QUESTION/SOLUTION SET LAB 4

CCIE lab Routing & Switching (v4.0) lab:4 Updated

Testing Guidelines 1. The equipment on the rack assigned to you is physically Cabled and should not be tempered with. 2. Router and Switch hostnames, basic ip addressing, no exec-timeout and passwords on the Con, AUX and VTYs have been preconfigured. Do not change these configurations. 3. All preconfigured passwords are cisco.do not change these passwords. 4. Static and default routes are not permitted unless directly stated in a question. This includes floating static routes. 5. Routers to Null generated as a result of a dynamic routing protocol solution are permitted. 6. If you need clarification on the meaning of a question, or, if you suspect hardware problems with you equipment, contact the lab proctor as soon as possible. 7. The following symbols are used throughout the exam: YY is your 2-digit rack number, for example YY value for Rack3 is 03 and for Rack11 is 11. X is your router number, for example X Value for router 1 is 1. Z is any number SW1 and SW2 refer to the Catalyst

Lab 2012 This CCIE lab scenario is only for applicants, please do not publish it on the internet or anywhere else. General Information IOS is 12.4 Doc CD: you have access to http://www.cisco.com/cisco/web/psa/default.html All configuration guides and master indexes are there. Tools: notepad and calculator are available

Address Allocation Use class B address range YY.YY.X.0/16. YY is your rack number YY is your rack number, X is your router number Ex : IF your Rack number is 03, Lo0 is 3.3.3.3 and Rack number is 07, Lo0 is 7.7.7.7 Note : - Vlan 11 name VLAN_BB1 - Vlan 22 name VLAN_BB2 - Vlan 33 name VLAN_BB3 - Vlan 42 name VLAN_42_R2-SW4 - Vlan 44 name VLAN_44_R4 - Vlan 55 name VLAN_55_R5-SW2 - Vlan 123 name VLAN_123_SWITCHES - Vlan 999 name VLAN_RSPAN - PPP : R1 : YY.YY.14.1, R4 : YY.YY.14.4 R2 : YY.YY.24.2, R4 : YY.YY.24.4 - Serial : R3 : YY.YY.35.5, R5 : YY.YY.35.3 - BB1 is 150.1.YY.254/24 - BB2 is 150.2.YY.254/24 - BB3 is 150.3.YY.254/24

Loopback IP Address Hostname RackYYR1 Loopback0 interface IP Address YY.YY.1.1/32 RackYYR2 YY.YY.2.2/32 RackYYR3 YY.YY.3.3/32 RackYYR4 YY.YY.4.4/32 RackYYR5 YY.YY.5.5/32 RackYYSW1 YY.YY.7.7/32 RackYYSW2 YY.YY.8.8/32 RackYYSW3 YY.YY.9.9/32 RackYYSW4 YY.YY.10.10/32 Unless specified above, all interface else must be 24 bit mask addressing.

Pre-configuration: RackYYR1# version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYR1 boot-start-marker boot-end-marker logging message-counter syslog no aaa new-model dot11 syslog ip source-route ip cef no ip domain lookup no ipv6 cef multilink bundle-name authenticated archive log config hidekeys interface Loopback0 ip address YY.YY.1.1 255.255.255.255 interface FastEthernet0/0 ip address YY.YY.17.1 255.255.255.0 shutdown duplex auto speed auto interface FastEthernet0/1 no ip address shutdown duplex auto speed auto interface Serial0/0/0

ip address YY.YY.14.1 255.255.255.0 encapsulation ppp shutdown no fair-queue interface Serial0/0/1 no ip address shutdown clock rate 2000000 ip forward-protocol nd ip http server no ip http secure-server control-plane line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 password cisco login scheduler allocate 20000 1000 end RackYYR1#

RackYYR2# version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYR2 boot-start-marker boot-end-marker no aaa new-model resource policy no ip cef no ip domain lookup interface Loopback0 ip address YY.YY.2.2 255.255.255.255 interface FastEthernet0/0 ip address YY.YY.42.2 255.255.255.0 shutdown duplex auto speed auto interface FastEthernet0/1 ip address 150.2.66.1 255.255.255.0 shutdown duplex auto speed auto interface Serial0/0/0 ip address YY.YY.24.2 255.255.255.0 encapsulation ppp shutdown no fair-queue clock rate 2000000 interface Serial0/0/1 no ip address shutdown clock rate 2000000 ip http server no ip http secure-server

control-plane line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 password cisco login scheduler allocate 20000 1000 RackYYR2#

RackYYR3# version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYR3 boot-start-marker boot-end-marker no aaa new-model resource policy no ip cef no ip domain lookup interface Loopback0 ip address YY.YY.3.3 255.255.255.255 interface FastEthernet0/0 ip address 150.1.66.1 255.255.255.0 duplex auto speed auto interface FastEthernet0/1 no ip address shutdown duplex auto speed auto interface Serial0/0/0 ip address YY.YY.35.3 255.255.255.0 clock rate 2000000 interface Serial0/0/1 no ip address shutdown clock rate 2000000 ip http server no ip http secure-server control-plane line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4

password cisco login scheduler allocate 20000 1000 RackYYR3#

RackYYR4# version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYR4 boot-start-marker boot system flash:c2800nm-adventerprisek9-mz.124-24.t7.bin boot-end-marker logging message-counter syslog no aaa new-model dot11 syslog ip source-route no ip cef no ip domain lookup no ipv6 cef multilink bundle-name authenticated archive log config hidekeys interface Loopback0 ip address YY.YY.4.4 255.255.255.255 interface FastEthernet0/0 ip address YY.YY.44.4 255.255.255.0 shutdown duplex auto speed auto interface FastEthernet0/1 ip address YY.YY.144.4 255.255.255.0 shutdown duplex auto speed auto interface Serial0/0/0 ip address YY.YY.14.4 255.255.255.248 encapsulation ppp shutdown no fair-queue clock rate 125000

interface Serial0/0/1 ip address YY.YY.24.4 255.255.255.0 shutdown ip forward-protocol nd ip http server no ip http secure-server control-plane line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 password cisco login scheduler allocate 20000 1000 end RackYYR4#

RackYYR5# version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYR5 boot-start-marker boot-end-marker no aaa new-model memory-size iomem 5 dot11 syslog ip source-route no ip cef no ip domain lookup no ipv6 cef multilink bundle-name authenticated archive log config hidekeys interface Loopback0 ip address YY.YY.5.5 255.255.255.255 interface FastEthernet0/0 no ip address shutdown duplex auto speed auto interface FastEthernet0/1 no ip address shutdown duplex auto speed auto interface Serial0/0/0 ip address 65.65.35.6 255.255.255.0 shutdown interface Serial0/0/1 no ip address shutdown clock rate 2000000

ip forward-protocol nd ip http server no ip http secure-server line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 password cisco login scheduler allocate 20000 1000 end RackYYR5#

RackYYSW1# version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYSW1 boot-start-marker boot-end-marker no aaa new-model switch 1 provision ws-c3750-48ts system mtu routing 1500 no ip domain-lookup spanningxtend system-id vlan access-map ospf 10 action drop match ip address vlan vlan access-map ospf 20 action forward vlan filter ospf vlan-list 1-4094 vlan internal allocation policy ascending interface Loopback0 ip address YY.YY.7.7 255.255.255.255 interface FastEthernet1/0/1 interface FastEthernet1/0/2 interface FastEthernet1/0/3 interface FastEthernet1/0/4 interface FastEthernet1/0/5 interface FastEthernet1/0/6 interface FastEthernet1/0/7 interface FastEthernet1/0/8 interface FastEthernet1/0/9 interface FastEthernet1/0/10

interface FastEthernet1/0/11 interface FastEthernet1/0/12 interface FastEthernet1/0/13 interface FastEthernet1/0/14 interface FastEthernet1/0/15 interface FastEthernet1/0/16 interface FastEthernet1/0/17 interface FastEthernet1/0/18 interface FastEthernet1/0/19 switchport trunk encapsulation dot1q switchport mode trunk interface FastEthernet1/0/20 switchport trunk encapsulation dot1q interface FastEthernet1/0/21 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast interface FastEthernet1/0/22 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast interface FastEthernet1/0/23 switchport access vlan 11 switchport trunk encapsulation dot1q switchport mode access interface FastEthernet1/0/24 switchport trunk encapsulation dot1q switchport mode trunk interface GigabitEthernet1/0/1 interface GigabitEthernet1/0/2 interface GigabitEthernet1/0/3 interface GigabitEthernet1/0/4 interface Vlan1

no ip address shutdown interface Vlan123 ip address YY.YY.123.7 255.255.255.0 ip classless ip http server ip http secure-server ip access-list extended vlan permit ospf any any line con 0 exec-timeout 0 0 logging synchronous line vty 0 4 password cisco login line vty 5 15 password cisco login end RackYYSW1#

