ccna 3 ex_ospf

CCNA Routing and SwitchingScaling NetworksOSPF Practice Skills Assessment Packet TracerA few things to keep in mind while completing this activity:1. Do not use the browser Back button or close or reload any exam windows during the exam.2. Do not close Packet Tracer when you are done. It will close automatically.3. Click the Submit Assessment button in the browser window to submit your work.IntroductionIn Part I of this practice skills assessment, you will configure the Company A network with routing and ACLs. You will configure dynamic routing with OSPFv2and distribute adefault route. In addition, you will configure two access control lists.In Part II of this practice skills assessment, you will configure the Company A network withRPVST+, port security, EtherChannel, DHCP, VLANs and trunking, and routing between VLANs. In addition you will perform an initial configuration on a switch, secure switch ports and create SVIs.You will also control access to the switch management network with an access control list.All IOS device configurations should be completed from a direct terminal connection to the device console from an available host.

Some values that are required to complete the configurations have not been given to you. In those cases, create the values that you need to complete the requirements. These values may include certain IP addresses, passwords, interface descriptions, banner text, and other values.

For the sake of time, many repetitive but important configuration tasks have been omitted from this activity. Many of these tasks, especially those related to device security, are essential elements of a network configuration. The intent of this activity is not to diminish the importance of full device configurations.You will practice and be assessed on the following skills: Configuration of initial device settings IPv4 address assignment and configuration Configuration and addressing of device interfaces Configuration of the OSPFv2 routing protocol Configuration of a default route Configuration of ACL to limit device access Configuration of switch management settings including SSH Configuration of port security Configuration of unused switch ports according to security best practices Configuration of RPVST+ Configuration of EtherChannel Configuration of a router as a DHCP server Configuration of VLANs and trunks Configuration of routing between VLANsYou are required to do the following:Site 1: Configure initial devicesettings. Configure interfaces withIPv4 addresses, descriptions, and other settings. Configureand customize OSPFv2.HQ: Configure interfaces withIPv4 addresses, descriptions, and other settings. Configureand customizeOSPFv2. Configure named and numbered ACLs. Configure and propagate a default route through OSPFv2.Site 2: Configure interfaces withIPv4 addresses, descriptions, and other settings. Configure DHCP pools and excluded addresses. Configure routing between VLANs. Configure a standard ACL. Configure OSPFv2.SW-A: Create and name VLANs. Configure EtherChannel. Configure trunking. Assign access ports to VLANs. Configure remote management settings. Activate and configure RPVST+. Secure unused switch ports. Configure port security.SW-B: Create and name VLANs. Configure EtherChannel. Configure trunking. Assign access ports to VLANs. Configure remote management settings with SSH. Activate RPVST+.SW-C: Create and name VLANs. Configure EtherChannel. Configure trunking. Assign access ports to VLANs. Configure remote management settings. Activate and configure RPVST+. Configure switch ports with PortFast and BPDU Guard.Internal PC hosts: Configure as DHCP clients. Assign static IPv4 addresses where indicated.

TablesNote: You are provided with the networks that interfaces should be configured on. Unless you are told to do differently in the detailed instructions below, you are free to choose the host addresses to assign.Addressing Table:DeviceInterfaceNetworkConfiguration Details

Site 1S0/0/0192.168.100.20/30any address in the network192.168.100.22

G0/0192.168.8.0/24first host address192.168.8.1

G0/1192.168.9.0/24first host address192.168.9.1

HQS0/0/0192.168.100.20/30any address in the network192.168.100.21

S0/0/1192.168.100.36/30any address in the network192.168.100.37

S0/1/0203.0.113.16/29(The first address in this network is already in use on the ISP router. Any other address in the network can be assigned to this interface.)203.0.113.18

