CloudLabBox
Try the free demo

CCIE Enterprise Infrastructure practice lab 8 of 8

Full mock with a scoring report

An 8-hour practice run across a whole enterprise: build a campus, routing and a BGP edge, repair an inherited DMVPN and MPLS VPN, then add multicast, security, services and automation. A scoring script on GRADER tests the network by outcome and prints a report out of 100.

Run this lab

It needs Professional: its 17 nodes are set to 18 vCPU and 13,568 MB in total.

In your workspace: Shared, then CCIE Enterprise Infrastructure practice guided labs, then 08 - Full mock with a scoring report

Run it on Professional from £7.50 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 18 vCPU and 13,568 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 480 minutes
Nodes need
18 vCPU, 13,568 MB
Smallest plan
Professional

The scenario

This is the whole of Halden Freight on one page. You have 8 hours. Read everything first, because later sections lean on earlier ones. The real exam is not like this in detail: treat this as stamina and integration practice, not a preview.

        ISPA ------------- ISPB
       /  |                 |  \  \
      /   |                 |   \  SP2
   EDGE   +-- HUB ~~~~ DMVPN ~~~~ SP1
   |  \         |
   |   \        |
 CORE1 -- CORE2 --- PE1 --- P1 --- PE2 --- CE2
   |        |
  DSW1 == DSW2
     \    /
      ASW1 --- HOST

   Every device also has an out-of-band port on the OOB LAN with GRADER.
PartWhoDesign
CampusDSW1, DSW2, ASW1VLAN 10 USERS, 20 PHONES, 99 MGMT, 999 NATIVE (unused). Po1 between DSWs by LACP. MST region HQ, revision 1: instance 1 has VLANs 10 and 99, instance 2 has VLAN 20. DSW1 is root of instances 0 and 1, DSW2 of instance 2.
GatewaysDSW1, DSW2SVIs .2 and .3, virtual .1 in 10.8.10.0/24, 10.8.20.0/24, 10.8.99.0/24. HSRP version 2. Active matches the root. VLAN 10 is dual stack: 2001:db8:8:10::/64. ASW1 is 10.8.99.11.
DHCPCORE1Pool for VLAN 10 from .100 up, gateway .1, already configured. Relay on the DSWs. Snooping and DAI on ASW1.
OSPFEDGE, CORE1, CORE2, DSW1, DSW2, HUBArea 0, HMAC-SHA-256 on every link, point-to-point on two-router links. OSPFv3 for IPv6 on the same links. SVIs are passive.
EIGRPHUB, SP1, SP2Named HALDEN, AS 100, over the DMVPN. Already built.
BGPEDGEAS 64496. ISPA AS 64500 at 198.51.100.1 is preferred. ISPB AS 64510 at 198.51.100.5 is backup. Halden's public range is 203.0.113.0/24.
NATEDGE10.8.0.0/16 reaches the Internet by PAT on whichever ISP interface it leaves. Internet test address 198.18.8.1.
DMVPNHUB, SP1, SP2Tunnel0 10.8.200.0/24, as in lab 4: VRF INET, IKEv2 key Halden-Dmvpn-2026, tunnel key 100, NHRP authentication HALDEN, Phase 3.
MPLSPE1, P1, PE2Already built. VRF PARTNER, RT 65000:8 both ways, carries 10.8.0.0/16 from CORE2 to CE2's 172.31.1.0/24.
MulticastCORE1, CORE2, HUBRP is CORE1, by BSR, for 239.8.0.0/16. CORE2 Loopback8 has joined 239.8.8.8.
ManagementEDGEOn Gi5, 10.255.255.1. GRADER runs TACACS+ (key Tac-Key-2026, users alice / Alice-Pass1), syslog, NetFlow v9 on UDP 2055.

