CCNA HANDS-ON LABS_
Free CCNA practice labs for SwitchLab and Cisco Packet Tracer. Download a starting topology, follow the tasks, use hints when needed, and verify your configuration against a worked solution. Start with guided lessons, then tackle troubleshooting and capstones.
★ Your first lab
New to networking? Trace an Ethernet link and watch a switch learn MAC addresses in a guided, 15-minute lesson.
START YOUR FIRST LAB
BEGINNER — guided foundations
INTERMEDIATE — apply and troubleshoot
ADVANCED — multi-topic challenges
Need to sharpen your skills before you start? Drill IPv4 and IPv6 subnetting, EUI-64, IPv6 types, and STP root election — all in the browser.
ALL PRACTICE TOOLS ↗
★ SWITCHLAB LABS
Choose a topic and work from guided practice toward requirements, troubleshooting and challenges. Expand a topic below, or filter to find a lesson. Import and export require a desktop-width SwitchLab window; exporting your work requires a free account.
64 labs available
No labs match these filters. Reset filters to browse the full library.
Ethernet and interface fundamentals3 lessons
SWITCHLAB · Guided
Trace an Ethernet Link and MAC LearningFollow two hosts through one switch, generate traffic and identify the learned source MAC addresses.Beginner · 15 min · 1.0 Network FundamentalsSWITCHLAB · Troubleshooting
Restore a Shutdown Access InterfaceDistinguish an administratively disabled access port from an addressing problem and restore the workstation.Intermediate · 15 min · 1.0 Network FundamentalsSWITCHLAB · Requirements
Commission a Workstation Access LinkBring a pre-cabled workstation port into service using an approved port description and access policy.Intermediate · 15 min · 1.0 Network FundamentalsVLANs and access ports4 lessons
SWITCHLAB · Guided
VLAN Guided LabConnect two departments across two switches while keeping their traffic in separate VLANs.Beginner · 25 min · 2.0 Network AccessSWITCHLAB · Troubleshooting
Repair a Workstation in the Wrong VLANInspect the local access-port membership before changing a trunk. Repair one access-port assignment without changing host addresses.Intermediate · 20 min · 2.0 Network AccessSWITCHLAB · Requirements
Provision Departmental Access PortsApply a department-to-port plan while preserving an existing trunk, then prove configuration and traffic independently.Intermediate · 20 min · 2.0 Network AccessSWITCHLAB · Challenge
Add a Third Department without Breaking Existing VLANsExtend a two-department LAN for Operations and audit access ports, VLAN definitions and both sides of the trunk.Advanced · 30 min · 2.0 Network Access802.1Q trunking4 lessons
SWITCHLAB · Guided
Build and Inspect an 802.1Q TrunkTurn a single interswitch cable into a trunk that carries two existing departmental VLANs.Beginner · 20 min · 2.0 Network AccessSWITCHLAB · Troubleshooting
Restore a VLAN Missing from a TrunkDistinguish a per-VLAN outage from a physical uplink failure. Compare both trunk allowed lists and restore the missing VLAN.Intermediate · 20 min · 2.0 Network AccessSWITCHLAB · Troubleshooting
Diagnose a Native VLAN MismatchExplain why a native VLAN mismatch can coexist with working tagged traffic. Repair the inconsistent native VLAN on the designated switch.Intermediate · 20 min · 2.0 Network AccessSWITCHLAB · Requirements
Carry Selected VLANs through Three SwitchesCommission the two uplinks of a distribution switch while retaining a restricted VLAN policy on the edge trunks.Intermediate · 20 min · 2.0 Network AccessSTP and RSTP4 lessons
SWITCHLAB · Guided
Read Root, Designated and Alternate STP PortsInspect a working redundant triangle and relate STP port roles to the physical paths carrying host traffic.Beginner · 20 min · 2.0 Network AccessSWITCHLAB · Requirements
Choose Primary and Secondary STP RootsPlace a distribution switch at the root and set an explicit backup priority while preserving host delivery.Intermediate · 20 min · 2.0 Network AccessSWITCHLAB · Troubleshooting
Repair an Unintended STP Root ElectionCorrect a single overly low access-switch priority without disturbing the approved distribution-switch configuration.Intermediate · 20 min · 2.0 Network AccessSWITCHLAB · Challenge
Design a Redundant Rapid-PVST CampusPlace different VLAN roots on two distribution switches and verify converged traffic after an uplink outage.Advanced · 30 min · 2.0 Network AccessEtherChannel / LACP3 lessons
SWITCHLAB · Guided
