Section 1: Bridging and Switching (18 Points)

Section 1.1: Frame Relay Configuration (3 Points)

• Configure the Frame Relay portion of the network as shown in Figure 4-8 and ensure that only the PVCs shown in Figure 4-8 will be used. Use of dynamic PVCs is not permitted.

The question clearly states that you must use only the PVCs as shown in Figure 4-8. You must therefore disable inverse-arp on the routers. It is good practice to ensure that all routers do not rely on inverse-arp, so you should have configured no frame-relay inverse-arp under R1, R2, R3, R4, and R5 on their serial interfaces.

• You are permitted to use subinterfaces on R2 interface S0/1.

• Do not configure subinterfaces on any other routers.

• You must be able to ping across the Frame Relay cloud.

R2 will be connecting to R1, R4, and R5. Because they are in the same subnet you do not need to configure subinterfaces, even though the question says "you are permitted to use subinterfaces on R2 interface S0/1. (Notice that you are permitted, so you can use one if you want to.) You should be able to ping across the Frame Relay cloud.

If you configured this correctly as shown in Example 4-1 through Example 4-10, you will get 3 points.

NOTE

When configuring the Frame Relay serial interfaces it is a very good idea for you to shut down the interfaces while you are configuring. This procedure will ensure you do not have unexpected behavior because of dynamic maps, etc., although you have configured the "no frame-relay inverse-arp." Another useful command is "clear frame-relay inarp interface" to clear your inverse ARP entries from the map table. Also, reloading the router may fix it. The following examples show the initial Frame Relay configuration on R1, R2, R3, R4, and R5.

Example 4-1. R1 Initial Frame Relay Solution Configuration

 R1#show run int s0/1 Building configuration... Current configuration : 285 bytes ! interface Serial0/1  ip address 160.10.37.1 255.255.255.0  encapsulation frame-relay  frame-relay map ip 160.10.37.2 112 broadcast  frame-relay map ip 160.10.37.4 112 broadcast  frame-relay map ip 160.10.37.5 112 broadcast  no frame-relay inverse-arp  frame-relay lmi-type ansi end R1# 

Example 4-2. R2 Initial Frame Relay Solution Configuration

 R2#show run int s0/0 Building configuration... Current configuration : 193 bytes ! interface Serial0/0  ip address 160.10.32.2 255.255.255.0  encapsulation frame-relay  frame-relay map ip 160.10.32.3 203 broadcast  no frame-relay inverse-arp  frame-relay lmi-type ansi end R2# R2#show run int s0/1 Building configuration... Current configuration : 285 bytes ! interface Serial0/1  ip address 160.10.37.2 255.255.255.0  encapsulation frame-relay  frame-relay map ip 160.10.37.1 211 broadcast  frame-relay map ip 160.10.37.4 214 broadcast  frame-relay map ip 160.10.37.5 215 broadcast  no frame-relay inverse-arp  frame-relay lmi-type ansi end R2# 

Example 4-3. R3 Initial Frame Relay Solution Configuration

 R3#show run int s0/0 Building configuration... Current configuration : 193 bytes ! interface Serial0/0  ip address 160.10.32.3 255.255.255.0  encapsulation frame-relay  frame-relay map ip 160.10.32.2 302 broadcast  no frame-relay inverse-arp  frame-relay lmi-type ansi end R3# 

Example 4-4. R4 Initial Frame Relay Solution Configuration

 R4#show run int s0/1 Building configuration... Current configuration : 285 bytes ! interface Serial0/1  ip address 160.10.37.4 255.255.255.0  encapsulation frame-relay  frame-relay map ip 160.10.37.1 412 broadcast  frame-relay map ip 160.10.37.2 412 broadcast  frame-relay map ip 160.10.37.5 412 broadcast  no frame-relay inverse-arp  frame-relay lmi-type ansi end R4# 

Example 4-5. R5 Initial Frame Relay Solution Configuration

 R5#show run int s0/1 Building configuration... Current configuration : 285 bytes ! interface Serial0/1  ip address 160.10.37.5 255.255.255.0  encapsulation frame-relay  frame-relay map ip 160.10.37.1 512 broadcast  frame-relay map ip 160.10.37.2 512 broadcast  frame-relay map ip 160.10.37.4 512 broadcast  no frame-relay inverse-arp  frame-relay lmi-type ansi end R5# 

The commands in Example 4-6 through Example 4-10 verify the connectivity and the Frame Relay maps. These commands are useful to double check if you have connectivity, and if not, to help you to find mistakes such as mismatching IP address, mapping to the wrong peer, and so on.

