Lab: Campus Network WIP

Intro

In this lab we will configure a basic campus network. This will include access layer, a collapsed core, WAN connectivity including NAT, as well as OOB management and basic security policies on the vPAN.

OOB management will be setup using a external connector in bridge mode enabling devices to get local network IPs for SSH. This can also be omitted in exchange for the built in terminal in CML.

There may be wireless portions added once CML gets wireless simulation capabilities in CML 2.10 (allegedly).

Features will include:

  • NAT Translations and simulated web traffic
  • HSRP for multiple VLANs
  • Nexus devices with  Active/Active vPC pair
  • SSH Configurations for applicable devices
  • DHCP Configurations with relay
  • Using the vPAN for East/West traffic monitoring with Port Mirroring
  • BGP Peering
  • OSPF between vPAN and Nexus devices

Topologies

Network topologies and port/IP diagrams will be provided here.





Configuration

OOB and SSH

First we will configure out of band management.

If you are not going to use OOB in favor for CMLs native console terminal you can skip this portion of the setup. We will be using that to setup OOB anyway.

You may need to adjust your IP config for whatever network address range you will be using for the external connector.

For example my IP range is 192.168.40.x/24 and I have set reservations in my network for addresses .100-120 for use as OOB management.

The following will work for all the cisco devices except the Nexus switches. Those and the PA will be after.


Cisco IOS

Create MGMT VRF that we will assign to the interface we want to use for OOB management.

(conf)#vrf definition MGMT
(config-router-vrf)#address-family ipv4

Setup switchport as a layer 3 interface and assign it to the VRF we just created.

(config-if)#no switchport
(config-if)#vrf forwarding MGMT

You have two options for ip addressing.
-

DHCP (not recommended in prod)

    (config-if)#ip address dhcp

Static address

    (config-if)#ip address '192.168.40.100' '255.255.255.0'
-

We now need to set a route for the switch to use for this network. IE the default gateway. We will need to assign it to the VRF we made as it is a seperate routing table.

(config)#ip route vrf MGMT 0.0.0.0 0.0.0.0 192.168.40.1

Now we will setup SSH and an account to use over this OOB session.

First give the device a domain name and a hostname.

(config)#ip domain-name campus.org
(config)#hostname SW-A

We will now setup a user account and set the enable mode password.

(config)#username "name" secret "password"
(config)#enable secret cisco

We will now setup the crypto key and the VTY lines.

(config)#crypto key generate rsa modulus '2048'
(config)#line vty 0 15
(config-line)#transport input ssh
(config-line)#login local

Verification

Show the routing table for our MGMT VRF.

#show ip route vrf MGMT

Show the interface status and ping from a device on the MGMT/Local network.

#show interface g3/3 status










Nexus

We will now configure OOB on the nexus core switches.

I will be using the dedicated MGMT interface. It is already added to the management VRF.

(config)#int mgmt0
(config-if)#ip address dhcp
(config-if)#no shut

You should now be able to ping out through this interface.

Now that the interface is configured, we will now setup SSH.
Add the domain name and create the key.

(config)#ip domain-name 'campus.org'
(config)#crypto key generate rsa modulus 2048

Create a local user account with the desired role for ssh use.

(config)#username 'name' role 'network-admin' password 'password'

Verify

ssh -l cadmin 192.168.40.17
ping 192.168.40.1 vrf management


VPC Setup

This configuration will NOT be an explainer for vPC as it would be very dense on it's own. Please use VPC as a knowledge base if need be instead. VPC domain and links will be first then vlans and HSRP.

Enable needed features and setup the vPC interfaces, Domain, keepalive, and peer-link.



Verification




ISP Setup

This portion will be setting up the ISP Edge device. This will include the interface to the vPAN and the BGP peering on the ISP side.

First the interface facing the customer side needs to be configured.

(config)#int g0/0
(config-if)#ip 64.102.100.2 255.255.255.252
(config-if)#no shut


Now we wil configure ebgp and the peer.

(conf)#router bgp "6500"

(conf-router)#neighbor "64.102.100.1" remote-as "6301"


We will then associate BGP with an address family. For the basic config it is ipv4 unicast.

(conf-router)#address-family ipv4 unicast

(conf-router)#network "64.102.100.0" mask "255.255.255.252"

(conf-router)#neighbor 64.102.100.1 activate


Nexus OSPF

Each Nexus device will connect over L3 to the vPAN. NX01 will be provided and you should be able to modify it to fit NX02. Similar to how OOB is provided.

We will use area 8.8.8.8

(config)#feature ospf

(config)#router ospf 0


Interface Setup

(config)#int e1/1

(config-if)# no switchport

(config-if)# ip address 10.10.3.1/31

(config-if)# ip ospf network point-to-point

(config-if)# ip route ospf 0 area 8.8.8.8

(config-if)# no shut



vPAN Setup

In this section we will setup a basic configuration for the vPAN. This will include but isn't limited to routed links to the Nexus devices, WAN link as well as 'in' and 'out' zones, management profiles, BGP peering to the provider, and a basic security policy.


To login to the vPAN you will need to navigate to the ip address assigned to the MGMT link that is connected to OOB. By default it will be setup for DHCP.

Default credentials are admin and admin. It will prompt you to change it.

Virtual Router and Static Routes.

We will be using the default router. We will rename it to something else in this case i'm using VR01.

Navigate to Network>Virtual Routers and click on default. We will rename this to VR01 or whatever you want it to be.


Next go to static routes.

Click on add and input the following.


Zones

We will create two zones, INSIDE and OUTSIDE. In larger more segmented networks, you may have more than an 'INSIDE' and 'OUTSIDE' zone.
Navigate to Network>Zones then on the bottom left add a zone. Add the name and then under type change it to layer 3 and click ok.

Do this for each zone we need to create. We can assign the interfaces when those are setup.



Interfaces and Management Profiles

Interfaces will need to be enabled, and ip ranges given. Management Profiles will be setup.






SNAT

BGP Peering

Under the virtual router go to BGP.

Check 'Enable' and give a router ID and a AS number. The AS number for this device will be 6301.

Under peer groups click add. Name this group. I used ISP. Next click add to add a peer to the group and also give this a name. The specific peer under ISP I named ISP- and the AS number.







Add the AS for the peer. In this case it's 6500. Add the interface it's coming from and the peer address. This is 64.102.100.2







OSPF To Lan








Popular posts from this blog

  This will be a follow along for studying the ENCOR and any exams that follow. As well as any misc information that relates such as python scripting etc. The first portion will be basic notes that I decided needed to be my base. This includes but isn't limited to topics such as basic network principles, the layer 2 process, SSH setup, IOS upgrades. This first section will most likely align with the CCENT. I will focus on Cisco for the time being, but I would like to get into Junos (OS?) and Aruba OS. Syntax and basic info on documentation Syntax for commands will be as follows: Any portion of the command with "example" should be an object that you can change. For example, in the line ip vrf "name" the portion "name" is a name you can give to identify this specific vrf. At times this "example" will identify an identifier you can change or an option that is needed for input, but it will always denote something that is configurable. The descrip...
Read more