CCNA labs without Cisco hardware: the legal options

You don't need a rack of second-hand routers to practise for the CCNA. Cisco itself offers two free lab tools, and open-source routers cover the routing theory. This guide lists the legal options as of October 2026, what each costs, and which ones need a Cisco image licence.

What the CCNA expects you to practise

Cisco's exam topics page lists 200-301 CCNA v1.1, a 120-minute exam with performance-based questions. Its six domains and weights are:

The same page says the last date to test for v1.1 is 2 February 2027, and v2.0 starts on 3 February 2027. If you will sit the exam after that, check the v2.0 topics before you plan your labs.

Most of this is hands-on: VLANs and trunks, STP, EtherChannel, OSPF, static routes, NAT, DHCP, ACLs, SSH and port security. You need a CLI that behaves like Cisco IOS.

The legal options at a glance

Cisco Packet Tracer

Packet Tracer is Cisco's free network simulator, built for Networking Academy courses. The current version on the NetAcad Resource Hub is 9.0.1, for Windows 11, macOS 12 or newer, and Ubuntu 22.04 or 24.04, on an amd64 CPU with 4 GB of free RAM. You get it by enrolling in the free Getting Started with Cisco Packet Tracer course, then you sign in with Skills for All when it starts.

Its help files list VLANs, 802.1Q, VTP, DTP, STP, EtherChannel, OSPF, EIGRP, NAT, ACLs, DHCP and SSH, among many others. Simulation mode lets you step through each packet, which is the best way to understand ARP, DHCP or an ACL drop. The trade-off: Cisco describes it as a medium-fidelity simulation with simplified models, and flags some protocols, such as STP and IPv6, as having substantial modeling limitations. Our Packet Tracer vs GNS3 comparison goes deeper.

Licence: none needed beyond the free sign-in.

Cisco Modeling Labs (CML-Free and Personal)

CML-Free is the legal way to run real Cisco IOS at no cost. It runs up to 5 nodes at once; unmanaged switches and external connectors don't count. It includes IOL (an IOS XE router), IOL-L2 (a switch) and ASAv, plus Ubuntu and Alpine Linux hosts and a desktop image. You need a Cisco.com account to download it, and usage telemetry is always on in the free tier.

Five nodes is enough for most CCNA labs: two or three routers, a switch and a host. With IOL and IOL-L2 you get real IOS output for OSPF, STP, EtherChannel and NAT.

If you outgrow it, Cisco lists CML Personal at $199 for 20 nodes and Personal Plus at $349 for 40 nodes, single user. Cisco's full reference platform ISO adds images such as IOSv, IOSv-L2, CSR 1000v and Catalyst 8000v to the free set.

Hardware: Cisco's system requirements ask for at least 8 GB of RAM and 4 physical cores on an Intel CPU with VT-x and EPT. The free and Personal editions run as a VM in VMware Workstation 17, Player 17, or Fusion Pro 13 on Intel Macs. AMD is best effort, and CML does not work on Apple M series chips.

Licence: the CML licence covers the images, but only inside CML. Cisco's CML-Free page states: "The Cisco VM images that are provided for download with Cisco Modeling Labs or as part of the CML refplat ISO file are only licensed for use within Cisco Modeling Labs."

IOL and IOSv in other tools: only with your own licence

GNS3, EVE-NG and Containerlab can all run Cisco IOL and IOSv. Containerlab's docs even explain how to package IOL from the CML reference platform ISO. The tools are legal and free (EVE-NG has a 7-node Freemium tier). The images are the problem.

• Images copied out of CML are licensed for CML only. Running them in another tool needs "a proper license", in Cisco's words.
• Images from download sites, forums or torrents are not licensed at all.
• If your employer or school holds a Cisco agreement that covers these images in other tools, that is your licence. Check its terms before you rely on it.

If you don't have such a licence, use CML for real Cisco images and use the other tools for open-source devices. Our EVE-NG vs GNS3 and GNS3 alternatives posts compare those tools.

FRR for routing concepts

FRRouting (FRR) is an open-source routing suite with an IOS-like shell called vtysh. It is not Cisco IOS, so it won't teach you every Cisco command, but OSPF neighbours, LSAs, route selection and BGP work the same way. It runs in Docker with no licence.

Here is a two-router OSPF lab in area 0, tested with FRR 10.7.1:

docker network create --subnet 192.168.12.0/24 ccna-lab
for r in r1 r2; do
  docker run -d --name $r --hostname $r --privileged \
    --network ccna-lab quay.io/frrouting/frr:10.7.1
done
for r in r1 r2; do
  docker exec $r sed -i 's/^ospfd=no/ospfd=yes/' /etc/frr/daemons
  docker restart $r
done

Open vtysh on r1 with docker exec -it r1 vtysh and configure it like a Cisco router:

r1# configure terminal
r1(config)# interface lo
r1(config-if)#  ip address 1.1.1.1/32
r1(config-if)# exit
r1(config)# router ospf
r1(config-router)#  ospf router-id 1.1.1.1
r1(config-router)#  network 192.168.12.0/24 area 0
r1(config-router)#  network 1.1.1.1/32 area 0
r1(config-router)# end

Do the same on r2 with 2.2.2.2. On a shared LAN, OSPF waits about 40 seconds to elect a designated router. Then check the neighbour and the learned route:

docker exec r1 vtysh -c "show ip ospf neighbor" -c "show ip route ospf"

Neighbor ID     Pri State           Up Time         Dead Time Address         Interface
2.2.2.2           1 Full/DR         5.096s            34.904s 192.168.12.3    eth0:192.168.12.2

IPv4 unicast VRF default:
O>* 2.2.2.2/32 [110/10] via 192.168.12.3, eth0, weight 1, 00:00:00

Note two differences from IOS. FRR's network statement takes a prefix length (192.168.12.0/24) where IOS uses a wildcard mask (192.168.12.0 0.0.0.255), and the router ID is set with ospf router-id. Clean up with docker rm -f r1 r2 and docker network rm ccna-lab. For a bigger version with two LANs, follow our OSPF lab with FRR in Docker.

Licence: FRR is open source; no Cisco licence needed.

A study plan that stays legal

1. Packet Tracer for the first pass through each topic: VLANs, trunks, STP, DHCP, NAT, ACLs, wireless.
2. CML-Free to repeat the key labs on real IOS: OSPF, EtherChannel, port security, NAT, SSH.
3. FRR and Linux to understand routing protocols in depth and to practise automation, for example with Python or Ansible against Linux hosts.
4. CML Personal only if 5 nodes becomes a real limit.

Planning labs with Isothrum

Isothrum's editor is a free browser editor that needs no account. It can draw FRR labs like the one above and export them as Docker Compose or Vagrant files to run yourself. It also takes Cisco IOL, IOSv, CSR 1000v, Catalyst 8000v or Dynamips routers, but only from your own images, built with vrnetlab; it ships none, so the licence rules above still apply. For Cisco images without a licence of your own, CML is the place.