Answers to Chapter 4 Configuration Exercises
Refer to Figure 4 28 for Configuration Exercises 1-5
Figure 4 28 The Internetwork for Configuration Exercises 1-5
Figure 4 28 The Internetwork for Configuration Exercises 1-5
SVR3
AS 3
172 16 0 0/16 ISP1 block:
201 50 13 0/24
ISP2 block:
200 100 30 0/24
~irt so
RTR2
1 ISP1 in Figure 4 28 has assigned the address block 201 50 13 0/24 to AS 3 ISP2 has assigned the address block 200 100 30 0/24 to AS 3 RTR1 and RTR2 are accepting full BGP routes from the ISP routers but do not transmit any routes to the ISPs They run IBGP between them and OSPF on all Ethernet interfaces No routes are redistributed between BGP and OSPF The addresses of the router interfaces are as
|
follows |
||
|
RTR1 |
E0 |
172 16 3 1/24 |
|
RTR1 |
El |
172 16 2 1/24 |
|
RTR1 |
SO |
201 50 26 13/30 |
|
RTR2 |
E0 |
172 16 3 2/24 |
|
RTR2 |
El |
172 16 1 1/24 |
|
RTR2 |
SO |
200 100 29 241/30 |
SVR1 is the DNS server authoritative for AS 3 its address is 172 16 3 3 DNS1 reaches SVR1 at 201 50 13 1 whereas DNS2 reaches the same server at 200 100 30 254 Write routing and NAT configurations for RTR1 and RTR2
translating inside addresses appropriately for each ISP s assigned address block Any inside device must be able to reach either ISP but no packets can leave AS 3 with a private source address under any circumstance
Answer:
RTR1
interface Loopback0 ip address 172 16 255 2 255 255 255 255
i interface Ethernet® ip address 172 16 3 1 255 255 255 0 ip nat inside j interface Ethernetl ip address 172 16 2 1 255 255 255 0 ip nat inside
interface Serial0 description to ISP1
ip address 201 50 26 13 255 255 255 252 ip access group 101 out ip nat outside i autonomous system 3 i router ospf 1 redistribute static network 172 16 0 0 0 0 255 255 area 0 default information originate
router bgp 3 neighbor 172 16 255 1 remote as 3 neighbor 172 16 255 1 update source Loopback0 neighbor 201 50 26 14 remote as 1
ip nat pool ISPIPool 201 50 13 2 201 50 13 254 netmask 255 255 255 0 ip nat inside source list 1 pool ISPIPool ip nat inside source static 172 16 3 3 201 50 13 1 i ip route 0 0 0 0 0 0 0 0 201 50 26 14 ip route 201 50 0 0 255 255 192 0 201 50 26 14 !
access list 1 permit 172 16 0 0 0 0 255 255 access list 101 deny ip 172 16 0 0 0 0 255 255 any access list 101 permit ip any any
RTR2
interface Loopback0 ip address 172 16 255 1 255 255 255 255
( Continuedj interface EthernetO ip address 172 16 3 2 255 255 255 0 ip nat inside i interface Ethernetl ip address 172 16 1 1 255 255 255 0 ip nat inside interface Serial0 description to ISP2
ip address 200 100 29 241 255 255 255 252 ip access group 101 out ip nat outside
autonomous system 3 !
router ospf 1 redistribute static network 172 16 0 0 0 0 255 255 area 0 default information originate i router bgp 3 neighbor 172 16 255 2 remote as 3 neighbor 172 16 255 2 update source Loopback0 neighbor 200 100 29 242 remote as 2
i ip nat pool ISP2Pool 200 100 30 1 200 100 30 253 netmask 255 255 255 0 ip nat inside source list 1 pool ISP2Pool ip nat inside source static 172 16 3 3 200 100 30 254 i ip route 0 0 0 0 0 0 0 0 200 100 29 242 ip route 200 100 0 0 255 255 224 0 200 100 29 242 i access list 1 permit 172 160000 255 255 access list 101 deny ip 172 16 0 0 0 0 255 255 any access list 101 permit ip any any
2 The address of SVR2 in Figure 4 28 is 172 16 2 2 and the address of SVR3 is 172 16 2 3 Modify the configurations of Configuration Exercise 1 so that devices within ISP1 s AS connect to the servers round robin at the address 201 50 13 3
Answer: Notice that in addition to the new commands ISPlPool has been modified to no longer include the address 201 50 13 3
RTR1
ip nat pool ISPlPool 201 50 13 4 201 50 13 254 netmask 255 255 255 0
ip nat pool SVRs 172 16 2 2 172 16 2 3 netmask 255 255 0 0 type rotary ip nat inside source list 1 pool ISPlPool ip nat inside source static 172 16 3 3 201 50 13 1
ip nat inside destination list 2 pool SVRs !
