QUESTION/SOLUTION SET LAB 2

Transcription

1 QUESTION/SOLUTION SET LAB 2

2 CCIE lab Routing & Switching (v4.0) Lab:2 Updated

3 Testing Guidelines 1. The equipment on the rack assigned to you is physically Cabled and should not be tempered with. 2. Router and Switch hostnames, basic ip addressing, no exec-timeout and passwords on the Con, AUX and VTYs have been preconfigured. Do not change these configurations. 3. All preconfigured passwords are cisco.do not change these passwords. 4. Static and default routes are not permitted unless directly stated in a question. This includes floating static routes. 5. Routers to Null generated as a result of a dynamic routing protocol solution are permitted. 6. If you need clarification on the meaning of a question, or, if you suspect hardware problems with you equipment, contact the lab proctor as soon as possible. 7. The following symbols are used throughout the exam: YY is your 2-digit rack number, for example YY value for Rack3 is 03 and for Rack11 is 11. X is your router number, for example X Value for router 1 is 1. Z is any number SW1 and SW2 refer to the Catalyst

4 IP DIAGRAM

5 IGP DIAGRAM BGP DIAGRAM BB YY.1 BGP 254 SW1 SW2 SW YY.1 BGP 254 BB2 BGP YY R3 R2

6 MPLS VPN

7 PHYSICAL TOPOLOGY TRUNK PORTS

8 Lab 2012 This CCIE lab scenario is only for applicants, please do not publish it on the internet or anywhere else. General Information IOS is 12.4 Doc CD: you have access to All configuration guides and master indexes are there. Tools: notepad and calculator are available

9 Address Allocation Use class B address range YY.YY.X.0/16. YY is your rack number YY is your rack number, X is your router number Ex : IF your Rack number is 03, Lo0 is and Rack number is 07, Lo0 is Note - Vlan 11 name Marketing - Vlan 12 name Sales - Vlan 20 name Engineering - Vlan 30 name HR - Vlan 33 name BB3 - Vlan 42 name ISP42 - Vlan 51 name ISP51 - Vlan 54 name ISPBB - Vlan 234 name Support - Vlan 243 name QA - Vlan 300 name Admin - Frame-Relay : ( R1 R3) - PPP : ( R2 R3 ) - BB1 is YY.254/24 - BB2 is YY.254/24 - BB3 is YY.254/24

10 Loopback IP Address Hostname RackYYR1 Loopback0 interface IP Address YY.YY.1.1/32 RackYYR2 YY.YY.2.2/32 RackYYR3 YY.YY.3.3/32 RackYYR4 YY.YY.4.4/32 RackYYR5 YY.YY.5.5/32 RackYYSW1 YY.YY.7.7/32 RackYYSW2 YY.YY.8.8/32 RackYYSW3 YY.YY.9.9/32 RackYYSW4 YY.YY.10.10/32 Unless specified above, all interface else must be 24 bit mask addressing.

11 Pre-configuration in real exam - Interface IP - F/R Mapping - VTP & VLAN On R1 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 4 pass ciscos hostname RackYYR1 interface loopback 0 ip address YY.YY interface fa0/1 no ip address no shutdown interface fa0/1.11 encapsulation dot1q 11 ip address YY.YY interface fa0/1.12 encapsulation dot1q 12 ip address YY.YY interface s0/0/1 no ip address encapsulation frame-relay

12 no shutdown interface s0/0/1.231 point-to-point no shutdown

13 On R2 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 4 pass cisco hostname RackYYR2 interface loopback 0 ip address YY.YY interface fa0/0 ip address YY.YY no shutdown interface fa0/1 ip address YY.YY no shutdown interface s0/1/0 ip unnumbered fa0/0 encapsulation ppp no shutdown interface s0/0/0 ip address YY.YY no shutdown

14 On R3 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 4 pass cisco hostname RackYYR3 interface loopback 0 ip address YY.YY interface fa0/0 ip address YY.YY no shutdown interface fa0/1 ip address YY.YY no shutdown interface s0/0/0 no ip address encapsulation frame-relay no shutdown interface s0/0/0.233 point-to-point no shutdown interface s0/1/0 ip unnumbered fa0/1 encapsulation ppp no shutdown

15 On R4 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 4 pass cisco hostname RackYYR4 interface loopback 0 ip address YY.YY interface fa0/0 ip address YY.YY no shutdown interface fa0/1 ip address YY.YY no shutdown

16 On R5 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 4 pass cisco hostname RackYYR5 frame-relay switching interface loopback 0 ip address YY.YY interface fa0/0 ip address YY.YY no shutdown interface fa0/1 ip address YY.YY no shutdown interface s0/0/0 description Conn to R1 encapsulation frame-relay clock rate no fair-queue no frame-relay inverse-arp frame-relay lmi-type cisco frame-relay intf-type dce frame-relay route 231 interface Serial0/0/1 233

17 interface s0/1/0 description Conn to R3 encapsulation frame-relay no frame-relay inverse-arp frame-relay lmi-type cisco frame-relay intf-type dce frame-relay route 233 interface Serial0/0/0 231 clock rate

