21.1.3 Lab – Troubleshoot IPv6 ACLs Answers

• Recommend

Lab – Troubleshoot IPv6 ACLs (Answers Version)

Answers Note: Red font color or gray highlights indicate text that appears in the instructor copy only.

Topology

Addressing Table

Objectives

Troubleshoot network issues related to the configuration and operation of IPv6 ACLs.

Background / Scenario

In this topology, R1 and R3 are BGP neighbors. R1 speaks for BGP ASN 15, while R3 speaks for BGP ASN 41. They are peered via their respective Loopback 0 interface using BGP Multi–hop across the serial interfaces that connect them. R1 and D1 have an OSPFv3 adjacency, with R1 providing a default route. R3 is performing Router-On-A-Stick for VLANs 16 and 27. The host connected to D1 is using SLAAC to determine their IPv6 Global Unicast Address (GUA), while the host connected to D2 is using DHCPv6 to determine their IPv6 GUA. You will be loading configurations with intentional errors onto the network. Your tasks are to FIND the error(s), document your findings and the command(s) or method(s) used to fix them, FIX the issue(s) presented here, and then test the network to ensure both of the following conditions are met:

1)the complaint received in the ticket is resolved

2)full reachability is restored

Note: The routers used with CCNP hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.4 (universalk9 image). The switches used in the labs are Cisco Catalyst 3650 with Cisco IOS XE Release 16.9.4 (universalk9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers.

Note: Make sure that the devices have been erased and have no startup configurations. If you are unsure, contact your instructor.

Answers Note: Refer to the Answers Lab Manual for the procedures to initialize and reload devices.

Required Resources

• 2 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 2 Switches (Cisco 3560 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 4 PCs (Choice of operating system with terminal emulation program installed)
• Console cables to configure the Cisco IOS devices via the console ports
• Ethernet and serial cables as shown in the topology

Part 1:Trouble Ticket 21.1.3.1

Scenario:

The night shift completed work in an attempt to secure the network. Network hosts, represented by PC1 and PC2 in this topology, are now unable to generate an IPv6 GUA.

Use the commands listed below to load the configuration files for this trouble ticket:

Answers Note: Commands for uploading the configuration are provided at the end of this document.

• PCs 1, 2, 3, and 4 should be configured for dynamic acquisition of an IPv6 address.
• Passwords on all devices are cisco12345. If a username is required, use admin.
• After you have corrected the ticket, change the MOTD on EACH DEVICE using the following command:

banner motd # This is $(hostname) FIXED from ticket <ticket number> #

• Save the configuration by issuing the wri command (on each device).
• Inform your instructor that you are ready for the next ticket.
• After the instructor approves your solution for this ticket, issue the privileged EXEC command reset.now. This script will clear your configurations and reload the devices.

Answers Notes:

This trouble ticket contains 1 intentional error. The ACL applied to D1 interface VLAN 11 and VLAN 12 does not allow for ICMPv6 ND and NA messages; the administrator that added the ACLs did not take ND or NA messages into account when adding the deny ipv6 any any ACE.

The commands used to fix this error should be:

D1(config)# ipv6 access-list CLIENT-CONTROL-VLAN11

D1(config-ipv6-acl)# sequence 31 permit icmp any any nd-na

D1(config-ipv6-acl)# sequence 32 permit icmp any any nd-ns

D1(config-ipv6-acl)# exit

D1(config)# ipv6 access-list CLIENT-CONTROL-VLAN12

D1(config-ipv6-acl)# sequence 31 permit icmp any any nd-na

D1(config-ipv6-acl)# sequence 32 permit icmp any any nd-ns

D1(config-ipv6-acl)# exit

Note: The permit icmp any any eq echo-request and permit icmp any any eq echo-reply ACE are necessary for a later ticket. They were added in this ticket to normalize their presence.

Note: Host behavior may be different amongst operating systems. For example, while Windows 10 honors the /no-autoconfig flag, it seems that Ubuntu 18.0.4 LTS ignores the lack of an A flag in the RA creates the GUA anyway.

