路由交换复习用途ccie rs v4.0版本k

1、1.0 Pre-configuration troubleshootingThere are some pre-configuration errors, find and correct them.Explanations:有一些预配置错误，找出并更正Solutions:SW1:en conf tno vlan filter CCIE vlan-list 1-4094er f0/10no spanning-tree guard root endSW2:en conf ter f0/10no spanning-tree guard root endSW3:en conf ter f0/10no

2、 spanning-tree guard root endR4:en conf ter f0/0ip add YY.YY.44.4 255.255.255.0no shut end1.3 Spanning-Trees for Switched NetworkConfigure the switches according to the following requirements:Each of the VLANs musve a separate spanning-tree instanceEnsuret SW1 is the Root Switch, and the Backup for

3、all even VLANsEnsuret SW2 is the Root Switch, and Backup for all odd VLANsConfigure instance per VLAN and ratransition for forwardingt all switches wait before their spanning-tree proConfigure to 30 secondst timeses attemptsto re-converge if it didnt receive any spanning-tree configuration message f

4、or all future VLANsExplanations:(1)(2)(3)(4)(5)每个VLAN 使用单独的 STP 实例确保 SW1 作为所有奇数 VLAN 的根桥，所有偶数 VLAN 的备份根桥确保 SW2 作为所有偶数 VLAN 的根桥，所有奇数 VLAN 的备份根桥使用一种可以让交换机端口快速进入转发状态的 STP 模式如果将来增加了新的 VLAN，配置所有交换机，以便在没有收到任何 BPDU 的时候可以在 30 秒的时间里重新收敛Solutions:SW1:en conf tspanning-tree mode ra-pvstspanning-tree vlan 22, 4

5、2, 44 root secondaryspanning-tree vlan 1, 11, 33, 55, 123, 999 primaryspanning-tree vlan 1-4094 max-age 30 endSW2:en conf tspanning-tree mode ra-pvstspanning-tree vlan 22, 42, 44 root primaryspanning-tree vlan 1, 11, 33, 55, 123, 999 root secondaryspanning-tree vlan 1-4094 max-age 30 endSW3:en conf

6、tspanning-tree vlan 1-4094 max-age 30spanning-tree mode ra end-pvstSW4:en conf tspanning-tree mode ra-pvstspanning-tree vlan 1-4094 max-age 30 endNotes:如 VLAN ID 有遗漏，请参见考场 VLAN ID。SW1/SW2 上最后再敲 spanning-tree vlan 1-4094 max-age30，否则 sh run 出来的结果不太一样1.4 Switch Trunking and Ether ChannelUse the follow

7、ing requirements to configure the EtherChannel of SW1, SW2, SW3 and SW4:Use encapsulation 802.1q Configure EtherChannel betConfigure EtherChannel betn SW1 and SW2, use the Industry standard.n SW3 and SW4, the Proprietary methodEnsuret SW1 and SW3 must initiate the negotiation and SW2 and SW4 must no

8、t start thenegotiationExplanations:(1)(2)(3)(4)(5)SW1/SW2/SW3/SW4 配置 EC要求使用 802.1Q 封装SW1/SW2 之间使用工业标准的链路聚合协议（LACP，802.3ad）SW3/SW4 之间使用私有标准的链路聚合协议（PAgP）确保协商请求由 SW1/SW3 发起，SW2/SW4 不主动发起协商请求Notes:也有可能是 SW1/SW2 之间要求使用私有标准，而 SW3/SW4 之间使用工业标准Solutions:SW1:en conf ter range f0/23-24channel-group 12 mode ac

9、tive er range f0/19-22 , port 12switchport trunk encapsulation dot1q switchport mode trunkendSW2:enconf ter range f0/23-24channel-group 12 mode passive er range f0/19-22 , port 12switchport trunk encapsulation dot1q switchport mode trunkendSW3:en conf ter range f0/23-24channel-group 34 mode desirabl