18 On SW1 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 15 pass cisco host RackYYSW1 vtp domain CCIE vtp mode transparent vlan 11 name Marketing vlan 12 name SALES vlan 20 name Engineering vlan 30 name HR vlan 33 name BB3 vlan 42 name ISP42 vlan 51 name ISP51 vlan 54 name ISPBB vlan 234 name Support

19 vlan 243 name QA vlan 300 name Admin interface loopback 0 ip address YY.YY interface fa0/2 switchport access vlan 20 switchport mode access interface fa0/3 switchport access vlan 30 switchport mode access interface fa0/4 switchport access vlan 42 switchport mode access interface fa0/5 switchport access vlan 54 switchport mode access interface fa0/10 no switchport ip address YY no shutdown interface vlan 12 ip address YY.YY interface vlan 51 ip address YY.YY

20 On SW2 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 15 pass cisco host RackYYSW2 vtp domain CCIE vtp mode transparent vlan 11 name Marketing vlan 12 name SALES vlan 20 name Engineering vlan 30 name HR vlan 33 name BB3 vlan 42 name ISP42 vlan 51 name ISP51 vlan 54 name ISPBB vlan 234 name Support

21 vlan 243 name QA vlan 300 name Admin interface loopback 0 ip address YY.YY interface fa0/2 switchport access vlan 234 switchport mode access interface fa0/3 switchport access vlan 300 switchport mode access interface fa0/4 switchport access vlan 54 switchport mode access interface fa0/5 switchport access vlan 51 switchport mode access interface fa0/10 no switchport ip address YY interface vlan 42 ip address YY.YY interface vlan 243 ip address YY.YY

22 On SW3 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 15 pass cisco host RackYYSW3 vtp domain CCIE vtp mode transparent vlan 11 name Marketing vlan 12 name SALES vlan 20 name Engineering vlan 30 name HR vlan 33 name BB3 vlan 42 name ISP42 vlan 51 name ISP51 vlan 54 name ISPBB vlan 234 name Support

23 vlan 243 name QA vlan 300 name Admin interface loopback 0 ip address YY.YY interface fa0/10 switchport access vlan 33 switchport mode access interface vlan 33 ip address YY interface vlan 234 ip address YY.YY interface vlan 243 ip address YY.YY

24 On SW4 en conf t no ip domain-lookup line console 0 logg syn exec-timeout 0 line vty 0 15 pass cisco host RackYYSW4 vtp domain CCIE vtp mode transparent vlan 11 name Marketing vlan 12 name SALES vlan 20 name Engineering vlan 30 name HR vlan 33 name BB3 vlan 42 name ISP42 vlan 51 name ISP51 vlan 54 name ISPBB vlan 234 name Support

25 vlan 243 name QA vlan 300 name Admin interface loopback 0 ip address YY.YY interface fa0/6 no switchport ip address YY.YY interface vlan 234 ip address YY.YY interface vlan 243 ip address YY.YY

26 SECTION I. Layer 2 Technologies Has Pre-Configuration on your exam. VLAN Trunking Protocol(VTP) is domain CCIE VLAN Trunking Protocol(VTP) is transparent. PPP on the serial links between R2 and R Troubleshoot Layer 2 Switching Two faults have been injected into the pre-configurations just described, These issues MAY impede a working solution for certain portions of this labs exam and affect any labs exam section. You must verify that all of your configurations work as expected, if something is not working as expected then you must fix the underlying problem. Point will be awarded for solving each problem. However, if you fail to solve a particular problem, and the injected fault prevents you from having a working solutions of this lab, then you will lose points for the fault and the scenario that is not working Score : Solve one fault 2point, solve two fault 4point

27 Verification: VTP Domain Name of Switches VTP password of Switches VLAN port assignment on switches There is monitor session destination fa0/10 on SW3. Wrong IP address for VLAN 33 on SW3 Native keyword added on R1, remove native on R1 On R1 s0/1/0, use "keepalive" command Configuration: Pre-config Fault: VTP Domain Name of Switches VTP password of Switches Solution: On all Switches i.e. SW1-SW4 vtp domain CCIE vtp mode transparent vtp password cisco vtp version

28 Pre-config Fault: There is monitor session destination fa0/10 on SW3 On SW3 Rack67SW3#sh run i monitor monitor session 1 destination interface Fa0/10 Rack67SW3# Solution: no monitor session 1 destination interface fa0/10 Pre-config Fault: Wrong IP address for VLAN 33 on SW3 Solution: interface vlan 33 ip address YY Pre-config Fault: Native keyword added on R1, remove native on R1 On R1 s0/1/0, use "keepalive" command interface FastEthernet0/1 no ip address

29 duplex auto speed auto no shut end Rack67R1#sh run int fa0/1.11 Building configuration... Current configuration : 106 bytes interface FastEthernet0/1.11 encapsulation dot1q 10 native ip address no shut end Rack67R1#sh run int fa0/1.12 Building configuration... Current configuration : 99 bytes

30 interface FastEthernet0/1.12 encapsulation dot1q 11 ip address no shut end Rack67R1#sh run int s0/0/0 Building configuration... Current configuration : 73 bytes interface Serial0/0/0 no ip address no keepalive no fair-queue end

31 Solution: interface FastEthernet0/1 no ip address duplex auto speed auto no shut end Rack67R1#sh run int fa0/1.11 Building configuration... Current configuration : 99 bytes interface FastEthernet0/1.11 encapsulation dot1q 11 ip address no shut end Rack67R1#sh run int fa0/1.12 Building configuration...

