CloudLabBox
Try the free demo

CCNP ENARSI practice labs

35 guided labs that cover the hands-on topics of the ENARSI exam: EIGRP, OSPFv2 and OSPFv3, redistribution and route control, BGP, PBR and IP SLA, VRF-Lite, BFD, MPLS, DMVPN with IPsec, AAA, ACLs, uRPF and CoPP, DHCP, SNMP, syslog and NetFlow, ending in two capstones. They run on Cisco IOSv routers.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 33 of the 35 labs also run in the free demo.

Guided labs
35
Follows
Cisco CCNP ENARSI 300-410 (v1.1)
Runs every lab
Standard
Devices
IOSv, EVE-NG GUI server, Alpine Linux, IOSvL2 and VPCS

Who these labs are for

For engineers preparing for Cisco’s CCNP Enterprise ENARSI 300-410 exam, and anyone who runs enterprise WANs and wants deliberate practice on real IOS. You should already be comfortable with CCNA-level routing.

Each protocol block ends with a troubleshooting lab, and the hints come in stages, so you can take a nudge without seeing the answer.

The 35 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

CCNP ENARSI course 35 labs

Shared folderCCNP ENARSI 300-410 guided labs

One ENARSI topic per lab, a troubleshooting lab after each block, and two capstones.

  1. 01EIGRP classic and named mode for IPv4 and IPv6

    Run classic-mode and named-mode EIGRP side by side in one autonomous system, for IPv4 and IPv6, and learn to read the neighbour, topology and routing tables that every later EIGRP lab relies on.

    4× IOSv, 2× VPCS

    6 vCPU, 4,096 MBFits LiteRuns in the free demo

  2. 02EIGRP metrics feasible successors and unequal-cost load balancing

    Calculate EIGRP metrics by hand, find successors and feasible successors in the topology table, and use variance to load-share across a fibre and a slower microwave link, then prove why the same trick fails in the other direction.

    4× IOSv, 2× VPCS

    6 vCPU, 4,096 MBFits LiteRuns in the free demo

  3. 03EIGRP stub routing summarisation default routing and authentication

    Shrink two branch routing tables to a single default route, summarise each branch's LANs into one prefix, stop HQ from querying the branches, and authenticate every EIGRP adjacency with HMAC-SHA-256 and MD5.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  4. 04Troubleshooting EIGRP

    Six faults were introduced during a weekend change window in a mixed classic and named-mode EIGRP network. Work through the tickets with a structured method, find each root cause and fix it without breaking anything else.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  5. 05OSPF network types router types and the link-state database

    Build a three-area OSPFv2 network that uses broadcast, point-to-point and non-broadcast links, control the DR election, add an ASBR, and then read every LSA type in the database to see how OSPF describes the network.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  6. 06OSPF area types summarisation and filtering

    Turn one area into a totally stubby area and another into a totally NSSA, summarise inter-area and external routes, and filter a guest network at the ABR, measuring the effect on every router's database.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  7. 07OSPF virtual links authentication and path preference

    Reconnect an area that was added without touching the backbone, secure the backbone and the virtual link with MD5 and a transit area with HMAC-SHA-256, fix a cost problem caused by a 10 Gbps link, and compare E1 and E2 external routes.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  8. 08OSPFv3 address families for IPv4 and IPv6

    Run IPv4 and IPv6 in one OSPFv3 process with address families, make the branch area totally stubby for both, summarise each family, authenticate the backbone with IPsec, and read the new OSPFv3 LSA types.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  9. 09Troubleshooting OSPF

    Six OSPF faults hide in a three-area network: stuck adjacencies, missing neighbours, a link that is FULL but unused, an isolated area and a missing external route. Diagnose each one from the evidence and fix it at the root.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  10. 10Route filtering with prefix lists route maps distribute lists and tags

    Clean up what a partner injects into your EIGRP domain: accept only the prefixes the contract allows, tag them, keep them away from the branch, and stop a test subnet reaching the data centre, using prefix lists, route maps, an ACL and route tags.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  11. 11Mutual redistribution administrative distance and loop prevention

    Join an OSPF domain and an EIGRP domain at two routers, see how administrative distance and feedback create suboptimal paths and loops, and fix them for good with route tags and an administrative distance change.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  12. 12Troubleshooting redistribution administrative distance and route control

    Six months after the OSPF and EIGRP domains were joined, redundancy has quietly disappeared and parts of the plant are unreachable. Find six faults in seed metrics, prefix lists, route maps and administrative distance, and restore the design.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  13. 13Path control with PBR IP SLA and tracked static routes

    Give a dual-homed branch a default route that fails over when the provider's core breaks, not just when the local link goes down, and send guest traffic over the cheaper link with policy-based routing that falls back safely.

