# MAG212 Network Academy — Student Lab Workbook

Independent educational material · Free to students · Not affiliated with or endorsed by Cisco.
Licensed under [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/).

## Getting started
1. Install an appropriately licensed Cisco Modeling Labs release, including images supplied directly by Cisco.
2. Download a lab ZIP from the academy, extract the `.yaml`, and import it into CML.
3. Start the virtual devices and review interface mapping before configuring.
4. Preserve your original YAML; use a copy for your answers.
5. Record command output, screenshots, and troubleshooting steps.
6. Do not import or distribute Cisco virtual-machine images or CML registration tokens.

> These labs passed structural validation only; check `validation/release_gate_report.json`
> for which labs (if any) have been verified on a running CML installation.

## Lab report template
**Name:** __________________  **Date:** __________________
**Lab ID:** __________________
**Objective:** __________________
**Initial symptom / expected behavior:** __________________
**Commands used and output:**
```text

```
**Changes made:** __________________
**Verification evidence:** __________________
**What I learned:** __________________

---

## CCNA-001 — IPv4 Static Routing

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Configure static routes across three routers so every router can reach every other router's loopback.

### Topology and addressing
- R1 Gi0/0 ↔ R2 Gi0/0
- R2 Gi0/1 ↔ R3 Gi0/0
- R1 Gi0/0 10.0.12.1/30 — R2 Gi0/0 10.0.12.2/30
- R2 Gi0/1 10.0.23.1/30 — R3 Gi0/0 10.0.23.2/30
- R1 Loopback0 172.16.1.1/32
- R2 Loopback0 172.16.2.2/32
- R3 Loopback0 172.16.3.3/32

### Tasks
0. Import `CCNA-001_STUDENT.yaml` into your CML and start the nodes.
1. Configure and enable the interfaces and loopbacks above.
2. On R1, add static routes to 172.16.2.2/32 and 172.16.3.3/32 via R2 (10.0.12.2).
3. On R3, add static routes to 172.16.1.1/32 and 172.16.2.2/32 via R2 (10.0.23.1).
4. On R2, add static routes to R1's and R3's loopbacks via the correct directly connected next hop.
5. Test every loopback from every router, sourcing pings from Loopback0.

### Verification commands
```text
show ip interface brief
show ip route static
ping 172.16.3.3 source Loopback0
traceroute 172.16.3.3 source Loopback0
```

### Pass criteria
- Each router has `S` routes to the two remote loopbacks
- R1 → R3 loopback ping is 100% successful and traceroute shows 10.0.12.2 as the first hop
- Return traffic works (a route exists in both directions)

### Troubleshooting hints
- A ping that fails only when sourced from Loopback0 usually means the *return* route is missing.
- `show ip route 172.16.3.3` shows exactly which entry is used.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-002 — Single-Area OSPF

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Form OSPF area 0 adjacencies across three routers and advertise every router loopback.

### Topology and addressing
- R1 Gi0/0 ↔ R2 Gi0/0
- R2 Gi0/1 ↔ R3 Gi0/0
- R1 Gi0/0 10.0.12.1/30 — R2 Gi0/0 10.0.12.2/30
- R2 Gi0/1 10.0.23.1/30 — R3 Gi0/0 10.0.23.2/30
- R1 Loopback0 172.16.1.1/32 (router ID 1.1.1.1)
- R2 Loopback0 172.16.2.2/32 (router ID 2.2.2.2)
- R3 Loopback0 172.16.3.3/32 (router ID 3.3.3.3)

### Tasks
0. Import `CCNA-002_STUDENT.yaml` into your CML and start the nodes.
1. Configure and enable the interfaces and loopbacks above.
2. Start an OSPF process (any process ID) on each router and set the router ID shown.
3. Advertise the links and loopbacks in area 0 using `network` statements or `ip ospf <pid> area 0` on interfaces.
4. Make Loopback0 a passive interface on every router.
5. Verify adjacencies and test loopback-to-loopback reachability.

### Verification commands
```text
show ip ospf neighbor
show ip ospf interface brief
show ip route ospf
ping 172.16.3.3 source Loopback0
```

### Pass criteria
- R2 has two neighbors in FULL state; R1 and R3 have one each
- Each router has `O` routes to both remote loopbacks
- R1 → R3 loopback ping is 100% successful

### Troubleshooting hints
- Neighbors stuck in INIT/EXSTART: compare area, subnet mask, hello/dead timers and MTU on both ends.
- A wildcard of 0.0.0.3 matches a /30; 0.0.0.0 matches one exact address.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-003 — VLANs and 802.1Q Trunking

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Create VLANs 10 and 20 on two switches and carry both across an 802.1Q trunk.

