Enter the access code provided by your instructor to continue.
Self-study step-by-step instructions for every lab
Self-study lab guide · Based on CCNA 200-301 v1.1 Official Exam Blueprint · Recommended tools: Cisco Packet Tracer (free), Wireshark (free), Cisco DevNet Sandbox (free)
Cut a piece of cable to around 1 metre. Use scissors or cable cutters — make a clean, straight cut.
Insert the cable into the cable stripper. Rotate once around and pull off 2–3 cm of the outer jacket. Do not nick the inner wires.
Spread out all four colour pairs. Untwist each pair just enough to arrange them — keep untwisting minimal to preserve noise cancellation.
Hold the wires flat between your fingers. Arrange left to right:
Pin 1: White/Orange · Pin 2: Orange · Pin 3: White/Green · Pin 4: Blue · Pin 5: White/Blue · Pin 6: Green · Pin 7: White/Brown · Pin 8: Brown
Memory tip: WO–O–WG–B–WB–G–WBr–Br
While holding all 8 wires flat and parallel, trim them to exactly 1.3 cm (½ inch) from the edge of the jacket.
Slide the 8 wires into the connector — each wire into its own channel. All 8 tips must reach the front gold pins. The jacket must enter the back of the connector for strain relief.
Look through the transparent body. Confirm the colour order matches T568B from left to right. Do NOT crimp if it's wrong — you cannot undo a crimp.
Insert the connector into the crimping tool. Squeeze firmly until the ratchet clicks and releases automatically.
Terminate the other end with the same T568B order to make a straight-through patch cable.
Plug one end into the main tester unit and the other into the remote. Press the test button. All 8 LEDs should light in sequence: 1–2–3–4–5–6–7–8.
| LED Sequence | Meaning |
|---|---|
| 1–2–3–4–5–6–7–8 | ✅ Good straight-through cable (T568B both ends) |
| 1–3–2–4–5–6–7–8 | ⚠️ Crossover cable (T568A one end, T568B other) — intentional or mistake? |
| Any LED missing | ❌ Broken wire or bad crimp — re-terminate that end |
| Two LEDs light at once | ❌ Short circuit — two wires touching — re-terminate |
File → New. You'll see the workspace in the centre and device palette at the bottom.
In the bottom palette, click Network Devices → Switches → drag a 2960 switch onto the workspace.
Click End Devices → drag three PC icons onto the workspace.
Click the lightning bolt (Connections) → select Copper Straight-Through. Click PC1 → choose FastEthernet0 → click Switch1 → choose FastEthernet0/1. Repeat for PC2 (Fa0/2) and PC3 (Fa0/3). Wait for the link lights to go green.
Click PC1 → Desktop tab → IP Configuration. Enter:
IP: 192.168.1.10 · Subnet: 255.255.255.0
Repeat: PC2 = 192.168.1.20, PC3 = 192.168.1.30 (same subnet mask).
Click PC1 → Desktop → Command Prompt. Type: ping 192.168.1.20. You should see 4 replies. Also ping 192.168.1.30.
Click Switch1 → CLI tab. Press Enter, then type: show mac address-table. You'll see PC MAC addresses mapped to the ports they're connected to.
Add 2× 2960 switches (Access-SW1, Access-SW2), 1× 3650 switch (Core-SW), and 4× PCs.
PC1 & PC2 → Access-SW1 (Fa0/1, Fa0/2). PC3 & PC4 → Access-SW2 (Fa0/1, Fa0/2). Access-SW1 Gi0/1 → Core-SW Gi0/1. Access-SW2 Gi0/1 → Core-SW Gi0/2. Use Copper Straight-Through for all.
PC1: 192.168.1.10/24 · PC2: 192.168.1.20/24 · PC3: 192.168.1.30/24 · PC4: 192.168.1.40/24. No gateway needed (all same subnet).
From PC1 CLI: ping 192.168.1.30 and ping 192.168.1.40. All should reply.
For each device, write down which OSI layer it operates at: PC NIC = Layer 1–4 · Access Switch = Layer 2 · Core Switch (3650) = Layer 2/3 · The IP addresses you assigned = Layer 3 · TCP/UDP in applications = Layer 4.
show mac address-table on Access-SW1 — confirm PC1 and PC2 MACs appear.Launch Wireshark. On the home screen, double-click your active network adapter (the one with the wave graph) to start capturing.
Open a command prompt (Windows) or terminal (Linux/Mac). Type: ping 8.8.8.8. Let it run 4 pings.
Click the red ■ stop button in Wireshark.
In the filter bar at the top, type icmp and press Enter. You'll see only your ping packets.
Click any "Echo (ping) request" row. The middle panel expands into collapsible layers.
Expand each section and map it:
Frame X = Layer 1 (Physical — size, timing)
Ethernet II = Layer 2 (Source MAC, Destination MAC)
Internet Protocol Version 4 = Layer 3 (Source IP, Destination IP)
Internet Control Message Protocol = Layer 4/3 (ICMP type, code, checksum)
Clear the filter. Open a browser and visit http://example.com. In Wireshark filter bar type tcp. Find 3 packets labelled SYN, SYN-ACK, ACK — this is the TCP 3-way handshake.
show interfaces output, and fix it.Add SW1 (2960) and SW2 (2960). Connect them: SW1 Gi0/1 → SW2 Gi0/1. Add PC1 to SW1 Fa0/1 and PC2 to SW2 Fa0/1. Assign IPs: PC1 192.168.1.1/24, PC2 192.168.1.2/24. Confirm ping works.
