EIGRP does not have process ID as it uses Autonomous System (AS) numbers only.

This is not an authentication problem or we would see this error from the debug:

EIGRP: Ethernet0/0: ignored packet from 10.1.1.3, opcode = 1 (missing authentication or key-chain missing)

If the AS numbers between two routers are different then the neighbor relationship cannot be formed.

Unmonitored: Unmonitored devices are devices for which Assurance did not receive any

telemetry data during the specified time range.

MPLS Network Protocols

+ IGP: OSPF, EIGRP, IS-IS on core facing and core links+ RSVP and/or LDP on core and/or core facing links ->

+ MP-iBGP on PE devices (for MPLS services), MP-BGP: Multiprotocol Border Gateway Protocol, used for MPLS L3 VPN -> .

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

The IPv6 Router Advertisement Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement guard messages that arrive at the network device platform. Router Advertisements are used by devices to announce themselves on the link. The IPv6 Router Advertisement Guard feature analyzes these router advertisements and filters out router advertisements that are sent by unauthorized devices.

Certain switch platforms can already implement some level of rogue RA filtering by the administrator configuring Access Control Lists (ACLs) that block RA ICMP messages that might be inbound on “user” ports.

Overview of the IPv6 First-Hop Security Binding Table

A database table of IPv6 neighbors connected to the device is created from information sources such as NDP snooping. This database, or binding table, is used by variousIPv6 guard features to validate the link-layer address (LLA), the IPv4 or IPv6 address, and the prefix binding of the neighbors to prevent spoofing and redirect attacks.

IPv6 First-Hop Security Binding Table Recovery MechanismThe IPv6 first-hop security binding table recovery mechanism enables the binding table to recover in the event of a device reboot.

When R2 & R5 are route reflectors (RRs), routes from R4 & R8 are advertised to R5 and R5

advertises to R2. But R2 would drop them as R2 is also a RR. Therefore some routes are

missing on R1 to advertise to eBGP peers.

Good reference:

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2015/pdf/TECRST-2310.pdf

Route reflectors (RR) must be fully iBGP meshed so we cannot configure RR on both R1 and

R5.

We should choose routers at the center of the topology RRs, in this case R4 & R5.

https://community.cisco.com/t5/networking-documents/how-to-configure-pbr/ta-p/3122774

R1(config)#int tunnel 1

R1(config-if) no ip split-horizon eigrp 100

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and management/dnacenter/tech_notes/b_dnac_sda_lan_automation_deployment.html

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01001.html

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/mpls/configuration/guide/mpls_cg/mp_mpls_overview.pdf

By default, the priority is 1 on all routers so we can set the OSPF priority of the hub to a value which is greater than 1 to make sure it would become the DR.

Diagram Description automatically generated

The MPLS LDP Inbound Label Binding Filtering feature can be used to control the amount of

memory used to store Label Distribution Protocol (LDP) label bindings advertised by other

devices. For example, in a simple Multiprotocol Label Switching (MPLS) Virtual Private Network

(VPN) environment, the VPN provider edge (PE) devices might require label switched paths

(LSPs) only to their peer PE devices (that is, they do not need LSPs to core devices). Inbound

label binding filtering enables a PE device to accept labels only from other PE devices.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/3850/snmp-xe-3se-3850-book/nm-snmp-snmpv3.html

Once again, Cisco changed the IOS configuration commands required for OSPFv3 configuration. The new OSPFv3 configuration uses the “ospfv3” keyword instead ofthe earlier “ipv6 router ospf” routing process command and “ipv6 ospf” interface commands.

The Open Shortest Path First version 3 (OSPFv3) address families feature enables both IPv4 and IPv6 unicast traffic to be supported. With this feature, users may havetwo processes per interface, but only one process per address family (AF).

