Build Foundational ~3m
Set hostname and enable secret
Rename a router to EDGE-1 and set an encrypted enable secret. Basic device hardening.
Hands-on CLI 25 build 26 fix
CCNA CLI labs: configure and troubleshoot
The real CCNA 200-301 lab section asks you to build a config from a topology and fix a broken network under time pressure. Each lab below does one of those on real Cisco IOS syntax, objectives grade live as you type.
Build. Start from a blank/partial device and configure to spec
Fix, diagnose one realistic fault on a broken network
Router console, free-play open →
Router> enable
Router# conf t
Router(config)# hostname R1
R1(config)# interface gi0/0
R1(config-if)# ip address 10.0.0.1 255.255.255.0
R1(config-if)# no shutdown
*Jul 19 10:00:00: %LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up
Try it live, open the free-play Cisco console open →
Or pick any lab below. Each opens its own graded live console.
Filter:
Network Fundamentals
4 labs
Build Foundational ~3m
Save the running config to NVRAM
Rename Router to CORE-1 + copy running-config startup-config so the change survives a reload.
Build Foundational ~4m
Assign an IP to a router interface
One router, one interface. Bring the link up, assign 10.0.0.1/24, confirm with show ip interface brief.
Build Foundational ~4m
IPv6 basics: address an interface
Enable ipv6 unicast-routing globally + assign 2001:db8::1/64 to Gi0/0.
Network Access
12 labs
Build Foundational ~5m
Harden a switchport with port-security
Lock Fa0/1 to a single MAC via sticky learning, err-disable on violation.
Build Foundational ~5m
Create VLAN 99 (MANAGEMENT) and put Fa0/24 in it
Segment out a dedicated management VLAN on SW1. Create VLAN 99, name it MANAGEMENT, then move access port Fa0/24 into it. A common first-day switch-hardening move.
Build Foundational ~6m
Create a VLAN, assign an access port
One switch, VLAN 10 named Engineering, Fa0/1 as access port. Verify with show vlan brief.
Build Intermediate ~5m
Force SW1 to be the STP root
Two switches, matching default priorities. Configure SW1 to win the root bridge election for VLAN 1.
Build Intermediate ~6m
Bundle two links with LACP
SW1 <-> SW2 have TWO cables. Form channel-group 1 with LACP active/active on both sides.
Fix Intermediate ~6m
EtherChannel bundle never forms
Two switches share four cables that are meant to bundle into one Port-channel, but STP is still blocking three of them and show etherchannel summary reports the bundle down. Find the mismatch and bring the channel up.
Fix Intermediate ~6m
VLAN 10 and VLAN 20 hosts can’t reach each other
Router-on-a-stick is configured but VLAN 10 hosts can’t ping VLAN 20 (or vice versa). Find the missing piece, the answer isn’t always the router, and the show commands here are the same ones you’ll use on the real exam.
Fix Intermediate ~6m
STP elected the wrong root bridge
A budget access switch ended up as the root of the spanning-tree instead of the distribution switch. Traffic hairpins the wrong way. Fix the topology so the designated root sits where you want it.
Fix Intermediate ~6m
A VLAN won’t cross the trunk
VLAN 20 hosts can’t reach the other switch even though VLAN 10 works across the same trunk. Find why VLAN 20 isn’t crossing and restore connectivity.
Build Intermediate ~8m
Two switches, one VLAN, one trunk
Multi-device. SW1 and SW2 both host VLAN 10. Configure access ports + an 802.1Q trunk.
Fix Intermediate ~12m
Inter-VLAN routing broken on a Layer 3 switch
Users in VLAN 10 and VLAN 20 cannot reach each other through the core Layer 3 switch. Fix IP routing, a shut SVI and a trunk that blocks VLAN 20 toward the access switch.
Fix Intermediate ~12m
Storm control: cap broadcasts on access ports and recover err-disabled
A chatty IoT sensor is sending a broadcast flood that is saturating VLAN 20. Enable storm-control for broadcast at 1 percent on the access ports, set the action to err-disable, and configure auto-recovery so a single flood does not require a manual reset. Verify the running config and the recovery timer.
IP Connectivity
13 labs
Build Foundational ~3m
Add a default route
Install a static default route pointing at 10.0.0.2 and see Gateway of last resort appear.
Build Foundational ~5m
Add a static route
Install a static route to 10.5.0.0/24 via 10.0.0.2. Verify with show ip route.
