Configure, Verify & Troubleshoot WAN Links & IP Services in Medium Enterprise - Case Study Lab

This document is a Case Study Lab for Diploma in IT Networking (ICT50415) which covers the elements of ICTNWK507: 1.1 – 1.7, 2.1 – 2.7, 3.1 – 3.7, 4.1 – 4.3, 5.1 – 5.3. It includes instructions, task, results, feedback sheet, and objectives. The lab aims to configure, verify & troubleshoot WAN links & IP services in a medium enterprise. The document also includes the assessment tool code, method, assessment name, assessment event, date given, date due, weighting, and conditions.

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Unit Number/Name
ICTNWK506 Configure, verify & troubleshoot WAN links & IP Services in
a
Medium enterprise
Assessment Tool Code: L
Method:
Assessment Name: Assessment 1 Case Study Lab Assessment Event: 1 of 1
Date Given: Week 1 Date Due: Week 10 Weighting: 100%
(This assessment covers elements):
Instructions: Outcome: See Feedback Sheet for details of
assessment
Task: Results:
Duration:
Resources: =
Conditions: Student Name
Student No:
Outcome:
Assessor Name:
Assessor Signature:
Resources / equipment to be supplied by assessor
PCs, Packet Tracer software, Routers, Swiches, laptops.PCs, LAN cabling, serial cabling
Unit Assessment Item 1 - ICTNWK506 Version 1 Last Updated: 17/01/2018 Page 1 of 121
Owner: ICT
Disclaimer: Printed copies of this document are regarded as uncontrolled
A major network design & lab implementation
This assessment event counts 100% towards the final marks for this subject.
For assessment reporing the Result will be either AC (competency
achieved) ot NC (Not Yet Achieved Competency)
PCs, Packet Tracer or other sumulation software, Routers,
Swiches, laptops.PCs, LAN cabling, serial cabling
Networking 4 Practical Demonstration Lab
Cumulative lab demonstration case work
ICTNWK507 : 1.1 – 1.7, 2.1 – 2.7, 3.1 – 3.7, 4.1 – 4.3, 5.1 – 5.3
*Plagiarism Declaration
I have read the Student Service Guide under Student Responsibilities
to “... not engage in plagiarism, collusion of cheating in any
assessment event or examination”.
I declare that, to the best of my knowledge and belief, this assignment is
my own work, all sources have been properly acknowledged and the
assignment contains no plagiarism.
*Student’s Signature
anup
george
AC or NC
His969
Anup silwal
O Other (Please Specify)N Training Record BookM Project
L Practical DemonstrationK Case StudyJ Self AssessmentI Portfolio
H Work BasedG ObservationF SimulationE Oral Questionning
D ExamC Role PlayB Written TaskA Assessment

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Unit Assessment Item 1 - ICTNWK506 Version 1 Last Updated: 17/01/2018 Page 2 of 121
Owner: ICT
Disclaimer: Printed copies of this document are regarded as uncontrolled

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Feedback Sheet
Unit Number/Name:
ICTNWK506 Install Configure, verify & troubleshoot WAN links & IP
Services
in a Medium enterprise
Assessment Event: 1 of 1
Results/comments:
Student Name:
Student No:
Marking Guide :
 Successful completion of all tasks in the Lab Case Study Desmonstrations.
 Documentation of the successful operation all network connectivity in the Lab
Demonstration.
 Documentation evidencing the successful implementation, testing and operation of the
Lab Demonstration.
 Marking Guide is integrated within the assessment Lab documentation
Assessor Name:
Assessor Signature:
Student Comment:
Student Signature:
Date:
Unit Assessment Item 1 - ICTNWK506 Version 1 Last Updated: 17/01/2018 Page 3 of 121
Owner: ICT
Disclaimer: Printed copies of this document are regarded as uncontrolled

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Diploma in IT Networking (ICT50415)
Networking 4 Project Area
ICTNWK506 Configure, verify & troubleshoot WAN links & IP Services in a
Medium enterprise
Major Lab Scenarios
0. PREPARATION
1. PPP & CHAP
2. FRAME RELAY
3. ACLs 1
4. ACLs 2
5. NAT & PAT
6. DHCP
7. VPN (GRE)
8. IPv6
9. ADSL
The following scenarios are lab exercises and lab activities that will allow the student
to demonstrate the ability to configure and test WAN links.
Networking 4 ICTNWK506 Assessment v01 Page 1

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 0 v1
Prepare to install medium enterprise WAN Links
Aim
To prepare the installation of meduium enterprise WAN links.
Method:
For this activity you are to complete the following written tasks for the situation of installing
medium enterprise WAN links.
1.1 Describe how you would prepare for Wan configuration work according to legislation, work
health and safety (WHS) codes, regulations and standards.
Ans: WAN configuration work according to legislation, work of health and safety(WHS)
codes, regulations and standards leads to the moto of safe work where it enflunece the
development of national policies to improve work health and safety. For confugiring the
WAN, wheather its assembling router or its assembling the topologies, each work
should be configured according to legislation. All three doesnot regulate or enforce WHS
regulation. Beside for the security purpose, If your Wan configuration doesnot meet the
requirements, might face penalty if it doesnot meet.According to WHS(work health and
safety), give a general overview and how to make the workplace safe and healthy.
They outline the legal responsibilities and duities as the employee to configure WAN or
the business owner. The regulations also set out the standards that you need to meet
for the specific hazards, and risk, such as noise, machinery and manual handling and
also set licence for specific activities inorder to be safe.
Networking 4 ICTNWK506 Assessment v01 Page 2

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
1.2 Describe in detail how you would arrange access to a work site according to required
procedures.
Ans: Due to management support, it is crucial by the managmnet support for the
implementation of modification of a policy related to the employee behaviour. Likewise
consulting with the staff developing and implementing workplace to policy to promote
stronger awareness. Providing the training through the policy and training session,they
should be reiterated and discussed with staff regularly at staff meeting, securing the policies
and the plans while arranging the WAN towards the work site. Set the aim of the policy,
explaining the topology about how the WAN are setup and provide the date when the policy
were developed. And at last all the routers and hub, switch are arranged well but need to be
implemented and the policies are applied conisistently through the organization, and there
should be the warning message, disciplinary action or dismissal.
(Instructor Initial ________ Date___________)
1.3 Explain how you would review existing network design documentation to ensure it is current
and complete
ANS: network documentation of the connection of WAN is to ensure that the network
document can provide service providers with valuable insight when it’s the time to
trobuleshoot the problems.since the first and very step is to cerate the network
documentation policy where it should detail what aspect of netwrk need to be documented.
Likewise create a network topology diagramwhere mapping the network topology is to
include each segment and routers connecting various segment. Document server names,
roles and IP address are included in a network topology diagram and including the certain
diagram for each and necessary servers and creating the change log for each server, and
document tge application and their versions running on each server where it leads to
document software and proof of lisence.
Networking 4 ICTNWK506 Assessment v01 Page 3

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
1.4 Describe the network elements required to install WAN services to meet technical
requirements.
ANS: designing the network and installing wAN services to meet technical requirement could be
difficult one but the first step is to understand your network requirement. Network devices must
reflects the goals, characterstics and polices of the organizations in which they operate. There
are two primary goals while driving the network design and implementation. Since in application
aviablity, network carry application information between computers. If the application are not
available to network users, the network is malfunctioning and is not doing its job.Likewise
Information system budget today often run in the millions of dollar. As large organization
increasingly rely on various electronic data for managing business activities, the associated
cost of computing would rise.And if any design problem occurs regarding the problem of
aviablity and cost, it fails to meet the technical requirement.
(Instructor Initial ________ Date___________)
1.5 Describe how you would co vendors and service suppliers to obtain specifications and
availability of identified WAN connection components
ANS: In order to obtain the specification and aviablity of identified WAN connection, there are
some of few steps for selecting the right supplier. While Identifying a supplier, it is important to
identify a few suppliers in order to access their capabilities and compare pricing.During the
selection of WAN connection component, should look at the total cost ownership, delivery
commitments. Likewsie the important step is to develop and audit and assestment program.We
can also gain and utilize with suppliers , which can be used to identify performance gaps, as well
Networking 4 ICTNWK506 Assessment v01 Page 4

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
as monitoring the direct value to the business of WAN connection.Acheiving certification here
the supplier relation grows stronger and both parties can feel as they are receiving positive
performance.Ultimately, the manufacturer/supplier relationship is formed, allowing full
knowledge of source and material and ensuring the high quality.
(Instructor Initial ________ Date___________)
1.6 Describe how you would develop plans, with prioritised tasks and contingency
arrangements, for installation of components with minimum disruption to client
ANS: Preparing for given work according to legislation, OHS codes, regulations and
standards, where the site are arranged according to required procedures, Reviewing existing
network design documentation to ensure it is current and complete the installation of WAN.
Selecing well as the network elements required to be installed to meet the technical
requirements, Configure and verify a basic serial WAN configuration, Configure and verify at
least two WAN protocols and Describe virtual private network (VPN) technology well as
Configure and verify a site to site VPN. Likewise configuration are made and changes during the
installation of components.
(Instructor Initial ________ Date___________)
1.7 Describe how you wouls liaise with appropriate persons to obtain approval for the WAN
installation plans, including security clearance and timing
ANS: When designing and implementing wide area networks (WANs) that integrate voice,
video, asynchronous and synchronous data and LAN traffic, all aspects of the organization's
goals must be factored into the WAN design. Specific attention must also be paid to line
charges, network throughput, security, and the inclusion of application and emerging
technologies.
When designing a WAN, numerous factors must be considered. The first issue to consider is the
Networking 4 ICTNWK506 Assessment v01 Page 5

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
organization and its short-, medium- and long-term goals. The factors are about
1. Staffing
2. Existing applications
3. Planned applications (it's very important to factor these into the design process)
4. Local access requirements
5. Remote access requirements
6. End-user equipment (workstations)
7. Network equipment (routers, switches)
8. Connectivity outside the organization (to suppliers, stakeholders, customers)
9. Competitive considerations
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 6

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 1 v2
PPP & CHAP Authentication
Aim
To configure PPP and CHAP Authentication between routers.
Instructions
- The lab can be completed by pairs of students (no more than two) working together.
- Successful completion of this lab assessment will require:
1. successful ping to/from the Warsaw host PC to/from the Moscow host PC
2. demonstration of the correct configuration stored in the startup-config file
Networking 4 ICTNWK506 Assessment v01 Page 7

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Objectives
Complete the following tasks:
• Configure the serial link between the Warsaw and Moscow routers
• Configure EIGRP (AS = 100) on all directly connected networks on each router.
• Configure the PCs connected to the Warsaw and Moscow routers
• Configure Challenge Handshake Authentication Protocol (CHAP) between the Warsaw and
Moscow routers
• Verify connectivity
Pre-configuration
The following items have been preconfigured on all three routers:
• Hostnames on all routers
• Interface IP addresses, subnet masks, and no shutdown commands
• Vty, and privileged passwords
• Clock rates on DCE interfaces
• IP addresses and subnet masks on PCs, including the default gateway IP address.
• Synchronous logging on the console line
Following are the actual commands already configured on the devices:
Warsaw Router
hostname Warsaw
enable secret class
interface serial0
shutdown
interface serial1
ip address 197.8.2.1 255.255.255.0
clock rate 64000
no shutdown
interface ethernet0
ip address 212.13.147.1 255.255.0.0
no shutdown
line con 0
logging synchronous
exec-timeout 0 0
line vty 0 4
password cisco
login
line aux 0
password cisco
login
Networking 4 ICTNWK506 Assessment v01 Page 8

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Moscow Router
hostname Moscow
enable secret class
interface serial0
ip address 197.8.2.2 255.255.255.0
no shutdown
interface ethernet0
ip address 142.66.0.1 255.255.0.0
no shutdown
line con 0
logging synchronous
exec-timeout 0 0
line vty 0 4
password cisco
login
line aux 0
password cisco
login
Overview of Configuration Tasks
1. Configure PPP
• Configure the link between Warsaw and Moscow with PPP encapsulation.
2. Configure EIGRP
Use the following values to configure the routing between Warsaw and Moscow.
• Configure EIGRP routing between Warsaw and Moscow. Enable EIGRP only on the
following networks:
- 197.8.2.0 255.255.255.0
- 212.13.147.0 255.255.255.0
- 142.66.0.0 255.255.0.0
• Both Warsaw and Moscow should be able to see the Ethernet network of the neighbouring
router in its routing table.
• Use 100 as the autonomous system number for EIGRP
Networking 4 ICTNWK506 Assessment v01 Page 9

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
3. Configure CHAP Authentication on the Warsaw Router
Use the following values to configure CHAP on Warsaw:
• Initialise CHAP authentication
• Set the hostname of the Warsaw router to “Warsaw”
• Set the CHAP authentication hostname of the Warsaw router to “Warsaw_City”
• Set the CHAP password to “SerendipitY”
4. Configure CHAP Authentication on the Moscow Router
Use the following values to configure CHAP on Moscow:
• Initialise CHAP authentication
• Set the hostname of the Moscow router to “Moscow”
• Set the CHAP authentication hostname of the Moscow router to “Moscow_City”
• Set the CHAP password to “SerendipitY”
NOTE that the CHAP authentication passwords must match on both routers. Try changing it
on one router, save the configuration, and then re-boot the other router to see whether
authentication takes place.
5. Configuration in startup-config file on the Warsaw Router
Save the completed configuration file, and display its contents.
6. Configuration in startup-config file on the Moscow Router
Save the completed configuration file, and display its contents.
7. Demonstration of correct CHAP configuration on the Warsaw Router
Use the appropriate command to display the contents of the CHAP configuration on the
Warsaw router.
8. Demonstration of correct CHAP configuration on the Moscow Router
Use the appropriate command to display the contents of the CHAP configuration on the
Moscow router.
9. Demonstration of successful pinging of the Moscow Router from the
Warsaw Router
It will be necessary to turn on debugging to capture the CHAP packet exchanges as they
occur: Warsaw# debug ppp authentication
Warsaw# debug ppp negotiation
10. Demonstration of successful pinging of the Warsaw Router from the
Moscow Router
Networking 4 ICTNWK506 Assessment v01 Page 10

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
It will be necessary to turn on debugging to capture the CHAP packet exchanges as they
occur: Moscow# debug ppp authentication
Moscow# debug ppp negotiation
Your Tasks
1. Configure PPP
• Configure the link between Warsaw and Moscow with PPP encapsulation.
1.1 Using the correct prompt, write out the command to set PPP encapsulation on
the Warsaw router:
int s0/0/1
encapsulation ppp
(Instructor Initial ________ Date___________)
1.2 Using the correct prompt, write out the command to set PPP encapsulation on the
Moscow router:
int s0/0/0
encapsulation ppp
(Instructor Initial ________ Date___________)
2. Configure EIGRP
Use the following values to configure the routing between Warsaw and Moscow.
• Take 100 as the autonomous system number for EIGRP.
• Configure EIGRP routing between Warsaw and Moscow. Enable EIGRP only on the
following networks:
- 197.8.2.0 255.255.255.0
- 212.13.147.0 255.255.255.0
- 142.66.0.0 255.255.0.0
2.1 Using the correct prompt, write out the commands to initialise EIGRP routing on the
Warsaw router.
Networking 4 ICTNWK506 Assessment v01 Page 11

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
config t
router eigrp 100
network 197.8.2.0
network 212.13.147.0
network 142.66.0.0
end
copy run star
(Instructor Initial ________ Date___________)
2.2 Using the correct prompt, write out the commands to initialise EIGRP routing on the
Moscow router.
config t
router eigrp 100
network 197.8.2.0
network 212.13.147.0
network 142.66.0.0
end
copy run star
(Instructor Initial ________ Date___________)
2.3 Using the correct prompt, write out the command to view the contents of the
routing table on the Warsaw router. What does this show?
Networking 4 ICTNWK506 Assessment v01 Page 12

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
2.4 Using the correct prompt, write out the command to view the contents of the
routing table on the Moscow router. What does this show?
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 13

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
3. Configure CHAP on the Warsaw Router
3.1 Use the following values to configure CHAP on Warsaw:
• Initialise CHAP authentication
• Set the CHAP authentication hostname of the Warsaw router to “Warsaw_City”
• Set the hostname of the Warsaw router to “Warsaw”
• Set the CHAP password to “SerendipitY”
Your router commands:
config t
int s0/0/1
ppp authentication chap
hostname Warsaw_City
username Warsaw password SerendipitY
(Instructor Initial ________ Date___________)
4. Configure CHAP on the Moscow Router
4.1 Use the following values to configure CHAP on Moscow:
• Initialise CHAP authentication
• Set the CHAP authentication hostname of the Moscow router to “Moscow_City”
• Set the hostname of the Moscow router to “Moscow”
• Set the CHAP password to “SerendipitY”
Your router commands:
config t
int s0/0/0
ppp authentication chap
hostname Moscow_City
username Moscow password SerendipitY
(Instructor Initial ________ Date___________)
5. Test CHAP on the Warsaw Router
5.1 Ping the Moscow serial interface from the Warsaw PC, and using the correct prompt,
write out the command that will display the realtime CHAP authentication packet exchanges
as they actually occur. After switching on the display of realtime authentication packet
exchanges, you may need to save the Warsaw and Moscow router configurations, and then
restart ONLY the Moscow router.
Your router command:
Networking 4 ICTNWK506 Assessment v01 Page 14

