CCNP ROUTE Comprehensive Lab With GNS3

home-lab-pt2This is a continuation of my previous work. The original topology was created last December. If you follow my posts, you’ll know that shortly after then I paused my studies for ROUTE and passed the CCDA, CCNA Voice and SWITCH exams. During the past eight months since that time, I feel like my level of networking knowledge has increased dramatically. Nearly two years ago, the thought of achieving the CCNA seemed like a distant but attainable goal. As I write this, on the verge of achieving the CCNP certification, that is exactly how I feel about the CCIE certification.

Originally, I looked over my notes and wrote down the topics I felt were essential to the ROUTE exam, then designed a topology on paper based on those topics. I then assembled the topology in GNS3 and came up with a preliminary IPv4 addressing scheme. However, at that time, I was stumped with the prospect of coming up with an IPv6 address scheme, and the project essentially halted last December.

I always knew I would return to the project, and here are the results.

The initial creation was performed after watching some training videos, reading the official cert guide, and going through some of the official lab manual. This time, I did all of that, read the foundation learning guide, went through the entire lab manual, and dug deeper into the topics, including reading various RFCs. In fact, by taking the time to read RFC4193, I discovered that private IPv6 addressing is so simple, it was actually no problem to come up with an IPv6 addressing scheme for the project once I was equipped with the proper knowledge. In fact, I feel I’ve become comfortable enough with IPv6 addresses that it makes me wonder why in 2013 we aren’t further along with the global migration to IPv6 as it provides so much more flexibility with addressing than IPv4 does. Not just in terms of raw address space, of course, but in the layout of subnets.

In particular with regards to this project, I generated a “global private” IPv6 prefix and then mapped the IPv6 subnet to the prefix. So, for example, the IPv4 address of the g2/0 interface on the ISP11 router is 10.30.14.1/30. The IPv6 address is FDA7:2ED4:506D:3014::1/64. The IPv6 address is composed of the unique local designation FD, followed by the pseudo-randomly-generated unique local prefix A72ED4506D (equaling FD17:2ED4:506D::/48). In my private IPv4 address scheme, I used the 10.0.0.0 major network for the entire topology and changed the middle two octets based on the location of the link. The second two octets map perfectly to the IPv6 subnet. For the host portion of the IPv6 address, I could have used auto-generated EUI-64 addresses, but instead I used ::1’s and ::2’s for better readability, since every IPv6 link in the topology is statically assigned.

TopologyI also modified the topology from the original by removing the redundant squares from the ISP1 and ISP2 regions, opting instead of have redundant triangles, as I posted about before. Though there is still the section between the Border and ISP routers that is a physical redundant square, once configured it is a logical triangle due to the use of different routing protocols.

As I was writing the implementation for the OSPF section, I discovered a couple of large mistakes in the topology. I was surprised that I had made such large mistakes in the first place. In the original topology, there was a section of the OSPF side that was to be designated an OSPF stub area. However, I didn’t take into account that all routers in the OSPF area must agree on the stub flag. My original design was in error because I had created OSPF area 2 directly attached to area 1 in order to demonstrate the OSPF virtual-link capability. However, I did not intend for the attached OA1 router to be a stub. Though it is true that I could have created a separate OSPF stub area attached to OA1 with a virtual-link to area 0, I already had OA2 for the purpose of demonstrating virtual links and I wanted to keep the stub area concept separate in the topology. If I were using physical routers, I would have done that in order to keep the required number of routers down, but in the virtual world you don’t have to do that.

The other major design flaw, in both the EIGRP and OSPF domains, was the IPv4 addressing scheme with regards to summarization. I knew from the beginning that the ROUTE topics covered summarization, but I initially forgot to take into account summarized routes accidentally overlapping with routes that I did not wish to summarize. So I revised the IPv4 address scheme in certain sections of the OSPF and EIGRP domains.

I initially designed the topology so that I could have a section on configuring iBGP route reflectors and confederations. Upon review, I realized that that is outside the scope of the ROUTE exam. I remember when I first started studying for ROUTE last year, I was having a difficult time with many of the concepts of BGP just because it was new to me and I had never worked with it before. So in attempt to try to learn more, I viewed some training videos from the former Cisco BGP course. In that course there is discussion of both route reflectors and confederations, so the ideas snuck into my original design. Since this design is based around the ROUTE exam, I decided to remove those two topics. Cisco has an excellent, short configuration guide available, however.

