A5 byCCIEMAN2016_nonvrf

CCIE R&S LAB – CFG H2/A5 Section 1 – Layer 2 Technologies 1.1 Jameson’s Datacenter: Access port There has been pre‐configured in Jameson’s Datacenter. SW3 is the server and the other three switches are clients. Do not modify this configuration. Some other configuration was already started but it is your responsibility to verify and complete them. Configure all four switches in Jameson’s datacenter network (AS 65002) as per the following requirements:  All unused ports must be configured in VLAN 999 and administratively shutdown. Refer to “Table 1: Jameson’s VLAN to Port Mapping” to figure out which ports are used and unused.  Access‐ports must immediately transition to the forwarding state upon link up, as long as they do not receive a BPDU. Use a unique command per switch to enable this feature.  If an access‐port received a BPDU, it must automatically shutdown, generate a syslog and a SNMP trap (to solve this issue add. Use a unique command per switch to enable to this feature.  Ports that were shutdown must always rely on a manual intervention to recover.  VLAN 911 (10.2.100.X/24) will be used as the management VLAN in Jameson’s datacenter. Ensure that all datacenter switches are able to ping each other IP address in the management VLAN.  SW5 and SW6 are low‐end access switches and they do not have much processing power. Ensure that their only Layer 3 interfaces are Loopback0 and VLAN 911.  SW3 and SW4 are robust and powerful distribution switches. Ensure that they maintain a Layer 3 interface for all local VLANs as well as all access VLANs, as specified in “Table 1: Jameson’s VLAN to Port Mapping”.

################ WARNING ################## PAY ATTENCION GUYS, CISCO PUT INTERFACE SW4,SW5,SW6 ON ACCESS MODE, AND ALL INTERFACE IN SHUTDOWN. WHEN WE START EXAM, UP INTERFACE AND ENABLED BPDUGUARD, INTERFACE GOES DOWN AGAIN. THIS WAS A WRAP FROM CISCO. ######################################## ####################### TIP #################### INTERFACE ARE DIFERENCES, EQUAL TOPOLOGY BELLOW, PORTCHANNEL WAS PRECONFIGURED, BUT INTERFACES WE NEED PUT INSIDE PORTCHANNEL!

CCIE R&S LAB – CFG H2/A5

Solution: SW3: vtp domain CCIE vtp mode server ! spanning-tree portfast bpduguard default spanning-tree portfast default snmp-server enable trap syslog ! vlan 34,100,153,156,164,173,184,911,999 ! interface range e0/1,e0/3,e2/0-3 switchport mode access switchport access vlan 999 shutdown ! interface e0/0 switchport mode access switchport access vlan 156 interface e0/2 switchport mode access switchport access vlan 153 ! SW4: vtp domain CCIE vtp mode client ! spanning-tree portfast bpduguard default spanning-tree portfast default snmp-server enable trap syslog

CCIE R&S LAB – CFG H2/A5 ! interface range e0/1,e0/3,e2/0-3 switchport mode access switchport access vlan 999 shutdown ! interface e0/0 switchport mode access switchport access vlan 156 interface e0/2 switchport mode access switchport access vlan 164 !

SW5: vtp domain CCIE vtp mode client ! spanning-tree portfast bpduguard default spanning-tree portfast default snmp-server enable trap syslog ! interface range e2/0-3 switchport mode access switchport access vlan 999 shutdown ! interface e0/0 switchport mode access switchport access vlan 173 ! interface range e0/1-3 switchport mode access switchport access vlan 100 ! SW6: vtp domain CCIE vtp mode client ! spanning-tree portfast bpduguard default spanning-tree portfast default snmp-server enable trap syslog ! interface range e2/0-3 switchport mode access switchport access vlan 999 shutdown ! interface e0/0

CCIE R&S LAB – CFG H2/A5 switchport mode access switchport access vlan 184 ! interface range e0/1-3 switchport mode access switchport access vlan 100

Check: Spanning-tree

Check all switches.

CCIE R&S LAB – CFG H2/A5 1.2 Jameson’s Datacenter: Trunk ports Refer to “Diagram 1: Jameson’s Layer 2 Connections” and “Table 1: Jameson’s VLAN to Port Mapping”. Configure Jameson’s datacenter network (AS 65002) as per the following requirements:  All inter‐switch links must be configured to use dot1q encapsulation.  Ensure that no switch attempt to negotiate the trunk parameters.  Ensure that all four switches send and receive untagged frames on VLAN 1.  All four switches must maintain a separate Spanning‐tree instance for each VLAN.  Spanning‐tree must immediately delete dynamically learned MAC address entries on a perport basis upon receiving a topology change.  SW3 must be the root switch for all VLANs. SW4 must be the backup root switch for all VLANs. Ensure that they both have the best chances of maintaining their respective role even if any new normal‐range VLAN were to be added in the future. Solution: SW3: ! spanning-tree mode rapid-pvst spanning-tree vlan 1-1001 priority 0 ! interface range e1/0-3 switchport trunk encapsulation dot1q switchport mode trunk switchport nonego ! SW4: spanning-tree mode rapid-pvst spanning-tree vlan 1-1001 priority 4096 ! interface range e1/0-3 switchport trunk encapsulation dot1q switchport mode trunk switchport nonego ! SW5: spanning-tree mode rapid-pvst ! interface range e1/0-3

CCIE R&S LAB – CFG H2/A5 switchport trunk encapsulation dot1q switchport mode trunk switchport nonego ! SW6: spanning-tree mode rapid-pvst ! interface range e1/0-3 switchport trunk encapsulation dot1q switchport mode trunk switchport nonego !

Check:

1.3 Jameson’s Datacenter: Link bundling Refer to “Diagram 1: Jameson’s Layer 2 Connections” and “Diagram 2: Initial Topology” Configure Jameson’s datacenter network as per the following requirements:  All four switches must bundle trunk ports so that they maintain a single logical link to each other (excepted between SW5 and SW6), as shown in the “Diagram 2: Initial Topology”.  Ensure that no switch attempt to negotiate which ports should become active in the bundle.  The distribution switches SW3 and SW4 must balance traffic between all members of the link bundle based on source and destination IP addresses.  The access switches SW5 and SW6 must balance the income traffic (that is originated from server) between all members of the link bundle based on the servers’ MAC address.