Site 2S0/0/1192.168.100.36/30any address in the network192.168.100.38

G0/1.210.10.2.0/24firstaddress in the network10.10.2.1

G0/1.410.10.4.0/24first address in the network10.10.4.1




SW-ASVI10.10.25.0/24the highest address in the network10.10.25.254

SW-BSVI10.10.25.0/24the second to the highest address in the network10.10.25.253

SW-CSVI10.10.25.0/24the third to the highest address in the network10.10.25.252

Manage-1ANIC192.168.8.0/24any address in the network192.168.8.2

Clerk-1CNIC192.168.9.0/24any address in the network192.168.9.2

Admin-ANIC10.10.15.0/24any available address in network10.10.15.2

Admin-BNIC10.10.15.0/24any available address in network10.10.15.3

VLAN Switch Port Assignment Table:VLANNameNetworkDeviceSwitch Ports

2sales10.10.2.0/24SW-AFa0/5

SW-CFa0/7

4prod10.10.4.0/24SW-AFa0/10

SW-CFa0/10

8acct10.10.8.0/24SW-AFa0/15

SW-CFa0/15

15admin10.10.15.0/24SW-AFa0/24

SW-CFa0/24

25SVI-NET10.10.25.0/24SW-ASVI

SW-BSVI

SW-CSVI

99nullN/ASW-Aall unused ports

Port-Channel Groups:ChannelDeviceInterfaces

1SW-AFa0/1, Fa0/2

SW-CFa0/1, Fa0/2

2SW-AFa0/3, Fa0/4

SW-BFa0/3, Fa0/4

3SW-BFa0/5, Fa0/6

SW-CFa0/5, Fa0/6

Instructions

All configurations must be performed through a direct terminal connection to the device console linefrom an available host.Part I: OSPFv2 Router ConfigurationStep 1: Plan the Addressing.Determine the IP addresses that you will use for the required interfaces on the devices andLAN hosts. Follow the configuration details provided in the Addressing Table.Step 2: Configure Site 1.