--------------------------R1---------------------------------------------

interface Ethernet0/0

ip address 209.165.201.1 255.255.255.0

ip access-group EGRESS2 out

ipv6 address 2001:DB8::1/64

end

----------------------R2--------------------------------------------------

interface Ethernet0/0

ip address 209.165.201.25 255.255.255.0

ipv6 address 2001:DB8::2/64

ipv6 address autoconfig

ipv6 nd autoconfig default-route

ipv6 nd cache expire 60

ipv6 nd ra suppress

ipv6 traffic-filter INGRESS in

end

IOU_Router2#telnet 2001:DB8::1

Trying 2001:DB8::1 ... Open

IOU_Router1>

------------------------------------------------------------------------------

Excessive time lag between Cisco DNA Center and device: The time difference between Cisco DNA Center and the device IP Address has drifted too far apart. CiscoDNA Center cannot process the device data accurately if the time difference is more than 3 minutes.

In the configuration above, the engineer has made a mistake as he was tracking 172.16.35.6 (the backup path) instead of tracking the main path (172.16.35.2). Therefore,when he shut down the main path, the track 1 was still up so traffic still went through the main path -> it failed.

To fix this issue, we just need to correct the tracking interface of the main path.

The configuration on NY router is good for OSPF authentication. So we must enable OSPF

authentication on LA router with the following commands:

router ospf 1

area 0 authentication message-digest

interface E0/0

ip ospf message-digest-key 1 md5 Cisco123

MPLS Layer-3 VPNs provide IP connectivity among CE sites* MPLS VPNs enable full-mesh, hub-andspoke, and hybrid IP connectivity* CE sites connect to the MPLS network via IP peering across PE-CE links* MPLS Layer-3 VPNs are implemented via VRFs on PE edge nodes* VRFs providing customer routing and forwarding segmentation* BGP used for signaling customer VPN (VPNv4) routes between PE nodes* To ensure traffic separation, customer traffic is encapsulated in an additional VPN label when forwarded in MPLS network* Key applications are layer-3 business VPN services, enterprise network segmentation, and segmented layer-3 Data Center access

Graphical user interface, application Description automatically generated

From the output of the “show ip eigrp topology …” command, we notice network 192.168.13.0/24 was learned via two routes:+ From 192.168.23.3 (R3) with FD = 1075200 and AD = 281600+ From 192.168.12.1 (R1) with FD = 2611200 and AD = 281600

From the output of the “show ip route …” command, we learned that the best (and chosen) path is via 192.168.23.3 (R3).

To use both paths (called unequal cost load balancing) with EIGRP, the second path via R1 must satisfy the feasibility condition. The feasibility condition states that, theAdvertised Distance (AD) of a route must be lower than the feasible distance of the current successor route.

In this case, the second path satisfies the feasible condition as its AD (281600) is smaller than the FD (1075200) of the best path. Therefore we can configure loadbalancing with “variance” command.

In other words, EIGRP will install all paths with metric < variance * best_metric into the local routing table, provided that it meets the feasibility condition to preventrouting loop. Therefore we can calculate the variance > metric / best_metric = 2611200 / 1075200 =2.4.

So with a variance greater than 2 (and must be an integer), we can load balance traffic to network 192.168.13.0/24.

To turn off terminal monitor, use “terminal no monitor” in the enable mode

1. R1 received DHCP packet and its interface was configured with the DHCP helper address. But we are not sure if R1 forward DHCP packet to R2 or not. 2. If we connect PC directly to R2 then this problem will not appear -> DHCP Server function was configured on R2.

From these facts, the most likely problem is related to Option 82. Maybe R2 ignored DHCP request packets because it was receiving these packets with the giant field set to 0.0.0.0.

By default Cisco IOS devices reject packets with zero “giaddr” and by default Cisco Catalyst switches use “giaddr” of zero when configured for DHCP snooping! Reference: https://blog.ine.com/2009/07/22/understanding-dhcp-option-82

If we can run the “debug ip dhcp server packet” on R2, we may see these messages:

*Feb 22 23:54:57.759: IP: s=0.0.0.0 (FastEthernet0/1), d=255.255.255.255, len 34 4, input feature, MCI Check(64), rtype 0, forus FALSE, sendself FALSE, mtu 0, fw dchk FALSE *Feb 22 23:54:57.759: IP: s=0.0.0.0 (FastEthernet0/1), d=255.255.255.255, len 34 4, rcvd 2 *Feb 22 23:54:57.759: IP: s=0.0.0.0 (FastEthernet0/1), d=255.255.255.255, len 34 4, stop process pak for forus packet

