10 AP Networking Packet Tracer Labs: Topologies, Configurations & Troubleshooting

Classroom-ready • Original practice

Ten Packet Tracer investigations, not ten click-through tutorials

A working network is only half the assignment. In every lab, students predict the expected behavior, build a small topology, collect baseline evidence, introduce or receive a specific fault, and justify a targeted repair. The goal is to turn a screenshot or a command result into an explanation another technician could act on.

What you are getting: complete, original browser-readable lab instructions, sample configurations, troubleshooting variants, verification criteria, and teacher answer notes. These are not downloadable Cisco .pkt or .pka files; create and save each topology in Packet Tracer using the instructions below. They are independent classroom activities, not official AP exam questions or official Cisco activities.

Find the lab that matches today's lesson

Before you beginInstall Packet Tracer, organize files, and learn the evidence standard.01 · Two-PC LANBuild a switch LAN and distinguish link faults from address faults.02 · DHCP and APIPAFix an exhausted or incorrect DHCP scope.03 · DNS dependencyProve that a hostname failure is not necessarily an internet failure.04 · VLAN isolationFind the wrong access VLAN and verify same-VLAN reachability.05 · Inter-VLAN routingConfigure router-on-a-stick and locate a missing gateway.06 · Route selectionUse longest-prefix matching to explain a failed destination.07 · ACL orderFind a rule that blocks a legitimate application.08 · Wireless onboardingSeparate association, authentication, addressing, and DNS.09 · NAT and internetTranslate private addresses and verify the return path.10 · Capstone outageDiagnose multiple faults without random configuration changes.Student evidence sheetA printable reusable template for every lab.Teacher setup and gradingDifferentiation, classroom timing, and assessment rubric.Frequently asked questionsAnswers about Packet Tracer files, grading, and exam relevance.

Before students open the software

Use a current school-approved Cisco Packet Tracer installation. Students should sign in through their own authorized account when required.
Create a folder named APN-Packet-Tracer-Labs. Save a baseline .pkt file before adding faults, and a separate final file after verification.
Use the device models available in your version. Interface labels may differ: GigabitEthernet0/0 and GigabitEthernet0/0/0 are not interchangeable names.
Use only the simulated topology or an authorized classroom network. Never test ACLs, DHCP, or routing changes on a school production network.

The evidence standard for every lab

Requirement: What must communicate, and by which service?
Baseline: Which tests worked before the fault?
Artifact: Capture the relevant IP configuration, routing table, switch port, or simulation event.
Decision: Explain why this evidence favors one cause over another.
Verification: Repeat the original test after one controlled change.

Free AP Networking teacher PowerPoints →

Introduce each networking mechanism with classroom slides before students build and troubleshoot the corresponding topology.

Eight worked artifact-analysis examples →

See how to convert command output, configuration snippets, and network symptoms into defensible written explanations.

Investigation 01 / 10

Two PCs, one switch, one missing link

Students must distinguish a physical/link problem from a logical IPv4 addressing problem before touching a configuration.

35–45 minUnit 1 • beginnerOriginal classroom activity

Build the topology

2 PCs, 1 access switch, 2 copper straight-through links

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
PC-A	192.168.10.11	/24
PC-B	192.168.10.12	/24

Student procedure

Connect each PC to a different switch access port.
Assign the two static IPv4 addresses in Desktop → IP Configuration.
Confirm both link indicators and ping PC-B from PC-A.
Switch to Simulation mode and inspect ARP before ICMP.

Commands and evidence to collect

PC-A> ping 192.168.10.12
Switch# show interfaces status
Switch# show mac address-table dynamic

Teacher fault injection: Disconnect PC-B cable, or administratively shut down only PC-B’s switch port. Do not also change an IP address.

Pass criteria

A successful ping after repair; both ports up; the switch learns both source MAC addresses.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

A down interface or unplugged cable prevents frames from reaching PC-B. Fix the single link issue, wait for the port to become active, then ping again. An empty dynamic MAC entry alone does not prove a bad cable until traffic has been generated.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

Network devices and connection roles →

Review how NICs, switches, MAC learning, and Ethernet links cooperate before routing is involved.

Investigation 02 / 10

DHCP lease failure and a 169.254 address

A host that cannot obtain its expected address needs a DHCP-path investigation—not an immediate assumption that the internet is down.

