Professional Documents
Culture Documents
Introduction
In Part I of this practice skills assessment, you will configure the [[labelOrg]] network with routing and ACLs. You
will configure dynamic routing with OSPFv2 and distribute a default route. In addition, you will configure two
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 1 of 28
CCNA ScaN
[[R2Name]]:
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 2 of 28
CCNA ScaN
[[R3Name]]:
[[S1Name]]:
[[S2Name]]:
[[S3Name]]:
Internal PC hosts:
Tables
Note: You are provided with the networks that interfaces should be configured on. Unless you are told to do
differently in the detailed instructions below, you are free to choose the host addresses to assign.
Addressing Table:
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 3 of 28
Device
CCNA ScaN
Interface
Network
Configuration Details
S0/0/0
192.168.100.20/30
192.168.100.21-22 255.255.255.252
G0/0
192.168.8.0/24
192.168.8.1 255.255.255.0
G0/1
192.168.9.0/24
192.168.9.1 255.255.255.0
S0/0/0
192.168.100.20/30
192.168.100.21-22 255.255.255.252
S0/0/1
192.168.100.36/30
192.168.100.37-38 255.255.255.252
S0/1/0
203.0.113.16/29
203.0.113.18-22 255.255.255.248
S0/0/1
192.168.100.36/30
192.168.100.37-38 255.255.255.252
G0/1.2
10.10.2.0/24
10.10.2.1 255.255.255.0
G0/1.4
10.10.4.0/24
10.10.4.1 255.255.255.0
G0/1.8
10.10.8.0/24
10.10.8.1 255.255.255.0
G0/1.15
10.10.15.0/24
10.10.15.1 255.255.255.0
G0/1.25
10.10.25.0/24
10.10.25.1 255.255.255.0
[[S1Name]]
SVI
10.10.25.0/24
10.10.25.254 255.255.255.0
[[S2Name]]
SVI
10.10.25.0/24
10.10.25.253 255.255.255.0
[[S3Name]]
SVI
10.10.25.0/24
10.10.25.252 255.255.255.0
[[PC1Name]]
NIC
192.168.8.0/24
192.168.8.2-254 255.255.255.0
[[PC2Name]]
NIC
192.168.9.0/24
192.168.9.2-254 255.255.255.0
[[VLAN15Host1]]
NIC
10.10.15.0/24
192.168.15.2-254 255.255.255.0
[[VLAN15Host2]]
NIC
10.10.15.0/24
192.168.15.2-254 255.255.255.0
[[R1Name]]
[[R2Name]]
[[R3Name]]
Name
Network
[[VLAN2Name]]
10.10.2.0/24
[[VLAN4Name]]
10.10.4.0/24
[[VLAN8Name]]
10.10.8.0/24
15
[[VLAN15Name]] 10.10.15.0/24
25
99
[[VLAN25Name]] 10.10.25.0/24
[[VLAN99Name]]
N/A
Device
Switch Ports
[[S1Name]]
Fa0/5
[[S3Name]]
Fa0/7
[[S1Name]]
Fa0/10
[[S3Name]]
Fa0/10
[[S1Name]]
Fa0/15
[[S3Name]]
Fa0/15
[[S1Name]]
Fa0/24
[[S3Name]]
Fa0/24
[[S1Name]]
SVI
[[S2Name]]
SVI
[[S3Name]]
SVI
[[S1Name]]
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 4 of 28
CCNA ScaN
Port-Channel Groups:
Channel
1
2
3
Device
Interfaces
[[S1Name]]
Fa0/1, Fa0/2
[[S3Name]]
Fa0/1, Fa0/2
[[S1Name]]
Fa0/3, Fa0/4
[[S2Name]]
Fa0/3, Fa0/4
[[S2Name]]
Fa0/5, Fa0/6
[[S3Name]]
Fa0/5, Fa0/6
Instructions
All configurations must be performed through a direct terminal connection to the device console line
from an available host.
Configure the router host name: [[R1HostName]]. This value must be entered exactly as it appears here.
Prevent the router from attempting to resolve command line entries to IP addresses.
Protect device configurations from unauthorized access with an encrypted secret password.
Secure the router console and remote access lines.
Prevent system status messages from interrupting console output.
Configure a message-of-the-day banner.
Encrypt all clear text passwords.
IP addressing
Descriptions for the three connected interfaces of [[R2Name]].
Configure DCE settings where required. Use a rate of 128000.
The Ethernet subinterfaces on [[R3Name]] will configured later in this assessment.
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 5 of 28
CCNA ScaN
Configure multiarea OSPFv2 to route between all internal networks. Use a process ID of 1.
Use the area numbers shown in the topology.
Use the correct wild card masks for all network statements.
You are not required to route the [[VLAN25Name]]VLAN network on [[R3Name]].
Prevent routing updates from being sent to the LANs.
Configure multiarea OSPFv2 to distribute the default route to the other routers.