Part 2:Trouble Ticket 21.1.3.2

Scenario:

The night shift completed work in an attempt to secure the network. This morning it was discovered that PC3 and PC4 are no longer able to reach D1 interfaces VLAN 11 and VLAN 12 using the ping command. This must be fixed to allow for normal business operations.

Use the commands listed below to load the configuration files for this trouble ticket:

Answers Note: Commands for uploading the configuration are provided at the end of this document.

• PCs 1, 2, 3, and 4 should be configured for dynamic acquisition of an IPv6 address.
• Passwords on all devices are cisco12345. If a username is required, use admin.
• Once you have fixed the ticket, change the MOTD on EACH DEVICE using the following command:

banner motd # This is $(hostname) FIXED from ticket <ticket number> #

• Then save the configuration by issuing the wri command (on each device).
• Inform your instructor that you are ready for the next ticket.
• After the instructor approves your solution for this ticket, issue the privileged EXEC command reset.now. This script will clear your configurations and reload the devices.

Answers Notes:

This trouble ticket contains 1 intentional error repeated in two places. The ACL applied to the R1 serial interfaces has a broad deny statement in place blocking hosts from the 2001:db8:acad:16::/64 and 2001:db8:acad:27::/64 networks from communicating with the interior of ASN 15.

There are several possible ways to fix this error and allow traffic from the 2001:db8:acad:16::/64 and 2001:db8:acad:27::/64 networks to pass. The commands used to fix this error in the most specific manner are:

R1(config)# ipv6 access-list BOGON-MARTIAN

R1(config-ipv6-acl)# sequence 11 permit ipv6 2001:db8:acad:16::/64 any

R1(config-ipv6-acl)# sequence 12 permit ipv6 2001:db8:acad:27::/64 any

R1(config-ipv6-acl)# exit

Part 3:Trouble Ticket 21.1.3.3

Scenario:

The night shift completed work in an attempt to secure the network. It was discovered this morning that PC3 and PC4 are no longer able to obtain DHCPv6 addresses. This must be fixed to allow for normal business operations.

Use the commands listed below to load the configuration files for this trouble ticket:

Answers Note: Commands for uploading the configuration are provided at the end of this document.

• PCs 1, 2, 3, and 4 should be configured for dynamic acquisition of an IPv6 address.
• Passwords on all devices are cisco12345. If a username is required, use admin.
• Once you have fixed the ticket, change the MOTD on EACH DEVICE using the following command:

banner motd # This is $(hostname) FIXED from ticket <ticket number> #

• Then save the configuration by issuing the wri command (on each device).
• Inform your instructor that you are ready for the next ticket.
• After the instructor approves your solution for this ticket, issue the privileged EXEC command reset.now. This script will clear your configurations and reload the devices.

Answers Notes:

This trouble ticket contains 1 intentional error repeated in two places. The ACL applied to the R3 sub-interfaces is allowing the wrong UDP ports for DHCPv6. The ACL is allowing UDP ports 67 and 68, while DHCPv6 uses UDP ports 546 and 547.

There are several possible ways to fix this error and allow DHCPv6 traffic to pass. The commands used to fix this error in the most specific manner are:

R3(config)# ipv6 access-list CONTROL-UDP-TRAFFIC

R3(config)# no sequence 10

R3(config)# sequence 10 permit udp any any range 546 547

R3(config)# exit

Note: Host behavior may be different amongst operating systems. For example, while Windows 10 honors the /no-autoconfig flag, it seems that Ubuntu 18.0.4 LTS ignores the lack of an A flag in the RA creates the GUA anyway.

Router Interface Summary Table

Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many interfaces the router has. There is no way to effectively list all the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. The table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface.

End of document

Uploading Configuration Files

Use the commands below to create the configuration files for each trouble ticket in this lab on the lab devices. The TCL script commands help create and copy the configurations. However, the configuration commands could also be copied and pasted directly into global config mode on each device. Simply remove the TCL script commands, enter the enable and configure t commands on the device, and copy and paste the configuration commands.

Important: The device requires a folder in flash named enarsi. Use the dir command to verify. If the folder is missing, then create it using the mkdir flash:/enarsi privileged EXEC command.For all switches, make sure the vlan.dat file is set to the default. Use the delete vlan.dat privileged EXEC command, if necessary.

