Desktop Environment Required

Please access the Network Lab from a workstation.

LearnAul

Network Engineering CLI Simulation Platform

INFRASTRUCTURE

CURRICULUM

1. CLI Fundamentals

ANY 1.1 Modes & Navigation

Cisco IOS uses a hierarchical mode structure. User Exec Mode (>) is for basic monitoring. Privileged Exec Mode (#) allows full access. Global Config ((config)#) is for making changes.

enable
configure terminal
exit
end

Pro Tip Use end or Ctrl+Z to jump straight back to Privileged Exec mode from anywhere.

ANY 1.2 Context Help

Never get stuck. Use ? to see available commands and Tab to autocomplete. This is essential for speed and accuracy.

sh?
show ip ?
conf<TAB>

ANY 1.3 Hostname

The device's network identity. It appears in the prompt and is used for authentication and logging. Always set this first.

configure terminal
hostname Core-Router-01

Verification Check the prompt change or run: show running-config | include hostname

ANY 1.4 Saving Config

Routers run on RAM (Running Config), which is volatile. You must save changes to NVRAM (Startup Config) or they will be lost on reboot.

write memory
copy running-config startup-config

Verification show startup-config should match your running config.

2. Layer 2 Switching

SW 2.1 VLANs

Virtual LANs logically segment a switch. This reduces broadcast traffic and improves security by isolating departments (e.g., Sales vs. Engineering).

vlan 10
name SALES
exit
vlan 20
name ENG

Verification show vlan brief - Ensure ports are assigned correctly.

Common Pitfall Forgetting to exit VLAN configuration mode. The VLAN is not created until you type exit or apply it to a port!

SW 2.2 Access Ports

Access ports belong to a single VLAN and connect to end devices like PCs. Frames are untagged.

interface eth1
switchport mode access
switchport access vlan 10

Verification show interfaces switchport - Check "Operational Mode" and "Access Mode VLAN".

SW 2.3 Trunks (802.1Q)

Trunks carry traffic for multiple VLANs between switches. They use 802.1Q tagging to identify which VLAN a frame belongs to.

interface eth2
switchport mode trunk
switchport trunk allowed vlan 10,20

Verification show interfaces trunk - Check "Status" and "Vlans allowed".

Common Pitfall Native VLAN Mismatch. Both sides of the trunk MUST have the same Native VLAN, or you'll get spanning tree errors.

SW 2.4 Spanning Tree

STP prevents deadly Layer 2 loops by blocking redundant paths. It elects a Root Bridge and calculates the best path to it.

spanning-tree mode rapid-pvst
spanning-tree vlan 10 root primary

Pro Tip Always manually set the Root Bridge for your core switches to ensure stability.

SW 2.5 Port Security

Secure your access layer by limiting the number of MAC addresses allowed on a port. Prevents unauthorized devices.

interface eth1
switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict

Verification show port-security interface eth1

3. L3 Addressing & Services

RTR 3.1 IPv4 Interface

Routers operate at Layer 3. Assign IP addresses to interfaces to create gateways. no shutdown brings the interface up.

interface eth0
ip address 192.168.1.1 255.255.255.0
no shutdown

Verification show ip interface brief - Look for "up/up".

RTR 3.2 DHCP Server

Configure the router to act as a DHCP server, automatically assigning IP addresses, subnet masks, and gateways to clients.

ip dhcp pool LAN_10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8

Verification show ip dhcp binding - See assigned addresses.

RTR 3.3 Router-on-Stick

Use Sub-interfaces to route between VLANs using a single physical interface. Each sub-interface is a gateway for a VLAN.

interface eth0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0

Pro Tip The sub-interface number (e.g., .10) doesn't have to match the VLAN ID, but it's best practice to keep them the same.

RTR 3.4 NAT Overload

PAT allows multiple internal private IPs to share a single public IP for internet access by using unique port numbers.

access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface eth0 overload

Verification show ip nat translations - View active sessions.

Common Pitfall Applying NAT to the wrong interface. Remember: LAN is ip nat inside, WAN is ip nat outside.

4. Routing Fundamentals

RTR 4.1 Routing Table

The router's map of the network. It uses the Longest Match Rule to decide where to forward packets. Specific routes beat general ones.

show ip route
show ip route connected

Pro Tip Codes: C = Connected, S = Static, O = OSPF, B = BGP.

RTR 4.2 Static Routes

Manually defined paths. Simple and secure for small networks, but they don't scale. Use for stub networks.

ip route 10.50.0.0 255.255.255.0 10.0.0.2
ip route 10.50.0.0 255.255.255.0 eth0

Verification show ip route static - Confirm the route exists.

RTR 4.3 Default Route

The "Gateway of Last Resort". Where traffic goes if no specific route matches (0.0.0.0/0). Essential for internet access.

ip route 0.0.0.0 0.0.0.0 10.0.0.1

Pro Tip If a router drops packets to unknown destinations, check for a missing Gateway of Last Resort.