Example 4-6. R1 show Commands and Pings to Verify Functionality

 R1#show fram map Serial0/1 (up): ip 160.10.37.2 dlci 112(0x70,0x1C00), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.4 dlci 112(0x70,0x1C00), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.5 dlci 112(0x70,0x1C00), static,               broadcast,               CISCO, status defined, active R1# R1#ping 160.10.37.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms R1#ping 160.10.37.4 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.4, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms R1#ping 160.10.37.5 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.5, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms R1# 

Example 4-7. R2 show Commands and Pings to Verify Functionality

 R2#show fram map Serial0/0 (up): ip 160.10.32.3 dlci 203(0xCB,0x30B0), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.1 dlci 211(0xD3,0x3430), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.4 dlci 214(0xD6,0x3460), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.5 dlci 215(0xD7,0x3470), static,               broadcast,               CISCO, status defined, active R2# R2# R2#ping 160.10.32.3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.32.3, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms R2#ping 160.10.37.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms R2#ping 160.10.37.4 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.4, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms R2#ping 160.10.37.5 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.5, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms R2# 

Example 4-8. R3 show Commands and Pings to Verify Functionality

 R3#show fram map Serial0/0 (up): ip 160.10.32.2 dlci 302(0x12E,0x48E0), static,               broadcast,               CISCO, status defined, active R3#ping 160.10.32.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.32.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms R3# 

Example 4-9. R4 show Commands and Pings to Verify Functionality

 R4#show fram map Serial0/1 (up): ip 160.10.37.1 dlci 412(0x19C,0x64C0), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.2 dlci 412(0x19C,0x64C0), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.5 dlci 412(0x19C,0x64C0), static,               broadcast,               CISCO, status defined, active R4# R4#ping 160.10.37.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms R4#ping 160.10.37.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms R4#ping 160.10.37.5 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.5, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms R4# 

Example 4-10. R5 show Commands and Pings to Verify Functionality

 R5#show fram map Serial0/1 (up): ip 160.10.37.1 dlci 512(0x200,0x8000), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.2 dlci 512(0x200,0x8000), static,               broadcast,               CISCO, status defined, active Serial0/1 (up): ip 160.10.37.4 dlci 512(0x200,0x8000), static,               broadcast,               CISCO, status defined, active R5# R5#ping 160.10.37.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms R5#ping 160.10.37.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms R5#ping 160.10.37.4 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.37.4, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms R5# 

Section 1.2: 3550 LAN Switch Configuration (12 Points)

• Sw1 and Sw2 are connected via a crossover cable using ports fa0/15. Configure an ISL trunk between Sw1 and Sw2.

If you configured this correctly as shown in Example 4-11 through Example 4-13, you have scored 2 points.

Example 4-11. 3550 Sw1 Initial Trunk Configuration

 Sw1#show run int fa0/15 Building configuration... Current configuration : 108 bytes ! interface FastEthernet0/15  switchport trunk encapsulation isl  switchport mode trunk  no ip address end Sw1# 

Example 4-12. 3550 Sw2 Initial Trunk Configuration

 Sw2#show run int fa0/15 Building configuration... Current configuration : 108 bytes ! interface FastEthernet0/15  switchport trunk encapsulation isl  switchport mode trunk  no ip address end Sw2 

Example 4-13. 3550 Sw1 and Sw2 show Commands Output to Verify Configuration and Functionality

 Sw1#show int trunk Port      Mode         Encapsulation  Status        Native vlan Fa0/15    on           isl            trunking      1 Port      Vlans allowed on trunk Fa0/15    1-4094 Port      Vlans allowed and active in management domain Fa0/15    1 Port      Vlans in spanning tree forwarding state and not pruned Fa0/15    1 Sw1# ________________________________________________________________ Sw2#show int trunk Port      Mode         Encapsulation  Status        Native vlan Fa0/15    on           isl            trunking      1 Port      Vlans allowed on trunk Fa0/15    1-4094 Port      Vlans allowed and active in management domain Fa0/15    1 Port      Vlans in spanning tree forwarding state and not pruned Fa0/15    1 Sw2# 

• All Ethernet ports are pre-cabled as per Table 4-4. Note that not all ports will be used on this lab.

