Services Ready Small Branch Network System Assurance Guide

DS3 Primary WAN Connections for Cisco 3900 Series Small Branch

Passed

Gigabit Ethernet Primary WAN Connection for Cisco 3900 Series Small Branch

Passed

MLPPP Primary WAN Connection for Cisco 3900 Series Small Branch

Passed

MLFR Primary WAN Connection for Cisco 3900 Series Small Branch

Passed

SHDSL IMA Secondary WAN Connection for Cisco 3900 Series Small Branch

Passed

Interface Removal and Addition to SHDSL IMA Interface

Passed

Layer 2 Access Layer Switch

Passed

L2 Security-802.1x Authentication on the EtherSwitch Service Module

Passed

L2 Security-DHCP Snooping and Dynamic ARP Inspection on EtherSwitch Service Module

Passed

L2 Security-Port Security on EtherSwitch Service Module

Passed

L2 Security-IP Source Guard on the EtherSwitch Service Module

Passed

L2 Security-BPDU Guard on the EtherSwitch Service Module

Passed

QoS on the LAN

Passed

WAN Edge QoS-8 Class QoS Model

Passed

LLQ for Voice and Interactive Video Traffic

Passed

CBWFQ and WRED for Data Traffic

Passed

Traffic Shaping on Different WAN Links

Passed

DSCP/CoS Marking Incoming/Returning Traffic from WAN to LAN

Passed

Modification and Deletion of ACLs Defined with Class Map match access-group Command

Passed

Unconfigure and Reconfigure QoS

Passed

Unconfigure QoS, Reload Router, and Reconfigure QoS

Passed

BGP Routing on the Branch

Passed

OSPF Routing as IGP Between Branch and Headquarters Network

Passed

EIGRP Routing as IGP Between the Branch Router and the Headquarters Router

Passed

Traffic Measurement Using NetFlow When QoS is Enabled on the Branch Router

Passed

NBAR Classification with QoS

Passed

Modify Match Protocol Statements and Bandwidth Percentage

Passed

100 ACLs

Passed

NTP in the Branch Router

Passed

Branch Router as a DHCP Server

Passed

IP SLA VoIP UDP Jitter Codec G.711 u-law (Branch to HQ)

Passed

IP SLA VoIP UDP Jitter Codec G.729A u-law (Branch to HQ)

Passed

IP SLA ICMP Echo (Branch to HQ)

Passed

IPsec Site-to-Site VPN Using DMVPN

Passed

IPsec Using GETVPN

Passed

GETVPN Unicast Rekeying

Passed

GETVPN Multicast Rekeying

Passed

IPsec DMVPN with Prefragmentation

Passed

IPsec DMVPN and IGP

Passed

DMVPN Backup for MPLS Network (Branch to HQ)

Passed

DMVPN Backup for MPLS Network (Branch to Branch)

Passed

DMVPN Backup for MPLS Metwork Using BFD (Branch to HQ)

Passed

DMVPN Backup for MPLS Network Using BFD (Branch to Branch)

Passed

DMVPN Backup for MPLS Network Using BFD IGP as OSPF (Branch to Branch)

Passed

DMVPN Backup for MPLS Network Using EBGP (Branch to HQ)

Passed

DMVPN with QoS

Passed

GETVPN with QoS

Passed

DMVPN with QoS and NBAR

Passed

GETVPN with QoS and NBAR

Passed

DMVPN/GETVPN with QoS, NBAR, and NetFlow

Passed

Zone-based Policy Firewall Configuration on the Branch Router

Passed

NAT and PAT Configuration on the Branch Router

Passed

NAT, QoS, and NetFlow on the Branch

Passed

ZPF, QoS, and NetFlow on the Branch

Passed

ZPF, QoS, NBAR, and NetFlow on the Branch

Passed

ZPF, QoS, NBAR, NAT, and NetFlow on the Branch

Passed

ZPF with DMVPN

Passed

ZPF with GETVPN

Passed

IPsec, ZPF, QoS, NBAR, NAT, and NetFlow on the Branch

Passed

DDOS Prevention Using Cisco IOS IPS

Passed

Cisco IOS IPS with Background Data Traffic

Passed

ZPF with NAT and Cisco IOS IPS

Passed

IPsec, ZPF, QoS, NBAR, NAT, Cisco IOS IPS, and NetFlow on the Branch

Passed

Remote Users Using WebVPN (SSL VPN)

Passed

Remote Users Using WebVPN (SSL VPN) Full Tunnel

Passed

Complete Baseline Test

Passed

EIGRP Subsecond Convergence During Primary WAN Failure

Passed

OSPF Subsecond Convergence During Primary WAN Failure

Passed

IPsec over Backup SHDSL WAN Link

Passed

ZPF, NAT, and IPsec over Backup SHDSL WAN Link

Passed

IPsec, ZPF, QoS, NBAR, and NefFlow on Both Primary and Secondary Link, and NAT on the Secondary Link

Passed

Multicast with Security and QoS Features

Passed

Enable SNMP on the UUTs for Management and Monitoring

Passed

Enable SYSLOG on the UUT for Management and Monitoring

Passed

Using Cisco CCP for Configuration and Monitoring of the UUTs

Passed

Cisco WCCP Redirection

Passed

Cisco WAE Automatic Discovery to Identify WAE Appliances

Passed

Cisco WAE Optimization Feature (TFO)

Passed

Cisco WAAS, Cisco IOS Zone-based Firewall, and Cisco IOS IPS Interoperability

Passed

Cisco WAAS with NBAR

Passed

Cisco WAAS with CIFS

Passed

Cisco WAE with Data Redundancy Elimination

Passed

Negative Test Case for DRE

Passed

SCCP Phone Registration to Cisco Unified CME

Passed

SIP Phone Registration to Cisco Unified CME

Passed

SCCP Local Calls

Passed

SIP Local Calls

Passed

PSTN Calls

Passed

Branch to Headquarters Calls over the WAN with a SIP Trunk

Passed

Branch to Headquarters Calls over the WAN with an H.323 trunk

Passed

Supplementary Services with Cisco Unified CME

Passed

Supplementary Services Between Phones in the Branch, Headquarters, and PSTN

Passed

Call Conference in the Branch Cisco Unified CME

Passed

Call Forward to Voice Mail

Passed

Video Call Between Branch and Headquarters

Passed

T.38 Fax Between Branch and Headquarters

Passed

IP SLA VoIP UDP Jitter Codec g711ulaw (Branch to HQ)

Passed

Remote Phones on the Cisco Unified CME

Passed

Cisco Unified CME with WAN Failure Scenario to Headquarters

Passed

Cisco Unified CME with IPsec over the WAN

Passed

Cisco Unified CME with QoS and NBAR

Passed

Cisco Unified CME with ZPF

Passed

Cisco Unified CME Remote Phones with ZPF

Passed

Cisco Unified CME Failover with Secondary Cisco Unified CME

Passed

Baseline Features Plus Cisco Unified CME

Passed

SCCP Phone Registration to Cisco Unified CM

Passed

SIP Phone Registration to Cisco Unified CM

Passed

SIP Local Calls

Passed

SCCP Local Calls

Passed

PSTN Calls with SIP Gateway

Passed

PSTN Calls with H.323 Gateway

Passed

Branch to Headquarters Calls over the WAN

Passed

Supplementary Services Between Phones in Branch, Headquarters, and PSTN

Passed

Call Conference in the Branch

Passed

Call Forward to Voice Mail

Passed

Phone Registration During Cisco Unified Survivable Remote Site Telephony (Cisco Unified SRST)

Passed

Local and PSTN Calls in Cisco Unified SRST Mode

Passed

Supplementary Services in Cisco Unified SRST Mode

Passed

Call Forward to Voice Mail in Cisco Unified SRST Mode

Passed

Call Conference in Cisco Unified SRST Mode

Passed

Branch to Headquarters Calls with IPsec over the WAN

Passed

Branch to Headquarters Voice and Video Calls with QoS and NBAR

Passed

Branch to Headquarters Voice and Video calls with ZPF

Passed

Baseline Features Plus Cisco Unified Communications Manager

Passed

RSVP Agent in SRST Router-HQ to Branch Call with Phones Registered to Cisco Unified CM

Passed

RSVP Agent with Application ID in SRST Router-HQ to Branch Call with Phones Registered to Cisco Unified CM

Passed

RSVP Agent-HQ to Branch Call with H.323 Trunk

Passed

Baseline Performance Test

Passed

Baseline Plus Voice Performance Test with Cisco Unified CME

Passed

Baseline Plus Voice Performance Test with Cisco Unified CM and Cisco Unified SRST

Passed

Baseline Plus Voice Plus Cisco WAAS Performance Test

Passed

Set up a DS3 (T3) private WAN connection between the branch Cisco ISR and headend router

Figure 1, Private WAN, Cisco Unified CME Mode

1. Install an NM-1T3/E3 card into the branch Integrated Services Router (ISR).

2. Configure the card as T3 on both branch and headend routers.

3. Connect the card using a T3 coaxial cable.

4. Configure the IP address on both routers.

5. Make sure that the IP addresses belong to the same segment and have the same subnet mask.

6. Ping both routers.

7. Send T3 line rate HTTP and FTP bidirectional traffic, with 75% HTTP and 25% FTP, and measure the branch Cisco ISR CPU utilization.