RackYYSW2# version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYSW2 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1528 vtp domain xyz vtp mode transparent ip subnet-zero no ip domain-lookup spanning-tree mode pvst spanning-tree extend system-id vlan internal allocation policy ascending interface Loopback0 ip address YY.YY.8.8 255.255.255.255 interface FastEthernet0/1 interface FastEthernet0/2 interface FastEthernet0/3 interface FastEthernet0/4 interface FastEthernet0/5 interface FastEthernet0/6 interface FastEthernet0/7 interface FastEthernet0/8 interface FastEthernet0/9 interface FastEthernet0/10

interface FastEthernet0/11 interface FastEthernet0/12 interface FastEthernet0/13 interface FastEthernet0/14 interface FastEthernet0/15 interface FastEthernet0/16 interface FastEthernet0/17 interface FastEthernet0/18 interface FastEthernet0/19 switchport trunk encapsulation dot1q shutdown interface FastEthernet0/20 switchport trunk encapsulation isl switchport mode trunk interface FastEthernet0/21 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast interface FastEthernet0/22 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast interface FastEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk interface FastEthernet0/24 switchport trunk encapsulation dot1q switchport mode trunk interface GigabitEthernet0/1 interface GigabitEthernet0/2 interface Vlan1 no ip address interface Vlan123 ip address YY.YY.123.8 255.255.255.0

ip classless ip http server ip http secure-server control-plane line con 0 exec-timeout 0 0 logging synchronous line vty 0 4 password cisco login line vty 5 15 password cisco login end RackYYSW2#

RackYYSW3# version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYSW3 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1500 ip subnet-zero no ip domain-lookup spanning-tree mode pvst spanning-tree extend system-id vlan internal allocation policy ascending interface Loopback0 ip address YY.YY.9.9 255.255.255.255 interface FastEthernet0/1 interface FastEthernet0/2 interface FastEthernet0/3 interface FastEthernet0/4 interface FastEthernet0/5 interface FastEthernet0/6 interface FastEthernet0/7 interface FastEthernet0/8 interface FastEthernet0/9 interface FastEthernet0/10 interface FastEthernet0/11

interface FastEthernet0/12 interface FastEthernet0/13 interface FastEthernet0/14 interface FastEthernet0/15 interface FastEthernet0/16 interface FastEthernet0/17 interface FastEthernet0/18 interface FastEthernet0/19 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast interface FastEthernet0/20 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree portfast interface FastEthernet0/21 switchport trunk encap trunk spanning-tree portfast interface FastEthernet0/22 switchport trunk encapsulation isl switchport mode trunk spanning-tree portfast interface FastEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk shutdown spanning-tree portfast interface FastEthernet0/24 switchport trunk encapsulation isl switchport mode trunk spanning-tree portfast interface GigabitEthernet0/1 interface GigabitEthernet0/2 interface Vlan1 no ip address

interface Vlan123 ip address YY.YY.123.9 255.255.255.0 ip classless ip http server ip http secure-server control-plane line con 0 exec-timeout 0 0 logging synchronous line vty 0 4 password cisco login line vty 5 15 password cisco login end RackYYSW3#

RackYYSW4# version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption hostname RackYYSW4 boot-start-marker boot-end-marker no aaa new-model system mtu routing 1500 ip subnet-zero no ip domain-lookup spanning-tree mode pvst spanning-tree extend system-id vlan internal allocation policy ascending interface Loopback0 ip address 67.67.10.10 255.255.255.255 interface FastEthernet0/1 interface FastEthernet0/2 interface FastEthernet0/3 interface FastEthernet0/4 interface FastEthernet0/5 interface FastEthernet0/6 interface FastEthernet0/7 interface FastEthernet0/8 interface FastEthernet0/9 interface FastEthernet0/10 interface FastEthernet0/11 interface FastEthernet0/12

interface FastEthernet0/13 interface FastEthernet0/14 interface FastEthernet0/15 interface FastEthernet0/16 interface FastEthernet0/17 interface FastEthernet0/18 interface FastEthernet0/19 switchport trunk encapsulation dot1q switchport mode trunk interface FastEthernet0/20 switchport trunk encapsulation dot1q switchport mode trunk interface FastEthernet0/21 switchport access vlan 11 switchport trunk encapsulation dot1q interface FastEthernet0/22 switchport trunk encapsulation dot1q switchport mode trunk interface FastEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk interface FastEthernet0/24 switchport trunk encapsulation dot1q switchport mode trunk interface GigabitEthernet0/1 interface GigabitEthernet0/2 interface Vlan1 no ip address shutdown ip classless ip http server ip http secure-server line con 0 exec-timeout 0 0 logging synchronous

line vty 0 4 password cisco login line vty 5 15 password cisco login end RackYYSW4#

BB1# version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption hostname BB1 memory-size iomem 15 ip subnet-zero ip cef no ip domain-lookup interface Loopback100 description RIP Networks ip address 150.100.28.254 255.255.255.0 interface Loopback197 description BGP Networks ip address 197.68.22.254 255.255.255.0 secondary ip address 197.68.21.254 255.255.255.0 secondary ip address 197.68.5.254 255.255.255.0 secondary ip address 197.68.4.254 255.255.255.0 secondary ip address 197.68.1.254 255.255.255.0

interface Loopback199 description *** RIP FOR R1 *** ip address 199.172.16.254 255.255.255.0 secondary ip address 199.172.15.254 255.255.255.0 secondary ip address 199.172.14.254 255.255.255.0 secondary ip address 199.172.13.254 255.255.255.0 secondary ip address 199.172.12.254 255.255.255.0 secondary ip address 199.172.11.254 255.255.255.0 secondary ip address 199.172.10.254 255.255.255.0 secondary ip address 199.172.9.254 255.255.255.0 secondary ip address 199.172.8.254 255.255.255.0 secondary ip address 199.172.7.254 255.255.255.0 secondary ip address 199.172.6.254 255.255.255.0 secondary ip address 199.172.5.254 255.255.255.0 secondary ip address 199.172.4.254 255.255.255.0 secondary ip address 199.172.3.254 255.255.255.0 secondary ip address 199.172.2.254 255.255.255.0 secondary ip address 150.100.1.1 255.255.255.0 secondary ip address 150.100.1.254 255.255.255.0 secondary ip address 199.172.1.254 255.255.255.0 interface Ethernet0/0 ip address 150.1.YY.254 255.255.255.0 ip rip receive version 1 2 full-duplex

interface Serial0/0 no ip address shutdown interface Serial0/1 no ip address shutdown router rip version 2 network 150.1.0.0 network 150.100.0.0 network 199.172.0.0 network 199.172.1.0 network 199.172.2.0 network 199.172.3.0 network 199.172.4.0 network 199.172.5.0 network 199.172.6.0 network 199.172.7.0 network 199.172.8.0 network 199.172.9.0 network 199.172.10.0 network 199.172.11.0 network 199.172.12.0 network 199.172.13.0 network 199.172.14.0

network 199.172.15.0 network 199.172.16.0 neighbor 150.1.1.1 no auto-summary router bgp 254 no synchronization bgp log-neighbor-changes network 197.68.1.0 network 197.68.4.0 network 197.68.5.0 network 197.68.21.0 network 197.68.22.0 neighbor 150.1.1.1 remote-as 1 neighbor 150.1.1.1 route-map LONGER_AS out neighbor 150.1.2.1 remote-as 2 neighbor 150.1.2.1 route-map LONGER_AS out neighbor 150.1.3.1 remote-as 3 neighbor 150.1.3.1 route-map LONGER_AS out neighbor 150.1.4.1 remote-as 4 neighbor 150.1.4.1 route-map LONGER_AS out neighbor 150.1.5.1 remote-as 5 neighbor 150.1.5.1 route-map LONGER_AS out neighbor 150.1.7.1 remote-as 7 neighbor 150.1.7.1 route-map LONGER_AS out neighbor 150.1.11.1 remote-as 11

