CCBOOTCAMP s CCIE Routing & Switching Lab Workbook

Transcription

1 A CCBOOTCAMP s CCIE Routing & Switching Lab Workbook sales@ccbootcamp.com Toll Free : (877) NLI-CCIE ( ) Int: +1 (702) WebSite : Version 12.4 Volume 3 (Labs 11-15)

2 For questions and support please visit: CCBOOTCAMP s CCIE R&S Advanced Lab Workbook Vol 3 Labs Version 12.4 Network Learning, Inc. 375 N. Stephanie Street Buildeing 21, Suite 2111 Henderson, NV PH# "Cisco" the "Cisco Logo," "CCNA," "CCNP," "CCDP," "CCDA," "CCIE," "Cisco Certified Network Associate," "Cisco Certified Design Professional," "Cisco Certified Design Associate," and "Cisco Certified Network Professional" are registered trademarks of Cisco Systems, Inc. The contents contained wherein, is not associated with or endorsed by Cisco Systems, Inc. NLI's Advanced Cisco CCIE Security Technology Workbook Network Learning Inc. Report unauthorized copies to: sales@ccbootcamp.com

3 License Agreement: PLEASE READ THIS SUBSCRIPTION LICENSE AGREEMENT CAREFULLY BEFORE USING THIS PRODUCT. THIS SUBSCRIPTION LICENSE AGREEMENT APPLIES TO NLI s Advanced Cisco CCIE R&S Lab Workbook Vol3. BY ORDERING THIS PRODUCT YOU ARE CONSENTING TO BE BOUND BY THIS LICENSING AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS LICENSE, THEN DO NOT PURCHASE THIS PRODUCT. License Agreement: NLI s CCIE R&S Practice Lab material is copyrighted. In addition, this product is at all times the property of Network Learning, Inc., and the customer shall agree to use this product only for themselves, the licensed user. The license for the specific customer remains valid from the purchase date until they pass their CCIE R&S lab exam. NLI s CCIE R&S Practice Lab materials are licensed by individual customer. Our material can't be resold, transferred, traded, sold, or have the price shared in any way. Each specific individual customer must have a license to use this product. The customer agrees that this product is always the property of Network Learning, Inc. and they are just purchasing a license to use it. A Customer s license will be revoked if they violate this licensing agreement in any way. Copies of this material in any from or fashion are strictly prohibited. If for any reason a licensed copy of this material is lost or damaged a new copy of the will be provided free of charge, except for the cost of shipping and handling. Individuals or entities that knowingly violate the terms of this licensing agreement may be subject to punitive damages that Network Learning, Inc. could seek in civil court. Damages will be limited to a maximum of $500, per individual and $2,000, per entity. In addition, individuals or entities that knowingly violate the terms of this license agreement may be subject to criminal penalties as are allowed by law. The venue of any dispute, controversy, litigation or proceeding (formal or informal) arising out of or pertaining to this licensing agreement or the subject hereof shall lie exclusively in the County of Clark, State of Nevada. Provided, however, that if any such dispute, controversy, litigation or proceeding requires or permits jurisdiction in a federal court or agency of the United States, then venue shall lie in no federal court or agency other than those located in (or nearest to) the County of Clark, State of Nevada.!" #$

4 Term and Termination of License Agreement: This License is effective until terminated. Customer may terminate this License at any time by destroying all copies of written and electronic material of said product. Customer's rights under this License will terminate immediately without notice from Network Learning, Inc. if Customer fails to comply with any provision of this License. Upon termination, Customer must destroy all copies of material in its possession or control. The license for the specific user remains valid from the purchase date until the user passes their lab exam pertaining to the purchased subscription. Once the customer passes the relevant lab exam the license is terminated and all material written or electronic in their possession or control must be destroyed or returned to Network Learning Inc. Warranty: No warranty of any kind is provided with this product. There are no guarantees that the use of this product will help a customer pass any exams, tests, or certifications, or enhance their knowledge in any way. The product is provided on an AS IS basis. In no event will Network Learning, Inc., its suppliers, or licensed resellers be liable for any incurred costs, lost revenue, lost profit, lost data, or any other damages regardless of the theory of liability arising out of use or inability to use this product.!" #$

5 Introduction to NLI's Advanced Cisco CCIE R&S Lab Workbook Volume 3 Version At a minimum all students attempting our labs should have passed the written CCIE exam and be confident with their Cisco IOS skills and experience. If this is your first attempt at working with complicated routing scenarios you may find these labs very difficult in the beginning. However, with practice and hard work you will gain the necessary skills to work through these labs. If getting your CCIE were easy then everyone would have one. 2. During your first attempt our labs try not to look at the provided router configurations unless you are completely stuck. Practice using the Cisco Online Docs that will be available when you take the lab exam. We recommend that if you have the time, you run through these labs at least two times before your lab exam. You need to get very quick at configuring the core technologies so you can have extra time to work on your weak areas or technologies you have never seen before. During your lab exam double check your work on the tasks you understand. Little or no partial credit is given on individual tasks. Make sure you get the points for the tasks you understand as you can only give up 20 points. If you don t understand a question or suspect hardware problems don t waste time and immediately talk to your proctor. 3. Please read all material NLI has sent you before you start. Please read all the material on before you start. This will save you time and help you prepare for exam day. When the big day comes and you take the CCIE lab exam for real we recommend that you read the whole lab before you start. Twenty minutes spent up front can pay high dividends in a high-pressure lab exam. 4. Go to for support on our R&S lab workbooks. 5. Configuration files, diagrams, and updates for our labs are always posted at Check back to our web site on a regular basis as we are always in a constant state of change. By purchasing NLI's Advanced Cisco CCIE R&S Lab Workbook Volume 3, you are agreeing to our licensing policy. Network Learning Inc. reserves the right to update this policy at any time.!" #$

