GUIDES MEET PRACTICE
Clear networking guides and 68 CCNA browser labs. Learn the concepts, practice IOS-style commands, and check your work as you go.
One lab free. No account, installation, or hardware needed.
A browser simulation of selected IOS behavior. It does not run an IOS image.
EXPLORE THE LIBRARY
Models, addresses, and the basics that connect everything.
↗ 02Switching & VLANsBuild and troubleshoot Layer 2 networks.
↗ 03RoutingUnderstand forwarding decisions and paths.
↗ 04Security & accessExplore controls, authentication, and firewalls.
↗ 05WirelessFrom WLAN fundamentals to controller operations.
↗ 06Linux & toolsDiagnose and verify from the command line.
↗FREE FIELD REFERENCES
A free PingLabz account unlocks the Linux, ASA, BGP, and OSPF PDFs. Choose the guide you need and keep it close while you practice.
GO FURTHER WITH PRO
Pro unlocks 60 build labs, six troubleshooting labs, and the campus Mega Lab. Follow guided exercises, try IOS-style commands, and check your configuration as you go.
SELECTED READING
Keep learning
I set up ISE 3.5 as the TACACS+ server for an IOS XE router: a network admin with full access and a help desk user who can run show commands but not show running-config or enter config mode. Then I broke the shared secret and watched the local fallback take over. Real Live Logs for every case.
Five 802.1X failures I broke on purpose against Cisco ISE 3.5: a bad shared secret, an unknown user, a wrong password, a supplicant that rejects the ISE certificate, and a disabled account. For each one: what the user sees, the Live Logs entry, the root cause and the fix.
The contractor authenticated, landed in VLAN 862 and got the web-only dACL from ISE. HTTPS to the portal's IP worked, but the portal's name never resolved. The dACL's implicit deny was dropping DNS. Here's the lab, the evidence and the fix.
The printer's MAC was in ISE, in the right endpoint identity group, and MAB authentication passed. ISE still sent an Access-Reject. The authorization rule was matching a MAC string that the switch never sends. Here's the lab, the evidence and the fix.
The switch was configured, the users existed, the policy was right, and every login still failed. ISE was throwing the request away with 11007 because it didn't recognise the address the switch sent from. Here's how I reproduced it, read the evidence, and fixed it.
Cisco ISE 3.5.0.527 first boot, built in my home lab: setup values, CLI checks that prove the services are up, the forced GUI password reset and the Administration pages to review first.
Built in my home lab on IOS XE 17.18: a privilege 5 NOC user got an empty config, then every secret. Parser views worked, once exec and console authorization were on.
Built in my home lab on IOS XE 17.18: stale SSH sessions filled every VTY line and locked the admin out. Keepalives, exec-timeout and a reserved line fixed it.
Built in my home lab on IOS XE 17.18: decoded every Type 7 password in seconds, migrated to Type 8, and broke Type 6 by removing the master key.
Built in my home lab on IOS XE 17.18: login block-for quiet mode locked out the admin too. A quiet-mode access-class let the NOC in while the attacker stayed refused.
Built in my home lab on IOS XE 17.18: a sniffed SNMPv2c RW community renamed the router and shut OSPF. SNMPv3 authPriv with an ACL stopped it.
Built in my home lab on IOS XE 17.18: a strict CoPP policy policed OSPF together with an ICMP flood, the neighbor went down, and one routing class fixed it.