Question 1mediummultiple choice
Read the full Network Services and Security explanation →CCNA Network Services and Security • Complete Question Bank
Complete CCNA Network Services and Security question bank — all 0 questions with answers and detailed explanations.
Drag a concept onto its matching description — or click a concept then click the description.
Automatic assignment of IP configuration information to clients
Resolution of hostnames into IP information
Synchronization of device clocks
Centralized collection of event and log messages
Drag a concept onto its matching description — or click a concept then click the description.
The private address used by the host on the internal network
The address representing the internal host to outside networks
A fixed one-to-one address mapping
A many-to-one translation approach using ports
Drag a concept onto its matching description — or click a concept then click the description.
Verification of identity
Determination of permitted actions after identity is verified
Recording of activity or usage information
Protection against unauthorized modification
Drag a concept onto its matching description — or click a concept then click the description.
Verification of identity
Determination of allowed actions
Recording of activity or usage details
Credential store on the device used for local checks
Drag a concept onto its matching description — or click a concept then click the description.
Resolution of names into IP-related information
Automatic assignment of IP configuration to clients
Synchronization of time across devices
Centralized collection of event and log messages
Drag a concept onto its matching description — or click a concept then click the description.
Protection against unauthorized disclosure
Protection against unauthorized modification
Ensuring systems and data remain accessible when needed
Verification of identity
Drag a concept onto its matching description — or click a concept then click the description.
Encrypted remote administration
Unencrypted remote terminal access
Framework for authentication, authorization, and accounting
Centralized event and log reporting
Drag a concept onto its matching description — or click a concept then click the description.
Who are you?
What are you allowed to do?
What happened during the session?
Can the system or service be accessed when needed?
Drag a concept onto its matching description — or click a concept then click the description.
Limits access to only what is necessary
Provides encrypted remote administration
Disables an edge port if a BPDU is received
Limits and controls MAC address learning on a switch port
Drag a concept onto its matching description — or click a concept then click the description.
Users can reach a service by IP but not by hostname
Clients do not receive IP settings automatically
Device clocks and log timestamps do not line up
Administrators need centralized event and message collection
Drag a concept onto its matching description — or click a concept then click the description.
Verification of identity
Determination of allowed actions
Limiting access to only what is necessary
Credential store used directly on the device
Drag a concept onto its matching description — or click a concept then click the description.
Protection against unauthorized disclosure
Protection against unauthorized modification
Ensuring systems and data can be accessed when needed
Recording activity or usage details
Drag a concept onto its matching description — or click a concept then click the description.
Hosts can reach services by IP but not by hostname
Clients are not receiving IP settings automatically
Device time and log timestamps are inconsistent
Administrators need one place to collect device events
Drag a concept onto its matching description — or click a concept then click the description.
Verification of identity
Determination of allowed actions
Protection against unauthorized disclosure
Protection against unauthorized modification
Drag a concept onto its matching description — or click a concept then click the description.
Encrypted remote administration
Framework for authentication, authorization, and accounting
Centralized event and log reporting
Clock synchronization across devices
Drag a concept onto its matching description — or click a concept then click the description.
Names fail but direct IP access still works
Clients do not receive addressing automatically
Device times and timestamps do not align
Administrators want centralized event collection
Drag a concept onto its matching description — or click a concept then click the description.
Who are you?
What are you allowed to do?
What happened during the session?
Can the service or data be used when needed?
Drag a concept onto its matching description — or click a concept then click the description.
ACL type that primarily matches on source address
ACL type that can match source, destination, and protocol details
Mask used to define which address bits must match
Unstated deny that exists at the end of the ACL
Drag a concept onto its matching description — or click a concept then click the description.
Protection against unauthorized disclosure
Protection against unauthorized modification
Ensuring systems and data can be accessed when needed
Limiting access to only what is necessary
Drag a concept onto its matching description — or click a concept then click the description.
Centralized event and message reporting
Monitoring and management data exchange
Traffic-flow visibility
Clock synchronization for reliable timelines
Drag a concept onto its matching description — or click a concept then click the description.
Users can reach resources by IP but not by hostname
Hosts are not receiving IP settings automatically
Logs from different devices do not line up in time
Operations team needs visibility into traffic conversations
Drag a concept onto its matching description — or click a concept then click the description.
Encrypted remote administration
Framework for authentication, authorization, and accounting
Centralized event and message visibility
Traffic-filtering mechanism that can restrict management access sources
Drag a concept onto its matching description — or click a concept then click the description.
Repeated collection of data by the management system
Event notification sent by the device
Indicator of how serious a logged event is
Visibility into traffic flows and conversations
Drag a concept onto its matching description — or click a concept then click the description.
Syslog
SNMP
NetFlow
NTP
Drag a concept onto its matching description — or click a concept then click the description.
Device events and log messages
Management data and monitored values
Traffic conversation visibility
Automatic host IP configuration
Drag a concept onto its matching description — or click a concept then click the description.
Users can reach servers by IP but not by hostname
Hosts are not receiving addressing automatically
Logs from different devices have inconsistent times
Engineers want centralized event messages
Drag a concept onto its matching description — or click a concept then click the description.
DNS
DHCP
NTP
Syslog
Drag a concept onto its matching description — or click a concept then click the description.
DNS
DHCP
NTP
Syslog
User tests: - ping 192.168.200.50 = success - HTTP to 192.168.200.50 = success - HTTP to app.internal.lab = fail
Match each operational tool to the kind of question it most directly helps answer.
A: SNMP: What is the current CPU utilization of a router? [CORRECT] B: Syslog: Why did the interface go down at 3:00 AM? [CORRECT] C: NetFlow: Which applications are consuming the most bandwidth? [CORRECT] D: IP SLA: What is the one-way latency between two sites? [CORRECT]
Drag a concept onto its matching description — or click a concept then click the description.
What events or messages occurred?
What are the counters or current status values?
Which conversations are using the bandwidth?
Are device clocks aligned for accurate timelines?
Drag a concept onto its matching description — or click a concept then click the description.
DNS
DHCP
NTP
Syslog
Drag a concept onto its matching description — or click a concept then click the description.
DNS
DHCP
NTP
Syslog
interface Vlan40 ip address 10.40.40.1 255.255.255.0 ip helper-address 10.99.99.30 Expected VLAN 40 scope: 10.40.40.0/24 Observed client address range: 10.50.50.0/24
R1 has the following static routes configured:
ip route 172.16.50.0 255.255.255.0 10.1.1.2 ip route 172.16.50.0 255.255.255.0 10.2.2.2 5 ip route 0.0.0.0 0.0.0.0 10.3.3.2
When the primary WAN path is up, which route will be installed in the routing table for traffic to 172.16.50.0/24?
ip route 172.16.50.0 255.255.255.0 10.1.1.2 ip route 172.16.50.0 255.255.255.0 10.2.2.2 5 ip route 0.0.0.0 0.0.0.0 10.3.3.2
Based on the JSON snippet below, which statement is correct?
{
"device": {
"hostname": "R1",
"interfaces": [
{"name": "Gig0/0", "status": "up"},
{"name": "Gig0/1", "status": "down"}
]
}
}Drag a concept onto its matching description — or click a concept then click the description.
UDP 53
UDP 67
UDP 123
UDP 514
WLAN: Guest Mapped VLAN: 300 Switch interface Gi1/0/24 toward AP: switchport mode trunk switchport trunk allowed vlan 10,20,30
Drag a concept onto its matching description — or click a concept then click the description.
0
1
20
110
show ip route 192.0.2.0 Routing entry for 192.0.2.0/24 Known via "ospf 1", distance 110, metric 20, type intra area Last update from 10.1.12.2 on GigabitEthernet0/0 Configured routes: ip route 192.0.2.0 255.255.255.0 10.1.13.3 130 RIP also advertises 192.0.2.0/24 with distance 120.
Drag a concept onto its matching description — or click a concept then click the description.
