Find the scenario you want to
Choose a certification collection, then narrow it by one topic. Every lab begins with a real symptom and ends with a verified repair.
Cisco Catalyst Center
The controller almost no one can home-lab: Cisco's own appliance alone needs 32 vCPUs and 256GB of dedicated RAM just to boot. We include it live and ready to launch: build SD-Access fabrics, explore Assurance telemetry, and automate with the Intent APIs.
- SD-Access fabric provisioning
- Assurance & telemetry
- Plug-and-Play onboarding
- REST / Intent API automation
Browse by goal
CCNA · 200-301
FreeSpanning Tree: Root Bridge Election
A free, ungated example lab: a misconfigured root bridge sends traffic the long way round. No email required to see the fix.
More details
CCNA · 200-301
FreeVLANs, Trunking & Spanning Tree
802.1Q trunks and native VLANs, STP root election, and inter-VLAN routing on a switched campus.
More details
CCNA · 200-301
FreeOSPF Neighbor Down: Area Mismatch
Two routers ping each other fine across a direct link, but their OSPF adjacency refuses to form. Work it from Layer 3 up to the routing protocol.
More details
CCNA · 200-301
FreeStatic Route: Wrong Next Hop
A static-route command names an unreachable next hop, so its prefix never reaches the routing table. Inspect the configuration, repair it, and prove the remote LAN is reachable.
More details
CCNA · 200-301
FreeAccess Control Lists: Configuring & Verifying
PC1 can't reach a server through R1, and the router is sending back an explicit deny, not a timeout. The permit entry meant to allow it is right there in the ACL.
More details
CCNA · 200-301
FreeEtherChannel: LACP Mode Mismatch
A two-link uplink should bundle, but each member remains individual. Compare both ends, correct the LACP mode, and verify the port channel.
More details
CCNA · 200-301
FreeNAT Overload: ACL Selection Error
Inside users reach the router but never the internet. Trace the NAT ACL, correct its wildcard mask, and verify live translations.
More details
CCNA · 200-301
FreeIPv6 SLAAC: Missing Router Advertisement
Hosts generate link-local addresses but never receive global IPv6 connectivity. Find the missing RA configuration and validate SLAAC end to end.
More details
CCNA · 200-301
FreeDHCP Relay: Missing Helper Address
A remote VLAN broadcasts DHCPDISCOVER but the centralized server never sees it. Configure and verify relay forwarding with ip helper-address.
More details
CCNA · 200-301
FreeDHCP Snooping: Trust Boundary Misconfiguration
One access switch can't reach the DHCP server. Trace the trust setting on each uplink to find the port silently dropping server replies.
More details
CCNA · 200-301
FreeVLAN Access Port: Wrong VLAN
A user reaches the switch but lands in the wrong broadcast domain. Trace the access VLAN, correct it, and prove same-VLAN reachability.
More details
CCNA · 200-301
FreeSTP Edge Port: Missing BPDU Guard
An access port is configured for fast startup but has no loop protection. Apply the right edge safeguards and verify the operational state.
More details
CCNA · 200-301
FreeInter-VLAN Routing: SVI Down
VLANs exist and trunks are up, but hosts cannot reach their gateway. Find why the SVI is down and restore inter-VLAN routing.
More details
CCNA · 200-301
FreeOSPF: Passive Interface Surprise
A router advertises a subnet but never forms the intended adjacency. Identify the passive-interface scope and restore only the required OSPF hello traffic.
More details
CCNA · 200-301
FreeIPv4 VLSM: Overlapping Subnets
A new subnet is added for growth but routing behaves unpredictably. Calculate the correct VLSM boundary and remove the overlap.
More details
CCNA · 200-301
FreeExtended ACL: Direction and Placement
The ACL syntax is valid, yet return traffic fails. Determine the correct interface direction and placement for the policy.
More details
CCNA · 200-301
FreeNTP: Wrong Source Interface
Clients can reach the time server, but authentication or ACL checks reject synchronization. Set a stable NTP source and verify stratum.
More details
CCNA · 200-301
FreeIPv6 Static Route: Invalid Next Hop
An IPv6 prefix is configured but absent from the routing table. Inspect recursive resolution, correct the next hop, and verify the remote LAN.
More details
CCNA · 200-301
FreeIPv6 Neighbor Discovery: Default Gateway Failure
Hosts have a global IPv6 address but cannot leave the LAN. Diagnose router advertisements and the default-router lifetime.
