CCIE Routing and Switching LAB
Ver:N4
Summary v3.0
Section 1: Bridging and Switching
All devices’ Loopback 0 is Y.Y.x.x/24
Troubleshooting:
预配错R1 的g0/1口有1个IP,要no ip address；交换机的双工配置等。
Vlan创建以及端口划分都已经预先配置好，只要用show命令检查一下是否正确即可，还有帧中继题目明确说明需要ping通自己，预先配置了帧中继封装的接口都是用ietf以及ansi，配置默认的能够通就好了。
下面是实验室交换机VLAN划分:
1.1 Frame-relay
●Configure IP across your frame relay network
●The frame could provide for you is fully meshed. However you must only use the PVC's
indicated on Diagram user of any dynamic circuits is not permitted.
●Do not use sub-interfaces for the frame relay links on all routers
●Ensure you can ping all frame relay interfaces (include self)
Solution:
R1:
int s0/0
en fram
no arp fram
no fram inver
ip add YY.YY.13.1 255.255.255.0
fram map ip YY.YY.13.3 103 br
fram map ip YY.YY.13.1 103 br
====================================
R3:
int s0/0
enca fram
no arp fram
no fram inver
ip add YY.YY.13.3 255.255.255.0
fram map ip YY.YY.13.1 301 br
fram map ip YY.YY.13.3 301 br
====================================
R6:
int s0/1
enca fram
no arp fram
no fram inver
ip add YY.YY.26.6 255.255.255.0
fram map ip YY.YY.26.2 612 br
fram map ip YY.YY.26.6 612 br
====================================
R2:
int s0/1
enca frma
no arp fram
no fram inver
ip add YY.YY.26.2 255.255.255.0
fram map ip YY.YY.26.6 216 br
fram map ip YY.YY.26.2 216 br
int s0/0
enca fram
no arp fram
no fram inver
ip add YY.YY.245.2 255.255.255.0
fram map ip YY.YY.245.5 205 br
fram map ip YY.YY.245.4 205 br
fram map ip YY.YY.245.2 205 br
=====================================
\\切记，如果R4与R5是否预配置好了，帧中继的封装类型、LMI类型都是必须要注意的。R5:
int s0/0
enca fram
no arp fram
no fram inver
ip add YY.YY.245.5 255.255.255.0
fram map ip YY.YY.245.2 502 br
fram map ip YY.YY.245.4 504 br
fram map ip YY.YY.245.5 504 br
==================================
R4:
int s0/0
enca fram
no arp fram
no fram inver
ip add YY.YY.245.4 255.255.255.0
fram map ip YY.YY.245.5 405 br
fram map ip YY.YY.245.2 405 br
fram map ip YY.YY.245.4 405 br
1.2 VTP
●Domain: RackYY
●Password: cisco
●SW1 will propagated all VLAN configuration changes to SW2 SW 3 SW4
●In the future these four Switches will be configured as VTP transparent mode. They
shouldn’t inspect the VTP domain name and version, and they support unrecognized TLV.
Solution:
SW1:
vtp domain RackYY
vtp password cisco
vtp version 2
vtp mode server
================================
SW2/SW3/SW4:
vtp domain RackYY
vtp password cisco
vtp mode client
\\vtp version 2只需要在Server端或透明模式下配置
\\VTP version 2具有V1所不支持的以下特性：
（1）支持Token Ring
（2）支持未识别的TLV（Type-Length-Value）。VTP 服务器或客户端可以将它的配置改变传递给它的另外的Trunk，甚至TLV不能解析的。当交换机处于VTP服务器模式下，未识别的TLV 保存在NVRAM中。
（3）依靠版本的透明模式。在VTP版本1中，VTP透明交换机检测VTP 域名、版本号信息，并且仅当这些信息匹配的情况下才进行转发。由于VTP V2仅支持一个域，它在透明模式下转发VTP信息而不需要检测版本号及域名。
（4）一致性检测。在VTP V2模式下，仅当你通过CLI或SNMP输入新的信息时才执行一致性检测。当从一个VTP消息中获取或从NVRAM中读出信息时，一致性检测并不会执行。
如果在接收到VTP消息时，MD5散列信息正确，这样的信息就会被接收。
1.3 Trunk
●Trunk among four Switches
●Trunk will be formed unconditionally use ISL choose encapsulation
●Create area Trunk between R6 and SW2, only VLAN BB3 and VLAN B must be allow
in the Trunk
Solution:
\\看清题目，是否不需要的TRUNK口是否要关闭
SW1/SW2/SW3/SW4:
int range fa0/19 - 20,fa0/23 – 24
sw trunk encap isl
sw mode trunk
=================================
SW2:
int fa0/6
sw trunk enca dot1q
sw trunk allow vlan 13,22
sw mode trunk
-------------------------------------------------
R6:
int fa0/1
no ip address
no shut
int fa0/1.13