6 NLI's Advanced Cisco CCIE R&S Lab Workbook Volume 3 is licensed by individual user. It can't be resold or have the price shared in any way. We have invested a significant amount of time and money into developing these labs. Your license may be revoked if you illegally sell or share the information in NLI's Advanced Cisco CCIE R&S Lab Workbook Volume 3. It is also illegal to reproduce this material in any electronic format. NLI's Advanced Cisco CCIE R&S Lab Workbook Volume 3 "Cisco" the "Cisco Logo," "CCNA," "CCNP," "CCDP," "CCDA," "CCIE," "Cisco Certified Network Associate," "Cisco Certified Design Professional," "Cisco Certified Design Associate," and "Cisco Certified Network Professional" are registered trademarks of Cisco Systems, Inc. The contents contained wherein, is not associated with or endorsed by Cisco Systems, Inc. Brad Ellis Brad Ellis President Network Learning, Inc. Copyright Network Learning, Inc. 2006!" #$

7 NLI s Advanced Cisco CCIE R&S Lab Workbook Vol 3 Lab#11

8 Network Learning, Inc. R&S CCIE Practice Lab 11 Initial Configurations We recommend that you start all configurations from scratch, but you can use the preconfiguration files to apply proper IP addresses and to name the routers. All serial interfaces should have a clockrate of Frame Relay and Serial connections 1.1 Configure 4 point-to-point frame-relay connections R1-R3, R1-R5, R1-R6 and R6-R8. 3 points 1.2 Configure a back-to-back serial connection between R3 and R4. Make sure R4 ignores the DCD signal on the Serial interface. Catalyst 3550 Configuration Catalyst 3550 Switch Port Assignment Device Cat Port Number VLAN R1 F0/0 1 0/1 10 R2 F0/0 1 0/2 123 R3 F0/0 1 0/3 123 R4 F0/0 1 0/4 40 R5 F0/0 1 0/5 50 R6 F0/0 1 0/6 60 R8 F0/0 1 0/ Name Cat1 and Cat 2 cat3550-x where X is the catalysts number. 2.2 Configure VLANs on cat using the VLAN numbers as shown on the diagram. For example, use VLAN 10 for the connection to router R1.!""#$ % &

9 2.3 Name all of the VLANs that you create on the Catalyst 3550, VLAN 10 should be named V10, VLAN 123 should be named V123, etc 2.4 Set the VTP domain name to lab11 with a password of ccie 2.5 Cat and cat are connected to each other by ports 0/19, 0/20, 0/21, 0/22. Bundle these ports together as an 802.1Q trunk. 3 points 2.6 Configure cat so its dynamically learned mac-address for VLAN 40 time out after 17 minutes. 3 points OSPF and EIGRP 3.1 Configure R6 and R8 for OSPF. Put R6's LAN interface and and the connection between R6 and R8 in Area 0. Put Loopback0 and FastEthernet0/0 on R8 in Area 1 summarizing them into one route. 4 points 3.2 Configure R1, R5 and R6's connection to R1 in Area Without using Tunnels or OSPF Virtual Links, configure R3's Serial 0/0/1 and R4 in Area 0 making sure all OSPF networks are reachable from all OSPF routers. 6 points 3.4 Change the OSPF hello interval between routers R3 and R4 to 32 seconds. 3.5 Pretend router R1 has an OSPF neighbor on its LAN connection. Make sure R1 is never elected as a Designated Router.!""#$ % &

10 3.6 Enable the least CPU demanding authentication between R3 and R4. Use cisco as the password. 3.7 Make sure that R3's OSPF cost to /24 and the summary route advertised by R8 is dependent on the OSPF cost of R1's connection to R6. 3 points 3.8 Add Loopback 0 interfaces specified on the diagram to routers R5 and R6. Enable EIGRP on the Loopback interfaces and exchange EIGRP routes in a manner such that all of the other routers besides R5 and R6 in your network have no knowledge of EIGRP or the networks associated with them. 4 points Additional IP Routing Protocol Configuration 4.1 Add a default route from R2 to R3 s interface F0/0. 1 point 4.2 Configure router R3 such that router R2 can ping all of the IP addresses on R4. You are not allowed to use any static routes, default routes, redistribution, or default-information commands to accomplish this. The ping will only work if it is sourced from R2. 4 points 4.3 Configure a means of backup for connectivity between routers R6 and R8. The backup connection should not be used unless there is a problem connecting via the serial interfaces between router R6 and router R8. Make sure you still follow the constraints of section 3.1 above regarding summarization of the subnets. 4 points IPv6 5.1 On one of R1's S0/0/0.2 or S0/0/0.3 interfaces, block protocol 41 and on the other block protocol 47. Make sure this doesn't impact anything else in the lab. 5.2!""#$ % &

