Hands On Skills – ENSA Final Skills Exam (Equipment) Answers

CCNAv7 ENSA Skills Assessment – ENSA Final Skills Exam (Equipment) Exam Answers

Topology

Addressing Table

Assessment Objectives

• Part 1: Initialize, Reload and Configure Basic Device Settings (40 points, 40 minutes)
• Part 2: Configure and Single Area OSPFv2 (20 points, 10 minutes)
• Part 3: Optimize Single Area OSPFv2 (25 points, 20 minutes)
• Part 4: Configure Access Control, NAT, and perform configuration backup (15 points, 30 minutes)

Scenario

In this Skills Assessment (SA) you will configure the devices in a small network. You must configure a router, switch and PCs to support IPv4 connectivity for supported hosts. Your router and switch must also be managed securely. You will configure Single-Area OSPFv2, NAT, and access control lists. Further, you will backup up your working configurations to a TFTP server.

Required Resources

• 2 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 2 Switches (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)
• 2 PCs (Windows with a terminal emulation program, such as Tera Term)
• Console cables to configure the Cisco IOS devices via the console ports
• Ethernet cables as shown in the topology

Instructions

Part 1: Initialize, Reload and Configure Basic Device Settings

Total points: 40
Time: 40 minutes

Step 1: Initialize and reload routers and switches.

Erase the startup configurations and VLANs from the router and switch and reload the devices.

Before proceeding, ask your instructor verify device initializations.

On Router R1-R2

Router>enable
Router#erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete
%SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
Router#reload

On Switch S1-S2

Switch>enable
Switch#erase startup-config
Switch#delete vlan.dat
Delete filename [vlan.dat]?
Delete flash:/vlan.dat? [confirm]

Switch#reload

Step 2: Configure the routers.

Configuration tasks for R1 and R2 include the following:

Router>enable
Router#config terminal

Router(config)#no ip domain lookup 

Router(config)#hostname R1

R1(config)#ip domain-name ccna-lab.com

R1(config)#enable secret ciscoenpass

R1(config)#line console 0
R1(config-line)#password ciscoconpass
R1(config-line)#login
R1(config-line)#exit 

R1(config)#security passwords min-length 10

R1(config)#username admin secret admin1pass

R1(config)#line vty 0 15
R1(config-line)#login local
R1(config-line)#transport input ssh 
R1(config-line)#exit

R1(config)#service password-encryption 

R1(config)#banner motd #Unauthorized Access is Prohibited#

R1(config)#interface g0/0/0
R1(config-if)#description Connect to R2
R1(config-if)#ip address 10.67.254.2 255.255.255.252
R1(config-if)#no shutdown 

R1(config-if)#interface g0/0/1
R1(config-if)#description Connect to LAN A
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown

R1(config-if)##interface loopback 0
R1(config-if)#ip address 10.52.0.1 255.255.255.248
R1(config-if)#exit

R1(config)#crypto key generate rsa 
How many bits in the modulus [512]: 1024
R1(config)#

Router>enable
Router#config terminal

Router(config)#no ip domain lookup 

Router(config)#hostname R2

R2(config)#ip domain-name ccna-lab.com

R2(config)#enable secret ciscoenpass

R2(config)#line console 0
R2(config-line)#password ciscoconpass
R2(config-line)#login
R2(config-line)#exit 

R2(config)#security passwords min-length 10

R2(config)#username admin secret admin1pass

R2(config)#line vty 0 15
R2(config-line)#login local
R2(config-line)#transport input ssh 
R2(config-line)#exit

R2(config)#service password-encryption 

R2(config)#banner motd #Unauthorized Access is Prohibited#

R2(config)#interface g0/0/0
R2(config-if)#description Connect to R1
R2(config-if)#ip address 10.67.254.1 255.255.255.252
R2(config-if)#no shutdown 

R2(config-if)#interface g0/0/1
R2(config-if)#description Connect to LAN B
R2(config-if)#ip address 10.67.1.1 255.255.255.0
R2(config-if)#no shutdown

R2(config-if)##interface loopback 0
R2(config-if)#ip address 209.165.201.1 255.255.255.224
R2(config-if)#exit

R2(config)#crypto key generate rsa 
How many bits in the modulus [512]: 1024
R2(config)#

Step 3: Configure S1 and S2.

