Hands-on lab library
Build Real Cisco-Style Networks in Packet Tracer.
Every lab is a step-by-step guide you follow while building, configuring, verifying, breaking, and repairing a real topology yourself — exact devices, exact ports, exact commands. No browser simulator: Cisco Packet Tracer is the recommended free platform.
Network Fundamentals
Cisco IOS Fundamentals — Navigation, Initial Setup, Interfaces, Verification, and Saving Configs
Every other lab in this library assumes you can already get around the IOS command line without thinking about it. This lab is that missing first step: the exact keystrokes to go from a blank device to a saved, working configuration — because nothing else works if you never typed no shutdown.
Preview →IPv4 Addressing and Subnetting — Splitting One Block, Troubleshooting a Wrong Mask
Subnetting math is the one CCNA skill you cannot fake your way past — either you can carve a block into the right pieces or you can't, and the exam will make you do it cold, on paper, under time pressure. This lab forces you to actually build the subnets you calculate instead of just checking answers against a chart, and then shows you exactly what a wrong mask does to a real host's behavior, because that failure mode is invisible until you've seen it once.
Preview →IPv6 Addressing, SLAAC, EUI-64, and Neighbor Discovery
IPv6 shows up on the exam expecting you to read long hexadecimal addresses at speed and to already understand that IPv6 doesn't use ARP or DHCP the way IPv4 does — it uses Neighbor Discovery and, usually, SLAAC instead. This lab builds one small IPv6 network by hand so those words stop being definitions and start being things you've actually watched happen in a neighbor table.
Preview →Ethernet Switching — MAC Learning, Flooding, Aging, and a Bad Static Entry
Every VLAN, trunk, and spanning-tree concept later in this course assumes you already understand the one thing a switch is actually doing underneath all of it: building a table that maps MAC addresses to ports by watching traffic go by. This lab is deliberately just three PCs and one switch, no router, no VLANs — so nothing distracts from watching that table get built, and broken, one frame at a time.
Preview →Interface, Cable, Speed, and Duplex Diagnosis — Finding a Duplex Mismatch
Most beginners only know how to troubleshoot a link that's completely down. The far more common real-world problem — and a favorite exam scenario — is a link that's up, passes some traffic, and is quietly terrible, because the two ends disagree about duplex. This lab builds that exact failure on purpose, so the counters in show interfaces stop being an intimidating wall of numbers and start being the first place you look.
Preview →Network Access
Router-on-a-Stick and Multilayer Switching — Two Ways to Route Between VLANs
VLANs solve broadcast-domain isolation, but isolated VLANs still need to talk to each other eventually — and a router with only one physical interface can't have a leg in every VLAN. Router-on-a-stick is the classic, exam-favorite answer: one trunk, multiple logical subinterfaces, each pretending to be its own router port. Get the trunk's allowed-VLAN list wrong and one entire VLAN quietly loses its gateway while every other VLAN keeps working fine.
Preview →CDP and LLDP — Two Discovery Protocols, One Missing Neighbor
The very first thing a network engineer does on an unfamiliar device is find out what it's actually connected to — and CDP or LLDP is almost always faster and more trustworthy than a cable map that's three renovations out of date. This lab is short on purpose: it exists to build the reflex of checking both protocols, and to show that turning one off on a single port doesn't mean the link disappeared, just that one specific window into it did.
Preview →Layer 2 EtherChannel with LACP — Bundling Two Links, and a Mode Mismatch
Two switches connected by two separate cables is normally an active invitation for a Spanning Tree loop — EtherChannel is what turns those two physical links into one logical link instead, doubling bandwidth without doubling risk. LACP mode mismatches are one of the most common real-world EtherChannel failures, and they don't announce themselves loudly: the links stay up, traffic might even limp along on one of them, and only show etherchannel summary tells you the bundle never actually formed.
Preview →VLAN Creation and Access-Port Assignment — Data and Voice VLANs
VLANs are the single most common Layer 2 building block on the exam and in real campus networks — everything from trunking to inter-VLAN routing to spanning tree assumes you already know how to create one and put the right port in it. Get the access-port assignment wrong here and every lab built on top of it inherits the same mistake.
Preview →Rapid PVST+ Fundamentals — Root Election, Port Roles, and PortFast
Every redundant Layer 2 design is a deliberate loop that Spanning Tree is trusted to tame — which means the one switch you want in charge of that decision (the root bridge) needs to be chosen on purpose, not by default MAC-address luck. This lab builds an actual three-switch loop, elects a specific root deliberately, and then shows exactly what happens to traffic paths when that election silently goes to the wrong switch instead.