• Configure the VLANs as follows:

  VLAN_11: Connected to R1-e0/0 (VLAN_11)

  VLAN_22: Connected to R3-fa0/0, R5-fa0/0, and R6-e0/0 (VLAN_22)

  VLAN_25: Connected to R1-e0/1 and R5-fa0/1 (VLAN_25)

  VLAN_33: Connected to R3-fa0/1 (VLAN_33)

  VLAN_100: Connected to R2-fa0/0 and Sw1-fa0/13 (VLAN_100)

  VLAN_200: Connected to R4-e0/0 and Sw2-fa0/13 (VLAN_200)

• Configure Sw1 to be the VTP server for the domain. Sw2 is a VTP client. Be sure that Sw2 can see the VLAN configuration from Sw1.

If you configured this correctly as shown in Example 4-14, you have scored 3 points.

An important thing to notice here is that creating the VLANs 25 and 33 on Sw2 will be possible if the VTP mode is still server on Sw2. When you configure Sw1 as VTP mode server and Sw2 as client as the question requires, you will be able to create the VLANs only on Sw1 (the VTP mode server), and Sw2 will learn all VLANs from Sw1 via trunk. Also, the VTP domain name must be the same.

The commands in Example 4-14 can help you not only to verify if you have configured correctly, but also can help you to identify problems and mistakes. In other words, these commands will help you to troubleshoot why a router cannot ping another router or why a router is not able to ping and receive routes from the backbone, and even identify why a VTP mode client switch is not seeing the VLANs.

NOTE

The VLAN configuration is completed under Vlan database.

Example 4-14. 3550 Sw1 and Sw2 VLAN and VTP Configuration

 Sw1#show vlan brief VLAN Name                             Status    Ports ---- -------------------------------- --------- ------------------------------- 1    default                          active    Fa0/7, Fa0/8, Fa0/9, Fa0/10                                                 Fa0/11, Fa0/12, Fa0/14, Fa0/16                                                 Fa0/17, Fa0/18, Fa0/19, Fa0/20                                                 Fa0/21, Fa0/22, Fa0/23, Fa0/24                                                 Gi0/1, Gi0/2 11   VLAN_11                          active    Fa0/1 22   VLAN_22                          active    Fa0/3, Fa0/5, Fa0/6 25   VLAN_25                          active 33   VLAN_33                          active 100  VLAN_100                         active    Fa0/2, Fa0/13 200  VLAN_200                         active    Fa0/4 1002 fddi-default                     active 1003 token-ring-default               active 1004 fddinet-default                  active 1005 trnet-default                    active Sw1# ________________________________________________________________ Sw2#show vlan brief VLAN Name                             Status    Ports ---- -------------------------------- --------- ------------------------------- 1    default                          active    Fa0/2, Fa0/4, Fa0/6, Fa0/7                                                 Fa0/8, Fa0/9, Fa0/10, Fa0/11                                                 Fa0/12, Fa0/14, Fa0/16, Fa0/17                                                 Fa0/18, Fa0/19, Fa0/20, Fa0/21                                                 Fa0/22, Fa0/23, Fa0/24, Gi0/1                                                 Gi0/2 11   VLAN_11                          active 22   VLAN_22                          active 25   VLAN_25                          active    Fa0/1, Fa0/5 33   VLAN_33                          active    Fa0/3 100  VLAN_100                         active 200  VLAN_200                         active    Fa0/13 1002 fddi-default                     active 1003 token-ring-default               active 1004 fddinet-default                  active 1005 trnet-default                    active Sw2# ________________________________________________________________ Sw1# Sw1#show vtp stat VTP Version                     : 2 Configuration Revision          : 1 Maximum VLANs supported locally : 1005 Number of existing VLANs        : 11 VTP Operating Mode              : Server VTP Domain Name                 : CCIE VTP Pruning Mode                : Disabled VTP V2 Mode                     : Disabled VTP Traps Generation            : Disabled MD5 digest                      : 0x36 0xC9 0xB9 0x93 0x5C 0xE6 0x7B 0x1D Configuration last modified by 160.10.7.7 at 3-19-93 04:55:23 Local updater ID is 160.10.11.10 on interface Vl11 (lowest numbered VLAN interface found) Sw1# ________________________________________________________________ Sw2#show vtp stat VTP Version                     : 2 Configuration Revision          : 1 Maximum VLANs supported locally : 1005 Number of existing VLANs        : 11 VTP Operating Mode              : Client VTP Domain Name                 : CCIE VTP Pruning Mode                : Disabled VTP V2 Mode                     : Disabled VTP Traps Generation            : Disabled MD5 digest                      : 0x36 0xC9 0xB9 0x93 0x5C 0xE6 0x7B 0x1D Configuration last modified by 160.10.7.7 at 3-19-93 04:55:23 Sw2# 

