CCNP SWITCH Chapter 6 Lab 6-1, First Hop Redundancy Protocols – HSRP and VRRP (Version 7)

Topology

Objectives

  • Configure inter-VLAN routing with HSRP and load balancing
  • Configure HSRP authentication
  • Configure HSRP interface tracking
  • Configure VRRP
  • Configure VRRP object tracking

Hot Standby Router Protocol (HSRP) is a Cisco-proprietary redundancy protocol for establishing a faulttolerant default gateway. It is described in RFC 2281. HSRP provides a transparent failover mechanism to the end stations on the network. This provides users at the access layer with uninterrupted service to the network if the primary gateway becomes inaccessible.

The Virtual Router Redundancy Protocol (VRRP) is a standards-based alternative to HSRP and is defined in RFC 3768. The two technologies are similar but not compatible.

This lab will offer configuration experience with both of the protocols in a phased approach.

Some of the configurations in this lab will be used in subsequent labs. Please read carefully before clearing your devices.

Note: This lab uses the Cisco WS-C2960-24TT-L switch with the Cisco IOS image c2960-lanbasek9-mz.150- 2.SE6.bin and the Catalyst 3560V2-24PS switch with the Cisco IOS image c3560-ipservicesk9-mz.150- 2.SE6.bin. Other switches and Cisco IOS Software versions can be used if they have comparable capabilities and features. Depending on the switch model and Cisco IOS Software version, the commands available and output produced might vary from what is shown in this lab.

Required Resources

  • 2 switches (Cisco 2960 with the Cisco IOS Release 15.0(2)SE6 C2960-LANBASEK9-M image or comparable)
  • 2 switches (Cisco 3560v2 with the Cisco IOS Release 15.0(2)SE6 C3560-IPSERVICESK9-M image or comparable)
  • Ethernet and console cables
  • 4 PC’s with Windows OS

Part 1: Prepare for the Lab

Step 1: Prepare the switches for the lab

Use the reset.tcl script you created in Lab 1 “Preparing the Switch” to set your switches up for this lab. Then load the file BASE.CFG into the running-config with the command copy flash:BASE.CFG running-config. An example from DLS1:

DLS1# tclsh reset.tcl
Erasing the nvram filesystem will remove all configuration files! Continue?
[confirm]
[OK]
Erase of nvram: complete
Reloading the switch in 1 minute, type reload cancel to halt

Proceed with reload? [confirm]

*Mar 7 18:41:40.403: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
*Mar 7 18:41:41.141: %SYS-5-RELOAD: Reload requested by console. Reload
Reason: Reload command.
<switch reloads - output omitted>

Would you like to enter the initial configuration dialog? [yes/no]: n
Switch> en
*Mar 1 00:01:30.915: %LINK-5-CHANGED: Interface Vlan1, changed state to
administratively down
Switch# copy BASE.CFG running-config
Destination filename [running-config]?
184 bytes copied in 0.310 secs (594 bytes/sec)

Step 2: Configure basic switch parameters.

Configure an IP address on the management VLAN according to the diagram. VLAN 1 is the default management VLAN, but following best practice, we will use a different VLAN. In this case, VLAN 99.

Enter basic configuration commands on each switch according to the diagram.

DLS1 example:

DLS1# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
DLS1(config)# interface vlan 99
DLS1(config-if)# ip address 172.16.99.1 255.255.255.0
DLS1(config-if)# no shutdown

The interface VLAN 99 will not come up immediately, because the Layer 2 instance of the VLAN does not yet exist. This issue will be remedied in subsequent steps

(Optional) On each switch, create an enable secret password and configure the VTY lines to allow remote access from other network devices.

DLS1 example:

DLS1(config)# enable secret class
DLS1(config)# line vty 0 15
DLS1(config-line)# password cisco
DLS1(config-line)# login

Note: The passwords configured here are required for NETLAB compatibility only and are NOT
recommended for use in a live environment.

Note(2): For purely lab environment purposes, it is possible to configure the VTY lines so that they accept any Telnet connection immediately, without asking for a password, and place the user into the privileged EXEC mode directly. The configuration would be similar to the following example for DLS1:

DLS1(config)# enable secret class
DLS1(config)# line vty 0 15
DLS1(config-line)# no login
DLS1(config-line)# privilege level 15

a. The access layer switches (ALS1 and ALS2) are Layer 2 devices and need a default gateway to send traffic outside of the local subnet. The distribution layer switches will not use a default gateway because they are Layer 3 devices. Configure default gateways on the access layer switches. **The HSRP virtual IP address 172.16.99.5 will be configured in subsequent steps.

ALS1(config)# ip default-gateway 172.16.99.5

Step 3: Configure trunks and EtherChannels between switches.

EtherChannel is used for the trunks because it allows you to utilize both Fast Ethernet interfaces that are available between each device, thereby doubling the bandwidth.

Note: It is good practice to shut down the interfaces on both sides of the link before a port channel is created and then re-enable them after the port channel is configured.

a. Configure trunks and EtherChannels from DLS1 and DLS2 to the other three switches according to the diagram. The switchport trunk encapsulation {isl | dot1q} command is used because these switches also support ISL encapsulation. A sample configuration is provided. Not all of the commands listed below will be used on all devices. Repeat and reference chapter 2 labs if you still are having difficulty with implementing trunking between devices.

DLS1(config)# interface range fastEthernet 0/x - x
DLS1(config-if-range)# switchport trunk encapsulation dot1q
DLS1(config-if-range)# switchport mode trunk
DLS1(config-if-range)# channel-group x mode desirable
DLS1(config-if-range)# no shut
Creating a port-channel interface Port-channel x

Note: Repeat configurations on the other three switches.

b. Verify trunking between DLS1, ALS1, and ALS2 using the show interface trunk command on all switches.

c. Verify the EtherChannel configuration

d. Which EtherChannel negotiation protocol is in use here?

