CCNA Routing and Switching

Scaling Networks
EIGRP Practice Skills Assessment - Packet Tracer
A few things to keep in mind while completing this activity:
1. Do not use the browser Back button or close or reload any exam
windows during the exam.
2. Do not close Packet Tracer when you are done. It will close automatically.
3. Click the Submit Assessment button in the browser window to submit
your work.
Introduction
In Part I of this practice skills assessment, you will configure routing and ACLs.
You will configure dynamic routing with EIGRP for IPv4 and static and default
routes. In addition, you will configure two access control lists.
In Part II of this practice skills assessment, you will configure the Medical
Company network with RPVST+, port security, EtherChannel, DHCP, VLANs and
trunking, and routing between VLANs. In addition you will perform an initial
configuration on a switch, secure unused switch ports and secure SVIs. You will
also control access to the switch management network with an access control
list.
All IOS device configurations should be completed from a direct
terminal connection to the device console from an available host.
Some values that are required to complete the configurations have
not been given to you. In those cases, create the values that you need
to complete the requirements. These values may include certain IP
addresses, passwords, interface descriptions, banner text, and other
values.
When you have been given a text value, such as a password, user
name, DHCP pool name, ACL name, VLAN name, etc, you must enter
these values exactly as they are given in these instructions. If the
values do not match exactly, you may not receive credit for your
configuration.
For the sake of time, many repetitive but important configuration tasks have
been omitted from this activity. Many of these tasks, especially those related to
device security, are essential elements of a network configuration. The intent
of this activity is not to diminish the importance of full device configurations.

You will practice and be assessed on the following skills:

Configuration of initial device settings

IPv4 address assignment and configuration

Configuration and addressing of device interfaces

Configuration of the EIGRP for IPv4 routing protocol

Configuration of a default route

Configuration of ACL to limit device access

Configuration of switch management settings including SSH

Configuration of port security

Configuration of unused switch ports according to security best practices

Configuration of RPVST+

Configuration of EtherChannel

Configuration of a router as a DHCP server

Configuration of VLANs and trunks

Configuration of routing between VLANs

You are required to do the following:

East:

Configure initial device settings.

Configure interfaces with IPv4 addresses, descriptions, and other

settings.

Configure and customize EIGRP for IPv4.

Central:

Configure interfaces with IPv4 addresses, descriptions, and other

settings.

Configure and customize EIGRP for IPv4.

Configure named and numbered ACLs.

Configure and propagate a default route through EIGRP for IPv4.

West:

Configure interfaces with IPv4 addresses, descriptions, and other

settings.

Configure DHCP pools and excluded addresses.

Configure routing between VLANs.

Configure EIGRP for IPv4.

Configure EIGRP for IPv4 route summarization.

Configure an ACL to limit access to the switch management network.

Bldg1:

Create and name VLANs.

Configure EtherChannel.

Configure trunking.

Assign access ports to VLANs.

Configure remote management settings.

Activate and configure RPVST+.

Secure unused switch ports.

Configure port security.

Bldg2:

Create and name VLANs.

Configure EtherChannel.

Configure trunking.

Assign access ports to VLANs.

Configure remote management settings with SSH.

Activate RPVST+.

Bldg3:

Create and name VLANs.

Configure EtherChannel.

Configure trunking.

Assign access ports to VLANs.

Configure remote management settings.

Activate and configure RPVST+.

Internal PC hosts:

Configure as DHCP clients.

Assign Static IPv4 addresses where indicated.

Tables
Note: You are provided with the networks that interfaces should be configured
on. Unless you are told to do differently in the detailed instructions below, you
are free to choose the host addresses to assign.
Addressing Table:
Device

