Enterprise Networking, Security, and Automation (Version 7.00) - ENSA Final PT Skills Assessment (PTSA)
A few things to keep in mind while completing this activity:
- Do not use the browser Back button or close or reload any exam windows during the exam.
- Do not close Packet Tracer when you are done. It will close automatically.
- Click the Submit Assessment button in the browser window to submit your work.
Topology
Addressing Table
| Device Name | Interface | IP Address | Default Gateway |
|---|---|---|---|
| R1 | G0/0/0 | 198.51.100.1/30 | N/A |
| G0/0/1 | 192.168.1.1/24 | N/A | |
| G0/0/2 | 64.100.1.1/29 | N/A | |
| R2 | G0/0/0 | 198.51.100.2/30 | N/A |
| G0/0/1 | 172.16.2.1/24 | N/A | |
| G0/0/2 | 209.165.202.129/27 | N/A | |
| S1 | VLAN1 | 64.100.1.2/29 | 64.100.1.1 |
| S2 | VLAN1 | 192.168.1.2/24 | 192.168.1.1 |
| S3 | VLAN1 | 209.165.202.130/27 | 209.165.202.129 |
| S4 | VLAN1 | 172.16.2.2/24 | 172.16.2.1 |
| DNS/WebServer | NIC | 209.165.202.131/27 | 209.165.202.129 |
| PC-A | NIC | 64.100.1.5/29 | 64.100.1.1 |
| PC-B | NIC | 192.168.1.5/24 | 192.168.1.1 |
| PC-C | NIC | 172.16.2.5/24 | 172.16.2.1 |
Scenario
In this Packet Tracer Skills Assessment, you will configure the devices in a small network. You will complete all tasks in PT Physical Mode. You will not have access to the logical topology.
You will place devices in proper locations and power them on. You will configure routers, switches, and PCs to support IPv4 connectivity for hosts. The routers and switches must be managed securely. You will configure Single-Area OSPFv2, NAT, and access control lists. Further, you will back up your working configurations to a TFTP server and upload a working configuration to another device.
Furthermore, different versions of the IOS image are used in switches. You will update a switch to use the latest IOS.
Instructions
Part 1: Place Devices in Proper Locations and Connect them with Proper Cables
Step 1: Place devices in proper Locations inside the main wiring closet
In the Physical Mode place network devices in the following locations:
- Organize the rack for ease of configuration. Place R1, R2, S1, S2, S3, and S4 from top down, with some space between the devices.
- Drag two 4331 routers, R1 and R2, from the shelf to the rack.
- Drag four switches, S1, S2, S3, and S4, from the shelf to the rack.
- Move PC-C to Table1, on the left, and place it in the left-hand area of the tabletop
- Move the DNS server to Table1, on the left, and place it in the right-hand area of the tabletop.
- Move PC-A to Table2, on the right, and place it in the left-hand area of the tabletop.
- Move PC-B to Table2, on the right, and place it in the right-hand area of the tabletop.
Step 2: Make sure all devices are powered on.
Power on all devices.
Instructions: Click each PC and the server, then click the power button to turn it on. The routers are turned off when they come from the shelf:
Right-click a router and select Inspect Rear to see its back panel. Click the power switch to turn the router on; the rear view also shows the router's Console port.
Step 3: Connect devices according to the network topology.
Use the logical topology diagram to connect the devices to the correct ports with correct cables.
Instructions:
Use a Copper Cross-Over cable (orange cable) to connect port G0/0/0 on router R1 to port G0/0/0 on router R2.
Use Copper Straight-Through cables (green cable) for all other links, plugging each one into the ports shown on the topology diagram.
Connect the 9 cables in the order below. Start at the bottom of the rack and plug the lower row of router ports first, so the cables you add later do not cover the ports you still need. The cross-over cable between R1 and R2 uses the upper row and goes last.
| # | From | To | Location | Cable |
|---|---|---|---|---|
| 1 | S4 Fa0/10 | PC-C | Table 1 | Straight-Through |
| 2 | S4 G0/1 | R2 G0/0/1 | Rack | Straight-Through |
| 3 | S3 Fa0/10 | DNS Server | Table 1 | Straight-Through |
| 4 | S3 G0/1 | R2 G0/0/2 | Rack | Straight-Through |
| 5 | S2 Fa0/5 | PC-B | Table 2 | Straight-Through |
| 6 | S2 G0/1 | R1 G0/0/1 | Rack | Straight-Through |
| 7 | S1 Fa0/5 | PC-A | Table 2 | Straight-Through |
| 8 | S1 G0/1 | R1 G0/0/2 | Rack | Straight-Through |
| 9 | R1 G0/0/0 | R2 G0/0/0 | Rack | Cross-Over |
Part 2: Configure Basic Devices Settings
All configurations are made through a direct console connection.