### Topology and addressing
- SW1 Gi0/0 ↔ SW2 Gi0/0 (trunk)
- VLAN 10 name STUDENTS
- VLAN 20 name STAFF
- SW1 Gi0/1 and SW2 Gi0/1: access VLAN 10
- SW1 Gi0/2 and SW2 Gi0/2: access VLAN 20
- Gi0/0 on both switches: 802.1Q trunk allowing only VLANs 10 and 20

### Tasks
0. Import `CCNA-003_STUDENT.yaml` into your CML and start the nodes.
1. Create and name VLAN 10 and VLAN 20 on both switches.
2. Assign the access ports listed above.
3. Configure Gi0/0 on both switches as an 802.1Q trunk (`switchport trunk encapsulation dot1q` if the image requires it, then `switchport mode trunk`).
4. Restrict the trunk to VLANs 10 and 20.
5. Verify the VLANs are active and forwarding across the trunk.

### Verification commands
```text
show vlan brief
show interfaces trunk
show spanning-tree vlan 10
```

### Pass criteria
- VLAN 10 and VLAN 20 are active on both switches with the correct access ports
- `show interfaces trunk` lists Gi0/0 trunking with only 10,20 allowed and forwarding
- A spanning-tree instance exists for VLAN 10 on both switches

### Troubleshooting hints
- If a VLAN is allowed but missing from "forwarding", check that the VLAN exists on *both* switches.
- Native VLAN mismatches produce CDP warnings — keep the native VLAN the same on both sides.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-004 — Router-on-a-Stick Inter-VLAN Routing

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Route between VLAN 10 and VLAN 20 using 802.1Q subinterfaces on one router link.

### Topology and addressing
- R1 Gi0/0 ↔ SW1 Gi0/0 (802.1Q trunk)
- R1 Gi0/0.10: encapsulation dot1Q 10, 192.168.10.1/24 (VLAN 10 gateway)
- R1 Gi0/0.20: encapsulation dot1Q 20, 192.168.20.1/24 (VLAN 20 gateway)
- SW1: VLANs 10 and 20; Gi0/0 trunk to R1
- Optional: SW1 VLAN 10 SVI 192.168.10.2/24 with default gateway 192.168.10.1 for testing

### Tasks
0. Import `CCNA-004_STUDENT.yaml` into your CML and start the nodes.
1. Create VLANs 10 and 20 on SW1 and make Gi0/0 a trunk.
2. On R1, enable Gi0/0 (no IP address on the physical interface).
3. Create subinterfaces Gi0/0.10 and Gi0/0.20 with the dot1Q tags and addresses above.
4. Verify both connected routes appear on R1.
5. Optional: configure the SW1 test SVI and ping 192.168.20.1 from it.

### Verification commands
```text
show ip interface brief
show ip route connected
show interfaces trunk
show vlan brief
show running-config interface GigabitEthernet0/0.10
```

### Pass criteria
- Gi0/0.10 and Gi0/0.20 are up/up with the correct addresses
- R1 has connected routes for 192.168.10.0/24 and 192.168.20.0/24
- SW1 shows Gi0/0 trunking VLANs 10 and 20

### Troubleshooting hints
- Subinterfaces stay down if the physical interface is shut down.
- The dot1Q tag on each subinterface must match the VLAN carried by the switch trunk.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-005 — IPv6 Routing and Reachability

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Enable IPv6 routing and use static routes so two routers can reach each other's IPv6 loopbacks.

### Topology and addressing
- R1 Gi0/0 ↔ R2 Gi0/0
- R1 Gi0/0 2001:db8:12::1/64 — R2 Gi0/0 2001:db8:12::2/64
- R1 Loopback0 2001:db8:1::1/128
- R2 Loopback0 2001:db8:2::2/128

### Tasks
0. Import `CCNA-005_STUDENT.yaml` into your CML and start the nodes.
1. Enable `ipv6 unicast-routing` on both routers.
2. Configure the IPv6 addresses above and enable the interfaces.
3. On R1, add `ipv6 route 2001:db8:2::2/128 2001:db8:12::2`; on R2, the reverse route to R1's loopback.
4. Verify the routes and test loopback-to-loopback reachability.

### Verification commands
```text
show ipv6 interface brief
show ipv6 route static
ping ipv6 2001:db8:2::2 source Loopback0
```

### Pass criteria
- Both routers show their global unicast and link-local (FE80::) addresses
- Each router has an `S` IPv6 route to the remote loopback
- Loopback-to-loopback ping is 100% successful

### Troubleshooting hints
- Without `ipv6 unicast-routing` a router will not forward IPv6 packets.
- A link-local next hop also works but must be combined with the exit interface.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-006 — Standard ACL and Reachability

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Block one lab loopback source while allowing a second with a standard ACL.

### Topology and addressing
- R1 Gi0/0 10.12.0.1/30 → R2 Gi0/0 10.12.0.2/30
- R1 Loopback10 10.1.10.1/32; Loopback20 10.1.20.1/32
- R2 Loopback0 10.2.2.2/32

### Tasks
1. Configure L3 links and static routes to R2 Loopback0.
2. Create standard ACL 10 on R2 to deny 10.1.10.1 and permit other sources.
3. Apply ACL 10 inbound on R2 Gi0/0, then test both source loopbacks.