11 Configure the following IPv6 addresses on R4, R5 and R8: R4's Fast0/0 2001:4:4:4::1/64 R5's Fast0/0 2001:5:5:5::1/64 R8's Fast0/0 2001:8:8:8::1/64 Only R4, R5 and R8 are allowed to route IPv Configure RIPng between R4, R5 and R8 and make sure you can ping the IPv6 LAN address between the three of them. 3 points 5.4 Configure filtering on R4 and R8 (using the same Prefix-List) to make sure they recieve RIPng to the LAN interfaces only. 3 points 5.5 Configure R4 and R8 to generate a default IPv6 route with a metric of 6 and advertise it to R Make sure R5 doesn't load-balance on the two default routes from R4 and R8. BGP Configuration 6.1 Configure R1, R5, and R6 in AS 156. R5 and R6 can only have 1 neighbor statement for this step. 3 point 6.2 On R1 configure Loopback 1 with the IP address of /27 and Loopback 2 with the IP address of / Advertise the two new Loopbacks created on R1 into BGP. Configure R1 in such a way that R6 only sees a summary address for the two Loopbacks. However, R5 should see the more specific routes and not the summary address. 4 points!""#$ % &

12 6.4 Put R3 into BGP AS 300. Neighbor AS 300 with AS 156 using R3 and R On R5 only allow AS 300 to see the /27 network without using any outbound access-lists, prefix-lists, or route-maps. R5 should still see both routes in its BGP table. 4 points NTP Configuration 7.1 Now configure NTP with authentication on router R5 and R6 with router R5 being the time server. Configure such that router R6 has a stratum level of 5. Use the password time for your authentication. 3 points 7.2 Ensure that the correct time zone is set on both routers as well as Daylight Savings Time. 7.3 R5 should send all NTP packets source from its Loopback 0 interface. 1 point 1 point Auto Installation Configuration 8.1 Configure another sub-interface on R1 with the IP address of / We have the configuration file on our TFTP server located at /16 for a new router we are going to hook up on the other side of the new frame relay link. Make sure that the new router will be able to automatically receive its configuration from the TFTP server. 4 points Miscellaneous Configuration 9.1!""#$ % &

13 Configure R4 so that its FastEthernet0/0 interface will be redirected to a Cache Engine located on VLAN 40 if they are trying to reach http port 80. If we apply an outbound access-list on this interface, make sure the router check it to make sure redirected traffic is permitted before forwarding. 3 points 9.2 Configure R5 s FastEthernet0/0 to block all outbound FTP traffic from 9am to 5pm Monday through Friday. All other traffic should be allowed. 4 points You have completed lab 11. Compare your configurations to the ones we provided. Often there is more than one way to complete a task so your configurations may be different than ours. If your configurations are different than ours make sure you understand how to complete the lab with our configurations too.!""#$ % &

14 Lab 11 Initial Setup This is the setup that is contained in the pre-configured files which are named lab11_rx_init.txt. Each router has its own pre-configuration file, for example lab11_r1_init.txt is the initial pre-configuration file for Router 1. Pre-configuration Explanation The pre-configuration files are simply adding IP addresses to the interfaces and naming the routers. You do not have to use the pre-configuration files, you can type in the IP addresses and hostnames yourself if you prefer. Frame Relay and Serial Connections 1.1 Configure 4 point-to-point frame-relay connections R1-R3, R1-R5, R1-R6 and R6-R8. General Frame Relay Configuration These are steps that you should follow on every Serial interface that is going to communicate with the frame switch. Frame Relay Encapsulation The first step is to indicate that we are going to run the frame relay encapsulation. This is done under the physical interface. interface Serial X encapsulation frame-relay Frame Relay Inverse ARP By default inverse ARP is on when frame relay encapsulation is used. This lab, as well as the other labs in the book, specify that you are not allowed to use inverse ARP for your frame relay connections. Turning off inverse ARP stops the router from automatically learning about the DLCIs configured on the frame relay switch. There are two commands we will use to stop both the sending, and answering, of ARP requests. These commands should be issued on the physical interface, as well as any multipoint sub-interfaces. interface Serial X no arp frame-relay no frame-relay inverse-arp The no frame-relay inverse-arp command stops the router from sending out ARP requests to the frame relay switch. The no arp frame-relay command stops the router from answering ARP requests. Once inverse ARP has been turned off we must statically set which DLCI s our routers frame relay interfaces are going to use. For physical interfaces, and multipoint sub- 1