encap dot1q 13 要用ISL
ip add 150.3.yy.1 255.255.255.0
int fa0/1.22
encap dot1q 22
ip add YY.YY.62.6 255.255.255.0
1.4 Switch Management
●configure SW1’s f0/3 f0/6 as routed port
●Configure area VLAN subnet Y.Y.90.0/24 includes Switches only SW1, SW2, SW3,
SW4
Solution:
SW1:
ip routing
int fa0/3 \\TO R3 f0/0
no sw
ip add YY.YY.33.7 255.255.255.0
int f0/6 \\TO R6 F0/0
no sw
ip add YY.YY.36.7 255.255.255.0
int vlan 100
ip add YY.YY.90.7 255.255.255.0
====================================
SW2:
ip routing
int vlan 100
ip add YY.YY.90.8 255.255.255.0
====================================
SW3:
ip routing
int vlan 100
ip add YY.YY.90.9 255.255.255.0
====================================
SW4:
ip routing
int vlan 100
ip add YY.YY.90.10 255.255.255.0
1.5 Support overlapping VLAN
customer_1 \\如果预配置没有创建，就需要在SW1上先配置
SW1 connects with FastEthernet0/5
SW2 connects with FastEthernet0/3
Assure that the two Switches both customer_1 as MTU 1500 bytes
Do not configure the command “ip mtu ” under SW1 f0/5 SW2 f0/3
\\新需求明确说明不让修改MTU，更不能重启了
Solution:
SW1:
int fa0/5
sw access vlan 50
sw mode dot1q-tunnel
no shut
================================
SW2:
int fa0/3
sw access vlan 50
sw mode dot1q-tunnel
no shut
\\使用show dot1q-tunnel 验证
SW1-SW4:
System mtu 1504
还要在R6、R3与SW1直连接口下输入：ip ospf mtu-ignore 修改MTU命令必须重启才生效
1.6 Ether-Channels
●SW1-4’s Et her-Channels will be formed unconditional without using any protocol
negotiation
Solution:
\\题目明确要求不让使用任何协议进行协商，当然就要静态配置了。
SW1:
int range fa0/23 – 24
chan 12 mode on
int range fa0/19 – 20
chan 13 mode on
================================
SW2:
int range fa0/23 – 24
chan 12 mode on
int range fa0/19 – 20
chan 24 mode on
================================
SW3:
int range fa0/19 – 20
chan 13 mode on
int range fa0/23 – 24
chan 34 mode on
================================
SW4:
int range fa0/19 – 20
chan 24 mode on
int range fa0/23 – 24
chan 34 mode on
1.7 Ether-Channels load- balance
●R4 is sending packets to many hosts on VLAN_BB2
●Configure SW1 SW2 so that the traffic is efficiently distributed across the physical links Solution:
SW1:
port-channel load-balance dst-mac
\\要保证的R4到VLAN——BB2和这一条线的负载
过去的流量到VLAN——BB2的N多主机所以要基于目的
===========================================
SW2:
port-channel load-balance src- mac
\\过来流量是反过来的
1.8 MST
●Spanning-tree of VLAN 11, 21, 100
●The VLANs with ports assign on only one Switch share one common Spanning-tree
●The VLANs with ports assign to more than one Switch share another tree for each tree ●The Switch with the highest number as the root Switch, all other VLANs share default
instance
Solution:
\\题目意思是让对VLAN 11，21，100三个VLAN配置MSTP，将端口指派到一个交换机上的VLAN为一个实例，将端口指派到不同的交换机的同一个VLAN为第二个实例，因此可以看出VLAN 11，21的端口没有跨交换机，VLAN100则是跨交换机的。第二问其实是配置根交换机。
SW1/SW2/SW3/SW4:
spanning-tree mst configuration
name cisco
revision 1
instance 1 vlan 11,21
instance 2 vlan 100
spanning-tree mode mst
================================
SW1:
spanning-tree mst 1 root primary
SW4:
spanning-tree mst 2 root primary
1.9 UDLD
●To avoid Spanning-tree topology loops that caused by area bad-cable between SW3
SW4
●Configure your Switches so that the affected ports are disabled if area unidirectional
link is detected
Solution:
SW3/SW4:
int range fa0/23– 24
udld port aggressive
\\注：UDLD（unidirctional link detection）单向链路检测，用于检测下列情况：
链路一端可以收到另一端发送过来包，但是另一端却收不到本端发送出去的数据包。
UDLD的两种工作模式：
（1）Normal mode
用于检测光纤，当检测到单向链路存在的时候，将该端口标记为undetermined.
