harden & Verify

Build and verify a three-VLAN router-on-a-stick design: one IOS router provides inter-VLAN routing via 802.1Q subinterfaces to a single Layer-2 access switch, with three Alpine hosts in VLANs 10, 20, and 30. The starter environment does not yet forward traffic correctly between all three VLANs, so you will apply a disciplined router-switch-host verification method to diagnose and fix the problem, then briefly break and restore one VLAN's connectivity before finishing with an enterprise-clean, hardened trunk.

CCNA68 min5 objectives

CCNA Port Security 1: Enable & Verify on Access Ports

Hands-on fundamentals with Cisco port security on host-facing access ports. Build a small two-switch campus with a trunk, place two Linux hosts in the same user VLAN, then enable port security with the explicit defaults (maximum 1, violation shutdown) on both host ports. Verify secure-up state and baseline host connectivity.

CCNA40 min4 objectives

Free with an account

802.1Q Trunking Troubleshooting Capstone

Advanced CCNA switching capstone centered on restoring end-to-end VLAN 20 transport across three Layer-2 switches using 802.1Q trunks. The starter ships intentionally broken: after a simulated maintenance window, two Alpine hosts in VLAN 20 can no longer reach each other across the inter-switch trunks. Learners diagnose with show interfaces trunk, show interfaces switchport, and show vlan brief, then identify and correct the trunking faults in the right order and verify with host pings.

CCNA55 min5 objectives

A Policy-Correct Multi-VLAN Trunk

Build a single 802.1Q trunk between two Layer-2 switches that correctly carries three VLANs with an explicit allow-list and a dedicated non-default native VLAN. Place hosts in Users (VLAN 10) across both switches and a server in Servers (VLAN 20). Verify that the trunk allows VLANs 10, 20, and 99, that the native VLAN matches on both ends, and that same-VLAN hosts communicate across the trunk. Then intentionally break and restore the configuration to practice troubleshooting trunk allow-lists, native VLAN alignment, and host VLAN placement.

CCNA47 min5 objectives

CCNA: Pruning the Allowed VLAN List on Trunks

Hands-on CCNA lab focusing on 802.1Q trunk allow-lists. Build a realistic three-switch campus with two user hosts in VLAN 10. First bring up trunks carrying all VLANs by default, then implement an explicit allowed VLAN list and prune a non-used VLAN. Intentionally remove VLAN 10 from one trunk to observe an outage, verify with Linux pings and IOS show commands, and restore service by fixing the allow-list. Reinforce native VLAN alignment and compare default vs explicit trunk policy.

CCNA48 min5 objectives

CCNA Capstone: Port Security Troubleshooting

Advanced CCNA port-security troubleshooting on a pure Layer-2 design. Two access switches linked by an 802.1Q trunk carry a Users VLAN across closets. Three Alpine Linux hosts are pre-addressed. The lab is intentionally shipped with multiple classic faults: one access port is err-disabled due to a prior port-security shutdown, one user-facing port lacks port-security altogether, another has the wrong violation mode and an overly restrictive maximum, and one port has an incorrect static secure-MAC configured. Your job is to diagnose using show commands, restore connectivity, and implement the intended security posture with sticky MACs, the correct maximum, the proper violation mode, and errdisable auto-recovery—without placing port-security on the trunk.

CCNA55 min6 objectives

CCNA Port Security: Maximum Secure MACs on Access Ports

Deploy and verify port security maximum settings on host-facing access ports in a pure Layer-2 campus with two access switches uplinked to a distribution switch. You will raise the allowed secure MAC count to 2 on each user port to support a PC and a potential downstream device (e.g., a dock), then verify with show commands. No Layer-3, SVIs, or routing are used; focus purely on access VLANs, trunks, and the port-security maximum behavior.

CCNA45 min4 objectives

Extended ACL: Application Filtering at a Hardened Edge

Build a 5-node edge/DMZ topology. Implement a named extended ACL on the EDGE router to allow only TCP/80, TCP/443, and ICMP echo from the Inside LAN to a DMZ web server, deny all other traffic to that server with logging, and still permit general traffic elsewhere. Apply the ACL inbound on the EDGE inside LAN interface. Harden router SSH management with a standard ACL. Verify with wget, ping, and an intentionally denied SSH attempt that increments the deny log counter.

CCNA55 min5 objectives

OSPFv2 Multi-Area with ABR Summarization (Redundant Core)

Deploy a 5-node OSPFv2 lab featuring a redundant area 0 triangle (R1–R2–R3) and an ABR (R3) connecting to area 1 with branch networks on R4. A client on R1’s area 0 LAN validates reachability to branch loopback networks summarized by the ABR. You will set explicit router-ids from Loopback0, use passive-interface default, advertise R4’s loopbacks as /24s using ip ospf network point-to-point, and summarize area 1 into a /23 on the ABR. Verify FULL adjacencies, a single O IA summary on R1, and end-to-end connectivity. Troubleshoot an introduced area mismatch and interface/addressing issues.

CCNA & CCNP80 min7 objectives

CCNA Static Routing: Redundant Branch Triangle

Build a 3-router triangle with two branch LANs and real Alpine clients. Deploy primary static routes via the hub and floating backup statics over a direct branch-to-branch link. Verify reachability, path selection, and failover by simulating a hub outage.

CCNA65 min5 objectives

Port Security: Err-Disable Auto Recovery

Configure port security in shutdown mode on host-facing access ports and enable automatic errdisable recovery for psecure-violation. The lab uses two Layer-2 switches connected by a trunk and three Linux hosts in the same VLAN to validate baseline L2 connectivity. You will deploy and verify the global errdisable recovery timer and cause while keeping the trunk healthy. Focus is on deterministic configuration and verification via show commands rather than attempting to trigger live violations.

CCNA45 min4 objectives

CCNA Port Security: Violation Protect vs Restrict

Deploy and compare the two non-disabling port-security violation modes on host-facing access ports. Build a small Layer-2 topology with a trunk between two switches and same-VLAN hosts. Configure violation protect on one access port and restrict on another using deterministic sticky MAC entries. Validate baseline reachability, then observe the different behaviors: protect silently drops with no counter/logs; restrict drops and increments the violation counter.

CCNA45 min4 objectives

802.1Q Trunk Fundamentals: Static Trunk and VLANs

Build a static 802.1Q trunk between two Layer-2 switches to carry VLANs 10 and 20. Map hosts to access ports, verify trunk encapsulation and allowed VLANs, demonstrate same-VLAN reachability across the trunk, and confirm inter-VLAN isolation. Then simulate an allow-list drift fault, diagnose with show commands, and restore service.

CCNA45 min5 objectives

Free with an account

CCNA Port Security 2: Sticky Secure MAC Learning

Two access-layer switches have a VLAN 20 connectivity problem: users in one wiring closet cannot reach users in the other. Diagnose and repair the issue, then deploy sticky secure MAC learning on the host-facing access ports so each port dynamically learns and persists its connected host's MAC. Verify sticky entries in show commands and confirm same-VLAN host connectivity end-to-end.

CCNA45 min4 objectives

Port Security: Static Secure MAC Binding

Troubleshoot a Layer-2 forwarding fault that breaks a user VLAN between access/distribution switches, then implement static secure MAC binding on the client-facing access port. You will restore end-to-end VLAN 20 reachability and enforce a single authorized MAC on the user port using port-security with violation restrict.

CCNA55 min5 objectives