Lab Objective:
The objective of this lab is to cover all relevant CCNP ROUTE and SWITCH theory. These labs will include topics from each of these guides. It should be noted that not all topics will be included in all labs. Additionally, not all solutions will be illustrated in detail. You can refer to previous labs for assistance with some basic configurations.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please implement the following pre-lab configurations. This is required because of the manner in which the routers and switches are physically cabled to each other. The following configuration should be applied to switch ALS1:
If you are using the www.howtonetwork.net racks, please bring up the LAN interface connected to R2 by the following configuration:
Alternatively, you can simply connect the interface to a hub or one of the switches and bring up the interface in the standard manner. |
Task 1
Configure hostnames, IP addressing on all routers as illustrated in the network topology.
Task 2
Configure an EtherChannel between DLS1 and DLS2. This should be a Layer 2 trunk link that uses PAgP. Assign IP address 150.1.1.253/24 to switch DLS2. Finally, verify that all devices on the 150.1.1.0/24 subnet can ping each other.
Task 3
To ensure a consistent Spanning Tree topology, ensure that ALS1 will be the root for all of the configured VLANs. Should a superior BPDU be received, the port should be disabled. Verify your configuration using the appropriate commands.
Task 4
Configure the EtherChannel between DLS1 and DLS2 to load distribution based on the destination MAC address. Verify your configuration.
Next, management has requested that all ports on ALS1 that are connected to the routers be configured in such a manner that if a BPDU is received, the ports are disabled. These ports should be re-enabled after 10 minutes. Implement this solution and verify your configuration.
Task 5
Configure BGP using AS 1 on R1, DLS1 and DLS2. Ensure that Non-Stop Forwarding (NSF) for BGP is enabled and all routers are peered with each other. Verify your configuration using the appropriate commands.
Task 6
Configure OSPF between R1, R2, and R3 as illustrated in the topology. Ensure that OSPF Hellos are not sent out the LAN interfaces of R2. Do NOT enable OSPF for the LAN segments connected to R1 or R3. Verify your OSPF configuration using the appropriate commands.
Task 7
Configure BGP on router R4. This router should peer with R1. Use Loopback interfaces that are comprised of the router numbers, i.e. 1.1.1.1/32 on R1 and 4.4.4.4/32 on R4. Verify your configuration using the appropriate commands. When completing this task, you MUST adhere to these restrictions and guidelines:
- You are allowed only ONE static route on R3 – this route can NOT be a default route
- You are allowed only ONE static route on R4 – this route can NOT be a default route
- You are NOT allowed any static routes on R1 – you can NOT originate a default route
Ensure that the Loopback interfaces are advertised as EXTERNAL routes. Do NOT redistribute any other connected subnets into OSPF when completing this task. Verify your configuration using the appropriate commands.
Task 8
Configure and then advertise the following prefixes via BGP on switches DLS1 and DLS2:
- DLS1: Loopback 0 – IP Address 100.1.1.1/24
- DLS2: Loopback 0 – IP Address 200.2.2.2/24
Next, advertise the 10.4.4.4/24 subnet connected to router R4 via BGP. Do NOT advertise the 150.1.1.0/24 prefix via OSPF or BGP. Verify that the prefixes are received by all BGP speakers.
Task 9
Configure your network so that the 150.1.1.0/24 , 100.1.1.0/24, and 200.2.2.0/24 subnets can ping the 10.4.4.0/24 subnet and vice-versa. Complete this task while adhering to the following:
- You are allowed to use only ONE static route . This can either be on R1 or R3
- You are NOT allowed to use any static or default routes on R4
- You are NOT allowed to advertise the 150.1.1.0/24 subnet via OSPF or BGP
Next, test your configuration by pinging from the 150.1.1.0/24 , 100.1.1.0/24, and 200.2.2.0/24 subnets to the 10.4.4.0/24 subnet and vice-versa. All pings should be successful.