NOTE

The VTP domain name is arbitrarily called CCIE. It could be any name because it was not requested to configure any specific name.

• Configure Sw1, using VLAN_11 with the IP address 160.10.11.10/24. After you have finished your routing section, all routers should be able to ping this interface.

If you configured this correctly as shown in Example 4-15, you have scored 1 point.

Example 4-15. 3550 Sw1 Management Interface Configuration

 Sw1# Sw1#show run int vlan 11 Building configuration... Current configuration : 63 bytes ! interface Vlan11  ip address 160.10.11.10 255.255.255.0 ! ! ip route 0.0.0.0 0.0.0.0 160.10.11.1 

NOTE

In this moment, Sw1 will be able to ping only R1-e0/0. With the static route highlighted in Example 4-15, you will be able to ping the Sw1-VLAN_11 interface from any router after completion of your IP IGP routing.

Example 4-16 first shows a basic test using a ping from the Sw1 to R1-0/0. This is basic because they are in the same VLAN_11. The second test is to be done after you have your routing section finished, and then you can have Sw1 able to ping, for example R6-lo0.

Example 4-16. 3550 Sw1 Management Interface Output Verification

 Sw1#ping 160.10.11.1 ! R1-E0/0 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.11.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms Sw1# Sw1#ping 160.10.6.6 ! Sw1 able to ping R6-Lo0 (After all IGP routing is finished) Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 160.10.6.6, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms Sw1# 

• Configure VLAN_11 on Sw1 to be the secondary root switch.

If you configured this correctly as shown in Example 4-17, you have scored 2 points.

This questions has a little trick. It tells you to make the configuration on Sw1. The use of the spanning-tree vlan 11 root secondary command on Sw1 alone will not make Sw1 the "secondary" root. The effect will be changing the VLAN_11 root priority on Sw1 to 2872, which is still "lesser" than Sw2, so Sw1 is still the spanning-tree root.

In this case, you need to configure on Sw2 the spanning-tree vlan 11 root primary command that will change the spanning-tree root priority on Sw2 to 24576 (lesser than Sw1), so now Sw1 is the secondary spanning-tree root.

