QUESTION/SOLUTION SET LAB 5

Transcription

1 QUESTION/SOLUTION SET LAB 5

2 CCIE lab Routing & Switching (v4.0) Lab:5 Updated

3 Testing Guidelines 1. The equipment on the rack assigned to you is physically Cabled and should not be tempered with. 2. Router and Switch hostnames, basic ip addressing, no exec-timeout and passwords on the Con, AUX and VTYs have been preconfigured. Do not change these configurations. 3. All preconfigured passwords are cisco.do not change these passwords. 4. Static and default routes are not permitted unless directly stated in a question. This includes floating static routes. 5. Routers to Null generated as a result of a dynamic routing protocol solution are permitted. 6. If you need clarification on the meaning of a question, or, if you suspect hardware problems with you equipment, contact the lab proctor as soon as possible. 7. The following symbols are used throughout the exam: YY is your 2-digit rack number, for example YY value for Rack3 is 03 and for Rack11 is 11. X is your router number, for example X Value for router 1 is 1. Z is any number SW1 and SW2 refer to the Catalyst

4 IP DIAGRAM IGP DIAGRAM

5 CCIERnSLABS.COM Or

6 CCIERnSLABS.COM BGP DIAGRAM

7 CCIERnSLABS.COM IPv6 DOMAIN

8 CCIERnSLABS.COM TRUNK PORTS

9 CCIERnSLABS.COM PHYSICAL TOPOLOGY

10 CCIERnSLABS.COM CCIERNS.COM ---> QUESTION SET LAB 5 <---- 1st-August-12 SERIAL PORTS Lab 2012

11 This CCIE lab scenario is only for applicants, please do not publish it on the internet or anywhere else. General Information IOS is 12.4 Doc CD: you have access to All configuration guides and master indexes are there. Tools: notepad and calculator are available Address Allocation

12 Use class B address range YY.YY.X.0/16. YY is your rack number YY is your rack number, X is your router number Ex : IF your Rack number is 03, Lo0 is and Rack number is 07, Lo0 is

13 Loopback IP Address Hostname RackYYR1 Loopback0 interface IP Address YY.YY.1.1/32 RackYYR2 YY.YY.2.2/32 RackYYR3 YY.YY.3.3/32 RackYYR4 YY.YY.4.4/32 RackYYR5 YY.YY.5.5/32 RackYYSW1 YY.YY.6.6/32 RackYYSW2 YY.YY.7.7/32 RackYYSW3 YY.YY.8.8/32 RackYYSW4 YY.YY.9.9/32 Unless specified above, all interface else must be 24 bit mask addressing.

14 Pre-Config: R1 hostname Rack65R1 no aaa new-model memory-size iomem 10 no network-elock-participate slot 1 no network-elock-participate wic 0 ipcef multilink bundle-name authenticated archive log config hidekeys interface loopback0 ip address interface FastEthernet0/1 ip address duplex auto speed auto no shutdown interface FastEthernet0/0

15 ip address duplex auto speed auto no shutdown interface Serial0/0/0 ip address encapsulation frame-relay no shutdown interface Serial0/0/1 ip address no fair-queue no shutdown ip forward-protocol nd ip http server no ip http secure-server control-plane line con 0 exec-t imeout 0 0 password cisco line aux 0

16 line vty 0 exec-timeout 0 0 password cisco login line vty 1 4 login End

17 R2 hostname Rack65R2 boot-start-marker boot-end-marker no aaa new-model memory-size iomem 10 no network-clock-participate slot 1 no network-clock-participate wrc 0 ipcef multilink bundle-name authenticated archive log config hidekeys interface loopback0 ip address interface FastEthernet0/1 ip address no shutdown duplex auto speed auto

18 interface Serial0/0/1 ip address no fair-queue no shutdown interface FastEthernet0/0 no ip address shutdown duplex auto speed auto interface Serial0/0/0 ip address encapsulation frame-relay ip forward-protocol nd ip httpserver no ip http secure-server control-plane line con 0 exec-timeout 0 0 password cisco line aux 0

19 line vty 0 exec-timeout 0 0 password cisco login line vty 1 4 login end

20 R3 hostname Rack65R2 boot-start-marker boot-end-marker no aaa new-model memory-size iomem 10 no network-clock-participate slot 1 no network-clock-participate wrc 0 ipcef multilink bundle-name authenticated archive log config hidekeys interface loopback0 ip address interface FastEthernet0/1 ip address no shutdown duplex auto speed auto interface Serial0/0/1 ip address no fair-queue no shutdown interface FastEthernet0/0 no ip address shutdown duplex auto speed auto interface Serial0/0/0 ip address encapsulation frame-relay ip forward-protocol nd ip httpserver no ip http secure-server control-plane line con 0 exec-timeout 0 0 password cisco

21 line aux 0 line vty 0 exec-timeout 0 0 password cisco login line vty 1 4 login end

22 R4 hostname Rack65R4 boot-start-marker boot-end-marker no aaa new-model memory-size iomem 15 dot11 syslog ipcef multilink bundle-name authenticated voice-card 0 no dspfarm archive log config hidekeys interface Loopback0 ip address no sh interface FastEthernet0/0 ip address duplex auto speed auto no sh interface FastEthernet0/1 ip address duplex auto speed auto no sh interface Serial0/1/0 no ip address shutdown no fair-queue clock rate no sh interface Serial0/1/1 no ip address shutdown clock rate no sh iphttpserver no ip http secure-server control-plane

23 line con 0 exec-timeout 0 0 password cisco line aux 0 line vty 0 4 login scheduler allocate

24 R5 hostname Rack65R5 boot-start-marker boot-end-marker no aaa new-model resource policy memory-size iomem 15 ipcef voice-card 0 no dspfarm interface Loopback0 ip address interface FastEthernet0/0 ip address no shutdown duplex auto speed auto interface FastEthernet0/1 no ip address no shutdown duplex auto speed auto interface Serial0/0/0 ip address clock rate no shutdown interface Serial0/0/1 ip address clock rate no shutdown ip http server no ip http secure-server control-plane line con 0 exec-timeout 0 0 password cisco line aux 0 line vty 0 4 login scheduler allocate

