Figure 1

Figure 2
Figure 3
Figure 4
Figure 5
Figure 6
Figure 7
 HCIE Lab Exam Paper

I. Exam Description

1. The full score is 100 and the pass mark is SO.

II. Exam Requirements

1. Complete the tasks in sequence.
2. If there are multiple choices for a task, select the one that best suits the requirements of the task.
3. Unless otherwise specified in a task, the following operations are prohibited

a) Create or delete interfaces.

b) Create a tunnel.
c) Create additional VLANs.
d) Change the interlace encapsulation mode.
e) Configure policy-based routing (PBR).
f) Summarize routes.
g) Use additional IP addresses,
h) Change IP addresses that have been assigned.

4. Do not create static route: to achieve the objective of each step except static route creations in
steps 1 and 2 of task 4.1
5. You must not log in to the ISP device.
6. Save the configuration at any time.
1. LAYER 2 and VRRP

1.1 Link Aggregation

S1:

interface Eth-Trunk1
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
load-balance src-dst-mac
#
interface GigabitEthernet0/0/23
eth-trunk 1
#
interface GigabitEthernet0/0/24
eth-trunk 1
#

S2:

interface Eth-Trunk1
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
load-balance src-dst-mac
#
interface GigabitEthernet0/0/23
eth-trunk 1
#
interface GigabitEthernet0/0/24
eth-trunk 1
#

1.2 Link Type

S1:

interface GigabitEthernet0/0/2
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
stp edged-port enable
#
interface GigabitEthernet0/0/3
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/12
 port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#

S2:

interface GigabitEthernet0/0/2
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
stp edged-port enable
#
interface GigabitEthernet0/0/3
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/12
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#

S3:

interface Ethernet0/0/3
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/1
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/2
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#

S4:

interface Ethernet0/0/3
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/1
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/2
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2 to 4094
#

C1:

interface GigabitEthernet0/0/2.10
dot1q termination vid 10
dot1q vrrp vid 10
ip address 10.3.1.1 255.255.255.0
vrrp vrid 10 virtual-ip 10.3.1.254
vrrp vrid 10 priority 120
vrrp vrid 10 preempt-mode timer delay 60
#
interface GigabitEthernet0/0/2.20
dot1q termination vid 20
dot1q vrrp vid 20
ip address 10.3.2.1 255.255.255.0
vrrp vrid 20 virtual-ip 10.3.2.254
#

C2:

#
interface GigabitEthernet0/0/2.10
dot1q termination vid 10
dot1q vrrp vid 10
ip address 10.3.1.2 255.255.255.0
vrrp vrid 10 virtual-ip 10.3.1.254
#
interface GigabitEthernet0/0/2.20
dot1q termination vid 20
dot1q vrrp vid 20
ip address 10.3.2.2 255.255.255.0
vrrp vrid 20 virtual-ip 10.3.2.254
vrrp vrid 20 priority 120
vrrp vrid 20 preempt-mode timer delay 60
#

S3:

interface Ethernet0/0/1
port link-type access
port default vlan 10
stp edged-port enable
#

S4:

interface Ethernet0/0/1
 port link-type access
port default vlan 20
stp edged-port enable
#

1.3 MSTP

S1:

vlan batch 10 20
stp mode mst
stp region-configuration
region-name HUAWEI
revision-level 12
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
#
stp instance 10 root primary
stp instance 20 root secondary
#

S2:

vlan batch 10 20
stp mode mst
stp region-configuration
region-name HUAWEI
revision-level 12
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
#
stp instance 10 root secondary
stp instance 20 root primary
#

S3:

vlan batch 10 20
stp mode mst
stp region-configuration
region-name HUAWEI
revision-level 12
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
#

S4:

vlan batch 10 20
 stp mode mst
stp region-configuration
region-name HUAWEI
revision-level 12
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
#

S3:

interface Ethernet0/0/1
stp edged-port enable
#

S4:

interface Ethernet0/0/1
stp edged-port enable
#

S1:

interface GigabitEthernet0/0/2

stp edged-port enable

interface GigabitEthernet0/0/2
stp edged-port enable

1.4 WAN

PE1:

interface Ip-Trunk1
ipv6 enable
ip address 10.1.13.1 255.255.255.252
ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1300/127
#
interface Serial0/0/0
link-protocol hdlc
ip-trunk 1
#
interface Serial0/0/1
link-protocol hdlc
ip-trunk 1
#

RR1:
 interface Ip-Trunk1
ipv6 enable
ip address 10.1.13.2 255.255.255.252
ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1302/127
#
interface Serial0/0/0
link-protocol hdlc
ip-trunk 1
#
interface Serial0/0/1
link-protocol hdlc
ip-trunk 1
#

