CloudLabBox
Try the free demo

Firewalls and VPNs lab 16 of 16

Capstone - merge two companies with overlapping networks

Ashgrove (Cisco ASA) has bought Brook (Juniper vSRX, with an IOS branch). Both use 10.0.1.0/24 for their servers. Build a route-based tunnel between the ASA and the SRX and translate each company into a unique range on the way through, so both head offices and Brook's branch can reach each other, without renumbering anything and without breaking either company's internet access.

Run this lab

It needs Standard: its 6 nodes are set to 7 vCPU and 8,192 MB in total.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 16 - Capstone - merge two companies with overlapping networks

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 8,192 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 150 minutes
Nodes need
7 vCPU, 8,192 MB
Smallest plan
Standard

The scenario

Ashgrove Instruments has bought Brook Sensors. Both companies numbered their server LAN 10.0.1.0/24, and both web servers are 10.0.1.10. Renumbering is a six-month project, but the finance systems must talk next week. Brook already has a tunnel from its HQ firewall (B-SRX) to its branch router (B-BR). Your job, as the network lead for the merger, is to design and build the inter-company link. This capstone gives you requirements, not steps.

RequirementDetail
R1. TunnelRoute-based IKEv2 between A-FW (VTI Tunnel1, nameif to-brook, 169.254.16.1/30) and B-SRX (st0.1, zone vpn-ash, 169.254.16.2/30). AES-256-CBC, SHA-256, DH group 20, PFS group 20, key Merger-VPN-27.
R2. Ashgrove's viewBrook's 10.0.0.0/16 appears to Ashgrove as 172.17.0.0/16: Brook's server is 172.17.1.10, the branch is 172.17.9.0/24.
R3. Brook's viewAshgrove's 10.0.1.0/24 appears to Brook (HQ and branch) as 172.16.1.0/24: Ashgrove's server is 172.16.1.10.
R4. Who translatesEach company translates its own addresses on its own firewall: A-FW maps 10.0.1.0/24 to 172.16.1.0/24; B-SRX maps 10.0.0.0/16 to 172.17.0.0/16. Nobody else changes addresses.
R5. AccessA-SRV can open http to 172.17.1.10 and 172.17.9.1; B-SRV and B-BR (from Loopback0) can reach 172.16.1.10.
R6. No regressionsInternet access (to the web server 198.18.0.80) still works from both servers, and Brook's branch tunnel still works.

What you’ll practise

  • Plan a NAT design for overlapping networks across a VPN
  • Build an ASA VTI to a vSRX st0 interface with IKEv2
  • Translate both ways on the ASA with twice NAT towards the tunnel
  • Translate both ways on the SRX with static NAT from the tunnel zone
  • Carry a third site (an IOS branch) through the SRX between two tunnels
  • Prove the design with each vendor's SA, NAT and traffic evidence

The tasks

  1. Design before you type
  2. The tunnel (R1)
  3. Translation on each side (R2 to R4)
  4. The branch (R5)
  5. Acceptance test (R5, R6)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - merge two companies with overlapping networks6 nodes, 5 links. Every link is listed as text below the diagram.ISPA-FWA-SRVB-SRXB-SRVB-BRGi0/0Gi0/0Gi0/2Gi0/0ge-0/0/1Gi0/0Gi0/1ge-0/0/0Gi0/0Gi0/1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to A-FW Gi0/1
  • ISP Gi0/1 to B-SRX ge-0/0/0
  • ISP Gi0/2 to B-BR Gi0/0
  • A-FW Gi0/0 to A-SRV Gi0/0
  • B-SRX ge-0/0/1 to B-SRV Gi0/0
Nodes in Capstone - merge two companies with overlapping networks, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
A-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
A-SRVCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
B-SRXJuniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
B-SRVCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
B-BRCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 16 - Capstone - merge two companies with overlapping networks and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.