（2）Aggressive mode
用于检测光纤为双胶线，当检测到单向链路存在的时候，将该端口标记为shutdown 配置方式：
Udld enable \\将所有端口设为normal mode
Udld aggressive \\将所有端口设为aggressive mode
1.10 Flow-control
●Sometimes hosts on VLAN_C are sending very heavy traffic to R2, so that R2 dropping
packets. Configure SW1 so that it can receive instruction from R2 to stop sending packet
●You do not have to configure R2
Solution:
SW1:
no mls qos
int fa0/2
flowcontrol receive on
\\注：flowcotrol为congestion控制技术，通过在一条congestion的链路上相互发送
pause-frame（此frame用来指明链路已经发生congestion），可以使对方停止在
congestion的链路上发送或者接收包。
Flowcontrol receive on \\打开接收pause-frame的功能
Flowcontrol receive off \\关闭接收pause-frame的功能
Flowcontrol send on \\打开发送pause-frame的功能
Flowcontrol send off \\关闭发送pause-frame的功能
1.11 Storm-control
●Configure SW1 FastEthernet0/10
●When the flood reach 85% bandwidth traffic will block when drop to 60% begin forward Solution:
\\我觉得题目应该指明是哪种流量，广播还是组播
SW1:
int fa0/10
storm-control broadcast level 85 60
1.12 Root bridge
●Configure SW2 so that the device will be the root for VLAN_ BB2
Solution:
SW2:
spanning-tree mst 0 root primary
1.13 Mac-address aging time
●Configure SW4 so that the Mac-address aging time is 500 seconds for VLAN BB3 Solution:
SW4:
mac-address-table aging-time 500 vlan 13
Section 2: IP IGP Protocols
当完成IGP后，从全网内任何设备都可以ping通BB1，BB3
2.1 RIP v2
●Don’t use multicast to propagate RIP routes
●No subnet aggregated
●RIP update only sends to RIP-enabled interfaces
Solution:
\\题目要求不让使用组播，当然就要使用单播方式。查看了一下资料要启用passive接口R1：
int s0/0
ip split-horizon \\默认情况下，FR是关闭水平分割的
router rip
ver 2
no auto
passive default
nei 150.1.YY.254
nei YY.YY.13.3
net 150.1.0.0
net YY.0.0.0
===============================
R3:
int s0/0
ip split-horizon
router rip
version 2
no auto
pass default
nei YY.YY.13.1
net YY.0.0.0
2.2 OSPF area 26
●Conserve bandwidth and shorten OSPF adjacency establishment time by avoiding DR
election
Solution:
\\要求不进行DR的选举，当然是要配置点到点的类型。但这个地方要注意，以太网接口需不需要配置OSPF网络类型?据新战报，以太不需要加
R2：
int s0/1
ip ospf network point-to-point
int f0/1
router ospf YY
router-id YY.YY.2.2
net YY.YY.26.2 0.0.0.0 area 26
net YY.YY.62.2 0.0.0.0 area 26
==============================
R6:
int s0/1
ip ospf network point-to-point
int f0/1.1
router ospf YY
router-id YY.YY.6.6
net YY.YY.26.6 0.0.0.0 area 26
net YY.YY.62.6 0.0.0.0 area 26
2.3 OSPF area 0
Don’t change network type, R5 must be DR
Solution:
\\不允许修改网络类型，帧中继接口默认类型为NON-BROADCAST，因此要配置neighbor 命令；另外由于area 0被分割，所以需要配置virtual-link
R5:
int s0/0
ip ospf priority 255
router ospf YY
router-id YY.YY.5.5
net YY.YY.245.5 0.0.0.0 area 0 \\ R5的loopback口没有宣告进area0 nei YY.YY.245.2
nei YY.YY.245.4
===============================
R4:
route-map R4_CONN permit 10 \\为了保证全网可达，需对R4－BB2的IP重分布match interface fa0/0
int s0/0
ip ospf priority 0
router ospf YY
router-id YY.YY.4.4
net YY.YY.245.4 0.0.0.0 area 0 \\ R4的loopback口没有宣告进area0
redistribute connect subnet route-map R4_CONN
==============================
R2:
int s0/0
ip ospf priority 0
router ospf YY
router-id YY.YY.2.2