CCIE R&S LAB – CFG H2/A5

PS.: This output no exactly equal on exam. Solution: SW3: interface range e1/0-1 channel-group 35 mode active ! interface Port-channel35 switchport trunk encapsulation dot1q switchport mode trunk ! interface range e1/2-3 channel-group 36 mode active ! interface Port-channel36 switchport trunk encapsulation dot1q switchport mode trunk ! port-channel load-balance src-dst-ip ! SW4:

interface ran e1/0-1 channel-group 46 mode active ! interface Port-channel46 switchport trunk encapsulation dot1q

CCIE R&S LAB – CFG H2/A5 switchport mode trunk ! interface ran e1/2-3 channel-group 45 mode active ! interface Port-channel45 switchport trunk encapsulation dot1q switchport mode trunk ! port-channel load-balance src-dst-ip SW5: interface Port-channel35 switchport trunk encapsulation dot1q switchport mode trunk ! interface range e1/0-1 channel-group 35 mode passive ! interface Port-channel45 switchport trunk encapsulation dot1q switchport mode trunk ! interface range e1/2-3 channel-group 45 mode passive ! port-channel load-balance src-mac SW6: interface Port-channel46 switchport trunk encapsulation dot1q switchport mode trunk ! interface range e1/0-1 channel-group 46 mode passive ! interface range e1/2-3 channel-group 36 mode passive ! interface Port-channel36 switchport trunk encapsulation dot1q switchport mode trunk ! port-channel load-balance src-mac

Check:

CCIE R&S LAB – CFG H2/A5

CCIE R&S LAB – CFG H2/A5

1.4 Jameson’s Branch Offices Refer to “Diagram 1: Jameson’s Layer 2 Connections”. Configure interface Ethernet0/0 in Jameson’s branch routers R19, R20 and R21 as per the following requirements:  The Ethernet WAN links must rely on a Layer 2 protocol that supports link negotiation and authentication.  The service provider expects that the branch routers complete a three‐way handshake by providing the expected response of a challenge that is sent by R49.  R19 must use the username “Jamesons‐R19” and password “CCIE” (without quotes).  R20 must use the username “Jamesons‐R20” and password “CCIE” (without quotes).  R21 must use the username “Jamesons‐R21” and password “CCIE” (without quotes).  The interface Eth0/0 of all three routers must receive an IP address from R49.  Ensure that all three routers can ping the IP address of each other’s interface Eth0/0.  You are allowed to configure a single static route in each branch router to achieve the previous requirement.

CCIE R&S LAB – CFG H2/A5 Solution: R19 ! interface Dialer0 ip address negotiated encapsulation ppp dialer pool 1 ppp chap hostname Jamesons-R19 ppp chap password 0 CCIE ppp ipcp route default ! interface Ethernet0/0 pppoe enable pppoe-client dial-pool-number 1 ! ip route 192.0.2.0 255.255.255.0 dialer1 R20

! interface Dialer0 ip address negotiated encapsulation ppp dialer pool 1 ppp chap hostname Jamesons-R20 ppp chap password 0 CCIE ppp ipcp route default ! interface Ethernet0/0 pppoe enable pppoe-client dial-pool-number 1 ! ip route 192.0.2.0 255.255.255.0 dialer1

R21

! interface Dialer0 ip address negotiated encapsulation ppp dialer pool 1 ppp chap hostname Jamesons-R21 ppp chap password 0 CCIE ppp ipcp route default ! interface Ethernet0/0 pppoe enable

CCIE R&S LAB – CFG H2/A5 pppoe-client dial-pool-number 1 ! ip route 192.0.2.0 255.255.255.0 dialer1

Check:

Section 2 – Layer 3 Technologies 2.1 Jameson’s IGP, part 1 Refer to “Diagram 2: Initial Topology”. The configuration was already started. It is your responsibility to complete and verify all requirements. Configure Jameson’s network (AS 65001 and AS 65002) according to the following requirements:  Ensure that all routers use their interface Lo0 as OSPF router‐id.  Ensure that OSPF is not running on any interface that is facing another BGP AS.  SW5 and SW6 must not participate in OSPF at all.  Do not use the “network” statement under the “router ospf” configuration anywhere in the core network (AS 65001).  Do not change the default OSPF cost of any interface anywhere.  Ensure that R1, SW1 and SW2 are elected the designated router on all of their interfaces, and that they have the best chances of maintaining that role as long as their interfaces are up.  Ensure that R2 is elected the Backup Designated router on all of their interfaces, and that it has the best chances of maintaining that role as long as its interfaces are up.

Solution:

-------------------|Datacenter Network| -------------------SW3 router ospf 65002 router-id 10.255.1.103 network 10.2.0.6 0.0.0.0 area 0

CCIE R&S LAB – CFG H2/A5 network network network network network

10.2.0.13 0.0.0.0 area 0 10.2.0.37 0.0.0.0 area 0 10.2.1.253 0.0.0.0 area 0 10.2.100.103 0.0.0.0 area 0 10.255.1.103 0.0.0.0 area 0

! SW4 router ospf 65002 router-id 10.255.1.104 network 10.2.0.10 0.0.0.0 area 0 network 10.2.0.14 0.0.0.0 area 0 network 10.2.0.41 0.0.0.0 area 0 network 10.2.1.254 0.0.0.0 area 0 network 10.2.100.104 0.0.0.0 area 0 network 10.255.1.104 0.0.0.0 area 0 ! R15 router ospf 65002 router-id 10.255.1.15 network 10.2.0.1 0.0.0.0 area 0 network 10.2.0.5 0.0.0.0 area 0 network 10.255.1.15 0.0.0.0 area 0 R16 router ospf 65002 router-id 10.255.1.16 network 10.2.0.2 0.0.0.0 area 0 network 10.2.0.9 0.0.0.0 area 0 network 10.255.1.16 0.0.0.0 area 0

R17 router ospf 65002 router-id 10.255.1.17 network 10.2.0.38 0.0.0.0 area 0 network 10.255.1.17 0.0.0.0 area 0

---------------------|Headquarters Network| ---------------------SW1 interface vlan101 ip ospf priority 255

CCIE R&S LAB – CFG H2/A5 ! router ospf 65002 router-id 10.255.1.101 network 10.1.1.254 0.0.0.0 area 0 network 10.1.254.254 0.0.0.0 area 0 network 10.255.1.101 0.0.0.0 area 0 R11 router ospf 65002 router-id 10.255.1.11 network 10.1.254.1 0.0.0.0 area 0 network 10.255.1.11 0.0.0.0 area 0 R12 router ospf 65002 router-id 10.255.1.12 network 10.1.254.2 0.0.0.0 area 0 network 10.255.1.12 0.0.0.0 area 0

-------------|Main Network| -------------SW2 interface vlan101 ip ospf priority 255 ! router ospf 65002 router-id 10.255.1.102 network 10.3.1.254 0.0.0.0 area 0 network 10.3.254.254 0.0.0.0 area 0 network 10.255.1.102 0.0.0.0 area 0 R13 router ospf 65002 router-id 10.255.1.13 network 10.3.254.1 0.0.0.0 area 0 network 10.255.1.13 0.0.0.0 area 0 R14 router ospf 65002 router-id 10.255.1.14 network 10.3.254.2 0.0.0.0 area 0 network 10.255.1.14 0.0.0.0 area 0

CCIE R&S LAB – CFG H2/A5 -------------|CORE Network| -------------R1 router ospf 65001 router-id 10.255.1.1 ! inte ran e0/0-3,e1/0,lo0 ip ospf priority 255 ip ospf 65001 area 0 ! R2 router ospf 65001 router-id 10.255.1.2 ! inte ran e0/0-3,e1/0,lo0 ip ospf priority 254 ip ospf 65001 area 0 ! R3 router ospf 65001 router-id 10.255.1.3 ! inte ran e0/0,e0/2,lo0 ip ospf 65001 area 0 ! R4 router ospf 65001 router-id 10.255.1.4 ! inte ran e0/0,e0/2,lo0 ip ospf 65001 area 0 ! R5 router ospf 65001 router-id 10.255.1.5 ! inte ran e0/0-1,lo0 ip ospf 65001 area 0 !

CCIE R&S LAB – CFG H2/A5 R6 router ospf 65001 router-id 10.255.1.6 ! inte ran e0/0-1,lo0 ip ospf 65001 area 0 ! R7 router ospf 65001 router-id 10.255.1.7 ! inte ran e0/3,lo0 ip ospf 65001 area 0 ! R8 router ospf 65001 router-id 10.255.1.8 ! inte ran e0/3,lo0 ip ospf 65001 area 0 !