Bundle Two Uplinks with LACPNegotiate a two-member LACP trunk and distinguish an operational bundle from independent redundant links.Beginner · 25 min · 2.0 Network AccessSWITCHLAB · Troubleshooting
Repair a Passive-Passive LACP BundleRestore LACP negotiation when neither switch initiates it, then verify both member ports and host traffic.Intermediate · 25 min · 2.0 Network AccessSWITCHLAB · Requirements
Extend a Trunk Port-Channel for StaffCarry a second VLAN over an existing LACP bundle and prove the port-channel survives one member outage.Intermediate · 25 min · 2.0 Network AccessIPv4 addressing and subnetting4 lessons
SWITCHLAB · Guided
Address Hosts inside a /26 SubnetCalculate a /26 network and usable range, then place a workstation beside its peer without adding a router.Beginner · 20 min · 1.0 Network FundamentalsSWITCHLAB · Troubleshooting
Repair a Host Address and Subnet MaskCompare host settings with an approved /24 LAN and restore local and routed traffic.Intermediate · 20 min · 1.0 Network FundamentalsSWITCHLAB · Requirements
Apply a VLSM Plan to Two Routed LANsAllocate a /27 and /28 from one /24 and configure their router gateways without overlapping subnets.Intermediate · 20 min · 1.0 Network FundamentalsSWITCHLAB · Troubleshooting
Repair an Incorrect Default GatewayUse local reachability as a control while correcting a workstation’s off-subnet forwarding choice.Intermediate · 20 min · 1.0 Network FundamentalsStatic routing4 lessons
SWITCHLAB · Guided
Configure Your First IPv4 Static RoutesAdd specific routes between two directly connected routers and prove that the forward path and reply path both work.Beginner · 25 min · 3.0 IP ConnectivitySWITCHLAB · Requirements
Static Routing Requirements LabProvide two-way connectivity between two branch networks using a specific route and a default return route.Intermediate · 25 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Troubleshoot a Static Route Next HopTrace a branch outage from working local gateways to an incorrect static next hop, then repair the route without changing addressing.Intermediate · 20 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Troubleshoot a Missing Return RouteExplain why a correct outbound static route is insufficient, find the missing reply path, and restore two-way connectivity.Intermediate · 25 min · 3.0 IP ConnectivityDefault and floating static routes3 lessons
SWITCHLAB · Guided
Use a Default Route at a Stub BranchConnect a stub branch to two HQ LANs with one default route and verify that connected routes still serve local traffic.Intermediate · 25 min · 3.0 IP ConnectivitySWITCHLAB · Guided
Configure and Test Floating Static BackupVerify static-route preference and prove an alternate circuit carries traffic when the primary link is unavailable.Intermediate · 25 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Repair a Floating Static Route PreferenceCorrect a backup static route that outranks the intended primary, then verify normal preference and controlled failover at both routers.Intermediate · 25 min · 3.0 IP ConnectivitySingle-area OSPF7 lessons
SWITCHLAB · Guided
Build Your First OSPF Neighbor RelationshipEnable single-area OSPF on two addressed routers, identify each peer, and follow a learned route to the remote LAN.Beginner · 30 min · 3.0 IP ConnectivitySWITCHLAB · Requirements
Advertise LANs over an Existing OSPF LinkExtend an established OSPF adjacency to carry two workstation LAN prefixes while keeping the LAN interfaces passive.Intermediate · 25 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
OSPF Troubleshooting LabFind why an operational router link has no OSPF neighbor, repair the fault, and prove route recovery.Intermediate · 20 min · 3.0 IP ConnectivitySWITCHLAB · Requirements
Route through a Three-Router OSPF CoreConnect two LANs through a transit-only core router and verify that OSPF carries routes across two separate adjacencies.Intermediate · 35 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Repair an OSPF Area MismatchReconcile incompatible OSPF areas on a working IPv4 transit link and verify that adjacency and LAN routes recover.Intermediate · 25 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Find a Missing OSPF LAN AdvertisementDiagnose failed user traffic when OSPF neighbors remain FULL but one remote LAN route has disappeared.Intermediate · 25 min · 3.0 IP ConnectivitySWITCHLAB · Challenge