___________________________________________________________________

Step 4: Configure VTP on DLS2, ALS1 and ALS2.

e. Change the VTP mode of ALS1 and ALS2 to client and VTP mode of DLS2 to server. A sample configuration is provided.

ALS1(config)# vtp mode client
Setting device to VTP CLIENT mode for VLANS.

f. Verify the VTP changes.

Step 5: Configure VTP on DLS1 and create VLANs.

g. Create the VTP domain on VTP server DLS1 and create VLANs 10, 20, 30, 40 and 99 for the domain.

NOTE: Switches default to vtp mode server. However, remember the base configuration modifies this setting to vtp mode transparent.

DLS1(config)# vtp domain SWLAB
DLS1(config)# vtp version 2
DLS1(config)# vtp mode server
Setting device to VTP Server mode for VLANS

DLS1(config)# vlan 10
DLS1(config-vlan)# name Finance
DLS1(config-vlan)# vlan 20
DLS1(config-vlan)# name Engineering
DLS1(config-vlan)# vlan 30
DLS1(config-vlan)# name Server-Farm1
DLS1(config-vlan)# vlan 40
DLS1(config-vlan)# name Server-Farm2
DLS1(config-vlan)# vlan 99
DLS1(config-vlan)# name Management

Verify VLAN propagation across the SWLAB domain.

Step 6: Configure access ports.

h. Configure the host ports of all four switches. The following commands configure the switch port mode as access, place the port in the proper VLANs, and turn on spanning-tree PortFast for the ports. A sample configuration is provided for you.

DLS2(config)# interface fastEthernet 0/6
DLS2(config-if)# switchport mode access
DLS2(config-if)# switchport access vlan 40
DLS2(config-if)# spanning-tree portfast
DLS2(config-if)# no shutdown

Note: The switchport host command can be used to configure individual access ports. This command automatically activates access mode, PortFast, and removes all associations of the physical switch port with the port-channel interfaces (if there are any).

i. Configure PC’s with the IP addresses shown in the topology diagram. Use the address ending in .5 as the gateway address for the respective VLANs.

j. Ping from the Host A (VLAN 10) to Host D (VLAN 40). The ping should fail.
Are these results expected at this point? Why?
______________________________________________________________

Step 7: Configure HSRP interfaces and enable routing.

HSRP provides redundancy in the network. The traffic can be load-balanced by using the standby group priority priority command. The ip routing command is used on DLS1 and DLS2 to activate routing capabilities on these Layer 3 switches.

Each route processor can route between the various SVIs configured on its switch. In addition to the real IP address assigned to each distribution switch SVI, assign a third IP address in each subnet to be used as a virtual gateway address. HSRP negotiates and determines which switch accepts information forwarded to the virtual gateway IP address.

The standby command configures the IP address of the virtual gateway, sets the priority for each group, and configures the router for preemption. Preemption allows the router with the higher priority to become the active router after a network failure has been resolved. Notice that HSRP is not used in the command syntax to implement HSRP.

In the following configurations, the priority for VLANs 10, 20, and 99 is 150 on DLS1, making it the active router for those VLANs. VLANs 30 and 40 have the default priority of 100 on DLS1, making DLS1 the standby router for these VLANs. DLS2 is configured to be the active router for VLANs 30 and 40 with a priority of 150, and the standby router for VLANs 10, 20, and 99 with a default priority of 100.

Note: It is recommended that the HSRP group number be mapped to VLAN number.

DLS1(config)# ip routing
DLS1(config)# interface loopback 200
DLS1(config-if)# ip address 209.165.200.254 255.255.255.0
*NOTE: This loopback is used only for the purpose of testing HSRP state
changes. Both DLS1 and DLS2 will have this loopback configured.

DLS1(config)# interface vlan 99
DLS1(config-if)# ip address 172.16.99.1 255.255.255.0
DLS1(config-if)# standby 99 ip 172.16 99.5
DLS1(config-if)# standby 99 preempt
DLS1(config-if)# standby 99 priority 110
DLS1(config-if)# exit

DLS1(config)# interface vlan 10
DLS1(config-if)# ip address 172.16.10.1 255.255.255.0
DLS1(config-if)# standby 10 ip 172.16.10.5
DLS1(config-if)# standby 10 preempt
DLS1(config-if)# standby 10 priority 110
DLS1(config-if)# exit

DLS1(config)# interface vlan 20
DLS1(config-if)# ip address 172.16.20.1 255.255.255.0
DLS1(config-if)# standby 20 ip 172.16.20.5
DLS1(config-if)# standby 20 preempt
DLS1(config-if)# standby 20 priority 110
DLS1(config-if)# exit

DLS1(config)# interface vlan 30
DLS1(config-if)# ip address 172.16.30.1 255.255.255.0
DLS1(config-if)# standby 30 ip 172.16.30.5
DLS1(config-if)# standby 30 preempt
DLS1(config-if)# exit
*NOTE: When the priority command is not present on the L3 interface, the
HSRP priority value defaults to 100.

DLS1(config)# interface vlan 40
DLS1(config-if)# ip address 172.16.40.1 255.255.255.0
DLS1(config-if)# standby 40 ip 172.16.40.5
DLS1(config-if)# standby 40 preempt

DLS2(config)# ip routing

DLS1(config)# interface loopback 200
DLS1(config-if)# ip address 209.165.200.254 255.255.255.0
*NOTE: This loopback is used only for the purpose of testing HSRP state
changes. Both DLS1 and DLS2 will have this loopback configured.