Step 1: Configure PCs with IPv4 addresses
Use the addressing table to manually configure the PCs with full IP addressing.
PC-A: click Desktop > IP Configuration, select Static and enter:
IP Address: 64.100.1.5
Subnet Mask: 255.255.255.248
Default Gateway: 64.100.1.1
DNS Server: 209.165.202.131
Configure PC-A with IPv4 addresses
PC-B: click Desktop > IP Configuration, select Static and enter:
IP Address: 192.168.1.5
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.1.1
DNS Server: 209.165.202.131
Configure PC-B with IPv4 addresses
PC-C: click Desktop > IP Configuration, select Static and enter:
IP Address: 172.16.2.5
Subnet Mask: 255.255.255.0
Default Gateway: 172.16.2.1
DNS Server: 209.165.202.131
Configure PC-C with IPv4 addresses
Step 2: Configure router R1 and R2
Note: When you open the console of R1 or R2, the router first asks Would you like to enter the initial configuration dialog? [yes/no]: Type no and press Enter, then press Enter again to reach the Router> prompt.
a. Configure R1 and R2 with the following:
- Prevent the router from attempting to resolve incorrectly entered commands as domain names.
Router(config)# no ip domain-lookup
Router(config)# no ip domain-lookup
- Router name: R1 or R2.
Router(config)# hostname R1
Router(config)# hostname R2
- Encrypted privileged EXEC secret password: ciscoenpass.
R1(config)# enable secret ciscoenpass
R2(config)# enable secret ciscoenpass
- Console access password: ciscoconpass.
R1(config)# line console 0 R1(config-line)# password ciscoconpass R1(config-line)# login
R2(config)# line console 0 R2(config-line)# password ciscoconpass R2(config-line)# login
- Set the minimum password length to 10 characters.
R1(config)# security passwords min-length 10
R2(config)# security passwords min-length 10
- Encrypt the clear text passwords.
R1(config)# service password-encryption
R2(config)# service password-encryption
- Configure an appropriate MOTD Banner.
R1(config)# banner motd #Unauthorized Access is Prohibited#
R2(config)# banner motd #Unauthorized Access is Prohibited#
b. Configure the interfaces of routers R1 and R2 as follows.
- Configure interface G0/0/0 with a description and IPv4 addressing.
R1(config)# interface gigabitethernet 0/0/0 R1(config-if)# description Connection to R2 R1(config-if)# ip address 198.51.100.1 255.255.255.252
R2(config)# interface gigabitethernet 0/0/0 R2(config-if)# description Connection to R1 R2(config-if)# ip address 198.51.100.2 255.255.255.252
- Configure interface G0/0/1 with a description and IPv4 addressing.
R1(config)# interface gigabitethernet 0/0/1 R1(config-if)# description Connection to S2 R1(config-if)# ip address 192.168.1.1 255.255.255.0
R2(config)# interface gigabitethernet 0/0/1 R2(config-if)# description Connection to S4 R2(config-if)# ip address 172.16.2.1 255.255.255.0
- Configure interface G0/0/2 with a description and IPv4 addressing.
R1(config)# interface gigabitethernet 0/0/2 R1(config-if)# description Connection to S1 R1(config-if)# ip address 64.100.1.1 255.255.255.248
R2(config)# interface gigabitethernet 0/0/2 R2(config-if)# description Connection to S3 R2(config-if)# ip address 209.165.202.129 255.255.255.224
- All interfaces should be ready to send and receive traffic.
R1(config)# interface gigabitethernet 0/0/0 R1(config-if)# no shutdown R1(config-if)# interface gigabitethernet 0/0/1 R1(config-if)# no shutdown R1(config-if)# interface gigabitethernet 0/0/2 R1(config-if)# no shutdown
R2(config)# interface gigabitethernet 0/0/0 R2(config-if)# no shutdown R2(config-if)# interface gigabitethernet 0/0/1 R2(config-if)# no shutdown R2(config-if)# interface gigabitethernet 0/0/2 R2(config-if)# no shutdown
c. Configure SSH.
- Domain name: ccna-lab.com.