East

Central

West

Bldg1

Interface Network

Configuration Details

S0/0/0

192.168.100.20/
192.168.100.21 255.255.255.252
30

S0/0/1

192.168.100.28/
192.168.100.29 255.255.255.252
30

G0/0

192.168.8.0/24 192.168.8.1 255.255.255.0

G0/1

192.168.9.0/24 192.168.9.1 255.255.255.0

S0/0/0

192.168.100.20/
192.168.100.22 255.255.255.252
30

S0/0/1

192.168.100.36/
192.168.100.37 255.255.255.252
30

S0/1/0

203.0.113.16/29 203.0.113.18 255.255.255.248

S0/0/0

192.168.100.28/
192.168.100.30 255.255.255.252
30

S0/0/1

192.168.100.36/
192.168.100.38 255.255.255.252
30

G0/1.2

10.10.2.0/24

10.10.2.1 255.255.255.0

G0/1.4

10.10.4.0/24

10.10.4.1 255.255.255.0

G0/1.8

10.10.8.0/24

10.10.8.1 255.255.255.0

G0/1.15

10.10.15.0/24

10.10.15.1 255.255.255.0

G0/1.25

10.10.25.0/24

10.10.25.1 255.255.255.0

SVI

10.10.25.0/24

10.10.25.254 255.255.255.0

Bldg2

SVI

10.10.25.0/24

10.10.25.253 255.255.255.0

Bldg3

SVI

10.10.25.0/24

10.10.25.252 255.255.255.0

Host 1

NIC

192.168.8.0/24 192.168.8.10 255.255.255.0

Host 2

NIC

192.168.9.0/24 192.168.9.10 255.255.255.0

NetAdmin 1

NIC

10.10.15.0/24

10.10.15.10 255.255.255.0

NetAdmin 2

NIC

10.10.15.0/24

10.10.15.20 255.255.255.0

VLAN Switch Port Assignment Table:

VL
Name
AN

15

25

LAB-A

LAB-B

LAB-C

Network

10.10.2.0/
24

10.10.4.0/
24

10.10.8.0/
24

NetAdm 10.10.15.0
in
/24

SWAdmin

Switc
Devi
h
ce
Ports
Bldg
Fa0/5
1
Bldg
Fa0/7
3
Bldg
Fa0/10
1
Bldg
Fa0/10
3
Bldg
Fa0/15
1
Bldg
Fa0/15
3
Bldg
Fa0/24
1
Bldg
Fa0/24
3

10.10.25.0 Bldg SVI

/24
1

Bldg
SVI
2
Bldg
SVI
3

99

spare

N/A

all
Bldg
unuse
1
d ports

Port-Channel Group Interfaces:

Channe Devic
Interfaces
l
e
Bldg1

Fa0/1, Fa0/2

Bldg3

Fa0/1, Fa0/2

Bldg1

Fa0/3, Fa0/4

Bldg2

Fa0/3, Fa0/4

Bldg2

Fa0/5, Fa0/6

Bldg3

Fa0/5, Fa0/6

Instructions
All configurations must be performed through a direct terminal
connection to the device console lines from an available host.
Part I: EIGRP Router Configuration
Step 1: Plan the Addressing.
Determine the IP addresses that you will use for the required interfaces on the
devices and LAN hosts. Follow the configuration details provided in the
Addressing Table.
Step 2: Configure East.
Configure East with initial settings:

Configure the router host name: East. This value must be entered
exactly as it appears here.

Prevent the router from attempting to resolve command line entries to IP

addresses.

Protect device configurations from unauthorized access with an

encrypted secret password.

Secure the router console and remote access lines.

Prevent system status messages from interrupting console output.

Configure a message-of-the-day banner.

Encrypt all clear text passwords.

Router East:
enable
config t
hostname East
no ip domain-lookup
enable secret class
line console 0
password cisco
login
logging synchronous
exec-timeout 60
exit
line vty 0 15
password cisco
login
logging synchronous
exec-timeout 60
exit
banner motd #Warning Access Only Authorized Personal#
service password-encryption
do write

Step 3: Configure the Router Interfaces.

Use the information in the addressing table to configure the interfaces of all
routers for full connectivity with the following:

Configure IP addressing.

Descriptions for the three connected interfaces of Central.

Configure DCE settings where required. Use a rate of 128000.

The Ethernet subinterfaces on West will be configured later in this

assessment.