### Verification commands
```text
show access-lists 10
show ip interface GigabitEthernet0/0
ping 10.2.2.2 source Loopback10
ping 10.2.2.2 source Loopback20
```

### Pass criteria
- ACL has explicit permit after deny
- Loopback10 source ping should fail; Loopback20 source ping succeeds

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-007 — DHCP Server and Relay Basics

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Use IOS DHCP server and relay configuration across a routed link.

### Topology and addressing
- R1 Gi0/0: 10.12.7.1/30; R2 Gi0/0: 10.12.7.2/30
- R2 Gi0/1 client LAN gateway: 10.7.70.1/24
- CLIENT (Alpine Linux) eth0 ↔ R2 Gi0/1 — gets its address by DHCP
- DHCP scope: 10.7.70.0/24, default gateway 10.7.70.1

### Tasks
1. Configure R1 DHCP pool for 10.7.70.0/24.
2. Configure R2 Gi0/1 with ip helper-address 10.12.7.1.
3. Add a return static route on R1 and confirm DHCP server configuration.
4. On CLIENT, run `sudo udhcpc -i eth0` (or `udhcpc -i eth0` as root) and confirm it receives an address in 10.7.70.0/24 with gateway 10.7.70.1.

### Verification commands
```text
show ip dhcp pool
show ip dhcp binding
show running-config interface GigabitEthernet0/1
show ip route 10.7.70.0
```

### Pass criteria
- DHCP pool configured with correct network/default-router
- Relay configured on R2 Gi0/1
- CLIENT obtains a lease; `show ip dhcp binding` on R1 lists it

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-008 — PAT / NAT Overload

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Translate internal loopback traffic to the edge router outside interface.

### Topology and addressing
- R1 Gi0/0 198.51.100.1/30 (outside), R2 Gi0/0 198.51.100.2/30
- R1 Loopback0 10.8.8.1/24 (inside)
- R2 Loopback0 203.0.113.8/32 (simulated public destination)

### Tasks
1. Mark R1 Gi0/0 outside and Loopback0 inside.
2. Create standard ACL 1 matching 10.8.8.0/24.
3. Enable NAT overload using R1 Gi0/0.
4. Route test traffic toward R2 and inspect NAT translation table.

### Verification commands
```text
show ip nat translations
show ip nat statistics
show access-lists 1
ping 203.0.113.8 source Loopback0
```

### Pass criteria
- NAT inside and outside are on correct interfaces
- A translation is expected only when eligible traffic is generated

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-009 — Spanning Tree Root Selection

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Create a three-switch L2 ring and select the root bridge for VLAN 10.

### Topology and addressing
- Triangle: SW1–SW2–SW3–SW1
- VLAN 10 exists on each switch
- All three inter-switch links are 802.1Q trunks

### Tasks
1. Create VLAN 10 on all switches.
2. Set all inter-switch ports to trunk mode.
3. Configure SW1 to be the root bridge with priority 4096.
4. Verify one redundant path is blocked by STP.

### Verification commands
```text
show spanning-tree vlan 10
show interfaces trunk
show vlan brief
```

### Pass criteria
- SW1 reports This bridge is the root for VLAN 10
- Exactly one redundant logical path is blocked by spanning tree

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-010 — LACP EtherChannel

**CCNA | MAG212 CYBER | Free student exercise**

### Goal
Bundle two physical links into one LACP port-channel trunk.

### Topology and addressing
- SW1 Gi0/0 ↔ SW2 Gi0/0
- SW1 Gi0/1 ↔ SW2 Gi0/1
- Port-channel 1, LACP active on both sides, VLANs 10 and 20

### Tasks
1. Create VLAN 10 and VLAN 20 on both switches.
2. Configure member interfaces in channel-group 1 mode active.
3. Configure Port-channel1 as a trunk.
4. Verify LACP members bundle successfully.

### Verification commands
```text
show etherchannel summary
show lacp neighbor
show interfaces trunk
```

### Pass criteria
- Po1 is up and both member interfaces bundled
- VLANs 10 and 20 present

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNA-011 — Extended ACL: Least Privilege

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Use extended ACL 110 to deny TCP destination port 23 from 10.111.1.0/24 to 10.111.2.0/24 while permitting IP traffic.

### Device and link plan
- R1 Gi0/0 ↔ R2 Gi0/0

### Addressing and setup
- R1 Gi0/0 = 10.111.12.1/30
- R2 Gi0/0 = 10.111.12.2/30
- R1 Lo0 = 10.111.1.1/24
- R2 Lo0 = 10.111.2.1/24