Exports event and log messages
Synchronizes device time
Summarizes traffic flows
Sends unsolicited alerts to a manager
ip flow-export destination 10.99.99.50 2055 ip flow-export source Loopback0 interface Loopback0 ip address 172.16.255.1 255.255.255.255 interface GigabitEthernet0/0 ip address 10.99.99.2 255.255.255.0 Collector subnet: 10.99.99.0/24 Collector accepts exports only from 10.99.99.2
access-list 1 permit 10.10.20.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/0 overload interface GigabitEthernet0/0 ip address 198.51.100.2 255.255.255.252 ip nat outside interface GigabitEthernet0/1 ip address 10.10.10.1 255.255.255.0 ip nat inside Users are in 10.10.10.0/24.
Drag a concept onto its matching description — or click a concept then click the description.
Verifies identity
Determines permitted actions
Records activity
Grants only required access
Drag a concept onto its matching description — or click a concept then click the description.
Resolves hostnames to IP addresses
Assigns IP addressing parameters to clients
Synchronizes device time
Sends event messages to a logging server
Source subnet: 10.20.30.0/24 Requirement: block Telnet, allow HTTP and HTTPS
line vty 0 4 access-class 12 in transport input ssh access-list 12 permit 10.5.5.0 0.0.0.255
Drag a concept onto its matching description — or click a concept then click the description.
Translates hostnames into IP addresses
Automatically assigns host addressing information
Sends event and logging messages to a collector
Monitors and manages devices using managed objects
SW1# show errdisable recovery ErrDisable Reason Timer Status bpduguard Enabled SW1# show interface status err-disabled Port Name Status Reason Gi1/0/11 err-disabled bpduguard
Drag a concept onto its matching description — or click a concept then click the description.
Resolves hostnames to IP addresses
Provides IP configuration to clients
Synchronizes device time
Collects and exports log messages
Interface: GigabitEthernet1/0/1
MAC Address: aaaa.bbbb.cccc
IP Address: Unknown
Status: Authz Success
Domain: DATA
Oper host mode: single-host
Oper control dir: both
Session timeout: N/A
Common Session ID: 0A1B2C3D4E5F6G7H8I9J
Acct Session ID: 0x00000001
Handle: 0x81000001
Current Policy: DEFAULT
Server Policies:
Vlan Group: Vlan: 10
Method status list:
Method State
dot1x Authc SuccessDrag a concept onto its matching description — or click a concept then click the description.
Uses UDP; encrypts only the password in the packet
Uses TCP; encrypts the entire packet
Port-based authentication using EAPoL frames
RADIUS server that validates credentials in 802.1X
Global command to enable AAA on IOS-XE
Router# show running-config | section interface GigabitEthernet0/1 interface GigabitEthernet0/1 ip address 192.168.10.1 255.255.255.0 ip access-group OUTBOUND_FILTER out duplex auto speed auto ! Router# show running-config | section ip access-list extended OUTBOUND_FILTER ip access-list extended OUTBOUND_FILTER permit tcp 192.168.10.0 0.0.0.255 host 10.10.10.10 established permit icmp 192.168.10.0 0.0.0.255 host 10.10.10.10 echo-request deny ip any any
Drag a concept onto its matching description — or click a concept then click the description.
Extended ACL that permits HTTP traffic
Standard ACL that permits a subnet
Wildcard mask that matches only the last octet
Applies ACL 10 inbound on an interface
Creates a named extended ACL
Wildcard mask that matches all IP addresses
Drag a concept onto its matching description — or click a concept then click the description.
Maps a hostname to an IPv4 address
Maps a hostname to an IPv6 address
Creates an alias from one domain name to another
Specifies the mail server responsible for accepting email on behalf of a domain
Identifies the authoritative name servers for a DNS zone
Used for reverse DNS lookup, mapping an IP address to a hostname
Drag a concept onto its matching description — or click a concept then click the description.
Maps a hostname to an IPv4 address
Maps a hostname to an IPv6 address
Aliases one hostname to another canonical name
Specifies mail exchange servers for a domain
Lists authoritative name servers for a zone
Maps an IP address to a hostname (reverse lookup)
Switch# show ip dhcp pool VLAN10
Pool VLAN10 :
Utilization mark (high/low) : 100 / 0
Subnet size (first/next) : 192.168.1.0 / 24
Total addresses : 254
Leased addresses : 0
Pending event : none
Automatic bindings :
Lease time : 1 day
Next network numbers :
192.168.1.0
Switch# show ip dhcp server statistics
Memory usage : 26740
Address pools : 1
Database agents : 0
Automatic bindings : 0
Manual bindings : 0
Expired bindings : 0
Malformed messages : 0
Message Received:
BOOTREQUEST : 0
DHCPDISCOVER : 0
DHCPREQUEST : 0
DHCPDECLINE : 0
DHCPRELEASE : 0
DHCPINFORM : 0
Switch# show ip dhcp conflict
IP address Detection method Detection time
192.168.1.1 Ping Jan 1 00:00:00.000
192.168.1.254 Ping Jan 1 00:00:00.000Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Verifies the identity of a user or device before granting access.
Determines what resources or services a user is allowed to access.
Tracks and logs user activities, such as login time and commands executed.
A Cisco proprietary protocol that separates authentication, authorization, and accounting.
An open standard protocol that combines authentication and authorization in one packet.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
R1# show running-config | section aaa aaa new-model aaa authentication login default group radius local radius server RADIUS address ipv4 192.0.2.10 key cisco123 ! R1# show aaa servers RADIUS: id 1, priority 1, host 192.0.2.10, auth-port 1812, acct-port 1813 State: current UP, duration 120s, previous duration 0s Dead: total 0, retransmit 0 SW1# show running-config | section dot1x dot1x system-auth-control dot1x port-control auto interface GigabitEthernet0/1 switchport mode access dot1x pae authenticator dot1x timeout reauth-period 3600 ! SW1# show authentication sessions interface GigabitEthernet0/1 Interface: GigabitEthernet0/1 MAC Address: Unknown IP Address: Unknown Status: Unauthorized Domain: DATA Oper host mode: single-host Session timeout: N/A Common Session ID: 0000000000000000000000 Acct Session ID: 0x00000000 Auth Method: dot1x SW1# show dot1x all summary Interface PAE Authenticator Supplicant Server Gi0/1 AUTH UNAUTHORIZED N/A N/A
R1# show running-config | section aaa
aaa new-model
!
!
R1# show running-config | include radius
!
R1# show running-config interface GigabitEthernet0/1
interface GigabitEthernet0/1
switchport mode access
authentication port-control auto
dot1x pae authenticator
!
