Build Foundational ~3m
Set hostname and enable secret
Rename a router to EDGE-1 and set an encrypted enable secret. Basic device hardening.
Hands-on CLI 25 build 13 fix
CCNA CLI labs — configure and troubleshoot
The real CCNA 200-301 lab section asks you to build a config from a topology and fix a broken network under time pressure. Each lab below does one of those on real Cisco IOS syntax — objectives grade live as you type.
Build — start from a blank/partial device and configure to spec
Fix — diagnose one realistic fault on a broken network
Router console — free-play open →
Router> enable
Router# conf t
Router(config)# hostname R1
R1(config)# interface gi0/0
R1(config-if)# ip address 10.0.0.1 255.255.255.0
R1(config-if)# no shutdown
*Jul 19 10:00:00: %LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up
Try it live — open the free-play Cisco console open →
Or pick any lab below — each opens its own graded live console.
Filter:
Network Fundamentals
4 labs
Build Foundational ~3m
Save the running config to NVRAM
Rename Router to CORE-1 + copy running-config startup-config so the change survives a reload.
Build Foundational ~4m
Assign an IP to a router interface
One router, one interface. Bring the link up, assign 10.0.0.1/24, confirm with show ip interface brief.
Build Foundational ~4m
IPv6 basics: address an interface
Enable ipv6 unicast-routing globally + assign 2001:db8::1/64 to Gi0/0.
Network Access
10 labs
Build Foundational ~5m
Harden a switchport with port-security
Lock Fa0/1 to a single MAC via sticky learning, err-disable on violation.
Build Foundational ~5m
Create VLAN 99 (MANAGEMENT) and put Fa0/24 in it
Segment out a dedicated management VLAN on SW1. Create VLAN 99, name it MANAGEMENT, then move access port Fa0/24 into it. A common first-day switch-hardening move.
Build Foundational ~6m
Create a VLAN, assign an access port
One switch, VLAN 10 named Engineering, Fa0/1 as access port. Verify with show vlan brief.
Build Intermediate ~5m
Force SW1 to be the STP root
Two switches, matching default priorities. Configure SW1 to win the root bridge election for VLAN 1.
Build Intermediate ~6m
Bundle two links with LACP
SW1 <-> SW2 have TWO cables. Form channel-group 1 with LACP active/active on both sides.
Fix Intermediate ~6m
EtherChannel bundle never forms
Two switches share four cables that are meant to bundle into one Port-channel, but STP is still blocking three of them and show etherchannel summary reports the bundle down. Find the mismatch and bring the channel up.
Fix Intermediate ~6m
VLAN 10 and VLAN 20 hosts can’t reach each other
Router-on-a-stick is configured but VLAN 10 hosts can’t ping VLAN 20 (or vice versa). Find the missing piece — the answer isn’t always the router, and the show commands here are the same ones you’ll use on the real exam.
Fix Intermediate ~6m
STP elected the wrong root bridge
A budget access switch ended up as the root of the spanning-tree instead of the distribution switch. Traffic hairpins the wrong way. Fix the topology so the designated root sits where you want it.
Fix Intermediate ~6m
A VLAN won’t cross the trunk
VLAN 20 hosts can’t reach the other switch even though VLAN 10 works across the same trunk. Find why VLAN 20 isn’t crossing and restore connectivity.
Build Intermediate ~8m
Two switches, one VLAN, one trunk
Multi-device. SW1 and SW2 both host VLAN 10. Configure access ports + an 802.1Q trunk.
IP Connectivity
9 labs
Build Foundational ~3m
Add a default route
Install a static default route pointing at 10.0.0.2 and see Gateway of last resort appear.
Build Foundational ~5m
Add a static route
Install a static route to 10.5.0.0/24 via 10.0.0.2. Verify with show ip route.
Fix Intermediate ~6m
HSRP failover never happens
Two routers share a virtual gateway with HSRP, but when the active router’s uplink fails, the standby never takes over and clients lose connectivity. Diagnose HSRP + interface tracking and make failover work.
Fix Intermediate ~6m
OSPF neighbor never comes up
R1 and R2 should be OSPF neighbors on the link between them, but on R2 the neighbor table is empty and the two LANs can’t reach each other. Diagnose R2 with the show commands and bring the adjacency to FULL — there’s more than one valid fix.
Fix Intermediate ~6m
Multi-area OSPF: area 1 can’t reach area 0
An ABR should be gluing area 1 to the backbone (area 0), but LSA Type 3 inter-area routes never show up on the far side. Investigate the ABR, find the misconfig, and get inter-area routes flowing.