net YY.YY.245.2 0.0.0.0 area 0 \\ R2的loopback口没有宣告进area0 area 26 virtual-link YY.YY.6.6
==============================
R6:
Int f0/0
router ospf YY
router-id YY.YY.6.6
net YY.YY.36.6 0.0.0.0 area 0 \\ R6的loopback口没有宣告进area0
area 26 virtual-link YY.YY.2.2
==============================
SW1:
Int f0./6
router ospf YY
router-id YY.YY.7.7
net YY.YY.36.7 0.0.0.0 area 0
2.4 OSPF Stub
●Area 4 only default route OSPF injected
●OSPF default route into area 5 routing tables of any OSPF area 5 internal routers
should have the OSPF intra-area routes, but not the OSPF external routes Solution:
\\Area 4为完全末梢区域，不允许汇总LSA，题目明确要求了area 4只有默认路由注入；area 5不允许有外部路由，也就是不允许external LSA进入，但可以有域间路由，配置为stub区域。
R2:
router ospf YY
net YY.YY.21.2 0.0.0.0 area 4
area 4 stub no-summary
==============================
R5：
router ospf YY
net YY.YY.55.5 0.0.0.0 area 5
area 5 stub
==============================
R3:
Int f0/0
router ospf YY
router-id YY.YY.3.3
net YY.YY.33.3 0.0.0.0 area 3
==============================
SW1:
Int f0/3
router ospf YY
net YY.YY.33.7 0.0.0.0 area 3
2.5 Loopback 0
R3/SW1/R6/R2/R5/R4:
int lo 0
ip ospf network point-to-point
==================================
R3:
router ospf YY
net YY.YY.3.3 0.0.0.0 area 3
==================================
SW1:
router ospf YY
net YY.YY.7.7 0.0.0.0 area 3
==================================
R6:
router ospf YY
net YY.YY.6.6 0.0.0.0 area 26
==================================
R2:
router ospf YY
net YY.YY.2.2 0.0.0.0 area 4
==================================
R5:
router ospf YY
net YY.YY.5.5 0.0.0.0 area 5
==================================
R4:
router ospf YY
net YY.YY.4.4 0.0.0.0 area 0
2.6 EIGRP YY
●Interface VLAN 100 into EIGRP YY
●SW2 SW3 SW4 Loopback 0 into EIGRP YY
●BB3 in EIGRP 100
●R6 neighbor EIGRP 100 on VLAN BB3 will not send query to R6
\\BB3不能发送query到R6，就需要配置stub
Solution:
SW1/SW2/SW3/SW4:
router eigrp YY
no auto
net YY.YY.90.0 0.0.0.255
=============================
SW2/SW3/SW4:
router eigrp YY
net YY.YY.*.*(lo 0)
=============================
R6:
router eigrp 100
no auto
net 150.3.YY.0 0.0.0.255
eigrp stub connected summary redistributed \\不要少了此关键字，EI－OS重分布,保
证Redistributed的OSPF路由被传到
BB3
2.7 RIP&OSPF
●Perform mutual redistribution between RIP and OSPF
●Consolidate all RIP routes beginning with 199.172.X.X prefix as one route NOT /16
●When redistributing them into OSPF,R1 and R3 should still have on their routing-table
as 199.172.X.X all RIP routes
Solution:
\\需要双向重分布。首先将RIP重分布进入OSPF，并进行汇总,需求说不在RIP里汇总R3:
\\对从RIP进入OSPF的路由设置TAG,这一步跟下面的EIGRP有关联
ip prefix-list FROMR1 permit 150.100.YY.0/24
route-map SETTAG permit 10
match ip add prefix FROMR1
Set tag 20
route-map SETTAG permit 20
router ospf YY
redistribute rip subnets metric-type 1 route-map SETTAG
summary-address 199.172.0.0 255.255.224.0 tag 20 \\对汇总的也设置TAG
=====================================
R3:
\\重分布OSPF进入RIP，过滤掉汇总路由,这里是必需要完成的
Ip prefix-list SUM permit 199.172.0.0/19
Rotue-map R2O deny 10
Match ip add prefix-list SUM
Route-map R2O permit 20
router rip