R1(config)# ip domain-name ccna-lab.com
R2(config)# ip domain-name ccna-lab.com
- Create an administrative user in the local database:
- Username: admin
- Secret Password: admin1pass
R1(config)# username admin secret admin1pass
R2(config)# username admin secret admin1pass
- Set login on VTY lines to use the local database
R1(config)# line vty 0 15 R1(config-line)# login local
R2(config)# line vty 0 15 R2(config-line)# login local
- Set VTY lines to accept SSH connections only
R1(config)# line vty 0 15 R1(config-line)# transport input ssh
R2(config)# line vty 0 15 R2(config-line)# transport input ssh
- Use an RSA crypto key with a 1024 bits modulus.
R1(config)# crypto key generate rsa general-keys modulus 1024
R2(config)# crypto key generate rsa general-keys modulus 1024
- Enable SSH using version 2.
R1(config)# ip ssh version 2
R2(config)# ip ssh version 2
Step 3: Configure switches S1, S2, S3, and S4
a. Configure the hostname according to the Addressing Table.
Switch(config)# hostname S1
Switch(config)# hostname S2
Switch(config)# hostname S3
Switch(config)# hostname S4
b. Configure Management Interface (SVI) for VLAN 1: Set the IPv4 address and activate the interface.
S1(config)# interface vlan 1 S1(config-if)# ip address 64.100.1.2 255.255.255.248 S1(config-if)# no shutdown
S2(config)# interface vlan 1 S2(config-if)# ip address 192.168.1.2 255.255.255.0 S2(config-if)# no shutdown
S3(config)# interface vlan 1 S3(config-if)# ip address 209.165.202.130 255.255.255.224 S3(config-if)# no shutdown
S4(config)# interface vlan 1 S4(config-if)# ip address 172.16.2.2 255.255.255.0 S4(config-if)# no shutdown
c. Configure default gateway.
S1(config)# ip default-gateway 64.100.1.1
S2(config)# ip default-gateway 192.168.1.1
S3(config)# ip default-gateway 209.165.202.129
S4(config)# ip default-gateway 172.16.2.1
Part 3: Configure Single Area OSPFv2
Step 1: Configure single-area OSPF routing
a. Configure the OSPF routing process: Use process id 1.
R1(config)# router ospf 1
R2(config)# router ospf 1
b. Manually configure the router id: Use 0.0.0.1 for R1 and 0.0.0.2 for R2
R1(config-router)# router-id 0.0.0.1
R2(config-router)# router-id 0.0.0.2
c. Configure network statements for the appropriate networks on R1 and R2.
Note: For the purposes of this assessment, enter your network statements in the following order:
On R1:
- the G0/0/2 network
- the G0/0/0 network
On R2:
- the G0/0/2 network
- the G0/0/0 network
R1(config-router)# network 64.100.1.0 0.0.0.7 area 0 R1(config-router)# network 198.51.100.0 0.0.0.3 area 0
R2(config-router)# network 209.165.202.128 0.0.0.31 area 0 R2(config-router)# network 198.51.100.0 0.0.0.3 area 0
Step 2: Adjust OSPF operation
a. Configure the appropriate interfaces to not forward OSPF updates where they are not required.
R1(config)# router ospf 1 R1(config-router)# passive-interface gigabitethernet 0/0/1 R1(config-router)# passive-interface gigabitethernet 0/0/2
R2(config)# router ospf 1 R2(config-router)# passive-interface gigabitethernet 0/0/1 R2(config-router)# passive-interface gigabitethernet 0/0/2
b. Configure the reference bandwidth: Adjust the reference bandwidth to 1 Gigabit.
R1(config-router)# auto-cost reference-bandwidth 1000
R2(config-router)# auto-cost reference-bandwidth 1000
c. Configure the OSPF network as a point-to-point network.
R1(config)# interface gigabitethernet 0/0/0 R1(config-if)# ip ospf network point-to-point
R2(config)# interface gigabitethernet 0/0/0 R2(config-if)# ip ospf network point-to-point
d. Configure the hello time for 30 seconds.
R1(config)# interface gigabitethernet 0/0/0 R1(config-if)# ip ospf hello-interval 30
R2(config)# interface gigabitethernet 0/0/0 R2(config-if)# ip ospf hello-interval 30
Part 4: Configure Access Control and NAT
Step 1: Verify connectivity
- PC-B cannot visit the web server.
- PC-C cannot ping PC-A.
Step 2: Configure NAT
a. Configure static NAT on router R1 with a public IP address 64.100.1.7 to allow PC-B to access the web server.
R1(config)# ip nat inside source static 192.168.1.5 64.100.1.7 R1(config)# interface gigabitethernet 0/0/0 R1(config-if)# ip nat outside R1(config-if)# interface gigabitethernet 0/0/1 R1(config-if)# ip nat inside
b. Configure PAT on router R2 to enable some devices on the network attached to the G0/0/1 interface to access the internet
- Create a NAT pool named IPNAT1 with IP address range of 209.165.202.140 to 209.165.202.150 with the subnet mask of 255.255.255.224.