Addressing

DeviceInterfaceAddressConnects to
ISPALo10198.18.8.1/24
ISPAGi0/0198.51.100.1/30EDGE Gi1
ISPAGi0/1198.51.100.9/30ISPB Gi0/1
ISPAGi0/2198.51.100.13/30HUB Gi0/0
ISPAGi0/710.255.255.14/24OOB
ISPBLo10198.19.8.1/24
ISPBGi0/0198.51.100.5/30EDGE Gi4
ISPBGi0/1198.51.100.10/30ISPA Gi0/1
ISPBGi0/2198.51.100.17/30SP1 Gi0/0
ISPBGi0/3198.51.100.21/30SP2 Gi0/0
ISPBGi0/710.255.255.15/24OOB
EDGELo010.8.255.1/32, 2001:db8:8:ff::1/128
EDGEGi1198.51.100.2/30ISPA Gi0/0
EDGEGi210.8.1.1/30, 2001:db8:8:1::1/64CORE1 Gi0/0
EDGEGi310.8.2.1/30, 2001:db8:8:2::1/64CORE2 Gi0/0
EDGEGi4198.51.100.6/30ISPB Gi0/0
EDGEGi510.255.255.1/24OOB
CORE1Lo010.8.255.2/32, 2001:db8:8:ff::2/128
CORE1Gi0/010.8.1.2/30, 2001:db8:8:1::2/64EDGE Gi2
CORE1Gi0/110.8.3.1/30, 2001:db8:8:3::1/64CORE2 Gi0/1
CORE1Gi0/210.8.4.1/30, 2001:db8:8:4::1/64DSW1 Gi1/0
CORE1Gi0/310.8.6.1/30, 2001:db8:8:6::1/64HUB Gi0/1
CORE1Gi0/710.255.255.2/24OOB
CORE2Lo010.8.255.3/32, 2001:db8:8:ff::3/128
CORE2Lo810.8.88.1/24
CORE2Gi0/010.8.2.2/30, 2001:db8:8:2::2/64EDGE Gi3
CORE2Gi0/110.8.3.2/30, 2001:db8:8:3::2/64CORE1 Gi0/1
CORE2Gi0/210.8.5.1/30, 2001:db8:8:5::1/64DSW2 Gi1/0
CORE2Gi0/3172.16.8.1/30PE1 Gi0/2
CORE2Gi0/710.255.255.3/24OOB
DSW1Gi1/310.255.255.4/24OOB
DSW2Gi1/310.255.255.5/24OOB
ASW1Gi1/310.255.255.6/24OOB
HUBGi0/0198.51.100.14/30ISPA Gi0/2
HUBLo010.8.255.7/32, 2001:db8:8:ff::7/128
HUBTunnel010.8.200.1/24
HUBGi0/110.8.6.2/30, 2001:db8:8:6::2/64CORE1 Gi0/3
HUBGi0/710.255.255.7/24OOB
SP1Gi0/0198.51.100.18/30ISPB Gi0/2
SP1Lo010.8.255.8/32
SP1Lo1010.8.101.1/24
SP1Tunnel010.8.200.8/24
SP1Gi0/710.255.255.8/24OOB
SP2Gi0/0198.51.100.22/30ISPB Gi0/3
SP2Lo010.8.255.9/32
SP2Lo1010.8.102.1/24
SP2Tunnel010.8.200.9/24
SP2Gi0/710.255.255.9/24OOB
PE1Lo010.8.255.21/32
PE1Gi0/010.8.11.1/30P1 Gi0/0
PE1Gi0/2172.16.8.2/30CORE2 Gi0/3
PE1Gi0/710.255.255.10/24OOB
P1Lo010.8.255.22/32
P1Gi0/010.8.11.2/30PE1 Gi0/0
P1Gi0/110.8.12.1/30PE2 Gi0/0
P1Gi0/710.255.255.11/24OOB
PE2Lo010.8.255.23/32
PE2Gi0/010.8.12.2/30P1 Gi0/1
PE2Gi0/2172.16.9.1/30CE2 Gi0/0
PE2Gi0/710.255.255.12/24OOB
CE2Lo10172.31.1.1/24
CE2Gi0/0172.16.9.2/30PE2 Gi0/2
CE2Gi0/710.255.255.13/24OOB
GRADEReth010.255.255.250/24OOB

Rules for the whole lab

  • Keep every address, hostname and interface as given. No new tunnels except those named.
  • Don't touch VRF OOB, the OOB ports, user grader, line vty 5 15, or the LAB-FAIL-* applets. If GRADER can't log in, it scores zero for that device.
  • ISPA, ISPB and CE2 are outside your control.
  • No static routes except those the design names or those already in the start-up configuration.

