English
Considerations:
1) Task 3: the pool name is not specified but should be called NAT_LIST or is not be possible to get 100%
2) Task 7: the VTP domain is called XYZCORP (capital letters) but the right domain is xyzcorp
3) Task 11 firewall ACL: the server xyzcorp is 209.165.200.246 and to permit port web access the code is "permit tcp any host 209.165.200.246 eq www" however to get 100% the code is "permit tcp any host 209.165.200.244 eq www" but is wrong and is not be possible to access the web server.
1: Configure Frame Relay in a Hub-and-Spoke Topology
Step 1. Configure the Frame Relay core.
Use the addressing tables and the following requirements.
HQ is the hub router. B1, B2, and B3 are the spokes.
HQ uses a point-to-point subinterface for each of the Branch routers.
B3 must be manually configured to use IETF encapsulation.
The LMI type must be manually configured as q933a for HQ, B1, and B2. B3 uses ANSI.
HQ
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname HQ
HQ(config)#int s0/0/0
HQ(config-if)#encapsulation frame-relay
HQ(config-if)#frame-relay lmi-type q933a
HQ(config-if)#no sh
HQ(config-if)#int s0/0/0.41 point-to-point
HQ(config-subif)#ip address 10.255.255.1 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 41
HQ(config-subif)#int s0/0/0.42 point-to-point
HQ(config-subif)#ip address 10.255.255.5 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 42
HQ(config-subif)#int s0/0/0.43 point-to-point
HQ(config-subif)#ip address 10.255.255.9 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 43
HQ(config-subif)#exit
HQ(config)#
B1
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname B1
B1(config)#int s0/0/0
B1(config-if)#ip address 10.255.255.2 255.255.255.252
B1(config-if)#no sh
B1(config-if)#encapsulation frame-relay
B1(config-if)#frame-relay lmi-type q933a
B1(config-if)#exit
B1(config)#
B2
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname B2
B2(config)#int s0/0/0
B2(config-if)#ip address 10.255.255.6 255.255.255.252
B2(config-if)#no sh
B2(config-if)#encapsulation frame-relay
B2(config-if)#frame-relay lmi-type q933a
B2(config-if)#exit
B2(config)#
B3
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname B3
B3(config)#int s0/0/0
B3(config-if)#ip address 10.255.255.10 255.255.255.252
B3(config-if)#no sh
B3(config-if)#encapsulation frame
B3(config-if)#encapsulation frame-relay ietf
B3(config-if)#frame-relay lmi-type ansi
B3(config-if)#exit
B3(config)#
Step 2. Configure the LAN interface on HQ.
HQ
HQ(config)#int f0/0
HQ(config-if)#ip address 10.0.1.1 255.255.255.0
HQ(config-if)#no sh
HQ(config-if)#exit
HQ(config)#
Step 3. Verify that HQ can ping each of the Branch routers.
HQ#ping 10.255.255.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/9 ms
HQ#ping 10.255.255.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/10 ms
HQ#ping 10.255.255.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/11 ms
Task 2: Configure PPP with CHAP and PAP Authentication
Step 1. Configure the WAN link from HQ to ISP using PPP encapsulation and CHAP authentication.
The CHAP password is ciscochap.
HQ
HQ(config)#username ISP password ciscochap
HQ(config)#int s0/1/0
HQ(config-if)#ip address 209.165.201.1 255.255.255.252
HQ(config-if)#encapsulation ppp
HQ(config-if)#pp authentication chap
HQ(config-if)#no sh
HQ(config-if)#exit
HQ(config)#
Step 2. Configure the WAN link from HQ to NewB using PPP encapsulation and PAP authentication.
You need to connect a cable to the correct interfaces. HQ is the DCE side of the link. You choose the clock rate. The PAP password is ciscopap.
HQ
HQ(config)#username NewB password ciscopap
HQ(config)#int s0/0/1
HQ(config-if)#clock rate 64000
HQ(config-if)#ip address 10.255.255.253 255.255.255.252
HQ(config-if)#encapsulation ppp
HQ(config-if)#pp authentication pap
HQ(config-if)#no sh
HQ(config-if)#ppp pap sent-username HQ password ciscopap
HQ(config-if)#exit
HQ(config)#
Step 3. Verify that HQ can ping ISP and NewB.
HQ#ping 209.165.201.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.201.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/6 ms
HQ#ping 10.255.255.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms
Task 3: Configure Static and Dynamic NAT on HQ
Step 1. Configure NAT.
Use the following requirements:
Allow all addresses for the 10.0.0.0/8 address space to be translated.
XYZ Corporation owns the 209.165.200.240/29 address space. The pool, XYZCORP, uses addresses .241 through .245 with a /29 mask.
The www.xyzcorp.com website at 10.0.1.2 is registered with the public DNS system at IP address 209.165.200.246.