45–55 minUnit 1–2 • beginner/intermediateOriginal classroom activity

Build the topology

1 router or server providing DHCP, 1 switch, 2 PCs

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
Gateway	192.168.20.1/24
DHCP pool	192.168.20.100–192.168.20.109
PC-A / PC-B	DHCP

Student procedure

Create the LAN and configure the DHCP service with gateway 192.168.20.1.
Request addresses on both PCs; record the lease, gateway, and DNS fields.
Use Simulation mode with DHCP events visible.
Repeat after the teacher injects a fault.

Commands and evidence to collect

Router# show ip dhcp pool
Router# show ip dhcp binding
Router# show running-config | section dhcp
PC> ipconfig /all

Teacher fault injection: Use an intentionally tiny pool containing one usable lease, allocate it to PC-A, then request a lease on PC-B. Alternatively, disable the DHCP service; choose only one fault per attempt.

Pass criteria

PC-B receives an expected 192.168.20.x lease, correct /24 mask, and gateway; successful gateway ping.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

For an exhausted pool, confirm that the DHCP service is reachable but has no free addresses. Increase the configured address pool within the intended subnet or release an unused test lease. A simulated client may display 169.254.x.x when automatic private addressing is supported; absence of that display does not change the diagnosis.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

DHCP troubleshooting guide →

Use a fault-by-fault decision process for exhausted scopes, relay problems, missing offers, and incorrect lease options.

Investigation 03 / 10

DNS: IP connectivity works, hostname fails

Students prove that reaching a web server by IP and reaching it by name are different requirements.

40–50 minUnit 2–4 • intermediateOriginal classroom activity

Build the topology

1 DNS server, 1 web server, 1 switch, 1 router or gateway, 1 PC

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
PC	192.168.30.10/24	DNS 192.168.30.53
DNS	192.168.30.53/24
Web	192.168.30.80/24
A record	portal.lab.test → 192.168.30.80

Student procedure

Enable HTTP on the web server and DNS on the DNS server.
Create the A record for portal.lab.test.
Open the website by IP, then by hostname; record both results.
Use the PC command prompt to query the resolver before introducing a fault.

Commands and evidence to collect

PC> ping 192.168.30.80
PC> nslookup portal.lab.test
PC> ipconfig /all

Teacher fault injection: Change only the client DNS setting to 192.168.30.99 (an unused address). Keep the web server and IP route unchanged.

Pass criteria

HTTP works by both IP and name; DNS query returns 192.168.30.80 from the intended resolver.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

The successful IP test narrows the issue to name resolution or a name-dependent application path. Restore the intended DNS server address, repeat nslookup, then retest the hostname. A successful ping to a web server is not proof that HTTP works—test HTTP separately.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

DNS troubleshooting guide →

Compare resolver failures, missing records, wrong DNS settings, and web-service faults using discriminating tests.

Investigation 04 / 10

VLAN access-port mistake

Two devices with compatible IP addresses can still be isolated when a switch assigns them to different VLANs.

45–60 minUnit 2–3 • intermediateOriginal classroom activity

Build the topology

1 managed switch, 3 PCs

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
PC-A	192.168.40.11/24	VLAN 10
PC-B	192.168.40.12/24	VLAN 10
PC-C	192.168.50.13/24	VLAN 20

Student procedure

Create VLANs 10 and 20 on the switch.
Assign PC-A and PC-B ports to VLAN 10; assign PC-C to VLAN 20.
Ping A→B and A→C; explain why no router means no inter-VLAN reachability.
Record switch VLAN membership and the observed test outcomes.

Commands and evidence to collect

Switch(config)# vlan 10
Switch(config-vlan)# name STUDENTS
Switch(config)# vlan 20
Switch(config-vlan)# name STAFF
Switch(config)# interface fa0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch# show vlan brief

Teacher fault injection: Move PC-B’s access port to VLAN 20 while leaving its 192.168.40.12/24 address unchanged.

Pass criteria

A→B works again after the port is returned to VLAN 10; A→C remains isolated unless routing is intentionally added.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

Use show vlan brief to identify the mismatched port membership. Restore PC-B to VLAN 10. Do not change its IP address to conceal a switch-side fault; this lab is about the broadcast-domain boundary.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

VLAN troubleshooting guide →

Practice separating wrong access VLANs, trunk restrictions, and routing failures.

Investigation 05 / 10

Router-on-a-stick: two VLANs, one missing gateway

Students build a trunk, router subinterfaces, and default gateways—then isolate the one missing configuration element.