Fix Intermediate ~6m
HSRP failover never happens
Two routers share a virtual gateway with HSRP, but when the active router’s uplink fails, the standby never takes over and clients lose connectivity. Diagnose HSRP + interface tracking and make failover work.
Fix Intermediate ~6m
OSPF neighbor never comes up
R1 and R2 should be OSPF neighbors on the link between them, but on R2 the neighbor table is empty and the two LANs can’t reach each other. Diagnose R2 with the show commands and bring the adjacency to FULL. There’s more than one valid fix.
Fix Intermediate ~6m
Multi-area OSPF: area 1 can’t reach area 0
An ABR should be gluing area 1 to the backbone (area 0), but LSA Type 3 inter-area routes never show up on the far side. Investigate the ABR, find the misconfig, and get inter-area routes flowing.
Fix Intermediate ~6m
A remote LAN is unreachable: static route missing
A branch office LAN is completely unreachable from HQ. The show route table on HQ tells the whole story. Add the correct static route, and be careful with the next-hop.
Build Intermediate ~7m
Inter-VLAN routing with SVIs
L3 switch: enable ip routing + create SVIs for VLAN 10 and VLAN 20.
Build Intermediate ~10m
Two routers, static routes, ping across
Multi-device. R1 and R2 share a link; add static routes both ways and ping across.
Build Intermediate ~12m
Bring up OSPF on a 3-router triangle
3-device. Configure OSPF area 0 on R1/R2/R3, watch neighbors reach Full, ping across via O routes.
Fix Intermediate ~15m
HSRP pair: wrong active router and no failover
Two gateway routers share 10.0.10.1 with HSRP, but they are not even in the same group, the wrong router is active and an uplink failure would not move the gateway. Fix all four settings.
Fix Intermediate ~15m
OSPF triangle: two neighbors missing and a loopback not advertised
Three routers in an OSPF triangle, but only R1 and R2 are neighbors and R3 cannot reach R1’s loopback. Find the area mismatch, the passive interface and the missing network statement.
Fix Intermediate ~15m
OSPFv3 triangle: an IPv6 network with no neighbors
Three IPv6 only routers run OSPFv3, yet not one neighbor is up. Find the missing router ID, the passive transit link and the area mismatch, then ping R3’s loopback.
Fix Intermediate ~15m
Branch LAN unreachable across three routers: fix the static routes
HQ cannot reach the branch LAN two hops away, and the branch cannot answer. Fix a wrong next hop, a missing transit route and a missing return route across three routers.
IP Services
9 labs
Build Foundational ~6m
Configure a DHCP server pool
Create pool LAN handing out 192.168.1.0/24, gateway .1, DNS 8.8.8.8, first ten addresses excluded.
Fix Intermediate ~6m
Clients aren’t getting an IP from the DHCP server
A DHCP server is running for a remote VLAN, but PCs on that VLAN keep landing on APIPA (169.254.x). Find what’s missing: most CCNA candidates get this exact scenario in production within their first year.
Fix Intermediate ~6m
The LAN can’t reach the internet
PAT is configured but inside hosts still can’t reach the internet and nothing is being translated. Investigate the NAT setup, find what’s incomplete, and get translations forming.
Fix Intermediate ~6m
NTP sync never reaches stratum
The router should be pulling time from an upstream NTP master, but show ntp status reports Unsynchronized. Diagnose why and get the router to a valid stratum.
Build Intermediate ~8m
Configure PAT (NAT overload)
Edge router: tag inside/outside, define an ACL for the inside net, bind PAT to the outside interface IP.
Build Intermediate ~8m
Make R1 the HSRP active router
Two routers share a LAN. Configure HSRP group 1 vip 10.0.0.254; give R1 higher priority + preempt.
Fix Intermediate ~15m
Branch clients get no DHCP address: fix the relay and the pool
Branch PCs behind R2 never get an address from the central DHCP server on R1. Fix the relay interface, the pool gateway, an excluded range that swallows the pool and the server’s route back.
Fix Intermediate ~15m
NTP authentication: fix the key, the trusted key, and the server reference
R1 should sync to NTP-SRV (10.0.99.20) using authenticated NTP. The key number differs on each side, the trusted-key list is empty, the authenticate flag is off and the server command does not reference any key. Fix the five issues so R1 reaches stratum 3.
