CCNA lab - Cisco 877 - how to create a simple CCNA lab at home

Setting up a Cisco 877w router from scratch - vlans, dhcp, static route, NAT, access lists...

[patmakhubela]

Its 2023 and this video is still helpful. Thank you so much.

[funknotik]

This is one of the best tutorials I've seen so far, thank you.

[kineticbe]

Thanks a lot.  Exactly what I needed to configure my 871W in a test-environment.  Good job!

[ezekiel]

Thank you for sharing your knowledge and best wishes for you and your career.

[Pete_H]

Great tutorial to help me with my lab set up and modem, thank you.

[xvm.ch.]

Hello
I have set up for cisco 892fsp, everything worked fine, thank you....👍🏽
How can I replace SSH rsa with version 2 ?
with vers. 1 is outdated and no longer works >> ( Protocol major versions differ: 2 vs. 1)

[spraycan]

Great learning video. How do you replace your linksys router with a cisco 871w  router

[RhinoCable]

Thanks for the great video and explanation.

[olajuwonkako]

This is a very great ccna practice video.Thank you very much.
Can you include ipv6, ospf, eigrp in part2 of this video.

[LooZypher]

Do you maybe have an input on how to create a VPN connection so that I can access the LAN from the outside world?

[LooZypher]

I loved this video... just bought myself an 877 router, and I set up just like you showed in the video...
Would it be possible for you to upload a video where you continued from the config and showed how you configured the Wlan to Vlan20?

Thanks man :-D

[jerryjacob]

Nice video, can you show a config using the Wlan port.

[samaboodi]

Hello mkccna,  
thanks for this experience, can you apply VPN on this router and deploy this video on line ... thanks

[micheledellanna]

Dear mkccna thank you very much for sharing your valuable experience!
I tryed configuration explained in this video and everything work fine using fastethernet ports.
I also configured wifi following your other video but I'm confused about how to bind dot11 to vlan 20.
Usig wireless connection I receive ip from dhcp but I can't go outside the lan.

Could you help me to find the mistake, please?

I upload my configuration.

!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Cisco877W
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
!
!
dot11 syslog
!
dot11 ssid TdG.Bussero.Guest
 vlan 20
 authentication open 
 authentication key-management wpa
 mbssid guest-mode
 wpa-psk ascii 0 cisco1234
!
ip source-route
!
!
ip dhcp excluded-address 192.168.50.1 192.168.50.99
ip dhcp excluded-address 192.168.50.151 192.168.50.254
!
ip dhcp pool LAN1
   network 192.168.50.0 255.255.255.0
   default-router 192.168.50.1 
   dns-server 208.67.222.222 
!
ip dhcp pool WLAN1
!
!
ip cef
ip domain name pippo.pluto
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
username admin privilege 15 password 0 cisco1234
! 
!
!
archive
 log config
  hidekeys
!
!
!
bridge irb
!
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
!
interface FastEthernet0
 switchport access vlan 10
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet1
 switchport access vlan 20
 spanning-tree portfast
!
interface FastEthernet2
 switchport access vlan 20
 spanning-tree portfast
!
interface FastEthernet3
 switchport access vlan 20
 spanning-tree portfast
!
interface Dot11Radio0
 no ip address
 !
 encryption vlan 20 mode ciphers aes-ccm tkip 
 !
 ssid TdG.Bussero.Guest
 !
 mbssid
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
!
interface Dot11Radio0.1
 encapsulation dot1Q 20 native
 bridge-group 20
 bridge-group 20 subscriber-loop-control
 bridge-group 20 spanning-disabled
 bridge-group 20 block-unknown-source
 no bridge-group 20 source-learning
 no bridge-group 20 unicast-flooding
!
interface Vlan1
 no ip address
!
interface Vlan10
 description SVI for WAN
 ip address dhcp
 ip nat outside
 ip virtual-reassembly
!
interface Vlan20
 description SVI for LAN - default gateway
 no ip address
 ip nat inside
 ip virtual-reassembly
 bridge-group 20
 bridge-group 20 spanning-disabled
!
interface BVI20
 ip address 192.168.50.1 255.255.255.0
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.1.254
no ip http server
no ip http secure-server
!
!
ip nat inside source list NAT-ACL interface Vlan10 overload
!
ip access-list extended NAT-ACL
 permit ip 192.168.50.0 0.0.0.255 any
 remark ACL for NAT
!
!
!
!
!
!
control-plane
!
bridge 20 route ip
!
line con 0
 logging synchronous
 no modem enable
line aux 0
line vty 0 4
 login local
 transport input ssh
!
scheduler max-task-time 5000
end


Thank you in advance!

