CCNA Routing and Switching
Switched Networks
Practice Skills Assessment – Packet Tracer
A few things to keep in mind while completing this activity:
Do not use the browser Back button or close or reload any exam windows during the exam.
Do not close Packet Tracer when you are done. It will close automatically.
Click the Submit Assessment button in the browser window to submit your work.
Introduction
In this practice skills assessment, you will configure the Company A network with RPVST+, port security, EtherChannel, DHCP, VLANs and trunking, and routing between VLANs. In addition you will perform an initial configuration on a switch, secure unused switch ports and secure SVIs. A simple access control list will also be configured.
All IOS device configurations should be completed from a direct terminal connection to the device console from an available host.
Some values that are required to complete the configurations have not been given to you. In those cases, create the values that you need to complete the requirements. These values may include certain IP addresses, passwords, interface descriptions, banner text, and other values.
For the sake of time, many repetitive but important configuration tasks have been omitted from this activity. Many of these tasks, especially those related to device security, are essential elements of a network configuration. The intent of this activity is not to diminish the importance of full device configurations.
You will practice and be assessed on the following skills:
- Configuration of initial switch settings
- IPv4 address assignment and configuration
- Configuration of switch management settings including SSH
- Configuration of port security
- Configuration of unused switch ports according to security best practices
- Configuration of RPVST+
- EtherChannel configuration
- Configuration of a router as a DHCP server
- Configuration of VLANs and trunks
- Configuration of routing between VLANs
You are required to do the following:
Campus:
- Configure interface IPv4 addresses and descriptions
- Configure DHCP pools and excluded addresses
- Configure routing between VLANs
- Configure a simple standard access control list
SW-A:
- Create and name VLANs
- Configure EtherChannel
- Configure trunking
- Assign access ports to VLANs
- Configure remote management settings
- Configure RPVST+
SW-B:
- Configure initial device settings
- Create and name VLANs
- Configure EtherChannel
- Configure trunking
- Assign access ports to VLANs
- Configure remote management settings and SSH
- Activate RPVST+
- Secure unused switch ports
- Configure port security
SW-C:
- Create and name VLANs
- Configure EtherChannel
- Configure trunking
- Assign access ports to VLANs
- Configure remote management settings
- Configure RPVST+
Internal PC hosts:
- Configure as DHCP clients
- Assign Static IPv4 addresses
Tables
Note: You are provided with the networks that interfaces should be configured on. Unless you are told to do differently in the detailed instructions below, you are free to choose the host addresses to assign.
Addressing Table:
Instructions
All configurations must be performed through a direct terminal connection to the device consoles from an available host.
Step 1: Configure initial device settings on SW-B only.
- Configure the host name as SW-B. The host name must match the value in the table exactly in spelling, case, and punctuation.
- Prevent the router CLI from attempting to look up mistyped commands as URLs.
- Configure an appropriate message-of-the-day banner.
- Configure an encrypted password for Privileged EXEC mode.
- Protect access to the device console.
- Prevent IOS status messages from interrupting command line output at the device console.
- Encrypt all clear text passwords.
Step 2: Create and name VLANs.
On all three switches, create and name the VLANs shown in the VLAN Table.
- The VLAN names must match the values in the table exactly in spelling, case, and punctuation.
- Each switch should be configured with all of the VLANs shown in the table.
Step 3: Assign switch ports to VLANs.
Using the VLAN table, assign the switch ports to the VLANs you created in Step 2, as follows:
- All switch ports that you assign to VLANs should be configured to static access mode.
- All switch ports that you assign to VLANs should be activated.
- Note that all the unused ports on SW-B only should be assigned to VLAN 999. This configuration step on switches SW-A and SW-C has been left out of this activity for the sake of time.
Step 4: Configure the SVIs.
Using the addressing table, create and address the SVIs on all three switches. Configure the switches so that they can connect with remote hosts. Full connectivity will be established after routing between VLANs has been configured later in this assessment.
Step 5: Configure Trunking and EtherChannel.
a. Use the information in the Port-Channel Groups table to configure EtherChannel as follows:
- Use LACP.
- The switch ports on both sides of Channels 1 and 2 should both initiate negotiations for channel establishment.
- The switch ports on the SW-B side of the Channel 3 should initiate negotiations with the switch ports on SW-C.
- The switch ports on the SW-C side of Channel 3 should not initiate negotiations with the switch ports on the other side of the channel.
b. Configure all port-channel interfaces as trunks.
c. Configure trunking on the switch port on SW-A that is connected to Campus.
Step 6: Configure Rapid PVST+.
Configure Rapid PVST+ settings as follows.
a. Activate Rapid PVST+ and set root priorities.