Reset scripts

These TCL scripts will completely clear and reload the device in preparation for the next ticket. Copy and paste the appropriate script to the appropriate device.

Router Reset Script

tclsh

puts [ open “flash:/enarsi/reset.tcl” w+ ] {

typeahead “\n”

copy running-config startup-config

typeahead “\n”

erase startup-config

puts “Reloading the router”

typeahead “\n”

reload

}

tclquit

D1/D2 (Cisco 3650) Reset Script – The default 3650 SDM template supports IPv6 by default, so it is not set by this script.

tclsh

puts [ open “flash:/enarsi/reset.tcl” w+ ] {

typeahead “\n”

copy running-config startup-config

typeahead “\n”

erase startup-config

delete /force vlan.dat

puts “Reloading the switch”

typeahead “\n”

reload

}

tclquit

A1 (Cisco 2960 Script) – The default 2960 SDM template does not support IPv6, so this script includes that setting.

tclsh

puts [ open “flash:reset.tcl” w+ ] {

typeahead “\n”

copy running-config startup-config

typeahead “\n”

erase startup-config

delete /force vlan.dat

delete /force multiple-fs

ios_config “sdm prefer lanbase-routing”

typeahead “\n”

puts “Reloading the switch in 1 minute, type reload cancel to halt”

typeahead “\n”