HQ
HQ(config)#int s0/1/0
HQ(config-if)#ip nat out
HQ(config-if)#int f0/0
HQ(config-if)#ip nat in
HQ(config-if)#int s0/0/1
HQ(config-if)#ip nat in
HQ(config-if)#int s0/0/0.41
HQ(config-subif)#ip nat in
HQ(config-subif)#int s0/0/0.42
HQ(config-subif)#ip nat in
HQ(config-subif)#int s0/0/0.43
HQ(config-subif)#ip nat in
HQ(config-subif)#exit
HQ(config)#
HQ(config)#ip access-list standard NAT_LIST
HQ(config-std-nacl)#permit 10.0.0.0 0.255.255.255
HQ(config-std-nacl)#exit
HQ(config)#ip nat pool XYZCORP 209.165.200.241 209.165.200.245 net 255.255.255.248
HQ(config)#ip nat inside source list NAT_LIST pool XYZCORP overload
HQ(config)#ip nat inside source static 10.0.1.2 209.165.200.246
HQ(config)#
Step 2. Verify NAT is operating by using extended ping.
From HQ, ping the serial 0/0/0 interface on ISP using the HQ LAN interface as the source address. This ping should succeed.
Verify that NAT translated the ping with the show ip nat translations command.
HQ#ping
Protocol [ip]:
Target IP address: 209.165.201.2
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: fastethernet0/0
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.201.2, timeout is 2 seconds:
Packet sent with a source address of 10.0.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 ms
HQ#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 209.165.200.241:7110.0.1.1:71 209.165.201.2:71 209.165.201.2:71
icmp 209.165.200.241:7210.0.1.1:72 209.165.201.2:72 209.165.201.2:72
icmp 209.165.200.241:7310.0.1.1:73 209.165.201.2:73 209.165.201.2:73
icmp 209.165.200.241:7410.0.1.1:74 209.165.201.2:74 209.165.201.2:74
icmp 209.165.200.241:7510.0.1.1:75 209.165.201.2:75 209.165.201.2:75
— 209.165.200.246 10.0.1.2 — —
Task 4: Configure Static and Default Routing
Step 1. Configure HQ with a default route to ISP and a static route to the NewB LAN.
Use the exit interface as an argument.
HQ(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0
HQ(config)#ip route 10.4.5.0 255.255.255.0 s0/0/1
Step 2. Configure the Branch routers with a default route to HQ.
Use the next-hop IP address as an argument.
B1
B1(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.1
B2
B2(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.5
B3
B3(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.9
Step 3. Verify connectivity beyond ISP.
All three NewB PCs and the NetAdmin PC should be able to ping the www.cisco.com web server.
NewB-PC1>ping www.cisco.com
Pinging 209.165.202.134 with 32 bytes of data:
Request timed out.
Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=21ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
NewB-PC2>ping www.cisco.com
Pinging 209.165.202.134 with 32 bytes of data:
Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125
NewB-PC3>ping www.cisco.com
Pinging 209.165.202.134 with 32 bytes of data:
Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125
NetAdmin-PC>ping www.cisco.com
Pinging 209.165.202.134 with 32 bytes of data:
Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125
Task 5: Configure Inter-VLAN Routing
Step 1. Configure each Branch router for inter-VLAN routing.
Using the addressing table for Branch routers, configure and activate the LAN interface for inter-VLAN routing. VLAN 99 is the native VLAN.
