CloudLabBox
Try the free demo

CCNA practice labs online

46 guided labs that follow the CCNA 200-301 exam topics, for both v1.1 and v2.0, from your first IOS command to a redundant, dual-stack campus. They run on Cisco IOSv routers and IOSvL2 switches, with Linux hosts, and a CSR 1000v and a Catalyst 9800-CL wireless controller where a lab needs one.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 44 of the 46 labs also run in the free demo.

Guided labs
46
Follows
Cisco CCNA 200-301, v1.1 and v2.0
Runs every lab
Standard
Devices
IOSv, IOSvL2, Alpine Linux, EVE-NG GUI server, CSR 1000v, Catalyst 9800-CL and VPCS

Who these labs are for

For anyone preparing for Cisco’s CCNA 200-301, whether you sit v1.1 before 3 February 2027 or v2.0 after it, and for help-desk and junior network engineers who want real IOS practice beyond a simulator.

The course ends with troubleshooting labs, a lab on judging an AI assistant’s troubleshooting advice, and three capstones. There’s no Cisco IOL in CloudLabBox, so the routers are IOSv and the switches IOSvL2, with VPCS and Alpine Linux as the hosts.

The 46 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

CCNA 200-301 course 46 labs

Shared folderCCNA 200-301 guided labs

One topic per lab in exam order, then troubleshooting labs and three capstones.

  1. 01IOS CLI and initial device configuration

    Take a factory-fresh router and switch to a secured, addressed and saved baseline, and learn the IOS command line you will use in every other lab.

    1× IOSv, 1× IOSvL2, 1× VPCS

    3 vCPU, 3,072 MBFits LiteRuns in the free demo

  2. 02IPv4 addressing and VLSM subnetting

    Carve one private /22 into right-sized subnets for a dental practice with VLSM, address two routers and three PCs from your own plan, and prove every subnet can reach the others.

    2× IOSv, 3× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  3. 03Client IP settings and TCP versus UDP on a Linux host

    Work a help-desk ticket from the client side: read and renew a Linux laptop's IP settings, test reachability and name resolution, then capture a TCP handshake and a UDP DNS exchange to see the difference on the wire.

    1× Alpine Linux, 1× IOSv, 1× IOSvL2, 1× VPCS

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  4. 04How a switch learns MAC addresses and floods frames

    Watch two switches build their MAC address tables, catch flooded broadcasts and unknown unicasts with a packet capture, tune aging and pin a printer with a static entry.

    2× IOSvL2, 1× Alpine Linux, 3× VPCS

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  5. 05IPv6 address types with EUI-64 and SLAAC

    Bring IPv6 to a small firm: write addresses in short form, configure global, unique local, link-local and EUI-64 addresses, watch hosts address themselves with SLAAC, and route between three IPv6 LANs.

    2× IOSv, 1× Alpine Linux, 2× VPCS

    5 vCPU, 4,608 MBFits LiteRuns in the free demo

  6. 06Validate network documentation with CDP and LLDP

    Audit a site's cabling records against what the devices themselves report with CDP and LLDP, correct three documentation errors, label every link and switch discovery off where it leaks information.

    2× IOSv, 2× IOSvL2

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  7. 07Troubleshoot interface and cable faults

    A two-site network is down after a weekend of changes. Work up the layers with show interfaces, CDP and the logs to find a shut port, an err-disabled link, a duplex mismatch, a cable in the wrong port and a bad mask, and learn what each counter would tell you on real copper and fibre.

    2× IOSv, 2× IOSvL2, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  8. 08VLANs and access ports with a voice VLAN

    Split a flat office network into staff, guest, voice and management VLANs across two switches, give a desk an IP phone port, park the unused ports, and prove which hosts can still reach each other.

    2× IOSvL2, 4× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  9. 09802-1Q trunks - native VLAN and DTP

    Three switches in a row, one link that never became a trunk and another that negotiated itself into a native VLAN mismatch. Replace guesswork with static 802.1Q trunks, an unused native VLAN and a pruned allowed list.

    3× IOSvL2, 3× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  10. 10Inter-VLAN routing with router-on-a-stick

    Route between three VLANs through a single router link: build the switch side, create 802.1Q subinterfaces with a native VLAN on the router, then follow a packet as it leaves and re-enters the same cable.

    1× IOSv, 1× IOSvL2, 3× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  11. 11Inter-VLAN routing on a Layer 3 switch - SVIs and routed ports

    Turn a distribution switch into the gateway for every VLAN with SVIs, connect it to the WAN router through a routed port, and route the whole site to an 'Internet' address with a default route and a summary route back.