The T3 link and line protocol should come up on both routers. The ping should be 100% successful. T3 line rate should be achieved, and branch Cisco ISR CPU should be less than 75%.

Passed

Figure 1, Private WAN, Cisco Unified CME Mode

1. Install an HWIC-1GE-SFP card into one of the HWIC slots on the branch Cisco ISR.

2. Connect to the GE port on the headend router using multimode fiber.

3. Configure the IP address and both routers.

4. Make sure that the IP addresses belong to the same segment and have the same subnet mask.

5. Ping both routers.

6. Send 100-Mb/s bidirectional HTTP and FTP traffic (50 Mb/s in each direction), with 75% HTTP and 25% FTP.

7. Measure the branch Cisco ISR CPU utilization.

The GE link and line protocol should come up on both routers. The ping should be 100% successful. 100-Mb/s throughput should be achieved, and the branch Cisco ISR CPU should be less than 75%.

Passed

Set up an MLPPP primary WAN connection between the branch Cisco ISR and the headend router

Figure 1, Private WAN, Cisco Unified CME Mode

1. Install an HWIC-4T card into one of the HWIC slots on the branch Cisco ISR.

2. Connect the card to the headend using Smart Serial cables. If you are using an HWIC-4T, configure the four serial ports with a clock rate of 2048000 Hz.

3. Enable PPP encapsulation. Bundle all the four serial interfaces into an MLPPP link.

4. Configure an IP address on the multilink interface of each router, make sure that the IP addresses belong to the same segment and have the same subnet mask.

5. Ping both routers.

6. Send 90 percent of line rate of bidirectional HTTP and FTP traffic, with 75% HTTP and 25% FTP. Measure branch Cisco ISR CPU.

The MLPPP link and line protocol should come up on both branch and headend routers. The ping should be 100% successful. The required throughput should be achieved, and the branch Cisco ISR CPU should be less than 75%.

Passed

Set up an MLFR primary WAN connection between the branch Cisco ISR and the headend router

Figure 1, Private WAN, Cisco Unified CME Mode

1. Install an HWIC-4T card into one of the HWIC slots on the branch Cisco ISR.

2. Connect to the headend using Smart Serial cables.

3. If you are using an HWIC-4T, configure the four serial ports with a clock rate of 2048000 Hz.

4. Enable Frame Relay encapsulation.

5. Configure four Frame Relay point-to-point subinterfaces with DLCIs, and bundle all four serial interfaces into an MLFR link.

6. Configure an IP address on the multilink interface of each router. Make sure that the IP addresses belong to the same segment and have the same subnet mask.

7. Ping both routers.

8. Send 90 percent of line rate of bidirectional HTTP and FTP traffic, with 75% HTTP and 25% FTP. Measure branch Cisco ISR CPU.

The MLFR link and line protocol should come up on both branch and headend routers. The ping should be 100% successful. The required throughput should be achieved, and the branch Cisco ISR CPU should be less than 75%.

Passed

Set up an SHDSL IMA WAN connection between the branch Cisco ISR and the DSLAM

Figure 1, Private WAN, Cisco Unified CME Mode

1. Install an HWIC-4SHDSL card into one of the HWIC slots on the branch Cisco ISR.

2. Connect to the ISP DSLAM.

3. Configure IMA with two ports to achieve a bandwidth of 4608 kb/s.

4. Configure a PVC with AAL5SNAP encapsulation.

5. Configure the IP address on the ATM IMA interface. Verify the connection by pinging the DSLAM IP address.

6. Send line rate bidirectional HTTP and FTP traffic over the interface.

The ATM link and line protocol should come up. The ping should be 100% successful. Close to line rate should be achieved for HTTP and FTP traffic, and the router CPU should be less than 75%.

Passed

Set up an SHDSL IMA WAN connection between the branch Cisco ISR and the ISP router (or DSLAM). Remove interfaces from the IMA group, and add the interfaces back to the IMA group while the traffic is traversing the IMA link.

Figure 1, Private WAN, Cisco Unified CME Mode

1. Install an HWIC-4SHDSL card into one of the HWIC slots on the branch Cisco ISR.

2. Connect to the ISP DSLAM or router.

3. Configure IMA with two ports to achieve a bandwidth of 4608 kb/s.

4. Configure a PVC with a AAL5SNAP encapsulation.

5. Configure the IP address on the ATM IMA interface. address belongs Verify the connection by pinging the DSLAM IP address.

6. Send line rate bidirectional HTTP and FTP traffic over the interface.

7. Shut down one of the ports of the IMA group.

8. After 2 minutes, restart the port.

The ATM link and line protocol should come up. The ping should be 100% successful. Close to line rate should be achieved for HTTP and FTP traffic, and the router CPU should be less than 75%.

The IMA link should not go down when one of the ports of the IMA group goes down, and all the traffic should be carried over just one port. When the port is brought back up using the no shutdown command, the traffic should be carried over both the links equally.

Passed

Set up the EtherSwitch service module as an access layer switch

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the EtherSwitch service module in Layer 2 mode.

2. Define VLANs for voice, data, and DMZ.

3. Enable RSPT for subsecond switchover in case of master distribution switch failure.

4. Do not enable Layer 3 routing on the access layer switches.

Layer 2 voice, data, and DMZ VLANs should come up. During master distribution switch failure, Layer 2 convergence should happen within a second.

Passed

Set up to verify 802.1x authentication on the EtherSwitch service module

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure DHCP snooping on the switch.

2. Configure only the gigabit Ethernet back interface trunk port connecting the EtherSwitch module and the router as the trusted port. Configure all other ports as non-trusted ports.

3. Configure the router as the DHCP server.

4. Add a Windows DHCP server and connect it to one of the non-trusted ports of the switch.

5. Configure DAI for VLAN (x,y).

6. Assign all the switch ports to either x or y VLAN.

7. Configure the DHCP scope in the DHCP servers to assign IP addresses to x and y VLANs.

8. Connect phones and PCs to the switch ports.

9. Place all IP Phones in VLAN x and PCs in VLAN y.

The IP Phones and PCs should obtain IP addresses from the DHCP server on the router and not from the Windows DHCP server, because the Widows server is connected to a non-trusted port.

DAI should build dynamic entries (ACLs) with IP addresses (obtained through DHCP) and corresponding MAC addresses for the phones and PCs.

If a laptop with a statically configured IP address (in the y VLAN) is connected to a switch port associated to the y VLAN, the DAI should prevent the laptop from obtaining network connectivity; that is, it builds a deny ACL for this laptop.

Passed

Set up to verify DHCP snooping and Dynamic ARP inspection on the EtherSwitch service module

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure 802.1x port authentication on several of the switch ports along with DHCP snooping and DAI.

2. Configure AAA on the switch.

3. Configure the IP address of the RADIUS server.

4. Set up the EtherSwitch module as a NAS by providing its IP address in the Cisco Secure ACS server located in HQ.

5. Install a self-signed certificate on the ACS server.

6. Configure EAP-PEAP MSCHAPV2 authentication on the ACS server.

7. Download the ACS certificate onto one of the PCs that is running Windows XP and that is located in the branch office.

8. Install the certificate on the PC.

9. Configure the PC for EAP-PEAP MSCHAPV2 authentication.

10. Connect the IP Phone to the switch port on which 802.1x authentication is enabled.

11. Connect the PC to the switch port of the IP Phone.

12. Connect another PC that does not have the ACS certificate installed to another switch port on which 802.1x port authentication is enabled.