Check: Tip: look loopback address.

CCIE R&S LAB – CFG H2/A5

2.2 Jameson’s IGP, part 2 Refer to “Diagram 2: Initial Topology”. Configure Jameson’s branch network according to the following requirements:  R17 must propagate a default route in its OSPF domain, but only if it already has a default route in its routing table.  Do not redistribute BGP into OSPF and vice versa on R17.  Each branch router must establish an OSPF adjacency with R17 and must receive a default route via OSPF. They may not receive any other LSA type 3 from the ABR.  Each branch router must advertise their interface Lo0 and Eth0/1 into OSPF.  None of the branch routers may attempt to elect a Designated Router on their Tunnel0 interface.

Solution (you cann’t do this section, before do section 3.1(dmvpn), this is prereq):

CCIE R&S LAB – CFG H2/A5 R17 router ospf 65002 area 51 stub no-summary network 10.100.0.1 0.0.0.0 area 51 ! R19 router ospf 65002 router-id 10.255.1.19 area 51 stub network 10.16.1.1 0.0.0.0 area 51 network 10.100.0.19 0.0.0.0 area 51 network 10.255.1.19 0.0.0.0 area 51 ! R20 router ospf 65002 router-id 10.255.1.20 area 51 stub network 10.16.2.1 0.0.0.0 area 51 network 10.100.0.20 0.0.0.0 area 51 network 10.255.1.20 0.0.0.0 area 51 ! R21 router ospf 65002 router-id 10.255.1.21 area 51 stub network 10.16.3.1 0.0.0.0 area 51 network 10.100.0.21 0.0.0.0 area 51 network 10.255.1.21 0.0.0.0 area 51 !

Check (usually, I make section 3.1 before this section, but now I created this section this normal sequence, cuz this this moment we cannot see ospf neighbor UP. You can jump to section 3.1 and apply solution for test):

CCIE R&S LAB – CFG H2/A5 2.3 Jacob’s IGP Refer to “Diagram 2: Initial Topology”. Jacob’s network is partly preconfigured. It is your responsibility to verify and complete them. Configure EIGRP for IPv4 in Jacob’s core network (AS 65006) according to the following requirements:  All EIGRP routers must support 64‐bit metric calculations and Routing Information Base (RIB) scaling in EIGRP topologies.  The interface Lo0 of each router must be seen as an internal EIGRP prefix by all other routers in their local domain.  Ensure that EIGRP is not running on any interface that is facing another AS. Use any method to accomplish this requirement.  Jacob’s core network must use the EIGRP autonomous system number 1.  R52 must inject its interface Lo52 into EIGRP as an external prefix.  All EIGRP core routers R50, R51,R52 must add the administrative tag “172.172.172.172” to all prefixes that they inject into EIGRP. Ensure that operators can filter routes by using the route tag wildcard mask. The following output must be seen on R50:

Solution: --------------|CORE JACOB’s| --------------R50

route-tag notation dotted-decimal !

CCIE R&S LAB – CFG H2/A5 router eigrp CCIE ! address-family ipv4 unicast autonomous-system 1 ! topology base exit-af-topology network 172.30.1.50 0.0.0.0 network 172.30.100.1 0.0.0.0 eigrp default-route-tag 172.172.172.172 exit-address-family

R51

route-tag notation dotted-decimal ! router eigrp CCIE ! address-family ipv4 unicast autonomous-system 1 ! topology base exit-af-topology network 172.30.1.51 0.0.0.0 network 172.30.100.2 0.0.0.0 eigrp default-route-tag 172.172.172.172 exit-address-family

R52

interface Loopback52 ip address 52.52.52.52 255.255.255.255 ! route-tag notation dotted-decimal ! route-map connected permit 10 match interface Loopback52 set tag 172.172.172.172 ! ! router eigrp CCIE ! address-family ipv4 unicast autonomous-system 1 ! topology base redistribute connected metric 10000 1000 255 1 1500 route-map connected exit-af-topology network 172.30.1.52 0.0.0.0 network 172.30.100.3 0.0.0.0 eigrp default-route-tag 172.172.172.172 exit-address-family

CCIE R&S LAB – CFG H2/A5 !

------------------------------| Headquarter network JACOB’s| ------------------------------SW10 no router eigrp 10 ! router eigrp CCIE ! address-family ipv4 unicast autonomous-system 10 ! topology base exit-af-topology network 172.18.1.254 0.0.0.0 network 172.18.2.254 0.0.0.0 network 172.18.254.254 0.0.0.0 network 172.30.1.110 0.0.0.0 ! R56 no router eigrp 10 ! router eigrp CCIE add ipv4 auto 10 network 172.18.254.2 0.0.0.0 network 172.30.1.56 0.0.0.0 ! R55

no router eigrp 10 ! router eigrp CCIE add ipv4 auto 10 network 172.18.254.1 0.0.0.0 network 172.30.1.55 0.0.0.0 !

-------------------------| Office network JACOB’s| -------------------------SW11

CCIE R&S LAB – CFG H2/A5 no router eigrp 10 ! router eigrp CCIE add ipv4 auto 10 network 172.17.1.254 0.0.0.0 network 172.17.254.254 0.0.0.0 network 172.30.1.111 0.0.0.0 ! R58 no router eigrp 10 ! router eigrp CCIE add ipv4 auto 10 network 172.17.254.1 0.0.0.0 network 172.30.1.58 0.0.0.0 !

Check:

CCIE R&S LAB – CFG H2/A5

2.4 Jameson’s Pre‐merge Refer to the “Overall Scenario”, “Diagram 2: Initial Topology” and “Diagram 4: Pre‐merge Topology”. Jameson’s decided to enable MPLS VPN in their network Configure Jameson’s network as per the following requirements:  R11, R12, R13 and R14 must redistribute OSPF into BGP and they must advertise a default route into their respective OSPF domain. They may not redistribute BGP into OSPF.  R15 and R16 must mutually redistribute OSPF and BGP.  R11, R12, R13 and R14 must advertise only four prefixes via eBGP to Jameson’s core network as follows: o R11 and R12 must advertise 10.1.0.0/16, 10.255.1.11/32, 10.255.1.12/32 and 10.255.1.101/32; o R13 and R14 must advertise 10.3.0.0/16, 10.255.1.13/32, 10.255.1.14/32 and 10.255.1.102/32;  R1 must reflect IPv4 BGP prefixes to all core routers except R2. All internal BGP peering must be established using interface Lo0.  Ensure that each Jameson’s site receives BGP prefixes from other sites.   A very smaller output as the one shown below must be seen on R11, R12, R13 and R14 (only the next‐hop, version and update‐group may differ). R11#sh ip top 10.2.0.0/16

CCIE R&S LAB – CFG H2/A5

PS.: you don’t see this output this point. You need done section 3.2 and 3.4 for see this output.