R2(config)# ip nat pool IPNAT1 209.165.202.140 209.165.202.150 netmask 255.255.255.224
- Create a numbered ACL (ACL 1) to allow devices with IP address range of 172.16.2.1 through 172.16.2.15 to access the internet through NAT.
R2(config)# access-list 1 permit 172.16.2.0 0.0.0.15
- Use PAT to allow the range of the public IP addresses to be shared.
R2(config)# ip nat inside source list 1 pool IPNAT1 overload R2(config)# interface gigabitethernet 0/0/1 R2(config-if)# ip nat inside R2(config-if)# interface gigabitethernet 0/0/0 R2(config-if)# ip nat outside
Step 3: Configure access control on R1
a. Create a standard ACL R1-VTY-LIMIT to allow only PC-B access to the R1 vty lines.
R1(config)# ip access-list standard R1-VTY-LIMIT R1(config-std-nacl)# permit host 192.168.1.5
b. Apply the ACL.
R1(config)# line vty 0 15 R1(config-line)# access-class R1-VTY-LIMIT in
Step 4: Configure access control on S1
a. Create a standard ACL S1-VTY-LIMIT to allow only PC-B access to the S1 vty lines.
S1(config)# ip access-list standard S1-VTY-LIMIT S1(config-std-nacl)# permit host 192.168.1.5
b. Apply the ACL.
S1(config)# line vty 0 15 S1(config-line)# access-class S1-VTY-LIMIT in
Step 5: Configure access control on R2
a. Create a standard ACL R2-VTY-LIMIT to allow only PC-C access to the R2 vty lines.
R2(config)# ip access-list standard R2-VTY-LIMIT R2(config-std-nacl)# permit host 172.16.2.5
b. Create an extended ACL R2-SECURITY to restrict access from the internet
- Allow FTP connections from the PC-B public IP address to the web/DNS server
- Deny all other FTP connections from the internet to the R2 LANs
- Deny all SSH connections from the internet
- Allow all other types of connections from the internet
Your ACL should consist of four statements that correspond to the four requirements above.
R2(config)# ip access-list extended R2-SECURITY R2(config-ext-nacl)# permit tcp host 64.100.1.7 host 209.165.202.131 eq ftp R2(config-ext-nacl)# deny tcp any any eq ftp R2(config-ext-nacl)# deny tcp any any eq 22 R2(config-ext-nacl)# permit ip any any
c. Apply the ACLs
R2(config)# line vty 0 15 R2(config-line)# access-class R2-VTY-LIMIT in R2(config-line)# interface gigabitethernet 0/0/0 R2(config-if)# ip access-group R2-SECURITY in
Step 6: Configure access control on S3
a. Create a standard ACL S3-VTY-LIMIT to allow only PC-C access to the S3 vty lines.
S3(config)# ip access-list standard S3-VTY-LIMIT S3(config-std-nacl)# permit host 172.16.2.5
b. Apply the ACL.
S3(config)# line vty 0 15 S3(config-line)# access-class S3-VTY-LIMIT in
Part 5: Perform Configuration Backup and IOS Update
Step 1: Use TFTP server to backup device configurations
a. Backup the running configurations of R1, S1, and S2 to the TFTP server on PC-B.
b. Name the configuration files as R1-Run-Config, S1-Run-Config, and S2-Run-Config.
R1# copy running-config tftp: Address or name of remote host []? 192.168.1.5 Destination filename [R1-confg]? R1-Run-Config
S1# copy running-config tftp: Address or name of remote host []? 192.168.1.5 Destination filename [S1-confg]? S1-Run-Config
S2# copy running-config tftp: Address or name of remote host []? 192.168.1.5 Destination filename [S2-confg]? S2-Run-Config Writing running-config....!! [OK - 1122 bytes] 1122 bytes copied in 3.003 secs (373 bytes/sec)
Step 2: Use TFTP server to update/upgrade IOS software
a. Obtain a newer IOS image from the TFTP service on the web/DNS server.
b. The newer version of the switch IOS is c2960-lanbasek9-mz.150-2.SE4.bin.
c. Configure S3 to use this newer version IOS after reloading.