Click SW1 → CLI tab. Enter:
! Enter privileged mode, then interface config SW1> enable SW1# configure terminal SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# duplex half SW1(config-if)# end
Wait 10 seconds, then run: show interfaces GigabitEthernet0/1. Look for rising input errors, CRC errors, or collisions. Try pinging PC2 from PC1 — you may see packet loss.
Set both switches to auto-negotiation (the correct setting):
SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# duplex auto SW1(config-if)# speed auto
Repeat on SW2.
Run show interfaces Gi0/1 again. Errors should stop incrementing. Ping should succeed consistently.
Start a Wireshark capture on your active adapter. Open a browser and visit http://example.com. Stop capture after the page loads. Filter: tcp and ip.addr == 93.184.216.34 (example.com's IP — look it up with ping example.com first).
Look for three consecutive packets: [SYN] → [SYN, ACK] → [ACK]. Click each one and note:
· The Flags field in the TCP header (SYN, ACK bits)
· The Sequence number and Acknowledgment number fields
Start a new capture. Open a command prompt and type: nslookup cisco.com. Stop capture. Filter: udp and port 53.
Click one DNS UDP packet. Expand the UDP header. Notice: no sequence numbers, no flags, no acknowledgment field — just source port, destination port, length, and checksum.
In a table, write: TCP has [list fields you found] · UDP has [list fields you found] · TCP = reliable because [explain] · UDP = faster because [explain].
You have been given 192.168.1.0/24. Divide it into 8 equal subnets. For each subnet, calculate: Network Address · Subnet Mask (CIDR) · First Usable Host · Last Usable Host · Broadcast Address.
You need 8 subnets. 2³ = 8, so you need to borrow 3 bits from the host portion. New prefix: /24 + 3 = /27. New subnet mask: 255.255.255.224.
256 − 224 = 32. Each subnet is 32 addresses wide. Subnets increment by 32.
Work through all 8 subnets:
| # | Network Address | First Host | Last Host | Broadcast |
|---|---|---|---|---|
| 1 | 192.168.1.0/27 | 192.168.1.1 | 192.168.1.30 | 192.168.1.31 |
| 2 | 192.168.1.32/27 | 192.168.1.33 | 192.168.1.62 | 192.168.1.63 |
| 3 | 192.168.1.64/27 | 192.168.1.65 | 192.168.1.94 | 192.168.1.95 |
| 4–8 | Complete these yourself, incrementing by 32 each time | |||
Repeat the exercise with 172.16.0.0/16 — divide it into 16 subnets. What is the new prefix? What is the block size?
| Segment | Hosts Needed | Subnet |
|---|---|---|
| LAN-A (R1) | 50 hosts | 10.0.0.0/26 (62 hosts) |
| LAN-B (R2) | 25 hosts | 10.0.0.64/27 (30 hosts) |
| LAN-C (R3) | 10 hosts | 10.0.0.96/28 (14 hosts) |
| LAN-D (R4) | 5 hosts | 10.0.0.112/29 (6 hosts) |
| R1–R2 link | 2 hosts | 10.0.0.120/30 |
| R1–R3 link | 2 hosts | 10.0.0.124/30 |
| R3–R4 link | 2 hosts | 10.0.0.128/30 |
Add 4× Router 1941, 4× PCs, connect using Serial or Gigabit as appropriate.
R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip address 10.0.0.1 255.255.255.192 R1(config-if)# no shutdown R1(config-if)# interface GigabitEthernet0/1 R1(config-if)# ip address 10.0.0.121 255.255.255.252 R1(config-if)# no shutdown
Apply the address plan to each router interface. Assign PC addresses from the first usable host in each LAN subnet. Set PC gateways to the router's LAN IP.
Add static routes so all routers know about all subnets. Example on R1: ip route 10.0.0.64 255.255.255.224 10.0.0.122.
Ping from PC-A to PC-D. Use traceroute [IP] to see the path taken.
Press Win + R, type cmd, press Enter.
Type ipconfig. Note: IPv4 Address, Subnet Mask, Default Gateway for each adapter. Then run ipconfig /all — also note the DNS Servers and MAC address (Physical Address).
On Ubuntu/Debian: press Ctrl+Alt+T.
ip address show — shows all interfaces with IPs and prefix lengths.ip route show — shows the routing table including default gateway.cat /etc/resolv.conf — shows DNS server.
Run ping 8.8.8.8 (Windows: 4 pings by default · Linux: Ctrl+C to stop). Run ping google.com — confirms DNS also works.
Record: IP Address · Subnet Mask · Default Gateway · DNS Server · MAC Address — for each OS. Compare the format differences between the two outputs.
R1 — R2, with PC1 behind R1 and PC2 behind R2.
R1(config)# ipv6 unicast-routingR1(config)# interface GigabitEthernet0/0 R1(config-if)# ipv6 address 2001:DB8:1:1::1/64 R1(config-if)# no shutdown R1(config-if)# interface GigabitEthernet0/1 R1(config-if)# ipv6 address 2001:DB8:1:12::1/64 R1(config-if)# no shutdown
Use 2001:DB8:1:2::1/64 for LAN and 2001:DB8:1:12::2/64 for the link to R1.