B1(config)#interface f0/0
B1(config-if)#no sh
B1(config-if)#exit
B1(config)#int f0/0.10
B1(config-subif)#encapsulation dot1Q 10
B1(config-subif)#ip address 10.1.10.1 255.255.255.0
B1(config-subif)#int f0/0.20
B1(config-subif)#encapsulation dot1Q 20
B1(config-subif)#ip address 10.1.20.1 255.255.255.0
B1(config-subif)#int f0/0.30
B1(config-subif)#encapsulation dot1Q 30
B1(config-subif)#ip address 10.1.30.1 255.255.255.0
B1(config-subif)#int f0/0.88
B1(config-subif)#encapsulation dot1Q 88
B1(config-subif)#ip address 10.1.88.1 255.255.255.0
B1(config-subif)#int f0/0.99
B1(config-subif)#encapsulation dot1Q 99 native
B1(config-subif)#ip address 10.1.99.1 255.255.255.0
B1(config-subif)#exit
B1(config)#
B2(config)#interface f0/0
B2(config-if)#no sh
B2(config-if)#exit
B2(config)#int f0/0.10
B2(config-subif)#encapsulation dot1Q 10
B2(config-subif)#ip address 10.2.10.1 255.255.255.0
B2(config-subif)#int f0/0.20
B2(config-subif)#encapsulation dot1Q 20
B2(config-subif)#ip address 10.2.20.1 255.255.255.0
B2(config-subif)#int f0/0.30
B2(config-subif)#encapsulation dot1Q 30
B2(config-subif)#ip address 10.2.30.1 255.255.255.0
B2(config-subif)#int f0/0.88
B2(config-subif)#encapsulation dot1Q 88
B2(config-subif)#ip address 10.2.88.1 255.255.255.0
B2(config-subif)#int f0/0.99
B2(config-subif)#encapsulation dot1Q 99 native
B2(config-subif)#ip address 10.2.99.1 255.255.255.0
B2(config-subif)#exit
B2(config)#
B3(config)#interface f0/0
B3(config-if)#no sh
B3(config-if)#exit
B3(config)#int f0/0.10
B3(config-subif)#encapsulation dot1Q 10
B3(config-subif)#ip address 10.3.10.1 255.255.255.0
B3(config-subif)#int f0/0.20
B3(config-subif)#encapsulation dot1Q 20
B3(config-subif)#ip address 10.3.20.1 255.255.255.0
B3(config-subif)#int f0/0.30
B3(config-subif)#encapsulation dot1Q 30
B3(config-subif)#ip address 10.3.30.1 255.255.255.0
B3(config-subif)#int f0/0.88
B3(config-subif)#encapsulation dot1Q 88
B3(config-subif)#ip address 10.3.88.1 255.255.255.0
B3(config-subif)#int f0/0.99
B3(config-subif)#encapsulation dot1Q 99 native
B3(config-subif)#ip address 10.3.99.1 255.255.255.0
B3(config-subif)#exit
B3(config)#
Step 2. Verify routing tables.
Each Branch router should now have six directly connected networks and one static default route.
B1#sh ip route
Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP
i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area
* – candidate default, U – per-user static route, o – ODR
P – periodic downloaded static route
Gateway of last resort is 10.255.255.1 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C 10.1.10.0/24 is directly connected, FastEthernet0/0.10
C 10.1.20.0/24 is directly connected, FastEthernet0/0.20
C 10.1.30.0/24 is directly connected, FastEthernet0/0.30
C 10.1.88.0/24 is directly connected, FastEthernet0/0.88
C 10.1.99.0/24 is directly connected, FastEthernet0/0.99
C 10.255.255.0/30 is directly connected, Serial0/0/0
S* 0.0.0.0/0 [1/0] via 10.255.255.1
B1#
Task 6: Configure and Optimize EIGRP Routing
Step 1. Configure HQ, B1, B2, and B3 with EIGRP.
Use AS 100.
Disable EIGRP updates on appropriate interfaces.
Manually summarize EIGRP routes so that each Branch router only advertises the 10.X.0.0/16 address space to HQ.
Note: Packet Tracer does not accurately simulate the benefit of EIGRP summary routes. Routing tables will still show all subnets, even though you correctly configured the manual summary.
HQ
HQ(config)#router eigrp 100
HQ(config-router)#passive-interface s0/1/0
HQ(config-router)#passive-interface s0/0/1
HQ(config-router)#passive-interface fa0/0
HQ(config-router)#network 10.0.0.0
HQ(config-router)# no auto-summary
B1
B1(config)#router eigrp 100
B2(config-router)#passive-interface fa0/0.10
B2(config-router)#passive-interface fa0/0.20
B2(config-router)#passive-interface fa0/0.30
B2(config-router)#passive-interface fa0/0.99
B1(config-router)#network 10.0.0.0
B1(config-router)# no auto-summary
B1(config-router)#int s0/0/0
B1(config-if)#ip summary-address eigrp 100 10.1.0.0 255.255.0.0
B2
B2(config)#router eigrp 100
B2(config-router)#passive-interface fa0/0.10
B2(config-router)#passive-interface fa0/0.20
B2(config-router)#passive-interface fa0/0.30
B2(config-router)#passive-interface fa0/0.99
B2(config-router)#network 10.0.0.0
B2(config-router)#no auto-summary
B2(config-router)#int s0/0/0
B2(config-if)#ip summary-address eigrp 100 10.2.0.0 255.255.0.0
B3
B3(config)#router eigrp 100
B3(config-router)#passive-interface fa0/0.10
B3(config-router)#passive-interface fa0/0.20
B3(config-router)#passive-interface fa0/0.30
B3(config-router)#passive-interface fa0/0.99
B3(config-router)#network 10.0.0.0
B3(config-router)#no auto-summary
B3(config-router)#int s0/0/0
B3(config-if)#ip summary-address eigrp 100 10.3.0.0 255.255.0.0
Step 2. Verify routing tables and connectivity.
HQ and the Branch routers should now have complete routing tables.
The NetAdmin PC should now be able to ping each VLAN subinterface on each Branch router.