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show access-lists 110
show ip interface gigabitEthernet0/0
show ip route
```

### Pass criteria
- ACL 110 denies TCP port 23 from 10.111.1.0/24 to 10.111.2.0/24, then permits IP
- ACL 110 is applied inbound on R2 Gi0/0 (`show ip interface gigabitEthernet0/0`)
- From R1, `ping 10.111.2.1 source Loopback0` succeeds while `telnet 10.111.2.1 /source-interface Loopback0` is refused, and the deny line's match counter increases

### Troubleshooting hints
- Without a final `permit ip any any`, the implicit deny blocks everything — including OSPF or pings.
- Give R2 a vty password (`line vty 0 4`, `password`, `login`, `transport input telnet`) so a *permitted* telnet would otherwise connect.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-012 — IPv4 Default Route

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Install a default static route on EDGE toward ISP and verify longest-prefix behavior.

### Device and link plan
- EDGE Gi0/0 ↔ ISP Gi0/0

### Addressing and setup
- EDGE Gi0/0 = 10.112.12.1/30
- ISP Gi0/0 = 10.112.12.2/30
- ISP Lo0 = 198.51.100.10/32

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip route static
show ip route 198.51.100.10
ping 10.112.12.2
```

### Pass criteria
- EDGE shows `S* 0.0.0.0/0 [1/0] via 10.112.12.2` and "Gateway of last resort is 10.112.12.2"
- `show ip route 198.51.100.10` on EDGE resolves through the default route (no more-specific match)
- `ping 198.51.100.10` from EDGE succeeds (ISP needs a route back to 10.112.12.0/30 — it is connected)

### Troubleshooting hints
- Explain why a /32 route to 198.51.100.10 would win over 0.0.0.0/0 if you added one (longest prefix match).

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-013 — Port Security: Sticky MAC

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Configure an access port for one learned MAC address and restrict violations.

### Device and link plan
- SW1 Gi0/0 ↔ SW2 Gi0/0
- SW1 Gi0/1 ↔ HOST eth0 (Alpine Linux)

### Addressing and setup
- SW1 Gi0/1 = lab access port VLAN 10
- SW1 VLAN 10 SVI: 10.13.10.1/24
- HOST eth0: 10.13.10.10/24 (`ip addr add 10.13.10.10/24 dev eth0; ip link set eth0 up`)
- Generate traffic from HOST (`ping 10.13.10.1`) so the sticky MAC is learned
- SW1 Gi0/0 to SW2 Gi0/0 uplink

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show port-security
show port-security interface gigabitEthernet0/1
show vlan brief
```

### Pass criteria
- `show port-security interface gigabitEthernet0/1` shows Port Status Secure-up, maximum 1, sticky enabled
- The running-config contains `switchport port-security mac-address sticky <HOST MAC>` after HOST pings 10.13.10.1
- After changing HOST's MAC (`ip link set eth0 address 02:00:00:00:00:99`) and pinging again, the violation counter increases or the port goes err-disabled, matching your configured violation mode

### Troubleshooting hints
- Port security only works on a static access port — `switchport mode access` first.
- Recover an err-disabled port with `shutdown` then `no shutdown`.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-014 — DHCP Snooping: Trust Boundary

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Enable DHCP snooping on VLAN 10 and trust only the authorized DHCP uplink.

### Device and link plan
- SW1 Gi0/0 ↔ SW2 Gi0/0
- SW1 Gi0/1 ↔ CLIENT eth0 (Alpine Linux)

### Addressing and setup
- SW1 Gi0/0 uplink to SW2
- VLAN 10 = student clients
- SW2 acts as the authorized DHCP server: VLAN 10 SVI 10.14.10.1/24 with a DHCP pool for 10.14.10.0/24
- SW1 Gi0/0 = trusted uplink; SW1 Gi0/1 = untrusted client port (access VLAN 10)
- On CLIENT, run `udhcpc -i eth0` to request a lease
- Tip: if the lease fails after snooping is on, research how option 82 inserted by SW1 interacts with a server that is not a relay (`no ip dhcp snooping information option` / `ip dhcp relay information trust-all`)

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip dhcp snooping
show ip dhcp snooping binding
show interfaces status
```

### Pass criteria
- `show ip dhcp snooping` shows snooping enabled on VLAN 10 with only Gi0/0 trusted
- CLIENT receives an address in 10.14.10.0/24 from SW2
- `show ip dhcp snooping binding` on SW1 lists CLIENT's MAC and IP on Gi0/1

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-015 — Rapid PVST Port Roles

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Elect SW1 root bridge for VLAN 10, inspect port roles, and document blocked alternate paths.

### Device and link plan
- SW1 Gi0/0 ↔ SW2 Gi0/0
- SW2 Gi0/1 ↔ SW3 Gi0/0
- SW3 Gi0/1 ↔ SW1 Gi0/1

### Addressing and setup
- Three-switch triangle
- VLAN 10 on all switches

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show spanning-tree vlan 10
show spanning-tree summary
show interfaces trunk
```

### Pass criteria
- `show spanning-tree vlan 10` on SW1 shows "This bridge is the root" and both SW1 ports as Desg/FWD
- Exactly one port in the topology is Altn/BLK, on the SW2–SW3 link
- Your report explains why that port (and not another) was chosen, using bridge IDs and path cost

### Troubleshooting hints
- Lowering SW1's priority (`spanning-tree vlan 10 priority 4096` or `root primary`) is the reliable way to make it root.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-016 — IPv6 OSPFv3 Fundamentals

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Enable IPv6 unicast routing and OSPFv3 over a point-to-point transit link.

### Device and link plan
- R1 Gi0/0 ↔ R2 Gi0/0

### Addressing and setup
- R1 Gi0/0 = 2001:db8:116:12::1/64
- R2 Gi0/0 = 2001:db8:116:12::2/64
- R1 Loopback0 = 2001:db8:116::1/128
- R2 Loopback0 = 2001:db8:116::2/128
- OSPFv3 process 1, area 0; router IDs 1.1.1.1 (R1) and 2.2.2.2 (R2)

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ipv6 ospf neighbor
show ipv6 route ospf
show ipv6 interface brief
```