32 Current configuration : 99 bytes interface FastEthernet0/1.12 encapsulation dot1q 12 ip address no shut end Rack67R1#sh run int s0/0/0 Building configuration... Current configuration : 73 bytes interface Serial0/0/0 no ip address keepalive no fair-queue end

33 1.2 Implement the Access-Switch Ports of Switched Network VLAN port assignments are per the following table : 11 Marketing R1 G0/1 12 Sales R1 G0/1 20 Engineering R2 G0/0 30 HR R3 G0/0 33 BB3 Sw3 F0/10 42 ISP42 R4 F0/0; SW2 51 ISP51 R5 F0/1 54 ISPBB R4 F0/1 ; R5 F0/0 234 Support R2 G0/1 243 QA SW2, SW3, SW4 300 Admin R3 F0/1 Configure all of the appropriate nontrunking access switch ports on SW1, SW2, SW3 and SW4, according to the following requirements Use 802.1w on all four switches. BackBone device can t be access and Don t consider the Backbone. Ensure that the spanning tree enters the forwarding state immediately only for these access switch ports, by passing the listening and learning states.backbone ports are not consider as access portand do not use default command

34 Avoiding transmitting BPDUs on any access switchport on any of these ports,the ports should be shutdown automatically if SW receive BPDU.You need to use only single command to do this task Ensure that all four switches are able to read to unidirectional link failure for any switch to switchport the affected port should be disabled in the event failure. Score : 4 Point Configuration: On all Switches i.e. SW1-SW4 vlan 11 name Marketing vlan 12 name SALES vlan 20 name Engineering vlan 30 name HR vlan 33 name BB3 vlan 42 name ISP42 vlan 51

35 name ISP51 vlan 54 name ISPBB vlan 234 name Support vlan 243 name QA vlan 300 name Admin On SW1 spanning-tree mode rapid-pvst spanning-tree portfast bpduguard default interface fa1/0/2 switchport access vlan 20 switchport mode access interface fa1/0/3

36 switchport access vlan 30 switchport mode access interface fa1/0/4 switchport access vlan 42 switchport mode access interface fa1/0/5 switchport access vlan 54 switchport mode access interface range fa1/0/2 5 spanning-tree portfast On SW2 interface fa0/1 switchport trunk encapsulation dot1q switchport trunk allowed vlan 11,12 switchport mode trunk

37 interface fa0/2 switchport access vlan 234 switchport mode access interface fa0/3 switchport access vlan 300 switchport mode access interface fa0/4 switchport access vlan 54 switchport mode access interface fa0/5 switchport access vlan 51 switchport mode access interface range fa0/2 5 spanning-tree portfast

38 On all Switches i.e. SW1-SW4 spanning-tree mode rapid-pvst spanning-tree portfast bpduguard default interface range fa0/19-24 udld port aggressive

39 1.3 Implement Frame Relay Use the following requirements to configure R1 and R3 for Frame Relay and R5 as the Frame Relay switch Configure Frame-relay as in diagram. Use point-to-point subinterface for end-point. Use the DLCI number to sub-interface number. Use CISCO LMI on Frame Relay switch and auto-sensing on R1 and R3 Use frame-relay encapsulation as cisco. Use the data-link connection identifier(dlci) assignments from the table below R1 0/0/1 FR Switch 0/0/0 231 R3 0/0/0 FR Switch 0/0/1 233 Score : 3 Point

40 SOLUTION: On R5 frame-relay switching On R1 interface s0/0/1 encapsulation frame-relay no frame-relay inverse-arp frame-relay lmi-type cisco // No need,it will autosense from R5 interface s0/0/1.231 point-to-point ip unnumbered loopback 0 frame-relay interface-dlci 231

41 On R3 interface s0/0/0 encapsulation frame-relay no frame-relay inverse-arp frame-relay lmi-type cisco // No need,it will autosense from R5 interface s0/0/0.233 point-to-point ip unnumbered loopback 0 frame-relay interface-dlci 233

42

43 1.4 Switching Use 802.1q on all four switches. Switches should not actively attempt to convert the links to trunk link by negotiating the trunk mode. Utilize Etherchannel between all switching inter connections using IEEE standard to actively negotiate channel. Etherchannel load balancing should be accomplished by destination ip address. Configure port 0/1 on SW2. Ensure that only VLAN Sales and Marketing are allowed. Score : 3 Point Make sure SW1 must be root for all VLAN Make sure SW4 should not become root for any VLAN Ensure the interface are connected to Backbone(Backbone1 and Backbone2) not become root switch. Make sure SW1 should be aging-time out two times as fast as than other vlans of VLAN 20 Score : 2 Point

44 Configuring 802.1q on all four switches & Switches should not actively attempt to convert the links to trunk link by negotiating the trunk mode: On all Switches i.e. SW1-SW4 default interface range fa0/19-24 interface range fa0/19-24 switchport trunk encapsulation dot1q switchport mode trunk udld port aggressive // We have already used but due to default intterface command,it get's deleted.so re-configure it. switchport nonegotiate // Switches should not actively attempt. no shut