Design and Test a Resilient OSPF TriangleDeploy OSPF with a preferred core path and a higher-cost direct backup, then prove recovery after a simulated core-link outage.Advanced · 45 min · 3.0 IP ConnectivityIPv64 lessons
SWITCHLAB · Guided
Configure and Verify IPv6 Router InterfacesAddress IPv6 LAN and transit interfaces, enable IPv6 routing and verify the supplied hosts and route plan.Beginner · 20 min · 3.0 IP ConnectivitySWITCHLAB · Requirements
Build IPv6 Static Routing between Two SitesInstall both IPv6 forward and return routes while preserving an already working IPv4 network.Intermediate · 20 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Repair an IPv6 LAN Prefix MismatchUse working IPv4 traffic as a control while correcting a router interface in the wrong IPv6 prefix.Intermediate · 20 min · 3.0 IP ConnectivitySWITCHLAB · Challenge
Deliver Dual-Stack Connectivity between SitesComplete independent IPv4 and IPv6 routing plans and prove host delivery in both address families.Advanced · 30 min · 3.0 IP ConnectivityDHCP and DHCP relay4 lessons
SWITCHLAB · Guided
Allocate Client Addresses from a Router DHCP PoolCreate a local DHCP pool with reserved infrastructure addresses, renew the client and verify its lease and routed traffic.Beginner · 25 min · 4.0 IP ServicesSWITCHLAB · Troubleshooting
Repair an Incorrect DHCP Gateway OptionFix the default-router option at the DHCP server and prove that a renewed lease restores remote access.Intermediate · 25 min · 4.0 IP ServicesSWITCHLAB · Requirements
Serve a Remote LAN through DHCP RelayRelay client broadcasts to a pool on a remote router without moving the server onto the client LAN.Intermediate · 25 min · 4.0 IP ServicesSWITCHLAB · Troubleshooting
Restore a Missing DHCP RelayDiagnose a client with no usable lease while preserving the correct remote pool and routed return path.Intermediate · 25 min · 4.0 IP ServicesACLs4 lessons
SWITCHLAB · Guided
Apply and Verify a Standard IPv4 ACLRestrict one source host at the destination LAN and verify both denied and permitted traffic.Beginner · 25 min · 5.0 Security FundamentalsSWITCHLAB · Requirements
Implement a Source-and-Destination Access PolicyUse an extended ACL to block one source-to-destination path while retaining the source’s access to another host.Intermediate · 25 min · 5.0 Security FundamentalsSWITCHLAB · Troubleshooting
Repair ACL Rule OrderingMove a specific deny ahead of a broad permit and prove the effective first-match policy.Intermediate · 25 min · 5.0 Security FundamentalsSWITCHLAB · Troubleshooting
Repair ACL Placement and DirectionAttach the correct ACL to the actual packet exit direction without changing its policy entries.Intermediate · 25 min · 5.0 Security FundamentalsNAT / PAT3 lessons
SWITCHLAB · Guided
Translate an Inside Host with Static NATMap one private host to a specific outside address and verify the translation with traffic and the NAT table.Beginner · 25 min · 4.0 IP ServicesSWITCHLAB · Requirements
Share an Outside Address with PATTranslate two inside hosts through the outside interface and inspect their separate PAT mappings.Intermediate · 25 min · 4.0 IP ServicesSWITCHLAB · Troubleshooting
Repair Reversed NAT Interface RolesCorrect swapped inside/outside interface assignments while preserving the approved overload rule.Intermediate · 25 min · 4.0 IP ServicesManagement / SSH / device hardening2 lessons
SWITCHLAB · Guided
Configure a Switch Management Address and Local AccountCreate a lab administrator and commission a reachable management SVI.Beginner · 25 min · 5.0 Security FundamentalsSWITCHLAB · Requirements
Configure and Verify Authenticated SSH AccessEnable SSH with local authentication, reject an incorrect password and run a remote verification command.Intermediate · 25 min · 4.0 IP ServicesLayer 2 security2 lessons
SWITCHLAB · Guided
Protect a Host Access Port with a Secure MACAllow the approved workstation MAC on an access port and prove a mismatched secure address blocks traffic.Beginner · 25 min · 5.0 Security FundamentalsSWITCHLAB · Troubleshooting
Recover from a Port-Security ViolationReplace a stale secure MAC, recover the access port and verify the approved host can transmit again.Intermediate · 25 min · 5.0 Security FundamentalsTroubleshooting2 lessons
SWITCHLAB · Troubleshooting
Separate Host, Switching and Routing FaultsUse independent control paths to isolate two faults without changing a working routed core.Intermediate · 35 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Restore a Branch after a Failed ChangeRepair a wrong static next hop and disabled destination LAN, verifying local and end-to-end paths separately.Intermediate · 35 min · 3.0 IP ConnectivityMulti-topic comprehensive labs2 lessons