- All three switches should be configured to run Rapid PVST+.
- SW-A should be configured as root primary for VLAN 5 and VLAN 10 using the default primary priority values.
- SW-A should be configured as root secondary for VLAN 15 and VLAN 100 using the default secondary priority values.
- SW-C should be configured as root primary for VLAN 15 and VLAN 100 using the default primary priority values.
- SW-C should be configured as root secondary for VLAN 5 and VLAN 10 using the default secondary priority values.
b. Activate PortFast and BPDU Guard on the SW-C switch access ports.
- Configure PortFast on all access ports that are connected to hosts. This must be configured on the switch ports. Do not use the portfast default form of the command.
- Activate BPDU Guard on all access ports that are connected to hosts.
Step 7: Configure switch security.
You are required to complete the following only on SW-B for this assessment. In reality, security should be configured on all devices in the network.
a. Secure unused switch ports. Following security best practices, do the following on SW-B only:
- Shutdown all unused switch ports.
- Configure all unused switch ports as access ports.
- All unused switch ports should be assigned to VLAN 999.
b. Configure port security on all active access ports on the SW-B.
- Each switch port should accept only two MAC addresses before a security action occurs.
- The learned MAC addresses should be recorded in the running configuration.
- If a security violation occurs, the switch ports should provide notification that a violation has occurred but not place the interface in an err-disabled state.
c. On SW-B, configure the virtual terminal lines to accept only SSH connections on the virtual terminal lines.
- Use a domain name of ccnaPTSA.com.
- Use a modulus value of 1024.
- Configure SSH version 2.
- Configure the vty lines to only accept SSH connections.
- Configure user-based authentication for SSH connections to the vty lines with a user name of netadmin and a secret password of SSH_secret9. The user name and password must match the values provided here exactly in case, punctuation, and spelling.
Step 8: Configure routing between VLANs.
Configure router Campus to route between VLANs according to the information in the addressing table.
- Do not route VLAN 999.
Step 9: Configure a standard access control list.
Configure a standard access control list to control access to the management interfaces (SVI) of the switches as follows:
- Use the number 1 for the list.
- Permit only addresses from the admin VLAN network to access any address on the manage VLAN network.
- Hosts on the admin VLAN network should be able to reach all other destinations.
- Your list should consist of one statement.
Step 10: Configure the router as a DHCP server.
Configure three DHCP pools as follows:
- Create a DHCP pool for hosts on VLAN5 using the pool name vlan5pool.
- Create a DHCP pool for hosts on VLAN10 using the pool name vlan10pool.
- Create a DHCP pool for hosts on VLAN15 using the pool name vlan15pool.
- All VLAN pool names must match the provided values exactly.
- Exclude the first five addresses from each pool.
- Configure a DNS server address of 192.0.2.62.
- Once they have received addresses, the hosts should be able to ping hosts on other networks.
Step 11: Configure host addressing.
All hosts should be able to ping each other and the two external servers after they have been addressed.
Hosts on VLANs 5, 10 and 15 should be configured to receive addresses dynamically over DHCP.
Hosts on VLAN 100 should be addressed statically as indicated in the addressing table. Once configured, the hosts should be able to ping hosts on other networks.
Shared by Gega Sxirtladze
Router Campus
en
conf t
int g0/1
no shut
no shutdown
exit
int g0/1.5
encapsulation dot1Q 5
ip address 10.10.5.1 255.255.255.0
no shutdown
exit
int g0/1.10
encapsulation dot1Q 10
ip address 10.10.10.1 255.255.255.0
no shut
exit
int g0/1.15
encapsulation dot1Q 15
ip addr 10.10.15.1 255.255.255.0
no shut
exit
int g0/1.100
encapsulation dot1Q 100
ip addr 10.10.100.1 255.255.255.0
no shut
exit
int g0/1.199
encapsulation dot1Q 199
ip addr 10.10.199.1 255.255.255.0
no shut
exit
ip dhcp excluded-address 10.10.5.1 10.10.5.5
ip dhcp pool vlan5pool
network 10.10.5.0 255.255.255.0
default-router 10.10.5.1
dns-server 192.0.2.62
exit
ip dhcp excluded-address 10.10.10.1 10.10.10.5
ip dhcp pool vlan10pool
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 192.0.2.62