Configure Site 1with initial settings: Configure the router host name:Site-1. This value must be entered exactly as it appears here.Router(config)#hostname Site-1 Prevent the router from attempting to resolve command line entries to IP addresses.Site-1(config)#no ip domain look up Protect device configurations from unauthorized access with an encryptedsecretpassword.Site-1(config)#enable secret class Secure the router console and remote access lines.Site-1(config)#line console 0Site-1(config-line)#password ciscoSite-1(config-line)#loginSite-1(config)#line vty 0 4Site-1(config-line)#password ciscoSite-1(config-line)#loginSite-1(config)#line aux 0Site-1(config-line)#password ciscoSite-1(config-line)#login Prevent system status messages from interrupting console output.Site-1(config)#line console 0Site-1(config-line)#logging synchronous Configure a message-of-the-day banner.Site-1(config)#banner motd Authorized Access Only Encrypt all clear text passwords.Site-1(config)#service password-encryptionStep 3: Configure the Router Interfaces.Configure the interfaces ofallrouters for full connectivity with the following: IP addressing Descriptions forserialinterfaces. Configure DCE settings where required. Use a rate of128000. The Ethernet subinterfaces on Site 2 will configured later in this assessment.Step 4: Configure inter-VLAN routing on Site 2.Configure routerSite 2to route betweenVLANs using information in the Addressing Table and VLAN Switch Port Assignment Table. The VLANs will be configured on the switches later in this assessment. Donotroute the VLAN 99 network.Step 5: Configure Default Routing.OnHQ, configurea default route to the Internet.Use the exit interface argument.Step 6: Configure OSPF Routing.a. On all routers: Configure multiarea OSPFv2 to route between all internal networks. Use a process ID of1. Use the area numbers shown in the topology. Use the correct wild card masks for all network statements. You arenotrequired to route theSVI-NETVLANnetwork onSite 2. Prevent routing updates from being sent to the LANs.b. On theHQrouter: Configure multiarea OSPFv2 to distribute the default route to the other routers.Step 7: Customize Multiarea OSPFv2.Customize multiarea OSPFv2 by performing the following configuration tasks:a. Set the bandwidth ofallserial interfaces to128 kb/s.b. Configure OSPF router IDs as follows: Site 1:1.1.1.1 HQ:2.2.2.2 Site 2:3.3.3.3 The configured router IDsshould be in effecton all three routes.c. Configure the OSPF cost of the link betweenSite 1andHQto7500.Step 8: Configure OSPF MD5 Authentication on the Required Interfaces.Configure OSPF to authenticate routing updates with MD5 authentication on the OSPF interfaces. Use a key value of1. Usexyz_OSPFas the password. Apply MD5 authentication to the required interfaces.Step 9: Configure Access Control Lists.You will configure two access control lists in this step. You should use theanyandhostkeywords in the ACL statements as required. The ACL specifications are as follows:a. Restrict access to the vty lines onHQwith an ACL: Create anamed standard ACLusing the nameTELNET-BLOCK. Be sure that you enter this name exactly as it appears in this instruction. Allow onlyAdmin Hostto access the vty lines ofHQ. No other Internet hosts (including hosts not visible in the topology) should be able to accessthe vty lines ofHQ. Your solution should consist ofoneACL statement. Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and device processing resources.b. Block ping requests from the Internet with an ACL: Use access list number101. Allow onlyAdmin Hostto ping addresses within the Company A network. Only echo messages should be permitted. Prevent all other Internet hosts (not only the Internet hosts visible in the topology) from pingingaddresses inside theCompany Anetwork. Block echo messages only. All other traffic should be allowed. Your ACL should consist ofthreestatements. Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and device processing resources.c. Control access to the management interfaces (SVI) of the threeswitches attached toSite 2as follows: Create a standard ACL. Use the number1for the list. Permit only addresses from theadminVLANnetwork to access anyaddress on theSVI-NETVLANnetwork. Hosts on theadminVLANnetwork should be able to reach all other destinations. Your list should consist ofonestatement. Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and device processing resources. You will be able to test this ACL at the end of Part II of this assessment.Part II: Switching and DHCP ConfigurationStep 1: Create and name VLANs.Onall three switchesthat are attached to Site 2, create and name the VLANs shown in the VLAN Table. The VLAN names that you configure must match the values in the table exactly. Each switch should be configured with all of the VLANs shown in the table.Step 2: Assign switch ports to VLANs.Using the VLAN table, assignswitch ports to the VLANs you created in Step 1, as follows: All switch ports that you assign to VLANsn should be configured tostatic access mode. All switch ports that you assign to VLANsshould be activated. Note that all of the unused ports onSW-Ashould be assigned to VLAN 99. This configuration step on switches SW-B and SW-C isnotrequired in this assessmentfor the sake of time. Secure the unused switch ports onSW-Aby shutting them down.Step 3: Configure the SVIs.Refer to the Addressing Table. Create and address the SVIs on all threeof the switches that are attached to Site 2. Configure the switches so that they can communicate with hosts on other networks. Full connectivity will be established after routing between VLANs has been configured later in this assessment.Step 4: Configure Trunking and EtherChannel.a. Use the information in the Port-Channel Groups table to configure EtherChannel as follows: Use LACP. The switch ports onbothsides ofChannels 1 and 2 should initiate negotiations forchannel establishment. The switch ports on theSW-Bside ofChannel 3 should initiate negotiations with the switch ports on SW-C. The switch ports on theSW-Cside of Channel 3 shouldnotinitiate negotiations with the switch ports on the other side of the channel. All channels should be ready to forward data after they have been configured.b. Configure all port-channel interfaces as trunks.c. Configure static trunking on the switch port onSW-Bthat is connected toSite 2.Step 5: Configure Rapid PVST+.

