CCIE-RS-N5.MC

1.1 Switch Management ​ Ether on each switch (sw1,sw2,sw3,and sw4) an IOS command that allows all Fast Ethernet Port to be configured at once you will find this step usesful on the next question. ​ note: the GB ethernet ports on these devices are not used in this test Define int 1-24 f0/1-24 1.2 Switch Protocols ​ disable DTP and VTP traffic on all Fast Ethernet ports on all switches Sw1-4: Int range macro 1-24 Sw mo access （access-link） Sw nonegotiate （trunk-link） Vtp mode transparent 禁用VTP，所以不用配置VTP domain-name 。 1.3 VLAN Managment VLAN ID VLAN Name Switch Port YY VLAN_A R1 g0/0 12 VLAN_B R5 g0/1 R2 g0/1 13 VLAN_C R3 g0/0 R6 g0/1 14 VLAN_D R4 g0/0 15 VLAN_BB1 R6 g0/0 BB1 16 VLAN_BB2 R5 g0/0 BB2 配置VLAN_YY ~ VLAN_BB2 在全部SW1-SW4 。 1.4 Trunking ​ trunk as a simple way to load balance traffic create 2 separate isl trunks between sw1 and sw2 using these ports: ​ trunk all odd VLANs that are being used in you topology over port Fa0/23 ​ trunk all even VLANs that are being used in you topology over port Fa0/24 ​ Make sure all VLANs are present on both switches SW1/SW2: int f0/23 Sw tr en isl Sw tr al vlan YY, 13, 15，17 Sw mo tr Sw nonegotiate int f0/24 Sw tr en isl Sw tr al vlan 12，14，16 Sw mo tr Sw nonegotiate ‘vlans that are being used in you topology’明确指出VLAN1不在考虑范围内 1.5 Etherchannel ​ Sw1 and sw3 Fa0/19 and Fa0/20 etherchannel ​ These interface to build 2 two-port standards-based EthernetChannel link with follow ​ The link should NOT be a trunk and should only service VLAN 13 ​ The port on sw3 must initiate negotiation to form the channel ​ The port on sw1 should not initiate negotiation to form the channel use your rack number in the form “YY” to number your port-channel Sw1: int range f0/19-20 Sw ac vlan 13 Channel-g yy mo pass Sw3: int range f0/19-20 Sw ac vlan 13 Channel-g yy mo active 必须使用LACP 1.6 SVI ​ Add the following switch virtual interface to SW1-VLAN_D and Sw3-VLAN_C Once they are configured make sure that you have connectivity to any other device on that network segment ​ Add IP address YY.YY.13.7/24 to Sw1 ​ Add IP address YY.YY.17.9/24 to Sw3 Sw1: int vlan 14 Ip add yy.yy.13.7 255.255.255.0 SW3:int vlan 13 Ip add yy.yy.17.9 255.255.255.0 1.7 Catalyst Feature ​ In order to prevent any loss of data packets during congestion configure Sw3 G0/1 so that the port can receive pause frames from the attached decice until the congestion condition cleans Sw3: No mls qos int g0/1 Flow-control recive on 1.8 Spanning Tree ​ Configure Sw1 port fa0/7 on VLAN_D ,Sw1 should be the root bridge for VLAN_D,the maxmum age interval to 16 seconds,the forward delay to 14 seconds,and hello interval of 2 second Sw1: int f0/7 Sw access vlan 14 Span vlan 14 pri 0 Span vlan 14 max 16 Span vlan 14 forward-time 14 1.9 Network Analyzer ​ Configure Sw2 so that a network analyzer can collect all bidirectional IP traffic on Fa0/20 The Analyzer is connected to Fa0/16(端口不确定) No monitor session all Monitor session 1 so int f0/20 both Monitor session 1 de int f0/18 1.10 Link Diagnostics ​ Configure the trunk between Sw1 and Sw2 on port Fa0/23 so that the trunk will be brought down if a unidirectional 链路在接口上产生，ensure that the trunk gets shutdown if one side stops processing traffics Sw1-2: int f0/23 Udld port aggressive 1.11 Spanning-Tree Protection ​ You have experienced problems with receving BPDU form Backbone VLANs,Configure your backbone interface to ensure that BPDUs are not send or received on VLAN_BB1 or VLAN_BB2 Sw1/sw2: int f0/10 Span bpdufliter enable 1.12 Port Recovery ​ On sw1,ensure that all ports that are put into errdisable state due to a unidirectional state are re-enabled, the maximum time that a port should remain in errdisable state in 10 minutes Sw1(config)#errdisable recovery cause udld Sw1(config)#errdisable recovery interval 600 1.13 Frame Relay Configuration ​ The Frame Relay Cloud provided is fully meshed,however only use PVCs indicated in Dagram 3,The use os dynamic circuits is not permitted,configure the frame relay cloud as follows ​ Creart a hub-and spoke configure setup for R3(hub),R2(spoke),and R5(spoke) use a mutil-point subinterface at the sub and phytical interface at the spoke ​ Use point-to-point subinterfaces fot the Frame Relay cloud between R1 and R6 ​ For all other connection use phytical interfaces ​ Make sure that you can ping across all Frame Relay interface within the same Frame Relay cloud R1 interface Serial0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp interface Serial0/0.1 point-to-point ip address YY.YY.6.18 255.255.255.252 frame-relay interface-dlci 106 R6 interface Serial0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp interface Serial0/0.6 point-to-point ip address YY.YY.6.17 255.255.255.252 frame-relay interface-dlci 601 R3 interface Serial0/0 no ip address encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp interface Serial0/0.3 multipoint ip address YY.YY.12.13 255.255.255.248 frame-relay map ip YY.YY.12.12 302 broadcast frame-relay map ip YY.YY.12.13 302 broadcast frame-relay map ip YY.YY.12.14 305 broadcast interface Serial0/1 ip address YY.YY.16.3 255.255.255.0 encapsulation frame-relay no arp frame-relay no frame-relay inverse-arp frame-relay map ip YY.YY.16.3 314 broadcast frame-relay map ip YY.YY.16.4 314 broadcast R4 interface Serial0/0 ip address YY.YY.16.4 255.255.255.0 encapsulation frame-relay no arp frame-relay frame-relay map ip YY.YY.16.3 413 broadcast frame-relay map ip YY.YY.16.4 413 broadcast no frame-relay inverse-arp R2 interface Serial0/0 ip address YY.YY.12.12 255.255.255.248 encapsulation frame-relay no arp frame-relay frame-relay map ip YY.YY.12.12 203 broadcast frame-relay map ip YY.YY.12.13 203 broadcast frame-relay map ip YY.YY.12.14 203 broadcast no frame-relay inverse-arp R5 interface Serial0/0 ip address YY.YY.12.14 255.255.255.248 encapsulation frame-relay no arp frame-relay frame-relay map ip YY.YY.12.12 503 broadcast frame-relay map ip YY.YY.12.13 503 broadcast frame-relay map ip YY.YY.12.14 503 broadcast no frame-relay inverse-arp IP IGP Protocols 1.1 Basic RIP Configuration ​ Configure RIPv2 on R6-G0/0,Backbone 1. A router on the backbone 1 . network advertise routes of the format 199.172.Z.0 . Make sure that routing updates are ONLY sent to the backbone routes (150.1.YY.254) on VLAN_BB1 2.2 RIP Filtering ​ Configure R6 using a standard access control list (ACL) named "RIP_IN" with a single access-list entry so that only the routes below are seen in the routing table of R6 and in the rest of your topology RackYYR6#show ip route rip R 199.172.YY.0/24 [120/4] via 150.1.YY.254 