Solution: R11 router ospf 65002 default-information originate ! ip prefix-list ebgp permit 10.1.0.0/16 ip prefix-list ebgp permit 10.255.1.11/32 ip prefix-list ebgp permit 10.255.1.12/32 ip prefix-list ebgp permit 10.255.1.101/32 ! router bgp 65002 aggregate-address 10.1.0.0 255.255.0.0 summary-only redistribute ospf 65002 neighbor 10.254.0.53 prefix-list ebgp out neighbor 10.255.1.12 next-hop-self ! R12

router ospf 65002 default-information originate ! ip prefix-list ebgp permit 10.1.0.0/16 ip prefix-list ebgp permit 10.255.1.11/32 ip prefix-list ebgp permit 10.255.1.12/32 ip prefix-list ebgp permit 10.255.1.101/32 ! router bgp 65002 aggregate-address 10.1.0.0 255.255.0.0 summary-only redistribute ospf 65002 neighbor 10.254.0.57 prefix-list ebgp out

CCIE R&S LAB – CFG H2/A5 neighbor 10.255.1.11 next-hop-self ! R13 router ospf 65002 default-information originate ! ip prefix-list ebgp permit 10.3.0.0/16 ip prefix-list ebgp permit 10.255.1.13/32 ip prefix-list ebgp permit 10.255.1.14/32 ip prefix-list ebgp permit 10.255.1.102/32 ! router bgp 65002 aggregate-address 10.3.0.0 255.255.0.0 summary-only redistribute ospf 65002 neighbor 10.254.0.41 prefix-list ebgp out neighbor 10.255.1.14 next-hop-self ! R14

router ospf 65002 default-information originate ! ip prefix-list ebgp permit 10.3.0.0/16 ip prefix-list ebgp permit 10.255.1.13/32 ip prefix-list ebgp permit 10.255.1.14/32 ip prefix-list ebgp permit 10.255.1.102/32 ! router bgp 65002 aggregate-address 10.3.0.0 255.255.0.0 suumary-only redistribute ospf 65002 neighbor 10.254.0.45 prefix-list ebgp out neighbor 10.255.1.13 next-hop-self ! R15 router ospf 65002 redistribute bgp 65002 subnets ! router bgp 65002 aggregate-address 10.2.0.0 255.255.0.0 summary-only redistribute ospf 65002 match internal external neighbor 10.255.1.16 next-hop-self

R16 router ospf 65002

CCIE R&S LAB – CFG H2/A5 redistribute bgp 65002 subnets ! router bgp 65002 aggregate-address 10.2.0.0 255.255.0.0 summary-only redistribute ospf 65002 match internal external neighbor 10.255.1.15 next-hop-self

R1 router bgp 65001 bgp router-id 10.255.1.1 bgp log-neighbor-changes neighbor ibgp peer-group neighbor ibgp remote-as 65001 neighbor ibgp update-source Loopback0 neighbor 10.255.1.3 peer-group ibgp neighbor 10.255.1.4 peer-group ibgp neighbor 10.255.1.5 peer-group ibgp neighbor 10.255.1.6 peer-group ibgp neighbor 10.255.1.7 peer-group ibgp neighbor 10.255.1.8 peer-group ibgp ! address-family ipv4 neighbor ibgp route-reflector-client neighbor 10.255.1.3 activate neighbor 10.255.1.4 activate neighbor 10.255.1.5 activate neighbor 10.255.1.6 activate neighbor 10.255.1.7 activate neighbor 10.255.1.8 activate ! R3 router bgp 65001 bgp router-id 10.255.1.3 bgp log-neighbor-changes neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 address-family ipv4 neighbor 10.255.1.1 activate ! R4 router bgp 65001 bgp router-id 10.255.1.4 bgp log-neighbor-changes neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 address-family ipv4 neighbor 10.255.1.1 activate

CCIE R&S LAB – CFG H2/A5 ! R5 router bgp 65001 bgp router-id 10.255.1.5 bgp log-neighbor-changes neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 address-family ipv4 neighbor 10.255.1.1 activate ! R6 router bgp 65001 bgp router-id 10.255.1.6 bgp log-neighbor-changes neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 address-family ipv4 neighbor 10.255.1.1 activate ! R7 router bgp 65001 bgp router-id 10.255.1.7 bgp log-neighbor-changes neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 address-family ipv4 neighbor 10.255.1.1 activate ! R8 router bgp 65001 bgp router-id 10.255.1.8 bgp log-neighbor-changes neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 address-family ipv4 neighbor 10.255.1.1 activate !

2.5 Jacob’s Pre‐merge

COMPLETELY DIFERENCE ON EXAM! DON’T REMEMBER EXACTLY WHAT WORDS CISCO SAY, BUT WE DON’T DO NOTHING. TASK HERE, ONLY

CCIE R&S LAB – CFG H2/A5 DIRECTION YOU TO USE SoO ON PE SIDE JAMESON SITE. REDISTRIBUT EIGRP+FILTER FOR CONTROL LOOP WAS PRE-CONFIGURED ON EXAM Refer to the “Overall Scenario”, “Diagram 2: Initial Topology” and “Diagram 4: Premerge Topology”. Jameson’s decided to enable MPLS VPN in their network Configure Jameson’s network as per the following requirements:  R55, R56and R58 must redistribute EIGRP and BGP Solution: R55 router eigrp CCIE ! address-family ipv4 unicast autonomous-system 10 ! topology base redistribute bgp 65005 metric 1000 100 255 1 1500 ! ip prefix-list EIGRP permit 172.18.0.0/16 le 32 ! route-map EIGRP permit 10 match ip address prefix-list EIGRP router bgp 65005 redistribute eigrp 10 route-map EIGRP aggregate 172.18.0.0 255.255.0.0 summary-only ! R56 router eigrp CCIE ! address-family ipv4 unicast autonomous-system 10 ! topology base redistribute bgp 65005 metric 1000 100 255 1 1500 ! ip prefix-list EIGRP permit 172.18.0.0/16 le 32 ! route-map EIGRP permit 10 match ip address prefix-list EIGRP router bgp 65005 redistribute eigrp 10 route-map EIGRP aggregate 172.18.0.0 255.255.0.0 summary-only ! R58

CCIE R&S LAB – CFG H2/A5 router bgp 65007 redistribute eigrp 10 !

Check:

Check if each prefix is sending for router border. This moment you don’t received nothing, cuz MPLS SETUP no configure yet. After section 3.2,3.3,3.4 you should see routes receive. Check only if you sent network.

2.6 Merge phase 1: BGP Refer to the “Overall Scenario” and “Diagram 5: Merge Phase: 1” Jameson’s and Jacob’s started the first phase of their merge and add a new border router in their respective main site (R18 and R57). Configure the network as per the following requirements:  Interface Lo0 of both R18 and R57 must be add into their respective IGP domain.  Interface Eth0/1 of both R18 and R57 must peer with its connected IGP neighbor.  Both R18 and R57 must advertise a summary prefix via eBGP to each other as follows: o R18 advertises 10.0.0.0/8 o R57 advertises 172.0.0.0/8  Both R18 and R57 must propagate the received summary prefix into their respective IGP domain.

Solution: R18 ip prefix-list merge seq 5 permit 10.0.0.0/8 ! router ospf 65002 router-id 10.255.1.18 redistribute bgp 65002 subnets metric-type 1 network 10.2.0.42 0.0.0.0 area 0

CCIE R&S LAB – CFG H2/A5 network 10.255.1.18 0.0.0.0 area 0 ! ! router bgp 65002 bgp router-id 10.255.1.18 redistribute ospf 65002 neighbor 10.2.0.46 remote-as 65005 neighbor 10.2.0.46 prefix-list merge out aggregate-address 10.0.0.0 255.0.0.0 !