DLS2(config)# interface vlan 99
DLS2(config-if)# ip address 172.16.99.2 255.255.255.0
DLS2(config-if)# standby 99 ip 172.16.99.5
DLS2(config-if)# standby 99 preempt
DLS2(config-if)# exit

DLS2(config)# interface vlan 10
DLS2(config-if)# ip address 172.16.10.2 255.255.255.0
DLS2(config-if)# standby 10 ip 172.16.10.5
DLS2(config-if)# standby 10 preempt
DLS2(config-if)# exit

DLS2(config)# interface vlan 20
DLS2(config-if)# ip address 172.16.20.2 255.255.255.0
DLS2(config-if)# standby 20 ip 172.16.20.5
DLS2(config-if)# standby 20 preempt
DLS2(config-if)# exit

DLS2(config)# interface vlan 30
DLS2(config-if)# ip address 172.16.30.2 255.255.255.0
DLS2(config-if)# standby 30 ip 172.16.30.5
DLS2(config-if)# standby 30 preempt
DLS2(config-if)# standby 30 priority 110
DLS2(config-if)# exit

DLS2(config)# interface vlan 40
DLS2(config-if)# ip address 172.16.40.2 255.255.255.0
DLS2(config-if)# standby 40 ip 172.16.40.5
DLS2(config-if)# standby 40 preempt
DLS2(config-if)# standby 40 priority 110

From Host A (VLAN 10) ping the HSRP virtual gateway address of 172.16.10.5.

C:\>ping 172.16.10.5

Pinging 172.16.10.5 with 32 bytes of data:

Reply from 172.16.10.5: bytes=32 time=1ms TTL=127
Reply from 172.16.10.5: bytes=32 time<1ms TTL=127
Reply from 172.16.10.5: bytes=32 time=1ms TTL=127
Reply from 172.16.10.5: bytes=32 time<1ms TTL=127

Ping statistics for 172.16.10.5:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

Now, start a continuous ping using the –t option to the loopback interface 209.165.200.254. The following is from Host A (VLAN 10) to the address 209.165.200.254. This continuous ping will be used to analyze the loss of connectivity experienced as result HSRP failover demonstration in coming in future steps.

C:\>ping 209.165.200.254 -t

Pinging 209.165.200.254 with 32 bytes of data:

Reply from 209.165.200.254: bytes=32 time=1ms TTL=127
Reply from 209.165.200.254: bytes=32 time<1ms TTL=127
Reply from 209.165.200.254: bytes=32 time=1ms TTL=127
Reply from 209.165.200.254: bytes=32 time<1ms TTL=127
<output omitted>

Step 8: Verify the HSRP configuration.

In the output below, the last two digits (XX) in the MAC address (0000.0c07.acXX) correspond with the HSRP group number. The MAC address is 0000.0c07.ac0a. The last two hexadecimal digits are 0a. These equate to decimal # 10. Our HSRP configuration is group 10.

a. Issue the show standby command on both DLS1 and DLS2.

DLS1# show standby
Vlan10 - Group 10
State is Active
2 state changes, last state change 00:01:36
Virtual IP address is 172.16.10.5
Active virtual MAC address is 0000.0c07.ac0a
Local virtual MAC address is 0000.0c07.ac0a (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.560 secs
Preemption enabled
Active router is local
Standby router is 172.16.10.2, priority 100 (expires in 10.704 sec)
Priority 150 (configured 150)
Group name is "hsrp-Vl10-10" (default)
Vlan20 - Group 20
State is Active
2 state changes, last state change 00:01:27
Virtual IP address is 172.16.20.5
Active virtual MAC address is 0000.0c07.ac14
Local virtual MAC address is 0000.0c07.ac14 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.192 secs
Preemption enabled
Active router is local
Standby router is 172.16.20.2, priority 100 (expires in 8.784 sec)
Priority 150 (configured 150)
Group name is "hsrp-Vl20-20" (default)
Vlan30 - Group 30
State is Standby
1 state change, last state change 00:01:10
Virtual IP address is 172.16.30.5
Active virtual MAC address is 0000.0c07.ac1e
Local virtual MAC address is 0000.0c07.ac1e (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.160 secs
Preemption enabled
Active router is 172.16.30.2, priority 150 (expires in 9.392 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Vl30-30" (default)
Vlan40 - Group 40
State is Standby
1 state change, last state change 00:01:37
Virtual IP address is 172.16.40.5
Active virtual MAC address is 0000.0c07.ac28
Local virtual MAC address is 0000.0c07.ac28 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.624 secs
Preemption enabled
Note that both the active priority and configured
priority are shown.
We configured the priority for this group at 150
Active router is 172.16.40.2, priority 150 (expires in 7.920 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Vl40-40" (default)
Vlan99 - Group 99
State is Active
2 state changes, last state change 00:10:23
Virtual IP address is 172.16.99.5
Active virtual MAC address is 0000.0c07.ac63
Local virtual MAC address is 0000.0c07.ac63 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.416 secs
Preemption enabled
Active router is local
Standby router is 172.16.99.2, priority 100 (expires in 9.216 sec)
Priority 150 (configured 150)
Group name is "hsrp-Vl99-99" (default)
DLS1#
DLS2# show standby
Vlan10 - Group 10
State is Standby
1 state change, last state change 00:05:09
Virtual IP address is 172.16.10.5
Active virtual MAC address is 0000.0c07.ac0a
Local virtual MAC address is 0000.0c07.ac0a (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.488 secs
Preemption enabled
Active router is 172.16.10.1, priority 150 (expires in 8.624 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Vl10-10" (default)
Vlan20 - Group 20
State is Standby
1 state change, last state change 00:05:03
Virtual IP address is 172.16.20.5
Active virtual MAC address is 0000.0c07.ac14
Local virtual MAC address is 0000.0c07.ac14 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.336 secs
Preemption enabled
Active router is 172.16.20.1, priority 150 (expires in 8.640 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Vl20-20" (default)
Vlan30 - Group 30
State is Active
2 state changes, last state change 00:05:26
Virtual IP address is 172.16.30.5
Active virtual MAC address is 0000.0c07.ac1e
Local virtual MAC address is 0000.0c07.ac1e (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.416 secs
Preemption enabled
Active router is local
Standby router is 172.16.30.1, priority 100 (expires in 9.120 sec)
Priority 150 (configured 150)
Group name is "hsrp-Vl30-30" (default)
Vlan40 - Group 40
State is Active
2 state changes, last state change 00:12:58
Virtual IP address is 172.16.40.5
Active virtual MAC address is 0000.0c07.ac28
Local virtual MAC address is 0000.0c07.ac28 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 2.592 secs
Preemption enabled
Active router is local
Standby router is 172.16.40.1, priority 100 (expires in 8.800 sec)
Priority 150 (configured 150)
Group name is "hsrp-Vl40-40" (default)
Vlan99 - Group 99
State is Standby
1 state change, last state change 00:05:29
Virtual IP address is 172.16.99.5
Active virtual MAC address is 0000.0c07.ac63
Local virtual MAC address is 0000.0c07.ac63 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.112 secs
Preemption enabled
Active router is 172.16.99.1, priority 150 (expires in 11.408 sec)
Standby router is local
Priority 100 (default 100)
Group name is "hsrp-Vl99-99" (default)
DLS2#

