每个阶段模拟器-na-实验手册lab k1k5过人ccie

CCIER&Sv4.0当前位置 首页→CCIE资料库→CCIER&Sv4.0实验→CCIELABCCIELABK12层接口FramerelaySecureHTTPPPPCHAPAutoQOSK1实验图设备串口连接拓朴图注loopback0Y.Y.X.X/32，R1：★BackBone地址分别为：BB1：配置1．在4交换（1）在4台交换机上同时做如下配置：vtpCCIERoutingandSwitchingvtppasswordciscovtpmode交换机上的VLAN信息如下：VlanVlanVLANVLANSW2-VLANVLANSW2-VLANSW2-VLANR2-VLANVLANSW1-VLANSW2-配置14台交换机上配置（1）在4台交换机上同时做如下配置：23nameVLAN_FVLANnameVLAN_G2原题Implementtheaccess-switchportsofswitchedConfigurealloftheappropriatenontrunkingaccessswitchportsonsw1,sw2,sw3,accordingtothefollowingrequirements:ConfiguretheVLANSfortheaccessswitchportsshowasthevlantables,includetheportstoBB1,BB2andBB3.ConfiguretrunkbetweenSW2F0/2andR2MakesurethatthespanningtreeenterstheforwardingstateimmediaOnlyfortheseaccessswitchports,bypassingthelisteningandlearningAvoidtransmittingbridgeprotocoldateunits(BPDUS)ontheseaccessswitchports.IfaBPDUisreceivedonanyoftheseports,theportsshouldtransitionbacktothelistening,learningandforwardstates.Addanyspeciallayer2commandsthatarerequiredontheroutersincludingtrunkconfiguration.中文注释：中包括连接BB1,BB2和BB3的接口。22VLAN24发BPDU。配置access接口SW1上将所有相应access接口划入相应VLAN：intf0/3switchportmodeaccessswitchportaccessvlan3intswitchportmodeaccessswitchportaccessvlan44intswitchportmodeaccessswitchportaccessvlan15intswitchportmodeaccessswitchportaccessvlan15SW2上将所有相应access接口划入相应VLAN：intf0/1switchportmodeaccessswitchportaccessvlan11intswitchportmodeaccessswitchportaccessvlan13intswitchportmodeaccessswitchportaccessvlan24intswitchportmodeaccessswitchportaccessvlan45intswitchportmodeaccessswitchportaccessvlan2SW3上将所有相应access接口划入相应VLAN：intf0/10switchportmodeaccessswitchportaccessvlan3SW2的F0/2R2G0/1间创建单臂路由interfacef0/2switchporttrunkencapsulationdot1qswitchportmodetrunkswitchporttrunkallowedvlan22,24R2G0/1上创建子接口intf0/1.22encapsulationdot1Q22ipaddress29intf0/1.24encapsulationdot1Q24ipaddress4配置所有交换机的所有access接口跳过STP，并不转发（1）在4台交换机上同时做如下配置：spanning-treeportfastspanning-treeportfastbpdufilterFrame原题ImplementFrameUsethefollowingrequirementstoconfigureR1andR2forframerelayandR4astheframerelayswitch.UseANSILMIonframerelayswitchandauto-sesingonR1andDon’tuseanystaticframerelaymapsorinverseaddressresolutionsUseRFCFrameRelayDLCIR1Frame-relayR2Frame-relay中文注释：R1R2Frame-relay，避免静态映射与动态学习（则使用点到点配置R4Frame-relay交换（1）配置R4Frame-relay交换机frame-relayswitchinginterfaces0/0noipencapsulationframe-relayietfframe-relaylmi-typeansiframe-relayintf-typedceclockrate64000frame-relayroute100interfaces0/1200noshutdowninterfaces0/1noipaddressencapsulationframe-relayietfframe-relaylmi-typeansiframe-relayintf-typedceclockrate64000frame-relayroute200interfaces0/0100noshutdownR1，R2frame-relay接口配置R1frame-relay接口interfaceencapsulationframe-relayietfframe-relaylmi-typeansinoframe-relayinverse