R57

ip prefix-list merge permit 172.0.0.0/8 ! router eigrp CCIE ! address-family ipv4 unicast autonomous-system 10 ! topology base redistribute bgp 65005 metric 10000 1000 255 1 1500 exit-af-topology network 172.18.2.1 0.0.0.0 network 172.30.1.57 0.0.0.0 exit-address-family ! router bgp 65005 bgp router-id 172.30.1.57 redistribute eigrp 10 neighbor 10.2.0.45 remote-as 65002 neighbor 10.2.0.45 prefix-list merge out aggregate-address 172.0.0.0 255.0.0.0 !

Check:

CCIE R&S LAB – CFG H2/A5

2.7 Merge phase 2: IGP Refer to “Diagram 2: Initial Topology” and “Diagram 6: Merge Phase 2”. Jameson’s and Jacob’s are entering in the second phase of the merge and have deployed two new border routers in their respective core network. Configure the core networks as per the following requirements:  R9 and R10 must run OSPF on their interface Eth0/0 and Lo0.  R9 and R10 must run EIGRP on their interface Eth0/1.  R53 and R54 must run EIGRP on all of their interfaces.  Mutually redistribute EIGRP and OSPF on both R9 and R10  Avoid routing loops and ensure that all current and future prefixes are routed via their optimal path. Do not use any access‐list or prefix‐list in order to achieve this requirement.  Do not change any administrative distance of any protocol in any router. Solution:

R9 route-tag notation dotted-decimal ! route-map loop deny 10 match tag 172.172.172.172 route-map loop permit 20 ! router ospf 65001 router-id 10.255.1.9 redistribute eigrp 1 subnets distribute-list route-map loop in !

CCIE R&S LAB – CFG H2/A5 inte ran e0/0,lo0 ip ospf 65001 area 0 ! ! router eigrp CCIE ! address-family ipv4 unicast autonomous-system 1 ! topology base redistribute ospf 65001 metric 10000 1000 255 1 1500 exit-af-topology network 10.254.0.61 0.0.0.0 !

R10 route-tag notation dotted-decimal ! route-map loop deny 10 match tag 172.172.172.172 route-map loop permit 20 ! router ospf 65001 router-id 10.255.1.10 redistribute eigrp 1 subnets distribute-list route-map loop in ! inte ran e0/0,lo0 ip ospf 65001 area 0 ! router eigrp CCIE ! address-family ipv4 unicast autonomous-system 1 ! topology base redistribute ospf 65001 metric 10000 1000 255 1 1500 exit-af-topology network 10.254.0.65 0.0.0.0

R53 router eigrp CCIE address-family ipv4 unicast autonomous-system 1 topology base exit-af-topology network 10.254.0.62 0.0.0.0 network 172.30.1.53 0.0.0.0 network 172.30.100.4 0.0.0.0

CCIE R&S LAB – CFG H2/A5 R54 router eigrp CCIE ! address-family ipv4 unicast autonomous-system 1 ! topology base exit-af-topology network 10.254.0.66 0.0.0.0 network 172.30.1.54 0.0.0.0 network 172.30.100.5 0.0.0.0

Check: Both solutions you should get prefix 52.52.52.52/32 on R9/R10 by EIGRP

CCIE R&S LAB – CFG H2/A5

2.8 Merge phase 2: Routing Policies

Refer to the “Overall Scenario”, “Diagram 2: Initial Topology” and “Diagram 6: Merge Phase 2”. Configure the network as per the following requirements:  Network managers have decided that the primary path for all traffic between Jameson’s 10.2.1.0/24 and Jacob’s 172.18.1.0/24 must be routed preferably via the BGP backdoor link between R18 and R57. If this link should fail then traffic should fall back over the MPLS core network.  All other traffic must be routed preferably via the MPLS core network.  Do not configure any route‐map nor access‐list in order to achieve this requirement.  Ensure that the following test reveals the same path as shown below:

CCIE R&S LAB – CFG H2/A5

Solution: R18 ip prefix-list merge seq 10 permit 10.2.1.0/24 ! clear ip bgp * out R57 ip prefix-list merge permit 172.18.1.0/24 ! clear ip bgp * out

Check: This moment, you don’t make section 5.1 and 5.3 (dhcp and hsrp) so you canno’t test from PC. For test, use source vlan over swich. Too you don’t make section MPLS vpn, so you don’t get traceroute over MPLS cloud. We can test for specfic network.

2.9 IPv6 Routing, part 1

CCIE R&S LAB – CFG H2/A5 Refer to “Diagram 2: Initial Topology”. Jameson’s started deploying IPv6 in dual‐stack mode in the datacenter. Configure Jameson’s datacenter network as per the following requirements:  Establish OSPFv3 adjacencies in Area 0 between SW3, SW4, R15 and R16.  Do not use the command “ipv6 ospf” anywhere in order to accomplish the previous requirement.  Interface VLAN 100 of SW3 must be configured with default route preference set to “high”.  Interface VLAN 100 of SW4 must be configured with default route preference set to “medium”.  The interval between Router Advertisement transmissions on VLAN 100 must be set 20 seconds on both SW3 and SW4.

Solution: SW3 ipv6 unicast-routing ! router ospfv3 65002 router-id 10.255.1.103 ! interface range l0, vlan153, vlan34 ospfv3 65002 ipv6 area 0 ! interface vlan 100 ipv6 nd router-preference High ipv6 nd ra interval 20

SW4 ipv6 unicast-routing ! router ospfv3 65002 router-id 10.255.1.104 ! interface range l0, vlan34 ospfv3 65002 ipv6 area 0 ! interface vlan 100 ipv6 nd router-preference medium ipv6 nd ra interval 20

R15

CCIE R&S LAB – CFG H2/A5 ipv6 unicast-routing ! ipv6 router ospf 65002 router-id 10.255.1.15 ! inte ran lo0,e0/0,e0/2 ospfv3 65002 ipv6 area 0 !

R16 ipv6 unicast-routing ! Ipv6 router ospf 65002 router-id 10.255.1.16 ! interface range e0/0, e0/2 ospfv3 65002 ipv6 area 0 !

Check:

2.10 IPv6 Routing, part 2 Configure Jameson’s datacenter network as per the following requirements:  SW3 and SW4 must provide first‐hop redundancy for hosts in VLAN 100 by sharing the virtual link‐local address FE80:100::1.  SW3 must be elected as the active router and SW4 must be elected the standby router

CCIE R&S LAB – CFG H2/A5  In case SW3 is down, SW4 must take over the active role. If SW3 comes back online, it must automatically recover the active role from SW4.  Ensure that HSRP Hello packets are exchanged every second and that the standby takes over the active role if three consecutive Hello packets were missed from the active. Solution: SW3 interface vlan 100 ospfv3 65002 ipv6 area 0 standby version 2 standby 6 ipv6 FE80:100::1 standby 6 preempt standby 6 priority 105 standby 6 timers 1 3 SW4 interface vlan 100 ipv6 address 2001:6500:2:100::34/64 ospfv3 65002 ipv6 area 0 standby version 2 standby 6 ipv6 FE80:100::1 standby 6 preempt standby 6 timers 1 3

R101 inte e0/0 ipv6 address autoconfig

Check:

CCIE R&S LAB – CFG H2/A5

2.11 Multicast in Jameson’s Refer to “Diagram 2: Initial Topology”. An application running on server R101 (which is located in Jameson’s datacenter) uses multicast to deliver specific traffic to users located in Jameson’s branch network. Configure Jameson’s network as per following requirements:  Use PIM Sparse‐mode.  The interface Lo0 of R15 must be elected as the Rendezvous point for the whole multicast domain.  R15 must announce its candidacy to advertise the group‐to‐RP mapping set to the router link local address.  For interoperability reasons, the selection of R17 as the RP must adhere to open standard and must use the default priority value as per the standard.  The source SW3 uses the group address 239.1.1.1 to send traffic to interested receivers.  No use PIM command on SW3.  Receivers are located in the branch network and they are connected to the datacenter via DMVPN.  Ensure that the following test is successful:

SW3#ping 239.1.1.1 source vlan 173

CCIE R&S LAB – CFG H2/A5 Solution:

R17 ip pim bsr-candidate lo0 ip pim rp-candidate loopback 0 ! ip multicast-routing ! interface range e0/1, tunnel0 ip pim sparse-mode ! R19 ! ip multicast-routing ! interface range e0/1, tunnel0 ip pim sparse-mode ! interface e0/1 ip igmp join-group 239.1.1.1

R20 ip multicast-routing ! interface range e0/1, tunnel0 ip pim sparse-mode ! interface e0/1 ip igmp join-group 239.1.1.1

R21 ip multicast-routing ! interface range e0/1, tunnel0 ip pim sparse-mode ! interface e0/1 ip igmp join-group 239.1.1.1

Check:

CCIE R&S LAB – CFG H2/A5

Section 3 – VPN Technologies

3.1 Jameson’s Branch Offices Refer to “Diagram 2: Initial Topology”. Configure DMVPN Phase 3 in Jameson’s branch network as per the following requirements:  Use the preconfigured interface Tunnel0 on all four routers in order to accomplish this task.  R17 must be configured as the hub router.  R19, R20 and R21 must be the spoke routers and must participate in the NHRP information exchange.  Ensure that spoke‐to‐spoke traffic does not transit via the hub.  Protect the tunneled traffic by attaching the preconfigured IPsec profile to the tunnel interface on all tunnel end‐points.  Ensure that all spoke establish an OSPF adjacency through the tunnel with the hub R17, without attempting to elect any Designated Router.  Ensure that the following test are successful:

Solution: ON EXAM, CRYPTO POLICY WAS PRE-CONFIGURED, WE NEED PUT ON INTERFACE; R17 interface Tunnel0 ip mtu 1400 ip nhrp authentication 65002key

CCIE R&S LAB – CFG H2/A5 ip nhrp map multicast dynamic ip nhrp network-id 65002 ip nhrp holdtime 300 ip nhrp redirect ip ospf priority 255 ip ospf network broadcast tunnel protection ipsec profile cisco ! R19 ! ! interface Tunnel0 ip mtu 1400 ip nhrp authentication 65002key ip nhrp map multicast 192.0.2.2 ip nhrp map 10.100.0.1 192.0.2.2 ip nhrp network-id 65002 ip nhrp holdtime 300 ip nhrp nhs 10.100.0.1 ip nhrp shortcut ip ospf network broadcast ip ospf priority 0 tunnel source Dialer0 tunnel vrf LOCALSP tunnel protection ipsec profile cisco ! R20

interface Tunnel0 ip mtu 1400 ip nhrp authentication 65002key ip nhrp map multicast 192.0.2.2 ip nhrp map 10.100.0.1 192.0.2.2 ip nhrp network-id 65002 ip nhrp holdtime 300 ip nhrp nhs 10.100.0.1 ip nhrp shortcut ip ospf network broadcast ip ospf priority 0 tunnel source Dialer0 tunnel vrf LOCALSP tunnel protection ipsec profile cisco ! R21 interface Tunnel0 ip mtu 1400 ip nhrp authentication 65002key

CCIE R&S LAB – CFG H2/A5 ip nhrp map multicast 192.0.2.2 ip nhrp map 10.100.0.1 192.0.2.2 ip nhrp network-id 65002 ip nhrp holdtime 300 ip nhrp nhs 10.100.0.1 ip nhrp shortcut ip ospf network broadcast ip ospf priority 0 tunnel source Dialer0 tunnel vrf LOCALSP tunnel protection ipsec profile cisco !

Check:

3.2 Jameson’s Pre‐merge VPN Refer to the “Overall Scenario” and “Diagram 4: Pre‐merge Topology”. Jameson’s decided to enable MPLS VPN in their network. They started configuring it but it is your responsibility to complete it and verify that it is fully functional. Configure Jameson’s network as per the following requirements:

CCIE R&S LAB – CFG H2/A5  Enable LDP in the core network as indicated in “Diagram 4: Pre‐merge Topology”.  Ensure that all LDP routers use their interface Lo0 as their LDP router‐id.  R1 must reflect VPNv4 prefixes to all PE’s.  The datacenter and main office network must be connected to the VPN “GREEN” via eBGP.  The headquarter network must be connected to the VPN “RED” via eBGP.  All six PE’s must use a consistent format “ASN.nn” for the VPN route distinguisher, where: o o

ASN is the Autonomous System Number of the connected CE nn is any relevant number for the VPN site.

 Ensure that R101 in the datacenter’s VLAN 100 can successfully ping SW2 in the main office as shown below:

CCIE R&S LAB – CFG H2/A5 Solution: R1 mpls ldp router-id lo0 force ! inte ran e0/0-3,e1/0 mpls ip ! router bgp 65001 address-family vpnv4 neighbor ibgp send-community extended neighbor ibgp route-reflector-client neighbor 10.255.1.3 activate neighbor 10.255.1.4 activate neighbor 10.255.1.5 activate neighbor 10.255.1.6 activate neighbor 10.255.1.7 activate neighbor 10.255.1.8 activate ! R2 mpls ldp router-id lo0 force ! inte ran e0/0-3,e1/0 mpls ip R3 mpls ldp router-id lo0 force ! inte ran e0/0,e0/2 mpls ip ! ip vrf GREEN rd 65002:3 ! int e0/1 ip vrf forwarding GREEN ip address 10.254.0.73 255.255.255.252 ! router bgp 65001 no neighbor 10.254.0.74 remote-as 65002 ! address-family vpnv4 neighbor 10.255.1.1 activate neighbor 10.255.1.1 send-community extended ! add ipv4 vrf GREEN neighbor 10.254.0.74 remote-as 65002 neighbor 10.254.0.74 as-override

CCIE R&S LAB – CFG H2/A5 neighbor 10.254.0.74 soo 3:4 ! R4 mpls ldp router-id lo0 force ! inte ran e0/0,e0/2 mpls ip ! ip vrf GREEN rd 65002:4 ! int e0/1 ip vrf forwarding GREEN ip address 10.254.0.77 255.255.255.252 ! ! router bgp 65001 no neighbor 10.254.0.78 remote-as 65002 ! address-family vpnv4 neighbor 10.255.1.1 activate neighbor 10.255.1.1 send-community extended ! add ipv4 vrf GREEN neighbor 10.254.0.78 remote-as 65002 neighbor 10.254.0.78 as-override neighbor 10.254.0.78 soo 3:4 ! R5 mpls ldp router-id lo0 force ! inte ran e0/0-1 mpls ip ! ip vrf GREEN rd 65002:5 ! interface Ethernet0/2 ip vrf forwarding GREEN ip address 10.254.0.41 255.255.255.252 ! router bgp 65001 no neighbor 10.254.0.42 remote-as 65002 ! address-family vpnv4 neighbor 10.255.1.1 activate neighbor 10.255.1.1 send-community extended