### Pass criteria
- `show ipv6 ospf neighbor` shows the other router in FULL state
- Each router has an `O` route to the other's /128 loopback
- `ping ipv6 2001:db8:116::2 source Loopback0` from R1 succeeds

### Troubleshooting hints
- With no IPv4 addresses configured, OSPFv3 cannot pick a router ID — set `router-id` manually.
- OSPFv3 is enabled per interface: `ipv6 ospf 1 area 0`.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-017 — Switch Management SVI and SSH

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Configure a management VLAN and secure SSH access with local authentication.

### Device and link plan
- SW1 Gi0/0 ↔ SW2 Gi0/0

### Addressing and setup
- Management VLAN 99
- SW1 VLAN99 = 10.117.99.11/24
- SW2 VLAN99 = 10.117.99.12/24

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip interface brief
show ip ssh
show running-config | section line vty
```

### Pass criteria
- VLAN 99 SVIs are up/up and SW2 can ping 10.117.99.11
- `show ip ssh` reports SSH enabled, version 2
- vty lines use `login local` and `transport input ssh`; `ssh -l <user> 10.117.99.11` from SW2 logs in, and telnet is refused

### Troubleshooting hints
- SSH needs a hostname, `ip domain-name`, and an RSA key of at least 768 bits (2048 recommended) before it enables.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-018 — Floating Static Route Failover

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Use a primary and higher-administrative-distance backup default route.

### Device and link plan
- HQ Gi0/0 ↔ ISP1 Gi0/0
- HQ Gi0/1 ↔ ISP2 Gi0/0

### Addressing and setup
- HQ Gi0/0 = 10.118.1.1/30 to ISP1
- HQ Gi0/1 = 10.118.2.1/30 to ISP2
- ISP1 Gi0/0 = 10.118.1.2/30; ISP2 Gi0/0 = 10.118.2.2/30
- Primary default route via ISP1 (AD 1); backup via ISP2 with AD 10

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip route static
show ip route 0.0.0.0
show ip interface brief
```

### Pass criteria
- With both links up, only `S* 0.0.0.0/0 [1/0] via 10.118.1.2` is installed
- After `shutdown` on HQ Gi0/0, `S* 0.0.0.0/0 [10/0] via 10.118.2.2` is installed
- After `no shutdown`, the primary route returns

### Troubleshooting hints
- In CML, shutting the *ISP1* side usually leaves HQ's interface up/up, so the floating route never activates. Shut HQ's own interface, or research IP SLA tracking.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-019 — DNS and NTP Client Configuration

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Configure DNS resolver and NTP synchronization parameters, then interpret reachability and synchronization state.

### Device and link plan
- R1 Gi0/0 ↔ R2 Gi0/0

### Addressing and setup
- R1 Gi0/0 = 10.119.12.1/30
- R2 Gi0/0 = 10.119.12.2/30
- R2 Lo0 = 10.119.2.2/32
- R2 acts as DNS server (`ip dns server`, `ip host lab-server.mag212.local 10.119.2.2`) and NTP master (`ntp master 3`)
- R1 uses R2 for both: `ip name-server 10.119.2.2`, `ntp server 10.119.2.2`

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show hosts
show ntp associations
show clock detail
```

### Pass criteria
- `ping lab-server.mag212.local` on R1 resolves to 10.119.2.2 and `show hosts` lists the entry
- `show ntp associations` on R1 shows `*~10.119.2.2` (synchronized) — allow several minutes
- `show clock detail` reports the time source as NTP

### Troubleshooting hints
- The starting config contains `no ip domain-lookup`; DNS resolution needs `ip domain-lookup`.
- R1 needs a route to 10.119.2.2 (R2's loopback).

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNA-020 — QoS Voice VLAN Foundations

**CCNA | Free practice exercise | Not an official Cisco exam question**

### Objective
Configure a data VLAN, voice VLAN, and access port; verify VLAN tagging configuration.

### Device and link plan
- SW1 Gi0/0 ↔ SW2 Gi0/0

### Addressing and setup
- VLAN 10 data
- VLAN 30 voice
- SW1 Gi0/1 = test access port

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show vlan brief
show interfaces gigabitEthernet0/1 switchport
show interfaces trunk
```

