21.1.3 Lab – Troubleshoot IPv6 ACLs (Answers)

21.1.3 Lab – Troubleshoot IPv6 ACLs (Answers)

Instructor Note: Red font color or gray highlights indicate text that appears in the instructor copy only.

Topology

Addressing Table

Objectives

Troubleshoot network issues related to the configuration and operation of IPv6 ACLs.

Background / Scenario

In this topology, R1 and R3 are BGP neighbors. R1 speaks for BGP ASN 15, while R3 speaks for BGP ASN 41. They are peered via their respective Loopback 0 interface using BGP Multi-hop across the serial interfaces that connect them. R1 and D1 have an OSPFv3 adjacency, with R1 providing a default route. R3 is performing Router-On-A-Stick for VLANs 16 and 27. The host connected to D1 is using SLAAC to determine their IPv6 Global Unicast Address (GUA), while the host connected to D2 is using DHCPv6 to determine their IPv6 GUA. You will be loading configurations with intentional errors onto the network. Your tasks are to FIND the error(s), document your findings and the command(s) or method(s) used to fix them, FIX the issue(s) presented here, and then test the network to ensure both of the following conditions are met:

1) the complaint received in the ticket is resolved
2) full reachability is restored

Note: The routers used with CCNP hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.4 (universalk9 image). The switches used in the labs are Cisco Catalyst 3650 with Cisco IOS XE Release 16.9.4 (universalk9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers.

Note: Make sure that the devices have been erased and have no startup configurations. If you are unsure, contact your instructor.

Instructor Note: Refer to the Instructor Lab Manual for the procedures to initialize and reload devices.

Required Resources

• 2 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 2 Switches (Cisco 3560 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 4 PCs (Choice of operating system with terminal emulation program installed)
• Console cables to configure the Cisco IOS devices via the console ports
• Ethernet and serial cables as shown in the topology

Instructions

Part 1: Trouble Ticket 21.1.3.1

Scenario:

The night shift completed work in an attempt to secure the network. Network hosts, represented by PC1 and PC2 in this topology, are now unable to generate an IPv6 GUA.

Use the commands listed below to load the configuration files for this trouble ticket:

Instructor Note: Commands for uploading the configuration are provided at the end of this document.

• PCs 1, 2, 3, and 4 should be configured for dynamic acquisition of an IPv6 address.
• Passwords on all devices are cisco12345. If a username is required, use admin.
• After you have corrected the ticket, change the MOTD on EACH DEVICE using the following command:
banner motd # This is $(hostname) FIXED from ticket <ticket number> #
• Save the configuration by issuing the wri command (on each device).
• Inform your instructor that you are ready for the next ticket.
• After the instructor approves your solution for this ticket, issue the privileged EXEC command reset.now. This script will clear your configurations and reload the devices.

Instructor Notes:

This trouble ticket contains 1 intentional error. The ACL applied to D1 interface VLAN 11 and VLAN 12 does not allow for ICMPv6 ND and NA messages; the administrator that added the ACLs did not take ND or NA messages into account when adding the deny ipv6 any any ACE.

The commands used to fix this error should be:

D1(config)# ipv6 access-list CLIENT-CONTROL-VLAN11
D1(config-ipv6-acl)# sequence 31 permit icmp any any nd-na
D1(config-ipv6-acl)# sequence 32 permit icmp any any nd-ns
D1(config-ipv6-acl)# exit
D1(config)# ipv6 access-list CLIENT-CONTROL-VLAN12
D1(config-ipv6-acl)# sequence 31 permit icmp any any nd-na
D1(config-ipv6-acl)# sequence 32 permit icmp any any nd-ns
D1(config-ipv6-acl)# exit

Note: The permit icmp any any eq echo-request and permit icmp any any eq echo-reply ACE are necessary for a later ticket. They were added in this ticket to normalize their presence.

Note: Host behavior may be different amongst operating systems. For example, while Windows 10 honors the /no-autoconfig flag, it seems that Ubuntu 18.0.4 LTS ignores the lack of an A flag in the RA creates the GUA anyway.

Part 2: Trouble Ticket 21.1.3.2

Scenario:

The night shift completed work in an attempt to secure the network. This morning it was discovered that PC3 and PC4 are no longer able to reach D1 interfaces VLAN 11 and VLAN 12 using the ping command. This must be fixed to allow for normal business operations.

Use the commands listed below to load the configuration files for this trouble ticket:

Instructor Note: Commands for uploading the configuration are provided at the end of this document.

• PCs 1, 2, 3, and 4 should be configured for dynamic acquisition of an IPv6 address.
• Passwords on all devices are cisco12345. If a username is required, use admin.
• Once you have fixed the ticket, change the MOTD on EACH DEVICE using the following command:
banner motd # This is $(hostname) FIXED from ticket <ticket number> #
• Then save the configuration by issuing the wri command (on each device).
• Inform your instructor that you are ready for the next ticket.
• After the instructor approves your solution for this ticket, issue the privileged EXEC command reset.now. This script will clear your configurations and reload the devices.

Instructor Notes:

This trouble ticket contains 1 intentional error repeated in two places. The ACL applied to the R1 serial interfaces has a broad deny statement in place blocking hosts from the 2001:db8:acad:16::/64 and 2001:db8:acad:27::/64 networks from communicating with the interior of ASN 15.

There are several possible ways to fix this error and allow traffic from the 2001:db8:acad:16::/64 and 2001:db8:acad:27::/64 networks to pass. The commands used to fix this error in the most specific manner are:

R1(config)# ipv6 access-list BOGON-MARTIAN
R1(config-ipv6-acl)# sequence 11 permit ipv6 2001:db8:acad:16::/64 any
R1(config-ipv6-acl)# sequence 12 permit ipv6 2001:db8:acad:27::/64 any
R1(config-ipv6-acl)# exit

Part 3: Trouble Ticket 21.1.3.3

Scenario:

The night shift completed work in an attempt to secure the network. It was discovered this morning that PC3 and PC4 are no longer able to obtain DHCPv6 addresses. This must be fixed to allow for normal business operations.

Use the commands listed below to load the configuration files for this trouble ticket:

Instructor Note: Commands for uploading the configuration are provided at the end of this document.

• PCs 1, 2, 3, and 4 should be configured for dynamic acquisition of an IPv6 address.
• Passwords on all devices are cisco12345. If a username is required, use admin.
• Once you have fixed the ticket, change the MOTD on EACH DEVICE using the following command:
banner motd # This is $(hostname) FIXED from ticket <ticket number> #
• Then save the configuration by issuing the wri command (on each device).
• Inform your instructor that you are ready for the next ticket.
• After the instructor approves your solution for this ticket, issue the privileged EXEC command reset.now. This script will clear your configurations and reload the devices.

Instructor Notes:

This trouble ticket contains 1 intentional error repeated in two places. The ACL applied to the R3 sub-interfaces is allowing the wrong UDP ports for DHCPv6. The ACL is allowing UDP ports 67 and 68, while DHCPv6 uses UDP ports 546 and 547.

There are several possible ways to fix this error and allow DHCPv6 traffic to pass. The commands used to fix this error in the most specific manner are:

R3(config)# ipv6 access-list CONTROL-UDP-TRAFFIC
R3(config)# no sequence 10
R3(config)# sequence 10 permit udp any any range 546 547
R3(config)# exit

Note: Host behavior may be different amongst operating systems. For example, while Windows 10 honors the /no-autoconfig flag, it seems that Ubuntu 18.0.4 LTS ignores the lack of an A flag in the RA creates the GUA anyway.

Router Interface Summary Table

Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many interfaces the router has. There is no way to effectively list all the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. The table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface.

Uploading Configuration Files

Use the commands below to create the configuration files for each trouble ticket in this lab on the lab devices. The TCL script commands help create and copy the configurations. However, the configuration commands could also be copied and pasted directly into global config mode on each device. Simply remove the TCL script commands, enter the enable and configure t commands on the device, and copy and paste the configuration commands.

Important: The device requires a folder in flash named enarsi. Use the dir command to verify. If the folder is missing, then create it using the mkdir flash:/enarsi privileged EXEC command. For all switches, make sure the vlan.dat file is set to the default. Use the delete vlan.dat privileged EXEC command, if necessary.

Reset scripts

These TCL scripts will completely clear and reload the device in preparation for the next ticket. Copy and paste the appropriate script to the appropriate device.

Router Reset Script

tclsh
puts [ open "flash:/enarsi/reset.tcl" w+ ] {
typeahead "\n"
copy running-config startup-config
typeahead "\n"
erase startup-config
puts "Reloading the router"
typeahead "\n"
reload
}
tclquit

D1/D2 (Cisco 3650) Reset Script – The default 3650 SDM template supports IPv6 by default, so it is not set by this script.

tclsh
puts [ open "flash:/enarsi/reset.tcl" w+ ] {
typeahead "\n"
copy running-config startup-config
typeahead "\n"
erase startup-config
delete /force vlan.dat
puts "Reloading the switch"
typeahead "\n"
reload
}
tclquit

A1 (Cisco 2960 Script) – The default 2960 SDM template does not support IPv6, so this script includes that setting.

tclsh
puts [ open "flash:reset.tcl" w+ ] {
typeahead "\n"
copy running-config startup-config
typeahead "\n"
erase startup-config
delete /force vlan.dat
delete /force multiple-fs
ios_config "sdm prefer lanbase-routing"
typeahead "\n"
puts "Reloading the switch in 1 minute, type reload cancel to halt"
typeahead "\n"
reload
}
tclquit

R1 Configuration File Scripts

! R1 – Trouble Ticket # 1

tclsh
puts [ open "flash:/enarsi/21.1.3.1-r1-config.txt" w+ ] {
hostname R1
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R1, Trouble Ticket 21.1.3.1 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/1
 ipv6 address fe80::1:1 link-local
 ipv6 address 2001:db8:acad:192::1/64
 no shutdown
 exit
interface s0/1/0
 ipv6 address fe80::1:2 link-local
 ipv6 address 2001:db8:acad:2000::1/64
 no shutdown
 exit
interface s0/1/1
 ipv6 address fe80::1:3 link-local
 ipv6 address 2001:db8:acad:2001::1/64
 no shutdown
 exit
interface loopback 0
 ipv6 address fe80::1:4 link-local
 ipv6 address 2001:db8:acad:226::1/64
 no shutdown
 exit
ipv6 route 2001:db8:acad:227::1/64 s0/1/0 2001:db8:acad:2000::2
ipv6 route 2001:db8:acad:227::1/64 s0/1/1 2001:db8:acad:2001::2
router ospfv3 1
 router-id 1.1.1.1
 address-family ipv6 unicast
  default-information originate always
  exit
 exit
router bgp 15
 bgp router-id 1.1.1.1
 neighbor 2001:db8:acad:227::1 remote-as 41
 neighbor 2001:db8:acad:227::1 update-source loopback 0
 neighbor 2001:db8:acad:227::1 ebgp-multihop 3
 address-family ipv6 unicast
  neighbor 2001:db8:acad:227::1 activate
  network 2001:db8:acad:224::/64
  network 2001:db8:acad:225::/64
  network 2001:db8:acad:192::/64
  exit
 exit
interface g0/0/1
 ospfv3 1 ipv6 area 0
 exit
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! R1 – Trouble Ticket # 2

tclsh
puts [ open "flash:/enarsi/21.1.3.2-r1-config.txt" w+ ] {
hostname R1
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R1, Trouble Ticket 21.1.3.2 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/1
 ipv6 address fe80::1:1 link-local
 ipv6 address 2001:db8:acad:192::1/64
 no shutdown
 exit
interface s0/1/0
 ipv6 address fe80::1:2 link-local
 ipv6 address 2001:db8:acad:2000::1/64
 no shutdown
 exit
interface s0/1/1
 ipv6 address fe80::1:3 link-local
 ipv6 address 2001:db8:acad:2001::1/64
 no shutdown
 exit
interface loopback 0
 ipv6 address fe80::1:4 link-local
 ipv6 address 2001:db8:acad:226::1/64
 no shutdown
 exit
ipv6 route 2001:db8:acad:227::1/64 s0/1/0 2001:db8:acad:2000::2
ipv6 route 2001:db8:acad:227::1/64 s0/1/1 2001:db8:acad:2001::2
router ospfv3 1
 router-id 1.1.1.1
 address-family ipv6 unicast
  default-information originate always
  exit
 exit
router bgp 15
 bgp router-id 1.1.1.1
 neighbor 2001:db8:acad:227::1 remote-as 41
 neighbor 2001:db8:acad:227::1 update-source loopback 0
 neighbor 2001:db8:acad:227::1 ebgp-multihop 3
 address-family ipv6 unicast
  neighbor 2001:db8:acad:227::1 activate
  network 2001:db8:acad:224::/64
  network 2001:db8:acad:225::/64
  network 2001:db8:acad:192::/64
  exit
 exit
interface g0/0/1
 ospfv3 1 ipv6 area 0
 exit
ipv6 access-list BOGON-MARTIAN
 permit ipv6 2001:db8:acad:227::/64 any
 deny ipv6 2001:db8:acad::/48 any
 permit ipv6 any any
 exit
interface s0/1/0
 ipv6 traffic-filter BOGON-MARTIAN in
 exit
interface s0/1/1
 ipv6 traffic-filter BOGON-MARTIAN in
 exit
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! R1 – Trouble Ticket # 3

tclsh
puts [ open "flash:/enarsi/21.1.3.3-r1-config.txt" w+ ] {
hostname R1
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R1, Trouble Ticket 21.1.3.3 #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/1
 ipv6 address fe80::1:1 link-local
 ipv6 address 2001:db8:acad:192::1/64
 no shutdown
 exit
interface s0/1/0
 ipv6 address fe80::1:2 link-local
 ipv6 address 2001:db8:acad:2000::1/64
 no shutdown
 exit
interface s0/1/1
 ipv6 address fe80::1:3 link-local
 ipv6 address 2001:db8:acad:2001::1/64
 no shutdown
 exit
interface loopback 0
 ipv6 address fe80::1:4 link-local
 ipv6 address 2001:db8:acad:226::1/64
 no shutdown
 exit
ipv6 route 2001:db8:acad:227::1/64 s0/1/0 2001:db8:acad:2000::2
ipv6 route 2001:db8:acad:227::1/64 s0/1/1 2001:db8:acad:2001::2
router ospfv3 1
 router-id 1.1.1.1
 address-family ipv6 unicast
  default-information originate always
  exit
 exit
router bgp 15
 bgp router-id 1.1.1.1
 neighbor 2001:db8:acad:227::1 remote-as 41
 neighbor 2001:db8:acad:227::1 update-source loopback 0
 neighbor 2001:db8:acad:227::1 ebgp-multihop 3
 address-family ipv6 unicast
  neighbor 2001:db8:acad:227::1 activate
  network 2001:db8:acad:224::/64
  network 2001:db8:acad:225::/64
  network 2001:db8:acad:192::/64
  exit
 exit
interface g0/0/1
 ospfv3 1 ipv6 area 0
 exit
ipv6 access-list BOGON-MARTIAN
 permit ipv6 2001:db8:acad:227::/64 any
 permit ipv6 2001:db8:acad:16::/64 any
 permit ipv6 2001:db8:acad:27::/64 any
 deny ipv6 2001:db8:acad::/48 any
 permit ipv6 any any
 exit
interface s0/1/0
 ipv6 traffic-filter BOGON-MARTIAN in
 exit
interface s0/1/1
 ipv6 traffic-filter BOGON-MARTIAN in
 exit
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

R2 Configuration File Scripts – Not Used In This Lab

R3 Configuration File Scripts

! R3 – Trouble Ticket # 1

tclsh
puts [ open "flash:/enarsi/21.1.3.1-r3-config.txt" w+ ] {
hostname R3
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R3, Trouble Ticket 21.1.3.1  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/1
 no ipv6 address
 no shutdown
 exit
interface g0/0/1.16
 encapsulation dot1q 16
 ipv6 address fe80::3:1 link-local
 ipv6 address 2001:db8:acad:16::1/64
 ipv6 nd prefix 2001:db8:acad:16::/64 no-autoconfig
 no shutdown
 exit
interface g0/0/1.27
 encapsulation dot1q 27
 ipv6 address fe80::3:2 link-local
 ipv6 address 2001:db8:acad:27::1/64
 ipv6 nd prefix 2001:db8:acad:27::/64 no-autoconfig
 no shutdown
 exit
interface s0/1/0
 ipv6 address fe80::3:3 link-local
 ipv6 address 2001:db8:acad:2000::2/64
 no shutdown
 exit
interface s0/1/1
 ipv6 address fe80::3:4 link-local
 ipv6 address 2001:db8:acad:2001::2/64
 no shutdown
 exit
interface loopback 0
 ipv6 address fe80::3:5 link-local
 ipv6 address 2001:db8:acad:227::1/64
 no shutdown
 exit
ipv6 route 2001:db8:acad:226::1/64 s0/1/0 2001:db8:acad:2000::1
ipv6 route 2001:db8:acad:226::1/64 s0/1/1 2001:db8:acad:2001::1
router bgp 41
 bgp router-id 3.3.3.3
 neighbor 2001:db8:acad:226::1 remote-as 15
 neighbor 2001:db8:acad:226::1 update-source loopback 0
 neighbor 2001:db8:acad:226::1 ebgp-multihop 3
 address-family ipv6 unicast
  neighbor 2001:db8:acad:226::1 activate
  network 2001:db8:acad:16::/64
  network 2001:db8:acad:27::/64
  exit
 exit
ipv6 dhcp pool LAN16
 address prefix 2001:db8:acad:16::/64
 exit
ipv6 dhcp pool LAN27
 address prefix 2001:db8:acad:27::/64
 exit
interface g0/0/1.16
 ipv6 nd managed-config-flag
 ipv6 dhcp server LAN16
 exit
interface g0/0/1.27
 ipv6 nd managed-config-flag
 ipv6 dhcp server LAN27
 exit
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! R3 – Trouble Ticket # 2

tclsh
puts [ open "flash:/enarsi/21.1.3.2-r3-config.txt" w+ ] {
hostname R3
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R3, Trouble Ticket 21.1.3.2  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/1
 no ipv6 address
 no shutdown
 exit
interface g0/0/1.16
 encapsulation dot1q 16
 ipv6 address fe80::3:1 link-local
 ipv6 address 2001:db8:acad:16::1/64
 ipv6 nd prefix 2001:db8:acad:16::/64 no-autoconfig
 no shutdown
 exit
interface g0/0/1.27
 encapsulation dot1q 27
 ipv6 address fe80::3:2 link-local
 ipv6 address 2001:db8:acad:27::1/64
 ipv6 nd prefix 2001:db8:acad:27::/64 no-autoconfig
 no shutdown
 exit
interface s0/1/0
 ipv6 address fe80::3:3 link-local
 ipv6 address 2001:db8:acad:2000::2/64
 no shutdown
 exit
interface s0/1/1
 ipv6 address fe80::3:4 link-local
 ipv6 address 2001:db8:acad:2001::2/64
 no shutdown
 exit
interface loopback 0
 ipv6 address fe80::3:5 link-local
 ipv6 address 2001:db8:acad:227::1/64
 no shutdown
 exit
ipv6 route 2001:db8:acad:226::1/64 s0/1/0 2001:db8:acad:2000::1
ipv6 route 2001:db8:acad:226::1/64 s0/1/1 2001:db8:acad:2001::1
router bgp 41
 bgp router-id 3.3.3.3
 neighbor 2001:db8:acad:226::1 remote-as 15
 neighbor 2001:db8:acad:226::1 update-source loopback 0
 neighbor 2001:db8:acad:226::1 ebgp-multihop 3
 address-family ipv6 unicast
  neighbor 2001:db8:acad:226::1 activate
  network 2001:db8:acad:16::/64
  network 2001:db8:acad:27::/64
  exit
 exit
ipv6 dhcp pool LAN16
 address prefix 2001:db8:acad:16::/64
 exit
ipv6 dhcp pool LAN27
 address prefix 2001:db8:acad:27::/64
 exit
interface g0/0/1.16
 ipv6 nd managed-config-flag
 ipv6 dhcp server LAN16
 exit
interface g0/0/1.27
 ipv6 nd managed-config-flag
 ipv6 dhcp server LAN27
 exit
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! R3 – Trouble Ticket # 3

tclsh
puts [ open "flash:/enarsi/21.1.3.3-r3-config.txt" w+ ] {
hostname R3
no ip domain lookup
ipv6 unicast-routing
banner motd # This is R3, Trouble Ticket 21.1.3.3  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface g0/0/1
 no ipv6 address
 no shutdown
 exit
interface g0/0/1.16
 encapsulation dot1q 16
 ipv6 address fe80::3:1 link-local
 ipv6 address 2001:db8:acad:16::1/64
 ipv6 nd prefix 2001:db8:acad:16::/64 no-autoconfig
 no shutdown
 exit
interface g0/0/1.27
 encapsulation dot1q 16
 ipv6 address fe80::3:2 link-local
 ipv6 address 2001:db8:acad:27::1/64
 ipv6 nd prefix 2001:db8:acad:27::/64 no-autoconfig
 no shutdown
 exit
interface s0/1/0
 ipv6 address fe80::3:3 link-local
 ipv6 address 2001:db8:acad:2000::2/64
 no shutdown
 exit
interface s0/1/1
 ipv6 address fe80::3:4 link-local
 ipv6 address 2001:db8:acad:2001::2/64
 no shutdown
 exit
interface loopback 0
 ipv6 address fe80::3:5 link-local
 ipv6 address 2001:db8:acad:227::1/64
 no shutdown
 exit
ipv6 route 2001:db8:acad:226::1/64 s0/1/0 2001:db8:acad:2000::1
ipv6 route 2001:db8:acad:226::1/64 s0/1/1 2001:db8:acad:2001::1
router bgp 41
 bgp router-id 3.3.3.3
 neighbor 2001:db8:acad:226::1 remote-as 15
 neighbor 2001:db8:acad:226::1 update-source loopback 0
 neighbor 2001:db8:acad:226::1 ebgp-multihop 3
 address-family ipv6 unicast
  neighbor 2001:db8:acad:226::1 activate
  network 2001:db8:acad:16::/64
  network 2001:db8:acad:27::/64
  exit
 exit
ipv6 dhcp pool LAN16
 address prefix 2001:db8:acad:16::/64
 exit
ipv6 dhcp pool LAN27
 address prefix 2001:db8:acad:27::/64
 exit
interface g0/0/1.16
 ipv6 nd managed-config-flag
 ipv6 dhcp server LAN16
 exit
interface g0/0/1.27
 ipv6 nd managed-config-flag
 ipv6 dhcp server LAN27
 exit
ipv6 access-list CONTROL-UDP-TRAFFIC
 permit udp any any range 67 68
 permit udp any any gt 1024
 deny udp any any
 permit ipv6 any any
 exit
interface g0/0/1.16
 ipv6 traffic-filter CONTROL-UDP-TRAFFIC in
 exit
interface g0/0/1.27
 ipv6 traffic-filter CONTROL-UDP-TRAFFIC in
 exit
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

D1 Configuration File Scripts

! D1 – Trouble Ticket # 1

tclsh
puts [ open "flash:/enarsi/21.1.3.1-d1-config.txt" w+ ] {
hostname D1
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D1, Trouble Ticket 21.1.3.1  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface range g1/0/1-24
 switchport mode access
 shutdown
 exit
interface g1/0/11
 no switchport
 ipv6 address fe80::d1:1 link-local
 ipv6 address 2001:db8:acad:192::2/64
 no shutdown
 exit
interface vlan 11
 ipv6 address fe80::d1:2 link-local
 ipv6 address 2001:db8:acad:224::1/64
 no shutdown
 exit
interface vlan 12
 ipv6 address fe80::d1:3 link-local
 ipv6 address 2001:db8:acad:225::1/64 
 no shutdown
 exit
interface g1/0/23
 switchport mode access
 switchport access vlan 11
 spanning-tree portfast
 no shutdown
 exit
interface g1/0/24
 switchport mode access
 switchport access vlan 12
 spanning-tree portfast
 no shutdown
 exit
router ospfv3 1
 router-id 0.0.13.1
 address-family ipv6 unicast
  passive-interface vlan 11
  passive-interface vlan 12
  exit
 exit
interface g1/0/11
 ospfv3 1 ipv6 area 0
 exit
interface vlan 11
 ospfv3 1 ipv6 area 0
 exit
interface vlan 12
 ospfv3 1 ipv6 area 0
 exit
ipv6 access-list CLIENT-CONTROL-VLAN11
 permit ipv6 2001:db8:acad:224::/64 any
 permit icmp any any echo-request
 permit icmp any any echo-reply
 deny ipv6 any any
 exit
interface vlan11
 ipv6 traffic-filter CLIENT-CONTROL-VLAN11 in
 exit 
ipv6 access-list CLIENT-CONTROL-VLAN12
 permit ipv6 2001:db8:acad:225::/64 any
 permit icmp any any echo-request
 permit icmp any any echo-reply
 deny ipv6 any any
 exit
interface vlan12
 ipv6 traffic-filter CLIENT-CONTROL-VLAN12 in
 exit 
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! D1 – Trouble Ticket # 2

tclsh
puts [ open "flash:/enarsi/21.1.3.2-d1-config.txt" w+ ] {
hostname D1
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D1, Trouble Ticket 21.1.3.2  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface range g1/0/1-24
 switchport mode access
 shutdown
 exit
interface g1/0/11
 no switchport
 ipv6 address fe80::d1:1 link-local
 ipv6 address 2001:db8:acad:192::2/64
 no shutdown
 exit
interface vlan 11
 ipv6 address fe80::d1:2 link-local
 ipv6 address 2001:db8:acad:224::1/64
 no shutdown
 exit
interface vlan 12
 ipv6 address fe80::d1:3 link-local
 ipv6 address 2001:db8:acad:225::1/64 
 no shutdown
 exit
interface g1/0/23
 switchport mode access
 switchport access vlan 11
 spanning-tree portfast
 no shutdown
 exit
interface g1/0/24
 switchport mode access
 switchport access vlan 12
 spanning-tree portfast
 no shutdown
 exit
router ospfv3 1
 router-id 0.0.13.1
 address-family ipv6 unicast
  passive-interface vlan 11
  passive-interface vlan 12
  exit
 exit
interface g1/0/11
 ospfv3 1 ipv6 area 0
 exit
interface vlan 11
 ospfv3 1 ipv6 area 0
 exit
interface vlan 12
 ospfv3 1 ipv6 area 0
 exit
ipv6 access-list CLIENT-CONTROL-VLAN11
 permit ipv6 2001:db8:acad:224::/64 any
 permit icmp any any echo-request
 permit icmp any any echo-reply
  permit icmp any any nd-na
 permit icmp any any nd-ns
 deny ipv6 any any
 exit
interface vlan11
 ipv6 traffic-filter CLIENT-CONTROL-VLAN11 in
 exit 
ipv6 access-list CLIENT-CONTROL-VLAN12
 permit ipv6 2001:db8:acad:225::/64 any
 permit icmp any any echo-request
 permit icmp any any echo-reply
 permit icmp any any nd-na
 permit icmp any any nd-ns
 deny ipv6 any any
 exit
interface vlan12
 ipv6 traffic-filter CLIENT-CONTROL-VLAN12 in
 exit 
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! D1 – Trouble Ticket # 3

tclsh
puts [ open "flash:/enarsi/21.1.3.3-d1-config.txt" w+ ] {
hostname D1
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D1, Trouble Ticket 21.1.3.3  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface range g1/0/1-24
 switchport mode access
 shutdown
 exit
interface g1/0/11
 no switchport
 ipv6 address fe80::d1:1 link-local
 ipv6 address 2001:db8:acad:192::2/64
 no shutdown
 exit
interface vlan 11
 ipv6 address fe80::d1:2 link-local
 ipv6 address 2001:db8:acad:224::1/64
 no shutdown
 exit
interface vlan 12
 ipv6 address fe80::d1:3 link-local
 ipv6 address 2001:db8:acad:225::1/64 
 no shutdown
 exit
interface g1/0/23
 switchport mode access
 switchport access vlan 11
 spanning-tree portfast
 no shutdown
 exit
interface g1/0/24
 switchport mode access
 switchport access vlan 12
 spanning-tree portfast
 no shutdown
 exit
router ospfv3 1
 router-id 0.0.13.1
 address-family ipv6 unicast
  passive-interface vlan 11
  passive-interface vlan 12
  exit
 exit
interface g1/0/11
 ospfv3 1 ipv6 area 0
 exit
interface vlan 11
 ospfv3 1 ipv6 area 0
 exit
interface vlan 12
 ospfv3 1 ipv6 area 0
 exit
ipv6 access-list CLIENT-CONTROL-VLAN11
 permit ipv6 2001:db8:acad:224::/64 any
 permit icmp any any echo-request
 permit icmp any any echo-reply
  permit icmp any any nd-na
 permit icmp any any nd-ns
 deny ipv6 any any
 exit
interface vlan11
 ipv6 traffic-filter CLIENT-CONTROL-VLAN11 in
 exit 
ipv6 access-list CLIENT-CONTROL-VLAN12
 permit ipv6 2001:db8:acad:225::/64 any
 permit icmp any any echo-request
 permit icmp any any echo-reply
 permit icmp any any nd-na
 permit icmp any any nd-ns
 deny ipv6 any any
 exit
interface vlan12
 ipv6 traffic-filter CLIENT-CONTROL-VLAN12 in
 exit 
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

D2 Configuration File Scripts

! D2- Trouble Ticket # 1

tclsh
puts [ open "flash:/enarsi/21.1.3.1-d2-config.txt" w+ ] {
hostname D2
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D2, Trouble Ticket 21.1.3.1  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface range g1/0/1-24
 switchport mode access
 shutdown
 exit
interface g1/0/11
 switchport mode trunk
 switchport nonegotiate
 no shutdown
 exit
interface g1/0/23
 switchport mode access
 switchport access vlan 16
 spanning-tree portfast
 no shutdown
 exit
interface g1/0/24
 switchport mode access
 switchport access vlan 27
 spanning-tree portfast
 no shutdown
 exit
interface vlan 27
 ipv6 address fe80::d2:1 link-local
 ipv6 address 2001:db8:acad:27::2/64
 no shutdown
 exit
ipv6 route ::/0 2001:db8:acad:27::1
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! D2- Trouble Ticket # 2

tclsh
puts [ open "flash:/enarsi/21.1.3.2-d2-config.txt" w+ ] {
hostname D2
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D2, Trouble Ticket 21.1.3.2  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface range g1/0/1-24
 switchport mode access
 shutdown
 exit
interface g1/0/11
 switchport mode trunk
 switchport nonegotiate
 no shutdown
 exit
interface g1/0/23
 switchport mode access
 switchport access vlan 16
 spanning-tree portfast
 no shutdown
 exit
interface g1/0/24
 switchport mode access
 switchport access vlan 27
 spanning-tree portfast
 no shutdown
 exit
interface vlan 27
 ipv6 address fe80::d2:1 link-local
 ipv6 address 2001:db8:acad:27::2/64
 no shutdown
 exit
ipv6 route ::/0 2001:db8:acad:27::1
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

! D2- Trouble Ticket # 3

tclsh
puts [ open "flash:/enarsi/21.1.3.3-d2-config.txt" w+ ] {
hostname D2
no ip domain lookup
ip routing
ipv6 unicast-routing
banner motd # This is D2, Trouble Ticket 21.1.3.3  #
enable secret cisco12345
username admin privilege 15 algorithm-type scrypt secret cisco12345
interface range g1/0/1-24
 switchport mode access
 shutdown
 exit
interface g1/0/11
 switchport mode trunk
 switchport nonegotiate
 no shutdown
 exit
interface g1/0/23
 switchport mode access
 switchport access vlan 16
 spanning-tree portfast
 no shutdown
 exit
interface g1/0/24
 switchport mode access
 switchport access vlan 27
 spanning-tree portfast
 no shutdown
 exit
interface vlan 27
 ipv6 address fe80::d2:1 link-local
 ipv6 address 2001:db8:acad:27::2/64
 no shutdown
 exit
ipv6 route ::/0 2001:db8:acad:27::1
line con 0
 logging synchronous
 exec-timeout 0 0
 exit
line vty 0 4
 login local
 transport input telnet
 exec-timeout 5 0
 exit
alias exec reset.now tclsh flash:/enarsi/reset.tcl
end
}
tclquit

A1 Configuration File Scripts – Not Used In This Lab

Download 21.1.3 Lab – Troubleshoot IPv6 ACLs .PDF file:

21.1.3 Lab - Troubleshoot IPv6 ACLs .PDF 517.78 KB 923 downloads

...

Download