-arpnoarpframe-relaynoipaddressnoshutdowninterfaces0/0.12point-to-ipaddress42frame-relayinterface-dlci配置R2frame-relay接口interfaceencapsulationframe-relayietfframe-relaylmi-typeansinoframe-relayinverse-arpnoarpframe-relaynoipaddressnoshutdowninterfaces0/0.12point-to-ipaddress41frame-relayinterface-dlciStorm原题TrafficcontrolprotectionfromtheConfiguretrafficcontrolonthethreebackbonelinks,protectingyournetworkfromabroadcaststorm.Thisprotectionshouldbeginoncebroadcasttrafficishalf(50%)availablebandwidth,theportshouldremainfunctioningduringthistime.中文注释：过50%，即使超过后，不能影响其它。配置1．在SW1，SW2，SW3上配置storm-（1）在SW1，SW2，SW3的F0/10上同时做如下配置：interfacestorm-controlmulticastlevel原题TrunkingConfigurethetrunkportsbetweenSW1,SW2,SW3andSW4accordingtothefollowingrequirements:DisableDTPonthesixdistributionportsforeachSetthelistofallowedvlansthatcanreceiveandsendtrafficontheseinterfacesintaggedformatinparticular,onlyallowVLAN中文注释：45Trunk配置1．在4交换（1）在4台交换机上同时做如下配置：intrangef0/19-switchporttrunkencapsulationdot1qswitchportmodetrunkswitchportswitchporttrunkallowedvlan须知Afterfinishingeachofthefollowingquestions,makesurethatallroutersandswitches.Don’tredistributebetweenandinteriorgatewayprotocol(IGP)andboardgatewayprotocol(BGP).Youneedtoabgprouteonlyifitisstatedinaquestion,otherwisetherouteshouldbeonlyinthebgptable.Attheendofsection2,allsubnetsinyourtopology,includingtheloopbackinterfaceexpectedforSW3,mustbereachablevia.Thereforeredistributeasyouwishunlessdirectlystatedinaquestion.Thebackboneinterfacemustbereachableonlyiftheyarepartofthesolutiontoaquestion.Theloopbackinterfacecanbeseenaseither/24or/32intheroutingtableunlessstatedotherwiseinaquestion.TheloopbackinterfacescanbeaddedintoyourIGPeitherviaredistributionoraddedtoaroutingprocessofyourchoice.须知注解：不能在IGP和BGP之间重分布，BGP的路由不需要通，除非题目明确说明要通，路由只需要BGP看见即可。原题ImplementIPv4ConfigureopenshortestpathUpdatesshouldbeadvertisedonlyoutoftheinterfacethatareindicatedintheIGPtopologydiagram.Don’tmanuallychangetheRouter-Don’tcreateadditionalospfConfigreospfarea2suchthattherearenoTYPE-5Advertisments(LSA)inthearea,R1shouldgenerateadefaultroute.ConfigureOSPFoverframerelaybetweenR1andR2choosinganetworktypethatrequiresdesignaterouter(DR)andbackupdesignaterouter(BDR)negotiationsandhasthefatestrecovertimes.中文注释：启Fastos功能。配置在各路由器上配置routerospfnetworkareanetwork6areanetwork4arearouterospfnetworkareanetwork4areanetwork2arearouterospfnetworkareanetwork9areaIproutingrouterospf2networkareanetwork6areanetwork9areaIproutingrouterospf2networkareanetwork30areaArea2（1）Area2NSSA，并发布默认路由：routerospfarea2area2nssadefault-information-routerospfarea2routerospfarea2改变接口类型（1）改变R1R2interfaceipospfnetworkiposdead-intervalminimalo-multiplierinterfaceipospfnetworkiposdead-interval