每個階段模擬器-na-實驗手冊lab k1k5過人ccie

CCIER&Sv4.0當(dāng)前位置 首頁→CCIE資料庫→CCIER&Sv4.0實驗→CCIELABCCIELABK12層接口FramerelaySecureHTTPPPPCHAPAutoQOSK1實驗圖設(shè)備串口連接拓樸圖注loopback0Y.Y.X.X/32，R1：★BackBone地址分別為：BB1：配置1．在4交換（1）在4臺交換機上同時做如下配置：vtpCCIERoutingandSwitchingvtppasswordciscovtpmode交換機上的VLAN信息如下：VlanVlanVLANVLANSW2-VLANVLANSW2-VLANSW2-VLANR2-VLANVLANSW1-VLANSW2-配置14臺交換機上配置（1）在4臺交換機上同時做如下配置：23nameVLAN_FVLANnameVLAN_G2原題Implementtheaccess-switchportsofswitchedConfigurealloftheappropriatenontrunkingaccessswitchportsonsw1,sw2,sw3,accordingtothefollowingrequirements:ConfiguretheVLANSfortheaccessswitchportsshowasthevlantables,includetheportstoBB1,BB2andBB3.ConfiguretrunkbetweenSW2F0/2andR2MakesurethatthespanningtreeenterstheforwardingstateimmediaOnlyfortheseaccessswitchports,bypassingthelisteningandlearningAvoidtransmittingbridgeprotocoldateunits(BPDUS)ontheseaccessswitchports.IfaBPDUisreceivedonanyoftheseports,theportsshouldtransitionbacktothelistening,learningandforwardstates.Addanyspeciallayer2commandsthatarerequiredontheroutersincludingtrunkconfiguration.中文注釋：中包括連接BB1,BB2和BB3的接口。22VLAN24發(fā)BPDU。配置access接口SW1上將所有相應(yīng)access接口劃入相應(yīng)VLAN：intf0/3switchportmodeaccessswitchportaccessvlan3intswitchportmodeaccessswitchportaccessvlan44intswitchportmodeaccessswitchportaccessvlan15intswitchportmodeaccessswitchportaccessvlan15SW2上將所有相應(yīng)access接口劃入相應(yīng)VLAN：intf0/1switchportmodeaccessswitchportaccessvlan11intswitchportmodeaccessswitchportaccessvlan13intswitchportmodeaccessswitchportaccessvlan24intswitchportmodeaccessswitchportaccessvlan45intswitchportmodeaccessswitchportaccessvlan2SW3上將所有相應(yīng)access接口劃入相應(yīng)VLAN：intf0/10switchportmodeaccessswitchportaccessvlan3SW2的F0/2R2G0/1間創(chuàng)建單臂路由interfacef0/2switchporttrunkencapsulationdot1qswitchportmodetrunkswitchporttrunkallowedvlan22,24R2G0/1上創(chuàng)建子接口intf0/1.22encapsulationdot1Q22ipaddress29intf0/1.24encapsulationdot1Q24ipaddress4配置所有交換機的所有access接口跳過STP，并不轉(zhuǎn)發(fā)（1）在4臺交換機上同時做如下配置：spanning-treeportfastspanning-treeportfastbpdufilterFrame原題ImplementFrameUsethefollowingrequirementstoconfigureR1andR2forframerelayandR4astheframerelayswitch.UseANSILMIonframerelayswitchandauto-sesingonR1andDon’tuseanystaticframerelaymapsorinverseaddressresolutionsUseRFCFrameRelayDLCIR1Frame-relayR2Frame-relay中文注釋：R1R2Frame-relay，避免靜態(tài)映射與動態(tài)學(xué)習(xí)（則使用點到點配置R4Frame-relay交換（1）配置R4Frame-relay交換機frame-relayswitchinginterfaces0/0noipencapsulationframe-relayietfframe-relaylmi-typeansiframe-relayintf-typedceclockrate64000frame-relayroute100interfaces0/1200noshutdowninterfaces0/1noipaddressencapsulationframe-relayietfframe-relaylmi-typeansiframe-relayintf-typedceclockrate64000frame-relayroute200interfaces0/0100noshutdownR1，R2frame-relay接口配置R1frame-relay接口interfaceencapsulationframe-