### Pass criteria
- `show vlan brief` lists VLAN 10 and VLAN 30 with Gi0/1 in VLAN 10
- `show interfaces gigabitEthernet0/1 switchport` shows Access Mode VLAN 10 and Voice VLAN 30
- The SW1–SW2 trunk allows and forwards VLANs 10 and 30

### Troubleshooting hints
- A voice VLAN is configured on an access port (`switchport voice vlan 30`); the phone tags voice traffic while the PC stays untagged.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNP-001 — eBGP Between Three Autonomous Systems

**CCNP Enterprise | MAG212 CYBER | Free student exercise**

### Goal
Establish eBGP across AS 65001, 65002 and 65003 and advertise each router's /32 loopback end to end.

### Topology and addressing
- AS65001 Gi0/0 ↔ AS65002 Gi0/0
- AS65002 Gi0/1 ↔ AS65003 Gi0/0
- AS65001 Gi0/0 192.0.2.1/30 — AS65002 Gi0/0 192.0.2.2/30
- AS65002 Gi0/1 198.51.100.1/30 — AS65003 Gi0/0 198.51.100.2/30
- AS65001 Loopback0 10.1.1.1/32 (BGP AS 65001)
- AS65002 Loopback0 10.2.2.2/32 (BGP AS 65002)
- AS65003 Loopback0 10.3.3.3/32 (BGP AS 65003)

### Tasks
0. Import `CCNP-001_STUDENT.yaml` into your CML and start the nodes.
1. Configure and enable the interfaces and loopbacks above.
2. On each router, start BGP with its AS number and peer with the directly connected neighbor(s) using interface addresses.
3. Advertise each Loopback0 with `network <address> mask 255.255.255.255`.
4. Verify that AS65002 has two Established peers and that AS65001 learns 10.3.3.3/32 with AS path 65002 65003.
5. Test AS65001 → AS65003 loopback reachability.

### Verification commands
```text
show ip bgp summary
show ip bgp
show ip route bgp
ping 10.3.3.3 source Loopback0
```

### Pass criteria
- Every session shows a prefix count (not Idle/Active) in State/PfxRcd
- AS65001's BGP table lists 10.3.3.3/32 with path `65002 65003`
- AS65001 → AS65003 loopback ping is 100% successful

### Troubleshooting hints
- A `network` statement only advertises a prefix that exists in the routing table with the *exact* mask.
- Idle/Active usually means a wrong neighbor address or remote-as, or no IP reachability to the peer.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNP-002 — OSPF Troubleshooting: Area Mismatch

**CCNP Enterprise | MAG212 CYBER | Free student exercise**

### Goal
Find and repair the fault that stops two OSPF routers from forming an adjacency.

### Topology and addressing
- R1 Gi0/0 ↔ R2 Gi0/0
- R1 Gi0/0 10.0.12.1/30 — R2 Gi0/0 10.0.12.2/30
- R1 Loopback0 172.16.1.1/32 (router ID 1.1.1.1)
- R2 Loopback0 172.16.2.2/32 (router ID 2.2.2.2)
- Design intent: the link and both loopbacks are in OSPF area 0

### Tasks
0. Import `CCNP-002_STUDENT.yaml` into your CML and start the nodes.
1. **This lab is pre-configured with a fault** — do not rebuild it from scratch.
2. Confirm the symptom: no OSPF neighbor, no `O` routes.
3. Use the verification commands (and briefly `debug ip ospf adj`, then `undebug all`) to identify the cause.
4. Correct the configuration on the misconfigured router so it matches the design intent.
5. Verify the adjacency and loopback reachability, and write down the root cause.

### Verification commands
```text
show ip ospf neighbor
show ip ospf interface brief
show running-config | section router ospf
debug ip ospf adj
```

### Pass criteria
- The R1–R2 neighbor reaches FULL
- Each router has an `O` route to the other's loopback
- Your report states the root cause and the exact command that fixed it

### Troubleshooting hints
- Compare the two routers' `show ip ospf interface brief` output line by line.
- `debug ip ospf adj` messages name the mismatched parameter.

### Packet Tracer alternative
See `PACKET_TRACER_BUILD_GUIDE.md`. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import the STUDENT YAML into your own appropriately licensed CML.
- Unlike most labs, the initial configs here are complete but contain a deliberate fault.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNP-003 — Multi-Area OSPF ABR

**CCNP Enterprise | MAG212 CYBER | Free student exercise**

### Goal
Build Area 10 connected to Area 0 through an OSPF area border router.

### Topology and addressing
- R1–R2 10.31.12.0/30: 10.31.12.1 and .2 (Area 10)
- R2–R3 10.31.23.0/30: 10.31.23.1 and .2 (Area 0)
- Loopbacks R1 10.31.1.1/32, R2 10.31.2.2/32, R3 10.31.3.3/32

### Tasks
1. Address links and loopbacks.
2. Configure process 31 with explicit OSPF network statements.
3. Make R2 an ABR with Area 10 and Area 0.
4. Verify O IA route to R1 loopback from R3.

