ENARSI Exam - Question 473

Question

SIMULATION-Guidelines-This is a lab item in which tasks will be performed on virtual devices. •	Refer to the Tasks tab to view the tasks for this lab item. •	Refer to the Topology tab to access the device console(s) and perform the tasks. •	Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. •	All necessary preconfigurations have been applied. •	Do not change the enable password or hostname for any device. •	Do not replace existing routing policies or configurations. •	Save your configurations to NVRAM before moving to the next item. •	Click Next at the bottom of the screen to submit this lab and move to the next question. •	When Next is clicked, the lab closes and cannot be reopened. Topology-Tasks-A DMVPN network is preconfigured with tunnel 0 IP address 192. 168. 1. 254 on the HUB, IP connectivity, crypto policies, profiles, and EIGRP AS 100. The NHRP password is cсnp123, and the network ID and tunnel key is EIGRP ASN. Do not introduce a static route. Configure DMVPN connectivity between routers BR1 and BR2 to the HUB router using physical interface as the tunnel source to achieve these goals:1.	Configure NHRP authentication, static IP-to-NBMA address maps, hold time 5 minutes, network ID, and server on branch router BR1. 2.	Configure NHRP authentication, static IP-to-NBMA address maps, hold time 5 minutes, network ID, and server on branch router BR2. 3.	Ensure that packet fragmentation is done before encryption to account for GRE and IPsec header and allow a maximum TCP segment size of 1360 on an IP MTU of 1400 on the tunnel interfaces of both branch routers. 4.	Apply an IPsec profile to the tunnel. Verify that direct spoke-to-spoke tunnel is functional between branch routers BR1 and BR2 by using traceroute to Ethernet 0/0 IP address to get a full score.

Examice · Accepted Answer

.

HungarianDish_111 · Answer

Sim was the same as here. Did not get full score for this sim on real exam, and could not figure out, what was missing. Still passed the exam. New question: MP-BGP NLRI attributes: RD, IPv4 Prefix, Next Hop, VPN Label
https://networklessons.com/mpls/mpls-layer-3-vpn-explained

chaba7654321 · Answer

Had this same lab on the exam, config and provided solution is correct (apart from 'ip nhrp holdtime' - as someone mentioned earlier this needs to be 300 - as it is in seconds.
There is no access to the HUB router on the exam, only config on the 2 spokes is needed.
both spokes have a pre-configured ipsec profile already, I just applied it to tu0

Config provided by Hungarian dish below is correct

HungarianDish_111 · Answer

Holdtime seems to be incorrect:
 ip nhrp holdtime 300 
! Seconds that NHRP NBMA addresses are advertised as valid in positive NHRP responses
https://www.ciscozine.com/dmvpn-phase-3-guide/
5 minutes = 300 seconds

HungarianDish_111 · Answer

3. Ensure that packet fragmentation is done before encryption
=> For me, it suggests that following config is required (global config mode or interface config):
crypto ipsec df-bit clear
crypto ipsec fragmentation before-encrypt

Brand · Answer

I got this exact sim in the exam and I'm here to confirm that presented answer is almost correct. Just make sure you use the lines below:
ip nhrp holdtime 300 (you define the holdtime using seconds)
tunnel mode gre multipoint (as the sim asks you to confirm direct communication between Spokes. Static destination is not what you looking for here)

HungarianDish_111 · Answer

"using physical interface as the tunnel source"
=> tunnel source eth0/1

HungarianDish_111 · Answer

hostname HUB
!
crypto isakmp policy 5
 hash md5
 authentication pre-share
crypto isakmp key cisco address 0.0.0.0        
!
crypto ipsec transform-set ciscoset esp-3des 
 mode tunnel
!
crypto ipsec profile ciscoprofile
 set transform-set ciscoset 
!
interface Tunnel0
 ip address 192.168.1.254 255.255.255.0
 no ip redirects
 no ip next-hop-self eigrp 100
 no ip split-horizon eigrp 100
 ip nhrp authentication ccnp123
 ip nhrp network-id 1
 ip nhrp holdtime 300
 ip nhrp redirect
 tunnel source GigabitEthernet0/1
 tunnel mode gre multipoint
 tunnel key 100
 tunnel protection ipsec profile ciscoprofile
!
router eigrp 100
 network 10.10.1.1 0.0.0.0
 network 192.168.1.0
!
crypto ipsec df-bit clear
crypto ipsec fragmentation before-encrypt

leipeG · Answer

Full lab setup based on Phase-3 DMVPN. Use a layer-2 switch (not a hub) for replicating the ISP.