    2× IOSvL2, 1× IOSv, 2× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  12. 12Rapid PVST plus - choosing root bridges and sharing the load

    Read a spanning tree that elected itself, upgrade three switches from PVST+ to Rapid PVST+, place the root bridge for each VLAN on purpose so both uplinks carry traffic, and watch an alternate port take over in a second.

    3× IOSvL2, 2× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  13. 13Protecting spanning tree with PortFast and the STP guards

    Someone has plugged a switch into a desk port and it wants to be root. Watch it hijack the spanning tree, then stop it with root guard and BPDU guard, speed up host ports with PortFast, and add loop guard and (carefully) BPDU filter.

    4× IOSvL2, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  14. 14EtherChannel with LACP - Layer 2 and Layer 3

    Stop spanning tree wasting a second uplink by bundling it into a Layer 2 LACP port channel, break the bundle on purpose and read why, then build a routed Layer 3 port channel between two distribution switches.

    3× IOSvL2, 1× VPCS

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  15. 15Port security with sticky MACs and violation modes

    Lock three office ports to the devices that belong there with sticky and static secure MACs, trigger a real violation from a Linux host that changes its MAC address, and compare protect, restrict and shutdown before recovering the port.

    1× Alpine Linux, 1× IOSv, 1× IOSvL2, 2× VPCS

    5 vCPU, 4,608 MBFits LiteRuns in the free demo

  16. 16DHCP snooping and dynamic ARP inspection

    A rogue DHCP server is handing out its own gateway and a laptop is about to poison everyone's ARP cache. Stop the first with DHCP snooping, fix the option 82 side effect, then use the snooping bindings for dynamic ARP inspection and watch a spoofed ARP get dropped.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2, 2× VPCS

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  17. 17Rogue IPv6 routers - RA guard and storm control

    A device on the LAN is advertising itself as an IPv6 router. Watch hosts take its prefix, trace it to a switch port from a link-local address, contain it, and build the RA guard policies and storm-control settings a Catalyst access switch would use.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2, 1× VPCS

    5 vCPU, 4,608 MBFits LiteRuns in the free demo

  18. 18Reading the routing table and how a router chooses a route

    A hub router learns overlapping prefixes from OSPF, static routes and a default route. Decode every field of show ip route, predict the next hop for four destinations, and prove how longest match, administrative distance and metric decide.

    4× IOSv, 1× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  19. 19Static and floating static routes for IPv4 and IPv6

    Connect a head office and a branch over a private WAN with an Internet backup, using every kind of static route in both IPv4 and IPv6, then fail the WAN and discover why static failover needs both ends to notice.

    3× IOSv, 2× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  20. 20Single-area OSPFv2 from adjacency to path cost

    Replace static routes in a four-router ring with OSPFv2: enable it two ways, fix the router IDs, silence the LANs, make the links point-to-point, steer traffic with cost and advertise a default route from the Internet edge.

    4× IOSv, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  21. 21OSPF network types and the DR-BDR election

    Four routers share one Ethernet segment and elected a designated router by accident. Read the FULL and 2-WAY states, control the election with priorities, compare the broadcast and point-to-point network types, and break an adjacency with mismatched timers.

    4× IOSv, 1× IOSvL2

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  22. 22Single-area OSPFv3 for IPv6

    Route an IPv6-only network with OSPFv3: set 32-bit router IDs on routers with no IPv4 at all, enable OSPF per interface, make the links point-to-point, keep the LANs passive and originate an IPv6 default route.

    3× IOSv, 2× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  23. 23First-hop redundancy with HSRP and VRRP

    Give two VLANs a default gateway that survives a router failure: HSRP for one VLAN and VRRP for the other, each active on a different router, with interface tracking. Then pull the uplink and read every state change.

    3× IOSv, 1× IOSvL2, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  24. 24DHCPv4 server and relay with a router as a DHCP client

    Run DHCP for three LANs from one head-office router: build pools with exclusions, relay requests from a branch router, see how the server picks the right pool, and make the edge router take its own Internet address from the provider by DHCP.

    3× IOSv, 1× Alpine Linux, 2× VPCS

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  25. 25DNS - name resolution and diagnosing record problems

    Query A, AAAA, MX, NS and PTR records from a Linux client, make a router resolve names, then work three help-desk tickets caused by a wrong A record, a client with the wrong DNS server and a mail record that points at nothing.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2, 1× VPCS

    5 vCPU, 4,608 MBFits LiteRuns in the free demo

  26. 26NAT and PAT on an IOS XE edge router

    Connect a private office to the Internet through a Catalyst-class IOS XE router: publish a web server with static NAT, share a small public pool with dynamic NAT, then switch to PAT so every host shares one address, and read the translation table at each step.