45 Utilize Etherchannel between all switching inter connections using IEEE standard to actively negotiate channel: On Sw1 interface range fa1/0/19-20 channel-group 13 mode active interface range fa1/0/21-22 channel-group 14 mode active interface range fa1/0/23-24 channel-group 12 mode active On Sw2 interface range fa0/19-20 channel-group 24 mode active interface range fa0/21-22 channel-group 23 mode active interface range fa0/23-24 channel-group 21 mode active

46 On Sw3 interface range fa0/19-20 channel-group 31 mode active interface range fa0/21-22 channel-group 32 mode active interface range fa0/23-24 channel-group 34 mode active On Sw4 interface range fa0/19-20 channel-group 42 mode active interface range fa0/21-22 channel-group 41 mode active interface range fa0/23-24 channel-group 43 mode active Etherchannel load balancing should be accomplished by destination ip address On all Switches i.e. SW1-SW4 port-channel load-balance dst-ip

47 Configure port 0/1 on SW2. Ensure that only VLAN Sales and Marketing are allowed On Sw2 interface FastEthernet0/1 switchport trunk encapsulation dot1q switchport trunk allowed vlan 11,12 switchport mode trunk end Make sure SW1 must be root for all VLAN On Sw1 spanning-tree vlan priority Make sure SW4 should not become root for any VLAN On Sw1 interface port-channel 14 spanning-tree guard root

48 On Sw2 interface port-channel 24 spanning-tree guard root On Sw3 interface port-channel 34 spanning-tree guard root Ensure the interface are connected to Backbone(Backbone1 and Backbone2) not become root switch. On Sw1 interface fa1/0/10 spanning-tree guard root On Sw2 interface fa0/10 spanning-tree guard root Make sure SW1 should be aging-time out two times as fast as than other vlans of VLAN 20 (Note - Default Aging Time is 300) On Sw1 mac address-table aging-time 150 vlan 20

49 1.5 Port Mirroring. Configure port monitoring on SW3 according to the following requirement. The transmit and receive traffic on ports Fa0/1 through Fa0/8 and the etherchannel port-channel for Fa0/19-20 should monitored. A copy of the traffic should be forwarded to Fa0/11. On Sw3 Score : 3 Point monitor session 1 source interface fa0/1 8, port-channel 31 both // Both because transmit and receive traffic monitor session 1 destination interface fa0/11 Verification:

50 SECTION ll. Layer 3 Technologies The loopback interface can be seen as /32 in the routing tables unless stated otherwise in a question 2.1 Implement IPv4 OSPF Configure Open Shortest Path First(OSPF) Updates should be advertised only out of the interfaces that are indicated in the IGP topology diagram. The OSPF process ID can be any number Loopback 0 interface should be advertised in any OSPF area for all non- MPLS devices. Configure OSPF area 1 as in diagram. Other routers should be seen as an external route about the Backbone 2. SW2 should inject default route. Score : 3 Point Configure OSPF area 0 and OSPF area 51 as in diagram. SW1 should be seen as an external route about the Backbone 1. SW1 should inject default route. Score : 3 Point

51 On R5 router ospf 67 router-id network area 51 On SW1 ip routing router ospf 67 router-id network area 0 network area 0 network area 51 router ospf 67 default-information originate always redistribute connected subnets route-map BB1 exit route-map BB1 permit 10 match interface fa1/0/10

52 On R1 router ospf 67 router-id network area 0 network area 0 network area 0 On R3 interface Serial0/0/1 ip unnumbered FastEthernet0/1 clock rate end router ospf 67 router-id network area 0 network area 1 network area 1

53 On R2 interface Serial0/0/1 ip unnumbered FastEthernet0/0 clock rate end router ospf 67 router-id network area 1 network area 1 network area 1 network area 1 On SW3 ip routing router ospf 67 router-id network area 1 network area 1 network area 1

54 On SW4 ip routing router ospf 67 router-id network area 1 network area 1 network area 1 On SW2 ip routing router ospf 67 router-id network area 1 network area 1 network area 1 router ospf 67 default-information originate always redistribute connected subnets route-map BB2 exit

55 route-map BB2 permit 10 match interface fa0/10 On R4 ip routing router ospf 67 router-id network area 1

56 Verification: Other routers should be seen as an external route about the Backbone 2. SW2 should inject default route.

57 Other routers should be seen as an external route about the Backbone 1. SW1 should inject default route.

58 2.2 Implement IPv4 EIGRP Configure EIGRP 10 between R4 and R5. Configure EIGRP 100 as in diagram. EIGRP updates should be advertised only out to the interfaces in the IGP topology. Configure SW3 such that it will not receive any EIGRP Queries. SW3 should also not send out information about BB3 routes to the EIGRP 100 neighbors. Do not configure any kind of outgoing filtering to do this. On SW3, Use route-maps to tag any CLASS A network address routes sourced from the external EIGRP ( Backbone 3 ) with tag 200 and define ACL for CLASS A network. loopback 0 of R4 and R5 should be seen as an external route. SW3 redistribute EIGRP 100 to OSPF summarize to the following routes into an aggregate /8 : / / / /24 Score : 3 Point