reload

}

tclquit

R1 Configuration File Scripts

! R1 – Trouble Ticket # 1

tclsh

puts [ open “flash:/enarsi/21.1.3.1-r1-config.txt” w+ ] {

hostname R1

no ip domain lookup

ipv6 unicast-routing

banner motd # This is R1, Trouble Ticket 21.1.3.1 #

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface g0/0/1

ipv6 address fe80::1:1 link-local

ipv6 address 2001:db8:acad:192::1/64

no shutdown

exit

interface s0/1/0

ipv6 address fe80::1:2 link-local

ipv6 address 2001:db8:acad:2000::1/64

no shutdown

exit

interface s0/1/1

ipv6 address fe80::1:3 link-local

ipv6 address 2001:db8:acad:2001::1/64

no shutdown

exit

interface loopback 0

ipv6 address fe80::1:4 link-local

ipv6 address 2001:db8:acad:226::1/64

no shutdown

exit

ipv6 route 2001:db8:acad:227::1/64 s0/1/0 2001:db8:acad:2000::2

ipv6 route 2001:db8:acad:227::1/64 s0/1/1 2001:db8:acad:2001::2

router ospfv3 1

router-id 1.1.1.1

address-family ipv6 unicast

default-information originate always

exit

exit

router bgp 15

bgp router-id 1.1.1.1

neighbor 2001:db8:acad:227::1 remote-as 41

neighbor 2001:db8:acad:227::1 update-source loopback 0

neighbor 2001:db8:acad:227::1 ebgp-multihop 3

address-family ipv6 unicast

neighbor 2001:db8:acad:227::1 activate

network 2001:db8:acad:224::/64

network 2001:db8:acad:225::/64

network 2001:db8:acad:192::/64

exit

exit

interface g0/0/1

ospfv3 1 ipv6 area 0

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! R1 – Trouble Ticket # 2

tclsh

puts [ open “flash:/enarsi/21.1.3.2-r1-config.txt” w+ ] {

hostname R1

no ip domain lookup

ipv6 unicast-routing

banner motd # This is R1, Trouble Ticket 21.1.3.2 #

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface g0/0/1

ipv6 address fe80::1:1 link-local

ipv6 address 2001:db8:acad:192::1/64

no shutdown

exit

interface s0/1/0

ipv6 address fe80::1:2 link-local

ipv6 address 2001:db8:acad:2000::1/64

no shutdown

exit

interface s0/1/1

ipv6 address fe80::1:3 link-local

ipv6 address 2001:db8:acad:2001::1/64

no shutdown

exit

interface loopback 0

ipv6 address fe80::1:4 link-local

ipv6 address 2001:db8:acad:226::1/64

no shutdown

exit

ipv6 route 2001:db8:acad:227::1/64 s0/1/0 2001:db8:acad:2000::2

ipv6 route 2001:db8:acad:227::1/64 s0/1/1 2001:db8:acad:2001::2

router ospfv3 1

router-id 1.1.1.1

address-family ipv6 unicast

default-information originate always

exit

exit

router bgp 15

bgp router-id 1.1.1.1

neighbor 2001:db8:acad:227::1 remote-as 41

neighbor 2001:db8:acad:227::1 update-source loopback 0

neighbor 2001:db8:acad:227::1 ebgp-multihop 3

address-family ipv6 unicast

neighbor 2001:db8:acad:227::1 activate

network 2001:db8:acad:224::/64

network 2001:db8:acad:225::/64

network 2001:db8:acad:192::/64

exit

exit

interface g0/0/1

ospfv3 1 ipv6 area 0

exit

ipv6 access-list BOGON-MARTIAN

permit ipv6 2001:db8:acad:227::/64 any

deny ipv6 2001:db8:acad::/48 any

permit ipv6 any any

exit

interface s0/1/0

ipv6 traffic-filter BOGON-MARTIAN in

exit

interface s0/1/1

ipv6 traffic-filter BOGON-MARTIAN in

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! R1 – Trouble Ticket # 3

tclsh

puts [ open “flash:/enarsi/21.1.3.3-r1-config.txt” w+ ] {

hostname R1

no ip domain lookup

ipv6 unicast-routing

banner motd # This is R1, Trouble Ticket 21.1.3.3 #

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface g0/0/1

ipv6 address fe80::1:1 link-local

ipv6 address 2001:db8:acad:192::1/64

no shutdown

exit

interface s0/1/0

ipv6 address fe80::1:2 link-local

ipv6 address 2001:db8:acad:2000::1/64

no shutdown

exit

interface s0/1/1

ipv6 address fe80::1:3 link-local

ipv6 address 2001:db8:acad:2001::1/64

no shutdown

exit

interface loopback 0

ipv6 address fe80::1:4 link-local

ipv6 address 2001:db8:acad:226::1/64

no shutdown

exit

ipv6 route 2001:db8:acad:227::1/64 s0/1/0 2001:db8:acad:2000::2

ipv6 route 2001:db8:acad:227::1/64 s0/1/1 2001:db8:acad:2001::2

router ospfv3 1

router-id 1.1.1.1

address-family ipv6 unicast

default-information originate always

exit

exit

router bgp 15

bgp router-id 1.1.1.1

neighbor 2001:db8:acad:227::1 remote-as 41

neighbor 2001:db8:acad:227::1 update-source loopback 0

neighbor 2001:db8:acad:227::1 ebgp-multihop 3

address-family ipv6 unicast

neighbor 2001:db8:acad:227::1 activate

network 2001:db8:acad:224::/64

network 2001:db8:acad:225::/64

network 2001:db8:acad:192::/64

exit

exit

interface g0/0/1

ospfv3 1 ipv6 area 0

exit

ipv6 access-list BOGON-MARTIAN

permit ipv6 2001:db8:acad:227::/64 any

permit ipv6 2001:db8:acad:16::/64 any

permit ipv6 2001:db8:acad:27::/64 any

deny ipv6 2001:db8:acad::/48 any

permit ipv6 any any

exit

interface s0/1/0

ipv6 traffic-filter BOGON-MARTIAN in

exit

interface s0/1/1

ipv6 traffic-filter BOGON-MARTIAN in

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

R2 Configuration File Scripts – Not Used In This Lab

R3 Configuration File Scripts

! R3 – Trouble Ticket # 1

tclsh

puts [ open “flash:/enarsi/21.1.3.1-r3-config.txt” w+ ] {

hostname R3

no ip domain lookup

ipv6 unicast-routing

banner motd # This is R3, Trouble Ticket 21.1.3.1#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface g0/0/1