Task 10
Configure Loopback interfaces with the IP addresses 2.2.2.2/32 and 3.3.3.3/32 respectively on R2 and R3. Next, configure 6to4 prefixes on the LAN interfaces of all routers. Use the Loopback addresses to complete the 48-bit global prefix. The router number should complete the next 16-bits, for a complete site prefix. Verify your configuration using the appropriate commands.
Finally, configure 6to4 tunnels on R2 and R3. Ensure that these two routers can ping each other LAN-to-LAN across the 6to4 tunnels. Use the extended ping function for verification.
Task 11
At this point, the 10.3.3.0/24 subnet connected to R3s LAN interface should not be known to any other router, i.e. should not be advertised by OSPF. Management has requested that this subnet remain anonymous. However, they would like devices residing on this subnet to be able to reach the LAN subnets on R2 and R3 only. These devices should appear to be coming from the 150.3.3.0/24 subnet. When completing this task, you MUST adhere to the following restrictions:
- You are NOT allowed to configure any additional interfaces on R3, i.e. Loopbacks
- There should be a one-to-one translation for the 10.3.3.0/24 subnet
- Your configuration should NOT ‘break’ the current OSPF or BGP routing in place
Verify your configuration by pinging the 150.1.1.0/24 and 150.2.2.0/24 subnets from ALS2
Lab Validation
Task 1
Please refer to previous labs for basic IPv4 addressing and hostname configuration. This will not be included in this section to avoid being redundant.
Task 2
Please refer to previous labs for EtherChannel configuration. This will not be included in this section to avoid being redundant. Verify your solution using the show etherchannel commands on both switches:
| DLS1#show etherchannel summary Flags: D – down P – bundled in port-channel I – stand-alone s – suspended H – Hot-standby (LACP only) R – Layer3 S – Layer2 U – in use f – failed to allocate aggregator M – not in use, minimum links not met
Number of channel-groups in use: 1 Group Port-channel Protocol Ports |
| DLS2#show etherchannel summary Flags: D – down P – bundled in port-channel I – stand-alone s – suspended H – Hot-standby (LACP only) R – Layer3 S – Layer2 U – in use f – failed to allocate aggregator M – not in use, minimum links not met
Number of channel-groups in use: 1 Group Port-channel Protocol Ports |
After configuring the SVI on switch DLS2, verify reachability on the 150.1.1.0/24 subnet:
| LS2#ping 150.1.1.0
Type escape sequence to abort. |
Task 3
To complete this task you need to configure the Root Guard feature on the switch. The Root Guard feature prevents a Designated Port from becoming a Root Port. If a port on which the Root Guard feature receives a superior BPDU, it moves the port into a root-inconsistent state, thus maintaining the current Root Bridge status quo.
Unlike other STP enhancements, which can also be enabled on a global basis, Root Guard must be manually enabled on all ports where the Root Bridge should not appear. To complete this task successfully, first ensure that switch ALS1 is the root for all VLANs and then enable Root Guard on all designated ports. The first part of this task is completed as follows:
| ALS1(config)#spanning-tree vlan 1 priority 0 ALS1(config)#spanning-tree vlan 100 priority 0 ALS1(config)#spanning-tree vlan 300 priority 0 ALS1(config)#spanning-tree vlan 400 priority 0 |
| ALS1#show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0001, VLAN0100, VLAN0300, VLAN0400 [Truncated Output] |
Next, to determine which ports are designated and actively forwarding, use the show spanning-tree [vlan <number> active [detail] command:
| ALS1#show spanning-tree vlan 100 active
VLAN0100 Bridge ID Priority 100 (priority 0 sys-id-ext 100) Interface Role Sts Cost Prio.Nbr Type |
Port Fa0/1 is irrelevent because it is connected to R1. To complete this task, simply enable the Root Guard feature on the remaining trunk ports:
| ALS1(config)#interface range fastethernet 0/7 – 8 , fastethernet 0/11 – 12 ALS1(config-if-range)#spanning-tree guard root ALS1(config-if-range)#exit |
To test Root Guard, you can increase the priority on ALS1 to 4096, for example, and configure a priority of 0 on either DLS1 or ALS2. This will result in the following error message:
| 06:00:49: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port FastEthernet0/7 on VLAN0100. |
Also, use the show spanning-tree inconsistentports to determine which switch the ports have been placed into an inconsistent state (Root Guard or Loop Guard) by the switch:
| ALS1#show spanning-tree inconsistentports
Name Interface Inconsistency Number of inconsistent ports (segments) in the system : 2 |
Task 4
To complete this task, you need to use the port-channel load-balance command on switches DLS1 and DLS2. Next, implement BPDU Guard on the ports that routers are connected to switch ALS1. Finally, enable the err-disable recovery for BPDU Guard and specify the timer. Complete the first part of this task by configuring switches DLS1 and DLS2 as follows:
| DLS1(config)#port-channel load-balance dst-mac |
| DLS2(config)#port-channel load-balance dst-mac |
Verify load balancing using the show etherchannel load-balance command:
| DLS1#show etherchannel load-balance EtherChannel Load-Balancing Configuration: dst-mac EtherChannel Load-Balancing Addresses Used Per-Protocol: |
Complete the second part of this task by configuring switch ALS1 as follows:
| ALS1(config)#interface range fastethernet 0/1 , fastethernet 0/3 – 4 ALS1(config-if-range)#spanning-tree bpduguard enable ALS1(config-if-range)#exit ALS1(config)#errdisable recovery cause bpduguard ALS1(config)#errdisable recovery interval 600 |
Verify BPDU Guard configuration using the show spanning-tree interface <name> detail command on switch ALS1:
| ALS1#show spanning-tree interface fastethernet 0/1 detail Port 1 (FastEthernet0/1) of VLAN0100 is forwarding Port path cost 19, Port priority 128, Port Identifier 128.1. Designated root has priority 100, address 0007.8432.dd00 Designated bridge has priority 100, address 0007.8432.dd00 Designated port id is 128.1, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Bpdu guard is enabled BPDU: sent 3148, received 0 |
Use the show errdisable commands to verify the errdisable recovery reasons and intervals:
| ALS1#show errdisable recovery ErrDisable Reason Timer Status —————– ————– udld Disabled bpduguard Enabled security-violatio Disabled channel-misconfig Disabled vmps Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled psecure-violation Disabled gbic-invalid Disabled dhcp-rate-limit Disabled unicast-flood Disabled loopback Disabled Timer interval: 600 seconds Interfaces that will be enabled at the next timeout: |
Task 5
The requirements of this task are straightforward. To enable NSF for BGP, you need to enable the bgp graceful-restart command on all devices under BGP configuration:
| R1(config)#router bgp 1 R1(config-router)#bgp router-id 1.1.1.1 R1(config-router)#neighbor 150.1.1.253 remote-as 1 R1(config-router)#neighbor 150.1.1.254 remote-as 1 R1(config-router)#bgp graceful-restart R1(config-router)#exit |