15 interfaces, we will use frame-relay map commands. For point-to-point sub-interfaces we will use frame-relay interface-dlci commands. Frame Relay Map Statements The frame-relay map command maps the layer 3 IP address to the layer 2 DLCI. This is needed for the physical and multipoint sub-interfaces since they can have multiple DLCIs and multiple destinations. Without the static mapping the router wouldn t know which DLCI to send a packet out. For example: interface Serial X frame-relay map ip broadcast In this example we are mapping the IP address to DCLI 102. When the interface tries to send a packet that has the next hop, or destination, of it will forward it using DLCI 102. The broadcast statement is needed at the end of command; if it is not included no routing protocol information will be passed. This is especially important when using OSPF. Once you map a protocol using a frame-relay map statement, all other protocols must be statically mapped to the appropriate DLCI. If you do not map a protocol, it will not reach its destination. The router will not know which DLCI to send the given protocol out. Frame Relay Interface-dlci Command The frame-relay interface-dlci command is only used on point-to-point sub-interfaces. Pointto-point sub-interfaces have a single reachable destination. Since they have only one possible destination, any packet going out the point-to-point frame relay interface will be sent using the single configured DLCI. For example: interface Serial X frame-relay interface-dlci 102 In this example any packets being sent out the interface will use DLCI 102. There is no need for the broadcast statement on a point-to-point interface. Unlike physical or multipoint sub-interfaces, all traffic types will be sent out using the configured DLCI automatically. Frame Relay Sub-interfaces As already mentioned, there are two types of frame relay sub-interfaces: multipoint and point-to-point. In order to configure either of these sub-interfaces, the physical interface must be configured with the frame relay encapsulation, and for lab purposes, should have inverse ARP turned off. The sub-interface will receive the layer 3 addressing, the physical interface will have no layer 3 addressing applied. Inverse ARP should be turned off on multipoint sub-interfaces. You do not need to turn off inverse ARP on point-to-point sub-interfaces. If you make a mistake and accidentally set the sub-interface incorrectly, that is make it point-to-point when it should have been multipoint or vise-versa, you will have to do two things. 1) You will have to delete the sub-interface no interface Serial X.1 2

16 2) You are going to have to reload the router. It ghosts the sub-interface in memory and will not allow you to change it until you reload. Don t forget to save your configuration before reloading. Step By Step Solution: We will start the configuration on R1. First on R1 we will set the encapsulation type and turn of the inverse ARP on Serial 0/0/0. interface Serial0/0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp Next we will create the Point-to-Point sub-interfaces on R1, one for each of the three different subnets that we have. The first one will be for the /16 network going to R5. We will apply the appropriate IP address and use the interface-dlci command to specify the local DLCI supplied to us in the diagram. interface Serial0/0/0.1 point-to-point ip address frame-relay interface-dlci 105 We will then create the Point-to-Point sub-interface on R1 for the /16 network going to R3. We will apply the IP address and specify the local DLCI. interface Serial0/0/0.2 point-to-point ip address frame-relay interface-dlci 103 Finally on R1 we will create the Point-to-Point sub-interface on R1 for the /16 network going to R6. We will again apply the IP address and specify the local DLCI. interface Serial0/0/0.3 point-to-point ip address frame-relay interface-dlci 107 Next we will go to R3 and configure the Physical Serial 0/0/1 interface with the Frame Relay encapsulation and turn off Inverse ARP. interface Serial0/0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp We will then create the Point-to-Point sub-interface on R3 for the /16 network, apply the IP address, and configure the local DLCI. interface Serial0/0/0.1 point-to-point ip address frame-relay interface-dlci 301 3

17 Next we will go to R5 and configure the Physical Serial 0/0/1 interface with the Frame Relay encapsulation and turn off Inverse ARP. interface Serial0/0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp We will then create the Point-to-Point sub-interface on R5 for the /16 network, apply the IP address, and configure the local DLCI. interface Serial0/0/0.1 point-to-point ip address frame-relay interface-dlci 501 Finally we will go to R6 and configure the Physical Serial 0/0/1 interface with the Frame Relay encapsulation and turn off Inverse ARP. interface Serial0/0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp We will then create the Point-to-Point sub-interface on R6 for the /16 network, apply the IP address, and configure the local DLCI. interface Serial0/0/0.1 point-to-point ip address frame-relay interface-dlci 701 The same applies for the point-to-point connection between R6 and R8 and we have chosen Serial0/0/0.68 in the final configurations. On R6: interface Serial0/0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp interface Serial0/0/0.68 point-to-point ip address frame-relay interface-dlci 608 On R8: interface Serial0/0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp interface Serial0/0/0.68 point-to-point ip address frame-relay interface-dlci 806 4

