新盟教育在线培训中心

新盟教育网络和网络安全培训中心

CCIE Enterprise Infrastructure Lab

Version: Lab 1.0 真题+解法
【Part2】

祝愿即将考试的小伙伴一切顺利
 新盟教育在线培训中心

Workbook Description

Author: ThinkMo NetWork Lab

Content: CCIE Enterprise Infrastructure Lab Version: Lab 1.0

Document Revision:4.0

Document Revision Date:16-September-2021

Content: Topology, Question, Solution, Verification, Initial Configuration

 新盟教育在线培训中心

Table of Contents

Section 1: Existing Network Review &Tuning

1.1 Introduction
1.2 Layer 2 Technologies in HQ---------2 point
1.3 First Hop Redundancy Protocol in HQ--------2 point
1.4 OSPFv2 Between HQ & DC---------3 point
1.5 DHCP IPv4 Services for HQ---------2 point
1.6 IPv6 in HQ-----------------------------1 point
1.7 IPv6 EIGRP in HQ-------------------2 point
1.8 OSPFv2 in DC ------------------------4 point
1.9 BGP Between HQ & DC and Service Providers------------3 point
1.10 Bringing Up VPNv4/VPNv6 in SP1 --------3 point
1.11 Fixing DMVPN Network Between DC and Branches3&4
1.12 Tuning EIGRP on DMVPN and DMVPN Enabled Sites
1.13 IPv4 Networks on Legacy Branches
1.14 Multicast in FADB2
1.15 Extending Connectivity to IAAS
1.16 Enabling Internet access to FADB2

Section 2: Implementing Proof of Concept SDX Branches

2.1 Correcting the IP Adresses of Managed Switches in DNA Center
2.2 Completing VN Configuration in DNA Center
2.3 Mapping SDA VNs to SD-WAN VPNs
2.4 Configuring SD-WAN VPN Route Leaking
2.5 Handling Guest Traffic
2.6 Support for Silent Hosts in Branch#2

Section 3: Making use of Programmability

3.1 Enabling CLI Access to R30
3.2 Using Guest Shell and Python on r30
3.3 Automated Configuration Backup Script
3.4 The End
 新盟教育在线培训中心

SECTION 1.6: IPv6 in HQ(1 points)

QUESTION
Implement IPv6 on sw101 and sw102 for switch virtual interfaces (SVI's)
Vlan2000 and Vlan2001 according to these requirements:
1. SW101
·Interface VLAN 2000：2001:DB8:1:100::1/64
·Interface VLAN 2001：2001:DB8:1:101::1/64
2. SW102
·Interface VLAN 2000：2001:DB8:1:100::2/64
·Interface VLAN 2001：2001:DB8:1:101::2/64
3. The configuration must enable hosts in these VLANs to obtain their IPv6
configuration via SLAAC and keep a stable connectivity with other IPv6 networks
4. Use native IPv6 means to provide gateway redundancy with sw101 being the
preferred gateway in VLAN 2000 and sw102 being the preferred gateway in VLAN
2001. The role must be determined by an explicit configuration solely on the intended
preferred gateway.
5. Hosts must be able to detect the failure of the preferred gateway in as little as 3
seconds.
 新盟教育在线培训中心

Solution
On sw101
sw101(config)#interface vlan 2000
sw101(config-if)#ipv6 enable
sw101(config-if)#ipv6 address 2001:DB8:1:100::1/64
sw101(config-if)#ipv6 nd router-preference high
sw101(config-if)#ipv6 nd ra interval msec 1000
sw101(config-if)#ipv6 nd ra lifetime 3
sw101(config-if)#exit
sw101(config)#
sw101(config)#interface vlan 2001
sw101(config-if)#ipv6 address 2001:DB8:1:101::1/64
sw101(config-if)#ipv6 nd ra interval msec 1000
sw101(config-if)#ipv6 nd ra lifetime 3
sw101(config-if)#exit
sw101(config)#

On sw102
sw102(config)#interface Vlan2000
sw102(config-if)#ipv6 address 2001:DB8:1:100::2/64
sw102(config-if)#ipv6 nd ra interval msec 1000
sw102(config-if)#ipv6 nd ra lifetime3
sw102(config-if)#exit
sw102(config)#
sw102(config)#interface Vlan2001
sw102(config-if)#ipv6 address 2001:DB8:1:101::2/64
sw102(config-if)#ipv6 nd router-preference high
sw102(config-if)#ipv6 nd ra interval msec1000
sw102(config-if)#ipv6 nd ra lifetime 3
sw102(config-if)#exit
sw102(config)#
 新盟教育在线培训中心

Verification
 新盟教育在线培训中心

SECTION 1.7: IPV6 EIGRP in HQ (2 points)

QUESTION
In HQ enable EIGRP for IPv6 on r11,r12, sw101 and sw102 according to
these requirements:
1. Use process name"ccie"(without the quotes) and AS number 65001.
2. Do not configure any additional IPv6 addresses
3. IPv6 EIGRP may form adjacencies only over the physical Layer3 interface
between r11,r12, sw101and sw102.
4. Prevent IPv6 EIGRP from automatically running on, or advertising attached
prefixes from new IPv6-enabled interfaces in the future unless allowed explicitly.
5. Ensure that the attached IPv6 prefixes on SVI's Vlan2000 and Vlan2001 on
SW101 and sw102 are advertised in IPv6 EIGRP and learned on r11 and r12.
6. No route filtering is allowed to accomplish this entire task.
 新盟教育在线培训中心

Solution
On r11
r11(config)#router eigrp ccie
r11(config-router)#address-family ipv6 unicast autonomous-system 65001
r11(config-router-af)#af-interface default
r11(config-router-af-interface)#passive-interface
r11(config-router-af-interface)#shutdown
r11(config-router-af-interface)#exit-af-interface
r11(config-router-af)#
r11(config-router-af)#af-interface gigabitEthernet 0/1 【连接R12】
r11(config-router-af-interface)#no passive-interface
r11(config-router-af-interface)#no shutdown
r11(config-router-af-interface)#exit-af-interface
r11(config-router-af)#
r11(config-router-af)#af-interface gigabitEthernet 0/2 【连接SW102】
r11(config-router-af-interface)#no passive-interface
r11(config-router-af-interface)#no shutdown
r11(config-router-af-interface)#exit-af-interface
r11(config-router-af-interface)#exit
r11(config-router-af)#
r11(config-router-af)#af-interface gigabitEthernet 0/3 【连接SW101】
r11(config-router-af-interface)#no passive-interface
r11(config-router-af-interface)#no shutdown
r11(config-router-af-interface)#exit-af-interface
r11(config-router-af)#exit-address-family
r11(config-router)#exit

r11(config-router-af)#af-interface loopback 0
r11(config-router-af-interface)#no shutdown
r11(config-router-af-interface)#exit-address-family
r11(config-router)#exit
 新盟教育在线培训中心

On r12
r12(config)#router eigrp ccie
r12(config-router)#address-family ipv6 unicast autonomous-system 65001
r12(config-router-af)#af-interface default
r12(config-router-af-interface)#passive-interface
r12(config-router-af-interface)#shutdown
r12(config-router-af-interface)#exit-af-interface
r12(config-router-af)#
r12(config-router-af)#af-interface gigabitEthernet 0/1 【连接R11】
r12(config-router-af-interface)#no passive-interface
r12(config-router-af-interface)#no shutdown
r12(config-router-af-interface)#exit-af-interface
r12(config-router-af)#
r12(config-router-af)#af-interface gigabitEthernet 0/2 【连接SW101】
r12(config-router-af-interface)#no passive-interface
r12(config-router-af-interface)#no shutdown
r12(config-router-af-interface)#exit
r12(config-router-af)#
r12(config-router-af)#af-interface gigabitEthernet 0/3 【连接SW102】
r12(config-router-af-interface)#no passive-interface
r12(config-router-af-interface)#no shutdown
r12(config-router-af-interface)#exit
r12(config-router-af)#exit-address-family
r12(config-router)#exit
r12(config)#
r12(config-router-af)#af-interface loopback 0
r12(config-router-af-interface)#no shutdown
r12(config-router-af-interface)#exit-af-interface
r12(config-router)#exit
 新盟教育在线培训中心

On sw101
sw101(config)#router eigrp ccie
sw101(config-router)#address-family ipv6 unicast autonomous-system 65001
sw101(config-router-af)#af-interface default
sw101(config-router-af-interface)#passive-interface
sw101(config-router-af-interface)#shutdown
sw101(config-router-af-interface)#exit-af-interface
sw101(config-router-af)#
sw101(config-router-af)#af-interface gigabitEthernet 0/0 【连接R11】
sw101(config-router-af-interface)#no passive-interface
sw101(config-router-af-interface)#no shutdown
sw101(config-router-af-interface)#exit-af-interface
sw101(config-router-af)#
sw101(config-router-af)#af-interface gigabitEthernet 0/1 【连接R12】
sw101(config-router-af-interface)#no passive-interface
SW101(config-router-af-interface)#no shutdown
sw101(config-router-af-interface)#exit
sw101(config-router-af)#exit-address-family
sw101(config-router)#exit
sw101(config)#
sw101(config-router-af)#af-interface vlan 2000
sw101(config-router-af-interface)#no shutdown
sw101(config-router-af-interface)#exit-af-interface
sw101(config-router-af)#af-interface vlan 2001
sw101(config-router-af-interface)#no shutdown
sw101(config-router-af-interface)#exit-af-interface
sw101(config-router-af)#exit-address-family

On sw102
sw102(config)#router eigrp ccie
sw102(config-router)#address-family ipv6 unicast autonomous-system 65001
sw102(config-router-af)#af-interface default
 新盟教育在线培训中心

sw102(config-router-af-interface)#passive-interface
sw102(config-router-af-interface)#shutdown
sw102(config-router-af-interface)#exit-af-interface
sw102(config-router-af)#
sw102(config-router-af)#af-interface gigabitEthernet 0/0 【连接R12】
sw102(config-router-af-interface)#no passive-interface
sw102(config-router-af-interface)#no shutdown
sw102(config-router-af-interface)#exit-af-interface
sw102(config-router-af)#
sw102(config-router-af)#af-interface gigabitEthernet 0/1 【连接R11】
sw102(config-router-af-interface)#no passive-interface
sw102(config-router-af-interface)#no shutdown
sw102(config-router-af-interface)#exit
sw102(config-router-af)#exit-address-family
sw102(config)#
sw102(config-router-af-interface)#af-interface vlan2000
sw102(config-router-af-interface)#no shutdown
sw102(config-router-af-interface)#exit-af-interface
sw102(config-router-af-interface)#af-interface vlan2001
sw102(config-router-af-interface)#no shutdown
sw102(config-router-af-interface)#exit-af-interface
sw102(config-router)#exit
 新盟教育在线培训中心

Verification
新盟教育在线培训中心
 新盟教育在线培训中心

注意：考场Host11和Host12皆是Debain系统的桌面版主机
 新盟教育在线培训中心

SECTION 1.8: OSPFv2 in DC(4 points)

QUESTION
Configure devices in the DC according to these requirements:
1. Switches sw201 and sw202 must establish a stable OSPF adjacency in the Full
state with vedge21 and vedge22 on interface Vlan3999. Any configuration changes and
corrections necessary to meet this requirement may be performed only on the switches
and any mismatched parameters causing the issue must be changed to exactly match
the configuration of the vedges.
2. All OSPF speakers in the DC running Cisco IOS and IOS-XE software must be
configured to keep the number of advertised internal routes to an absolute minimum
while not impacting the reachability of the services. This includes the reachability of
ISE, DNA Center, vManage, vBond, VSmart on their internal(In Band Connectivity)
addresses as well as any existing and future devices in VLAN4000 on sw201 and
SW202. The configuration of this requirement must be completed exclusively within
the "router ospf"and "interface Vlan"context without causing any impact to existing
OSPF adjacencies.
3. Router r24 must advertise two prefixes,10.6.0.0/16 and 10.200.0.0/24 as Type-
5 LSAs in OSPFv2 to provide HQ and DC with the reachability to the DMVPN tunnel
and Branches#3 and #4. The configuration of this requirement must be completed
exclusively within the "router ospf" context.
4. Any route from 10.2.0.0/16 range that keeps being advertised in OSPF must
continue being advertised as an intra-area route.
5. It is not allowed to modify existing areas to accomplish this entire task.
 新盟教育在线培训中心

Solution
On sw201
sw201(config)#router ospf 1
sw201(config-router)#prefix-suppression
sw201(config-router)#exit
sw201(config)#

sw201(config)#interface vlan 3999

sw201(config-if)#ip mtu 1496
sw201(config-if)#exit

sw201(config)#interface vlan 4000

sw201(config-if)#ip ospf prefix-suppression disable
sw201(config-if)#exit

On sw202
sw202(config)#router ospf 1
sw202(config-router)#prefix-suppression
sw202(config-router)#exit
sw202(config)#

sw202(config)#interface vlan 3999

sw202(config-if)#ip mtu 1496
sw202(config-if)#exit

sw202(config)#int vlan 4000

sw202(config-if)#ip ospf prefix-suppression disable
sw202(config-if)#exit

On sw211
sw211(config)#router ospf 1
sw211(config-router)#router-id 10.2.255.211
 新盟教育在线培训中心

sw211(config-router)#prefix-suppression
sw211(config-router)#passive-interface GigabitEthernet1/1 //注意考场时G口
sw211(config-router)#passive-interface GigabitEthernet1/2
sw211(config-router)#passive-interface GigabitEthernet1/3
sw211(config-router)#exit
sw211(config)#

On sw212
sw212(config)#router ospf 1
sw212(config-router)#router-id 10.2.255.212
sw212(config-router)#prefix-suppression
sw212(config-router)#passive-interface GigabitEthernet1/1 //一定记住是连接谁
sw212(config-router)#passive-interface GigabitEthernet1/2
sw212(config-router)#exit
sw212(config)#

On r21
r21(config)#router ospf 1
r21(config-router)#router-id 10.2.255.21
r21(config-router)#prefix-suppression
r21(config-router)#exit
r21(config)#
On r22
r22(config)#router ospf 1
r22(config-router)#router-id 10.2.255.22
r22(config-router)#prefix-suppression
r22(config-router)#exit
On r23
r23(config)# router ospf 1
r23(config-router)#prefix-suppression
r23(config-router)# prefix-suppression
r23(config-router)# exit
 新盟教育在线培训中心

On r24
r24(config)# router ospf 1
r24(config-router)# redistribute eigrp 65006 subnets
r24(config-router)# summary-address 10.6.0.0 255.255.0.0
r24(config-router)# summary-address 14.0.0.0 255.0.0.0 not-advertise
r24(config-router)# prefix-suppression
r24(config-router)# exit
r24(config)#
整个Section1做完之后注意校验下面的效果图
Verification
 新盟教育在线培训中心

SECTION 1.9: BGP between HQ-DC and Service Providers

(3 Points)
QUESTION
Configure the BGP peering between HQ/DC and Global SP #1 and Global SP
#2 according to these requirements:
1. Bring up the BGP peering between HQ r11 and SP#1 r3
2. Bring up the BGP peering between DC r21 and SP#1 r3
3. Bring up the BGP peering between DC r22 and SP#2
4. Ensure that the routes learned over eBGP sessions and further advertised in
iBGP will beconsidered reachable even if the networks on inter-AS links are not
advertised in OSPF. The configuration of this requirement must be completed
exclusively with the "router bgp"context.
5. On r11,r21,r22 perform mutual redistribution between OSPFv2 and BGP.
However, prevent routes that were injected into OSPF from BGP to be reinjected back
into BGP. This requirement must be solved on r11,r21,r22 using only a single route-
map on each of the routers and without any reference to ACLs, prefix lists, or route-
types.
6. Prevent HQ and DC from ever communicating through SP#1 r3. All
communication between HQ and DC must occur only over the direct sw101/sw201 and
sw102/sw202 interconnections. Any other communication must remain unaffected.
This requirement must be solved on r21 and r22 by route filtering based on a well-
known mandatory attribute without the use of route-maps.
7. No command may be removed from configuration on r11 to accomplish this
entire task.
8. It is not allowed to modify existing configuration commands on r21 and r22 to
accomplish this entire task.
 新盟教育在线培训中心

Solution
On r11
r11(config)# router ospf 1
r11(config-router)# redistribute bgp 65001 subnets tag 200
r11(config-router)# exit
r11(config)#

r11(config)# ip as-path access-list 1 deny _65002_

r11(config)# ip as-path access-list 1 permit .*
备注：_65002_表示字符串中间有65002，即AS_PATH中有65002，表示匹配经过
AS65002的路由。
.* 表示匹配任意字符串，即AS_PATH为任意，表示匹配所有路由。
r11(config)# route-map NO deny 10
r11(config-route-map)# match tag 200
r11(config-route-map)# exit
r11(config)# route-map NO permit 20
r11(config-route-map)# exit
r11(config)#

r11(config)# router bgp 65001

r11(config-router)#bgp router-id 10.1.255.11
r11(config-router)# neighbor 100.3.11.1 remote-as 10000
r11(config-router)# address-family ipv4
r11(config-router-af)# neighbor 100.3.11.1 activate
r11(config-router-af)# redistribute ospf 1 route-map NO
r11(config-router-af)# neighbor 100.3.11.1 filter 1 in
//此处不需要携带外部路由，不需要match internal external
r11(config-router-af)# exit
r11(config)#

On r21
r21(config)# router ospf 1
 新盟教育在线培训中心

r21(config-router)# redistribute bgp 65002 subnets tag 200

r21(config-router)# exit
r21(config)# ip as-path access-list 1 deny _65001$
r21(config)# ip as-path access-list 1 permit .*
备注： _65001$ 表示匹配字符串最后为65001，即AS_PATH最右边AS
（起始AS）为65001，表示匹配AS65001始发的路由。
r21(config)# route-map NO deny 10
r21(config-route-map)# match tag 200
r21(config-route-map)# exit
r21(config)# route-map NO permit 20
r21(config-route-map)# exit

r21(config)# router bgp 65002

r21(config-router)# neighbor 10.2.255.22 next-hop-self
r21(config-router)# neighbor 100.3.21.1 remote-as 10000
r21(config-router)# neighbor 100.3.21.1 filter-list 1 in
r21(config-router)# redistribute ospf 1 match internal external route-map NO
r21(config-router)# exit

On r22
r22(config)# router ospf 1
r22(config-router)# redistribute bgp 65002 subnets tag 200
r22(config-router)# exit
r22(config)#

r22(config)# route-map NO deny 10

r22(config-route-map)# match tag 200
r22(config-route-map)# exit
r22(config)# route-map NO permit 20
r22(config-route-map)# exit
r22(config)#
r22(config)# router bgp 65002
 新盟教育在线培训中心

r22(config-router)# neighbor 101.22.0.1 remote-as 10001

r22(config-router)# redistribute ospf 1 match internal external route-map NO
r22(config-router)# exit
 新盟教育在线培训中心

Verification
 新盟教育在线培训中心

SECTION 1.10: Bringing up VPNv4/VPNv6 in SP#1 (3 Points)

QUESTION
Configure routers r3,r4,r5 and r6 in SP#1 accoding to these requirements:
1. Configure r3 through r6 for mutual VPNv4 and VPNv6 route exchange without
the use of a route-reflector. Use Lo0 IPv4 addresses for peerings.
2. Configure r3 through r6 to assign(allocate/bind) as few unique MPLS labels to
all existing and future VPNv4 and VPNv6 routes as possible.
3. On routers r3 through r6, prevent any existing and future customer from
discovering details about the inner topology of SP#1, It is not allowed to use ACLs to
accomplish this requirement.
 新盟教育在线培训中心

Solution
On r3
r3(config)# router bgp 10000
r3(config-router)#bgp router-id 100.255.254.3
r3(config-router)# neighbor 100.255.254.4 remote-as 10000
r3(config-router)# neighbor 100.255.254.4 update-source Loopback0
r3(config-router)# neighbor 100.255.254.5 remote-as 10000
r3(config-router)# neighbor 100.255.254.5 update-source Loopback0
r3(config-router)# neighbor 100.255.254.6 remote-as 10000
r3(config-router)# neighbor 100.255.254.6 update-source Loopback0
r3(config-router)# address-family vpnv4
r3(config-router-af)# neighbor 100.255.254.4 activate
r3(config-router-af)# neighbor 100.255.254.5 activate
r3(config-router-af)# neighbor 100.255.254.6 activate
r3(config-router-af)# exit-address-family

r3(config-router)# address-family vpnv6

r3(config-router-af)# neighbor 100.255.254.4 activate
r3(config-router-af)# neighbor 100.255.254.5 activate
r3(config-router-af)# neighbor 100.255.254.6 activate
r3(config-router-af)# exit-address-family
r3(config-router)# exit

On r4
r4(config)# router bgp 10000
r4(config-router)# neighbor 100.255.254.3 remote-as 10000
r4(config-router)# neighbor 100.255.254.3 update-source Loopback0
r4(config-router)# neighbor 100.255.254.5 remote-as 10000
r4(config-router)# neighbor 100.255.254.5 update-source Loopbacko
 新盟教育在线培训中心

r4(config-router)# neighbor 100.255.254.6 remote-as 10000

r4(config-router)# neighbor 100.255.254.6 update-source Loopbacko
r4(config-router)# address-family vpnv4
r4(config-router-af)# neighbor 100.255.254.3 activate
r4(config-router-af)# neighbor 100.255.254.5 activate
r4(config-router-af)# neighbor 100.255.254.6 activate
r4(config-router-af)# exit-address-family
r4(config-router)# address-family vpnv6
r4(config-router-af)# neighbor 100.255.254.3 activate
r4(config-router-af)# neighbor 100.255.254.5 activate
r4(config-router-af)# neighbor 100.255.254.6 activate
r4(config-router-af)# exit-address-family
r4(config-router)# exit
r4(config)#

On r5
r5(config)# router bgp 10000
r5(config-router)# neighbor 100.255.254.3 remote-as 10000
r5(config-router)# neighbor 100.255.254.3 update-source Loopback0
r5(config-router)# neighbor 100.255.254.4 remote-as 10000
r5(config-router)# neighbor 100.255.254.4 update-source Loopback0
r5(config-router)# neighbor 100.255.254.6 remote-as 10000
r5(config-router)# neighbor 100.255.254.6 update-source Loopback0
r5(config-router)# address-family vpnv4
r5(config-router-af)# neighbor 100.255.254.3 activate
r5(config-router-af)# neighbor 100.255.254.4 activate
 新盟教育在线培训中心

r5(config-router-af)# neighbor 100.255.254.6 activate

r5(config-router-af)# exit-address-family
r5(config-router)# address-family vpnv6
r5(config-router-af)# neighbor 100.255.254.3 activate
r5(config-router-af)# neighbor 100.255.254.4 activate
r5(config-router-af)# neighbor 100.255.254.6 activate
r5(config-router-af)# exit-address-family
r5(config-router)# exit
r5(config)#

On r6
r6(config)# router bgp 10000
r6(config-router)# bgp router-id 10.255.254.6
r6(config-router)# bgp log-neighbor-changes
r6(config-router)# neighbor 100.255.254.3 remote-as 10000
r6(config-router)# neighbor 100.255.254.3 update-source Loopback0
r6(config-router)# neighbor 100.255.254.4 remote-as 10000
r6(config-router)# neighbor 100.255.254.4 update-source Loopback0
r6(config-router)# neighbor 100.255.254.5 remote-as 10000
r6(config-router)# neighbor 100.255.254.5 update-source Loopback0
r6(config-router)# address-family vpnv4
r6(config-router-af)# neighbor 100.255.254.3 activate
r6(config-router-af)# neighbor 100.255.254.4 activate
r6(config-router-af)# neighbor 100.255.254.5 activate
r6(config-router-af)# exit-address-family
r6(config-router)# address-family vpnv6
r6(config-router-af)# neighbor 100.255.254.3 activate
r6(config-router-af)# neighbor 100.255.254.4 activate
r6(config-router-af)# neighbor 100.255.254.5 activate
r6(config-router-af)# exit-address-family
 新盟教育在线培训中心

r6(config-router)# exit r6(config)#

Verification
 新盟教育在线培训中心

Note:Do not try to match the prefixes as shown，the output is taken

after completion of complete lab or in between.In exam you will see
exact prefixes.