Router East:
Interface serial 0/0/0
Ip address 192.168.100.21 255.255.255.252
Clock rate 128000
No shutdown
Exit
Interface serial 0/0/1
Ip address 192.168.100.29 255.255.255.252
No shutdown
Exit
Interface gi 0/0
Ip address 192.168.8.1 255.255.255.0
No shutdown
Exit
Interface gi 0/1
Ip address 192.168.9.1 255.255.255.0
No shutdown
Exit
Do write
Router Central:
Interface serial 0/0/0
Ip add 192.168.100.22 255.255.255.252
Description Central_To_East
No shutdown
Exit
Interface serial 0/0/1
Ip add 192.168.100.37 255.255.255.252
Clock rate 128000
Description Central_To_West
No shutdown
Exit
Interface serial 0/1/0
Ip add 203.0.113.18 255.255.255.248
Description Central_To_Internet
No shutdown
Exit
Do write
Router West:
Interface serial 0/0/0
Ip add 192.168.100.30 255.255.255.252
Clock rate 128000
No shutdown
Exit
Interface serial 0/0/1

Ip add 192.168.100.38 255.255.255.252

No shutdown
Exit
Do write
Step 4: Configure inter-VLAN routing on West.
Configure router West to route between VLANs using information in the
Addressing Table and VLAN Switch Port Assignment Table. The VLANs will be
configured on the switches later in this assessment.

Do not route the VLAN 99 network.

Router West:
Interface gi 0/1.2
Encapsulation dot1q 2
Ip add 10.10.2.1 255.255.255.0
No shutdown
Exit
Interface gi 0/1.4
Encapsulation dot1q 4
Ip add 10.10.4.1 255.255.255.0
No shutdown
Exit
Interface gi 0/1.8
Encapsulation dot1q 8
Ip add 10.10.8.1 255.255.255.0
No shutdown
Exit
Interface gi 0/1.15
Encapsulation dot1q 15
Ip add 10.10.15.1 255.255.255.0
No shutdown
Exit
Interface gi 0/1.25
Encapsulation dot1q 25
Ip add 10.10.25 .1 255.255.255.0
No shutdown
Exit
Interface gi 0/1
No shutdown
Exit
Do write
Step 5: Configure EIGRP Routing and a default route.
a. On all routers:

Configure EIGRP for IPv4 to route between the internal networks. Use
ASN 100.

Use the precise wild card masks for all network statements.

You are not required to route the SW-Admin VLAN network over EIGRP.

Prevent routing updates from being sent on the LAN networks. Do not
use the default keyword version of the command to do so.

Prevent EIGRP for IPv4 from performing automatic route summarization

on all routers.

Router East:
Router eigrp 100
No auto-summary
Network 192.168.100.20 0.0.0.3
Network 192.168.100.28 0.0.0.3
Network 192.168.8.0 0.0.0.255
Network 192.168.9.0 0.0.0.255
Passive-interface gi 0/0
Passive-interface gi 0/1
Exit
Do write
Router Central:
Router eigrp 100
No auto-summary
Network 192.168.100.20 0.0.0.3
Network 192.168.100.36 0.0.0.3
Exit
Do write
Router West:
Router eigrp 100
No auto-summary
Network 192.168.100.28 0.0.0.3
Network 192.168.100.36 0.0.0.3
Network 10.10.2.0 0.0.0.255
Network 10.10.4.0 0.0.0.255
Network 10.10.8.0 0.0.0.255
Network 10.10.15.0 0.0.0.255
Passive-interface gi0/1.2
Passive-interface gi0/1.4
Passive-interface gi0/1.8
Passive-interface gi0/1.15
Passive-interface gi0/1.25
Exit
Do write

b. On the Central router:

Configure a default route to the Internet. Use the exit interface

argument.

Configure EIGRP for IPv4 to distribute the default route to the other
routers.
Router Central:
ip route 0.0.0.0 0.0.0.0 serial 0/1/0
router eigrp 100
resdistribute static
exit
do write

Step 6: Customize EIGRP for IPv4.

Customize EIGRP for IPv4 by performing the following configuration tasks:

Set the bandwidth of the link between East and Central to 128 kb/s.

Create a summary route for the LANs connected to Bldg3. It should

include all networks from 10.10.0.0 to 10.10.15.0.