G0/0 R 199.172.10.0/24 [120/4] via 150.1.YY.254 G0/0 R 199.172.9.0/24 [120/4] via 150.1.YY.254 G0/0 R 199.172.8.0/24 [120/4] via 150.1.YY.254 G0/0 R 199.172.3.0/24 [120/4] via 150.1.YY.254 G0/0 R 199.172.2.0/24 [120/4] via 150.1.YY.254 G0/0 R 199.172.1.0/24 [120/4] via 150.1.YY.254 G0/0 ip access-list standard RIP_IN permit 199.172.0.0 0.0.15.0 router rip version 2 passive-interface default no pass e0/0 network 150.1.0.0 neighbor 150.1.YY.254 distribute-list RIP_IN in Ethernet0/0 no auto-summary 2.3 OSPF Configuration ​ Configure OSPF on all routers and switches as indicated on Diagram 2 Use router-ID x.x.x.x on each device running OSPF. Example For R1, this router-ID would be 1.1.1.1, and for Sw2, this router-ID would be 8.8.8.8 .Configure the diffrent interfaces within OSPF areas as follows R1 G0/0 Area 10 R1 G0/1 Area YY R1 S0/0.1 Area YY R2 S0/0 Area 0 R3 S0/0.1 Area 0 R3 S0/1 Area 2 R3 G0/0 Area YY R3 G0/1 Area YY R4 S0/1 Area 2 R4 G0/0 Area 13 R5 S0/0 Area 0 R6 S0/0.1 Area YY R6 G0/1 Area YY Sw1 SVI Area 13 Sw2 Fa0/1 Area YY Sw2 Fa0/3 Area YY Sw2 Fa0/19 Area YY Sw3 SVI Area YY Sw4 Fa0/19 Area YY 2.3a Area 0 ​ Configure OSPF area 0 over the Frame Relay cloud ​ Do NOT change the OSPF network type. R3: router ospf YY router-id 3.3.3.3 log-adjacency-changes network YY.YY.12.13 0.0.0.0 area 0 neighbor YY.YY.12.12 neighbor YY.YY.12.14 R2: router ospf YY router-id 2.2.2.2 log-adjacency-changes network YY.YY.12.12 0.0.0.0 area 0 int s0/0 ip os pri 0 R5 router ospf YY router-id 5.5.5.5 network YY.YY.12.14 0.0.0.0 area 0 int s0/0 ip os pri 0 2.3b Area 2 ​ Make sure that the OSPF process uses a hello interval of 10 seconds and a dead interval of 40 seconds. however do NOT configure these timers explicitly. P2P Serial0/0/1 is up, line protocol is up Internet Address 7.7.16.4/24, Area 2 Process ID 7, Router ID 4.4.4.4, Network Type POINT_TO_POINT, Cost: 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 R3 Router os YY network YY.YY.16.3 0.0.0.0 area 2 int s0/1 ip ospf net point-to-point R4 Router os YY network YY.YY.16.4 0.0.0.0 area 2 int s0/1 ip ospf net point-to-point 2.3c Area 11 ​ Configure OSPF on R1,R3,R6,Sw2,Sw3,and SW4 as indicated in Diagram 2. R1 router ospf yy router-id 1.1.1.1 log-adjacency-changes detail network yy.yy.6.18 0.0.0.0 area 11 network yy.yy.10.1 0.0.0.0 area 11 R3 router ospf yy router-id 3.3.3.3 log-adjacency-changes detail network yy.yy.11.3 0.0.0.0 area 11 network yy.yy.17.3 0.0.0.0 area 11 R6 router ospf yy router-id 6.6.6.6 log-adjacency-changes detail network yy.yy.6.17 0.0.0.0 area 11 network yy.yy.17.6 0.0.0.0 area 11 SW2 router ospf yy router-id 8.8.8.8 log-adjacency-changes detail network yy.yy.10.2 0.0.0.0 area 11 network yy.yy.11.8 0.0.0.0 area 11 network yy.yy.18.8 0.0.0.0 area 11 SW3 router ospf yy router-id 9.9.9.9 log-adjacency-changes detail network yy.yy.17.9 0.0.0.0 area 11 SW4 router ospf yy router-id 10.10.10.10 log-adjacency-changes detail network yy.yy.18.10 0.0.0.0 area 11 2.3d Area 10 and 13 ​ Configure Area 10 as indicated in Diagram 2. ​ Configure Area 13 so that both external routes and summary routes(interarea routes)are blocked .Make sure that only intra-area routes and the default of 0.0.0.0 are allowed into this area and as seen on Sw1. Area 13 total stub area ​ Configrure R4 so that the