Preview →STP Protections — BPDU Guard, Root Guard, and Loop Guard
Knowing how Spanning Tree elects a root is only half the story — the other half is defending that carefully planned topology from accidents and bad actors. Someone plugging an unmanaged switch into what was supposed to be a PC's access port is one of the most common real-world Layer 2 incidents, and BPDU Guard exists specifically to shut that down in milliseconds, automatically, before it ever gets the chance to become a real problem.
Preview →Controller-Based WLAN with WPA2-PSK — WLC, Lightweight AP, and a Wrong Passphrase
Almost every modern enterprise network is controller-based wireless, not a pile of individually configured access points — a WLC centralizes WLAN creation, security policy, and roaming for every AP that joins it. This lab builds that exact model in miniature, and then reproduces the single most common real help-desk ticket in all of wireless networking: 'my Wi-Fi won't connect,' caused by nothing more than one mistyped character in a passphrase.
Preview →SSH Management — Replacing Telnet with an Encrypted Remote Session
Telnet sends every keystroke, including passwords, in plain text — anyone positioned to capture that traffic reads your enable secret as easily as reading this sentence. SSH is the direct, encrypted replacement, and this lab builds the exact prerequisite chain IOS demands before it will even let you enable it: a domain name, a generated key pair, and a local username, in that specific order.
Preview →IP Connectivity
Reading the Routing Table — Codes, Longest-Prefix Match, and a Missing Route
The exam loves to hand you a wall of show ip route output and ask which single route a router will actually use — and the honest answer is always found by working through the same three-step process in the same order: longest prefix match first, then administrative distance only if prefixes tie, then metric only if AD also ties. This lab builds a router with several competing routes on purpose, so that process stops being a memorized rule and becomes something you've actually watched happen.
Preview →Single-Area OSPFv2 Fundamentals — Router ID, Passive Interfaces, and an Area Mismatch
Static routes don't scale past a handful of routers, which is exactly the problem OSPF solves — but OSPF only works when every router on a shared link agrees on some very specific values first, especially the area number. This lab builds a clean three-router OSPF network, sets router IDs and passive interfaces deliberately instead of by accident, and then shows exactly what a single mistyped area number does to a neighbor relationship that looks, at the cabling level, completely fine.
Preview →OSPF Network Types — Broadcast DR/BDR Election vs. Point-to-Point
Not every OSPF link behaves the same way — a shared Ethernet segment with three or more routers needs a Designated Router to avoid an every-router-to-every-router mesh of adjacencies, while a direct link between exactly two routers doesn't need that overhead at all. This lab builds both situations side by side in one topology, so DR/BDR election stops being an abstract rule and becomes something you've watched happen, deliberately controlled, and then deliberately broken.
Preview →Static, Default, Host, and Floating Routes — IPv4 and IPv6
Dynamic routing protocols get all the attention, but static routes never really go away — a default route to the internet, a backup path for when the primary link dies, or one specific server that needs to take a different path than the rest of its subnet are all jobs static routes still do best. This lab builds all four variants side by side: standard, default, host, and floating, on both IPv4 and IPv6, so the differences between them stop being exam trivia and become muscle memory.
Preview →IP Services
Static and Dynamic NAT — Translating an Inside Network to the Outside World
Almost nothing on the real internet talks directly to a private RFC 1918 address — NAT is the quiet, constant translation layer that makes that mismatch invisible to everyone involved. This lab builds both flavors the exam expects you to know cold: a static one-to-one mapping for a server that needs a predictable public identity, and a dynamic pool for everyday clients that just need to get out.
Preview →DHCP Server, Client, and Relay — When the Server Isn't on the Same Subnet
DHCP works invisibly right up until the server and the client are on different subnets — because DHCPDISCOVER is a Layer 2 broadcast, and routers don't forward broadcasts by default. DHCP relay is the fix, and forgetting it produces one of the most recognizable symptoms in networking: a client stuck with a 169.254.x.x address, quietly unable to reach anything, with no error message pointing at the actual cause.
Preview →NTP Client and Server — Synchronizing the Clock, and a Wrong Server Address
Every troubleshooting session that spans more than one device depends on being able to line up timestamps across syslog messages, and that's completely impossible if each router's clock is drifting on its own schedule. NTP is one of the smallest configurations in this entire course — a handful of lines — and one of the easiest to silently misconfigure with a single wrong digit in a server address.