10、e er range f0/19-22 , port 34switchport trunk encapsulation dot1q switchport mode trunkendSW4:en conf ter range f0/23-24channel-group 34 mode auto er range f0/19-22 , port 34switchport trunk encapsulation dot1q switchport mode trunkend1.5 Spanning-Tree TuningFind the VLAN betn R2 and SW4. The BID of

11、t VLAN must be 12330Ensuret the port Fa0/20 ison SW4.he forwarding se rathern the blocking se for even VLANsYou must do this withohanging any configurations on SW4Use the highest numerical values to completeExplanations:(1)(2)(3)(4)找出R2/SW4 之间的 VLAN，配置该 VLAN 的BID 为 12330确保 SW4 的 Fa0/20 对于偶数 VLAN，处于转

12、发状态，而非堵塞状态不允许修改 SW4 的配置来完成上述需求使用最大的数值来完成上述需求Notes:BID:12330，网桥优先级可以配置的为 4096, 8192, 12288，12330-12288=42，因此，R2/SW4 之间的VLAN ID 为 42Solutions:SW2:en conf tspanning-tree vlan 42 pri 12288er f0/19spanning-tree vlan 22, 42, 44 port-priority 240 end1.6 RSPANAny traffic received (and only receive) from VLA

13、N_BB1 and VLAN_BB2 must be replicated to atrafficyser connected to SW4 Fa0/15 via VLAN 999. Ensure this even if othorts are addedo these VLANsYou need to monitor any futureerfaconnecting to VLAN_BB1 and VLAN_BB2Any traffic flowing through the trunk betyser connected to SW4 Fa0/16n SW3 and SW4 must b

14、e replicated to another trafficThere should not be any configuration regarding this on SW3.Explanations:(1)任何经过VLAN_BB1 和VLAN_BB2 的流量，通过VLAN 999给连接到 SW4 Fa0/15 的流量分析设备，并且确保即使有其他端口增加进这些VLAN（也把它分析设备）需要对将来连接到VLAN_BB1 和 VLAN_BB2 的流量进行给连接到 SW4 Fa0/15 的流量(2)(3)(4)经过 SW3/SW4 trunk 链路的流量，给连接到 SW4 Fa0/16 的流量

15、分析设备SW3 上不允许做相关配置Solutions:SW1:en conf tmonitor ses monitor ses end1 source vlan 11 rx1 destination remote vlan 999SW2:en conf tmonitor ses monitor ses end1 source vlan 22 rx1 destination remote vlan 999SW4:en conf tmonitor ses monitor ses monitor ses monitor ses end1 source remote vlan 9991 destina

16、tionerface f0/152 sourceerface port-channel 34 both2 destinationerface f0/162.3 Implement RIP Ver2Configure RIP Ver2 (RIPv2) betn R3 and BB1R3 must accept from BB1 only the following prefixeso 199.172.4.0/24o 199.172.6.0/24o 199.172.12.0/24o 199.172.14.0/24Use Standard ACL wisingle entryDisable Auto

17、 SummarizationExplanations:(1)(2)(3)(4)R3 和BB1 之间配置 RIPv2只允许 R3 从 BB1 接收 199.172.4.0/24, 199.172.6.0/24, 199.172.12.0/24 以及 199.172.16.0/24只允许使用包含一条语句的标准 ACL 实现该需求禁用自动汇总Solutions:R3:en conf tacs-list 1 permit 199.172.4.0 0.0.10.0router ripver2no auto-summary network 150.1.0.0distribu endist 1 in g0/

18、02.4 Redistribute RIPo OSPFRedistribute RIPo OSPF on R3 sucht the routing table on R5 contains the following.o O N2 199.172.14.0/24o O N2 199.172.12.0/24o O N1 199.172.6.0/24o O N1 199.172.4.0/24o O N2 150.1.YY.0Use Standard ACL wisingle entryExplanations:在 R3 上把 RIP 重分发进OSPF，使得 R5 可以包含以 O N2 开头的几条前