relayietfframe-relaylmi-typeansinoframe-relayinverse-arpnoarpframe-relaynoipaddressnoshutdowninterfaces0/0.12point-to-ipaddress42frame-relayinterface-dlci配置R2frame-relay接口interfaceencapsulationframe-relayietfframe-relaylmi-typeansinoframe-relayinverse-arpnoarpframe-relaynoipaddressnoshutdowninterfaces0/0.12point-to-ipaddress41frame-relayinterface-dlciStorm原題TrafficcontrolprotectionfromtheConfiguretrafficcontrolonthethreebackbonelinks,protectingyournetworkfromabroadcaststorm.Thisprotectionshouldbeginoncebroadcasttrafficishalf(50%)availablebandwidth,theportshouldremainfunctioningduringthistime.中文注釋：過50%，即使超過后，不能影響其它。配置1．在SW1，SW2，SW3上配置storm-（1）在SW1，SW2，SW3的F0/10上同時做如下配置：interfacestorm-controlmulticastlevel原題TrunkingConfigurethetrunkportsbetweenSW1,SW2,SW3andSW4accordingtothefollowingrequirements:DisableDTPonthesixdistributionportsforeachSetthelistofallowedvlansthatcanreceiveandsendtrafficontheseinterfacesintaggedformatinparticular,onlyallowVLAN中文注釋：45Trunk配置1．在4交換（1）在4臺交換機上同時做如下配置：intrangef0/19-switchporttrunkencapsulationdot1qswitchportmodetrunkswitchportswitchporttrunkallowedvlan須知Afterfinishingeachofthefollowingquestions,makesurethatallroutersandswitches.Don’tredistributebetweenandinteriorgatewayprotocol(IGP)andboardgatewayprotocol(BGP).Youneedtoabgprouteonlyifitisstatedinaquestion,otherwisetherouteshouldbeonlyinthebgptable.Attheendofsection2,allsubnetsinyourtopology,includingtheloopbackinterfaceexpectedforSW3,mustbereachablevia.Thereforeredistributeasyouwishunlessdirectlystatedinaquestion.Thebackboneinterfacemustbereachableonlyiftheyarepartofthesolutiontoaquestion.Theloopbackinterfacecanbeseenaseither/24or/32intheroutingtableunlessstatedotherwiseinaquestion.TheloopbackinterfacescanbeaddedintoyourIGPeitherviaredistributionoraddedtoaroutingprocessofyourchoice.須知注解：不能在IGP和BGP之間重分布，BGP的路由不需要通，除非題目明確說明要通，路由只需要BGP看見即可。原題ImplementIPv4ConfigureopenshortestpathUpdatesshouldbeadvertisedonlyoutoftheinterfacethatareindicatedintheIGPtopologydiagram.Don’tmanuallychangetheRouter-Don’tcreateadditionalospfConfigreospfarea2suchthattherearenoTYPE-5Advertisments(LSA)inthearea,R1shouldgenerateadefaultroute.ConfigureOSPFoverframerelaybetweenR1andR2choosinganetworktypethatrequiresdesignaterouter(DR)andbackupdesignaterouter(BDR)negotiationsandhasthefatestrecovertimes.中文注釋：啟Fastos功能。配置在各路由器上配置routerospfnetworkareanetwork6areanetwork4arearouterospfnetworkareanetwork4areanetwork2arearouterospfnetworkareanetwork9areaIproutingrouterospf2networkareanetwork6areanetwork9areaIproutingrouterospf2networkareanetwork30areaArea2（1）Area2NSSA，并發(fā)布默認(rèn)路由：routerospfarea2area2nssadefault-information-routerospfarea2routerospfarea2改變接口類型（1）改變R1R2interfaceipospfnetworkiposdead-intervalminimalo-multiplierinterfaceipospfnetworkiposdead-interval