CCNP TSHOOT 6.0 - Cisco Learning Home

CCNPv6 TSHOOT
Background
Routers and Layer 3 switches are typically segmented into three planes of operation, each with a clearly
identified objective. The data plane (also called the forwarding plane) forwards user data packets. The control
plane routes data correctly. The management plane provides administrative access to network devices.
The data plane encompasses all “customer” application traffic. Customer traffic refers to traffic generated by
hosts, clients, servers, and applications that are intended to use the network for the purpose of transport only.
Data plane traffic should never have destination IP addresses that belong to any networking devices (routers
or switches). Instead, data plane traffic should be sourced from and destined to other devices, such as PCs
and servers, that are supported by the network. The primary job of the router or Layer 3 switch is to forward
these packets downstream as quickly as possible. Routers and switches can inspect and filter traffic as part of
the implementation of a security policy.
Examples of security features implemented on the data plane include ACLs, NAT, firewalls, IPS, switch port
security, VLAN ACLs (VACLs), IP Source Guard, private VLANs, Storm Control, and VPNs.
This lab focuses on data plane security issues related to Cisco IOS stateful firewalls and VLAN ACLs for
routers and Layer 3 switches.
For each task or trouble ticket, the trouble scenario and problem symptom are described. While
troubleshooting, you will discover the cause of the problem, correct it, and then document the process and
results.
Lab Structure
This lab is divided into two main sections.
Section 1—Trouble Tickets and Troubleshooting Logs
This section includes two tasks. Each task is associated with a trouble ticket (TT) and introduces one or more
errors on one or more devices. If time is a consideration, each task or trouble ticket can be performed
independently.
Section 2—Troubleshooting Reference Information
This section provides general troubleshooting information that can be applied to any of the trouble tickets in
this lab. Examples of useful commands and output are provided. If time permits, it is recommended that you
read through Section 2 prior to starting on the trouble tickets.
Note: This lab uses Cisco 1841 routers with Cisco IOS Release 12.4(24)T1 and the advanced IP image
c1841-advipservicesk9-mz.124-24.T1.bin. The switches are Cisco WS-C2960-24TT-L with the Cisco IOS
image c2960-lanbasek9-mz.122-46.SE.bin and Catalyst 3560-24PS with the Cisco IOS image c3560advipservicesk9-mz.122-46.SE.bin.
Other routers (such as 2801 and 2811), switches (such as 2950 or 3550),
and Cisco IOS Software versions can be used if they have comparable capabilities and features. Depending
on the router or switch model and Cisco IOS Software version, the commands available and output produced
might vary from what is shown in this lab.
Any changes made to configurations or topology (other than errors introduced) are noted in the lab and
trouble tickets so that you are aware of them prior to beginning the troubleshooting process.
Required Resources
• 3 routers (Cisco 1841 with Cisco IOS Release 12.4(24)T1 Advanced IP Service or comparable)
• 1 switch (Cisco 2960 with the Cisco IOS Release 12.2(46)SE C2960-LANBASEK9-M image or
comparable)
• 2 switches (Cisco 3560 with the Cisco IOS Release 12.2(46)SE C3560-LANBASEK9-M image or
comparable)
• SRV1 (Windows PC with static IP address) with TFTP and syslog servers plus an SSH client (PuTTY
or comparable) and WireShark software
• PC-B (Windows PC DHCP client) with PuTTY and WireShark software
All contents are Copyright © 1992–2010 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 2 of 16