redistribute ospf YY metric 1 route-map R2O \\这个metric一定不能少了，切记呀
2.8 Redistribute
●150.100.1.0 and 199.172 routes should not appear in the routing table of SW2 SW3
SW4
Redistribute OSPF into EIGRP YY. Don’t use route filter DO NOT use route filtering to perform this task(不能用access-list和prefix-list 方式的路由过滤)
Redistribute EIGRP 100 route 150.3.y.0 and 198.2.1/3/5.0 only into OSPF(with 2 ACL) Redistribute OSPF route YY.YY.6.0 YY.YY.90.0into EIGRP 100.Don’t use
distribute-list
Summary all 198.2 prefix route as one
Solution:
\\第一问OSPF-EIGRP YY，有3种解法
SW1:
redistribute ospf YY metric 10000 100 255 1 1500 route-map OSPF_EI
router ospf YY
redistribute eigrp YY subnets
=============================================
第二种：
Route-map tag per 10
Match tag 20
Set metric 0 -1 255 1 1500
Route-map tag per 20
Router eigrp YY
Redistribute ospf YY metric 10000 100 255 1 1500 route-map tag
Router ospf YY
Redistribute eigrp YY subnets
第三种：
在RIP进OSPF时，在OSPF中指定150.100.YY.0/24, 199.172.0.0/19 metric-type 为type-2,其他路由的metric-type 为type-1, 在SW1 重发布OSPF路由到EIGRP 路由时，只重发布metric-type为type-1的，从而达到过滤的目的。相关命令：
Router eigrp YY
Redistribute ospf YY metric 10000 100 255 1 1500 match internal external 1
\\第二问，R6上OSPF及EIGRP 100双向重分布
(1)首先将EIGRP 100重分布到OSPF中
R6:
access-list 6 permit 150.3.YY.0 0.0.0.255
access-list 6 permit 198.2.1.0 0.0.6.0
route-map E2O permit 10
match ip address 6
router ospf YY
summary-address 198.2.0.0 mask 255.255.248.0
redistribute eigrp 100 subnets metric-type 1 route-map E2O
(2)将OSPF重分布到EIGRP 100中
ip prefix-list TOEIGRP permit YY.YY.6.0
ip prefix-list TOEIGRP permit YY.YY.90.0
router-map O2E permit 10
match ip address prefix-list TOEIGRP
router eigrp 100
redistribute ospf YY metric 10000 1000 255 1 1500 route-map O2E
2.9 IPv6 address
●R2 Loopback 0 Serial 0/0
●R4 Loopback 0 Serial 0/0
●R5 Loopback 0 Serial 0/0
●Use 3007: abc:def:[IPv4第三个8位组]:: /64 in address interfaces
●R2 Serial 0/0 subnet id is 245
Solution:
R2:
ipv unicast-routing
int lo 0
ipv ospf network point-to-point \\有必要加上
ipv address 3007:abc:def:2::/64 eui-64 有隐含提示，必须
int s0/0
ipv address 3007:abc:def:245::/64 eui-64
fram map ipv R5_local_ipv_address 205 br
fram map ipv R5_golbal_ipv_add 205 br
fram map ipv R4_local_ipv_address 205 br
fram map ipv R4_golbal_ipv_add 205 br
=====================================
R4/R5配置同上
2.10 OSPF v3
●Don’t change network types configure OSPF v3 area 0
●R5 must be DR
Solution:
\\FR默认类型为NON-BRAODCAST，如果不指定网络类型，就需要neighbor命令R5:
ipv router ospf YY
router-id YY.YY.5.5
int s0/0
ipv ospf YY area 0
ipv ospf priority 255
ipv6 ospf nei R2_local_ipv_address
ipv6 ospf nei R4_local_ipv_address
int lo 0
ipv ospf YY area 0
ipv ospf network point-to-point
===================================
R2/R4接口优先级改为0，neighbor只需在R5上配置。其他配置同上Section 3: IP/IOS Features
3.1 DHCP
●Configure R6 to be the DHCP server for VLAN_B
●DNS-server: 150.1.y.50 150.1.y.51,
●Domain: https://www.doczj.com/doc/215682061.html,
●If R6 was down, R2 can be the Gateway,Don’t use HSRP to configure it.
