RackSection1–Layer2troubleshootinglayer2 (4Twofaultshavebeeninjectedintothepreconfigurationjustdescribed,theseissuesmayimpedeaworkingsolutionforcertainportionsWorkingasexpected.thenyoumustfixtheunderlyingproblemNoipdhcpsnoopingvlan17NoiparpinspectionvlanInterrangef0/19–Nospanning-treeguardVLANandAccess- (2Configurethefourswitchesasperthefollowing·CompletetheVLANsconfigurationfortheaccessswitchportsaspertheVLANtableabove(casesensitive)·EnsurethatallunusedphysicalportsonallswitchesareshutdownandconfiguredasaccessportsinVLAN999(donotforgetGigabitports)·ConfigVTPtransparentmodeallswitchesVtpdomainCCIEVtpversion2vlanvlan29vlan34nameR3-R4vlan38vlan45nameR4-R5vlan56vlan67nameSW1-SW2vlan89nameSW3-SW4vlan100vlan200nameBB2vlan300nameBB3vlan333vlan500vlan666nameCARRIERvlan999name//showvlanInterSwitchportmodeaccessSwitchportaccessvlan17Interf0/2SwitchportmodeaccessSwitchportaccessvlan200Interf0/3SwitchportmodeaccesssSwitchportaccessvlan34Interf0/4SwitchportmodeaccessSwitchportaccessvlan45Interf0/5SwitchportmodeaccessSwitchportaccessvlan56Interf0/10SwitchportmodeaccessInterrangef0/6-9,f0/11–18,g0/1-2SwitchportmodeaccessSwitchportaccessvlan999IntervlanIpaddNoshutIpaddNoInterSwitchportmodeaccessSwitchportaccessvlan100Interf0/2SwitchportmodeaccessSwitchportaccessvlan29Interf0/3SwitchportmodeaccessSwitchportaccessvlan38Interf0/4SwitchportmodeaccessSwitchportaccessvlan34Interf0/5SwitchportmodeaccessSwitchportaccessvlan45Interf0/10SwitchportmodeaccessSwitchportaccessvlan200Interrangef0/6-9,f0/11–18,g0/1-2SwitchportmodeaccessSwitchportaccessvlan999IntervlanIpaddNoshutIpaddNoInterSwitchportmodeSwitchportaccessvlanInterrangef0/1–9,f0/11–18,g0/1–2SwitchportmodeaccessSwitchportaccessvlan999IntervlanIpaddNoshutIpaddNoshutIpaddNoInterrangef0/1–18,g0/1–2SwitchportmodeaccessSwitchportaccessvlan999IntervlanIpaddNoshutIpaddNo (3ConfigureMultipleSpanning-Tree(MST)onallfourswitchesasperthefollowing·Settheregionnameas·AssignallactiveoddVLANstoinstance·AssignallactiveevenVLANstoinstance·ExplicitlyassignallunsetedVLANstoinstance·EnsurethatSW1istheprimaryrootbridgeforoddVLANsandfor·EnsurethatSW1isthesecondaryrootforeven·EnsurethatSW2istheprimaryrootbridgeforeven·EnsurethatSW2isthesecondaryrootforoddVLANsandfor·Oddnumbersare1,3,5,etcandevennumbersare·Don’tforgetanyotherVLANsusedthroughouttheexam!VLANID:1729343845566789100200300333500666999Spanning-treemodemstSpanning-treemstconfigurationnameCiscoinstance3vlan1-Instance1vlanInstance2vlanSpanning-treemst0,1rootprimarySpanning-treemst2rootsecondarySpanning-treemst2rootprimarySpanning-treemst0,1rootsecondarySwitchTrunkingand (3Refertothe“Diagrams5Trunkports”andconfigurethedualtrunkportsbetweenallswitchesasperthefollowingrequirements:·ThenativeVLANisVLAN·EnsurethatthenativeVLANisConfigurea200MbpslogicaltrunkbetweenSW1andSW2asperthefollowing·TheEtherChannelmustuseIEEE·SW2can'tinitiatethe·TheloaddistributionmechanismmustusethesourceanddestinationhostMAC·Ifmorechannelmemberswereaddedinthefuture,Fa0/24musthavethebestchancetobethefirstactiveportVlandot1qtagnativeInterrangef0/19-Switchporttrunkencapsulationdot1qSwitchportmodetrunkSwitchportnonegotiateSwitchporttrunknativevlan999Interrangef0/23-24Channel-group12modeactiveInterf0/24Port-channelload-balancesrc-dst-macInterrangef0/23-24Channel-group21modepassiveInterf0/24Layer2Protocol (4Configureyournetworkasperthefollowing·UsersconnectedtoVLAN333onSW3mustbeabletocommunicatewithusersconnectedtoVLAN333onSW4viatheirinterfaceFa0/19(respectivelyconnectedtoSW1andSW2)·ConfiguretheVLAN333interfaceonSW3withtheIPaddress·ConfiguretheVLAN333interfaceonSW4withtheIPaddress·VLAN333mustbeallowedtoflowonlythroughSW3andSW4’sFa0/19,noothertrunksmaycarrythisVLAN·SW1andSW2mustcarrytheVLAN333dataacrossthenetworkusingVLAN·VLAN666mayexistonlyonSW1andSW1andSW2mustallowedVLAN333onanytrunksandmustallowVLANonlyonthetrunksbetween·NootherportinanyswitchmaycarryVLAN·Donotmodifyanyspanningtreecostorportprioritytoachievethe·ReferingtotheexhibitbelowSW3mustseeSW4asCDPneighborviainterfaceFa0/19andmustbeabletopingSW4’sVLAN333IntervlanIpaddNoIntervlanIpaddNoInterf0/19Switchporttrunkallowedvlan333Interrangef0/20-24SwitchporttrunkallowedvlanremoveInterf0/19Switchmodedot1q-tunnelSwitchaccessvlan666L2protocol-tunnelcdpInterrangef0/20-22Switchporttrunkallowedvlanremove333,666interport12/port21switchporttrunkallowedvlanremove//SW3/SW4showcdpPingvlanPPPover (3Configureyournetworkasperthefollowing·ConfigureR3asaPPPoE·ConfigureR4asaPPPoE·Thelinkmustbeupifthereisnotrafficat·DonotuseDHCPtoassigntheIP·TheclientmustuseCHAPtoauthenticatewiththeserver(usethedevice’shostnameasCHAPusernameandanypassword)VpdnBba-grouppppoeglobalVirtual-template1UsernameRack29R4passwordciscoIplocalpoolciscoInterg0/0IpaddIpmtuIpunnumberedg0/0pppauthenticationchapPeerdefaultipaddresspoolvirtual-template1下就可以了，總之注意審題VpdnenableInterf0/1PppoeenableNoipaddressInterdialerIpmtuIpaddressnegotiatedEncapsulationpppPppchappasswordciscoDialerpool1Dialer//R4clearpppoeallshowipinterbriefIfR4f0/1hasanIPaddress,deleteit(noip (2ConfigureFrame-RelaybetweenR1andR2asperthefollowing·R1usesDLCI·R2usesDLCI·UseIETF·EnsurebothDTEdonotbuilddynamicaddress·EnsurethatbroadcastpacketsarereplicatedontheFrame-Relay·EnsurethatbothDTEareabletopingeachotheraswellastheirownFrame-Relay·ConfigureR1andR2theadministrativebandwidthforbothFrame-Relayinterfacesto50000Kbps·R4ispre-configuredastheFrame-RelaySwitch,DotnotmodifyanyFrame-RelayconfigurationonR4Note:Kbps=KilobitspersecondR4(Preconfigure,neednottomodifyit)Frame-relayswitchingInterEncapsulationframe-relayClockrate64000Frame-relayroute102interfaces0/0/1201NoipaddressNoshutEncapsulationframe-relayClockrate64000Frame-relayroute201interfaces0/0/0102NoipaddressNoInters0/0/0Noframe-relayinverse-arpIpaddFrame-relaymapip102Frame-relaymapip102broadcastNoshutInters0/0/0Noframe-relayinverse-arpIpaddFrame-relaymapip201Frame-relaymapip201broadcastNoshutSection2–Layer3·Afterfinishingeachofthefollowingquestions,makesurethatallconfiguredinterfaceandsubnetsareconsistentlyvisibleonallpertinentroutersandswitches·Donotredistributebetweenanyinteriorgatewayprotocol(IGP)andBorderGatewayProtocol(BGP)unlessstatedotherwiseinaquestion·YouneedtopingaBGProuteonlyifitisstatedexplicitlyinaquestion,otherwisetherouteshouldbeonlyintheBGPtable·Attheendofthissection,allsubnetsinyourtopology,includingtheloopbackinterfaces,mustbereachableviapingfromR3,Thebackboneinterfacesmustbereachableonlyiftheyarepartofthesolutiontoaquestion·TheloopbackinterfacesmustbeseenasahostrouteintheroutingtablesunlessstatedotherwiseinaquestionIPv4 (3ConfigureOSPFasperthe“Diagram1:IGPRouting”andasperthefollowing·TheOSPFprocessIDcanbeany·TheOSPFrouterIDsmustbestableandmustbeconfiguredusingtheIPaddressofinterfaceloopback0·DonotcreateadditionalOSPF·DonotuseanyIPaddressnotlistedin“Diagram1:IGP·IncaseeitherR1orR5isdown,R4muststillbeabletoreachallotherOSPFprefixesviaR3·DonotchangetheOSPFnetworktypeonFrame-Relay·DonotpropagateanydefaultrouteinanyAreaIpIpRouterospfNetworkaNetworkaNetworkaRouterospfNetworkaNetworkaNetworkaRouterospfNetworkaNetworkaNetworkaNetworkaArea1virtual-linkInterIpospfmtu-RouterospfNetworkaNetworkaNetworkaNetworkaNetworkaNeighborArea1virtual-linkInterIpospfmtu-RouterospfNetworkaNetworkaNetworkaNetworkaArea1virtual-linkArea1virtual-linkRouterospfNetworkaNetworkaNetworkaNetworkaRouterospfNetworkaNetworkaIPv4 (2Configureyournetworkasperthefollowing·ConfigureEIGRPASYYandEIGRPAS100asperthe“Diagram1IGP·RedistributeEIGRPAS100intoEIGRPAS·DisableautomaticsummarizationforbothautonomoussystemsRoutereigrpNoauto-NetworkRoutereigrpNoauto-NetworkRoutereigrp100NetworkRoutereigrpNoauto-summaryNetworkNetworkRedistributeeigrpRoutereigrpNoauto-summaryNetworkNetworkIPv4 (1ConfigureRIPversion2asperthe“Diagram1IGPRouting”diagramandthefollowingrequirements:·RIPmustbeenabledonlyfortherequiredinterfaces,noothersinterfacesmaysendanyRIPupdateRouterripNoauto-summaryNopassive-interfacef0/0NetworkRouterripNoauto-summaryNopassive-interfacef0/1NetworkRedistribution:OSPFinto (2RedistributeOSPFintoRIPonR5asperthefollowing·R4mustroutetrafficdestinedtoSW1Loopback0via·R4mustrouteallotherOSPFprefixesviaR3Access-list1permitRouterripRoute-mapconpermit10Matchinterfacef0/1Routerospf29RouterRedistributeospf29metricRedistribution:EIGRPand (4MutuallyredistributeEIGRPandOSPFonbothR2andR3accordingtothe·TheonlyEIGRPExternalroutesthatbothR2andR3mustseearetheprefixesoriginatedinEIGRP100andtheVLAN300prefix·AllinternalOSPFprefixes(ieallexistingsubnetsofYY.YY.0.0/16thatarenotoriginatedinEIGRPYYorEIGRP100)mustbeseenasOSPFinternalbybothR2andR3·Withoutanyadditionalconfiguration,yoursolutionmustcoveranyfutureprefixesthatcouldeventuallybeadvertisedbyBB3·Youmustusearoutefilteringmechanismbutdonouseanyaccess-listorprefix-listtoachievethistask·EnsureoptimalroutingisperformedonbothR2and·DonotchangeanydefaultadministrativedistancetoachievethistaskRoutereigrpRedistributeospf29metric10001002551Route-maptag10permit10Matchroute-typeexternalSettag10Route-mapmtagdeny10Matchtag10Route-mapmtagpermitRouterospfRedistributeeigrp29subnetroute-maptag10Distribute-listroute-mapmtaginIPv4 (2ConfigureeBGPbetweenASYYandAS254asperthe“Diagram2BGPRouting”andaccordingtothefollowingrequirements:·R2mustgenerateawarninglogmessageifitreceivesmorethan5prefixesfrom·BothR2andR3mustexchangetheBGPcapabilitythatindicatestheendofRIBmarkeraftertheinitialroutingupdateiscomplete·RedistributeOSPFintoBGPonbothR1and·EnsurethatyoureceiveBGPprefixesfrombothBB1and·Donotusenext-hop-selfineitherR1andR2RouterbgpNosynchronousBgprouter-idBgpgraceful-restartNeighbor54maximum-prefix5100warning-onlyRedistirbuteospf29matchinternalexternelRouterbgpNosynchronousBgprouter-idNeighbor54remote-as254Redistributeospf29matchinternalexternalRouterbgpNosynchronousBgprouter-idBgpgraceful-restartIPv4 (2ConfigureBGPASYYandAS254betweenallfiveroutesaccordingtothefollowing·UseLoopback0interfacesforallinternalBGP·R3mustbetheRouteReflectorforAS·Donotusepeer-groupsRouterbgpRouterbgpRouterbgpRouterbgpNosynchronousBgprouter-idRouterbgpNosynchronousBgprouter-idAdvanced (5Configureyournetworkasperthefollowing·R1mustprefertheexternalpathtoreachdestinationsinAS254andthebebreakerintheBGPBestpathselectionalgorithmmustbethe“externalvsinternal·R3mustpreferthepathviaR1andthechangemustnotimpactanyother·R4mustbeabletosuccessfullypinghost·TrafficsentfromR4todestinationsinAS254mustberoutedthrough·BGPattributesofASPath,localPreferenceandWeightcan’tbechangedonotherR4orR5·OSPFcostmaybechangedforonlyoneinterfaceRoute-mapprependpermit10Setas-pathprepend253Routerbgp29RouterbgpNeighborweightInters0/0/0---R5’sinterfaceconnectedtoR1Ipospfcost1IPv6 (2Refertothe“Diagram3IPv6Routing”andconfigureIPv6inyournetworkasperthefollowingrequirements:·YYstandsforyourtwo-digitsracknumber,writtenindecimal·SSisthethirdoctetoftheIPv4addressofthesameinterface,writtenindecim·HHisthefourthoctetoftheIPv4addressofthesameinterface,writtendecimal·MMisthesubnetmaskandmustbe/128forLoopbackinterfacesand/64forothersinterfaces·DisablesendingtheperiodicrouteradvertisementmessagesonallIPv6IPv6 (2ConfigureOSPFv3accordingtothe“Diagram3IPv6Routing”andtothefollowing·Usethenumber2001astheOSPFv3process·UsetheLoopback0IPaddressastheOSPFv3router·Usingasinglecommand,theserialbetweenR1andR5mustbeauthenticatedusingtheMD5key“1234567890ABCDEF1234567890ABCDEF”·AllIPv6interfacesmustbereachablefromanyIPv6routerSdmpreferdual-ipv4-and-ipv6defaultIpv6cefIpv6routerospf2001Router-idInterloopbackIpv6addIpv6ospf2001aIntervlanIpv6addIpv6ospf2001a0Ipv6ndrasuppressIntervlan67Ipv6addIpv6ospf2001a0Ipv6ndrasuppressSdmpreferdual-ipv4-and-ipv6defaultIpv6cefIpv6routerospf2001Router-idInterloopbackIpv6addIpv6ospf2001aIntervlanIpv6addIpv6ospf2001a0Ipv6ndrasuppressIntervlan67Ipv6addIpv6ospf2001a0Ipv6ndrasuppressIpv6cefIpv6routerospf2001Router-idInterloopbackIpv6addIpv6ospf2001a0Inters0/0/0Ipv6addIpv6ospf2001a0Ipv6ndrasuppressInterf0/0Ipv6addIpv6ospf2001a0Ipv6ndrasuppressIpv6ospfmtu-ignoreIpv6cefIpv6routerospf2001Router-idInterloopbackIpv6addIpv6ospf2001a0Inters0/0/1Ipv6addIpv6ospf2001a0Ipv6ndrasuppressInterg0/0Ipv6addIpv6ospf2001a0Ipv6ndrasuppressIpv6ospfmtu-ignoreInterIpv6ospfauthenticationipsecspi500md5InterIpv6ospfauthenticationipsecspi500md5Section3– (3ConfiguremulticastonR3andR5accordingtothefollowing·R3’sloopback0issimulatingamulticastvideoserverandreceiversareconnectedtoR5Fa0/0·Multicastforwardingshouldnotrelyonanyrendezvous·ThenetworkshouldnothavetofloodandprunemulticasttrafficunnecessarilyIpmulticast-routingInterloopback0Ippimsparse-modeInters0/0/0Ipmulticast-routingInters0/0/1Ippimsparse-modeInterf0/0AdvancedMulticast (3Continueconfiguringmulticastasperthefollowing·ConfigureastaticjoinonR5FasEthernet0/0forthegroupaddressandensurethatonlythemulticastvideoserversimulatedbyYY.YY.3.3isallowedtosendtrafficforthatgroup·ConsiderthattherearehostsconnectedtoR5thatonlysupportIGMPv2andwhoareinterestedtojointhegroupaddressesand·Thesehostsmustbeabletojointhesetwogroupsonlyforthesource·RoutersshouldnotquerytheDomainNameSystem(DNS)foranysourceaddressAccess-list10permitAccess-list10permitAccess-list10permitIppimssmrange10Access-list10permitAccess-list10permitAccess-list10permitIppimssmrange10Access-list20permitIpigmpssm-mapenableIpigmpssm-mapstatic20Noipigmpssm-mapquerydnsInterIpigmpversionIpigmpjoin-groupsourceSection4–AdvancedIGP (3Configureyournetworkasperthefollowing·CompletetheconfigurationofMD5authenticationintheRIP·Youarenotallowedtochangethepre-configuredkeyin·R5mustsavethekeyasaplantext(notencrypted!)intheconfigurationKeychainripKey1InterIpripauthenticationmodemd5Ipripauthenticationkey-chainripKeychainccieKey1InterIpripauthenticationmodemd5Ipripauthenticationkey-chainripZone-Based (3ConfigureZone-BasedFirewall(ZBF)onR1sothatthefollowingsequenceof producestheexactsameoutput:Youmustusetheexactsamenamesforthepolicyandclasses(casesensitive)R5#ping150.1.YY.254SW2#pingR1#shpolicy-maptypeinspectzone-pairA_BZone-pairA_BClass-map:A-B{match-all}Match:protocolicmp100ZonesecurityAZonesecurityInters0/0/1 Interg0/0< Interg0/1< Class-maptypeinspectmatch-allA-BMatchprotocolicmpPolicy-maptypeinspectpmap_A_BClasstypeinspectA-BZone-pairsecurityA_BsourceAdestinationBService-policytypeinspectpmap_A_BZone-pairsecurityB_AsourceBdestinationAService-policytypeinspectpmap_A_BLayer2 (3ConfigureSW1andSW2asperthefollowing·R4andR5maycommunicateonlywitheachotherinVLAN45andnotwithanyotherhostinthatVLAN·HostsconnectedtoportFa0/6ofbothSW1andSW2mustalsobepartofVLAN45,andmaycommunicateonlywitheachother·HostsconnectedtoportFa0/7ofbothSW1andSW2arenotallowedtocommunicatewithanyhostinVLAN45·Alloftheaboveports(Fa0/6,Fa0/7fromSW1andSW2)mustbeallowedtocommunicatewithadeviceconnectedtoportFa0/8ofSW1·UseonlyoddVLANnumber(s)(between334and998)ifyouneedtocreateanynew·Currently,thereisnohostattachedtotheseportsbutensurethattheyarefullyconfiguredandthatnointerventionisrequiredwhenactuallyconnectingPhysicalhoststothemVlan451Vlan453NameVlan457NameVlan45Defaultinterf0/4Defaultinterf0/6Defaultinterf0/7Defaultinterf0/8InterSwitchportprivate-vlanhost-association45451NoshutInterSwitchportprivate-vlanhost-association45453NoshutInterSwitchportprivate-vlanhost-association45457NoshutInterSwitchportmodeprivate-vlanpromiscuousSwitchportprivate-vlanmaping45451,453,457NoshutDefaultinterf0/5Defaultinterf0/6Defaultinterf0/7InterSwitchportprivate-vlanhost-association45451NoshutinterSwitchportprivate-vlanhost-association45453NoshutinterSwitchportprivate-vlanhost-association45457NoshutInstance1vlanQualityof (2itappearsthatsomehostsattachedtothesubnet/24behindBB1aresendingsuspicioustraffictomultipledevicesinOSPFArea0ConfigureR1asperthefollowing·UsetheModularQoS·Limitonlythissuspicioustrafficto128Kbpsper·Donotpolicethis·Useastandardaccess-listwithasingleentry,donotuseanamedaccess-Note:Kbps=KilobitspersecondAccess-list1permitMatchaccess-group Classbb1ShapeaverageInter Inters0/0/1< Qualityof (3ConsiderthatusersconnectedtoVLAN56aresendingtrafficisalreadymarkedas·ControlIPprecedence6or·VideoIPprecedence·BusinessIPprecedence·InternetIPprecedenceConfigureR5’sinterfaceS0/0/1toshareitsavailablebandwidthasperfollowing·UsetheModularQoSCLIanduseclassnamesaspertheabovedescription(case·Usethematch-alloptionforallClass-·Useonlythecriteria“matchipprecedence”forallClass-·Incaseofcongestion,theVoicetrafficmustbesentinpriorityoverallother·Thelowlatencyqueuemayneverusemorethan20%oftheavailable·Incaseofcongestion,reserve100Kbpsoftheavailable2000KbpsfortheControl·OnlyincaseofcongestiontheVideotrafficmaynotexceed30%oftheavailable·OnlyincaseofcongestiontheBusinesstrafficmaynotexceed30%oftheavailablebandwidth·EnablethecongestionavoidancemechanismfortheBusinesstrafficusingaweightfactorof10fortheaveragequeuesizecalculation·TheInternettrafficshouldusetheremainingbandwidthwithnoother·Kbps=Kilobitsper·Usethefirstword(casesensitive)oftheabovetrafficdescriptiontonameyourclasses(ie.classControl,classVoice,etc)Class-mapControlMatchipprecedence67Class-mapVoiceMatchipprecedence5Class-mapVideoMatchipprecedence4Class-mapBusinessMatchipprecedence3Class-mapInternetMatchipprecedence0Policy-mappolicyClassControlPriority100ClassVoicePrioritypercent15ClassVideoBandwidthpercent30ClassBusinessBandwidthpercent30Inters0/0/1<--->R3Bandwidth2000FirstHop (3ConsiderthatusersareconnectedtoVLAN500onbothSW1andConfigureHSRPtoprovideredundancyfortheusergatewayYY.YY.100.254/24asperthefollowingrequirements:·TheHSRPtopologymustfollowtheSTPtopology(ie.thedefaultgatewaymustbethedefaultrootbridge)·TheactivegatewayIPaddressisYY.YY.100.1/24andthestandbygatewayIPaddressisYY.YY.100.2/24·Usepriority120ontheactivegatewayandthedefaultpriorityonthesecondary·BothHSRPgatewaysmustauthenticateeachotherusingtheMD5password·ThestandbygatewaymusttakeovertheactiverolewhentheactivegatewaylosesreachabilitytotheBB1subnet(150.1.YY.0/24)·TheprimarygatewaymustrecoveritsactiverolewhenreachabilitytotheBB1subnetisrestored·When5Hellopacketsareamissed,thesecondarygatewaymusttakeovertheactivewithin1second·MakesurenoIGPprotocolisrunningonVLAN500Track1iprouteIntervlanIpaddNoStandbyipStandbypreemptStandbyauthenticationmd5key-stringCCIEStandbytrack1decrement21standbytimersmsec100msecIntervlanIpaddNoStandbyip54StandbypreemptStandbyauthenticationmd5key-stringCCIEstandbytimersmsec100msec500 (3configureSW1andSW2inordertorestrictaccessforVLAN500usersasperthefollowingrequirements:·HTTP(fromanyuserworkstationtoanyremoteserver)isnotallowedduringofficehours(from09:00to16:59,MondaytoFriday)·FTP(fromanyuserworkstationtoanyremoteserver)isallowedonlyduringeverynightforbackupbetween22:00to23:59andisnotallowedatanyothertime·UDPtrafficisallowedonlyoutsidetheofficehours(everydayfrom17:00to·AnyrequiredcontroltrafficmustbeallowedatanytimeandtheACLentry(-ies)mustbeasspecificaspo