hostname HUB
!
configure terminal
!
crypto ipsec df-bit clear
crypto ipsec fragmentation before-encrypt
!
crypto ipsec transform-set TRANSFORM-SET esp-aes esp-sha-hmac
 mode transport
!
crypto ipsec profile IPSEC-PROFILE
 set transform-set TRANSFORM-SET
!
interface Tunnel0
 ip address 192.168.1.254 255.255.255.0
 ip nhrp authentication ccnp123
 ip nhrp holdtime 300
 ip nhrp network-id 100
 ip nhrp shortcut
 ip nhrp map multicast dynamic
 ip nhrp redirect
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet1/0
 tunnel mode gre multipoint
 tunnel key 100
 tunnel protection ipsec profile IPSEC-PROFILE
!
interface GigabitEthernet0/0
 ip address 172.16.0.254 255.255.255.0 
 no shutdown
!
interface GigabitEthernet1/0
 ip address 10.10.255.254 255.255.255.0 
 no shutdown
!
router eigrp 100
 network 10.10.255.0 0.0.0.255
 network 172.16.0.0 0.0.0.255
 network 192.168.1.0 0.0.0.255

HungarianDish_111 · Answer

The task is to create a direct spoke-to-spoke tunnel. So, setting a static tunnel destination on spokes is incorrect. We should use "tunnel mode gre multipoint"

1948 · Answer

Do you think we will get marked down for including config that is not asked for I.e. IP NHRP shortcut and IP NHRP redirect as it doesn't mention suboptimal paths.

Rabbit3232 · Answer

crypto ipsec df-bit clear
crypto ipsec fragmentation before-encrypt
Ip mtu 1400
Ip tcp adjust-mss 1360

->
Tunnel key
Tunnel mode gre mulitpoint
Ip nhrp nhs 
Ip nhrp map 
Ip nhrp network-id 100
Ip nhrp authentication ccnp123

Ip http server

It also says ensure you can tunnel to the ethernet port on the other side of the router, so make sure you can do that and the tunnel isn't just up.

HungarianDish_111 · Answer

int tu 0
 tunnel protection ipsec profile

GReddy2323 · Answer

I would like to lab this in CML, but what type of basic configuration does the ISP router need? I always struggle whenever an "ISP" router is put in the topology because I don't know what basic configuration it needs to get it to work.

Not_That_Guy · Answer

Anyone know if the test allows using 'ip nhrp nhs' like this instead of  'ip nhrp map', ip nhrp map multicast', and 'ip nhrp nhs'?
!SPOKES
interface Tunnel0
ip address 192.168.100.X 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
ip nhrp authentication CCNP
ip nhrp nhs 192.168.100.1 nbma 10.100.255.1 multicast
ip nhrp network-id 100
ip nhrp holdtime 300
ip nhrp shortcut
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key 100
tunnel protection ipsec profile MyPROFILE
exit
!
!GLOBAL-Check the HUB and modify crypto options
!
crypto isakmp policy 1
  authentication pre-share
!
crypto isakmp key MyKEY address 0.0.0.0
!
crypto ipsec transform-set MyTRANSFORM esp-aes esp-sha-hmac
!
crypto ipsec profile MyPROFILE
  set transform-set MyTRANSFORM
!
crypto ipsec df-bit clear
crypto ipsec fragmentation before-encrypt

Newmanas · Answer

Tell me please, is it possible to pass the exam if you skip Sim Lab question?

ENARSI Exam - Question 473

Discussion