b. Issue the show standby brief command on both DLS1 and DLS2.

DLS1# sh stand bri
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP 
Vl10        10   150 P Active  local           172.16.10.2     172.16.10.5 
Vl20        20   150 P Active  local           172.16.20.2     172.16.20.5 
Vl30        30   100 P Standby 172.16.30.2     local           172.16.30.5 
Vl40        40   100   Standby 172.16.40.2     local           172.16.40.5 
Vl99        99   150 P Active  local           172.16.99.2     172.16.99.5 

DLS2# sh stand bri
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP 
Vl10        10   100 P Standby 172.16.10.1     local           172.16.10.5 
Vl20        20   100 P Standby 172.16.20.1     local           172.16.20.5 
Vl30        30   150 P Active  local           172.16.30.1     172.16.30.5 
Vl40        40   150 P Active  local           172.16.40.1     172.16.40.5 
Vl99        99   100 P Standby 172.16.99.1     local           172.16.99.5

Which router is the active router for VLANs 10, 20, and 99? Which is the active router for 30 and 40?

For VLANs 10, 20 and 99, the active router is DLS1. For VLANs 30 and 40 the active router is
DLS2__________________________________________________________________

What is the default hello time for each VLAN? What is the default hold time?

The default hello time is 3 seconds. The default hold time is 10
seconds._____________________________________________________________

How is the active HSRP router selected?

The router with the highest priority is selected as the active HSRP router. If more routes share the highest priority, the HSRP router with the highest IP address on the segment becomes the active router.
_____________________________________________________________________

c. Use the show ip route command to verify routing on both DLS1 and DLS2.

DLS1# show ip route | begin Gateway 
Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 10 subnets, 2 masks 
C        172.16.10.0/24 is directly connected, Vlan10 
L        172.16.10.1/32 is directly connected, Vlan10 
C        172.16.20.0/24 is directly connected, Vlan20 
L        172.16.20.1/32 is directly connected, Vlan20 
C        172.16.30.0/24 is directly connected, Vlan30 
L        172.16.30.1/32 is directly connected, Vlan30 
C        172.16.40.0/24 is directly connected, Vlan40 
L        172.16.40.1/32 is directly connected, Vlan40 
C        172.16.99.0/24 is directly connected, Vlan99 
L        172.16.99.1/32 is directly connected, Vlan99
      209.165.200.0/24 is variably subnetted, 2 subnets, 2 masks 
C        209.165.200.0/24 is directly connected, Loopback200 
L        209.165.200.254/32 is directly connected, Loopback200 
DLS1#

Step 9: Verify connectivity between VLANs.

Verify connectivity between VLANs using the ping command with a –t option from Host D (VLAN 40) to the other hosts and servers on the network. Keep the ping running to evaluate loss of connectivity that will occur in Step 11.

The following is from the Host D(VLAN 40) to the 209.165.200.254 address.

C:\>ping 209.165.200.254 -t

Pinging 209.165.200.254 with 32 bytes of data:

Reply from 209.165.200.254: bytes=32 time=1ms TTL=127
Reply from 209.165.200.254: bytes=32 time<1ms TTL=127
Reply from 209.165.200.254: bytes=32 time=1ms TTL=127
Reply from 209.165.200.254: bytes=32 time<1ms TTL=127
<output omitted>

Step 10: Verify HSRP functionally.

a. Verify HSRP by disconnecting the trunks to DLS2. You can simulate this using the shutdown command on those interfaces.

DLS2(config)# interface range fastEthernet 0/7 - 12
DLS2(config-if-range)# shutdown

Output to the console at DLS1 should reflect DLS1 becoming the active router for VLANs 30 and 40.

b. Verify that DLS1 is acting as the backup default gateway for VLANs 30 and 40 using the show standby brief command. DLS1 is now the active HSRP router for all VLANs and the standby router is unknown.

DLS1# sh stand bri
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP 
Vl10        10   150 P Active  local           unknown         172.16.10.5 
Vl20        20   150 P Active  local           unknown         172.16.20.5 
Vl30        30   100 P Active  local           unknown         172.16.30.5 
Vl40        40   100   Active  local           unknown         172.16.40.5 
Vl99        99   150 P Active  local           unknown         172.16.99.5

Repeat this process by bringing up the DLS2 trunks and shutting down the DLS1 interfaces. Use the show standby brief command to see the results.

