Home Lab for Security Studies: CML and Beyond

By Taylor Thomas · 2026-09-02

The question behind every home-lab plan is not “what should I buy?” but “what does my blueprint require me to touch?” For Cisco security study, most of the answer is software: the routers, switches, and firewalls in a modern security topology exist as virtual machine images, and Cisco Modeling Labs — CML — exists to wire those images into topologies on your own hardware. A good lab plan starts with CML at the center, then names the gaps honestly and fills each one with the cheapest thing that closes it.

What CML Actually Gives You

CML is Cisco’s network simulation platform: it runs virtual builds of Cisco network operating systems as VMs and lets you draw the topology that connects them. The tiering is simple. CML Free includes five nodes plus unmanaged switches and external connectors, and it does not expire — a standing five-node lab for the cost of an account. The paid single-user tiers, Personal and Personal Plus, are licensed for 20 and 40 Cisco nodes respectively, and neither count is expandable.

The image set is the part security candidates should read closely, because it differs by tier. CML Free carries a deliberately reduced set: the lightweight IOL and IOL-L2 router and switch images, ASAv, and host VM images — enough for real routing, switching, and classic firewall labs, and nothing more. A paid license unlocks the full reference-platform catalog: IOSv and IOSv-L2, CSR 1000v and Catalyst 8000V for IOS XE, NX-OS 9000, IOS XRv 9000 (IOL itself arrived in CML 2.7, so older installs lack it). Since CML 2.8, Cisco supplies FMCv and FTDv on a supplemental ISO of VM images — outside CML Free’s reduced set — which makes a Secure Firewall management-center-plus-sensor lab a Cisco-supplied build rather than an improvisation. Beyond the shipped set, additional images for VM-based node types load as .qcow2 files through the UI or with scp (IOL images use their own binary format); a platform CML has never seen first needs a node definition.

Budget Nodes Before You Budget Money

The five-node free tier disciplines your lab design in a useful way: a focused lab rarely needs more. An ASAv, two routers, and two endpoints is five nodes and a complete NAT or VPN study environment. What forces you into a paid tier is breadth — a multi-site VPN topology with redundant firewalls and enough endpoints to make policy interesting.

The quieter constraint is the machine underneath. CML runs on your hardware, and memory is almost always what runs out first: security appliances are far heavier than router images, and management platforms are the heaviest of all. Check the published resource requirements for each image against your machine before you design a topology you cannot boot, and lean on the small-footprint IOL images where a full VM router adds nothing to the lesson.

Naming the Gaps

Three gaps matter for security study. First, identity: ISE is not among CML’s shipped reference platforms, so identity labs typically run ISE as its own VM on a hypervisor beside CML. A fresh ISE install grants a 90-day evaluation license — 100 endpoints, all features enabled — which is enough runway to work through posture, profiling, and 802.1X at study pace; continued use past the evaluation needs an appropriate license. This split is less awkward than it sounds: CML’s external connectors bridge a lab topology to networks outside the simulator, so a CML node whose image supports the needed RADIUS and 802.1X functions can talk to an ISE that lives beside it — verify the chosen switch image’s feature limitations first — and an appropriately configured connector can also give lab devices internet reachability when a scenario needs real DNS or updates.

Second, cloud-delivered products. Umbrella, Duo, and the SSE portfolio have no image to download because they are services; you lab them through trials or, where the current catalog offers one, through Cisco DevNet sandboxes — free environments, some always-on and some reservable, that span Cisco’s portfolios, security included; reservations are booked in a browser, and many reservable labs are reached over a client VPN. Third, physical behavior: anything that depends on switching silicon or real media — PoE, hardware queuing, physical failover cabling — is beyond any simulator. That last gap is the one that inherently requires physical hardware, and for most professional-level study it can stay open.

Build the Lab Your Blueprint Describes

The strongest study labs are built backward from exam topics, not forward from available gear: pick an objective, build the smallest topology that exercises it, break it, repair it, tear it down. A NAT objective needs a firewall, an inside host, and an outside host — build exactly that, then deliberately misorder the rules and watch what the counters and logs tell you. That loop — not lab size — is what compounds, because troubleshooting a lab you broke on purpose is the closest rehearsal there is for troubleshooting a network you did not. It is also the working style the CCIE Security lab eventually demands, so practicing it from the SCOR 350-701 stage forward pays twice: once in the topics you master now, and again in the fluency you carry into every exam after.

Frequently Asked Questions

Is Cisco Modeling Labs free?

There is a free tier. CML Free includes five nodes plus unmanaged switches and external connectors, and it does not expire. The paid single-user tiers raise the ceiling — Personal is licensed for 20 Cisco nodes and Personal Plus for 40 — but neither is expandable beyond its count. Five nodes is enough for a focused protocol lab; a multi-site security topology usually wants a paid tier.

Can I run Cisco security products in CML?

Partly, and the tier matters. ASAv is included on every tier, CML Free included, so classic firewall labs run natively. Since CML 2.8, FMCv and FTDv are supplied on a supplemental ISO of VM images, which is not part of CML Free's reduced set. ISE is not among the shipped reference platforms on any tier — identity labs typically run ISE as its own virtual machine outside CML, where a fresh install grants a 90-day evaluation license supporting 100 endpoints with all features enabled.

Do I need real hardware for CCNP Security study?

For most of the blueprint, no — virtual images cover firewalling, VPN, and policy work well. Real hardware primarily earns its cost for behavior that depends on physical switching silicon or physical media. Many candidates pass with no physical gear at all, using CML for topology work and, for the products CML does not carry, separate virtual machines or free DevNet sandboxes where the catalog offers one.