o-multiplier原題ImplementIPv4ConfigureEIGRP100andEIGRPYYpertheIGPtopologyEIGRPupdatesshouldbeadvertiseonlyouttotheinterfacepertheIGPtopolotydiagram.OnR1,redistributebetweenospfandEIGRPYY.Howeveralloftheroutesthatareindicatedbelowfrombackbone3(EIGRP100)shouldnotberedistributedbetweenbothprotocols.Useroutemapstoplishthisrequirement.Allroute-mapsshouldutilizethesameaccesslists.OnR3,redistributefromEIGRP100intoOnR3,RedistributefromEIGRP100intoEIGRPYY.Howeverthree/24,/24,/24shouldbeaggregatedintoasingleaddresswiththemostspecificmaskpossible.中文注釋：含在其中，使用route-map調(diào)用相同access-list做過濾。在R3EIGRP100重分布到OSPF（如果沒有明確說要往EIGRP100重分布，要往EIGRP100重分布，請不要做）配置按配置EIGRP100和EIGRP（1）按配置EIGRP100和EIGRPYY：R1：routereigrp2noauto-network49routereigrp2noauto-summarynetwork45routereigrp100noauto-summarynetworkroutereigrp2noauto-summarynetworknetwork46network50network7routereigrp2noauto-summarynetwork0network8R1配置OSPFEIGRPYY雙向重分布匹配EIGRP100和OSPF默認(rèn)路由：ipprefix-listEIGRP100permitipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/30ipprefix-listEIGRP100permit/24access-list1permit配置OSPFEIGRPYYEIGRPYYOSPFroute-OSPFEIGRProute-mapO2Edenymatchipaddressprefix-listEIGRP100route-mapO2Edeny20matchipaddress1route-mapE2Opermit30EIGRPYYroute-mapE2Odenymatchipaddressprefix-listroute-mapE2Opermit20配置OSPFEIGRPYY的雙向重分布EIGRPYYrouterospfredistributeeigrp2subnetsroute-mapE2OOSPFEIGRProutereigrpredistributeospf2metric1000010025511500route-mapO2ER3EIGRP100重分布到routerospf2redistributeeigrp100subnetsR3EIGRP100重分布到EIGRProutereigrp2redistributeeigrp100metric1000010025511500Intipsummary-addresseigrp2RIP原題ImplementRIPVersionConfigureRIPversion2(RIPv2)pertheIGPtopologyRIPupdatesshouldbeadvertiseonlyouttheinterfacepertheIGPtopologyAllripupdatesshouldbeAllripupdatesmustbeabletoreceiveandprocessRIPV1ManuallyredistributebetweenRIPandospfonR2andSW4,R4learnedroutesshouldbepreferredEIGRP.中文注配置（1）按照配置RIPv2：routerripversion2noauto-summarynetworkpassive-interfaceneighbor3routerripversion2noauto-summarynetworkpassive-interfacedefaultneighbor4neighbor6routerripversion2noauto-summarynetworkpassive-interfacedefaultneighbor5RIP接口接收數(shù)據(jù)包配置RIP接口接收數(shù)據(jù)包：Intiprip12Intiprip12intiprip12Intvlaniprip12RIP與OSPFEIGRPYY的雙向重分布：（此步為重點在R2上配置OSPF重分布進(jìn)RIP時，過濾掉默認(rèn)路由，并且metric值要大：access-list2permitroute-mapO2Rdeny10matchipaddress2route-mapO2Rpermit20routerredistributeospf2metric5route-mapO2RR2對RIP自己的路由，從OSPF過來時，要加大AD值,保證走自己內(nèi)部：access-list22permitaccess-list22permitrouterospfredistributeripsubnetsmetric-type2metric30distance12122R2將自己的直連接口發(fā)給RIP的路由，要加大Access-Access-Access-routeroffset-list10out5(4)在SW4上將RIP重分布進(jìn)EIGRPYY時的metricR1重分布OSPFEIGRPmetricroutereigrpredistributeripmetric10000010025511500route-mapR2E在routerredistributeeigrp2metric2大AD：access-4denyaccess-4denyaccess-router4perdistance175原題ImplementInternetprotocolversion6(IPv6)toconfigureIPv6uniquelocalunicastaddressusingtheEUI-64interfaceidentifier.R4-G0/1andR2-G0/1.Z(VLAN24) FC01:DB8:74:9::/64euiR2-S0/0.ZandR1-S0/0.Z FC01:DB8:74:A::/64euiR1-G0/1andSW1-SVI FC01:DB8:74:B::/64ConfigureOSPFv3pertheIPv6topology.EnsurethatR4canSW1usingIPv6.