B1#sh ip route
Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP
i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area
* – candidate default, U – per-user static route, o – ODR
P – periodic downloaded static route
Gateway of last resort is 10.255.255.1 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 14 subnets, 3 masks
D 10.0.1.0/24 [90/2172416] via 10.255.255.1, 00:09:20, Serial0/0/0
D 10.1.0.0/16 is a summary, 00:09:24, Null0
C 10.1.10.0/24 is directly connected, FastEthernet0/0.10
C 10.1.20.0/24 is directly connected, FastEthernet0/0.20
C 10.1.30.0/24 is directly connected, FastEthernet0/0.30
C 10.1.88.0/24 is directly connected, FastEthernet0/0.88
C 10.1.99.0/24 is directly connected, FastEthernet0/0.99
D 10.2.0.0/16 [90/2684416] via 10.255.255.1, 00:09:20, Serial0/0/0
D 10.3.0.0/16 [90/2684416] via 10.255.255.1, 00:09:20, Serial0/0/0
D 10.4.5.0/24 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
C 10.255.255.0/30 is directly connected, Serial0/0/0
D 10.255.255.4/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
D 10.255.255.8/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
D 10.255.255.252/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
S* 0.0.0.0/0 [1/0] via 10.255.255.1
B1#
NetAdmin-PC>ping 10.3.10.1
Pinging 10.3.10.1 with 32 bytes of data:
Reply from 10.3.10.1: bytes=32 time=18ms TTL=254
Reply from 10.3.10.1: bytes=32 time=17ms TTL=254
Reply from 10.3.10.1: bytes=32 time=18ms TTL=254
Reply from 10.3.10.1: bytes=32 time=17ms TTL=254
Ping statistics for 10.3.10.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 17ms, Maximum = 18ms, Average = 17ms
NetAdmin-PC>ping 10.3.20.1
Pinging 10.3.20.1 with 32 bytes of data:
Reply from 10.3.20.1: bytes=32 time=15ms TTL=254
Reply from 10.3.20.1: bytes=32 time=15ms TTL=254
Reply from 10.3.20.1: bytes=32 time=18ms TTL=254
Reply from 10.3.20.1: bytes=32 time=16ms TTL=254
Ping statistics for 10.3.20.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 15ms, Maximum = 18ms, Average = 16ms
NetAdmin-PC>ping 10.3.30.1
Pinging 10.3.30.1 with 32 bytes of data:
Reply from 10.3.30.1: bytes=32 time=18ms TTL=254
Reply from 10.3.30.1: bytes=32 time=17ms TTL=254
Reply from 10.3.30.1: bytes=32 time=17ms TTL=254
Reply from 10.3.30.1: bytes=32 time=18ms TTL=254
Ping statistics for 10.3.30.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 17ms, Maximum = 18ms, Average = 17ms
NetAdmin-PC>ping 10.3.88.1
Pinging 10.3.88.1 with 32 bytes of data:
Reply from 10.3.88.1: bytes=32 time=20ms TTL=254
Reply from 10.3.88.1: bytes=32 time=17ms TTL=254
Reply from 10.3.88.1: bytes=32 time=16ms TTL=254
Reply from 10.3.88.1: bytes=32 time=20ms TTL=254
Ping statistics for 10.3.88.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 16ms, Maximum = 20ms, Average = 18ms
NetAdmin-PC>ping 10.3.99.1
Pinging 10.3.99.1 with 32 bytes of data:
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=16ms TTL=254
Ping statistics for 10.3.99.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 14ms, Maximum = 16ms, Average = 14ms
Task 7: Configure VTP, Trunking, the VLAN Interface, and VLANs
The following requirements apply to all three Branches. Configure one set of three switches. Then use the scripts for those switches on the other two sets of switches.
Step 1. Configure Branch switches with VTP.
BX-S1 is the VTP server. BX-S2 and BX-S3 are VTP clients.
The domain name is XYZCORP. <– mistake all is lower character xyzcorp
The password is xyzvtp.
B1-S1
Switch>en
Switch#conf t
Switch(config)#hostname B1-S1
B1-S1(config)#vtp mode server
Device mode already VTP SERVER.
B1-S1(config)#vtp domain xyzcorp
Changing VTP domain name from xyzcorp<br> to xyzcorp
B1-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S1(config)#
B1-S2
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B1-S2
B1-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B1-S2(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B1-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S2(config)#
B1-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B1-S3
B1-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B1-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B1-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S3(config)#
B2-S1
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B2-S1
B2-S1(config)#vtp mode server
Device mode already VTP SERVER.
B2-S1(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B2-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S1(config)#
B2-S2
Switch>en
Switch#conf t
Switch(config)#hostname B2-S2
B2-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B2-S2(config)#vtp domain xyzcorp
Changing VTP domain name from xyzcorp<br> to xyzcorp
B2-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S2(config)#
B2-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B2-S3
B2-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B2-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B2-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S3(config)#
B3-S1
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B3-S1
B3-S1(config)#vtp mode server
Device mode already VTP SERVER.