Do not include the SW-Admin VLAN network in the summary route.

Configure EIGRP for IPv4 with the route summary so that it will be sent to
the other routers. Be sure to configure the summary on all of the
appropriate interfaces.

Router East:
Interface serial 0/0/0
Bandwidth 128
Exit
Do write
Router Central:
Interface serial 0/0/0
Bandwidth 128
Exit
Do write
Router west:
Interface serial 0/0/0
Ip summary-address eigrp 100 10.10.0.0 255.255.240.0
Exit
Interface serial 0/0/1
Ip summary-address eigrp 100 10.10.0.0. 255.255.240.0
Exit

Do write
Step 7: Configure Access Control Lists.
You will configure two access control lists in this step. You should use
the any and host keywords in the ACL statements where appropriate. The ACL
specifications are as follows:
a. Restrict access to the vty lines on Central with an ACL:

Create a named standard ACL using the name telnetBlock. Be sure that
you enter this name exactly as it appears in this instruction or you will
not receive credit for your configuration.

Allow only Test PC to access the vty lines of Central.

No other Internet hosts (including hosts not visible in the topology)

should be able to access the vty lines of Central.

Your solution should consist of one ACL statement.

Router Central:
Ip access-list standard telnetBlock
Permit host 198.51.100.5
Exit
Line vty 0 15
Ip access-class telnetBlock in
Exit
Do write
b. Block ping requests from the Internet with an ACL:

Use access list number 101.

Allow only Test PC to ping addresses within the Medical Company

network. Only echo messages should be permitted.

Prevent all other Internet hosts (not only the Internet hosts visible in the
topology) from pinging addresses inside the Medical Company network.
Block echo messages only.

All other traffic should be allowed.

Your ACL should consist of three statements.

Your ACL should be placed in the most efficient location as possible to

conserve network bandwidth and device processing resources.

Router Central:
Access-list 101 permit icmp host 198.51.100.5 any echo
Access-list 101 deny icmp any any echo
Access-list 101 permit ip any any

Interface serial 0/1/0

Ip access-group 101 in
Exit
Do write
c. Control access to the management interfaces (SVI) of the three switches
attached to West as follows:

Create a standard ACL.

Use the number 1 for the list.

Permit only addresses from the NetAdmin VLAN network to access

any address on the SW-Admin VLAN network.

Hosts on the NetAdmin VLAN network should be able to reach all other
destinations.

Your list should consist of one statement.

Router West:
Access-list 1 permit 10.10.15.0 0.0.0.255
Interface gi 0/1.25
Ip access-group 1 out
Exit
Do write
Part II: Switching and DHCP Configuration
Step 1: Create and name VLANs.
On all three switches that are attached to West, create and name the VLANs
shown in the VLAN Table.

The VLAN names that you configure must match the values in the table
exactly.

Each switch should be configured with all of the VLANs shown in the
table.

Hacer esto en los switches Bldg1, Bldg2, Bldg3:

Enable
Config t
Vlan 2
Name LAB-A
Exit
Vlan 4
Name LAB-B
Exit
Vlan 8

Name LAB-C
Exit
Vlan 15
Name NetAdmin
Exit
Vlan 25
Name SW-Admin
Exit
Vlan 99
Name spare
Exit
Do write
Step 2: Assign switch ports to VLANs.
Using the VLAN table, assign the switch ports to the VLANs you created in Step
1, as follows:

All switch ports that you assign to VLANs should be configured to static
access mode.

All switch ports that you assign to VLANs should be activated.

