CloudLabBox
Try the free demo

CCNP ENCOR practice labs

36 guided labs that cover the hands-on topics of ENCOR 350-401 v1.2: campus switching and spanning tree, OSPF, EIGRP and BGP, VRF-Lite, GRE and IPsec, NAT, FHRP, multicast, QoS, assurance tools, device security, and NETCONF, RESTCONF, Python and Ansible. They run on Cisco IOSv, IOSvL2 and CSR 1000v, with Linux hosts.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 35 of the 36 labs also run in the free demo.

Guided labs
36
Follows
Cisco CCNP ENCOR 350-401 (v1.2)
Runs every lab
Standard
Devices
IOSv, IOSvL2, EVE-NG GUI server, Alpine Linux, CSR 1000v and VPCS

Who these labs are for

For engineers preparing for Cisco’s CCNP Enterprise core exam (350-401 ENCOR v1.2), or the CCIE Enterprise Infrastructure written, who want to practise on real IOS and IOS XE rather than a simulator.

Troubleshooting labs start broken, and the course ends with a troubleshooting capstone, a build capstone and a small LISP lab that shows the SD-Access control plane.

The 36 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

CCNP ENCOR course 36 labs

Shared folderCCNP ENCOR 350-401 guided labs

One ENCOR topic per lab, with troubleshooting labs along the way and two capstones.

  1. 01Campus VLANs VTP 802-1Q trunks and forwarding tables

    Build the switching block of Fernhill's new Leeds warehouse: VTP to share VLANs, one static and one DTP-negotiated 802.1Q trunk, access ports, inter-VLAN routing on the distribution switch, and a look inside the MAC, ARP and CEF tables that forward every frame.

    3× IOSvL2, 3× VPCS

    6 vCPU, 5,376 MBFits LiteRuns in the free demo

  2. 02Troubleshoot VLANs VTP and 802-1Q trunks

    The warehouse switching block from lab 1 has been 'standardised' by a contractor and half the users are offline. Work bottom-up through trunks, DTP, VTP, native VLANs, access ports and SVIs to find and fix five faults.

    3× IOSvL2, 3× VPCS

    6 vCPU, 5,376 MBFits LiteRuns in the free demo

  3. 03EtherChannel - LACP PAgP static and layer 3 bundles

    Bundle Fernhill's warehouse uplinks with all three EtherChannel methods (LACP, PAgP and static), build a routed layer 3 port channel between the distribution switches, and check how spanning tree and load balancing treat the bundles.

    3× IOSvL2, 2× VPCS

    5 vCPU, 4,352 MBFits LiteRuns in the free demo

  4. 04Troubleshoot EtherChannel

    Four bundles from lab 3 are each broken in a different, realistic way: a negotiation deadlock, a suspended member, a static-versus-LACP mismatch with the misconfiguration guard, and a layer 2 port in a layer 3 bundle. Find and fix them all.

    3× IOSvL2, 2× VPCS

    5 vCPU, 4,352 MBFits LiteRuns in the free demo

  5. 05Rapid PVST plus - root placement load sharing and tuning

    Take a four-switch campus block from default PVST+ with a random root to Rapid PVST+ with planned roots per VLAN, long path costs, a tuned management path and edge ports, then watch RSTP converge in a second.

    4× IOSvL2, 2× VPCS

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  6. 06Multiple Spanning Tree - MST

    Replace per-VLAN spanning trees with MST: one region, two instances that carry different VLANs on different uplinks, planned roots per instance, and a hands-on look at what happens at a region boundary.

    4× IOSvL2, 2× VPCS

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  7. 07Spanning-tree protection - BPDU guard root guard and loop guard

    A rogue switch has taken over as root bridge of the staff VLAN. Find it, then protect Fernhill's access layer with PortFast and BPDU guard on user ports, root guard towards a test-bench switch, loop guard on uplinks and automatic err-disable recovery.

    4× IOSvL2, 1× VPCS

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  8. 08Multi-area OSPFv2 - adjacencies network types and passive interfaces

    Join a three-router backbone to two regional areas with OSPFv2, control the DR election, use point-to-point links and passive interfaces, and read the link-state database the way the exam expects.

    5× IOSv, 1× VPCS

    6 vCPU, 3,584 MBFits LiteRuns in the free demo

  9. 09OSPF summarisation filtering and area types

    Shrink Fernhill's OSPF tables with inter-area and external summaries, keep a lab network and a partner extranet where they belong with filters, and turn the regional areas into a totally stubby area and an NSSA.

    5× IOSv, 1× VPCS

    6 vCPU, 3,584 MBFits LiteRuns in the free demo

  10. 10OSPFv3 for IPv6 and IPv4 address families

    Route Fernhill's new dual-stack network with OSPFv3 address families: three areas for IPv6, an ABR summary, and IPv4 carried by the same OSPFv3 process.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  11. 11Troubleshoot multi-area OSPF

    A change window has gone wrong and four tickets are open against Fernhill's OSPF network. Work through them with a structured method, find five realistic faults, and restore the designed DR.