B3-S1(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S1(config)#
B3-S2
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B3-S2
B3-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B3-S2(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S2(config)#
B3-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname B3-S3
B3-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B3-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S3(config)#
Step 2. Configure trunking on BX-S1, BX-S2, and BX-S3.
Configure the appropriate interfaces in trunking mode and assign VLAN 99 as the native VLAN.
B1-S1
B1-S1(config)#int range fa0/1-5
B1-S1(config-if-range)#switchport trunk native vlan 99
B1-S1(config-if-range)#switchport mode trunk
B1-S2
B1-S2(config)#int range fa0/1-4
B1-S2(config-if-range)#switchport trunk native vlan 99
B1-S2(config-if-range)#switchport mode trunk
B1-S3
B1-S3(config)#int range fa0/1-4
B1-S3(config-if-range)#switchport trunk native vlan 99
B1-S3(config-if-range)#switchport mode trunk
B2-S1
B2-S1(config)#int range fa0/1-5
B2-S1(config-if-range)#switchport trunk native vlan 99
B2-S1(config-if-range)#switchport mode trunk
B2-S2
B2-S2(config)#int range fa0/1-4
B2-S2(config-if-range)#switchport trunk native vlan 99
B2-S2(config-if-range)#switchport mode trunk
B2-S3
B2-S3(config)#int range fa0/1-4
B2-S3(config-if-range)#switchport trunk native vlan 99
B2-S3(config-if-range)#switchport mode trunk
B3-S1
B3-S1(config)#int range fa0/1-5
B3-S1(config-if-range)#switchport trunk native vlan 99
B3-S1(config-if-range)#switchport mode trunk
B3-S2
B3-S2(config)#int range fa0/1-4
B3-S2(config-if-range)#switchport trunk native vlan 99
B3-S2(config-if-range)#switchport mode trunk
B3-S3
B3-S3(config)#int range fa0/1-4
B3-S3(config-if-range)#switchport trunk native vlan 99
B3-S3(config-if-range)#switchport mode trunk
Step 3. Configure the VLAN interface and default gateway on BX-S1, BX-S2, and BX-S3.
B1-S1(config)#ip default-gateway 10.1.99.1
B1-S2(config)#ip default-gateway 10.1.99.1
B1-S3(config)#ip default-gateway 10.1.99.1
B2-S1(config)#ip default-gateway 10.2.99.1
B2-S2(config)#ip default-gateway 10.2.99.1
B2-S3(config)#ip default-gateway 10.2.99.1
B3-S1(config)#ip default-gateway 10.3.99.1
B3-S2(config)#ip default-gateway 10.3.99.1
B3-S3(config)#ip default-gateway 10.3.99.1
B1-S1
B1-S1(config)#int vlan 99
B1-S1(config-if)#ip addr 10.1.99.21 255.255.255.0
B1-S1(config-if)#no shutdown
B1-S2
B1-S2(config)#int vlan 99
B1-S2(config-if)#ip addr 10.1.99.22 255.255.255.0
B1-S2(config-if)#no shutdown
B1-S3
B1-S3(config)#int vlan 99
B1-S3(config-if)#ip addr 10.1.99.23 255.255.255.0
B1-S3(config-if)#no shutdown
B2-S1
B2-S1(config)#int vlan 99
B2-S1(config-if)#ip addr 10.2.99.21 255.255.255.0
B2-S1(config-if)#no shutdown
B2-S2
B2-S2(config)#int vlan 99
B2-S2(config-if)#ip addr 10.2.99.22 255.255.255.0
B2-S2(config-if)#no shutdown
B2-S3
B2-S3(config)#int vlan 99
B2-S3(config-if)#ip addr 10.2.99.23 255.255.255.0
B2-S3(config-if)#no shutdown
B3-S1
B3-S1(config)#int vlan 99
B3-S1(config-if)#ip addr 10.3.99.21 255.255.255.0
B3-S1(config-if)#no shutdown
B3-S2
B3-S2(config)#int vlan 99
B3-S2(config-if)#ip addr 10.3.99.22 255.255.255.0
B3-S2(config-if)#no shutdown
B3-S3
B3-S3(config)#int vlan 99
B3-S3(config-if)#ip addr 10.3.99.23 255.255.255.0
B3-S3(config-if)#no shutdown
Step 4. Create the VLANs on BX-S1.
Create and name the VLANs listed in the VLAN Configuration and Port Mappings table on BX-S1 only. VTP advertises the new VLANs to BX-S1 and BX-S2.