19、缀：150.1.YY.0, 199.172.12.0/24 以及 199.172.16.0/24；以 O N1 开头的几条前缀：199.172.4.0/24 与 199.172.6.0/24只允许使用包含一条语句的标准 ACL 实现该需求Solutions:R3:en conf tacs-list 2 per 199.172.4.0 0.0.2.0route-map n1n2 per 10 match ip add 2set metric-type type-1 route-map n1n2 per 20 exitrouter osp 29redis rip sub route-map n1n

20、2 end2.7 Implement Performance RoutingImplement PfR to achieve the following policies:R1 must be the Master and Border Router and R2 must be a Border RoutersEnsuret PfR sess are established using the Lo0erface onlyA specific traffic (marked with DSCP CS2) from VLAN_44 to VLAN_55 must be routed via R

21、1Another traffic (marked with DSCP CS4) from VLAN_44 to VLAN_55 must be routed via R2Use Extended ACL wiUse active probes onlysingle entryConfigure tunnel to have direct connectivity betIf required by your solution you may use any prefixn Border routerst is not used in your topologyYourerface is all

22、owed to have aum utilization on R1 of 80% and aum utilization onR2 of 90%You should use acs-list specifying only source address and DSCP valueR1 use a floating default sic route wiD of 250 to theerface of switch SW1 f0/1; R2 use afloating default sic route wiD of 250 to theerface of switch SW4 VLAN

23、123You must use set mode select-exit good You may not use:max-range-utilizationresolve utilizationresolve range Use the following:monitor-period 1periodic-erval 0period roion 90Explanations:(1)(2)(3)(4)(5)(6)(7)(8)(9)R1 做 MC/BR，R2 做BR确保所有PfR 的会话都是通过 Lo0 建立来自VLAN 44 去往VLAN 55 标记为 DSCP CS2 的流量必须通过 R1

24、路由来自VLAN 44 去往VLAN 55 标记为 DSCP CS4 的流量必须通过 R2 路由只允许使用包含一条语句的扩展 ACL 实现上述需求只允许使用主动探测机制直连 BR 之间配置隧道必要，可以使用拓扑中不存在的 IP 前缀R1 接口利用率最大 80%，R2 接口利用率最大 90%使用只匹配源地址和 DSCP 的 ACLR1 创建一条 AD 为 250 的浮动静态默认路由到 SW1 的 fa0/1；R2 创建一条 AD 为 250 的浮动静态默认路由到 SW4 的 SVI 123使用 AD 为 250 的浮动静态路由指向下游交换机不允许使用：max-range-utilization，

25、resolve utilization 以及 resolve range(14) 使用以下参数：monitor-period 1，periodic-erval 0 和 period roion 90Solutions:R1:en conf tkey chain PFR key 1key-string PFRerface FastEthernet0/0 load-erval 30erface Tunnel0ip address YY.YY.12.1 255.255.255.0tunnel source Loack0tunnel destination YY.YY.2.2 exitoer bord

26、er local Loack0master YY.YY.1.1 key-chain PFR exitip route 0.0.0.0 0.0.0.0 32.32.17.7 250ip acs-list extende2permit ip YY.YY.44.0 0.0.0.255 any dscp cs2 exitip acs-list extende4permit ip YY.YY.44.0 0.0.0.255 any dscp cs4 exitoer-map map 10 match traffic-class acs-list CS2set mode select-exit good se

27、t mode route control set mode monitor activeset active-probe jitter YY.YY.55.5 set link-group R1exitoer-map map 20-port 1025match traffic-class acs-list CS4set mode select-exit goodset mode route control set mode monitor activeset active-probe jitter YY.YY.55.5 set link-group R2exit-port 1025oer mas

28、ter policy-rules mapno max-range-utilization loggingborder YY.YY.1.1 key-chain PFR erface FastEthernet0/0 externalmax-xmit-utilization percentage 80 link-group R1erface Tunnel0ernalernalerfa exiterial0/1/0border YY.YY.2.2 key-chain PFRerfaerial0/1/0ernal ernalerface Tunnel0erface FastEthernet0/0 ext