The traffic should be distributed 2:1 between the primary and secondary router.

The standby router should take over control after the primary router is power cycled.

When power returns to the primary router, it should take over control from the standby router after waiting for the preemption time to expire.

Passed

Set up to verify port security on EtherSwitch service module

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the port security feature on one of the switch ports of the EtherSwitch service module to allow only one MAC address.

2. Configure the port security aging timer to be 2 seconds, and configure the port security violation policy to Restrict.

3. Connect a laptop to the switch port.

4. After the laptop gets an IP address through DHCP, disconnect the laptop and connect a different laptop to the same switch port.

When the laptop is connected to the switch port, it should get an IP address through DHCP. The switch should populate the laptop's MAC address and port information into a port security table.

When another laptop with a different MAC address is connected to the same port, a port security violation error should be displayed on the console of the switch, and the new laptop should not be provided with an IP address.

Passed

Set up to verify IP source guard on the EtherSwitch service module

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure IP source guard on the switch ports.

2. Connect a traffic generator to the switch port on which the IP source guard is configured, and send line rate traffic to HQ.

3. Obtain the IP address of the traffic generator, using DHCP before sending the traffic.

4. After sending traffic for about 15 minutes, change the source MAC address of the traffic generator connected to the switch port, and observe the behavior.

The traffic from the traffic generator should be successfully allowed from the switch port and should reach the traffic generator at HQ.

The IP source guard feature validates the source MAC address of the host that is connected to the switch port on which the IP source guard is enabled. It associates the host MAC address to the IP address obtained through DHCP.

Once the traffic generator MAC address is changed, traffic should be dropped and not be allowed to pass from the switch port.

Passed

Set up to verify BPDU guard on the EtherSwitch service module

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure Spanning Tree PortFast with the BPDU guard on the switch port that is connected to PC and phones.

2. Remove the PC or phone from one of the ports where BPDU guard is enabled, and connect another switch.

The phones and PC ports should be operational and able to send traffic normally after enabling BPDU guard.

The port shut down after connecting the switch.

Passed

Enable conditionally trusted IP Phone and PC and scavenger-class traffic (Advanced) Model Configuration on the EtherSwitch service module

Figure 34 on page 42, Traffic Flow to QoS Class Mapping

Figure 33 on page 41, LAN Switch

1. Enable QoS on the access layer switch. Re-mark all the packets coming from PC endpoints, servers, and so on, with appropriate CoS or DSCP values. Trust the voice and signaling packets coming out of Cisco IP Phones, but re-mark all the packets coming from PCs attached to the IP Phones. Use Ethereal to verify proper packet marking.

2. Enable MLS QoS on the Catalyst switches.

3. Configure CoS to DSCP mapping to map CoS 5 to DSCP EF.

4. Re-mark excess data VLAN traffic marked 0, AF11, AF21, CS3, DSCP 25, and AF41 to scavenger class (CS1).

5. Define class maps for voice VLAN, voice signaling, interactive video, transactional data, mission-critical data, bulk data, and default (best effort).

6. Define policy maps and mark voice traffic to DSCP 46 (EF), voice signaling traffic to DSCP 24 (CS3), interactive video to DSCP 34 (AF41), mission-critical traffic to DSCP 25 (CS3), transactional data traffic to DSCP 18 (AF21), bulk data to DSCP 10 (AF11), and default to DSCP 0.

7. Configure policing (rate limiting) for each class.

8. Configure Catalyst switch egress queue in 1P3Q3T mode, that is, set up Q1 as the priority queue to carry all voice traffic, and set up the rest of the three queues in shared-bandwidth mode. Assign Q2 for mission-critical data traffic, Q3 for best-effort traffic, and Q2 for scavenger and bulk traffic. Configure shared weights of 70, 25, and 5 for Q2, Q3, and Q4, respectively.

9. Configure Weighted Tail Drop (WTD) thresholds per queue as shown in Figure 34. For Q2 set the first threshold to 70% and the second threshold to 80%. For Q4, set the first threshold to 40% and the second threshold to 100%.

10. Verify, using the following show commands:

show mls qos

show mls qos map

show mls qos interface

show mls qos interface policers

show class-map

show policy-map

show policy interface

Voice and data packets should be properly marked by the switches.

Excess traffic should be re-marked to scavenger class and dropped if the scavenger class limit is also exceeded.

Queuing should be engaged only during congestion.

Each traffic type should be properly queued based on the queue assignments.

Passed

Enable 8-class hierarchical QoS on the primary WAN interface

1. Configure class maps for voice, voice signaling, interactive video, mission-critical data, transactional data, internetwork control, bulk/scavenger data, and best-effort data.

2. Match voice, based on a DSCP value of 46, and also based on IP address/port number using ACLs. Port numbers range from 16384 to 32768.

3. Match voice signaling, based on a DSCP of CS3, and also based on IP address/port number using ACLs. Use port number range 2000 to 2002 for SCCP, 1720 for H.323, and 5060 to 5062 for SIP.

4. Match interactive video-based on a DSCP value of 34, and also based on IP address/port number using ACLs. Use port number range 16384 to 32768.

5. Match mission-critical data traffic-based on a DSCP value of 25, and also based on IP address/port number using ACLs.

6. Match transactional data traffic, based on a DSCP value of 18, and also based on IP address/port number using ACLs.

7. Match internetwork control traffic, based on a DSCP value of 48, and also based on IP address/port number using ACLs.

8. Match bulk/scavenger traffic, based on a DSCP value of 8, and also based on IP address/port number using ACLs.

9. Match best-effort traffic, based on a DSCP value of 0, and also based on IP address/port number using ACLs.

10. Verify whether packets are matched to the correct class map, using the show policy-map interface command.

Incoming traffic from the LAN interface of the router should be properly classified, based on the DSCP/CoS values present in the packet.

Passed

Enable LLQ for RTP traffic, which includes voice and video

1. Configure strict priority queuing for voice and video traffic not exceeding 33% of the configured bandwidth.

2. Drop excess RTP traffic during link congestion.

3. Make voice and video calls, and also send background HTTP traffic.

4. Verify using show ip policy-map interface command.

RTP and data packets should be Cisco Express Forwarding switched.

Voice traffic and video traffic should always be given priority, even during congestion, and they should not be dropped, provided they do not exceed their allocated bandwidth.

Passed

Configure CBWFQ for various types of data traffic, allocate bandwidth for each category, and configure WRED for congestion management

1. Allocate A% of bandwidth for mission-critical traffic, B% of bandwidth for transactional data traffic, C% for internetwork control traffic, D% for bulk/scavenger traffic, and the remaining bandwidth for best-effort traffic.

2. Configure DSCP-based WRED for mission-critical, transactional, and best-effort traffic. Retain default thresholds, and drop probabilities for WRED.

3. Send voice, video, and data traffic, and oversubscribe the bandwidth with data traffic.

The following data traffic types are mandatory:

•HTTP

•HTTPS

•FTP

•ICMP

•DNS

The following data traffic types are optional and based on availability of tools:

•CIFS

•SMTP

•POP3

•Citrix

Voice traffic and video traffic should always be given priority, even during congestion, and they should not be dropped, provided they do not exceed their allocated bandwidth. Excess data traffic not conforming to the allocated bandwidth should be dropped based on WRED and DSCP. WRED should minimize tail drops for high-priority traffic.

Passed

Enable traffic shaping on the WAN interface as part of the hierarchical QoS configuration

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure traffic shaping on the WAN links to shape the egress traffic to 95% of the available bandwidth.

2. Send voice and data traffic to oversubscribe bandwidth.

The egress traffic should be shaped to an average of 95% of the total available bandwidth.

Passed

Re-mark ingress traffic to the router coming from the WAN and going to the LAN

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure DSCP to CoS mapping for the various ingress traffic types from the WAN. The marking should match the DSCP value of similar or the same type of traffic egressing the WAN interface.