no ipv6 address

no shutdown

exit

interface g0/0/1.16

encapsulation dot1q 16

ipv6 address fe80::3:1 link-local

ipv6 address 2001:db8:acad:16::1/64

ipv6 nd prefix 2001:db8:acad:16::/64 no-autoconfig

no shutdown

exit

interface g0/0/1.27

encapsulation dot1q 27

ipv6 address fe80::3:2 link-local

ipv6 address 2001:db8:acad:27::1/64

ipv6 nd prefix 2001:db8:acad:27::/64 no-autoconfig

no shutdown

exit

interface s0/1/0

ipv6 address fe80::3:3 link-local

ipv6 address 2001:db8:acad:2000::2/64

no shutdown

exit

interface s0/1/1

ipv6 address fe80::3:4 link-local

ipv6 address 2001:db8:acad:2001::2/64

no shutdown

exit

interface loopback 0

ipv6 address fe80::3:5 link-local

ipv6 address 2001:db8:acad:227::1/64

no shutdown

exit

ipv6 route 2001:db8:acad:226::1/64 s0/1/0 2001:db8:acad:2000::1

ipv6 route 2001:db8:acad:226::1/64 s0/1/1 2001:db8:acad:2001::1

router bgp 41

bgp router-id 3.3.3.3

neighbor 2001:db8:acad:226::1 remote-as 15

neighbor 2001:db8:acad:226::1 update-source loopback 0

neighbor 2001:db8:acad:226::1 ebgp-multihop 3

address-family ipv6 unicast

neighbor 2001:db8:acad:226::1 activate

network 2001:db8:acad:16::/64

network 2001:db8:acad:27::/64

exit

exit

ipv6 dhcp pool LAN16

address prefix 2001:db8:acad:16::/64

exit

ipv6 dhcp pool LAN27

address prefix 2001:db8:acad:27::/64

exit

interface g0/0/1.16

ipv6 nd managed-config-flag

ipv6 dhcp server LAN16

exit

interface g0/0/1.27

ipv6 nd managed-config-flag

ipv6 dhcp server LAN27

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! R3 – Trouble Ticket # 2

tclsh

puts [ open “flash:/enarsi/21.1.3.2-r3-config.txt” w+ ] {

hostname R3

no ip domain lookup

ipv6 unicast-routing

banner motd # This is R3, Trouble Ticket 21.1.3.2#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface g0/0/1

no ipv6 address

no shutdown

exit

interface g0/0/1.16

encapsulation dot1q 16

ipv6 address fe80::3:1 link-local

ipv6 address 2001:db8:acad:16::1/64

ipv6 nd prefix 2001:db8:acad:16::/64 no-autoconfig

no shutdown

exit

interface g0/0/1.27

encapsulation dot1q 27

ipv6 address fe80::3:2 link-local

ipv6 address 2001:db8:acad:27::1/64

ipv6 nd prefix 2001:db8:acad:27::/64 no-autoconfig

no shutdown

exit

interface s0/1/0

ipv6 address fe80::3:3 link-local

ipv6 address 2001:db8:acad:2000::2/64

no shutdown

exit

interface s0/1/1

ipv6 address fe80::3:4 link-local

ipv6 address 2001:db8:acad:2001::2/64

no shutdown

exit

interface loopback 0

ipv6 address fe80::3:5 link-local

ipv6 address 2001:db8:acad:227::1/64

no shutdown

exit

ipv6 route 2001:db8:acad:226::1/64 s0/1/0 2001:db8:acad:2000::1

ipv6 route 2001:db8:acad:226::1/64 s0/1/1 2001:db8:acad:2001::1

router bgp 41

bgp router-id 3.3.3.3

neighbor 2001:db8:acad:226::1 remote-as 15

neighbor 2001:db8:acad:226::1 update-source loopback 0

neighbor 2001:db8:acad:226::1 ebgp-multihop 3

address-family ipv6 unicast

neighbor 2001:db8:acad:226::1 activate

network 2001:db8:acad:16::/64

network 2001:db8:acad:27::/64

exit

exit

ipv6 dhcp pool LAN16

address prefix 2001:db8:acad:16::/64

exit

ipv6 dhcp pool LAN27

address prefix 2001:db8:acad:27::/64

exit

interface g0/0/1.16

ipv6 nd managed-config-flag

ipv6 dhcp server LAN16

exit

interface g0/0/1.27

ipv6 nd managed-config-flag

ipv6 dhcp server LAN27

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! R3 – Trouble Ticket # 3

tclsh

puts [ open “flash:/enarsi/21.1.3.3-r3-config.txt” w+ ] {

hostname R3

no ip domain lookup

ipv6 unicast-routing

banner motd # This is R3, Trouble Ticket 21.1.3.3#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface g0/0/1

