CloudLabBox
Try the free demo

CCNP ENCOR lab 35 of 36

Build capstone: campus, edge and secure branch

Build Fernhill Freight's new Leeds site and its Bristol branch from bare addressing: an LACP-bundled campus core with planned spanning-tree roots and HSRP, OSPF, an eBGP internet edge with PAT, an IKEv2 VTI to Bristol that backhauls the branch's internet traffic, NTP and SSH.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 5,888 MB in total.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 35 - Build capstone - campus edge and secure branch

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 5,888 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 180 minutes
Nodes need
8 vCPU, 5,888 MB
Smallest plan
Standard

The scenario

Fernhill Freight has signed the lease on a new distribution centre in Leeds and is moving its Bristol branch to broadband. You're the engineer building it, from cabled devices with interface addresses to a working network. Everything you've practised in this course comes together here; the design is below, and it's up to you how you get there. The tasks group the work and give you checkpoints.

Design

AreaRequirement
VLANsVTP transparent on all switches; VLAN 10 STAFF, VLAN 20 WAREHOUSE, VLAN 999 NATIVE (unused, native on all trunks)
Core bundleDSW1 Gi0/0–0/1 ↔ DSW2 Gi0/0–0/1 = Po1, LACP (DSW1 active, DSW2 passive), 802.1Q trunk, native 999, allowed 10,20
AccessASW1 Gi0/1 → DSW1 Gi0/2 and ASW1 Gi0/2 → DSW2 Gi0/2: static 802.1Q trunks (DTP off), native 999, allowed 10,20. ASW1 Gi1/0: PC1, VLAN 10, PortFast, BPDU guard
Spanning treeRapid PVST+; DSW1 root for VLAN 10 and backup for 20; DSW2 root for VLAN 20 and backup for 10
GatewaysSVIs: DSW1 .2, DSW2 .3 in each VLAN; HSRPv2, VIP .1, group = VLAN; DSW1 active for 10, DSW2 for 20 (priority 110, pre-empt on all groups)
OSPFProcess 1, area 0: R1, DSW1, DSW2 (uplinks, loopbacks, SVIs passive) and BR1 (tunnel, loopback, LAN passive); router IDs = Loopback0
InternetR1 AS 65010 ↔ ISP AS 64500 (203.0.113.1). Advertise only 192.0.2.0/24 (Null0 anchor); accept only the default route; R1 originates the default into OSPF
NATPAT on R1 for all 10.0.0.0/8 traffic to Gi0/0's address; inside: Gi0/1, Gi0/2, Tunnel1
Branch VPNR1 Tunnel1 172.16.12.1/30 ↔ BR1 Tunnel1 172.16.12.2/30: static VTI, IKEv2 (AES-CBC-256, SHA-256, group 14, PSK Fh-Br1stol-VPN), IPsec ESP AES-256/SHA-256 tunnel mode, IP MTU 1400, MSS 1360. Bristol's internet traffic goes through HQ
TimeR1 is the NTP master (stratum 3); DSW1, DSW2 and BR1 sync from R1's Loopback0
ManagementR1: user admin (privilege 15, secret Fh-Adm1n-Local, scrypt), domain fernhill.example, RSA 2048, SSH v2 only on VTY 0–4
DevicePre-configured addresses
R1Gi0/0 203.0.113.2/30, Gi0/1 10.0.1.1/30, Gi0/2 10.0.2.1/30, Lo0 10.255.0.1
DSW1 / DSW2Gi0/3 10.0.1.2/30 / 10.0.2.2/30 (routed), Lo0 10.255.0.11 / 10.255.0.12
BR1Gi0/0 203.0.113.6/30, Gi0/1 10.20.10.1/24, Lo0 10.255.0.21, static route to 203.0.113.0/30 via the ISP
ISP203.0.113.1 (Leeds), 203.0.113.5 (Bristol), Lo0 198.51.100.1 (internet test server); BGP to R1 is ready
PC1 / PC210.10.10.10/24 gw .1 / 10.20.10.10/24 gw .1

Topology: ISP connects to R1 (Leeds) and BR1 (Bristol); R1 has routed links to DSW1 and DSW2; DSW1 and DSW2 are joined by two cables (Po1) and each has a trunk to ASW1; PC1 hangs off ASW1, PC2 off BR1.

What you’ll practise

  • Design-to-config: turn a written design into working configuration across eight devices
  • Build the campus: VLANs, LACP, trunks, Rapid PVST+ roots, edge protection and HSRP
  • Route the site with OSPF and originate a default from the internet edge
  • Connect to the provider with filtered eBGP and give the whole company internet access with PAT
  • Join the branch with an IKEv2 static VTI and backhaul its internet traffic through HQ
  • Add NTP and SSH-only management, then prove every requirement with show commands and pings

The tasks

  1. Layer 2 campus
  2. Gateways
  3. OSPF
  4. The internet edge
  5. NAT
  6. The Bristol VTI
  7. Time and management

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Build capstone - campus edge and secure branch8 nodes, 10 links. Every link is listed as text below the diagram.DSW1DSW2ASW1R1ISPBR1PC1PC2Gi1/0eth0Gi0/1eth0Gi0/0Gi0/1Gi0/3Gi0/1Gi0/3Gi0/2Gi0/2Gi0/1Gi0/2Gi0/2Gi0/0Gi0/0Gi0/1Gi0/1Gi0/0Gi0/0
8 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • DSW1 Gi0/0 to DSW2 Gi0/0
  • DSW1 Gi0/1 to DSW2 Gi0/1
  • DSW1 Gi0/2 to ASW1 Gi0/1
  • DSW2 Gi0/2 to ASW1 Gi0/2
  • DSW1 Gi0/3 to R1 Gi0/1
  • DSW2 Gi0/3 to R1 Gi0/2
  • R1 Gi0/0 to ISP Gi0/0
  • BR1 Gi0/0 to ISP Gi0/1
  • ASW1 Gi1/0 to PC1 eth0
  • BR1 Gi0/1 to PC2 eth0
Nodes in Build capstone: campus, edge and secure branch, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
DSW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
DSW2Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
ASW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 35 - Build capstone - campus edge and secure branch and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.