R1# show authentication sessions interface GigabitEthernet0/1 details
Interface: GigabitEthernet0/1
MAC Address: 0050.7966.6800
IP Address: Unknown
User-Name: host-1
Status: Unauthorized
Domain: DATA
Oper host mode: single-host
Oper control dir: both
Session timeout: N/A
Common Session ID: 0A1B2C3D4E5F6G7H8I9J
Acct Session ID: 0x00000001
Handle: 0x81000001
Runnable methods list:
Method list: dot1xR1# show running-config | section aaa aaa new-model aaa authentication login default group radius local aaa authentication dot1x default group radius ! radius server RADIUS address ipv4 10.0.0.2 auth-port 1812 acct-port 1813 key cisco123 ! interface GigabitEthernet0/1 switchport mode access authentication port-control auto dot1x pae authenticator ! R1# show aaa servers RADIUS: id 1, priority 1, host 10.0.0.2, auth-port 1812, acct-port 1813 State: current UP, duration 120s, previous duration 0s Dead: total time 0s, count 0 R1# show dot1x interface GigabitEthernet0/1 details Dot1x Info for GigabitEthernet0/1 ------------------------------- PAE = AUTHENTICATOR PortControl = AUTO PortStatus = UNAUTHORIZED ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 30 SuppTimeout = 30 ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 RateLimitPeriod = 0 AuthMethod = Open Critical = no Critical Recovery = no Guest VLAN = no Host Mode = Single Auth-Fail VLAN = no Vlan Group = no Capability = n/a Client Status = not authenticated Client Mac = 0000.0000.0000 Client IP = 0.0.0.0 Client Username = unknown Client Auth Protocol = unknown Client VLAN = 0 Client Session ID = 0
R1# show running-config | section aaa no aaa new-model ! R1# show running-config | section radius ! R1# show running-config interface GigabitEthernet0/1 interface GigabitEthernet0/1 description 802.1X port switchport mode access switchport access vlan 10 authentication port-control auto dot1x pae authenticator spanning-tree portfast ! R1# show authentication sessions interface GigabitEthernet0/1 Interface: GigabitEthernet0/1 MAC Address: aaaa.bbbb.cccc IP Address: unknown Status: Unauthorized Domain: DATA Oper host mode: single-host Oper control dir: both Session timeout: N/A Common Session ID: 0A0000010000000100000001 Acct Session ID: 0x00000001 Handle: 0x51000001 R1# test aaa group radius legacy aaaa.bbbb.cccc password cisco123 Trying to authenticate with server group radius User authentication request was rejected by server R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 203.0.113.1 YES NVRAM up up GigabitEthernet0/1 unassigned YES unset up up Loopback0 10.10.10.1 YES NVRAM up up
R1# show running-config | section aaa|radius|dot1x|interface GigabitEthernet0/1 aaa new-model aaa authentication login default group radius local radius server RADIUS_SERVER address ipv4 192.0.2.10 auth-port 1812 acct-port 1813 key Cisco123 ! interface GigabitEthernet0/1 description 802.1X Port switchport mode access authentication port-control auto dot1x pae authenticator spanning-tree portfast ! R1# show authentication sessions interface GigabitEthernet0/1 Interface: GigabitEthernet0/1 MAC Address: 0050.7966.6800 IP Address: Unknown Status: Unauthorized Domain: DATA Oper host mode: single-host Oper control dir: both Session timeout: N/A Common Session ID: 0A0000010000000B00000001 Acct Session ID: 0x00000001 Handle: 0x81000001 R1# ping 192.0.2.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.0.2.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5) R1# show radius server-group Server group radius: not defined
R1# show running-config | section interface interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 duplex auto speed auto ! interface GigabitEthernet0/1 ip address 10.0.1.1 255.255.255.252 duplex auto speed auto ! R1# show running-config | section access-list access-list 10 permit any ! interface GigabitEthernet0/0 ip access-group 10 in !
R1# show running-config | section interface GigabitEthernet0/0 interface GigabitEthernet0/0 ip address 192.0.2.1 255.255.255.252 ip access-group BLOCK_HTTP in duplex auto speed auto ! R1# show running-config | section access-list ip access-list extended BLOCK_HTTP deny tcp any 203.0.113.100 0.0.0.0 eq 80 deny tcp any 203.0.113.100 0.0.0.0 eq 443 permit ip 192.168.10.0 0.0.0.255 203.0.113.100 0.0.0.0 permit tcp 192.168.20.0 0.0.0.255 203.0.113.100 0.0.0.0 eq 22 permit tcp 192.168.20.0 0.0.0.255 203.0.113.100 0.0.0.0 eq 23 permit tcp 192.168.20.0 0.0.0.255 203.0.113.100 0.0.0.0 eq 443 permit tcp 192.168.20.0 0.0.0.255 203.0.113.100 0.0.0.0 eq 80 !
hostname R1 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 no shutdown ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 no shutdown ! ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 !
R1# show running-config | section interface GigabitEthernet0/0 interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip access-group PERMIT_ALL in ! R1# show running-config | section ip access-list ip access-list extended PERMIT_ALL permit ip any any
R1# show running-config | section ip nat ip nat inside source list 100 interface GigabitEthernet0/1 ip nat inside source static 192.168.10.100 203.0.113.10 ! access-list 100 permit ip host 192.168.10.100 any ! interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.252 ip nat inside ! interface GigabitEthernet0/2 ip address 10.0.0.1 255.255.255.252 no ip nat
R1# show running-config | section ip nat ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.6 80 ! ip nat inside source list 2 interface GigabitEthernet0/0 overload ! interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.248 ip nat inside ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip nat outside ! access-list 1 permit 192.168.2.0 0.0.0.255 access-list 2 permit 192.168.1.0 0.0.0.255
R1# show running-config | section ip domain ip domain lookup ip name-server 203.0.113.10 ip domain timeout 1 ! R1# show ip dns DNS lookup is enabled DNS server 203.0.113.10 DNS timeout 1 seconds Default domain name: example.com ! R1# nslookup server.example.com Server: 203.0.113.10 Address 1: 203.0.113.10 Name: server.example.com Address 1: 203.0.113.50 ! R1# dig server.example.com ; <<>> DiG 9.8.3 <<>> server.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12345 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;server.example.com. IN A ;; ANSWER SECTION: (empty) ;; AUTHORITY SECTION: (empty) ;; ADDITIONAL SECTION: (empty) ;; Query time: 1 msec ;; SERVER: 203.0.113.10#53(203.0.113.10) ;; WHEN: Thu Jan 11 12:34:56 2024 ;; MSG SIZE rcvd: 34
R1#show running-config | section ip domain ip domain lookup ip domain name courseiva.local ip name-server 192.168.1.100 ! R1#show ip dns No DNS servers configured R1#ping 192.168.1.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5) R1#nslookup server01.courseiva.local Translating "server01.courseiva.local"...domain server (255.255.255.255) % Unrecognized host or address, or protocol not running.
R1#show running-config | section dhcp ip dhcp excluded-address 192.168.100.1 192.168.100.10 ip dhcp excluded-address 192.168.100.254 ! ip dhcp pool POOL_100 network 192.168.100.0 255.255.255.0 default-router 192.168.100.254 dns-server 8.8.8.8 ! interface GigabitEthernet0/0 ip address 192.168.100.1 255.255.255.0 no shut ! interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 ip helper-address 192.168.100.254 no shut
SW1#show running-config | section interface vlan 10 interface Vlan10 ip address 192.168.10.254 255.255.255.0 ip helper-address 192.168.20.1 ! SW1#show ip dhcp snooping Switch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 10 Insertion of option 82 is disabled Interface Trusted Rate limit (pps) ----------------------- ------- ----------------- GigabitEthernet0/1 no unlimited GigabitEthernet0/2 no unlimited R1#show running-config | section dhcp ip dhcp excluded-address 192.168.10.1 192.168.10.254 ! ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 203.0.113.10 !
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
A router interface applies this ACL inbound:
10 deny tcp any any eq 80 20 permit ip any any
A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?
A show ip nat translations command displays this entry:
Inside global 203.0.113.10:30001 Inside local 192.168.10.25:51514 Outside local 198.51.100.20:443 Outside global 198.51.100.20:443
Which statement is correct?
A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped.
What is the best fix?
A switch port is configured with port security using these commands:
switchport port-security switchport port-security maximum 1 switchport port-security violation restrict switchport port-security mac-address sticky
A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.
Which statement best explains what happened?
A host sends a packet larger than the outgoing interface MTU, and the IPv4 header has the Don't Fragment bit set.
What will a router do with the packet?
A router is configured as follows:
interface g0/1 ip address 172.16.1.1 255.255.255.0 ip helper-address 10.20.20.10
Hosts on 172.16.1.0/24 are not receiving addresses from the DHCP server at 10.20.20.10. The server is reachable by ping from the router.
What is the purpose of the ip helper-address command in this scenario?
An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.
Which combination of features best meets that requirement?
access-list 110 ?
Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside
!
interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.0 ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload access-list 1 permit 192.168.10.0 0.0.0.255
Based on this configuration, which change is required to make PAT work correctly?
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.252 ip nat inside ! access-list 1 permit 192.168.10.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload
Drag a concept onto its matching description — or click a concept then click the description.
Verifies identity before access is granted
Determines permitted actions after identity is verified
Records activity or session information
Protects information from unauthorized disclosure
Observed symptom: - Internal users can reach internal routes - Internet browsing fails - Private source addresses are still seen on outbound WAN traffic
`ip nat inside source static 192.168.1.50 203.0.113.50`
Drag a concept onto its matching description — or click a concept then click the description.