neighbor 150.1.11.1 route-map LONGER_AS out neighbor 150.1.12.1 remote-as 12 neighbor 150.1.12.1 route-map LONGER_AS out neighbor 150.1.13.1 remote-as 13 neighbor 150.1.13.1 route-map LONGER_AS out neighbor 150.1.14.1 remote-as 14 neighbor 150.1.14.1 route-map LONGER_AS out neighbor 150.1.15.1 remote-as 15 neighbor 150.1.15.1 route-map LONGER_AS out neighbor 150.1.16.1 remote-as 16 neighbor 150.1.16.1 route-map LONGER_AS out neighbor 150.1.17.1 remote-as 17 neighbor 150.1.17.1 route-map LONGER_AS out neighbor 150.1.18.1 remote-as 18 neighbor 150.1.18.1 route-map LONGER_AS out neighbor 150.1.19.1 remote-as 19 neighbor 150.1.19.1 route-map LONGER_AS out neighbor 150.1.37.1 remote-as 37 neighbor 150.1.37.1 route-map LONGER_AS out neighbor 150.1.65.1 remote-as 65 neighbor 150.1.65.1 route-map LONGER_AS out neighbor 150.1.66.1 remote-as 66 neighbor 150.1.66.1 route-map LONGER_AS out neighbor 150.1.67.1 remote-as 67 neighbor 150.1.67.1 route-map LONGER_AS out no auto-summary

ip classless ip http server ip bgp-community new-format ip as-path access-list 1 permit ^$ route-map LONGER_AS permit 10 match as-path 1 set as-path prepend 253 dial-peer cor custom line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 login scheduler allocate 20000 1000 end BB1#

BB2# version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption hostname BB2 ip subnet-zero ip cef no ip domain-lookup interface Loopback0 ip address 1.1.1.1 255.255.255.0 interface Loopback197 description BGP Networks ip address 197.68.22.254 255.255.255.0 secondary ip address 197.68.21.254 255.255.255.0 secondary ip address 197.68.5.254 255.255.255.0 secondary ip address 197.68.4.254 255.255.255.0 secondary ip address 197.68.1.254 255.255.255.0 interface Loopback300 ip address 210.210.210.210 255.255.255.255 interface FastEthernet0/0 ip address 150.2.YY.254 255.255.255.0 duplex auto speed auto router bgp 254 no synchronization bgp log-neighbor-changes network 197.68.1.0 network 197.68.4.0 network 197.68.5.0 network 197.68.21.0 network 197.68.22.0 neighbor 150.2.1.1 remote-as 1 neighbor 150.2.2.1 remote-as 2 neighbor 150.2.3.1 remote-as 3 neighbor 150.2.4.1 remote-as 4 neighbor 150.2.5.1 remote-as 5 neighbor 150.2.7.1 remote-as 7 neighbor 150.2.8.1 remote-as 8 neighbor 150.2.11.1 remote-as 11 neighbor 150.2.12.1 remote-as 12 neighbor 150.2.13.1 remote-as 13

neighbor 150.2.14.1 remote-as 14 neighbor 150.2.15.1 remote-as 15 neighbor 150.2.16.1 remote-as 16 neighbor 150.2.17.1 remote-as 17 neighbor 150.2.18.1 remote-as 18 neighbor 150.2.19.1 remote-as 19 neighbor 150.2.37.1 remote-as 37 neighbor 150.2.65.1 remote-as 65 neighbor 150.2.66.1 remote-as 66 no auto-summary ip classless ip http server ip bgp-community new-format line con 0 line aux 0 line vty 0 4 login end BB2#

BB3# version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption hostname BB3 ip subnet-zero no ip domain-lookup ip cef interface Loopback0 ip address 1.1.1.1 255.255.255.0 interface Loopback197 description BGP Networks ip address 197.68.22.254 255.255.255.0 secondary ip address 197.68.21.254 255.255.255.0 secondary ip address 197.68.5.254 255.255.255.0 secondary ip address 197.68.4.254 255.255.255.0 secondary ip address 197.68.1.254 255.255.255.0 interface Loopback198 description EIGRP NETWORK ip address 198.198.22.254 255.255.255.0 secondary ip address 198.198.21.254 255.255.255.0 secondary ip address 198.198.4.254 255.255.255.0 secondary ip address 198.2.1.254 255.255.255.0 secondary ip address 198.2.3.254 255.255.255.0 secondary ip address 198.2.5.254 255.255.255.0 secondary ip address 198.198.1.5 255.255.255.252 interface Loopback300 ip address 210.210.210.210 255.255.255.255 interface FastEthernet0/0 ip address 150.3.YY.254 255.255.255.0 speed 100 full-duplex interface Serial0/0 no ip address shutdown no fair-queue interface Serial0/1 no ip address shutdown

router eigrp 100 redistribute connected route-map EIGRP network 150.3.0.0 no auto-summary no eigrp log-neighbor-changes router bgp 254 no synchronization bgp log-neighbor-changes network 197.68.1.0 network 197.68.4.0 network 197.68.5.0 network 197.68.21.0 network 197.68.22.0 neighbor 150.2.1.1 remote-as 1 neighbor 150.2.2.1 remote-as 2 neighbor 150.2.3.1 remote-as 3 neighbor 150.2.4.1 remote-as 4 neighbor 150.2.5.1 remote-as 5 neighbor 150.2.7.1 remote-as 7 neighbor 150.2.8.1 remote-as 8 neighbor 150.2.11.1 remote-as 11 neighbor 150.2.12.1 remote-as 12 neighbor 150.2.13.1 remote-as 13 neighbor 150.2.14.1 remote-as 14 neighbor 150.2.15.1 remote-as 15 neighbor 150.2.16.1 remote-as 16 neighbor 150.2.17.1 remote-as 17 neighbor 150.2.18.1 remote-as 18 neighbor 150.2.19.1 remote-as 19 neighbor 150.2.37.1 remote-as 37 neighbor 150.2.65.1 remote-as 65 neighbor 150.2.66.1 remote-as 66 no auto-summary ip classless ip http server ip bgp-community new-format route-map EIGRP permit 10 match interface Loopback198 route-map eigrp permit 10 match interface Loopback197 line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4

SECTION I. Layer 2 Technologies 1.1 Troubleshoot Layer 2 Switching A few faults have been injected into the pre-configurations just described, These issues may impede a working solution for certain portions of this labs exam and affect any labs exam section. You must verify that all of your configurations work as expected, if something is not working as expected then you must fix the underlying problem. Point will be awarded for solving each problem. However, if you fail to solve a particular problem, and the injected fault prevents you from having a working solutions of this lab, then you will lose points for the fault and the scenario that is not working Score : Solve one fault 2point, solve two fault 4point FAULT 1

RackYYSW1(config)#vlan access-map ospf 10 RackYYSW1(config-access-map)# action forward FAULT 2 Remove spanning-tree port fast trunk command on all trunk ports

1.2 Implement the Access-Switch Ports of Switched Network Configure all of the appropriate spanning-tree domains on Sw1, Sw2, Sw3 and Sw4, according to the following requirements :- SW1 is the server for the VLAN Trunking Protocol(VTP) version 2 domain CCIERoutingandSwitching +YY (for example, the rack number of 3 would have a VTP domain of 802.1 Q trunks between all switches) VTP password cisco both without quote. PPP on the serial links between R1 and R4, R2 and R4. Sw2, Sw3 and SW4 are expecting Sw1 to update their VLAN database when needed. Configure the VLAN ID and Name according to the table below (case sensitive) Configure the Access ports for each VLAN as per the diagram. Using a single command ensure that all access ports are transitioned to forwarding state as quickly as possible. Using a single command ensure that the interface is forced the err-disabled state if a BPDU is received by any access ports. Ensure that any BPDU received by the access ports facing the backbone devices ( and only these ports) have no effect to your spanning-tree decision Don t forget to configure the Layer 3 interfaces and to include SW1 s port fa0/4 into VLAN 44

