BPDU Guard Lab: Catch a Rogue Bridge on an Access Port
Built in my home lab: a Linux bridge sends BPDUs, BPDU Guard err-disables the Cisco access port, and shutdown/no shutdown restores it. Storm control stays untested.
GUIDES MEET PRACTICE
Learn networking. Put it into practice.
Clear networking guides and 68 CCNA browser labs. Learn the concepts, practice IOS-style commands, and check your work as you go.
One lab free. No account, installation, or hardware needed.
A browser simulation of selected IOS behavior. It does not run an IOS image.
EXPLORE THE LIBRARY
Go deeper by topic
01Fundamentals
Models, addresses, and the basics that connect everything.
↗ 02Switching & VLANsBuild and troubleshoot Layer 2 networks.
↗ 03RoutingUnderstand forwarding decisions and paths.
↗ 04Security & accessExplore controls, authentication, and firewalls.
↗ 05WirelessFrom WLAN fundamentals to controller operations.
↗ 06Linux & toolsDiagnose and verify from the command line.
↗FREE FIELD REFERENCES
Four field references. Free to keep.
A free PingLabz account unlocks the Linux, ASA, BGP, and OSPF PDFs. Choose the guide you need and keep it close while you practice.
Linux commandsCisco ASABGPOSPF
GO FURTHER WITH PRO
A whole network to practice in.
Pro unlocks 60 build labs, six troubleshooting labs, and the campus Mega Lab. Follow guided exercises, try IOS-style commands, and check your configuration as you go.
SELECTED READING
Useful places to begin
Keep learning
Latest guides
FlexVPN Spoke Has No Routes? 6 IKEv2 Authorization Faults
Six FlexVPN authorization faults, built in my home lab on Cisco IOL 17.18.2. Missing hub references stopped establishment; other faults kept READY SAs while losing routes. Real outputs separate received prefixes, installed routes and host forwarding.
GRE over IPsec MTU Black Hole: MSS 1360 vs a 1400-Byte Path
Small pings and HTTP passed, but three 2 MiB downloads stalled in a deliberate GRE/IPsec PMTUD fault. A DF sweep found a 1302-byte inner limit. Measured captures explain why MSS 1360 failed and what MTU 1302 plus MSS 1262 repaired.
Adding a Subnet to IPsec: Crypto Map ACL vs SVTI Route
Adding a subnet to an IPsec VPN on the same IOL routers took mirrored crypto ACL edits and a second ESP pair with a crypto map, but one OSPF line with SVTI. Follow both changes, the failed transform-fault attempt, the destination typo, and verified GCM recovery.
Cisco ZBF Self Zone: Why One Zone-Pair Broke OSPF and BGP
SSH stayed reachable while unicast OSPF and loopback eBGP failed on IOSv. This Containerlab home lab follows the timer expiries, ineffective OSPF inspection, reverse-policy trap, and verified repair with OSPF pass and stateful TCP/ICMP.
members
DHCP Relay Not Working: Free ip helper-address Packet Tracer Lab
A free CCNA Packet Tracer ticket: VLAN 20 PCs get no address while VLAN 10 is fine. Work from the client to R1's ip helper-address and fix it.
FMC REST API: Change FTD Rules and Deploy with curl and Python
The script saved TCP/8080 in FMC, but FTD still blocked it. This home lab follows the pending policy, measured token expiry, a failed deployment and the Python fix that completed deployment and restored HTTP.
FTD Transparent Mode in FMC: Bridge Group, BVI and Zone Fault
The bridge stayed up and ARP resolved the server, but ping and HTTP failed. In this FMC-managed FTDv home lab, one bridge member in the wrong Switched zone removed the intended deployed permits. Restoring its zone and deploying restored traffic.
FMC File Policy Attached but Not Blocking? Check the Rule's Application Protocol
An attached FMC file policy let a complete HTTP ZIP download pass because its rule selected FTP. Follow the saved rule, matching hashes, empty events, HTTP correction, and two verified ZIP resets in my home lab.
FTD File Policy in FMC: Why ZIP Downloads Pass Until It's Attached
A ZIP block policy existed in FMC, but Allow-Web did not use it. This home lab follows the full download, empty File Events, policy attachment, and verified ZIP resets while PDF and TXT stayed intact.
FMC Intrusion Policy with Snort 3: Why “Would block” Still Allows HTTP
A Snort 3 local rule set to Block still allowed HTTP in Detection mode. Follow the FMC event, real requests, and server captures, then change only Inspection Mode to Prevention and verify selective blocking.
Cisco FTD Twice NAT in FMC: Fix Swapped Destination Objects
An FMC twice NAT edit broke requests to both partner addresses. Follow real HTTP tests, UN-NAT phases, ASP drops and captures, then restore OLD-to-NEW destination translation and interface source PAT in the same rule.