Ccna Labs 6x723f

CCNA Labs

1

Cisco Icons and Symbols

DSP Switch

Router

Access Server

Multilayer Switch

Digital Signal Processor

Personal Computer

File Server Cisco CallManager Server

Cisco IP Phone

Voice Gateway Router

WAN “Cloud”

VLAN or Cluster (Color May Vary)

PBX

PSTN “Cloud”

Ethernet

Fast Ethernet

Serial Line

Circuit-Switched Line 2

Im

po

rt

10

0: 10

2

Cisco Icons and Symbols

Metro Network DWDM/SONET/Ethernet

3

LabS2- Basic Router Configuration 172.16.X.0/24 RA RA:+1 RB:+2 RC:+3 RD:+4 RE:+5 RF:+6 Lab1, Lab2:Y=6 Lab3: Y=8

1 S0/0

F0/0 .10

RB S0/1

2 S0/0 F0/0 .11

RC S0/1

3 S0/0

F0/0 .12

RD S0/1

4 S0/0

RE S0/1

F0/0 .13

5 S0/0

F0/0 .14

RF S0/1 F0/0 .15

10.0.Y.0/24 SW1

Lab-SW

TFTP Server

Objectives: In this lab, students configure some basic router settings: 1. Router name. 2. Router s:console, vty, enable , perform encryption. 3. Serial interfaces, FastEthernet interfaces. 4. Interface description. 5. banners. 6. Host name resolution. 7. Using Router show commands. 8. Making configuration changes. 9. Backing up configuration files, IOS on TFTP servers. 10. Capture the configuration . 11. ing and Troubleshooting: show, telnet, ping, traceroute 4

LabS2- Managing Cisco IOS Software Network:10.0.Y.0/24 Lab1, Lab2:Y=6 Lab3: Y=8

RA

RB

F0/0 .11

F0/0 .10

RD

RC

F0/0 .13 RE

F0/0 .14

F0/0 .12

F0/0 .15

LAB-SW

RF

TFTP Server

Objectives: 1. Using the boot system command 2. Configuration 3. Managing configuration files using TFTP 4. Managing configuration files using copy and paste 5. Managing IOS images using TFTP 6. using TFTP from ROMmon 7. Recovery 8. ing and Troubleshooting: show, telnet, ping, traceroute 5

LabS3-RIP-OSPF-EIGRP Default route1: 20.0.0.0/24

Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7

1

OFF1

RIP ver2 174.18.X.0/24

GATE1 3

key-id=1 key-string=”green123" mode MD5 level 7 OSPF, 172.16.X.0/24

Objectives: 1. Configuring RIP ver2, EIGRP, OSPF routing protocols 2. Propagating a default route (use one and only): 1. Default route 1 2. Default route 2 3. Default route 3 3. Redistrbute RIP, OSPF, EIGRP routes 4. Enable MD5 authentication 5. ing and Troubleshooting

2

SW1

Default route2: 30.0.0.0/24

BORDER GATE2

EIGRP 88, 173.17.X.0/24

4 5

Key=2 key-string=”blue123" mode MD5

SW2 OFF2 7

OFF3 8 9

GATE3

6

Default route3: 40.0.0.0/24

6

LabS2b-RIP-EIGRP-OSPF EIGRP 22, 122.22.X.0/24 1

OSPF authentication: key-id=1 =red123 MD5 level 7

4

Default route2: 2.0.0.0/24 3

5

BR2

GATE2

RIP authentication: key=2 key-string=blue123 MD5

Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7

Default route1: 1.0.0.0/24

6 2

CENTER OSPF, 133.33.X.0/24

GATE1 13 14

EIGRP authentication: key=3 key-string=green123 MD5 Objectives: 1. Propagate the default route (use one and only): Default route 1 or Default route 2 or Default route 3 2. OFF router: Disable routing protocol 3. GATE1: configure and redistribute static routes to 16,17,18 subnets