Score : 3 Point

ON SW1 Configure Vlans manually as per the given diagram vtp mode server vtp ver 2

vtp domain CCIERoutingandSwitchingYY vtp pass cisco spanning-tree portfast default spanning-tree portfast bpduguard default interface FastEthernet1/0/10 spanning-tree bpdufilter enable spanning-tree bpduguard disable RackYYSW1#sh run int fa1/0/4 Building configuration... Current configuration : 86 bytes interface FastEthernet1/0/4 switchport access vlan 44 switchport mode access end

ON SW 2 vtp mode client vtp ver 2 vtp domain CCIERoutingandSwitchingYY vtp pass cisco spanning-tree portfast default spanning-tree portfast bpduguard default interface FastEthernet0/10 spanning-tree bpdufilter enable spanning-tree bpduguard disable ON SW 3 vtp mode client vtp ver 2 vtp domain CCIERoutingandSwitchingYY vtp pass cisco spanning-tree portfast default spanning-tree portfast bpduguard default interface FastEthernet0/10 spanning-tree bpdufilter enable spanning-tree bpduguard disable ON SW 4

vtp mode client vtp ver 2 vtp domain CCIERoutingandSwitchingYY vtp pass cisco spanning-tree portfast default spanning-tree portfast bpduguard default CONFIGURATION OF IP ADDRESS SCHEME & SVI as per the toplogy R4

SW1

SW4

SW2

SW3

CONFIGURE VLAN AS PER THE GIVEN PORTS RackYYSW1#sh run int fa1/0/10 Building configuration... Current configuration : 153 bytes interface FastEthernet1/0/10 switchport access vlan 11

switchport mode access spanning-tree bpdufilter enable spanning-tree bpduguard disable end RackYYSW2#sh run int fa0/10 Building configuration... Current configuration : 151 bytes interface FastEthernet0/10 switchport access vlan 22 switchport mode access spanning-tree bpdufilter enable spanning-tree bpduguard disable end RackYYSW2# RackYYSW3#sh run int fa0/10 Building configuration... Current configuration : 151 bytes interface FastEthernet0/10 switchport access vlan 33 switchport mode access spanning-tree bpdufilter enable spanning-tree bpduguard disable end RackYYSW1#sh run int fa1/0/2

Building configuration... Current configuration : 86 bytes interface FastEthernet1/0/2 switchport access vlan 42 switchport mode access end RackYYSW1#sh run int fa1/0/4 Building configuration... Current configuration : 86 bytes interface FastEthernet1/0/4 switchport access vlan 44 switchport mode access end RackYYSW1# RackYYSW2#sh run int fa0/5 Building configuration... Current configuration : 84 bytes interface FastEthernet0/5 switchport access vlan 55 switchport mode access end

RackYYSW2# RackYYSW1#sh run int vlan 123 Building configuration... Current configuration : 63 bytes interface Vlan123 ip address YY.YY.123.7 255.255.255.0 end RackYYSW1# RackYYSW2#sh run int vlan 123 Building configuration... Current configuration : 63 bytes interface Vlan123 ip address YY.YY.123.8 255.255.255.0 end RackYYSW2# RackYYSW3#sh run int vlan 123 Building configuration... Current configuration : 63 bytes interface Vlan123 ip address YY.YY.123.9 255.255.255.0

end RackYYSW3# Rack67SW4#sh run int vlan 123 Building configuration... Current configuration : 64 bytes interface Vlan123 ip address YY.YY.123.10 255.255.255.0 end Rack67SW4#

1.3 Implement Spanning Tree ( STP ) Configure the spanning-trees on Sw1, Sw2, Sw3 and Sw4 according to the following requirements :- Configure VLANs for Backbones should be in instance 1 and VLANs throughout your network should be in instance 2. All other VLAN should be in default spanning-tree instance. Ensure that Sw1 must be the root for instance 1 with Sw2 being the backup for instance 1. Ensure that Sw2 must be the root for instance 2 with Sw1 being the backup for instance 2. Score : 3 Point

SW1 spanning-tree mode mst spanning-tree mst configuration name CCIE revision 1 instance 1 vlan 11, 22, 33 instance 2 vlan 42, 44, 55, 123, 999 spanning-tree mst 1 priority 24576 spanning-tree mst 2 priority 28672 SW2 spanning-tree mode mst spanning-tree mst configuration name CCIE revision 1 instance 1 vlan 11, 22, 33 instance 2 vlan 42, 44, 55, 123, 999 spanning-tree mst 1 root secondary spanning-tree mst 2 root primary SW3 spanning-tree mode mst spanning-tree mst configuration

name CCIE revision 1 instance 1 vlan 11, 22, 33 instance 2 vlan 42, 44, 55, 123, 999 SW4 spanning-tree mode mst spanning-tree mst configuration name CCIE revision 1 instance 1 vlan 11, 22, 33 instance 2 vlan 42, 44, 55, 123, 999

1.4 Implement the Additional Spanning-Tree Configure the additional spanning-trees Switches according to the following requirements : Configure Spanning-tree timers such that if no BPDU was received within 30 seconds, that the network re-converges. Ensure port Fa0/20 is forwarding rather than blocking for MST 1 on SW3. Ensure port Fa0/20 is forwarding rather than blocking for MST 2 on SW4. You must do this without any configuration on SW3 and SW4. Use the highest numerical value to accomplish this task. Or Use the lowest numerical value to accomplish this task.(in that case on SW1 int fa0/20 make spanning-tree mst 1 port priority 0 and on SW2 int fa0/20 make spanningtree mst 2 port priority 0 Score : 2 Point

Sw1 - Sw 4 spanning-tree mst max-age 30 RackYYSW1#sh run int fa1/0/19 Building configuration... Current configuration : 136 bytes interface FastEthernet1/0/19 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree mst 1 port-priority 240 end RackYYSW1#

RackYYSW2#sh run int fa0/19 Building configuration... Current configuration : 158 bytes interface FastEthernet0/19 switchport trunk encapsulation dot1q switchport mode trunk spanning-tree mst 2 port-priority 240 end RackYYSW2#

1.5 Implement EtherChannel Use the following requirements to configure the Etherchannel on Sw1, Sw2, Sw3 and Sw4. Configure the industry standard (Lacp) Etherchannel between Sw1 and Sw2. Configure the Cisco proprietary (Pagp) Etherchannel between Sw3 and Sw4. Ensure that Sw1 and Sw3 should actively negotiate the Etherchannel. Ensure that Sw4 and Sw2 should establish the Etherchannel only when it is requested. Score : 3 Point

SW1 RackYYSW1(config)#int range fastethernet 0/23-24 RackYYSW1(config-if-range)#channel-group 12 mode active Creating a port-channel interface Port-channel 12 RackYYSW1#sh run int fa1/0/23 Building configuration... Current configuration : 155 bytes interface FastEthernet1/0/23 switchport access vlan 11 switchport trunk encapsulation dot1q switchport mode access channel-group 12 mode active end RackYYSW1#sh run int fa1/0/24 Building configuration... Current configuration : 127 bytes interface FastEthernet1/0/24 switchport trunk encapsulation dot1q switchport mode trunk channel-group 12 mode active end RackYYSW1#

RackYYSW2(config)#int range fastethernet 0/23-24 RackYYSW2(config-if-range)#channel-group 12 mode passive Creating a port-channel interface Port-channel 12 RackYYSW2#sh run int fa0/23 Building configuration... Current configuration : 126 bytes interface FastEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk channel-group 12 mode passive end

RackYYSW2#sh run int fa0/24 Building configuration... Current configuration : 126 bytes interface FastEthernet0/24 switchport trunk encapsulation dot1q switchport mode trunk channel-group 12 mode passive end RackYYSW2# RackYYSW3(config)#int range fa0/23-24 RackYYSW3(config-if-range)#channel-group 34 mode desirable Creating a port-channel interface Port-channel 34

RackYYSW3#sh run int fa0/23 Building configuration... Current configuration : 152 bytes interface FastEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk channel-group 34 mode desirable spanning-tree portfast end RackYYSW3#sh run int fa0/24 Building configuration... Current configuration : 150 bytes interface FastEthernet0/24 switchport trunk encapsulation dot1q switchport mode trunk channel-group 34 mode desirable spanning-tree portfast end RackYYSW3#