| DLS1(config)#router bgp 1 DLS1(config-router)#bgp router-id 150.1.1.254 DLS1(config-router)#neighbor 150.1.1.1 remote-as 1 DLS1(config-router)#neighbor 150.1.1.253 remote-as 1 DLS1(config-router)#bgp graceful-restart DLS1(config-router)#exit |
| DLS2(config)#router bgp 1 DLS2(config-router)#bgp router-id 150.1.1.253 DLS2(config-router)#neighbor 150.1.1.1 remote-as 1 DLS2(config-router)#neighbor 150.1.1.254 remote-as 1 DLS2(config-router)#bgp graceful-restart DLS2(config-router)#exit |
Verify the BGP peering configuration using the show ip bgp summary command:
| R1#show ip bgp summary BGP router identifier 1.1.1.1, local AS number 1 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
| DLS1#show ip bgp summary BGP router identifier 150.1.1.254, local AS number 1 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
| DLS2#show ip bgp summary BGP router identifier 150.1.1.253, local AS number 1 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
Verify BGP NSF configuration using the show ip bgp neighbors <address> command:
| R1#show ip bgp neighbors BGP neighbor is 150.1.1.253, remote AS 1, internal link BGP version 4, remote router ID 150.1.1.253 BGP state = Established, up for 00:02:26 Last read 00:00:23, last write 00:00:26, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Graceful Restart Capability: advertised Message statistics: InQ depth is 0 OutQ depth is 0 Sent Rcvd Opens: 1 1 Notifications: 0 0 Updates: 0 0 Keepalives: 5 4 Route Refresh: 0 0 Total: 6 5 Default minimum time between advertisement runs is 0 seconds [Truncated Output] |
Task 6
Please refer to previous tasks for basic OSPF configuration. Following this, use the show ip ospf neighbor command to verify adjacencies:
| R1#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface |
| R2#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface |
| R3#show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface |
Next, verify routing using the show ip route command on all three routers:
| R1#show ip route ospf 150.0.0.0/30 is subnetted, 3 subnets O 150.0.0.8 [110/845] via 150.0.0.6, 00:00:11, Serial0/1 150.2.0.0/24 is subnetted, 1 subnets O 150.2.2.0 [110/65] via 150.0.0.2, 00:00:11, Serial0/0 |
| R2#show ip route ospf 150.0.0.0/30 is subnetted, 3 subnets O 150.0.0.4 [110/845] via 150.0.0.10, 00:00:23, Serial0/1 |
| R3#show ip route ospf 150.0.0.0/30 is subnetted, 4 subnets O IA 150.0.0.0 [110/845] via 150.0.0.9, 00:00:34, Serial1/1 [110/845] via 150.0.0.5, 00:00:34, Serial1/0 150.2.0.0/24 is subnetted, 1 subnets O IA 150.2.2.0 [110/782] via 150.0.0.9, 00:00:34, Serial1/1 |
Task 7
This task has several requirements. First, you must configure the specified Loopback interfaces and advertise them via BGP. Next, you need to configure BGP between R1 and R4. You must include the neighbor <address> ebgp-multihop command in addition to specifying the Loopback interfaces as update sources. Following that, you need to adhere to the restrictions while ensuring that the BGP session can also be established. This task is completed as follows:
| R1(config)#interface loopback 0 R1(config-if)#ip address 1.1.1.1 255.255.255.255 R1(config-if)#exit R1(config)#router bgp 1 R1(config-router)#neighbor 4.4.4.4 remote-as 4 R1(config-router)#neighbor 4.4.4.4 update-source loopback 0 R1(config-router)#neighbor 4.4.4.4 ebgp-multihop R1(config-router)#exit R1(config-router)#route-map LOOPBACK0 permit 10 R1(config-route-map)#match interface loopback 0 R1(config-route-map)#exit R1(config)#router ospf 1 R1(config-router)#redistribute connected subnets route-map LOOPBACK0 R1(config-router)#exit |