18 1.2 Configure a back-to-back serial connection between R3 and R4. Make sure R4 ignores the DCD signal on the Serial interface. The direct link between R3 and R4. This links uses the default encapsulation type, which is HDLC, a Cisco proprietary version of HDLC. When building this type of link there is one key command to activate the link. This command is clockrate xxxxxxx. The xxxxxxx is any legal speed setting. This command is required on the DCE side of the link. The DCE side of the link can be determined by looking at the detailed configuration of the serial controller. The command show controllers Serial 0/0/1 will give this information. Here is the output from that command which was run on R4. Lab11R4#sh controller Serial 0/0/1 HD unit 1, idb = 0x2A4C34, driver structure at 0x2AC1F0 buffer size 1524 HD unit 1, V.35 DCE cable, clockrate cpb = 0xE2, eda = 0x30B4, cda = 0x30C8 We have underlined and emphasized the portion, which identifies the cable type. Here the Serial 0/0/1 interface of R4 is a DCE interface; therefore the clockrate command is required. In this lab we are instructed that all serial links should have a clock rate of R3 s Serial 0/0/1 needs the clockrate command applied. To ignore the DCD signal, we will configure the command ignore dcd on R4's Serial0/0/1 interface which was introduced in 12.3(2)T. The lab diagram does specify which links are DCE and which are DTE, and if you have physical access to the rack, you can look at the serial cables, they will have their ends marked either DCE or DTE. However, knowing how to find out which end is the DCE, without being told on the diagram, or having access to the rack, is important. Catalyst 3550 Configuration This set of tasks will configure the VLANS on our switches. Our two switches will be hooked together over an ISL trunk with one acting as the server and the other as the client. This section is worth 14 points, and there are no initial configurations for the switches. 2.1 Switch Naming Name Cat1 and Cat 2 cat3550-x where X is the catalysts number. This step is straight forward. We are going to name our two switches appropriately. The Catalyst 3550 s use the same IOS as the Cisco routers so the naming command on the switch is the same as on the router. On CAT1 we will issue the command Switch(config)#hostname cat cat3550-1# On CAT2 we will issue the command 5

19 Switch(config)#hostname cat cat3550-2# We will refer to the switches by their hostnames for the remainder of the lab. 2.2 and 2.3 VLAN Creation and Naming Configure VLANS on cat using the VLAN numbers as shown on the diagram. For example, use VLAN 10 for the connection to router R1. Name all of the VLANS that you create on the Catalyst 3550, VLAN 10 should be named V10, VLAN 123 should be named V123, etc... These two steps should be completed together to avoid going back and redoing your configurations. In these steps we are going to create our VLANS on cat The catalyst 3550 switches use a vlan database to create and modify VLANS, as well as modify most of the VTP information. We are told to create the VLANS on cat3550-1, this statements means that will be our VTP server since you cannot create VLANS on a VTP client. After our VLANS are created, following the chart on the lab, we will apply them to the appropriate interfaces. Step By Step Solution 1) The first thing we do is enter the vlan database. We do this under enable mode, NOT under config mode. cat3550-1#vlan database cat3550-1(vlan)# 2) The default VTP mode is server so we don t have to change anything. 3) We will create and name the VLANS according to the chart and section 2.c. cat3550-1(vlan)#vlan 10 name V10 VLAN 10 added: Name: V10 cat3550-1(vlan)#vlan 123 name V123 VLAN 123 added: Name: V123 cat3550-1(vlan)#vlan 40 name V40 VLAN 40 added: Name: V40 cat3550-1(vlan)#vlan 50 name V50 VLAN 50 added: Name: V50 cat3550-1(vlan)#vlan 60 name V60 VLAN 60 added: Name: V60 cat3550-1(vlan)#vlan 80 name V80 VLAN 80 added: Name: V80 6

20 4) After we have created all of the VLANS we need to apply our changes to the vlan database. cat3550-1(vlan)#apply APPLY completed. We could also exit the vlan database and it will automatically apply the changes. 5) Now we must apply the VLANS to the correct interfaces as shown on the chart. By default an interface on the switch is in auto mode, it can be either an access port or a trunk port. Since we are applying a VLAN to the interfaces we are also going to statically set them as access ports. interface FastFastEthernet0/0/1 switchport access vlan 10 switchport mode access interface FastFastEthernet0/0/2 switchport access vlan 123 switchport mode access interface FastFastEthernet0/0/3 switchport access vlan 123 switchport mode access interface FastFastEthernet0/0/4 switchport access vlan 40 switchport mode access interface FastFastEthernet0/0/5 switchport access vlan 50 switchport mode access interface FastFastEthernet0/0/6 switchport access vlan 60 switchport mode access 2.4 VTP Naming interface FastFastEthernet0/0/8 switchport access vlan 80 switchport mode access Set the VTP domain name to lab11 with a password of ccie 7

21 For this step we are going to go back into the vlan database. We are going to set the VTP domain name to lab11. vtp domain lab11 Then we are going to set up some security. All switches in the VTP domain must share the same password. If a switch does not have the password configured it will not receive the VLANS. vtp password ccie 2.5 Etherchannel Creation Cat and cat are connected to each other by ports 0/19, 0/20, 0/21, 0/22. Bundle these ports together as an 802.1Q trunk. In this step we are told that we should create an 802.1Q trunk on ports 0/19 0/22. We are also told that we should bundle these ports together. We are going to accomplish this with the use of an Etherchannel. The Etherchannel allows us to bundle together a group of interfaces that are configured identically, and to have that group of interfaces act as a single link. This allows us to increase the bandwidth used between devices. Before we create the Etherchannel we need to configure the vlan database on cat so the VTP mode and password are set. cat3550-2#vlan database cat3550-2(vlan)#vtp client Setting device to VTP CLIENT mode. cat3550-2(vlan)#vtp password ccie Setting device VLAN database password to ccie. The next steps will be the same for both cat and cat We will set ports 0/19 0/22 as trunking with the ISL encapsulation. We will then specify that they are all in channel-group 1 with the mode as desirable. Setting the mode as desirable allows the ports to auto-negotiate the creation of the Etherchannel. Step By Step Solution 1) We will use the interface range command to configure ports 0/19 to 0/22 simultaneously. interface range fa0/19 22 switchport trunk encapsulation dot1q switchport mode trunk channel-group 1 mode desirable 2) This will automatically create the interface port-channel 1. This interface will inherit the settings of the ports it is bundling together. The port-channel 1 interface should look like this. interface Port-channel1 switchport trunk encapsulation dot1q switchport mode trunk no ip address 8

