ENARSI SA Troubleshooting - ILM

Download as pdf or txt
Download as pdf or txt
You are on page 1of 21

ENARSI Skills Assessment - Troubleshooting (Instructor Version)

Instructor Note: Red f ont color or gray highlights indicate text that appears in the instructor copy only.

Topology

Addressing Table
Device Interface IPv4 Address/Mask IPv6 Address/Prefix Length Link-Local Address

R1 G0/0/0 209.165.200.1/24 2001:db8:200::1/64 f e80::1:1

R1
G0/0/1 10.165.249.1/24 2001:db8:249::1/64 f e80::1:2

R1
Loopback 0 10.0.0.1/24 2001:db8:10::1/64 f e80::1:3

R1
Loopback 1 10.165.248.1/24 2001:db8:248::1/64 f e80::1:4

R2 G0/0/0 209.165.200.2/24 2001:db8:200::2/64 f e80::2:1

R2
G0/0/1 209.165.201.2/24 2001:db8:201::2/64 f e80::2:2

R2
Loopback 0 172.16.0.1/24 2001:db8:172::1/64 f e80::2:3

R2
Loopback 1 209.165.224.1/24 2001:db8:224::1/64 f e80::2:4

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 1 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

Device Interface IPv4 Address/Mask IPv6 Address/Prefix Length Link-Local Address

R3 G0/0/0 209.165.201.1/24 2001:db8:201::1/64 f e80::3:1

R3
G0/0/1 192.168.241.1/24 2001:db8:241::1/64 f e80::3:2

R3
Loopback 0 192.168.0.1/24 2001:db8:192::1/64 f e80::3:3

R3
Loopback 1 192.168.240.1/24 2001:db8:240::1/64 f e80::3:4

D1 G1/0/11 10.165.249.2/25 2001:db8:249::2/64 f e80::d1:1

D1
VLAN 250 10.165.250.1/24 2001:db8:24a::1/64 f e80::d1:2

D1
VLAN 251 10.165.251.1/24 2001:db8:24b::1/64 f e80::d1:3

D2 G1/0/11 192.168.241.2/24 2001:db8:241::2/64 f e80::d2:1

D2
VLAN 242 192.168.242.1/24 2001:db8:242::1/64 f e80::d2:2

D2
VLAN 243 192.168.243.1/24 2001:db8:243::1/64 f e80::d2:3
A1 VLAN 250 10.165.250.2/24 2001:db8:24a::2/64 f e80::a1:1

PC1 NIC DHCP SLAAC EUI-64/CGA


PC2 NIC 10.165.251.5/24 2001:db8:24b::5/64 EUI-64/CGA

PC3 NIC DHCP SLAAC EUI-64/CGA


PC4 NIC DHCP SLAAC EUI-64/CGA

Objectives
Troubleshoot network issues related to the conf iguration and operation of routing protocols.

Background / Scenario
This is the same topology that you built in Part 1 of the ENARSI SA. In this topology, R1 and D1 are EIGRP
neighbors and R3 and D2 are OSPF neighbors. R1, R2, and R3 are all speaking BGP f or their respective
ASNs. Switch A1 is supporting host access f or a AAA server. You will be loading conf igurations with
intentional errors onto the network. Your tasks are to FIND the error(s), document your f indings and the
command(s) or method(s) used to f ix them, FIX the issue(s) presented here and then test the network to
ensure both of the f ollowing conditions are met:
1) the complaint received in the ticket is resolved
2) f ull reachability is restored
Note: The routers used with CCNP hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.4
(universalk9 image). The switches used in the labs are Cisco Catalyst 3650 with Cisco IOS XE Release
16.9.4 (universalk9 image) and Cisco Catalyst 2960 with Cisco IOS Release 15.2(2) (lanbasek9 image).
Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS
version, the commands available and the output produced might vary f rom what is shown in the labs. Ref er to
the Router Interf ace Summary Table at the end of the lab f or the correct interf ace identif iers.
Note: Make sure that the devices have been erased and have no startup conf igurations. If you are unsure,
contact your instructor.
Note: The def ault Switch Database Manager (SDM) template on a Catalyst 2960 does not support IPv6. You
must change the def ault SDM template to the dual-ipv4-and-ipv6 def ault template using the sdm prefer dual-
ipv4-and-ipv6 default global conf iguration command. Changing the template will require a reboot.