| R3(config)#ip route 4.4.4.4 255.255.255.255 serial 1/2 R3(config)#router ospf 3 R3(config-router)#redistribute static subnets R3(config-router)#exit |
| R4(config)#interface loopback 0 R4(config-if)#ip address 4.4.4.4 255.255.255.255 R4(config-if)#exit R4(config)#ip route 1.1.1.1 255.255.255.255 serial 0/0 R4(config)#router bgp 4 R4(config-router)#bgp router-id 4.4.4.4 R4(config-router)#neighbor 1.1.1.1 remote-as 1 R4(config-router)#neighbor 1.1.1 update-source loopback 0 R4(config-router)#neighbor 1.1.1.1 ebgp-multihop R4(config-router)#exit |
Following this, verify BGP peering using the show ip bgp summary command:
| R1#show ip bgp summary BGP router identifier 1.1.1.1, local AS number 1 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
| R4#show ip bgp summary BGP router identifier 4.4.4.4, local AS number 4 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
Task 8
This task is straightforward. Verify your BGP RIBs using the show ip bgp command:
| DLS1#show ip bgp BGP table version is 24, local router ID is 150.1.1.254 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| DLS2#show ip bgp BGP table version is 8, local router ID is 150.1.1.253 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| R1#show ip bgp BGP table version is 10, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| R4#show ip bgp BGP table version is 6, local router ID is 4.4.4.4 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
Task 9
This task is not as complex as it might appear if you have a good understanding of BGP and IP routing in general. First, because switches DLS1 and DLS2 do not know about the 4.4.4.4/32 prefix, they will show the route received from R4 as inaccessible. This can be verified as follows:
| DLS1#show ip bgp 10.4.4.0 255.255.255.0 BGP routing table entry for 10.4.4.0/24, version 24 Paths: (1 available, no best path) Not advertised to any peer 4 4.4.4.4 (inaccessible) from 150.1.1.1 (1.1.1.1) Origin IGP, metric 0, localpref 100, valid, internal |
| DLS2#show ip bgp 10.4.4.0 255.255.255.0 BGP routing table entry for 10.4.4.0/24, version 8 Paths: (1 available, no best path) Not advertised to any peer 4 4.4.4.4 (inaccessible) from 150.1.1.1 (1.1.1.1) Origin IGP, metric 0, localpref 100, valid, internal |
To resolve this, you will need to modify the BGP NEXT_HOP attribute on R1 so that this field is updated to reflect R1 as the NEXT_HOP instead.
Second, while BOTH the 100.1.1.0/24 and 200.2.2.0/24 prefixes are advertised by R1 to R4, the 150.1.1.0/24 prefix is not. This means that we will instead need to advertise a default route to router R2 and R3 via OSPF. This will allow these routers to forward packets destined to this subnet to R1 – where the subnet resides.
Third, we also need to advertise a default route via BGP to R4. This will allow R4 to reach the 150.1.1.0/24 subnet (via R3). And finally, we are allowed to use a single static route on either R1 or R3. We will choose to use this on R3 and configure a static route for the 10.1.1.0/24 prefix. This prefix will then be redistributed into OSPF, allowing all routers to know about the location of this subnet. This task is therefore completed as follows:
| R1(config)#router bgp 1 R1(config-router)#neighbor 150.1.1.253 next-hop-self R1(config-router)#neighbor 150.1.1.254 next-hop-self R1(config-router)#neighbor 4.4.4.4 default-originate R1(config-router)#exit R1(config)#router ospf 1 R1(config-router)#default-information originate always R1(config-router)#exit |
| R3(config)#ip route 10.4.4.0 255.255.255.0 serial 1/2 R3(config)#end R3#clear ip ospf redistribution |