中文注釋：OSPFv3R2-S0/0.ZSW1area1area0配置在相應(yīng)接口上配置IPv6地址(1)在R4的相應(yīng)接口上配置IPv6地址：ipv6unicast-routingintf0/1ipv6addressFC01:DB8:74:9::/64eui-在R2的相應(yīng)接口上配置IPv6地址：ipv6unicast-routingintf0/1.24ipv6addressFC01:DB8:74:9::/64eui-64intipv6addressFC01:DB8:74:A::/64eui-在R1的相應(yīng)接口上配置IPv6地址：ipv6unicast-routingints0/0.12ipv6addressFC01:DB8:74:A::/64eui-64intipv6addressFC01:DB8:74:B::/64eui-64在SW1的相應(yīng)接口上配置IPv6地址：sdmpreferdual-ipv4-and-ipv6defaultintvlanipv6addressFC01:DB8:74:B::/64eui-ipv6routerospf2intipv6ospf2areaipv6routerospf2intipv6ospf2area0intipv6ospf2areaipv6routerospf2router-idintipv6ospf2area1intipv6ospf2areaipv6routerospf2router-idintvlanipv6ospf2area原題ImplementIPv4ReferringtheBGProutingdiagram.configureBGPwiththeseConfiguretwobgpconfederationsR1,R3,R5andSW4(ASYY1)andR2andSW2(ASYY2).TheconfederationpeersshouldneighborbetweenR1andR2andbetweenSW4andR2.EBGP:SW2EBGPpeerswiththerouter150.2.Y.254onbackbone2inAS254.ThisEBGP:R5EBGPpeerswiththerouter150.1.Y.254onbackbone1inAS254.Thisrouteradvertisefiverouteswithformat197.68.Z.0/24andtheAS_PATHThebgpdevicesshouldallpreferthepaththroughR5(150.1.Y.254)fornetwork/24and/24,Theinternalboardgatewayprotocol(IBGP)devicesshouldallpreferthepaththroughSW2(150.2.Y.254)fornetwork/24,/24and/24,thismanipulationshouldbe refertoasingleaccess-list.Configureonlytheloopback0ipaddresstopropagateBGProuteinformation.BGProutesshouldbeadvertisedtoAS254.中文注釋：配置兩個BGPconfederations()，使用loopback0更新；R1，R3，R5和SW4在ASYY1；R2和SW2在ASYY2。之間R1與R2，SW2與R2建立鄰居關(guān)系，SW2SW4loopback0BGP。（ASYY1R5）R5和BB1建立EBGP197.68.Z.0/24andtheAS_PATH254，配置（1）R1，R2，R3R5，SW2和SW4上配置BGP：R1：routerbgp21noauto-nosynchronizationbgprouter-idbgpconfederationidentifier2bgpconfederationpeers22remote-asupdate-source0remote-asupdate-source0routerbgp22nosynchronizationbgprouter-idbgpconfederationidentifier2Rbgpconfederationpeers21neighborremote-as21neighborupdate-sourceloopbackneighborebgp-neighbor0remote-asneighbor0update-sourceloopbackneighbor0ebgp-neighborremote-asneighborupdate-sourceloopbackrouterbgp21nosynchronizationbgprouter-idbgpconfederationidentifier2neighborremote-as21neighborupdate-sourceloopbackrouterbgp21nosynchronizationbgprouter-idbgpconfederationidentifier2neighborASYY1peer-groupneighborASYY1remote-as21neighborASYY1update-sourceloopback0neighborASYY1route-reflector-clientneighborASYY1next-hop-selfneighborpeer-groupASYY1neighborpeer-groupASYY1neighbor0peer-groupASYY1routerbgp22nosynchronizationbgprouter-