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 2 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

Instructor Note: Ref er to the Instructor Lab Manual f or the procedures to initialize and reload devices.

Required Resources
• 3 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 2 Switches (Cisco 3650 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 1 Switch (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)
• 3 PCs (Choice of operating system with terminal emulation program installed)
• 1 PC (Choice of operating system with a server running conf igured RADIUS (Optional))
• Console cables to conf igure the Cisco IOS devices via the console ports
• Ethernet and serial cables as shown in the topology

Scenario
You had the network working to specif ications and took a week of f . While you were gone, a junior
administrator and a security engineer were tasked to improve the network. The opposite occurred. Now you
are tasked with f ixing the network.
The instructions the junior administrator and security engineer were given were as f ollows:
1. Reduce the number of TCP sessions between R1 and R3.
2. Apply IPv4 and IPv6 f ilters to the outward -f acing interf aces on R1 and R3 to ensure that inbound
traf f ic sourced f rom their local networks is dropped.
3. Reduce the size of the EIGRP routing table on R1.
4. Reduce the number of route entries R1 is sending to R2.
5. Incorporate AAA using the AAA server at 209.165.251.5 to secure remote access to all devices in the
AS 10 and AS 192 networks.
They did not document things as they were supposed to, so all you have been told is things are not working
as they should be. You need to f ix all of this as soon as possible!
Use the commands listed below to load the conf iguration f iles f or this skills assessment:
Instructor Note: Commands f or uploading the conf iguration are provided at the end of this document.

Device Command

R1 copy flash:/enarsi/sa-tshoot-r1-config.txt run


R2 copy flash:/enarsi/sa-tshoot-r2-config.txt run

R3 copy flash:/enarsi/sa-tshoot-r3-config.txt run


D1 copy flash:/enarsi/sa-tshoot-d1-config.txt run

D2 copy flash:/enarsi/sa-tshoot-d2-config.txt run


A1 copy flash:/enarsi/sa-tshoot-a1-config.txt run

• Console Passwords on all devices are cisco12345. If a username is required, use admin.
• Remote access should be available using the username raduser and password upass123.
Instructor Note: If you are using a RADIUS server, update the RADIUS username and password as necessary.

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 3 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

• PC2 must be conf igured with static addresses as shown in the topology diagram/addressing table.
PC1, PC3, and PC4 will dynamically acquire IPv4 and IPv6 addresses.
• When you have f ixed the ticket, change the MOTD on EACH DEVICE using the f ollowing command:
banner motd # This is $(hostname) FIXED Skills Assessment #
• Save the conf iguration by issuing the wri command (on each device).
• Inf orm your instructor that you are f inished.
• Af ter the instructor approves your solution, issue the reset.now privileged EXEC command. This
script will clear your conf igurations and reload the devices.
Instructor Notes:
This skills assessment contains several intentional errors. The list below is mapped to the tasks given the junior
administrator and security engineer:
1. Reduce the number of TCP sessions between R1 and R3.
The junior administrator did not complete the conf iguration - at both R1 and R3, the ebgp-multihop
command was excluded. The commands to f ix this error are:
Router R1
conf t
router bgp 10
neighbor 192.168.0.1 ebgp-multihop 3
neighbor 2001:db8:192::1 ebgp-multihop 3
exit
end
Router R3
config t
router bgp 192
neighbor 10.0.0.1 ebgp-multihop 3
neighbor 2001:db8:10::1 ebgp-multihop 3
exit
end
2. Apply IPv4 and IPv6 f ilters to the outward -f acing interf aces on R1 and R3 to ensure that inbound traf f ic
sourced f rom their local networks is dropped .
R3 has the default-information originate command, but it does not seem to be working. D2 does not
see the def ault route. R2 is sending it, as R1 has it. The issue is that the MY-X-NETWORKS f ilter at the
G0/0/0 ingress is denying 0.0.0.0. The filters configured on R1 are correct. The commands to f ix this on
R3 are as f ollows:
config t
ip access-list standard MY-4-NETWORKS
no 30
exit
ipv6 access-list MY-6-NETWORKS
no permit ipv6 any any
exit
end

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 4 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

clear ip bgp * soft


3. Reduce the size of the EIGRP routing table at R1.
The junior administrator used the wrong mask on the summary address at D 1, so the networks f rom D1
are not all being advertised to R1. The commands to f ix this on D1 are as f ollows:
conf t
router eigrp ENARSI-SA
address-family ipv4 unicast autonomous-system 1
af-interface g1/0/11
no summary-address 10.165.250.0 255.255.255.0
summary-address 10.165.250.0 255.255.254.0
exit-af-interface
exit-address-family
address-family ipv6 unicast autonomous-system 1
af-interface g1/0/11
no summary-address 2001:db8:240::/48
summary-address 2001:db8:240::/46
exit-af-interface
exit-address-family
end
4. Reduce the number of route entries R1 is sending to R2.
R1 is missing static routes f or the summaries it is advertising into BGP; R2 and R3 only have routes to the
10.0.0.0 network in ASN 10. The commands to f ix this on R1 are as f ollows:
conf t
ip route 10.165.248.0 255.255.252.0 null0
ipv6 route 2001:db8:248::/46 null0
end
5. Incorporate AAA using the AAA server at 209.165.251.5 to secure remote access to all devices in the AS
10 and AS 192 networks.
The security engineer did this correctly.

Router Interface Summary Table


Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2

Fast Ethernet 0/0 Fast Ethernet 0/1


1800 (F0/0) (F0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
Gigabit Ethernet 0/0 Gigabit Ethernet 0/1
1900 (G0/0) (G0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
Fast Ethernet 0/0 Fast Ethernet 0/1
2801 (F0/0) (F0/1) Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)
Fast Ethernet 0/0 Fast Ethernet 0/1
2811 (F0/0) (F0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
Gigabit Ethernet 0/0 Gigabit Ethernet 0/1
2900 (G0/0) (G0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 5 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2

Gigabit Ethernet 0/0/0 Gigabit Ethernet 0/0/1


4221 (G0/0/0) (G0/0/1) Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)
Gigabit Ethernet 0/0/0 Gigabit Ethernet 0/0/1
4300 (G0/0/0) (G0/0/1) Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)

Note: To f ind out how the router is conf igured, look at the interf aces to identif y the type of router and how many
interf aces the router has. There is no way to ef f ectively list all the combinations of conf igurations f or each router
class. This table includes identif iers f or the possible combinations of Ethernet and Serial interf aces in the device.
The table does not include any other type of interf ace, even though a specif ic router may contain one. An
example of this might be an ISDN BRI interf ace. The string in parenthesis is the legal abbreviation that can be
used in Cisco IOS commands to represent the interf ace.
End of document

Uploading Configuration Files


Use the commands below to create the conf iguration f iles on the lab devices f or each trouble ticket in this lab.
The TCL script commands help create and copy the conf igurations. However, the conf iguration commands
could also be copied and pasted directly into global conf ig mode on each device. Simply remove the TCL
script commands, enter the enable and configure t commands on the device, and copy and paste the
conf iguration commands.
Important: The device requires a f older in f lash named enarsi. Use the dir command to verif y. If the f older is
missing, then create it using the mkdir flash:/enarsi privileged exec command.
Reset scripts
These TCL scripts will completely clear and reload the device in preparation f or the next ticket. Copy and
paste the appropriate script to the appropriate device.
Router Reset Script
tclsh
puts [ open "flash:/enarsi/reset.tcl" w+ ] {
typeahead "\n"
copy running-config startup-config
typeahead "\n"
erase startup-config
puts "Reloading the router"
typeahead "\n"
reload
}
tclquit
D1/D2 (Cisco 3650) Reset Script - The def ault 3650 SDM template supports IPv6, so it is not set by this
script.
tclsh
puts [ open "flash:/enarsi/reset.tcl" w+ ] {
typeahead "\n"
copy running-config startup-config
typeahead "\n"
erase startup-config
delete /force vlan.dat

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 6 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

puts "Reloading the switch"


typeahead "\n"
reload
}
tclquit
A1 (Cisco 2960 Script) - The def ault 2960 SDM template does not support IPv6, so this script includes that
setting.
tclsh
puts [ open "flash:reset.tcl" w+ ] {
typeahead "\n"
copy running-config startup-config
typeahead "\n"
erase startup-config
delete /force vlan.dat
delete /force multiple-fs
ios_config "sdm prefer lanbase-routing"
typeahead "\n"
puts "Reloading the switch in 1 minute, type reload cancel to halt"
typeahead "\n"
reload
}
tclquit

R1 Configuration File Scripts


tclsh
puts [ open "flash:/enarsi/sa-tshoot-r1-config.txt" w+ ] {
hostname R1
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R1, ENARSI SA Part 2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/0
ip address 209.165.200.1 255.255.255.0
ipv6 address fe80::1:1 link-local
ipv6 address 2001:db8:200::1/64
no shutdown
exit
interface g0/0/1
ip address 10.165.249.1 255.255.255.0
ipv6 address fe80::1:2 link-local
ipv6 address 2001:db8:249::1/64
no shutdown
exit
interface s0/1/0

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 7 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

ip address 209.165.202.1 255.255.255.0


ipv6 address fe80::1:3 link-local
ipv6 address 2001:db8:202::1/64
no shutdown
exit
interface s0/1/1
ip address 209.165.203.1 255.255.255.0
ipv6 address fe80::1:4 link-local
ipv6 address 2001:db8:203::1/64
no shutdown
exit
interface loopback 0
ip address 10.0.0.1 255.255.255.0
ipv6 address fe80::1:5 link-local
ipv6 address 2001:db8:10::1/64
no shutdown
exit
interface loopback 1
ip address 10.165.248.1 255.255.255.0
ipv6 address fe80::1:6 link-local
ipv6 address 2001:db8:248::1/64
no shutdown
exit
ip route 192.168.0.1 255.255.255.255 s0/1/0 209.165.202.2
ip route 192.168.0.1 255.255.255.255 s0/1/1 209.165.203.2
ipv6 route 2001:db8:192::1/128 s0/1/0 2001:db8:202::2
ipv6 route 2001:db8:192::1/128 s0/1/1 2001:db8:203::2
ip access-list standard MY-4-NETWORKS
permit 10.0.0.0 0.0.0.255
permit 10.165.248.0 0.0.3.255
exit
route-map FILTER-MY-4-NETS deny 10
match ip address MY-4-NETWORKS
exit
route-map FILTER-MY-4-NETS permit 20
ipv6 access-list MY-6-NETWORKS
permit 2001:db8:248::/46 any
permit 2001:db8:10::/64 any
exit
route-map FILTER-MY-6-NETS deny 10
match ipv6 address MY-6-NETWORKS
exit
route-map FILTER-MY-6-NETS permit 20
router bgp 10
no bgp default ipv4-unicast

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 8 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

neighbor 209.165.200.2 remote-as 172


neighbor 192.168.0.1 remote-as 192
neighbor 192.168.0.1 update-source loopback 0
neighbor 2001:db8:200::2 remote-as 172
neighbor 2001:db8:192::1 remote-as 192
neighbor 2001:db8:192::1 update-source loopback 0
address-family ipv4 unicast
neighbor 209.165.200.2 activate
neighbor 192.168.0.1 activate
neighbor 192.168.0.1 route-map FILTER-MY-4-NETS in
neighbor 209.165.200.2 route-map FILTER-MY-4-NETS in
network 10.0.0.0 mask 255.255.255.0
network 10.165.248.0 mask 255.255.252.0
exit
address-family ipv6 unicast
neighbor 2001:db8:200::2 activate
neighbor 2001:db8:192::1 activate
neighbor 2001:db8:200::2 route-map FILTER-MY-6-NETS in
neighbor 2001:db8:192::1 route-map FILTER-MY-6-NETS in
network 2001:db8:10::/64
network 2001:db8:248::/46
exit
exit
router eigrp ENARSI-SA
address-family ipv4 unicast autonomous-system 1
eigrp router-id 0.4.10.1
network 10.0.0.0
network 10.165.248.0
network 10.165.249.0
topology base
redistribute bgp 10 metric 1000000 10 255 1 1500
exit
exit-address-family
address-family ipv6 unicast autonomous-system 1
eigrp router-id 0.6.10.1
topology base
redistribute bgp 10 metric 1000000 10 255 1 1500
exit
af-interface g0/0/0
shutdown
exit-af-interface
exit-address-family
exit
aaa new-model
radius server MY-RADIUS

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 9 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

address ipv4 10.165.251.5 auth-port 1812 acct-port 1813


key $trongPass
exit
aaa authentication login VTY-CONTROL group radius local
line con 0
logging synchronous
exec-timeout 0 0
exit
line vty 0 4
transport input telnet
exec-timeout 5 0
login authentication VTY-CONTROL
exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

R2 Configuration File Scripts


tclsh
puts [ open "flash:/enarsi/sa-tshoot-r2-config.txt" w+ ] {
hostname R2
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R2, ENARSI SA Part 2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/0
ip address 209.165.200.2 255.255.255.0
ipv6 address fe80::2:1 link-local
ipv6 address 2001:db8:200::2/64
no shutdown
exit
interface g0/0/1
ip address 209.165.201.2 255.255.255.0
ipv6 address fe80::2:2 link-local
ipv6 address 2001:db8:201::2/64
no shutdown
exit
interface loopback 0
ip address 172.16.0.1 255.255.255.0
ipv6 address fe80::2:3 link-local
ipv6 address 2001:db8:172::1/64
no shutdown
exit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 10 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

interface loopback 1
ip address 209.165.224.1 255.255.255.0
ipv6 address fe80::2:4 link-local
ipv6 address 2001:db8:224::1/64
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 null0
ipv6 route ::/0 null0
router bgp 172
no bgp default ipv4-unicast
bgp router-id 4.6.172.2
neighbor 209.165.200.1 remote-as 10
neighbor 209.165.201.1 remote-as 192
neighbor 2001:db8:200::1 remote-as 10
neighbor 2001:db8:201::1 remote-as 192
address-family ipv4 unicast
neighbor 209.165.200.1 activate
neighbor 209.165.201.1 activate
network 172.16.0.0 mask 255.255.255.0
network 209.165.224.0
network 0.0.0.0 mask 0.0.0.0
exit
address-family ipv6 unicast
neighbor 2001:db8:200::1 activate
neighbor 2001:db8:201::1 activate
network 2001:db8:172::/64
network 2001:db8:224::/64
network ::/0
exit
exit
line con 0
logging synchronous
exec-timeout 0 0
exit
line vty 0 4
login local
transport input telnet
exec-timeout 5 0
exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 11 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

R3 Configuration File Scripts


tclsh
puts [ open "flash:/enarsi/sa-tshoot-r3-config.txt" w+ ] {
hostname R3
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R3, ENARSI SA Part 2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/0
ip address 209.165.201.1 255.255.255.0
ipv6 address fe80::3:1 link-local
ipv6 address 2001:db8:201::1/64
no shutdown
exit
interface g0/0/1
ip address 192.168.241.1 255.255.255.0
ipv6 address fe80::3:2 link-local
ipv6 address 2001:db8:241::1/64
no shutdown
exit
interface s0/1/0
ip address 209.165.202.2 255.255.255.0
ipv6 address fe80::3:3 link-local
ipv6 address 2001:db8:202::2/64
no shutdown
exit
interface s0/1/1
ip address 209.165.203.2 255.255.255.0
ipv6 address fe80::3:4 link-local
ipv6 address 2001:db8:203::2/64
no shutdown
exit
interface loopback 0
ip address 192.168.0.1 255.255.255.0
ipv6 address fe80::3:5 link-local
ipv6 address 2001:db8:192::1/64
no shutdown
exit
interface loopback 1
ip address 192.168.240.1 255.255.255.0
ipv6 address fe80::3:6 link-local
ipv6 address 2001:db8:240::1/64
no shutdown
exit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 12 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

ip access-list standard MY-4-NETWORKS


permit 192.168.0.0 0.0.0.255
permit 192.168.240.0 0.0.3.255
permit 0.0.0.0 0.0.0.0
exit
route-map FILTER-MY-4-NETS deny 10
match ip address MY-4-NETWORKS
exit
route-map FILTER-MY-4-NETS permit 20
ipv6 access-list MY-6-NETWORKS
permit any 2001:db8:240::/46
permit any 2001:db8:192::/64
permit any ::/0
exit
route-map FILTER-MY-6-NETS deny 10
match ipv6 address MY-6-NETWORKS
exit
route-map FILTER-MY-6-NETS permit 20
ip route 10.0.0.1 255.255.255.255 s0/1/0 209.165.202.1
ip route 10.0.0.1 255.255.255.255 s0/1/1 209.165.203.1
ipv6 route 2001:db8:10::1/128 s0/1/0 2001:db8:202::1
ipv6 route 2001:db8:10::1/128 s0/1/1 2001:db8:203::1
ip route 192.168.240.0 255.255.248.0 null0
ipv6 route 2001:db8:240::/46 null0
router bgp 192
neighbor 209.165.201.2 remote-as 172
neighbor 10.0.0.1 remote-as 10
neighbor 10.0.0.1 update-source loopback 0
neighbor 2001:db8:201::2 remote-as 172
neighbor 2001:db8:10::1 remote-as 10
neighbor 2001:db8:10::1 update-source loopback 0
address-family ipv4 unicast
neighbor 209.165.201.2 activate
neighbor 10.0.0.1 activate
neighbor 209.165.201.2 route-map FILTER-MY-4-NETS in
neighbor 10.0.0.1 route-map FILTER-MY-4-NETS in
network 192.168.240.0 mask 255.255.248.0
network 192.168.0.0
exit
address-family ipv6 unicast
neighbor 2001:db8:201::2 activate
neighbor 2001:db8:10::1 activate
neighbor 2001:db8:201::2 route-map FILTER-MY-6-NETS in
neighbor 2001:db8:10::1 route-map FILTER-MY-6-NETS in
network 2001:db8:240::/46

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 13 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

network 2001:db8:192::/64
exit
exit
router ospfv3 1
router-id 0.0.192.3
address-family ipv4 unicast
passive-interface default
no passive-interface g0/0/1
default-information originate
exit
address-family ipv6 unicast
passive-interface default
no passive-interface g0/0/1
default-information originate
exit
exit
interface g0/0/1
ospfv3 1 ipv4 area 0
ospfv3 1 ipv6 area 0
exit
interface loopback 0
ip ospf network point-to-point
ipv6 ospf network point-to-point
ospfv3 1 ipv4 area 0
ospfv3 1 ipv6 area 0
exit
interface loopback 1
ip ospf network point-to-point
ipv6 ospf network point-to-point
ospfv3 1 ipv4 area 0
ospfv3 1 ipv6 area 0
exit
aaa new-model
radius server MY-RADIUS
address ipv4 10.165.251.5 auth-port 1812 acct-port 1813
key $trongPass
exit
aaa authentication login VTY-CONTROL group radius local
line con 0
logging synchronous
exec-timeout 0 0
exit
line vty 0 4
transport input telnet
exec-timeout 5 0

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 14 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

login authentication VTY-CONTROL


exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

D1 Configuration File Scripts


tclsh
puts [ open "flash:/enarsi/sa-tshoot-d1-config.txt" w+ ] {
hostname D1
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D1, ENARSI SA Part 2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
vlan 250
name Users
exit
vlan 251
name Servers
exit
interface range g1/0/1-24
switchport mode access
shutdown
interface g1/0/11
no switchport
ip address 10.165.249.2 255.255.255.0
ipv6 address fe80::d1:1 link-local
ipv6 address 2001:db8:249::2/64
no shutdown
exit
interface g1/0/23
switchport mode access
spanning-tree portfast
switchport access vlan 250
no shutdown
exit
interface vlan 250
ip address 10.165.250.1 255.255.255.0
ipv6 address fe80::d1:2 link-local
ipv6 address 2001:db8:24A::1/64
no shutdown
exit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 15 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

interface vlan 251


ip address 10.165.251.1 255.255.255.0
ipv6 address fe80::d1:3 link-local
ipv6 address 2001:db8:24B::1/64
no shutdown
exit
interface range g1/0/5-6
switchport mode trunk
channel-group 1 mode active
no shutdown
exit
ip dhcp excluded-address 10.165.250.1 10.165.250.5
ip dhcp pool VLAN250DHCP
network 10.165.250.0 255.255.255.0
default-router 10.165.250.1
exit
router eigrp ENARSI-SA
address-family ipv4 unicast autonomous-system 1
eigrp router-id 0.4.10.2
network 10.165.249.0
network 10.165.250.0
network 10.165.251.0
af-interface vlan 250
passive-interface
exit
af-interface g1/0/11
summary-address 10.165.250.0 255.255.255.0
exit
af-interface vlan 251
passive-interface
exit
exit-address-family
address-family ipv6 unicast autonomous-system 1
eigrp router-id 0.6.10.2
af-interface g1/0/11
summary-address 2001:db8:240::/48
exit
af-interface vlan 250
passive-interface
exit
af-interface vlan 251
passive-interface
exit
exit-address-family
exit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 16 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

aaa new-model
radius server MY-RADIUS
address ipv4 10.165.251.5 auth-port 1812 acct-port 1813
key $trongPass
exit
aaa authentication login VTY-CONTROL group radius local
line con 0
logging synchronous
exec-timeout 0 0
exit
line vty 0 4
transport input telnet
exec-timeout 5 0
login authentication VTY-CONTROL
exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

D2 Configuration File Scripts


tclsh
puts [ open "flash:/enarsi/sa-tshoot-d2-config.txt" w+ ] {
hostname D2
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D2, ENARSI SA Part 2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
vlan 242
name Users
exit
interface range g1/0/1-24
switchport mode access
shutdown
interface g1/0/11
no switchport
ip address 209.165.241.2 255.255.255.0
ipv6 address fe80::d2:1 link-local
ipv6 address 2001:db8:241::2/64
no shutdown
exit
interface g1/0/23
switchport mode access

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 17 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

spanning-tree portfast
switchport access vlan 242
no shutdown
exit
interface g1/0/24
switchport mode access
spanning-tree portfast
switchport access vlan 243
no shutdown
exit
interface vlan 242
ip address 192.168.242.1 255.255.255.0
ipv6 address fe80::d2:2 link-local
ipv6 address 2001:db8:242::1/64
no shutdown
exit
interface vlan 243
ip address 192.168.243.1 255.255.255.0
ipv6 address fe80::d1:3 link-local
ipv6 address 2001:db8:243::1/64
no shutdown
exit
ip dhcp excluded-address 192.168.242.1 192.168.242.5
ip dhcp pool VLAN242DHCP
network 192.168.242.0 255.255.255.0
default-router 192.168.242.1
exit
ip dhcp excluded-address 192.168.243.1 192.168.243.5
ip dhcp pool VLAN243DHCP
network 192.168.243.0 255.255.255.0
default-router 192.168.243.1
exit
router ospfv3 1
router-id 0.0.192.2
address-family ipv4 unicast
passive-interface default
no passive-interface g1/0/11
exit
address-family ipv6 unicast
passive-interface default
no passive-interface g1/0/11
exit
exit
interface g1/0/11
ospfv3 1 ipv4 area 0

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 18 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

ospfv3 1 ipv6 area 0


exit
interface vlan 242
ospfv3 1 ipv4 area 0
ospfv3 1 ipv6 area 0
exit
interface vlan 243
ospfv3 1 ipv4 area 0
ospfv3 1 ipv6 area 0
exit
aaa new-model
radius server MY-RADIUS
address ipv4 10.165.251.5 auth-port 1812 acct-port 1813
key $trongPass
exit
aaa authentication login VTY-CONTROL group radius local
line con 0
logging synchronous
exec-timeout 0 0
exit
line vty 0 4
transport input telnet
exec-timeout 5 0
login authentication VTY-CONTROL
exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

A1 Configuration File Scripts


tclsh
puts [ open "flash:/enarsi/sa-tshoot-a1-config.txt" w+ ] {
hostname A1
no ip domain lookup
banner motd # This is A1, ENARSI SA Part 2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
vlan 251
name Servers
exit
interface range f0/1-24
switchport mode access
shutdown
exit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 19 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

interface f0/23
switchport mode access
switchport access vlan 250
spanning-tree portfast
no shutdown
exit
interface f0/24
switchport mode access
switchport access vlan 251
spanning-tree portfast
no shutdown
exit
interface vlan 250
ip address 10.165.250.2 255.255.255.0
ipv6 address fe80::a1:1 link-local
ipv6 address 2001:db8:24A::2/64
no shutdown
exit
ip default-gateway 10.165.250.1
interface f0/23
shutdown
exit
interface range f0/1-3
switchport mode trunk
channel-group 1 mode active
no shutdown
exit
line con 0
logging synchronous
exec-timeout 0 0
exit
aaa new-model
radius server MY-RADIUS
address ipv4 10.165.251.5 auth-port 1812 acct-port 1813
key $trongPass
exit
aaa authentication login VTY-CONTROL group radius local
line con 0
logging synchronous
exec-timeout 0 0
exit
line vty 0 4
transport input telnet
exec-timeout 5 0
login authentication VTY-CONTROL

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 20 of 21 www.netacad.com
ENARSI Skills Assessment - Troubleshooting

exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

© 2020 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 21 of 21 www.netacad.com

You might also like