S3# copy tftp: flash: Address or name of remote host []? 209.165.202.131 Source filename []? c2960-lanbasek9-mz.150-2.SE4.bin Destination filename [c2960-lanbasek9-mz.150-2.SE4.bin]? [Enter] Accessing tftp://209.165.202.131/c2960-lanbasek9-mz.150-2.SE4.bin.... Loading c2960-lanbasek9-mz.150-2.SE4.bin from 209.165.202.131: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 4670455 bytes] 4670455 bytes copied in 3.046 secs (123272 bytes/sec) S3(config)# boot system flash:c2960-lanbasek9-mz.150-2.SE4.bin S3# copy running-config startup-config Destination filename [startup-config]? [Enter] Building configuration... [OK] S3# reload Proceed with reload? [confirm]
Device Configs - Final
PC-A
PC-APC
IP Address64.100.1.5
Subnet Mask255.255.255.248
Default Gateway64.100.1.1
DNS Server209.165.202.131
PC-B
PC-BPC
IP Address192.168.1.5
Subnet Mask255.255.255.0
Default Gateway192.168.1.1
DNS Server209.165.202.131
PC-C
PC-CPC
IP Address172.16.2.5
Subnet Mask255.255.255.0
Default Gateway172.16.2.1
DNS Server209.165.202.131
ROUTER R1
! ============================================================== !--- ENSA Final PT Skills Assessment (PTSA) !--- ANSWER SCRIPT FOR ROUTER R1 !--- Usage: power on and cable the device, open its console and paste this whole file at the Router> prompt (the router first asks "Would you like to enter the initial configuration dialog? [yes/no]:" - type no, press Enter, then press Enter again until Router> appears). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 2a: Configure basic settings on the router. ! -------------------------------------------------------------- !--- 1. Prevent the router from resolving incorrectly entered commands as domain names. no ip domain-lookup !--- 2. Router name: R1. hostname R1 !--- 3. Encrypted privileged EXEC secret password: ciscoenpass. enable secret ciscoenpass !--- 4. Console access password: ciscoconpass. line console 0 password ciscoconpass login exit !--- 5. Minimum password length of 10 characters. security passwords min-length 10 !--- 6. Encrypt the clear text passwords. service password-encryption !--- 7. MOTD banner. banner motd #Unauthorized Access is Prohibited# ! -------------------------------------------------------------- !--- Part 2, Step 2b: Configure the router interfaces. ! -------------------------------------------------------------- !--- 1. G0/0/0: description and IPv4 address. interface gigabitethernet 0/0/0 description Connection to R2 ip address 198.51.100.1 255.255.255.252 exit !--- 2. G0/0/1: description and IPv4 address. interface gigabitethernet 0/0/1 description Connection to S2 ip address 192.168.1.1 255.255.255.0 exit !--- 3. G0/0/2: description and IPv4 address. interface gigabitethernet 0/0/2 description Connection to S1 ip address 64.100.1.1 255.255.255.248 exit !--- 4. All interfaces ready to send and receive traffic. interface gigabitethernet 0/0/0 no shutdown interface gigabitethernet 0/0/1 no shutdown interface gigabitethernet 0/0/2 no shutdown exit ! -------------------------------------------------------------- !--- Part 2, Step 2c: Configure SSH. ! -------------------------------------------------------------- !--- 1. Domain name: ccna-lab.com. ip domain-name ccna-lab.com !--- 2. Administrative user admin with secret password admin1pass. username admin secret admin1pass !--- 3-4. VTY lines: log in with the local database and accept SSH connections only. line vty 0 15 login local transport input ssh exit !--- 5. RSA key with a 1024-bit modulus (hostname and domain name are already set). crypto key generate rsa general-keys modulus 1024 !--- 6. Enable SSH version 2. ip ssh version 2 ! -------------------------------------------------------------- !--- Part 3, Step 1: Configure single-area OSPF routing. ! -------------------------------------------------------------- !--- a-b. OSPF process 1 with router ID 0.0.0.1. router ospf 1 router-id 0.0.0.1 exit !--- c. Network statements in the required order: the G0/0/2 network, then the G0/0/0 network. router ospf 1 network 64.100.1.0 0.0.0.7 area 0 network 198.51.100.0 0.0.0.3 area 0 exit ! -------------------------------------------------------------- !--- Part 3, Step 2: Adjust OSPF operation. ! -------------------------------------------------------------- !--- a. No OSPF updates into the LANs on G0/0/1 and G0/0/2. router ospf 1 passive-interface gigabitethernet 0/0/1 passive-interface gigabitethernet 0/0/2 exit !--- b. Reference bandwidth of 1 Gigabit (1000 Mbps). router ospf 1 auto-cost reference-bandwidth 1000 exit !