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
ping 197.8.2.2
debug ppp authentication
(Instructor Initial ________ Date___________)
5.2 Write out the command that will display realtime PPP negotiation packets. Again it may
be necessary to save the configurations on each router, and then reload one of them while
watching the output generated on the other in Hyperterminal.
Networking 4 ICTNWK506 Assessment v01 Page 15

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Your router command:
debug ppp negotiation
(Instructor Initial ________ Date___________)
6. Test CHAP on the Moscow Router
6.1 Ping the Warsaw serial interface from the Moscow PC, and using the correct prompt,
write out the command that will display the realtime CHAP authentication packet exchanges
as they actually occur. After switching on the display of realtime authentication packet
exchanges, you may need to save the Warsaw and Moscow router configurations, and then
restart ONLY the Warsaw router.
Your router command:
debug ppp authentication
(Instructor Initial ________ Date___________)
6.2 Write out the command that will display realtime PPP negotiation packets. Again it may
be necessary to save the configurations on each router, and then reload one of them while
watching the output generated on the other in Hyperterminal.
Your router command:
Debug ppp negoti
(Instructor Initial ________ Date___________)
7. Test PPP on the either Router
7.1 Write out the command that will display realtime PPP packet exchanges.
Networking 4 ICTNWK506 Assessment v01 Page 16

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Your router command:
Debug ppp packet
(Instructor Initial ________ Date___________)
7.2 Write out the command that will display the ARP cache contents on both the Warsaw
router and the Moscow router.
Your router command:
Show arp
(Instructor Initial ________ Date___________)
7.3 Change the password for CHAP authentication ONLY on the Moscow router to
“Bullwinkle”, save the configuration and then reboot the Warsaw router. Monitor the PPP
negotiation on the Moscow router with:
Moscow# debug ppp negotiation
Your router commands to change the password for CHAP authentication:
username Warsaw password Bullwinkle
(Instructor Initial ________ Date___________)
8. Configuration in startup-config file on the Warsaw Router
(Instructor Initial ________ Date___________)
9. Configuration in startup-config file on the Moscow Router
(Instructor Initial ________ Date___________)
10. Demonstration of correct CHAP configuration on the Warsaw Router
(Instructor Initial ________ Date___________)
11. Demonstration of correct CHAP configuration on the Moscow Router
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 17

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
12. Demonstration of successful pinging of the Moscow PC from the
Warsaw PC
(Instructor Initial ________ Date___________)
13. Demonstration of successful pinging of the Warsaw PC from the
Moscow PC
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 18

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 2 v3
Frame Relay Configuration
Aim
To configure frame relay on Cisco routers by simulating a frame relay network.
Method
For this laboratory you will need to set up the following network.
Toowoomba
Frame Relay
Switch
Ballarat
Switch
Switch
192 . 5 . 5 . 2 223 . 8 . 151 . 2
Frame Relay Network
Fa0/0
192.5.5.1
Network 192 . 5 . 5 . 0 Network 223 . 8 . 151 . 0
Network
210 . 100 . 11 . 0 Fa0/0
223.8.151.1
Serial0/0/0
210.100.11.1
Serial0/0/1
210.100.11.2
Serial0/0/1
DCE
Serial0/0/0
DCE
Networking 4 ICTNWK506 Assessment v01 Page 19

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
The following IP addresses and serial connection types are to be used:
Router: Toowoomba
Router Type - 2811
Fa0/0 = 192.5.5.1
Fa0/1 = No IP Address / Shutdown
S0/0/0 = 210.100.11.1 (DTE)
S0/0/1 = Shutdown
SM = 255.255.255.0
Router: Frame_Relay_Switch
Router Type - 2811
Fa0/0 = No IP Address / Shutdown
S0/0/0 = No IP Address (DCE)
S0/0/1 = No IP Address (DCE)
SM = 255.255.255.0
Router: Ballarat
Router Type - 2811
Fa0/0 = 223.8.151.1
S0/0/0 = Shutdown
S0/0/1 = 210.100.11.2 (DTE)
S0/0/1 = SM = 255.255.255.0
Objectives:
- To become familiar with Frame Relay related WAN terminology
- To understand the requirements and options for Frame Relay communications
- To simulate the configuration of a Frame Relay switch and links between two routers
Background:
This laboratory focuses on the Frame Relay Packet Switching Protocol for connecting
devices on a Wide Area Network (WAN). Frame Relay is an industry-standard,
switched data link layer protocol that handles multiple virtual circuits using HDLC
encapsulation between connected devices (routers). Frame Relay is more
efficient than X.25, the protocol for which it is generally considered a
replacement. Frame Relay is a very widely used and important WAN
communication technology. With this lab you will use a router to create a Frame
Relay switch (the cloud) and connected two other routers through it to simulate a
wide area link between two LANs.
Point-to-Point vs. Frame Relay
Two of the most common types of WAN communication links in use today are 1)
Leased Dedicated Point-to-Point permanent circuits and 2) Frame Relay Packet-Switched
circuits. Using leased dedicated point-to-point circuits assumes that the organisation that
leased the circuit is paying for the full dedicated bandwidth (such as a T1 at 1.544 Mbps)
24 hours a day, 7 days a week whether they actually use the full bandwidth or
not. Packet-switched networks enable end stations to dynamically share the
network medium (sometimes referred to as "the cloud") and the available
Networking 4 ICTNWK506 Assessment v01 Page 20

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
bandwidth and it is possible to only pay for the bandwidth you need. This is
referred to a Committed Information Rate (CIR).
Potential Bandwidth Sharing
Frame Relay uses variable-length packets for more efficient and flexible
transfers. These packets then are switched between the various network
segments (usually phone company Central Offices or COs) until the destination
is reached. Statistical multiplexing techniques control network access in a
packet-switched network. The advantage of this technique is that it
accommodates more flexibility and more efficient use of bandwidth especially
between switches within the cloud. Frame Relay is a way of sharing existing T-1
and T-3 lines owned by service providers and potentially getting better use from
them. Most telephone companies now provide Frame Relay service for
customers who want connections at 56 Kbps to T-1 speeds.
Frame Relay Devices - DTE and DCE
Devices attached to a Frame Relay WAN fall into two general categories: Data
Terminal Equipment (DTE) and Data Circuit-terminating Equipment (DCE). DTEs
are typically located on the premises of and owned by a customer. Examples of
DTE devices are terminals, personal computers, routers, and bridges. DCEs are
usually carrier-owned (phone company) internetworking devices but can be
owned by the customer. The purpose of DCE equipment is to provide clocking
and switching services in a network, which are the devices that actually transmit
data through the WAN cloud In most cases, these are Frame Relay packet
switches themselves. CSU/DSU's are considered to be DCEs.
The connection between a DTE device and a DCE device consists of both a
physical-layer component and a Data link-layer component. The physical
component defines the mechanical, electrical, functional, and procedural
specifications for the connection between the devices. One of the most
commonly used physical-layer interface specifications is the Recommended
Standard (RS)-232 specification. The link-layer component defines the protocol
that establishes the connection between the DTE device, such as a router, and
the DCE device, such as a Frame Relay switch (usually at the phone company
CO).
4. Virtual Circuits
Frame Relay provides connection-oriented data link layer communication. This
means that a defined communication exists between each pair of devices and
that these connections are associated with a connection identifier. This service is
implemented by using a Frame Relay virtual circuit, which is a logical connection
created between two data terminal equipment (DTE) devices across a Frame
Relay packet-switched network (PSN). Virtual circuits provide a bi-directional
communications path from one DTE device to another and are identified by a
Data-Link Connection Identifier (DLCI).
Networking 4 ICTNWK506 Assessment v01 Page 21

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
A number of virtual circuits can be multiplexed into a single physical circuit for
transmission across the network. This capability often can reduce the equipment
and network complexity required to connect multiple DTE devices. A virtual
circuit can pass through any number of intermediate DCE devices (switches)
located within the Frame Relay PSN (Packet Switched Network) or cloud. Frame
Relay virtual circuits fall into two categories: Switched Virtual Circuits (SVCs) and
Permanent Virtual Circuits (PVCs). PVCs are the most common.
Laboratory Tools / Preparation:
Three (3) routers must be available. The middle router will act as the
Frame Relay Switch and the other routers will connect through it. The middle
router must have DCE clock rate and DCE cable ends on both serial ports (S0
and S1).
Note: This is a simulated lab. The purpose of this lab is to practice the process of
configuring the routers to connect to a frame relay WAN link.
The following is a list of resources required.
- 3 Cisco routers with the IOS 11.2 or later
- Middle router serial ports connected to DCE serial cables
- Switch attached to the end routers
- Workstation connected to each router's console port
Networking 4 ICTNWK506 Assessment v01 Page 22

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Select 3 routers which have WAN serial links between them. The middle router will simulate
a Frame Relay switch and the end routers will simulate geographically separate sites
connected through the Frame Relay "cloud". This lab worksheet uses routers Toowoomba,
Frame_Relay_Switch and Ballarat. You will configure the two remote routers Toowommba
and Ballarat) first, and then the middle Frame Relay router (Frame_Relay_Switch).
Task 1 - Configure the physical 3-router setup
The two cables connected to the middle router (Frame_Relay_Switch) should both be DCE in
order to have this router simulate the Frame Relay switch (The DCE cables are
labelled on one end). On router Frame_Relay_Switch, connect one of the DCE cables to
Serial 0/0/0 and the other to Serial0/0/1. The DCE cable from Frame_Relay_Switch
Serial0/0/1 will connect to a DTE cable going to router Toowoomba Serial0/0/0 and the
Frame_Relay_Switch serial 0/0/1 cable will go to the router Ballarat DTE cable on
Serial0/0/1. Use the tables below for cabling and interfaces.
Router Frame
Relay switch
From Serial Intfc # &
Type (DCE / DTE)
To Remote
Router Name
To Serial Intf # &
Type (DCE / DTE)
Frame_Relay_Switch Serial 0/0/0 DCE Ballarat Serial 0/0/1 DTE
Frame_Relay_Switch Serial 0/0/1 DCE Toowoomba Serial 0/0/0 DTE
Use the show controller command to check the DCE/DTE connections.
Toowoomba#show controllers S0/0/0
1. What does the show controller command for S0 indicate?
It indicates the following:
i. It is a DTE interface
ii. Hardware type
iii. HDLC encapsulation type
Router Interface
Ethernet Fa0/0
Interface
Serial 0/0/0
Interface
Serial 0/0/1
Subnet Mask
Toowoomba (remote) 192.5.5.1 210.100.11.1 Not used 255.255.255.0
Frame_Relay_Switch
(switch)
Not used DLCI 21 DLCI 20 N/A
Networking 4 ICTNWK506 Assessment v01 Page 23

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Ballarat (remote) 223.8.151.1 Not used 210.100.11.2 255.255.255.0
2. Draw the 3 router set up showing cabling, interfaces, IP addresses and DLCIs.
(Hint: use the table above for the diagram)
(Instructor Initial ________ Date___________)
Task 2 - Check the WAN Interface on remote router Toowoomba
Connect your workstation to the console port connection on Router Toowoomba and
use show interface command to answer the following questions:
Toowoomba# show interface serial 0
1. What is the IP address and number of subnet bits for this interface?
210.100.11.1/24
Number of subnet bits is 24
Networking 4 ICTNWK506 Assessment v01 Page 24

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
2. What is the status of the interface and the Line protocol?
Serial0/0/0 is up, line protocol is down
(Instructor Initial ________ Date___________)
3. What is the encapsulation currently set to?
HDLC
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 25

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 3 - Configure the Serial Interface on Toowoomba for a Frame Relay Connection
Connect your workstation to the console port connection on Router Toowoomba and use the
following commands to set up Frame Relay on interface Serial 0/0/0. Note that if your are
using Cisco IOS version 11.2 or newer the Frame Relay DLCI and LMI type can be detected
automatically and will not need to be configured manually.
Toowoomba Remote Router Frame Relay Configuration Commands
Toowoomba# config t (Configure from terminal)
Toowoomba(config)# int s/0/0/0 (Select interface S0/0/0 to
configure)
Toowoomba(config-if)# ip address 210.100.11.1 255.255.255.0 (Set the IP address and subnet
mask for S/0/0/0)
Toowoomba(config-if)# encapsulation frame-relay (Change the data link encapsulation
from HDLC to Frame Relay. Use
IETF if connecting to non-Cisco
routers. Default is Cisco
encapsulation.)
Toowoomba(config-if)# bandwidth 64 (Sets the link bandwidth in kpbs)
Toowoomba(config-if)# frame-relay inverse-arp ip 20 (Enables mapping of IP to DLCI)
Toowoomba(config-if)# frame-relay local-dlci 20 (Sets the FR DLCI route to 20)
Toowoomba(config-if)# no shutdown (Enables S0/0/0)
Toowoomba(config-if)# exit
Toowoomba(config)# int Fa0/0 (Select interface Fa0/0 to configure)
Toowoomba(config-if)# ip address 192.5.5.1 255.255.255.0(Set the IP address and subnet
mask for Fa0/0)
Toowoomba(config-if)# no shutdown (Enables Fa0/0)
Toowoomba(config-if)# exit (Back to global configuration mode)
Toowoomba(config)# router eigrp 100 (Enables IGRP routing protocol
process on autonomous system
100)
Toowoomba(config-router)# network 210.100.11.0 (Specifies a directly connected
network)
Toowoomba(config-router)# network 192.5.5.0 (Specifies a directly connected
network)
Toowoomba(config-router)# Ctrl-Z (Back to privileged mode)
Toowoomba# copy run start (Backup configuration to NVRAM)
Toowoomba# show run (Show running configuration)
Networking 4 ICTNWK506 Assessment v01 Page 26

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 4 - Use the show running-config interface command to verify the
configuration of S0
Toowoomba#sh run
6. What information was displayed about Toowoomba interface S0/0/0?
bandwidth 64
ip address 210.100.11.1 255.255.255.0
encapsulation frame-relay
frame-relay interface-dlci 20
(Instructor Initial ________ Date___________)
Task 5 - Check the WAN Interface on remote router Ballarat
Connect your workstation to the console port connection on Router Ballarat and
use show interface command to answer the following questions:
Ballarat# show interface serial 0/0/1
7. What is the IP address and number of subnet bits for this interface?
IP Address: 210.100.11.2
Number of subnetbits is 24
(Instructor Initial ________ Date___________)
8. What is the status of the interface and the Line protocol?
Serial0/0/1 is up, line protocol is up
(Instructor Initial ________ Date___________)
9. What is the encapsulation currently set to?
Encapsulation Frame Relay
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 27

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 6 - Configure the Serial Interface on Ballarat for a Frame Relay Connection
Connect your workstation to the console port connection on Router Ballarat and use the
following commands to set up Frame Relay on interface Serial 0/0/1. Note that if you are
using Cisco IOS version 11.2 or newer the Frame Relay DLCI and LMI type can be detected
automatically.
Ballarat Remote Router Frame Relay Configuration Commands
Ballarat# config t (Configure from terminal)
Ballarat(config)# int s0/0/1 (Select interface S0/0/1 to
configure)
Ballarat(config-if)# ip address 210.100.11.2 255.255.255.0 (Set the IP address and subnet
mask for S0/0/1)
Ballarat(config-if)# encapsulation frame-relay (Change the data link encapsulation
from HDLC to Frame Relay. Use
IETF if connecting to non-Cisco
routers. Default is Cisco
encapsulation.)
Ballarat(config-if)# bandwidth 64 (Sets the link bandwidth in kpbs)
Ballarat(config-if)# frame-relay inverse-arp ip 21 (Enables mapping of IP to DLCI)
Ballarat(config-if)# frame-relay local-dlci 21 (Sets the FR DLCI route to
21)
Ballarat(config-if)# no shutdown
Ballarat(config-if)# exit
Ballarat(config)# int Fa0/0 (Select interface Fa0/0 to configure)
Ballarat(config-if)# ip address 223.8.151.1 255.255.255.0 (Set the IP address and subnet
mask for Fa0/0)
Ballarat(config-if)# no shutdown (Enables Fa0/0)
Ballarat(config-if)# exit (Back to global configuration mode)
Ballarat(config)# router eigrp 100 (Enables EIGRP routing protocol
process on autonomous system
100)
Ballarat(config-router)# network 210.100.11.0 (Specifies a directly connected
network)
Ballarat(config-router)# network 223.8.151.0 (Specifies a directly connected
network)
Ballarat(config-router)# Ctrl-Z (Back to privileged mode)
Ballarat# copy run start (Backup configuration to NVRAM)
Ballarat # show run (Show running configuration)
Networking 4 ICTNWK506 Assessment v01 Page 28