[[R1Name]]: 1.1.1.1
[[R2Name]]: 2.2.2.2
[[R3Name]]: 3.3.3.3
The configured router IDsshould be in effecton all three routes.
c. Configure the OSPF cost of the link between [[R1Name]] and [[R2Name]] to 7500.
Step 8: Configure OSPF MD5 Authentication on the Required Interfaces.
Configure OSPF to authenticate routing updates with MD5 authentication on the OSPF interfaces.
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 6 of 28
CCNA ScaN
Create a named standard ACL using the name telnetBlock. Be sure that you enter this name exactly as
it appears in this instruction or you will not receive credit for your configuration.
Allow only [[TestHost]] to access the vty lines of [[R2Name]].
No other Internet hosts (including hosts not visible in the topology) should be able to access the vty lines
of [[R2Name]].
Your solution should consist of one ACL statement.
Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and
device processing resources.
c. Control access to the management interfaces (SVI) of the three switches attached to [[R3Name]] as follows:
The VLAN names that you configure must match the values in the table exactly.
Each switch should be configured with all of the VLANs shown in the table.
All switch ports that you assign to VLANsn should be configured to static access mode.
All switch ports that you assign to VLANs should be activated.
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 7 of 28
CCNA ScaN
Note that all of the unused ports on [[S1Name]] should be assigned to VLAN 99. This configuration step
on switches [[S2Name]] and [[S3Name]] is not required in this assessment for the sake of time.
Secure the unused switch ports on [[S1Name]] by shutting them down.
Use LACP.
The switch ports on both sides of Channels 1 and 2 should initiate negotiations for channel establishment.
The switch ports on the [[S2Name]] side of Channel 3 should initiate negotiations with the switch ports on
[[S3Name]].
The switch ports on the [[S3Name]] side of Channel 3 should not initiate negotiations with the switch
ports on the other side of the channel.
All channels should be ready to forward data after they have been configured.
b. Activate PortFast and BPDU Guard ontheactive [[S3Name]] switch access ports.
On [[S3Name]], configure PortFast on the access ports that are connected to hosts.
On [[S3Name]], activate BPDU Guard on the access ports that are connected to hosts.
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 8 of 28
CCNA ScaN
Each active access port should accept only two MAC addresses before a security action occurs.
The learned MAC addresses should be recorded in the running configuration.
If a security violation occurs, the switch ports should provide notification that a violation has occurred but
not place the interface in an err-disabled state.
b. On [[S2Name]], configure the virtual terminal lines to accept only SSH connections.
c. Ensure that all unused switch ports on [[S1Name]] have been secured as follows:
Step 7: Configure [[R3Name]] as a DHCP server for the hosts attached to the [[S1Name]] and [[S3Name]]
switches.
Configure three DHCP pools as follows:
Hosts on VLANs 2, 4, and 8 should be configured to receive addresses dynamically over DHCP.
Hosts on VLAN 15 should be addressed statically as indicated in the Addressing Table. Once
configured, the hosts should be able to ping hosts on other networks.
Hosts on the LANs attached to [[R1Name]] should be statically assigned addresses that enable them to
communicate with hosts on other networks, as indicated in the Addressing Table.
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 9 of 28
CCNA ScaN
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 10 of 28
CCNA ScaN
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 11 of 28
CCNA ScaN
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 12 of 28
CCNA ScaN
PT_ccna5
login
!
End
[[R2Name]]
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
ip cef
no ipv6 cef
!
license udi pid CISCO1941/K9 sn FTX1524E082
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0/0
description any_text
bandwidth 128
ip address 192.168.100.22 255.255.255.252
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 xyz_OSPF
ip ospf cost 7500
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 13 of 28
CCNA ScaN
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 14 of 28
CCNA ScaN
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 15 of 28
CCNA ScaN
default-router 10.10.8.1
dns-server 192.168.200.225
!
ip cef
no ipv6 cef
!
license udi pid CISCO1941/K9 sn FTX152448Z7
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.2
description Relevant description text.
encapsulation dot1Q 2
ip address 10.10.2.1 255.255.255.0
!
interface GigabitEthernet0/1.4
description Relevant description text.
encapsulation dot1Q 4
ip address 10.10.4.1 255.255.255.0
!
interface GigabitEthernet0/1.8
description Relevant description text.
encapsulation dot1Q 8
ip address 10.10.8.1 255.255.255.0
!
interface GigabitEthernet0/1.15
description Relevant description text.
encapsulation dot1Q 15
ip address 10.10.15.1 255.255.255.0
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 16 of 28
CCNA ScaN
!
interface GigabitEthernet0/1.25
encapsulation dot1Q 25
ip address 10.10.25.1 255.255.255.0
ip access-group 1 out
!
interface Serial0/0/0
no ip address
clock rate 2000000
shutdown
!
interface Serial0/0/1
description Any description text.
bandwidth 128
ip address 192.168.100.38 255.255.255.252
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 xyz_OSPF
clock rate 2000000
!
interface Vlan1
no ip address
shutdown
!
router ospf 1
router-id 3.3.3.3
log-adjacency-changes
passive-interface GigabitEthernet0/1.2
passive-interface GigabitEthernet0/1.4
passive-interface GigabitEthernet0/1.8
passive-interface GigabitEthernet0/1.15
network 192.168.100.36 0.0.0.3 area 0
network 10.10.2.0 0.0.0.255 area 2
network 10.10.4.0 0.0.0.255 area 2
network 10.10.8.0 0.0.0.255 area 2
network 10.10.15.0 0.0.0.255 area 2
!
ip classless
!
ip flow-export version 9
!