Hostname works incorrectly or cannot be resolved into IP information
Clients need automatic IP configuration
Device timestamps do not line up consistently
Administrators need centralized event and log collection
Drag a concept onto its matching description — or click a concept then click the description.
DNS
DHCP
NTP
Syslog
`ip nat inside source list 1 interface GigabitEthernet0/1 overload`
Drag a concept onto its matching description — or click a concept then click the description.
Private address used by the host on the internal network
Address that represents the internal host to outside networks
Fixed one-to-one translation
Many-to-one translation using ports
Drag a concept onto its matching description — or click a concept then click the description.
Ensuring data is accessible only to authorized users
Ensuring data is not altered by unauthorized entities
Ensuring data and services are accessible when needed
Ensuring a party cannot deny an action they performed
Verifying the identity of a user or system
Determining what an authenticated user is allowed to do
Drag a concept onto its matching description — or click a concept then click the description.
Verification of identity
Determination of allowed actions
Limiting access to only what is necessary
Credential store maintained on the device itself
Drag a concept onto its matching description — or click a concept then click the description.
Centralized event and message reporting
Monitoring and management information exchange
Visibility into traffic flows and conversations
Clock synchronization for consistent timing
Drag a concept onto its matching description — or click a concept then click the description.
Collecting device events and messages centrally
Reading interface status and counters from devices
Finding which hosts are using the most bandwidth
Keeping event timelines consistent across systems
Drag a concept onto its matching description — or click a concept then click the description.
Secures remote management sessions
Provides authentication, authorization, and accounting framework
Limits access to only what is necessary
Centralizes visibility into device events and messages
User test results: - ping 10.20.30.40 = success - open http://10.20.30.40 = success - open http://intranet.corp.local = fail
interface Vlan30 ip address 10.30.30.1 255.255.255.0 no shutdown interface Vlan99 ip address 10.99.99.1 255.255.255.0 no shutdown Remote DHCP server: 10.99.99.20
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.252 ip nat inside ! access-list 1 permit 192.168.10.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload
Requirement: - Block HTTP from 10.10.10.0/24 to 172.16.1.10 - Permit all other traffic access-list 110 ?
Client tests: - ping 172.16.20.50 = success - open http://172.16.20.50 = success - open http://portal.corp.example = fail
Requirement: - Block HTTPS from 10.20.20.0/24 to 172.16.5.10 - Allow all other traffic Configured entry: deny ip 10.20.20.0 0.0.0.255 host 172.16.5.10
Requirement: - Block Telnet from 10.30.30.0/24 to 172.16.9.9 - Allow all other traffic Configured ACL entry: deny tcp 10.30.30.0 0.0.0.255 host 172.16.9.9
Requirement: - Block HTTPS from 10.44.44.0/24 to 172.16.8.20 Configured ACL entry: deny tcp 10.44.44.0 0.0.0.255 host 172.16.8.20 eq 80
VLAN 70 DHCP scope: network 10.70.70.0 255.255.255.0 default-router 10.70.70.1 Client tests: - ping 192.0.2.50 = success - open http://192.0.2.50 = success - open http://portal.branch.lab = fail
Drag a concept onto its matching description — or click a concept then click the description.
Retrieve a resource
Create a new resource
Update or replace a resource
Remove a resource
R1 has the following routes installed:
O 10.10.10.0/24 via 192.0.2.2 S 10.10.10.128/25 via 198.51.100.2
S* 0.0.0.0/0 via 203.0.113.1
A packet destined for 10.10.10.200 arrives at R1. Which route is used?
Drag a concept onto its matching description — or click a concept then click the description.
Client looks for DHCP servers
Server proposes an address and lease details
Client asks to use the offered address
Server confirms the lease
An ACL entry reads:
access-list 25 permit 192.168.8.0 0.0.0.15
Which address range does this statement match?
SW2# show spanning-tree vlan 10
Root ID Priority 32778
Address 0011.1111.1111
Cost 4
Port 1 (GigabitEthernet0/1)
Bridge ID Priority 32778
Address 00aa.aaaa.aaaaR1 Gi0/0: ip address 10.10.12.1 255.255.255.252 ip ospf 10 area 0 ip mtu 1500 R2 Gi0/0: ip address 10.10.12.2 255.255.255.252 ip ospf 10 area 0 ip mtu 1400 Both interfaces are up/up. show ip ospf neighbor on both routers: Neighbor ID Pri State Dead Time Address Interface 2.2.2.2 1 EXSTART 00:00:31 10.10.12.2 Gi0/0
R1 learns three OSPF routes to different destinations:
O 10.10.10.0/24
O IA 10.20.20.0/24 O E2 10.30.30.0/24
Which statement is correct about these route types?
AP-1 channel: 1 AP-2 channel: 3 AP-3 channel: 6 All three APs cover the same conference area on 2.4 GHz. Transmit power is set to high on all APs.
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.252 ip nat inside access-list 1 permit 192.168.10.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload
An ACL on R1 contains only these entries:
access-list 101 permit tcp 10.10.10.0 0.0.0.255 any eq 443 access-list 101 permit icmp any any
What happens to an HTTP packet sourced from 10.10.10.25 and destined for 198.51.100.10 if ACL 101 is applied in the traffic path?
interface Vlan20 ip address 10.20.20.1 255.255.255.0 ip helper-address 10.50.0.100 interface Vlan30 ip address 10.30.30.1 255.255.255.0 ip helper-address 10.50.0.10 DHCP server address: 10.50.0.10
SW1: interface range g1/0/1-2 channel-group 5 mode active SW2: interface range g1/0/1-2 channel-group 5 mode on
show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0001 VLAN0010 VLAN0020 Extended system ID is enabled Portfast Default is disabled show spanning-tree vlan 40 Spanning tree enabled protocol ieee Root ID Priority 327...
show ip route 203.0.113.0 Routing entry for 203.0.113.0/24 Known via "static", distance 5, metric 0 * 198.51.100.2 Configured route: ip route 203.0.113.0 255.255.255.0 192.0.2.2 10 name ISP-A ip route 203.0.113.0 255.255.255.0 198.51.100.2 5 name ISP-B
AP-1 5 GHz power: 8 dBm AP-2 5 GHz power: 8 dBm AP-3 5 GHz power: 23 dBm AP-4 5 GHz power: 8 dBm Users report problems mainly near AP-3's area boundary.
PC1 ipconfig IPv4 Address . . . . . . . . . : 10.40.40.25 Subnet Mask . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . : 10.40.40.1 DNS Server . . . . . . . . . . : 10.4.4.4 PC1> ping 8.8.8.8 success PC1> ping www.example.com failed Correct internal DNS server: 10.40.10.53
SW1: interface range g1/0/1-2 switchport mode trunk channel-group 5 mode active SW2: interface range g1/0/1-2 switchport mode trunk channel-group 5 mode desirable
Drag a concept onto its matching description — or click a concept then click the description.
Retrieve a resource
Create a new resource
Update or replace a resource
Remove a resource
Access-SW uplink: interface g0/24 switchport mode trunk switchport trunk allowed vlan 10,20 User ports: interface range g0/1-12 switchport mode access switchport access vlan 30 Distribution switch SVI: interface vlan 30 ip address 10.30.30.1 255.255.255.0
Clients: 10.40.40.0/24 in VLAN 40 SVI on distribution switch: 10.40.40.1/24 DHCP server: 172.16.1.10/24 reachable by routing Clients keep sending DHCPDISCOVER and receive no offer.
ACL 15: access-list 15 deny 10.10.10.50 access-list 15 permit any Applied inbound on G0/0, the user LAN interface.
PC output: C:\> ping 8.8.8.8 -> success C:\> ping www.example.com -> Ping request could not find host www.example.com
Requirement: Allow 10.1.10.0/24 to reach 198.51.100.20 on TCP ports 80 and 443 only. Block all other traffic from 10.1.10.0/24.
