CCIE Enterprise Infrastructure practice lab 1 of 8

Campus Layer 2 at scale

Build a dual-stack campus on six virtual switches: pruned trunks, LACP, static and Layer 3 channels, MST meeting a Rapid-PVST+ switch at its boundary, HSRP aligned with spanning tree, DHCP with option 82, and DAI, VACLs and PACLs. A rogue switch and a fault injector prove the protection. A 3 to 4 hour practice lab.

Run this lab

It needs Standard: its 12 nodes are set to 12 vCPU and 7,680 MB in total.

In your workspace: Shared, then CCIE Enterprise Infrastructure practice guided labs, then 01 - Campus Layer 2 at scale

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 12 vCPU and 7,680 MB together. Every lab plan includes every guided lab.

Level: Advanced
Time: About 210 minutes
Nodes need: 12 vCPU, 7,680 MB
Smallest plan: Standard

The scenario

Halden Freight is replacing the depot campus. Two distribution switches serve three access switches, and one of those, ASW3, is an old unit whose owner won't let it leave Rapid-PVST+. Somebody keeps plugging an unmanaged switch with spanning tree into any free port: that's ROGUE.

                 R1  10.1.100.0/24, DHCP server
                /  \
           Gi1/0    Gi1/0   routed
           DSW1 ===== DSW2     Po12 trunk, Po3 routed
          /|  \\      /|  \
    Po1  / | Gi1/3  / | Po2\  Gi2/1
        /  | Gi2/0 /  |     \
     ASW1  |     ASW2  |   ROGUE ---- also on ASW1 Gi1/3
       |   +--- ASW3 --+
       |          |
      A1      G2, SNIFF      A2 and G1 on ASW2

VLAN	Name	IPv4	IPv6	Active gateway
10	STAFF	10.1.10.0/24	2001:db8:1:10::/64	DSW1
20	VOICE	10.1.20.0/24	none	DSW1
30	GUEST	10.1.30.0/24	2001:db8:1:30::/64	DSW2
99	MGMT	10.1.99.0/24	none	DSW2
999	NATIVE	none	none	Carries no traffic
1010	MIRROR	none	none	RSPAN only

Item	Design
SVIs	.2 on DSW1, .3 on DSW2, virtual .1. For IPv6, ::2 and ::3, and hosts use the HSRP link-local address.
Trunks	ASW1: VLANs 10, 20, 99, 1010. ASW2: 10, 30, 99. ASW3: 30, 99, 1010. Po12: all of them.
Channels	Po1 ASW1 to DSW1 LACP; Po2 ASW2 to DSW2 static; Po12 DSW1 to DSW2 LACP; Po3 DSW1 to DSW2 Layer 3 LACP, 10.1.255.1/30 and .2
MST	Region CAMPUS, revision 1. Instance 1: VLANs 10, 20. Instance 2: VLANs 30, 99. All others stay in instance 0.
Roots	DSW1 for instances 0 and 1, DSW2 for instance 2, each backing up the other
Switch management	ASW1 10.1.99.11, ASW2 .12, ASW3 .13, gateway .1
A1	ASW1 Gi1/0. A PC by DHCP on STAFF, on a port that also has to be ready for a phone on VOICE
A2	ASW2 Gi1/0. A printer, static 10.1.10.50, MAC 0200.0000.1050, STAFF VLAN
G1, G2	Guest hosts on ASW2 Gi1/1 and ASW3 Gi1/0, by DHCP
SNIFF	ASW3 Gi1/2, an analyser with no address
DHCP	R1 is the server, reached at 10.1.1.2. Its pools are configured, and hosts get .100 upwards.

Addressing

Device	Interface	Address	Connects to
R1	Lo0	10.255.1.1/32
R1	Lo10	10.1.100.1/24, 2001:db8:1:100::1/64
R1	Gi0/0	10.1.1.2/30, 2001:db8:1:1::2/64	DSW1 Gi1/0
R1	Gi0/1	10.1.2.2/30, 2001:db8:1:2::2/64	DSW2 Gi1/0
A2	eth0	10.1.10.50/24	ASW2 Gi1/0

Rules for the whole lab

ROGUE and R1 are outside your control. Keep every address as given.
No VTP advertisements, no DTP, and no VLAN on a trunk that the design doesn't list.
Spanning-tree priorities are set per instance, not with the root macro.
A host may not need any change beyond its Startup-configs entry.