--- c. The R1-R2 link (G0/0/0) is an OSPF point-to-point network. interface gigabitethernet 0/0/0 ip ospf network point-to-point exit !--- d. Hello time of 30 seconds on G0/0/0 (dead interval follows at 120 seconds). interface gigabitethernet 0/0/0 ip ospf hello-interval 30 exit ! -------------------------------------------------------------- !--- Part 4, Step 2a: Configure static NAT. ! -------------------------------------------------------------- !--- Translate PC-B (192.168.1.5) to the public address 64.100.1.7 so it can reach the web server. ip nat inside source static 192.168.1.5 64.100.1.7 !--- G0/0/0 faces R2 and the internet: NAT outside. interface gigabitethernet 0/0/0 ip nat outside exit !--- G0/0/1 faces the PC-B LAN: NAT inside. interface gigabitethernet 0/0/1 ip nat inside exit ! -------------------------------------------------------------- !--- Part 4, Step 3: Configure access control on R1. ! -------------------------------------------------------------- !--- a. Standard ACL R1-VTY-LIMIT: allow only PC-B. ip access-list standard R1-VTY-LIMIT permit host 192.168.1.5 exit !--- b. Apply the ACL to the VTY lines. line vty 0 15 access-class R1-VTY-LIMIT in exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show ip interface brief -> G0/0/0, G0/0/1 and G0/0/2 up/up with the addressing-table IPs !--- show ip ospf neighbor -> 0.0.0.2 (R2) FULL, no DR/BDR on the point-to-point link !--- show ip ospf interface gigabitethernet 0/0/0 -> Network Type POINT_TO_POINT, Hello 30, Dead 120 !--- show ip nat translations -> static entry 64.100.1.7 -> 192.168.1.5 !--- show ip ssh -> SSH Enabled - version 2.0 !--- show access-lists -> R1-VTY-LIMIT permit host 192.168.1.5 !--- Note: Part 5, Step 1 (backup to the TFTP server on PC-B) is interactive; run it by hand: !--- R1# copy running-config tftp: !--- Address or name of remote host []? 192.168.1.5 !--- Destination filename [R1-confg]? R1-Run-Config ! ==============================================================
ROUTER R2
! ============================================================== !--- ENSA Final PT Skills Assessment (PTSA) !--- ANSWER SCRIPT FOR ROUTER R2 !--- Usage: power on and cable the device, open its console and paste this whole file at the Router> prompt (the router first asks "Would you like to enter the initial configuration dialog? [yes/no]:" - type no, press Enter, then press Enter again until Router> appears). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 2a: Configure basic settings on the router. ! -------------------------------------------------------------- !--- 1. Prevent the router from resolving incorrectly entered commands as domain names. no ip domain-lookup !--- 2. Router name: R2. hostname R2 !--- 3. Encrypted privileged EXEC secret password: ciscoenpass. enable secret ciscoenpass !--- 4. Console access password: ciscoconpass. line console 0 password ciscoconpass login exit !--- 5. Minimum password length of 10 characters. security passwords min-length 10 !--- 6. Encrypt the clear text passwords. service password-encryption !--- 7. MOTD banner. banner motd #Unauthorized Access is Prohibited# ! -------------------------------------------------------------- !--- Part 2, Step 2b: Configure the router interfaces. ! -------------------------------------------------------------- !--- 1. G0/0/0: description and IPv4 address. interface gigabitethernet 0/0/0 description Connection to R1 ip address 198.51.100.2 255.255.255.252 exit !--- 2. G0/0/1: description and IPv4 address. interface gigabitethernet 0/0/1 description Connection to S4 ip address 172.16.2.1 255.255.255.0 exit !--- 3. G0/0/2: description and IPv4 address. interface gigabitethernet 0/0/2 description Connection to S3 ip address 209.165.202.129 255.255.255.224 exit !--- 4. All interfaces ready to send and receive traffic. interface gigabitethernet 0/0/0 no shutdown interface gigabitethernet 0/0/1 no shutdown interface gigabitethernet 0/0/2 no shutdown exit ! -------------------------------------------------------------- !--- Part 2, Step 2c: Configure SSH. ! -------------------------------------------------------------- !--- 1. Domain name: ccna-lab.com. ip domain-name ccna-lab.com !--- 2. Administrative user admin with secret password admin1pass. username admin secret admin1pass !--- 3-4. VTY lines: log in with the local database and accept SSH connections only. line vty 0 15 login local transport input ssh exit !--- 5. RSA key with a 1024-bit modulus (hostname and domain name are already set). crypto key generate rsa general-keys modulus 1024 !