Configuration tasks for the switches include the following:

Switch>enable
Switch#configure terminal 

Switch(config)#no ip domain-lookup 

Switch(config)#hostname S1

S1(config)#ip domain-name ccna-lab.com

S1(config)#enable secret ciscoenpass

S1(config)#line console 0
S1(config-line)#password ciscoconpass
S1(config-line)#login
S1(config-line)#exit

S1(config)#interface range f0/1-4, f0/7-24, g0/1-2
S1(config-if-range)#shutdown 
S1(config-if-range)#exit

S1(config)#username admin secret admin1pass

S1(config)#line vty 0 15
S1(config-line)#login local 
S1(config-line)#transport input ssh 
S1(config-line)#exit

S1(config)#service password-encryption 

S1(config)#banner motd #Unauthorized access or use prohibited#

S1(config)#crypto key generate rsa 
How many bits in the modulus [512]: 1024

S1(config)# interface vlan 1
S1(config-if)#ip address 192.168.1.2 255.255.255.0
S1(config-if)#no shutdown 
S1(config-if)#exit

S1(config)#ip default-gateway 192.168.1.1

Switch>enable
Switch#configure terminal 

Switch(config)#no ip domain-lookup 

Switch(config)#hostname S2

S2(config)#ip domain-name ccna-lab.com

S2(config)#enable secret ciscoenpass

S2(config)#line console 0
S2(config-line)#password ciscoconpass
S2(config-line)#login
S2(config-line)#exit

S2(config)#interface range f0/1-4, f0/6-17, f0/19-24, g0/1-2
S2(config-if-range)#shutdown 
S2(config-if-range)#exit

S2(config)#username admin secret admin1pass

S2(config)#line vty 0 15
S2(config-line)#login local 
S2(config-line)#transport input ssh 
S2(config-line)#exit

S2(config)#service password-encryption 

S2(config)#banner motd #Unauthorized access or use prohibited#

S2(config)#crypto key generate rsa 
How many bits in the modulus [512]: 1024

S2(config)# interface vlan 1
S2(config-if)#ip address 10.67.1.2 255.255.255.0
S2(config-if)#no shutdown 
S2(config-if)#exit

S2(config)#ip default-gateway 10.67.1.1

Part 2: Configure Single Area OSPFv2

Total points: 10
Time: 10 minutes

Configuration tasks for R1 and R2 include the following:

User Access Verification

Password: ciscoconpass

R1>enable
Password: ciscoenpass
R1#configure terminal 

R1(config)#router ospf 1
R1(config-router)#router-id 0.0.0.1
R1(config-router)#network 10.67.254.0 0.0.0.3 area 0
R1(config-router)#network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#network 10.52.0.0 0.0.0.7 area 0
R1(config-router)#

User Access Verification

Password: ciscoconpass

R2>enable
Password: ciscoenpass
R2#configure terminal 

R2(config)#router ospf 1
R2(config-router)#router-id 0.0.0.2
R2(config-router)#network 10.67.254.0 0.0.0.3 area 0
R2(config-router)#network 10.67.1.0 0.0.0.255 area 0
R2(config-router)#

Part 3: Optimize Single-Area OSPFv2

Total points: 20
Time: 20 minutes

Step 1: Configure R1.

Configuration Tasks for R1 include the following:

Router 1

R1>enable
Password: ciscoenpass
R1#configure terminal 

R1(config)#router ospf 1

R1(config-router)#passive-interface g0/0/1
R1(config-router)#passive-interface loopback 0

R1(config-router)#auto-cost reference-bandwidth 1000
R1(config-router)#exit

R1(config)#interface loopback 0
R1(config-if)#ip ospf network point-to-point 
R1(config-if)#exit

R1(config)#interface g0/0/0
R1(config-if)#ip ospf hello-interval 30
R1(config-if)#

Step 2: Configure R2.

