Documentation

Securedy Labs is a browser-based network topology designer and simulator. Describe a network in plain English, the AI builds it on the canvas, then open a real CLI terminal on any device.

What gets simulated

Securedy Labs is most powerful when you treat it as a hands-on simulator, not just a diagram tool. The AI builds the topology, but the learning happens in the terminal and the Learn tab — where you investigate how devices actually behave.

Workflow that maximises learning

Writing better AI prompts

The more specific your prompt, the more accurate the topology. Vague prompts produce generic results.

Using Learn mode effectively

Learn mode works best when you ask specific questions about your topology, not generic questions. The AI has full context about every device, IP, VLAN, and connection in your current lab.

Building real-world lab scenarios

These prompts build complete, exam-quality topologies you can explore with the terminal:

$ Build a multi-site WAN with HQ and two branch offices connected via MPLS. Use OSPF for routing. HQ has a dual-firewall DMZ with a web server.
$ Create a campus network with a collapsed core/distribution layer using two L3 switches in HSRP, four access switches with VLANs 10, 20, 30, and 40, and a WLC managing 6 access points.
$ Build an enterprise datacenter with a load balancer, web tier (3 servers), app tier (2 servers), and DB tier (1 server). Add a DMZ firewall between the internet and the web tier.
$ Create a small ISP network with a BGP edge router peering with two upstream providers, MPLS in the core, and three customer CE routers.

Challenge strategy

Challenges are designed so you have to find the fault yourself — the symptom description tells you what is broken, not where. Use the terminal to investigate systematically:

Suggested learning paths

The canvas is the main workspace. Devices are nodes, links are edges.

Adding devices

In Architect mode, a vertical palette sits on the left edge. Devices are arranged in three categories — Infrastructure, Endpoints, and Network. Click any icon to drop a device at a default position, or drag to place precisely. Use the search bar at the top of the palette to filter by name (e.g. type sw to see Switch and L3 Switch). Clear the search with the ✕ button. Zoom controls and fit-view sit at the bottom of the palette.

Connecting devices

Hover a device until the connection handles appear (small circles on the edges), then drag from one handle to another device. Duplicate links are rejected automatically.

Selecting and deleting

Click the Select icon in the bottom-left controls to enter rubber-band selection. Draw a box over multiple nodes, then press Delete or Backspace to remove them and their links. Click Pan to return to normal navigation.

Editing a device

Click any device to open the Device Inspector on the right. In Architect mode you can edit the label and IP address, delete the device, or open the CLI terminal via the Open Terminal button.

Architect

Default mode. The AI builds and modifies the topology from your prompts. Manual editing is fully enabled. Three sub-modes control how AI changes land:

Learn

The AI acts as a network instructor. Ask questions about any device or concept — it answers in the context of your specific topology. Each device shows a Learning Note with OSI-layer context. The device palette and edit controls are hidden in this mode.

Type any network design or learning request into the prompt bar and press Enter. The AI uses Claude and can build or modify any topology described in plain English — including large multi-site and continental networks.

File & image attachments

Click the paperclip icon next to the prompt bar to attach files. Supported formats: JPEG, PNG (screenshots, diagrams), PDF, plain text, and Cisco Packet Tracer .pkt files. Maximum 10 MB per file. Attachments are sent to the AI alongside your prompt — paste a screenshot of an existing network diagram and ask the AI to recreate it on the canvas.

$ Build a small office network with a firewall, core switch, two access switches, and 10 workstations. Use 192.168.10.0/24 for the LAN.
$ Add a DMZ with a web server behind the firewall.
$ Replace the core switch with two redundant switches using LACP.
$ Explain what OSPF is doing in this topology.
$ What would happen if the firewall went down?

Securedy Labs can import existing network topologies directly from simulator files. All devices, connections, IP addresses, and interface names are preserved — the topology appears on the canvas exactly as it was built in the source tool.

Importing a Cisco Packet Tracer file (.pkt)

Supported Packet Tracer versions: PT 7, 8, and 9.x (including the latest PT 9.0 format). Both the legacy numeric-index link format and the newer save-ref-id link format are handled automatically.

What gets cleaned up automatically

Packet Tracer's canvas coordinates do not translate to Securedy Labs' viewport, so the import discards PT positions and applies a fresh hierarchical layout instead — the same tier-based arrangement the AI uses when generating topologies from scratch. Power strips, PDUs, and annotation notes are ignored.

More simulators coming soon

Securedy Labs supports multiple AI models from Anthropic and OpenAI. The active model is shown in the bottom-left of the chat input — click it to switch. Your selection is saved and remembered across sessions.

Available models

How to switch models

Inside any lab, the model selector appears in the bottom-left corner of the chat input bar — it shows the current model name (e.g. Claude Sonnet 4.6). Click the dropdown to switch instantly. The change applies to the next message you send. Your selection persists across labs and browser sessions via localStorage.