--- 6. Enable SSH version 2. ip ssh version 2 ! -------------------------------------------------------------- !--- Part 3, Step 1: Configure single-area OSPF routing. ! -------------------------------------------------------------- !--- a-b. OSPF process 1 with router ID 0.0.0.2. router ospf 1 router-id 0.0.0.2 exit !--- c. Network statements in the required order: the G0/0/2 network, then the G0/0/0 network. router ospf 1 network 209.165.202.128 0.0.0.31 area 0 network 198.51.100.0 0.0.0.3 area 0 exit ! -------------------------------------------------------------- !--- Part 3, Step 2: Adjust OSPF operation. ! -------------------------------------------------------------- !--- a. No OSPF updates into the LANs on G0/0/1 and G0/0/2. router ospf 1 passive-interface gigabitethernet 0/0/1 passive-interface gigabitethernet 0/0/2 exit !--- b. Reference bandwidth of 1 Gigabit (1000 Mbps). router ospf 1 auto-cost reference-bandwidth 1000 exit !--- c. The R1-R2 link (G0/0/0) is an OSPF point-to-point network. interface gigabitethernet 0/0/0 ip ospf network point-to-point exit !--- d. Hello time of 30 seconds on G0/0/0 (dead interval follows at 120 seconds). interface gigabitethernet 0/0/0 ip ospf hello-interval 30 exit ! -------------------------------------------------------------- !--- Part 4, Step 2b: Configure PAT on R2. ! -------------------------------------------------------------- !--- 1. NAT pool IPNAT1: 209.165.202.140 to 209.165.202.150, mask 255.255.255.224. ip nat pool IPNAT1 209.165.202.140 209.165.202.150 netmask 255.255.255.224 !--- 2. ACL 1 permits 172.16.2.1 through 172.16.2.15 (172.16.2.0/28). access-list 1 permit 172.16.2.0 0.0.0.15 !--- 3. PAT (overload) so the public pool addresses are shared. ip nat inside source list 1 pool IPNAT1 overload !--- 3. G0/0/1 faces the PC-C LAN: NAT inside. interface gigabitethernet 0/0/1 ip nat inside exit !--- 3. G0/0/0 faces R1 and the internet: NAT outside. interface gigabitethernet 0/0/0 ip nat outside exit ! -------------------------------------------------------------- !--- Part 4, Step 5: Configure access control on R2. ! -------------------------------------------------------------- !--- a. Standard ACL R2-VTY-LIMIT: allow only PC-C. ip access-list standard R2-VTY-LIMIT permit host 172.16.2.5 exit !--- b. Extended ACL R2-SECURITY, four statements in the order of the requirements. ip access-list extended R2-SECURITY permit tcp host 64.100.1.7 host 209.165.202.131 eq ftp deny tcp any any eq ftp deny tcp any any eq 22 permit ip any any exit !--- c. Apply R2-VTY-LIMIT to the VTY lines. line vty 0 15 access-class R2-VTY-LIMIT in exit !--- c. Apply R2-SECURITY inbound on G0/0/0, where traffic from the internet enters. interface gigabitethernet 0/0/0 ip access-group R2-SECURITY in exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show ip interface brief -> G0/0/0, G0/0/1 and G0/0/2 up/up with the addressing-table IPs !--- show ip ospf neighbor -> 0.0.0.1 (R1) FULL !--- show ip route ospf -> 64.100.1.0/29 learned from R1 !--- show ip nat translations -> PAT entries for PC-C after it opens a connection !--- show access-lists -> ACL 1, R2-VTY-LIMIT and R2-SECURITY with match counters !--- Note: the permit for PC-B's public address (64.100.1.7) must stay above "deny tcp any any eq ftp"; !--- ACL statements are checked top-down and the first match wins. ! ==============================================================
SWITCH S1
! ============================================================== !--- ENSA Final PT Skills Assessment (PTSA) !--- ANSWER SCRIPT FOR SWITCH S1 !--- Usage: power on and cable the device, open its console and paste this whole file at the Switch> prompt. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 3: Configure the switch. ! -------------------------------------------------------------- !--- a. Hostname according to the Addressing Table. hostname S1 !--- b. Management SVI for VLAN 1: IPv4 address and activate the interface. interface vlan 1 ip address 64.100.1.2 255.255.255.248 no shutdown exit !--- c. Default gateway. ip default-gateway 64.100.1.1 ! -------------------------------------------------------------- !--- Part 4, Step 4: Configure access control on S1. ! -------------------------------------------------------------- !--- a. Standard ACL S1-VTY-LIMIT: allow only PC-B. ip access-list standard S1-VTY-LIMIT permit host 192.168.1.5 exit !--- b. Apply the ACL to the VTY lines. line vty 0 15 access-class S1-VTY-LIMIT in exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show ip interface brief -> Vlan1 up/up with 64.100.1.2 !--- show access-lists -> S1-VTY-LIMIT permit host 192.168.1.5 !--- ping 64.100.1.1 -> default gateway R1 G0/0/2 !--- Note: Part 5, Step 1 (backup to the TFTP server on PC-B) is interactive; run it by hand: !--- S1# copy running-config tftp: !--- Address or name of remote host []? 192.168.1.5 !--- Destination filename [S1-confg]? S1-Run-Config ! ==============================================================