EIGRP 55, 155.55.X.0/24

RIP ver2 144.44.0/24

Disable routing protocol

15

7

Default route3: 3.0.0.0/24

9

17

18

BR3 8

OFF 12

16

GATE3 10

11

OSPF, 166.66.X.0/24

(config)# router ospf {process-id} (config-router)# redistribute [rip | eigrp {as_number}] [subnets | metric {value}| metric-type {1| 2}] (config)# router rip (config-router)# redistribute [eigrp {as_number} | ospf {process-id}] metric {value} (config)# router eigrp {as_number} (config-router)# redistribute [rip | ospf {process-id} ] metric {bandwidth | delay | reliability | loading | MTU } 7

LabS2-OpenLab2

Default route1: 1.1.1.0/24 4

OSPF, 177.77.X.0/24 key-id=1 =”green123" MD5

GATE1 BR1

2

5

1

Default route2: 2.2.2.0/24

3

Objectives: 1. Propagate the default route (use one and only): Default route 1 or Default route 2 or Default route 3 2. Redistrbute RIP, OSPF, EIGRP routes 3. Enable MD5 authentication

6

EIGRP 88, 155.55.X.0/24

BR2

Key=4 Key-string=”cyan123" MD5

8 9

7

GATE2 10 11

15

OSPF, 133.33.X.0/24 key-id=3 =”red123" MD5

RIP ver2 122.22.X.0/24 BR3

14 16

12

Key=2 Key-string=”blue123" MD5

GATE3 13

Default route3: 3.3.3.0/24

(config)# router ospf {process-id} (config-router)# redistribute [rip | eigrp {as_number}] [subnets | metric {value}| metric-type {1| 2}] (config)# router rip (config-router)# redistribute [eigrp {as_number} | ospf {process-id}] metric {value} (config)# router eigrp {as_number} (config-router)# redistribute [rip | ospf {process-id} ] metric {bandwidth | delay | reliability | loading | MTU }

Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7

8

LabS2- RIPv2-EIGRP-OSPF 2

Ext LANs 172.0.0.0/16 … 172.255.0.0/16

5

SITE1 S0/0

BR1

4

6

1

S0/1

Default route: 200.200.200.0/24

S0/0

3

EIGRP AS=44, 144.44.X.0/24

7

GATE

RIPver2, 133.33.X.0/24

Ext LANs 173.0.0.0/16 … 173.255.0.0/16

SITE2

S0/1

18

F0/1

8

F0/1

F0/0

9

SW2

BR2

S0/0

EIGRP AS=55, 155.55.X.0/24

11

S0/1 14 16

SW1 10

OSPF 122.22.X.0/24

15

Ext LANs 174.0.0.0/16 … 174.255.0.0/16

F0/0

19

BR3 12

S0/1

S0/0

SITE3 17

13

Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7

(config)# router ospf {process-id} (config-router)# redistribute [rip | eigrp {as_number}] [subnets | metric {value}| metric-type {1| 2}] (config)# router rip (config-router)# redistribute [eigrp {as_number} | ospf {process-id}] metric {value} (config)# router eigrp {as_number} (config-router)# redistribute [rip | ospf {process-id} ] metric {bandwidth | delay | reliability | loading | MTU } 9

LabS3-Switch Configuration Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7 Sw1:+8 Sw2:+9 Sw3:+10

RIP ver2 172.16.X.0/24 PC11

PC12

TFTP Server1

SW1 3

Objectives: 1. Configuring RIP routing protocol 2. Resetting the switch defaults 3. Asg the switch host name and 4. Asg the switch IP address and Default gateway 5. Enabling HTTP service and port on all switchs 6. Configuring static MAC addresses 7. Configuring port security 8. Back up the IOS to a local TFTP server 9. recovery (reference: CCNA3_lab_6_2_8_en.pdf ) 10. ing and Troubleshooting: show, debug, ping, traceroute, telnet on switchs: debug ip packet, debug ip icmp, show macaddress-table, show arp, clear mac-address-table dynamic ...