default route on Sw1 looks like the following O*IA 0.0.0.0/0 [110/19] via YY.YY.13.4,......VLAN14 R1 router ospf YY router-id YY.YY.1.1 log-adjacency-changes area YY virtual-link YY.YY.3.3 network YY.YY.15.1 0.0.0.0 area 10 R3 Router os YY Area YY virtual-link YY.YY.1.1 Area 2 virtual-link YY.YY.4.4 R4 router ospf YY router-id YY.YY.4.4 log-adjacency-changes area 2 virtual-link YY.YY.3.3 area 13 stub no-summary area 13 default-cost 18 network YY.YY.13.4 0.0.0.0 area 13 Sw1 router ospf YY router-id YY.YY.7.7 log-adjacency-changes area 13 stub network YY.YY.13.7 0.0.0.0 area 13 2.4 OSPF Summarization ​ Make sure that Area 13 subnets get summarized to the remaining area as one single minimal route (not/24).Make sure to maintain full connectivity within your network upon meeting this requirment. R4： router os YY are 13 rang y.y.0.0 255.255.240.0 也可能在R1和R3上做： router os YY area YY range YY.YY.0.0 255.255.224.0 邻居统计: R1 3 R2 1 R3 8 R4 3 R5 1 R6 3 SW1 1 SW2 3 SW3 2 SW4 1 2.5 Redistribution RIP-OSPF ​ Configure mutual redistribution between RIP and OSPF. Make sure that all routes are seen thoughout your topology upon fulfilling This task,. Make sure to meet requirements in Question 2.2. ​ Advertise your YY.YY.0.0 network to the backbone router as a /16 only. Even if new networks are added to RIP process in the future. Keep RIP autosummarization disabled. R6 router ospf YY router-id YY.YY.6.6 log-adjacency-changes redistribute rip subnets ip prefix tbb1 permit yy.yy.0.0/16 router rip redistribute ospf YY metric 1 no auto-summary distribute-list prefix tbb1 out e0/0 int e0/0 ip summary-address rip YY.YY.0.0 255.255.0.0 2.6 EIGRP 100 And EIGRP YY ​ Configure EIGRP 100 on Sw3-Fa0/10 for backbone 3 in AS 100. Permit routes 4.1.1.0/24 128.28.2.0/24 198.1.1.4/32 only and redistribute so that those prefixes are advertised thoughout your topology. These routes must appear as EIGRP routes in SW3 routing table ​ Make sure when redistribuding these routes into OSPF that the cost of the links within the OSPF ​ domain is included with each network LSA on a per hop basic. Metic-type 为一类的就可以了 ​ Configure EIGRP YY on R2 and R5. Ensure that R2 receives the routes within your topology from EIGRP-VLAN_B. Make mutual redistribution between EIGRP YY and OSPF, so that all devices Are reachable from and to VLAN_B. Sw3 ip prefix-list fbb3 seq 5 permit 4.1.1.0/24 ip prefix-list fbb3 seq 10 permit 128.28.2.0/24 ip prefix-list fbb3 seq 15 permit 198.1.1.4/32 router eigrp 100 network 150.3.yy.0 0.0.0.255 distribute-list prefix fbb3 in FastEthernet0/10 no auto-summary router ospf YY router-id 9.9.9.9 log-adjacency-changes redistribute eigrp 100 metric-type 1 subnets R2 router eigrp YY redistribute ospf YY metric 10000 100 255 1 1500 network YY.YY.14.0 0.0.0.255 distance eigrp 90 90 no auto-summary ip prefix-list eto per yy.yy.14.0/24 ip prefix-list eto per yy.yy.5.5 /32 ip prefix-list eto per 150.2.yy.0/24 route-map eto permit 10 match ip address prefix-list eto router ospf YY router-id 2.2.2.2 log-adjacency redistribute eigrp YY subnets route-map eto R5 Route-map con per 10 match int E0/0 router eigrp YY redistribute ospf YY metric 10000 100 255 1 1500 redistribute connected route-map con metric 10000 100 255 1 1500 network YY.YY.14.0 0.0.0.255 no auto-summary ip prefix-list