SWITCH S2
! ============================================================== !--- ENSA Final PT Skills Assessment (PTSA) !--- ANSWER SCRIPT FOR SWITCH S2 !--- Usage: power on and cable the device, open its console and paste this whole file at the Switch> prompt. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 3: Configure the switch. ! -------------------------------------------------------------- !--- a. Hostname according to the Addressing Table. hostname S2 !--- b. Management SVI for VLAN 1: IPv4 address and activate the interface. interface vlan 1 ip address 192.168.1.2 255.255.255.0 no shutdown exit !--- c. Default gateway. ip default-gateway 192.168.1.1 end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show ip interface brief -> Vlan1 up/up with 192.168.1.2 !--- ping 192.168.1.1 -> default gateway R1 G0/0/1 !--- Note: Part 5, Step 1 (backup to the TFTP server on PC-B) is interactive; run it by hand: !--- S2# copy running-config tftp: !--- Address or name of remote host []? 192.168.1.5 !--- Destination filename [S2-confg]? S2-Run-Config ! ==============================================================
SWITCH S3
! ============================================================== !--- ENSA Final PT Skills Assessment (PTSA) !--- ANSWER SCRIPT FOR SWITCH S3 !--- Usage: power on and cable the device, open its console and paste this whole file at the Switch> prompt. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 3: Configure the switch. ! -------------------------------------------------------------- !--- a. Hostname according to the Addressing Table. hostname S3 !--- b. Management SVI for VLAN 1: IPv4 address and activate the interface. interface vlan 1 ip address 209.165.202.130 255.255.255.224 no shutdown exit !--- c. Default gateway. ip default-gateway 209.165.202.129 ! -------------------------------------------------------------- !--- Part 4, Step 6: Configure access control on S3. ! -------------------------------------------------------------- !--- a. Standard ACL S3-VTY-LIMIT: allow only PC-C. ip access-list standard S3-VTY-LIMIT permit host 172.16.2.5 exit !--- b. Apply the ACL to the VTY lines. line vty 0 15 access-class S3-VTY-LIMIT in exit ! -------------------------------------------------------------- !--- Part 5, Step 2: Use TFTP server to update/upgrade IOS software. ! -------------------------------------------------------------- !--- c. Boot S3 from the newer IOS image after the next reload. boot system flash:c2960-lanbasek9-mz.150-2.SE4.bin end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show ip interface brief -> Vlan1 up/up with 209.165.202.130 !--- show access-lists -> S3-VTY-LIMIT permit host 172.16.2.5 !--- show flash: -> c2960-lanbasek9-mz.150-2.SE4.bin is present !--- show boot -> BOOT path-list points to the new image !--- Note: copy the image from the web/DNS server by hand (the copy is interactive): !--- S3# copy tftp: flash: !--- Address or name of remote host []? 209.165.202.131 !--- Source filename []? c2960-lanbasek9-mz.150-2.SE4.bin !--- Destination filename [c2960-lanbasek9-mz.150-2.SE4.bin]? (press Enter) !--- Reload S3 only if you want to see it boot the new image; the reload is not part of this script. ! ==============================================================
SWITCH S4
! ============================================================== !--- ENSA Final PT Skills Assessment (PTSA) !--- ANSWER SCRIPT FOR SWITCH S4 !--- Usage: power on and cable the device, open its console and paste this whole file at the Switch> prompt. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 3: Configure the switch. ! -------------------------------------------------------------- !--- a. Hostname according to the Addressing Table. hostname S4 !--- b. Management SVI for VLAN 1: IPv4 address and activate the interface. interface vlan 1 ip address 172.16.2.2 255.255.255.0 no shutdown exit !--- c. Default gateway. ip default-gateway 172.16.2.1 end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show ip interface brief -> Vlan1 up/up with 172.16.2.2 !--- ping 172.16.2.1 -> default gateway R2 G0/0/1 ! ==============================================================