59 SOLUTION: Configure EIGRP 10 between R4 and R5. Loopback 0 of R4 and R5 should be seen as an external route. On R4 router eigrp 10 redistribute connected route-map Loopback network no auto-summary route-map Loopback permit 10 match interface loopback 0 - On R5 router eigrp 10 redistribute connected route-map Loopback network no auto-summary route-map Loopback permit 10 match interface loopback 0

60

61 Configure EIGRP 100 as in diagram. EIGRP updates should be advertised only out to the interfaces in the IGP topology. Configure SW3 such that it will not receive any EIGRP Queries. SW3 should also not send out information about BB3 routes to the EIGRP 100 neighbors. Do not configure any kind of outgoing filtering to do this. On SW3, Use route-maps to tag any CLASS A network address routes sourced from the external EIGRP ( Backbone 3 ) with tag 200 and define ACL for CLASS A network. On SW3 router eigrp 100 network no auto-summary eigrp stub receive-only distribute-list route-map Eigrp->Ospf in route-map Eigrp->Ospf permit 10 match ip address xyz match route-type external set tag 200 route-map Eigrp->Ospf permit 20 ip access-list stand xyz permit

62 Verification: SW3 redistribute EIGRP 100 to OSPF summarize to the following routes into an aggregate /8 : / / / /24 On SW3 router ospf 67 redistribute eigrp 100 subnets summary-address

63 Verification:

64 2.3 Implement MPLS Name the VRF as vpna Use rd 100:1 both R4 and R5 Use OSPF as routing protocol between PE and CE. Use MPBGP AS 100 to exchange customer prefixes. Source all updates using loopback 0 address. Address the need MPLS introduces of connecting partitioned OSPF backbone. Score : 4 Point R1 must prefer the MPLS Backbone about other prefixes originated from site-b, Not in the case of R3. Make sure that MPLS backbone is preferred over link between R3 and R2. Use the network YY.YY.100.x/24 to facilitate this. The routes of MPLS network should have reachability for YY.YY.0.0 network Score : 3 Point

65 On R5 ip cef mpls ip mpls label protocol ldp mpls ldp router-id loopback 0 force ip vrf vpna rd 100:1 route-target both 100:1 interface fa0/0 mpls ip interface fa0/1 ip vrf forwarding vpna ip address interface loopback 100 ip vrf forwarding vpna ip address

66 router ospf 100 vrf vpna router-id area 1 sham-link cost 1 redistribute bgp 100 subnets network area 51 router bgp 100 bgp router-id no bgp default ipv4-unicast neighbor remote-as 100 neighbor update-source Loopback0 address-family vpnv4 neighbor activate neighbor send-community extended exit-address-family address-family ipv4 vrf vpna network mask redistribute ospf 100 vrf vpna match internal external 1 external2 exit-address-family

67 On R4 ip cef mpls ip mpls label protocol ldp mpls ldp router-id loopback 0 force ip vrf vpna rd 100:1 route-target both 100:1 interface fa0/1 mpls ip interface loopback 100 ip vrf forwarding vpna ip address interface fa0/0 ip vrf forwarding vpna ip address

68 router ospf 100 vrf vpna router-id area 1 sham-link cost 1 redistribute bgp 100 subnets network area 1 router bgp 100 bgp router-id no bgp default ipv4-unicast neighbor remote-as 100 neighbor update-source Loopback0 address-family vpnv4 neighbor activate exit-address-family address-family ipv4 vrf vpna network mask redistribute ospf 100 vrf vpna match internal external 1 external 2 exit-address-family

69 Verification: R5 R4

70 Virtual-link between R5 and SW1: On R5 router ospf 100 vrf vpna area 51 virtual-link On SW1 router ospf 67 area 51 virtual-link Verification:

71 R1 must prefer the MPLS Backbone about other prefixes originated from site-b, Not in the case of R3. Make sure that MPLS backbone is preferred over link between R3 and R2 Backdoor Link's: On R3 interface s0/0/1 ip ospf cost 500 On R2 interface s0/0/1 ip ospf cost 500 Verification:

72 The routes of MPLS network should have reachability for YY.YY.0.0 network. Verification: From R5 From R4

73 2.4 Implement IPv4 BGP Referring the BGP Routing diagram. Configure BGP within these parameters EBGP: SW1 connects to BB1 (150.1.YY.254); and from BB1 SW1 receives Z.0/24 networks with AS PATH : SW2 connects to BB2 (150.2.YY.254); and from BB2 SW2 receives Z.0/24 networks with AS PATH : 254 SW2 should modify the AS PATH of its learned routes; adding AS253 by using a single route-map. Do not worry about blackhole. IBGP: Score : 2 Point SW1, SW2, R2, R3 are IBGP peers. ( Do not use next-hop-self and route-reflector and confederation ) Use BGP command to cause R2 to prefer SW2 as the exit point for ASYY to AS 254, and R3 to prefer SW1 and the exit point for ASYY to AS 254 Both R2 and R3 should still have routes to the other exit point in their BGP table. Use ONLY the loopback 0 IP address to propagate BGP route information. No IGP router should be advertised to AS254. Score : 4 Point