Click PC1 → Desktop → IP Configuration → switch to Static IPv6. Enter: 2001:DB8:1:1::10/64, Gateway: 2001:DB8:1:1::1.
R1(config)# ipv6 route 2001:DB8:1:2::/64 2001:DB8:1:12::2And the reverse on R2.
| Command | Expected Output |
|---|---|
| show ipv6 interface brief | Both interfaces show IPv6 address and [up/up] |
| ping 2001:DB8:1:2::10 | 5 replies from PC2's IPv6 address |
| show ipv6 route | C routes for connected, S routes for static |
1× 2960 switch + 4× PCs on Fa0/1 through Fa0/4. Assign IPs: 192.168.1.1–4/24.
SW1# clear mac address-table dynamicSW1# show mac address-table Mac Address Table should show no dynamic entries yet
From PC1, ping PC3: ping 192.168.1.3.
SW1# show mac address-tableYou should now see PC1's MAC on Fa0/1 and PC3's MAC on Fa0/3.
In Packet Tracer: click the Simulation button (bottom right). Set filter to show only ICMP. Send a ping from PC1 to PC2 when the MAC table is empty. Click Auto Capture / Play and watch — the first frame floods to ALL ports.
After the first exchange, send another ping. This time the switch forwards directly to Fa0/2 only — no flooding.
SW1 (2960) + SW2 (2960). Connect SW1 Gi0/1 → SW2 Gi0/1 (this will be the trunk). Add 6 PCs: PC1, PC2 on SW1; PC3, PC4 on SW2 (VLAN 10 and VLAN 20 respectively); PC5 on SW1 and PC6 on SW2 (VLAN 30).
SW1(config)# vlan 10 SW1(config-vlan)# name Sales SW1(config-vlan)# vlan 20 SW1(config-vlan)# name HR SW1(config-vlan)# vlan 30 SW1(config-vlan)# name IT SW1(config-vlan)# exit
SW1(config)# interface Fa0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 ! Repeat for Fa0/2 (VLAN 20) and Fa0/3 (VLAN 30)
SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk native vlan 99
Create the same VLANs, assign access ports, and configure Gi0/1 as trunk with native VLAN 99.
VLAN 10: 192.168.10.x/24 · VLAN 20: 192.168.20.x/24 · VLAN 30: 192.168.30.x/24.
PC1 (VLAN 10) ping PC2 (VLAN 10 on SW2) → ✅ success. PC1 ping PC3 (VLAN 20) → ❌ fails (correct — no routing yet).
| Command | What to check |
|---|---|
| show vlan brief | All 3 VLANs exist, correct ports assigned |
| show interfaces trunk | Gi0/1 shows as trunk, VLANs 10,20,30 allowed |
Add a Router 1941 (R1). Connect R1 Gi0/0 → SW1 Fa0/24 (a free port on SW1).
SW1(config)# interface Fa0/24 SW1(config-if)# switchport mode trunk
R1(config)# interface GigabitEthernet0/0 R1(config-if)# no shutdown R1(config)# interface GigabitEthernet0/0.10 R1(config-subif)# encapsulation dot1Q 10 R1(config-subif)# ip address 192.168.10.1 255.255.255.0 R1(config)# interface GigabitEthernet0/0.20 R1(config-subif)# encapsulation dot1Q 20 R1(config-subif)# ip address 192.168.20.1 255.255.255.0 R1(config)# interface GigabitEthernet0/0.30 R1(config-subif)# encapsulation dot1Q 30 R1(config-subif)# ip address 192.168.30.1 255.255.255.0
VLAN 10 PCs → gateway 192.168.10.1 · VLAN 20 PCs → 192.168.20.1 · VLAN 30 PCs → 192.168.30.1.
PC1 (VLAN 10) ping PC3 (VLAN 20) → ✅ should now succeed.
encapsulation dot1Q [vlan-id] command must match the VLAN number exactly. Missing this command or using the wrong VLAN ID is the most common mistake in this lab.SW1, SW2, SW3 (all 2960). Connect: SW1 Gi0/1 → SW2 Gi0/1 · SW2 Gi0/2 → SW3 Gi0/1 · SW3 Gi0/2 → SW1 Gi0/2. This creates a loop.
SW1# show spanning-tree vlan 1Look for "This bridge is the root" or the Root ID section. The switch with the lowest MAC address (with default priority 32768) becomes root.
Run show spanning-tree vlan 1 on SW2 and SW3. Identify which port is Designated (FWD), Root (FWD), and Alternate/Blocked (BLK).
SW1(config)# spanning-tree vlan 1 priority 4096Wait ~30 seconds for convergence.
Re-run show spanning-tree vlan 1 on all three switches. SW1 should now show "This bridge is the root." Watch which port moves from FWD to BLK on the other switches.
On SW1, connect a PC to Fa0/1. Configure:
SW1(config)# interface Fa0/1 SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard enable
The PC port should come up instantly (no 30-second wait). If you connect a switch to that port, BPDU Guard will err-disable it.
SW1 and SW2. Connect two separate cables: SW1 Gi0/1 → SW2 Gi0/1 AND SW1 Gi0/2 → SW2 Gi0/2.