[herousall]

Thanks very helpful post. I receive a private ip address 192.168.0.6 from the DHCP for vlan 10. And my computer couldn't get connected to the internet because I'ts on the 192.168.50.1 network. How can I fix it. By the way I have  871 router

Thanks

[selimzairi]

Hi,  
Many thanks and regards for this interesting real lab and demonstration 
you video was very help full would you like pleased explain how to do it if the two router are connected to WAN the first router is linksys router with dynamic ip address and local ip address 192.168.1.1, DHCP SERVER 192.168.1.11-50 SERVER MAPED TO 192.168.1.253 (SERVER IP) on remote desktop 3389 
the 877 is static ip 1.2.3.4 on dialer0 interface 
and i can use the two router to access the server on the address 192.168.1.253
and i can use one router to access the server
i want to use the router 877 to access the server with RD ONLY i do not want to use it as dhcp server or to distribute any ip to the local clients or to deal with them only to be available for server 192.168.1.253

[joaquinluceromusic]

2012 BUT still relevant to an idiot tech like me. lol

[phusarproduction]

hi, great video. Please can you give me your email address. With your steps everything was working but when i ping with the source vlan, it keep timing out. Could you please help me. When i ping 4.2.2.2 only it work but to ping with source vlan it does not work. thanks. my name is Kwasi

[joedarvish]

Hard to read what you are typing. Have you tried to look at your video?

[garychap]

Oh god no!

Your home router is going to end up set up very predictably configured and rarely messed with... it's basically going to be NAPT and DHCP. Certainly no routing protocols, no serial or other point-to-point, in fact almost NONE of the cisco syllabus.

So, what should you do instead ?

First, consider getting GNS3 if your PC has enough grunt for it. This will allow you to start up many virtual routers each running actual IOS images. It will let you run some very complex lab setups until you're happy you can configure *and troubleshoot* them. If you have a study buddy, you can take turns setting up (and introducing errors into) each others setups. Remember! Configuring is the easy part ... but figuring out what's gone wrong using show and debug commands is going to be 90% of your job.

And THAT is where you need the bulk of your experience to be. Not memorising basic configs, but understanding WTF is going on when shit don't work - using diagnostics and a fair understanding of what you SHOULD be seeing.

But unfortunately GNS3 doesn't do everything!

So, if you have the space and want to buy equipment (definitely if you're planning to move on to CCNP at any point) ... then cheap 'previous generation' ISR routers that take HWIC/EHWICs are *essential* Something like second-hand 2600's and certainly nothing bigger than 2901's ... Modularity is going to be important as later you can add WIC-2T's or a 16A very cheaply for point-to-point configs.

Why go for hardware? Because it will introduce a lot of practical issues you don't get under GNS3 ... you'll be installing/uninstalling modules regularly... you can mess with things that just don't work realistically under simulation. You can plug in Wireshark and get a real good packet view of an actual, disorderly, non-ideal, setup. You'll be forced to deal with IOS changes, Memory swapping, Flash, The odd loose or noisy cable, making patches ... Most importantly - it makes this stuff 'real' to you.

It's like muscle memory ... you need to be super comfortable with the practicalities and the kind of weird shit that only ever goes wrong in real life.

Later, you can sell it all ... that's the great thing about second hand gear, it won't depreciate anywhere near as much as new kit. Expect to only get about half of the cost back if you sell after 24 months on 2900 series gear (And 2600 gear is already so cheap it's almost worth it's own scrap value!) But, in that time, you'll be config'ing like a daemon and will have developed a hands-on troubleshooting confidence your classmates simply won't have.

Real kit is absolutely invaluable!

But, if you expect to learn on your own gateway, forget it. That's like expecting to learn how to build houses by living in one.


Source: I'm a home-lab owner who's confidently passed his CCIE Theory, and is now prepping to sit the practical.

(If you're in Lancashire, UK and need un-rushed rack time to practice - hit me up for free access)