2. Verify using the show policy-map interface command and using the Ethereal packet sniffer on the LAN.

The ingress traffic should be properly marked.

Passed

Modify or delete ACLs defined under class-map configuration mode using match access-group statements

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Change ACLs' source and destination IP addresses.

2. Change ACLs' source and destination ports.

3. Delete ACLs.

4. Save configuration.

5. Run traffic while making the changes.

The ACL changes or deletions should not have no adverse impact on the router such as tracebacks, memory leaks, or a crash. The changes should be properly handled and applied to the traffic stream.

Passed

Remove QoS configuration, and reapply QoS configuration

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Remove QoS configuration.

2. Reapply QoS configuration.

There should be no adverse impact on the router such as tracebacks, memory leaks, or a crash.

Passed

Remove QoS configuration, and reapply QoS configuration after router reload

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Remove the entire hierarchical QoS configuration from the branch router.

2. Reload the router.

3. Reapply the configuration to the branch router while running traffic.

There should be no adverse impact on the router such as tracebacks, memory leaks, or a crash.

Passed

Configure BGP routing to the ISP

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure External BGP (eBGP) on the branch router on the secondary WAN interface.

2. Inject a default route and a limited set of required routes, using a route filter, into the branch Interior Gateway Protocol (IGP) from the ISP.

3. Disable synchronization in the BGP configuration.

4. Advertise only the outside address of the branch to the ISP.

5. Do not advertise any inside addresses (LAN) of the branch router to the ISP.

6. Verify by pinging the headend router.

BGP should come up between the branch and the ISP. The default route and all other routes injected from the ISP should be visible in the branch router's Routing Information Base (RIB).

Ping should be successful between the branch and headend router.

Passed

Enable OSPF between the branch router and headend router, and advertise each other's LAN addresses

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure OSPF routing between the branch router and the headend router.

2. Advertise all the LAN addresses attached to the branch and the LAN addresses attached to the headend so that the headend router can see the branch network and vice versa.

3. Redistribute connected and static routes in the branch and headend into OSPF.

4. Verify by OSPF adjacency, using the show ip ospf neighbors command.

5. Verify by pinging from the branch LAN to the headend LAN and vice versa.

OSPF adjacency should be established between the branch router and the headend router.

Passed

Enable EIGRP between the branch router and headend router and advertise each other's LAN addresses

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure EIGRP routing between the branch router and the headend router.

2. Advertise all the LAN addresses attached to the branch and the headend so that the headend router can see the branch network and vice versa.

3. Redistribute connected and static routes in the branch and headend into EIGRP.

4. Verify by EIGRP adjacency, using the show ip eigrp neighbors command.

5. Verify by pinging from the branch LAN to the headend LAN and vice versa.

EIGRP adjacency should be established between the branch router and the headend router.

Ping should be 100% successful.

Passed

Enable NetFlow on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure NetFlow version 5 or version 9 for both ingress and egress traffic on the WAN and LAN interfaces of the branch router.

2. Send bidirectional HTTP, FTP, and voice traffic between the branch and the headend router.

3. Collect protocol distribution charts, interface statistics, and QoS statistics.

4. Export the statistics to a network analysis module (NAM) located at the enterprise headquarters.

NetFlow should collect the statistics and export it to the NAM. The collected statistics should be within performance requirements.

Passed

Enable NBAR protocol discovery and classification. With the help of QoS, provide bandwidth guarantees for certain traffic flows, and drop certain distributed denial of service (DDoS) traffic such as SQL slammer and worms such as CODE RED, NIMDA, and so on.

1. Configure NBAR protocol discovery on the interfaces, and match protocol statements in the QoS policy map.

•Mark HTTP traffic to a certain URL, such as http://example.com as mission critical.

•Mark all other HTTP traffic as best effort.

•Limit bulk traffic such as FTP.

•Mark all voice traffic as critical.

2. Provide bandwidth guarantees by specifying bandwidth percentage in the QoS policy map configuration for different classes of traffic.

•For mission-critical traffic, provide X% bandwidth.

•For voice traffic, provide Y% bandwidth.

•For transactional traffic, provide Z% bandwidth.

•For all other traffic, provide the remaining bandwidth.

3. Measure the various traffic flows, using NBAR.

4. Send HTTP, FTP, and voice traffic.

NBAR should properly classify the different protocols and provide bandwidth guarantees based on the policy map configuration. NBAR should provide the percentage breakdown of various protocols traversing the LAN and WAN links. NBAR should drop worm packets.

Passed

Modify "match protocol" statements and bandwidth percentage in the policy map configuration

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

Modify the match protocol statements in the NBAR configuration by adding more protocols, changing the existing HTTP URL, and modifying the percentage bandwidth allocated for each traffic class over a live network

Changes should not cause any abnormal behavior in the branch router such as tracebacks, memory leaks, or crashes. Changes should be applied to traffic.

Passed

Configure about 100 ACLs on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure about 100 ACLs, either dummy ACLs or ACLs matching certain hosts or networks.

2. At the end of the list configure a permit ip any any statement.

3. Configure the ACL on the primary and secondary WAN interface.

4. Send data traffic.

If a packet does not match any of the statements in the list, the packet should match the permit ip any any statement at the end of the list and be allowed to pass through. If the packet matches any statement in the last, appropriate action such as permit or deny should be taken, depending on what is configured in the ACL statement.

Passed

NTP in the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure NTP in the branch to source the clock from an NTP server in the network. The NTP server could be local to the branch, or it could be located in either the headquarters or the service provider premises.

2. Configure Message Digest 5 (MD5) authentication for NTP.

3. Verify, using the show ntp status command.

NTP should be sourced from the NTP server after successful authentication.

Passed

Branch router as a DHCP server

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure a DHCP server on the branch router to provide IP addresses for DHCP clients such as IP Phones and PCs.

2. Verify, using the show ip dhcp binding and show ip dhcp server statistics commands.

The DHCP server on the router should be able to provide IP addresses to the clients using DHCP.

Passed

Set up for verification of the service level agreement (SLA) for VoIP UDP jitter SLA

Figure 1, Private WAN, Cisco Unified CME Mode

1. Enable the IP SLA responder on the HQ router.

2. Configure a basic type of VoIP UDP jitter operation on the branch router.

3. Configure any available options, such as codec G.711 u-law for a VoIP UDP jitter SLAs operation type.

4. Configure any threshold conditions, if required.

5. Schedule the operation to run, and then allow the operation to run for enough time to gather statistics.

6. Display and interpret the results of the operation, using Cisco IOS CLI or using an NMS system using SNMP.

To view and interpret the results of an IP SLA operation, use the show ip sla monitor statistics command, and check that the boundaries are within limits. For example,

ICPIF Range  MOS  Quality

0-3                  5       Best

4-13                4       High

14-23              3       Medium

24-33              2       Low

34-43              1       Poor

Passed

Set up verification of the service level agreement (SLA) for VoIP UDP jitter SLA

Figure 1, Private WAN, Cisco Unified CME Mode

1. Enable the IP SLA responder on the HQ router.

2. Configure a basic type of VoIP UDP jitter operation on the branch router.

3. Configure any available options, such as codec G.729A u-law for a VoIP UDP jitter SLA operation type.

4. Configure any threshold conditions, if required.

5. Schedule the operation to run, and then allow the operation to run for enough time to gather statistics.

6. Display and interpret the results of the operation, using Cisco IOS CLI or using an NMS system using SNMP.

To view and interpret the results of an IP SLA operation, use the show ip sla monitor statistics command and check that the boundaries are within limits. For example,

ICPIF Range  MOS  Quality

0-3                  5       Best

4-13                4       High

14-23              3       Medium

24-33              2       Low

34-43              1       Poor

Passed

Set up verification of the service level agreement (SLA) for ICMP echo

Figure 1, Private WAN, Cisco Unified CME Mode

1. Enable the IP SLA responder on the HQ router.

2. Configure ICMP echo operation type on the branch router.

3. Configure any options available for SLAs operation type.

4. Configure any threshold conditions, if required.

5. Schedule the operation to run, and then allow the operation run for enough time to gather statistics.

Display and interpret the results of the operation, using Cisco IOS CLI or using an NMS system using SNMP. For example

ip sla monitor 6  
type echo protocol ipIcmpEcho 192.168.0.2 source-ipaddr 
192.168.0.1 
frequency 300!  
ip sla monitor schedule 6 life forever start-time now

To view and interpret the results of an IP SLA operation, use the show ip sla monitor 6 command to verify details, and report any significant delay issues.