29、ernal max-xmit-utilization percentage 90 link-group R2exit learnno max-range-utilazation no resolve utilizationno resolve rang monitor-period 1periodic-erval 0holddown 90backoff 90 90 endR2:en conf tkey chain PFR key 1key-string PFRerface FastEthernet0/0 load-erval 30erface Tunnel0ip address YY.YY.1

30、2.2 255.255.255.0tunnel source Loack0tunnel destination 32.32.1.1 exitoer border local Loack0master 32.32.1.1 key-chain PFR exitip route 0.0.0.0 0.0.0.0 YY.YY.42.10 250endVerification:先做如下验证：R2#sh route-map dyroute-map OER-06/24/13-00:04:36.571-4-OER, permit, sequence 0, identifier 1187224092 Match

31、clauses:ip address (ac Set clauses:s-lists): oer#1ip next-hop 31.31.12.1 erface Tunnel0Policy routing matches: 0 packets, 0 bytesroute-map OER-06/24/13-00:04:36.571-4-OER, permit, sequence 1, identifier 1218915508 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31.42.10 erface

32、 FastEthernet0/0Policy routing matches: 0 packets, 0 bytes Current active dynamic routemaps = 1R2#sh ip acs-list dynamic oer#1Extended IP acs list oer#11073741823 permit ip 31.31.44.0 0.0.0.255 any dscp cs2R2#sh ip acs-list dynamic oer#2Extended IP acs list oer#21073741823 permit ip 31.31.44.0 0.0.0

33、.255 any dscp cs4R1#sh ip acs-lists dynamic oer#1Extended IP acs list oer#11073741823 permit ip 31.31.44.0 0.0.0.255 any dscp cs2R1#sh ip acs-lists dynamic oer#2Extended IP acs list oer#21073741823 permit ip 31.31.44.0 0.0.0.255 any dscp cs4R1#sh oer mast traOrefix Sistics:Pas - Passive, Act - Activ

34、e, S - Short term, L - Long term, Dly - Delay (ms), P - Percentage below threshold, Jit - Jitter (ms),MOS - Mean Opinion ScoreLos - Packet Loss (packets-per-million), Un - Unreachable (flows-per-million), E - Egress, I - Ingress, Bw - Bandwidth (kbps), N - Not applicableU - unknown, * - uncontrolled

35、, + - control more specific, - active probe all# - Prefix monitor mode is Spel, & - Blackholed Prefix% - Force Next-Hop, - Prefix is deniedDstPrefix Appl_IDDscpProtSrcPortDstPortSrcPrefix Flags Se TimeCurrBR CurrI/F ProtocolPasSDly PasLDly Pan PasPasSLos PasLLos EBw IBw ActSJit ActPMOSActSDly ActLDl

36、y ActSUn Act0.0.0.0/0 N cs4 256NN 31.31.44.0/24 INPOLICY0 31.31.2.2Fa0/0 PBRNNNNNNNN22000U0.0.0.0/0 N cs2 256NN 31.31.44.0/24INPOLICY NNN0 31.31.1.1Fa0/0 PBRNNNNN22000UR1#sh route-map dyroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 0, identifier 1224007484 Match clauses:ip address (ac

37、Set clauses:s-lists): oer#1ip next-hop 31.31.17.7 erface FastEthernet0/0Policy routing matches: 0 packets, 0 bytesroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 1, identifier 1224006984 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31.12.2 erface Tunnel0Policy r

38、outing matches: 0 packets, 0 bytes Current active dynamic routemaps = 1从 R4 上连续1000 个DSCP 为CS2（TOS 64）的报文，R2 接收到报文，通过Tunnel0 接口路由到R1，并发送给 31.31.17.7：R4#ipIP address: 31.31.55.5Repeat count 5: 1000Datagram size 100:Timeout in seconds 2:Extendedds n: ySource address orerface: 31.31.44.4 Type of servic