GATE2 TFTP Server2

GATE1 1

2

SW2 SW3

PC21

PC22

PC23

PC24

10

LabS4-NAT-DH-PPP Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7

OSPF Key-id=1 =“student” MD5 level 7

4 SW1

6

5

CHAP 1

7

200.0.X.0/24 CHAP

CHAP 2

3 2

1 NAT DH

ISP3

ISP2

ISP1

NAT DH

8

200.0.X.0/24

3

NAT DH

172.16.X.0/24

9

Objectives: 1. Configuring OSPF routing protocol in ISP area 2. Configuring PPP-Multilink, CHAP (one-way), NAT, DH, ACLs 3. ing and Troubleshooting 11

LabS4-NAT-DH-PPP-VLANs DNS server 192.168.2.1

Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7

Lab1:Y=6 Lab2:Y=6 Lab3:Y=8

ISP1

ISP3

ISP2

10.0.Y.0/24

NAT CHAP

4

NAT DH

Objectives: 1. Configuring OSPF routing protocol in area 2. Configuring PPP, CHAP (bidirection), NAT, DH, ACLs 3. Configuring Vlans, VTP 4. ing and Troubleshooting: all PCs can access Internet

CHAP

2

1

OSPF Key-id=1 =“student” MD5 level 7

2

CHAP

1

3

172.16.X.0/24

3

5

192.168.X.0/24 6

VLAN2

T

VLAN3 7 SW1 (Server)

T

T

SW2 (Client)

SW3 (Client) VTP ver2 Domain: bkacad =“redblue” Vlan2: Technical Vlan3: 12

Open Lab 1 DNS Server WEB Server1 (www.cisco.com)

LAN4 Switch3

LAN3

WAN F0/1 Router1

Loopback3

S0/1 F0/0

LAN2 Loopback2 DH Server1

Switch1

PC1

PC2 LAN1

WEB Server2 (www.yahoo.com)

TFTP Server LAN5

Switch4 Router2 S0/0

F0/1

Loopback6

LAN6

Loopback7

LAN7

F0/0 DH Server2

Switch2

PC3

PC4 LAN8

13

NS2 Skill Practice 100

HUB +DH server +EzVPN server for SP2

SP1

SP5

+CA +EzVPN server for mobile s

+EzVPN server for mobile s 3

1

1

SP2

5

ISP

2

5

4

SP4 +EzVPN server for mobile s

+EzVPN client 3

2

100

4

SP3 +DH client

Mobile s 3

14

NS1- OpenLab1 Network address 1: 10.0.0.0/24 2,7: 172.16.0.0/24 3,4,5,6: X.0.0.0/24

ISP Outside

RIP ver2 Outside Network 192.168.131.0/24

SW-2950 F0/0

F0/0 GATE1

GATE2 6

3 WEB

F0/1

FTP

SW-2950

F0/1 4

5

E0

DMZ1

AAA Server PIX1

PIX2 T

• • • •

TECH2

7

SW-2950 INSIDE1

•

SW-3550 E1

E1

2

DMZ2 E2

T

TECH1

FTP

E0

E2 SW-3550

WEB

SW-2950

1

INSIDE2

Configure features of PIX as the following: NAT, ACL, Vlans, Trunking, Routing, AAA, Cut-through, Telnet, SSH, ASDM … Configure 802.1X on SW-2950 for Inside s. Inside s can access to DMZ, Internet. Outside s can access to the WEB, FTP servers in DMZ by the IP address assigned to the hosts. Tech networks can access into together. 15

NS1- OpenLab2 Network address 1: 10.0.0.0/24 2,7: 172.16.0.0/24 3,4,5,6: X.0.0.0/24