55–70 minUnit 3 • intermediateOriginal classroom activity

Build the topology

1 switch, 1 router with Ethernet interface, 2 PCs

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
VLAN 10 PC	192.168.10.10/24	GW .1
VLAN 20 PC	192.168.20.20/24	GW .1
Router G0/0.10	192.168.10.1/24
Router G0/0.20	192.168.20.1/24

Student procedure

Create VLANs 10 and 20, assign PC access ports, and trunk the switch port connected to the router.
Configure router subinterfaces with 802.1Q encapsulation and distinct gateway addresses.
Test each PC to its own gateway and then to the other PC.
Inspect subinterface and trunk status before applying the teacher fault.

Commands and evidence to collect

Router(config)# interface g0/0
Router(config-if)# no shutdown
Router(config)# interface g0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config)# interface g0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Switch# show interfaces trunk
Router# show ip interface brief

Teacher fault injection: Remove or misconfigure the VLAN 20 router subinterface IP address, while preserving the VLAN 10 subinterface and trunk.

Pass criteria

Both PCs can ping their own gateway and each other after correction; show interfaces trunk includes the required VLANs.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

If VLAN 10 reaches its gateway but VLAN 20 cannot, inspect VLAN 20 subinterface addressing and trunk allowance. Restore 192.168.20.1/24 on the correct dot1Q 20 subinterface. Router interface naming varies by model.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

VLANs explained for AP Networking →

Connect the physical trunk, 802.1Q tags, logical router interfaces, and host gateway requirements.

Investigation 06 / 10

Longest-prefix match and the wrong next hop

A route table can contain a valid default route and still send one destination the wrong way when a more-specific route overrides it.

55–70 minUnit 3–4 • advancedOriginal classroom activity

Build the topology

3 routers, 2 LAN switches, 2 PCs; use static routes

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
Source LAN	10.10.10.0/24
Destination LAN	10.20.20.0/24
R1–R2 transit	172.16.12.0/30
R1–R3 transit	172.16.13.0/30

Student procedure

Build R1 with links to R2 and R3. Place the destination LAN behind R2.
Configure a static route on R1 to 10.20.20.0/24 via R2 (172.16.12.2).
Add return routing on R2 toward 10.10.10.0/24; confirm end-to-end ping.
Capture show ip route and traceroute results before injecting the fault.

Commands and evidence to collect

R1(config)# ip route 10.20.20.0 255.255.255.0 172.16.12.2
R1# show ip route 10.20.20.10
R1# traceroute 10.20.20.10

Teacher fault injection: Add a more-specific 10.20.20.0/25 route via R3 (172.16.13.2), which has no onward path to that /25. Use a destination 10.20.20.10 inside that /25.

Pass criteria

Route lookup for 10.20.20.10 uses the intended R2 next hop; traceroute and end-to-end ping recover.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

The /25 wins over the /24 for addresses in 10.20.20.0–10.20.20.127, regardless of a higher-metric broader route. Remove or correct the mistaken /25, and verify both the selected route and return path.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

How routers choose paths →

Review longest-prefix match, static-route decisions, next-hop reachability, and why a default route may be irrelevant.

Investigation 07 / 10

ACL order: the web server that cannot be reached

Students learn why a permit statement cannot help if an earlier deny statement already matches the traffic.

50–65 minUnit 4 • advancedOriginal classroom activity

Build the topology

1 router, 2 switches, 2 PCs, 1 web server

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
Client	192.168.60.10/24
Web server	192.168.70.80/24
Service	HTTP TCP/80
Routers	.1 gateways for each LAN

Student procedure

Build routed client and server networks; verify HTTP by IP before adding an ACL.
Create an extended ACL that permits client-to-server TCP destination port 80 and allows required return traffic under the chosen placement.
Apply the ACL inbound on the client-side router interface.
Confirm the browser loads HTTP and inspect match counters.

Commands and evidence to collect

Router(config)# ip access-list extended WEB-LAB
Router(config-ext-nacl)# permit tcp host 192.168.60.10 host 192.168.70.80 eq 80
Router(config-ext-nacl)# permit ip any any
Router(config)# interface g0/0
Router(config-if)# ip access-group WEB-LAB in
Router# show access-lists WEB-LAB

Teacher fault injection: Insert a broad deny ip 192.168.60.0 0.0.0.255 192.168.70.0 0.0.0.255 above the specific HTTP permit; keep an explicit allow for other lab traffic if appropriate.