*Feb 22 23:54:57.759: DHCPD: inconsistent relay information. *Feb 22 23:54:57.759: DHCPD: relay information option exists, but giaddr is zero

We are receiving the DHCP packet from R1, source 0.0.0.0, and destination 255.255.255.255 broadcast, but if you notice from the debug output, R2, our DHCP Server, is complaining that the relay information is inconsistent. Option 82, Information Option, is contained in the packet but the GIADDR is zero. The GIADDR stands for Gateway IP Address, which is the IP Address of the relaying agent. The Option 82, Information Option, would then contain the receiving port and hostname of the Relaying Agent by default.

R2 sees the Option 82 information, signalling that the DHCP packet might have been relayed, BUT there is no relaying IP Address. This is the behavior of DHCP Snooping when enabling it on a switch, and since the switchport does not contain an IP Address, since it’s Layer 2, no GIADDR will be added.

Instead, just the Option 82 Information is added and this is the problem we have, but there are options:

1. You could trust all on R2 the DHCP Server, which will cause the server to not be so suspicious: – ip dhcp relay information trust-all – ip dhcp relay information trusted 2. Disable theaddition of Option 82 information on SW: – no ip dhcp snooping information option 3. Trust the port that is receiving the DHCP Discover: – ip dhcp snooping trust

Any of these options will fix our predicament.

When the aggregate-address command is used within BGP routing, the aggregated address is advertised, along with the more specific routes. The exception to this

rule is through the use of the summary-only command. The “summary-only” keyword suppresses the more specific routes and announces only the summarized

route.

https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/8606-redist.html

https://community.cisco.com/t5/other-network-architecture/out-of-band-router-access/td-p/333295

The “transport output none” command prevents any protocol connection made from R1.

Therefore our SSH connection to 192.168.12.2 was refused. In order to fix this problem we can

configure “transport output ssh” under “line console 0” of R1.

Note: The parameter “-l” specifies the username to log in as on the remote machine.

In order to use a prefix-list in a route-map, we must use the keyword “prefix-list” in the “match”

statement. . For example:

match ip address prefix-list WAN_PREFIXES

Without this keyword, the router will try to find an access-list with the same name instead.

A route received from one iBGP peer will NOT be advertised to another iBGP peer. Therefore R4 could not receive advertisement for network 192.168.100.0/24. We can overcome this BGP limitation by configuring R1 as a route reflector server and R4 as a route reflector client so that R1 sends advertisements for R4.

Required Min RX Interval: This is the minimum interval, in microseconds, between received BFD Control packets that this system is capable of supporting.

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html#anc12

Even PC2 cannot reach PC1 so there is something wrong with RIP redistribution in R2. Because

RIP has higher Administrative Distance (AD) value than OSPF and EIGRP so it will be looped

when doing mutual redistribution.

The ―imp-null‖ (implicit null) tag instructs the upstream router to pop the tag entry off the tag stack before forwarding the packet.

Note: pop means ―remove the top MPLS label‖

LDP multicasts hello messages to a well-known UDP port (646) in order to discover neighbors. Once the discovery is accomplished, a TCP connection (port 646) is established and the LDP session begins. LDP keepalives ensure the health of the session. Thanks to the LDP session, LDP messages create the label mappings required for a FEC. Withdraw messages are used when FECs need to be torn down.

By default BGP advertises all prefixes to external BGP neighbors. This means that if you are

multi-homed (connected to two or more ISPs) then you might become a transit AS. For example,

ISP 2 in AS 200 can send traffic to your router in AS 100 to reach ISP 3 in AS 300 because you

advertised prefixes in ISP 3 to ISP 2.

This is what will be seen in the BGP routing table of ISP1:

IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables. IPv6 ND inspection analyzes neighbor discovery messages in order to build a trusted binding table database, and IPv6 neighbor discovery messages that do not have valid bindings are dropped. A neighbor discovery message is considered trustworthy if its IPv6-to-MAC mapping is verifiable.