Note: If both DLS1 and DLS2 have links to the Internet, failure of either switch will cause HSRP to redirect packets to the other switch. The functioning switch will take over as the default gateway to provide virtually uninterrupted connectivity for hosts at the access layer.

Go back to Host A and Host D. The ping to 209.165.200.254 should still be running. Evaluate the loss of connectivity the hosts experienced during the HSRP state change. The users should experience minimal service disruption as a result of the HSRP state change.

Step 11: Apply HSRP authentication using MD5.

Now that we have successfully implemented default gateway redundancy in our network, we should think about securing the HSRP communication between member devices. HSRP authentication prevents rogue routers on the network from joining the HSRP group. Without authentication a rogue router could join the group and claim the active role. The attacker would then be able to capture all the track forwarded to attacker’s device. HSRP authentication can be configured using plain text or MD5. MD5 is the preferred method. Using MD5 key, a hash is calculated on HSRP messages.

DLS1(config)# int vlan 10
DLS1(config-if)# standby 10 authentication ?

WORD Plain text authentication string (8 chars max)
md5 Use MD5 authentication
text Plain text authentication

DLS1(config-if)# standby 10 authentication md5 ?
key-chain Set key chain
key-string Set key string

With MD5 authentication, you can choose between a configuration using the key string or a key chain. Key chains offer more options and security because you can have lifetime parameters associated with the different keys. For simplicity, we will configure HSRP authentication using the key string option.

DLS1(config-if)# standby 10 authentication md5 key-string ?
  0     Specifies an UNENCRYPTED key string will follow
  7     Specifies a HIDDEN key string will follow
  WORD  Key string (64 chars max)
DLS1(config-if)# standby 10 authentication md5 key-string cisco123

*Mar 1 22:22:34.315: %HSRP-4-BADAUTH: Bad authentication from 172.16.10.2,
group 10, remote state Active

Notice as soon as this command was entered on DLS1 that we received a “bad authentication” message display to the console screen. HSRP authentication is not yet configured on DLS2 therefore we expect for the HSRP process to be disrupted. The output of the show standby brief command below confirms that DLS2 is no longer the standby router for group 10. The standby router shows unknown.

DLS1# sh stand bri
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP 
Vl10        10   110 P Active  local           unknown         172.16.10.5 
Vl20        20   110 P Active  local           172.16.20.2     172.16.20.5 
Vl30        30   100 P Standby 172.16.30.2     local           172.16.30.5 
Vl40        40   100   Standby 172.16.40.2     local           172.16.40.5

Now configure HSRP authentication for interface VLAN 10 on DLS2.

DLS2(config-if)# standby 10 authentication md5 key-string cisco123

*Mar 1 22:24:04.165: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Active -> Speak
*Mar 1 22:24:14.349: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Speak -> Standby

Refer to the above output. Once the HSRP authentication with the correct key string were added to DLS2, the HSRP state changed.

Verify the HSRP status of VLAN 10 on DLS1 and DLS2. DLS1 should be the active router for VLAN 10 while DLS2 is the standby.

DLS1# sh stand bri
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP 
Vl10        10   110 P Active  local           172.16.10.2     172.16.10.5 
Vl20        20   110 P Active  local           172.16.20.2     172.16.20.5 
Vl30        30   100 P Standby 172.16.30.2     local           172.16.30.5
Vl40        40   100   Standby 172.16.40.2     local           172.16.40.5 
Vl99        99   110 P Active  local           172.16.99.2     172.16.99.5

Continue configuring HSRP authentication on the remaining HSRP groups used in this lab scenario.

CHALLENGE:

On one of the groups, implement HSRP authentication using a key chain instead of a key string.

Step 12: Configure HSRP interface tracking.

Interface tracking enables the priority of a standby group router to be automatically adjusted, based on the availability of the router interfaces. When a tracked interface becomes unavailable, the HSRP priority of the router is decreased. When properly configured, the HSRP tracking features ensures that a router with an unavailable key interface will relinquish the active router role.

Refer to the network topology, we will track availability to the 209.165.200.254 destination. Loopback 200 is configured with this address and is used for testing HSRP interface tracking concepts.

HSRP can perform object and interface tracking. Configure an IP SLA reachability test on DLS1. Also create an object that tracks this SLA test. HSRP will then be configured to track this object and decrease the priority by a value that will cause an HSRP state change.

DLS1# conf t
DLS1(config)# ip sla 10
DLS1(config-ip-sla)# icmp-echo 209.165.200.254
DLS1(config-ip-sla-echo)# frequency 5
DLS1(config-ip-sla-echo)# ip sla schedule 10 life forever start-time now
DLS1(config)# track 100 ip sla 10
DLS1(config)# int vlan 10
DLS1(config-if)# standby 10 track 100 decrement 70
DLS1(config-if)# exit

Verify SLA configuration using the show ip sla configuration and the show ip sla statistics command.

Verify HSRP tracking configuration using the show standby command.

To test the HSRP tracked object, shut down the loopback 200 interface. Notice the messages displayed to console screen concerning the tracked object 10. More significantly, notice the HSRP state change that happened as a result of the failure of the SLA test.

DLS1(config)# int lo 200
DLS1(config-if)# shut
*Mar 1 23:29:32.072: %TRACKING-5-STATE: 1 interface Lo200 line-protocol Up-
>Down
*Mar 1 23:29:34.077: %LINK-5-CHANGED: Interface Loopback200, changed state to
administratively down
*Mar 1 23:29:35.084: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Loopback200, changed state to down
*Mar 1 23:29:43.707: %TRACKING-5-STATE: 100 ip sla 10 state Up->Down
*Mar 1 23:29:46.207: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Active -> Speak
*Mar 1 23:29:57.691: %HSRP-5-STATECHANGE: Vlan10 Grp 10 state Speak -> Standby

Issue the show standby vlan 10 on DLS1 command to view how the new priority value.