idbgpconfederationidentifier2neighborremote-as22neighborupdate-sourceloopbackneighbornext-hop-networkmask55routerbgp21nobgprouter-idbgpconfederationidentifier2bgpconfederationpeers22remote-asupdate-source0ebgp-remote-asupdate-source0network0maskR2R5RouterbgpNei54remote-asRouterbgpNei54remote-asSW上控制路由選擇（1）在SW2上將/24和/24附加兩個access-list21permit55route-mapASpermit10matchipaddresssetas-pathprepend2122route-mapASpermit20routerbgpneighbor54route-mapASin原題ImplementPIMsparsemodeforIPv6ontheWANlinkbetweenR2andR1,UsingtheseCriteria:ConfigureR4-F0/1tobetheredezvouspoint(RP)fortheFF08::4000:4000multicastgroupnoothergroupsshouldbepermited.中文注釋：Framerelay配置R4，R2，R1配置IPv6（1）在R4，R2，R1上同時做如下配置：ipv6multicast-R4的接口F0/1FF08::4000:4000的（1）在R4，R2，R1上同時做如下配置：ipv6access-listpermitipv6hostFF08::4000:4000anyipv6pimrp-addressR4-F0/1原題MulticastConfigureR2S0/0.ZasanIPv6receiverforthemulticastgroupR2shouldbeabletothemulticastgroup中文注釋：配置1R2入組interfaceipv6mldjoin-groupSecure原題SecureHTTPEnablesecureHTTPaccessforR5.Enableauthenticationusingthelist“HTTP”whichutilizeslocaluserauthentication.ConfiguretwodifferentusersforaccesstoR5;theusercisco(password“cisco”),whoonyhasprivilege1accesstoR5;andtheuserADMIN(password“CISCO”)whohasprivilege15accessto中文注釋：list名為“HTTP”，調(diào)用本地用戶數(shù)據(jù)庫作認(rèn)證。用戶名：ADMIN，：CISCO，權(quán)限為15級。配置R5上配置AAA證方式（1）R5配置AAAaaanew-aaaauthenticationlogindefaultlineaaaauthenticationloginHTTPlocal-caseaaaauthorizationexecHTTPlocalnoiphttpiphttpsecure-iphttpauthenticationaaalogin-authenticationHTTPiphttpauthenticationaaaexec-authorizationHTTPR5上配置本地用戶數(shù)據(jù)（1）在R5上配置本地用戶數(shù)據(jù)庫：usernameciscoprivilege1passwordciscousernameADMINprivilege15passwordCISCOPPPCHAP認(rèn)證原題SecuretheWANPPPConfigurechallengehandshakeauthenticationprotocol(CHAP)onR5forthelinktoR1andR3,accordingtothefollowingrequirements:Anauthentication,authorization,andaccording(AAA)listnamedR1andR3forR1andR3respectively.AuthenticationforR1shouldfirsttrytheradiusserver28usingakeyofciscoandfallbacktolocalloginintheeventofafailuretoconnecttotheradiusserver.R1shouldpresentitselftoR5RACKYYR1withasharedpasswordAuthenticationforR3shouldfirsttrytheTACASserver29usingakeyofciscoandfallbacktolocalloginintheeventofafailuretoconnecttotheTACASserver.R3shouldpresentitselftoR5asBACKUPwithasharepasswordof中文注釋：R1list為“R1”，R3list“R3”。認(rèn)證R1時使用radiusserver28，cisco,失敗后使用本地用戶數(shù)據(jù)庫認(rèn)證；認(rèn)證R3時使用TACASserver29，cisco,失敗后使用配置（1）在R5上配置AAA認(rèn)證方式，并開啟CHAP認(rèn)證：aaanew-aaaauthenticationpppR1groupradiuslocal-aaaauthenticationpppR3grouptacacs+local-caseusernameRACKYYR1passwordciscousernameBACKUPpasswordintpppauthenticationchapR1intpppauthenticationchapR3R5配置AAAradius-serverhost18keyciscotacacs-serverhost29keyR1R3在R1上配置CHAP用戶名和R1config)#intR1(config-if)#pppchaphostnameRACKYYR1R1(config-if)#pppchappasswordcisco在R2上配置CHAP用戶名和intpppchaphostnameBACKUPpppchappasswordCISCO原題OnR2,Configureparentclass-defaultcommitedinformationrate(CIR)as64kb,whennoBackwardexplicitcongestionnotification( s)arepresentand32kbwhen