This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, device discovery, and the neighbor cache.

The reason for the loop is that R2 is forwarding the packets destined to 10.1.1.1 to R4, instead of R1. This is because in the redistribute OSPF statement, BW metric has a higher value and delay has a value of 1. So, R2 chooses R4 over R1 for 10.1.1.0/24 subnet causing a loop. Now, R5 learns 10.1.1.0/24 from R3 and advertises the same route to R4, that R4 redistributes back in EIGRP. If R3 sets a tag of 1 while redistributing EIGRP in OSPF, and R4 denies all the OSPF routes with tag 1 while redistributing, it will not advertise 10.1.1.0/24 back into EIGRP. Hence, the loop will be broken.

Upload Software Images for Devices in Install Mode

The Image Repository page might show a software image as being in Install Mode. When a device is in Install Mode, Cisco DNA Center is unable to upload its software image directly from the device. When a device is in install mode, you must first manually upload the software image to the Cisco DNA Center repository before marking the image as golden, as shown in the following steps.

From the exhibit, we learned:

+ VRF customer_a was exported with Route target (RT) of 1:1 so at the remote site it must be

imported with the same RT 1:1.

+ VRF customer_a was imported with Route target (RT) of 1:1 so at the remote site it must be

exported with the same RT 1:1.

Therefore at the remote site we must configure the command “route-target both 1:1” (which is

equivalent to two commands “route-target import 1:1” & “route-target export 1:1”.

Unlike legacy network technologies such as ISDN, Frame Relay, and ATM that defined separate data and control channels, IP carries all packets within a single pipe. Thus, IP network devices such as routers and switches must be able to distinguish between data plane, control plane, and management plane packets to treat each packet appropriately.From an IP traffic plane perspective, packets may be divided into four distinct, logical groups:1. Data plane packets – End-station, user-generated packets that are always forwarded by network devices to other end-station devices. From the perspective of the network device, data plane packets always have a transit destination IP address and can be handled by normal, destination IP address-based forwarding processes.2. Control plane packets – Network device generated or received packets that are used for the creation and operation of the network itself. From the perspective of the network device, control plane packets always have a receive destination IP address and are handled by the CPU in the network device route processor. Examples include protocols such as ARP, BGP, OSPF, and other protocols that glue the network together.3. Management plane packets – Network device generated or received packets, or management station generated or received packets that are used to manage the network. From the perspective of the network device, management plane packets always have a receive destination IP address and are handled by the CPU in the network device route processor. Examples include protocols such as Telnet,Secure Shell (SSH), TFTP, SNMP, FTP, NTP, and other protocols used to manage the device and/or network.4. Services plane packets – A special case of data plane packets, services plane packets are also user-generated packets that are also forwarded by network devices to other end-station devices, but that require high-touch handling by the network device (above and beyond normal, destination IP address-based forwarding) to forward the packet. Examples of high-touch handling include such functions as GRE encapsulation, QoS, MPLS VPNs, and SSL/IPsec encryption/decryption, etc. From the perspective of the network device, services plane packets may have a transit destination IP address, or may have a receive destination IP address (for example, in the case of a VPN tunnel endpoint).

By default, Catalyst switches add a simple uptime timestamp to logging messages. This is a cumulative counter that shows the hours, minutes, and seconds since the switch has been booted up

Label Switch Router 1. Reads labels and forwards the packet based on the based on the label.

2. Performs PHP

Label Edge Router: 1 Assigns labels and unlabeled packets.

2. Handles traffic between multiple VPNs

The policy-map COPP-7600 only rate-limit HTTP & HTTPS traffic (based on the ACL

conditions) so any BGP packets will be processed in the class “class-default”, which drops

exceeded BGP packets. Therefore we have two ways to solve this problem:

+ Add BGP to the ACL with the statement “permit tcp any any eq bgp”

+ Configure higher value for CIR in default class as 2Mbps is too low for web traffic (http &

https)

https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/25160-bgp-maximum-prefix.html#b

From the output we can see there are 2 NHRP Peers. The first one with the NBMA Address of

172.18.16.2 and the “Attribute” (Attrb) of Static (S) so we can deduce it is the Hub device.