Following this, verify the routing tables of all devices using the show ip route command:
| R1#show ip route Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2 E1 – OSPF external type 1, E2 – OSPF external type 2 i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2 ia – IS-IS inter area, * – candidate default, U – per-user static route o – ODR, P – periodic downloaded static route Gateway of last resort is not set 1.0.0.0/32 is subnetted, 1 subnets |
| R2#show ip route ospf 1.0.0.0/32 is subnetted, 1 subnets O E2 1.1.1.1 [110/20] via 150.0.0.1, 00:18:22, Serial0/0 4.0.0.0/32 is subnetted, 1 subnets O E2 4.4.4.4 [110/20] via 150.0.0.10, 00:01:27, Serial0/1 10.0.0.0/24 is subnetted, 1 subnets O E2 10.4.4.0 [110/20] via 150.0.0.10, 00:01:27, Serial0/1 150.0.0.0/30 is subnetted, 3 subnets O 150.0.0.4 [110/845] via 150.0.0.10, 00:18:22, Serial0/1 O*E2 0.0.0.0/0 [110/1] via 150.0.0.1, 00:03:20, Serial0/0 |
| R3#show ip route ospf 1.0.0.0/32 is subnetted, 1 subnets O E2 1.1.1.1 [110/20] via 150.0.0.5, 00:20:38, Serial1/0 150.0.0.0/30 is subnetted, 4 subnets O IA 150.0.0.0 [110/845] via 150.0.0.9, 00:20:48, Serial1/1 [110/845] via 150.0.0.5, 00:20:48, Serial1/0 150.2.0.0/24 is subnetted, 1 subnets O IA 150.2.2.0 [110/782] via 150.0.0.9, 00:20:48, Serial1/1 O*E2 0.0.0.0/0 [110/1] via 150.0.0.5, 00:05:46, Serial1/0 |
| R4#show ip route Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2 E1 – OSPF external type 1, E2 – OSPF external type 2 i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2 ia – IS-IS inter area, * – candidate default, U – per-user static route o – ODR, P – periodic downloaded static route Gateway of last resort is 1.1.1.1 to network 0.0.0.0 1.0.0.0/32 is subnetted, 1 subnets |
Following this, verify end-to-end connectivity using the extended ping function on all devices:
| R1#ping 10.4.4.4 source 150.1.1.1 size 1500 repeat 10
Type escape sequence to abort. |
| DLS1#ping 10.4.4.4 source 100.1.1.1 size 1500 repeat 10
Type escape sequence to abort. |
| DLS2#ping 10.4.4.4 source 200.2.2.2 size 1500 repeat 10
Type escape sequence to abort. |
Task 10
Unlike static tunnel configuration, 6to4 tunneling has three main characteristics, which make it unique from static tunnel implementation. These characteristics are:
- Automatic or Dynamic Tunneling
- Automatic Prefix Assignment
- There is no IPv6 Route Propagation
6to4 automatic tunneling provides a dynamic method to deploy tunnels between IPv6 sites over IPv4 networks. Unlike with manually configured tunnels, there is no need to manually configure tunnel source and destination addresses to establish the tunnels. Instead, the tunneling of IPv6 packets between 6to4 sites is performed dynamically based on the destination IPv6 address of the packets originated by IPv6 hosts. These packets are then encapsulated in IPv4 and IPv4 routing protocols are used to transport the packets between the source and destination hosts.
Automatic prefix assignment provides a global aggregate IPv6 prefix to each 6to4 site which is based on the 2002::/16 prefix assigned by IANA for 6to4 sites. As stated earlier in this section, the tunnel endpoint, or destination is determined by the globally unique IPv4 address embedded in a 6to4 address. This address must be an address that is globally routable. In other words, RFC 191 (private IP addresses) cannot be used for 6to4 tunnels because they are not unique. This 32-bit IPv4 address is converted to Hexadecimal and the final representation is a 48-bit prefix. For example, if the IP address 1.1.1.1 was embedded into the IPv6 6to4 prefix, the final representation would be 2002:0101:0101::/48.
