LAB SIMULATION 14
Guidelines
This is a lab item in which tasks will be performed on virtual devices.
* Refer to the Tasks tab to view the tasks for this lab item.
* Refer to the Topology tab to access the device console(s) and perform the tasks.
* Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.
* All necessary preconfigurations have been applied.
* Do not change the enable password or hostname for any device.
* Do not replace existing routing policies or configurations.
* Save your configurations to NVRAM before moving to the next item.
* Click Next at the bottom of the screen to submit this lab and move to the next question.
* When Next is clicked, the lab closes and cannot be reopened.
Topology

Tasks
Troubleshoot and resolve the issues on West and East routers to achieve these goals:
1. SW2 should only allow telnet access from ISP router's Loopback 0 using the AAA services. Fix the configs on SW2 to achieve this. Use preconfigured access-list ISP without removing the existing rule.
2. East router is configured to perform forwarding table lookup on an IP packet's source address, and it checks the incoming interface to reduce the risk of IP Address spoofing. Fix the issue where some East Router fails to ping destinations which are reachable via default route such as loopback 16 on ISP router. Do not advertise this interface into ospf and neither use a static route on East router to perform this task.
You must remove wrong preconfigs that have impact on tasks you are performing to fix issues.
Enable password is 'Cisco' on all devices
SW2: Local username is "SW2" and password is "Cisco"
Correct Answer:
Issue1:
To allow Telnet access on SW2 only for the ISP router's Loopback 0 address:
SW2 Configuration:
aaa new-model
aaa authentication login TELNET_AUTH local
line vty 0 4
login authentication TELNET_AUTH
transport input telnet
ip access-group ISP in
- The ISP access list ensures that only the ISP router's Loopback 0 address is permitted to access SW2 via Telnet.
- The aaa new-model and authentication login ensure proper AAA setup.
Issue 2:
To resolve the ping issue caused by strict uRPF on the East router:
East Router Configuration:
interface e0/0
ip verify unicast source reachable-via any
The reachable-via any command enables loose uRPF, allowing the router to verify the source address of incoming packets based on any route in the routing table.