Therefore the second one must be the remaining Spoke device with the attribute of Dynamic

(D).

--> S - Static, D - Dynamic, I - Incomplete

N - NATed, L - Local, X - No Socket

# Ent --> Number of NHRP entries with same NBMA peer

NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting

UpDn Time --> Up or Down Time for a Tunnel

========================================================================

==

Interface: Tunnel1, IPv4 NHRP Details

Type:Spoke, NHRP Peers:2,

# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

1 44.44.44.4 192.168.100.254 UP 00:03:40 S

1 12.12.12.2 192.168.100.2 UP 00:03:20 D

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-3s/ip6f-xe-3s-book/ip6-ra-guard.html#GUID-589AF00C-7499-439F-AD23-51005D61CAB7

The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

The first 20 bits constitute a label, which can have 2^20 values. Next comes 3 bit value called Traffic Class. It was formerly called as experimental (EXP) field. Now it has been renamed toTraffic Class (TC). This field is used for QoS related functions. Ingress router can classify the packet according to some criterion and assign a 3 bit value to this filed. If an incoming packet is marked with some IP Precedence or DSCP value and the ingress router may use such a field to assign an FEC to the packet. Next bit is Stack bit which is called bottom-of-stack bit. This field is used when more than one label is assigned to a packet, as in the case of MPLS VPNs or MPLS TE. Next byte is MPLS TTL field which serves the same purpose as that of IP TTL byte in the IP header

By using “deny” keyword in a route-map, we can filter out the prefix specified in the prefix-list.

But there is an implicit “deny all” statement in the prefix-list so we must permit other prefixes

with “permit” keyword in the route-map.

Restrictions for IPv6 RA Guard

The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

This feature is supported only in hardware when the ternary content addressable memory (TCAM) is programmed.

This feature can be configured on a switch port interface in the ingress direction.

This feature supports host mode and router mode.

This feature is supported only in the ingress direction; it is not supported in the egress direction.

This feature is not supported on EtherChannel and EtherChannel port members.

This feature is not supported on trunk ports with merge mode.

This feature is supported on auxiliary VLANs and private VLANs (PVLANs). In the case of PVLANs, primary VLAN features are inherited and merged with port features.

Packets dropped by the IPv6 RA Guard feature can be spanned.

If you configure the redistribution of OSPF into BGP without keywords, only OSPF intra-area and inter-area routes are redistributed into BGP, by default.

You can redistribute both internal and external (type-1 & type-2) OSPF routes via this command: ―Router(config-router)#redistribute ospf 1 match internal external 1 external 2‖

LDP provides a standard methodology for hop-by-hop, or dynamic label, distribution in an MPLS

network by assigning labels to routes that have been chosen by the underlying Interior Gateway

Protocol (IGP) routing protocols. The resulting labeled paths, called label switch paths (LSPs), forward

label traffic across an MPLS backbone to particular destinations.

We tested this config in GNS3 (except the LAN interface) but R1 loopback0 was advertised normally on R2 and R2 could reach this loopback0.

Note: Although the configured loopback address is 4.4.4.4/24 but by default OSPF will advertise this route to loopback0 as 4.4.4.4/32 (most specific route to that loopback). In order to override this, we have to change the network type to point-to-point. After this OSPF will advertise the address to loopback as 4.4.4.0/24.

SOLUTION:-

R4

Int range et0/0 – 1

Ip ospf authentication message-digest

Ip ospf message-digest-key 1 md5 CCNP

Router ospf 1

Redistribute connected subnets route-map to-ospf metric-type 1

Copy run start

R5

Int range et0/0 – 1

Ip ospf authentication message-digest

Ip ospf message-digest-key 1 md5 CCNP

Interface eth 0/1

Ip ospf cost 10

Copy run start

VERIFICATION:-

A black screen with white text AI-generated content may be incorrect.