25 SW1 hostname Rack65SW1 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1500 vtp domain CCIE vtp mode transparent ip subnet-zero spanning-tree mode pvst spanning-tree extend system-id vlan internal allocation policy ascending vlan 17,29,34,38,45,56,67,89,100,200,300,333,666,999 interface Loopback0 ip address interface FastEthernet2/0/1 interface FastEthernet2/0/2 interface FastEthernet2/0/3 interface FastEthernet2/0/4 interface FastEthernet2/0/5 interface FastEthernet2/0/6 interface FastEthernet2/0/7 interface FastEthernet2/0/8 interface FastEthernet2/0/9 interface FastEthernet2/0/10 interface FastEthernet2/0/11 interface FastEthernet2/0/12 interface FastEthernet2/0/13 interface FastEthernet2/0/14 interface FastEthernet2/0/15 interface FastEthernet2/0/16 interface FastEthernet2/0/17 interface FastEthernet2/0/18 interface FastEthernet2/0/19 interface FastEthernet2/0/20 interface FastEthernet2/0/21 interface FastEthernet2/0/22 interface FastEthernet2/0/23 interface FastEthernet2/0/24 interface GigabitEthernet1/0/1 interface GigabitEthernet1/0/2 interface Vlan1 no ip address

26 interface Vlan56 ip address interface Vlan67 ip address ip classless ip http server control-plane line con 0 exec-timeout 0 0 password cisco line vty 0 exec-t imeout 0 0 password cisco login line vty 1 4 login line vty 5 15 login end

27 SW2 hostname Rack65SW2 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1500 vtp domain CCIE vtp mode transparent spanning-tree mode pvst spanning-tree extend system-id vlan internal allocation policy ascending vlan 17,29,34,38,45,56,67,89,100,200,300,333,666,999 interface Loopback0 ip address interface FastEthernet1/0/1 interface FastEthernet1/0/2 interface FastEthernet1/0/3 interface FastEthernet1/0/4 interface FastEthernet1/0/5 interface FastEthernet1/0/6 interface FastEthernet1/0/7 interface FastEthernet1/0/8 interface FastEthernet1/0/9 interface FastEthernet1/0/10 interface FastEthernet1/0/11 interface FastEthernet1/0/12 interface FastEthernet1/0/13 interface FastEthernet1/0/14 interface FastEthernet1/0/15 interface FastEthernet1/0/16 interface FastEthernet1/0/17 interface FastEthernet1/0/18 interface FastEthernet1/0/19 interface FastEthernet1/0/20 interface FastEthernet1/0/21 interface FastEthernet1/0/22 interface FastEthernet1/0/23 interface FastEthernet1/0/24 interface GigabitEthernet0/1 interface GigabitEthernet0/2 interface Vlan1 no ip address interface Vlan17 ip address interface Vlan67 ip address

28 ip classless ip http server ip http secure-server control-plane line con 0 exec-timeout 0 0 password cisco line vty 0 4 login line vty 5 15 login end

29 SW3 hostname Rack65SW3 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1500 vtp domain CCIE vtp mode transparent ip subnet-zero spanning-tree mode pvst spanning-t ree extend system-id vlan internal allocation policy ascending vlan 17,29,34,38,45,56,67,89,100,200,300,333,666,999 interface loopback0 ip address interface FastEthernet1/0/1 interface FastEthernet1/0/2 interface FastEthernet1/0/3 interface FastEthernet1/0/4 interface FastEthernet1/0/5 interface FastEthernet1/0/6 interface FastEthernet1/0/7 interface FastEthernet1/0/8 interface FastEthernet1/0/9 interface FastEthernet1/0/10 interface FastEthernet1/0/11 interface FastEthernet1/0/12 interface FastEthernet1/0/13 interface FastEthernet1/0/14 interface FastEthernet1/0/15 interface FastEthernet1/0/16 interface FastEthernet1/0/17 interface FastEthernet1/0/18 interface FastEthernet1/0/19 interface FastEthernet1/0/20 interface FastEthernet1/0/21 interface FastEthernet1/0/22 interface FastEthernet1/0/23 interface FastEthernet1/0/24 interface GigabitEthernet0/1 interface GigabitEthernet0/2 interface Vlan1 no ip address interface Vlan38 ip address

30 interface Vlan89 ip address interface Vlan300 ip address ip classless iphttpserver ip http secure-server control-plane line con 0 exec-timeout 0 0 password cisco line vty 0 exec-timeout 0 0 password cisco login line vty 1 4 login line vty 5 15 login end

31 SW4 hostname Rack65SW4 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1500 vtp domain CCIE vtp mode transparent ip subnet-zero spanning-tree mode pvst spanning-tree extend system-id vlan internal allocation policy ascending vlan 17,29,34,38,45,56,67,89,100,200,300,333,666,999 interface Loopback0 ip address interface FastEthernet0/1 interface FastEthernet0/2 interface FastEthernet0/3 interface FastEthernet0/4 interface FastEthernet0/5 interface FastEthernet0/6 interface FastEthernet0/7 interface FastEthernet0/8 interface FastEthernet0/9 interface FastEthernet0/10 interface FastEthernet0/11 interface FastEthernet0/12 interface FastEthernet0/13 interface FastEthernet0/14 interface FastEthernet0/15 interface FastEthernet0/16 interface FastEthernet0/17 interface FastEthernet0/18 interface FastEthernet0/19 interface FastEthernet0/20 interface FastEthernet0/21 interface FastEthernet0/22 interface FastEthernet0/23 interface FastEthernet0/24 interface GigabitEthernet0/1 interface GigabitEthernet0/2 interface Vlan1 no ip address

32 interface Vlan29 ip address interface Vlan89 ip address ip classless iphttpserver ip http secure-server control-plane line con 0 exec-timeout 0 0 password cisco line vty 0 exec-t imeout 0 0 password cisco login line vty 1 4 login line vty 5 15 login end