5. Dynamic Routing (OSPF)

RTR 5.1 OSPF Concepts

Open Shortest Path First. A Link-State protocol that builds a topology map. Uses Areas to scale. Area 0 is the backbone.

router ospf 1
router-id 1.1.1.1

Pro Tip All non-backbone areas MUST connect to Area 0.

RTR 5.2 Configuration

Enable OSPF with a Process ID. Use network statements with wildcard masks to advertise interfaces.

router ospf 1
network 192.168.10.0 0.0.0.255 area 0
network 10.0.0.0 0.255.255.255 area 0

Verification show ip ospf neighbor - State should be FULL or 2WAY.

Common Pitfall Mismatched Area IDs or Subnet Masks. Neighbors won't form if these don't match exactly!

RTR 5.3 Passive Int

Prevent routing updates from being sent out interfaces where there are no other routers (e.g., LANs). Improves security.

router ospf 1
passive-interface eth1

Verification show ip ospf interface eth1 - Should say "No Hellos (Passive interface)".

RTR 5.4 Inject Default

Propagate a default route to all OSPF neighbors so they know how to reach the internet.

router ospf 1
default-information originate always

6. Advanced Routing (BGP)

RTR 6.1 BGP Concepts

Border Gateway Protocol. The routing protocol of the internet. Uses Autonomous System (AS) numbers to exchange routes.

router bgp 65001
bgp router-id 1.1.1.1

RTR 6.2 eBGP Peering

Peering with a neighbor in a different AS. Requires direct connection usually.

router bgp 65001
neighbor 10.0.0.2 remote-as 65002
address-family ipv4 unicast

Verification show ip bgp summary - Look for "State/PfxRcd" to be a number (not Idle/Active).

RTR 6.3 Advertisement

BGP only advertises what is explicitly in the routing table. Use the network command with the exact mask.

router bgp 65001
address-family ipv4 unicast
network 1.1.1.0 mask 255.255.255.0

Pro Tip If the mask doesn't match exactly what's in the routing table, BGP won't advertise it.

7. Security & Management

ANY 7.1 Standard ACL

Filters traffic based on Source IP only. Place as close to the destination as possible. Implicit deny at the end.

access-list 10 deny 192.168.1.50
access-list 10 permit any
interface eth0
ip access-group 10 in

Pro Tip Remember the "Implicit Deny" at the end of every ACL. If you don't permit something, everything else is blocked.

Common Pitfall Applying the ACL in the wrong direction (in vs out). Think from the router's perspective: Is traffic entering the interface or leaving it?

ANY 7.2 Extended ACL

Filters based on Protocol, Source, Destination, and Port. Place as close to the source as possible to save bandwidth.

access-list 101 deny tcp any host 10.0.0.5 eq 80
access-list 101 permit ip any any
interface eth0
ip access-group 101 in

Verification show access-lists - See hit counts to verify traffic is matching.

ANY 7.3 SSH Config

Secure remote management. Requires a hostname, domain name, and crypto keys. Disable Telnet!

ip domain-name learnaul.lab
crypto key generate rsa
line vty 0 4
transport input ssh
login local

Verification show ip ssh - Confirm SSH is enabled.

8. Troubleshooting

ANY 8.1 Connectivity

Ping tests reachability (Layer 3). Traceroute shows the path and where packets are dropping.

ping 8.8.8.8
traceroute 8.8.8.8

Pro Tip If Ping works but Traceroute fails, an intermediate firewall might be blocking UDP/ICMP.

ANY 8.2 Show Commands

The lifeblood of a network engineer. Check status, routes, and neighbors.

show ip interface brief
show ip route
show cdp neighbors detail

Pro Tip Use the pipe character | to filter output. Ex: show run | section ospf.

ANY 8.3 Debugging

Real-time packet analysis. Warning: Can crash a router if traffic is high. Use cautiously.

debug ip icmp
undebug all

Pro Tip u all is the shorthand to turn off all debugging instantly. Memorize it.

9. IPv6 Addressing

RTR 9.1 IPv6 Config

128-bit addresses. Hexadecimal. No broadcasts, uses Multicast. Routing must be enabled globally.

ipv6 unicast-routing
interface eth0
ipv6 address 2001:db8::1/64

Verification show ipv6 interface brief

10. Discovery Protocols

ANY 10.1 CDP & LLDP

Cisco Discovery Protocol (Proprietary) and Link Layer Discovery Protocol (Standard) help you map the network by seeing directly connected neighbors.

show cdp neighbors
lldp run
show lldp neighbors

Pro Tip Use show cdp neighbors detail to see the IP address of the neighbor!

11. System Management

ANY 11.1 NTP & Passwords

Keep time synchronized for logs and encrypt passwords.

ntp server 1.1.1.1
service password-encryption

Verification show ntp status - Check if "synchronized".

12. Mission Control (Labs)

MISSION 1: THE BLACKOUT RTR

"Agent, the core router 'HQ-Core' has been wiped. We need it back online immediately to secure the perimeter."

