CCNA Final Challenge Lab
A client path is incomplete and its access policy is missing. Establish the failure boundary, restore service, and prove the policy yourself.
Symptom
Restore a client path, enforce its access policy, and prove the result across three simulated devices.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW1 · R1 · PC1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
The access VLAN and trunk are present, but a client cannot reach its server and the intended Telnet restriction has not been enforced.
What you'll practice
- Establish the Layer 2 and Layer 3 failure boundary
- Restore the router gateway and upstream route
- Place an extended ACL in the correct order and direction
- Prove both successful connectivity and an intentional denial
The topology
PC1 reaches R1 through VLAN 10 on SW1. R1 routes toward a remote server and applies the client policy inbound on its VLAN subinterface.
Frequently asked
Does this cover the whole CCNA?
No. It is an integrated checkpoint for switching, routing, and ACL reasoning; the learning path contains the remaining domains.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.