What you’ll practise

  • Plan and pace a full day across every part of the course
  • Build layer on layer, without breaking what you built before
  • Repair inherited faults under time pressure
  • Read a scoring report and find the cause of each lost mark

The tasks

  • Section 1: Campus (18 points)
  • Section 2: Routing and the Internet edge (21 points)
  • Section 3: Inherited WAN (22 points)
  • Section 4: Multicast (8 points)
  • Section 5: Security and services on EDGE (19 points)
  • Section 6: Automation (12 points)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Full mock with a scoring report17 nodes and 1 network, 37 links. Every link is listed as text below the diagram.ISPAISPBEDGECORE1CORE2DSW1DSW2ASW1HOSTHUBSP1SP2PE1P1PE2CE2GRADEROOBGi0/0Gi0/0Gi0/1Gi0/0Gi0/2Gi0/0eth0Gi0/2Gi0/0Gi0/2Gi1/0Gi0/2Gi1/0Gi0/3Gi0/2Gi0/0Gi0/2Gi0/1Gi0/2Gi0/3Gi0/1Gi1Gi0/0Gi2Gi0/0eth0Gi0/2Gi0/2Gi0/0Gi0/1Gi0/1Gi0/0Gi0/0Gi0/1Gi0/1Gi0/3Gi0/0Gi1/3Gi1/3Gi0/1Gi0/1Gi5Gi3Gi0/0Gi0/7Gi1/3Gi4Gi0/0Gi0/7Gi0/7Gi0/7Gi0/7Gi0/7Gi0/7Gi0/7Gi0/7Gi0/7Gi0/7
17 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE Gi1 to ISPA Gi0/0
  • EDGE Gi4 to ISPB Gi0/0
  • ISPA Gi0/1 to ISPB Gi0/1
  • EDGE Gi2 to CORE1 Gi0/0
  • EDGE Gi3 to CORE2 Gi0/0
  • CORE1 Gi0/1 to CORE2 Gi0/1
  • CORE1 Gi0/2 to DSW1 Gi1/0
  • CORE2 Gi0/2 to DSW2 Gi1/0
  • CORE1 Gi0/3 to HUB Gi0/1
  • CORE2 Gi0/3 to PE1 Gi0/2
  • ISPA Gi0/2 to HUB Gi0/0
  • ISPB Gi0/2 to SP1 Gi0/0
  • ISPB Gi0/3 to SP2 Gi0/0
  • PE1 Gi0/0 to P1 Gi0/0
  • P1 Gi0/1 to PE2 Gi0/0
  • PE2 Gi0/2 to CE2 Gi0/0
  • DSW1 Gi0/0 to DSW2 Gi0/0
  • DSW1 Gi0/1 to DSW2 Gi0/1
  • ASW1 Gi0/0 to DSW1 Gi0/2
  • ASW1 Gi0/1 to DSW2 Gi0/2
  • HOST eth0 to ASW1 Gi0/2
  • ISPA Gi0/7 to OOB (network)
  • ISPB Gi0/7 to OOB (network)
  • CORE1 Gi0/7 to OOB (network)
  • CORE2 Gi0/7 to OOB (network)
  • HUB Gi0/7 to OOB (network)
  • SP1 Gi0/7 to OOB (network)
  • SP2 Gi0/7 to OOB (network)
  • PE1 Gi0/7 to OOB (network)
  • P1 Gi0/7 to OOB (network)
  • PE2 Gi0/7 to OOB (network)
  • CE2 Gi0/7 to OOB (network)
  • EDGE Gi5 to OOB (network)
  • DSW1 Gi1/3 to OOB (network)
  • DSW2 Gi1/3 to OOB (network)
  • ASW1 Gi1/3 to OOB (network)
  • GRADER eth0 to OOB (network)
Nodes in Full mock with a scoring report, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPACisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPBCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
EDGECisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial2 vCPU, 4,096 MB
CORE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CORE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
DSW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
DSW2Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
ASW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
HOSTAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
HUBCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SP1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SP2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
P1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
GRADEREVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCIE Enterprise Infrastructure practice guided labs.

  3. Open 08 - Full mock with a scoring report and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCIE Enterprise Infrastructure practice labs

All CCIE Enterprise Infrastructure practice labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.