Passed

Setup an IPsec site-to-site VPN between the branch router and the headend router, using DMVPN.

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the headend router as a DMVPN hub and Next Hop Resolution Protocol (NHRP) server with multipoint GRE.

2. Configure the branch router as a spoke with multipoint GRE.

3. Configure ISAKMP policy preshared authentication with 3-DES encryption for the keys.

4. Configure ISAKMP SA lifetime to be 3600.

5. Configure transform set with 3-DES, ESP-SHA, DH Group 2 and preshared keys.

6. Configure IPsec SA lifetime to be 86400.

7. Configure tunnel protection for the DMVPN tunnel interface.

8. Add the DMVPN tunnel interface network address to the IGP configuration.

9. Verify IPsec connectivity, using the following show commands:

•show crypto isakmp sa

•show crypto ipsec sa

•show crypto engine connections active

10. Send a sweep ping from a host connected to the branch data VLAN to a host connected to the headquarters data VLAN.

11. Verify whether the ping traffic gets encrypted; use the show crypto engine accelerator statistics command.

ISAKMP and IPsec sessions should be established.

The DMVPN tunnel line protocol should come up.

Routing tables at both the branch and headquarters routers should be updated.

Ping should be 100% successful.

Ping traffic should be encrypted.

Passed

Set up an IPsec VPN between the branch router and the headend router, using GETVPN

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Set up a GDOI key server for GETVPN in headquarters. The key server can be a Cisco 2900 series ISR platform.

2. Configure the key server to send unicast rekeys.

3. Configure the network segments associated with branch and headquarters LANs for encryption, using an ACL. Associate the ACL to the GDOI SA.

4. Configure AES 256-bit encryption for IPsec.

5. Configure a rekey timeout of 10800 seconds.

6. Configure antireplay protection.

7. Configure the branch routers and the headend routers as group members.

8. Configure the GDOI crypto map on the primary WAN interface of the branch router and the headend router.

9. Configure the TCP maximum segment size (MSS) to 1360 bytes on the router interfaces.

10. Register the group members to the key server.

11. Send a sweep ping from a host connected to the branch data VLAN to a host connected to the headquarters data VLAN.

12. Verify whether the ping traffic gets encrypted; use the show crypto engine accelerator statistics command.

13. Verify GETVPN, using the following show commands:

•show crypto isakmp sa

•show crypto ipsec sa

•show crypto engine connections active

Group members should be registered to the key server.

The key server should successfully push the IPsec SA ACL and rekey the ACL to the group members.

The routing tables at both the branch and head quarters routers should be updated.

Ping should be 100% successful.

Ping traffic should be encrypted.

Passed

GETVPN unicast rekeying

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Set up a GDOI key server for GETVPN in the headquarters. The key server can be a Cisco 2900 series ISR platform.

2. Configure the key server to send unicast rekeys.

3. Configure the network segments associated with the branch and headquarters LANs for encryption, using an ACL. Associate the ACL to the GDOI SA.

4. Configure AES 256-bit encryption for IPsec.

5. Configure a rekey timeout of 10800 seconds.

6. Configure the branch router(s) and the headend router (s) as group members.

7. Configure the GDOI crypto map on the primary WAN interface of the branch router and headend router.

8. Register the group members to the key server.

9. Verify rekeying functionality.

10. Use the show crypto isakmp sa command to verify.

Group members should be registered to the key server.

The key server should be able to successfully push the ACL for unicast rekeying to the group members.

After the rekey timeout, the key server should send new keys to the group members. For some time, both old keys and new keys should be present in group members. The new key should take over after a certain amount of time, usually within a minute.

Passed

GETVPN multicast rekeying

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Set up a GDOI key server for GETVPN in the headquarters. The key server can be a Cisco 2900 series ISR platform.

2. Configure the key server to send multicast rekeys, with unicast rekeys as a backup mechanism.

3. Define an ACL for multicast rekeying in the key server, and use the 239.x.x.x multicast group for rekeying.

4. Configure PIM sparse mode (PIM-SM) on the key server and all the group members.

5. Configure the headend router as the rendezvous point (RP).

6. Configure the network segments associated with the branch and headquarters LANs for encryption, using an ACL. Associate the ACL to the GDOI SA.

7. Configure AES 256-bit encryption for IPsec.

8. Configure a rekey timeout of 10800 seconds.

9. Configure the branch router(s) and the headend router(s) as group members.

10. Configure the GDOI crypto map on the primary WAN interface of the branch router and the headend router.

11. Register the group members to the key server.

12. Verify rekeying functionality.

13. Use the show crypto isakmp sa command to verify.

Group members should be registered to the key server.

The key server should be able to successfully push the ACL for multicast rekeying to the group members.

Group members should register to the 239.x.x.x multicast group successfully.

After the rekey timeout, the key server should send new keys to the multicast group. For some time, both old keys and new keys should be present in group members, and the new key should take over after a certain amount of time, usually within a minute.

Passed

IPsec DMVPN with prefragmentation

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure IPsec VPN between the branch and headquarters with a tunnel MTU of 1000 bytes.

2. Enable prefragmentation.

3. Send voice and data traffic through the IPsec VPN tunnel.

The IPsec packets that are larger than 1000 bytes should be fragmented.

Passed

IPsec DMVPN and IGP

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Bring down the IPsec tunnel between the branch and the headquarters router.

2. Verify whether the routing table is updated at both the branch and headquarters routers.

3. After 3 minutes, bring up the IPsec tunnel between the branch and headquarters routers.

4. Verify whether the routing table is updated at both the branch and headquarters routers.

When the IPsec tunnel goes down, the routing tables at both the branch and headquarters are updated. At the branch, the headquarters becomes unreachable, and the routes should be removed from the routing table. Similarly, at the headquarters, the branch becomes unreachable, and routes should be removed from the routing table.

When the tunnel comes back up, the routes at both the branch and headquarters should reappear.

Passed

DMVPN backup on medium branch using static floating route (Spoke-to-HQ)

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. On the medium branch Cisco 2951 router, configure the serial interface on the branch that connects to the Internet Cloud router for frame-relay.

2. Configure the static route in the branch router to reach to HQ with higher administrative distance (for example, 240).

3. Redistribute the static route into the IGP on the branch router.

4. Make sure that the entire traffic flow is going through the MPLS network when the branch WAN is up and running.

5. Shut down the WAN and verify that the IP traffic flows to HQ using the Internet Cloud.

Verify that you can reach HQ from the branch when the primary WAN is down.

Passed

DMVPN backup on medium branch using static floating route (Spoke-to-Spoke)

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. On the medium branch Cisco 2951 router, configure the serial interface on the branch that connects to the Internet Cloud router for frame-relay.

2. Configure the static route in the branch router to reach to HQ with higher administrative distance (for example, 240).

3. Redistribute the static route into the IGP on the branch router.

4. Make sure that the entire traffic is going through the MPLS network when the branch WAN is up and running.

5. Shut down the WAN and verify that IP traffic flows to HQ through the Internet Cloud.

6. Verify that from small branch running DMVPN that you can reach the medium branch when the WAN link is down.

7. Check the DMVPN hub for the NHRP database for all the spoke addresses (registered branch address).

8. Verify that a dynamic tunnel has been created between the medium branch and the small branch.

Verify that you can reach HQ and the small branch from the medium branch when the primary WAN is down.

Passed

DMVPN backup with BFD using EIGRP as IGP (Branch to HQ)

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the primary WAN interface and secondary WAN interface on the branch router.

2. Configure the secondary WAN interface as a Frame Relay interface that accesses the Internet.

3. Configure DMVPN on the branch router.

4. Configure the secondary WAN to be a higher cost route than the primary WAN so that primary WAN is always the preferred route.

5. Configure BFD on the primary WAN interface of the branch router and the primary WAN interface of the head-end router with a BFD interval of 50 ms, min_rx of 50 ms, and a BFD multiplier of 5.