o-multiplier原题ImplementIPv4ConfigureEIGRP100andEIGRPYYpertheIGPtopologyEIGRPupdatesshouldbeadvertiseonlyouttotheinterfacepertheIGPtopolotydiagram.OnR1,redistributebetweenospfandEIGRPYY.Howeveralloftheroutesthatareindicatedbelowfrombackbone3(EIGRP100)shouldnotberedistributedbetweenbothprotocols.Useroutemapstoplishthisrequirement.Allroute-mapsshouldutilizethesameaccesslists.OnR3,redistributefromEIGRP100intoOnR3,RedistributefromEIGRP100intoEIGRPYY.Howeverthree/24,/24,/24shouldbeaggregatedintoasingleaddresswiththemostspecificmaskpossible.中文注释：含在其中，使用route-map调用相同access-list做过滤。在R3EIGRP100重分布到OSPF（如果没有明确说要往EIGRP100重分布，要往EIGRP100重分布，请不要做）配置按配置EIGRP100和EIGRP（1）按配置EIGRP100和EIGRPYY：R1：routereigrp2noauto-network49routereigrp2noauto-summarynetwork45routereigrp100noauto-summarynetworkroutereigrp2noauto-summarynetworknetwork46network50network7routereigrp2noauto-summarynetwork0network8R1配置OSPFEIGRPYY双向重分布匹配EIGRP100和OSPF默认路由：ipprefix-listEIGRP100permitipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/24ipprefix-listEIGRP100permit/30ipprefix-listEIGRP100permit/24access-list1permit配置OSPFEIGRPYYEIGRPYYOSPFroute-OSPFEIGRProute-mapO2Edenymatchipaddressprefix-listEIGRP100route-mapO2Edeny20matchipaddress1route-mapE2Opermit30EIGRPYYroute-mapE2Odenymatchipaddressprefix-listroute-mapE2Opermit20配置OSPFEIGRPYY的双向重分布EIGRPYYrouterospfredistributeeigrp2subnetsroute-mapE2OOSPFEIGRProutereigrpredistributeospf2metric1000010025511500route-mapO2ER3EIGRP100重分布到routerospf2redistributeeigrp100subnetsR3EIGRP100重分布到EIGRProutereigrp2redistributeeigrp100metric1000010025511500Intipsummary-addresseigrp2RIP原题ImplementRIPVersionConfigureRIPversion2(RIPv2)pertheIGPtopologyRIPupdatesshouldbeadvertiseonlyouttheinterfacepertheIGPtopologyAllripupdatesshouldbeAllripupdatesmustbeabletoreceiveandprocessRIPV1ManuallyredistributebetweenRIPandospfonR2andSW4,R4learnedroutesshouldbepreferredEIGRP.中文注配置（1）按照配置RIPv2：routerripversion2noauto-summarynetworkpassive-interfaceneighbor3routerripversion2noauto-summarynetworkpassive-interfacedefaultneighbor4neighbor6routerripversion2noauto-summarynetworkpassive-interfacedefaultneighbor5RIP接口接收数据包配置RIP接口接收数据包：Intiprip12Intiprip12intiprip12Intvlaniprip12RIP与OSPFEIGRPYY的双向重分布：（此步为重点在R2上配置OSPF重分布进RIP时，过滤掉默认路由，并且metric值要大：access-list2permitroute-mapO2Rdeny10matchipaddress2route-mapO2Rpermit20routerredistributeospf2metric5route-mapO2RR2对RIP自己的路由，从OSPF过来时，要加大AD值,保证走自己内部：access-list22permitaccess-list22permitrouterospfredistributeripsubnetsmetric-type2metric30distance12122R2将自己的直连接口发给RIP的路由，要加大Access-Access-Access-routeroffset-list10out5(4)在SW4上将RIP重分布进EIGRPYY时的metricR1重分布OSPFEIGRPmetricroutereigrpredistributeripmetric10000010025511500route-mapR2E在routerredistributeeigrp2metric2大AD：access-4denyaccess-4denyaccess-router4perdistance175原题ImplementInternetprotocolversion6(IPv6)toconfigureIPv6uniquelocalunicastaddressusingtheEUI-64interfaceidentifier.R4-G0/1andR2-G0/1.Z(VLAN24) FC01:DB8:74:9::/64euiR2-S0/0.ZandR1-S0/0.Z FC01:DB8:74:A::/64euiR1-G0/1andSW1-SVI FC01:DB8:74:B::/64ConfigureOSPFv3pertheIPv6topology.EnsurethatR4canSW1usingIPv6.