Rack67SW4(config)#int range fa0/23-24 Rack67SW4(config-if-range)#channel-group 34 mode auto Creating a port-channel interface Port-channel 34 Rack67SW4#sh run int fa0/23 Building configuration... Current configuration : 123 bytes interface FastEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk channel-group 34 mode auto end

Rack67SW4#sh run int fa0/24 Building configuration... Current configuration : 123 bytes interface FastEthernet0/24 switchport trunk encapsulation dot1q switchport mode trunk channel-group 34 mode auto end Rack67SW4#

1.6 Remote Switched Port Analyzer (RSPAN) Configure port monitoring for receiving Backbone 1. Configure port monitoring for receiving Backbone 2. Traffic should be sent to SW4 fa0/15. Use remote vlan 999. Configure port mirroring for traffic between SW3 and SW4, This traffic should be sent to SW4 fa0/16. ( Do not add any vlan to accomplish this task) The solution should be suitable in case of adding more ports in BB1 and BB2 vlans. Score : 3 Point

RackYYSW1(config)#vlan 999 RackYYSW1(config-vlan)#remote-span monitor session 1 source interface vlan 11 rx monitor session 1 destination remote vlan 999 SW2 monitor session 1 source interface vlan 22 rx monitor session 1 destination remote vlan 999 SW4 monitor session 1 destination interface Fa0/15 monitor session 1 source remote vlan 999 monitor session 2 source interface Po34 both monitor session 2 destination interface Fa0/16

1.7 Secure PPP Links Configure Challenge Handshake Authentication Protocol(CHAP) on R4 for the link to R1 and R2, according to the following requirements:- Use authentication, authorization, and accounting (AAA) R4 must authenticate R1 and R2, but R1 and R2 should not authenticate R4. Do not use any ppp chap hostname command on R1 and R2. OR Use ppp chap hostname command on R1 and R2. R4 should first try the Radius Server YY.YY.44.200 using a key of CISCO and fall back to local login in the event of a failure to connect to the Radius Server Make sure that this should not affect any username/password setting on Line console or line VTY. Score: 3 Point R4 aaa new-model aaa authentication login default line --> If console/vty has a password then this should be line if console/vty has no password then it should be default none aaa authentication ppp default group radius local-case

username RackYYR1 password 0 CISCO username RackYYR2 password 0 CISCO interface Serial0/0/0 ip address YY.YY.14.4 255.255.255.248 encapsulation ppp no fair-queue clock rate 125000 ppp authentication chap interface Serial0/0/1 ip address YY.YY.24.4 255.255.255.0 encapsulation ppp ppp authentication chap radius-server host YY.YY.44.200 auth-port 1645 acct-port 1646 key CISCO line con 0 exec-timeout 0 0 password cisco logging synchronous line aux 0 line vty 0 4 password cisco

OR Use ppp chap hostname command on R1 and R2. R4 aaa authentication ppp R1 group radius local-case aaa authentication ppp R2 group radius local-case interface s0/0/0 ppp authentication chap R1 interface s0/1/0 ppp authentication chap R2 VERIFICATION

SECTION ll. Layer 3 Technologies After finishing each of the following questions, make sure that all configured interfaces and subnets are consistently visible on all pertinent routers and switches Do not redistribute between any interior gateway protocol(igp) and Board Gateway Protocol(BGP) You need to ping a BGP route only if it is stated in a question, otherwise the route should be only in the BGP table. At the end of section 2, all subnets in your topology, including the loopback interfaces, must be reachable via ping. Therefore, redistribute as you wish unless directly stated in a question. The backbone interface must be reachable only if they are part of the solution to a question The loopback interface can be seen as either /24 or /32 in the routing tables unless stated otherwise in a question The loopback interfaces can be added into your IGP either via redistribution or added to a routing process of your choice

2.1 Implement IPv4 OSPF Configure Open Shortest Path First(OSPF) Updates should be advertised only out of the interfaces that are indicated in the IGP topology diagram. OSPF process ID is your Rack number, YY. Configure OSPF router ID with interface loopback 0 on respective router. Configure Area 0 between the Ethernet segments shared by all switches. Ensure SW1 should be control all routing, and SW2 should be the backup. Use the largest value to accomplish this task. Configure OSPF Area 142 between Sw1, R1, R4, R2 and Sw4. Configure OSPF Area 51 between Sw2, R5 and R3. Do not create any additional OSPF areas, unless required in the questions. All backbone networks should be seen as external type 2 on R4. Score : 3 Point

R4 RackYYR4#sh run b r o router ospf YY router-id YY.YY.4.4 log-adjacency-changes network YY.YY.4.4 0.0.0.0 area 142 network YY.YY.14.4 0.0.0.0 area 142 network YY.YY.24.4 0.0.0.0 area 142 network YY.YY.44.4 0.0.0.0 area 142 network YY.YY.144.4 0.0.0.0 area 142 R1 RackYYR1#sh run b r o router ospf YY router-id YY.YY.1.1 log-adjacency-changes network YY.YY.1.1 0.0.0.0 area 142 network YY.YY.14.1 0.0.0.0 area 142 network YY.YY.17.1 0.0.0.0 area 142 RackYYR1#sh run int fa0/0 Building configuration... Current configuration : 115 bytes interface FastEthernet0/0 ip ospf mtu-ignore // Not required R2 RackYYR2#sh run b r o router ospf YY router-id YY.YY.2.2

log-adjacency-changes network YY.YY.2.2 0.0.0.0 area 142 network YY.YY.24.2 0.0.0.0 area 142 network YY.YY.42.2 0.0.0.0 area 142 RackYYR2#sh run int fa0/0 Building configuration... Current configuration : 115 bytes interface FastEthernet0/0 ip ospf mtu-ignore end // Not required SW1 ip routing router ospf YY log-adjacency-changes network YY.YY.7.7 0.0.0.0 area 0 network YY.YY.17.7 0.0.0.0 area 142 network YY.YY.123.7 0.0.0.0 area 0 RackYYSW1#sh run int vlan 123 Building configuration... Current configuration : 83 bytes interface Vlan123 ip address YY.YY.123.7 255.255.255.0 ip ospf mtu-ignore // Not required

end SW4 ip routing Rack67SW4#sh run b r o router ospf YY log-adjacency-changes network YY.YY.10.10 0.0.0.0 area 0 network YY.YY.42.10 0.0.0.0 area 142 network YY.YY.123.10 0.0.0.0 area 0 Rack67SW4#sh run int vlan 123 Building configuration... Current configuration : 84 bytes interface Vlan123 ip address YY.YY.123.10 255.255.255.0 ip ospf mtu-ignore end // Not required SW2 ip routing RackYYSW2#sh run b r o router ospf YY router-id YY.YY.8.8

log-adjacency-changes network YY.YY.8.8 0.0.0.0 area 0 network YY.YY.55.8 0.0.0.0 area 51 network YY.YY.123.8 0.0.0.0 area 0 RackYYSW2(config)#int vlan 123 RackYYSW2(config-if)#ip ospf mtu-ignore // Not required SW3 ip routing RackYYSW3#sh run b r o router ospf YY log-adjacency-changes network YY.YY.9.9 0.0.0.0 area 0 network YY.YY.123.9 0.0.0.0 area 0 RackYYSW3(config)#int vlan 123 RackYYSW3(config-if)#ip ospf mtu-ignore // Not required R3 RackYYR3#sh run b r o router ospf YY router-id YY.YY.3.3 log-adjacency-changes network YY.YY.3.3 0.0.0.0 area 51 network YY.YY.35.3 0.0.0.0 area 51

R5 RackYYR5#sh run b r o router ospf YY router-id YY.YY.5.5 log-adjacency-changes network YY.YY.5.5 0.0.0.0 area 51 network YY.YY.35.5 0.0.0.0 area 51 RackYYSW1#sh run int vlan 123 Building configuration... Current configuration : 105 bytes interface Vlan123 ip address YY.YY.123.7 255.255.255.0 ip ospf priority 255 ip ospf mtu-ignore end // Not required RackYYSW2#sh run int vlan 123 Building configuration... Current configuration : 105 bytes interface Vlan123 ip address YY.YY.123.8 255.255.255.0 ip ospf priority 254 ip ospf mtu-ignore end // Not required

RackYYSW2# Verification router ospf YY redistribute connected subnets route-map inbb2 route-map inbb2 permit 10 match interface FastEthernet0/1

VERIFICATION BB1 / BB3 routes will come as OE2 when you will run RIP/EIGRP so do not have to do anything at this stage.