B1-S1
B1-S1(config)#vlan 10
B1-S1(config-vlan)#name Admin
B1-S1(config-vlan)#vlan 20
B1-S1(config-vlan)#name Sales
B1-S1(config-vlan)#vlan 30
B1-S1(config-vlan)#name Production
B1-S1(config-vlan)#vlan 88
B1-S1(config-vlan)#name Wireless
B1-S1(config-vlan)#vlan 99
B1-S1(config-vlan)#name Mgmt&Native
B1-S1(config-vlan)#exit
B1-S1(config)#
B2-S1
B2-S1(config)#vlan 10
B2-S1(config-vlan)#name Admin
B2-S1(config-vlan)#vlan 20
B2-S1(config-vlan)#name Sales
B2-S1(config-vlan)#vlan 30
B2-S1(config-vlan)#name Production
B2-S1(config-vlan)#vlan 88
B2-S1(config-vlan)#name Wireless
B2-S1(config-vlan)#vlan 99
B2-S1(config-vlan)#name Mgmt&Native
B2-S1(config-vlan)#exit
B2-S1(config)#
B3-S1
B3-S1(config)#vlan 10
B3-S1(config-vlan)#name Admin
B3-S1(config-vlan)#vlan 20
B3-S1(config-vlan)#name Sales
B3-S1(config-vlan)#vlan 30
B3-S1(config-vlan)#name Production
B3-S1(config-vlan)#vlan 88
B3-S1(config-vlan)#name Wireless
B3-S1(config-vlan)#vlan 99
B3-S1(config-vlan)#name Mg&Native
B3-S1(config-vlan)#exit
B3-S1(config)#
Step 5. Verify that VLANs have been sent to BX-S2 and BX-S3.
Use the appropriate commands to verify that S2 and S3 now have the VLANs you created on S1. It may take a few minutes for Packet Tracer to simulate the VTP advertisements. A quick way to force the sending of VTP advertisements is to change one of the client switches to transparent mode and then back to client mode.
B1-S2#sh vtp passw
VTP Password: xyzvtp
B1-S2#sh vtp status
VTP Version : 2
Configuration Revision : 10
Maximum VLANs supported locally : 255
Number of existing VLANs : 10
VTP Operating Mode : Client
VTP Domain Name : xyzcorp
VTP Pruning Mode : Disabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0xE1 0xB3 0x4C 0x9C 0x8E 0×80 0x7E 0×28
Configuration last modified by 10.1.99.21 at 3-1-93 05:47:41
B1-S2#sh vlan
VLAN Name Status Ports
—- ——————————– ——— ——————————-
1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
Fa0/13, Fa0/14, Fa0/15, Fa0/16
Fa0/17, Fa0/18, Fa0/19, Fa0/20
Fa0/21, Fa0/22, Fa0/23, Fa0/24
Gig1/1, Gig1/2
10 Admin active
20 Sales active
30 Production active
88 Wireless active
99 Mgmt&Native active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
B1-S2# sh interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 99
Fa0/2 on 802.1q trunking 99
Fa0/3 on 802.1q trunking 99
Fa0/4 on 802.1q trunking 99
Port Vlans allowed on trunk
Fa0/1 1-1005
Fa0/2 1-1005
Fa0/3 1-1005
Fa0/4 1-1005
Port Vlans allowed and active in management domain
Fa0/1 1,10,20,30,88,99
Fa0/2 1,10,20,30,88,99
Fa0/3 1,10,20,30,88,99
Fa0/4 1,10,20,30,88,99
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,10,20,30,88,99
Fa0/2 1,10,20,30,88,99
Fa0/3 1,10,20,30,88,99
Fa0/4 1,10,20,30,88,99
B1-S2#
NetAdmin-PC>ping 10.3.99.23
Pinging 10.3.99.23 with 32 bytes of data:
Request timed out.
Request timed out.
Reply from 10.3.99.23: bytes=32 time=23ms TTL=253
Reply from 10.3.99.23: bytes=32 time=21ms TTL=253
Task 8: Assign VLANs and Configure Port Security
Step 1. Assign VLANs to access ports.
Use the VLAN Configuration and Port Mappings table to complete the following requirements:
Configure access ports
Assign VLANs to the access ports
B1-S2
B1-S2(config)#int f0/6
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 10
B1-S2(config-if)#int fa0/11
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 20
B1-S2(config-if)#int fa 0/16
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 30
B2-S2
B2-S2(config)#int f0/6
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 10
B2-S2(config-if)#int fa0/11
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 20
B2-S2(config-if)#int fa 0/16
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 30
B2-S2(config-if)#
B3-S2
B3-S2(config)#int f0/6
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 10
B3-S2(config-if)#int fa0/11
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 20
B3-S2(config-if)#int fa 0/16
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 30
B1-S3
B1-S3(config)#int fa 0/7
B1-S3(config-if)#switchport mode access
B1-S3(config-if)#switchport access vlan 88
B2-S3
B2-S3(config)#int fa 0/7
B2-S3(config-if)#switchport mode access
B2-S3(config-if)#switchport access vlan 88
B3-S3
B3-S3(config)#int fa 0/7
B3-S3(config-if)#switchport mode access
B3-S3(config-if)#switchport access vlan 88
Step 2. Configure port security.