22 3) Now if we enter the show interface trunk command on cat or cat we will see that the port-channel 1 is trunking, we will not see the 4 individual interfaces acting as trunks. The 4 individual interfaces have been combined into one virtual interface, the port-channel 1 interface. It is the virtual interface that is acting as the trunk. The output from the show interface trunk on the cat should look like this. Port Mode Encapsulation Status Native vlan Po1 on 802.1q trunking 1 Port Vlans allowed on trunk Po Port Vlans allowed and active in management domain Po1 1,10,40,50,60,80,123 Port Vlans in spanning tree forwarding state and not pruned Po1 1,10,40,50,60,80, Mac-address Aging Timer Configure cat so it s dynamically learned mac-address for VLAN 40 time out after 17 minutes. By default the length of time that a dynamic entry remains in the MAC address table after the entry is used or updated is 300 seconds (5 minutes). We want to change this default for VLAN 40 so the entries are timed out after 17 minutes (1020 seconds). This is accomplished globally. mac-address-table aging-time 1020 vlan 40 OSPF and EIGRP 3.1 Configure R6 and R8 for OSPF. Put R6's LAN interface and and the connection between R6 and R8 in Area 0. Put Loopback0 and FastEthernet0/0 on R8 in Area 1 summarizing them into one route. In this section we are going to configure Area 0 on the Serial interface between R6 and R8. We are also going to configure OSPF Area 1 on R8 s FastEthernet and Loopback interface. After we have R8 s FastEthernet and Loopback interface advertised in OSPF Area 1 we are going to summarize the two addresses together. General OSPF Configuration One highly recommended command you add under your OSPF configuration is the router-id command. By default OSPF will pick the highest Loopback, and if there isn t a Loopback present, it will pick the highest active interface address. Virtual Links are created using the OSPF router IDs, and when you issue the show ip ospf neighbors command you are seeing the router IDs of your neighbors. 9

23 The router ID that you set can be the current Loopback, or it can be an IP address that doesn t even exist in your network. The router ID is only how the other OSPF routers see each other. Statically setting the router IDs can make it easier to manage your OSPF network, as well as saving problems with your Virtual Link configuration. If your Virtual Link is set up between two routers, and both routers are using the current Loopback as the OSPF router ID. What would happen if you added a higher IP address Loopback to one of the routers? Nothing would happen right away, but if the router was reloaded, or the OSPF process cleared, when that router comes back up its OSPF router ID would be changed to the new, higher, Loopback and the Virtual Link would no longer work. If the router IDs are statically set, it won t matter how many Loopbacks you add, or what the IP addresses of the Loopbacks are. The OSPF router ID will never change. Step By Step Solution We will start the configuration by setting up OSPF Area 0, move on to OSPF Area 1, and finally tackle the summarization. 1) On R6, configure OSPF, set your router ID, and advertise the Serial 0/0/0 network as part of area 0. router ospf 10 router-id network area 0 2) On R8, configure OSPF, set your router ID, and advertise the Serial 0/0/0 network as part of area 0. router ospf 10 router-id network area 0 We can verify that OSPF has neighbored up across the Serial interface between R6 and R8 by issuing the show ip ospf neighbor command on R6. Lab11R6#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface FULL/ - 00:00: Serial0/0/0 3) It isn t very clear on this next part, but it wants us to set up the rest of the OSPF areas now. We cannot do the summarization of R8 s Loopback 0 and FastEthernet0/0 networks unless they are advertised into OSPF. By looking at the diagram we can see that R8 s Loopback 0 and FastEthernet0/0 networks will be advertised into OSPF area 1. router ospf 10 network area 1 network area 1 4) We are then going to summarize the two OSPF area 1 networks. We can summarize in OSPF two different ways. We can either use the area range command, or the summary-address command. The area range command is 10

24 used to summarize OSPF areas, and the summary-address is used to summarize external routes. In our case we are summarizing area 1 so we will use the area range command. First we have to figure out what summary address will include the /27 and /27 networks as closely as possible. We want to try and be exact in our summarization so we don t include extra networks that we may not own. We must find out how many bits are common between the two networks. The first 2 octets match, so it s the third octet we will look at: In our third octet we have 4 common bits from the left. This will give us a mask in the third octet of 240 ( ) and we will start with the 16 network. We start with the 16 network since it is on, has a one, in the bits we care about. We would add all of the bits that had a one together, in the bits that matched, to figure out our starting network. In this case only the 16 bit is on, meaning it has a one. router ospf 10 area 1 range This summary will include the networks through which is as close as we can get. 3.2 Configure R1, R5 and R6's connection to R1 in Area 1. Now that we're asked to configure another Area 1 on the other side of the backbone, we usually plan to configure an OSPF Virtual Link or a Tunnel. In the actual Lab exam it's recommended that you read the whole Lab before proceeding with any configurations, well, this is one of the cases why you should. In the next question we will be instructed not to use OSPF Virtual links or Tunnels. Not only that, but we will be expected to configure another Area 0 between R3 and R4. Technically, it's impossible to have Area 0 split in half without a direct connection. This is why we will consider these two Backbones as if they were in separate domains. The fact that we are not allowed to use virtual links will restrict our choice of where to split the OSPF domain in half. Let's take a look at one ABR at a time and see which ones are candidates to become the splitting point. R8 (ABR between Area 0 and Area 1) is not possible because this will leave the rest of the OSPF domain forming an Backbone area split in half. 11