no ipv6 address

no shutdown

exit

interface g0/0/1.16

encapsulation dot1q 16

ipv6 address fe80::3:1 link-local

ipv6 address 2001:db8:acad:16::1/64

ipv6 nd prefix 2001:db8:acad:16::/64 no-autoconfig

no shutdown

exit

interface g0/0/1.27

encapsulation dot1q 16

ipv6 address fe80::3:2 link-local

ipv6 address 2001:db8:acad:27::1/64

ipv6 nd prefix 2001:db8:acad:27::/64 no-autoconfig

no shutdown

exit

interface s0/1/0

ipv6 address fe80::3:3 link-local

ipv6 address 2001:db8:acad:2000::2/64

no shutdown

exit

interface s0/1/1

ipv6 address fe80::3:4 link-local

ipv6 address 2001:db8:acad:2001::2/64

no shutdown

exit

interface loopback 0

ipv6 address fe80::3:5 link-local

ipv6 address 2001:db8:acad:227::1/64

no shutdown

exit

ipv6 route 2001:db8:acad:226::1/64 s0/1/0 2001:db8:acad:2000::1

ipv6 route 2001:db8:acad:226::1/64 s0/1/1 2001:db8:acad:2001::1

router bgp 41

bgp router-id 3.3.3.3

neighbor 2001:db8:acad:226::1 remote-as 15

neighbor 2001:db8:acad:226::1 update-source loopback 0

neighbor 2001:db8:acad:226::1 ebgp-multihop 3

address-family ipv6 unicast

neighbor 2001:db8:acad:226::1 activate

network 2001:db8:acad:16::/64

network 2001:db8:acad:27::/64

exit

exit

ipv6 dhcp pool LAN16

address prefix 2001:db8:acad:16::/64

exit

ipv6 dhcp pool LAN27

address prefix 2001:db8:acad:27::/64

exit

interface g0/0/1.16

ipv6 nd managed-config-flag

ipv6 dhcp server LAN16

exit

interface g0/0/1.27

ipv6 nd managed-config-flag

ipv6 dhcp server LAN27

exit

ipv6 access-list CONTROL-UDP-TRAFFIC

permit udp any any range 67 68

permit udp any any gt 1024

deny udp any any

permit ipv6 any any

exit

interface g0/0/1.16

ipv6 traffic-filter CONTROL-UDP-TRAFFIC in

exit

interface g0/0/1.27

ipv6 traffic-filter CONTROL-UDP-TRAFFIC in

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

D1 Configuration File Scripts

! D1 – Trouble Ticket # 1

tclsh

puts [ open “flash:/enarsi/21.1.3.1-d1-config.txt” w+ ] {

hostname D1

no ip domain lookup

ip routing

ipv6 unicast-routing

banner motd # This is D1, Trouble Ticket 21.1.3.1#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface range g1/0/1-24