Configure Rapid PVST+as follows:a. Activate Rapid PVST+ and set root priorities. All three switches should be configured to run Rapid PVST+. SW-Ashould be configured as root primary forVLAN 2andVLAN 4using the default primary priority values. SW-Ashould be configured asrootsecondary forVLAN 8andVLAN 15using the default secondary priority values. SW-Cshouldbe configured as root primaryforVLAN 8andVLAN 15using the default primary priority values. SW-Cshould beconfigured as root secondaryforVLAN 2andVLAN 4using the default secondary priority values.b. Activate PortFast and BPDU Guard ontheactiveSW-Cswitch accessports. OnSW-C, configure PortFast on the access ports that are connected to hosts. OnSW-C,activate BPDU Guard on the access ports that are connected to hosts.Step 6: Configure switch security.

You are required to complete the following onlyon some of the devices in the networkfor this assessment.In reality, security should be configured on all devices in the network.a. Configure port security on all active access ports that have hosts connected onSW-A. Each active accessport should accept only two MAC addresses before a security action occurs. The learned MAC addresses should be recorded in the running configuration. If a security violation occurs, the switch ports should provide notification that a violation has occurred butnotplace the interface in anerr-disabledstate.b. OnSW-B, configure the virtual terminal lines to acceptonlySSH connections. Use a domain name ofccnaPTSA.com. UseSW-Bas the host name. Use a modulus value of1024. Configure SSHversion2. Configure the vty lines to only accept SSH connections. Configure user-based authentication for the SSH connections with a user name ofnetadminand asecretpassword ofSSH_secret9. The username and password must match the values provided here exactly.c. Ensure that all unused switch ports onSW-Ahave been secured as follows: They should be assigned to VLAN 99. They should all be in access mode. They should be shutdown.Step 7: Configure Site 2 as a DHCP server for the hosts attached to the SW-A and SW-C switches.Configure three DHCP pools as follows: Refer to the information in the Addressing Table. Create a DHCP pool for hosts onVLAN 2using the pool namevlan2pool. Create a DHCP pool for hosts onVLAN 4using the pool namevlan4pool. Create a DHCP pool for hosts onVLAN 8using the pool namevlan8pool. All VLAN pool namesmustmatch the provided values exactly. Exclude thefirst fiveaddresses from each pool. Configure a DNS server address of192.168.200.225. All hosts should be able to communication with hosts on other networks.Step 8: Configure host addressing.