SW1(config)# interface range GigabitEthernet0/1-2 SW1(config-if-range)# channel-group 1 mode active SW1(config-if-range)# exit SW1(config)# interface Port-channel1 SW1(config-if)# switchport mode trunk
SW2(config)# interface range GigabitEthernet0/1-2 SW2(config-if-range)# channel-group 1 mode active
SW1# show etherchannel summaryLook for Po1(SU) — S = Layer 2, U = in use. The member ports should show (P) for bundled.
Add PCs on each switch, assign same-subnet IPs, verify pinging works. Then right-click SW1 Gi0/1 → delete connection (simulating a link failure). Confirm pinging continues — traffic moved to Gi0/2.
SW1(config)# lldp runRepeat on SW2 and SW3.
LLDP sends advertisements every 30 seconds by default.
SW1# show lldp neighbors SW1# show lldp neighbors detail
The detail view shows: neighbor hostname, interface connected to, IP address, platform/capabilities.
On paper, draw boxes for each device discovered. Draw lines showing which port connects to which neighbor port. Compare to the actual Packet Tracer topology — they should match exactly.
CDP is Cisco-only and on by default: show cdp neighbors detail. Compare the output to LLDP — same information, different protocol.
Add: 1× WLC-3504 (from Network Devices → Wireless), 1× Lightweight AP (from Wireless Devices), 1× 2960 switch, 1× laptop (wireless-capable). Connect: AP → Switch Fa0/1 (access port), WLC → Switch Gi0/1 (trunk port).
Create VLANs 10 and 20. Set WLC uplink as trunk; AP uplink as access VLAN 1 (management).
Click the WLC → GUI tab. Default credentials: admin / Cisco123 (check the device info). Navigate to WLANs → Create New.
Profile Name: Corp · SSID: Corp · WLAN ID: 1 · Map to Interface: VLAN 10 · Security: WPA2-PSK → enter a passphrase (e.g. Cisco1234!) · Click Apply.
Repeat: Profile Name: Guest · SSID: Guest · WLAN ID: 2 · Interface: VLAN 20 · Security: WPA2-PSK or None.
Click Laptop → Desktop → PC Wireless. Under Connect tab, find "Corp" in the site survey. Click Connect, enter the PSK. The laptop should receive an IP from VLAN 10's DHCP pool (configure one on a server or router if needed).
Sketch a 2-floor office. Each floor has 3 APs. Place them in corners and centre of each floor to maximise coverage overlap.
Floor 1: AP1=Ch1 · AP2=Ch6 · AP3=Ch11. Floor 2: AP4=Ch1 · AP5=Ch6 · AP6=Ch11. Stagger placement so APs on the same channel do not have overlapping coverage zones.
Each AP has a cable going to an access switch on that floor. Label those switch ports as Access — VLAN 1 (management). The access switches uplink to the core switch via trunk ports.
WLC sits in the server room on Floor 1 connected to the core switch. Label the WLC uplink as Trunk port (carries VLAN 10, 20, 30) or as a LAG (EtherChannel) for redundancy.
Draw a dotted line from each AP to the WLC labelled "CAPWAP tunnel." This represents the logical management and data tunnels — not a physical cable.
In a small table on your diagram: SSID Corp → VLAN 10 · SSID HR → VLAN 20 · SSID Guest → VLAN 30.
SW1(config)# hostname SW1 SW1(config)# ip domain-name ccna.lab
SW1(config)# crypto key generate rsa modulus 2048 ! When prompted "How many bits in the modulus?" enter 2048
SW1(config)# ip ssh version 2SW1(config)# username admin privilege 15 secret Cisco123!SW1(config)# line vty 0 15 SW1(config-line)# transport input ssh SW1(config-line)# login local SW1(config-line)# exec-timeout 5 0
SW1(config)# interface vlan 1 SW1(config-if)# ip address 192.168.1.100 255.255.255.0 SW1(config-if)# no shutdown
Click PC1 → Desktop → SSH. Enter IP: 192.168.1.100, User: admin, Password: Cisco123!. You should get a CLI session.
In PC1 → Desktop → Terminal (Telnet). Try connecting to 192.168.1.100 — it should refuse the connection.
| Command | Expected Result |
|---|---|
| show ssh | Version 2.0, active sessions listed |
| show running-config | section vty | transport input ssh (not telnet or all) |
| show ip ssh | SSH Enabled — version 2.0 |
3× 2960 switches (SW1 core, SW2, SW3), 1× 1941 router, 1× WLC, 1× Lightweight AP, 6× PCs, 1× wireless laptop.
Create VLANs 10, 20, 30 on all switches. Configure trunk ports between SW1–SW2 and SW1–SW3. Configure LACP EtherChannel between SW2 and SW3 (two links). Verify with show vlan brief and show etherchannel summary.
Force SW1 to be root for all VLANs (priority 4096). Add PortFast + BPDU Guard on all access ports. Verify with show spanning-tree.
Connect router to SW1. Configure subinterfaces .10, .20, .30. Verify cross-VLAN pinging.
Connect WLC and AP. Create Corp WLAN (VLAN 10, WPA2 PSK). Connect wireless laptop to Corp. Verify it gets a VLAN 10 address.
Configure SSH v2, disable Telnet, create local user. Verify SSH login from a PC.