switchport mode access

shutdown

exit

interface g1/0/11

no switchport

ipv6 address fe80::d1:1 link-local

ipv6 address 2001:db8:acad:192::2/64

no shutdown

exit

interface vlan 11

ipv6 address fe80::d1:2 link-local

ipv6 address 2001:db8:acad:224::1/64

no shutdown

exit

interface vlan 12

ipv6 address fe80::d1:3 link-local

ipv6 address 2001:db8:acad:225::1/64

no shutdown

exit

interface g1/0/23

switchport mode access

switchport access vlan 11

spanning-tree portfast

no shutdown

exit

interface g1/0/24

switchport mode access

switchport access vlan 12

spanning-tree portfast

no shutdown

exit

router ospfv3 1

router-id 0.0.13.1

address-family ipv6 unicast

passive-interface vlan 11

passive-interface vlan 12

exit

exit

interface g1/0/11

ospfv3 1 ipv6 area 0

exit

interface vlan 11

ospfv3 1 ipv6 area 0

exit

interface vlan 12

ospfv3 1 ipv6 area 0

exit

ipv6 access-list CLIENT-CONTROL-VLAN11

permit ipv6 2001:db8:acad:224::/64 any

permit icmp any any echo-request

permit icmp any any echo-reply

deny ipv6 any any

exit

interface vlan11

ipv6 traffic-filter CLIENT-CONTROL-VLAN11 in

exit

ipv6 access-list CLIENT-CONTROL-VLAN12

permit ipv6 2001:db8:acad:225::/64 any

permit icmp any any echo-request

permit icmp any any echo-reply

deny ipv6 any any

exit

interface vlan12

ipv6 traffic-filter CLIENT-CONTROL-VLAN12 in

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! D1 – Trouble Ticket # 2

tclsh

puts [ open “flash:/enarsi/21.1.3.2-d1-config.txt” w+ ] {

hostname D1

no ip domain lookup

ip routing

ipv6 unicast-routing

banner motd # This is D1, Trouble Ticket 21.1.3.2#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface range g1/0/1-24

switchport mode access

shutdown

exit

interface g1/0/11

no switchport

ipv6 address fe80::d1:1 link-local

ipv6 address 2001:db8:acad:192::2/64

no shutdown

exit

interface vlan 11

ipv6 address fe80::d1:2 link-local

ipv6 address 2001:db8:acad:224::1/64

no shutdown

exit

interface vlan 12

ipv6 address fe80::d1:3 link-local

ipv6 address 2001:db8:acad:225::1/64

no shutdown

exit

interface g1/0/23

switchport mode access

switchport access vlan 11

spanning-tree portfast

no shutdown

exit

interface g1/0/24

switchport mode access

switchport access vlan 12

spanning-tree portfast

no shutdown

exit

router ospfv3 1

router-id 0.0.13.1

address-family ipv6 unicast

passive-interface vlan 11

passive-interface vlan 12

exit

exit

interface g1/0/11

ospfv3 1 ipv6 area 0

exit

interface vlan 11

ospfv3 1 ipv6 area 0

exit

interface vlan 12

ospfv3 1 ipv6 area 0

exit

ipv6 access-list CLIENT-CONTROL-VLAN11

permit ipv6 2001:db8:acad:224::/64 any

permit icmp any any echo-request

permit icmp any any echo-reply

permit icmp any any nd-na

permit icmp any any nd-ns

deny ipv6 any any

exit

interface vlan11

ipv6 traffic-filter CLIENT-CONTROL-VLAN11 in

exit

ipv6 access-list CLIENT-CONTROL-VLAN12

permit ipv6 2001:db8:acad:225::/64 any

permit icmp any any echo-request

permit icmp any any echo-reply

permit icmp any any nd-na

permit icmp any any nd-ns

deny ipv6 any any

exit

interface vlan12

ipv6 traffic-filter CLIENT-CONTROL-VLAN12 in

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! D1 – Trouble Ticket # 3

tclsh

puts [ open “flash:/enarsi/21.1.3.3-d1-config.txt” w+ ] {

hostname D1

no ip domain lookup

ip routing

ipv6 unicast-routing

banner motd # This is D1, Trouble Ticket 21.1.3.3#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface range g1/0/1-24