CCIE R&S LAB – CFG H2/A5 ! address-family ipv4 vrf GREEN neighbor 10.254.0.42 remote-as 65002 neighbor 10.254.0.42 activate neighbor 10.254.0.42 as-override neighbor 10.254.0.42 soo 5:6

R6 mpls ldp router-id lo0 force ! inte ran e0/0-1 mpls ip ! ip vrf GREEN rd 65002:6 ! interface Ethernet0/2 ip vrf forwarding GREEN ip address 10.254.0.45 255.255.255.252 ! router bgp 65001 no neighbor 10.254.0.46 remote-as 65002 ! address-family vpnv4 neighbor 10.255.1.1 activate neighbor 10.255.1.1 send-community extended add ipv4 vrf GREEN neighbor 10.254.0.46 remote-as 65002 neighbor 10.254.0.46 as-override neighbor 10.254.0.46 soo 5:6

R7 mpls ldp router-id lo0 force ! inte ran e0/3 mpls ip ! ip vrf RED rd 65002:7 ! int e0/0 ip vrf forwarding RED ip address 10.254.0.53 255.255.255.252 ! router bgp 65001 no neighbor 10.254.0.54 remote-as 65002 address-family vpnv4 neighbor 10.255.1.1 activate neighbor 10.255.1.1 send-community extended

CCIE R&S LAB – CFG H2/A5 ! add ipv4 vrf RED neighbor 10.254.0.54 remote-as 65002 neighbor 10.254.0.54 as-override neighbor 10.254.0.54 soo 7:8 ! R8 mpls ldp router-id lo0 force ! inte ran e0/3 mpls ip ! ip vrf RED rd 65002:8 ! interface Ethernet0/0 ip vrf forwarding RED ip address 10.254.0.57 255.255.255.252 ! router bgp 65001 no neighbor 10.254.0.58 remote-as 65002 address-family vpnv4 neighbor 10.255.1.1 activate neighbor 10.255.1.1 send-community extended ! add ipv4 vrf RED neighbor 10.254.0.58 remote-as 65002 neighbor 10.254.0.58 as-override neighbor 10.254.0.58 soo 7:8

Check:

3.3 Merge phase 2: VPN Refer to the “Overall Scenario” and “Diagram 6: Merge Phase 2”. Jameson’s and Jacob’s are entering in the second phase of the merge and have deployed two new border routers in their respective core network. Configure the network as per the following requirements:  The BGP AS number of Jacob’s original core network must be converted to use Jameson’s AS number 65001, as indicated in “Diagram 6: Merge Phase 2”.

CCIE R&S LAB – CFG H2/A5  All BGP sessions between Jacob’s core and remote sites (including headquarters and office networks) must be recovered using the new AS number.  Do not modify the BGP configuration of Jacob’s CEs (R55, R56, R58) in order to accomplish this requirement.  Enable LDP in the merged core network as indicated in “Diagram 6: Merge Phase2”, including the four new border router (R9, R10, R53, R54) and Jacob’s core network.  Ensure that all LDP routers use their interface Lo0 as their LDP router‐id.  R1 must reflect VPNv4 prefixes to all PE’s, including to Jacob’s PE.  Jacob’s headquarters network must be added to the VPN GREEN.  Jacob’s office network must be added to the VPN BLUE.  All nine PE’s must use a consistent format “ASN.nn” for the VPN route distinguisher, where: o ASN is the Autonomous System Number of the connected CE o nn is any relevant number

Solution: R9 mpls ldp router-id lo0 force ! interface range e0/0-1 mpls ip R10 mpls ldp router-id lo0 force !

CCIE R&S LAB – CFG H2/A5 interface range e0/0-1 mpls ip R53 mpls ldp router-id lo0 force ! interface range e0/0-1 mpls ip R54 mpls ldp router-id lo0 force ! interface range e0/0-1 mpls ip R50 mpls ldp router-id lo0 force ! interface e0/0 mpls ip ! ###ON EXAME THIS RD WAS CONFIGURED WRONG, LIKE IT BELLOW: ip vrf GREEN rd 100:100 ###################WE NEED ERASE THIS RD AND RE-CREATE CORRECT FORM ASN:NN, WHERE ASN IS EQUAL AS CE, NN ANY NUMBER RELEVANT; ip vrf GREEN rd 65005:50 ! interface e0/1 ip vrf fo GREEN ip address 172.18.253.1 255.255.255.252 ! no router bgp 65006 ! #we need wait some sec here# ! router bgp 65001 bgp router-id 172.30.1.50 neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 add ipv4 vrf GREEN neighbor 172.18.253.2 remote-as 65005 neighbor 172.18.253.2 local-as 65006 add vpnv4 neighbor 10.255.1.1 act

CCIE R&S LAB – CFG H2/A5 R51 mpls ldp router-id lo0 force ! interface e0/0 mpls ip ! ###ON EXAME THIS RD WAS CONFIGURED WRONG, LIKE IT BELLOW: ip vrf GREEN rd 100:100 ###################WE NEED ERASE THIS RD AND RE-CREATE CORRECT FORM ASN:NN, WHERE ASN IS EQUAL AS CE, NN ANY NUMBER RELEVANT;

ip vrf GREEN rd 65005:51 ! interface e0/1 ip vrf fo GREEN ip address 172.18.253.5 255.255.255.252 ! no router bgp 65006 ! #we need wait some sec here# ! router bgp 65001 bgp router-id 172.30.1.51 neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 add ipv4 vrf GREEN neighbor 172.18.253.6 remote-as 65005 neighbor 172.18.253.6 local-as 65006 add vpnv4 neighbor 10.255.1.1 act

R52 mpls ldp router-id lo0 force ! interface e0/0 mpls ip ! ip vrf BLUE rd 65007:52 ! interface e0/1 ip vrf fo BLUE ip address 172.17.253.22 255.255.255.252 ! no router bgp 65006

CCIE R&S LAB – CFG H2/A5 ! #we need wait some sec here# ! router bgp 65001 bgp router-id 172.30.1.52 neighbor 10.255.1.1 remote-as 65001 neighbor 10.255.1.1 up lo0 add ipv4 vrf BLUE neighbor 172.17.253.21 remote-as 65007 neighbor 172.17.253.21 local-as 65006 add vpnv4 neighbor 10.255.1.1 act

R1 router bgp 65001 neighbor 172.30.1.50 neighbor 172.30.1.51 neighbor 172.30.1.52 ! add vpnv4 neighbor 172.30.1.50 neighbor 172.30.1.51 neighbor 172.30.1.52

peer-group ibgp peer-group ibgp peer-group ibgp

act act act

Check:

3.4 Inter‐VPN Routing LOST HERE ALOT TIME, WORDS TASK ARE DIFERENCES BUT WHAT CISCO WANT WE IMPORT ALL RT ON DC PE, AND ON OTHERS SITES IMPORT ONLY RT FROM DC. CISCO WANT WE USED SoO SIDE JAMESON SITE. Refer to the “Overall Scenario” and “Diagram 6: Merge Phase 2”. Configure the network as per the following requirements:  Jameson’s headquarters (VPN RED), main office (VPN GREEN) and Jacob’ office (VPN BLUE) must receive datacenter prefixes (VPN GREEN).  Jameson’s main office (VPN GREEN) may not receive headquarters (VPN RED) prefixes nor