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Step 7 - Use the show running-config interface command to verify the
configuration of S1
Ballarat#sh run
10. What information was displayed about Ballarat interface S0/0/1?
bandwidth 64
ip address 210.100.11.2 255.255.255.0
encapsulation frame-relay
frame-relay interface-dlci 21
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 29

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 8 - Configure Frame_Relay_Switch as a Frame Relay Switch
Connect your workstation to the console port on Router Frame_Relay_Switch and use the
following commands to enable Frame Relay switching and define interfaces Serial 0/0/0 and
Serial 0/0/1 as DCE.
Frame_Relay_Switch Configuration Commands (Frame Relay Switch)
Frame_Relay_Switch# config t (Configure from terminal)
Frame_Relay_Switch(config)# frame-relay switching (Starts the frame relay switching
process)
Frame_Relay_Switch(config)# int s0/0/0 (Select interface S0/0/0)
Frame_Relay_Switch(config-if)# no ip address (Specify no IP address for S0/0/0)
Frame_Relay_Switch(config-if)# encapsulation frame-relay(Change the Layer 2 data link
encapsulation from HDLC to Frame
Relay.)
Frame_Relay_Switch(config-if)# clock rate 56000 (Specify the synchronous clock rate
for the DCE side of the interface)
Frame_Relay_Switch(config-if)# frame-relay intf-type dce (Specify the interface as a DCE
device)
Frame_Relay_Switch(config-if)# frame-relay route 21 interface serial 0/0/1 20
(Define frame route so packets
coming in on S0/0/0 DLCI 21 should
go to S0/0/1 DLCI 20)
Frame_Relay_Switch(config-if)# no shutdown (Enable S0/0/0)
Frame_Relay_Switch(config-if)# exit (Back to global configuration mode)
Frame_Relay_Switch(config)# int s0/0/1 (Select interface S0/0/1)
Frame_Relay_Switch(config-if)# no ip address (Specify no IP address for S0/0/1)
Frame_Relay_Switch(config-if)# encapsulation frame-relay(Change the Layer 2 data link
encapsulation from HDLC to Frame
Relay.)
Frame_Relay_Switch(config-if)# clock rate 56000 (Specify the synchronous clock rate
for the DCE side of the interface)
Frame_Relay_Switch(config-if)# frame-relay intf-type dce (Specify the interface as a DCE
device)
Frame_Relay_Switch(config-if)# frame-relay route 20 interface serial 0/0/0 21
(Define frame route so packets
coming in on S0/0/1 DLCI 20 should
go to S0/0/0 DLCI 21)
Frame_Relay_Switch(config-if)# no shutdown (Enable S0/0/1)
Frame_Relay_Switch(config-if)# exit (Back to global configuration mode)
Frame_Relay_Switch(config-if)# Ctrl-Z (Back to privileged mode)
Frame_Relay_Switch # copy run start (Backup configuration to NVRAM)
Frame_Relay_Switch # show run (Show running configuration)
Networking 4 ICTNWK506 Assessment v01 Page 30

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 9 - Use the show running-config interface command to verify the configuration of
S0 and S1.
Note that there are several commands added by the router.
Frame_Relay_Switch#sh run
11. What information was displayed about Frame_Relay_Switch interface S0/0/0?
no ip address
encapsulation frame-relay
frame-relay interface-dlci 21
clock rate 56000
(Instructor Initial ________ Date___________)
12. What information was displayed about Frame_Relay_Switch interface S0/0/1?
no ip address
encapsulation frame-relay
frame-relay interface-dlci 20
clock rate 56000
(Instructor Initial ________ Date___________)
Task 10 - Confirm that the Line Is Up by entering the show interface serial 0 command:
Toowoomba# show interface serial 0/0/0
13. What is the status of the Serial frame link?
Serial0/0/0 is up, line protocol is down
(Instructor Initial ________ Date___________)
14. How many LMI messages were sent and received?
LMI enq sent 98, LMI stat recvd 0
Networking 4 ICTNWK506 Assessment v01 Page 31

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
15. What does this mean?
It means Serial0/0/0 is sending out messages towards the other interface but there are no
replies being received.
(Instructor Initial ________ Date___________)
16. What is the LMI type?
CISCO
(Instructor Initial ________ Date___________)
Task 11 - Verify the Frame Relay PVC status for router Toowoomba (remote router)
Toowoomba# show frame pvc
17. What is the DLCI number of the connection? (DLCI =)
20
(Instructor Initial ________ Date___________)
18. What is the status of the PVC? (PVC Status )
Static
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 32

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 12 - Check the Frame Relay map for router Toowoomba (remote router)
Toowoomba# show frame map
19. What is local interface number, IP address of the switch interface and the
DLCI of the connection?
local interface number: Serial0/0/0
IP address:
DLCI: 20
(Instructor Initial ________ Date___________)
20. What is the status of the PVC?
PVC STATUS = STATIC
(Instructor Initial ________ Date___________)
Task 13 - Check the LMI status for router Toowoomba (remote router)
Toowoomba# show frame lmi
21. What is local interface number and is it DCE or DTE?
DLCI = 20
DTE
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 33

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 14 - Verify the Frame Relay PVC status for router Frame_Relay_Switch (the
switch)
Frame_Relay_Switch# show frame pvc
22. What are the DLCI numbers of the connections?
20 and 21
(Instructor Initial ________ Date___________)
23. What is the status of the PVCs?
active
(Instructor Initial ________ Date___________)
Task 15 - Verify the Frame Relay routing table for router Frame_Relay_Switch (the
switch)
Frame_Relay_Switch# show frame route
24. What information is shown? Input intf, Input DLCI, Output Intf, Output
DLCI, Status
Frame_Relay_Switch#show frame route
^
% Invalid input detected at '^' marker.
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 34

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 16 - Verify the Frame Relay PVC status for router Frame_Relay_Switch (the
switch)
Toowoomba# ping 201.100.11.2
25. What was the result?
Toowoomba#ping 201.100.11.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 201.100.11.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 35

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 3 v3
Access Control Lists 1
Aim
To investigate Router configuration for IP Access Control Lists
Background
Access Lists provide control over what types of packets can enter a router (inbound lists), be
relayed through a router or exit a router (outbound lists), based on IP source addresses
(Standard Access Lists) or IP Source and Destination Addresses (Extended Access Lists)
The syntax is for a global Standard IP Access Control List definition is:
Router(config)# access-list access-list-number {deny | permit} {test conditions}
The syntax is for a global Extended IP Access Control List definition is:
Router(config)# access-list access-list-number {deny | permit} protocol
source source-mask destination destination-mask operator operand [established]
where protocol = TCP,UDP, ICMP, IGRP and
where operator = lt, gt, eq, neq and
where operand = port number.
Standard access lists filter on Source IP Address for an entire protocol suite. For Standard IP
Access Control Lists, access-list-number has the values 1-99. Extended IP Access Control
Lists can filter on:
- source IP address
- destination IP address
- protocol
- TCP/UDP port numbers,
In the case of Extended IP Access Control Lists, access-list-number has values 100-199.
For Standard IP Access Control Lists, {test conditions} means source [source mask],
eg, 172.30.16.0 0.0.15.255, which examines subnets 172.30.16.0 to 172.30.31.0
Networking 4 ICTNWK506 Assessment v01 Page 36

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
The syntax for including (or binding) an interface to the Access Group is:
Router(config-if)# {protocol} access-group access-list-number {in | out}
Note that in Cisco IOS Release 11.2 or newer, access lists for IP may also use an access list
name rather than a number. You can use several global access list statements with the same
identifier to stack several test conditions into a logical sequence or list of tests.
For example, an IP Standard Access List configuration to deny all IP Class B subnet traffic from
subnet 172.30.16.0 (that is, all hosts from 172.30.16.1 to172.30.31.254) and subnet 172.30.32.0
(that is, all hosts from 172.30.32.1 to 172.30.47.254) to have outgoing access through the E0
interface:
Router(config)# access-list 1 deny 172.30.16.0 0.0.15.255
Router(config)# access-list 1 deny 172.30.32.0 0.0.15.255
Router(config)# interface e0
Router(config-if)# ip access-group 1 out
Method Part 1
Set up the following network. Remember to configure the PCs with the correct IP address,
subnet mask and default gateway. Use the default network mask of 255.0.0.0 in this lab.
Networking 4 ICTNWK506 Assessment v01 Page 37

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Basic Router Configuration
Router A configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname RtrA
RtrA(config)# line console 0
RtrA(config-line)# logging synchronous
RtrA(config-line)# exit
RtrA(config)# ip host RtrB 10.0.0.2 11.0.0.1 13.0.0.1
RtrA(config)# ip host RtrC 11.0.0.2 12.0.0.1 9.0.0.1
RtrA(config)# ip host RtrD 9.0.0.2 15.0.0.1
RtrA(config)# cdp run
RtrA(config)# no ip domain-lookup
RtrA(config)# banner motd # 
Access control lists trials are under way #
RtrA(config)# enable secret class
RtrA(config)# enable password cisco
RtrA(config)# line vty 0 4
Networking 4 ICTNWK506 Assessment v01 Page 38

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
RtrA(config-line)# login
RtrA(config-line)# password cisco
RtrA(config-line)# exit
RtrA(config)# interface serial0/0
RtrA(config-if)# description DTE Link to RtrB
RtrA(config-if)# ip address 10.0.0.1 255.0.0.0
RtrA(config-if)# no shutdown
RtrA(config-if)# interface fastethernet0/0
RtrA(config-if)# description Default gateway for the 14.0.0.0 network
RtrA(config-if)# ip address 14.0.0.1 255.0.0.0
RtrA(config-if)# no shutdown
RtrA(config-if)# exit
RtrA(config)# ip routing
RtrA(config)# router rip
RtrA(config-router)# network 14.0.0.0
RtrA(config-router)# network 10.0.0.0
RtrA(config-router)# CTRL-Z
RtrA# show running-config
RtrA# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 39

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Router B configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname RtrB
RtrB(config)# line console 0
RtrB(config-line)# logging synchronous
RtrB(config-line)# exit
RtrB(config)# ip host RtrA 10.0.0.1 14.0.0.1
RtrB(config)# ip host RtrC 11.0.0.2 12.0.0.1 9.0.0.1
RtrB(config)# ip host RtrD 9.0.0.2 15.0.0.1
RtrB(config)# cdp run
RtrB(config)# no ip domain-lookup
RtrB(config)# banner motd # 
Access control lists trials are under way #
RtrB(config)# enable secret class
RtrB(config)# enable password cisco
RtrB(config)# line vty 0 4
RtrB(config-line)# login
RtrB(config-line)# password cisco
RtrB(config-line)# exit
RtrB(config)# interface serial0/0
RtrB(config-if)# description DCE Link to RtrA
RtrB(config-if)# ip address 10.0.0.2 255.0.0.0
RtrB(config-if)# clock rate 64000
RtrB(config-if)# no shutdown
RtrB(config-if)# interface fastethernet0/0
RtrB(config-if)# description Default gateway for the 13.0.0.0 network
RtrB(config-if)# ip address 13.0.0.1 255.0.0.0
RtrB(config-if)# no shutdown
RtrB(config-if)# exit
RtrB(config)# interface serial0/1
RtrB(config-if)# description DTE Link to RtrC
RtrB(config-if)# ip address 11.0.0.1 255.0.0.0
RtrB(config-if)# no shutdown
RtrB(config)# ip routing
RtrB(config)# router rip
RtrB(config-router)# network 10.0.0.0
RtrB(config-router)# network 11.0.0.0
RtrB(config-router)# network 13.0.0.0
Networking 4 ICTNWK506 Assessment v01 Page 40

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
RtrB(config-router)# CTRL-Z
RtrB# show running-config
RtrB# copy run start
Router C configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname RtrC
RtrC(config)# line console 0
RtrC(config-line)# logging synchronous
RtrC(config-line)# exit
RtrC(config)# ip host RtrA 10.0.0.1 14.0.0.1
RtrC(config)# ip host RtrB 10.0.0.2 11.0.0.1 13.0.0.1
RtrC(config)# ip host RtrD 9.0.0.2 15.0.0.1
RtrC(config)# cdp run
RtrC(config)# no ip domain-lookup
RtrC(config)# banner motd # 
Access control lists trials are under way #
RtrC(config)# enable secret class
RtrC(config)# enable password cisco
RtrC(config)# line vty 0 4
RtrC(config-line)# login
RtrC(config-line)# password cisco
RtrC(config-line)# exit
RtrC(config)# interface serial0/0
RtrC(config-if)# description DCE Link to RtrB
RtrC(config-if)# ip address 11.0.0.2 255.0.0.0
RtrC(config-if)# clock rate 64000
RtrC(config-if)# no shutdown
RtrC(config-if)# interface fastethernet0/0
RtrC(config-if)# description Default gateway for the 12.0.0.0 network
RtrC(config-if)# ip address 12.0.0.1 255.0.0.0
RtrC(config-if)# no shutdown
RtrC(config-if)# exit
RtrC(config)# interface serial0/1
RtrC(config-if)# description DTE Link to RtrD
RtrC(config-if)# ip address 9.0.0.1 255.0.0.0
RtrC(config-if)# no shutdown
RtrC(config)# ip routing
Networking 4 ICTNWK506 Assessment v01 Page 41

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
RtrC(config)# router rip
RtrC(config-router)# network 9.0.0.0
RtrC(config-router)# network 11.0.0.0
RtrC(config-router)# network 12.0.0.0
RtrC(config-router)# CTRL-Z
RtrC# show running-config
RtrC# copy run start
Router D configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname RtrD
RtrD(config)# line console 0
RtrD(config-line)# logging synchronous
RtrD(config-line)# exit
RtrD(config)# ip host RtrA 10.0.0.1 14.0.0.1
RtrD(config)# ip host RtrB 10.0.0.2 11.0.0.1 13.0.0.1
RtrD(config)# ip host RtrC 9.0.0.1 12.0.0.1 11.0.0.2
RtrD(config)# cdp run
RtrD(config)# no ip domain-lookup
RtrD(config)# banner motd # 
Access control lists trials are under way #
RtrD(config)# enable secret class
RtrD(config)# enable password cisco
RtrD(config)# line vty 0 4
RtrD(config-line)# login
RtrD(config-line)# password cisco
RtrD(config-line)# exit
RtrD(config)# interface serial0/0
RtrD(config-if)# description DCE Link to RtrC
RtrD(config-if)# ip address 9.0.0.2 255.0.0.0
RtrD(config-if)# clock rate 64000
RtrD(config-if)# no shutdown
RtrD(config-if)# interface fastethernet0/0
RtrD(config-if)# description Default gateway for the 15.0.0.0 network
RtrD(config-if)# ip address 15.0.0.1 255.0.0.0
RtrD(config-if)# no shutdown
RtrD(config-if)# exit
RtrD(config)# ip routing
Networking 4 ICTNWK506 Assessment v01 Page 42

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
RtrD(config)# router rip
RtrD(config-router)# network 9.0.0.0
RtrD(config-router)# network 15.0.0.0
RtrD(config-router)# CTRL-Z
RtrD# show running-config
RtrD# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 43

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Access Control List Tasks
Perform the following tasks ONE AT A TIME, taking care to remove the Access Control List
statements in one task before going on to the next task.
Task 1:
1.1 On Router A, deny all PC telnet traffic from network 12.0.0.0 so that it does not enter
Router A
RtrA(config)# access-list 101 deny tcp
12.0.0.0 0.255.255.255 10.0.0.1 0.0.0.0 eq 23
RtrA(config)# access-list 101 deny tcp
12.0.0.0 0.255.255.255 14.0.0.1 0.0.0.0 eq 23
RtrA(config)# access-list 101 permit ip any any
RtrA(config)# int serial0/1
RtrA(config-if)# ip access-group 101 in
1.2 Verify that these commands work in practice. This means that the PC 12.0.0.2 will not be
able to telnet into Router A, but all other PCs will be able to telnet into Router A. Ping
however will not be affected, and PC 12.0.0.2 will be able to ping all active interfaces on
Router A
1.3 Switch off the Access Control List
RtrA(config)# no access-list 101
RtrA(config)# int serial0/1
RtrA(config-if)# no ip access-group 101 in
(Instructor Initial ________ Date___________)
Task 2:
Deny a specific host 13.0.0.2 connected to Router B from telnetting into Router C
RtrC(config)# access-list 102 deny tcp host 13.0.0.2 host 11.0.0.2 eq 23
RtrC(config)# access-list 102 deny tcp host 13.0.0.2 host 12.0.0.1 eq 23
RtrC(config)# access-list 102 deny tcp host 13.0.0.2 host 9.0.0.1 eq 23
RtrC(config)# access-list 102 permit ip any any
RtrC(config)# int serial0/0
RtrC(config-if)# ip access-group 102 in
RtrC(config)# int serial0/1
RtrC(config-if)# ip access-group 102 in
(Why are the last two lines necessary above ? There’s a good reason!)
Networking 4 ICTNWK506 Assessment v01 Page 44

