CloudLabBox
Try the free demo

Multi-vendor troubleshooting lab 11 of 12

Ticket set B with WAN BGP NAT and VPN faults

Four tickets arrive from Larkfield's sites, and six faults sit behind them across Cisco, Juniper, MikroTik and FortiGate: a firewall that blocks its own BGP, an iBGP next hop nobody can reach, NAT that covers one subnet too few, a tunnel that passes traffic one way, a return route and a published server.

Run this lab

It needs Standard: its 10 nodes are set to 11 vCPU and 9,984 MB in total.

In your workspace: Shared, then Multi-vendor interoperability and troubleshooting guided labs, then 11 - Ticket set B with WAN BGP NAT and VPN faults

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 11 vCPU and 9,984 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
11 vCPU, 9,984 MB
Smallest plan
Standard

The scenario

You're on call for Larkfield's WAN on Monday morning, after a weekend of changes by a contractor. HQ has a Cisco router, Hull a Juniper SRX, York a FortiGate, and Goole a MikroTik that hangs off HQ.

TicketSiteReported problem
INC-5201Hull"No internet at all."
INC-5202HQ"We can't reach Hull's file server, but they say they can reach ours."
INC-5203Goole"No internet, and nothing at Hull."
INC-5204York"Customers can't load the portal at 192.0.2.3."
DeviceInterfaceAddressNotes
ISPGi0/0, Gi0/1203.0.113.1/30, 198.51.100.1/30AS 64500, sends a default route by eBGP
ISPGi0/2192.0.2.1/29York's static range
ISPGi0/3198.18.9.1/24EXT, 198.18.9.10, the internet test address
R1Gi0/0203.0.113.2/30AS 65010, NAT overload for HQ and Goole
R1Gi0/110.1.0.1/24PC-HQ 10.1.0.10
R1Gi0/210.0.14.1/30iBGP to CHR1
R1Tunnel1169.254.10.1/30VTI to Hull
SRX1ge-0/0/0.0198.51.100.2/30AS 65020, zone untrust
SRX1ge-0/0/1.010.2.0.1/24Zone trust, PC-HULL 10.2.0.10
SRX1st0.0169.254.10.2/30Zone vpn
CHR1ether110.0.14.2/30iBGP in AS 65010
CHR1ether210.4.0.1/24PC-GOOLE 10.4.0.10
FGT1port1192.0.2.2/29Publishes 192.0.2.3:80 to WEB
FGT1port210.3.0.1/24WEB 10.3.0.20

Traffic rules: Goole reaches Hull through HQ over the VPN. HQ and Goole use R1's NAT for the internet. Hull uses the SRX's NAT.

What you’ll practise

  • Work a set of WAN tickets in dependency order
  • Separate traffic to a vSRX from traffic through it
  • Fix an unreachable iBGP next hop on IOS and read it on RouterOS
  • Find a one-way VPN from each end's policy
  • Find a missing NAT range and a missing return route
  • Publish a server correctly on a FortiGate

The tasks

  1. Start the Linux hosts
  2. Order the tickets
  3. Work INC-5201
  4. Work INC-5202
  5. Work INC-5203
  6. Work INC-5204
  7. Close the tickets

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Ticket set B with WAN BGP NAT and VPN faults10 nodes, 9 links. Every link is listed as text below the diagram.ISPR1SRX1FGT1CHR1PC-HQPC-HULLPC-GOOLEWEBEXTether2eth0port2eth0Gi0/1eth0ge-0/0/1eth0Gi0/2ether1Gi0/3eth0Gi0/0Gi0/0Gi0/1ge-0/0/0Gi0/2port1
10 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to R1 Gi0/0
  • ISP Gi0/1 to SRX1 ge-0/0/0
  • ISP Gi0/2 to FGT1 port1
  • ISP Gi0/3 to EXT eth0
  • R1 Gi0/1 to PC-HQ eth0
  • R1 Gi0/2 to CHR1 ether1
  • SRX1 ge-0/0/1 to PC-HULL eth0
  • CHR1 ether2 to PC-GOOLE eth0
  • FGT1 port2 to WEB eth0
Nodes in Ticket set B with WAN BGP NAT and VPN faults, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRX1Juniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
FGT1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
CHR1MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
PC-HQAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC-HULLAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC-GOOLEAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
EXTAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Multi-vendor interoperability and troubleshooting guided labs.

  3. Open 11 - Ticket set B with WAN BGP NAT and VPN faults and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Multi-vendor troubleshooting labs

All Multi-vendor troubleshooting labs

Related labs in other courses

CloudLabBox is independent of Arista Networks, Cisco, CompTIA, Fortinet, HPE, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.