Fix Intermediate ~15m
SCP config backup fails: fix routing, SSH and SCP
R1 must back up its running config to an SCP server and push a template file into R2 flash. Both copies fail. Fix the missing route, the missing RSA key and the disabled SCP server.
Security Fundamentals
14 labs
Build Foundational ~5m
Apply an ACL inbound on an interface
Create ACL 10 permitting 10.0.0.0/24, then attach it with ip access-group 10 in on Gi0/0.
Build Foundational ~6m
Write a standard numbered ACL
Build ACL 10: permit host 192.168.1.100, deny the rest of that /24.
Build Intermediate ~5m
Dynamic ARP Inspection (DAI): trust ports + validation
Enable DAI on VLAN 10 alongside DHCP snooping and trust the Gi0/1 uplink. Stops ARP spoofing at the access layer.
Build Intermediate ~6m
DHCP snooping + Dynamic ARP Inspection
Enable DHCP snooping + DAI for VLAN 10 on SW1; mark the uplink trusted for both.
Build Intermediate ~6m
Secure VTY lines for SSH only
Add user admin/Cisco123!, then line vty 0 4 with transport input ssh + login local.
Build Intermediate ~6m
Port Security + IP Source Guard
Sticky port-security (max 2) on Fa0/3, then IP Source Guard so only DHCP-snooping-bound traffic is allowed.
Fix Intermediate ~6m
A blocked host still reaches the server
An ACL is supposed to stop one host from reaching a server, but the host still connects. Find why it isn’t taking effect and make it block the right traffic, two valid fixes exist.
Fix Intermediate ~6m
Port-security err-disabled a legitimate host
An access port that’s supposed to run port-security has gone err-disabled and the real workstation can’t come online. Read the interface state, figure out what tripped the violation, and restore the port without opening a security hole.
Build Intermediate ~7m
Write an extended ACL
ACL 100 filtering by protocol + destination + port. Permit TCP 80 and 443 to a host; deny all other IP.
Build Intermediate ~7m
Enable 802.1X on an access port
Turn on AAA + RADIUS, enable 802.1X globally, then make Fa0/1 an authenticator with port-control auto.
Fix Intermediate ~15m
TACACS+ VTY login: fix AAA and the local fallback
R1 should check SSH logins against a TACACS+ server behind R2 and fall back to a local account. Fix the route, the server address, the unused login list and the missing user.
Fix Intermediate ~15m
DHCP snooping: fix the globally disabled feature and the wrong trusted port
SW1 is between the DHCP server (on Gi0/23) and the clients (Fa0/1-10). Snooping is turned off, the VLAN is not enrolled, Fa0/1 is marked trusted by mistake and Gi0/23 is still untrusted. A client's DISCOVER is being blocked. Make the real server port the trusted one and let legitimate DHCP through.
Fix Intermediate ~15m
IPv6 RA Guard: block a rogue router advertisement on access ports
A user plugged a travel router into Fa0/5 and it is sending IPv6 Router Advertisements that are poisoning the clients' default gateway. Enable IPv6 RA Guard on the access ports so only the real router (Gi0/23) can send RAs.
Fix Intermediate ~18m
802.1X wired: fix the RADIUS reach, policy and interface mode
SW1 should authenticate wired clients on Fa0/1 via 802.1X against RADIUS-SRV (10.0.99.10), with a VLAN 99 guest fallback if the client fails. The AAA model, the system auth control and the interface mode are all misconfigured. Fix all five issues.
How it works
- Pick a lab. Each one is a fixed topology and objectives, configure a trunk, bring up OSPF, harden a switch port, or fix a fault.
- Type real IOS. Every device has its own CLI tab.
configure terminal,interface Gi0/0,router ospf 1: the parser understands standard syntax. - Objectives check live. The engine watches state and ticks each objective ✓ as you satisfy it. Ping, OSPF adjacency, trunk formation. All verified against a shared network model.
- Stuck? Progressive hints reveal on demand. Copy a share URL to send your stuck state to your mentor. They open the same lab in the exact position you left it.
Independent, clean-room implementation. Cisco®, IOS®, and CCNA® are trademarks of Cisco Systems, Inc. Referenced here descriptively: see the Trademarks & Disclaimer.
Want every fault to feel obvious?
1:1 mentorship walks you through the CLI live. Free 20-minute first call.