CCIE R&S LAB – CFG H2/A5 Jacob’s headquarters (VPN GREEN) prefixes.  In order to simplify future changes, your solution may not be limited to specific prefixes. Solution: R3 ip vrf GREEN route-target route-target route-target route-target route-target route-target

export import import import import import

65001:1 65001:1 65001:2 65001:3 65001:4 65001:5

export import import import import import

65001:1 65001:1 65001:2 65001:3 65001:4 65001:5

R4 ip vrf GREEN route-target route-target route-target route-target route-target route-target R5 ip vrf GREEN route-target export 65001:2 route-target import 65001:1 route-target import 65001:2 R6 ip vrf GREEN route-target export 65001:2 route-target import 65001:1 route-target import 65001:2

R7 ip vrf RED route-target export 65001:3 route-target import 65001:1 route-target import 65001:3

R8 ip vrf RED

CCIE R&S LAB – CFG H2/A5 route-target export 65001:3 route-target import 65001:1 route-target import 65001:3

R50 ip vrf GREEN route-target export 65001:4 route-target import 65001:1

R51 ip vrf GREEN route-target export 65001:4 route-target import 65001:1 R52 ip vrf BLUE route-target export 65001:5 route-target import 65001:1

Check:

Section 4 – Infrastructure Security 4.1 Device Security Refer to “Diagram 1: Initial Topology”. Configure the network as per the following requirements:

CCIE R&S LAB – CFG H2/A5  Protect R17’s control‐plane from TTL expiry attacks so that illegitimate IP packets with a TTL of 0 or 1 are dropped before the CPU processes them.  Legit packets include expected control protocols running on the link. Solution:

R17 ip access-list extended ttl deny pim any any deny ospf any any deny gre any any deny udp any any eq isakmp deny esp any any deny tcp any eq 179 any deny tcp any any eq 179 permit ip any any ttl lt 2 ! class-map match-all classttl match access-group name ttl ! policy-map policyttl class classttl drop ! control-plane service-policy input policyttl

4.2 Network Security Refer to “Diagram 1: Jameson’s Layer 2 Connections” and “Diagram 2: Initial Topology”. Configure the network as per the following requirements:  SW5 and SW6 must filter DHCP message received by untrusted hosts by comparing the source MAC address and the DHCP client hardware address. If the address match, the switches must forward the packet. If the addresses do not match, the switches must drop the packet.  Ensure that these access switches do not filter DHCP packets on their uplinks.  Ensure that the DHCP relay switches (refer to item 5.1) allow DHCP message received on their interface VLAN 100 with the added Option 82 and uninitialized GIADDR field to be accepted. Solution: SW5 ip dhcp snooping

CCIE R&S LAB – CFG H2/A5 ip dhcp snooping vlan 100-101 ip dhcp verify mac ! interface range po35,po45 ip dhcp snooping trust SW6 ip dhcp snooping ip dhcp snooping vlan 100-101 ip dhcp verify mac ! interface range po36,po46 ip dhcp snooping trust SW3 interface vlan 100 ip dhcp relay information trusted SW4 interface vlan 100 ip dhcp relay information trusted

Check:

Section 5 – Infrastructure Services 5.1 Centralized DHCP Refer to “Diagram 1: Jameson’s Layer 2 Connections” and “Diagram 2: Initial Topology”. Jameson’s R15 must centralize DHCP service for the datacenter’s hosts VLANs. Configure the network as per the following requirements:  Ensure that the distribution switches SW3 and SW4 forward DHCP discover broadcast message received from VLAN 100’s hosts to interface Lo0 of R15 as unicast messages.  R15 must assign hosts in VLAN 100 a valid IP address from the prefix 10.2.1.0/24.

CCIE R&S LAB – CFG H2/A5  Ensure that addresses that were statically configured will never be assigned to any host.  The DHCP offer must include the IP address 10.2.1.1/24 as the default gateway for VLAN 100 users.  Ensure that the server R101 effectively receives an IP address from the expected prefix 10.2.1.0/24 as well as its default gateway information.

Solution: R15 ip dhcp excluded-address 10.2.1.1 ip dhcp excluded-address 10.2.1.253 ip dhcp excluded-address 10.2.1.254 ip dhcp pool VLAN100 network 10.2.1.0 255.255.255.0 default-router 10.2.1.1 ! SW3 interface vlan 100 ip helper-address 10.255.1.15 SW4 interface vlan 100 ip helper-address 10.255.1.15

Check:

5.2 Internet Gateway Refer to “Diagram 1: Initial Topology”. Configure the network as per the following requirements:

CCIE R&S LAB – CFG H2/A5  R17 is Jameson’s Internet gateway router.  Ensure that R17 enables all internal hosts (that is: hosts with source IP address in the range of 10.0.0.0/8 or 172.0.0.0/8) to simultaneously connect to the Internet using the public IP address of interface Eth0/0. The following tests must be successful:

Solution: R17 access-list 99 permit 10.0.0.0 0.255.255.255 access-list 99 permit 172.0.0.0 0.255.255.255 ! interface e0/0 ip nat outside ! interface range e0/1, tunnel0 ip nat inside

CCIE R&S LAB – CFG H2/A5 ! ip nat inside source list 99 interface e0/0 overload ! R15 router bgp 65002 neighbor 10.254.0.73 default-originate R16 router bgp 65002 neighbor 10.254.0.77 default-originate

5.3 First hop redundancy Refer to “Diagram 1: Jameson’s Layer 2 Connections” and “Diagram 2: Initial Topology”. Jameson’s datacenter’s SW3 and SW4 must offer first hop redundancy to VLAN 100’s host using HSRP. Configure the network as per the following requirements:  SW3 and SW4 must use the multicast address 224.0.0.102 in order to negotiate the active and standby roles.  SW3 must be elected as the active router and SW4 must be elected as the standby router.  In case SW3 is down, SW4 must take over the active role. If SW3 comes back online, it must automatically recover the active role from SW4.  Ensure that HSRP hello packets are exchanged every second and that the standby takes over the active role if three consecutive Hello packets were missed from the active.  Both routers must share the virtual IP address 10.2.1.1 that will be used as default gateway for VLAN 100’s hosts. Solution: SW3 interface Vlan100 standby version 2 standby 100 ip 10.2.1.1 standby 100 timers 1 3 standby 100 priority 105 standby 100 preempt -------------------------------SW4 interface Vlan100 standby version 2 standby 100 ip 10.2.1.1 standby 100 timers 1 3

CCIE R&S LAB – CFG H2/A5 standby 100 preempt

Check:

5.4 Tracking reachability Refer to “Diagram 1: Jameson’s Layer 2 Connections” and “Diagram 2: Initial Topology”. Configure the network as per the following requirements:

 SW3 and SW4 must monitor the reachability of their OSPF IPv4 default route and in case it is not available, the HSRP priority must be decreased by 10.

Solution: SW3 track 1 ip route 0.0.0.0/0 reachability ! interface vlan100 standby 100 track 1 decrement 10 SW4 track 1 ip route 0.0.0.0/0 reachability ! interface vlan100 standby 100 track 1 decrement 10

Check: