CCNA · 200-301 v2.0 · Practice path
CCNA labs:
find the fault, prove the fix.
Turn networking knowledge into a troubleshooting habit. Read the evidence, make a deliberate change, and verify what happened in your browser.
Try the free STP labNo signup or installation. A browser simulation, ready to investigate.
What a lab looks like
The free spanning tree lab starts with the wrong switch as root bridge. You read show spanning-tree vlan 10, find the priority 0 that let an access switch win, lower the core switch priority to 4096, clear the access switch override, then prove the change: the output now reads This bridge is the root
.
Build from scratch →
Configure a working client network in the shared guided simulator.
Wireless GUI practice →
Connect a WPA2 client through security and VLAN settings.
Final challenge lab →
Restore connectivity and prove the access policy in the shared guided simulator.
Objective map →
Every v2.0 exam objective, and where our practice covers it.
Six stages, in order
Work in order, or revisit the stage that exposed a gap. Read the explanation, try each lab with guidance, then repeat it in expert mode. A stage is done when you can name the evidence that proves each fix without the answer open.
Understand the packet
Explain addressing, forwarding, and subnet boundaries.
Before you begin: Start here; no CLI experience needed.
IPv4 VLSM: Overlapping SubnetsA new subnet is added for growth but routing behaves unpredictably. Calculate the correct VLSM boundary and remove the overlap.Evidence:Practise subnetting hands-onOpen subnetting practiceshow ip interface briefVLAN Access Port: Wrong VLANA user reaches the switch but lands in the wrong broadcast domain. Trace the access VLAN, correct it, and prove same-VLAN reachability.Evidence:show interfaces Ethernet0/1 switchportMake switching predictable
Read VLAN and spanning-tree evidence, then restore the intended Layer 2 path.
Before you begin: Recognise a subnet and a broadcast domain.
Spanning Tree: Root Bridge ElectionA free, ungated example lab: a misconfigured root bridge sends traffic the long way round. No email required to see the fix.Trunk Allowed VLANs: A Silently Pruned VLANA newly created VLAN works on each switch but not between them. Read the trunk's allowed list and add the VLAN without wiping the ones already there.Evidence:Understand the spanning-tree output firstshow interfaces trunkSTP Edge Port: Missing BPDU GuardAn access port is configured for fast startup but has no loop protection. Apply the right edge safeguards and verify the operational state.Evidence:show spanning-tree interface Ethernet0/1 detailEtherChannel: Two Passive Ends and a Bundle That Never FormsTwo switches have matching channel-group numbers and physical links that are up, yet the EtherChannel stays down. Both ends are passive, so neither one starts LACP negotiation.Evidence:show etherchannel summaryCDP and LLDP: The Neighbour That Is Not ThereThree devices are cabled in and only two appear in the neighbour table. The cable is fine, the port is fine, and no amount of CDP will ever reveal the third one.Evidence:show cdp neighborsFollow the route
Choose the correct next hop and establish single-area OSPF connectivity and a redundant gateway.
Before you begin: Understand VLANs and IPv4 addressing.
Static Route: Wrong Next HopA static-route command names an unreachable next hop, so its prefix never reaches the routing table. Inspect the configuration, repair it, and prove the remote LAN is reachable.Evidence:show ip route 10.20.20.0Inter-VLAN Routing: SVI DownVLANs exist and trunks are up, but hosts cannot reach their gateway. Find why the SVI is down and restore inter-VLAN routing.Evidence:show ip interface briefRouter on a Stick: Missing EncapsulationSubinterfaces are addressed and up, yet one VLAN has no working gateway. Work out which half of the subinterface configuration is missing.Evidence:show running-config | section interface GigabitEthernet0/0HSRP: Priority and PreemptThe backup gateway is active after recovery even though the preferred router is healthy. Read HSRP state, priorities, and preempt behavior.Evidence:show standby briefOSPF Neighbor Down: Area MismatchTwo routers ping each other fine across a direct link, but their OSPF adjacency refuses to form. Work it from Layer 3 up to the routing protocol.Evidence:show ip interface briefIPv6 Static Route: Invalid Next HopAn IPv6 prefix is configured but absent from the routing table. Inspect recursive resolution, correct the next hop, and verify the remote LAN.Evidence:show ipv6 routeIPv6 SLAAC: Prefix Not Advertised for AutoconfigurationHosts generate link-local addresses but never receive global IPv6 connectivity. Find the missing RA configuration and validate SLAAC end to end.Evidence:show ipv6 interface Ethernet1/0Restore essential services
Trace address allocation, translation, time synchronisation, and management failures.
Before you begin: Read a routing table and verify reachability.
