CloudLabBox
Try the free demo

CCNP ENARSI lab 34 of 35

Capstone 1: build the Merganser enterprise WAN

Build a complete enterprise WAN from bare addressing: an OSPF core, an EIGRP data centre joined by safe mutual redistribution, an eBGP Internet edge that feeds a default route, and an encrypted phase 3 DMVPN for the branches in its own OSPF area, then prove every path end to end.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 4,608 MB in total.

In your workspace: Shared, then CCNP ENARSI 300-410 guided labs, then 34 - Capstone 1 - build the Merganser enterprise WAN

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 4,608 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 150 minutes
Nodes need
8 vCPU, 4,608 MB
Smallest plan
Standard

The scenario

Merganser Group has merged three networks and you are the engineer who joins them. Everything is cabled and addressed; no routing, VPN or service is configured, except on the provider's router. Build the design below, then prove it works from every corner. Work in the order of the tasks: each one depends on the one before.

RouterRoleKey addresses
HQ1, HQ2head-office core; OSPF area 0; EIGRP to the data centre; redistribution pointsLo0 10.255.0.1 / .2; HQ1–HQ2 10.0.12.0/24; to DC 172.20.101.0/24 and 172.20.102.0/24
DCdata centre, EIGRP named mode DC, AS 100LANs 172.20.0.0/24–172.20.3.0/24 (Lo1–Lo4), Lo0 172.20.255.1
EDGEInternet edge: OSPF area 0 and 10, eBGP, DMVPN hubLo0 10.255.0.3; to HQ1 10.0.13.0/24, to HQ2 10.0.23.0/24; Internet 198.51.100.1/30; Tunnel0 172.16.0.1/24
ISPprovider AS 64501 (configured)198.51.100.2 (EDGE), .5 (BR1), .9 (BR2); content 192.0.2.1
BR1branch 1, DMVPN spoke, DHCP server for PC1Internet 198.51.100.6/30; LAN 10.10.1.1/24; Tunnel0 172.16.0.11
BR2branch 2, DMVPN spokeInternet 198.51.100.10/30; LAN Lo1 10.10.2.1/24; Tunnel0 172.16.0.12

Design rules

  • OSPF process 1: area 0 on HQ1, HQ2 and EDGE (loopbacks and core links, point-to-point network type), router IDs 1.1.1.1, 2.2.2.2, 3.3.3.3. Area 10 is the DMVPN: tunnels use the point-to-multipoint network type; branch router IDs 11.11.11.11 and 12.12.12.12; BR1's LAN is passive. EDGE summarises area 10 as 10.10.0.0/16 and originates a default route into OSPF from its BGP default.
  • EIGRP: named instance DC, AS 100, on DC (all of 172.20.0.0/16) and on HQ1/HQ2 (their DC links). Router IDs 1.1.1.1, 2.2.2.2 and 5.5.5.5.
  • Redistribution on both HQ1 and HQ2, both directions, with tags: EIGRP → OSPF tagged 90 (deny tag 110), OSPF → EIGRP tagged 110 (deny tag 90), seed metric 1000000 10 255 1 1500, subnets into OSPF.
  • BGP: EDGE in AS 64500 peers with 198.51.100.2 (AS 64501) with MD5 password Merg-Bgp-Key, and originates 203.0.113.0/24 (static route to Null0).
  • DMVPN phase 3: Tunnel0 on EDGE (hub) and both branches: NHRP network ID 10, authentication MERGKEY, tunnel key 10, IP MTU 1400, MSS 1360, NHRP redirect on the hub and shortcut on the spokes, IPsec profile DMVPN-PROF (IKEv2 keyring DMVPN-KR with key Merg-Dmvpn-Psk, transform set DMVPN-TS AES-256/SHA-256 transport mode).
  • DHCP on BR1: pool BR1-LAN for 10.10.1.0/24 (gateway .1, DNS 192.0.2.53, domain merganser.lab), excluding .1–.9.
  • The branches keep their static default route to the ISP for Internet traffic (split tunnelling).

What you’ll practise

  • Design and configure OSPF areas, network types and summarisation for a core and a DMVPN area
  • Join an EIGRP named-mode domain to OSPF at two points without feedback
  • Peer eBGP with an authenticated provider, originate the company prefix and inject a default route into OSPF
  • Build an IKEv2-protected phase 3 DMVPN running OSPF point-to-multipoint
  • Serve DHCP at a branch and verify the whole design end to end

The tasks

  1. OSPF area 0
  2. EIGRP data centre and redistribution
  3. The Internet edge
  4. The encrypted DMVPN and area 10
  5. Branch DHCP
  6. Prove the design

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone 1 - build the Merganser enterprise WAN8 nodes, 9 links. Every link is listed as text below the diagram.HQ1HQ2EDGEDCISPBR1BR2PC1Gi0/1eth0Gi0/1Gi0/1Gi0/2Gi0/0Gi0/1Gi0/0Gi0/2Gi0/0Gi0/0Gi0/0Gi0/0Gi0/1Gi0/2Gi0/0Gi0/2Gi0/1
8 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ1 Gi0/0 to DC Gi0/0
  • HQ2 Gi0/0 to DC Gi0/1
  • HQ1 Gi0/1 to HQ2 Gi0/1
  • HQ1 Gi0/2 to EDGE Gi0/0
  • HQ2 Gi0/2 to EDGE Gi0/1
  • EDGE Gi0/2 to ISP Gi0/0
  • ISP Gi0/1 to BR1 Gi0/0
  • ISP Gi0/2 to BR2 Gi0/0
  • BR1 Gi0/1 to PC1 eth0
Nodes in Capstone 1: build the Merganser enterprise WAN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQ2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
EDGECisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
DCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENARSI 300-410 guided labs.

  3. Open 34 - Capstone 1 - build the Merganser enterprise WAN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENARSI labs

All CCNP ENARSI labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.