Pass criteria

HTTP succeeds again after the overly broad early deny is removed or correctly narrowed; ACL counters reflect intended matches.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

ACLs are processed top-down, first match. An early broad deny shadows the later HTTP permit. Use show access-lists to inspect order and counters, change only the faulty rule, and retest HTTP. The exact interface placement matters.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

Firewall rule-order practice →

Differentiate policy denial from missing routes, a stopped web service, and an incorrectly placed ACL.

Investigation 08 / 10

Wireless: connected to Wi-Fi, no usable network

Students separate SSID association and WPA authentication from receiving a usable address, gateway, and DNS server.

45–60 minUnit 1–2 • intermediateOriginal classroom activity

Build the topology

1 wireless router or access point, 1 laptop, 1 wired PC

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

★ Teacher Extension • 2028 Exam Study Plan

A five-minute warm-up for 10 AP Networking Packet Tracer Labs

Tomorrow’s opening question can pick up where this page leaves off: ask students to read the packet evidence, spot the important clue and explain what happened. The 300 Bell Ringers give you short questions and teacher answers you can use without preparing a new starter each morning.

300 AP Networking Bell Ringers

$74.99

BUY TEACHER PACK → See what is included in the 300 Bell Ringers →

Instant Access • Full-Year Teacher Resource

Addressing and setup

Device or service	Address or setting	Additional detail
Wireless LAN	192.168.80.0/24
Gateway	192.168.80.1
SSID	APN-LAB
Security	WPA2-PSK where supported

Student procedure

Configure a wireless router with SSID APN-LAB and a classroom-only passphrase.
Enable its DHCP service for the wireless LAN.
Connect the laptop, verify association, then record its IP, gateway, and DNS.
Ping the gateway, then reach the wired PC and test name resolution if a DNS service is configured.

Commands and evidence to collect

Laptop> ipconfig /all
Laptop> ping 192.168.80.1
Laptop> ping 192.168.80.20

Teacher fault injection: Keep the correct SSID and security credentials but disable DHCP on the wireless router; if supported, watch the client DHCP exchange in Simulation mode.

Pass criteria

Laptop obtains an expected 192.168.80.x address and gateway, then reaches the wired PC.

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

Successful association proves only the wireless link and authentication stages. Re-enable the authorized DHCP service, renew the lease, and verify the address/gateway fields before testing higher-layer services.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

Wireless failure-signature database →

Use a staged checklist for association, signal, authentication, DHCP, DNS, and interference.

Investigation 09 / 10

NAT: the private LAN cannot reach the outside

Students trace the outbound packet and the translated source address instead of assuming every internet-like failure is DNS.

60–75 minUnit 4 • advancedOriginal classroom activity

Build the topology

2 routers, 1 switch, 1 inside PC, 1 outside server

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
Inside	192.168.90.0/24
R1 inside	192.168.90.1
R1 outside	203.0.113.1/30
R2 outside-facing	203.0.113.2/30
Server behind R2	198.51.100.80/24

Student procedure

Configure routing so R1 reaches 198.51.100.0/24 via R2 and R2 reaches the server.
Configure PAT on R1 for the inside 192.168.90.0/24 network using its outside interface.
Test HTTP from the inside PC to the outside server; inspect translations.
Repeat the test after the teacher removes one NAT setting.

Commands and evidence to collect

R1(config)# access-list 1 permit 192.168.90.0 0.0.0.255
R1(config)# interface g0/0
R1(config-if)# ip nat inside
R1(config)# interface g0/1
R1(config-if)# ip nat outside
R1(config)# ip nat inside source list 1 interface g0/1 overload
R1# show ip nat translations
R1# show ip route

Teacher fault injection: Remove ip nat inside from R1’s LAN interface. Keep the rest of routing and the overload rule intact.

Pass criteria

The inside client reaches the outside server; show ip nat translations shows active translations after generating traffic.

Premium Troubleshooting Lab • 120 Missions

Let students try 10 AP Networking Packet Tracer Labs for themselves

Reading the explanation is a start. In the browser simulator, students work through a broken network, choose what to test and see whether their fix worked. It gives them another chance to use what they learned about 10 AP Networking Packet Tracer Labs.

AP Networking Browser Troubleshooting Simulator

$29.99

120 Missions • 60 Failure Patterns • Offline Copy

GET THE SIMULATOR → See all 120 missions & features

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

The inside interface must be marked as inside for PAT to translate matching traffic. Restore the interface role, generate new traffic, and inspect translations. The reserved documentation IP ranges in this lab simulate an outside network, not actual public internet access.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

NAT troubleshooting basics →

Learn to separate missing translation, wrong interface roles, ACL mismatches, routing, and return-path errors.