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
2.2 Verify that these commands work in practice. This means that the PC 13.0.0.2 will not be
able to telnet into Router C, but all other PCs will be able to telnet into Router C. Ping
however will not be affected, and PC 13.0.0.2 will be able to ping all active interfaces on
Router C.
2.3 Switch off the Access Control List
RtrC(config)# no access-list 102
RtrC(config)# int serial0/0
RtrC(config-if)# no ip access-group 102 in
RtrC(config)# int serial0/1
RtrC(config-if)# no ip access-group 102 in
(Instructor Initial ________ Date___________)
Task 3:
3.1 Deny network 15.0.0.0 telnet traffic from exiting RouterD.
RtrD(config)# access list 103 deny tcp 15.0.0.0 0.255.255.255 any eq 23
RtrD(config)# access-list 103 permit ip any any
RtrD(config)# int serial0/0
RtrD(config-if)# ip access-group 103 out
3.2 Verify that these commands work in practice. This means that the PC 15.0.0.2 will not be
able to telnet into Router A, Router B and Router C, but all other PCs will be able to telnet
into Router A, Router B and Router C. Ping however will not be affected, and PC 15.0.0.2
will be able to ping all active interfaces on Router A, Router B and Router C.
3.3 Switch off the Access Control List
RtrD(config)# no access-list 103
RtrD(config)# int serial0/0
RtrD(config-if)# no ip access-group 103 out
(Instructor Initial ________ Date___________)
Task 4:
Deny all telnet traffic from network 13.0.0.0 from entering RouterB.
RtrB(config)# access list 104 deny tcp 13.0.0.0 0.255.255.255 any eq telnet
RtrB(config)# access-list 104 permit ip any any
RtrB(config)# int fa0/0
RtrB(config-if)# ip access-group 104 in
Networking 4 ICTNWK506 Assessment v01 Page 45

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
4.2 Verify that these commands work in practice. This means that the PC 13.0.0.2 will not be
able to telnet into Router A, Router B, Router C and Router D, but all other PCs will be able
to telnet into Router A, Router B, Router C and Router D. Ping however will not be affected,
and PC 13.0.0.2 will be able to ping all active interfaces on Router A, Router B, Router C and
Router D.
4.3 Switch off the Access Control List
RtrB(config)# no access-list 104
RtrB(config)# int fa0/0
RtrB(config-if)# no ip access-group 104 in
Note that extended access control lists must be placed as close as possible to the source
(standard access control lists must be placed as close as possible to the destination).
We could have placed two (2) access lists on Router B:
- one access list outgoing on S0
- one access list outgoing on S1.
However this would entail routing the incoming datagrams from network 13.0.0.0 out to the
two interfaces where they would be subsequently denied exit. In the meantime valuable
system resources were being used to process those packets even though they end up going
nowhere.
This is why the access list was placed in the E0 interface as close as possible to the source
network 13.0.0.0.
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 46

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Method Part 2
Set up the following network. Remember to configure the PCs with the correct IP address,
subnet mask and default gateway. Use the default network mask of 255.0.0.0 in this lab.
Networking 4 ICTNWK506 Assessment v01 Page 47

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Basic Router Configuration
Cordoba router configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Cordoba
Cordoba(config)# line console 0
Cordoba(config-line)# logging synchronous
Cordoba(config-line)# exit
Cordoba(config)# ip host Granada 20.0.0.2 30.0.0.1
Cordoba(config)# cdp run
Cordoba(config)# no ip domain-lookup
Cordoba(config)# banner motd # 
Access control lists trials are under way #
Cordoba(config)# enable secret class
Cordoba(config)# enable password cisco
Cordoba(config)# line vty 0 4
Cordoba(config-line)# login
Cordoba(config-line)# password cisco
Cordoba(config-line)# exit
Cordoba(config)# interface serial0/0
Cordoba(config-if)# description DTE Link to Granada
Cordoba(config-if)# ip address 20.0.0.1 255.0.0.0
Cordoba(config-if)# no shutdown
Cordoba(config-if)# interface fastethernet0/0
Cordoba(config-if)# description Default gateway for the 10.0.0.0 network
Cordoba(config-if)# ip address 10.0.0.1 255.0.0.0
Cordoba(config-if)# no shutdown
Cordoba(config-if)# exit
Cordoba(config)# ip routing
Cordoba(config)# router rip
Cordoba(config-router)# network 20.0.0.0
Cordoba(config-router)# network 10.0.0.0
Cordoba(config-router)# CTRL-Z
Cordoba# show running-config
Cordoba# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 48

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Granada router configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Granada
Granada(config)# line console 0
Granada(config-line)# logging synchronous
Granada(config-line)# exit
Granada(config)# ip host Codoba 10.0.0.1 20.0.0.1
Granada(config)# cdp run
Granada(config)# no ip domain-lookup
Granada(config)# banner motd # 
Access control lists trials are under way #
Granada(config)# enable secret class
Granada(config)# enable password cisco
Granada(config)# line vty 0 4
Granada(config-line)# login
Granada(config-line)# password cisco
Granada(config-line)# exit
Granada(config)# interface serial0/0
Granada(config-if)# description DCE Link to Cordoba
Granada(config-if)# ip address 20.0.0.2 255.0.0.0
Granada(config-if)# clock rate 64000
Granada(config-if)# no shutdown
Granada(config-if)# interface fastethernet0/0
Granada(config-if)# description Default gateway for the 30.0.0.0 network
Granada(config-if)# ip address 30.0.0.1 255.0.0.0
Granada(config-if)# no shutdown
Granada(config-if)# exit
Granada(config)# ip routing
Granada(config)# router rip
Granada(config-router)# network 20.0.0.0
Granada(config-router)# network 30.0.0.0
Granada(config-router)# CTRL-Z
Granada# show running-config
Granada# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 49

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 5:
Confirm that the network connections work by using ping to all the most remote IP addresses
in the network, from both PCs. If the most remote hosts can be contacted, it means that the
intermediate connections are operational.
For PC-1 C:\> ping 30.0.0.2
For PC-2 C:\> ping 10.0.0.2
Also, test the connections by using the Windows trace tool:
For PC-1 C:\> tracert 30.0.0.2
For PC-2 C:\> tracert 10.0.0.2
(Instructor Initial ________ Date___________)
Task 6:
Networking 4 ICTNWK506 Assessment v01 Page 50

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Configure a standard IP access control list on the Cordoba router that will:
1. Be placed on the OUTGOING fastethernet interface of the Cordoba router
2. Stop all IP traffic from the 30.0.0.0 network from entering the 10.0.0.0 network
Cordoba(config)# access-list 11 deny 30.0.0.0 0.255.255.255
Cordoba(config)# access-list 11 permit any
Cordoba(config)# interface fa0/0
Cordoba(config)# ip access-group 11 out
(Instructor Initial ________ Date___________)
Task 7:
Now ping PC-1 from PC-2:
For PC-2 C:\> ping 10.0.0.2
You should find that the destination is unreachable. The access control list placed on the
outgoing fastethernet interface of the Cordoba router stopped the echo request from PC-2.
However the ACL may stopped IP traffic from going OUT of the Cordoba fastethernet0/0
interface, but does not stop the ping AT the fastethernet0/0 interface. Try the following:
For PC-2 C:\> ping 10.0.0.1
Networking 4 ICTNWK506 Assessment v01 Page 51

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
This will be successful because each request was directed AT the Cordoba fastethernet0/0
interface, and not OUT of the Cordoba fastethernet0/0 interface.
So the placement of the standard access control list at the exit point of the Cordoba
fastethernet0/0 interface will not stop more serious attempts at accessing the 10.0.0.0
network.
Try to telnet into the Cordoba fastethernet0/0 interface:
For PC-2 C:\> telnet 10.0.0.1
Once have accessed the Cordoba router you will then be able to ping PC-1:
Cordoba(config)# ping 10.0.0.1
This can be used as an exploit.
(Instructor Initial ________ Date___________)
Task 8:
Remove the fastethernet0/0 interface from the access-group 11 and place the access list on
the Cordoba router serial0/0 interface:
Cordoba(config)# interface fa0/0
Networking 4 ICTNWK506 Assessment v01 Page 52

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Cordoba(config)# no ip access-group 11 out
Cordoba(config)# interface serial0/0
Cordoba(config)# ip access-group 11 in
(Instructor Initial ________ Date___________)
Task 9:
Now ping PC-1 from PC-2:
For PC-2 C:\> ping 10.0.0.2
For PC-2 C:\> ping 10.0.0.1
You should find that the destinations are unreachable. The access control list placed on the
incoming serial interface of the Cordoba router stopped all the echo requests from PC-2.
Try to telnet into the Cordoba fastethernet0/0 interface:
For PC-2 C:\> telnet 10.0.0.1
You should find that the destination is not reachable
The potential exploit has bee stopped because of the judicious placement of the access control
list.
Networking 4 ICTNWK506 Assessment v01 Page 53

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
Observations
Indicate whether your command sequence performed the intended function. The indicated
sequence performed the intended function as per the screenshots above.
Conclusion
In this lab, IP Access control Lists were place on both inbound and outbound interfaces, and a
testing regime invoked to conform the correct operation of the lists.
Networking 4 ICTNWK506 Assessment v01 Page 54

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 4 v2
Access Control Lists 2
Aim
To configure a network using 4 routers in a simulated subnetted enterprise network connected
via a WAN link to a different network containing a webserver and examine various IP Access
Control List scenarios. The routing protocol is RIP.
Auckland Sydney_Branch_1 Sydney_Branch_2 Sydney_Branch_3
Switch
Switch
Webserver PC
PC
Switch Switch
Net ID
201 . 67 . 43 . 0 / 24
(Netmask 255.255.255.0)
Net ID
169 . 113 . 0 . 0 / 19
(Netmask 255.255.224.0)
Net ID
45 . 0 . 0 . 0 / 8
(Netmask 255.0.0.0)
PC
Networking 4 ICTNWK506 Assessment v01 Page 55

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Method
This lab builds on the details of a previous lab. It reviews the configuration covered earlier,
including advanced management features, but now investigates IP Access Control Lists.
Configure the following network using the router names and IP addresses shown.
Auckland
201 . 67 . 43 . 1
Sydney_Branch_1
169 . 113 . 32 . 1
Sydney_Branch_2
169 . 113 . 96 . 1
Sydney_Branch_3
169 . 113 . 160 . 1
Switch
Switch
Webserver
IP address
201 . 67 . 43 . 2
Default Gateway
201 . 67 . 43 . 1
169 . 113 . 96 . 2
169 . 113 . 32 . 2 169 . 113 . 160 . 2
Switch Switch
Serial 0/0
DCE
45 . 0 . 0 . 1
Serial 0/0
DTE
45 . 0 . 0 . 2
Serial 0/0
DTE
169 . 113 . 64 . 2
Serial 0/1
DCE
169 . 113 . 64 . 1
Serial 0/1
DCE
169 . 113 . 128 . 1
Serial 0/0
DTE
169 . 113 . 128 . 2
Net ID
201 . 67 . 43 . 0 / 24
Net ID
169 . 113 . 0 . 0 / 19
Net ID
45 . 0 . 0 . 0 / 8
Networking 4 ICTNWK506 Assessment v01 Page 56

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Basic Configurations
In the following configurations there are preliminary configurations and custom
configurations to suit the particular lab. It is important that you learn and internalise the
preliminary configurations.
The Auckland Router
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Auckland
Auckland(config)# line console 0
Auckland(config-line)# logging synchronous
Auckland(config-line)# exit
Auckland(config)# ip host Sydney1 169.113.64.1
Auckland(config)# ip host Sydney2 169.113.64.2
Auckland(config)# ip host Sydney3 169.113.128.2
Auckland(config)# no ip domain-lookup
Auckland(config)# banner motd # 
This is an open Gateway to Auckland Webservices so please be nice and soon security
policies will be in place #
Auckland(config)# cdp run
Auckland(config)# enable secret class
Auckland(config)# enable password cisco
Auckland(config)# line vty 0 4
Auckland(config-line)# password cisco
Auckland(config-line)# login
Auckland(config-line)# exit
Auckland(config)# interface serial0/0/0
Auckland(config-if)# description DCE Link to Sydney
Auckland(config-if)# ip address 45.0.0.1 255.0.0.0
Auckland(config-if)# clock rate 64000
Auckland(config-if)# no shutdown
Auckland(config-if)# interface fastethernet0/0
Networking 4 ICTNWK506 Assessment v01 Page 57

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Auckland(config-if)# description Default gateway for the Webserver
Auckland(config-if)# ip address 201.67.43.1 255.255.255.0
Auckland(config-if)# no shutdown
Auckland(config-if)# exit
Auckland(config)# router rip
Auckland(config-router)# network 45.0.0.0
Auckland(config-router)# network 201.67.43.0
Auckland(config-router)# CTRL-Z
Auckland# show running-config
Auckland# copy run start
The Sydney Branch 1 Router
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Sydney_Branch_1
Sydney_Branch_1(config)# line console 0
Sydney_Branch_1(config-line)# logging synchronous
Sydney_Branch_1(config-line)# exit
Sydney_Branch_1(config)# ip host Auckland 45.0.0.1
Sydney_Branch_1(config)# ip host Sydney2 169.113.64.2
Sydney_Branch_1(config)# ip host Sydney3 169.113.128.2
Sydney_Branch_1(config)# no ip domain-lookup
Sydney_Branch_1(config)# banner motd # 
Welcome to Sydney1 where security policies will soon be in place #
Sydney_Branch_1(config)# cdp run
Sydney_Branch_1(config)# enable secret class
Sydney_Branch_1(config)# enable password cisco
Sydney_Branch_1(config)# line vty 0 4
Sydney_Branch_1(config-line)# password cisco
Sydney_Branch_1(config-line)# login
Sydney_Branch_1(config-line)# exit
Networking 4 ICTNWK506 Assessment v01 Page 58

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Sydney_Branch_1(config)# interface serial0/0/0
Sydney_Branch_1(config-if)# description DTE Link to Auckland
Sydney_Branch_1(config-if)# ip address 45.0.0.2 255.0.0.0
Sydney_Branch_1(config-if)# no shutdown
Sydney_Branch_1(config)# interface serial0/0/1
Sydney_Branch_1(config-if)# description DCE Link to Sydney_Branch_2
Sydney_Branch_1(config-if)# ip address 169.113.64.1 255.255.224.0
Sydney_Branch_1(config-if)# clock rate 64000
Sydney_Branch_1(config-if)# no shutdown
Sydney_Branch_1(config-if)# interface fastethernet0/0
Sydney_Branch_1(config-if)# description Default gateway for all PCs in Branch 1
Sydney_Branch_1(config-if)# ip address 169.113.32.1 255.255.224.0
Sydney_Branch_1(config-if)# no shutdown
Sydney_Branch_1(config-if)# exit
Sydney_Branch_1(config)# router rip
Sydney_Branch_1(config-router)# network 45.0.0.0
Sydney_Branch_1(config-router)# network 169.113.0.0
Sydney_Branch_1(config-router)# CTRL-Z
Sydney_Branch_1# show running-config
Sydney_Branch_1# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 59

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
The Sydney Branch 2 Router
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Sydney_Branch_2
Sydney_Branch_2(config)# line console 0
Sydney_Branch_2(config-line)# logging synchronous
Sydney_Branch_2(config-line)# exit
Sydney_Branch_2(config)# ip host Sydney1 169.113.32.1
Sydney_Branch_2(config)# ip host Auckland 45.0.0.1
Sydney_Branch_2(config)# ip host Sydney3 169.113.128.2
Sydney_Branch_2(config)# no ip domain-lookup
Sydney_Branch_2(config)# banner motd # 
Welcome to Sydney2 where security policies will soon be in place #
Sydney_Branch_2(config)# cdp run
Sydney_Branch_2(config)# enable secret class
Sydney_Branch_2(config)# enable password cisco
Sydney_Branch_2(config)# line vty 0 4
Sydney_Branch_2(config-line)# password cisco
Sydney_Branch_2(config-line)# login
Sydney_Branch_2(config-line)# exit
Sydney_Branch_2(config)# interface serial0/0/0
Sydney_Branch_2(config-if)# description DTE Link to Sydney_Branch_1
Sydney_Branch_2(config-if)# ip address 169.113.64.2 255.255.224.0
Sydney_Branch_2(config-if)# no shutdown
Sydney_Branch_2(config)# interface serial0/0/1
Sydney_Branch_2(config-if)# description DCE Link to Sydney_Branch_3
Sydney_Branch_2(config-if)# ip address 169.113.128.1 255.255.224.0
Sydney_Branch_2(config-if)# clock rate 64000
Sydney_Branch_2(config-if)# no shutdown
Sydney_Branch_2(config-if)# interface fastethernet0/0
Sydney_Branch_2(config-if)# description Default gateway for all PCs in Branch 2
Sydney_Branch_2(config-if)# ip address 169.113.96.1 255.255.224.0
Networking 4 ICTNWK506 Assessment v01 Page 60