SWITCHLAB · Requirements
Connect Departmental VLANs through Routed GatewaysComplete gateway activation and VLAN carriage, then prove local, inter-VLAN and remote paths separately.Intermediate · 35 min · 3.0 IP ConnectivitySWITCHLAB · Requirements
Migrate a Routed Site from Static Routes to OSPFReplace working specific static routes with OSPF and prove the final route source, return path and durable configuration.Intermediate · 35 min · 3.0 IP ConnectivityFinal capstones5 lessons
SWITCHLAB · Requirements
Small Office DeploymentDeliver a VLSM office/workshop network with automatic office addressing and verified inter-LAN routing.Advanced · 45 min · 3.0 IP ConnectivitySWITCHLAB · Requirements
Branch Office DeploymentCommission branch DHCP and OSPF, then prove a leased workstation can reach the remote site and retain service after reload.Advanced · 45 min · 3.0 IP ConnectivitySWITCHLAB · Challenge
Multi-Switch Campus ScenarioCommission two department VLANs across two closets and connect each VLAN to its own routed gateway.Advanced · 45 min · 3.0 IP ConnectivitySWITCHLAB · Troubleshooting
Broken Network Troubleshooting CapstoneRecover a campus with host, trunk, OSPF and ACL faults while preserving the intended access policy.Advanced · 45 min · 3.0 IP ConnectivitySWITCHLAB · Challenge
TheLineman CCNA CapstoneDeliver a segmented campus, an OSPF branch and a verified resource-access policy from an incomplete network.Advanced · 60 min · 3.0 IP ConnectivityExisting Packet Tracer versions remain in the legacy library below.
★ PACKET TRACER & BROWSER LABS
EXTERNAL BROWSER LAB
SWITCHLAB — LEARN NETWORKING IN YOUR BROWSER
A free, install-free platform for practicing networking interactively in the browser. Import the .swlab downloads above to practice switching, routing, IP services and security with guided tasks and verification.
Browser-based · Switching · Hands-on · No install
BEGINNER PACKET TRACER
LAB 1 — VLAN SEGMENTATION
Two switches, six PCs. Students on VLAN 10, Staff on VLAN 100, trunk between switches. Configure from scratch and verify isolation with ping tests.
VLANs · Access Ports · Trunk Ports · 802.1Q · Portfast
INTERMEDIATE PACKET TRACER
LAB 2 — INTER-VLAN ROUTING
Add SW3 and a router. Configure dot1q subinterfaces on R1 to route between Student and Staff subnets. Two parts — isolation then routing.
Router-on-a-Stick · Dot1Q · Subinterfaces · Default Gateway
INTERMEDIATE BROWSER LAB
LAB 3 — STP ROOT BRIDGE ELECTION
Walk through the 4-step STP algorithm, then drill it in an interactive browser lab. Quiz mode, step-by-step walkthrough, and a sandbox where you change priorities and watch STP recalculate.
STP · Root Bridge · Port Roles · Port Costs · BPDU
INTERMEDIATE PACKET TRACER
LAB 4 — RAPID SPANNING TREE (RSTP)
Same triangle as Lab 3, faster recovery. Configure 802.1w / Rapid-PVST+ on three switches and watch a link failure reconverge in under a second.
RSTP · 802.1w · Rapid-PVST+ · PortFast · BPDU Guard · Edge Ports
INTERMEDIATE PACKET TRACER
LAB 5 — OSPF SINGLE AREA
Multilayer switch and one router, three PC LANs and a server segment. Configure OSPFv2 area 0, watch the adjacency reach FULL, and verify routes appear in every table.
OSPF · Area 0 · Router-ID · LSDB · Adjacency · L3 Routed Ports
INTERMEDIATE PACKET TRACER
LAB 6 — STATIC & FLOATING STATIC
Six routers, four LANs. Build full reachability with nothing but ip route, then watch your AD-100 statics beat the pre-configured OSPF on a contested link. Bonus: flip the contest with a floating static at AD 120.
Static Routes · Default Routes · Administrative Distance · Floating Static · OSPF AD Compare
INTERMEDIATE PACKET TRACER
LAB 7 — ETHERCHANNEL (PAgP / LACP / STATIC)
Three EtherChannel modes in one topology. Build a routed PAgP /30 between distribution switches, an LACP trunk between access switches, and a Static bundle on the third — then ping end-to-end through all three.
EtherChannel · LAG · PAgP · LACP · Static · L3 Port-Channel · Inter-VLAN
INTERMEDIATE PACKET TRACER
LAB 8 — OSPF MULTI-AREA
Six routers, five OSPF areas. Backbone area 0 with R100/R200, three ABRs (R10/R20/R30) using loopback router-IDs and network statements, and R40 configured in modern interface-mode. Watch type-3 summary LSAs leak between areas in show ip ospf database.