Investigation 10 / 10

Capstone: a three-fault campus outage

Students receive an incident report, choose tests, and repair independent faults one at a time while preserving evidence.

75–100 minUnits 1–4 • advancedOriginal classroom activity

Build the topology

2 switches, 2 routers, DNS/web server, 4 PCs, optional wireless client

Starting configuration: use the addressing and VLAN details below; interface names may vary by router model.

Student deliverable

Submit a baseline .pkt file, a repaired .pkt file, and a short incident report identifying the fault, the decisive evidence, the minimal correction, and a repeated verification test.

Addressing and setup

Device or service	Address or setting	Additional detail
Students VLAN 10	192.168.110.0/24
Staff VLAN 20	192.168.120.0/24
DNS/web server	192.168.130.80/24
Gateway	.1 in each subnet

Student procedure

Build two access VLANs with routed connectivity to a server subnet.
Configure DHCP for both client VLANs and an A record portal.lab.test → 192.168.130.80.
Verify staff and students can browse the portal before faults are introduced.
Teacher introduces three independent faults; students are not told which layers are affected.

Commands and evidence to collect

Switch# show vlan brief
Switch# show interfaces trunk
Router# show ip interface brief
Router# show ip route
Router# show access-lists
PC> ipconfig /all
PC> nslookup portal.lab.test
PC> ping 192.168.130.80

Teacher fault injection: Teacher faults: move one student access port to VLAN 20; set one staff client to wrong DNS server; add an ACL denying the student VLAN to the web server on TCP/80. Save a teacher-only broken baseline.

Pass criteria

All clients receive intended subnet addresses, can resolve portal.lab.test, and load HTTP according to the original requirements; each repair has before/after evidence.

Troubleshooting Exam Practice • the 2028 study plan

Check whether 10 AP Networking Packet Tracer Labs has really stuck

Once students have worked through this topic, give them questions mixed in with the rest of the course. The Exam Prep Vault includes practice exams, multiple-choice questions and artifact labs so they cannot rely on a chapter heading to tell them what to do.

AP Networking Complete Exam Prep Vault

$39.99

GET THE EXAM PREP VAULT → See the Exam Prep Vault contents →

4 Practice Exams • 320 MCQs • 60 Artifact Labs

Evidence question: Which observed field or test result proves your chosen cause, and which alternative cause does it rule out?

Teacher notes: expected diagnosis and repair (expand)

There are three distinct failure boundaries: wrong VLAN membership, wrong DNS configuration, and an ACL application restriction. A single ping result cannot prove all services are healthy. Students must test from multiple clients and distinguish successful IP reachability from successful DNS and HTTP.

Extension: Ask students to explain one plausible but incorrect diagnosis and design a test that would distinguish it from the real fault.

Network troubleshooting simulator →

Continue with additional scenarios that require choosing a diagnostic test before seeing the next artifact.

Reusable • Print for every investigation

Student troubleshooting evidence sheet

Students should complete this sheet before they read the teacher notes. It prevents random changes and gives teachers evidence of reasoning, not just a finished topology.

Incident report • One page per lab

Lab: _____________________ Name: _____________________

1. Requirement: What exactly should work? From which device to which destination, using which protocol or service?

2. Known-good checkpoint: Which test succeeds, and what does that success actually prove?

3. First failure: Record the earliest failed dependency, the relevant command or screen, and the exact output.

4. Two hypotheses: Name two plausible causes. Which next test would separate them?

Premium Evidence-Grading Copilot

Spend less time marking explanations about 10 AP Networking Packet Tracer Labs

When students explain their answer, it takes more than a right-or-wrong check to see what they understand. The Grading Copilot helps you review how they used the clues, where their explanation falls short and what feedback to give next. You make the final grading decision.

AP Networking Artifact Analysis Grading Copilot

$49.99

8 Criteria • 5 Task Modes • Offline Premium Copy

GET THE GRADING COPILOT → See the free Copilot preview

5. Minimal repair: Describe the single change made and why the evidence supports it.

6. Verification: Repeat the original requirement. What changed in the result or artifact?

Printing uses your browser's print dialog. Select the pages you need, or copy this worksheet into your classroom LMS.

Network Evidence Decision Lab →

Give students extra practice choosing the next diagnostic command and explaining what its output can establish.

Teacher implementation

How to run these labs without spending the whole period fixing student files

Before class: build three copies

Known-good master: a functioning baseline with device labels, saved before fault injection.
Student start: the same topology with the intended fault but without revealing its cause.
Teacher key: a copy with expected evidence, exact repair, and screenshots of the final verification.