    1× Alpine Linux, 1× CSR 1000v, 1× IOSv, 2× VPCS

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  27. 27NTP - one source of time for every device

    Make a core router the network's NTP server, synchronise two routers and a switch to it with authentication, set the UK time zone and summer time, and timestamp every log message correctly.

    3× IOSv, 1× IOSvL2

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  28. 28Syslog and SNMP - see what your network is saying

    Send two routers' logs to a network management station, read each message's facility, severity and mnemonic, then poll the routers with SNMPv2c and SNMPv3 and catch their link traps.

    2× IOSv, 1× IOSvL2, 1× EVE-NG GUI server

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  29. 29File transfer for configurations and images - TFTP to SFTP

    Back up a router's configuration to a server with TFTP, FTP and SCP, try SFTP from the server, compare what each protocol protects, copy a file into flash and verify its hash before an upgrade, and turn another router into an SCP server.

    2× IOSv, 1× IOSvL2, 1× EVE-NG GUI server

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  30. 30QoS per-hop behaviour on a WAN edge

    Protect voice on a congested branch link: classify and mark traffic at the edge, give voice a priority queue and video a bandwidth guarantee, shape the WAN to the provider's rate, police on the far side, and read the counters while iperf fills the pipe.

    2× Alpine Linux, 2× IOSv, 1× VPCS

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  31. 31Secure device management with SSH and VTY access control

    Replace a router's shared Telnet password with named accounts, privilege levels and SSH version 2, harden logins against guessing, and allow management only from the management VLAN, then prove it from a Linux admin laptop and from a router that should be refused.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2, 1× VPCS

    5 vCPU, 4,608 MBFits LiteRuns in the free demo

  32. 32AAA - RADIUS and TACACS plus clients with local fallback

    Move device logins to a central RADIUS server that also decides each user's privilege level, keep a local account for when the server is down, record sessions with accounting, and configure a TACACS+ client to see the fallback in action.

    2× IOSv, 1× IOSvL2, 1× EVE-NG GUI server

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  33. 33Standard ACLs - wildcard masks and where to place them

    Protect an HR server so that only the sales office can reach it: write a numbered standard ACL, rebuild it as a named ACL with remarks and sequence numbers, restrict who may manage the core router, and learn why standard ACLs belong close to the destination.

    3× IOSv, 3× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  34. 34Extended ACLs - filtering by protocol and port

    Turn a written security policy into an extended ACL at a branch: allow web and DNS to the head-office servers, ping everywhere, SSH for the admin only, block Telnet and everything else to the servers, and prove each rule from a Linux host.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2, 1× VPCS

    5 vCPU, 4,608 MBFits LiteRuns in the free demo

  35. 35Site-to-site IPsec VPN and how remote access differs

    Join two offices across an Internet provider that won't route private addresses: build a GRE tunnel, see that it works but is readable, then protect it with IKEv2 and IPsec and read the security associations and packet counters.

    3× IOSv, 2× VPCS

    5 vCPU, 5,120 MBFits LiteRuns in the free demo

  36. 36A wireless LAN controller with a WPA2-PSK WLAN

    Bring up a Catalyst 9800-CL wireless controller from its console, configure the switch ports an access point needs in local and FlexConnect mode, then build a WPA2-PSK staff WLAN in the controller's web GUI and read every setting back from the CLI.

    1× Catalyst 9800-CL, 1× IOSvL2, 1× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  37. 37REST APIs and JSON with RESTCONF on IOS XE

    Talk to a router the way controllers and automation tools do: enable RESTCONF on IOS XE, read its configuration as JSON with curl and Python, change it with PATCH, PUT and DELETE, and decode every status code and every part of the JSON.

    1× CSR 1000v, 1× EVE-NG GUI server

    2 vCPU, 5,120 MBFits LiteRuns in the free demo

  38. 38Automating IOS with Ansible

    Prepare two routers and a switch for automation, then use Ansible from a Linux control node to run show commands everywhere at once, push a baseline that proves idempotency, create a VLAN with a resource module and read device facts as JSON.