Wired PC in VLAN 10 (SW2) should ping wireless laptop on Corp WLAN (VLAN 10). PC in VLAN 10 should NOT ping PC in VLAN 20 directly — only through the router.
R1 — R2 — R3. Each router has one LAN: R1 LAN = 10.1.0.0/24, R2 LAN = 10.2.0.0/24, R3 LAN = 10.3.0.0/24. Links: R1–R2 = 10.0.12.0/30, R2–R3 = 10.0.23.0/30.
R1(config)# router ospf 1 R1(config-router)# network 10.0.0.0 0.255.255.255 area 0
Repeat on R2 and R3.
R1(config)# ip route 0.0.0.0 0.0.0.0 10.0.12.2Redistribute into OSPF: default-information originate under the OSPF process.
R3# show ip routeIdentify each line: C = directly connected · O = OSPF · S* = static default. The [110/X] format = [AD/metric].
Q1: Where does R3 send packets to 10.1.0.5? → (answer: Gi0/1 toward R2)
Q2: Where does R3 send packets to 8.8.8.8? → (answer: via default route)
Q3: Where does R3 send packets to 10.3.0.99? → (answer: directly connected, Gi0/0)
Q4: What happens to a packet for 192.168.99.1 with NO default route? → (dropped — ICMP unreachable)
Destination Next-Hop 10.0.0.0/8 via Gi0/0 10.1.0.0/16 via Gi0/1 10.1.1.0/24 via Gi0/2 10.1.1.128/25 via Gi0/3 0.0.0.0/0 via Gi0/4 (default)
Matches /8, /16, /24, AND /25 → longest match = /25 → Gi0/3
Matches /8, /16, /24 but NOT /25 (50 is in .0–.127) → longest = /24 → Gi0/2
Matches /8, /16 but NOT /24 or /25 → longest = /16 → Gi0/1
Matches /8 only → Gi0/0
No specific match → default route → Gi0/4
Generate random IPs and determine which interface they use. Practice until it feels instinctive — this is tested heavily on the real exam.
R1 connects to R2 (primary path) and R3 (backup path). Both R2 and R3 connect to the same destination LAN (192.168.2.0/24) where PC-B lives.
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.12.2This is the default AD for static routes (1). It will always be preferred.
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.13.2 200 ! AD 200 — higher than 1, so this only installs if the primary is gone
R1# show ip route ! Only the AD 1 route to 192.168.2.0 should appear — NOT the floating static
Ping from PC-A to PC-B — should succeed via R2. Run traceroute 192.168.2.x — confirm the path goes through R2.
R1(config)# interface GigabitEthernet0/1 R1(config-if)# shutdown ! shut the R1-R2 link
R1# show ip route ! Now the AD 200 route via R3 should appear — it was invisible before
Ping from PC-A to PC-B again. Should still succeed — now via R3. Run traceroute to confirm the path changed.
R1(config-if)# no shutdownThe AD 1 route returns. The floating static disappears from the table again.
3× Router 1941. R1 LAN: 192.168.1.0/24 · R2 LAN: 192.168.2.0/24 · R3 LAN: 192.168.3.0/24. Links: R1–R2 = 10.0.12.0/30, R1–R3 = 10.0.13.0/30, R2–R3 = 10.0.23.0/30. Connect a PC to each LAN.
Assign IPs to all interfaces. Enable no shutdown.
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.12.2 R1(config)# ip route 192.168.3.0 255.255.255.0 10.0.13.2 R1(config)# ip route 0.0.0.0 0.0.0.0 10.0.12.2 ! default route
Each router needs static routes pointing to the other two LANs.
From PC1, ping PC2 (192.168.2.x) and PC3 (192.168.3.x). Both should succeed.
R1(config)# ip route 192.168.2.0 255.255.255.0 10.0.13.2 200 ! AD 200 = higher than primary (AD 1) — only installs if primary fails
Shut R1's interface toward R2: interface Gi0/1 → shutdown. Check show ip route — the floating static should now be active. Ping PC2 — should still work via R3.
R1 — R2 — R3 — R4 in a line. Each router has a loopback for a LAN simulation. Links use /30 subnets.
R1(config)# router ospf 1 R1(config-router)# router-id 1.1.1.1 R1(config-router)# network 10.0.0.0 0.0.0.3 area 0 ! link to R2 R1(config-router)# network 192.168.1.0 0.0.0.255 area 0 ! LAN R1(config-router)# passive-interface GigabitEthernet0/0 ! LAN port — no hellos
Use router IDs 2.2.2.2, 3.3.3.3, 4.4.4.4 respectively. Include all connected networks in the network statement.
R1# show ip ospf neighborAll neighbors should show state FULL. If you see 2-WAY or EXSTART, wait 30 seconds and try again.
R1# show ip route ospfYou should see O routes for all remote LANs.
Ping from R1's LAN to R4's LAN — should succeed.
SW1 (2960) in the centre. R1, R2, R3 each connect to SW1. Assign IPs from 10.0.1.0/24: R1=.1, R2=.2, R3=.3.
Use process ID 1, area 0. Include the 10.0.1.0/24 network. Set Router IDs manually: R1=1.1.1.1, R2=2.2.2.2, R3=3.3.3.3.
R1# show ip ospf interface GigabitEthernet0/0Look for DR and BDR IP addresses. By default, highest Router ID = DR (R3 = 3.3.3.3 wins).