Use the following policy to establish port security on the BX-S2 access ports:
Allow only one MAC address
Configure the first learned MAC address to "stick" to the configuration
Set the port to shut down if there is a security violation
B1-S2
B1-S2(config)#int fa0/6
B1-S2(config-if)#switchport access vlan 10
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B1-S2(config-if)#int fa0/11
B1-S2(config-if)#switchport access vlan 20
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B1-S2(config-if)#int fa0/16
B1-S2(config-if)#switchport access vlan 30
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B2-S2
B2-S2(config)#int fa0/6
B2-S2(config-if)#switchport access vlan 10
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B2-S2(config-if)#int fa0/11
B2-S2(config-if)#switchport access vlan 20
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B2-S2(config-if)#int fa0/16
B2-S2(config-if)#switchport access vlan 30
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B3-S2
B3-S2(config)#int fa0/6
B3-S2(config-if)#switchport access vlan 10
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
B3-S2(config-if)#int fa0/11
B3-S2(config-if)#switchport access vlan 20
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
B3-S2(config-if)#int fa0/16
B3-S2(config-if)#switchport access vlan 30
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
Step 3. Verify VLAN assignments and port security.
Use the appropriate commands to verify that access VLANs are correctly assigned and that the port security policy has been enabled.
B1-S2#show port-security interface f0/6
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0000.0000:0
Security Violation Count : 0
Task 9: Configure STP
Step 1. Configure BX-S1 as the root bridge.
Set the priority level to 4096 on BX-S1 so that these switches are always the root bridge for all VLANs.
B1-S1(config)#spanning-tree vlan 1-1001 priority 4096
B2-S1(config)#spanning-tree vlan 1-1001 priority 4096
B3-S1(config)#spanning-tree vlan 1-1001 priority 4096
Step 2. Configure BX-S3 as the backup root bridge.
Set the priority level to 8192 on BX-S3 so that these switches are always the backup root bridge for all VLANs.
B1-S3(config)#spanning-tree vlan 1-1001 priority 8192
B2-S3(config)#spanning-tree vlan 1-1001 priority 8192
B3-S3(config)#spanning-tree vlan 1-1001 priority 8192
Step 3. Verify that BX-S1 is the root bridge.
B1-S1#sh spanning-tree
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 4097
Address 00D0.BA3D.2C94
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4097 (priority 4096 sys-id-ext 1)
Address 00D0.BA3D.2C94
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
—————- —- — ——— ——– ——————————–
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/2 Desg FWD 19 128.2 P2p
Fa0/3 Desg FWD 19 128.3 P2p
Fa0/4 Desg FWD 19 128.4 P2p
Fa0/5 Desg FWD 19 128.5 P2p
VLAN0010
Spanning tree enabled protocol ieee
Root ID Priority 4106
Address 00D0.BA3D.2C94
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
…
VLAN0020
Spanning tree enabled protocol ieee
Root ID Priority 4116
Address 00D0.BA3D.2C94
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
…
VLAN0030
Spanning tree enabled protocol ieee
Root ID Priority 4126
Address 00D0.BA3D.2C94
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
…
VLAN0088
Spanning tree enabled protocol ieee
Root ID Priority 4184
Address 00D0.BA3D.2C94
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
…
VLAN0099
Spanning tree enabled protocol ieee
Root ID Priority 4195
Address 00D0.BA3D.2C94
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
…
Task 10: Configure DHCP
Step 1. Configure DHCP pools for each VLAN.
On the Branch routers, configure DHCP pools for each VLAN using the following requirements:
Exclude the first 10 IP addresses in each pool for the LANs.
Exclude the first 24 IP addresses in each pool for the wireless LANs.
The pool name is BX_VLAN## where X is the router number and ## is the VLAN number.
Include the DNS server attached to the HQ server farm as part of the DHCP configuration.