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Sydney_Branch_2(config-if)# no shutdown
Sydney_Branch_2(config-if)# exit
Sydney_Branch_2(config)# router rip
Sydney_Branch_2(config-router)# network 169.113.0.0
Sydney_Branch_2(config-router)# CTRL-Z
Sydney_Branch_2# show running-config
Sydney_Branch_2# copy run start
The Sydney Branch 3 Router
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Sydney_Branch_3
Sydney_Branch_3(config)# line console 0
Sydney_Branch_3(config-line)# logging synchronous
Sydney_Branch_3(config-line)# exit
Sydney_Branch_3(config)# ip host Sydney1 169.113.32.1
Sydney_Branch_3(config)# ip host Sydney2 169.113.128.1
Sydney_Branch_3(config)# ip host Auckland 45.0.0.1
Sydney_Branch_3 (config)# no ip domain-lookup
Sydney_Branch_3(config)# banner motd # 
Welcome to Sydney3 where security policies will soon be in place #
Sydney_Branch_3(config)# cdp run
Sydney_Branch_3(config)# enable secret class
Sydney_Branch_3(config)# enable password cisco
Sydney_Branch_3(config)# line vty 0 4
Sydney_Branch_3(config-line)# password cisco
Sydney_Branch_3(config-line)# login
Sydney_Branch_3(config-line)# exit
Sydney_Branch_3(config)# interface serial0/0/0
Sydney_Branch_3(config-if)# description DTE Link to Sydney_Branch_2
Sydney_Branch_3(config-if)# ip address 169.113.128.2 255.255.224.0
Networking 4 ICTNWK506 Assessment v01 Page 61

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Sydney_Branch_3(config-if)# no shutdown
Sydney_Branch_3(config-if)# interface fastethernet0/0
Sydney_Branch_3(config-if)# description Default gateway for all PCs in Branch 3
Sydney_Branch_3(config-if)# ip address 169.113.160.1 255.255.224.0
Sydney_Branch_3(config-if)# no shutdown
Sydney_Branch_3(config-if)# exit
Sydney_Branch_3(config)# router rip
Sydney_Branch_3(config-router)# network 169.113.0.0
Sydney_Branch_3(config-router)# CTRL-Z
Sydney_Branch_3# show running-config
Sydney_Branch_3# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 62

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
The Auckland Webserver
IP Address: 201.67.43.2
Netmask: 255.255.255.0
Default Gateway: 201.67.43.1
Install the Cisco TFTP software supplied, and ensure that you are familiar with the folder that
the software is installed in. It will be into this folder that the configuration and IOS backup
files will be stored.
The Sydney Branch 1 PC
IP Address: 169.113.32.2
Netmask: 255.255.224.0
Default Gateway: 169.113.32.1
Install the Cisco TFTP software supplied, and ensure that you are familiar with the folder that
the software is installed in. It will be into this folder that the configuration and IOS backup
files will be stored.
The Sydney Branch 2 PC
IP Address: 169.113.96.2
Netmask: 255.255.224.0
Default Gateway: 169.113.96.1
Install the Cisco TFTP software supplied, and ensure that you are familiar with the folder that
the software is installed in. It will be into this folder that the configuration and IOS backup
files will be stored.
The Sydney Branch 3 PC
IP Address: 169.113.160.2
Netmask: 255.255.224.0
Default Gateway: 169.113.160.1
Install the Cisco TFTP software supplied, and ensure that you are familiar with the folder that
the software is installed in. It will be into this folder that the configuration and IOS backup
files will be stored.
Networking 4 ICTNWK506 Assessment v01 Page 63

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Tasks and Observations
Task 1
Ping from the command line on each PC (and the webserver) to every other PC in the
network. Also ping from each of the routers, through Hyperterminal using the IP Host Tables
to test the connectivity, eg,
Auckland# ping Sydney1
Auckland# ping Sydney2
Auckland# ping Sydney3
Sydney_Branch_2# ping Auckland
Sydney_Branch_2# ping Sydney1
Sydney_Branch_2# ping Sydney3
Networking 4 ICTNWK506 Assessment v01 Page 64

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
Task 2
Configure and IP ACL to deny all IP traffic (including ICMP requests) from any PC on the
Sydney network from getting into the Auckland router.
Auckland(config)# access-list 1 deny 169.113.0.0 0.0.255.255
Auckland(config)# interface serial0/0/0
Auckland(config-if)# ip access-group 1 in
Q2.1 Can the Sydney_Branch_1 router can still ping the Auckland router from the console
(Hyperterminal)?
NO
………………………………………………………………………………………………….
Q2.2 Why is it so?
………………………………………………………………………………………………….
Access-list 1 denies incoming traffic towards serial interface of Aucland router
………………………………………………………………………………………………….
Q2.3 What happens when the following line is added to the Auckland ACL?
Auckland(config)# access-list 1 deny 45.0.0.2 0.0.0.0
Only specified host whose IP address is 45.0.0.2 will be denied access to the Auckland
router.
………………………………………………………………………………………………….
………………………………………………………………………………………………….
Q2.3 Is it now possible to telnet or ping from ANY PC or router on the Sydney network to
any Auckland device?
NO
………………………………………………………………………………………………….
………………………………………………………………………………………………….
Networking 4 ICTNWK506 Assessment v01 Page 65

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
Task 3
Remove the previous ACL on the Auckland Router.
Auckland(config)# no access-list 1
Auckland(config)# interface serial0/0/0
Auckland(config-if)# no ip access-group 1 in
Confirm that the ACL and the binding to the serial interface have both been removed.
Auckland# show run
(Instructor Initial ________ Date___________)
Task 4
On the Auckland router devise an ACL to allow ping (ICMP echo requests), but deny telnet
from any Sydney device to any Auckland device.
Auckland(config)# access-list 101 permit icmp
169.113.0.0 0.0.255.255 201.67.43.0 0.0.0.255
Auckland(config)# access-list 101 permit icmp
45.0.0.2 0.0.0.0 201.67.43.0 0.0.0.255
Auckland(config)# access-list 101 permit icmp
45.0.0.2 0.0.0.0 45.0.0.1 0.0.0.0
Auckland(config)# access-list 101 permit icmp
169.113.0.0 0.0.255.255 45.0.0.1 0.0.0.0
Auckland(config)# access-list 101 deny tcp
169.113.0.0 0.0.255.255 201.67.43.0 0.0.0.255 eq 23
Auckland(config)# access-list 101 deny tcp
45.0.0.2 0.0.0.0 201.67.43.0 0.0.0.255 eq 23
Auckland(config)# access-list 101 deny tcp
45.0.0.2 0.0.0.0 45.0.0.1 0.0.0.0 eq 23
Networking 4 ICTNWK506 Assessment v01 Page 66

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Auckland(config)# access-list 101 deny tcp
169.113.0.0 0.0.255.255 45.0.0.1 0.0.0.0 eq 23
Auckland(config)# interface serial0/0/0
Auckland(config-if)# ip access-group 101 in
(Instructor Initial ________ Date___________)
Task 5
Remove the previous ACL on the Auckland Router.
Auckland(config)# no access-list 101
Auckland(config)# interface serial0/0/0
Auckland(config-if)# no ip access-group 101 in
Confirm that the ACL and the binding to the serial interface have both been removed.
Auckland# show run
(Instructor Initial ________ Date___________)
Task 6
Configure each router to deny telnet from any other device except the PCs on the subnet
directly connected to that router’s Ethernet interface.
Auckland(config)# access-list 101 permit tcp
201.67.43.1 0.0.0.255 201.67.43.1 0.0.0.0 eq 23
Networking 4 ICTNWK506 Assessment v01 Page 67

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Auckland(config)# access-list 101 permit tcp
201.67.43.1 0.0.0.255 45.0.0.1 0.0.0.0 eq 23
Auckland(config)# interface fa0/0
Auckland(config-if)# ip access-group 101 in
Auckland(config-if)# exit
Auckland(config)# interface serial0/0/0
Auckland(config-if)# ip access-group 101 in
Sydney_Branch_1(config)# access-list 102 permit tcp
169.113.32.0 0.0.31.255 169.113.32.1 0.0.0.0 eq 23
Sydney_Branch_1(config)# access-list 102 permit tcp
169.113.32.0 0.0.31.255 45.0.0.2 0.0.0.0 eq 23
Sydney_Branch_1(config)# access-list 102 permit tcp
169.113.32.0 0.0.31.255 169.113.64.1 0.0.0.0 eq 23
Sydney_Branch_1(config)# interface fa0/0
Sydney_Branch_1(config-if)# ip access-group 102 in
Sydney_Branch_1(config-if)# exit
Sydney_Branch_1(config)# interface serial0/0/0
Sydney_Branch_1(config-if)# ip access-group 102 in
Sydney_Branch_1(config-if)# exit
Sydney_Branch_1(config)# interface serial0/0/1
Sydney_Branch_1(config-if)# ip access-group 102 in
Sydney_Branch_2(config)# access-list 103 permit tcp
169.113.96.0 0.0.31.255 169.113.96.1 0.0.0.0 eq 23
Sydney_Branch_2(config)# access-list 103 permit tcp
169.113.96.0 0.0.31.255 169.113.64.2 0.0.0.0 eq 23
Sydney_Branch_2(config)# access-list 103 permit tcp
169.113.96.0 0.0.31.255 169.113.128.1 0.0.0.0 eq 23
Sydney_Branch_2(config)# interface fa0/0
Sydney_Branch_2(config-if)# ip access-group 103 in
Sydney_Branch_2(config-if)# exit
Sydney_Branch_2(config)# interface serial0/0/0
Sydney_Branch_2(config-if)# ip access-group 103 in
Sydney_Branch_2(config-if)# exit
Sydney_Branch_2(config)# interface serial0/0/1
Networking 4 ICTNWK506 Assessment v01 Page 68

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Sydney_Branch_2(config-if)# ip access-group 103 in
Sydney_Branch_3(config)# access-list 104 permit tcp
169.113.160.0 0.0.31.255 169.113.160.1 0.0.0.0 eq 23
Sydney_Branch_3 (config)# access-list 104 permit tcp
169.113.160.0 0.0.31.255 169.113.128.2 0.0.0.0 eq 23
Sydney_Branch_3 (config)# interface fa0/0
Sydney_Branch_3 (config-if)# ip access-group 104 in
Sydney_Branch_3 (config-if)# exit
Sydney_Branch_3 (config)# interface serial0/0/0
Sydney_Branch_3 (config-if)# ip access-group 104 in
Sydney_Branch_3 (config-if)# exit
Sydney_Branch_3 (config)# exit
Sydney_Branch_3# show run
(Instructor Initial ________ Date___________)
Conclusion
In this lab we have emulated two security scenarios. The first protects the Auckland router
from the Sydney network. The second scenario protects the each router from telnet access
from everyone else except the trusted directly connected network or subnet users.
Networking 4 ICTNWK506 Assessment v01 Page 69

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 5 v3.1
NAT & PAT
Aim
To configure NAT/PAT for IP address translation.
Warsaw
router Moscow
router
Hub Hub
10.10.0.2 / 16 10.20.0.2 / 16
E0 = 10.10.0.1 /16
212.13.147.0 / 24 Outside
10.10.0.0 / 16 Inside
E0 = 10.20.0.1 / 16
142.66.0.0 /16 Outside
10.20.0.0. / 16 Inside
HDLC Link
197.8.2.0 / 24
S1 (DCE)
197.8.2.1 S0 (DTE)
197.8.2.2
Instructions
- Successful completion of this lab will require:
1. successful ping to/from the Warsaw host PC to/from the Moscow host PC
2. demonstration of the correct configuration stored in the startup-config file
Networking 4 ICTNWK506 Assessment v01 Page 70

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Objectives
Complete the following tasks:
• Configure the serial link between the Warsaw and Moscow routers
• Configure NAT so that the Warsaw 10.10.0.0 network is translated to 212.13.147.0
network addresses via a pool; and the Moscow 10.20.0.0 network is translated to
142.66.0.0 network addresses via a pool. There is a static mapping of 212.13.147.1 to
Warsaw Ethernet 0 interface of 10.10.0.1. There is also a static mapping of 142.66.0.1 to
Moscow Ethernet 0 interface of 10.20.0.1
• Static routes are set in both directions on both routers to enable the translated network
addresses on both routers to be accessible
• Verify connectivity
Pre-configuration
The following items have been preconfigured on all three routers:
• Hostnames on all routers
• Interface IP addresses, subnet masks, and no shutdown commands
• Vty, and privileged passwords
• Clock rates on DCE interfaces
• IP addresses and subnet masks on PCs, including the default gateway IP address.
Following are the actual commands already configured on the devices:
Warsaw Router
hostname Warsaw
enable secret class
interface serial0
shutdown
interface serial1
ip address 197.8.2.1 255.255.255.0
clock rate 64000
no shutdown
interface ethernet0
ip address 10.10.0.1 255.255.0.0
no shutdown
line con 0
logging synchronous
exec-timeout 0 0
line vty 0 4
password cisco
login
line aux 0
password cisco
login
Networking 4 ICTNWK506 Assessment v01 Page 71

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Moscow Router
hostname Moscow
enable secret class
interface serial0
ip address 197.8.2.2 255.255.255.0
no shutdown
interface ethernet0
ip address 10.20.0.1 255.255.0.0
no shutdown
line con 0
logging synchronous
exec-timeout 0 0
line vty 0 4
password cisco
login
line aux 0
password cisco
login
Overview of Configuration Tasks
1. Configure HDLC
• Configure the link between Warsaw and Moscow with HDLC encapsulation.
2. Configure NAT on the Warsaw Router
Use the following values to configure NAT services on Warsaw:
• Configure NAT on the Warsaw router to translate the 10.10.0.0/16 inside host IP addresses
to the 212.13.147.0/24 outside network address range.
• Use PAT, so that all addresses are using only the IP addresses of 212.13.147.10 through
212.13.147.20, with a subnet mask of 255.255.255.0. Call this pool of addresses
“Warsaw_public_access”
• Create a static mapping of 212.13.147.1 to the Warsaw Ethernet 0 interface of 10.10.0.1.
This will allow other routers to ping the Ethernet 0 interface of Warsaw with the command
ping 212.13.147.1.
Verify that the Moscow PC can ping both the Ethernet 0 interface of Warsaw and the Warsaw
PC (see next paragraph).
Networking 4 ICTNWK506 Assessment v01 Page 72

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Note that the Warsaw PC will NEVER be directly visible to the outside world. Its address
will be translated dynamically by NAT to an address in the pool range 212.13.147.10 to
212.13.147.20. So it is necessary to ‘capture’ the translated address of the Warsaw PC in the
Warsaw router’s translation table, using the command show ip nat translation,
and then ping this translated Warsaw PC address from the Moscow PC.
To capture this translation, you must prevent the translation table entries from aging out too
early, at least for the ICMP echo request and echo reply packets (that is, ping). To freeze the
translation table entries, add the following to the configuration:
Warsaw(config)# ip nat translation icmp-timeout never
(An alternative might be to create another static mapping of the inside local Warsaw PC
address of 10.10.0.2 to the inside global Warsaw PC address of 212.13.147.2, using:
Warsaw(config)# ip nat inside source static 10.10.0.2 212.13.147.2 )
3. Configure NAT on the Moscow Router
Use the following values to configure NAT services on Moscow:
• Configure NAT on the Moscow router to translate the 10.20.0.0/16 inside host IP addresses
to the 142.66.0.0/16 outside network address range.
• Use PAT, so that all addresses are using only the IP addresses of 142.66.0.10 through
142.66.0.20, with a subnet mask of 255.255.0.0. Call this pool of addresses
“Moscow_public_access”
• Create a static mapping of 142.66.0.1 to Moscow Ethernet 0 interface of 10.20.0.1. This
will allow other routers to ping the Ethernet 0 interface of Moscow with the command ping
142.66.0.1. Verify that the Warsaw PC can ping both the Ethernet 0 interface of Moscow and
the Moscow PC (see next paragraph).
Note that the Moscow PC will NEVER be directly visible to the outside world. Its address
will be translated dynamically by NAT to an address in the pool range 142.66.0.11 to
142.66.0.20. So it is necessary to ‘capture’ the translated address of the Moscow PC in the
Moscow router’s translation table, using the command show ip nat translation,
and then ping this translated Moscow PC address from the Warsaw PC.
To capture this translation, you must prevent the translation table entries from aging out too
early, at least for the ICMP echo request and echo reply packets (that is, ping). To freeze the
translation table entries, add the following to the configuration:
Moscow(config)# ip nat translation icmp-timeout never
Networking 4 ICTNWK506 Assessment v01 Page 73