More details
CCNA · 200-301
FreeHSRP: Priority and Preempt
The backup gateway is active after recovery even though the preferred router is healthy. Read HSRP state, priorities, and preempt behavior.
More details
CCNA · 200-301
FreeHSRP: Missing Uplink Tracking
The active gateway remains reachable locally after its WAN fails, blackholing client traffic. Configure object tracking so HSRP fails over on the real fault.
More details
CCNP · ENARSI
OSPF Multi-Area & Redistribution
Areas and LSA types, route summarization, and controlled redistribution between OSPF and EIGRP.
More details
CCNP · ENARSI
BGP Peering & Path Selection
eBGP and iBGP sessions, the best-path algorithm, and policy via local-preference, AS-path and communities.
More details
CCNA · 200-301
EIGRP Neighbor Down: AS Mismatch
Two routers connect over a live link and ping fine, but their EIGRP neighbor adjacency never forms. The configuration looks right at first glance.
More details
Palo Alto · PCNSE
NGFW Zones, NAT & App-ID
Security zones, source/destination NAT, App-ID security policies and SSL decryption on PAN-OS.
More details
Fortinet · NSE 4
FortiGate Policy & IPsec VPN
Firewall policies, SD-WAN rules and a site-to-site IPsec tunnel between two FortiOS gateways.
More details
Check Point · CCSE
Security Policy & Identity Awareness
Ordered policy layers, NAT rules and Identity Awareness on a Gaia gateway managed from SmartConsole.
More details
Cisco SD-WAN · Viptela
Cisco SD-WAN (Viptela)
Stand up the vManage/vSmart/vBond control plane and bring a WAN edge under management over a live overlay.
More details
RHCSA · EX200
Linux Firewalld & iptables Policy
Zone-based firewalld policy, iptables/nftables rule chains, and troubleshooting a host that's silently dropping traffic.
More details
RedHat · RH294
Ansible Playbook Automation
Write and run real Ansible playbooks against multiple managed hosts: inventories, roles, idempotent tasks and ad-hoc modules.
More details
CCNP · DCACI
Cisco ACI EPGs & Contracts
Bridge domains, EPGs and contract-based policy on a real APIC-managed ACI fabric, not a slide deck.
More details
CCNP · DCINX9K
Nexus 9000 NX-OS Switching
vPC domains, peer-links and standalone NX-OS switching on real Nexus 9000 gear, not the ACI-mode UI.
More details
CCNP · ENARSI
BGP Route Reflector Scaling
Replace a full iBGP mesh with route reflectors and clusters: clients, non-clients, and cluster-ID loop prevention.
More details
CCNP · CLCOR
CUCM Dial Plan & Call Routing
Route patterns, partitions/calling search spaces and a working SIP trunk on a real Cisco Unified Communications Manager cluster.
More details
Security · Zero Trust
Zero Trust: JWT Access & Token Expiry
Never trust, always verify: explicit auth, least-privilege endpoints and short-lived JWTs that fail closed the moment they expire.
More details
Cisco · SVPN
GRE VPN Endpoint Migration
Cut a live site-to-site GRE tunnel over to new ISP IPs with minimal downtime, keeping DNS, LDAP and web reachable across both sites.
More details
Linux · RHCSA
Linux Namespaces & veth Routing
veth pairs, network namespaces and inter-subnet routing, the primitives Docker and containerlab use to wire every container.
More details
Cisco · SPCOR
MPLS L3VPN: Customer Routes Missing
The MPLS core is up and MP-BGP is peering, but two sites in the same L3VPN still can't see each other's routes.
More details
Cisco · DEVASC
RESTCONF: 2xx, But Nothing Changed
A Python script pushes config over RESTCONF and returns success every run, yet the device never actually changes.
More details
Cisco · DEVCOR
Webhooks: Events Fire, Nothing Runs
The platform is sending webhook events and the receiver logs are clean, but the automation never triggers.
More details
Cisco · CBROPS
SOC Triage: The Alert That Didn't Fire
A host is beaconing out and the telemetry is in the SIEM, but the detection rule that should have caught it never triggered.
More details
Cisco · AIOps
Assurance: Red Score, Happy Users
Assurance flags a switch red while its users are fine, and a genuinely degraded uplink shows healthy. The model is only as good as its telemetry.
More details