Guided builds
Build real networks, one checked step at a time
A guided build is a networking lab you follow in the browser. Each step tells you which device to place, which ports to cable, and exactly what to type in the CLI — then checks your network live, the way a real ping or show would, before you move on. Troubleshooting builds hand you a broken network and walk you through finding the fault. Every command on these pages is run by an automated test against the simulator, so it works as printed.
Builds with up to 5 devices are free for everyone, no account needed. Larger builds need any paid plan.
Foundations
Addressing, cabling, the first ping, and how a packet finds its way.
- One router, one PC, one pingBuild the smallest network that works: address a router and a PC on the same subnet and get a reply back.starter 5 steps · 2 devices ~10 min
- Three hosts, one switchPut three PCs on a single subnet through an unconfigured switch and watch it learn who lives where.starter 6 steps · 4 devices ~12 min
- ARP and MAC learning, side by sideWatch a host's ARP cache and a switch's MAC table fill from the very first frame — and see why a host never ARPs for anything beyond its gateway.starter 5 steps · 4 devices ~14 min
- Two LANs, one routerPut a PC on each of two different subnets and make them talk through a router.starter 7 steps · 3 devices ~12 min
- VLSM for two sitesCarve one /24 into a /26, a /27 and a /30 sized to what each site needs, then route between them with masks that match the plan.core 5 steps · 4 devices ~18 min
- A stub branch and one default routeSend everything a branch can't place to HQ with a single default route, and see why HQ still needs a specific route back for every branch network.core 7 steps · 4 devices ~22 min
- Traceroute across three routersChain three routers with static routes and follow a packet hop by hop — then watch a trace stop at a missing route and circle in a routing loop.core 7 steps · 5 devices ~25 min
- Your first IPv6 pingAddress two routers and their LANs with IPv6, ping across the link between them, then route between the sites with a static route and a ::/0 default.core 7 steps · 4 devices ~22 min
Switching & wireless
VLANs, trunks, inter-VLAN routing, loops, bundles and Wi-Fi.
- Map the network with CDP and LLDPLet two switches and a router discover each other, find the router's address from a switch that was never told it, add LLDP, then stop the router announcing itself toward the internet.starter 5 steps · 3 devices ~12 min
- Two departments, one switchSplit a single switch into Sales and Ops with VLANs, and watch the pings between them stop.core 7 steps · 5 devices ~15 min
- One VLAN across two switchesSplit four PCs into two VLANs across two switches, then carry both VLANs between the switches over a single tagged trunk.core 7 steps · 6 devices ~18 min Paid plan
- Router on a stickSplit one switch into two VLANs and route between them over a single router port.core 8 steps · 4 devices ~18 min
- Route between VLANs on the switchGive one switch an SVI in each VLAN, find out why the VLANs still can't talk, then turn on ip routing — inter-VLAN routing with no router at all.core 6 steps · 3 devices ~15 min
- Choose your root bridgeClose a loop of three switches, find the port spanning tree blocks on its own, then decide which switch is root — and which one takes over when it fails.core 6 steps · 3 devices ~16 min
- Two cables, one logical linkAdd a second uplink between two switches, watch spanning tree block it, then bundle both into an LACP EtherChannel so they carry traffic together.core 5 steps · 4 devices ~15 min
- Guest Wi-Fi that actually associatesStand up a WPA2-PSK guest network on a bridged access point and prove a laptop joins it and reaches the wired LAN.core 6 steps · 5 devices ~15 min
Routing
Static, default and floating routes, then OSPF, RIP, EIGRP and BGP.
- Static routes across a WANJoin three sites with point-to-point WAN links and route between them by hand, one line at a time.core 9 steps · 6 devices ~22 min Paid plan
- RIP: routing by counting hopsChain three routers over two serial links and let RIP version 2 teach every router the way to every network, counting the hops as it goes.core 6 steps · 5 devices ~18 min
- Two routers that learn the networkJoin two sites over a WAN link, then let OSPF fill in the routing tables that you would otherwise type by hand.advanced 7 steps · 5 devices ~20 min
- A backup link that waits its turnRun two sites over a fast primary link, park a floating static route on a slow standby line, then pull the primary and watch the backup carry the traffic.core 8 steps · 4 devices ~20 min
- Steer OSPF with link costGive OSPF two paths between two sites, watch it choose the cheaper one over the shorter one, then re-rate a link and watch the route move.advanced 7 steps · 5 devices ~25 min
- Share one default route with OSPFGive the edge router a default route to the provider, then let OSPF hand it to the rest of the campus instead of typing it on every router.advanced 7 steps · 5 devices ~22 min
- EIGRP across three routersJoin two sites through a hub with EIGRP, find why one router learns nothing, then add a direct link and watch EIGRP choose speed over hop count.advanced 7 steps · 5 devices ~25 min
- OSPF across two areasSplit an OSPF network into a backbone and a branch area, and make one router the border between them.advanced 7 steps · 7 devices ~28 min Paid plan
- Two providers, one eBGP sessionConnect two autonomous systems, bring up an eBGP session between their border routers, and announce each provider's customer blocks to the other.advanced 8 steps · 5 devices ~25 min
Network services
DHCP, NAT, NTP and secure management.