And finally, 6to4 tunneling uses special addresses which are a combination of the unique IPv6 routing prefix 2002::/16 and a globally unique 32-bit IPv4 address. With 6to4 tunneling, the tunnel endpoint (destination) is determined by the globally unique IPv4 address embedded in the 6to4 address. Because 6to4 prefixes are based on unique IPv4 address, the 48-bit IPv6 routes do not need to be propagated between 6to4 sites. This task is completed as follows:
| R2(config)#interface loopback 0 R2(config-if)#ip address 2.2.2.2 255.255.255.255 R2(config-if)#exit R2(config)#router ospf 2 R2(config-router)#redistribute connected subnets R2(config-router)#exit R2(config)#ipv6 unicast-routing R2(config)#ip cef R2(config)#interface fastethernet 0/0 R2(config-if)#ipv6 address 2002:202:202:2::2/64 R2(config-if)#exit R2(config)#interface tunnel 0 R2(config-if)#ipv6 unnumbered fastethernet 0/0 R2(config-if)#tunnel source loopback 0 R2(config-if)#tunnel mode ipv6ip 6to4 R2(config-if)#exit R2(config)#ipv6 route 2002::/16 tunnel 0 R2(config)#exit |
| R3(config)#interface loopback 0 R3(config-if)#ip address 3.3.3.3 255.255.255.255 R3(config-if)#exit R3(config)#router ospf 3 R3(config-router)#network 3.3.3.3 0.0.0.0 area 0 R3(config-router)#exit R3(config)#ipv6 unicast-routing R3(config)#ip cef R3(config)#interface fastethernet 0/0 R3(config-if)#ipv6 address 2002:303:303:3::3/64 R3(config-if)#exit R3(config)#interface tunnel 0 R3(config-if)#ipv6 unnumbered fastethernet 0/0 R3(config-if)#tunnel source loopback 0 R3(config-if)#tunnel mode ipv6ip 6to4 R3(config-if)#exit R3(config)#ipv6 route 2002::/16 tunnel 0 R3(config)#exit |
Verify your IPv6 addressing using the show ipv6 interface command on both routers:
| R2#show ipv6 interface fastethernet 0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::20D:28FF:FE9E:F940 Global unicast address(es): 2002:202:202:2::2, subnet is 2002:202:202:2::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:2 FF02::1:FF9E:F940 MTU is 1500 bytes [Truncated Output] |
| R3#show ipv6 interface fastethernet 0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::213:7FFF:FEAF:3E00 Global unicast address(es): 2002:303:303:3::3, subnet is 2002:303:303:3::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:3 FF02::1:FFAF:3E00 MTU is 1500 bytes [Truncated Output] |
| R2#show ipv6 interface tunnel 0 Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::202:202 Interface is unnumbered. Using address of FastEthernet0/0 No global unicast address is configured Joined group address(es): FF02::1 FF02::2 FF02::1:FF02:202 MTU is 1480 bytes [Truncated Output] |
| R3#show ipv6 interface tunnel 0 Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::303:303 Interface is unnumbered. Using address of FastEthernet0/0 No global unicast address is configured Joined group address(es): FF02::1 FF02::2 FF02::1:FF03:303 MTU is 1480 bytes [Truncated Output] |
Next, verify IPv6 routing using the show ipv6 route command on both routers:
| R2#show ipv6 route IPv6 Routing Table – 5 entries Codes: C – Connected, L – Local, S – Static, R – RIP, B – BGP U – Per-user Static route I1 – ISIS L1, I2 – ISIS L2, IA – ISIS interarea, IS – ISIS summary O – OSPF intra, OI – OSPF inter, OE1 – OSPF ext 1, OE2 – OSPF ext 2 ON1 – OSPF NSSA ext 1, ON2 – OSPF NSSA ext 2 S 2002::/16 [1/0] via ::, Tunnel0 C 2002:202:202:2::/64 [0/0] via ::, FastEthernet0/0 L 2002:202:202:2::2/128 [0/0] via ::, FastEthernet0/0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 |