33 BB1 hostname BB1 memory-size iomem 15 ip subnet-zero ip cef no ip domain-lookup interface Loopback100 description RIP Networks ip address no ip directed-broadcast interface Loopback197 description BGP Networks ip address secondary ip address secondary ip address secondary ip address secondary ip address no ip directed-broadcast interface Loopback199 description RIP Networks ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address no ip directed-broadcast interface Ethernet0/0 ip address description ### I AM BB1 ### no ip directed-broadcast half-duplex interface Serial0/0 no ip address

34 no ip directed-broadcast shutdown interface Serial0/1 no ip address no ip directed-broadcast shutdown router rip version 2 network network network network network network network network network network network network network network network network network network no auto-summary router bgp 254 no synchronization bgp log-neighbor-changes network network network network network neighbor remote-as 65 neighbor ebgp-multihop 5 neighbor remote-as 1 neighbor remote-as 2 neighbor route-map LONGER_AS out neighbor remote-as 1 neighbor route-map LONGER_AS out neighbor remote-as 4 neighbor route-map LONGER_AS out neighbor remote-as 5 neighbor route-map LONGER_AS out neighbor remote-as 7 neighbor route-map LONGER_AS out neighbor remote-as 10 neighbor route-map LONGER_AS out neighbor remote-as 11 neighbor route-map LONGER_AS out neighbor remote-as 12 neighbor route-map LONGER_AS out neighbor remote-as 13

35 neighbor route-map LONGER_AS out neighbor remote-as 14 neighbor route-map LONGER_AS out neighbor remote-as 15 neighbor route-map LONGER_AS out neighbor remote-as 16 neighbor route-map LONGER_AS out neighbor remote-as 17 neighbor route-map LONGER_AS out neighbor remote-as 18 neighbor route-map LONGER_AS out neighbor remote-as 19 neighbor ebgp-multihop 15 neighbor route-map LONGER_AS out neighbor remote-as 21 neighbor route-map LONGER_AS out neighbor remote-as 24 neighbor route-map LONGER_AS out neighbor remote-as 65 neighbor remote-as 67 neighbor route-map LONGER_AS out no auto-summary ip classless ip route ip route ip route no ip http server ip bgp-community new-format ip as-path access-list 1 permit ^$ route-map LONGER_AS permit 10 match as-path 1 set as-path prepend 253 tftp-server flash:c2600-i-mz xk1 line con 0 exec-timeout 0 0 logging synchronous transport input none line aux 0 line vty 0 4 password cisco login scheduler allocate end

36 BB2 hostname BB2 memory-size iomem 10 ip subnet-zero interface Loopback197 description *** BGP *** ip address secondary ip address secondary ip address secondary ip address secondary ip address interface Ethernet0/0 description ### I AM BB2 ### ip address half-duplex interface Serial0/0 no ip address no ip mroute-cache shutdown no fair-queue interface Serial0/1 no ip address shutdown router bgp 254 no synchronization bgp log-neighbor-changes network network network network network neighbor remote-as 65 neighbor ebgp-multihop 5 neighbor remote-as 1 neighbor remote-as 2 neighbor remote-as 3 neighbor remote-as 4 neighbor remote-as 5 neighbor remote-as 7 neighbor remote-as 8 neighbor remote-as 11 neighbor remote-as 12 neighbor remote-as 13 neighbor remote-as 14 neighbor remote-as 15

37 neighbor remote-as 16 neighbor remote-as 17 neighbor remote-as 18 neighbor remote-as 19 neighbor remote-as 37 neighbor remote-as 65 no auto-summary ip classless ip route ip route ip http server ip bgp-community new-format dial-peer cor custom gatekeeper shutdown line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 password cisco login end BB2#

38 BB3 hostname BB3 ip subnet-zero interface Loopback4 description EIGRP NETWORK ip address no ip directed-broadcast interface Loopback128 description EIGRP NETWORK ip address secondary ip address no ip directed-broadcast interface Loopback198 description EIGRP NETWORK ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address secondary ip address no ip directed-broadcast interface Ethernet0/0 description ### I AM BB3 ### ip address no ip directed-broadcast half-duplex router eigrp 100 redistribute connected network no auto-summary ip classless ip http server line con 0 transport input none line aux 0 line vty 0 4 login end

39

40 SECTION I. Layer 2 Technologies 1.1 Troubleshoot Layer 2 Switching A few faults have been injected into the pre-configurations just described, These issues may impede a working solution for certain portions of this labs exam and affect any labs exam section. You must verify that all of your configurations work as expected, if something is not working as expected then you must fix the underlying problem. Point will be awarded for solving each problem. However, if you fail to solve a particular problem, and the injected fault prevents you from having a working solutions of this lab, then you will lose points for the fault and the scenario that is not working Score : Solve one fault 2point, solve two fault 4point

41 SOLUTION: 1) Guard root on SW1 trunk ports is configured in the pre-configuration. On SW1-3 interface f0/65-24 spanning-tree gaurd root 2) ARP inspection on Vlan17 on SW2 On SW2 ip arp inspection vlan 17 3) Portfast trunk on f0/65-24 of SW4 On SW4 interface f0/65-24 spanning-tree portfast trunk 4) Root Gaurd on interfaces connected to Backbones. On SW1-4 interface f0/10 spanning-tree gaurd root 5) Difference in VTP domain name,version and password Note : VTP version 2 is pre-configured on SW1 as Server the other switches are preconfigured with VTP version 1 as Client Mode this product belong to cciernslabs. com. 6) IP cef and IPv6 cef disabled on few routers