In EIGRP (Enhanced Interior Gateway Routing Protocol), a stub router is one that is connected to one or more neighbors and should not be a transit router1. The EIGRP stub routing feature improves network stability, reduces resource utilization, and simplifies the stub router’s configuration1.

The network engineer wants to configure an EIGRP stub router that advertises only connected and summary routes. This can be achieved with the configuration provided in Option B:

router eigrp 100

eigrp stub summary

This configuration ensures that the EIGRP stub router advertises only connected and summary routes12. The summary keyword after the eigrp stub command indicates that the router should advertise only auto-summarized or statically configured summary routes12.

In the context of Control Plane Policing (CoPP) in Cisco devices, the rate limit is specified in bits per second (bps), not kilobits per second (kbps). Therefore, a limit of 1000 kbps should indeed be entered as 1,000,000 bps in the CoPP configuration.

Also, the access list should be configured to match the specific SNMP traffic from the Cisco Prime IP address (192.168.1.11), as you correctly pointed out.

Here’s the corrected configuration:

no access-list 100

access-list 100 permit udp host 192.168.1.11 any eq 161

!

policy-map PM-COPP

class CM-SNMP

no police 1000 conform-action transmit

police 1000000 conform-action transmit

This configuration ensures that only the SNMP traffic from Cisco Prime is policed and any excess traffic is dropped, preventing the router’s CPU from being overwhelmed.

Option A configures uRPF loose mode to forward the packet. This mode allows the router to check if there is a route in the routing table that matches the source IP address of the incoming packet, regardless of the interface that is used to reach the source. This mode is suitable for networks that have asymmetric routing, where the incoming and outgoing interfaces for a packet may differ2.

Option B permits the 172.16.3.251 in the inbound ACL on interface gi0/3. This option does not resolve the issue, because it only allows the packet to pass the ACL check, but not the uRPF check. The packet will still be dropped by uRPF if there is no route to reach the source IP address via the same interface3.

Option C permits the 172.16.3.251 in the inbound ACL on interface gi0/3 to allow 172.16.3.251. This option is redundant and incorrect, because it repeats the same IP address twice in the ACL statement. It also does not resolve the issue for the same reason as Option B3.

Option D configures uRPF strict mode to forward the packet. This option does not resolve the issue, because it is the same mode that was already configured on the interface. Strict mode requires that the router has a route to reach the source IP address via the same interface where the packet was received. If this condition is not met, the packet will be dropped4.

For OSPF, we can only summary at the ABR with the command “area range” or at the ASBR with the command “summary-address” -> Therefore answer A and answer B are not correct.

In this question, the most likely problem is that when doing summarization, the network mask is configured wrong and summarization doesn’t work because of the misconfiguration. When configuring the area range command, make sure that the summarization mask is in the form of a prefix mask rather than a wildcard mask (that is, 255.255.255.0 instead of 0.0.0.255).

Good reference: https://www.configrouter.com/troubleshooting-route-summarization-ospf-14082/

Solution:

Use cu-red under interfaces facing SW1 & SW3:

On R1:

interface Ethernet0/0

ip vrf forwarding cu-red

ip address 192.168.1.254 255.255.255.0

Check reachability to SW1:

R1#ping vrf cu-red 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R2:

interface Ethernet0/0

ip vrf forwarding cu-red

ip address 192.168.2.254 255.255.255.0

Check reachability to SW3:

R2#ping vrf cu-red 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Use vrf cu-green for SW2 & SW4:

On R1:

interface Ethernet0/1

ip vrf forwarding cu-green

ip address 192.168.20.254 255.255.255.0

Test reachability to SW2:

R1#ping vrf cu-green 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R2:

interface Ethernet0/1

ip vrf forwarding cu-green

ip address 192.168.22.254 255.255.255.0

Test reachability to SW4:

R2#ping vrf cu-green 192.168.22.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R1:

interface Ethernet0/2.100

mpls ip

!

interface Ethernet0/2.200

mpls ip

!