    5× IOSv, 1× VPCS

    6 vCPU, 3,584 MBFits LiteRuns in the free demo

  12. 12EIGRP named mode compared with OSPF

    Run EIGRP named mode and OSPF side by side on the same four routers, then compare how each one measures paths, finds backups, balances load and limits its own scope.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  13. 13eBGP to a single provider

    Bring up Fernhill's first eBGP session to its internet provider with MD5 protection, advertise the company's public block, accept only a default route, and hand that default to the inside network.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  14. 14BGP best-path selection and dual-homed path control

    Fernhill adds a second provider. Work through the BGP best-path algorithm on real tables, stop the site becoming a transit AS, and steer outbound traffic with weight and local preference and inbound traffic with AS-path prepending.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  15. 15VRF-Lite - separate routing tables over one link

    Carry Fernhill's corporate network and a vendor-managed IoT network over the same Leeds–Bristol link with VRF-Lite: two routing tables, overlapping addresses, OSPF in one VRF and static routes in the other, and proof that they can't see each other.

    6× IOSv

    6 vCPU, 3,072 MBFits LiteRuns in the free demo

  16. 16GRE tunnels over the internet

    Join the Leeds and Bristol LANs across an internet provider that can't route private addresses: build a GRE tunnel, run OSPF through it, size the MTU and MSS correctly and learn why recursive routing takes tunnels down.

    3× IOSv, 2× VPCS

    5 vCPU, 3,584 MBFits LiteRuns in the free demo

  17. 17IPsec - static VTI with IKEv2 and GRE over IPsec

    Encrypt Fernhill's branch links across the internet two ways: a static virtual tunnel interface with IKEv2 to Bristol, and GRE protected by IPsec with IKEv1 to Glasgow, then route both with OSPF and read the security associations.

    4× IOSv, 2× VPCS

    6 vCPU, 4,096 MBFits LiteRuns in the free demo

  18. 18NAT and PAT at the internet edge

    Publish a web server with static NAT and a port forward, give staff addresses from a public pool and put guests behind PAT, then read and clear the translation table like an operator.

    3× IOSv, 2× VPCS

    5 vCPU, 3,584 MBFits LiteRuns in the free demo

  19. 19HSRP - redundant gateways with load sharing and tracking

    Give the warehouse VLANs a gateway that survives the loss of a distribution switch or its uplink: HSRP version 2 with one active switch per VLAN, pre-emption, MD5 authentication, fast timers and interface tracking.

    3× IOSvL2, 1× IOSv, 2× VPCS

    6 vCPU, 4,864 MBFits LiteRuns in the free demo

  20. 20VRRPv3 for IPv4 and IPv6

    Give the Glasgow branch LAN a standards-based redundant gateway with VRRP version 3 for both IPv4 and IPv6, uplink tracking and tuned timers, and compare VRRP with HSRP and GLBP.

    3× IOSv, 2× Alpine Linux

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  21. 21NTP hierarchy with authentication and reading PTP

    Build Fernhill's time hierarchy: a stratum 1 source, two authenticated core servers that also peer with each other, a branch client, access control and UK summer time, then read a PTP configuration the way the exam presents it.

    4× IOSv

    4 vCPU, 2,048 MBFits LiteRuns in the free demo

  22. 22Multicast - PIM sparse mode IGMP RPF and SSM

    Deliver Fernhill's warehouse paging stream with PIM sparse mode: join a group with IGMP, watch the shared tree turn into a shortest-path tree, check RPF, move the RP to BSR and finish with source-specific multicast.

    5× IOSv

    5 vCPU, 2,560 MBFits LiteRuns in the free demo

  23. 23QoS with MQC - interpret classify mark queue shape and police

    Read an existing HQ QoS policy the way the exam shows it, then build Bristol's: trust-boundary marking and policing, LLQ and CBWFQ on the WAN, and a hierarchical shaper that matches the 1 Mbit/s contract, all verified with live counters.

    3× IOSv

    3 vCPU, 1,536 MBFits LiteRuns in the free demo

  24. 24Diagnose with ping traceroute debugs syslog and SNMP

    Use the network engineer's everyday tools on Fernhill's WAN: extended ping to find a path MTU, traceroute and conditional debugging to find a filter, then send every router's logs to the NOC and poll them with SNMPv2c and SNMPv3 from a Linux workstation.

    3× IOSv, 1× EVE-NG GUI server

    4 vCPU, 2,560 MBFits LiteRuns in the free demo

  25. 25Flexible NetFlow and ERSPAN on IOS XE

    On Fernhill's IOS XE branch router, record who talks to whom with Flexible NetFlow and export it to a collector, then mirror the branch LAN across the routed WAN to a Linux analyser with ERSPAN.