42 1.2 Implement Access Switch Ports of Switched Network Configure all of the appropriate non-trunking switch ports on SW1-SW4 according to the following requirement VTP domain name should be "CCIE". VTP mode on all switches should be configures to transparent mode. Configure the VLAN ID and Name according to the table below(case Sensitive) Configure the access ports for each VLAN as per the Diagram VLAN TABLE Vlan ID VLAN NAME Vlan17 VLAN_17_R1-SW2 Vlan29 VLAN_29_R2_SW4 Vlan34 VLAN_34 Vlan38 VLAN_38_R3-SW3 Vlan45 VLAN_45 Vlan56 VLAN_56_R5-SW1 Vlan67 VLAN_67_SW1-SW2 Vlan89 VLAN_89_SW3-SW4 Vlan100 VLAN_BB1 Vlan200 VLAN_BB2 Vlan300 VLAN_BB3 Vlan333 VLAN_Customer Vlan666 VLAN_Carrier Vlan999 VLAN_NATIVE Configure the switches according to the following requirements SOLUTION: On SW1-4 vtp domain CCIE vtp mode transparent

43 vtp version 2 vtp password cisco vlan 17 name VLAN_17_R1-SW2 vlan 29 name VLAN_29_R2-SW4 vlan 34 name VLAN_34 vlan 38 name VLAN_38_R3-SW3 vlan 45 name VLAN_45 vlan 56 name VLAN_56_R5-SW1 vlan 67 name VLAN_67_SW1-SW2 vlan x name fake vlan this product is of cciernslabs vlan 89 name VLAN_89_SW3-SW4 vlan 100 name VLAN_BB1 vlan 200 name VLAN_BB2 vlan 300 name VLAN_BB3 vlan 333 name VLAN_Customer

44 vlan 500 name USERS // Required for HSRP & Time Based ACL vlan 666 name VLAN_Carrier vlan 999 name VLAN_NATIVE On SW1 int fa1/0/1 switchport access vlan 17 switchport mode access int fa1/0/2 switchport access vlan 29 switchport mode access int fa1/0/3 switchport access vlan 38 switchport mode access int fa1/0/4 switchport access vlan 45 switchport mode access int fa1/0/5 switchport access vlan 56 switchport mode access int fa1/0/10 switchport access vlan 100 switchport mode access int rang fa1/0/6-9, fa1/0/11-18 switchport access vlan 999 switchport mode access shutdown this pro d uct is of ccier nsl abs. co m

45 int vl 56 ip add int vl 67 ip add On SW2 int fa1/0/1 switchport access vlan 100 switchport mode access int fa1/0/2 switchport access vlan 200 switchport mode access int fa1/0/3 switchport access vlan 34 switchport mode access int fa1/0/4 switchport access vlan 34 switchport mode access int fa1/0/5 switchport access vlan 45 switchport mode access int fa1/0/10 switchport access vlan 200 switchport mode access int rang fa1/0/6-9, fa1/0/11-18 switchport access vlan 999 switchport mode access shut int vl 17 ip add

46 int vl 67 ip add On SW3 int fa1/0/10 switchport access vlan 300 switchport mode access int rang fa1/0/1-9, fa1/0/11-18 switchport access vlan 999 switchport mode access sh int vl 38 ip add int vl 89 ip add int vl 300 ip add On SW4 int rang fa1/0/1-9, fa1/0/11-18 switchport access vlan 999 switchport mode access sh int vl 29 ip add

47 int vl 89 ip add

48 1.3 Spanning-tree Configuration Configure the switches according to the following requirement Each of the following sets of VLAN must share a common Spanning-Tree topology Spanning-Tree Topology 1: all odd VLANs used throughout your exam Spanning-Tree Topology 2: all even VLANs used throughout your exam Spanning-Tree Topology 3: all other VLANs: Use domain name as cisco Ensure SW1 is root switch for Instance 1 and backup root switch for instance 2. Ensure SW2 is root switch for Instance 2 and backup root switch for instance 1 Configure native vlan to vlan 999. Ensure that it is tagged. All unused ports should be administratively shutdown and defined as access ports on VLAN 999 SOLUTION: Configure native vlan to vlan 999. Ensure that it is tagged. All unused ports should be administratively shutdown and defined as access ports on VLAN 999 On SW1-4 vlan 999 native-vlan exit vlan dot1q tag native t h is pr od uct is of cc i ernsla bs.c om

49 Interface range f1/0/6-9,f1/0/11-18 switchport access vlan 999 switchport mode access shutdown exit Spanning-Tree Topology 1: all odd VLANs used throughout your exam Spanning-Tree Topology 2: all even VLANs used throughout your exam Spanning-Tree Topology 3: all other VLANs: Use domain name as cisco On SW1-4 spanning-tree mode mst spanning-tree extend system-id spanning-tree mst configuration name cisco revision 1 instance 1 vlan 17, 29, 45, 67, 89,333,999 instance 2 vlan 34, 38, 56, 100, 200, 300,666 instance 3 vlan 1-16, 18-28, 30-33, 35-37, 39-44, 46-55, 57-66, , , , , , ,

50 Ensure SW1 is root switch for Instance 1 and backup root switch for instance 2. Ensure SW2 is root switch for Instance 2 and backup root switch for instance 1 Ensure SW1 is root switch for Instance 3 and SW2 is backup root switch for Instance 3 On SW1 spanning-tree mst 1 root primary spanning-tree mst 2 root secondary On SW2 spanning-tree mst 1 root secondary spanning-tree mst 2 root primary Ensure SW1 is root switch for Instance 3 and SW2 is backup root switch for Instance 3 On SW1 spanning-tree mst 3 root primary On SW2 spanning-tree mst 3 root secondary

51 1.4 Switch Trunking and Etherchannel Configuration Refer to Trunk ports diagram. Configure the dual trunk ports between sw1,sw2,sw3 and sw4 according to the following requirements: Use encapsulation 802.1Q Disable DTP on the six distribution ports for each switch.the native VLAN is 999. Configure an 802.3ad 200Mbps etherchannel between sw1 and sw2. SW2 should not actively start it Etherchannel load balancing should be accomplished by source and destination MAC address In future,if more links(ports)are added to the bundle, make sure that interface Fa0/24 is always closen first for traffic flow along with the channel SOLUTION: On SW1-4 Interface range f1/0/65 24 switchport trunk encapsulation dot1q switchport trunk native vlan 999 switchport mode trunk switchport nonegotiate On SW1 Interface range f1/0/23 24 channel-group 12 mode active port-channel this pr od u ct is o f cc ier n sl abs. c o m load-balancing src-dst-mac