In completing the project for the purpose of demonstrating various ROUTE topics, I created various implementation steps. Some of the steps are purposefully ambiguous as there are multiple ways to perform them while still being within the realm of the ROUTE topics. Also, there are a few different corner cases that are covered in ROUTE, but I decided not to implement them in my topology. There’s a few IPv6 topics and most notably IP SLA that I didn’t cover. Although each of these tasks could be implemented in individual labs, my goal for this project was to create a comprehensive lab where I could fit as many of the major topics as possible into a single internetwork simultaneously. In doing that, and not yet being an expert in network design (but I’ll get there!), it was difficult to truly fit in everything without going through several major redesigns (as it is, I went through a few different fairly major revisions from my original creation last year). I’m not at all saying that it can’t be done, I just don’t have the time to do it currently.

As mentioned in a previous post, this project reached a point where it had the potential of pushing my ROUTE exam date back. In coming up with the implementation steps, I had to use a lot of skills that are covered on the TSHOOT exam to discover and correct mistakes in both the topology as well as my implementation questions. In the end, I revised the topology a couple of times, and my implementation steps several times. In fact, I ended up needing to remove a couple more topics due to mistakes in the design that would take too much time to fix without a proper redesign. For example, the “IPv6 Branch” section is not even used in the implementation.

I also ran into some limits with GNS3, especially after all of the routing protocols were implemented. This project was designed on a Macbook Pro with an i7 CPU and 16 GB of RAM. When I first load the project and turn on all the virtual routers with only IP addresses configured (no actual implementation steps followed yet), the CPU stays around 30%. With all of the steps implemented, the CPU stays at around 85%. There are definitely some optimizations that could be made, such as making sure to run only a single routing platform such as the 3725, but that would require more time to redesign the topology.

I learned a lot by creating this project, which luckily was the end goal, regardless of the actual success of the design and implementation. Some notable things I encountered were the results of different methods of default routing for the different routing protocols, iBGP implementation issues such as update-source and next-hop-self, eBGP advertisement issues with regards to routes actually being in the routing table. There was also one item in particular that I don’t remember being in any of the study material, and this may be platform/IOS-version dependent, but when I configured EIGRP routing for IPv6, despite enabling it on the individual links, I had to go into IPv6 EIGRP router configuration mode and issue no shutdown before it actually worked. I thought that was rather strange, as it doesn’t work that way for IPv4.

So in the end, these were the topics that I felt were important to the ROUTE exam and led to the creation of the topology and implementation steps:


EIGRP:
•    Passive Interface
•    Authentication
•    Manual Unicast Neighbor
•    P2MP Split Horizon
•    P2MP Bandwidth Control
•    EIGRP Stub
•    Filter Routes via ACL, Distribute List,vRoute Map
•    Summarization
•    Default Route Injection

OSPF:
•    Multi-Area
•    Passive Interface
•    Authentication
•    Frame Relay Operation
•    LSA Type 3 Filtering via ACL,vDistribute List, Route Map
•    Summarization
•    Default Route
•    Stub area
•    Virtual Link

BGP:
•    eBGP connectivity
•    Authentication
•    Loopback / Update-Source / ebgp-multihop
•    Route injection via network commandvand redistribution
•    Route aggregation
•    iBGP connectivity, Route reflector, confederation
•    Route filtering via distribute-list, prefix-list, filter-list, route-map

Redistribution:
•    OSPF / EIGRP / RIP
•    Route filtering
•    Route tagging

Path Control / IP SLA:
•    Policy routing
•    IP SLA object tracking
•    Influence outbound BGP
•    Influence inbound BGP

Branch/Remote Operations:
•    Floating Static Routes
•    DHCP Server
•    NAT
•    IPsec VPN

IPv6:
•    IPv6 Addressing
•    IPv6 Routing
•    RIPng / OSPFv3 / EIGRPv6
•    NAT-PT
•    Manual Tunnel
•    6to4 Tunnel
•    ISATAP Tunnel