Force R1 to become DR:
R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip ospf priority 255
Set R3 to never become DR:
R3(config-if)# ip ospf priority 0R1# clear ip ospf processType yes to confirm. Do this on all three routers.
R1# show ip ospf interface GigabitEthernet0/0R1 should now be DR. R2 should be BDR. R3 should show DROTHER.
R1 connects to R3 via R2 (path 1) and also directly to R3 (path 2). Both paths have equal cost initially.
R1(config)# router ospf 1 R1(config-router)# auto-cost reference-bandwidth 1000
Repeat on all routers. This makes GigabitEthernet cost = 1, FastEthernet cost = 10.
R1# show ip route ospf R1# traceroute 10.3.0.1
Note which path is being used.
R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip ospf cost 100
R1# show ip route ospfThe route to R3's LAN should now show a higher metric and route via R2.
R1 and R2 both connected to SW1 (LAN side) and SW2 (uplink/WAN side). Add 2 PCs on SW1's LAN. LAN subnet: 192.168.1.0/24.
R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip address 192.168.1.2 255.255.255.0 R1(config-if)# standby 1 ip 192.168.1.1 ! virtual IP R1(config-if)# standby 1 priority 110 R1(config-if)# standby 1 preempt R1(config-if)# no shutdown
R2(config)# interface GigabitEthernet0/0 R2(config-if)# ip address 192.168.1.3 255.255.255.0 R2(config-if)# standby 1 ip 192.168.1.1 ! same virtual IP R2(config-if)# standby 1 priority 100 ! lower = standby R2(config-if)# no shutdown
Both PCs use gateway 192.168.1.1 (the virtual IP — never the real R1 or R2 IP).
R1# show standby briefR1 should show Active, R2 should show Standby.
Shut R1's LAN interface: interface Gi0/0 → shutdown. Run continuous pings from PC1. After ~10 seconds, R2 takes over as Active. Pings resume. Bring R1 back up — due to preempt, R1 reclaims Active.
4× routers. R1 and R2 are dual-homed to the LAN (HSRP). R3 and R4 extend the OSPF domain. A simulated WAN cloud connects to R1.
Assign /30 subnets on all inter-router links. Assign /24 subnets on all LAN segments.
All in Area 0. Set Router IDs. Use passive-interface on all LAN-facing interfaces.
Configure a static default route on R1 toward the WAN. Redistribute with default-information originate in OSPF so all routers learn it.
Virtual IP for the LAN. R1 = active (priority 110, preempt). R2 = standby (default priority 100).
| Check | Command | Expected |
|---|---|---|
| OSPF neighbors | show ip ospf neighbor | All FULL |
| All routes visible | show ip route | O routes for all remote LANs |
| HSRP state | show standby brief | R1 Active, R2 Standby |
| End-to-end ping | ping [remote LAN PC] | 100% success |
| HSRP failover | Shut R1 LAN int, ping again | Pings recover in ~10s |
R1 (edge router) with Gi0/0 = inside LAN (192.168.1.0/24) and Gi0/1 = outside (203.0.113.1/30 toward ISP). Add 3 PCs on the inside. Add a server on the outside (simulating the internet).
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overloadR1(config)# interface GigabitEthernet0/0 R1(config-if)# ip nat inside R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip nat outside
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.2Ping the outside server from PC1, PC2, PC3. Each should succeed.
R1# show ip nat translationsYou should see 3 entries — all showing inside global = 203.0.113.1 but with different port numbers (unique per inside host).
| NAT Term | In This Lab |
|---|---|
| Inside Local | 192.168.1.10 (PC1's real IP) |
| Inside Global | 203.0.113.1:1025 (public IP + port) |
| Outside Global | The destination server IP |
R1 (DHCP server router) has LAN 192.168.1.0/24. R2 is connected to R1 and has LAN 192.168.2.0/24 with PCs needing DHCP addresses. R1–R2 link: 10.0.12.0/30.
R1(config)# ip dhcp pool REMOTE-LAN R1(dhcp-config)# network 192.168.2.0 255.255.255.0 R1(dhcp-config)# default-router 192.168.2.1 R1(dhcp-config)# dns-server 8.8.8.8 R1(config)# ip dhcp excluded-address 192.168.2.1 192.168.2.10
R2(config)# interface GigabitEthernet0/0 R2(config-if)# ip helper-address 10.0.12.1
This tells R2 to forward DHCP broadcasts as unicast to R1's IP.
Click each PC → Desktop → IP Configuration → select DHCP. They should receive IPs from the 192.168.2.11+ range.
R1# show ip dhcp bindingEach PC's MAC address should appear with the assigned IP and lease time.
ip helper-address command is one of the most exam-tested IP Services topics. Remember: it goes on the router interface CLOSEST to the clients, not the DHCP server.In Packet Tracer, add a generic Server. Click it → Services → SYSLOG → enable it. Note the server's IP (e.g. 192.168.1.200).
R1(config)# ntp server 192.168.1.200 ! In a real lab, point to pool.ntp.org or a real NTP server
R1(config)# logging 192.168.1.200 R1(config)# logging trap informational ! level 6 and below R1(config)# service timestamps log datetime msec
Shut and bring back up an interface: interface Gi0/1 → shutdown → no shutdown. This generates link-state change messages.