    4× IOSv, 2× VPCS

    6 vCPU, 4,096 MBFits LiteRuns in the free demo

  14. 14VRF-Lite with OSPF EIGRP and BGP

    Split two routers into isolated corporate and lab networks that reuse the same addresses, run OSPF in one VRF and named EIGRP in the other over one trunk, and connect only the corporate VRF to a cloud provider with eBGP.

    3× IOSv

    3 vCPU, 1,536 MBFits LiteRuns in the free demo

  15. 15Bidirectional Forwarding Detection for OSPF EIGRP BGP and static routes

    Measure how long OSPF, EIGRP and BGP take to notice a silent link failure, then add BFD so that every protocol, and a static route, reacts in about a second and a half.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  16. 16BGP neighbours - iBGP eBGP multihop next-hop-self 4-byte and private AS

    Bring up every kind of BGP session an enterprise edge needs: an iBGP mesh over loopbacks with a peer group, an authenticated eBGP multihop session to a 4-byte-AS provider, and an eBGP session to a subsidiary whose private AS must never reach the Internet.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  17. 17BGP path selection - weight local preference AS-path prepending and MED

    Steer a dual-homed enterprise's traffic in both directions: outbound with weight and local preference, inbound with MED and AS-path prepending, and predict every decision from the BGP best-path algorithm.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  18. 18BGP policy - prefix lists AS-path filters and communities

    Protect an edge router from bad Internet routes with prefix lists and AS-path filters, act on a partner's communities, and use the no-export community so that more-specific routes help your provider without leaking into the global table.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  19. 19BGP route reflectors and MP-BGP for IPv4 and IPv6

    Replace an iBGP full mesh with a route reflector, run separate IPv4 and IPv6 address families over native sessions, and follow the originator ID and cluster list that keep reflected routes loop-free.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  20. 20Troubleshooting BGP

    Kingfisher's BGP edge (lab 16) is broken in six places after a change by a junior engineer. Use session states, notifications, logs and the BGP table to find every fault, including two that only appear once the others are fixed.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  21. 21MPLS LDP and Layer 3 VPN explorer

    Build a three-router MPLS provider core with LDP, then deliver a Layer 3 VPN to two customers with overlapping addresses using VRFs, route distinguishers, route targets and MP-BGP, and watch the two-label stack in a traceroute.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  22. 22DMVPN phases 1 and 2 with NHRP and EIGRP

    Build a single-hub DMVPN over an Internet provider: first as phase 1 hub-and-spoke with point-to-point GRE spokes, then as phase 2 with multipoint GRE spokes that build direct spoke-to-spoke tunnels on demand through NHRP.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  23. 23DMVPN phase 3 with IKEv2 and IPsec protection

    Turn a working phase 2 DMVPN into phase 3, so the hub can summarise while spokes still build direct tunnels through NHRP redirects and shortcuts, then encrypt every tunnel with an IKEv2 and IPsec profile.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  24. 24Troubleshooting DMVPN

    Six faults stop Ibis Pharmacy's encrypted phase 3 DMVPN from working: registrations fail, an IKE negotiation is rejected, a spoke has no routing neighbour, branches can't reach head office and spoke-to-spoke traffic never goes direct. Work layer by layer: underlay, IPsec, NHRP, routing, phase 3.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  25. 25Device access with AAA - TACACS plus RADIUS and the local database

    Move two routers' administrator logins from shared passwords to a real TACACS+ and RADIUS server: authenticate, authorise exec sessions and individual commands, account for what people did, and keep a local fallback that works when the server is down.

    2× IOSv, 1× EVE-NG GUI server

    3 vCPU, 2,048 MBFits LiteRuns in the free demo

  26. 26IPv4 and IPv6 ACLs time-based ACLs and uRPF

    Protect an Internet edge router: restrict management with a standard ACL, filter inbound IPv4 traffic with an extended named ACL and a time-based entry, filter IPv6 without breaking neighbour discovery, and drop spoofed sources with uRPF.

    3× IOSv, 1× VPCS

    4 vCPU, 2,560 MBFits LiteRuns in the free demo

  27. 27Control plane policing

    Classify everything that reaches a router's own CPU into routing, management, ICMP, unwanted and default traffic, police each class, and prove that a ping flood and telnet attempts from a guest network no longer threaten OSPF, BGP or SSH.