DHCP Relay: Missing Helper AddressA remote VLAN broadcasts DHCPDISCOVER but the centralized server never sees it. Configure and verify relay forwarding with ip helper-address.Evidence:show ip interface briefNAT Overload: ACL Selection ErrorInside users reach the router but never the internet. Trace the NAT ACL, correct its wildcard mask, and verify live translations.Evidence:show running-config | include ip natNTP: Wrong Source InterfaceClients can reach the time server, but authentication or ACL checks reject synchronization. Set a stable NTP source and verify stratum.Evidence:show clock detailSSH Remote Access: Enabling It ProperlyTelnet works, SSH is refused, and generating a key returns an error. Build the four prerequisites SSH actually needs, in the right order, then close Telnet off.Evidence:show ip sshSNMP: Community ACL Blocks the NMSThe community is configured, but the NMS times out. Follow its source ACL and correct the permitted management subnet.Evidence:show snmp communityProtect the access layer
Place security controls correctly and prove legitimate traffic still works.
Before you begin: Understand addressing, trunks, and traffic direction.
Extended ACL: Direction and PlacementThe ACL syntax is valid, yet return traffic fails. Determine the correct interface direction and placement for the policy.Evidence:show ip interfaceDHCP Snooping: Trust Boundary MisconfigurationOne access switch can't reach the DHCP server. Trace the trust setting on each uplink to find the port silently dropping server replies.Evidence:show ip dhcp snoopingDynamic ARP Inspection: Untrusted UplinkTurning on ARP inspection broke the very traffic it was meant to protect. Find the interface that should have been trusted and read the drop counters that prove it.Evidence:show ip arp inspectionPort Security: Violation and Err-disabled RecoveryA replacement PC takes the desk offline instantly. Read the secure address table, find the MAC still pinned there from the last machine, and recover the port properly.Evidence:show interfaces status err-disabledExplain automation decisions
Interpret structured data, evaluate AI advice, and distinguish automation tools.
Before you begin: Explain and verify a manual configuration change.
No lab in this stage. Practise with the review questions, then check yourself in the CCNA Readiness Assessment.
CCNA lab options compared
Most candidates use more than one. Build freely in a full emulator, and use prepared faults to practise finding problems you did not create.
| Option | Setup | Devices | Faults to diagnose |
|---|---|---|---|
| Cisco Packet Tracer | Desktop install, free with a Cisco Networking Academy account | Simulated IOS | Build any topology yourself; course activities include some prepared faults |
| Cisco CML Free | Local install on a capable PC, limited to a few nodes | Real Cisco images | Build and break it yourself |
| GNS3 or EVE-NG | Local install, plenty of RAM, and your own device images | Real device images | Build and break it yourself |
| LabFabric CCNA path | Nothing to install; any modern browser with a keyboard | Focused simulation of the commands each lab needs | 23 prepared faults with guided and expert modes |
Questions about these CCNA labs
Are these CCNA labs free?
The spanning tree root-bridge lab is open without signup. A free account unlocks more guided labs of your choice. The rest of the path, and unlimited practice questions, come with a Learning Pass.
Do I need Packet Tracer or a Cisco account?
No. Every lab on this path runs in your browser as a simulation, so there is nothing to download, no Cisco account, and no device images to find.
Does it work on a Chromebook, Mac or iPad?
Yes. The labs run in any modern browser, so a Chromebook, Mac, Linux machine or iPad with a keyboard all work. Packet Tracer, CML and GNS3 all need a desktop install.
Is a simulator enough to pass the CCNA?
Not on its own. Each lab models the commands its fault needs, not a full IOS, so it trains the diagnose, repair and verify reasoning rather than open-ended building. Pair it with your course, a book, and free building time in Packet Tracer or CML.
What is the difference between guided and expert mode?
Guided mode gives hints and lets you reveal the fix. Expert mode hides both. Only expert completions without revealing an answer count as unaided in your practice record.
After the practice path
CCNA Readiness Assessment
Test your knowledge across all five domains, complete practical simulations, and review the topics that need more work.
Start the assessmentKnow what you’re getting
The STP root-bridge lab is open without signup. A free account unlocks five additional guided labs. Try 50 practice questions free across the site. Dedicated hosted network lab sessions are purchased separately.
See current pricing, pass duration and accessScope and sources
This is independently authored practice. The path concentrates on switching, routing, services, and access security. EIGRP and advanced routing exercises elsewhere in the catalogue are extension material.
Compare with Cisco’s published exam objectivesLast reviewed against the CCNA 200-301 v2.0 exam topics: October 2026. Content maintained by LabFabric. Found an issue? Send the page URL and the command or answer that needs review.