52 On SW2 Interface range f1/0/23 24 channel-group 12 mode passive port-channel load-balancing src-dst-mac On SW1 interface FastEthernet1/0/24 lacp port-priority 1 end On SW2 interface FastEthernet1/0/24 lacp port-priority 1 end

53 VERIFICATION:

54 Q Tunneling or Etherchannel over 802.1Q tunneling Configure the 802.1Q tunneling on all switches according to the following requirements: A dot1q tunnel needs to be configured from SW1 to SW2 via one of their trunk ports F0/65. Configure VLAN 333 for Customer VLAN on SW1 and SW2. VLAN 333 should be configured on both SW1 and SW2 with IP address of YY.YY.100.6/24 on SW1 and YY.YY.100.7/24 on SW2 for VLAN 333. Configure VLAN 666 for Carrier VLAN for this dot1q tunnel on SW3 and sw4. Ensure that SW1 and SW2 should be seen as directly connected CDP neighbor across dot1q tunnel and can ping each other. You are NOT allowed to change priority or cost on any switches. SOLUTION: On SW1 no vlan 666 spanning-tree mst configuration instance 1 add vlan 333 exit vlan 333 name Customer interface Vlan333 ip address

55 On SW2 no vlan 666 spanning-t this pro du ct is of cci ern s l a bs.com ree mst configuration instance 1 add vlan 333 exit vlan 333 name Customer interface Vlan333 ip address On SW3 system mtu 1504 no vlan 333 spanning-tree mst configuration instance 2 add vlan 666 exit vlan 666 name Carrier

56 interface FastEthernet1/0/65 switchport access vlan 666 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp no cdp enable exit On SW4 system mtu 1504 no vlan 333 spanning-tree mst configuration instance 2 add vlan 666 exit vlan 666 name carrier interface FastEthernet1/0/65 switchport access vlan 666

57 switchport mode dot1q-tunnel l2protocol-tunnel thi s pro du ct I s of cc I er nsl Abs, c0m cdp l2protocol-tunnel stp no cdp enable VERIFICATION:

58 1.6 PPP over Ethernet Configure R4 as the PPPoE Server and R3 as the PPPoE Client The link must be up even if there is no traffic at all Ensure R4 always gets the same IP address YY.YY.34.4 from server You are not allowed to use DHCP Ensure no interleaving in PPPOE / Ensure that there is no unnecessary ppp fragmentation on the PPPoE link R4 must use PPP CHAP tp authenticate with the server. You can make use of R4 hostname as CHAP username and CISCO as password Make Sure that all CHAP password are shown in clear in all the configurations. SOLUTION: On R3 username Rack65R4 password CISCO interface FastEthernet0/1 ip address pppoe enable group CISCO no shut exit bba-group pppoe CISCO virtual-template 1 no sh exit interface Virtual-Template1 mtu 1492 ip unnumbered FastEthernet0/1 peer default ip address pool PPPOE ppp authentication chap ip ospf mtu-ignore exit ip local pool PPPOE

59 On R4 interface FastEthernet0/1 pppoe enable group CISCO pppoe-client dial-pool-number 1 exit interface Dialer1 ip ospf mtu-ignore mtu 1492 ip address negotiated encapsulation ppp dialer pool 1 dialer persistent dialer-group 1 ppp authentication chap th1s product 1s of cc1ernslabs,c0m callin ppp chap password CISCO exit dialer-list 1 protocol ip permit

60 1.7 Implement Frame Relay Use the following requirements to configure R1 and R2 for Frame-Relay use static frame relay maps with the broadcast capability Do not use dynamic ARP mapping / Do not make use of frame-relay inverse-arp Do not change anything in the frame-relay switch (R4) Use RFC1490/RFC2427 encapsulation / Use IETF encapsulation. Use the DLCI assignments from the table below Use the IP addressing as shown in IP diagram and use the largest subnet mask (meaning the least number of hosts in the subnet) R1 and R2 must be able to ping self interface IP address as well as each other IP addresses Configure administrative bandwidth on R1 and R2 for Frame-Relay interfaces to 50000Kbps R1 S0/0/0 FR Switch 0/0/0 102 R2 S0/0/0 FR Switch 0/0/1 201 SOLUTION: On R4 // PRE-CONFIGURED interface s0/0/0 no ip address encapsulation frame-relay IETF frame-relay lmi-type ansi frame-relay intf-type dce frame-relay route 102 interface s0/0/1 201 interface s0/0/1 no ip address encapsulation frame-relay IETF frame-relay lmi-type ansi frame-relay intf-type dce frame-relay route 201 interface s0/0/0 102

61 On R1 int s0/0/0 band ip add encap frame-relay ietf frame-re map ip frame-re map ip broadcast no frame- relay inverse-arp no shutdown On R2 int s0/0/0 band ip add encap frame-relay ietf frame-re map ip broadcast frame-re map ip no frame- relay inverse-arp no shutdown

62 Section II: Layer 3 technologies After finishing each of the following questions, make sure that all configured interfaces and subnets are consistently visible on all pertinent routers and switches. Do not redistribute between any IGP and BGP if not explicitly required. If not explicitly stated otherwise, you need to ping a BGP route only if it is stated in a question; otherwise, the route should be only in the BGP table. At the end of this section, all subnets in your topology, including the loopback interfaces must be reachable via ping from anywhere in your topology. The backbone interfaces must be reachable only if they are part of the solution to a question. The loopback interfaces must be seen as a host route /32 in the routing tables unless stated otherwise in a question.