access list 1 permit 172 16 0 0 0 0 255 255 access list 2 permit 201 50 13 3
3 HTTP packets sent to 200 100 30 50 from ISP2 are sent to SVR2 in Figure 4 28 SMTP packets sent to 200 100 30 50 from ISP2 are sent to SVR3 Modify the configurations of the previous exercises to implement these translations
Answer: The IG address falls in the middle of the ISP2Pool range so in addition to the static NAT mappings ISP2Pool must be reconfigured
|
RTR2 |
|||||
|
ip nat pool ISP2Pool netmask 255 255 255 0 |
|||||
|
address 200 100 30 1 200 100 30 49 |
|||||
|
address 200 100 30 51 200 100 30 253 |
|||||
|
ip nat inside source list 1 pool ISP2Pool |
|||||
|
ip nat inside source static tcp 172 16 2 3 24 200 |
100 |
30 |
50 |
25 |
extendable |
|
ip nat inside source static tcp 172 16 2 2 80 200 |
100 |
30 |
50 |
80 |
extendable |
|
ip nat inside source static 172 16 3 3 200 100 30 ! |
254 |
||||
|
access list 1 permit 172 16 0 0 0 0 255 255 |
4 Five outside devices in Figure 4 28 201 50 12 67-201 50 12 71 must appear to devices within AS 3 as having addresses 192 168 1 1-192 168 1 5 respectively Add the appropriate NAT configurations to the previously created configurations
Answer:
RTR1
ip nat pool ISPIPool 201 50 13 2 201 50 13 254 netmask 255 255 255 0 ip nat pool SVRs 172 16 2 2 172 16 2 3 netmask 255 255 255 0 type rotary ip nat inside source list 1 pool ISPIPool ip nat inside source static 172 16 3 3 201 50 13 1 ip nat inside destination list 2 pool SVRs ip nat outside source static 201 50 12 71 192 168 1 5 ip nat outside source static 201 50 12 70 192 168 1 4 ip nat outside source static 201 50 12 69 192 168 1 3 ip nat outside source static 201 50 12 68 192 168 1 2 ip nat outside source static 201 50 12 67 192 168 1 1 !
access list 1 permit 172 16 0 0 0 0 255 255 access list 2 permit 201 50 13 1
5 Devices in AS 3 of Figure 4 28 with addresses in the 172 16 100 0/24 subnet should all appear to have the IG address 200 100 30 75 when sending packets to ISP2 Modify the configurations of the previous exercises to accommodate this
Answer: The solution is to configure PAT Unlike the PAT example shown in this chapter, however, the address to be used here is not the address of the outgoing interface So an address pool is configured on RTR2 that consists of a single address Notice also that access list 1 is modified so that the IL addresses used for PAT are not translated to the ISP2Pool range address 200 100 30 1 200 100 30 49 address 200 100 30 51 200 100 30 253 ip nat pool PATPool 200 100 30 75 200 100 30 75 netmask 255 255 0 0 ip nat inside source list 1 pool ISP2Pool ip nat inside source list 3 pool PATPool overload ip nat inside source static tcp 172 16 2 3 24 200 100 30 50 25 extendable ip nat inside source static tcp 172 16 2 2 80 200 100 30 50 80 extendable ip nat inside source static 172 16 3 3 200 100 30 254
access list 1 deny 172 16 100 0 0 0 0 255 access list 1 permit 172 16 0 0 0 0 255 255 access list 3 permit 172 16 100 0 0 0 0 255
6 In Figure 4 29 redundant links have been added so that RTR1 and RTR2 each have connections to both ISPs and each accepts full BGP routes from both ISPs The address of RTR1 SI is 200 100 29 137/30 and the address of RTR2 SI is 201 50 26 93/30 Write configurations for the two routers ensuring that all features added in the previous exercises still work correctly
RTR2
ip nat pool ISP2Pool netmask 255 255 0
Figure 4 29 The Internetwork for Configuration Exercise 6
Figure 4 29 The Internetwork for Configuration Exercise 6
172 16 0 0/16 ISP1 block:
block: SVR1
block: SVR1
Answer:
RTR1
interface LoopbackO ip address 172 16 255 2 255 255 255 255
i interface EthernetO ip address 172 16 3 1 255 255 255 0 ip nat inside i interface Ethernetl ip address 172 16 2 1 255 255 255 0 ip nat inside i interface Serial0 description to ISP1
ip address 201 50 26 13 255 255 255 252 ip access group 101 out ip nat outside i interface Seriall description to ISP2
ip address 200 100 29 137 255 255 255 252 ip access group 101 out ip nat outside
autonomous system 3 !