Hosts should be able to ping each other andexternal hosts after they have been correctly addressed, where permitted. Hosts on VLANs 2, 4, and 8 should be configured to receive addresses dynamically over DHCP. Hosts on VLAN 15 should be addressed statically as indicated in theAddressing Table. Once configured,the hosts should be able to ping hosts on other networks. Hosts on the LANs attached toSite 1should be statically assigned addresses that enable them to communicate with hosts on other networks, as indicated in the Addressing Table.Configuration#####SITE 1hostname Eastno ip domain-lookupenable secret ciscoline console 0logging synchronouspassword ciscologinline aux 0password ciscologinline vty 0 15password ciscologinservice password-encryptionbanner motd @Authorized acces only!@interface serial 0/0/0bandwidth 128clock rate 12800ip address 192.168.100.22 255.255.255.252description 2-Centralip ospf cost 7500ip ospf message-digest-key 1 md5 xyz_OSPFip ospf authentication message-digestno shutdownexitinterface gi 0/0ip address 192.168.8.1 255.255.255.0description Manage-1Ano shutdowninterface gi 0/1ip address 192.168.9.1 255.255.255.0description Clerk-1Cno shutdownexit OSPFrouter ospf 1router-id 1.1.1.1area 0 authentication message-digestnetwork 192.168.100.20 0.0.0.3 area 0network 192.168.8.0 0.0.0.255 area 1network 192.168.9.0 0.0.0.255 area 1passive-interface GigabitEthernet0/0passive-interface GigabitEthernet0/1no auto-summaryexit############################HQhostname Centralno ip domain-lookupenable secret ciscoline console 0logging synchronouspassword ciscologinline aux 0password ciscologinline vty 0 15password ciscologinservice password-encryptionbanner motd @Authorized acces only @ip route 0.0.0.0 0.0.0.0 s0/1/0interface serial 0/0/0bandwidth 128ip address 192.168.100.21 255.255.255.252description 2-Eastip ospf cost 7500ip ospf message-digest-key 1 md5 xyz_OSPFip ospf authentication message-digestno shutdownexitinterface serial 0/0/1bandwidth 128ip address 192.168.100.37 255.255.255.252description 2-Westclock rate 128000ip ospf message-digest-key 1 md5 xyz_OSPFip ospf authentication message-digestno shutdownexitinterface serial 0/1/0bandwidth 128ip address 203.0.113.18 255.255.255.248description 2-INTERNETno shutdownexit OSPFrouter ospf 1router-id 2.2.2.2area 0 authentication message-digestdefault-information originatenetwork 192.168.100.20 0.0.0.3 area 0network 192.168.100.36 0.0.0.3 area 0passive-interface Serial0/1/0no auto-summaryexitACCESS LISTip access-list standard TELNET-BLOCKpermit host 198.51.100.5line vty 0 15access-class TELNET-BLOCK ininterface serial 0/1/0ip access-group 101 inexit############################# SITE 2hostname Westno ip domain-lookupenable secret ciscoline console 0logging synchronouspassword ciscologinline vty 0 15password ciscologinservice password-encryptionbanner motd @Authorized acces only.@interface serial 0/0/1bandwidth 128ip address 192.168.100.38 255.255.255.252description 2-Centralip ospf message-digest-key 1 md5 xyz_OSPFip ospf authentication message-digestno shutdowninterface gi 0/1no shutdowninterface gi 0/1.2encapsulation dot1q 2ip address 10.10.2.1 255.255.255.0interface gi 0/1.4encapsulation dot1q 4ip address 10.10.4.1 255.255.255.0interface gi 0/1.8encapsulation dot1q 8ip address 10.10.8.1 255.255.255.0interface gi 0/1.15encapsulation dot1q 15ip address 10.10.15.1 255.255.255.0interface gi 0/1.25encapsulation dot1q 25ip address 10.10.25.1 255.255.255.0exit OSPFrouter ospf 1router-id 3.3.3.3passive-interface GigabitEthernet0/1network 192.168.100.36 0.0.0.3 area 0network 10.10.2.0 0.0.0.255 area 2network 10.10.4.0 0.0.0.255 area 2network 10.10.8.0 0.0.0.255 area 2network 10.10.15.0 0.0.0.255 area 2no auto-summarypassive-interface g0/1.2passive-interface g0/1.4passive-interface g0/1.8passive-interface g0/1.15exit ROUTE SUMMARIZATIONinterface serial 0/0/1ip summary-address eigrp 100 10.10.0.0 255.255.240.0 DHCPip dhcp excluded-address 10.10.2.1 10.10.2.5ip dhcp excluded-address 10.10.4.1 10.10.4.5ip dhcp excluded-address 10.10.8.1 10.10.8.5ip dhcp pool vlan2poolnetwork 10.10.2.0 255.255.255.0default-router 10.10.2.1dns-server 192.168.200.225ip dhcp pool vlan4poolnetwork 10.10.4.0 255.255.255.0default-router 10.10.4.1dns-server 192.168.200.225ip dhcp pool vlan8poolnetwork 10.10.8.0 255.255.255.0default-router 10.10.8.1dns-server 192.168.200.225exitACCESS LISTaccess-list 1 permit 10.10.15.0 0.0.0.255interface gi0/1.25ip access-group 1 out#######SW-Ahostname Bldg1no ip domain-lookupenable secret ciscoline console 0logging synchronouspassword ciscologinline vty 0 15password ciscologinservice password-encryptionbanner motd @Authorized acces only!