Configured: interface G0/0 ip nat inside interface G0/1 ip nat outside No translations appear in 'show ip nat translations'.
interface g0/0 ip address 192.168.20.1 255.255.255.0 ip nat outside ! interface g0/1 ip address 203.0.113.2 255.255.255.252 ip nat inside ! ip nat inside source list 10 interface g0/1 overload access-list 10 permit 192.168.20.0 0.0.0.255
Client IP address: 192.168.50.23/24 Ping to 192.168.50.1 succeeds Ping to 8.8.8.8 fails DHCP pool intended for VLAN 50 users
access-list 101 permit tcp any any eq 80 interface g0/1 ip access-group 101 in DMZ web server: 172.16.100.10
Drag a concept onto its matching description — or click a concept then click the description.
Resolves hostnames to IP addresses
Assigns IP configuration to clients
Synchronizes device time
Collects and stores log messages
ip nat inside source list 10 interface g0/1 access-list 10 permit 10.10.10.0 0.0.0.255 G0/0 = inside G0/1 = outside
VLAN 20 clients: 10.20.20.0/24 DHCP server: 10.99.99.10 Clients and server are in different subnets
show ntp associations address ref clock st when poll reach delay offset disp *~10.10.50.5 .INIT. 16 - 64 0 0.000 0.000 16000 Configured server: 10.10.50.5
Requirement: send warnings, errors, critical, alerts, and emergencies
User can ping 8.8.8.8 User cannot resolve www.example.com
show run | section nat ip nat inside source list 10 interface g0/0 overload access-list 10 permit 192.168.10.0 0.0.0.255
Targets: Log collector 10.10.10.50 Time source 10.10.10.60
interface vlan 30 ip address 10.30.30.1 255.255.255.0 no shutdown DHCP server: 10.99.99.20
ip nat inside source static 192.168.20.10 198.51.100.10 interface g0/0 ip nat outside ip access-group OUTSIDE-IN in
Requirement: report top applications and source-destination flows on WAN links
SW1# show port-security interface gi1/0/5 Port Security : Enabled Port Status : Secure-up Violation Mode : Restrict Maximum MAC Addresses : 2 Current MAC Addresses : 2
ip nat inside source list 10 interface g0/0 overload access-list 10 permit 192.168.10.0 0.0.0.255 ! interface g0/0 ip address 203.0.113.2 255.255.255.252 ! interface g0/1 ip address 192.168.10.1 255.255.255.0 ip nat inside
access-list 101 deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 23 access-list 101 permit ip any any ! interface g0/1 ip access-group 101 out
Client output: IP address: 192.168.50.22/24 Default gateway: 192.168.50.1 DNS server: 0.0.0.0
R1# show ntp associations address ref clock st when poll reach delay offset disp ~192.0.2.50 203.0.113.1 3 12 64 377 22.1 0.8 1.2 *198.51.100.20 .GPS. 1 14 64 377 18.3 0.4 0.9
ip access-list standard USERS_ONLY permit 192.168.30.0 0.0.0.255 deny any interface g0/1 ip access-group USERS_ONLY out
R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255 R1(config)# ip nat inside source list 1 interface g0/1 overload R1# show ip nat translations Pro Inside global Inside local Outside local Outside global udp 203.0.113.10:1054 192.168.10.25:1054 8.8.8.8:53 8.8.8.8:53
R2# show clock *00:12:11.123 UTC Mon Mar 1 1993 R3# show logging | include %LINEPROTO Mar 1 00:12:17.011: %LINEPROTO-5-UPDOWN: Line protocol on Interface G0/0, changed state to up
Router(config)# ip flow-export destination 192.0.2.50 2055 Router(config)# ip flow-export version 9
Relevant config: interface GigabitEthernet0/1.20 encapsulation dot1Q 20 ip address 10.20.20.1 255.255.255.0 ! ip dhcp excluded-address 10.20.20.1 10.20.20.254 ip dhcp pool USERS20 network 10.20.20.0 255.255.255.0 default-router 10.20.20.1
Current NAT: ip nat inside source list 10 interface GigabitEthernet0/0 overload
Example message: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Switch# show running-config interface GigabitEthernet1/0/1
Building configuration...
Current configuration : 250 bytes
!
interface GigabitEthernet1/0/1
switchport mode access
switchport access vlan 10
authentication port-control auto
authentication periodic
authentication timer reauthenticate 3600
dot1x pae authenticator
dot1x timeout tx-period 3
spanning-tree portfast
end
Switch# show authentication sessions interface GigabitEthernet1/0/1 details
Interface: GigabitEthernet1/0/1
MAC Address: aaaa.bbbb.cccc
IP Address: 192.168.10.25
User-Name: host/workstation
Status: Authz Success
Domain: DATA
Oper host mode: single-host
Oper control dir: both
Session timeout: 3600s
Common Session ID: 0A1B2C3D4E5F6G7H8I9J0K
Acct Session ID: 0x00000001
Handle: 0x00000001
Runnable methods list:
Method State
dot1x Authz Success
Switch# show dot1x all details
Sysauthcontrol ENABLED
Dot1x Protocol Version 3
Supplicant aaaa.bbbb.cccc, GigabitEthernet1/0/1
PAE = AUTHENTICATOR
quietPeriod = 60
serverTimeout = 30
maxReq = 2
reAuthMax = 2
allowAuthOn = [all]
startPeriod = 30
handshakePeriod = 15
txPeriod = 3
guestVlan = 999
authVlan = 100
criticalVlan = 200
hostMode = SINGLE_HOST
port-control = AUTO
control-direction = BOTH
host-auth = [success]
re-authentication = ENABLED
re-authperiod = 3600
server-timeout = 30
supp-timeout = 30
server-retries = 2
supp-retries = 2
max-reauth-req = 2
lastrx = 0
cap = 0
status = AUTHORIZED
state = HELD
backend-state = HELD
method = dot1x
timeout = 30SW1#show authentication sessions interface GigabitEthernet0/1 details Interface: GigabitEthernet0/1 MAC Address: aaaa.bbbb.cccc IP Address: 192.168.1.100 Status: Authorized Domain: DATA Oper host mode: single-host Oper control dir: both Session timeout: N/A Common Session ID: 0A1234567890ABCDEF123456 Acct Session ID: 0x00000001 Handle: 0x00000001 Runnable methods list: Method State dot1x Authc Success SW1#show dot1x interface GigabitEthernet0/1 details Dot1x Info for GigabitEthernet0/1 ----------------------------- PAE = AUTHENTICATOR PortControl = AUTO PortStatus = AUTHORIZED ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 30 SuppTimeout = 30 ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 RateLimitPeriod = 0 SW1#show running-config interface GigabitEthernet0/1 Building configuration... Current configuration : 200 bytes ! interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 authentication port-control auto dot1x pae authenticator spanning-tree portfast end
R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.10 198.51.100.1 198.51.100.1 --- 203.0.113.11 192.168.1.20 198.51.100.2 198.51.100.2 R1# show ip nat statistics Total active translations: 2 (0 static, 2 dynamic; 2 extended) Pool translations: 2 Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 5 Misses: 0 CEF Translated packets: 5, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0 access-list NAT permit 192.168.1.0 0.0.0.255 Refcount: 2
R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.10 --- --- --- 203.0.113.11 192.168.1.11 --- --- --- 203.0.113.12 192.168.1.12 --- --- --- 203.0.113.13 192.168.1.13 --- --- --- 203.0.113.14 192.168.1.14 --- --- --- 203.0.113.15 192.168.1.15 --- --- --- 203.0.113.16 192.168.1.16 --- --- --- 203.0.113.17 192.168.1.17 --- --- --- 203.0.113.18 192.168.1.18 --- --- --- 203.0.113.19 192.168.1.19 --- --- --- 203.0.113.20 192.168.1.20 --- --- --- 203.0.113.21 192.168.1.21 --- --- --- 203.0.113.22 192.168.1.22 --- --- --- 203.0.113.23 192.168.1.23 --- --- --- 203.0.113.24 192.168.1.24 --- --- --- 203.0.113.25 192.168.1.25 --- --- --- 203.0.113.26 192.168.1.26 --- --- --- 203.0.113.27 192.168.1.27 --- --- --- 203.0.113.28 192.168.1.28 --- --- --- 203.0.113.29 192.168.1.29 --- --- --- 203.0.113.30 192.168.1.30 --- ---
R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- --- 192.0.2.12 10.0.0.12 --- --- --- 192.0.2.13 10.0.0.13 --- --- --- 192.0.2.14 10.0.0.14 --- --- --- 192.0.2.15 10.0.0.15 --- --- --- 192.0.2.16 10.0.0.16 --- --- --- 192.0.2.17 10.0.0.17 --- --- --- 192.0.2.18 10.0.0.18 --- --- --- 192.0.2.19 10.0.0.19 --- --- R1# show running-config | include ip nat ip nat pool MYPOOL 192.0.2.10 192.0.2.19 netmask 255.255.255.240 ip nat inside source list 1 pool MYPOOL
C:\Users\User1> nslookup intranet.company.local Server: dc01.company.local Address: 192.168.10.10 *** dc01.company.local can't find intranet.company.local: Non-existent domain C:\Users\User1> nslookup mail.company.local Server: dc01.company.local Address: 192.168.10.10 Name: mail.company.local Address: 192.168.10.55 C:\Users\User1> nslookup 192.168.10.50 Server: dc01.company.local Address: 192.168.10.10 Name: webserver.company.local Address: 192.168.10.50
A network administrator is troubleshooting an issue where internal hosts can ping the company's web server by IP address (192.0.2.10) but cannot access it using the fully qualified domain name www.example.com. The DNS server (192.0.2.5) is reachable and responds to queries. The administrator runs nslookup www.example.com from a host and receives the following output:
C:\> nslookup www.example.com
Server: UnKnown Address: 192.0.2.5
Name: www.example.com Address: 192.0.2.20
Based on the output, what is the most likely cause of the problem?