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 17 of 28
CCNA ScaN
!
access-list 1 permit 10.10.15.0 0.0.0.255
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
end
[[S1Name]]
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Switch
!
spanning-tree mode rapid-pvst
spanning-tree vlan 2,4 priority 24576
spanning-tree vlan 8,15 priority 28672
!
interface FastEthernet0/1
channel-group 1 mode active
switchport mode trunk
!
interface FastEthernet0/2
channel-group 1 mode active
switchport mode trunk
!
interface FastEthernet0/3
channel-group 2 mode active
switchport mode trunk
!
interface FastEthernet0/4
channel-group 2 mode active
switchport mode trunk
!
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 18 of 28
CCNA ScaN
interface FastEthernet0/5
switchport access vlan 2
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
switchport port-security mac-address sticky 00D0.D3A1.9792
!
interface FastEthernet0/6
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/7
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/8
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/9
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/10
switchport access vlan 4
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
switchport port-security mac-address sticky 0001.C9A8.E69E
!
interface FastEthernet0/11
switchport access vlan 99
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 19 of 28
CCNA ScaN
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 20 of 28
CCNA ScaN
shutdown
!
interface FastEthernet0/19
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/20
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/21
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/22
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/23
switchport access vlan 99
switchport mode access
shutdown
!
interface FastEthernet0/24
switchport access vlan 15
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
switchport port-security mac-address sticky 0004.9A02.4569
!
interface GigabitEthernet0/1
switchport access vlan 99
switchport mode access
shutdown
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 21 of 28
CCNA ScaN
!
interface GigabitEthernet0/2
switchport access vlan 99
switchport mode access
shutdown
!
interface Port-channel 1
switchport mode trunk
!
interface Port-channel 2
switchport mode trunk
!
interface Vlan1
no ip address
shutdown
!
interface Vlan25
ip address 10.10.25.254 255.255.255.0
!
ip default-gateway 10.10.25.1
!
!
line con 0
!
line vty 0 4
login
line vty 5 15
login
!
!
end
[[S2Name]]
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 22 of 28
CCNA ScaN
hostname Switch
!
ip ssh version 2
ip domain-name ccnaPTSA.com
!
username netadmin secret SSHsecret9
!
spanning-tree mode rapid-pvst
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
channel-group 2 mode active
switchport mode trunk
!
interface FastEthernet0/4
channel-group 2 mode active
switchport mode trunk
!
interface FastEthernet0/5
channel-group 3 mode active
switchport mode trunk
!
interface FastEthernet0/6
channel-group 3 mode active
switchport mode trunk
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 23 of 28
CCNA ScaN
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
switchport mode trunk
!
interface GigabitEthernet0/2
!
interface Port-channel 2
switchport mode trunk
!
interface Port-channel 3
switchport mode trunk
!
interface Vlan1
no ip address
shutdown
!
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 24 of 28
CCNA ScaN
interface Vlan25
ip address 10.10.25.253 255.255.255.0
!
ip default-gateway 10.10.25.1
!
line con 0
!
line vty 0 4
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
end
[[S3Name]]
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname S3
!
spanning-tree mode rapid-pvst
spanning-tree vlan 8,15 priority 24576
spanning-tree vlan 2,4 priority 28672
!
interface FastEthernet0/1
channel-group 1 mode active
switchport mode trunk
!
interface FastEthernet0/2
channel-group 1 mode active
switchport mode trunk
!
interface FastEthernet0/3
!
interface FastEthernet0/4
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 25 of 28
CCNA ScaN
!
interface FastEthernet0/5
channel-group 3 mode passive
switchport mode trunk
!
interface FastEthernet0/6
channel-group 3 mode passive
switchport mode trunk
!
interface FastEthernet0/7
switchport access vlan 2
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
switchport access vlan 4
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
switchport access vlan 8
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/16
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 26 of 28
CCNA ScaN
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
switchport access vlan 15
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface GigabitEthernet0/1
shutdown
!
interface GigabitEthernet0/2
!
interface Port-channel 1
switchport mode trunk
!
interface Port-channel 3
switchport mode trunk
!
interface Vlan1
no ip address
shutdown
!
interface Vlan25
ip address 10.10.25.252 255.255.255.0
!
ip default-gateway 10.10.25.1
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 27 of 28
CCNA ScaN
!
line con 0
!
line vty 0 4
login
line vty 5 15
login
!
!
end
2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 28 of 28