74 EBGP: SW1 connects to BB1 (150.1.YY.254); and from BB1 SW1 receives Z.0/24 networks with AS PATH : On SW1 router bgp 67 no synchronization no auto-summary neighbor remote-as SW2 connects to BB2 (150.2.YY.254); and from BB2 SW2 receives Z.0/24 networks with AS PATH : 254 On SW2 router bgp 67 no synchronization no auto-summary neighbor remote-as 254

75 Verification: On SW1 On SW2

76 SW2 should modify the AS PATH of its learned routes; adding AS253 by using a single route-map. Do not worry about blackhole On SW2 router bgp 67 no synchronization no auto-summary neighbor remote-as 254 neighbor route-map MODIFY in exit route-map MODIFY permit 10 set as-path prepend 253 exit Verification:

77 IBGP: SW1, SW2, R2, R3 are IBGP peers. ( Do not use next-hop-self and route-reflector and confederation ) On SW1 router bgp 67 no synchronization no auto-summary neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback On SW2 router bgp 67 no synchronization no auto-summary neighbor remote-as 67

78 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback On R2 router bgp 67 no synchronization no auto-summary neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback On R3 router bgp 67

79 no synchronization no auto-summary neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback 0 neighbor remote-as 67 neighbor update-source loopback Verification: On SW1

80 On SW2 On R2

81 On R3 Use BGP command to cause R2 to prefer SW2 as the exit point for ASYY to AS 254, and R3 to prefer SW1 and the exit point for ASYY to AS 254 Both R2 and R3 should still have routes to the other exit point in their BGP table. On R2 router bgp 67 neighbor weight 1000 On R3 router bgp 67 neighbor weight 1000

82 Verification: On R2 On R3

83 2.5 Implement IPv6 RIPng Hosts in the Engineering Vlan(VLAN20) need IPv6 access to the internet via BB3. Configure IPv6 unique local unicast-address as follow: - R2 fa0/0 : 10YY:1010:10::1/64 fa0/1 : 10YY:1010:20::1/64 - SW3 SVI 234 : 10YY:1010:20::2/64 SVI 33 : 10YY:1010:30::2/64 Score : 2 Point Configure RIPng between R2 and SW3. Ensure that R2 can receive default route from SW3 Ensure that IPv6 scenarios can ping each other. Score : 2 Point

84 On R2 ipv6 unicast-routing interface fa0/0 ipv6 address 1067:1010:10::1/64 ipv6 rip 1 enable interface fa0/1 ipv6 address 1067:1010:20::1/64 ipv6 rip 1 enable On SW3 sdm prefer dual-ipv4-and-ipv6 default ipv6 unicast-routing interface vlan234 ipv6 address 1067:1010:20::2/64 ipv6 rip 1 enable ipv6 rip 1 default-information originate interface vlan33 ipv6 address 1067:1010:30::2/64 ipv6 rip 1 enable. // Reload required

85 Verification: On SW3 On R2

86 SECTION lll. IP Multicast 3.1 Implement PIM Spares Mode for Multicast Enable PIM Sparse mode(pim-sm) between SW2, SW3 and SW4 The QA and Support VLANs should handle multicast traffic. Configure Auto-RP, with SW3 Loopback0 serving as RP only for the multicast group /24, and SW4 serving as the mapping agent. Enable SW2 VLAN 243 to join group To verify you should be able to successfully generate multicast traffic for the group using R2 as the source. Score : 3 Point

87 On SW2 ip multicast-routing distributed interface vlan 243 ip pim sparse-mode ip igmp join-group exit On SW3 ip multicast-routing distributed interface vlan 234 ip pim sparse-mode exit interface vlan 243 ip pim sparse-mode exit interface loopback 0 ip pim sparse-mode exit ip pim send-rp-announce loopback 0 scope 16 group-list 10 access-list 10 permit

88 On SW4 ip multicast-routing distributed interface vlan 234 ip pim sparse-mode exit interface vlan 243 ip pim sparse-mode exit interface loopback 0 ip pim sparse-mode exit ip pim send-rp-discovery lo0 scope On R2 ip multicast-routing interface fa0/1 ip pim sparse-mode exit

89 Verification: On R2 On SW4

90 3.2 Multicast Joins Configure Switches(SW2~SW4) so that hosts connected to vlan QA can only join in multicast group Score : 3 Point On SW2 access-list 9 permit host interface vlan 243 ip igmp access-group On SW4 access-list 9 permit host interface vlan 243 ip igmp access-group On SW3 access-list 9 permit host interface vlan 243 ip igmp access-group 9

91 SECTION IV. Advanced Services 4.1 Link Fragmentation On R1 and R3 Use end point identifier for multilink bundling. APPLY a fragment delay of 8ms to the MPPP bundle. Use bandwidth command on both virtual interface and multilink interface for interleaving to work( use ppp multilink interleave) The committed burst size as 8K bits and excess burst size is 1K bits. Score : 3 Point

92 On R1 multilink bundle-name endpoint interface s0/0/1.231 no ip address frame-relay interface-dlci 231 ppp virtual-template 1 exit interface virtual-template 1 no ip address ppp multilink ppp multilink group 1 bandwidth 128 exit interface multilink 1 bandwidth 128 ip unnumbered loopback 0 ppp multilink ppp multilink interleave ppp multilink group 1 ppp multilink fragment delay 8 ppp multilink endpoint hostname

93 On R1 The committed burst size as 8K bits and excess burst size is 1K bits. map-class frame-relay FRTS frame-relay cir frame-relay bc 8000 frame-relay be 1000 exit interface s0/0/1 frame-relay traffic-shaping exit interface s0/0/1.231 frame-relay interface-dlci 231 ppp virtual-template 1 class FRTS exit

94 On R3 multilink bundle-name endpoint interface s0/0/0.233 no ip address frame-relay interface-dlci 233 ppp virtual-template 1 exit interface virtual-template 1 no ip address ppp multilink ppp multilink group 1 bandwidth 128 exit interface multilink 1 bandwidth 128 ip unnumbered loopback 0 ppp multilink ppp multilink interleave ppp multilink group 1 ppp multilink fragment delay 8 ppp multilink endpoint hostname

95 On R1 The committed burst size as 8K bits and excess burst size is 1K bits. map-class frame-relay FRTS frame-relay cir frame-relay bc 8000 frame-relay be 1000 exit interface s0/0/0 frame-relay traffic-shaping exit interface s0/0/0.233 frame-relay interface-dlci 233 ppp virtual-template 1 class FRTS exit

96 Verification: On R1 On R3

97 4.2 Link Efficiency On R1 and R3 Define CIR ( and interface bandwidth ) as 128K. Use a policy map to define a priority of 45 all VoIP traffic whose proceeding as critical and using the access-list but don t use named extended and you should Implement using the LLQ. Use a multilink group interface for all QoS and IP commands. Score : 3 Point

98 On R1 access-list 124 permit udp any any precedence critical class-map match-all aaa match access-group 124 exit policy-map bbb class aaa priority percent 45 class class-default fair-queue exit exit interface multilink 1 bandwidth 128 service-policy output bbb On R3 access-list 142 permit udp any any precedence critical class-map match-all aaa match access-group 142 exit policy-map bbb class aaa priority percent 45 class class-default fair-queue exit exit

99 interface multilink 1 bandwidth 128 service-policy output bbb Verification: On R3 On R1

100 4.2 Link Efficiency (Other) On R1 and R3 Define CIR ( and interface bandwidth ) as 128K. Use a policy map to define a priority of 45Kbps all VoIP traffic whose proceeding as critical and using the access-list but don t use named extended. and you should Implement using the LLQ. Use a multilink group interface for all QoS and IP commands. Score : 3 Point

101 On R1 access-list 124 permit udp any any precedence critical class-map match-all aaa match access-group 124 exit policy-map bbb class aaa priority 45 class class-default fair-queue exit exit interface multilink 1 bandwidth 128 service-policy output bbb On R3 access-list 142 permit udp any any precedence critical class-map match-all aaa match access-group 142 exit policy-map bbb class aaa priority 45 class class-default fair-queue exit exit

102 interface multilink 1 bandwidth 128 service-policy output bbb Verification: On R3 On R1

103 4.3 MLS QoS for Video Port fa0/6 on SW4, will host a video server for streaming to devices off the Marketing VLAN on R1. Configure MLS QoS in the network according to : The video server IP YY.YY Use policy-map to assign video traffic a DSCP 56. Define policy for the video traffic with rate of 3M (million) and a burst size of 1M (million). Additionally when these routes are exceeded the DSCP value for video traffic should be mark down from 56 to 8. The Distribution ports between all 4 switches should trust inbound DSCP value for classification. Additionally, for untagged packets the default CoS value should be defined as 1. Finally the expedite queue should be for all these ports. Score : 3 Point Note : If question say Define policy for the video traffic with rate of 3M (million) and a burst size byte of 1M (million). police exceed-action policed-dscp-transmit

104 On SW4 mls qos class-map match-all VIDEO match access-group 100 mls qos map policed-dscp 56 to 8 policy-map QoS class VIDEO set dscp 56 police exceed-action policed-dscp-transmit access-list 100 permit udp host range interface fa0/6 ip address // pre-config service-policy input QoS // Should be input on switches priority-queue out

105 On all switches i.e. SW1-SW4 mls qos interface range fa0/19-24 mls qos trust dscp mls qos cos 1 priority-queue out exit On SW2 interface fa0/1 priority-queue out exit

106 4.4 RSVP Configure Reservable bandwidth 64K with the largest reservable flow 64K. Configure R3 to simulate a host generating a RSVP PATH message to R3, protocol should be TCP. Configure R1 to simulate a host generation RSVP RECV message to R1. Use loopback address to R1 and R3 and the message protocol should be TCP with a desination port and a source of telnet The message should be for a single reservation with a guaranteed average bit Rate of 10K and a maximum burst of 1K(1000) bytes. Score : 2 Point

107 On R1 interface multilink 1 ip rsvp bandwidth exit ip rsvp reservation-host tcp ff rate On R3 interface multilink 1 ip rsvp bandwidth exit ip rsvp sender-host tcp

108 Verification: On R3 On R1

109 4.5 MHSRP Configure MHSRP on SW3 and SW4 for Support VLANs : SW3 should be configure as the active router for group 1 and SW4 should be configure as the active router for group 2. Group 1 uses a virtual IP address of YY.YY and group 2 uses a virtual IP address of YY.YY Do load balance and fault tolerance in SW3 and SW4. You should track availability of SW2 ( YY.YY ) Score : 3 Point