sarepresent.Differenatiatebetweenvoicepacketswhichshouldreceiveaguranteedbandwidthof40percentanddatawhichshouldreceiveaguarantedbandwidthof35percent.Voicepackesaremarkedasexpeditedchildclass-default.中文注釋： 配置R2上配置class-map匹配相應(yīng)流量匹配voice量class-mapVOICEmatchdscpefclass-mapDATA1matchdscpaf11class-mapmatchdscpaf21class-mapmatch-anyDATAmatchclass-mapDATA1matchclass-mapDATA2（1）為語音和數(shù)據(jù)分配帶寬policy-mapSHAPEclassVOICEprioritypercent40classDATAbandwidthpercent35Class-Basepolicy-mapCBWFQclassclass-defaultshapeaverageshapeadaptive32000service-policySHAPEmap-classframe-relayFRTSservice-policyoutputCBWFQints0/0frame-relaytraffic-shaintframe-relayinterface-dlci200classCBWFQAuto原題AutoQOSoverTo4.3continuetoaddressvoipqualityofservice(QOS)byconfiguringciscoAutoQOSoverPPPlinkbetweenR1andR5.中文注釋：配置Ints0/0autodiscoveryqosautoqosvoipIntautodiscoveryqosautoqosvoip原題FirstHopTofacilitateloadbalancingandbackupforhostsofVLAN_H,configureGLBPonVLAN_H,Useanygroupnumber.R4shouldhavethehigherprioritywiththeabilityforR2toassumecontrolifthepriorityofR4decreases.UseMD5authenticationtoprotecttheGLBPgroup.Usethekey-string“cisco”.ConfiguretheIPY.Y.15.35asyourGLBPvirtual中文注釋：配置1．在R2R4配置Intf0/1.24glbp1ipy.y.15.35glbp1preemptglbp1authenticationmd5key-stringIntf0/1glbp1ipy.y.15.35glbp1priorityglbp1glbp1authenticationmd5key-string原PoliedandBroadcastR2shouldactasanNTPservertoR4shouldprovidebroadcastNTPupdatesonlytoVLANThehardwareclocksonR2,R3andR4shouldbeupdatedbythesofewareclock.R4shoulduseloopback0asthesourceaddress.Absentanexternaltimeserver,R4shoulduseitsownsystemclocktosynchronizeR2andR3.SettheclockonR4as8:00am(08:00),January1,2000.Ultimay,theclocksonR2,R3andR4shouldbeinsynchronized.中文注釋：配置R4的時間為8:00am(08:00),January1,2000.（了配時區(qū)），最后R2，R3要從R4同步自己的時間。配置R4NTPntpmaster2ntpsourceIntntpbroadcastclocktimezoneGMT08clockset8:00:00jan1R2ntpmaster3Intntpbroadcastntpserver配置硬件時鐘從軟件時鐘更新（1）在R2，R3，R4上同時做如下配置：ntpupdata-原題DHCPConfigureR1asDHCPserverwiththefollowingHostsofVLANA,B,CandHshouldbeabletoassignedaddressfromR1usingAddressofthesubnetsforVLANA,B,CandHshouldbeavailabletoR1forAllotherY.Y.15.ZsubnetrangesshouldnotbeavailabletoR1foruse.Usetheloopback0addressofR1forallconnections.Configurethenameas EachaddressleaseshouldbevalidforonlyoneEachDHCPclientshouldbeprovidedadefaultrouteraddressofalocallyconnectedrouter.中文注釋：址，租約為1天，網(wǎng)關(guān)為主機所在本地路由器地址。VLANA,B,CHR1Y.Y.15.ZDHCP分配的name為,DNSserver為Y.Y.15.163,NETBIOSserver為Y.Y.15.18，這些信息只能配置一次。AC配置R1ipdhcppoolnetwork60default-routerleaseipdhcppoolnetwork92default-routerleaseipdhcp