Fix Intermediate ~6m
A remote LAN is unreachable — static route missing
A branch office LAN is completely unreachable from HQ. The show route table on HQ tells the whole story. Add the correct static route, and be careful with the next-hop.
Build Intermediate ~7m
Inter-VLAN routing with SVIs
L3 switch: enable ip routing + create SVIs for VLAN 10 and VLAN 20.
Build Intermediate ~10m
Two routers, static routes, ping across
Multi-device. R1 and R2 share a link; add static routes both ways and ping across.
Build Intermediate ~12m
Bring up OSPF on a 3-router triangle
3-device. Configure OSPF area 0 on R1/R2/R3, watch neighbors reach Full, ping across via O routes.
IP Services
6 labs
Build Foundational ~6m
Configure a DHCP server pool
Create pool LAN handing out 192.168.1.0/24, gateway .1, DNS 8.8.8.8, first ten addresses excluded.
Fix Intermediate ~6m
Clients aren’t getting an IP from the DHCP server
A DHCP server is running for a remote VLAN, but PCs on that VLAN keep landing on APIPA (169.254.x). Find what’s missing — most CCNA candidates get this exact scenario in production within their first year.
Fix Intermediate ~6m
The LAN can’t reach the internet
PAT is configured but inside hosts still can’t reach the internet and nothing is being translated. Investigate the NAT setup, find what’s incomplete, and get translations forming.
Fix Intermediate ~6m
NTP sync never reaches stratum
The router should be pulling time from an upstream NTP master, but show ntp status reports Unsynchronized. Diagnose why and get the router to a valid stratum.
Build Intermediate ~8m
Configure PAT (NAT overload)
Edge router: tag inside/outside, define an ACL for the inside net, bind PAT to the outside interface IP.
Build Intermediate ~8m
Make R1 the HSRP active router
Two routers share a LAN. Configure HSRP group 1 vip 10.0.0.254; give R1 higher priority + preempt.
Security Fundamentals
10 labs
Build Foundational ~5m
Apply an ACL inbound on an interface
Create ACL 10 permitting 10.0.0.0/24, then attach it with ip access-group 10 in on Gi0/0.
Build Foundational ~6m
Write a standard numbered ACL
Build ACL 10: permit host 192.168.1.100, deny the rest of that /24.
Build Intermediate ~5m
Dynamic ARP Inspection (DAI) — trust ports + validation
Enable DAI on VLAN 10 alongside DHCP snooping and trust the Gi0/1 uplink. Stops ARP spoofing at the access layer.
Build Intermediate ~6m
DHCP snooping + Dynamic ARP Inspection
Enable DHCP snooping + DAI for VLAN 10 on SW1; mark the uplink trusted for both.
Build Intermediate ~6m
Secure VTY lines for SSH only
Add user admin/Cisco123!, then line vty 0 4 with transport input ssh + login local.
Build Intermediate ~6m
Port Security + IP Source Guard
Sticky port-security (max 2) on Fa0/3, then IP Source Guard so only DHCP-snooping-bound traffic is allowed.
Fix Intermediate ~6m
A blocked host still reaches the server
An ACL is supposed to stop one host from reaching a server, but the host still connects. Find why it isn’t taking effect and make it block the right traffic — two valid fixes exist.
Fix Intermediate ~6m
Port-security err-disabled a legitimate host
An access port that’s supposed to run port-security has gone err-disabled and the real workstation can’t come online. Read the interface state, figure out what tripped the violation, and restore the port without opening a security hole.
Build Intermediate ~7m
Write an extended ACL
ACL 100 filtering by protocol + destination + port. Permit TCP 80 and 443 to a host; deny all other IP.
Build Intermediate ~7m
Enable 802.1X on an access port
Turn on AAA + RADIUS, enable 802.1X globally, then make Fa0/1 an authenticator with port-control auto.
How it works
- Pick a lab. Each one is a fixed topology and objectives — configure a trunk, bring up OSPF, harden a switch port, or fix a fault.
- Type real IOS. Every device has its own CLI tab.
configure terminal,interface Gi0/0,router ospf 1— the parser understands standard syntax. - Objectives check live. The engine watches state and ticks each objective ✓ as you satisfy it. Ping, OSPF adjacency, trunk formation — all verified against a shared network model.
- Stuck? Progressive hints reveal on demand. Copy a share URL to send your stuck state to your mentor — they open the same lab in the exact position you left it.
Independent, clean-room implementation. Cisco®, IOS®, and CCNA® are trademarks of Cisco Systems, Inc. Referenced here descriptively — see the Trademarks & Disclaimer.
Want every fault to feel obvious?
1:1 mentorship walks you through the CLI live. First session free.