DLS1# sh stand vlan 10
Vlan10 - Group 10
  State is Standby
    4 state changes, last state change 01:33:49
  Virtual IP address is 172.16.10.5
  Active virtual MAC address is 0000.0c07.ac0a
    Local virtual MAC address is 0000.0c07.ac0a (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.752 secs
  Authentication MD5, key-string
  Preemption enabled
  Active router is 172.16.10.2, priority 100 (expires in 9.488 sec)
  Standby router is local
  Priority 80 (configured 110)
    Track object 100 state Down decrement 30
  Group name is "hsrp-Vl10-10" (default)

Part 2: Implement VRRP.

Background: Your company is merging with another company that does not have all Cisco devices deployed in their campus network. As a result, you need to change your first hop redundancy protocols from a proprietary solution to an industry standard solution. In preparation for the next phase of this lab, remove all HSRP configurations. Issuing the command no standby [group #] on the switched virtual interface (SVI) will remove all HSRP commands configured on that SVI.

In the next phase of this lab, we will use the Virtual Router Redundancy Protocol (VRRP). VRRP is an industry standard protocol that has many similarities to HSRP. HSRP elects an active and standby router to participate in the HSRP process, while VRRP elects a Master and Backup. Although referred to by different names, the operational concepts of the VRRP master and backup are similar to the HSRP active and standby respectively.

Both HSRP and VRRP operation requires the use of a virtual router IP address, but VRRP can use an address assigned to an interface on the device. In this case, the device automatically assumes the master role and ignores the priority value in its role election process. Recall that preemption in HSRP must be explicitly configured. VRRP uses preempt by default. The next lab will demonstrate the commands necessary to run VRRP in a campus switched network.

Step 1: Implement VRRP on DLS1 and DLS2.

Assign the VRRP protocol to the switched virtual interfaces. DLS1 will be the master for VLANs 10, 20, and 99. DLS2 will be the master for VLANs 30 and 40. The priority values default to 100, with a higher priority being preferred.

NOTE: The IP address shown in the example below has previously been configured in earlier steps of the lab. It is displayed here to show a complete configuration.

DLS1(config)# interface Vlan10
DLS1(config-if)# ip address 172.16.10.1 255.255.255.0
DLS1(config-if)# vrrp 10 ip 172.16.10.5
DLS1(config-if)# vrrp 10 priority 150

*Only use the vrrp x priority command on the interfaces in which you desire this switch to be the master forwarder.

Repeat these commands as necessary to implement VRRP on all SVIs on DLS1 and DLS2 switches.

Verify VRRP operation using the following show commands: show vrrp. Ensure DLS1 is the master for VLANs 10, 20 and 99 and backup for VLANs 30 and 40, and DLS2 is the master for VLANs 30 and 40 and backup for VLANs 10, 20, and 99.

DLS1# show vrrp
Vlan10 - Group 10
   State is Master
   Virtual IP address is 172.16.10.5
   Virtual MAC address is 0000.5e00.010a
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 150
   Master Router is 172.16.10.1 (local), priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.414 sec

Vlan20 - Group 20
   State is Master
   Virtual IP address is 172.16.20.5
   Virtual MAC address is 0000.5e00.0114
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 150
   Master Router is 172.16.20.1 (local), priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.414 sec

Vlan30 - Group 30
   State is Backup
   Virtual IP address is 172.16.30.5
   Virtual MAC address is 0000.5e00.011e
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 100
   Master Router is 172.16.30.2, priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.609 sec (expires in 3.475 sec)

Vlan40 - Group 40
   State is Backup
   Virtual IP address is 172.16.40.5
   Virtual MAC address is 0000.5e00.0128
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 100
   Master Router is 172.16.40.2, priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.609 sec (expires in 2.930 sec)
   
Vlan99 - Group 99
   State is Master
   Virtual IP address is 172.16.99.5
   Virtual MAC address is 0000.5e00.0163
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 150
   Master Router is 172.16.99.1 (local), priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.414 sec

View the show vrrp output on DLS2.

DLS2# sh vrrp
Vlan10 - Group 10
   State is Backup
   Virtual IP address is 172.16.10.5
   Virtual MAC address is 0000.5e00.010a
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 100
   Master Router is 172.16.10.1, priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.609 sec (expires in 3.097 sec)

Vlan20 - Group 20
   State is Backup
   Virtual IP address is 172.16.20.5
   Virtual MAC address is 0000.5e00.0114
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 100
   Master Router is 172.16.20.1, priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.609 sec (expires in 2.736 sec)

Vlan30 - Group 30
   State is Master
   Virtual IP address is 172.16.30.5
   Virtual MAC address is 0000.5e00.011e
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 150
   Master Router is 172.16.30.2 (local), priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.414 sec

Vlan40 - Group 40
   State is Master
   Virtual IP address is 172.16.40.5
   Virtual MAC address is 0000.5e00.0128
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 150
   Master Router is 172.16.40.2 (local), priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.414 sec

Vlan99 - Group 99
   State is Backup
   Virtual IP address is 172.16.99.5
   Virtual MAC address is 0000.5e00.0163
   Advertisement interval is 1.000 sec
   Preemption enabled
   Priority is 100
   Master Router is 172.16.99.1, priority is 150
   Master Advertisement interval is 1.000 sec
   Master Down interval is 3.609 sec (expires in 3.206 sec)

You can also use the show vrrp brief command to view a summary of the VRRP configuration.