- Let the router hand out the addressesBuild a four-device office LAN, address one PC by hand, then put a DHCP pool on the router so the next machine configures itself.starter 6 steps · 4 devices ~15 min
- One DHCP server for every floorServe a user floor from a central DHCP server on another subnet — watch the first request die at the router, then relay it with ip helper-address.core 6 steps · 5 devices ~20 min
- Let the core switch hand out the addressesRun two department VLANs, their gateways and their DHCP pools on a single switch — and find out why a perfect pool can still hand out nothing.core 7 steps · 3 devices ~20 min
- NAT to the internetHide two private office LANs behind the single public address your provider gave you.core 8 steps · 5 devices ~20 min
- Give the whole network one clockBuild an NTP hierarchy from HQ to a branch switch, read the strata hop by hop, then find the security ACL that silently broke time while ping kept working.core 7 steps · 3 devices ~20 min
- Lock management down to SSHMake a switch manageable from the admin subnet, then harden it: RSA keys, SSH version 2, a local account, and VTY lines that refuse everything but SSH.core 7 steps · 3 devices ~20 min
Security & resilience
Filtering, firewalls, and gateways that survive a failure.
- One jack, one PC: port securityLock the reception wall jack to one PC with sticky port security, watch a visitor's laptop err-disable it, recover the port, then switch to restrict so the next intruder is dropped without taking reception offline.core 6 steps · 5 devices ~18 min
- Guard the server with an ACLLet one workstation reach the server, stop the guest laptop, and learn what the implicit deny does to everyone else.core 7 steps · 5 devices ~20 min
- A DMZ behind a firewallStand a firewall between three zones so the public reaches one server and nothing else.advanced 7 steps · 6 devices ~25 min Paid plan
- Two routers, one gatewayGive a LAN a gateway that survives a router failure: two routers share one virtual address with VRRP, and the hosts never notice the handover.advanced 7 steps · 5 devices ~25 min
Troubleshooting
You are handed a broken network. Find the fault, then fix it.
- Fix the broken officeNobody in a two-desk office can reach the intranet server. Find the two faults and fix them, one layer at a time.starter 6 steps · 5 devices ~12 min
- Fix the VLAN that stops at the trunkEngineering's server is unreachable and the south desk is cut off completely. Find the wrong VLAN and the trunk that drops it.core 6 steps · 5 devices ~15 min
- Fix the desks DHCP forgotThe clinic's desks come up with no address. Find why the DHCP server never hears them — then why their leases still go nowhere.core 6 steps · 5 devices ~16 min
- Fix the NAT that translates nothingThe shop's desks and tills cannot reach the internet, yet the router itself can. Find why nothing leaves translated.core 7 steps · 5 devices ~18 min
- Fix the OSPF adjacenciesThree routers run OSPF and nothing converges. Find the area mismatch and the network statement that matches nothing.advanced 6 steps · 5 devices ~20 min
- Fix the branch that fails four waysA branch depot has lost head office, and two of its hosts have faults of their own. Find all four, one layer at a time.advanced 10 steps · 7 devices ~30 min Paid plan
Capstones
Whole networks that combine everything above.
- Campus capstonePut it all together: two wiring closets, two VLANs, DHCP for the desks, and one public address for the whole site.advanced 9 steps · 8 devices ~35 min Paid plan
- Branch office capstoneStaff and guests on one switch: guests lease an address the moment they plug in, reach the internet, and never see a staff file.advanced 10 steps · 7 devices ~40 min Paid plan
- Redundant campusDouble every link and box between a desk and HQ — bundled, spanning-tree protected, VRRP gateways, twin OSPF circuits — then break two of them and keep working.advanced 10 steps · 8 devices ~50 min Paid plan