中文注释：OSPFv3R2-S0/0.ZSW1area1area0配置在相应接口上配置IPv6地址(1)在R4的相应接口上配置IPv6地址：ipv6unicast-routingintf0/1ipv6addressFC01:DB8:74:9::/64eui-在R2的相应接口上配置IPv6地址：ipv6unicast-routingintf0/1.24ipv6addressFC01:DB8:74:9::/64eui-64intipv6addressFC01:DB8:74:A::/64eui-在R1的相应接口上配置IPv6地址：ipv6unicast-routingints0/0.12ipv6addressFC01:DB8:74:A::/64eui-64intipv6addressFC01:DB8:74:B::/64eui-64在SW1的相应接口上配置IPv6地址：sdmpreferdual-ipv4-and-ipv6defaultintvlanipv6addressFC01:DB8:74:B::/64eui-ipv6routerospf2intipv6ospf2areaipv6routerospf2intipv6ospf2area0intipv6ospf2areaipv6routerospf2router-idintipv6ospf2area1intipv6ospf2areaipv6routerospf2router-idintvlanipv6ospf2area原题ImplementIPv4ReferringtheBGProutingdiagram.configureBGPwiththeseConfiguretwobgpconfederationsR1,R3,R5andSW4(ASYY1)andR2andSW2(ASYY2).TheconfederationpeersshouldneighborbetweenR1andR2andbetweenSW4andR2.EBGP:SW2EBGPpeerswiththerouter150.2.Y.254onbackbone2inAS254.ThisEBGP:R5EBGPpeerswiththerouter150.1.Y.254onbackbone1inAS254.Thisrouteradvertisefiverouteswithformat197.68.Z.0/24andtheAS_PATHThebgpdevicesshouldallpreferthepaththroughR5(150.1.Y.254)fornetwork/24and/24,Theinternalboardgatewayprotocol(IBGP)devicesshouldallpreferthepaththroughSW2(150.2.Y.254)fornetwork/24,/24and/24,thismanipulationshouldbe refertoasingleaccess-list.Configureonlytheloopback0ipaddresstopropagateBGProuteinformation.BGProutesshouldbeadvertisedtoAS254.中文注释：配置两个BGPconfederations()，使用loopback0更新；R1，R3，R5和SW4在ASYY1；R2和SW2在ASYY2。之间R1与R2，SW2与R2建立邻居关系，SW2SW4loopback0BGP。（ASYY1R5）R5和BB1建立EBGP197.68.Z.0/24andtheAS_PATH254，配置（1）R1，R2，R3R5，SW2和SW4上配置BGP：R1：routerbgp21noauto-nosynchronizationbgprouter-idbgpconfederationidentifier2bgpconfederationpeers22remote-asupdate-source0remote-asupdate-source0routerbgp22nosynchronizationbgprouter-idbgpconfederationidentifier2Rbgpconfederationpeers21neighborremote-as21neighborupdate-sourceloopbackneighborebgp-neighbor0remote-asneighbor0update-sourceloopbackneighbor0ebgp-neighborremote-asneighborupdate-sourceloopbackrouterbgp21nosynchronizationbgprouter-idbgpconfederationidentifier2neighborremote-as21neighborupdate-sourceloopbackrouterbgp21nosynchronizationbgprouter-idbgpconfederationidentifier2neighborASYY1peer-groupneighborASYY1remote-as21neighborASYY1update-sourceloopback0neighborASYY1route-reflector-clientneighborASYY1next-hop-selfneighborpeer-groupASYY1neighborpeer-groupASYY1neighbor0peer-groupASYY1routerbgp22nosynchronizationbgprouter-idbgpconfederationidentifier2neighborremote-as22neighborupdate-sourceloopbackneighbornext-hop-networkmask55routerbgp21nobgprouter-idbgpconfederationidentifier2bgpconfederationpeers22remote-asupdate-source0ebgp-remote-asupdate-source0network0maskR2R5RouterbgpNei54remote-asRouterbgpNei54remote-asSW上控制路由选择（1）在SW2上将/24和/24附加两个access-list21permit55route-mapASpermit10matchipaddresssetas-pathprepend2122route-mapASpermit20routerbgpneighbor54route-mapASin原题ImplementPIMsparsemodeforIPv6ontheWANlinkbetweenR2andR1,UsingtheseCriteria:ConfigureR4-F0/1tobetheredezvouspoint(RP)fortheFF08::4000:4000multicastgroupnoothergroupsshouldbepermited.中文注释：Framerelay配置R4，R2，R1配置IPv6（1）在R4，R2，R1上同时做如下配置：ipv6multicast-R4的接口F0/1FF08::4000:4000的（1）在R4，R2，R1上同时做如下配置：ipv6access-listpermitipv6hostFF08::4000:4000anyipv6pimrp-addressR4-F0/1原题MulticastConfigureR2S0/0.ZasanIPv6receiverforthemulticastgroupR2shouldbeabletothemulticastgroup中文注释：配置1R2入组interfaceipv6mldjoin-groupSecure原题SecureHTTPEnablesecureHTTPaccessforR5.Enableauthenticationusingthelist“HTTP”whichutilizeslocaluserauthentication.ConfiguretwodifferentusersforaccesstoR5;theusercisco(password“cisco”),whoonyhasprivilege1accesstoR5;andtheuserADMIN(password“CISCO”)whohasprivilege15accessto中文注释：list名为“HTTP”，调用本地用户数据库作认证。用户名：ADMIN，：CISCO，权限为15级。配置R5上配置AAA证方式（1）R5配置AAAaaanew-aaaauthenticationlogindefaultlineaaaauthenticationloginHTTPlocal-caseaaaauthorizationexecHTTPlocalnoiphttpiphttpsecure-iphttpauthenticationaaalogin-authenticationHTTPiphttpauthenticationaaaexec-authorizationHTTPR5上配置本地用户数据（1）在R5上配置本地用户数据库：usernameciscoprivilege1passwordciscousernameADMINprivilege15passwordCISCOPPPCHAP认证原题SecuretheWANPPPConfigurechallengehandshakeauthenticationprotocol(CHAP)onR5forthelinktoR1andR3,accordingtothefollowingrequirements:Anauthentication,authorization,andaccording(AAA)listnamedR1andR3forR1andR3respectively.AuthenticationforR1shouldfirsttrytheradiusserver28usingakeyofciscoandfallbacktolocalloginintheeventofafailuretoconnecttotheradiusserver.R1shouldpresentitselftoR5RACKYYR1withasharedpasswordAuthenticationforR3shouldfirsttrytheTACASserver29usingakeyofciscoandfallbacktolocalloginintheeventofafailuretoconnecttotheTACASserver.R3shouldpresentitselftoR5asBACKUPwithasharepasswordof中文注释：R1list为“R1”，R3list“R3”。认证R1时使用radiusserver28，cisco,失败后使用本地用户数据库认证；认证R3时使用TACASserver29，cisco,失败后使用配置（1）在R5上配置AAA认证方式，并开启CHAP认证：aaanew-aaaauthenticationpppR1groupradiuslocal-aaaauthenticationpppR3grouptacacs+local-caseusernameRACKYYR1passwordciscousernameBACKUPpasswordintpppauthenticationchapR1intpppauthenticationchapR3R5配置AAAradius-serverhost18keyciscotacacs-serverhost29keyR1R3在R1上配置CHAP用户名和R1config)#intR1(config-if)#pppchaphostnameRACKYYR1R1(config-if)#pppchappasswordcisco在R2上配置CHAP用户名和intpppchaphostnameBACKUPpppchappasswordCISCO原题OnR2,Configureparentclass-defaultcommitedinformationrate(CIR)as64kb,whennoBackwardexplicitcongestionnotification( s)arepresentand32kbwhen