DLS1# show vrrp brief 
Interface          Grp Pri Time  Own Pre State   Master addr     Group addr 
Vl10               10  150 3414       Y  Master  172.16.10.1     172.16.10.5 
Vl20               20  150 3414       Y  Master  172.16.20.1     172.16.20.5 
Vl30               30  100 3609       Y  Backup  172.16.30.2     172.16.30.5 
Vl40               40  100 3609       Y  Backup  172.16.40.2     172.16.40.5 
Vl99               99  150 3414       Y  Master  172.16.99.1     172.16.99.5

DLS2# show vrrp brief 
Interface          Grp Pri Time  Own Pre State   Master addr     Group addr 
Vl10               10  100 3609       Y  Backup  172.16.10.1     172.16.10.5 
Vl20               20  100 3609       Y  Backup  172.16.20.1     172.16.20.5 
Vl30               30  150 3414       Y  Master  172.16.30.2     172.16.30.5 
Vl40               40  150 3414       Y  Master  172.16.40.2     172.16.40.5 
Vl99               99  100 3609       Y  Backup  172.16.99.1     172.16.99.5

Step 2: Configure VRRP tracking.

As you may recall from earlier, HSRP can perform interface tracking and object tracking. VRRP can only perform object tracking. As with the HSRP scenario, we are simulating connectivity to the 209.165.200.254 address in the cloud. Create an object that tracks the line protocol status of the interface loopback 200 with this address. Once the object is created, configure VRRP to track the object and to decrease the priority to a value that would cause a state change between the Master and Backup devices. Recall that we configured the priority values to 150 on the Master devices. The Backup devices priority defaults to 100. To cause the state change, we would need to decrease the priority by at least 60. A sample configuration is provided for you below.

DLS1(config)# track 1 int loop 200 line-protocol
DLS1(config-track)# int vlan 99
DLS1(config-if)# vrrp 99 track 1 decrement 60

CHALLENGE:

Step 3: Alternative option for VRRP configuration

Remove the VRRP commands from the interfaces and implement VRRP using the IP addresses assigned to the SVIs.

NOTE: The IP addresses shown in the examples below have previously been configured in earlier steps of the lab. They are displayed here to show a complete configuration.

• On DLS1, configure VRRP using the IP addresses assigned to interfaces VLAN 10 as the virtual router
IP. A sample configuration is provided for you below.

• Do not configure the VRRP priority.

DLS1(config)# interface Vlan10
DLS1(config-if)# ip address 172.16.10.1 255.255.255.0
DLS1(config-if)# vrrp 10 ip 172.16.10.1

• On DLS2, use the IP address assigned to interfaces VLAN 30.

DLS2(config)# interface Vlan30
DLS2(config-if)# ip address 172.16.30.2 255.255.255.0
DLS2(config-if)# vrrp 10 ip 172.16.30.2

• Observe VRRP results. DLS1 should automatically become the Master for VLAN 10 and Backup for VLAN 30.

• DLS2 should become the Master for VLAN 30 and become the backup for VLAN 10.

Step 3: End of Lab

Do not save your configurations. The equipment will be reset for the next lab.

Device Configurations:
Below are the final configurations for each switch.

DLS1:

DLS1# show run | exclude !
Building configuration...

Current configuration : 3392 bytes
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname DLS1
boot-start-marker
boot-end-marker
enable secret 5 $1$iH7y$KmmpYHeHJXQezv2wRIctX/
no aaa new-model
system mtu routing 1500
ip routing
no ip domain-lookup
ip domain-name CCNP.NET
key chain HSRP-CHAIN
key 1
key-string cisco456
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
track 1 interface Loopback200 line-protocol
track 100 ip sla 10
interface Loopback200
ip address 209.165.200.254 255.255.255.0
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
interface Port-channel2
switchport trunk encapsulation dot1q
switchport mode trunk
interface Port-channel3
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0/1
shutdown
interface FastEthernet0/2
shutdown
interface FastEthernet0/3
shutdown
interface FastEthernet0/4
shutdown
interface FastEthernet0/5
shutdown
interface FastEthernet0/6
switchport access vlan 99
switchport mode access
spanning-tree portfast
interface FastEthernet0/7
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/8
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/9
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/10
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/11
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/12
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/13
shutdown
interface FastEthernet0/14
shutdown
interface FastEthernet0/15
shutdown
interface FastEthernet0/16
shutdown
interface FastEthernet0/17
shutdown
interface FastEthernet0/18
shutdown
interface FastEthernet0/19
shutdown
interface FastEthernet0/20
shutdown
interface FastEthernet0/21
shutdown
interface FastEthernet0/22
shutdown
interface FastEthernet0/23
shutdown
interface FastEthernet0/24
shutdown
interface GigabitEthernet0/1
shutdown
interface GigabitEthernet0/2
shutdown
interface Vlan1
no ip address
shutdown
interface Vlan10
ip address 172.16.10.1 255.255.255.0
vrrp 10 ip 172.16.10.5
vrrp 10 priority 150
interface Vlan20
ip address 172.16.20.1 255.255.255.0
vrrp 20 ip 172.16.20.5
vrrp 20 priority 150
interface Vlan30
ip address 172.16.30.1 255.255.255.0
vrrp 30 ip 172.16.30.5
interface Vlan40
ip address 172.16.40.1 255.255.255.0
vrrp 40 ip 172.16.40.5
interface Vlan99
ip address 172.16.99.1 255.255.255.0
vrrp 99 ip 172.16.99.5
vrrp 99 priority 150
vrrp 99 track 1 decrement 60
ip http server
ip http secure-server
ip sla 10
icmp-echo 209.165.200.254
frequency 5
ip sla schedule 10 life forever start-time now
line con 0
exec-timeout 0 0
logging synchronous
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
end

DLS1#

DLS2:

DLS2# show run | exclude !
Building configuration...