switchport mode access

shutdown

exit

interface g1/0/11

no switchport

ipv6 address fe80::d1:1 link-local

ipv6 address 2001:db8:acad:192::2/64

no shutdown

exit

interface vlan 11

ipv6 address fe80::d1:2 link-local

ipv6 address 2001:db8:acad:224::1/64

no shutdown

exit

interface vlan 12

ipv6 address fe80::d1:3 link-local

ipv6 address 2001:db8:acad:225::1/64

no shutdown

exit

interface g1/0/23

switchport mode access

switchport access vlan 11

spanning-tree portfast

no shutdown

exit

interface g1/0/24

switchport mode access

switchport access vlan 12

spanning-tree portfast

no shutdown

exit

router ospfv3 1

router-id 0.0.13.1

address-family ipv6 unicast

passive-interface vlan 11

passive-interface vlan 12

exit

exit

interface g1/0/11

ospfv3 1 ipv6 area 0

exit

interface vlan 11

ospfv3 1 ipv6 area 0

exit

interface vlan 12

ospfv3 1 ipv6 area 0

exit

ipv6 access-list CLIENT-CONTROL-VLAN11

permit ipv6 2001:db8:acad:224::/64 any

permit icmp any any echo-request

permit icmp any any echo-reply

permit icmp any any nd-na

permit icmp any any nd-ns

deny ipv6 any any

exit

interface vlan11

ipv6 traffic-filter CLIENT-CONTROL-VLAN11 in

exit

ipv6 access-list CLIENT-CONTROL-VLAN12

permit ipv6 2001:db8:acad:225::/64 any

permit icmp any any echo-request

permit icmp any any echo-reply

permit icmp any any nd-na

permit icmp any any nd-ns

deny ipv6 any any

exit

interface vlan12

ipv6 traffic-filter CLIENT-CONTROL-VLAN12 in

exit

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

D2 Configuration File Scripts

! D2– Trouble Ticket # 1

tclsh

puts [ open “flash:/enarsi/21.1.3.1-d2-config.txt” w+ ] {

hostname D2

no ip domain lookup

ip routing

ipv6 unicast-routing

banner motd # This is D2, Trouble Ticket 21.1.3.1#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface range g1/0/1-24

switchport mode access

shutdown

exit

interface g1/0/11

switchport mode trunk

switchport nonegotiate

no shutdown

exit

interface g1/0/23

switchport mode access

switchport access vlan 16

spanning-tree portfast

no shutdown

exit

interface g1/0/24

switchport mode access

switchport access vlan 27

spanning-tree portfast

no shutdown

exit

interface vlan 27

ipv6 address fe80::d2:1 link-local

ipv6 address 2001:db8:acad:27::2/64

no shutdown

exit

ipv6 route ::/0 2001:db8:acad:27::1

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! D2– Trouble Ticket # 2

tclsh

puts [ open “flash:/enarsi/21.1.3.2-d2-config.txt” w+ ] {

hostname D2

no ip domain lookup

ip routing

ipv6 unicast-routing

banner motd # This is D2, Trouble Ticket 21.1.3.2#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface range g1/0/1-24

switchport mode access

shutdown

exit

interface g1/0/11

switchport mode trunk

switchport nonegotiate

no shutdown

exit

interface g1/0/23

switchport mode access

switchport access vlan 16

spanning-tree portfast

no shutdown

exit

interface g1/0/24

switchport mode access

switchport access vlan 27

spanning-tree portfast

no shutdown

exit

interface vlan 27

ipv6 address fe80::d2:1 link-local

ipv6 address 2001:db8:acad:27::2/64

no shutdown

exit

ipv6 route ::/0 2001:db8:acad:27::1

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

! D2– Trouble Ticket # 3

tclsh

puts [ open “flash:/enarsi/21.1.3.3-d2-config.txt” w+ ] {

hostname D2

no ip domain lookup

ip routing

ipv6 unicast-routing

banner motd # This is D2, Trouble Ticket 21.1.3.3#

enable secret cisco12345

username admin privilege 15 algorithm-type scrypt secret cisco12345

interface range g1/0/1-24

switchport mode access

shutdown

exit

interface g1/0/11

switchport mode trunk

switchport nonegotiate

no shutdown

exit

interface g1/0/23

switchport mode access

switchport access vlan 16

spanning-tree portfast

no shutdown

exit

interface g1/0/24

switchport mode access

switchport access vlan 27

spanning-tree portfast

no shutdown

exit

interface vlan 27

ipv6 address fe80::d2:1 link-local

ipv6 address 2001:db8:acad:27::2/64

no shutdown

exit

ipv6 route ::/0 2001:db8:acad:27::1

line con 0

logging synchronous

exec-timeout 0 0

exit

line vty 0 4

login local

transport input telnet

exec-timeout 5 0

exit

alias exec reset.now tclsh flash:/enarsi/reset.tcl

end

}

tclquit

A1 Configuration File Scripts – Not Used In This Lab

• Recommend