PE3:

interface Mp-group0/0/0
ip address 10.2.33.1 255.255.255.252
#
interface Pos4/0/0
link-protocol ppp
ppp mp Mp-group 0/0/0
#
interface Pos6/0/0
link-protocol ppp
ppp mp Mp-group 0/0/0
#

CE3:

interface Mp-group0/0/0
ip address 10.2.33.2 255.255.255.252
#
interface Pos4/0/0
link-protocol ppp
ppp mp Mp-group 0/0/0
#
interface Pos6/0/0
link-protocol ppp
ppp mp Mp-group 0/0/0
#

2. IPv4 IGP

2.1 Basic Configurations

PE1:

interface Ip-Trunk1
ipv6 enable
ip address 10.1.13.1 255.255.255.252
ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1300/127
 #

interface Ip-Trunk1
ipv6 enable
ip address 10.1.13.2 255.255.255.252
ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1302/127
#

2.2 OSPF

CE1:

#
ospf 1
silent-interface GigabitEthernet0/0/2.10
silent-interface GigabitEthernet0/0/2.20
area 0.0.0.0
network 10.2.12.1 0.0.0.0
network 10.3.1.0 0.0.0.255
network 10.3.2.0 0.0.0.255
network 172.17.1.1 0.0.0.0
#

CE2:

ospf 1
silent-interface GigabitEthernet0/0/2.10
silent-interface GigabitEthernet0/0/2.20
area 0.0.0.0
network 10.2.12.2 0.0.0.0
network 10.3.1.0 0.0.0.255
network 10.3.2.0 0.0.0.255
network 172.17.1.2 0.0.0.0
#

PE3:

interface GigabitEthernet0/0/0
ip address 10.1.112.1 255.255.255.252
ospf cost 20
ospf network-type p2p
mpls
mpls ldp
#

PE4:

#
interface GigabitEthernet0/0/0
ip address 10.1.112.2 255.255.255.252
ospf cost 20
ospf network-type p2p
 mpls
mpls ldp
#

ip ip-prefix LOOPBACK index 10 permit 172.16.1.2 32

#
route-policy LOOPBACK permit node 10
if-match ip-prefix LOOPBACK
#
ospf 1
import-route direct type 1 route-policy LOOPBACK
area 0.0.0.0
network 10.1.102.2 0.0.0.0
network 10.1.112.2 0.0.0.0
#

2.3 ISIS

PE1:

interface Ip-Trunk1
ip address 10.1.13.1 255.255.255.252
isis enable 1
isis cost 1500

RR1:

interface Ip-Trunk1
ip address 10.1.13.2 255.255.255.252
isis enable 1
isis circuit-level level-1
isis cost 1500

RR2:

interface GigabitEthernet0/0/0
ip address 10.1.91.1 255.255.255.252
isis enable 1
isis circuit-type p2p
isis cost 50
ospf cost 10

P2:

interface GigabitEthernet0/0/0
ip address 10.1.91.2 255.255.255.252
isis enable 1
isis circuit-type p2p
isis cost 50
ospf cost 10

P1:
 isis 1
cost-style wide
timer lsp-generation 1 50 50 level-1
timer lsp-generation 1 50 50 level-2
flash-flood level-1
flash-flood level-2
network-entity 49.0001.74dd.fffe.cc34.00
is-name P1
timer spf 1 100 100
#

3. MPLS VPN

For this section, is better to read all 13 questions for a complete picture of the final requirement, which is an
Inter AS Option C solution 2 with a HUB and SPOKE setup (with dual links at the HUB PEs), above that, path
manipulation and redistributions are requested.

First, ensure full IGP Loopback 0 reachability in AS100 and AS200.

RR2:

route-policy I2O deny node 5

if-match tag 500

route-policy I2O permit node 10

apply tag 400

route-policy O2I deny node 5

if-match tag 300

route-policy O2I permit node 10

apply tag 200

ospf 1

import-route isis 1 route-policy I2O

preference ase 14
 area 0.0.0.0

network 10.1.91.1 0.0.0.0

network 10.1.119.1 0.0.0.0

isis 1

is-level level-2

cost-style wide

network-entity 49.0003.fbd6.a8b4.4da9.00

import-route ospf 1 route-policy O2I

P2:

route-policy I2O deny node 5

if-match tag 200

route-policy I2O permit node 10

apply tag 300

route-policy O2I deny node 5

if-match tag 400

route-policy O2I permit node 10

apply tag 500

ospf 1

import-route isis 1 route-policy I2O

preference ase 14

area 0.0.0.0
 network 10.1.91.2 0.0.0.0

network 10.1.102.1 0.0.0.0

isis 1

cost-style wide

network-entity 49.0003.fbd6.a8b4.4daa.00

import-route ospf 1 route-policy O2I

RR1:

isis 1

cost-style wide

network-entity 49.0001.0000.0000.0003.00

is-name RR1

import-route isis level-2 into level-1

P1:

isis 1

cost-style wide

timer lsp-generation 1 50 50 level-1

timer lsp-generation 1 50 50 level-2

flash-flood level-1

flash-flood level-2

network-entity 49.0001.74dd.fffe.cc34.00

is-name P1

import-route isis level-2 into level-1

timer spf 1 100 100

Enable and verify all MPLS LDP peerings (only need to be enabled on PE1 and RR1, for other
devices, it is already enabled)

PE1:

interface Ip-Trunk1

ip address 10.1.13.1 255.255.255.252

isis enable 1

isis cost 1500

mpls

mpls ldp

RR1:

interface Ip-Trunk1

ip address 10.1.13.2 255.255.255.252

isis enable 1

isis circuit-level level-1

isis cost 1500

mpls

mpls ldp

Later, configure EBGP and propagate LoO isis routes into BGP on the ASBRs, according to the
requirements:

ASBR1:

ip ip-prefix I2B index 5 permit 172.16.1.1 32

ip ip-prefix I2B index 10 permit 172.16.1.20 32

ip ip-prefix I2B index 15 permit 172.16.1.3 32

ip ip-prefix I2B index 20 permit 172.16.1.4 32

ip ip-prefix I2B index 25 permit 172.16.1.5 32

ip ip-prefix I2B index 30 permit 172.16.1.6 32

#

route-policy I2B permit node 10

if-match ip-prefix I2B

bgp 100

peer 10.1.57.2 as-number 200

import-route isis 1 route-policy I2B

isis 1

is-level level-2

cost-style wide

network-entity 49.0002.afcb.bb33.8da5.00

is-name ASBR1

import-route bgp

ASBR2:

ip ip-prefix I2B index 5 permit 172.16.1.1 32

ip ip-prefix I2B index 10 permit 172.16.1.20 32

ip ip-prefix I2B index 15 permit 172.16.1.3 32

ip ip-prefix I2B index 20 permit 172.16.1.4 32

ip ip-prefix I2B index 25 permit 172.16.1.5 32

ip ip-prefix I2B index 30 permit 172.16.1.6 32

route-policy I2B permit node 10

if-match ip-prefix I2B

#
bgp 100

peer 10.1.68.2 as-number 200

import-route isis 1 route-policy I2B

isis 1

is-level level-2

cost-style wide

network-entity 49.0002.90ae.cef2.fa56.00

is-name ASBR2

import-route bgp

ASBR3:

ip ip-prefix I2B index 5 permit 172.16.1.11 32

ip ip-prefix I2B index 10 permit 172.16.1.2 32

ip ip-prefix I2B index 15 permit 172.16.1.9 32

route-policy I2B permit node 10

if-match ip-prefix I2B

bgp 200

peer 10.1.57.1 as-number 100

import-route isis 1 route-policy I2B

isis 1

is-level level-2

cost-style wide

network-entity 49.0003.0003.fbd6.a8b4.4da7.00
import-route bgp

ASBR4:

ip ip-prefix I2B index 5 permit 172.16.1.11 32

ip ip-prefix I2B index 10 permit 172.16.1.2 32

ip ip-prefix I2B index 15 permit 172.16.1.9 32

route-policy I2B permit node 10

if-match ip-prefix I2B

bgp 200

peer 10.1.68.1 as-number 100

import-route isis 1 route-policy I2B

isis 1

is-level level-2

cost-style wide

network-entity 49.0003.fbd6.a8b4.4da8.00

import-route bgp

Then, configure VPN instances according to HUB and SPOKE requirements and associate
corresponding interfaces to the VPNs.

PE3:

ip vpn-instance VPN1

ipv4-family

route-distinguisher 100:13

vpn-target 100:1 export-extcommunity

vpn-target 200:1 import-extcommunity

#

interface Mp-group0/0/0

ip binding vpn-instance VPN1

ip address 10.2.33.1 255.255.255.252

PE4:

ip vpn-instance VPN1

ipv4-family

route-distinguisher 100:14

vpn-target 100:1 export-extcommunity

vpn-target 200:1 import-extcommunity

interface GigabitEthernet0/0/1.1

dot1q termination vid 1

ip binding vpn-instance VPN1

ip address 10.2.41.2 255.255.255.252

arp broadcast enable

PE1:

ip vpn-instance VPN1_in

ipv4-family

route-distinguisher 100:11

vpn-target 100:1 import-extcommunity

ip vpn-instance VPN1_out

ipv4-family

route-distinguisher 100:12

vpn-target 200:1 export-extcommunity

#
interface GigabitEthernet0/0/1.1

dot1q termination vid 10

ip binding vpn-instance VPN1_in

ip address 10.2.11.2 255.255.255.252

arp broadcast enable

interface GigabitEthernet0/0/1.2

dot1q termination vid 20

ip binding vpn-instance VPN1_out

ip address 10.2.11.6 255.255.255.252

arp broadcast enable

PE2:

ip vpn-instance VPN1_in

ipv4-family

route-distinguisher 100:111

vpn-target 100:1 import-extcommunity

ip vpn-instance VPN1_out

ipv4-family

route-distinguisher 100:122

vpn-target 200:1 export-extcommunity

interface GigabitEthernet0/0/1.1

dot1q termination vid 1

ip binding vpn-instance VPN1_in

ip address 10.2.22.2 255.255.255.252

arp broadcast enable

#

interface GigabitEthernet0/0/1.2

dot1q termination vid 2

ip binding vpn-instance VPN1_out

ip address 10.2.22.6 255.255.255.252

arp broadcast enable

Later, configure EBGP PE-CE and OSPF PE-CE according to the requirements:

PE3:

ospf 2 vpn-instance VPN1

default-route-advertise

import-route bgp

area 0.0.0.1

network 10.2.33.0 0.0.0.3

bgp 200

ipv4-family vpn-instance VPN1

import-route ospf 2

CE3:

ospf 1

area 0.0.0.1

network 10.2.33.0 0.0.0.3

network 172.17.1.3 0.0.0.0

#
PE4:

ospf 2 vpn-instance VPN1

default-route-advertise

import-route bgp

area 0.0.0.0

network 10.2.41.0 0.0.0.3

bgp 200

ipv4-family vpn-instance VPN1

import-route ospf 2

CE4:

ip vpn-instance VPN1

ipv4-family

route-distinguisher 100:14

vpn-target 100:1 export-extcommunity

vpn-target 200:1 import-extcommunity

interface GigabitEthernet0/0/1.1

dot1q termination vid 1

ip binding vpn-instance VPN1

ip address 10.2.41.1 255.255.255.252

arp broadcast enable

interface LoopBack0
ip binding vpn-instance VPN1

ip address 172.17.1.4 255.255.255.255

interface LoopBack1

ip binding vpn-instance VPN1

ip address 10.3.3.4 255.255.255.255

ospf 2 vpn-instance VPN1

vpn-instance-capability simple

area 0.0.0.0

network 10.2.41.0 0.0.0.3

network 10.3.3.4 0.0.0.0

network 172.17.1.4 0.0.0.0

PE1:

bgp 100

ipv4-family vpn-instance VPN1_in

peer 10.2.11.1 as-number 65000

ipv4-family vpn-instance VPN1_out

peer 10.2.11.5 as-number 65000

peer 10.2.11.5 allow-as-loop

PE2:

bgp 100

ipv4-family vpn-instance VPN1_in

peer 10.2.22.1 as-number 65000

#
ipv4-family vpn-instance VPN1_out

peer 10.2.22.5 as-number 65000

peer 10.2.22.5 allow-as-loop

CE1:

ip ip-prefix O2B index 5 permit 10.3.1.0 24

ip ip-prefix O2B index 10 permit 10.3.2.0 24

route-policy O2B permit node 10

if-match ip-prefix O2B

bgp 65000

peer 10.2.11.2 as-number 100

peer 10.2.11.6 as-number 100

peer 172.17.1.2 as-number 65000

peer 172.17.1.2 connect-interface LoopBack0

network 172.17.1.1 255.255.255.255

import-route ospf 1 route-policy O2B

CE2:

ip ip-prefix O2B index 5 permit 10.3.1.0 24

ip ip-prefix O2B index 10 permit 10.3.2.0 24

route-policy O2B permit node 10

if-match ip-prefix O2B

#
bgp 65000

peer 10.2.22.2 as-number 100

peer 10.2.22.6 as-number 100

peer 172.17.1.1 as-number 65000

peer 172.17.1.1 connect-interface LoopBack0

network 172.17.1.2 255.255.255.255

import-route ospf 1 route-policy O2B

Then, consigure IBGP sessions for InterAS Option C solution 2:

PE1:

bgp 100

peer 172.16.1.3 as-number 100

peer 172.16.1.3 connect-interface LoopBack0

ipv4-family vpnv4

peer 172.16.1.3 enable

PE2:

bgp 100

peer 172.16.1.3 as-number 100

peer 172.16.1.3 connect-interface LoopBack0

ipv4-family vpnv4

peer 172.16.1.3 enable

RR1:

bgp 100
 peer 172.16.1.1 as-number 100

peer 172.16.1.1 connect-interface LoopBack0

peer 172.16.1.9 as-number 200

peer 172.16.1.9 ebgp-max-hop 20

peer 172.16.1.9 connect-interface LoopBack0

peer 172.16.1.20 as-number 100

peer 172.16.1.20 connect-interface LoopBack0

ipv4-family vpnv4

undo policy vpn-target

peer 172.16.1.1 enable

peer 172.16.1.1 reflect-client

peer 172.16.1.1 next-hop-invariable

peer 172.16.1.9 enable

peer 172.16.1.9 next-hop-invariable

peer 172.16.1.20 enable

peer 172.16.1.20 reflect-client

peer 172.16.1.20 next-hop-invariable

PE3:

bgp 200

peer 172.16.1.9 as-number 200

peer 172.16.1.9 connect-interface LoopBack0

ipv4-family vpnv4

peer 172.16.1.9 enable

PE4:
bgp 200

peer 172.16.1.9 as-number 200

peer 172.16.1.9 connect-interface LoopBack0

ipv4-family vpnv4

peer 172.16.1.9 enable

RR2:

bgp 200

peer 172.16.1.2 as-number 200

peer 172.16.1.2 connect-interface LoopBack0

peer 172.16.1.3 as-number 100

peer 172.16.1.3 ebgp-max-hop 20

peer 172.16.1.3 connect-interface LoopBack0

peer 172.16.1.11 as-number 200

peer 172.16.1.11 connect-interface LoopBack0

ipv4-family vpnv4

undo policy vpn-target

peer 172.16.1.2 enable

peer 172.16.1.2 reflect-client

peer 172.16.1.2 next-hop-invariable

peer 172.16.1.3 enable

peer 172.16.1.3 next-hop-invariable

peer 172.16.1.11 enable

peer 172.16.1.11 reflect-client

peer 172.16.1.11 next-hop-invariable

#
Later, configure BGP label capability and exchange as required for Inter AS option C Solution 2

ASBR1:

mpls

lsp-trigger bgp-label-route

route-policy LABEL permit node 10

apply mpls-label

interface GigabitEthernet0/0/2

ip address 10.1.57.1 255.255.255.252

mpls

bgp 100

peer 10.1.57.2 as-number 200

peer 10.1.57.2 route-policy LABEL export

peer 10.1.57.2 label-route-capability

ASBR2:

mpls

lsp-trigger bgp-label-route

route-policy LABEL permit node 10

apply mpls-label

interface GigabitEthernet0/0/2

ip address 10.1.68.1 255.255.255.252

mpls

bgp 100

peer 10.1.68.2 as-number 200

peer 10.1.68.2 route-policy LABEL export

peer 10.1.68.2 label-route-capability

ASBR3:

mpls

lsp-trigger bgp-label-route

route-policy LABEL permit node 10

apply mpls-label

interface GigabitEthernet0/0/2

ip address 10.1.57.2 255.255.255.252

mpls

bgp 200

peer 10.1.57.1 as-number 100

peer 10.1.57.1 route-policy LABEL export

peer 10.1.57.1 label-route-capability

ASBR4:

mpls
 lsp-trigger bgp-label-route

route-policy LABEL permit node 10

apply mpls-label

interface GigabitEthernet0/0/2

ip address 10.1.68.2 255.255.255.252

mpls

bgp 200

peer 10.1.68.1 as-number 100

peer 10.1.68.1 route-policy LABEL export

peer 10.1.68.1 label-route-capability

Verification commands:

display bgp routing-table label command on each ASBR to check label information

display mpls lsp on each PE to check for the LDP LSP to the peer PE

display ip routing-table on CEs

The following applies for requirement in 3.8:

ASBR1:

acl number 2345

rule 10 permit source 172.16.100.1 0.0.0.254

acl number 2346

rule 10 permit source 172.16.100.0 0.0.0.254

#
route-policy PATH permit node 10

if-match acl 2345

apply local-preference 333

route-policy PATH permit node 20

if-match acl 2346

apply local-preference 33

route-policy PATH permit node 30

bgp 100

peer 10.1.57.2 as-number 200

peer 10.1.57.2 route-policy PATH import

ASBR2:

acl number 2345

rule 10 permit source 172.16.100.1 0.0.0.254

acl number 2346

rule 10 permit source 172.16.100.0 0.0.0.254

route-policy PATH permit node 10

if-match acl 2345

apply local-preference 33

route-policy PATH permit node 20

if-match acl 2346

apply local-preference 333

#
route-policy PATH permit node 30

bgp 100

peer 10.1.68.2 as-number 200

peer 10.1.68.2 route-policy PATH import

ASBR3:

acl number 2345

rule 10 permit source 172.16.200.1 0.0.0.254

acl number 2346

rule 10 permit source 172.16.200.0 0.0.0.254

route-policy PATH permit node 10

if-match acl 2345

apply local-preference 333

route-policy PATH permit node 20

if-match acl 2346

apply local-preference 33

route-policy PATH permit node 30

bgp 200

peer 10.1.57.1 as-number 100

peer 10.1.57.1 route-policy PATH import

#
ASBR4:

acl number 2345

rule 10 permit source 172.16.200.1 0.0.0.254

acl number 2346

rule 10 permit source 172.16.200.0 0.0.0.254

route-policy PATH permit node 10

if-match acl 2345

apply local-preference 33

route-policy PATH permit node 20

if-match acl 2346

apply local-preference 333

route-policy PATH permit node 30

bgp 200

peer 10.1.68.1 as-number 100

peer 10.1.68.1 route-policy PATH import

The following applies for requirement in 3.13:

PE3/PE4:

acl number 2333

rule 5 permit source 10.3.1.0 0.0.0.255

acl number 2334

rule 5 permit source 10.3.2.0 0.0.0.255

#

route-policy LP permit node 10

if-match acl 2333

if-match ip next-hop ip-prefix PE1

apply local-preference 555

route-policy LP permit node 20

if-match acl 2333

if-match ip next-hop ip-prefix PE2

apply local-preference 55

route-policy LP permit node 30

if-match acl 2334

if-match ip next-hop ip-prefix PE1

apply local-preference 55

route-policy LP permit node 40

if-match acl 2334

if-match ip next-hop ip-prefix PE2

apply local-preference 555

route-policy LP permit node 50

bgp 200

ipv4-family vpnv4

peer 172.16.1.9 enable

peer 172.16.1.9 route-policy LP import

Verify: display bgp vpnv4 all routing-table on PE3 and PE4

NOTE: for requirement 3.12, this question was removed from the exam I took. According the BGP
route preference rule, PrefVal and LP are even before EBGP over IBGP criteria, however, no
matter what value (PrefVal or LP) you modify on CEs, EBGP route is installed over IBGP route
with better PrefVal or LP. Here a configuration example:

CE1:

route-policy LP permit node 10

apply local-preference 222

bgp 65000

peer 172.17.1.2 route-policy LP import

CE2:

route-policy LP permit node 10

apply local-preference 222

bgp 65000

peer 172.17.1.1 route-policy LP import

4. FEATURES

4.1 HA

CE1:

bfd
#
bfd isp bind peer-ip 100.0.1.2 interface GigabitEthernet2/0/1 one-arm-echo
discriminator local 1
min-echo-rx-interval 50
#
ip route-static 0.0.0.0 0.0.0.0 100.0.1.2 track bfd-session isp
#
ip ip-prefix DEFAULT index 5 permit 0.0.0.0 0
#
route-policy DEFAULT permit node 10
if-match ip-prefix DEFAULT
#
bgp 65000
default-route imported
 import-route static route-policy DEFAULT
#

CE2:

nqa test-instance test user

test-type icmp
destination-address ipv4 200.0.2.2
frequency 5
interval seconds 5
probe-count 1
start now
#
ip route-static 0.0.0.0 0.0.0.0 200.0.2.2 track nqa test user
#
ip ip-prefix DEFAULT index 5 permit 0.0.0.0 0
#
route-policy DEFAULT permit node 10
if-match ip-prefix DEFAULT
#
bgp 65000
default-route imported
import-route direct route-policy DEFAULT

NOTE: IBGP session and redistribution between CE1 and CE2 ensure the HA scenario when the
CE-PE link fails. For remote PE3 and PE4 to propagate the default route:

PE3:

#
ospf 2 vpn-instance VPN1
default-route-advertise
import-route bgp
area 0.0.0.1
network 10.2.33.0 0.0.0.3
#

PE4:

#
ospf 2 vpn-instance VPN1
default-route-advertise
import-route bgp
area 0.0.0.0
network 10.2.41.0 0.0.0.3
#

4.2 NAT

CE1:

#
 acl number 2111
rule 5 deny source 10.3.2.10 0
rule 10 permit source 10.3.0.0 0.0.255.255
#
nat address-group 1 102.0.1.2 102.0.1.6
#
nat alg ftp enable
#
interface GigabitEthernet2/0/1
ip address 100.0.1.1 255.255.255.252
traffic-policy P1 outbound
nat server protocol tcp global 102.0.1.1 www inside 10.3.2.10 8080
nat server protocol tcp global 102.0.1.1 ftp inside 10.3.2.10 ftp
nat outbound 2111 address-group 1

CE2:

#
acl number 2111
rule 5 deny source 10.3.2.10 0
rule 10 permit source 10.3.0.0 0.0.255.255
#
nat address-group 1 102.0.1.2 102.0.1.6
#
nat alg ftp enable
#
interface GigabitEthernet2/0/2
ip address 200.0.2.1 255.255.255.252
traffic-policy P1 outbound
nat server protocol tcp global 102.0.1.1 www inside 10.3.2.10 8080
nat server protocol tcp global 102.0.1.1 ftp inside 10.3.2.10 ftp
nat outbound 2111 address-group 1
#

4.3 QoS

CE1:

#
time-range working_time 08:00 to 18:00 working-day
#
acl number 3111
rule 5 permit tcp destination-port range 6881 6999 time-range working_time
#
traffic classifier C1 operator or
if-match acl 3111
#
traffic behavior B1
car cir 1000 cbs 188000 pbs 313000 green pass yellow pass red discard
 #
traffic policy P1
classifier C1 behavior B1
#
#
interface GigabitEthernet2/0/1
traffic-policy P1 outbound
#

CE2:

#
time-range working_time 08:00 to 18:00 working-day
#
acl number 3111
rule 5 permit tcp destination-port range 6881 6999 time-range working_time
#
traffic classifier C1 operator or
if-match acl 3111
#
traffic behavior B1
car cir 1000 cbs 188000 pbs 313000 green pass yellow pass red discard
#
traffic policy P1
classifier C1 behavior B1
#
interface GigabitEthernet2/0/2
traffic-policy P1 outbound
#

5. IPv6

5.1 Basic Configurations

IPv6 address configurations already done in section 1.

5.2 IPv6 IGP

PE1:

isis 1

is-level level-1

cost-style wide

network-entity 49.0001.ea4c.8def.d3e1.00

is-name PE1
 #

ipv6 enable topology ipv6

interface Ip-Trunk1

ipv6 enable

ip address 10.1.13.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1300/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1550

isis cost 1500

mpls

mpls ldp

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.12.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1200/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 20

isis cost 20

mpls

mpls ldp

PE2:

#
isis 1

is-level level-1

cost-style wide

network-entity 49.0001.ea4c.8def.d3e2.00

is-name PE2

ipv6 enable topology ipv6

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.12.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1201/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 20

isis cost 20

mpls

mpls ldp

interface GigabitEthernet0/0/2

ipv6 enable

ip address 10.1.24.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:2400/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1500

isis cost 1500

mpls
 mpls ldp

RR1:

isis 1

cost-style wide

network-entity 49.0001.0000.0000.0003.00

is-name RR1

import-route isis level-2 into level-1

ipv6 enable topology ipv6

ipv6 import-route isis level-2 into level-1 // Apply L2 to L2 route propagation for ISISv6

interface Ip-Trunk1

ipv6 enable

ip address 10.1.13.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1302/127

isis enable 1

isis ipv6 enable 1

isis circuit-level level-1

isis ipv6 cost 1550

isis cost 1500

mpls

mpls ldp

interface GigabitEthernet0/0/0

ipv6 enable
 ip address 10.1.34.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3401/127

isis enable 1

isis ipv6 enable 1

isis circuit-level level-2

isis ipv6 cost 80

isis cost 100

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.35.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3501/127

isis enable 1

isis ipv6 enable 1

isis circuit-level level-2

isis ipv6 cost 860

isis cost 1000

mpls

mpls ldp

P1:

isis 1

cost-style wide

timer lsp-generation 1 50 50 level-1

timer lsp-generation 1 50 50 level-2

flash-flood level-1
 flash-flood level-2

network-entity 49.0001.74dd.fffe.cc34.00

is-name P1

import-route isis level-2 into level-1

timer spf 1 100 100

ipv6 enable topology ipv6

ipv6 import-route isis level-2 into level-1 // Apply L2 to L2 route propagation for ISISv6

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.34.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3401/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 80

isis cost 1000

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.46.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:4600/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1000

isis cost 1000

mpls
 mpls ldp

interface GigabitEthernet0/0/2

ipv6 enable

ip address 10.1.24.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:2401/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1500

isis cost 1500

mpls

mpls ldp

ASBR1:

isis 1

is-level level-2

cost-style wide

network-entity 49.0002.afcb.bb33.8da5.00

is-name ASBR1

import-route bgp

ipv6 enable topology ipv6

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.56.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:5600/127

 isis enable 1

isis ipv6 enable 1

isis ipv6 cost 100

isis cost 50

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.35.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3501/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 860

isis cost 1000

mpls

mpls ldp

ASBR2:

isis 1

is-level level-2

cost-style wide

network-entity 49.0002.90ae.cef2.fa56.00

is-name ASBR2

import-route bgp

ipv6 enable topology ipv6

 #

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.56.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:5601/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 100

isis cost 50

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.46.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:4601/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1000

isis cost 1000

mpls

mpls ldp

5.3 IPv6 Multicast

PE1:

multicast ipv6 routing-enable

pim-ipv6

spt-switch-threshold 1024

interface Ip-Trunk1

ipv6 enable

ip address 10.1.13.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1300/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1550

isis cost 1500

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.12.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1200/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 20

isis cost 20

pim ipv6 sm

mpls
 mpls ldp

PE2:

multicast ipv6 routing-enable

pim-ipv6

spt-switch-threshold 1024

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.12.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1201/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 20

isis cost 20

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/2

ipv6 enable

ip address 10.1.24.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:2400/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1500

 isis cost 1500

pim ipv6 sm

mpls

mpls ldp

RR1:

multicast ipv6 routing-enable

pim-ipv6

spt-switch-threshold 1024

interface Ip-Trunk1

ipv6 enable

ip address 10.1.13.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1302/127

isis enable 1

isis ipv6 enable 1

isis circuit-level level-1

isis ipv6 cost 1550

isis cost 1500

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.34.1 255.255.255.252

 ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3401/127

isis enable 1

isis ipv6 enable 1

isis circuit-level level-2

isis ipv6 cost 80

isis cost 100

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.35.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3501/127

isis enable 1

isis ipv6 enable 1

isis circuit-level level-2

isis ipv6 cost 860

isis cost 1000

pim ipv6 sm

mpls

mpls ldp

P1:

multicast ipv6 routing-enable

pim-ipv6
 spt-switch-threshold 1024

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.34.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3401/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 80

isis cost 1000

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.46.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:4600/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1000

isis cost 1000

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/2

ipv6 enable

ip address 10.1.24.2 255.255.255.252

 ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:2401/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1500

isis cost 1500

pim ipv6 sm

mpls

mpls ldp

ASBR1:

multicast ipv6 routing-enable

acl ipv6 number 2777

rule 5 permit source FF1E::/112

pim-ipv6

c-bsr 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5

c-rp 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5 group-policy 2777

spt-switch-threshold 1024

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.56.1 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:5600/127

isis enable 1

isis ipv6 enable 1

 isis ipv6 cost 100

isis cost 50

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.35.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:3501/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 860

isis cost 1000

pim ipv6 sm

mpls

mpls ldp

interface LoopBack0

ipv6 enable

ip address 172.16.1.5 255.255.255.255

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5/128

isis enable 1

isis ipv6 enable 1

pim ipv6 sm

ASBR2:

#
multicast ipv6 routing-enable

acl ipv6 number 2777

rule 5 permit source FF1E::/112

pim-ipv6

c-bsr 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5

c-rp 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5 group-policy 2777

spt-switch-threshold 1024

interface GigabitEthernet0/0/0

ipv6 enable

ip address 10.1.56.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:5601/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 100

isis cost 50

pim ipv6 sm

mpls

mpls ldp

interface GigabitEthernet0/0/1

ipv6 enable

ip address 10.1.46.2 255.255.255.252

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:4601/127

isis enable 1

isis ipv6 enable 1

isis ipv6 cost 1000

 isis cost 1000

pim ipv6 sm

mpls

mpls ldp

interface LoopBack0

ipv6 enable

ip address 172.16.1.6 255.255.255.255

ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA6/128

isis enable 1

isis ipv6 enable 1

pim ipv6 sm

MLD requirement:

PE1:

interface Ethernet0/0/0

ipv6 enable

ipv6 address 3000:E85A:8CA2:BF40:C45A:89EE:CBDF:ADD1/112

mld enable

mld static-group FF1E::AA