6. Configure BFD on the secondary WAN interface.

7. Enable BFD for all interfaces in the EIGRP routing process.

8. Verify whether BFD is up and running by issuing show bfd neighbor command

9. Send HTTP and voice traffic between the branch and HQ.

10. Bring down the primary WAN interface by either disconnecting the cable or shutting down the link on the head-end side.

11. After about three minutes, bring up the primary WAN interface.

Verify that, when the primary WAN fails, EIGRP reconvergence occurs within a second because of BFD.

Verify that all the traffic is routed through the secondary WAN interface.

Verify that voice and HTTP sessions are maintained during reconvergence.

Verify that, when the primary WAN comes up after three minutes, the traffic is routed over the primary WAN interface.

Passed

DMVPN backup with BFD using EIGRP as IGP (Branch to Branch)

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the primary WAN interface and secondary WAN interface on the branch router.

2. Configure the secondary WAN interface as a Frame Relay interface that assesses the Internet.

3. Configure DMVPN on the branch router.

4. Configure the secondary WAN to be a higher cost route than the primary WAN so that primary WAN is always the preferred route.

5. Configure BFD on the primary WAN interface of the branch router and the primary WAN interface of the head-end router with BFD interval of 50 ms, min_rx of 50 ms, and a BFD multiplier of 5.

6. Configure BFD on the secondary WAN interface.

7. Enable BFD for all interfaces in the EIGRP routing process.

8. Verify whether BFD is up and running by issuing show bfd neighbor command.

9. Send HTTP and voice traffic between the branch and HQ.

10. Bring down the primary WAN interface by either disconnecting the cable or shutting down the link on the head-end side.

11. After about three minutes, bring up the primary WAN interface.

Verify that, when the primary WAN fails, EIGRP reconvergence occurs within a second because of BFD.

Verify that all the traffic is routed through the secondary WAN interface.

Verify that voice and HTTP sessions are maintained during reconvergence.

Verify that, when the primary WAN comes up after three minutes, the traffic is routed over the primary WAN interface.

Passed

DMVPN backup with BFD using OSPF as IGP (Branch to Branch)

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the primary WAN interface and secondary WAN interface on the branch router.

2. Configure the secondary WAN interface as a Frame Relay interface that assesses the Internet.

3. Configure DMVPN on the branch router.

4. Configure the secondary WAN to be a higher cost route than the primary WAN so that primary WAN is always the preferred route.

5. Configure BFD on the primary WAN interface of the branch router and the primary WAN interface of the head-end router with BFD interval of 50 ms, min_rx of 50 ms, and a BFD multiplier of 5.

6. Configure BFD on the secondary WAN interface.

7. Enable BFD for all interfaces in the EIGRP routing process.

8. Verify whether BFD is up and running by issuing show bfd neighbor command.

9. Send HTTP and voice traffic between the branch and HQ.

10. Bring down the primary WAN interface by either disconnecting the cable or shutting down the link on the head-end side.

11. After about three minutes, bring up the primary WAN interface.

Verify that, when the primary WAN fails, EIGRP reconvergence occurs within a second because of BFD.

Verify that all the traffic is routed through the secondary WAN interface.

Verify that voice and HTTP sessions are maintained during reconvergence.

Verify that, when the primary WAN comes up after three minutes, the traffic is routed over the primary WAN interface.

Passed

DMVPN backup for MPLS using EBGP

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the primary WAN interface and backup WAN interface on the branch router.

2. Configure the secondary WAN interface as a Frame Relay interface that assesses the Internet.

3. Configure DMVPN on the branch router.

4. Configure EBGP peers with the Internet router on the branch router. Under normal conditions, when the primary WAN is up and running, the backup DMVPN is dormant.

5. Shut down the primary WAN interface. The backup interface should come up and the EBGP peers become activated. Finally, the DMVPN should come up.

6. Send 2 Mb/s of traffic from the backup interface (DMVPN is up) and check the QoS status and various queues.

7. Send HTTP and Voice traffic between the branch and HQ

8. After about three minutes, bring up the primary WAN interface

Verify that, when the primary WAN fails, the backup DMVPN comes up.

Verify that voice and HTTP sessions pass through.

Check for appropriate QoS Queues.

When the primary comes up after three minutes, verify that the traffic is routed over the primary WAN interface.

Passed

DMVPN with QoS

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the 8-class QoS model as explained in the QoS test cases.

2. Configure DMVPN with the qos pre-classify command to classify IPsec packets before encryption.

3. Send voice and data traffic, and verify whether traffic going through the DMVPN tunnel gets the correct QoS treatment, such as voice put in strict priority queue with proper bandwidth percentages applied.

The IPsec packets should get the correct QoS treatment.

Passed

GETVPN with QoS

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the 8-class QoS model as explained in the QoS test cases.

2. Configure GETVPN with the qos pre-classify command to classify IPsec packets before encryption.

3. Send voice traffic and data traffic, and verify whether traffic going through the GETVPN gets the correct QoS treatment, such as voice put in strict priority queue with proper bandwidth percentages applied.

The IPsec packets should get the correct QoS treatment.

Passed

DMVPN with QoS and NBAR

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the 8-class QoS model as explained in the QoS test cases.

2. Configure NBAR with the custom ip nbar port-map and ip nbar protocol-discovery commands as in the NBAR test case.

3. Configure DMVPN with the qos pre-classify command to classify IPsec packets before encryption.

4. Send voice and data (HTTP, FTP, and ICMP) traffic, and verify whether traffic going through the DMVPN tunnel gets the correct NBAR and QoS treatment, such as voice put in the strict priority queue with the proper bandwidth percentages applied.

QoS and NBAR classification and bandwidth guarantees should be given to the voice and data traffic egressing the WAN interface before encryption.

Passed

GETVPN with QoS and NBAR

Figure 1, Private WAN, Cisco Unified CME Mode or

Figure 2, Private WAN, Cisco Unified SRST Mode or

Figure 3, MPLS WAN, Cisco Unified CME Mode or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the 8-class QoS model as explained in the QoS test cases.

2. Configure NBAR with the custom ip nbar port-map and ip nbar protocol-discovery commands as in the NBAR test case.

3. Configure GETVPN with the qos pre-classify command to classify IPsec packets before encryption.

4. Send voice and data (HTTP, FTP, and ICMP) traffic and verify whether traffic going through the IPsec tunnel gets the correct NBAR and QoS treatment, such as voice put in the strict priority queue with the proper bandwidth percentages applied.

QoS and NBAR classification and bandwidth guarantees should be given to the voice and data traffic egressing the WAN interface before encryption.

Passed

DMVPN/GETVPN with QoS, NBAR and NetFlow

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure the 8-class QoS model as explained in the QoS test cases.

2. Configure NBAR with custom ip nbar port-map and ip nbar protocol-discovery commands as in the NBAR test case.

3. Configure NetFlow version 5 or version 9 for both ingress and egress traffic on the WAN and LAN interfaces of the branch router.

4. Configure IPsec with the qos pre-classify command to classify IPsec packets before encryption.

5. Send voice and data (HTTP, FTP, and ICMP) traffic, and verify whether traffic going through the IPsec tunnel gets the correct NBAR and QoS treatment, such as voice put in the strict priority queue with the proper bandwidth percentages applied.

6. Collect protocol distribution charts, interface statistics, and QoS statistics. Export the statistics to a NAM at the enterprise headquarters.

QoS and NBAR classification and bandwidth guarantees should be given to the voice and data traffic egressing the WAN interface before encryption

NetFlow should collect the statistics and export them to the NAM, and the collected statistics should be within performance requirements.

Passed

Configure Zone-based Policy Firewall (ZPF) with three zones: Public, Private, and DMZ

1. Create the firewall policy.

Referring to the test setup, the steps for creating zone-based policy firewall are outlined below.

2. Create the class maps to classify network traffic.

3. Create the policy map (firewall policy).

4. Create the Inspect Parameter-Map.

5. Create the security zones: Public, Private, and DMZ.

6. Assign the interfaces to the security zones (zone membership).

7. Assign the primary WAN interfaces to the Private zone.

8. Assign the voice and data VLANs to the Private zone.

9. Assign the DMZ VLAN to the DMZ zone.

10. Assign secondary WAN interface to Public zone.

11. Create the zone pairs in the test setup, and assign a policy map (firewall policy).

12. Send various kinds of traffic, such as HTTP, HTTPS, DNS, FTP, and ICMP, between the zones.

From Private zone to Private zone all traffic should be passed without any inspection.