| R3#show ipv6 route IPv6 Routing Table – 5 entries Codes: C – Connected, L – Local, S – Static, R – RIP, B – BGP U – Per-user Static route I1 – ISIS L1, I2 – ISIS L2, IA – ISIS interarea, IS – ISIS summary O – OSPF intra, OI – OSPF inter, OE1 – OSPF ext 1, OE2 – OSPF ext 2 ON1 – OSPF NSSA ext 1, ON2 – OSPF NSSA ext 2 S 2002::/16 [1/0] via ::, Tunnel0 C 2002:303:303:3::/64 [0/0] via ::, FastEthernet0/0 L 2002:303:303:3::3/128 [0/0] via ::, FastEthernet0/0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 |
Finally, verify LAN-to-LAN connectivity between the IPv6 subnets using an extended ping:
| R2#ping 2002:303:303:3::3 source fastethernet 0/0 repeat 10 size 1500
Type escape sequence to abort. |
| R3#ping 2002:202:202:2::2 source fastethernet 0/0 repeat 10 size 1500
Type escape sequence to abort. |
Task 11
To complete this task, you need to configure a NAT pool using the 150.1.1.0/24 subnet. In order to allow reachability to this subnet, without creating an additional interface, you need to configure a static route pointing to Null0 and advertise it via OSPF. Complete this as follows:
| R3(config)#ip route 150.3.3.0 255.255.255.0 null 0 R3(config)#$at pool R3-LAN-POOL 150.3.3.1 150.3.3.254 netmask 255.255.255.0 R3(config)#access-list 100 permit ip 10.3.3.0 0.0.0.255 150.1.1.0 0.0.0.255 R3(config)#access-list 100 permit ip 10.3.3.0 0.0.0.255 150.2.2.0 0.0.0.255 R3(config)#ip nat inside source list 100 pool R3-LAN-POOL R3(config)#interface fastethernet 0/0 R3(config-if)#ip nat inside R3(config-if)#exit R3(config)#interface serial 1/0 R3(config-if)#ip nat outside R3(config-if)#exit R3(config)#interface serial 1/1 R3(config-if)#ip nat outside R3(config-if)#exit R3(config)#end R3#clear ip ospf redistribution |
Following this configuration, ping from R3s LAN subnet to 150.1.1.0/24 and 150.2.2.0/24:
| ALS2#ping 150.1.1.1
Type escape sequence to abort. |
| ALS2#ping 150.2.2.2
Type escape sequence to abort. |
Finally, verify NAT operation using the show ip nat translations command on R3:
| R3#show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 150.3.3.1:4484 10.3.3.254:4484 150.1.1.1:4484 150.1.1.1:4484 icmp 150.3.3.1:4485 10.3.3.254:4485 150.1.1.1:4485 150.1.1.1:4485 icmp 150.3.3.1:4486 10.3.3.254:4486 150.1.1.1:4486 150.1.1.1:4486 icmp 150.3.3.1:4487 10.3.3.254:4487 150.1.1.1:4487 150.1.1.1:4487 icmp 150.3.3.1:4488 10.3.3.254:4488 150.1.1.1:4488 150.1.1.1:4488 icmp 150.3.3.1:7980 10.3.3.254:7980 150.2.2.2:7980 150.2.2.2:7980 icmp 150.3.3.1:7981 10.3.3.254:7981 150.2.2.2:7981 150.2.2.2:7981 icmp 150.3.3.1:7982 10.3.3.254:7982 150.2.2.2:7982 150.2.2.2:7982 icmp 150.3.3.1:7983 10.3.3.254:7983 150.2.2.2:7983 150.2.2.2:7983 icmp 150.3.3.1:7984 10.3.3.254:7984 150.2.2.2:7984 150.2.2.2:7984 |
Final Router Configurations
R1
| R1#term len 0 R1#sh run Building configuration… Current configuration : 1662 bytes R1# |
R2
| R2#term len 0 R2#sh run Building configuration… Current configuration : 1351 bytes R2# |
R3
|
R3#term len 0 Current configuration : 2126 bytes R3# |
R4
|
R4#term len 0 Current configuration : 1146 bytes R4# |
Final Switch Configurations
DLS1
|
DLS1#term len 0 Current configuration : 4993 bytes DLS1# |
DLS2
|
DLS2#term len 0 Current configuration : 6603 bytes DLS2# |
ALS1
|
ALS1#term len 0 Current configuration : 1654 bytes ALS1# |
ALS2
|
ALS2#term len 0 Current configuration : 1135 bytes ALS2# |