2.2 Implement IPv4 EIGRP Configure Enhanced Interior Gateway Routing Protocol(EIGRP) 100 on Sw2 in order to establish EIGRP neighbor with Backbone 3 in the IGP topology diagram. Do not use auto-summary. Score : 1 Point

SW2 router eigrp 100 no auto-summary network 150.3.YY.1 0.0.0.0

2.3 Implement RIP Version 2 Configure RIP Version 2(RIPv2) per the IGP topology diagram. RIP updates should be advertise only out to the interface per the IGP topology diagram Do not use auto-summary. The 16 routes from Backbone 1 is advertised to R3. Only 4 routes indicated on the below should be allowed. you are allowed to use only one ACL line to accomplish this task. X.X.5.0 /24 X.X.7.0/24 X.X.13.0/24 X.X.15.0/24 Score : 2 Point

R3 router rip no auto version 2 network 150.1.0.0 The 16 routes from Backbone 1 is advertised to R3. Only 4 routes indicated on the below should be allowed. you are allowed to use only one ACL line to accomplish this task. router rip version 2 network 150.1.0.0

distribute-list 1 in FastEthernet0/0 ip http server no ip http secure-server access-list 1 permit 199.172.5.0 0.0.10.255

2.4 Implement IPv4 EIGRP-OSPF Redistribute Configure Sw2 to redistribute EIGRP 100 into OSPF. EIGRP-learned routes should be seen as external type 2 on OSPF area 0 Ensure that the EIGRP routes should NOT be presented into OSPF Area 51 and Sw2 should generate a default route. Score : 2 Point

Configure Sw2 to redistribute EIGRP 100 into OSPF. Sw2 RackYYSW2#sh run b r o router ospf YY router-id YY.YY.8.8 log-adjacency-changes area 51 nssa no-redistribution default-information-originate Or area 51 nssa no-redistribution no-summary redistribute eigrp 100 subnets network YY.YY.8.8 0.0.0.0 area 0 network YY.YY.55.8 0.0.0.0 area 51 network YY.YY.123.8 0.0.0.0 area 0 EIGRP-learned routes should be seen as external type 2 on OSPF area 0 Verification

Ensure that the EIGRP routes should NOT be presented into OSPF Area 51 and Sw2 should generate a default route. R5 RackYYR5#sh run b r o router ospf YY router-id YY.YY.5.5 log-adjacency-changes area 51 nssa network YY.YY.5.5 0.0.0.0 area 51 network YY.YY.35.5 0.0.0.0 area 51 network YY.YY.55.5 0.0.0.0 area 51

Verification RackYYR3#sh run b r o router ospf YY router-id YY.YY.3.3 log-adjacency-changes area 51 nssa network YY.YY.3.3 0.0.0.0 area 51 network YY.YY.35.3 0.0.0.0 area 51

2.5 Implement RIP-OSPF Redistribute Configure to redistribute RIP into OSPF area 51. The routing table must be shown on R5 as the below table. The redistributed routes must be advertised to all routers in OSPF. You are allowed to use only one ACL line to accomplish this task. N1 X.X.5.0 /24 [110/115] N1 X.X.7.0/24 [110/115] N2 X.X.13.0/24 [110/30] N2 X.X.15.0/24 [110/30] N2 150.1.YY.0/24 [110/30] Score : 2 Point

Configure to redistribute RIP into OSPF area 51. R3 RackYYR3#sh run b r o router ospf YY router-id YY.YY.3.3 log-adjacency-changes area 51 nssa redistribute rip subnets network YY.YY.3.3 0.0.0.0 area 51 network YY.YY.35.3 0.0.0.0 area 51 The routing table must be shown on R5 as the below table.

The redistributed routes must be advertised to all routers in OSPF. You are allowed to use only one ACL line to accomplish this task. N1 X.X.5.0 /24 [110/115] N1 X.X.7.0/24 [110/115] N2 X.X.13.0/24 [110/30] N2 X.X.15.0/24 [110/30] N2 150.1.YY.0/24 [110/30]

R3 router ospf YY redistribute rip subnets route-map rip access-list 2 permit 199.172.5.0 0.0.2.255 route-map rip permit 10 match ip address 2 set metric 50 set metric-type type-1 route-map rip permit 20 set metric 30 set metric-type type-2 VERIFICATION

2.6 Implement IPv4 BGP Referring the BGP Routing diagram. Configure BGP within these parameters Configure ibgp peering in AS YY. ibgp peering needs to be established between Sw2, R1, R2, R3 and R5. Each ibgp peer should have only one neighbor, except Sw2. Use the minimal statements to accomplish this task. Make sure that ibgp neighbor relationship should not be affected by the physical status of the link. EBGP : R2 EBGP peers with the router 150.2.YY.254 on Backbone 2 AS 254 EBGP : R3 EBGP peers with the routes 150.1.YY.254 on Backbone 1 AS 254 Routes that are received from BB2 should be tagged with community 254 108 104 and routes received from BB1 should be tagged with community 254 109 103 within AS YY. This community should be shown in all other ibgp peers. The next hop for AS254 routes should be Backbones. All ibgp neighbors within ASYY should prefer path through R3 for all BGP learned routes except R2 that can prefer path through BB2. Score : 3 Point SW2 RackYYSW2#sh run b r b router bgp YY no synchronization bgp router-id YY.YY.8.8 bgp log-neighbor-changes neighbor IBGP peer-group neighbor IBGP remote-as YY

no neighbor IBGP transport path-mtu-discovery neighbor IBGP update-source Loopback0 neighbor IBGP route-reflector-client neighbor IBGP send-community neighbor YY.YY.1.1 peer-group IBGP neighbor YY.YY.2.2 peer-group IBGP neighbor YY.YY.3.3 peer-group IBGP neighbor YY.YY.5.5 peer-group IBGP no auto-summary R1 RackYYR1#sh run b r b router bgp YY no synchronization bgp router-id YY.YY.1.1 bgp log-neighbor-changes neighbor YY.YY.8.8 remote-as YY neighbor YY.YY.8.8 update-source Loopback0 no auto-summary R2 RackYYR2#sh run b r b router bgp YY no synchronization bgp router-id YY.YY.2.2 bgp log-neighbor-changes neighbor YY.YY.8.8 remote-as YY neighbor YY.YY.8.8 update-source Loopback0 neighbor 150.2.YY.254 remote-as 254 no auto-summary R5 RackYYR5#sh run b r b router bgp YY no synchronization

bgp router-id YY.YY.5.5 bgp log-neighbor-changes neighbor YY.YY.8.8 remote-as YY neighbor YY.YY.8.8 update-source Loopback0 no auto-summary R3 RackYYR3#sh run b r b router bgp YY no synchronization bgp router-id YY.YY.3.3 bgp log-neighbor-changes neighbor YY.YY.8.8 remote-as YY neighbor YY.YY.8.8 update-source Loopback0 neighbor 150.1.YY.254 remote-as 254 no auto-summary Routes that are received from BB2 should be tagged with community 254 108 104 and routes received from BB1 should be tagged with community 254 109 103 within AS YY. This community should be shown in all other ibgp peers. R3 RackYYR3#sh run b r b router bgp YY neighbor 150.1.YY.254 route-map inbb1comm in route-map inbb1comm permit 10 set community 103 109 254 additive VERIFICATION

R2 RackYYR2#sh run b r b router bgp YY neighbor 150.2.YY.254 route-map inbb2comm in route-map inbb2comm permit 10 set community 104 108 254 additive VERIFICATION

All ibgp neighbors within ASYY should prefer path through R3 for all BGP learned routes except R2 that can prefer path through BB2. By default every route is going from R2 Verification

We have to change as per the question R3 RackYYR3(config)#router bgp YY RackYYR3(config-router)#bgp default local-preference 150 R2 RackYYR2(config-router)#neighbor 150.2.YY.254 weight 1000 VERIFICATION