eto permit YY.YY.14.0/24 ip prefix-list eto permit YY.YY.2.2/32 route-map eto permit 10 match ip address prefix-list eto router ospf YY router-id 5.5.5.5 log-adjacency-changes redistribute eigrp YY subnets route-map eto redistribute con subenets route-map con 2.7 Loopback Advertisement ​ Each device has a Loopback0 address in the form YY.YY.X.X/32. Where "YY" is your rack number. And "X" is the router number, For example,R2 on Rack03 has a Loopback0 of 3.3.2.2/32. Assign these loopbacks to the OSPF area of your choice. Once the IP routing is complete, these loopbacks should appear on all routers and Sw2,Sw3,and Sw4 IP routing tables and must be reachable from all devices in your network. 任意公告lo0 注意r4的lo0要公布到area 2 这个需求与前面2.4 有联系 2.8 IPv6 Tunneling ​ Creats a manual IPv6 mode tunnel between R3 and R4 that will support IPv6. The tunnel should Be point-to-point and have the following characteristics ​ R3 Tun0 uses 2001:303:100::3/40 ​ R4 Tun0 uses 2001:303:100::4/40 ​ Ensure that the address can be pinged from R3 and R4. 2.9 IPv6 Routing ​ Create loopback interface on R3 and R4 with the IPv6 addresses below. Configure RIP on R3 And R4 to ensure that the loopback interfaces are advertised across the tunnel created Above. Ensure that you can ping between the loopbacks created. ​ R3 Lo1 uses 2001:303:300::3/128 ​ R4 Lo1 uses 2001:303:400::4/128 R3: Ipv6 unicast-routing Ipv6 router rip cisco interface Loopback1 no ip address ipv6 address 2001:303:300::3/128 ipv6 rip cisco enable interface Tunnel0 no ip address ipv6 address 2001:303:100::3/40 ipv6 rip cisco enable tunnel source Loopback0 tunnel destination y.y.4.4 R4: Ipv6 unicast-routing Ipv6 router rip cisco interface Loopback1 no ip address ipv6 address 2001:303:400::4/128 ipv6 rip cisco enable interface Tunnel0 no ip address ipv6 address 2001:303:100::4/40 ipv6 rip cisco enable tunnel source Loopback0 tunnel destination y.y.3.3 IP/IOS Features 3.1 System Management:NTP 3point ​ Make sure that the clock of R4 gets synchroronized to the clock of R3,meeting the following Requirements: ​ R4 has stratum of 3. ​ Synchronization is done as long as there is an active path between the routers ​ Use the loopback 0 as the source interface ​ Update are authentication R3: Clock set YY:30:00 26 JUN 2008 Clock timezone GMT 8 ntp authentication-key 1 md5 cisco ntp authenticate ntp trusted-key 1 ntp source Loopback0 ntp master 2 R4: Clock timezone GMT 8 ntp authentication-key 1 md5 cisco ntp authenticate ntp trusted-key 1 ntp server y.y.3.3 key 1 source Loopback0 show ntp status ； show running-config 3.2 HSRP 3point ​ Configure R2 and R5 to support HSRP for host on vlan B ​ R5 should be the active router unless its s0/0/0 interface is down,Then R2 should take over (unless its s0/0 interface is down at the same time) Use the ip address yy.yy.14.1 for the gateway ​ Do not use BIA for HSRP MAC_ADDRESS R2: standby 1 ip y.y.14.1 standby 1 preempt standby 1 track Serial0/0 standby 1 mac-address 1234.1234.1234 R5: standby 1 ip y.y.14.1 standby 1 priority 105 standby 1 preempt standby 1 track Serial0/0 standby 1 mac-address 1234.1234.1234 3.3 SYSLOG 2point ​ Configure R5 to send messages representing emergency(0),alerts(1) and critical(2)events to the syslog deamon on a unix device with an ip address of 150.2.yy.250 