63 2.1 Implement IPv4 OSPF Configure OSPF area 0, 1, 2 as per IGP topology diagram and the following requirements The OSPF process ID can be any number OSPF router-id must be stable and must be configured using the IP address of interface Loopback 0 All Loopback interfaces should be advertised in the relevant OSPF area as shown in the IGP topology diagram and must appear as /32 host routes Updates should be advertised only out of the interfaces that indicated in the IGP topology diagram Make sure that all three prefixes for the backbone links ( 150.BB.YY.0/24 ) appear as OSPF external type 2 routes in R4's routing table. Ensure that OSPF neighborship should be established between R1 and R2 without changing the frame-relay network type. Ensure that R4 can still reach all OSPF networks via R3 in case R1 or R5 goes down Do not create additional OSPF areas Do not use any IP address not listed in diagram SOLUTION: On R1 router ospf 1 router-id area 1 virtual-link network area 0 network area 0 network area 0 network area 1 neighbor // Bcoz link between R1 and R2 is NBMA POINT-TO_POINT LINK redistribute connected subnets route-map BB1 exit route-map BB1 permit 10 match interface FastEthernet0/1

64 On R2 router ospf 1 router-id network area 1 network th 1s p r odu ct is of cc ierrnslabs,c0m area 1 network area 1 neighbor redistribute connected subnets route-map BB2 exit route-map BB2 permit 10 match interface FastEthernet0/1 // Bcoz link between R1 and R2 is NBMA POINT-TO_POINT LINK On R3 router ospf 1 router-id area 1 virtual-link area 1 virtual-link network area 1 network area 1 network area 1 network area 2 On R4 router ospf 1 router-id network area 2 network area 2 On R5 router ospf 1 router-id area 1 virtual-link

65 network area 0 network area 0 network area 0 network area 1 On SW1 ip routing router ospf 1 router-id network area 0 network area 0 network area 0 On SW2 ip routing router ospf 1 router-id network area 0 network area 0 network area 0

66 2.2 Implement IPv4 EIGRP Configure EIGRP 100 and EIGRP YY as per the diagram Backbone 3 has the ip address YY.254 and is using AS number 100. EIGPR updates sh Th1s product is of c cie Rnslabs,c0M ould be advertised only out to the interface per the IGP Topology diagram. On SW3, redistribute from EIGRP 100 into EIGRP YY. Do not use auto-summary for any EIGRP process. SOLUTION: On SW3 ip routing router eigrp 65 net net net redist eigrp 100 no auto-summary router eigrp 100 net no auto-summary On SW4 ip routing router eigrp 65 net net net no auto-summary

67 On R2 router eigrp 65 net no auto-summary On R3 router eigrp 65 net no auto-summary

68 2.3 RIPv2 Configure Rip version 2 as per topology RIP update must be advertised only out interfaces per IGP Topology diagram. All Rip updates must be unicast only Do Not use automatic summarization SOLUTION: On R4 router rip vers 2 net no auto-sum neighbor passive-int default no passive-int f0/0 On R5 router rip vers 2 net no auto-sum net neighbor passive-int default no passive-int f0/1 Note : - You can see n/w a th1s pr0d uct is o f cc1ern sla bs,c0m s rip route at R5

69 2.4 Redistribution between OSPF and RIPv2 Redistribute OSPF into RIP in R5 Ensure that R4 should access SW1 loopback0 via R5, but all other routers should go via R3. SOLUTION: On R4 router rip distance exit // Distance 109 means less than AD value of OSPF access-list 1 permit On R5 router rip redistribute ospf 1 metric 10

70 2.5 Redistribute OSFP and EIGRP Redistribute mutually between OSPF and EIGRP YY on R2 and R3 On R2 and R3, ensure that all prefix learnt from OSPF should be seen as OSPF and that learnt from EIGRP 100 should be seen as EIGRP External routes (D EX). No default route should be seen in this network You are not allowed to use any access-lists, prefix-lists or AD value to accomplish this requirement. SOLUTION: On R2 and R3 (Config for this section would be same on both router s) First redistributing EIGRP in Ospf router ospf 1 redist eigrp 65 sub route-map EigrpOspf distribute-list route-map NO_EIGRP_100 in // For blocking EIGRP routes with Tag 100 route-map EigrpOspf per 10 match source-protocol eigrp 65 match route-type external set tag 100 route-map EigrpOspf per 20 route-map NO_EIGRP_100 deny 10 // For blocking EIGRP routes with Tag 100 match tag 100 route-map NO_EIGRP_100 permit 20

71 Secondly redistributing Ospf in Eigrp router eigrp 65 redist ospf 1 metric route-map OspfEigrp distribute-list route-map NO_OSPF in // For blocking OSPF routes with Tag 200 route-map OspfEigrp permit 10 match source-protocol ospf 1 set tag 200 route-map OspfEigrp permit 20 route-map NO_OSPF deny 10 // For blocking OSPF routes with Tag 200 match tag 200 route-map NO_OSPF permit 20

72 2.6 Implement IPv4 ibgp Configure ibgp between R1, R2, R3 and R5 according to the following requirement Where possible failure of a physical interface should not permanently affect BGP peer connections Configure R3 as route-reflector. Minimize the number of BGP peering sessions and all BGP speakers in AS YY You are not allowed to use BGP next-hop self anywhere and BGP peer groups. SOLUTION: On R1 router bgp 65 neigh remote-as 65 neigh update-source lo0 neigh send-community no sync no auto-summary On R2 router bgp 65 neigh remote-as 65 neigh update-source lo0 this pr od u ct is o f cc ier n sl abs. c 0 m neigh send-community no sync no auto-summary On R5 router bgp 65 neigh remote-as 65 neigh update-source lo0 neigh send-community no sync no auto-summary

73 On R3 router bgp 65 neigh remote-as 65 neigh update-source lo0 neigh send-community neigh route-reflector-client neigh remote-as 65 neigh update-source lo0 neigh send-community neigh route-reflector-client neigh remote-as 65 neigh update-source lo0 neigh send-community neigh route-reflector-client no sync no auto-summary

74 2.7 Implement IPv4 ebgp Configure ebgp on R1 and R2 according to the following requirement R1 should be ebgp peers with the router YY.254 on Backbone1 AS 254 R2 should be ebgp peers with the router YY.254 on Backbone2 AS 254 Use only the loopback0 IP addresses to propagate BGP route information within your BGP domain. No IGP routes should be advertised to AS 254 maximum 5 prefix is allowed otherwise it should generate a message SOLUTION: On R1 router bgp 65 neighbor remote-as 254 neighbor maximum-prefix 5 warning-only neighbor update-source lo0 On R2 router bgp 65 neighbor remote-as 254 neighbor maximum-prefix 5 warning-only neighbor update-source lo0