    1× Alpine Linux, 1× CSR 1000v, 1× IOSv, 1× VPCS

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  26. 26SPAN and RSPAN - mirror traffic to an analyser

    Mirror a warehouse PC's traffic to a Linux analyser, first with local SPAN on the same switch and then with RSPAN across a trunk to a second switch, and capture it with tcpdump.

    2× IOSvL2, 1× Alpine Linux, 2× VPCS

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  27. 27IP SLA object tracking and policy-based routing

    Make the Bristol branch fail over when the MPLS service breaks beyond the first hop, measure voice quality to HQ with UDP jitter, and send guest traffic out of the broadband link with policy-based routing.

    4× IOSv, 2× VPCS

    6 vCPU, 4,096 MBFits LiteRuns in the free demo

  28. 28Device access - lines local users SSH and AAA with RADIUS

    Replace shared passwords on Fernhill's Bristol router with named users, SSH only and login protection, then centralise authentication and authorisation on a RADIUS server with a safe local fallback and accounting.

    2× IOSv, 1× EVE-NG GUI server

    3 vCPU, 2,048 MBFits LiteRuns in the free demo

  29. 29ACLs and control plane policing

    Lock down Fernhill's Bristol router: restrict management access with a standard ACL, fence the guest network with an extended named ACL, protect a server with an outbound ACL, and keep the router's CPU safe with control plane policing.

    3× IOSv, 2× VPCS

    5 vCPU, 3,584 MBFits LiteRuns in the free demo

  30. 30Embedded Event Manager applets

    Teach Bristol's router to look after itself with EEM: bring a backup link up and down from a tracked probe, collect evidence the moment the WAN fails, take health snapshots on demand and on a timer, and block accidental reloads.

    3× IOSv

    3 vCPU, 1,536 MBFits LiteRuns in the free demo

  31. 31NETCONF and YANG on IOS XE

    Read a YANG model, enable NETCONF on an IOS XE router, then use Python's ncclient from the NOC workstation to discover capabilities, read configuration and operational data with filters, and create an interface with edit-config.

    1× CSR 1000v, 1× EVE-NG GUI server

    3 vCPU, 5,120 MBFits LiteRuns in the free demo

  32. 32RESTCONF REST response codes and API security

    Manage an IOS XE router over HTTPS with RESTCONF: read and change YANG data with curl and Python, trigger and explain every common response code, lock the API down, and read Catalyst Center and SD-WAN Manager API responses the way the exam presents them.

    1× CSR 1000v, 1× EVE-NG GUI server

    3 vCPU, 5,120 MBFits LiteRuns in the free demo

  33. 33Python JSON and agentless automation with Ansible

    Prepare two routers for automation, then work as Fernhill's first network automation engineer: read and predict a Python script, repair a broken JSON file, fix a Netmiko collection script, and push standard configuration with an agentless Ansible playbook.

    2× IOSv, 1× EVE-NG GUI server

    3 vCPU, 2,048 MBFits LiteRuns in the free demo

  34. 34Troubleshooting capstone - from the access port to the internet

    A whole Fernhill campus is down after a bad maintenance night. Work three tickets end to end through access trunks, HSRP, OSPF default routing, eBGP and NAT, and find six independent faults with a structured method.

    3× IOSvL2, 2× IOSv, 1× VPCS

    6 vCPU, 4,352 MBFits LiteRuns in the free demo

  35. 35Build capstone - campus edge and secure branch

    Build Fernhill Freight's new Leeds site and its Bristol branch from bare addressing: an LACP-bundled campus core with planned spanning-tree roots and HSRP, OSPF, an eBGP internet edge with PAT, an IKEv2 VTI to Bristol that backhauls the branch's internet traffic, NTP and SSH.

    3× IOSv, 3× IOSvL2, 2× VPCS

    8 vCPU, 5,888 MBFits Standard

  36. 36Overlay explorer - LISP the SD-Access control plane in miniature

    Connect two warehouse networks across a core that knows nothing about them, using LISP: xTRs register their EID prefixes with a map server, resolve each other on demand and tunnel the traffic, which is the control-plane idea behind SD-Access.

    4× IOSv, 2× VPCS

    6 vCPU, 4,096 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the CCNP ENCOR practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB2690
Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB1135
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB55
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB34
Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial2 vCPU, 4,096 MB33
VPCS hostBuilt in to EVE-NGcounted as 1 vCPU, 1,024 MB2138

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the CCNP ENCOR labs

Are these CCNP ENCOR labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 35 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 35 of the 36. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Build capstone - campus edge and secure branch”, needs 8 vCPU and 5,888 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Cisco?

No. CloudLabBox wrote them to follow the topics of Cisco’s CCNP and CCIE Enterprise core exam, ENCOR 350-401 v1.2. They aren’t training material from Cisco, and CloudLabBox is independent of Cisco.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 35 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.