    3× IOSv

    3 vCPU, 1,536 MBFits LiteRuns in the free demo

  28. 28IPv6 first-hop security - rogue routers RA guard and the binding table

    Watch a rogue router hijack hosts with IPv6 router advertisements and a rogue DHCPv6 server, trace and contain it, and build the first-hop security policies (RA guard, DHCPv6 guard, binding table, source guard, ND inspection) an access switch uses to stop it.

    2× IOSv, 1× Alpine Linux, 1× IOSvL2

    4 vCPU, 2,560 MBFits LiteRuns in the free demo

  29. 29Device management - console VTY SSH HTTPS SCP and TFTP

    Harden how a router is managed: console and VTY settings, login protection, SSH version 2 only, HTTPS instead of HTTP, an SCP server for configuration pulls, and TFTP backups, each proven from a real Linux management server.

    1× IOSv, 1× EVE-NG GUI server

    2 vCPU, 1,536 MBFits LiteRuns in the free demo

  30. 30DHCPv4 and DHCPv6 - server relay client and options

    Centralise addressing on one IOS DHCP server: relay DHCPv4 for a user LAN and a branch router, fix a pool that hands out the wrong gateway, add options, and give the branch router a stateful DHCPv6 address through a DHCPv6 relay.

    3× IOSv, 2× VPCS

    5 vCPU, 3,584 MBFits LiteRuns in the free demo

  31. 31SNMPv2c and SNMPv3 syslog timestamps and conditional debugging

    Wire two routers into a real monitoring server: accurate timestamps, local and remote syslog, SNMPv2c with an ACL, SNMPv3 with authentication and encryption, traps of both versions, and debugging that shows only what you ask for.

    2× IOSv, 1× EVE-NG GUI server

    3 vCPU, 2,048 MBFits LiteRuns in the free demo

  32. 32IP SLA and NetFlow v5 v9 and Flexible NetFlow

    Measure voice quality across a WAN with IP SLA UDP jitter and a responder, alert on slow round trips, and see who is using the network with traditional NetFlow v5 and Flexible NetFlow v9, decoded live by a collector.

    3× IOSv, 1× EVE-NG GUI server

    4 vCPU, 2,560 MBFits LiteRuns in the free demo

  33. 33Troubleshooting infrastructure security and services

    A hardening project went wrong: OSPF is down, TACACS+ logins fail, the NMS can't poll or receive anything, PCs get no addresses and IPv6 to the core is dead. Seven faults in AAA, ACLs, an IPv6 filter, CoPP, SNMP, syslog and DHCP relay, each found from the evidence a real engineer would use.

    2× IOSv, 1× EVE-NG GUI server, 1× VPCS

    4 vCPU, 3,072 MBFits LiteRuns in the free demo

  34. 34Capstone 1 - build the Merganser enterprise WAN

    Build a complete enterprise WAN from bare addressing: an OSPF core, an EIGRP data centre joined by safe mutual redistribution, an eBGP Internet edge that feeds a default route, and an encrypted phase 3 DMVPN for the branches in its own OSPF area, then prove every path end to end.

    7× IOSv, 1× VPCS

    8 vCPU, 4,608 MBFits Standard

  35. 35Capstone 2 - the Monday morning trouble tickets

    The Merganser WAN from capstone 1 is broken after a weekend of changes: eight faults across OSPF, EIGRP, redistribution, BGP, DMVPN with IPsec and DHCP. Work the tickets like an on-call engineer: gather facts, isolate the domain, fix the root cause, and prove the service.

    7× IOSv, 1× VPCS

    8 vCPU, 4,608 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the CCNP ENARSI practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB35142
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB55
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB11
Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB11
VPCS hostBuilt in to EVE-NGcounted as 1 vCPU, 1,024 MB812

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENARSI 300-410 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the CCNP ENARSI labs

Are these CCNP ENARSI labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 33 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 33 of the 35. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone 1 - build the Merganser enterprise WAN”, needs 8 vCPU and 4,608 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Cisco?

No. CloudLabBox wrote them to follow the topics of ENARSI, Cisco’s CCNP Enterprise advanced routing and services exam (300-410 v1.1). They aren’t training material from Cisco, and CloudLabBox is independent of Cisco.

Do the ENARSI labs cover Catalyst Center assurance?

Only in concept notes. There’s no Catalyst Center image, so that exam topic is explained rather than configured.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 33 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.