    2× IOSv, 1× IOSvL2, 1× EVE-NG GUI server

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  39. 39Evaluate troubleshooting advice from an AI assistant

    An AI operations agent has analysed an outage and produced seven findings. Check every claim against the routers' own output, reject the wrong and risky ones, pick and improve the prompt you'd send it next time, redact a configuration safely, and fix the real faults.

    3× IOSv, 1× IOSvL2, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  40. 40Troubleshooting a switched network - VLANs to EtherChannel

    A switched campus with router-on-a-stick was 'tidied up' overnight and now nothing works. Find seven faults across access ports, VLANs, trunks, the native VLAN, an EtherChannel, spanning tree and a router subinterface, using only show commands and logs.

    3× IOSvL2, 1× IOSv, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  41. 41Troubleshooting IPv4 and IPv6 addressing and static routes

    Three sites, dual stack, static routes only, and seven faults: a wrong interface mask, a wrong gateway, a missing return route, a mistyped next hop, swapped administrative distances, IPv6 routing switched off and a mistyped IPv6 prefix. Find each with ping, traceroute and the routing tables.

    3× IOSv, 3× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  42. 42Troubleshooting OSPF adjacencies and routes

    Four routers in a ring, four links, and not one healthy OSPF adjacency on the path between the two LANs. Find an area mismatch, a timer mismatch, a passive transit link, a duplicate router ID, an MTU mismatch and a LAN that was never advertised.

    4× IOSv, 2× VPCS

    6 vCPU, 6,144 MBFits LiteRuns in the free demo

  43. 43Troubleshooting IP services and ACLs

    Three LANs depend on one edge router for DHCP, DNS and Internet access, and every service has broken in a different way. Find seven faults across exclusions, a relay, a pool option, NAT interfaces and ACL, a DNS record and a filter that blocks name resolution.

    3× IOSv, 1× Alpine Linux, 2× VPCS

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  44. 44Capstone 1 - build a secure dual-stack branch office

    Build a complete branch from a requirements list, with no step-by-step instructions: VLANs and a trunk, router-on-a-stick, DHCP, PAT and a default route, IPv6 with SLAAC, SSH-only management from one VLAN, a guest ACL, port security, DHCP snooping and NTP. A grading checklist tells you when you're done.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2, 2× VPCS

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  45. 45Capstone 2 - a redundant campus with an Internet edge

    Build a two-tier campus that survives the loss of any distribution switch or link: trunks and an LACP bundle, Rapid PVST+ roots aligned with HSRP, Layer 3 switching with OSPF to an edge router, central DHCP through relays, PAT to the Internet and an ACL protecting management.

    4× IOSvL2, 2× IOSv, 3× VPCS

    9 vCPU, 9,216 MBFits Standard

  46. 46Capstone 3 - enterprise troubleshooting challenge

    The redundant campus from capstone 2 comes back with ten faults spread across access ports, trunks, EtherChannel, spanning tree, HSRP, OSPF, DHCP relay, NAT, an ACL and switch management. Work five help-desk tickets to root causes and restore the design.

    4× IOSvL2, 2× IOSv, 3× VPCS

    9 vCPU, 9,216 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the CCNA practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB3887
Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB3153
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB1415
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB; 1 vCPU, 2,048 MB66
Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial1 vCPU, 4,096 MB22
Cisco Catalyst 9800-CLc9800cl-17.12.024 vCPU, 4,096 MB11
VPCS hostBuilt in to EVE-NGcounted as 1 vCPU, 1,024 MB3775

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the CCNA labs

Are these CCNA labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 44 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 44 of the 46. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone 2 - a redundant campus with an Internet edge”, needs 9 vCPU and 9,216 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Cisco?

No. CloudLabBox wrote them to follow the topics of Cisco’s CCNA exam (200-301), both v1.1 and v2.0. They aren’t training material from Cisco, and CloudLabBox is independent of Cisco.

Do these CCNA labs use Cisco IOL?

No. There’s no Cisco IOL image in CloudLabBox. The labs use IOSv routers and IOSvL2 switches, which run Cisco IOS, with VPCS and Alpine Linux as the hosts.

Do the labs cover CCNA v1.1 or v2.0?

Both. Each lab is mapped to the CCNA 200-301 v1.1 and v2.0 exam topics, so it suits you whichever version you sit.

Are some labs slow to start?

A few. The wireless controller lab’s Catalyst 9800-CL takes about 15 to 17 minutes to boot, RESTCONF on the CSR 1000v takes a few minutes to answer, and NTP clients show synchronised about 40 minutes after the start. Each lab’s pane says what to expect.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 44 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.