25 R3 (ABR between Area 0 and Area 1) is not possible because this will leave the rest of the OSPF domain forming an Area 1 split by a backbone area which will require an OSPF Virtual link. This leaves us only R6 as an option and it would work because it will split the network in two OSPF domains (1 and 10) each having one Backbone and one Area 1. Below is the configuration needed for R1 and R5 and after that we will proceed with R6. Because all the interfaces on R1 are going to be in the same OSPF domain and Area, we will simply use in the network statement. R1 router ospf 1 router-id log-adjacency-changes network area 1 R5 router ospf 1 router-id log-adjacency-changes network area 1 network area Without using Tunnels or OSPF Virtual Links, configure R3's Serial 0/0/1 and R4 in Area 0 making sure all OSPF networks are reachable from all OSPF routers. We cannot use the same router ID in two different processes on the same router. This is why we used for process 10 and for process 1. To achieve reachability everywhere in the network we have to redistribute between the two OSPF domains. router ospf 1 router-id log-adjacency-changes redistribute ospf 10 subnets network area 1! router ospf 10 router-id log-adjacency-changes redistribute ospf 1 subnets 12

26 network area 0 network area Change the OSPF hello interval between routers R3 and R4 to 32 seconds. Using the interface command ip ospf hello-interval on R3's and R4's Serail0/0/1 and specifying 32 for the number of seconds will do the job. R3 and R4 interface Serial0/0/1 ip ospf hello-interval Pretend router R1 has an OSPF neighbor on its LAN connection. Make sure R1 is never elected as a Designated Router. To keep and OSPF router from becoming the DR or BDR on a multi-access network, we need to set the OSPF priority to zero on the interface attached to this network. interface FastEthernet0/0 ip ospf priority Enable the least CPU demanding authentication between R3 and R4. Use cisco as the password. Least CPU demanding would be clear-text as opposed to MD5 which uses hashing to enhance security. R3 and R4 interface Serial0/0/1 ip ospf authentication ip ospf authentication-key cisco 3.7 Make sure that R3's OSPF cost to /24 and the summary route advertised by R8 is dependent on the OSPF cost of R1's connection to R6. Let's take a look at these routes on R3 first: Lab11R3#sh ip ro Routing entry for /24 Known via "ospf 1", distance 110, metric 64, type extern 2, forward metric

27 Last update from on Serial0/0/0.1, 00:00:01 ago Routing Descriptor Blocks: * , from , 00:00:01 ago, via Serial0/0/0.1 Route metric is 64, traffic share count is 1 Lab11R3#sh ip ro Routing entry for /20 Known via "ospf 1", distance 110, metric 65, type extern 2, forward metric 128 Last update from on Serial0/0/0.1, 00:00:12 ago Routing Descriptor Blocks: * , from , 00:00:12 ago, via Serial0/0/0.1 Route metric is 65, traffic share count is 1 Note that we have a metric of 64 and 65 respectively and then another forward metric of 128 for both. The first number is the cost to reach the destination network for the advertising router (R6) and the second is R3's cost to reach the advertising router itself. By default, OSPF redistributes External networks as Type-2 which basically means ignore the cost of reaching the advertising router and only use the cost it advertises. If we allow this behavior, it will mean that regardless of the cost on R1's interfaces or any links before R6, the cost will remain 64 and 65 respectively. If we change R6's behavior to make these routes Type-1 as it advertises them in OSPF process 1, R3 will receive these routes as Type-1 and take the cost to reach R6 into consideration. Let's change R6 and then see what difference this made to R3: R6 router ospf 1 redistribute ospf 10 metric-type 1 subnets Now note the metric change on R3. You can use the command ip ospf cost 1000 for example on R1's connection to R6 and see if the metric will change on R3. Lab11R3#sh ip ro Routing entry for /24 Known via "ospf 1", distance 110, metric 192, type extern 1 Last update from on Serial0/0/0.1, 00:06:06 ago Routing Descriptor Blocks: * , from , 00:06:06 ago, via Serial0/0/0.1 Route metric is 192, traffic share count is 1 Lab11R3#sh ip ro Routing entry for /20 Known via "ospf 1", distance 110, metric 193, type extern 1 Last update from on Serial0/0/0.1, 00:06:59 ago Routing Descriptor Blocks: 14