### Verification commands
```text
show ip ospf neighbor
show ip ospf border-routers
show ip route ospf
ping 10.31.1.1 source Loopback0
```

### Pass criteria
- Two FULL adjacencies across ABR
- Inter-area routes visible in R3

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNP-004 — EIGRP Classic-Mode IPv4 Neighbors

**CCNP Enterprise | MAG212 CYBER | Free student exercise**

### Goal
Form EIGRP AS 100 adjacency across three routers and advertise loopbacks.

### Topology and addressing
- R1–R2: 10.41.12.0/30 (.1 .2)
- R2–R3: 10.41.23.0/30 (.1 .2)
- R1 Lo0 10.41.1.1/32, R2 Lo0 10.41.2.2/32, R3 Lo0 10.41.3.3/32

### Tasks
1. Configure IPv4 addressing.
2. Enable EIGRP AS 100 without automatic summary.
3. Advertise connected point-to-point and loopback networks.
4. Verify adjacencies and EIGRP routes.

### Verification commands
```text
show ip eigrp neighbors
show ip route eigrp
show ip protocols
ping 10.41.3.3 source Loopback0
```

### Pass criteria
- Each transit neighbor adjacency is up
- Remote loopbacks appear with D routes

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNP-005 — HSRP First-Hop Redundancy

**CCNP Enterprise | MAG212 CYBER | Free student exercise**

### Goal
Configure two routed gateways with a shared HSRP virtual IP on VLAN 10.

### Topology and addressing
- R1 Gi0/0 10.51.10.2/24 → SW1 Gi0/0 access VLAN 10
- R2 Gi0/0 10.51.10.3/24 → SW1 Gi0/1 access VLAN 10
- HSRP virtual IP 10.51.10.1, group 10
- HOST (Alpine Linux) eth0 → SW1 Gi0/2 access VLAN 10: 10.51.10.10/24, default gateway 10.51.10.1

### Tasks
1. Build access VLAN 10 on SW1.
2. Configure router IP interfaces and HSRP group 10.
3. Give R1 priority 110, preempt; R2 priority 100.
4. Verify active/standby and simulate R1 shutdown.

### Verification commands
```text
show standby brief
show standby GigabitEthernet0/0
show vlan brief
```

### Pass criteria
- R1 active and R2 standby at steady state
- R2 takes active role when R1 link is shut
- HOST keeps reaching 10.51.10.1 during failover (run `ping 10.51.10.1` on HOST while shutting R1 Gi0/0)

### Packet Tracer alternative
Where the current Packet Tracer device supports these commands, recreate the illustrated topology using equivalent routers or switches. Packet Tracer syntax and feature availability can differ from IOSv; this is a build guide, **not** a generated `.pkt` file.

### Student notes
- Import STUDENT.yaml into your own appropriately licensed CML.
- The initial device configs contain hostnames only; configure the devices yourself.
- Does not include Cisco images, license keys, or proprietary exam questions.
- These exercises are structurally validated, **not boot-tested**.

---

## CCNP-006 — BGP Prefix Filtering

**CCNP Enterprise | Free practice exercise | Not an official Cisco exam question**

### Objective
Accept only an authorized /24 from an eBGP peer using a prefix-list and route-map.

### Device and link plan
- R1 Gi0/0 ↔ R2 Gi0/0

### Addressing and setup
- R1 AS 65061 Gi0/0 = 10.126.12.1/30
- R2 AS 65062 Gi0/0 = 10.126.12.2/30
- R2 advertises 198.51.100.0/24
- R2 Loopback1 = 198.51.100.1/24 (authorized) and Loopback2 = 203.0.113.1/24 (not authorized); advertise both
- R1: `neighbor 10.126.12.2 soft-reconfiguration inbound` so received-routes can be shown

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip bgp summary
show ip bgp neighbors 10.126.12.2 received-routes
show ip route bgp
```

### Pass criteria
- The R1–R2 session is Established
- `show ip bgp neighbors 10.126.12.2 received-routes` on R1 shows both /24s
- R1's BGP table and `show ip route bgp` contain only 198.51.100.0/24

### Troubleshooting hints
- After changing an inbound policy, apply it with `clear ip bgp 10.126.12.2 soft in`.
- A route-map with no matching `permit` clause denies everything.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNP-007 — OSPF Authentication

**CCNP Enterprise | Free practice exercise | Not an official Cisco exam question**

### Objective
Configure matching OSPF MD5 authentication on adjacent routers, then observe adjacency behavior after mismatched keys.

### Device and link plan
- R1 Gi0/0 ↔ R2 Gi0/0

### Addressing and setup
- R1 Gi0/0 = 10.127.12.1/30
- R2 Gi0/0 = 10.127.12.2/30

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip ospf neighbor
show ip ospf interface gigabitEthernet0/0
show logging
```

### Pass criteria
- With matching keys, the neighbor is FULL and `show ip ospf interface gigabitEthernet0/0` reports message-digest authentication
- After changing the key on one router, the neighbor drops after the dead interval and authentication-mismatch messages appear (`debug ip ospf adj` if they are not logged)
- Restoring the key brings the neighbor back to FULL