@ip default-gateway 10.10.25.1vlan 2name salesvlan 4name prodvlan 8name acctvlan 15name adminvlan 25name SVI-NETvlan 99name nullinterface vlan 25ip address 10.10.25.254 255.255.255.0no shutdowninterface fa0/5switchport mode accesswitchport acces vlan 2interface fa0/10switchport mode accesswitchport acces vlan 4interface fa0/15switchport mode accesswitchport acces vlan 8interface fa0/24switchport mode accesswitchport acces vlan 15interface range fa0/6-9,fa0/11-14,fa0/16-23switchport mode accesswitchport acces vlan 99shutdowninterface range gi1/1-2switchport mode accesswitchport acces vlan 99shutdown ETHERCHANNELinterface range fa0/1-2channel-group 1 mode activeinterface port-channel 1switchport mode trunkinterface range fa0/3-4channel-group 2 mode activeinterface port-channel 2switchport mode trunkexitPVST+spanning-tree mode rapid-pvstspanning-tree vlan 2 root primaryspanning-tree vlan 4 root primaryspanning-tree vlan 8 root secondaryspanning-tree vlan 15 root secondarySECURITYinterface fa0/5switchport port-securityswitchport port-security violation restrictswitchport port-security maximum 2switchport port-security mac-address stickyinterface fa0/10switchport port-securityswitchport port-security violation restrictswitchport port-security maximum 2switchport port-security mac-address stickyinterface fa0/15switchport port-securityswitchport port-security violation restrictswitchport port-security maximum 2switchport port-security mac-address stickyinterface fa0/24switchport port-securityswitchport port-security violation restrictswitchport port-security maximum 2switchport port-security mac-address sticky#######SW-Bhostname Bldg2no ip domain-lookupenable secret ciscoline console 0logging synchronouspassword ciscologinline vty 0 15password ciscologinservice password-encryptionbanner motd @Authorized acces only!@ SSHip ssh version 2ip domain-name ccnaPTSA.comcrypto key generate rsausername netadmin password SSH_secret9line vty 0 4login localtransport input sshline vty 5 15login localtransport input sship default-gateway 10.10.25.1vlan 2name salesvlan 4name prodvlan 8name acctvlan 15name adminvlan 25name SVI-NETvlan 99name nullinterface vlan 25ip address 10.10.25.253 255.255.255.0no shutdowninterface gi 1/1switchport mode trunk ETHERCHANNELinterface range fa0/3-4channel-group 2 mode activeinterface port-channel 2switchport mode trunkinterface range fa0/5-6channel-group 3 mode activeinterface port-channel 3switchport mode trunkPVST+spanning-tree mode rapid-pvst######### SW-Chostname Bldg3no ip domain-lookupenable secret ciscoline console 0logging synchronouspassword ciscologinline vty 0 15password ciscologinservice password-encryptionbanner motd @Authorized acces only !@ip default-gateway 10.10.25.1vlan 2name salesvlan 4name prodvlan 8name acctvlan 15name adminvlan 25name SVI-NETvlan 99name nullinterface vlan 25ip address 10.10.25.252 255.255.255.0no shutdowninterface fa0/7switchport mode accesswitchport acces vlan 2interface fa0/10switchport mode accesswitchport acces vlan 4interface fa0/15switchport mode accesswitchport acces vlan 8interface fa0/24switchport mode accesswitchport acces vlan 15 ETHERCHANNELinterface range fa0/1-2channel-group 1 mode activeno shutdowninterface port-channel 1switchport mode trunkinterface range fa0/5-6channel-group 3 mode passiveno shutdowninterface port-channel 3switchport mode trunkPVST+spanning-tree mode rapid-pvstspanning-tree vlan 2 root secondaryspanning-tree vlan 4 root secondaryspanning-tree vlan 8 root primaryspanning-tree vlan 15 root primaryPort Fast BPDU Guardinterface range fa0/7, fa0/10, fa0/15, fa0/24spanning-tree portfastspanning-tree bpduguard enableno shutdown

ccna 3 ex_ospf

Documents