39、e 0: 64Set DF bit in IP header? no: Validate reply data? no:Data pattern 0 xABCD:Loose, Strict, Record, Timest, Verenone:Sp range of sizes n:Type escsequence to abort.Sending 1000, 100-byte ICMP Echos to 31.31.55.5, timeout is 2 seconds:Packet wisource address of 31.31.44.4!Sucs rate is 100 percent

40、(1000/1000), round-trip min/avg/max = 4/4/8 ms再次验证：R2#sh route-map dyroute-map OER-06/24/13-00:04:36.571-4-OER, permit, sequence 0, identifier 1187224092 Match clauses:ip address (ac Set clauses:s-lists): oer#1ip next-hop 31.31.12.1 erface Tunnel0Policy routing matches: 1000 packets, 104000 bytesrou

41、te-map OER-06/24/13-00:04:36.571-4-OER, permit, sequence 1, identifier 1218915508 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31.42.10 erface FastEthernet0/0Policy routing matches: 0 packets, 0 bytes Current active dynamic routemaps = 1R1#sh route-map dyroute-map OER-08/15

42、/12-10:07:06.451-4-OER, permit, sequence 0, identifier 1224007484 Match clauses:ip address (ac Set clauses:s-lists): oer#1ip next-hop 31.31.17.7 erface FastEthernet0/0Policy routing matches: 1000 packets, 100000 bytesroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 1, identifier 122400698

43、4 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31.12.2 erface Tunnel0Policy routing matches: 0 packets, 0 bytes Current active dynamic routemaps = 1从 R4 上连续2000 个DSCP 为CS4（TOS 128）的报文，R2 接收到报文直接路由给 SW4：R4#ipIP address: 31.31.55.5Repeat count 5: 2000Datagram size 100:Timeout

44、 in seconds 2:Extendedds n: ySource address orerface: 31.31.44.4 Type of service 0: 128Set DF bit in IP header? no: Validate reply data? no:Data pattern 0 xABCD:Loose, Strict, Record, Timest, Verenone:Sp range of sizes n:Type escsequence to abort.Sending 2000, 100-byte ICMP Echos to 31.31.55.5, time

45、out is 2 seconds:Packet wisource address of 31.31.44.4!Sucs rate is 100 percent (2000/2000), round-trip min/avg/max = 1/3/4 ms再次验证：R1#sh route-map dyroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 0, identifier 1224007484 Match clauses:ip address (ac Set clauses:s-lists): oer#1ip next-ho

46、p 31.31.17.7 erface FastEthernet0/0Policy routing matches: 1000 packets, 100000 bytesroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 1, identifier 1224006984 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31.12.2 erface Tunnel0Policy routing matches: 0 packets, 0

47、byte Current active dynamic routemaps = 1R2#sh route-map dyroute-map OER-06/24/13-00:04:36.571-4-OER, permit, sequence 0, identifier 1187224092 Match clauses:ip address (ac Set clauses:s-lists): oer#1ip next-hop 31.31.12.1 erface Tunnel0Policy routing matches: 1000 packets, 104000 byteroute-map OER-

48、06/24/13-00:04:36.571-4-OER, permit, sequence 1, identifier 1218915508 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31.42.10 erface FastEthernet0/0Policy routing matches: 2000 packets, 208000 bytes Current active dynamic routemaps = 12.8 Implement Performance RoutingContinu

49、e as per following:Set the frequency of probes to the lowest valueMake suret all exits are probedhe most effective wayThe voice traffic is sourced from VLAN_44 destined to the voice gateway R5 (YY.YY.55.5) and marked with DSCP EF should go through R1 if the delay is 40ms and jitter is 5ms and it sho

50、uldfallback to R2 should these values not be metYou should use acs-list specifying only source address and DSCP valueYou must use set mode select-exit goodExplanations:(1)(2)(3)探测信息的发送频率采用最低值所有出口的探测采用最有效率的途径源自VLAN_44 去往语音网关R5（YY.YY.55.55）标记为 DSCP EF 的语音流量，如果延迟 40m 抖动 5ms 则通过 R1 转发；如不满足上述条件，则通过 R2 走使