on VLAN_BB2 the syslog deamon expecting you to use the local6 facility R5: Logging 150.2.Y.250 Logging traps critical Logging facility local6 QOS 4.1 Minimum Buffer Size 3PONIT ​ Configure SW1-F0/1 to change the minimum buffer size form the default values as follows: ​ Minimum-reserve level 3 to 80 packets assigned to egress queue 1 ​ Minimum-reserve level 4 to 150 packets assigned to egress queue 2 ​ Minimum-reserve level 8 to 170 packets assigned to egress queue 3 Sw1 mls qos mls qos min-reserve 3 80 mls qos min-reserve 4 150 mls qos min-reserve 8 170 int fa0/1 wrr-queue min-reserve 1 3 wrr-queue min-reserve 2 4 wrr-queue min-reserve 3 8 verify: show mls qos interface fastEthernet 0/1 buffers 4.2 Frame Relay Fragmentation 3POINT ​ Make sure that data packets going out on R6-S0/0/0.X (dlci601)and R1-S0/0/0.X(106) get fragmented when the packet size exceeds 40 bytes R1/R6： map-class frame fr frame fragment 40 frame fair-queue int s0/0 frame traffic-shaping int s0/0.x frame interface-dlci 106/601 class fr 4.3 NBAR ​ On R6,limit HTTP(URL)associated with images downloads to 100kb/s Assume that the images are in the form of files with extensions .gif,.jpg or .jepg Downloads that exceed 100000 b/s must be drop ​ Apply this inbound on your R6-G0/0 backBone1 interface R6: Ip cef class-map NBAR match protocol http url *.(gif|jpeg|jpg) policy-map NBAR class NBAR policy cir 100000 exceed-action drop interface G0/0 service-policy input NBAR ip nbar protocol-discovery Multicast 5.1 PIM Sparse Mode 3 points ​ Configure-IP-PIM-SM-on-R5(G0/1,S0/0/0),R3(S0/0/0.X,S0/0/1),r4(S0/0/1,G0/0),use R5 loopback 0 as 1 static Rendezvous point,Configure R4 G0/0 to join multicast group 239.225.8.8 make sure you are able to ping this multicast address form the routers on witch multicast is enabled R5 ip multicast-routing interface g0/1 ip pim sparse-mode interface Serial0/0/0 ip pim sparse-mode ip pim rp-address y.y.5.5 R3 ip multicast-routing interface Serial0/0/0.x ip pim sparse-mode interface Serial0/0/0.x multipoint ip pim sparse-mode interface Serial0/0/1 ip pim sparse-mode ip pim rp-address y.y.5.5 R4: ip multicast-routing ip pim rp-address y.y.5.5 interface Serial0/0/1 ip pim sparse-mode interface g0/0 ip pim sparse-mode ip igmp join-group 239.225.8.8 5.2 Multicast Timer 3 points ​ Configure R5 so when it detects there are no longer connected members of a given multicast group on VLAN_B,R5 will respond to IGMP QUERIES AFTER 6 SECONDS of INACTIVITY,before the router deletes this (these) multicast group(s). R5: int G0/1 ip pim sparse-mode ip igmp query-max-response-time 6 Security 6.1 Telnet Control 3ponits ​ Ensure that only users on the following networks are allowed to telnet to SW2 ​ yy.yy.0.0/16 ​ 150.1.0.0/16 sw2: access-list 1 permit yy.yy.0.0 0.0.255.255 access-list 1 permit 150.1.0.0 0.0.255.255 line vty 0 15 access-class 1 in 6.2 Switch Secuity 3points ​ VLAN_B needs high security,Configure the ports in the VLAN to support only the MAC addresses of the routers that are currently attached to them ​ This configuration should survive a reboot of a switch ​ Log violation of this policy while allowing correct traffic to proceed SW1： int f0/2 shut (一定要先shutdown) switchport mode access switchport port-security switchport port-security maximum 2 switchport port-