Which model should I use?

Click any device → Open Terminal. The panel slides up from the bottom of the canvas. Switching to a different device opens a fresh session.

Routers (and firewalls) support a full Cisco IOS configuration mode. Changes persist in the topology and immediately update show command output — just like a real device.

Entering and exiting

Static routes — ip route

Add or remove static routes from global configuration mode. Routes appear immediately in show ip route as S entries and in show running-config.

Router# configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)# ip route 10.10.10.0 255.255.255.0 192.168.1.1
Router(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1 1
Router(config)# end
Router# show ip route
S    10.10.10.0/24 [1/0] via 192.168.1.1
S*   0.0.0.0/0 [1/0] via 10.0.0.1

Routing protocols

High availability — HSRP / VRRP

IPv6

EtherChannel

Management services

Interface configuration

Enter interface config mode to assign IP addresses, set descriptions, and control administrative state. Changes reflect in show ip interface brief.

Interface name abbreviations

Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# no shutdown
%LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to up
Router(config-if)# description WAN uplink to ISP
Router(config-if)# end
Router# show ip interface brief
GigabitEthernet0/1     192.168.1.1      YES  NVRAM  up   up

IOS hardening commands are available in global configuration mode on routers. All settings persist in the topology and appear in show running-config.

Enable password & secret

enable secret uses an MD5 hash and takes precedence over enable passwordwhenever both are set. Always prefer enable secret on real devices.

Password encryption

Line passwords — console & VTY

Use line console 0 to secure direct console access and line vty 0 4 (or 0 15) to secure SSH/Telnet sessions. The prompt changes to hostname(config-line)#.

Full hardening example

Router# configure terminal
Router(config)# enable secret MySecret1
Router(config)# service password-encryption
Router(config)# line console 0
Router(config-line)# password ConsolePw
Router(config-line)# login
Router(config-line)# exit
Router(config)# line vty 0 4
Router(config-line)# password VtyPw
Router(config-line)# login
Router(config-line)# end
Router# show running-config
...
service password-encryption
enable secret 5 $1$mERr$hashed...
...
line console 0
  password 7 04435B0A16
  login
line vty 0 4
  password 7 05120D0B04
  login
  transport input ssh telnet

Simulates a CISCO2911/K9. Routing tables, neighbors, and ARP are derived from the topology graph. All show commands below are available on any router device.

Interfaces & routing

High availability

IPv6

Security & tunnels

WAN

Management

Route codes

The Multilayer Switch (L3 Switch) operates at both Layer 2 and Layer 3 — modelled after the Cisco Catalyst 3650/3850. It runs the same CLI commands as a regular switch for Layer 2 features, plus the full router command set for routing (OSPF, BGP, EIGRP, static routes, HSRP) and the ? help command shows the Router section headings. Use it wherever you need inter-VLAN routing without a separate router.

Simulates a WS-C3750E. VLAN tables, MAC tables, STP state, CDP/LLDP neighbors, and security bindings are derived from the topology.

VLANs & interfaces

Spanning tree

Discovery protocols

EtherChannel

Security

Management & PoE

STP port roles

Interfaces mapped to outside / inside / DMZ zones. ACLs and NAT entries are derived from server neighbors in the topology.

Interfaces & traffic

AAA & authentication

Security levels

Prompt style: hostname:~$. Workstations have fewer open ports than servers.

Networking

Application layer protocols

Management

Three mobile endpoint types are available in the Endpoints category of the device palette. All three share the same Linux shell CLI as Workstations and Servers.

Represents an ISP or internet uplink. Runs BGP. Traceroute injects 2 synthetic ISP hops (198.51.100.x) before internal devices.

Cisco IOS lightweight AP. SSIDs: CORP_WIFI and CORP_WIFI_5G. Connected workstation neighbors appear as wireless clients.

HAProxy-style interface. Backend health reflects topology — devices marked broken show as DOWN.

Wireless LAN Controllers centrally manage Access Points over CAPWAP tunnels. Add a WLC from the canvas palette and connect it to Access Point devices — CAPWAP tunnels, AP registrations, and client tables are all derived from the topology.

Challenges present a broken network topology and ask you to diagnose the fault. Open the terminal on affected devices, run show commands to investigate, and submit your answer.

Available challenges

Diagnostic approach

All CCNA exam protocols and technologies, grouped by category. Each shows whether it is fully simulated via interactive CLI commands in this lab.

Most issues in Securedy Labs are caused by configuration on the canvas or in the terminal — not a bug in the platform. Work through the steps below before reaching out to support.

Can't sign in

How to troubleshoot general issues

Common issues (user-side)

These are the most frequent problems reported by users — all caused by a configuration step being missed rather than a platform fault.

If you've worked through the troubleshooting steps above and still need help, the support team is available by email.

What to include in your message