Click the server → Services → SYSLOG. You should see timestamped entries like %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down.
| Level | Name | Example |
|---|---|---|
| 0 | Emergency | System unusable |
| 1 | Alert | Immediate action needed |
| 2 | Critical | Critical conditions |
| 3 | Error | Interface error |
| 4 | Warning | Config warning |
| 5 | Notice | Normal but significant |
| 6 | Informational | Link state change |
| 7 | Debug | Debug output |
R1 with VLAN 10 LAN (192.168.10.0/24) on Gi0/0 and a server (10.0.0.100) on Gi0/1. PCs in VLAN 10 should only be allowed to access HTTP (80) and DNS (53) on the server.
R1(config)# ip access-list extended VLAN10-TO-SERVER R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.100 eq 80 R1(config-ext-nacl)# permit udp 192.168.10.0 0.0.0.255 host 10.0.0.100 eq 53 ! implicit deny any any at the end — no need to type it
R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip access-group VLAN10-TO-SERVER in ! "in" = filtering traffic coming FROM the VLAN 10 LAN
From a PC, open the web browser (Desktop → Web Browser) and go to 10.0.0.100. Should load.
From PC, ping 10.0.0.100. Should fail because ICMP is not permitted in the ACL.
R1# show access-lists VLAN10-TO-SERVEREach ACE shows how many packets have matched it.
deny any any. If you forget to permit return traffic or DNS, everything breaks. Test each permitted service explicitly.SW1 connected to: real DHCP server (Gi0/1 — trusted uplink), PC1, PC2 (access ports — untrusted), and a rogue DHCP server on Fa0/5.
SW1(config)# ip dhcp snooping SW1(config)# ip dhcp snooping vlan 10
SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# ip dhcp snooping trust
All other ports are untrusted by default.
Set the rogue server on Fa0/5 to serve 192.168.1.200–210. Set PC1 and PC2 to DHCP. Verify they receive IPs from the legitimate server (192.168.1.11+), NOT from the rogue.
SW1(config)# ip arp inspection vlan 10 SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# ip arp inspection trust
SW1# show ip dhcp snooping binding SW1# show ip arp inspection vlan 10
PC1 and PC2 on Fa0/1 (via a hub or by swapping cables in simulation mode).
SW1(config)# interface FastEthernet0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 2 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation restrict
PC1 pings the gateway. PC2 pings the gateway. The switch learns and saves both MACs as sticky.
SW1# show port-security interface Fa0/1 SW1# show port-security address
Change PC1's MAC address (in Packet Tracer, click PC → Config → FastEthernet → change MAC) or swap with a third PC. The port should increment the violation counter. With restrict mode, the port stays up but drops the violating frames.
| Mode | Port State | Logging | When to use |
|---|---|---|---|
| shutdown (default) | err-disabled (port goes down) | Yes | Maximum security |
| restrict | Port stays up, frames dropped | Yes | Visible but non-disruptive |
| protect | Port stays up, frames dropped | No | Silent drop |
Download from postman.com (free). Create a free account or skip login.
In Postman: Settings → General → toggle off SSL certificate verification. The sandbox uses a self-signed cert.
Method: GET
URL: https://sandbox-iosxe-latest-1.cisco.com/restconf/data/Cisco-IOS-XE-native:native/hostname
Headers: Accept: application/yang-data+json
Auth: Basic Auth → username/password from sandbox page. Click Send.
You'll receive something like:{"Cisco-IOS-XE-native:hostname": "Cat8000v"}
Identify the key (hostname) and the value (Cat8000v).
URL: https://sandbox-iosxe-latest-1.cisco.com/restconf/data/ietf-interfaces:interfaces. The response will be a JSON object containing an array of interfaces. Count how many are listed. Identify which ones are iana-if-type:ethernetCsmacd.
| CRUD Operation | HTTP Verb | Use Case |
|---|---|---|
| Read | GET | Retrieve config or operational data |
| Create | POST | Add a new resource (e.g. new VLAN) |
| Update | PUT / PATCH | Replace or modify existing config |
| Delete | DELETE | Remove a resource |
{
"interfaces": [
{
"name": "GigabitEthernet1",
"ip_address": "10.0.0.1",
"status": "up",
"input_errors": 0
},
{
"name": "GigabitEthernet2",
"ip_address": "192.168.1.1",
"status": "up",
"input_errors": 42
},
{
"name": "GigabitEthernet3",
"ip_address": "null",
"status": "down",
"input_errors": 7
}
]
}
Count the objects inside the [ ] array → Answer: 3
Look for "status": "up" → Answer: 2
Find the object where name = GigabitEthernet2 → Answer: 192.168.1.1
Compare all input_errors values → Answer: GigabitEthernet2 (42 errors)
No quotes around the number → Answer: Integer (number)
Write in your notes: { } = object (key-value pairs) · [ ] = array (ordered list) · "key": "value" = string · "key": 42 = number · "key": true/false = boolean
--- - name: Configure VLANs on all access switches hosts: access_switches # which devices to target gather_facts: no connection: network_cli tasks: - name: Create VLAN 10 cisco.ios.ios_vlans: # the Ansible module config: - vlan_id: 10 name: Sales state: active state: merged - name: Create VLAN 20 cisco.ios.ios_vlans: config: - vlan_id: 20 name: HR state: active state: merged
hosts: access_switches — this tells Ansible which group of devices to run the playbook on. The group is defined in a separate inventory file (a list of IP addresses or hostnames).