The final IPv4 and IPv6 addressing scheme is:


IPv4 Address Scheme (based on RFC1918):

Enterprise OSPF Domain: 10.10.x.x

OS1 s0/0 10.10.130.1/29
OS1 f0/0 10.10.140.1/24
OS1 lo150 10.10.150.1/24
OS2 s0/0 10.10.130.2/29
OS2 lo160 10.10.160.1/24
OS3 s0/0 10.10.130.3/29
OS3 lo170 10.10.170.1/24
OS1Client f0/0 DHCP
OStub s0/0 10.10.130.4/24
OStub f0/0 10.10.135.2/30
OA1 f1/0 10.10.15.1/30
OA1 f2/0 10.10.80.1/30
OA1 f0/0 10.10.10.2/30
OIPv6 f0/0 10.10.15.2/30
OA2 f0/0 10.10.80.2/30
OA2 f0/1 10.10.90.1/24
OA2Client f0/0 DHCP
ABR1 f1/0 10.10.10.1/30
ABR1 f0/0 10.10.0.2/30
ABR1 f0/1 10.10.0.6/30
ABR1 f2/0 10.10.135.1/30

Enterprise EIGRP Domain: 10.20.x.x

ES1 s0/0 10.20.30.1/29
ES1 f0/0 10.20.40.1/24
ES1 lo50 10.20.50.1/24
ES2 s0/0 10.20.30.2/29
ES2 lo60 10.20.60.1/24
ES3 s0/0 10.20.30.3/29
ES3 lo70 10.20.70.1/24
ES1Client f0/0 DHCP
EStub s0/0 10.20.30.4/29
EStub f0/0 10.20.20.2/30
EIPv6 f0/0 10.20.10.2/30
ESummary f0/1 10.20.10.1/30
ESummary f0/0 10.20.20.1/30
ESummary f1/0 10.20.100.2/30
ESummary f2/0 10.20.100.6/30

Enterprise Border Routers:

Border1 g0/0 10.70.11.2/30
Border1 g1/0 10.80.21.2/30
Border1 f2/0 10.20.100.1/30
Border1 f2/1 10.10.0.1/30
Border1 g3/0 10.15.12.1/30
Border2 g0/0 10.70.12.2/30
Border2 g1/0 10.80.22.2/30
Border2 f2/0 10.20.100.5/30
Border2 f2/1 10.10.0.5/30
Border2 g3/0 10.15.12.2/30

ISP1: 10.30.x.x

ISP11 f5/1 10.70.12.1/30
ISP11 f5/0 10.70.11.1/30
ISP11 g0/0 10.30.12.1/30
ISP11 g1/0 10.30.13.1/30
ISP11 g2/0 10.30.14.1/30
ISP11 g3/0 10.60.11.1/30
ISP12 g0/0 10.30.12.2/30
ISP12 g2/0 10.30.24.1/30
ISP13 f3/0 10.50.0.1/30
ISP13 g2/0 10.30.34.1/30
ISP13 g1/0 10.30.13.2/30
ISP14 g2/0 10.30.34.2/30
ISP14 g0/0 10.30.24.2/30
ISP14 g3/0 10.60.44.1/30
ISP14 g1/0 10.30.14.2/30

ISP2: 10.40.x.x

ISP21 f5/1 10.80.21.1/30
ISP21 f5/0 10.80.22.1/30
ISP21 g0/0 10.40.12.1/30
ISP21 g1/0 10.40.14.1/30
ISP21 g2/0 10.40.13.1/30
ISP21 g3/0 10.60.11.2/30
ISP24 g0/0 10.40.14.2/30
ISP24 g2/0 10.40.34.2/30
ISP24 g1/0 10.40.24.2/30
ISP24 g3/0 10.60.44.2/30
ISP23 g0/0 10.40.13.2/30
ISP23 g2/0 10.40.34.1/30
ISP22 g0/0 10.40.12.2/30
ISP22 g1/0 10.40.24.1/30