28 * , from , 00:06:59 ago, via Serial0/0/0.1 Route metric is 193, traffic share count is Add Loopback 0 interfaces specified on the diagram to routers R5 and R6. Enable EIGRP on the Loopback interfaces and exchange EIGRP routes in a manner such that all of the other routers besides R5 and R6 in your network have no knowledge of EIGRP or the networks associated with them. Here we are going to create two new Loopback interfaces that are specified on the diagram. We are going to create a new Loopback on R5 with the address /8 and another new Loopback interface on R6 with the address /8. Once we have these two new Loopbacks created we are going to advertise them into EIGRP. We need to exchange EIGRP routes between R5 and R6 yet still ensure that no other routers know about these new Loopbacks. Given this restriction we cannot redistribute the EIGRP into any other protocol; doing so would make all of the routers learn the two new Loopbacks. The only option that we have is to create a Tunnel between R5 and R6. We will create a Tunnel between R5 and R6 s Serial interfaces. We will give that Tunnel its own subnet and advertise it into the same EIGRP process as the two new Loopbacks. This will allow R5 and R6 to exchange EIGRP routes without letting any other routers learn about them. General EIGRP There are two ways to advertise networks into EIGRP. The first way is to advertise the classful network. network network This way is less precise and not recommended. If you advertise the classful network you may have to use the passive-interface command to stop EIGRP from advertising out unwanted interfaces. The preferred way to advertise networks in EIGRP is with a wildcard mask. The wildcard mask is exactly the same as OSPF. It allows us to advertise a specific subnet instead of advertising the entire classful network. network network network Auto summary is on by default in EIGRP. If you leave auto summary on, EIGRP will summarize the routes down to the classful boundary between different major networks. It is recommended that you always turn off auto summary with the no auto-summary command. Step By Step Solution 1) The first thing we will do is create the new Loopbacks. We will start on R5 creating the new Loopback with the IP address of /8. 15

29 interface Loopback0 ip address ) Then on R6 we will create the new Loopback with the IP address of /8. interface Loopback0 ip address ) On R5 we will create the new Tunnel interface. We have chosen to place the Tunnel into the /24 subnet. We will use the Serial 0/0/1.1 interface on R5 as the Source and the Serial 0/0/1.1 interface on R6 as the Destination. interface Tunnel0 ip address tunnel source tunnel destination ) On R6 we will create the Tunnel interface. Again we will give it an IP address out of the /24 subnet and we will use R6 s Serial 0/0/1.1 interface as the Source and R5 s Serial 0/0/1.1 interface as the Destination. interface Tunnel0 ip address tunnel source tunnel destination We should now be able to ping the /24 subnet across the Tunnel interface. 5) We are then going to advertise the new Loopbacks as well as the Tunnel interface into EIGRP. We will start on R5. Since they didn t specify an AS number for EIGRP we are simply going to use AS 2. With all EIGRP configurations it is recommended that auto summary be turned off. router eigrp 2 network network no auto-summary 6) On R6 we are again going to use EIGRP AS 2 and advertise the new Loopback as well as the Tunnel interface. We are also going to turn off auto summary. router eigrp 2 network network no auto-summary 7) We should now have an EIGRP neighbor formed across the Tunnel interface. We will issue the show ip eigrp neighbor command on R6. IP-EIGRP neighbors for process 2 H Address Interface Hold Uptime SRTT RTO Q Seq Type (sec) (ms) Cnt Num 16

30 Tu :09: ) With the neighbor up R5 should see R6 s /8 network and R6 should see R5 s /8 network. We will issue the show ip route command on both R5 and R6. We are only showing the routes that are important to this section in the table. Lab11R5#show ip route C /8 is directly connected, Loopback0 D /8 [90/ ] via , 00:11:14, Tunnel /24 is subnetted, 1 subnets C is directly connected, Tunnel0 Lab11R6#show ip route D /8 [90/ ] via , 00:12:18, Tunnel0 C /8 is directly connected, Loopback /24 is subnetted, 1 subnets C is directly connected, Tunnel0 Additional IP Routing Protocol Configuration 4.1 R2 Default Route Add a default route from R2 to R3 s interface F0/0. Until this point we have done nothing with R2. The only connectivity that R2 should have is with R3 s directly connected FastEthernet0/0 interface. R2 cannot reach any other interface in the network and no other router can reach it. This step is the first part in giving R2 connectivity to the rest of the network. We are going to create a default route on R2 that will point to R3 s FastEthernet0/0 interface. R2 will still not have any specific knowledge of the rest of the network; the default route will only allow R2 to send all traffic it originates to R3. R2 will count on R3 to forward it the rest of the way. 4.2 NAT ip route Configure router R3 such that router R2 can ping all of the IP addresses on R4. You are not allowed to use any static routes, default routes, redistribution, or default-information commands to accomplish this. The ping will only work if it is sourced from R2. In the previous step we have told R2 what to do with all of it traffic forward it to R3. R3 has a full routing table so it will forward the packets from R2 onto the final destination. However, all of the traffic that R3 forwards for R2 will be sourced from the /8 address and no router except R3 knows how to get back to the /8 subnet on R2. So even though R2 can get to anywhere in the network, no one except R3 can get back to R2. 17