The tasks: block contains two tasks: create VLAN 10 and create VLAN 20. Each task has a human-readable name and a module call.
cisco.ios.ios_vlans — this is the Ansible module for managing VLANs on Cisco IOS devices. Ansible is agentless — it connects via SSH to push these changes. No software installed on the switches.
| Concept | Meaning |
|---|---|
| Agentless | No software needed on managed devices — uses SSH |
| Playbook | YAML file defining the automation tasks |
| Inventory | List of target devices (IPs or hostnames) |
| Module | Pre-built function (ios_vlan, ios_config, etc.) |
| Idempotent | Running twice produces the same result — safe to repeat |
| Terraform (contrast) | HCL language, plan/apply, for infrastructure provisioning |
3× 2960 switches (SW1 core, SW2, SW3) · 2× routers on LAN (R1, R2 for HSRP) · 1× edge router (R-EDGE) · 1× WLC · 1× lightweight AP · 1× DHCP/Syslog server · 4× wired PCs · 1× wireless laptop
Create VLANs 10, 20, 30. Configure 802.1Q trunks between all switches. Set SW1 as STP root (priority 4096) for all VLANs. Apply PortFast + BPDU Guard to all access ports. Verify: show spanning-tree · show vlan brief.
Configure LACP EtherChannel (2 links) between SW2 and SW3. Verify: show etherchannel summary → SU flag.
Configure router-on-a-stick on R1 (subinterfaces .10, .20, .30). Verify cross-VLAN pinging from PCs.
Configure OSPFv2 Area 0 on R1, R2, R-EDGE. Set Router IDs. Use passive-interface on all LAN-facing ports. Verify: show ip ospf neighbor → all FULL.
R1 = active (priority 110, preempt). R2 = standby. Virtual IP = gateway for each VLAN. Set PC gateways to virtual IPs. Verify: show standby brief.
Configure PAT on R-EDGE. Multiple inside hosts share one public IP. Mark interfaces. Verify: show ip nat translations.
Configure DHCP server on the server. Add ip helper-address on R1's VLAN interfaces. PCs get IPs via DHCP. Verify: show ip dhcp binding.
SSH v2 on all switches. Extended ACL: permit only HTTP and DNS from VLAN 10 to server. Apply in correct direction. Verify SSH login; verify ping to server is blocked.
DHCP snooping on all VLANs. Port security (max 2 MACs, sticky, restrict) on all access ports. Verify: show port-security interface.
Create Corp WLAN on WLC (VLAN 10, WPA2 PSK). Connect wireless laptop. Verify it gets a VLAN 10 IP and can ping wired PCs in VLAN 10.
Configure syslog pointing to server. Configure NTP client on all routers. Verify timestamps in log output.
| # | Fault Type | Symptom | Diagnostic Command |
|---|---|---|---|
| 1 | Wrong VLAN on access port (PC in VLAN 1 instead of 10) | PC can't reach VLAN 10 gateway | show vlan brief |
| 2 | Missing OSPF network statement on one router | That router's LAN not in routing table of others | show ip ospf interface / show ip route |
| 3 | ACL applied in wrong direction (out instead of in) | ACL has zero matches / wrong traffic blocked | show access-lists / show run int |
| 4 | Native VLAN mismatch on a trunk | Native VLAN traffic tagged incorrectly / CDP warning | show interfaces trunk |
| 5 | Duplex mismatch on an uplink | High CRC errors / slow throughput | show interfaces [int] |
| 6 | Missing ip helper-address on a VLAN interface | PCs in that VLAN get APIPA (169.254.x.x) | show run int vlan [id] |
| 7 | Wrong STP root (wrong switch is root) | Suboptimal path / traffic not flowing as expected | show spanning-tree |
| 8 | Port security violation not cleared (port err-disabled) | PC connected but port shows err-disabled in red | show port-security int |
| 9 | SSH version 1 configured (not version 2) | SSH connects but exam requires v2 | show ip ssh |
| 10 | NAT inside/outside reversed on router interfaces | No translations appear in show ip nat translations | show run int / show ip nat stats |
show interfaces, show ip route, show vlan brief, and ping before you need deeper commands.| Resource | Type | Notes |
|---|---|---|
| Cisco Learning Network | Free | learningnetwork.cisco.com — official sample questions |
| Boson ExSim | Paid (~$100) | Closest to real exam — highly recommended |
| Jeremy's IT Lab (YouTube) | Free | Free Anki flashcard deck + practice questions |
| Packet Tracer Activities | Free | Cisco NetAcad has CCNA PT activities by topic |
100 questions · 120 minutes · No pausing · No looking things up. Record your score by domain. Target: 75%+.
Don't just note the correct answer — understand WHY each wrong answer was wrong, and why the correct answer is right. This is the most important study step.
Focus on domains where you scored below 70% in Mock #1. Target 80%+.
Flashcard review: syslog levels, AD values, ACL placement rules, HSRP/OSPF commands. No new topics.
No heavy study. Review key mnemonics. Get 8 hours sleep. Eat well.
Arrive 30 minutes early. Bring valid photo ID. Time budget: simulation questions = 5–8 min each. Flag uncertain questions and return. Never leave blank — no penalty for guessing.