75 2.8 Advanced BGP (Doubt on Solution) Configure BGP path selection as following requirements The routes from BGP AS 254 should be redistribute into OSPF area YY on R1 and R2 R1 should prefer the path pointing to BB1 AS 254. when failed, fall back to BGP best path selection based on Internal vs External Criteria R3 should prefer the path through R1 for BGP AS 254 prefixs. This changes should not impact any other BGP peer routers You are not allowed to change following BGP attributes such as AS-Path, Local Preference on R1 and R2 to accomplish this task You are allowed to change the ospf cost of only on one interface of any router. R4 should prefer R2 as exit point for AS 254 R4 should be able to ping a prefix learnt from BGP AS 254 or R4 should able to ping from AS254 with path to R1 You are allowed to change only R1 and R3 to accomplish this task SOLUTION: Rack65R4#ping Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:... Success rate is 0 percent (0/5) On R1 router ospf 1 redist bgp 65 subnets // Violating the general guidelines for Section 2 IP routing router bgp 65 bgp bestpath as-path ignore On R2 router ospf 1 redist bgp 65 subnets

76 On R3 int s0/1 ip ospf cost 1000 ****************************************************** ******************************************************

77 2.8 Advanced BGP (Other Question) Configure BGP path selection as following requirements R3 should prefer the path through R1 to BB1 for reaching AS 254. This configuration should not affect any other routers in AS YY getting to BGP AS 254 You are not allowed to change BGP attributes Weight, AS-Path or Local Preference on R4 and R5 to accomplish this task You are allowed to change the ospf cost of only one interface. You are allowed to change only R1 and R3 to accomplish this task R4 should prefer R1 as exit point for reaching AS 254 R4 should ping a prefix network in learned from BGP AS254 SOLUTION: (PENDING)

78 2.9 Implement IPv6 addressing The administrator has started to configure Global unicast IPv6 addresses in your network according to the Diagram 3 IPv6 Routing Configure Global unicast IP's on every interface on R1, R5, SW1 and SW2 including loopback 0. Use /64 for physical interface and /128 for loopback interface. Ensure that all routes and switches can ping each other using IPv6 Configure IPv6 address Number as follow (YY - Rack number, HH - interface ipv4 3rd octet, ZZ - interface ipv4 4th octet Interfaces :YY:HH::ZZ/64 Loopbacks :YY:HH::ZZ/ Implement IPv6 OSPF v3 Routing Continue configuring IPv6 OSPFv3 according to the Ipv6 Diagram as per the following requirement: The Process ID is 2001 OSPFv3 router IDs must be stable and identical to the OSPFv2 router IDs Ensure that periodic Router Advertisements should be disabled on the IPv6 enabled interfaces Do no create any additional OSPFv3 areas Ensure that all IPv6 networks on all routes and switches can ping each other using IPv6. SOLUTION: On R1 ipv6 unicast-rout ipv6 router ospf 2001 router-id int lo0 ipv6 add 2001:65:1::1/128 ipv6 nd ra suppress // Ensure that periodic Router Advertisements should be disabled on the IPv6 enabled interfaces ipv6 ospf 2001 area 0

79 int fa0/0 ipv6 add 2001:65:17::1/64 ipv6 nd ra suppress ipv6 ospf 2001 area 0 ipv6 ospf mtu-ignore int s0/0/1 ipv6 add 2001:65:15::1/64 ipv6 nd ra th1s pr od u ct is 0f cc ier n sl abs. c0msuppress ipv6 ospf 2001 area 0 On R5 ipv6 unicast-rout ipv6 router ospf 2001 router-id int lo0 ipv6 add 2001:65:5::5/128 ipv6 nd ra suppress ipv6 ospf 2001 area 0 int fa0/0 ipv6 add 2001:65:56::5/64 ipv6 nd ra suppress ipv6 ospf 2001 area 0 ipv6 ospf mtu-ignore int s0/0/0 ipv6 add 2001:65:15::5/64 ipv6 nd ra suppress ipv6 ospf 2001 area 0 On SW1 sdm pref dual-ipv4-and-ipv6 def ipv6 unicast-rout ipv6 router ospf 2001 router-id

80 int lo0 ipv6 add 2001:65:6::6/128 ipv6 nd suppress-ra ipv6 ospf 2001 area 0 int vl 56 ipv6 add 2001:65:56::6/64 ipv6 nth1s pr od u ct is 0f cc ier n sl abs. c0md suppress-ra ipv6 ospf 2001 area 0 int vl 67 ipv6 add 2001:65:67::6/64 ipv6 nd suppress-ra ipv6 ospf 2001 area 0 On SW2 sdm pref dual-ipv4-and-ipv6 def ipv6 unicast-rout ipv6 router ospf 2001 router-id int lo0 ipv6 add 2001:65:7::7/128 ipv6 nd suppress-ra ipv6 ospf 2001 area 0 int vl 17 ipv6 add 2001:65:17::7/64 ipv6 nd suppress-ra ipv6 ospf 2001 area 0 int vl 67 ipv6 add 2001:65:67::7/64 ipv6 nd suppress-ra ipv6 ospf 2001 area 0

81 2.11 Implement Advanced IPv6 Authenticate the OSPFv3 between R1 and R5 according to the following requirement: Use the authentication type with MD5 with following key string ABCDEF ABCDEF You are not allowed to use any commands under the router configuration mode to accomplish this task. SOLUTION: On R1 int s0/0/1 ipv6 ospf authentication ipsec spi 300 md ABCDEF ABCDEF On R5 int s0/0/0 ipv6 ospf authen th1s pr od u ct is 0f cc ier n sl abs. c0m tication ipsec spi 300 md ABCDEF ABCDEF

