Lab Objective:
The focus of this lab is to understand how to implement and verify MLS, routed EtherChannels as well as some of the different Cisco IOS Catalyst series switch security features.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please begin each and every lab by shutting down all interfaces on all switches and then manually re-enabling only the interfaces that are illustrated in this topology. |
Task 1
Disable VTP on all switches. All switches should support the configuration, modification and deletion of VLANs.
Task 2
Configure the following VLANs on the switches:
DLS1 and ALS1: VLAN 100
DLS2 and ALS2: VLAN 200
Configure the following SVIs on the switches:
DLS1 SVI 100 – IP Address 100.1.1.1/30
ALS1 SVI 100 – IP Address 100.1.1.2/30
DLS2 SVI 200 – IP Address 200.1.1.1/30
ALS2 SVI 200 – IP Address 200.1.1.2/30
Switches ALS1 and ALS2 should have their default gateway point to switches DLS1 and DLS2 respectively. There should be no default gateway configured on switches DLS1 and DLS2.
Task 3
Configure the ports between the access and distribution layer switches as static access ports. These should be assigned to the VLANs configured on the switches. Configure a routed EtherChannel between DLS1 and DLS2. Use any channel protocol. Assign switch DLS1 IP address 172.16.1.1/30 and switch DLS2 IP address 172.16.1.2/30.
Task 4
Using a routing protocol of your choice, configure switches DLS1 and DLS2 so that switches ALS1 and ALS2 have IP connectivity to each other. For efficiency, enable CEF. Verify your configuration and validate connectivity using PING and Telnet.
Task 5
At the VLAN level, implement filtering for VLAN 100 as follows:
- Drop all TCP packets
- Drop all UDP packets
- Forward all other non-IP packets
- Forward all other IP packets
At the VLAN level, implement filtering for VLAN 200 as follows:
- Forward all ICMP packets
- Forward all MAC packets from the MAC address of ALS2
- Drop all other IP packets
- Drop all other non-IP packets
Verify that you can still ping between switches ALS1 and ALS2; however, you should not be able to Telnet between switches ALS1 and ALS2. Verify your configuration.
Task 6
Configure Dynamic ARP Inspection for VLAN 100 such that the switch compares the ARP body for invalid and unexpected IP addresses, which includes 0.0.0.0, 255.255.255.255, all IP Multicast addresses, and a valid source MAC and explicitly denies them. Allow logging for DAI. Verify that switch ALS1 can still ping switch ALS2 after this configuration.
Task 7
In order to mitigate against Broadcast attacks, configure the access ports on switches DLS1 and DLS2 to monitor inbound packets and shut them down if Broadcast traffic exceeds 10% of the physical port bandwidth. Verify your configuration using relevant commands on the switches.