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNP-008 — OSPF Summarization at ABR

**CCNP Enterprise | Free practice exercise | Not an official Cisco exam question**

### Objective
Summarize area 10 loopback networks from an ABR toward area 0.

### Device and link plan
- R1 Gi0/0 ↔ ABR Gi0/0
- ABR Gi0/1 ↔ R3 Gi0/0

### Addressing and setup
- R1 + ABR = area 10
- ABR + R3 = area 0
- R1 loopback subnets 10.128.16.0/24 and 10.128.17.0/24
- R1 Gi0/0 10.128.12.1/30 — ABR Gi0/0 10.128.12.2/30 (area 10)
- ABR Gi0/1 10.128.23.1/30 — R3 Gi0/0 10.128.23.2/30 (area 0)

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip route ospf
show ip ospf database summary
show ip protocols
```

### Pass criteria
- Before summarization, R3 shows two `O IA` /24 routes
- After `area 10 range 10.128.16.0 255.255.254.0` on the ABR, R3 shows one `O IA 10.128.16.0/23` and neither /24
- `show ip ospf database summary` on R3 contains the /23 Type-3 LSA

### Troubleshooting hints
- OSPF advertises loopbacks as /32 by default. Use `ip ospf network point-to-point` on R1's loopbacks so they appear as /24s.
- Summarization happens on the ABR, for the area the routes come *from*.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNP-009 — BGP Local Preference and Failover

**CCNP Enterprise | Free practice exercise | Not an official Cisco exam question**

### Objective
Prefer ISP1 with inbound local preference and assess path choice and failover.

### Device and link plan
- EDGE Gi0/0 ↔ ISP1 Gi0/0
- EDGE Gi0/1 ↔ ISP2 Gi0/0

### Addressing and setup
- EDGE AS 65090
- ISP1 AS 64591
- ISP2 AS 64592
- EDGE Gi0/0 10.129.1.1/30 — ISP1 Gi0/0 10.129.1.2/30
- EDGE Gi0/1 10.129.2.1/30 — ISP2 Gi0/0 10.129.2.2/30
- Both ISPs advertise test prefix 203.0.113.0/24 (Loopback1 203.0.113.1/24 on each)
- EDGE: inbound route-map from ISP1 sets local preference 200

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show ip bgp summary
show ip bgp
show ip route bgp
```

### Pass criteria
- `show ip bgp` on EDGE lists 203.0.113.0/24 from both ISPs, with the ISP1 path best (`>`) and LocPrf 200
- `show ip route bgp` points 203.0.113.0/24 at 10.129.1.2
- After shutting EDGE Gi0/0, the ISP2 path becomes best; after `no shutdown`, ISP1 is preferred again

### Troubleshooting hints
- Local preference only affects *outbound* path choice from your AS, and higher wins.
- Apply policy changes with `clear ip bgp * soft in`.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---

## CCNP-010 — VRF Lite Segmentation

**CCNP Enterprise | Free practice exercise | Not an official Cisco exam question**

### Objective
Create BLUE and RED routing tables, assign interfaces, and verify VRF isolation.

### Device and link plan
- PE1 Gi0/0 ↔ PE2 Gi0/0

### Addressing and setup
- PE1 Gi0/0 = transit link
- VRF BLUE Lo10 = 10.130.10.1/24
- VRF RED Lo20 = 10.130.20.1/24
- VRFs BLUE and RED exist on PE1 and PE2 (`vrf definition`, `address-family ipv4`)
- Transit uses one subinterface per VRF: Gi0/0.10 (dot1Q 10, VRF BLUE) 10.130.112.1/30 — .2; Gi0/0.20 (dot1Q 20, VRF RED) 10.130.212.1/30 — .2
- PE2 reaches each PE1 loopback with a VRF static route

### Student tasks
1. Import the YAML into your appropriately licensed CML instance.
2. Configure interfaces and the addressing plan above (the student YAML only configures hostnames).
3. Implement the feature described in the objective using Cisco IOS syntax supported by your device image.
4. Capture before-and-after evidence for the checks below.
5. Explain why the final configuration satisfies the objective.

### Verification commands
```text
show vrf
show ip route vrf BLUE
show ip route vrf RED
```

### Pass criteria
- `show vrf` lists BLUE and RED with the correct interfaces on both routers
- `show ip route vrf BLUE` contains 10.130.10.0/24 but not 10.130.20.0/24 (and vice versa for RED)
- From PE2, `ping vrf BLUE 10.130.10.1` succeeds and `ping vrf BLUE 10.130.20.1` fails

### Troubleshooting hints
- `vrf forwarding` removes the interface's IP address — re-enter the address afterwards.

### Evidence
Record your results in `VERIFICATION_WORKSHEET.md` (included in this lab pack).

**Status:** YAML structure checked only. A live Cisco CML import/boot and device-level functionality test are still required before calling this lab validated. Hardware/image capabilities may vary.

---