ISP Outside

RIP ver2 Outside Network 192.168.131.0/24

SW-2950 F0/0

F0/0 GATE1

GATE2 6

3 WEB

F0/1

FTP

SW-2950

F0/1 4

5

E0

DMZ1

AAA Server PIX1

PIX2 T

• • • •

TECH2

7

SW-2950 INSIDE1

•

SW-3550 E1

E1

2

DMZ2 E2

T

TECH1

FTP

E0

E2 SW-3550

WEB

SW-2950

1

INSIDE2

Configure features of PIX as the following: NAT, ACL, Vlans, Trunking, Routing, AAA, Cut-through, Telnet, SSH, ASDM … Configure 802.1X on SW-2950 for Inside s. Inside s can access to DMZ, Internet. Outside s can access to the WEB, FTP servers in DMZ by the IP address assigned to the hosts. Tech networks can access into together. 16

NS1- OpenLab2 Network address 1,2,3,4,12: 10.0.X.0/24 5: 100.0.0.0/24 6,7,8,9: 200.0.X.0/24 10,11: 172.16.0.0/24

Lab-SW

SW-2950 F0/0 BKACAD network 192.168.131.0/24 WEB

FTP

F0/0

GATE1

GATE2 F0/1

6

7

F0/1

8

SW-3550

5

F0/0

SW-2950

10

11

E0

F0/0

Outside E2

SITE1

DMZ1

E1

FTP

SW-3550

E0 SW-2950

WEB

9

Outside

SITE2

F0/1.2 F0/1.1

SITE3

F0/1.2

ENG1

F0/1.1

ENG2

E2

SITE4

SW-2950

DMZ4

E1

12

SW-2950 INSIDE1

INSIDE2

INSIDE3

1

2

3

INSIDE4 4

AAA Server

• • • • •

Basic configurations: NAT, ACL, Object-group, Vlan, Trunking, Routing Outside can access to the devices by SSH Inside can access to the devices by Telnet, SDM or ASDM Outside can access to DMZ servers Eng1 and Eng2 can access into together

• • •

Enable Authentication-Proxy, Cut-through Configure FTP, HTTP Inspection Mitigate layer 2 attack

17

LabS2- RIP version1 WEB (www.bkacad.com)

DNS

2

ISP 1

TFTP

GATE

3 8

SITE3 5

7 6

PC1

SITE1:+1 SITE2:+2 SITE3:+3 GATE:+4 ISP:+5

Tasks: • Basic Router configuration: – Hostname – s – Banner Message – Descriptions – Host Table – disable the Name Service – Logging Synchronous – … 200.200.X.0/24 • Basic RIPv1 configuration : – Enable RIP RIP – ive interfaces 172.16.X.0/24 – Configure and propagate the default route – Create and redistribute the static route SITE1 • Configuring the Servers, PCs • Backing up configuration files on the TFTP server 4 • ing and Troubleshooting: – Show SITE2 – Telnet – Ping – Traceroute, Tracert External LAN – Debug 30.30.30.0/24 18

RIP version1 10.0.0.1/16 10.1.0.1/16

10.2.0.1/16 10.0.0.2/24

19

LabS2- OpenLab1 Default Route 200.200.200.0/24

Key=3 Key-string=”cyan123" MD5

EIGRP 55 155.55.X.0/24

OSPF 133.33.X.0/24

HaiBaTrung

8

10

18

16

(DR)

5

TayHo

Key=2 Key-string=”blue123" MD5

9

6

2

RIP ver2 177.77.X.0/24

CauGiay

1

20

4

HoanKiem

7

3

SW1

BaDinh

17 19

Ext LANs 172.0.0.0/16 … 172.127.0.0/16

(BDR) 12

11

key-id=1 =”green123" MD5

Ext LANs 172.128.0.0/16 … 172.255.0.0/16

ThanhXuan =”green123" clear text

13

HaTay 15

14

Backup Route 100.100.100.0/24 (HaTay only)

Ext LANs 192.168.0.0/24 … 192.168.255.0/24

(config)# router ospf {process-id} (config-router)# redistribute [rip | eigrp {as_number}] [subnets | metric {value}| metric-type {1| 2}] (config)# router rip (config-router)# redistribute [eigrp {as_number} | ospf {process-id}] metric {value} (config)# router eigrp {as_number} (config-router)# redistribute [rip | ospf {process-id} ] metric {bandwidth | delay | reliability | loading | MTU } 20