Redistribution Domain: 10.50.x.x

RIPClient f0/0 DHCP
RIP f1/0 10.50.100.1/24
RIP f0/0 10.50.10.2/30
RIP f0/1 10.50.10.6/30
RDR12 f0/0 10.50.10.5/30
RDR12 f0/1 10.50.30.9/30
RDR12 f1/0 10.50.30.6/30
RDR22 f0/0 10.50.30.10/30
RDR22 f0/1 10.50.20.5/30
RDR22 f1/0 10.50.30.13/30
OSPF f0/0 10.50.20.6/30
OSPF f0/1 10.50.20.2/30
OSPF f1/0 10.50.200.1/24
OSPFClient f0/0 DHCP
RDR21 f0/0 10.50.20.1/30
RDR21 f1/0 10.50.35.1/24
RDR21 f2/0 10.50.30.14/30
RDR21 f0/1 10.50.30.2/30
RDR21Client f0/0 DHCP
RDR11 f0/0 10.50.10.1/30
RDR11 f1/0 10.50.0.2/30
RDR11 f0/1 10.50.30.1/30
RDR11 f2/0 10.50.30.5/30

Additional Loopbacks (Router-ID / Possible OOB Management Network):

OSPF Domain lo10 10.10.254.x
Border1 lo10 10.10.254.200
Border2 lo10 10.10.254.150
ABR1 lo10 10.10.254.100
OA1 lo10 10.10.254.70
OA2 lo10 10.10.254.60
OIPv6 lo10 10.10.254.50
OStub lo10 10.10.254.40
OS1 lo10 10.10.254.10
OS2 lo10 10.10.254.20
OS3 lo10 10.10.254.30
EIGRP Domain lo20 10.20.254.x
Border1 lo20 10.20.254.200
Border2 lo20 10.20.254.150
ESummary lo20 10.20.254.100
EIPv6 lo20 10.20.254.50
EStub lo20 10.20.254.40
ES1 lo20 10.20.254.10
ES2 lo20 10.20.254.20
ES3 lo20 10.20.254.30
ISP1 Domain lo30 10.30.254.x
ISP11 lo30 10.30.254.10
ISP12 lo30 10.30.254.20
ISP13 lo30 10.30.254.30
ISP14 lo30 10.30.254.40
ISP2 Domain lo40 10.40.254.x
ISP21 lo40 10.40.254.10
ISP22 lo40 10.40.254.20
ISP23 lo40 10.40.254.30
ISP24 lo40 10.40.254.40
Redistribution Domain lo50 10.50.254.x
RDR11 lo50 10.50.254.110
RDR12 lo50 10.50.254.120
RDR21 lo50 10.50.254.210
RDR22 lo50 10.50.254.220
RIP lo50 10.50.254.50
OSPF lo50 10.50.254.150
eBGP Transit Domain lo60 10.60.254.x
ISP11 lo60 10.60.254.110
ISP21 lo60 10.60.254.210
ISP14 lo60 10.60.254.140
ISP24 lo60 10.60.254.240
eBGP ISP1 Non-Transit lo70 10.70.254.x
Border1 lo70 10.70.254.100
Border2 lo70 10.70.254.200
eBGP ISP2 Non-Transit lo80 10.80.254.x
Border1 lo80 10.80.254.100
Border2 lo80 10.80.254.200