router ospf 1 redistribute static network 172 16 0 0 0 0 255 255 area 0 default information originate i router bgp 3 neighbor 172 16 255 1 remote as 3 neighbor 172 16 255 1 update source LoopbackO neighbor 200 100 29 138 remote as 2 neighbor 201 50 26 14 remote as 1
ip nat pool ISPIPool 201 50 13 2 201 50 13 254 netmask 255 255 255 0 ip nat pool ISP2Pool netmask 255 255 255 0 address 200 100 30 1 200 100 30 49 address 200 100 30 51 200 100 30 253 ip nat pool PATPool 200 100 30 75 200 100 30 75 netmask 255 255 0 0 ip nat pool SVRs 172 16 2 2 172 16 2 3 netmask 255 255 255 0 type rotary ip nat inside source route map ISP1 pool ISPIPool ip nat inside source route map ISP2 pool ISP2Pool ip nat inside source list 3 pool PATPool overload ip nat inside source static tcp 172 16 2 3 24 200 100 30 50 25 extendable ip nat inside source static tcp 172 16 2 2 80 200 100 30 50 80 extendable ip nat inside source static 172 16 3 3 201 50 13 1 ip nat inside destination list 2 pool SVRs
(Continued)
ip nat outside source static ip nat outside source static ip nat outside source static ip nat outside source static ip nat outside source static
201.50.12.71 192.168.1.5 201.50.12.70 192.168.1.4 201.50.12.69 192.168.1.3 201.50.12.68 192.168.1.2 201.50.12.67 192.168.1 1
access-list 1 deny 172.16.100.0 0.0.0.255 access-list 1 permit 172.16.0.0 0.0.255.255 * access-list 2 permit 201.50.13.1 access-list 3 permit 172.16.100.0 0.0.0.255 access-list 4 permit 200.100.29.138 access-list 5 permit 201.50.26.14
access-list 101 deny ip 172.16.0.0 0.0.255.255 any access-list 101 permit ip any any route-map ISP1 permit 10 match ip address 1 match ip next-hop 5
route-map ISP2 permit 10 match ip address 1 match ip next-hop 4
RTR2
interface LoopbackO ip address 172.16.255.1 255.255.255.255
interface EthernetO ip address 172.16.3.2 255.255.255.0 ip nat inside interface Ethernetl ip address 172.16.1 1 255.255.255.0 ip nat inside interface SerialO description to ISP2
ip address 200.100.29.241 255.255.255.252 ip access-group 101 out ip nat outside interface Seriall description to ISP1
ip address 201.50.26.93 255.255.255.252 ip access-group 101 out ip nat outside autonomous-system 3
router ospf 1 redistribute static network 172.16.0.0 0.0.255.255 area 0
default information originate
router bgp 3 neighbor 172 16 255 2 remote as 3 neighbor 172 16 255 2 update source LoopbackO neighbor 200 100 29 242 remote as 2 neighbor 201 50 26 94 remote as 1
i ip nat pool ISPIPool 201 50 13 2 201 50 13 254 netmask 255 255 255 0 ip nat pool ISP2Pool netmask 255 255 255 0 address 200 100 30 1 200 100 30 49 address 200 100 30 51 200 100 30 253 ip nat pool PATPool 200 100 30 75 200 100 30 75 netmask 255 255 0 0 ip nat pool SVRs 172 16 2 2 172 16 2 3 netmask 255 255 255 0 type rotary ip nat inside source route map ISP1 pool ISPIPool ip nat inside source route map ISP2 pool ISP2Pool ip nat inside source list 3 pool PATPool overload ip nat inside source static tcp 172 16 2 3 24 200 100 30 50 25 extendable ip nat inside source static tcp 172 16 2 2 80 200 100 30 50 80 extendable ip nat inside source static 172 16 3 3 200 100 30 254 ip nat inside destination list 2 pool SVRs
|
ip |
nat |
outside |
source |
static |
201 |
50 |
12 |
71 |
192 |
168 |
1 |
5 |
|
ip |
nat |
outside |
source |
static |
201 |
50 |
12 |
70 |
192 |
168 |
1 |
4 |
|
ip |
nat |
outside |
source |
static |
201 |
50 |
12 |
69 |
192 |
168 |
1 |
3 |
|
ip |
nat |
outside |
source |
static |
201 |
50 |
12 |
68 |
192 |
168 |
1 |
2 |
|
ip |
nat |
outside |
source |
static |
201 |
50 |
12 |
67 |
192 |
168 |
1 |
1 |
|
access |
list |
1 deny 172 16 100 0 0 0 |
0 255 |
|
access |
list |
1 permit 172 16 0 0 0 0 |
255 255 |
|
access |
list |
2 permit 201 50 13 1 |
|
|
access |
list |
3 permit 172 16 100 0 0 |
0 0 255 |
|
access |
list |
4 permit 200 100 29 242 |
|
|
access |
list |
5 permit 201 50 26 94 |
|
|
access |
list |
101 deny ip 172 16 0 0 ( |
) 0 255 255 any |
|
access |
list |
101 permit ip any any |
route map ISP1 permit 10 match ip address 1 match ip next hop 5
route map ISP2 permit 10 match ip address 1 match ip next hop 4
Continue reading here: Answers to Chapter 6 Configuration Exercises
Was this article helpful?