LabS4-Load Balancing Ra:+1 Rb:+2 Rc:+3 Rd:+4 Re:+5 Rf:+6 Rg:+7 Lab1,2:Y=6 Lab3:Y=8 Lab4,5:Y=4 Lab6:Y=5

SW-A

Lab-SW

10.0.Y.0/24 NAT/PAT

VNN

FPT

VIETTEL

F0/0 F0/0

F0/0 4

200.0.X.0/24 PAP

5

CHAP

PAP

CHAP

6

PAP

CHAP

NAT/PAT RIP ver2

•

• •

172.16.X.0/24

F0/0 MD1 2

MD2 3

F0/0 F0/0

MD3 4

Vlan2 Vlan3 Tasks: SW-B – Multilink: use interface Multilink T F0/0 – DH – Load Balancing: enable Process Switching GATE DH – RIP ver2: F0/1 5 Vlan4 • MD1, MD2, MD3, GATE • GATE: propagate subnets 172.16.X.0/24 only • Change RIP timer SW-C distribute-list command: (config-router)# distribute-list {access-list} { in | out } [ interface ] Adjust static route: (config)# ip route static adjust-time {seconds} 21

LabS3- STP

Tasks: • Configuring VTP: – VTP ver2 – VTP domain: ccna – VTP : cisco123 – SW1: server; SW2,SW3: clients – Vlan10: teacher – Vlan20: student – Vlan30: – Vlan99: management; 10.0.X.0/24 • Configuring STP: – SW1: root bridge – PortFast – UplinkFast – BackboneFast • Troubleshooting: show, debug …

Lab-SW

SW1

F0/9

F0/1

F0/3 F0/4 F0/2

T F0/1

T F0/2

F0/4

F0/5

F0/5

F0/6

F0/6

F0/3

SW3

SW2 F0/10

T

F0/10

22

LabS3- OpenLab1 •

•

VTP: Ver 2 Default route: Domain: ccna 200.200.200.0/24 : 1234 SW1: server; SW2,SW3: client 1 VLANs: Vlan20: teacher; 144.44.20.0/24 Vlan30: student; 144.44.30.0/24 Vlan99: management; 144.44.99.0/24

GATE 2 S0/0 3 S0/1 BR

Ra:+1 Rb:+2

Rd:+4 Re:+5

SW1 (Server)

9

EIGRP,66 166.66.X..0/24

T

S0/0

10

Rg:+7

SITE2

SW1:+8

EIGRP,55 155.55.X..0/24 F0/0

SW3 (Client)

SW2 (Client)

SITE3

30

S0/0

S0/1

5 SITE4

S0/1 11

13

T

4

T

F0/0

SITE1

Rf:+6

RIP ver2 133.33.X..0/24 OSPF 144.44.X..0/24

F0/0 20

Rc:+3

OSPF Authentication: key-id=1 HIDDEN =055A1C MD5 level 7 RIPv2 Authentication: key=2 key-string=blue123 MD5 EIGRP Authentication: key=3 key-string=red123 MD5

6

8

SW2:+9 SW3:+10 12

7

23

LabS3- OpenLab2 Default route: 200.200.200.0/24

Ra:+1

GATE

Rb:+2 Rc:+3

1

Rd:+4 Re:+5 Rf:+6

SITE1

2

3 10

SW1 (server)

T 4

20

Rg:+7

BR1

SW2:+9 SW3:+10

30

5

SW1:+8

WLAN Local IP:172.16.0.0/24 DNS: 203.162.0.181 210.245.0.11 Mode: Mixed SSID: CCNA Channel: 11 Authentication: Auto Encryption: WPA2 Access Restriction: - deny access to www.bbc.com website - deny Telnet traffics VLANs Vlan10: technic AP Vlan20: staff Vlan30: RIP ver2 133.33.X.0/24

6

SITE2 40

T

T

7

OSPF 155.55.X.0/24

SW2 (server)