IPv6 Address Scheme (Based on RFC4193):
FDA7:2ED4:506D::/48

OIPv6: f0/1 FDA7:2ED4:506D:0010::1/64
OIPv6Cl f0/0 FDA7:2ED4:506D:0010::2/64
EIPv6 f0/1 FDA7:2ED4:506D:0020::1/64
EIPv6Cl f0/0 FDA7:2ED4:506D:0020::2/64
IPv6Br f0/0 FDA7:2ED4:506D:3000::2/64
IPv6Br f0/1 FDA7:2ED4:506D:0090::1/64
IPv6BrCl f0/0 FDA7:2ED4:506D:0090::2/64
ISP23 f3/0 FDA7:2ED4:506D:3000::1/64
ISP23 g0/0 FDA7:2ED4:506D:4013::2/64
ISP23 g2/0 FDA7:2ED4:506D:4034::1/64
ISP22 g0/0 FDA7:2ED4:506D:4012::2/64
ISP22 g1/0 FDA7:2ED4:506D:4024::1/64
ISP21 g0/0 FDA7:2ED4:506D:4012::1/64
ISP21 g1/0 FDA7:2ED4:506D:4014::1/64
ISP21 g2/0 FDA7:2ED4:506D:4013::1/64
ISP21 g3/0 FDA7:2ED4:506D:6011::2/64
ISP24 g0/0 FDA7:2ED4:506D:4014::2/64
ISP24 g1/0 FDA7:2ED4:506D:4024::2/64
ISP24 g2/0 FDA7:2ED4:506D:4034::2/64
ISP24 g3/0 FDA7:2ED4:506D:6044::2/64
ISP14 g0/0 FDA7:2ED4:506D:3024::2/64
ISP14 g1/0 FDA7:2ED4:506D:3014::2/64
ISP14 g2/0 FDA7:2ED4:506D:3034::2/64
ISP14 g3/0 FDA7:2ED4:506D:6044::1/64
ISP13 g1/0 FDA7:2ED4:506D:3013::2/64
ISP13 g2/0 FDA7:2ED4:506D:3034::1/64
ISP12 g0/0 FDA7:2ED4:506D:3012::2/64
ISP12 g2/0 FDA7:2ED4:506D:3024::1/64
ISP11 g0/0 FDA7:2ED4:506D:3012::1/64
ISP11 g1/0 FDA7:2ED4:506D:3013::1/64
ISP11 g2/0 FDA7:2ED4:506D:3014::1/64
ISP11 g3/0 FDA7:2ED4:506D:6011::1/64

And finally, here are the implementation challenge steps I came up with. I was not able to cover all of the topics that I listed before, but I believe at least 85% of them are covered in one way or another.


EIGRP Section:

  1. Configure the appropriate frame-relay mappings on EStub, ES1, ES2 and ES3.
  2. Configure EIGRP for AS1 on all links on ES1, ES2, ES3, EStub and ESummary. Configure EIGRP AS1 for Border1 and Border2 only on the specific links connecting to the EIGRP domain (including the link between Border1 and Border2).
  3. Configure MD5 authentication on the links between ESummary, Border1 and Border2 in the EIGRP domain.
  4. Manually configure the neighborship between ESummary and EStub.
  5. Configure ESummary to advertise the link to EIPv6 without forming an EIGRP neighborship.
  6. Configure ES1, ES2 and ES3 as EIGRP stub routers.
  7. On ESummary, advertise a summary route encompassing 10.20.0.0 – 10.20.63.255 toward both Border1 and Border2.
  8. Prevent ESummary from receiving the OS3 LAN prefix 10.10.70.0/24 via distribute-list
  9. Manually configure the bandwidth of the ES1, ES2 and ES3 serial links to 128kbps. Manually configure the EStub serial link to 384kbps and limit the EIGRP bandwidth to 25%.
  10. Disable split-horizon on the serial interface of EStub.
  11. Create static default routes to ISP11 and ISP21 on Border1 and Border2. Redistribute the static routes into EIGRP.

OSPF Section:

  1. Configure the appropriate frame-relay mappings on OStub, OS1, OS2 and OS3.
  2. Configure the appropriate links on ABR1, Border1 and Border2 (including the link between Border1 and Border2) for the OSPF backbone area.
  3. Configure the appropriate links on ABR1 and OA1 for OSPF area 1.
  4. Configure OA1 to advertise the link to OIPv6 without forming an OSPF neighborship. Ensure OIPv6 can still reach the rest of the network.
  5. Configure the appropriate links on OA1 and OA2 for OSPF area 2.
  6. Prevent OS1, OS2 and OS3 from Designated Router eligibility.
  7. Configure the appropriate links on ABR1, OStub, OS1, OS2 and OS3 for OSPF area 3 and configure it as a regular stub area.
  8. Configure the frame relay network as type “nonbroadcast”.
  9. Configure an OSPF virtual-link between OA2 and ABR1.
  10. Configure MD5 authentication on the links between ABR1, Border1 and Border2 in the OSPF domain.
  11. Prevent ABR1 from adding the ES3 LAN prefix 10.20.70.0/24 to the routing table.
  12. Summarize all OSPF area 3 routes on ABR1.
  13. Configure Border1 and Border2 to send a permanent default route into OSPF.