C:\Users\admin> nslookup www.example.com Server: dns.example.com Address: 192.0.2.5 Name: www.example.com Address: 198.51.100.1 C:\Users\admin> ping 198.51.100.1 Pinging 198.51.100.1 with 32 bytes of data: Reply from 192.0.2.10: Destination host unreachable. C:\Users\admin> ping 192.0.2.10 Pinging 192.0.2.10 with 32 bytes of data: Reply from 192.0.2.10: bytes=32 time<1ms TTL=128
Router# show running-config | section interface GigabitEthernet0/1 interface GigabitEthernet0/1 description VLAN 200 ip address 192.168.200.1 255.255.255.0 ip helper-address 192.168.100.10 no shutdown ! Router# show ip dhcp relay information trusted DHCP relay information trusted: Not configured Router# show ip dhcp server statistics Memory usage: 12345 Address pools: 1 Database agents: 0 Automatic bindings: 0 Manual bindings: 0 Expired bindings: 0 Malformed messages: 0 Message received: BOOTREQUEST: 0 DHCPDISCOVER: 0 DHCPREQUEST: 0 DHCPDECLINE: 0 DHCPRELEASE: 0 DHCPINFORM: 0 Message sent: BOOTREPLY: 0 DHCPOFFER: 0 DHCPACK: 0 DHCPNAK: 0
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet.
OPTIONS: A: Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay. [CORRECT] B: Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet. C: Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet. D: Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
R1# show running-config | section aaa aaa new-model aaa authentication login default local aaa authentication dot1x default local aaa authorization network default local ! radius server RADIUS address ipv4 10.0.0.2 auth-port 1812 acct-port 1813 key cisco123 ! interface GigabitEthernet0/1 switchport mode access dot1x pae authenticator spanning-tree portfast ! R1# show dot1x interface GigabitEthernet0/1 dot1x status for interface Gi0/1 PAE = AUTHENTICATOR portControl = AUTO controlDirection = Both hostMode = SINGLE_HOST reAuthentication = Disabled quietPeriod = 60 serverTimeout = 30 suppTimeout = 30 reAuthPeriod = 3600 (Locally configured) reAuthMax = 2 maxReq = 2 txPeriod = 30 rateLimitPeriod = 0 Session: Authen Method = NONE Auth SM State = DISCONNECTED Auth BEND SM State = IDLE Port Status = UNAUTHORIZED Wait Client = TRUE
R1# show running-config | section aaa|radius|interface|line|username username admin secret 5 $1$abc$defghijklmnopqrstuvwxyz12345 ! aaa new-model aaa authentication login default group radius local aaa authentication dot1x default group radius ! radius server RADIUS address ipv4 198.51.100.10 auth-port 1812 acct-port 1813 key cisco123 ! interface GigabitEthernet0/1 switchport mode access authentication port-control auto dot1x pae authenticator ! line vty 0 4 login authentication default transport input ssh ! end R1# show dot1x interface GigabitEthernet0/1 details Dot1x Info for GigabitEthernet0/1 ----------------------------- PAE = AUTHENTICATOR PortControl = AUTO PortStatus = UNAUTHORIZED ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 30 SuppTimeout = 30 ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 AuthPeriod = 30 R1# show radius server-group all Server group radius Type: Standard Member servers: RADIUS VRF: default R1# show radius server RADIUS Radius server: RADIUS Address: 198.51.100.10 Auth Port: 1812 Acct Port: 1813 Timeout: 5 seconds Retransmit: 3 Key: cisco123 State: current UP Dead: 0 Authentication: 0 requests, 0 timeouts, 0 failures Accounting: 0 requests, 0 timeouts, 0 failures
R1# show running-config | section interface GigabitEthernet0/0 interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip access-group BLOCK_SERVER in duplex auto speed auto ! R1# show running-config | section ip access-list ip access-list extended BLOCK_SERVER deny tcp any host 203.0.113.5 eq 80 permit ip any any !
R1# show running-config | section interface
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
!
interface GigabitEthernet0/1
ip address 10.0.0.1 255.255.255.0
no shutdown
!
R1# show ip route
Codes: L - local, C - connected, S - static
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0/24 is directly connected, GigabitEthernet0/1
192.168.1.0/24 is subnetted, 1 subnets
C 192.168.1.0/24 is directly connected, GigabitEthernet0/0
203.0.113.1/32 [1/0] via 192.168.1.2R1#show running-config | section interface
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip access-group BLOCK_SSH in
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.252
duplex auto
speed auto
!
R1#show access-lists
Extended IP access list BLOCK_SSH
10 deny tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 22
20 permit ip any anyR1# show running-config | section interface GigabitEthernet0/1
interface GigabitEthernet0/1
ip address 192.168.10.1 255.255.255.0
ip access-group BLOCK_SMTP in
duplex auto
speed auto
!
R1# show access-lists BLOCK_SMTP
Extended IP access list BLOCK_SMTP
10 deny tcp any any eq 25
20 permit ip any anyR1# show running-config | section interface interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 duplex auto speed auto ! interface GigabitEthernet0/1 ip address 10.0.0.1 255.255.255.252 duplex auto speed auto ! R1# show access-lists (no output – no ACLs configured)
R1# show running-config | section interface interface GigabitEthernet0/0 description LAN - 192.168.1.0/24 ip address 192.168.1.1 255.255.255.0 no shutdown ! interface GigabitEthernet0/1 description LAN - 192.168.2.0/24 ip address 192.168.2.1 255.255.255.0 no shutdown ! interface Serial0/0/0 description WAN to ISP ip address 203.0.113.1 255.255.255.252 no shutdown
R1# show running-config | section interface GigabitEthernet0/1
interface GigabitEthernet0/1
ip address 192.0.2.1 255.255.255.0
ip access-group BLOCK_IN in
duplex auto
speed auto
R1# show access-lists
Extended IP access list BLOCK_IN
10 deny ip any any
R1# show ip interface GigabitEthernet0/1 | include access
Inbound access list is BLOCK_INR1# show running-config | section interface interface GigabitEthernet0/0 description Link to Internal LAN ip address 192.168.1.1 255.255.255.0 duplex auto speed auto ! interface GigabitEthernet0/1 description Link to ISP ip address 203.0.113.2 255.255.255.252 duplex auto speed auto ! ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply
R1# show running-config | section ip nat ip nat inside source list 10 interface GigabitEthernet0/1 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.3 80 extendable ! access-list 10 permit 10.0.0.0 0.255.255.255 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.248 ip nat outside !