OSPF Authentication: key-id=1 HIDDEN =055A1C MD5 level 7 RIPv2 Authentication: key=2 key-string=blue123 MD5 EIGRP Authentication: key=3 key-string=red123 MD5

SW3 (client) 50

8

BR2 9

10

VTP ver2 domain name: BKACAD : cisco VLANs Vlan40: teacher Vlan50: student

EIGRP, AS=77 177.77.X.0/24

11

SITE3 12

24

LabS3- OpenLab4 ftp://121.100.48.11 WLAN name:cisco Local IP:172.16.0.0/24 : sadikhov DNS: 203.162.0.181 Default route: Lab-SW 208.67.222.222 192.168.X.0/24 Mode: Mixed SSID: CCNA GATE Channel: 11 Authentication: Auto 5 6 Encryption: WPA Access Restrictions: - deny access to www.24h.com website SITE1 SITE2 - deny Telnet, FTP traffics 50 10 20 40 VLANs T Vlan10: student; 144.44.10.0/24 Vlan20: teacher; 144.44.20.0/24 SW1 SW2 Vlan30: sale; 144.44.30.0/24 (client) T (client) T Vlan99: management; 144.44.99.0/24 VTP ver2 SW3 Domain name: STUDENT 30 T (server) : cisco123 SW1: server; SW2,SW3: client BR STP SW1: the primary root for Vlan10 3 the secondary root for Vlan20 SW2: the primary root for Vlan20 2 4 the secondary root for Vlan30 SW3: the primary root for Vlan30 BackboneFast, UplinkFast, PortFast, udld, BPDU Guard SITE3

NAT/PAT (Configure by Instructor) EIGRP, AS=33

133.33.X.0/24 key=1 key-string=blue123 MD5

OSPF 144.44.X.0/24 key-id=2 =red123 MD5

RIP ver2 155.55.X.0/24 key=3 key-string=cyan123 MD5

1

25

LabS4- PAP - CHAP Subnet address: 172.16.X.0/24 Authentication : 0101X; X=[1,3,5,7,9]

4 3 S0/1

CHAP 5

2

S0/0 S0/1

PAP

S0/0

6

PAP

CHAP

SITE3

1

SITE2

PAP

CHAP

S0/1

S0/0

12

SITE1

SITE4 S0/0

S0/1

PAP

CHAP SITE5

7

SITE6 11

PAP

PAP

S0/1

CHAP

CHAP S0/0 9 8

S0/0

S0/1 10

Objectives: 1. Configuring PPP 2. Configuring PAP, CHAP authentication: the name must match the hostname 3. ing and Troubleshooting: - show - debug ppp authentication - debug ppp packet - ... 4. Other: - The hostname on one router don’t match the name that the other router has configured. - The s don’t match (PAP only) 26

LabS4- Full Mesh Frame Relay SITE1

SITE2 S0/1 S0/0 S0/0 S0/1 S0/3 S0/2

S0/0 S0/1

SITE4

SITE3

27

LabS4- NAT/PAT Lab-SW SW1

10.0.Y.0/24 Y=[4,5,6,8] F0/0

F0/0

F0/0

MD1

PAT (Interface) S0/0

192.168.X.0/24

S0/0

1

NAT Pool:

F0/0

FW2

S0/1

NAT (Dynamic)/ DH

F0/0

20

FW3 DH Pool: Excluded-Address: 172.16.X.1 –

30

10

172.16.X.0/24

192.168.X.10 – 192.168.X.20/24

3

S0/1

F0/0

MD3

S0/0

2

S0/1

FW1

MD2

SW2

172.16.X.10 DNS server: 203.162.0.181,

PC1

PC2

PC3

210.245.0.11 Duration: 3days, 3hours, 30 minutes

•

Notes: – MD1,MD2,MD3: Enable PAT with the interface – FW1,FW2,FW3: Enable dynamic NAT with the pool. Configure DH servers. – SW2: Create Vlans 10,20,30 – MD1,MD2,MD3: Interface F0/0 assigned an IP address automatically

28