sarepresent.Differenatiatebetweenvoicepacketswhichshouldreceiveaguranteedbandwidthof40percentanddatawhichshouldreceiveaguarantedbandwidthof35percent.Voicepackesaremarkedasexpeditedchildclass-default.中文注释： 配置R2上配置class-map匹配相应流量匹配voice量class-mapVOICEmatchdscpefclass-mapDATA1matchdscpaf11class-mapmatchdscpaf21class-mapmatch-anyDATAmatchclass-mapDATA1matchclass-mapDATA2（1）为语音和数据分配带宽policy-mapSHAPEclassVOICEprioritypercent40classDATAbandwidthpercent35Class-Basepolicy-mapCBWFQclassclass-defaultshapeaverageshapeadaptive32000service-policySHAPEmap-classframe-relayFRTSservice-policyoutputCBWFQints0/0frame-relaytraffic-shaintframe-relayinterface-dlci200classCBWFQAuto原题AutoQOSoverTo4.3continuetoaddressvoipqualityofservice(QOS)byconfiguringciscoAutoQOSoverPPPlinkbetweenR1andR5.中文注释：配置Ints0/0autodiscoveryqosautoqosvoipIntautodiscoveryqosautoqosvoip原题FirstHopTofacilitateloadbalancingandbackupforhostsofVLAN_H,configureGLBPonVLAN_H,Useanygroupnumber.R4shouldhavethehigherprioritywiththeabilityforR2toassumecontrolifthepriorityofR4decreases.UseMD5authenticationtoprotecttheGLBPgroup.Usethekey-string“cisco”.ConfiguretheIPY.Y.15.35asyourGLBPvirtual中文注释：配置1．在R2R4配置Intf0/1.24glbp1ipy.y.15.35glbp1preemptglbp1authenticationmd5key-stringIntf0/1glbp1ipy.y.15.35glbp1priorityglbp1glbp1authenticationmd5key-string原PoliedandBroadcastR2shouldactasanNTPservertoR4shouldprovidebroadcastNTPupdatesonlytoVLANThehardwareclocksonR2,R3andR4shouldbeupdatedbythesofewareclock.R4shoulduseloopback0asthesourceaddress.Absentanexternaltimeserver,R4shoulduseitsownsystemclocktosynchronizeR2andR3.SettheclockonR4as8:00am(08:00),January1,2000.Ultimay,theclocksonR2,R3andR4shouldbeinsynchronized.中文注释：配置R4的时间为8:00am(08:00),January1,2000.（了配时区），最后R2，R3要从R4同步自己的时间。配置R4NTPntpmaster2ntpsourceIntntpbroadcastclocktimezoneGMT08clockset8:00:00jan1R2ntpmaster3Intntpbroadcastntpserver配置硬件时钟从软件时钟更新（1）在R2，R3，R4上同时做如下配置：ntpupdata-原题DHCPConfigureR1asDHCPserverwiththefollowingHostsofVLANA,B,CandHshouldbeabletoassignedaddressfromR1usingAddressofthesubnetsforVLANA,B,CandHshouldbeavailabletoR1forAllotherY.Y.15.ZsubnetrangesshouldnotbeavailabletoR1foruse.Usetheloopback0addressofR1forallconnections.Configurethenameas EachaddressleaseshouldbevalidforonlyoneEachDHCPclientshouldbeprovidedadefaultrouteraddressofalocallyconnectedrouter.中文注释：址，租约为1天，网关为主机所在本地路由器地址。VLANA,B,CHR1Y.Y.15.ZDHCP分配的name为,DNSserver为Y.Y.15.163,NETBIOSserver为Y.Y.15.18，这些信息只能配置一次。AC配置R1ipdhcppoolnetwork60default-routerleaseipdhcppoolnetwork92default-routerleaseipdhcp