Switch Bldg1:
Interface fa 0/5
Switchport mode access
Switchpor access vlan 2
No shutdown
Exit
Interface fa 0/10
Switchport mode access
Switchport access vlan 4
No shutdown
Exit
Interface fa 0/15
Switchport mode access
Switchport access vlan 8
No shutdown
Exit
Interface fa 0/24
Switchport mode access
Switchport access vlan 15
No shutdown
Exit
Do write
Switch Bldg3:

Interface fa 0/7
Switchport mode access
Switchport access vlan 2
No shutdown
Exit
Interface fa 0/10
Switchport mode access
Switchport access vlan 4
No shutdown
Exit
Interface fa 0/15
Switchport mode access
Switchport access vlan 8
No shutdown
Exit
Interface fa 0/24
Switchport mode access
Switchport access vlan 15
No shutdown
Exit
Do write
Step 3: Configure the SVIs.
Refer to the Addressing Table. Create and address the SVIs on all three of the
switches that are attached to West. Configure the switches so that they can
communicate with hosts on other networks. Full connectivity will be established
after routing between VLANs has been configured later in this assessment.

switch Bldg1:
Interface vlan 25
Ip address 10.10.25.254 255.255.255.0
No shutdown
Exit
Ip default-gateway 10.10.25.1
Do write
Swtich Bldg2:
Interface vlan 25
Ip address 10.10.25.253 255.255.25.0
No shutdown
Exit
Ip default-gateway 10.10.25.1
Do write
Switch Bldg3:

Interface vlan 25
Ip address 10.10.25.252 255.255.255.0
No shutdown
Exit
Ip default-gateway 10.10.25.1
Do write
Step 4: Configure Trunking and EtherChannel.
a. Use the information in the Port-Channel Groups table to configure
EtherChannel as follows:
Use LACP.

The switch ports on both sides of Channels 1 and 2 should initiate

negotiations for channel establishment.

The switch ports on the Bldg2 side of the Channel 3 should initiate
negotiations with the switch ports on Bldg3.

The switch ports on the Bldg3 side of Channel 3 should not initiate
negotiations with the switch ports on the other side of the channel.

All channels should be ready to forward data after they have been
configured.

Switch Bldg1:
Interface range fa 0/1-2
Channel-group 1 mode active
Exit
Interface range fa 0/3-4
Channel-group 2 mode active
Exit
Do write
Switch Bldg2:
Interface range fa 0/3-4
Channel group 2 mode active
Exit
Interface range fa 0/5-6
Channel-group 3 mode active
Exit
Do write
Switch Bldg3:
Interface range fa 0/1-2
Channel-group 1 mode active
Exit
Interface range fa 0/5-6
Channel group 3 mode passive

No shutdown
Exit
Do write
b. Configure all port-channel interfaces as trunks.

Switch Bldg1:
Interface range fa 0/1-4
Switchport mode trunk
Exit
Interface port-channel 1
Switchport mode trunk
No shutdown
Exit
Interface port-channel 2
Switchport mode trunk
exit
Do write
Switch Bldg2:
Interface range fa 0/3-6
Switchport mode trunk
Exit
Interface port-channel 2
Switchport mode trunk
Exit
Interface port-channel 3
Switchport mode trunk
Exit
Do write
Switch Bldg 3:
Interface range fa 0/1-2, fa 0/5-6
Switchport mode trunk
Exit
Interface port-channel 1
Switchport mode trunk
Exit
Interface port-channel 3
Switchport mode trunk
exit
Do write
c. Configure static trunking on the switch port on Bldg2 that is connected
to West.
Switch Bldg2:
Interface gi 0/1
Switchport mode trunk

Exit
Do write
Step 5: Configure Rapid PVST+.
Configure Rapid PVST+ settings as follows:
a. Activate Rapid PVST+ and set root priorities.
All three switches should be configured to run Rapid PVST+.

Bldg1 should be configured as root primary for VLAN 2 and VLAN 4

using the default primary priority values.

Bldg1 should be configured as root secondary for VLAN 8 and VLAN

15 using the default secondary priority values.

Bldg3 should be configured as root primary for VLAN 8 and VLAN

15 using the default primary priority values.

Bldg3 should be configured as root secondary for VLAN 2 and VLAN

4 using the default secondary priority values.

Switch Bldg1:
Spanning-tree mode rapid-pvst
Spanning-tree vlan 2,4 root primary
Spanning-tree vlan 8,15 root secondary
Do write
Switch Bldg2:
Spanning-tree mode rapid-pvst
Switch Bldg3:
Spanning-tree mode rapid-pvst
Spanning-tree vlan 8,15 root primary
Spanning-tree vlan 2,4 root secondary
Do write
b. Activate PortFast and BPDU Guard on the active Bldg3 switch access ports.