Objectives:

Set Hostname to HQ-Core
Create Loopback0 with 10.10.10.10/32
Enable SSH (Domain: agency.gov, User: admin)
SAVE the configuration!

REVEAL SOLUTION

enable
conf t
hostname HQ-Core
!
interface Loopback0
 ip address 10.10.10.10 255.255.255.255
!
ip domain-name agency.gov
crypto key generate rsa
!
username admin secret cisco
line vty 0 4
 login local
 transport input ssh
!
end
write memory

MISSION 2: SECTOR SPLIT SW

"Departments are mixing traffic. We need strict isolation between Ops and Intel. Proceed with VLAN segmentation."

Objectives:

Create VLAN 10 (Name: OPS)
Create VLAN 20 (Name: INTEL)
Assign eth1 to OPS
Assign eth2 to INTEL

REVEAL SOLUTION

vlan 10
 name OPS
vlan 20
 name INTEL
exit
!
interface eth1
 switchport mode access
 switchport access vlan 10
!
interface eth2
 switchport mode access
 switchport access vlan 20

MISSION 3: THE GATEWAY RTR

"The switch is segmented, but no one can talk to the outside world. Configure the gateway for inter-VLAN routing."

Objectives:

Configure eth0 as a Router-on-a-Stick
Sub-interface for VLAN 10 (Gateway: .1)
Sub-interface for VLAN 20 (Gateway: .1)
Ensure encapsulation matches tags

REVEAL SOLUTION

interface eth0
 no shutdown
!
interface eth0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
!
interface eth0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

MISSION 4: THE BOTTLENECK SW

"Bandwidth is choked between Core-SW1 and Core-SW2. Aggregate the uplinks into a single logical channel."

Objectives:

Configure eth3 and eth4 into Port-Channel 1
Use LACP (Active mode)
Set the Port-Channel as a Trunk

REVEAL SOLUTION

interface range eth3 - 4
 channel-group 1 mode active
!
interface port-channel 1
 switchport mode trunk

MISSION 5: SILENT NEIGHBOR RTR

"OSPF adjacency with Branch-B is down. They are stuck in INIT state. Intelligence suggests a timer mismatch."

Objectives:

Interface eth1 needs Hello Interval set to 10
Dead Interval must be 4x Hello (40)
Verify adjacency comes up

REVEAL SOLUTION

interface eth1
 ip ospf hello-interval 10
 ip ospf dead-interval 40

MISSION 6: THE HELPER RTR

"Clients in the new wing (VLAN 30) aren't getting IPs. The DHCP server is on a different subnet (10.0.0.5)."

Objectives:

Configure eth0.30 (VLAN 30 Gateway)
Forward DHCP requests to 10.0.0.5

REVEAL SOLUTION

interface eth0.30
 ip helper-address 10.0.0.5

MISSION 7: PUBLIC FACE RTR

"We are launching a public web server (Internal: 192.168.10.50). It needs to be accessible via Public IP 203.0.113.5."

Objectives:

Configure Static NAT
Map internal IP to external IP

REVEAL SOLUTION

ip nat inside source static 192.168.10.50 203.0.113.5

MISSION 8: THE FIREWALL RTR

"Lock down the server farm. Block insecure Telnet, but allow SSH and Web traffic from anywhere."

Objectives:

Create Extended ACL 100
Deny TCP port 23 (Telnet) to 192.168.50.0/24
Permit TCP port 22 (SSH) and 80 (HTTP)
Permit ICMP (Ping)
Apply to eth0 inbound

REVEAL SOLUTION

access-list 100 deny tcp any 192.168.50.0 0.0.0.255 eq 23
access-list 100 permit tcp any 192.168.50.0 0.0.0.255 eq 22
access-list 100 permit tcp any 192.168.50.0 0.0.0.255 eq 80
access-list 100 permit ip any any
!
interface eth0
 ip access-group 100 in

MISSION 9: REDUNDANT GATEWAY RTR

"The primary router is flaky. Configure HSRP so the backup router takes over automatically if the primary fails."

Objectives:

Configure HSRP Group 1 on eth0
Virtual IP: 192.168.1.1
Set Priority to 150 (Primary)
Enable Preempt

REVEAL SOLUTION

interface eth0
 standby 1 ip 192.168.1.1
 standby 1 priority 150
 standby 1 preempt

MISSION 10: THE TIME TRAVELER RTR

"Logs are useless with the wrong time. Sync to the atomic clock and send all traps to the syslog server."

Objectives:

Set NTP Server to 1.1.1.1
Set Syslog Server to 10.0.0.50
Set Logging Trap level to Warning

REVEAL SOLUTION

ntp server 1.1.1.1
logging host 10.0.0.50
logging trap warning

SSH SESSION

Lab resets on refresh

CONNECTED

Latency 24ms

Packets/s 1,204

Uptime 00:12:45

Encryption TLS 1.3

Desktop Environment Required

LearnAul

CLI Quick Reference

Navigation

Modes

Verification

Command List

Cert Quiz