From Private zone to Public zone, HTTP, FTP, DNS, HTTPS, SSH, and ICMP traffic should be inspected and allowed, and the rest of the traffic should be blocked.

From Public zone to Private zone, no traffic should be allowed.

From Public zone to DMZ zone, only HTTP, FTP, and DNS should be allowed.

Passed

Configure NAT and PAT for traffic going out to the Internet

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure static NAT translations for certain hosts on the data VLAN, using an address pool.

2. For the rest of the hosts, configure PAT by using the overload command in the NAT configuration.

3. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

4. Configure the LAN as NAT inside, and configure the secondary WAN interface as NAT outside.

5. Send HTTP, HTTPS, ICMP, DNS, and SSH traffic from clients on the LAN to the Internet.

6. Verify translations and statistics using the show ip nat translations and show ip nat statistics commands.

The inside address should be translated to the outside global address when the traffic from the LAN is going out to the Internet. The return traffic from the Internet to the LAN should always be directed to the outside global address of the inside hosts.

Passed

Configure NAT and QoS on the branch

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure static NAT translations for certain hosts on the data VLAN using an address pool and for the rest of the hosts configure PAT by using the overload command in the NAT configuration.

2. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

3. Configure 8-class H-QoS on the secondary WAN interface.

4. Mark all the traffic going out to the Internet as best-effort traffic.

5. Configure traffic shaping to 95% of the available WAN bandwidth.

6. Configure NetFlow on the secondary WAN interface for ingress and egress traffic.

7. Collect traffic statistics and distribution charts, and export the statistics to a NAM, using either v5 or v9 NetFlow.

8. Send HTTP, HTTPS, ICMP, DNS and SSH traffic from clients on the LAN to the Internet.

9. Verify translations and statistics, using the show ip nat translations and show ip nat statistics commands.

10. Verify QoS, using the show policy-map interface command.

11. Verify NetFlow, using the show ip flow command.

The inside address should be translated to the outside global address when the traffic from the LAN is going out to the Internet. The return traffic from the Internet to the LAN should always be directed to the outside global address of the inside hosts.

All the Internet traffic should be marked as best effort.

Traffic should be shaped to 95% of the WAN bandwidth.

The NetFlow statistics collected should be within performance requirements.

Passed

Configure ZPF, QoS, and NetFlow on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

2. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

3. Assign the primary WAN interface to the Private zone.

4. Assign the secondary WAN interface to the Public zone.

5. Assign the voice VLAN and data VLAN interfaces to the Private zone.

6. Configure 8-class hierarchical QoS on both the primary and secondary WAN interfaces.

7. Mark all the traffic going out to the Internet as best-effort traffic.

8. Configure traffic shaping to 95% of the available WAN bandwidth.

9. Configure NetFlow on the WAN and LAN interfaces for ingress and egress traffic.

10. Collect traffic statistics and distribution charts, and export the statistics to a NAM, using NetFlow version 5 or version 9.

11. Send HTTP, HTTPS, ICMP, DNS, and SSH traffic from clients on the LAN to the Internet.

12. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

13. Ping one of the clients on the LAN from the ISP.

14. Verify translations and statistics, using the show ip nat translations and show ip nat statistics command.

15. Verify QoS, using the show policy-map interface command.

16. Verify NetFlow, using the show ip flow command.

Traffic from the branch to headquarters should not be inspected.

Traffic from the branch to the Internet should be inspected.

QoS should be applied to the traffic, and ZPF should have no adverse effect on the QoS.

All the Internet traffic should be marked as best effort.

Traffic should be shaped to 95% of the WAN bandwidth.

The NetFlow statistics collected should be within performance requirements.

The ping should fail.

Passed

Configure ZPF, QoS, NBAR, and NetFlow on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

2. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

3. Assign the primary WAN interface to the Private zone.

4. Assign the secondary WAN interface to the Public zone.

5. Assign the voice VLAN and data VLAN interfaces to the Private zone.

6. Configure 8-class hierarchical QoS on both primary and secondary WAN interfaces.

7. Mark all the traffic going out to the Internet as best-effort traffic.

8. Configure traffic shaping to 95% of the available WAN bandwidth.

9. Configure NBAR as in the NBAR Classification with QoS test case.

10. Configure NetFlow on the WAN and LAN interfaces for ingress and egress traffic.

11. Collect traffic statistics and distribution charts, and export the statistics to a NAM, using NetFlow version 5 or version 9.

12. Send HTTP, HTTPS, ICMP, DNS, and SSH traffic from clients on the LAN to the Internet.

13. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

14. Ping one of the clients on the LAN from the ISP.

15. Verify translations and statistics using the show ip nat translations and show ip nat statistics commands.

16. Verify QoS, using the show policy-map interface command.

17. Verify NetFlow, using the show ip flow command.

Traffic from the branch to headquarters should not be inspected.

Traffic from the branch to the Internet should be inspected.

QoS should be applied to the traffic, and ZPF should have no adverse effect on the QoS.

All the Internet traffic should be marked as best effort.

Traffic should be shaped to 95% of the WAN bandwidth.

NBAR should provide bandwidth guarantees to different flows and should detect and stop worms such as NIMDA and CODE RED.

The NetFlow statistics collected should be within performance requirements.

The ping should fail.

Passed

Configure ZPF, QoS, NBAR, and NetFlow on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

2. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

3. Assign the primary WAN interface to the Private zone.

4. Assign the secondary WAN interface to the Public zone.

5. Assign the voice VLAN and data VLAN interfaces to the Private zone.

6. Configure static NAT translations for certain hosts on the data VLAN using an address pool. For the rest of the hosts, configure PAT by using the overload keyword in the ip nat inside source command in the NAT configuration.

7. Configure the data VLAN as NAT inside, and configure the secondary WAN interface as NAT outside.

8. Configure 8-class hierarchical QoS on both primary and secondary WAN interfaces.

9. Mark all the traffic going out to the Internet as best-effort traffic.

10. Configure traffic shaping to 95% of the available WAN bandwidth.

11. Configure NBAR as in the NBAR Classification with QoS test case.

12. Configure NetFlow on the WAN and LAN interfaces for ingress and egress traffic.

13. Collect traffic statistics and distribution charts, and export the statistics to a NAM, using NetFlow version 5 or version 9.

14. Send HTTP, HTTPS, ICMP, DNS, and SSH traffic from clients on the LAN to the Internet.

15. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

16. Ping one of the clients on the LAN from the ISP.

17. Verify translations and statistics, using the show ip nat translations and show ip nat statistics commands.

18. Verify QoS, using the show policy-map interface command.

19. Verify NetFlow, using the show ip flow command.

Traffic from the branch to headquarters should not be inspected.

Traffic from the branch to the Internet should be inspected.

Inside addresses should be translated to outside global addresses when the traffic from the LAN is going out to the Internet. The return traffic from the Internet to the LAN should always be directed to the outside global address of the inside hosts.

QoS should be applied to the traffic, and ZPF should not have any adverse effect on the QoS.

All the Internet traffic should be marked as best effort.

Traffic should be shaped to 95% of the WAN bandwidth.

NBAR should provide bandwidth guarantees to different flows and should detect and stop worms such as NIMDA and CODE RED.

The NetFlow statistics collected should be within performance requirements.

The ping should fail.

Passed

Configure ZPF with DMVPN on the primary WAN interface connecting the branch and headquarters

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

2. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

3. Assign the primary WAN interface to the Private zone.

4. Assign the DMVPN tunnel interface over the primary WAN to the Private zone.

5. Assign the voice VLAN and data VLAN interfaces to the Private zone.

6. Assign the secondary WAN interface to the Public zone.

7. Configure firewall policy for the Private zone to the Public zone, the Private zone to the DMZ zone, and the Public zone to the DMZ zone.

8. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

ZPF should have no adverse impact on DMVPN.

Traffic between the branch and headquarters over the primary WAN interface should be encrypted.