Example 4-17. 3550 Sw1 and Sw2 Secondary Root Configuration and Verification

 Sw1# Sw1#conf t Enter configuration commands, one per line.  End with CNTL/Z. Sw1(config)#spanning-tree vlan 11 root secondary Sw1(config)# ! Sw2#conf t Enter configuration commands, one per line.  End with CNTL/Z. Sw2(config)#spanning-tree vlan 11 root primary ! Sw1#sh spanning-tree detail active VLAN0011 is executing the ieee compatible Spanning Tree protocol   Bridge Identifier has priority 28672, sysid 11, address 0009.e8ef.1800   Configured hello time 2, max age 20, forward delay 15   Current root has priority 24587, address 0009.e8ee.f200   Root port is 15 (FastEthernet0/15), cost of root path is 19   Topology change flag not set, detected flag not set   Number of topology changes 3 last change occurred 00:50:41 ago           from FastEthernet0/15   Times:  hold 1, topology change 35, notification 2           hello 2, max age 20, forward delay 15   Timers: hello 0, topology change 0, notification 0, aging 300  Port 1 (FastEthernet0/1) of VLAN0011 is forwarding    Port path cost 100, Port priority 128, Port Identifier 128.1.    Designated root has priority 24587, address 0009.e8ee.f200    Designated bridge has priority 28683, address 0009.e8ef.1800    Designated port id is 128.1, designated path cost 19    Timers: message age 0, forward delay 0, hold 0    Number of transitions to forwarding state: 1    Link type is shared by default    BPDU: sent 547165, received 40 ! ________________________________________________________________ Sw2#sh spanning-tree detail  VLAN0011 is executing the ieee compatible Spanning Tree protocol   Bridge Identifier has priority 24576, sysid 11, address 0009.e8ee.f200   Configured hello time 2, max age 20, forward delay 15   We are the root of the spanning tree   Topology change flag not set, detected flag not set   Number of topology changes 4 last change occurred 00:51:38 ago   Times:  hold 1, topology change 35, notification 2           hello 2, max age 20, forward delay 15   Timers: hello 0, topology change 0, notification 0, aging 300  Port 15 (FastEthernet0/15) of VLAN0011 is forwarding    Port path cost 19, Port priority 128, Port Identifier 128.15.    Designated root has priority 24587, address 0009.e8ee.f200    Designated bridge has priority 24587, address 0009.e8ee.f200    Designated port id is 128.15, designated path cost 0    Timers: message age 0, forward delay 0, hold 0    Number of transitions to forwarding state: 1    Link type is point-to-point by default    BPDU: sent 1565, received 545717 

• Configure Sw1 to permit any SNMP manager to access all objects with read-only permission using the community string public. The switch also sends VTP traps to the hosts 160.10.11.111 and 160.10.11.33 using SNMPv1 and to the host 160.10.11.27 using SNMPv2C. The community string public is sent with the traps.

If you configured this correctly as shown in Example 4-18, you have scored 2 points.

Example 4-18 shows the SNMP configuration to accomplish the question requirement. Notice that to allow "read-only" permission you do not need extra configuration because it is the default permission. The SNMP version 1 is also the default.

Example 4-18. 3550 Sw1 SNMP Configuration and Verification

 Sw1#sh run | include snmp snmp-server community public RO snmp-server enable traps vtp snmp-server host 160.10.11.111 public snmp-server host 160.10.11.27 version 2c public snmp-server host 160.10.11.33 public Sw1# ! Sw1#sh snmp ! SNMP logging: enabled     Logging to 160.10.11.111.162, 0/10, 0 sent, 0 dropped.     Logging to 160.10.11.33.162, 0/10, 0 sent, 0 dropped.     Logging to 160.10.11.27.162, 0/10, 0 sent, 0 dropped. SNMP agent enabled Sw1# 

Section 1.3: ATM Configuration (3 Points)

• Configure the ATM as shown in Figure 4-9.

• There is a PVC configured between R6 and the backbone router. Do not configure subinterfaces.

• Use explicit address mapping. Do not depend on the remoter backbone router for inverse ARP.

• You must be able to ping the backbone router address 170.100.10.254/24.

Example 4-19 provides a basic ATM PVC configuration where an important note here is to not forget to configure the broadcast keyword. If you fail to do so, you will not be able to exchange routing protocol between R6 and the backbone router. The commands in Example 4-19 show the configuration, the ping test, and whether your ATM PVC is up and running.

Example 4-19. R6 ATM Configuration, Map Verification, and Access to Backbone Router

 R6#show run int a3/0 Building configuration... Current configuration : 140 bytes ! interface ATM3/0  ip address 170.100.10.1 255.255.255.0  no atm ilmi-keepalive  pvc 0/100   protocol ip 170.100.10.254 broadcast  ! end R6#ping 170.100.10.254 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 170.100.10.254, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms R6#sh atm vc            VCD /                                        Peak  Avg/Min Burst Interface  Name         VPI   VCI  Type   Encaps   SC   Kbps   Kbps   Cells  Sts 3/0        3              0   100  PVC    SNAP     UBR  155000                UP R6#