国外K8最新资料

PP139226557

HI,
+ C* s$ x) H, @3 H7 o* a, h! H
) X) r# B" b- iNew account but old user, for know reasons:)
: Z  {9 C$ I) S9 T9 F
) ~, U3 W& I( S: {/ M  s8 ?Took K8 recently and failed. If you have your lab scheduled in Europe then be ready. Everyone in Brussels is getting it now.

$ T$ \' V- e; [Below is what I remember from the exam, can someone update main K8 thread with the relevant information?

I have also drawn physical, ipv6, vpnv4 and igp topologies - check out shared section.
" H& |! t% _5 F& b

. p) m8 K1 r6 N; m2 ~; T( Y9 G0 `IP addressing
Loopbacks: 10Y.X.X.X
EIGRP domain: 10.Y.XX.X
, H7 a- w' v) C) k) d2 `RIP domain: 10.10Y.XX.X
OSPF domain: 10.20Y.XX.X
3 S/ r( H- {; V; `6 P3 G8 J% R
Layer2
! K6 z/ W+ l; M7 K& iBlock unknown unicast/multicast
3 portchannels – defined load balancing method
# h; |8 c, i& k' r* e2 fEnable bpdu filter on all BB links on 3 switches. Fa0/10 on sw4 was shutdown.
1 l. H$ o7 d5 e. }Vlan1 to be tagged on all switches.
  G& i. d2 ], o! ]STP – rpvst on all switches, with default timers. Sw1 to be root for all vialns 1-4094, sw2 to be secondary. Question indicated to make sure it always stays as root. Used priority 0
Back to back Frame raly links. – configured # frame-relay switching + interface-type dce
PPP encapsulation between R5 R3. No auth, just encapsulation ppp.
" R) N# L. g2 t0 D# [% MDisble DTP on all trunks
All unused ports on all switches to be assigned into vlan 999 and shutdown. Including Gig ports
Ports in on sw1 I think connecting to routers  R3 and R1 should have port – security enabled. 1 mac address per port, dynamically learned and it should survive reboot.

2 l& h! I1 S6 ^4 [: f& }L2 security
5 users will connect to ports in vlan500. Users connected to these ports  should not  be able to talk to each other, just to their gateway. Also portfast to be enabled on those.
L2 Acl – reference single named ACL to block SMTP, DNS and HTTP traffic to users from and to Vlan500 on sw3
% M8 F) T* y) P0 Q" _) n: O, o
5 I" r# k3 o0 S' \& F: DLayer3
( H( b$ G. \; C# P8 z* q) L6 uLoopback were shown as belonging to OSPF, however in guidelines they said that loopbacks can be advertised into both EIGRP and OSPF (helpful with iBGP peering)
Enable OSPF 100 as per diagram
SW1 vlan 13, 16 and 68 should always be designated router.
, c- r/ I; {, a; ]! |7 AR3 and R1 ports (connecting to SW1) – should always be in DROTHER state
Area 1 to be stub but with ability to have exterior routes redistributed into it.
4 k" s7 c+ ^% k) r! @, l. ^SW1 to originate default route everywhere in OSPF domain
# l' i: c' m( w3 G+ K" V
Enable EIGRP YY as per diagram
Redistribute EIGRP into OSPF and vice versa on R5 only. Make sure prefixes are still reachable when link between R5 R4 goes down.
8 [* U/ `! ]1 W3 Y( N8 gRedistribute on Sw1 from RIP to OSPF (or both do not remember at the moment) –question said to make sure there are no routing loops and not to use any static routes to solve them.
6 m  R$ P% ~" [% u$ u/ Z: a
2 Z9 d/ @$ R/ S/ R: g; v* \- [: ZIPv6
Enable ipv6 OSPF and EIGRP . Redistribute between both on SW3
Create tunnel between R1 and R3 – they give you all the details for it and run EIGRP on that.

BGP,
iBGP with R1 as route reflector. R1 can only start bgp session. Use md5 for each session
eBGP – enable from R4 and R5 to AS 254. Need as-path prepending on on R5 and next-hop-self on both routers.
# r' ^) w5 u6 P* D# u
* H/ s6 E. s/ l. w* O5 IL3 MPLS
% g' V- d" k' u, E9 `MPLS ldp to be enabled between R3, R5, R1 and R2
, ?+ Z1 h( ]- f/ ]( q7 aF0/1 on R3 is simulating connection to cust SITE1 vrf
Fo/1 on R2 is simulating connection to cust SITE2 vrf
They ask you to ping and traceroute and to make sure traffic between both loopbacks goes over MPLS.
R3 connects to Sw2 int f0/4 (I think) – interfaces is a L3 interface
R2 connects to Sw2 int f0/2 – interface is a L2 interface.
7 X$ b# W% ?+ W* t! V, |! P! Z3 gR3 talks to R5 using rd 3:3 (pretty much exact wording)
5 w7 {9 T- }3 u5 B/ fR2 talks to R5 using rd2:2
& u% o; t' W# a6 Z) y$ XSW2 has got 2 loopback interfaces L71 71.71.71.71 and L72 72.72.72.72. you need to make sure there are two separate routing tables on R2 for vrf SITE1 and vrf Site2. You will need to put loopbacks and L3 uplinks into corresponding VRFs
They also want you to enable BGP as a PE-CE protocol with customer’s ASN set to BGP777
* Y. L- j' x1 HR5 is acting as a RR for VPN traffic only. They do not allow you to configure direct R2 – R3 vpnv4 neighbor. All needs to be done via R5.

