CloudLabBox
Try the free demo

CCNP ENCOR lab 34 of 36

Troubleshooting capstone: from the access port to the internet

A whole Fernhill campus is down after a bad maintenance night. Work three tickets end to end through access trunks, HSRP, OSPF default routing, eBGP and NAT, and find six independent faults with a structured method.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 4,352 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 34 - Troubleshooting capstone - from the access port to the internet

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
6 vCPU, 4,352 MB
Smallest plan
Lite

The scenario

After a maintenance night at Fernhill Freight's Leeds warehouse, three tickets arrived before 07:00:

  1. INC-7001 Staff PCs (VLAN 10) can't reach anything, not even their gateway.
  2. INC-7002 Nobody on site can reach the internet; the ISP says "we can see you trying".
  3. INC-7003 Monitoring shows HSRP warnings on DSW2.

The design is unchanged and documented below. Six independent faults were introduced; some hide behind others. Fix them all without redesigning anything, and record each one as symptom → evidence → cause → fix.

AreaDesign
AccessASW1 trunks to DSW1 (Gi0/1) and DSW2 (Gi0/2), both allowing VLANs 10 and 20; PC1 in VLAN 10
STPDSW1 root for VLAN 10, DSW2 root for VLAN 20 (Rapid PVST+)
GatewaysHSRPv2: group 10 VIP 10.10.10.1 (DSW1 110, active), group 20 VIP 10.10.20.1 (DSW2 110, active); SVIs .2 (DSW1) and .3 (DSW2)
RoutingOSPF area 0 between DSW1 (10.0.1.2), DSW2 (10.0.2.2) and R1 (10.0.1.1, 10.0.2.1); R1 originates a default route learned from the ISP
InternetR1 AS 65010 ↔ ISP AS 64500 (203.0.113.1/30); R1 advertises 192.0.2.0/24 and receives a default route; PAT for 10.10.0.0/16 to Gi0/0
Test hostsPC1 10.10.10.10/24 (gateway 10.10.10.1); internet server 198.51.100.1

Topology: ISP — R1; R1 has routed links to DSW1 and DSW2; DSW1 and DSW2 are trunked to each other and to ASW1; PC1 hangs off ASW1.

What you’ll practise

  • Troubleshoot end to end across layers 2, 3 and services, following the packet
  • Find trunk and port faults on the access layer
  • Find an FHRP misconfiguration that silently removes redundancy
  • Find missing default-route origination, a BGP neighbour fault and a NAT ACL fault
  • Document each fault as symptom, evidence, cause and fix

The tasks

  1. Follow the packet
  2. INC-7001: the access layer
  3. INC-7003: the gateway pair
  4. INC-7002 (part 1): does the campus know the way out?
  5. INC-7002 (part 2): does the traffic get translated?
  6. Write it up

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting capstone - from the access port to the internet6 nodes, 7 links. Every link is listed as text below the diagram.DSW1DSW2ASW1R1ISPPC1Gi1/0eth0Gi0/1Gi0/1Gi0/2Gi0/2Gi0/3Gi0/1Gi0/3Gi0/2Gi0/0Gi0/0Gi0/0Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • DSW1 Gi0/0 to DSW2 Gi0/0
  • DSW1 Gi0/1 to ASW1 Gi0/1
  • DSW2 Gi0/2 to ASW1 Gi0/2
  • DSW1 Gi0/3 to R1 Gi0/1
  • DSW2 Gi0/3 to R1 Gi0/2
  • R1 Gi0/0 to ISP Gi0/0
  • ASW1 Gi1/0 to PC1 eth0
Nodes in Troubleshooting capstone: from the access port to the internet, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
DSW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
DSW2Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
ASW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 34 - Troubleshooting capstone - from the access port to the internet and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.