Configuration tasks for R2 include the following:

Router 2

R2>en
Password: ciscoenpass
R2#configure terminal 

R2(config)#router ospf 1

R2(config-router)#passive-interface g0/0/1
R2(config-router)#passive-interface loopback 0

R2(config-router)#auto-cost reference-bandwidth 1000

R2(config)#ip route 0.0.0.0 0.0.0.0 loopback 0
R2(config)#router ospf 1
R2(config-router)#default-information originate 
R2(config-router)#exit 

R2(config)#interface g0/0/0
R2(config-if)#ip ospf hello-interval 30

R2(config-if)#ip ospf priority 50
R2(config-if)#exit
R2(config)#

Points for Step 1 (8 points)
Enter score here.
Points for Step 2 (12 points)
Enter score here.
Instructor Sign-off Part 3:
Instructor Sign-off
Total points (20 points):
Enter score here.

Part 4: Configure Access Control, NAT, and perform configuration backup

Total points: 30
Time: 30 minutes

Step 1: Configure host computers.

Configure the host computers PC-A and PC-B with IPv4 addresses. (4 points)

PC-A

PC-B

After configuring each host computer, perform the following tests: (4 points)

If you get different results, troubleshoot your OSPF and host configurations.

Note: If you are unable to access 209.165.201.1 via https, enter ip http secure-server at R2 CLI.

R2(config)# ip http secure-server

Step 2: Configure Access Control on R2.

Create and apply an access control list on R2 named R2-SECURITY to do the following:

On Router R2

R2(config)#ip access-list extended R2-SECURITY
R2(config-ext-nacl)#deny tcp any host 209.165.201.1 eq 443
R2(config-ext-nacl)#deny tcp any host 209.165.201.1 eq 22
R2(config-ext-nacl)#permit ip any any 
R2(config-ext-nacl)#exit

R2(config)#interface g0/0/0
R2(config-if)#ip access-group R2-SECURITY in

After configuring and applying the ACL, perform the following tests: (2 points)

If you get different results, double check your ACL configuration and application.

Step 3: Configure NAT.

The decision has been made that the entire organization should be using addresses in the 10.0.0.0/8 network space. R1’s LAN is out of compliance. There are applications and services running in the R1 LAN that cannot have their IP address changed without the entire system being rebuilt, so NAT is in order. Here are the configuration tasks at R1:

On Router R1

R1(config)#router ospf 1
R1(config-router)#no network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#exit

R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255

R1(config)#ip nat inside source list 1 interface g0/0/0 overload 

R1(config)#interface g0/0/0
R1(config-if)#ip nat outside
R1(config-if)#interface g0/0/1
R1(config-if)#ip nat inside 
R1(config-if)#

Step 4: Backup all device configurations.

On 4 devices: R1, R2, S1, S2:

User Access Verification

Password: ciscoconpass

R1/R2/S1/S2>en
Password: ciscoenpass
R1/R2/S1/S2#copy running-config tftp
Address or name of remote host []? 10.67.1.50

[alert-note]If you are testing on a real device, you can install and use SolarwinTFTP on PC-B as TFTP server
[/alert-note]

Points for Step 1 (8 points):
Enter score here.
Points for Step 2 (12 points):
Enter score here.
Points for Step 3 (8 points):
Enter score here.
Points for Step 4 (2 points):
Enter score here.
Instructor Sign-off Part 4:
Instructor Sign-off
Total points (30 points):
Enter score here.

Part 5: Cleanup

NOTE: DO NOT PROCEED WITH CLEANUP UNTIL YOUR INSTRUCTOR HAS GRADED YOUR SKILLS EXAM AND HAS INFORMED YOU THAT YOU MAY BEGIN CLEANUP.

Unless directed otherwise by the instructor, restore host computer network connectivity, and then turn off power to the host computers.

Before turning off power to the router and switch, remove the NVRAM configuration files (if saved) from both devices.

Disconnect and neatly put away all LAN cables that were used in the Final.

Router Interface Summary Table

Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many interfaces the router has. There is no way to effectively list all the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device.
The table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface.

Download Packet Tracer & PDF file

[sociallocker id=”57850″][wpdm_package id=’58453′][/sociallocker]