51、用只匹配源地址和 DSCP 的 ACL必须使用 set mode select-exit good(4)(5)Solutions:R1:en conf tip acs-list extended VOICEpermit ip YY.YY.44.0 0.0.0.255 any dscp efoer-map map 30 match traffic-class acs-list VOICEset mode select-exit good set delay threshold 40set mode route control set mode monitor fast set jitter th

52、reshold 5set active-probe jitter 32.32.55.5 set probe frequency 2set link-group R1 fallback R2 end-port 32767 codec g729aR5:en conf tip sla responder endVerification:先做如下验证：R1#sh oer master traffic-classOrefix Sistics:Pas - Passive, Act - Active, S - Short term, L - Long term, Dly - Delay (ms), P -

53、Percentage below threshold, Jit - Jitter (ms),MOS - Mean Opinion ScoreLos - Packet Loss (packets-per-million), Un - Unreachable (flows-per-million), E - Egress, I - Ingress, Bw - Bandwidth (kbps), N - Not applicableU - unknown, * - uncontrolled, + - control more specific, - active probe all# - Prefi

54、x monitor mode is Spel, & - Blackholed Prefix% - Force Next-Hop, - Prefix is deniedDstPrefixAppl_IDDscpProtSrcPortDstPortSrcPrefixFlags S e Time PasSDly PasLDly ActSDly ActLDlyCurrBR CurrI/F ProtocolPan PasPasSLos PasLLos EBw IBw ActSJit ActPMOSActSUn Act0.0.0.0/0 N ef 256NN 31.31.44.0/24INPOLICY NN

55、N0 31.31.1.1Fa0/0 PBRNN00NNN22000.0.0.0/0 N cs4 256NN 31.31.44.0/24INPOLICY NNN0 31.31.2.2Fa0/0 PBRNN0UNNN22000.0.0.0/0 N cs2 256NN 31.31.44.0/24INPOLICY NNN0 31.31.1.1Fa0/0 PBRNNNNN22000UR1#sh route-map dyroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 0, identifier 1224007484 Match cla

56、uses:ip address (ac Set clauses:s-lists): oer#1ip next-hop 31.31.17.7 erface FastEthernet0/0Policy routing matches: 1000 packets, 100000 bytesroute-map OER-08/15/12-10:07:06.451-4-OER, permit, sequence 1, identifier 1224006984 Match clauses:ip address (ac Set clauses:s-lists): oer#2ip next-hop 31.31

57、.12.2erface Tunnel0Policy routing matches: 0 packets, 0 bytes Current active dynamic routemaps = 1R1#sh ip acs-lists dynamic oer#1Extended IP acs list oer#1536870911 permit ip 31.31.44.0 0.0.0.255 any dscpef1073741823 permit ip 31.31.44.0 0.0.0.255 any dscp cs2 (1000 matches)R1#sh ip acs-lists dynam

58、ic oer#2Extended IP acs list oer#21073741823 permit ip 31.31.44.0 0.0.0.255 any dscp cs4再从R4 上1500 个 DSCP 为EF（TOS 184）的报文：R4#Protocol ip:IP address: 31.31.55.5Repeat count 5: 1500Datagram size 100: Timeout in seconds 2:ExtendedSource address ords n: yerface: 31.31.44.4Type of service 0: 184Set DF bi

59、t in IP header? no: Validate reply data? no:Data pattern 0 xABCD:Loose, Strict, Record, Timest, Verenone:Sp range of sizes n:Type escsequence to abort.Sending 1500, 100-byte ICMP Echos to 31.31.55.5, timeout is 2 seconds:Packet wisource address of 31.31.44.4!Sucs rate is 100 percent (1500/1500), rou

60、nd-trip min/avg/max = 4/4/8 msR2#sh route-map dyroute-map OER-06/24/13-00:04:36.571-4-OER, permit, sequence 0, identifier 1187224092 Match clauses:ip address (ac Set clauses:s-lists): oer#1ip next-hop 31.31.12.1 erface Tunnel0Policy routing matches: 1000 packets, 104000 bytesroute-map OER-06/24/13-0