What you’ll practise

Build pruned 802.1Q trunks and every kind of EtherChannel in one design
Design MST with path control, and interoperate with a Rapid-PVST+ switch at the region boundary
Protect spanning tree against a real rogue switch
Align HSRP with spanning tree and prove failover with tracking
Combine DHCP snooping, option 82, DAI, port security, VACLs and PACLs without breaking a static host
Mirror traffic across the campus with RSPAN

The tasks

Section 1: VLANs, trunks and channels (22 points)
Section 2: Spanning tree (24 points)
Section 3: Gateways and Layer 3 (18 points)
Section 4: Access layer security (24 points)
Section 5: RSPAN and the failure drill (12 points)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

12 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.

Every link, as text

R1 Gi0/0 to DSW1 Gi1/0
R1 Gi0/1 to DSW2 Gi1/0
DSW1 Gi0/0 to DSW2 Gi0/0
DSW1 Gi0/1 to DSW2 Gi0/1
DSW1 Gi0/2 to DSW2 Gi0/2
DSW1 Gi0/3 to DSW2 Gi0/3
ASW1 Gi0/0 to DSW1 Gi1/1
ASW1 Gi0/1 to DSW1 Gi1/2
ASW1 Gi0/2 to DSW2 Gi1/1
ASW2 Gi0/0 to DSW2 Gi1/2
ASW2 Gi0/1 to DSW2 Gi1/3
ASW2 Gi0/2 to DSW1 Gi1/3
ASW2 Gi0/3 to DSW1 Gi2/0
ASW3 Gi0/0 to DSW1 Gi2/1
ASW3 Gi0/1 to DSW2 Gi2/0
ROGUE Gi0/0 to ASW1 Gi1/3
ROGUE Gi0/1 to DSW2 Gi2/1
A1 eth0 to ASW1 Gi1/0
A2 eth0 to ASW2 Gi1/0
G1 eth0 to ASW2 Gi1/1
G2 eth0 to ASW3 Gi1/0
SNIFF eth0 to ASW3 Gi1/2

Nodes in Campus Layer 2 at scale, with the image each runs and the vCPU and RAM it’s set to
Node	Device	Image in Add Node	Set to
R1	Cisco IOSv	`vios-adventerprisek9-m.spa.159-3.m9`	1 vCPU, 512 MB
DSW1	Cisco IOSvL2	`viosl2-adventerprisek9-m.ssa.high_iron_20200929`	1 vCPU, 768 MB
DSW2	Cisco IOSvL2	`viosl2-adventerprisek9-m.ssa.high_iron_20200929`	1 vCPU, 768 MB
ASW1	Cisco IOSvL2	`viosl2-adventerprisek9-m.ssa.high_iron_20200929`	1 vCPU, 768 MB
ASW2	Cisco IOSvL2	`viosl2-adventerprisek9-m.ssa.high_iron_20200929`	1 vCPU, 768 MB
ASW3	Cisco IOSvL2	`viosl2-adventerprisek9-m.ssa.high_iron_20200929`	1 vCPU, 768 MB
ROGUE	Cisco IOSvL2	`viosl2-adventerprisek9-m.ssa.high_iron_20200929`	1 vCPU, 768 MB
A1	Alpine Linux	`clbalpinebase-alpine-base-3-20-3`	1 vCPU, 512 MB
A2	Alpine Linux	`clbalpinebase-alpine-base-3-20-3`	1 vCPU, 512 MB
G1	Alpine Linux	`clbalpinebase-alpine-base-3-20-3`	1 vCPU, 512 MB
G2	Alpine Linux	`clbalpinebase-alpine-base-3-20-3`	1 vCPU, 512 MB
SNIFF	Alpine Linux	`clbalpinebase-alpine-base-3-20-3`	1 vCPU, 512 MB

How to open this lab

Sign in to your workspace at lab.cloudlabbox.com.
In File Manager, open Shared, then the folder CCIE Enterprise Infrastructure practice guided labs.
Open 01 - Campus Layer 2 at scale and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCIE Enterprise Infrastructure practice labs

All CCIE Enterprise Infrastructure practice labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.

Build your own lab

Docs

Sign in

Support