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(An alternative might be to create another static mapping of the inside local Moscow PC
address of 10.20.0.2 to the inside global Moscow PC address of 142.66.0.2, using:
Moscow(config)# ip nat inside source static 10.20.0.2 142.66.0.2 )
4. Configure a static route to the Moscow Router on the Warsaw Router
Set up a static route on the Warsaw router so that the translated subnetwork 142.66.0.0 /16
becomes accessible via the Moscow router serial interface 197.8.2.2. Use the appropriate
subnet mask for the /24 subnet.
5. Configure a static route to the Warsaw Router on the Moscow Router
Set up a static route on the Moscow router so that the translated subnetwork 212.13.147.0 /24
becomes accessible via the Warsaw router serial interface 197.8.2.1. Use the appropriate
subnet mask for the /24 subnet.
6. Configuration in startup-config file on the Warsaw Router
Save the completed configuration file, and display its contents.
7. Configuration in startup-config file on the Moscow Router
Save the completed configuration file, and display its contents.
8. Demonstration of correct NAT translations on the Warsaw Router
Use the appropriate command to display the contents of the NAT translation table kept in
RAM on the Warsaw router.
9. Demonstration of correct NAT translations on the Moscow Router
Use the appropriate command to display the contents of the NAT translation table kept in
RAM on the Moscow router.
10. Demonstration of pinging the two translated 10.20.0.0/16 addresses on
the Moscow Router from the Warsaw Router
After viewing the contents of the NAT translation table, show the translated 10.20.0.0
addresses on the Moscow router respond to the ping command from the Sydney router.
It will be necessary to turn on debugging to capture the translation as they occur :
Warsaw# debug ip nat
11. Demonstration of pinging the two translated 10.10.0.0/16 addresses on
the Warsaw Router from the Moscow Router
Networking 4 ICTNWK506 Assessment v01 Page 74

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
After viewing the contents of the NAT translation table, show the translated 10.10.0.0
addresses on the Warsaw router respond to the ping command from the Moscow router.
It will be necessary to turn on debugging to capture the translation as they occur :
Moscow# debug ip nat
Your Tasks
1. Configure HDLC
• Configure the link between Warsaw and Moscow with HDLC encapsulation.
1.1 Using the correct prompt, write out the command to set HDLC encapsulation
on the Warsaw router:
interface serial 0/0/1
encapsulation hdlc
(Instructor Initial ________ Date___________)
1.2 Using the correct prompt, write out the command to set HDLC encapsulation on the
Moscow router:
interface serial 0/0/1
encapsulation hdlc
(Instructor Initial ________ Date___________)
2. Configure NAT on the Warsaw Router
2.1 Use the following values to configure NAT services on Warsaw:
• Configure NAT on the Warsaw router to translate the 10.10.0.0/16 inside host IP addresses
to the 212.13.147.0/24 outside network address range.
• Use PAT, so that all addresses are using only the IP addresses of 212.13.147.10 through
212.13.147.20, with a subnet mask of 255.255.255.0. Call this pool of addresses
“Warsaw_public_access”
• Create a static mapping of 212.13.147.1 to Sydney Ethernet 0 interface of 10.10.0.1. This
will allow other routers to ping the Ethernet 0 interface of Warsaw with the command ping
212.13.147.1. Verify that the Moscow PC can ping both the Ethernet 0 interface of the
Warsaw router and the Warsaw PC. Make sure however that you create a static route to the
212.13.147.0 network from the Moscow router first.
Networking 4 ICTNWK506 Assessment v01 Page 75

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Your router command:
access-list 13 permit 10.10.0.0 0.0.255.255
access-list 13 deny any
ip nat pool Warsaw_public_access 212.13.147.10 212.13.147.20 netmask 255.255.255.0
ip nat inside source list 13 pool Warsaw_public_access overload
interface FastEthernet 0/0
ip nat inside
exit
interface Serial0/0/1
ip nat outside
exit
ip route 212.13.147.0 255.255.255.0 197.8.2.2
(Instructor Initial ________ Date___________)
2.2 Ping the Moscow serial interface from the Warsaw PC, and using the correct prompt,
write out the command to view the contents of the NAT translation table on the Warsaw
router. Also, write out the command that will show the realtime address translations as they
actually occur. What does this table show?
Your router command:
ping 197.8.2.2
sho ip nat translations
sho ip nat statistics
the table shows realtime inside global and inside local addresses.
(Instructor Initial ________ Date___________)
3. Configure NAT on the Moscow Router
3.1 Use the following values to configure NAT services on Moscow:
• Configure NAT on the Moscow router to translate the 10.20.0.0/16 inside host IP addresses
to the 142.66.0.0/24 outside network address range.
• Use PAT, so that all addresses are using only the IP addresses of 142.66.0.10 through
142.66.0.20, with a subnet mask of 255.255.0.0. Call this pool of addresses
“Moscow_public_access”
• Create a static mapping of 142.66.0.1 to Auckland Ethernet 0 interface of 10.20.0.1. This
will allow other routers to ping the Ethernet 0 interface of Moscow with the command ping
142.66.0.1. Verify that the Warsaw PC can ping both the Ethernet 0 interface of the Moscow
router and the Moscow PC. Make sure however that you create a static route to the
142.66.0.0 network from the Warsaw router first.
Your router command:
Networking 4 ICTNWK506 Assessment v01 Page 76

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
access-list 13 permit 10.20.0.0 0.0.255.255
access-list 13 deny any
ip nat pool Moscow_public_access 142.66.0.10 142.66.0.20 netmask 255.255.0.0
ip nat inside source list 13 pool Moscow_public_access overload
interface FastEthernet 0/0
ip nat inside
exit
interface Serial0/0/0
ip nat outside
exit
ip nat inside source static 10.20.0.2 142.66.0.2
(Instructor Initial ________ Date___________)
3.2 Ping the Warsaw serial interface from the Moscow PC, and using the correct prompt,
write out the command to view the contents of the NAT translation table on the Moscow
router. Also, write out the command that will show the realtime address translations as they
actually occur. What does this table show?
Your router command:
Ping 197.8.2.1
sho ip nat translations
sho ip nat statistics
the table shows realtime inside global and inside local addresses.
(Instructor Initial ________ Date___________)
4. Configure a static route to the Warsaw Router on the Moscow Router
4.1 Use the following values to configure the static route to Warsaw:
Set up a static route on the Moscow router so that the translated network 212.13.147.0 /24
becomes accessible via the Warsaw router serial interface 197.8.2.1. Use the appropriate
subnet mask for the /24 subnet.
Your router command
ip route 10.20.0.0 255.255.0.0 197.8.2.1
(Instructor Initial ________ Date___________)
5. Configure a static route to the Moscow Router on the Warsaw Router
Networking 4 ICTNWK506 Assessment v01 Page 77

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
5.1 Use the following values to configure the static route to Moscow:
Set up a static route on the Warsaw router so that the translated network 142.66.0.0 /16
becomes accessible via the Moscow router serial interface 197.8.2.2. Use the appropriate
subnet mask for the /24 subnet.
Your router command
ip route 212.13.147.0 255.255.255.0 197.8.2.2
(Instructor Initial ________ Date___________)
6. Configuration in startup-config file on the Warsaw Router
(Instructor Initial ________ Date___________)
7. Configuration in startup-config file on the Moscow Router
(Instructor Initial ________ Date___________)
8. Demonstration of correct NAT translations on the Warsaw Router
(Instructor Initial ________ Date___________)
9. Demonstration of correct NAT translations on the Moscow Router
(Instructor Initial ________ Date___________)
10. Demonstration of successful pinging the two translated 10.20.0.0/16
addresses on the Moscow Router from the Warsaw PC
(Instructor Initial ________ Date___________)
11. Demonstration of successful pinging the two translated 10.10.0.0/16
addresses on the Warsaw Router from the Moscow Router
Networking 4 ICTNWK506 Assessment v01 Page 78

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 79

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 6
DHCP & DHCP Relay
Aim
To configure (1) DHCP (2) routing between DHCP networks and (3) DHCP Relay.
Method: (Part 1) DHCP Configuration
The purpose of this section of the lab is to allocate IP addresses to the two PCs by
configuring a DHCP server on the Campus router.
Campus ISP
Switch
PC-1 PC-2
Serial0/0
DCE
172.16.1.5 / 30
Serial0/0
DTE
172.16.1.6 / 30
Fastethenet0/0
172.16.12.1 / 24
These PCs are to
obtain their IP
addresses
automatically
using DHCP
Networking 4 ICTNWK506 Assessment v01 Page 80

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 1. Basic Router Configuration
Basic ISP Router Configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname ISP
ISP(config)# line console 0
ISP(config-line)# logging synchronous
ISP(config-line)# exit
ISP(config)# ip host Campus 172.16.1.6 172.16.12.1
ISP(config)# no ip domain-lookup
ISP(config)# banner motd # This is an ISP # 
ISP(config)# cdp run
ISP(config)# enable secret class
ISP(config)# enable password cisco
ISP(config)# line vty 0 4
ISP(config-line)# login
ISP(config-line)# password cisco
ISP(config-line)# exit
ISP(config)# interface serial0/0
ISP(config-if)# description DCE Link to Campus
ISP(config-if)# ip address 172.16.1.5 255.255.255.252
ISP(config-if)# clock rate 64000
ISP(config-if)# no shutdown
ISP(config-if)# interface fastethernet0/0
ISP(config-if)# shutdown
ISP(config-if)# exit
ISP(config-if)# CTRL-Z
ISP# show running-config
ISP# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 81

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Basic Campus Router Configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Campus
Campus(config)# line console 0
Campus(config-line)# logging synchronous
Campus(config-line)# exit
Campus(config)# ip host ISP 172.16.1.5
Campus(config)# no ip domain-lookup
Campus(config)# banner motd # 
This Campus using DHCP for IP address allocations #
Campus(config)# cdp run
Campus(config)# enable secret class
Campus(config)# enable password cisco
Campus(config)# line vty 0 4
Campus(config-line)# login
Campus(config-line)# password cisco
Campus(config-line)# exit
Campus(config)# interface serial0/0
Campus(config-if)# description DTE Link to ISP
Campus(config-if)# ip address 172.16.1.6 255.255.255.252
Campus(config-if)# no shutdown
Campus(config-if)# interface fastethernet0/0
Campus(config-if)# description Default gateway for the Campus network
Campus(config-if)# ip address 172.16.12.1 255.255.255.0
Campus(config-if)# no shutdown
Campus(config-if)# exit
Campus(config-if)# CTRL-Z
Campus# show running-config
Campus# copy run start
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 82

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 2. Configuring Static Routes
ISP Router Configuration
Establish a static route to the Campus router:
ISP(config)# ip route 172.16.12.0 255.255.255.0 172.16.1.6
Confirm that the routing table is correctly populated :
ISP# show ip route
Campus Router Configuration
Establish a default route to the ISP router:
Campus(config)# ip route 0.0.0.0 0.0.0.0 172.16.1.5
Confirm that the routing table is correctly populated :
Campus# show ip route
(Instructor Initial ________ Date___________)
Task 3. Configuring DHCP
Campus Router Configuration
Define the DHCP parameters, that will be used to allocated IP addresses
Campus(config)# ip dhcp pool Campus
Campus(dhcp-config)# network 172.16.12.0 255.255.255.0
Campus(dhcp-config)# default-router 172.16.12.1
Campus(dhcp-config)# dns-server 172.16.12.2
Campus(dhcp-config)# domain-name ciscoclass.net
Campus(dhcp-config)# netbios-name-server 172.16.12.10
Campus(dhcp-config)# exit
Campus(config)# ip dhcp excluded-address 172.16.12.1 172.16.12.10
Verifying Campus Router Bindings
Confirm that the bindings for the hosts, including their MAC addresses, lease expiry times
and type, can be seen by issuing the command:
Networking 4 ICTNWK506 Assessment v01 Page 83

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Campus# show ip dhcp binding
(Instructor Initial ________ Date___________)
Observations
After saving the running-configuration files to NVRAM on both routers, set the PC TCP/IP
properties on both PCs to “Obtain an IP address automatically”.
Reboot the PCs.
Open a command line window (Start Run cmd) and display the configuration of each PC
using:
C:\> ipconfig
Confirm that the PCs can ping each other and the ISP router.
Confirm, again, that the bindings for the hosts, including their MAC addresses, lease expiry
times and type, can be seen by issuing the command:
Campus# show ip dhcp binding
Networking 4 ICTNWK506 Assessment v01 Page 84

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Method: (Part 2) Routing between DHCP enabled networks
The purpose of this section of the lab is to allocate IP addresses to the two PCs by
configuring DHCP servers on the Campus and Remote routers. OSPF will be used to route IP
packets between subnets 172.16.12.0 /24 and 172.16.13.0 /24.
Campus Remote
Switch
PC-1 PC-2
Serial0/0
DCE
172.16.1.5 / 30
Serial0/0
DTE
172.16.1.6 / 30
Fastethenet0/0
172.16.12.1 / 24
PC-1 will obtain its IP address automatically
using DHCP.
Use OSPF to route between subnets 172.16.13.0 and 172.16.12.0
Switch
Fastethenet0/0
172.16.13.1 / 24
Networking 4 ICTNWK506 Assessment v01 Page 85

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task 1: Basic Router Configuration
Basic Remote Router Configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Remote
Remote(config)# line console 0
Remote(config-line)# logging synchronous
Remote(config-line)# exit
Remote(config)# ip host Campus 172.16.1.6 172.16.12.1
Remote(config)# no ip domain-lookup
Remote(config)# banner motd # 
This is a Remote router #
Remote(config)# enable secret class
Remote(config)# enable password cisco
Remote(config)# line vty 0 4
Remote(config-line)# login
Remote(config-line)# password cisco
Remote(config-line)# exit
Remote(config)# interface serial0/0
Remote(config-if)# description DCE Link to Campus
Remote(config-if)# ip address 172.16.1.5 255.255.255.252
Remote(config-if)# clock rate 64000
Remote(config-if)# no shutdown
Remote(config-if)# interface fastethernet0/0
Remote(config-if)# description Default gateway for the Remote network
Remote(config-if)# ip address 172.16.13.1 255.255.255.0
Remote(config-if)# no shutdown
Remote(config-if)# exit
Remote(config-if)# CTRL-Z
Remote# show running-config
Remote# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 86

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Basic Campus Router Configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Campus
Campus(config)# line console 0
Campus(config-line)# logging synchronous
Campus(config-line)# exit
Campus(config)# ip host Remote 172.16.1.5
Campus(config)# no ip domain-lookup
Campus(config)# banner motd # 
This is a Campus router #
Campus(config)# enable secret class
Campus(config)# enable password cisco
Campus(config)# line vty 0 4
Campus(config-line)# login
Campus(config-line)# password cisco
Campus(config-line)# exit
Campus(config)# interface serial0/0
Campus(config-if)# description DTE Link to Remote
Campus(config-if)# ip address 172.16.1.6 255.255.255.252
Campus(config-if)# no shutdown
Campus(config-if)# interface fastethernet0/0
Campus(config-if)# description Default gateway for the Campus network
Campus(config-if)# ip address 172.16.12.1 255.255.255.0
Campus(config-if)# no shutdown
Campus(config-if)# exit
Campus(config-if)# CTRL-Z
Campus# show running-config
Campus# copy run start
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 87

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Taks 2: Configuring OSPF Dynamic Routing
Remote Router Configuration
Establish dynamic routing on the Remote router:
Remote(config)# router ospf 1
Remote(config-router)# network 172.16.1.0 0.0.0.255 area 0
Remote(config-router)# network 172.16.13.0 0.0.0.255 area 0
Campus Router Configuration
Establish dynamic routing on the Campus router:
Campus(config)# router ospf 1
Campus(config-router)# network 172.16.1.0 0.0.0.255 area 0
Campus(config-router)# network 172.16.12.0 0.0.0.255 area 0
Wait, and then confirm that the routing table is correctly populated for both routers:
Remote# show ip route
Campus# show ip route
Save the configuration for both routers:
Remote# copy running-config startup-config
Campus# copy running-config startup-config
(Instructor Initial ________ Date___________)
Task 3: Configuring DHCP
Both routers will now act as DHCP servers for PCs on each of their respective subnets.
Campus Router Configuration
Define the DHCP parameters, that will be used to allocated IP addresses
Campus(config)# ip dhcp pool Campus
Networking 4 ICTNWK506 Assessment v01 Page 88