Configure BGP:

router bgp 65000

neighbor 10.10.10.2 remote-as 65000

neighbor 10.10.20.2 remote-as 65000

!

address-family vpnv4

neighbor 10.10.10.2 activate

neighbor 10.10.20.2 activate

exit-address-family

!

address-family ipv4 vrf cu-green

redistribute connected

exit-address-family

!

address-family ipv4 vrf cu-red

redistribute connected

exit-address-family

!

R1(config)#ip vrf cu-red

R1(config-vrf)#route-target both 65000:100

!

R1(config)#ip vrf cu-green

R1(config-vrf)#route-target both 65000:200

On R2:

interface Ethernet0/2.100

mpls ip

!

interface Ethernet0/2.200

mpls ip

!

router bgp 65000

neighbor 10.10.10.1 remote-as 65000

neighbor 10.10.20.1 remote-as 65000

!

address-family vpnv4

neighbor 10.10.10.1 activate

neighbor 10.10.20.1 activate

exit-address-family

!

address-family ipv4 vrf cu-green

redistribute connected

exit-address-family

!

address-family ipv4 vrf cu-red

redistribute connected

exit-address-family

R2(config)#ip vrf cu-red

R2(config-vrf)#route-target both 65000:100

!

R2(config)#ip vrf cu-green

R2(config-vrf)#route-target both 65000:200

Verification:

From SW1 to SW3:

SW1#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

But can’t Reach SW2 or SW4 in VRF cu-green:

SW1#ping 192.168.22.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

SW1#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Same Test for SW2:

From SW2 to SW4:

SW2#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

But can’t Reach SW3 or SW1 in VRF cu-red:

SW2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

SW2#ping 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Both R1 & R2 has separate tables for VRFs cu-red and cu-green.

The Destination Guard feature helps in minimizing denial-of-service (DoS) attacks. It performs address resolutions only for those addresses that are active on the link,and requires the FHS binding table to be populated with the help of the IPv6 snooping feature.The feature enables the filtering of IPv6 traffic based on the destinationaddress, and blocks the NDP resolution for destination addresses that are not found in the binding table. By default, the policy drops traffic coming for an unknowndestination.

From the exhibit we see there are two flow monitors: the first one “FLOW-MONITOR-1” has been configured correctly but the second one “v4_r1” was left empty andinterface E0/0.1 is using it. So the remote server does not receive any NetFlow data.

In this topology, Chicago router (Hub) will receive advertisements from Los Angeles (Spoke1) router on its tunnel interface. The problem here is that it also has a connection with New York (Spoke2) on that same tunnel interface. If we don’t disable EIGRP split-horizon, then the Hub will not relay routes from Spoke1 to Spoke2 and the other way around. That is because it received those routes on interface Tunnel1 and therefore it cannot advertise back out that same interface (splithorizon rule). Therefore we must disable split-horizon on the Hub router to make sure the Spokes know about each other.

Desired Min TX Interval: This is the minimum interval, in microseconds, that the local system would like to use when transmitting BFD Control packets, less any jitterapplied. The value zero is reserved.

Required Min Echo RX Interval: This is the minimum interval, in microseconds, between received BFD Echo packets that this system is capable of supporting, less anyjitter applied by the sender. If this value is zero, the transmitting system does not support the receipt of BFD Echo packets.

After redistribution, R3 learns about network 10.1.1.0/24 via two paths:

+ Internal BGP (IBGP): advertised from R4 with AD of 200 (and metric of 0)

+ OSPF: advertised from R1 with AD of 110 (O E2) (and metric of 20)

Therefore R3 will choose the path with the lower AD via OSPF

But this is a looped path which is received from R3 -> R2 -> R1 -> R3. So when the advertised route

from R4 is expired, the looped path is also expired soon and R3 will reinstall the main path from R4.

This is the cause of intermittent connectivity.

We can solve this problem by denying the 10.1.1.0/24 prefix from being redistributed into OSPF on

R1. So R3 will not learn this prefix from R1.

Or another solution is to place an OSPF distribute-list inbound on R3 to block the 10.1.1.0/24 prefix

from being advertised back to R3.