82 Section III: IP Multicast 3.1 Implement IPv4 Multicast -1 Configure IPv4 Multicast Routing between R3 Serial 0/0/0 and R5 Serial 0/0/1 according to the following requirements Do not user any RP Interfaces Loopback 0 of R3 video server simulated in R5 client Multicast is sourced from on Loopback 0 R3 and receiver was R5 FastEthernet 0/0 ( ) Ensure that unnecessary flooding/pruning does not occur Ensure that only R3-loopback0 (YY.YY.3.3) is allowed to send multicast SOLUTION: On R3 ip multicast-routing ip pim ssm range 53 access-lis 53 per access-lis 3 per access-lis 3 per // Not Required // Not Required // Not Required // Not Required int lo0 ip pim sparse-mode int s0/0/0 ip pim sparse-mode

83 On R5 ip multicast-routing ip pim ssm range 53 access-lis 53 per access-lis 53 per access-lis 53 per int s0/0/1 ip pim sparse-mode int f0/0 ip pim sparse-mode ip igmp join-group source ip igmp ver 3 // Bcoz SSM work s only on IGMP Ver 3

84 3.2 Implement IPv4 Multicast 2 In near future others users in R5 are planning to join and These users will use IGMP v2. Ensure that these users can only access the two multicast streams. SOLUTION: On R3 no ip igmp ssm-map query dns On R5 ip igmp-ssm map enable ip igmp-ssm map static no ip igmp ssm-map query dns access-lis 35 per access-lis 35 per int f0/0 ip igmp static-group source ssm-map ip igmp static-group source ssm-map // Ver 2 config // Ver 2 config

85 Section IV Advanced Services 4.1 Implement RIPv2 Authentication Secure the RIP domain according to the following requirement: Complete RIP authentication between R4 and R5 The key chain for RIP authentication is pre-configured on R4. The password must be saved in clear in the config and must be see to cisco in show run command (without quotes) on R5. You are NOT allowed to modify key chain pre-configured on R4 Note: The key chain pre-configured can be found using show key-chain RIP on R4. SOLUTION: On R4 RackYYR4#sh key chain RIP This command wil show the pre-configured key chain on R4 int f0/0 ip rip authentication key-chain RIP ip rip authentication mode md5 On R5 no service password-encryption key chain RIP key 1 key-string cisco // Password cisco is stated in the question itself int f0/1 ip rip authentication th1s pr od u ct is 0f cc ier n sl abs. c0m key-chain RIP ip rip authentication mode md5

86 4.2 Implement Zone Based Firewall Configure Zone Based Firewall (ZBF) on R1 using the Exact naming convention as following output. Make sure that when you input the show command, it must show the same output.

87 SOLUTION: Note: - Policy-maps,class-maps and zone-pair s are case sensitive On R1 class-map type inspect match-all A_B match proto icmp policy-map type inspect A_B class type inspect A_B pass class class-default pass zone sec A zone sec B zone-pair sec A_B source A dest B service-policy type inspect A_B zone-pair sec B_A source B dest A service-policy type inspect A_B int f0/0 zone-member sec A int f0/1 zone-member sec B int s0/0/1 zone-member sec A int s0/0/0 zone-member sec A

88 4.3 Private VLAN / LAYER 2 SECURITY Configure Private VLAN on SW1 and SW2 according to following Requirement: Configure vlan 45 as primary VLAN Ensure That port Fa0/6 on SW1 should be able to communicate with same port on SW2 only each other, no other in VLAN can communicate with these Ports Ensure that port fa0/7 on SW1 should Not be able to communicate with same port on SW2 each other. No other in VLAN can communicate with these port. Ensure that port fa0/8 on SW1 Should be able to communicate with all others on VLAN 45 and it is acted as gateway to internet. You are allowed to add Vlan to accomplish this task. Or Configure Private VLAN according to the following requirement R4 and R5 should be able to communicate only with each other in vlan 45. No other host is allowed to communicate with them in vlan 45. Hosts connected to port fa0/6 on SW1 and SW2 should be a part of vlan 45, and should only communicate with each other. Must not be able to communicate with any other host in vlan 45. Hosts connected to port fa0/7 on SW1 and SW2 should not be able to communicate with any host. SW1 fa0/8 as promiscuous port Use only odd vlans ranging from 334-some vlan, if you need to create new vlans.

89 SOLUTION: On SW1/SW2/SW3/SW4 instance 1 add vlan 335, 337, 339 vlan 335 private-vlan community vlan 337 private-vlan community vlan 339 private-vlan isolated vlan 45 private-vlan primary private-vlan association 335,337,339 On SW1 interface fastethernet 0/4 no switchport access vlan 45 switchport private-vlan host-association switchport mode private-vlan host no shutdown interface Fastethernet 0/6 no switchport access vlan 999 switchport private-vlan host-association switchport mode private-vlan host no shutdown interface Fastethernet 0/7 no switchport access vlan 999 switchport private-vlan host-association switchport mode private-vlan host no shutdown interface Fastethernet 0/8 no switchport access vlan 999 switchport private-vlan mapping ,337,339

90 switchport mode private-vlan promiscuous no shutdown On SW2 interface Fastethernet 0/5 no switchport access vlan 45 switchport private-vlan host-association switchport mode private-vlan host no shutdown interface Fastethernet 0/6 no switchport access vlan 999 switchport private-vlan host-association switchport mode private-vlan host no shutdown interface Fastethernet 0/7 no switchport access vlan 999 switchport private-vlan host-association switchport mode private-vlan host no shutdown

91 4.4 Implement QOS 1 Configure QOS as per given Requirement: A subnet /24 from BB2 may generate traffic which affect your network in future You need to match the traffic from BB2 and Limiting this traffic into the rest of the network down to 128k. You are NOT Allowed to use Policing to accomplish this task. SOLUTION: On R2 class-map match-all Limit_BB2 match access-group 10 policy-map QOS class Limit_BB2 shape average access-list 10 permit int f0/0 service-policy output QOS int s0/0/1 service-policy th1s pr od u ct is 0f cc 1er n sl abs. c0m output QOS int s0/0/0 service-policy output QOS Note: In the exam they might ask you work on network /24 from BB1 instead of BB2,so in that case make these changes on R1