R1# show running-config | section ip nat ip nat inside source list 1 interface GigabitEthernet0/1 ip nat inside source static tcp 192.168.1.10 80 198.51.100.10 80 extendable ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.252 ip nat inside ! access-list 1 permit 192.168.2.0 0.0.0.255
R1# show running-config | section ip nat ip nat inside source list 100 interface GigabitEthernet0/1 ip nat inside source static 192.168.1.10 203.0.113.5 access-list 100 permit ip 192.168.2.0 0.0.0.255 any ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat inside !
R1# show running-config | section ip nat ip nat inside source list 100 interface GigabitEthernet0/1 ip nat inside source static tcp 192.168.1.100 80 interface GigabitEthernet0/1 80 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.248 ip nat inside ! access-list 100 permit ip 192.168.2.0 0.0.0.255 any
R1# show running-config | section ip nat ip nat inside source list NAT_POOL interface GigabitEthernet0/1 ip nat inside source static tcp 192.168.1.10 80 203.0.113.3 80 extendable ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.248 ip nat inside ! access-list 10 permit 10.0.0.0 0.255.255.255
R1# show running-config | section ip nat
ip nat inside source list 100 interface GigabitEthernet0/1
ip nat inside source static 192.168.1.10 203.0.113.10
!
R1# show running-config | section interface
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.0
ip nat outside
!
R1# show access-lists 100
Standard IP access list 100
10 permit 192.168.2.0 0.0.0.255R1# show running-config | section ip nat ip nat inside source list 10 interface GigabitEthernet0/1 ip nat inside source static tcp 10.10.10.100 80 203.0.113.2 80 ! interface GigabitEthernet0/0 ip address 10.10.10.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.248 ip nat inside ! access-list 10 permit 192.168.1.0 0.0.0.255
R1# show running-config | section ip nat ip nat inside source list 1 interface GigabitEthernet0/1 ip nat inside source static 192.168.1.10 203.0.113.10 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 ip nat inside ! access-list 1 permit 10.0.0.0 0.255.255.255
R1# show running-config | section ip nat ip nat inside source list 10 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.100 203.0.113.5 ! access-list 10 permit 10.0.0.0 0.255.255.255 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.248 ip nat inside ! interface Serial0/0/0 ip address 10.0.0.1 255.255.255.252 ip nat outside !
R1# show running-config | section ip nat ip nat inside source list 100 interface GigabitEthernet0/1 ip nat inside source static tcp 192.168.10.100 80 203.0.113.5 80 extendable ! access-list 100 permit ip 192.168.20.0 0.0.0.255 any ! interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat outside !
R1# show running-config | section ip nat ip nat pool GLOBAL 203.0.113.1 203.0.113.1 netmask 255.255.255.0 ip nat inside source list 1 pool GLOBAL ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat inside ! access-list 1 permit 192.168.2.0 0.0.0.255
R1# show running-config | section ip domain ip domain lookup ip name-server 10.0.0.2 ip domain timeout 3 ip domain retry 2 ! R1# ping 203.0.113.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 203.0.113.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms R1# nslookup www.example.com Server: 10.0.0.2 Address: 10.0.0.2#53 ** server can't find www.example.com: SERVFAIL R1# dig www.example.com @203.0.113.10 ; <<>> DiG 9.11.3 <<>> www.example.com @203.0.113.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12345 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.example.com. IN A ;; Query time: 2 msec ;; SERVER: 203.0.113.10#53(203.0.113.10) ;; WHEN: Mon Jan 01 00:00:00 UTC 2024 ;; MSG SIZE rcvd: 45 R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 10.0.0.1 YES NVRAM up up GigabitEthernet0/1 203.0.113.2 YES NVRAM up up Loopback0 192.0.2.1 YES NVRAM up up
R1# show running-config | section ip domain ip domain lookup ip domain name courseiva.local ip name-server 203.0.113.10 ! R1# nslookup fileserver.courseiva.local Server: 203.0.113.10 Address: 203.0.113.10#53 ** server can't find fileserver.courseiva.local: NXDOMAIN R1# nslookup webserver.courseiva.local Server: 203.0.113.10 Address: 203.0.113.10#53 Name: webserver.courseiva.local Address: 192.0.2.5 R1# dig fileserver.courseiva.local ; <<>> DiG 9.11.3 <<>> fileserver.courseiva.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12345 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;fileserver.courseiva.local. IN A ;; AUTHORITY SECTION: courseiva.local. 86400 IN SOA ns1.courseiva.local. admin.courseiva.local. 2025032101 3600 900 86400 3600 ;; Query time: 12 msec ;; SERVER: 203.0.113.10#53(203.0.113.10) ;; WHEN: Fri Mar 21 10:00:00 UTC 2025 ;; MSG SIZE rcvd: 98 R1# ping 203.0.113.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 203.0.113.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
You are connected to R1. The network uses DNS to resolve hostnames for remote device management. Currently, R1 cannot resolve the hostname 'ServerA' via DNS. Using the nslookup and dig commands, you have gathered the following outputs:
nslookup ServerA Server: 203.0.113.1 Address: 203.0.113.1#53
Name: ServerA.example.com Address: 203.0.113.10
dig ServerA ... ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: ... ...
The show running-config command shows that 'ip domain-lookup' is enabled, the name-server is 203.0.113.1, and no static host entries are configured. Diagnose and fix the DNS resolution failure. Ensure that R1 can successfully resolve 'ServerA' to its intended IP address 198.51.100.10.
R1# show running-config | section ip domain ip domain lookup ip name-server 203.0.113.1 ip domain name example.com ! R1# show ip dns server DNS server: 203.0.113.1 Default domain: example.com R1# nslookup ServerA Server: 203.0.113.1 Address 1: 203.0.113.1 Name: ServerA.example.com Address 1: 203.0.113.10 R1# dig ServerA ; <<>> DiG 9.8.3 <<>> ServerA ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1234 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;ServerA. IN A ;; Query time: 10 msec ;; SERVER: 203.0.113.1#53(203.0.113.1) ;; WHEN: Thu Jan 18 12:00:00 2024 ;; MSG SIZE rcvd: 28 R1# ping ServerA Translating "ServerA"...domain server (203.0.113.1) % Unrecognized host or address, or protocol not running.