110 On SW3 interface vlan 234 standby 1 ip standby 1 priority 110 standby 1 preempt standby 1 track vlan standby 2 ip standby 2 preempt On SW4 interface vlan 234 standby 2 ip standby 2 priority 110 standby 2 preempt standby 2 track vlan standby 1 ip standby 1 preempt

111 Verification: On SW3 On SW4

112 4.5 MHSRP ( Other) Configure MHSRP on SW3 and SW4 for Support VLANs : Group 1 uses a virtual IP address of YY.YY and group 2 uses a virtual IP address of YY.YY SW3 should be configure as the active router for group 2 and SW4 should be configure as the active router for group 1. Do load balance and fault tolerance in SW3 and SW4. You should track availability of default route Score : 3 Point

113 On SW3 track 100 ip route reachability interface vlan 234 standby 2 ip standby 2 preempt standby 2 priority 110 standby 2 track 100 standby 1 ip standby 1 preempt On SW4 track 100 ip route reachability interface vlan 234 standby 1 ip standby 1 priority 110 standby 1 preempt standby 1 track 100 standby 2 ip standby 2 preempt

114 4.6 Polling NTP Between R5, SW1, SW2, R3 R5 should synchronize with a NTP server YY.YY In the event of the R5 looses connection to NTP Server it should act as a NTP Server with a stratum 5 and its calendar as an authoritative time source. SW1, SW2, R3 using loopback 0 should use R5 as a authoritative time server. Set Clock on R5 8:00:00 AM 1 Jan Ultimately, clock should be in synchronized. Score : 4 Point R3 and R5 should authenticate each other. SW1 and SW2 do not authenticate. Score : 3 Point

115 On R5 clock set 08:00:00 1 Jan 2010 // On privelege mode ntp access-group peer 20 ntp access-group serve-only 10 clock calendar-valid ntp master 5 ntp authentication-key 1 md5 cisco ntp authenticate ntp source fa0/1 ntp server access-list 10 permit access-list 10 permit access-list 10 permit access-list 20 permit access-list 20 permit On SW1 ntp server source Loopback On SW2 ntp server source Loopback

116 On R3 ntp authentication-key 1 md5 cisco ntp authenticate ntp trusted-key 1 ntp server key 1 source Loopback0 x-x-x-x-x- x-x-x-x-x-x-x-x-x-x-x-x x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x Note:- On R3 If the router does not allows to make use of ntp server "A.B.C.D" command then solution would be int lo0 ntp broadcast client On R5 int fa0/1 ntp broadcast x-x-x-x-x- x-x-x-x-x-x-x-x-x-x-x-x x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

117 SECTION V. Optimize the Network 5.1 IP Service Level Agreement Configure IP SLA, intented to monitor or the response across between MPLS network and backdoor serials according to the : SW2 will do all monitoring, SW1 act as a IP SLA responder, while R3 should have no knowledge of IP SLAs. SW2 should use TCP to monitor SW1. The operation should repeat every 3 min. starting immediately and repeat everyday. TCP SLAs should use the well-known telnet port. SW2 should use ICMP to monitor R3. The operation should repeat every 3 min. starting immediately and every day. Loopback addresses should be used for and by all devices. The above tasks should be the only active SLA devices. Score : 3 Point

118 On SW2 ip sla 1 tcp-connect source-ip frequency 180 exit exit ip sla schedule 1 start-time now recurring ip sla 2 icmp-echo source-ip frequency 180 exit exit ip sla schedule 2 start-time now recurring On SW1 ip sla responder

119 5.2 SNMP Configure SNMP on SW2 and R3 according to the : All traps should be set to the SNMP server YY.YY using communiy string "public" There should be 2 communities defined one (public) with read-only access and another (ciscoadmin) with read-write access On SW2 enable SNMP traps for IP SLA in the event that round-trip time default value violates the upper a lower threshold On R3 enable SNMP traps for RSVP only Score : 3 Point

120 On SW2 snmp-server community public RO snmp-server community ciscoadmin RW ip sla reaction-configuration 1 react rtt threshold-value threshold-type immediate action-type traponly ip sla reaction-configuration 2 react rtt threshold-value threshold-type immediate action-type traponly snmp-server enable traps rtr snmp-server host public On R3 snmp-server community public RO snmp-server community ciscoadmin RW snmp-server enable traps rsvp snmp-server host public

121 5.3 Logging, Management, Core Dumps Configure the following system management feature on R2, according to: Enable local time-stamps with date and time in msec debug and logged messages. Configure the local logging buffer to be bytes, loggin messages with set The severity level 4 (warning) and the higher. In the event that the local buffer is over written, enable the error counter. To facilitate troubleshooting, when there is unexpected system shout down or reboot ensure that core dump is generated and saved to the host YY.YY using the FTP protocol. The filename should be RackYYR2 and the file should be compressed. The username/password for the ftp transfer should be reload/cisco. Score : 3 Point

122 On R2 service timestamps log datetime localtime msec service timestamps debug datetime localtime msec logging on logging buffered warning logging count ip ftp username reload ip ftp password cisco exception core-file RackYYR2 compress exception protocol ftp exception dump