2.7 Performance Routing(PFR) Configure OER on R1, R2 and R4 according to the following requirements:- R4 must be the master controller R1 and R2 must be the Border routers. Ensure that PFR sessions are established using Loopback 0 interface only A specific traffic ( marked with DSCP "CS 2" ) from VLAN_44 to ANY VLAN must be routed via R1 Another traffic ( marked with DSCP "CS 4" ) from VLAN_44 to ANY VLAN must be routed via R2 Use extended access-lists with a single entry Use active probes only If required by your solution, you may use any prefix that is not used in your topology You should use access-list specifying only source address and DSCP value. *you must use set mode select-exit good Score : 3 Point

2.8 Performance Routing(PFR) Continue configured PFR as per the following requirements:- PFR must ensure that the voice traffic is routed via an exit which provides a maximum delay 40 ms and a maximum jitter of 5ms Set the frequency of probes to 2 seconds- make sure that all exits are constantly probed The voice traffic is sourced from VLAN_44, designated to the voice gateway R5 (YY.YY.55.5) and marked with DSCP " EF Score : 3 Point

RackYYR4# key chain cisco key 1 key-string CISCO oer master policy-rules OER no max-range-utilization logging no resolve range no resolve utilization border YY.YY.1.1 key-chain cisco interface Serial0/2/0 internal interface Tunnel0 internal interface FastEthernet0/0 external link-group CS2 border YY.YY.2.2 key-chain cisco interface Serial0/2/0 internal interface Tunnel0 internal interface FastEthernet0/0 external link-group CS4 ip access-list extended CS2 permit ip YY.YY.44.0 0.0.0.255 any dscp cs2 ip access-list extended CS4 permit ip YY.YY.44.0 0.0.0.255 any dscp cs4 ip access-list extended voice permit ip YY.YY.44.0 0.0.0.255 any dscp ef oer-map OER 10 match traffic-class access-list CS2 set mode select-exit good set mode route control set next-hop YY.YY.17.7 set active-probe echo YY.YY.55.5 set link-group CS2 fallback CS4 oer-map OER 20 match traffic-class access-list CS4 set mode select-exit good set mode route control

set next-hop YY.YY.42.10 set active-probe echo YY.YY.55.5 set link-group CS4 fallback CS2 oer-map OER 30 match traffic-class access-list voice set mode select-exit best set delay threshold 40 set mode route control set mode monitor fast set jitter threshold 100 set active-probe jitter YY.YY.55.5 target-port 32767 codec g729a set probe frequency 2 RackYYR5 ip sla responder router bgp YY network YY.YY.55.0 mask 255.255.255.0 route-map comm exit route-map comm permit 10 set community no-export RackYYR1 key chain cisco key 1 key-string CISCO oer border local Loopback0 port 60000 master YY.YY.4.4 key-chain cisco active-probe address source interface Loopback0 interface Tunnel1 ip address 12.12.12.1 255.255.255.252 tunnel source YY.YY.1.1 tunnel destination YY.YY.2.2

RackYYR2 key chain cisco key 1 key-string CISCO oer border local Loopback0 port 60000 master YY.YY.4.4 key-chain cisco active-probe address source interface Loopback0 interface Tunnel1 ip address 12.12.12.2 255.255.255.252 tunnel source YY.YY.2.2 tunnel destination YY.YY.1.1

2.9 IPv6 Routing The administrator has started to configure Unique Local IPv6 addresses in your network. Continue configuring IPv6 according to the Diagram and as per the following requirement: The process ID can be any number OSPFv3 router IDs must be stable and identical to the OSPFv2 router IDs Ensure that all switches attached to the VLAN 123 exchange routing updates primary with SW1 and then with SW2 (in case SW1 goes down) and ensure that SW3 and SW4 will never take over this role in place of SW1 or SW2. Use extreme numeric values. Assign sure that SW2-Lo8 global address 2011:CC1E:88:88:88::88/128 on interface Lo8 in SW2 Make sure that SW2-Lo8 global address is filtered from going into AREA 142. but allowed in AREA 51. SW2-Lo8 must appear as OSPFv3 External Type 2 in Area 0 Do not assign other globally routable IPv6 address to any physical interface. Note Ipv6 addresses on interfaces will be preconfigured Score : 3 Point

R4 RackYYR4# RackYYR4#sh run int ser0/0/0 Building configuration... Current configuration : 202 bytes interface Serial0/0/0 ip address YY.YY.14.4 255.255.255.248 encapsulation ppp ipv6 address FEC1:CC1E:14::4/64 ipv6 ospf YY area 142 no fair-queue clock rate 125000 ppp authentication chap end RackYYR4# RackYYR4#sh run int ser0/0/1 Building configuration... Current configuration : 1YY bytes interface Serial0/0/1 ip address YY.YY.24.4 255.255.255.0 encapsulation ppp ipv6 address FEC1:CC1E:24::4/64 ipv6 ospf YY area 142 ppp authentication chap end ipv6 router ospf YY router-id YY.YY.4.4 log-adjacency-changes R1 RackYYR1#sh run int ser0/0/0 Building configuration...

Current configuration : 183 bytes interface Serial0/0/0 ip address YY.YY.14.1 255.255.255.0 encapsulation ppp ipv6 address FEC1:CC1E:14::1/64 ipv6 ospf YY area 142 no fair-queue ppp chap password 0 CISCO end RackYYR1#sh run int fa0/0 Building configuration... Current configuration : 171 bytes interface FastEthernet0/0 ip address YY.YY.17.1 255.255.255.0 ip ospf mtu-ignore duplex auto speed auto ipv6 address FEC1:CC1E:17::1/64 ipv6 ospf YY area 142 end // Not required RackYYR1# ipv6 router ospf YY router-id YY.YY.1.1 log-adjacency-changes R2 RackYYR2#sh run int ser0/0/0 Building configuration... Current configuration : 203 bytes interface Serial0/0/0 ip address YY.YY.24.2 255.255.255.0 encapsulation ppp

ipv6 address FEC1:CC1E:24::2/64 ipv6 ospf YY area 142 no fair-queue clock rate 2000000 ppp chap password 0 CISCO end RackYYR2#sh run int fa0/0 Building configuration... Current configuration : 171 bytes interface FastEthernet0/0 ip address YY.YY.42.2 255.255.255.0 ip ospf mtu-ignore duplex auto speed auto ipv6 address FEC1:CC1E:42::2/64 ipv6 ospf YY area 142 end // Not required ipv6 router ospf YY router-id YY.YY.2.2 log-adjacency-changes SW1 RackYYSW1#sh run int vlan 123 Building configuration... Current configuration : 182 bytes interface Vlan123 ip address YY.YY.123.7 255.255.255.0 ip ospf priority 255 ip ospf mtu-ignore ipv6 address FEC1:CC1E:123::7/64 ipv6 ospf mtu-ignore ipv6 ospf YY area 0 end // Not required RackYYSW1#sh run int fa1/0/1 Building configuration...

Current configuration : 143 bytes interface FastEthernet1/0/1 no switchport ip address YY.YY.17.7 255.255.255.0 ipv6 address FEC1:CC1E:17::7/64 ipv6 ospf YY area 142 end RackYYSW1# ipv6 router ospf YY router-id YY.YY.7.7 log-adjacency-changes SW2 RackYYSW2#sh run int vlan 123 Building configuration... Current configuration : 182 bytes interface Vlan123 ip address YY.YY.123.8 255.255.255.0 ip ospf priority 254 ip ospf mtu-ignore ipv6 address FEC1:CC1E:123::8/64 ipv6 ospf mtu-ignore ipv6 ospf YY area 0 end // Not required RackYYSW2#sh run int vlan 55 Building configuration... Current configuration : 158 bytes interface Vlan55 ip address YY.YY.55.8 255.255.255.0 ip ospf mtu-ignore ipv6 address FEC1:CC1E:55::8/64 ipv6 ospf mtu-ignore // Not required

ipv6 ospf YY area 51 end RackYYSW2# ipv6 router ospf YY router-id YY.YY.8.8 log-adjacency-changes SW3 RackYYSW3#sh run int vlan 123 Building configuration... Current configuration : 160 bytes interface Vlan123 ip address YY.YY.123.9 255.255.255.0 ip ospf mtu-ignore ipv6 address FEC1:CC1E:123::9/64 ipv6 ospf mtu-ignore ipv6 ospf YY area 0 end // Not required RackYYSW3# ipv6 router ospf YY router-id YY.YY.9.9 log-adjacency-changes SW4 Rack67SW4#sh run int vlan 123 Building configuration... Current configuration : 162 bytes interface Vlan123 ip address YY.YY.123.10 255.255.255.0 ip ospf mtu-ignore // Not required

ipv6 address FEC1:CC1E:123::10/64 ipv6 ospf mtu-ignore ipv6 ospf YY area 0 end Rack67SW4#sh run int vlan 42 Building configuration... Current configuration : 161 bytes interface Vlan42 ip address YY.YY.42.10 255.255.255.0 ip ospf mtu-ignore ipv6 address FEC1:CC1E:42::10/64 ipv6 ospf mtu-ignore ipv6 ospf YY area 142 end // Not required Rack67SW4# ipv6 router ospf YY router-id YY.YY.9.9 log-adjacency-changes R5 RackYYR5#sh run int fa0/1 Building configuration... Current configuration : 192 bytes interface FastEthernet0/1 ip address YY.YY.55.5 255.255.255.0 ip ospf mtu-ignore duplex auto speed auto ipv6 address FEC1:CC1E:55::5/64 ipv6 ospf mtu-ignore ipv6 ospf YY area 51 end // Not required RackYYR5#sh run int ser0/0/0 Building configuration...

Current configuration : 136 bytes interface Serial0/0/0 ip address YY.YY.35.5 255.255.255.0 ipv6 address FEC1:CC1E:35::5/64 ipv6 ospf YY area 51 no fair-queue end RackYYR5# ipv6 router ospf YY router-id YY.YY.5.5 log-adjacency-changes R3 RackYYR3#sh run int ser0/0/0 Building configuration... Current configuration : 156 bytes interface Serial0/0/0 ip address YY.YY.35.3 255.255.255.0 ipv6 address FEC1:CC1E:35::3/64 ipv6 ospf YY area 51 no fair-queue clock rate 2000000 ipv6 router ospf YY router-id YY.YY.3.3 log-adjacency-changes VERIFICATION

Ensure that all switches attached to the VLAN 123 exchange routing updates primary with SW1 and then with SW2 (in case SW1 goes down) and ensure that SW3 and SW4 will never take over this role in place of SW1 or SW2. SW1 RackYYSW1(config)#int vlan 123 RackYYSW1(config-if)#ipv6 ospf priority 255 SW2 RackYYSW1(config)#int vlan 123 RackYYSW2(config-if)#ip ospf priority 254

VERIFICATION Use extreme numeric values. Assign sure that SW2-Lo8 global address 2011:CC1E:88:88:88::88/128 on interface Lo8 in SW2 R2 RackYYSW2#sh run int loopback 8 Building configuration... Current configuration : 83 bytes interface Loopback8 no ip address ipv6 address 2011:CC1E:88:88:88::88/128 end

RackYYSW2# Make sure that SW2-Lo8 global address is filtered from going into AREA 142. but allowed in AREA 51. RackYYSW2(config)#route-map lp8 RackYYSW2(config-route-map)#match interface loopback 8 RackYYSW2(config)#ipv6 router ospf YY RackYYSW2(config-rtr)#redistribute connected route-map lp8 RackYYR4(config)#ipv6 router ospf YY RackYYR4(config-rtr)#area 142 stub RackYYR1(config)#ipv6 router ospf YY RackYYR1(config-rtr)#area 142 stub RackYYR2(config)#ipv6 router ospf YY RackYYR2(config-rtr)#area 142 stub RackYYSW1(config)#ipv6 router ospf YY RackYYSW1(config-rtr)#area 142 stub Rack67SW4(config)#ipv6 router ospf YY Rack67SW4(config-rtr)#area 142 stub VERIFICATION on R4 area 142

It will come as default route VERIFICATION on R3 Area 51

SW2-Lo8 must appear as OSPFv3 External Type 2 in Area 0 VERIFICATION on Sw3

2.10 IPv6 Feature Continue configuring IPv6 according to the following requirements:- In an attempt to reduce link-layer congestion, limit to 4 messages per second the rate at which all IPv6 enabled deviced general all IPv6 ICMP error messages Enable Netflow for IPv6 on R1 to monitor the traffic leaving AREA 142 Export the flows every two minutes to the server YY.YY.44.100 (port 9876) Use R1-Lo0 as source address for the exports Aggregate the flows per ports and allow up to 20000 entries in the cache Inactive entries must be deleted from the cache after 3 min of inactivity Score : 3 Point

On R1, R2, R3, R4, R5, SW1, SW2, SW3, SW4 ( all routers and switches ) ipv6 icmp error-interval 250 R1 ipv6 cef ipv6 flow-export version 9 ipv6 flow-export destination YY.YY.44.100 9876 ipv6 flow-export source Loopback0 ipv6 flow-export template timeout-rate 2 ipv6 flow-aggregation cache protocol-port export destination YY.YY.44.100 cache entries 20000 -> You must reboot, then value will be applied cache timeout inactive 180 enabled interface FastEthernet0/0 ipv6 flow egress

SECTION lll. IP Multicast 3.1 Implement PIM Spares Mode for IPv4 Multicast Configure PIM sparse mode on OSPF Area 0 and Area 142 according to following requirement There is multicast source on VLAN_44 and clients are located on the BB3 subnet (150.3.YY.0 /24) Use a non-proprietary dynamic method of learning the RP. Ensure that R1-Lo0 is the preferred RP but that R2-Lo0 is able to take over in case R1 goes down. Simulate that clients have sent requests to join the multicast group 239.YY.YY.1 and ensure they reply to pings from R4's f0/0 Score : 3 Point On R4 ip multicast-routing

interface Serial0/0/0 ip pim sparse-mode interface Serial0/1/0 ip pim sparse-mode interface FastEthernet0/0 ip pim sparse-mode interface FastEthernet0/1 ip pim sparse-mode On R1 ip multicast-routing interface Serial0/0/0 ip pim sparse-mode interface FastEthernet0/0 ip pim sparse-mode On R2 ip multicast-routing interface Serial0/0/0 ip pim sparse-mode interface FastEthernet0/0 ip pim sparse-mode 106

On SW1 ip multicast-routing distribute interface FastEthernet0/1 ip pim sparse-mode int vlan 123 ip pim sparse-mode On SW2 ip multicast-routing distribute interface vlan 123 ip pim sparse-mode interface vlan 33 ip pim sparse-mode On SW3 ip multicast-routing distribute int vlan 123 ip pim sparse-mode SW4 ip multicast-routing distribute interface vlan 42 ip pim sparse-mode interface vlan 123 ip pim sparse-mode 107

Ensure that R1-Lo0 is the preferred RP but that R2-Lo0 is able to take over in case R1 goes down. On R1 interface Loopback0 ip pim sparse-mode ip pim rp-candidate Loopback0 priority 0 On R2 interface Loopback0 ip pim sparse-mode ip pim rp-candidate Loopback0 priority 255 On R4 interface Loopback0 ip pim sparse-mode Use a non-proprietary dynamic method of learning the RP. ip pim bsr-candidate lo0 There is multicast source on VLAN_44 and clients are located on the BB3 subnet (150.3.YY.0 /24) On SW2 interface vlan 33 ip igmp join-group 239.YY.YY.1 Simulate that clients have sent requests to join the multicast group 239.YY.YY.1 and ensure they reply to pings from R4's f0/0

Verification

3.2 PIM Tuning Ensure that all multicast PIM register request are always sent upstream to the RP via SW1 It SW1 fails, another switch on VLAN 123 should be able to forward the PIM register requests upstream to the RP. Score : 3 Point

On SW1 interface vlan 123 ip pim dr-priority 4294967294 On SW4 Interface vlan 123 Ip pim dr-priority 4294967290 VERIFICATION

SECTION IV. Advanced Services 4.1 Network Address Translation (NAT) You are required to configure NAT in this task. The output must be matched with it provided the below. You are allowed to add only 1 static route on a maximum of 4 devices to accomplish this task. But do not use static on R4 Score : 3 Point NAT should be implemented on R4, with nat translations showing SW1 is pinging SW4 SW1 can be established SW4 with a new source not yet created on the SW. Thus create new loopback and ping SW4 with ip YY.YY.200.4

SW4 pinging SW1 with a new source also as per above, but pinging SW1 with ip YY.YY.100.1