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Campus(dhcp-config)# network 172.16.12.0 255.255.255.0
Campus(dhcp-config)# default-router 172.16.12.1
Campus(dhcp-config)# dns-server 172.16.12.2
Campus(dhcp-config)# domain-name ciscoclass.net
Campus(dhcp-config)# netbios-name-server 172.16.12.10
Campus(dhcp-config)# exit
Campus(config)# ip dhcp excluded-address 172.16.12.1 172.16.12.10
Remote Router Configuration
Define the DHCP parameters, that will be used to allocated IP addresses
Remote(config)# ip dhcp pool Remote
Remote(dhcp-config)# network 172.16.13.0 255.255.255.0
Remote(dhcp-config)# default-router 172.16.13.1
Remote(dhcp-config)# dns-server 172.16.13.2
Remote(dhcp-config)# domain-name ciscoclass.net
Remote(dhcp-config)# netbios-name-server 172.16.13.10
Remote(dhcp-config)# exit
Remote(config)# ip dhcp excluded-address 172.16.13.1 172.16.13.10
Verifying Campus Router Bindings
Confirm that the bindings for the hosts, including their MAC addresses, lease expiry times
and type, can be seen by issuing the command:
Campus# show ip dhcp binding
Remote# show ip dhcp binding
(Instructor Initial ________ Date___________)
Observations
After saving the running-configuration files to NVRAM on both routers, set the PC TCP/IP
Networking 4 ICTNWK506 Assessment v01 Page 89

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
properties on both PCs to “Obtain an IP address automatically”.
Reboot the PCs.
Open a command line window (Start Run cmd) and display the configuration of each PC
using:
C:\> ipconfig
Confirm that the PCs can ping each other and the Remote router.
Networking 4 ICTNWK506 Assessment v01 Page 90

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4 ICTNWK506 Assessment v01 Page 91

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Method: (Part 3) DHCP Relay
The purpose of this section of the lab is to allocate IP addresses to the two PCs by
configuring DHCP servers on the Remote router only. DHCP Relay will be used to forward
DHCP requests from PC-1 to the DHCP server on the Remote router. OSPF is used to router
IP packets between subnets 172.16.12.0 /24 and 172.16.13.0 /24.
Campus Remote
Switch
PC-1 PC-2
Serial0/0
DCE
172.16.1.5 / 30
Serial0/0
DTE
172.16.1.6 / 30
Fastethenet0/0
172.16.12.1 / 24
PC-1 will obtain its IP address automatically
using DHCP Relay.
Use OSPF to route between subnets 172.16.13.0 and 172.16.12.0
Switch
Fastethenet0/0
172.16.13.1 / 24
Networking 4 ICTNWK506 Assessment v01 Page 92

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task1: Basic Router Configuration
Basic Remote Router Configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Remote
Remote(config)# line console 0
Remote(config-line)# logging synchronous
Remote(config-line)# exit
Remote(config)# ip host Campus 172.16.1.6 172.16.12.1
Remote(config)# no ip domain-lookup
Remote(config)# banner motd # 
This is a Remote router #
Remote(config)# enable secret class
Remote(config)# enable password cisco
Remote(config)# line vty 0 4
Remote(config-line)# login
Remote(config-line)# password cisco
Remote(config-line)# exit
Remote(config)# interface serial0/0
Remote(config-if)# description DCE Link to Campus
Remote(config-if)# ip address 172.16.1.5 255.255.255.252
Remote(config-if)# clock rate 64000
Remote(config-if)# no shutdown
Remote(config-if)# interface fastethernet0/0
Remote(config-if)# description Default gateway for the Remote network
Remote(config-if)# ip address 172.16.13.1 255.255.255.0
Remote(config-if)# no shutdown
Remote(config-if)# exit
Remote(config-if)# CTRL-Z
Remote# show running-config
Remote# copy run start
Networking 4 ICTNWK506 Assessment v01 Page 93

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Basic Campus Router Configuration
Router> enable
Router# erase startup-config
Router# reload
Router> enable
Router# config t
Router(config)# hostname Campus
Campus(config)# line console 0
Campus(config-line)# logging synchronous
Campus(config-line)# exit
Campus(config)# ip host Remote 172.16.1.5
Campus(config)# no ip domain-lookup
Campus(config)# banner motd # 
This is a Campus router #
Campus(config)# enable secret class
Campus(config)# enable password cisco
Campus(config)# line vty 0 4
Campus(config-line)# login
Campus(config-line)# password cisco
Campus(config-line)# exit
Campus(config)# interface serial0/0
Campus(config-if)# description DTE Link to Remote
Campus(config-if)# ip address 172.16.1.6 255.255.255.252
Campus(config-if)# no shutdown
Campus(config-if)# interface fastethernet0/0
Campus(config-if)# description Default gateway for the Campus network
Campus(config-if)# ip address 172.16.12.1 255.255.255.0
Campus(config-if)# no shutdown
Campus(config-if)# exit
Campus(config-if)# CTRL-Z
Campus# show running-config
Campus# copy run start
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 94

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Task2: Configuring OSPF Dynamic Routing
Remote Router Configuration
Establish dynamic routing on the Remote router:
Remote(config)# router ospf 1
Remote(config-router)# network 172.16.1.0 0.0.0.255 area 0
Remote(config-router)# network 172.16.13.0 0.0.0.255 area 0
Campus Router Configuration
Establish dynamic routing on the Campus router:
Campus(config)# router ospf 1
Campus(config-router)# network 172.16.1.0 0.0.0.255 area 0
Campus(config-router)# network 172.16.12.0 0.0.0.255 area 0
Wait, and then confirm that the routing table is correctly populated for both routers:
Remote# show ip route
Campus# show ip route
Save the configuration for both routers:
Remote# copy running-config startup-config
Campus# copy running-config startup-config
Task 3: Configuring DHCP
The Remote router will now act as a DHCP server for PCs on each of their respective
subnets.
Remote Router Configuration
Define the DHCP parameters, that will be used to allocated IP addresses
Remote(config)# ip dhcp pool Remote
Networking 4 ICTNWK506 Assessment v01 Page 95

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Remote(dhcp-config)# network 172.16.13.0 255.255.255.0
Remote(dhcp-config)# default-router 172.16.13.1
Remote(dhcp-config)# dns-server 172.16.13.2
Remote(dhcp-config)# domain-name ciscoclass13.net
Remote(dhcp-config)# netbios-name-server 172.16.13.10
Remote(dhcp-config)# exit
Remote(config)# ip dhcp excluded-address 172.16.13.1 172.16.13.10
Remote(config)# ip dhcp pool Campus
Remote(dhcp-config)# network 172.16.12.0 255.255.255.0
Remote(dhcp-config)# default-router 172.16.12.1
Remote(dhcp-config)# dns-server 172.16.12.2
Remote(dhcp-config)# domain-name ciscoclass12.net
Remote(dhcp-config)# netbios-name-server 172.16.12.10
Remote(dhcp-config)#exit
Remote(config)# ip dhcp excluded-address 172.16.12.1 172.16.12.10
Task 4: Configuring a Helper Address and the Directed Broadcasting of
DHCP Requests
PC-1 will obtain its DHCP IP address from the Remote router where the DHCP servers have
been configured. To s this both a helper address and broadcast forwarding must be enabled.
On the Campus router Fastethernet interface type:
Campus(config)# interface fa0/0
Campus(config-if)# ip helper-address 172.16.13.1
Campus(config-if)# CTRL-Z
Campus# show running-config
Campus# copy run start
On the Remote router Fastethernet interface type:
Remote(config)# interface fa0/0
Remote(config-if)# ip directed-broadcast
Remote(config-if)# CTRL-Z
Remote# show running-config
Remote# copy run start
Verifying Campus Router Bindings
Confirm that the bindings for the hosts, including their MAC addresses, lease expiry times
Networking 4 ICTNWK506 Assessment v01 Page 96

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
and type, can be seen by issuing the command:
Campus# show ip dhcp binding
Remote# show ip dhcp binding
(Instructor Initial ________ Date___________)
Observations
After saving the running-configuration files to NVRAM on both routers, set the PC TCP/IP
properties on both PCs to “Obtain an IP address automatically”.
Reboot the PCs.
Open a command line window (Start Run cmd) and display the configuration of each PC
using:
C:\> ipconfig
Confirm that the PCs can ping each other and the ISP router.
Networking 4 ICTNWK506 Assessment v01 Page 97

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 7
Configuring a VPN (GRE)
Aim
To configure a VPN using Generic Route Encapsulation (GRE)
Method: Topology
The purpose of this section of the lab is to create a VPN tunnel between two routers using
GRE. Set up the following topology using the table of IP address allocations.
Networking 4 ICTNWK506 Assessment v01 Page 98

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Addressing Table
Device Interface IP Address Subnet Mask Default Gateway
RA
G0/0 192.168.1.1 255.255.255.0 N/A
S0/0/0 64.103.211.2 255.255.255.252 N/A
Tunnel 0 10.10.10.1 255.255.255.252 N/A
RB
G0/0 192.168.2.1 255.255.255.0 N/A
S0/0/0 209.165.122.2 255.255.255.252 N/A
Tunnel 0 10.10.10.2 255.255.255.252 N/A
PC-A NIC 192.168.1.2 255.255.255.0 192.168.1.1
PC-C NIC 192.168.2.2 255.255.255.0 192.168.2.1
Objectives
Part 1: Verify Router Connectivity
Part 2: Configure GRE Tunnels
Part 3: Verify PC Connectivity
Scenario
You are the network administrator for a company which wants to set up a GRE tunnel to a remote
office. Both networks are locally configured, and need only the tunnel configured.
Networking 4 ICTNWK506 Assessment v01 Page 99

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Part 1: Verify Router Connectivity
Step 1: Ping RA from RB.
a. Use the show ip interface brief command on RA to determine the IP address of the
S0/0/0 port.
Serial0/0/0 64.103.211.2 YES manual up up
b. From RB ping the IP S0/0/0 address of RA.
Step 2: Ping PCA from PCB.
Attempt to ping the IP address of PCA from PCB. We will repeat this test after configuring the
GRE tunnel. What were the ping results? Why?
NO
No route is configured to route packeckets within the network
(Instructor Initial ________ Date___________)
Part 2: Configure GRE Tunnels
Step 1: Configure the Tunnel 0 interface of RA.
a. Enter into the configuration mode for RA Tunnel 0.
RA(config)# interface tunnel 0
b. Set the IP address as indicated in the Addressing Table.
Networking 4 ICTNWK506 Assessment v01 Page 100

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
RA(config-if)# ip address 10.10.10.1 255.255.255.252
c. Set the source and destination for the endpoints of Tunnel 0.
RA(config-if)# tunnel source s0/0/0
RA(config-if)# tunnel destination 209.165.122.2
d. Configure Tunnel 0 to convey IP traffic over GRE.
RA(config-if)# tunnel mode gre ip
e. The Tunnel 0 interface should already be active. In the event that it is not, treat it like
any other interface.
RA(config-if)# no shutdown
Step 2: Configure the Tunnel 0 interface of RB.
Repeat Steps 1a – e with RB. Be sure to change the IP addressing as appropriate.
RB(config)# interface tunnel 0
RB(config-if)# ip address 10.10.10.2 255.255.255.252
RB(config-if)# tunnel source s0/0/0
RB(config-if)# tunnel destination 64.103.211.2
RB(config-if)# tunnel mode gre ip
RB(config-if)# no shutdown
Step 3: Configure a route for private IP traffic.
Establish a route between the 192.168.X.X networks using the 10.10.10.0/30 network as the
destination.
RA(config)# ip route 192.168.2.0 255.255.255.0 10.10.10.2
RB(config)# ip route 192.168.1.0 255.255.255.0 10.10.10.1
(Instructor Initial ________ Date___________)
Part 3: Verify Router Connectivity
Step 1: Ping PCA from PCB.
Attempt to ping the IP address of PCA from PCB. The ping should be successful.
Step 2: Trace the path from PCA to PCB.
Attempt to trace the path from PCA to PCB. Note the lack of public IP addresses in the output.
Device Configs
Router RA
no service timestamps log datetime msec
no service timestamps debug datetime msec
Networking 4 ICTNWK506 Assessment v01 Page 101

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
no service password-encryption
hostname RA
license udi pid CISCO2911/K9 sn FTX15242579
spanning-tree mode pvst
interface Tunnel0
ip address 10.10.10.1 255.255.255.252
tunnel source Serial0/0/0
tunnel destination 209.165.122.2
tunnel mode gre ip
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
shutdown
interface GigabitEthernet0/2
no ip address
duplex auto
speed auto
shutdown
interface Serial0/0/0
ip address 64.103.211.2 255.255.255.252
interface Serial0/0/1
no ip address
shutdown
interface Vlan1
no ip address
shutdown
ip classless
ip route 192.168.2.0 255.255.255.0 10.10.10.2
ip route 0.0.0.0 0.0.0.0 Serial0/0/0
line con 0
line aux 0
line vty 0 4
login
end
Router RB
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
license udi pid CISCO2911/K9 sn FTX152497Z4
spanning-tree mode pvst
interface Tunnel0
ip address 10.10.10.2 255.255.255.252
Networking 4 ICTNWK506 Assessment v01 Page 102

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
tunnel source Serial0/0/0
tunnel destination 64.103.211.2
tunnel mode gre ip
interface GigabitEthernet0/0
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
shutdown
interface GigabitEthernet0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0/0
ip address 209.165.122.2 255.255.255.252
!
interface Serial0/0/1
no ip address
shutdown
interface Vlan1
no ip address
shutdown
ip classless
ip route 192.168.1.0 255.255.255.0 10.10.10.1
ip route 0.0.0.0 0.0.0.0 Serial0/0/0
line con 0
line aux 0
line vty 0 4
login
end
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 103

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 8
Configuring IPv6
Instructions
- Successful completion of this lab will require you configure static and default routes, using
the following toplogy
Networking 4 ICTNWK506 Assessment v01 Page 104

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Addressing Table
Device Interface IPv6 Address / Prefix Length Default Gateway
R1 G0/1 2001:DB8:ACAD:A::/64 eui-64 N/A
S0/0/1 FC00::1/64 N/A
R3 G0/1 2001:DB8:ACAD:B::/64 eui-64 N/A
S0/0/0 FC00::2/64 N/A
PC-A NIC SLAAC SLAAC
PC-C NIC SLAAC SLAAC
Objectives
Part 1: Build the Network and Configure Basic Device Settings Enable IPv6 unicast routing and configure IPv6 addressing on the routers. Disable IPv4 addressing and enable IPv6 SLAAC for the PC network interfaces. Use ipconfig and ping to verify LAN connectivity. Use show commands to verify IPv6 settings.
Part 2: Configure IPv6 Static and Default Routes Configure a directly attached IPv6 static route. Configure a recursive IPv6 static route. Configure a default IPv6 static route.
Background / Scenario
In this lab, you will configure the entire network to communicate using only IPv6 addressing,
including configuring the routers and PCs. You will use stateless address auto-configuration
(SLAAC) for configuring the IPv6 addresses for the hosts. You will also configure IPv6 static and
default routes on the routers to enable communication to remote networks that are not directly
connected.
Note: The routers used with CCNA hands-on labs are Cisco 1941 Integrated Services Routers
(ISRs) with Cisco IOS Release 15.2(4)M3 (universalk9 image). The switches used are Cisco
Catalyst 2960s with Cisco IOS Release 15.0(2) (lanbasek9 image). Other routers, switches, and
Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands
available and output produced might vary from what is shown in the labs. Refer to the Router
Interface Summary Table at the end of this lab for the correct interface identifiers.
Note: Make sure that the routers and switches have been erased and have no startup
configurations. If you are unsure, contact your instructor.
Required Resources 2 Routers (Cisco 1941 with Cisco IOS Release 15.2(4)M3 universal image or comparable) 2 Switches (Cisco 2960 with Cisco IOS Release 15.0(2) lanbasek9 image or comparable) 2 PCs (Windows 7, Vista, or XP with terminal emulation program, such as Tera Term) Console cables to configure the Cisco IOS devices via the console ports
Networking 4 ICTNWK506 Assessment v01 Page 105