R1# show running-config | section ip domain ip domain lookup ip domain name internal ip name-server 192.0.2.53 ip name-server 203.0.113.53 ! R1# show ip dns DNS lookup enabled Default domain: internal Name-server list: 192.0.2.53 (unreachable) 203.0.113.53 R1# nslookup webserver.internal Server: 203.0.113.53 Address: 203.0.113.53#53 ** server can't find webserver.internal: NXDOMAIN R1# nslookup 192.168.10.50 Server: 203.0.113.53 Address: 203.0.113.53#53 50.10.168.192.in-addr.arpa name = mail.internal. R1# dig @203.0.113.53 example.com ; <<>> DiG 9.11.3 <<>> @203.0.113.53 example.com ;; connection timed out; no servers could be reached
R1# show running-config | section ip domain ip domain lookup ip domain name example.com ip name-server 192.0.2.53 ! R1# show ip dns server DNS server is enabled Forwarding: enabled Forwarder: 192.0.2.53 (unreachable) R1# nslookup server1.example.com Server: 192.0.2.53 Address: 192.0.2.53#53 ** server can't find server1.example.com: NXDOMAIN R1# dig -x 192.168.1.10 ; <<>> DiG 9.11.4-P1 <<>> -x 192.168.1.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12345 ;; QUESTION SECTION: ;10.1.168.192.in-addr.arpa. IN PTR ;; AUTHORITY SECTION: 0.in-addr.arpa. 86400 IN SOA ns.example.com. admin.example.com. 1 3600 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 192.0.2.53#53(192.0.2.53) ;; WHEN: Mon Jan 15 10:00:00 UTC 2024 ;; MSG SIZE rcvd: 96
R1#show running-config | section ip domain ip domain lookup ip domain name courseiva.com ip name-server 198.51.100.53 ! R1#ping 198.51.100.53 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 198.51.100.53, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5) R1#nslookup fileserver.courseiva.com Server: 198.51.100.53 Address: 198.51.100.53#53 ** server can't find fileserver.courseiva.com: NXDOMAIN R1#nslookup 203.0.113.10 Server: 198.51.100.53 Address: 198.51.100.53#53 ** server can't find 203.0.113.10.in-addr.arpa: NXDOMAIN R1#dig fileserver.courseiva.com ; <<>> DiG 9.16.1 <<>> fileserver.courseiva.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12345 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; AUTHORITY SECTION: courseiva.com. 3600 SOA ns1.courseiva.com. admin.courseiva.com. 2025030101 3600 900 86400 3600 R1#dig -x 203.0.113.10 ; <<>> DiG 9.16.1 <<>> -x 203.0.113.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12346 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; AUTHORITY SECTION: 113.0.203.in-addr.arpa. 3600 SOA ns1.courseiva.com. admin.courseiva.com. 2025030101 3600 900 86400 3600 R1#
R1# show running-config | section ip domain ip domain lookup ip name-server 198.51.100.53 203.0.113.53 ip domain list example.com R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0/0 10.0.0.1 YES NVRAM up up GigabitEthernet0/0/1.10 192.168.10.1 YES NVRAM up up GigabitEthernet0/0/1.20 192.168.20.1 YES NVRAM up up R1# ping 198.51.100.53 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 198.51.100.53, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5) R1# nslookup files.example.com Server: 198.51.100.53 Address: 198.51.100.53#53 ** server can't find files.example.com: NXDOMAIN R1# nslookup files.example.com 203.0.113.53 Server: 203.0.113.53 Address: 203.0.113.53#53 Name: files.example.com Address: 203.0.113.100 R1# dig @198.51.100.53 files.example.com A ; <<>> DiG 9.16.1 <<>> @198.51.100.53 files.example.com A ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12345 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;files.example.com. IN A ;; Query time: 100 msec ;; SERVER: 198.51.100.53#53(198.51.100.53) ;; WHEN: Thu Jan 01 00:00:00 UTC 2024 ;; MSG SIZE rcvd: 42 R1# dig @203.0.113.53 files.example.com A ; <<>> DiG 9.16.1 <<>> @203.0.113.53 files.example.com A ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54321 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;files.example.com. IN A ;; ANSWER SECTION: files.example.com. 3600 IN A 203.0.113.100 ;; Query time: 50 msec ;; SERVER: 203.0.113.53#53(203.0.113.53) ;; WHEN: Thu Jan 01 00:00:00 UTC 2024 ;; MSG SIZE rcvd: 60
R1# show running-config | section ip domain ip domain lookup ip name-server 203.0.113.1 ip domain timeout 3 ip domain retry 2 R1# nslookup fileserver.courseiva.com Translating "fileserver.courseiva.com"...% Unrecognized host or address, or protocol not running. R1# nslookup 198.51.100.10 Server: 203.0.113.1 Address: 203.0.113.1#53 ** server can't find 10.100.51.198.in-addr.arpa: NXDOMAIN R1# dig fileserver.courseiva.com ; <<>> DiG 9.8.3-P1 <<>> fileserver.courseiva.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1234 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;fileserver.courseiva.com. IN A ;; AUTHORITY SECTION: courseiva.com. 3600 IN SOA ns1.courseiva.com. admin.courseiva.com. 2025032101 3600 900 86400 3600 R1# dig -x 198.51.100.10 ; <<>> DiG 9.8.3-P1 <<>> -x 198.51.100.10 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5678 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;10.100.51.198.in-addr.arpa. IN PTR ;; AUTHORITY SECTION: 100.51.198.in-addr.arpa. 3600 IN SOA ns1.courseiva.com. admin.courseiva.com. 2025032101 3600 900 86400 3600
R1#show running-config | section dhcp ip dhcp excluded-address 192.168.50.1 192.168.50.200 ip dhcp pool LAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 8.8.8.8 ! interface GigabitEthernet0/0 ip address 192.168.50.1 255.255.255.0 ip helper-address 203.0.113.10 no shutdown ! interface GigabitEthernet0/1 ip address 10.0.0.1 255.255.255.252 no shutdown !
R1#show running-config | section dhcp ip dhcp excluded-address 192.168.20.0 192.168.20.255 ip dhcp pool VLAN20_POOL network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 203.0.113.10 ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 no shutdown SW1#show running-config | section interface vlan 20 interface Vlan20 ip address 192.168.20.1 255.255.255.0 ip helper-address 192.0.2.99 SW1#show ip dhcp snooping Global DHCP Snooping is disabled DHCP Snooping is configured on following vlans: No VLANs configured SW1#show interfaces status | include Fa0/3 Fa0/3 connected 1 auto auto 10/100BaseTX
R1#show running-config | section dhcp ip dhcp excluded-address 192.168.10.1 192.168.10.254 ip dhcp pool VLAN10_POOL network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 ! interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ip helper-address 10.0.0.2 ! SW1#show running-config | section dhcp ip dhcp snooping ip dhcp snooping vlan 10 no ip dhcp snooping information option interface GigabitEthernet0/1 ip dhcp snooping trust ! interface GigabitEthernet0/2 ip dhcp snooping limit rate 10 !
SW1#show running-config | section interface interface GigabitEthernet0/0 description to DHCP Server ip address 10.0.0.1 255.255.255.252 no switchport ! interface GigabitEthernet0/1 switchport access vlan 20 spanning-tree portfast ! interface Vlan20 ip address 192.168.20.1 255.255.255.0 ip helper-address 10.0.0.3 ! SW1#show ip dhcp snooping Switch DHCP snooping is disabled DHCP snooping is configured on following VLANs: none DHCP snooping is operational on following VLANs: none DHCP snooping is configured on the following L3 Interfaces: Insertion of option 82 is enabled circuit-id default format: vlan-mod-port remote-id: 00e0.f711.2233 (MAC) Option 82 on untrusted port is not allowed Verification of hwaddr field is enabled Verification of giaddr field is enabled Check for address on untrusted interfaces is enabled Custom option 82 strings are disabled
R1# show running-config | section dhcp ip dhcp excluded-address 192.168.50.1 192.168.50.100 ip dhcp pool VLAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 8.8.8.8 ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 no shutdown ! SW1# show running-config | section interface interface GigabitEthernet0/1 description uplink to R1 ip address 10.0.0.2 255.255.255.252 ip helper-address 10.0.0.1 ! interface VLAN50 ip address 192.168.50.1 255.255.255.0 ! interface FastEthernet0/5 description rogue server switchport mode access switchport access vlan 50 ! SW1# show ip dhcp snooping Switch DHCP snooping is disabled DHCP snooping is configured on the following VLANs: none DHCP snooping trust/untrusted ports: Trusted ports: Untrusted ports:
MLS1# show running-config | section interface interface GigabitEthernet0/0 description Link to R1 ip address 10.0.0.2 255.255.255.252 no switchport ! interface GigabitEthernet0/1 description Access port VLAN 20 switchport mode access switchport access vlan 20 ! interface Vlan20 ip address 192.168.20.1 255.255.255.0 ! MLS1# show ip dhcp snooping Switch DHCP snooping is disabled R1# show running-config | section dhcp ip dhcp excluded-address 192.168.20.1 192.168.20.254 ! ip dhcp pool VLAN20_POOL network 192.168.20.0 255.255.255.0 default-router 192.168.10.1 dns-server 4.4.4.4 ! R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 10.0.0.1 YES manual up up