Redistribution Section:

  1. Redistribute all OSPF routes into EIGRP on Border1. Redistribute all EIGRP routes into OSPF on Border2.
  2. Redistribute EIGRP routes into RIP on RDR11 and RDR12. Deny routes with a tag of 120 from being redistributed. Assign a tag of 90 to the redistributed routes.
  3. Redistribute EIGRP routes with all subnets into OSPF on RDR21 and RDR22. Deny routes with a tag of 110 from being redistributed. Assign a tag of 90 to the redistributed routes.
  4. Redistribute RIP routes into EIGRP on RDR11 and RDR12. Deny routes with a tag of 90 from being redistributed. Assign a tag of 120 to the redistributed routes.
  5. Redistribute OSPF routes into EIGRP on RDR21 and RDR22. Deny routes with a tag of 90 from being redistributed. Assign a tag of 110 to the redistributed routes.
  6. On RDR11, configure a default route to ISP13’s f3/0 IP address. Redistribute the default route into EIGRP on RDR11.
  7. Configure RDR21 to send a default route into OSPF.

BGP Section:

  1. Configure Border1 and Border2 as members of AS65003 and advertise the summarized IP address space of the OSPF and EIGRP domains.
  2. Configure an iBGP neighborship between Border1 and Border2.
  3. Configure ISP11 as a member of AS65001 and advertise the 10.30.0.0/16 and 10.50.0.0/16 address ranges.
  4. Configure ISP21 as a member of AS65002 and advertise the 10.40.0.0/16 address range.
  5. Create the following eBGP neighborships: Border1 ISP11, Border1 ISP21, Border2 ISP11, Border2 ISP21. Prevent AS65003 from becoming a transit between ISP1 and ISP2.
  6. Create eBGP neighborships between ISP11 and ISP21, IPS14 and ISP24 with MD5 authentication. Use the ISP1 lo30 and ISP2 lo40 loopbacks as the update source.
  7. Configure an iBGP mesh inside ISP1 and ISP2. Use ISP1 lo30 and ISP2 lo40 loopbacks as the update source. Use OSPF (on the inter-ISP1 links and loopbacks only) as the internal routing protocol for ISP1. Use EIGRP AS 65002 (on the inter-ISP2 links and loopbacks only) as the internal routing protocol for ISP2.
  8. On ISP13, configure a static route to the Redistribution domain via the IP address for RDR11’s f1/0 interface. Redistribute the static route into BGP.

Path Control Section:

  1. Configure the local preference to prefer Border2 as the default exit point.
  2. Configure policy routing on RIP so that all routes toward OSPF will prefer RDR12.
  3. Configure policy routing on OSPF so that all routes toward RIP will prefer RDR22.

Branch/Remote Operations Section:

  1. Configure a GRE/IPsec VPN tunnel between RDR11 and ES1. Use 10.200.0.1 and 10.200.0.2, respectively, as the tunnel endpoints.

IPv6 Section:

  1. Configure OSPFv3 on all of the internal links in ISP1.
  2. Configure EIGRPv6 on all of the internal links in ISP2.
  3. Configure a manual IPv6 in IPv4 tunnel between OIPv6 and EIPv6. Configure IPv6 addresses of your choice on each end of the tunnel, so long as they are in the same subnet.
  4. Enable RIP on all IPv6 interfaces on EIPv6 and OIPv6.

In the end, I really learned a lot from this experience, and I look forward to a future, cleaner revision of this project (when I find some time). I had a lot of fun working on it and troubleshooting my initial design issues. Rest assured, there are still mistakes and omissions in the current topology. Looking ahead, I will probably use IOU/IOL for large topology designs, as GNS3 can be somewhat limiting. Who knows, maybe we’ll all be lucky and Cisco will make VIRL available soon 🙂

Attached is a PDF of the lab information, and an archive of the GNS3 project. The archive is only 2MB, but be forewarned that it decompresses to 1.5 GB. If you found any of this helpful in any way, drop me a line 🙂