●Lease infinite
Solution:
R6:
service dhcp
ip dhcp excluded-address YY.YY.62.2
ip dhcp excluded-address YY.YY.62.6
ip dhcp pool DHCP
network YY.YY.62.0 255.255.255.0
dns 150.1.YY.50 150.1.YY.51
default-router YY.YY.62.6 YY.YY.62.2
domain https://www.doczj.com/doc/215682061.html,
lease infinite
int f0/1.22
ip irdp
ip irdp pri 1
==================================
R2:
Int F0/0
ip irdp
3.2 IP SLA
●Configure R1 and R4
●The telnet source is Y.Y.245.4 on R4 and the destination is Y.Y.1.1 on R1 ●The testing will occur once every hour and will continue to do so forever Solution:
R4:
ip sla monitor 1
type tcpconnect dest-ipaddr YY.YY.1.1 dest-port 23 sour-ipaddr YY.YY.245.4
frenquency 3600
ip sla monitor schedule 1 life forever start-time now
============================================
R1:
ip sla monitor responder
3.3 UDP broadcast
●Configure R6 (link to BB3 interface) to forward incoming bootstrap protocol client
broadcast to 150.2.y.254 on BB2
Solution:
R6:
Ip forward-protocol udp bootpc
int fa1/0.13 \\link to BB3
ip help-address 150.2.YY.254
Section 4 :Qos
4.1 Congestion Control
●Configure R3 Frame-relay interface for rate limiting by configuring the parameters
CIR.Bc and Mincir
●Your max throughout is 128 kbps
●During congestion, your provider will mark any traffic in excess of 48kps as discard
eligible. Make sure your throughput changes accordingly,based upon BECNs received only.
●Your token bucket interval is 125ms tc=1/8s bc=cir/tc
●Use a map-class to apply this feature to all PVCs
Solution:
R3:
map-class frame-relay FRTS
frame-relay adaptive-shaping becn
frame-relay cir 128000
frame-relay bc 16000
framerelay mincir 48000
int s0/0
frame-relay traffic-shaping \\不要忘记，要不白作了
frame-relay class FRTS
\\注：BC=CIR*TC
验证：show traffic-shape s0/0
4.2 Congestion Management
●On R2 make sure either any traffic leaving FastEthernet0/0 set with IP-Precedence 3 ,
Traffic from VLAN_C destined to VLAN_BB1 has area guaranteed minimum bandwidth 128000bps.In case of congestion, that these packets get dropped randomly
●Limit all traffic leaving FastEthernet0/0 with IP-precedence 2 to 128000bps on average ●Do not use policing or rate-limiting;
●Do not use an ACL to match on ip precedence.
Solution:
\\需要注意是否是来自VLAN_C的流量，或者是别的VLAN;其他颜色的字体为别的版本上的需求。另外一个需要注意的就是单位(是K，还是bit)
R2:
ip cef
access-list 110 ip permit YY.YY.22.0 0.0.0.255 150.1.YY.0 0.0.0.255
class-map match-any QOS
match access-group 110
match ip precedence 3
class-map match-all QOS1
match ip precedence 2
policy-map shape
class QOS
bandwidth 128
random-detect
class QOS1
shape average 128000
int fa0/0
service-policy output shape
4.3 Frame-relay Precedence
●On R4 s0/0 config the frame-relay PVC 405 with precedence routine or priority as
eligible for discarding.During of traffic congestion.
●Do not use MQC
Solution:
R4:
Ip cef
Access-list 101 permit ip any any precedence routine
Access-list 101 permit ip any any precedence priority
fram-relay de-list 1 protocol ip list 101
Int s0/0
Frame-relay de-group 1 405