Use .pkt for ordinary saved topologies. Instructors familiar with Packet Tracer's Activity Wizard may separately package activities as .pka; these web instructions do not claim to contain those files.

A 55-minute lesson structure

0–6 min: state the business requirement and predict the expected network path.
6–16 min: load the baseline, inspect interfaces and collect a successful test.
16–32 min: open the faulty topology; choose tests and record evidence.
32–44 min: justify and apply one targeted repair; verify the original requirement.
44–55 min: write the incident report and compare diagnoses.

Original 20-point classroom rubric

Category	Points	What earns full credit
Topology and baseline	4	Correct devices, addresses, and a documented known-good test.
Evidence selection	4	Relevant commands or Simulation events, with exact output captured.
Diagnosis	4	Names the correct failure boundary and rules out a plausible alternative.
Targeted correction	4	Changes only what is needed and preserves the intended design.
Verification and explanation	4	Repeats the original service test and explains what the new result proves.

Assessment boundary: This is an original classroom rubric, not an official AP Networking scoring guideline.

Differentiate without lowering the evidence standard

Beginning students: provide the topology and addressing table, then ask for two diagnostic tests and one repair.

Developing students: provide the broken topology and requirement, but hide the faulty device.

Advanced students: give only the incident ticket and require a before/after route, ARP, ACL, or service artifact.

What Packet Tracer cannot prove

Simulation behavior varies by device model and software version. It does not reproduce every production device command, radio-interference condition, internet service, or security feature. Treat a successful simulation as evidence for the modeled network, not proof that the same configuration is production-ready.

NEW • COMPLETE 180-DAY TEACHER CURRICULUM

Teach 10 AP Networking Packet Tracer Labs as part of a planned school year

This page gives you one topic. The 180-Day Teacher Curriculum puts it into a full course plan, with daily teaching notes, student activities and checks for understanding. Use it when you need to know what comes before this lesson and what to teach next.

AP Networking Complete 180-Day Teacher Curriculum

$199.99

180 Lessons • 180 Daily Simulators • 36 Teaching Weeks

GET THE 180-DAY CURRICULUM → See 3 free curriculum examples

How to teach AP Networking in 2027–28 →

Place these labs inside a full-year pacing plan with equipment options, assessment checkpoints, and an introductory DNS lesson.

AP Networking teacher resources →

Find related lesson plans, classroom practice, PowerPoints, and curriculum materials for the four course units.

Teacher and student questions

Packet Tracer lab FAQs

Are these actual downloadable Packet Tracer files?

No. This page provides ten original, fully written lab blueprints with configurations, fault injections, verification steps, and teacher notes. It does not include prebuilt .pkt or .pka downloads.

Do students need physical routers or switches?

No. The labs are designed around Cisco Packet Tracer simulation. Schools can add physical hardware later, but it is not required for these activities.

What is the difference between .pkt and .pka?

A .pkt file saves an ordinary Packet Tracer topology. A .pka activity can contain an initial network, instructions, and assessment information authored using Packet Tracer Activity Wizard.

Which lab should a beginner complete first?

Start with the two-PC switched LAN, then DHCP and DNS. These introduce the dependency chain from link to address to name resolution before students troubleshoot VLANs and routing.

Are these official AP Networking exam labs?

No. These are independent classroom exercises designed to practice networking mechanisms and evidence-based reasoning. They are not released exam questions or official scoring materials.

How should teachers grade the labs?

Use the original 20-point rubric on this page: topology and baseline, evidence selection, diagnosis, targeted correction, and verification/explanation, each worth four points.

Can students use different router models?

Yes, but interface names and supported commands vary. Translate example interface labels to the actual device and verify available features before distributing a topology.

How do I keep students from guessing the fault?

Give them a known-good baseline and a separate broken file. Require two competing hypotheses, a discriminating test, and an explanation of why the selected repair fits the evidence.

Can Packet Tracer simulate a real public internet connection?

These labs simulate routed and NAT-connected networks. Documentation IP ranges used in examples represent an outside test network; they are not a live internet connection.

Can I use the labs in a 45-minute class?

The first three fit with a prepared topology. More advanced labs can be split into a build day and an evidence-and-repair day. The capstone is designed for a longer block or two periods.

Browse the complete AP Networking site directory →

Move from these hands-on investigations to the related unit hubs, troubleshooting guides, CLI evidence references, and exam practice pages.