Preview →SSH Management — Replacing Telnet with an Encrypted Remote Session
Telnet sends every keystroke, including passwords, in plain text — anyone positioned to capture that traffic reads your enable secret as easily as reading this sentence. SSH is the direct, encrypted replacement, and this lab builds the exact prerequisite chain IOS demands before it will even let you enable it: a domain name, a generated key pair, and a local username, in that specific order.
Preview →Security Fundamentals
Controller-Based WLAN with WPA2-PSK — WLC, Lightweight AP, and a Wrong Passphrase
Almost every modern enterprise network is controller-based wireless, not a pile of individually configured access points — a WLC centralizes WLAN creation, security policy, and roaming for every AP that joins it. This lab builds that exact model in miniature, and then reproduces the single most common real help-desk ticket in all of wireless networking: 'my Wi-Fi won't connect,' caused by nothing more than one mistyped character in a passphrase.
Preview →Local Device Security — Passwords, Banners, Privilege, and an Open Console
Every other security feature in this course — ACLs, port security, DHCP snooping — is pointless if anyone who reaches the console port can walk straight into privileged EXEC mode with zero resistance. Local device security is the unglamorous foundation everything else sits on, and it's full of small, easy-to-miss gaps: a password set but never enforced, an enable password stored in plain text, a session left open indefinitely.
Preview →Standard ACLs — Filtering by Source, and the Wrong-Direction Trap
A standard ACL only ever looks at one thing — the source address — which makes it simple to write and dangerously easy to apply in the wrong place. Because a standard ACL can't see the destination, best practice is to apply it as close to the destination as possible; get the direction wrong on that interface and you can accidentally block replies to the very traffic you meant to allow, while the traffic you meant to block sails through untouched.
Preview →Extended and Named ACLs — Matching on Port, and the Rule-Order Trap
Extended ACLs can finally see destination and port, which makes them powerful enough to write real security policy — permit web traffic, block one specific host from SSH, allow everything else — but that same power means entry order now determines the entire outcome, since the first matching line wins and every rule after it is simply never reached for that packet. Named ACLs make this survivable by letting you edit one specific line by number instead of deleting and retyping an entire policy to fix an ordering mistake.
Preview →Port Security — Sticky MAC Learning and a Violation Shutdown
An access port with no port security will happily learn and forward traffic for absolutely any device someone plugs into it — port security is the switch's way of saying 'I know exactly which one device belongs here, and anything else is a problem I refuse to ignore.' It's a small configuration with an outsized effect on physical security, and the shutdown violation mode in particular is deliberately loud rather than quietly dropping the unauthorized traffic.
Preview →DHCP Snooping and Dynamic ARP Inspection — Trusting the Right Port
DHCP snooping exists to stop someone from plugging in a rogue DHCP server and quietly handing out fake gateway addresses to your users — but the entire feature hinges on the switch correctly knowing which one port the real server lives behind. Mark that port untrusted by mistake, and DHCP snooping doesn't just fail to catch a rogue server — it actively drops your own legitimate server's replies, breaking DHCP for everyone.
Preview →Guided Activities
Shorter, focused walkthroughs covering exam-adjacent topics that don't need a full topology build.
Cabling and Connectors — Straight-Through, Crossover, and Fiber
Picking the wrong cable used to mean a dead link and a confusing troubleshooting session. Auto-MDIX made a lot of that go away, but the exam still expects you to know exactly which cable belongs where, and real fiber runs still require you to actually know the difference between single-mode and multimode.
Preview →TCP vs. UDP — Watching the Three-Way Handshake in Simulation Mode
Every port number and every 'why did this connection take three extra packets' question on the exam assumes you already know the difference between a protocol that confirms delivery and one that doesn't bother. Watching the handshake happen frame by frame makes 'connection-oriented' stop being a vocabulary word.
Preview →Packet-Flow Analysis — Reading Simulation Mode Like a Capture Tool
Simulation Mode is the closest thing Packet Tracer has to a real packet capture tool, and learning to read it properly — clicking into a specific event and actually opening the PDU details — turns abstract encapsulation diagrams into something you've watched happen to a real frame, hop by hop.
Preview →DNS — Configuring a Server and Watching a Name Resolve
Every 'the website is down' ticket that turns out to actually be a DNS problem starts from the same misunderstanding: DNS has to succeed before the real connection even begins. This activity builds the smallest possible DNS setup so that dependency stops being abstract.
