CCNA Troubleshooting Labs: Find the Fault, Fix the Network, Get Graded

Why CCNA troubleshooting needs its own practice

Most CCNA lab time goes into building: type the OSPF config, watch the neighbours come up, move on. That practises recall of syntax. It does not practise diagnosis, because you already know where the configuration is and what it should say. Diagnosis is a different skill - reading show ip interface brief, show vlan brief or a traceroute and noticing the one value that is wrong - and it only improves on networks you did not build.

That matters more from 3 February 2027, when CCNA 200-301 v2.0 replaces v1.1 under the same exam number. Cisco's v2.0 exam topics bring back troubleshoot and diagnose verbs after five years: troubleshoot IPv4 and IPv6 addressing (1.3/1.4), DHCPv4 client, server and relay (1.7), Layer 2 and Layer 3 connectivity using show commands, ping, traceroute and packet capture (2.4), and IPv4/IPv6 static routing (3.2), plus diagnose topics for interfaces and DNS. The v2.0 changes guide lists all seven.

The 9 CCNA troubleshooting scenarios

Each scenario is a small network with a written brief and a set of checks. Every run draws one fault from its list, so the second run of a scenario is new practice. Difficulty runs from Core to Advanced; times are for a first attempt.

WAN troubleshootingFree scenario

Branch Office Connectivity Failure

A branch PC has lost access to the head-office server. Work through the path - the access switch, the branch router and the head-office router - find what is wrong, and fix it so PC1 reaches Server1 again.

Core20 min6 possible faults

VLANs & trunks

Campus VLAN: Restore the Uplink

An application server is unreachable across two access switches. Restore the staff VLAN without connecting the isolated guest segment.

Core15 min2 possible faults

Static routing

Return Path: Two-Way Routing

All interfaces are up, but branch requests still time out. Trace both directions and restore reliable communication between the branch and the data centre.

Exam level20 min2 possible faults

OSPF

Three Sites on OSPF

Head office, branch and warehouse run a single OSPF area over a triangle of links. One site has dropped out of the routing domain. Find out why the adjacency will not form and bring the site back.

Exam level25 min4 possible faults

EtherChannel

Bundle the Access Uplink

Two cables run between the access switch and the distribution switch, and they were meant to work as one 2 Gbps link. The bundle has not formed, so spanning tree is blocking half the capacity. Get the channel up.

Exam level20 min3 possible faults

NAT & ACLs

The Office Edge: NAT and a Filter

The office router translates the private LAN behind its public address and filters what leaves. Since a change window, nobody on the LAN can reach the hosted application. Work out which half of the edge is broken.

Advanced25 min3 possible faults

IPv6

Dual Stack: IPv6 Beside IPv4

The IPv4 half of this network works and proves the cabling is fine. The IPv6 half does not. Find the difference between the two stacks and bring IPv6 up without disturbing IPv4.

Exam level22 min3 possible faults

Port security

Port Security: The Uplink That Locked Itself Out

An access switch was hardened over the weekend. Since Monday the whole second floor is offline while the reception PC beside it works perfectly. Find what the hardening actually secured, and fix it without leaving the edge ports unprotected.

Exam level25 min2 possible faults

DHCP & snooping

DHCP Relay and Snooping: No Address on the Floor

The DHCP server lives on the data centre subnet and serves the office through a relay. After a security change, office machines boot with no address at all. Work out whether the request is failing on the way out or the offer on the way back.

Advanced28 min3 possible faults

Between them: 28 different faults. The Branch Office scenario is free; the rest come with the CCNA pack. See them all in the scenario library.

What a run looks like, step by step

1. Read the brief and the topology. You get the symptom a user would report ("the branch PC cannot reach the head-office server") and a live diagram whose port lights follow the real link state.
2. Work from the console. Every device has a tab: routers and switches take IOS-style commands (show, ping, traceroute, configure terminal, pipes like | include), PCs take ipconfig, ping, tracert and arp -a. Enable passwords, --More-- paging, ? help and Tab completion behave the way they do on a real device.
3. Press Check whenever you like. It tests the network and costs nothing. It grades exactly what Submit will, so a repair that is still converging (a switch port coming up, an OSPF adjacency forming) is judged on its settled state.
4. Submit for a score. Correctness, efficiency against a par, hints used, integrity (nothing unrelated changed) and safety. Then draw a new fault or move on.

What a fault looks like from the console

This is real output from the engine the scenarios run on - an access switch whose EtherChannel uplink has one member refusing to join. Nothing in the brief says "EtherChannel"; the clue is a user complaining that the file server is slow and sometimes unreachable.

DIST#show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        R - Layer3      S - Layer2
        U - in use      u - unsuitable for bundling

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)       LACP        Gi0/1(s) Gi0/2(P)

The lower-case s means suspended: that member did not negotiate into the bundle. Compare the two ends' channel modes - one side set to on and the other to active will never bundle.

DIST#show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        R - Layer3      S - Layer2
        U - in use      u - unsuitable for bundling

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)       LACP        Gi0/1(P) Gi0/2(P)

Every command you would use on the exam works this way. The CCNA troubleshooting commands cheat sheet collects them by symptom, with more real output.

Scenario-to-blueprint map (v1.1 now, v2.0 from February 2027)

Mapped to Cisco's published exam topics. Before 3 February 2027 you sit v1.1, where these topics are configure-and-verify; from that date v2.0 applies, and 7 of the 9 scenarios drill a topic Cisco now words as troubleshoot.

Full domain weights and verbs: CCNA exam topics.

Troubleshooting labs vs Packet Tracer labs

They answer different questions, and most candidates benefit from both.

Packet Tracer is the better tool for building a topology from a blank canvas; it is free and every CCNA candidate should have it. For how it compares with GNS3, Cisco Modeling Labs and Boson NetSim, see the best CCNA lab simulators, ranked.

What is free, and what the CCNA pack adds

• Free with CCNA-EXAM-FULL: the Branch Office Connectivity Failure scenario (one fault) and a full-length CCNA practice exam with an explanation and an exam tip on every question.
• The CCNA pack, $39 once: all 9 scenarios and their 28 faults, plus every CCNA practice exam (5 exams, 509 questions) - for life, including future versions of the exam. No subscription.

CCNA troubleshooting practice questions

Five questions on reading symptoms and output, each with an explanation of why the other answers fail.