% e+ n- \! ~. C6 z0 i, vServices:
* @* B6 k# w: }) S; ]
" [: E* G: k: p) w) MNTP:
  ?' k  h9 o0 V: ]8 lEnable NTP between R1 and R3, R5 make sure it survives reload?
GLBP – between R4 R5 on vlan 45.  Assign IP to the group, configure R5 with weighting of 150 and make sure that it handles 3 responses to R4’s 1. ) I set R4 as 50.
The also ask you to enable Md5 password using key-string
SYSLOG
! F; {$ S0 {# S' {To make sure that any config changes are logged and syslog is notified. They said that local memory should not store nay information.  Only 10 lines to be stored and sensitive information should not be logged – hidekeys
# {- c  ~% D! Q+ w4 J! cPolicy based routing
Loopback 148 – on switch 3 – 148.0.0.8/32
Loopback 148 – on R4 – 148.0.0.4/32
Make sure that traffic from L148 on Sw3 to L148 on R4, and only that traffic is routed via vlan18. If vlan 18 is down the traffic should be dropped. Advertise both loopbacks into eigrp

# T" f1 v0 {4 w. g/ vEEM
They give you pattern to match and ask you to bounce interfaces in certain order.  
Username authentication
( K7 m5 T4 r* R7 L$ ^2 users, admin and guest.
When admin logs in then he should go straight to enable.  Guest is needs to go to normal moed, the one with Router> mode.
* R( d' I! n/ DLines vty 0 16 should use ssh, your config should not affect console.
( O( ]$ t% L4 a( H7 D5 U
3 j( I* s* E( d& V+ O" G3 b. C5 dMulticast:
+ l2 B9 Y( k3 ]* i) {# s- TEnable industry standard method of advertising RP.
9 K& o9 H* F/ j% t# @) M; SConfigure Loopback1 with 200.100.100.100 on R3 and R2 and advertise these to OSPF/EIGRP
There will be senders in vlan68 and int f0/1 of R4 will join the 232.1.1.1 group.
; `/ A6 q/ u$ h4 R1 zUse sparse-mode everywhere in OSPF and EIGRP domains.
9 [: p. g/ W6 A! vR2 and R3 should advertise Loopback 1 as RP
$ g% o- P6 n' O% ^R2 and R3 should have MSDP enabled.
7 Y! q+ Z, m& `3 TLater question asks to only allow vlan68 to allow to register wit RP – restriction on both RPs
8 p# w" f; Y- u: |7 J* U6 l, c
2 i$ \% J" p$ N7 E1 dQoS
Policy on R5 with 3 class maps. Classification based on ACL’s. They tell you what naming convention to use.  1 class for for SSH traffic – police based on cir,
) c9 h, ~5 j) Y; X6 K+ d2nd for WWW, HTTPS traffic- drop all traffic (match any)
and the last one was and ACL for icmp echo and echo reply – police based on packet rate.
; \% c9 I# k: k. y1 N& L
  V5 c2 _7 @* |0 R, q" s1 ZL3 MPLS VPN QoS
Didn’t do this one – it was saying something about traffic leaving our core towards CE should be classified based on the last MPLS tag?? – something like that
6 O1 K  |% M- g8 f) tAlso something about possible  need of reconfiguring class maps.
Config has some predefined MPLS class-maps and the classification is done based on qos-groups.
" @+ [/ M* K5 u3 r& N: Q' I
Hope this helps

5 w& K5 M1 P$ a. r8 U, b3 S. u" m8 c

幸福的海

mickeymichael

老信息了~~

yang314

suisuivivi

这个需求百分之多少？？

chen701

啥也不说了，楼主就是给力！

winnerccie

llw_annie

不管你信不信，反正我是信了。

hehui200812

拿过来解解！

cisco_2012

幸福的海

七曜

action1

我信了

ppp12345

不管你信不信，反正我是信了。

llw_annie

听说6月底 (23日到26日)在美国 Orlando 的"Cisco Live" 大会上就会宣布新的5.0 大纲. 如属实， 今年底或明年初 LAB 题目全换。