Preview →Syslog — Sending Router Events to a Central Log Server
A single router's local log buffer is fine until you have more than one router — the moment you do, you need every device shipping its events to one place so an outage that touches three routers doesn't require three separate console sessions to understand.
Preview →SNMP — Enabling Read-Only Monitoring from a Management Station
SNMP is how most real network monitoring dashboards actually get their data — a management station periodically asks each device 'how are you doing,' and the device answers, as long as it's been configured to allow that specific station to ask.
Preview →QoS — Classifying and Marking Voice Traffic Ahead of Data
QoS doesn't make more bandwidth appear — it decides who gets to go first when a link is genuinely busy. Marking voice traffic with a higher-priority DSCP value is the first of several steps real QoS deployments take, and it's the one every CCNA candidate needs to be able to configure from memory.
Preview →REST APIs — Enabling HTTP Management and Reading the Verbs
Modern network automation tools don't type IOS commands over SSH the way you do in every other lab in this library — they send HTTP requests to a REST API and read a status code back. Recognizing that GET reads, POST creates, PUT replaces, and DELETE removes is the single fact that makes every automation tool's documentation instantly readable instead of mysterious.
Preview →JSON — Reading the Data Format Every Automation Tool Speaks
Every REST API response, most Ansible variable file, and Terraform's own state file all use JSON (or YAML, its close cousin) as the underlying data shape — being able to read curly braces, square brackets, and colons at a glance is what makes an automation tool's output something you can actually troubleshoot instead of just stare at.
Preview →Ansible — Recognizing Agentless, Push-Based Automation
The CCNA exam doesn't ask you to write Ansible playbooks — the blueprint's own wording is 'recognize,' not 'configure.' What it does expect is that you can look at a playbook and correctly identify what it's about to do, and explain why 'agentless' and 'push-based' are the two words that define how Ansible actually reaches a device.
Preview →Terraform — Recognizing Declarative, State-Based Infrastructure
Terraform answers a different question than Ansible does — not 'what steps do I run,' but 'what should exist when this is done,' letting the tool figure out the steps itself by comparing that desired state against what it already knows exists. That distinction, declarative versus imperative, is exactly what the CCNA blueprint expects you to recognize.
Preview →Controller-Based Networking — Control Plane, Data Plane, and SDN APIs
You already built one real controller-based system in this library — the WLC lab, where one controller pushed WLAN policy to a lightweight AP instead of configuring the AP directly. This activity zooms out from that one wireless example to the general SDN concept it's actually a small instance of: a centralized control plane, a separated data plane, and APIs facing in two different directions.
Preview →AI and ML in Network Operations — Predictive vs. Generative, and Where a Human Still Decides
AI shows up in modern network operations mainly in two shapes: predictive models that flag 'this looks like the start of a known failure pattern' from historical data, and generative tools that can draft a configuration or summarize a log dump — neither one is meant to make the final call on a production change without a human checking its work first.
Preview →Capstone Labs
Capstone: Small Business LAN — VLANs, EtherChannel, Inter-VLAN Routing, STP, DHCP, and SSH
This capstone is every earlier Network Access lab combined into one coherent, believable small business network — two departments, one redundant uplink, one Layer 3 core doing the inter-VLAN routing and DHCP, and every device locked down to SSH-only management. If you can build and troubleshoot this from a blank canvas, you've internalized the whole domain, not just the individual pieces.
Preview →Capstone: Multi-Site Network — OSPF, Static Default Routes, NAT, ACLs, NTP, and Two Simultaneous Faults
Real networks are rarely one clean, single-technology problem — this capstone hands you a hub-and-spoke design with two independent faults active at once, on purpose, because that's a far more honest simulation of a real trouble ticket than any single-fault lab could be. Learning to isolate which symptom belongs to which fault, without one confusing your diagnosis of the other, is the actual skill.
Preview →Capstone: Secure Branch — Wired/Wireless Segmentation, Port Security, DHCP Snooping/DAI, and Central Services
A real branch office is never just wired or just wireless — it's both, sharing central services like DHCP and DNS, expected to keep the guest-adjacent wireless segment away from sensitive wired resources, and expected to survive someone plugging in an unauthorized device on either side. This capstone is that branch, in miniature: three VLANs, one relayed DHCP server, and every access-layer security control from this course's Security Fundamentals labs applied at once.
Preview →