Current configuration : 3175 bytes
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname DLS2
boot-start-marker
boot-end-marker
enable secret 5 $1$FNl5$.TMoHwkzsahidvlZImuBP0
no aaa new-model
system mtu routing 1500
ip routing
no ip domain-lookup
ip domain-name CCNP.NET
key chain HSRP-CHAIN
key 1
key-string cisco456
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface Loopback200
ip address 209.165.200.254 255.255.255.0
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
interface Port-channel2
switchport trunk encapsulation dot1q
switchport mode trunk
interface Port-channel3
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0/1
shutdown
interface FastEthernet0/2
shutdown
interface FastEthernet0/3
shutdown
interface FastEthernet0/4
shutdown
interface FastEthernet0/5
shutdown
interface FastEthernet0/6
switchport access vlan 40
switchport mode access
spanning-tree portfast
interface FastEthernet0/7
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/8
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/9
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/10
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/11
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/12
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/13
shutdown
interface FastEthernet0/14
shutdown
interface FastEthernet0/15
shutdown
interface FastEthernet0/16
shutdown
interface FastEthernet0/17
shutdown
interface FastEthernet0/18
shutdown
interface FastEthernet0/19
shutdown
interface FastEthernet0/20
shutdown
interface FastEthernet0/21
shutdown
interface FastEthernet0/22
shutdown
interface FastEthernet0/23
shutdown
interface FastEthernet0/24
shutdown
interface GigabitEthernet0/1
shutdown
interface GigabitEthernet0/2
shutdown
interface Vlan1
no ip address
shutdown
interface Vlan10
ip address 172.16.10.2 255.255.255.0
vrrp 10 ip 172.16.10.5
interface Vlan20
ip address 172.16.20.2 255.255.255.0
vrrp 20 ip 172.16.20.5
interface Vlan30
ip address 172.16.30.2 255.255.255.0
vrrp 30 ip 172.16.30.5
vrrp 30 priority 150
interface Vlan40
ip address 172.16.40.2 255.255.255.0
vrrp 40 ip 172.16.40.5
vrrp 40 priority 150
interface Vlan99
ip address 172.16.99.2 255.255.255.0
vrrp 99 ip 172.16.99.5
ip http server
ip http secure-server
line con 0
exec-timeout 0 0
logging synchronous
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
end

DLS2#

ALS1:

ALS1# show run | exclude !
Building configuration...

Current configuration : 2302 bytes
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname ALS1
boot-start-marker
boot-end-marker
enable secret 5 $1$XhgA$UgBJw/pOfDf.5XeSWE3Sw0
no aaa new-model
system mtu routing 1500
no ip domain-lookup
ip domain-name CCNP.NET
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface Port-channel1
switchport mode trunk
interface Port-channel2
switchport mode trunk
interface Port-channel3
switchport mode trunk
interface FastEthernet0/1
shutdown
interface FastEthernet0/2
shutdown
interface FastEthernet0/3
shutdown
interface FastEthernet0/4
shutdown
interface FastEthernet0/5
shutdown
interface FastEthernet0/6
switchport access vlan 10
switchport mode access
spanning-tree portfast
interface FastEthernet0/7
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/8
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/9
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/10
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/11
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/12
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/13
shutdown
interface FastEthernet0/14
shutdown
interface FastEthernet0/15
shutdown
interface FastEthernet0/16
shutdown
interface FastEthernet0/17
shutdown
interface FastEthernet0/18
shutdown
interface FastEthernet0/19
shutdown
interface FastEthernet0/20
shutdown
interface FastEthernet0/21
shutdown
interface FastEthernet0/22
shutdown
interface FastEthernet0/23
shutdown
interface FastEthernet0/24
shutdown
interface GigabitEthernet0/1
shutdown
interface GigabitEthernet0/2
shutdown
interface Vlan1
no ip address
interface Vlan99
ip address 172.16.99.3 255.255.255.0
ip default-gateway 172.16.99.5
ip http server
ip http secure-server
line con 0
exec-timeout 0 0
logging synchronous
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
end

ALS1#

ALS2:

ALS2# show run | exclude !
Building configuration...

Current configuration : 2312 bytes
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname ALS2
boot-start-marker
boot-end-marker
enable secret 5 $1$p6PN$sW8CgvvOPVCkyhezwxB720
no aaa new-model
system mtu routing 1500
no ip domain-lookup
ip domain-name CCNP.NET
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface Port-channel1
switchport mode trunk
interface Port-channel2
switchport mode trunk
interface Port-channel3
switchport mode trunk
interface FastEthernet0/1
shutdown
interface FastEthernet0/2
shutdown
interface FastEthernet0/3
shutdown
interface FastEthernet0/4
shutdown
interface FastEthernet0/5
shutdown
interface FastEthernet0/6
switchport access vlan 20
switchport mode access
spanning-tree portfast
interface FastEthernet0/7
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/8
switchport mode trunk
channel-group 1 mode desirable
interface FastEthernet0/9
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/10
switchport mode trunk
channel-group 2 mode desirable
interface FastEthernet0/11
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/12
switchport mode trunk
channel-group 3 mode desirable
interface FastEthernet0/13
shutdown
interface FastEthernet0/14
shutdown
interface FastEthernet0/15
shutdown
interface FastEthernet0/16
shutdown
interface FastEthernet0/17
shutdown
interface FastEthernet0/18
shutdown
interface FastEthernet0/19
shutdown
interface FastEthernet0/20
shutdown
interface FastEthernet0/21
shutdown
interface FastEthernet0/22
shutdown
interface FastEthernet0/23
shutdown
interface FastEthernet0/24
shutdown
interface GigabitEthernet0/1
shutdown
interface GigabitEthernet0/2
shutdown
interface Vlan1
no ip address
shutdown
interface Vlan99
ip address 172.16.99.4 255.255.255.0
ip default-gateway 172.16.99.5
ip http server
ip http secure-server
line con 0
exec-timeout 0 0
logging synchronous
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
end

ALS2#

Related Articles

guest
0 Comments
Inline Feedbacks
View all comments