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2 Ethernet and serial cables as shown in the topology
Part 4: Build the Network and Configure Basic Device Settings
In Part 1, you will cable and configure the network to communicate using IPv6 addressing.
Step 1: Cable the network as shown in the topology diagram.
Step 2: Initialize and reload the routers and switches.
Step 1: Enable IPv6 unicast routing and configure IPv6 addressing on the routers.
a. Using Tera Term, console into the router labeled R1 in the topology diagram and assign the
router the name R1.
b. Within global configuration mode, enable IPv6 routing on R1.
R1(config)# ipv6 unicast-routing
c. Configure the network interfaces on R1 with IPv6 addresses. Notice that IPv6 is enabled on
each interface. The G0/1 interface has a globally routable unicast address and EUI-64 is used
to create the interface identifier portion of the address. The S0/0/1 interface has a privately
routable, unique-local address, which is recommended for point-to-point serial connections.
R1(config)# interface g0/1
R1(config-if)# ipv6 address 2001:DB8:ACAD:A::/64 eui-64
R1(config-if)# no shutdown
R1(config-if)# interface serial 0/0/1
R1(config-if)# ipv6 address FC00::1/64
R1(config-if)# no shutdown
R1(config-if)# exit
d. Assign a device name to router R3.
e. Within global configuration mode, enable IPv6 routing on R3.
R3(config)# ipv6 unicast-routing
f. Configure the network interfaces on R3 with IPv6 addresses. Notice that IPv6 is enabled on
each interface. The G0/1 interface has a globally routable unicast address and EUI-64 is used
to create the interface identifier portion of the address. The S0/0/0 interface has a privately
routable, unique-local address, which is recommended for point-to-point serial connections.
The clock rate is set because it is the DCE end of the serial cable.
R3(config)# interface gigabit 0/1
R3(config-if)# ipv6 address 2001:DB8:ACAD:B::/64 eui-64
R3(config-if)# no shutdown
R3(config-if)# interface serial 0/0/0
R3(config-if)# ipv6 address FC00::2/64
R3(config-if)# clock rate 128000
R3(config-if)# no shutdown
R3(config-if)# exit
Networking 4 ICTNWK506 Assessment v01 Page 106

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Step 2: Disable IPv4 addressing and enable IPv6 SLAAC for the PC network
interfaces.
a. On both PC-A and PC-C, navigate to the Start menu > Control Panel. Click the Network
and Sharing Center link while viewing with icons. In the Network and Sharing Center
window, click the Change adapter settings link on the left side of the window to open the
Network Connections window.
b. In the Network Connections window, you see the icons for your network interface adapters.
Double-click the Local Area Connection icon for the PC network interface that is connected to
the switch. Click the Properties to open the Local Area Connection Properties dialogue
window.
c. With the Local Area Connection Properties window open, scroll down through the items and
uncheck the item Internet Protocol Version 4 (TCP/IPv4) check box to disable the IPv4
protocol on the network interface.
d. With the Local Area Connection Properties window still open, click the Internet Protocol
Version 6 (TCP/IPv6) check box, and then click Properties.
e. With the Internet Protocol Version 6 (TCP/IPv6) Properties window open, check to see if the
radio buttons for Obtain an IPv6 address automatically and Obtain DNS server address
automatically are selected. If not, select them.
f. With the PCs configured to obtain an IPv6 address automatically, they will contact the routers
to obtain the network subnet and gateway information, and auto-configure their IPv6 address
information. In the next step, you will verify the settings.
Step 3: Use ipconfig and ping to verify LAN connectivity.
a. From PC-A, open a command prompt, type ipconfig /all and press Enter. The output should
look similar to that shown below. In the output, you should see that the PC now has an IPv6
global unicast address, a link-local IPv6 address, and a link-local IPv6 default gateway
address. You may also see a temporary IPv6 address and under the DNS server addresses,
three site-local addresses that start with FEC0. Site-local addresses are private addresses
that were meant to be backwards compatible with NAT. However, they are not supported in
IPv6 and are replaced by unique-local addresses.
C:\Users\User1> ipconfig /all
Windows IP Configuration
<Output omitted>
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) 82577LC Gigabit Network
Connection
Physical Address. . . . . . . . . : 1C-C1-DE-91-C3-5D
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . :
2001:db8:acad:a:7c0c:7493:218d:2f6c(Preferred)
Temporary IPv6 Address. . . . . . :
2001:db8:acad:a:bc40:133a:54e7:d497(Preferred)
Link-local IPv6 Address . . . . . : fe80::7c0c:7493:218d:2f6c
%13(Preferred)
Networking 4 ICTNWK506 Assessment v01 Page 107

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Default Gateway . . . . . . . . . : fe80::6273:5cff:fe0d:1a61%13
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Disabled
Based on your network implementation and the output of the ipconfig /all command, did PC-
A receive IPv6 addressing information from R1?
YES
__________________________________________________________________________
__________________________________________________________________________
b. What is the PC-A global unicast IPv6 address?
2001:DB8:ACAD:A:20B:BEFF:FE25:B207/64
__________________________________________________________________________
c. What is the PC-A link-local IPv6 address?
FE80::20B:BEFF:FE25:B207
__________________________________________________________________________
d. What is the PC-A default gateway IPv6 address?
FE80::260:3EFF:FEA1:5A02
__________________________________________________________________________
e. From PC-A, use the ping -6 command to issue an IPv6 ping to the link-local default gateway
address. You should see replies from the R1 router.
C:\Users\User1> ping -6 <default-gateway-address>
Did PC-A receive replies to the ping from PC-A to R1? __YES________
f. Repeat Step 5a from PC-C.
Did PC-C receive IPv6 addressing information from R3? _YES_________
g. What is the PC-C global unicast IPv6 address?
2001:DB8:ACAD:B:290:21FF:FE05:C105/64
__________________________________________________________________________
h. What is the PC-C link-local IPv6 address?
FE80::290:21FF:FE05:C105
__________________________________________________________________________
i. What is the PC-C default gateway IPv6 address?
FE80::260:3EFF:FEA2:9B02
__________________________________________________________________________
j. From PC-C, use the ping -6 command to ping the PC-C default gateway.
Did PC-C receive replies to the pings from PC-C to R3? ___YES_______
k. Attempt an IPv6 ping -6 from PC-A to the PC-C IPv6 address.
C:\Users\User1> ping -6 PC-C-IPv6-address
Networking 4 ICTNWK506 Assessment v01 Page 108

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Was the ping successful? Why or why not?
__NO______________________________________________________________________
__
The route is not
discovered__________________________________________________________
______
Step 4: Use show commands to verify IPv6 settings.
a. Check the status of the interfaces on R1 with the show ipv6 interface brief command.
What are the two IPv6 addresses for the G0/1 interface and what kind of IPv6 addresses are
they?
FE80::260:3EFF:FEA1:5A02
2001:DB8:ACAD:A:260:3EFF:FEA1:5A02
They are link local addresses and global unicast address.
__________________________________________________________________________
__________________________________________________________________________
What are the two IPv6 addresses for the S0/0/1 interface and what kind of IPv6 addresses
are they?
FE80::260:3EFF:FEA1:5A01
FC00::1
__________________________________________________________________________
__________________________________________________________________________
b. To see more detailed information on the IPv6 interfaces, type a show ipv6 interface
command on R1 and press Enter.
What are the multicast group addresses for the Gigabit Ethernet 0/1 interface?
FF02::1
FF02::2
FF02::1:FFA1:5A02
__________________________________________________________________________
What are the multicast group addresses for the S0/0/1 interface?
FF02::1
FF02::2
FF02::1:FF00:1
FF02::1:FFA1:5A01
__________________________________________________________________________
What is an FF02::1 multicast address used for?
Internetwork control
__________________________________________________________________________
What is an FF02::2 multicast address used for?
Networking 4 ICTNWK506 Assessment v01 Page 109

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Used to communicate with dynamic groupings
__________________________________________________________________________
What kind of multicast addresses are FF02::1:FF00:1 and FF02::1:FF0D:1A60, and what are
they used for?
They are unicast/anycast addresses
__________________________________________________________________________
__________________________________________________________________________
c. View the IPv6 routing table information for R1 using the show ipv6 route command. The
IPv6 routing table should have two connected routes, one for each interface, and three local
routes, one for each interface and one for multicast traffic to a Null0 interface.
In what way does the routing table output of R1 reveal why you were unable to ping PC-C
from PC-A?
We only have local and connected interfaces making packets not able to be routed outside
the network.
__________________________________________________________________________
__________________________________________________________________________
Part 5: Configure IPv6 Static and Default Routes
In Part 2, you will configure IPv6 static and default routes three different ways. You will confirm
that the routes have been added to the routing tables, and you will verify successful connectivity
between PC-A and PC-C.
You will configure three types of IPv6 static routes: Directly Connected IPv6 Static Route – A directly connected static route is created when
specifying the outgoing interface. Recursive IPv6 Static Route – A recursive static route is created when specifying the next-
hop IP address. This method requires the router to execute a recursive lookup in the routing
table in order to identify the outgoing interface. Default IPv6 Static Route – Similar to a quad zero IPv4 route, a default IPv6 static route is
created by making the destination IPv6 prefix and prefix length all zeros, ::/0.
Step 1: Configure a directly connected IPv6 static route.
In a directly connected IPv6 static route, the route entry specifies the router outgoing interface. A
directly connected static route is typically used with a point-to-point serial interface. To configure a
directly attached IPv6 static route, use the following command format:
Router(config)# ipv6 route <ipv6-prefix/prefix-length> <outgoing-
interface-type> <outgoing-interface-number>
a. On router R1, configure an IPv6 static route to the 2001:DB8:ACAD:B::/64 network on R3,
using the R1 outgoing S0/0/1 interface.
R1(config)# ipv6 route 2001:DB8:ACAD:B::/64 serial 0/0/1
R1(config)#
b. View the IPv6 routing table to verify the new static route entry.
What is the code letter and routing table entry for the newly added route in the routing table?
S 2001:DB8:ACAD:B::/64 [1/0]
Networking 4 ICTNWK506 Assessment v01 Page 110

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
via ::, Serial0/0/1
__________________________________________________________________________
c. Now that the static route has been configured on R1, is it now possible to ping the host PC-C
from PC-A?
__________________________________________________________________________
These pings should fail. If the recursive static route is correctly configured, the ping arrives at
PC-C. PC-C sends a ping reply back to PC-A. However, the ping reply is discarded at R3
because R3 does not have a return route to the 2001:DB8:ACAD:A::/64 network in the routing
table. To successfully ping across the network, you must also create a static route on R3.
d. On router R3, configure an IPv6 static route to the 2001:DB8:ACAD:A::/64 network, using the
R3 outgoing S0/0/0 interface.
R3(config)# ipv6 route 2001:DB8:ACAD:A::/64 serial 0/0/0
R3(config)#
e. Now that both routers have static routes, attempt an IPv6 ping -6 from PC-A to the PC-C
global unicast IPv6 address.
Was the ping successful? Why?
YES
Routing has been enabled_____________
Step 2: Configure a recursive IPv6 static route.
In a recursive IPv6 static route, the route entry has the next-hop router IPv6 address. To configure
a recursive IPv6 static route, use the following command format:
Router(config)# ipv6 route <ipv6-prefix/prefix-length> <next-hop-
ipv6-address>
a. On router R1, delete the directly attached static route and add a recursive static route.
R1(config)# no ipv6 route 2001:DB8:ACAD:B::/64 serial 0/0/1
R1(config)# ipv6 route 2001:DB8:ACAD:B::/64 FC00::2
R1(config)# exit
b. On router R3, delete the directly attached static route and add a recursive static route.
R3(config)# no ipv6 route 2001:DB8:ACAD:A::/64 serial 0/0/0
R3(config)# ipv6 route 2001:DB8:ACAD:A::/64 FC00::1
R3(config)# exit
c. View the IPv6 routing table on R1 to verify the new static route entry.
What is the code letter and routing table entry for the newly added route in the routing table?
S 2001:DB8:ACAD:B::/64 [1/0]
via
FC00::2___________________________________________________________________
______
d. Verify connectivity by issuing a ping -6 command from PC-A to PC-C.
Was the ping successful? ________YES______
Note: It may be necessary to disable the PC firewall to ping between PCs.
Networking 4 ICTNWK506 Assessment v01 Page 111

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Step 3: Configure a default IPv6 static route.
In a default static route, the destination IPv6 prefix and prefix length are all zeros.
Router(config)# ipv6 route ::/0 <outgoing-interface-type> <outgoing-
interface-number> {and/or} <next-hop-ipv6-address>
a. On router R1, delete the recursive static route and add a default static route.
R1(config)# no ipv6 route 2001:DB8:ACAD:B::/64 FC00::2
R1(config)# ipv6 route ::/0 serial 0/0/1
R1(config)#
b. Delete the recursive static route and add a default static route on R3.
c. View the IPv6 routing table on R1 to verify the new static route entry.
What is the code letter and routing table entry for the newly added default route in the routing
table?
____________________S_____________________________________________________
___________
d. Verify connectivity by issuing a ping -6 command from PC-A to PC-C.
Was the ping successful? _____NO________
Note: It may be necessary to disable the PC firewall to ping between PCs.
Reflection
1. This lab focuses on configuring IPv6 static and default routes. Can you think of a situation where
you would need to configure both IPv6 and IPv4 static and default routes on a router?
Default routes are necessary for cases where a device may not have specified route, its packets
will be routed using default route
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
2. In practice, configuring an IPv6 static and default route is very similar to configuring an IPv4 static
and default route. Aside from the obvious differences between the IPv6 and IPv4 addressing,
what are some other differences when configuring and verifying an IPv6 static route as compared
to an IPv4 static route?
For IPv6, to enable routing, one has to use ipv6 unicast-routing command to enable IPv6 routing.
Additionally, during verification, one has to use show ipv6 route command to view routing table.
Networking 4 ICTNWK506 Assessment v01 Page 112

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Router Interface Summary Table
Router Interface Summary
Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2
1800 Fast Ethernet 0/0
(F0/0)
Fast Ethernet 0/1
(F0/1)
Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
1900 Gigabit Ethernet 0/0
(G0/0)
Gigabit Ethernet 0/1
(G0/1)
Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
2801 Fast Ethernet 0/0
(F0/0)
Fast Ethernet 0/1
(F0/1)
Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)
2811 Fast Ethernet 0/0
(F0/0)
Fast Ethernet 0/1
(F0/1)
Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
2900 Gigabit Ethernet 0/0
(G0/0)
Gigabit Ethernet 0/1
(G0/1)
Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many
interfaces the router has. There is no way to effectively list all the combinations of configurations for each router
class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device.
The table does not include any other type of interface, even though a specific router may contain one. An
example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be
used in Cisco IOS commands to represent the interface.
(Instructor Initial ________ Date___________)
Networking 4 ICTNWK506 Assessment v01 Page 113

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Networking 4
Laboratory 9
Configuring ADSL
Instructions
- Successful completion of this lab will require you to research and list the steps in
configuring am ADSL connection for a small business enterprise.
Task 1: Configuration.
With the aid of a logical topology diagram, list and describe the steps that you would take to
configure and ADSL modem connection
Steps
1. Power the ADSL device, use patch code to connect the device on
your computer.
2. Assign your computer an IP address which is in the subnebt range
of the ADSL.
NB. The default gateway should be the default IP address of the
ADSL.
3. Open your computer browser and enter the ADSL’s IP address.
Press enter.
4. Type admin username and password. Usually, the defaults are,
admin admin. Click on Login
5. Select Setup tab. Select Connection tab
6. Configure the following parameters:
i. Type: PPPoA
ii. Name: type connection name
iii. Encapsulation: enter encapsulation advised by ISP
iv. Password : enter ISP username
v. Password: enter login secret word
vi. Keep alive: __________
vii. Max fail: ___________
viii. MTU __________
ix. MRU ___________
x. Set route ________activate the set route
xi. VPI __________enter ISP advised settings
Networking 4 ICTNWK506 Assessment v01 Page 114

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
xii. VCI: enter ISP provided settings
xiii. QoS ________
xiv. PCR ____________
Press apply.
7. Select status tab, activate the status tab
8. Select tools, system commands, click on save all.
Networking 4 ICTNWK506 Assessment v01 Page 115

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
(Instructor Initial ________ Date___________)
Sample configuration steps:
Step 1. Open up a web browser and type in theIP address of the ADSL router(default is 192.168.1.1). PressEnter.
Step 2. Enter the Login nameand password (default is admin/admin). Click onLogin.
Step 3. Click on the Setup tabat the top and then click on Connection 1 on theleft.
Networking 4 ICTNWK506 Assessment v01 Page 116

Course No/s: ICT50415_R2
Training Package: ICT01 v02 National Code: ICT50415_R2
Step 4. Configure the following for yourconnection: Type - Set the connection Type to PPPoA Name - Type in the name for theconnection Options - Enable the NAT and Firewalloptions Encapsulation - set to VC Username - Type in the ISP login username Password - Type in the login password Keep alive - leave default MAX Fail - leave default MRU - leave default Set Route - enable set route VPI - set to ISP recommended settings (i.e. 0)(UK ADSL commonly uses VPI=0 and VCI=38) VCI - set to ISP recommended settings (i.e.38) (UK ADSL commonly uses VPI=0 and VCI=38) QoS - leave default PCR - leave default SCR - leave default
Click on Apply.
Step 5. Click on the Statustab at the top. Click on Connection Statuson the left side. The Connection information
can be seen in the WANsection of the page.
Step 6. Click on Tools at thetop. Click on System Commands on the left. Clickon Save All to permanently
save the changes.
Networking 4 ICTNWK506 Assessment v01 Page 117