Cisco CCNA and ENCOR labs
Routers, switches and PCs cabled together in your browser. Configure them with real IOS commands. Ping fails until the routing is right and OSPF neighbours only form when both ends match. Each lab checks the result, so any correct configuration passes.
CCNA 200-301 labs
From first device setup to wireless on a 9800 controller, ACLs, NAT, DHCP and troubleshooting.
Basic device setup and SSH-ready management
Secure a new router and switch: hostnames, enable secret, console password, banner, management IPs, SSH, and save.
VLANs and 802.1Q trunking
Create VLANs on two switches, assign access ports, and build a trunk with a restricted allowed list and native VLAN 99.
Inter-VLAN routing (router-on-a-stick)
Route between VLAN 10 and VLAN 20 with 802.1Q subinterfaces on one router port and a trunk to the switch.
Inter-VLAN routing on a Layer 3 switch (SVIs)
Route between two VLANs with switched virtual interfaces on a Catalyst 3650, then add a routed uplink and a default route to the edge router.
Spanning tree: choose the root bridge per VLAN
Control which switch becomes the root bridge for each VLAN, move to Rapid PVST+, and protect the access ports with PortFast and BPDU Guard.
EtherChannel with LACP
Bundle two trunk links between switches into one LACP port-channel so spanning tree stops blocking one of them, then restrict the VLANs it carries.
Port security: sticky MACs, violations and err-disable
Lock switch ports to known devices with port security, watch an unknown laptop err-disable its port, and shut down the unused ports.
Static and default routing
Three routers in a line: add default and static routes so both LANs and the internet loopback can reach each other, in both directions.
Single-area OSPFv2
Three routers in a triangle: set router IDs, form OSPF adjacencies, make LAN ports passive and advertise a default route.
IPv6 addressing, SLAAC and static routing
Enable IPv6 routing, address two routers (manual, EUI-64 and link-local), let the PCs autoconfigure with SLAAC, and route between the LANs with IPv6 static routes.
HSRP: a redundant default gateway
Give a LAN a virtual gateway shared by two routers with HSRP, make R1 the preferred active router, and prove the LAN keeps working when R1's LAN link fails.
Standard ACLs: filter a host and secure VTY access
Block one host from a server LAN with a standard ACL placed near the destination, and allow only the HR subnet to telnet to the router.
Extended ACL: allow only web and DNS to a server
Write a named extended ACL that lets the LAN reach a server only on HTTP and DNS, keeps the rest of the network open, and is placed close to the source.
NAT: PAT for internet access and static NAT for a server
Give a private LAN internet access with PAT on the edge router's outside interface, and publish an internal web server with static NAT.
DHCP server on a router, with a relay for a remote LAN
Make R1 the DHCP server for two LANs, keep the first ten addresses out of each pool, and relay requests from the remote LAN with ip helper-address.
Device management: NTP, syslog, SNMP and SSH
Point a router at the company's NTP and syslog servers, publish read-only SNMP limited by an ACL, and allow management only over SSH from the management subnet.
Wireless: a WPA2-PSK WLAN on a 9800 controller
Use the controller's web interface to create a WPA2-PSK WLAN, put its clients in VLAN 20 with a policy profile, publish it on the AP with a policy tag, and connect a laptop.
Troubleshooting: a broken trunk between two switches
PCs in the same VLAN on two switches cannot talk. Find the trunk, native VLAN, allowed-list and VLAN database faults, and fix them.
Troubleshooting: an EtherChannel that will not come up
Two switches should share an LACP port-channel trunk for VLANs 10 and 20, but users cannot reach each other. Find the bundling and trunk faults and fix them.
Troubleshooting: OSPF adjacencies and missing routes
Three routers are configured for OSPF area 0 but PC1 cannot reach PC3. Find the faults that stop the adjacencies and the routes, and fix them.
Troubleshooting: IPv6 hosts that cannot get out
PCs on two LANs should autoconfigure IPv6 and reach each other across two routers. Find the routing, prefix and next-hop faults and fix them.
Troubleshooting: NAT and an edge ACL
The office lost internet access after a change on the edge router. Find the NAT and ACL faults that break outbound traffic and the published web server.
Troubleshooting: guests connect but get no address
Guests can see and join the Guest Wi-Fi but never get an address in their VLAN. Find the controller and switch faults and fix them.
CCNP ENCOR 350-401 labs
EIGRP, multi-area OSPF, redistribution, BGP, GRE tunnels, first-hop redundancy and wireless 802.1X.
EIGRP: adjacencies, feasible successors and path control
Bring up EIGRP on a triangle of routers, then steer traffic onto the longer path with delay while keeping the direct link as a feasible successor.
OSPF: multi-area design and DR election control
Build a two-area OSPF network with an ABR, control which router becomes DR on a shared segment, and keep a router out of the election entirely.
Mutual redistribution between OSPF and EIGRP
Join an OSPF domain and an EIGRP domain at a border router with two-way redistribution, avoiding the classic subnets and seed-metric traps.
eBGP peering and prefix advertisement
Peer three autonomous systems with eBGP, advertise each LAN with network statements, and follow a prefix across two AS hops.
iBGP over loopbacks with next-hop-self
Peer two routers in the same AS over their loopbacks, carried by OSPF, and fix the unreachable next hop that iBGP leaves behind with next-hop-self.
GRE tunnel with OSPF across the internet
Connect two sites over an ISP that knows nothing about their private networks with a GRE tunnel, run OSPF across it, and avoid recursive routing.
VRRP with uplink tracking
Give a LAN a VRRP virtual gateway, make R1 master, and track R1's uplink so the gateway moves to R2 when the uplink, not just the LAN port, fails.
Wireless: AP discovery with DHCP option 43 and WPA2-Enterprise
Get an AP in another subnet to find its controller through DHCP option 43, then build an 802.1X WLAN that authenticates users against a RADIUS server.
Wired 802.1X and MAB with RADIUS VLAN assignment
Turn on port-based authentication on an access switch: staff log in with 802.1X, the printer gets in by MAB, and anyone else lands in a guest VLAN, each placed in a VLAN chosen by the RADIUS server.
Troubleshoot 802.1X with an LDAP identity store
Users authenticate on the switch through RADIUS against an LDAP directory, and nobody gets on. Follow the failure reasons from the switch to the RADIUS log to the directory and fix each layer.
Troubleshooting: BGP edge and EIGRP core
A branch's LAN never reaches the provider over BGP. Find the faults in the EIGRP core and the BGP edge and fix them.
Labs are listed in a suggested order of study. Troubleshooting labs start broken: find the faults and fix them.