Lab Simulation 12
Guidelines
This is a lab item in which tasks will be performed on virtual devices.
- Refer to the Tasks tab to view the tasks for this lab item.
- Refer to the Topology tab to access the device console(s) and perform the tasks.
- Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.
- All necessary preconfigurations have been applied.
- Do not change the enable password or hostname for any device.
- Save your configurations to NVRAM before moving to the next item.
- Click Next at the bottom of the screen to submit this lab and move to the next question.
- When Next is clicked, the lab closes and cannot be reopened.
Topology

Tasks
The operations team started configuring network devices for a new site. R10 and R20 are preconfigured with the CORP VRF. R10 has network connectivity to R20. Complete the configurations to achieve these goals:
1. Extend the CORP VRF between R10 and R20 using Tunnel0.
2. Protect Tunnel0 using the preconfigured profile
3. Configure static routing on R10 and R20 so that users in VLANs100 and 101 that belong to the CORP VRF are able to communicate with each other. Tunnel0 should be the only interface used to route traffic for the CORP VRF Initial configs

Correct Answer:
Note: There are some versions of this sim so please check the initial configs carefully to see what commands are missing. For example, in this version the "tunnel destination ..." command is missing but in other versions, other commands may be missing:
+ the "tunnel source ..." command is missing OR
+ the IP address of the tunnel interface ("ip address 10.100.100.1 255.255.255.0") is missing OR
+ the interface Tunnel0 has not been assigned to CORP VRF yet (missing "vrf forwarding CORP" command).
Task 1. Extend the CORP VRF between R10 and R20 using Tunnel0.
We need to find out the IP addresses of e0/1 of R10 and e0/2 of R20 first with the "show ip interface brief" command on these two routers. Suppose they are 10.10.1.1 and 10.10.2.1 respectively. We will use them in the "tunnel destination ..." commands:
R10
interface Tunnel 0
//use "source" command below if the initial config did not have
tunnel source Ethernet0/1
tunnel destination 10.10.2.1
//use below command if the IP address or VRF CORP is missing
vrf forwarding CORP
ip address 10.100.100.1 255.255.255.0
R20
interface Tunnel 0
tunnel source Ethernet0/2
tunnel destination 10.10.1.1
vrf forwarding CORP
ip address 10.100.100.2 255.255.255.0
On a tunnel interface you use the vrf forwarding command (old command is "ip vrf forwarding") to place the tunnel interface in that particular routing table.
Although the "tunnel source ..." command has been typed in the initial configurations but we retype them in the solution just for sure. Same for "vrf forwarding CORP" and "ip address
10.100.100.1 255.255.255.0" commands.
After applying the "vrf forwarding CORP" command above, the IP address will be removed so we need to retype it again (with command "ip address 10.100.100.1 255.255.255.0" for R10).
Verification
On R10:
R10#ping vrf CORP 10.100.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.100.2, timeout is 2 seconds:
!!!!!
(Optional) Task 2. Protect Tunnel0 using the preconfigured profile.
Note: This task may or may not exist so please check it carefully.
For task 2, we need to use the "show run" command to find out the preconfigured profile.
Suppose it is named "MyProfile". We will apply this profile to Tunnel 0:
R10
interface Tunnel 0
tunnel protection ipsec profile MyProfile
R20
interface Tunnel 0
tunnel protection ipsec profile MyProfile
Task 3. Configure static routing on R10 and R20 so that users in VLAN 100 and VLAN 101 that belong to the CORP VRF are able to communicate with each other. Tunnel0 should be the only interface used to route traffic for the CORP VRF.
Static route:
On R10:
R10(config)#ip route vrf CORP 10.101.2.0 255.255.255.0 Tunnel0
On R20:
R20(config)#ip route vrf CORP 10.100.1.0 255.255.255.0 Tunnel0
Verification
On R10:
R10#ping vrf CORP 10.101.2.1 source e0/0.100
!!!!!
On R20:
R20#ping vrf CORP 10.100.1.1 source e0/0.101
!!!!!
Save the configuration
R10#, R20#copy running-config startup-config