exit
ip dhcp excluded-address 10.10.15.1 10.10.15.5
ip dhcp pool vlan15pool
network 10.10.15.0 255.255.255.0
default-router 10.10.15.1
dns-server 192.0.2.62
exit
ip access-list standard 1
permit 10.10.100.0 0.0.0.255
exit
int g0/1.199
ip access-group 1 out
————————————————-
SW-B
en
conf t
hostname SW-B
no ip domain-lookup
banner motd “SW-B”
enable secret cisco
service password-encryption
line console 0
password cisco
login
Logging synchronous
exit
line vty 0 15
password cisco
login
exit
no logging console
vlan 5
name sales
exit
vlan 10
name prod
exit
vlan 15
name acct
exit
vlan 100
name admin
exit
vlan 199
name manage
exit
vlan 999
name null
exit
int f0/7
switchport mode access
switchport access vlan 5
no shutdown
exit
int f0/10
switchport mode access
switchport access vlan 10
no shutdown
exit
int f0/15
switchport mode access
switchport access vlan 15
no shutdown
exit
int f0/24
switchport mode access
switchport access vlan 100
no shutdown
exit
int vlan 199
ip address 10.10.199.253 255.255.255.0
ip default-gateway 10.10.199.1
int port-channel 2
exit
int range fa0/3-4
channel-group 2 mode active
exit
int port-channel 3
exit
int range fa0/5-6
channel-group 3 mode active
exit
int range fa0/3-6
switchport mode trunk
exit
spanning-tree mode rapid-pvst
int range fa0/1-2
switchport mode access
switchport access vlan 999
shutdown
exit
int range fa0/8-9
switchport mode access
switchport access vlan 999
shutdown
exit
int range fa0/11-14
switchport mode access
switchport access vlan 999
shutdown
exit
int range fa0/16-23
switchport mode access
switchport access vlan 999
shutdown
exit
Int range g1/1-2
switchport mode access
switchport access vlan 999
shutdown
exit
int fa0/7
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
exit
int fa0/10
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
exit
int fa0/15
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
exit
int fa0/24
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
exit
ip domain-name ccnaPTSA.com
crypto key generate rsa
1024
ip ssh version 2
line vty 0 4
login local
transport input ssh
exit
username netadmin secret SSH_secret9
—————————————————-
SW-A>
en
conf t
vlan 5
name sales
exit
vlan 10
name prod
exit
vlan 15
name acct
exit
vlan 100
name admin
exit
vlan 199
name manage
exit
vlan 999
name null
exit
int f0/5
switchport mode access
switchport access vlan 5
no shutdown
exit
int f0/10
switchport mode access
switchport access vlan 10
no shutdown
exit
int f0/15
switchport mode access
switchport access vlan 15
no shutdown
exit
int f0/24
switchport mode access
switchport access vlan 100
no shutdown
exit
int vlan 199
ip address 10.10.199.254 255.255.255.0
ip default-gateway 10.10.199.1
int port-channel 1
exit
int port-channel 2
exit
int range fa0/1-2
channel-group 1 mode active
exit
int range fa0/3-4
channel-group 2 mode active
exit
int range fa0/1-4
switchport mode trunk
exit
int gig1/1
no shutdown
switchport mode trunk
exit
spanning-tree mode rapid-pvst
spanning-tree vlan 5 root primary
spanning-tree vlan 10 root primary
spanning-tree vlan 15 root secondary
spanning-tree vlan 100 root secondary
————————————————–
SW-C
en
conf t
vlan 5
name sales
exit
vlan 10
name prod
exit
vlan 15
name acct
exit
vlan 100
name admin
exit
vlan 199
name manage
exit
vlan 999
name null
exit
int f0/7
switchport mode access
switchport access vlan 5
no shutdown
exit
int f0/10
switchport mode access
switchport access vlan 10
no shutdown
exit
int f0/15
switchport mode access
switchport access vlan 15
no shutdown
exit
int f0/24
switchport mode access
switchport access vlan 100
no shutdown
exit
int vlan 199
ip address 10.10.199.252 255.255.255.0
ip default-gateway 10.10.199.1
int port-channel 1
exit
int port-channel 3
exit
int range fa0/1-2
channel-group 1 mode active
exit
int range fa0/5-6
channel-group 3 mode passive
exit
int range fa0/1-2
switchport mode trunk
exit
int range fa0/5-6
switchport mode trunk
exit
spanning-tree mode rapid-pvst
spanning-tree vlan 15 root primary
spanning-tree vlan 100 root primary
spanning-tree vlan 5 root secondary
spanning-tree vlan 10 root secondary
int fa0/7
spanning-tree portfast
spanning-tree bpduguard enable
exit
int fa0/10
spanning-tree portfast
spanning-tree bpduguard enable
exit
int fa0/15
spanning-tree portfast
spanning-tree bpduguard enable
exit
int fa0/24
spanning-tree portfast
spanning-tree bpduguard enable
exit
0 Comment "CCNA 3 v5.0 Final Switched Networks Practice Skills Assessment"
Post a Comment