B1
B1(config)#ip dhcp excluded-address 10.1.10.1 10.1.10.10
B1(config)#ip dhcp excluded-address 10.1.20.1 10.1.20.10
B1(config)#ip dhcp excluded-address 10.1.30.1 10.1.30.10
B1(config)#ip dhcp excluded-address 10.1.88.1 10.1.88.24
B2
B2(config)#ip dhcp excluded-address 10.2.10.1 10.2.10.10
B2(config)#ip dhcp excluded-address 10.2.20.1 10.2.20.10
B2(config)#ip dhcp excluded-address 10.2.30.1 10.2.30.10
B2(config)#ip dhcp excluded-address 10.2.88.1 10.2.88.24
B3
B3(config)#ip dhcp excluded-address 10.3.10.1 10.3.10.10
B3(config)#ip dhcp excluded-address 10.3.20.1 10.3.20.10
B3(config)#ip dhcp excluded-address 10.3.30.1 10.3.30.10
B3(config)#ip dhcp excluded-address 10.3.88.1 10.3.88.24
B1
B1(config)#ip dhcp pool B1_VLAN10
B1(dhcp-config)#network 10.1.10.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.10.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN20
B1(dhcp-config)#network 10.1.20.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.20.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN30
B1(dhcp-config)#network 10.1.30.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.30.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN88
B1(dhcp-config)#network 10.1.88.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.88.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#
B2
B2(config)#ip dhcp pool B2_VLAN10
B2(dhcp-config)#network 10.2.10.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.10.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN20
B2(dhcp-config)#network 10.2.20.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.20.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN30
B2(dhcp-config)#network 10.2.30.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.30.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN88
B2(dhcp-config)#network 10.2.88.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.88.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#
B3
B3(config)#ip dhcp pool B3_VLAN10
B3(dhcp-config)#network 10.3.10.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.10.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN20
B3(dhcp-config)#network 10.3.20.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.20.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN30
B3(dhcp-config)#network 10.3.30.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.30.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN88
B3(dhcp-config)#network 10.3.88.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.88.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#
Step 2. Configure the PCs to use DHCP.
Currently, the PCs are configured to use static IP addresses. Change this configuration to DHCP.
Step 3. Verify that the PCs and wireless routers have an IP address.
Step 4. Verify connectivity.
All PCs physically attached to the network should be able to ping the www.cisco.com web server.
B3-PC1>ping www.cisco.com
Pinging 209.165.202.134 with 32 bytes of data:
Request timed out.
Reply from 209.165.202.134: bytes=32 time=29ms TTL=125
Reply from 209.165.202.134: bytes=32 time=31ms TTL=125
Reply from 209.165.202.134: bytes=32 time=23ms TTL=125
Task 11: Configure a Firewall ACL
Step 1. Verify connectivity from Outside Host.
The Outside Host PC should be able to ping the server at www.xyzcorp.com.
Outside host PC>ping www.cisco.com
Pinging 209.165.202.134 with 32 bytes of data:
Reply from 209.165.202.134: bytes=32 time=9ms TTL=127
Reply from 209.165.202.134: bytes=32 time=7ms TTL=127
Reply from 209.165.202.134: bytes=32 time=6ms TTL=127
Reply from 209.165.202.134: bytes=32 time=8ms TTL=127
Step 2. Implement a basic firewall ACL.
Because ISP represents connectivity to the Internet, configure a named ACL called FIREWALL in the following order:
Allow inbound HTTP requests to the www.xyzcorp.com server.
Allow only established TCP sessions from ISP and any source beyond ISP.
Allow only inbound ping replies from ISP and any source beyond ISP.
Explicitly block all other inbound access from ISP and any source beyond ISP.
HQ
HQ(config)#ip access-list extended FIREWALL
HQ(config-ext-nacl)#permit tcp any host 209.165.200.244 eq www
HQ(config-ext-nacl)#permit tcp any any established
HQ(config-ext-nacl)#permit icmp any any echo-reply
HQ(config-ext-nacl)#deny ip any any
HQ(config-ext-nacl)#exit
HQ(config)#int s0/1/0
HQ(config-if)#ip access-group FIREWALL in
HQ(config-if)#exit
HQ(config)#
Outside host PC>ping www.xyzcorp.com
Pinging 209.165.200.246 with 32 bytes of data:
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Task 12: Configure Wireless Connectivity
Step 1. Verify the DHCP configuration.
Each BX-WRS router should already have IP addressing from the DHCP of the BX router for VLAN 88.
B1-WRS ip address 10.1.40.1 (click save settings)
B2-WRS ip address 10.2.40.1 (click save settings)
B2-WRS ip address 10.3.40.1 (click save settings)
Step 3. Configure the wireless network settings.
The SSIDs for the routers are BX-WRS_LAN where the X is the Branch router number.
The WEP key is 12345ABCDE
Wireless > Wireless security > security mode: WEP and key1: 12345ABCDE for all 3 routers
(click save settings)
Step 4. Configure the wireless routers for remote access.
Configure the administration password as cisco123 and enable remote management.
Step 5. Configure the BX-PC4 PCs to access the wireless network using DHCP.
Step 6. Verify connectivity and remote management capability.
Each wireless PC should be able to access the www.cisco.com web server.
Verify remote management capability by accessing the wireless router through the web browser.
From NetAdmin open Browser
access: http://10.1.88.25/
user: admin
password: cisco123