Configure PortFast on all access ports that are connected to hosts.

Activate BPDU Guard on all access ports that are connected to hosts.
Switch Bldg 3:
interface range fa 0/7, fa 0/10, fa 0/15, fa 0/24
spanning-tree portfast
spanning-tree bpduguard enable
exit
do write

Step 6: Configure switch security.

You are required to complete the following only on some of the devices in the
network for this assessment. In reality, security should be configured on all
devices in the network.
a. Secure unused switch ports. Following security best practices, do the
following on Bldg1 only:

Shutdown all unused switch ports.

Configure all unused switch ports as static access ports.

Ensure that all unused switch ports have been assigned to VLAN 99.

b. Configure port security on all active access ports on Bldg1.

Each switch port should accept only two MAC addresses before a
security action occurs.

The learned MAC addresses should be recorded in the running

configuration.

If a security violation occurs, the switch ports should provide notification

that a violation has occurred but not place the interface in an errdisabled state.

Switch Bldg1:
Interface range fa 0/6-9, fa 0/11-14, fa 0/16-23, gi 0/1-2
shutdown
Switchport mode access
Switchport access vlan 99
Exit
Interface range fa0/5, fa0/10, fa0/15, fa0/24
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
exit
do write
c. On Bldg2, configure the virtual terminal lines to accept only SSH
connections.

Use a domain name of ccnaPTSA.com.

Use a modulus value of 1024.

Configure SSH version 2.

Configure the vty lines to only accept SSH connections.

Configure user-based authentication for the SSH connections with a user

name of netadmin and an encrypted secret password of SSHsecret9.
The user name and password must match the values provided here
exactly in capitalization, punctuation, and spelling.

In order to test the SSH connection, you will need further

configure Bldg2.

Switch Bldg2:
Ip domain-name ccnaPTSA.com
Crypto key generate rsa
1024
Ip ssh version 2
Line vty 0 15
Login local
Transport input ssh
Exit
Username netadmin secret SSHsecret9
Do write
Step 7: Configure West as a DHCP server for the hosts attached to the
Bldg1 and Bldg2 switches.
Configure three DHCP pools as follows:

Create a DHCP pool for hosts on VLAN 2 using the pool name vlan2pool.

Create a DHCP pool for hosts on VLAN 4 using the pool name vlan4pool.

Create a DHCP pool for hosts on VLAN 8 using the pool name vlan8pool.

All VLAN pool names must match the provided values above exactly.

Exclude the first five addresses from each pool.

Configure a DNS server address of 192.168.200.225.

All hosts should be able to communication with hosts on other networks.

Router West:
Ip dhcp excluded-address 10.10.2.1 10.10.2.5
Ip dhcp excluded-address 10.10.4.1 10.10.4.5
Ip dhcp excluded-address 10.10.8.1 10.10.8.5
Ip dhcp pool vlan2pool
Network 10.10.2.0 255.255.255.0
Dns-server 192.168.200.225
Default-router 10.10.2.1
Exit
Ip dhcp pool vlan4pool

Network 10.10.4.0 255.255.255.0

Dns-server 192.168.200.225
Default-router 10.10.4.1
Exit
Ip dhcp pool vlan8pool
Network 10.10.8.0 255.255.255.0
Dns-server 192.168.200.225
Default-router 10.10.8.1
Exit
Do write
Step 8: Configure host addressing.
Note: This assessment is a simulation of a working network. Due to
the complexities of the protocols and technologies that are simulated
in this network, some connectivity tests may not succeed even though
the network has been properly configured. If all required
configurations are complete, your score will not be affected.
All hosts should be able to ping each other and the two external servers after
they have been addressed.

Hosts on VLANs 2, 4, and 8 should be configured to receive addresses

dynamically over DHCP.

Hosts on VLAN 15 should be addressed statically as indicated in the

addressing table. Once configured, the hosts should be able to ping
hosts on other networks.

Hosts on the LANs attached to East should be statically assigned

addressing that enables them to communicate with hosts on other
networks.

Last Updated: December, 2015

ID: 2