OSPF · Multi-Area · ABR · LSA Types · Loopback Router-ID · Interface-Mode OSPF
INTERMEDIATE PACKET TRACER
LAB 9 — CDP & LLDP NEIGHBOR DISCOVERY
Four devices, two discovery protocols. Observe CDP, manipulate it globally and per-interface, then enable LLDP across the topology and compare. Learn why CDP doesn't cross switches, why you turn it off on edge interfaces, and exactly what an attacker harvests from one frame.
CDP · LLDP · 802.1AB · Neighbor Discovery · Security · Edge Hardening
INTERMEDIATE BROWSER LAB
LAB 10 — ACL EVALUATION (STANDARD, EXTENDED, NAMED)
Top-down, first-match-wins, implicit deny. Read sample ACLs by hand, then build standard, extended, and named ACLs from CLI templates. Drill the matching logic on randomized packets in the browser drill — Standard, Extended, and Mixed modes.
ACL · Standard · Extended · Named · Wildcard Mask · access-class · CCNA Domain 5
INTERMEDIATE BROWSER LAB
LAB 11 — PACKET FLOW & ENCAPSULATION
Trace one packet host → switch → router → router → switch → server: ARP, MAC learning, encapsulation/decapsulation and TTL at every hop — then the TCP 3-way handshake, UDP, FTP active/passive and DHCP. Driven in the live packet visualizer, with an optional Packet Tracer simulation-mode build.
Encapsulation · ARP · TTL · TCP/UDP · DHCP · CCNA Domain 1
INTERMEDIATE PACKET TRACER
LAB 12 — NAT OVERLOAD (PAT)
Configure NAT overload to allow multiple inside hosts to share a single public IP. The most common NAT in the wild.
NAT · PAT · Inside/Outside · ip nat pool
◌ COMING SOON
ADVANCED PACKET TRACER
LAB 13 — FULL CCNA TOPOLOGY
VLANs, trunking, inter-VLAN routing, OSPF, NAT, ACLs all in one topology. Exam-style, no handholding.
Everything · Comprehensive · Exam-ready
◌ COMING SOON
[ ★ WHAT'S COMING ]
NAT overload and final capstones are now available in the SwitchLab library. The Packet Tracer versions above remain planned. Every lab gets a matching lab doc that walks through the why, not just the how. If there's a topic you'd like a lab for, send it through on the contact page._
★ SWITCHLAB — SETUP & FAQ
How do I open a SwitchLab lesson?
Download the lesson’s .swlab file, open SwitchLab, and choose Import Sandbox (folder icon). Keep the lesson beside the simulator for tasks, hints and verification. SwitchLab files do not open in Packet Tracer.
Can I do these labs on my phone?
You can read lessons on your phone. SwitchLab import and export controls require a desktop-width window, so use a laptop or desktop to load and save your lab.
Do I need an account to save my SwitchLab work?
The lesson pages and starting files are free to access. Use a free SwitchLab account to export your work. Export before restarting; reimporting the original download resets the network.
Which file should I download?
Choose .swlab for SwitchLab or .pkt for Cisco Packet Tracer. The browser drills in the older collection launch directly from their cards.
★ PACKET TRACER LABS — FAQ
Are these CCNA Packet Tracer labs free?
Yes — every lab here is free to download. No account, no signup, no paywall. Grab the .pkt file and open it in Cisco Packet Tracer.
Do I need Cisco Packet Tracer to run them?
Yes. The labs are .pkt files, so you'll need Cisco Packet Tracer — itself free from the Cisco Networking Academy. Download Packet Tracer, open the lab file, and start configuring.
Do the labs come with a walkthrough or answers?
Every lab has a matching lab doc — a full written walkthrough with the topology, IP addressing table, step-by-step tasks, the exact IOS commands, and the reasoning behind each step. Try it yourself first, then check your work against the doc.
What CCNA 200-301 topics do the labs cover?
VLANs and trunking, inter-VLAN routing (router-on-a-stick), STP and RSTP, single- and multi-area OSPF, EtherChannel, CDP/LLDP, and static/floating routes — each one mapped to the official Cisco 200-301 blueprint on the CCNA Study Hub.
Are these good for CCNA 200-301 exam practice?
Yes. The labs are built around the 200-301 blueprint and ramp from guided (Beginner) to exam-style with less guidance (Advanced), so you practice hands-on config the same way the exam tests it.