Passed

Configure ZPF with GETVPN connecting the branch and headquarters

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

2. Assign the primary WAN interface to the Public zone.

3. Assign the voice VLAN and data VLAN interfaces to the Private zone.

4. Configure GETVPN as in the IPsec Using GETVPN test case procedure.

5. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

Traffic between the branch and headquarters should be encrypted.

ZPF should have no effect on the traffic between the branch and headquarters.

Passed

Configure ZPF, QoS, NBAR, and NetFlow on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure IPsec VPN, using either DMVPN or GETVPN on the primary WAN interface.

2. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

3. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

4. Assign the primary WAN interface to the Private zone.

5. Assign the secondary WAN interface to the Public zone.

6. Assign the voice VLAN and data VLAN interfaces to the Private zone.

7. Configure static NAT translations for certain hosts on the data VLAN, using an address pool. For the rest of the hosts, configure PAT by using the overload command in the NAT configuration.

8. Configure the data VLAN as NAT inside, and configure the secondary WAN interface as NAT outside.

9. Configure 8-class hierarchical QoS on both the primary and secondary WAN interfaces.

10. Mark all the traffic going out to the Internet as best-effort traffic.

11. Configure traffic shaping to 95% of the available WAN bandwidth.

12. Configure NBAR as in the NBAR Classification with QoS test case.

13. Configure NetFlow on the WAN and LAN interfaces for ingress and egress traffic.

14. Collect traffic statistics and distribution charts, and export the statistics to a NAM using NetFlow version 5 or version 9.

15. Send HTTP, HTTPS, ICMP, DNS, and SSH traffic from clients on the LAN to the Internet.

16. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

17. Ping one of the clients on the LAN from the ISP.

18. Verify translations and statistics, using the show ip nat translations and show ip nat statistics commands.

19. Verify QoS, using the show policy-map interface command.

20. Verify NetFlow, using the show ip flow command.

Traffic from the branch to headquarters should be encrypted.

Traffic from the branch to headquarters should not be inspected.

Traffic from the branch to the Internet should be inspected.

Inside addresses should be translated to outside global addresses when the traffic from the LAN is going out to the Internet. The return traffic from the Internet to the LAN should always be directed to the outside global address of the inside hosts.

QoS should be applied to the traffic, and ZPF should not have any adverse effect on the QoS.

All the Internet traffic should be marked as best-effort.

Traffic should be shaped to 95% of the WAN bandwidth.

NBAR should provide bandwidth guarantees to different flows and should detect and stop worms such as NIMDA and CODE RED.

The NetFlow statistics collected should be within performance requirements.

The ping should fail.

Passed

Configure Cisco IOS IPS with IDCONF v5.0 in the branch router to prevent denial-of-service attacks

1. Download the latest IPS signature pack from: http://www.cisco.com/cgi-bin/tablebuild.pl/ios-v5sigup to the router flash.

2. Configure Cisco IOS IPS with IDCONF v5.0 on the router.

3. Enable the advanced category signature set.

4. Configure Cisco IOS IPS for both directions of traffic on the data VLAN and WAN interfaces.

5. Enable syslog on the router and log the syslog messages to a syslog server located in the branch.

6. Launch DDOS attacks from a PC attached to the branch router data VLAN to a server at the headquarters.

7. Verify whether the attacks are detected by Cisco IOS IPS and whether the alert messages are logged to the syslog server.

The attacks should be detected by Cisco IOS IPS, and appropriate signatures should be triggered.

Actions such as warning, dropping the packets, or dropping the session should be taken based on a particular signature configuration.

The alert messages related to the attack should be logged to a syslog server.

Passed

Configure Cisco IOS IPS with IDCONF v5.0 in the branch router to prevent denial-of-service attacks

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Download the latest IPS signature pack from: http://www.cisco.com/cgi-bin/tablebuild.pl/ios-v5sigup to the router flash.

2. Configure Cisco IOS IPS with IDCONF v5.0 on the router.

3. Enable advanced category signature set.

4. Configure Cisco IOS IPS for both directions of traffic on the data VLAN and WAN interfaces.

5. Enable syslog on the router, and log the syslog messages to a syslog server located in the branch.

6. Send HTTP, HTTPS, and FTP traffic between the branch and headquarters.

7. Launch DDOS attacks from a PC attached to the branch router data VLAN to a server at the headquarters.

8. Verify whether the attacks are detected by Cisco IOS IPS and whether the alert messages, logged to the syslog server.

The attacks should be detected by Cisco IOS IPS, and appropriate signatures should be triggered.

Actions such as warning, dropping the packets, or dropping the session should be taken based on a particular signature configuration.

The alert messages related to the attack should be logged to a syslog server.

Passed

Configure ZPF with NAT and Cisco IOS IPS on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure

2. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

3. Assign the primary WAN interface to the Private zone.

4. Assign the secondary WAN interface to the Public zone.

5. Assign the voice VLAN and data VLAN interfaces to the Private zone.

6. Configure static NAT translations for certain hosts on the data VLAN, using an address pool. For the rest of the hosts, configure PAT by using the overload command in the NAT configuration.

7. Configure the data VLAN as NAT inside, and configure the secondary WAN interface as NAT outside.

8. Download the latest Cisco IOS IPS signature pack from: http://www.cisco.com/cgi-bin/tablebuild.pl/ios-v5sigup to the router flash.

9. Configure Cisco IOS IPS with IDCONF v5.0 on the router.

10. Enable advanced category signature set.

11. Configure Cisco IOS IPS for both directions of traffic on the data and DMZ VLAN and WAN interfaces.

12. Enable syslog on the router, and log the syslog messages to a syslog server located at the branch.

13. Send HTTP, HTTPS, and FTP traffic between the branch and headquarters.

14. Send HTTP, FTP, and DNS traffic between the branch and the Internet.

15. Launch DDOS attacks from a PC attached to the branch router data VLAN to a server located at the headquarters.

16. Launch threats from a host in the Internet to the DMZ servers.

17. Verify whether the attacks are detected by Cisco IOS IPS and whether the alert messages are logged to the syslog server.

Traffic from the branch to headquarters should not be inspected.

Traffic from the branch to Internet should be inspected.

Inside addresses should be translated to outside global addresses when the traffic from the LAN is going out to the Internet. The return traffic from the Internet to the LAN should always be directed to the outside global address of the inside hosts.

The attacks should be detected by Cisco IOS IPS, and appropriate signatures should be triggered.

Actions such as warning, dropping the packets or dropping the session, or blocking the host should be taken based on a particular signature configuration.

The alert messages related to the attack should be logged to a syslog server.

Passed

Configure ZPF, QoS, NBAR, NAT, Cisco IOS IPS, and NetFlow on the branch router

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or

Figure 3, MPLS WAN, Cisco Unified CME Mode, or

Figure 4, MPLS WAN, Cisco Unified SRST Mode

1. Configure IPsec VPN using either DMVPN or GETVPN on the primary WAN interface.

2. Configure ZPF as explained in the Zone-based Policy Firewall Configuration on the Branch Router test case procedure.

3. Configure the secondary WAN interface as the interface connecting to the Internet through the ISP.

4. Assign the primary WAN interface to the Private zone.

5. Assign the secondary WAN interface to the Public zone.

6. Assign the voice VLAN and data VLAN interfaces to the Private zone.

7. Configure static NAT translations for certain hosts on the data VLAN, using an address pool. For the rest of the hosts, configure PAT by using the overload command in the NAT configuration.

8. Configure the data VLAN as NAT inside, and configure the secondary WAN interface as NAT outside.

9. Configure Cisco IOS IPS with IDCONF v5.0 on the router.

10. Enable advanced category signature set.

11. Configure Cisco IOS IPS for both directions of traffic on the data and DMZ VLAN and WAN interfaces.

12. Enable syslog on the router and log the syslog messages to a syslog server at the branch.

13. Configure 8-class hierarchical QoS on both primary and secondary WAN interfaces.

14. Mark all the traffic going out to the Internet as best-effort traffic.

15. Configure traffic shaping to 95% of the available WAN bandwidth.

16. Configure NBAR as in the NBAR Classification with QoS test case.

17. Configure NetFlow on the WAN and LAN interfaces for ingress and egress traffic.

18. Collect traffic statistics and distribution charts, and export the statistics to a NAM, using NetFlow version 5 or version 9.

19. Send HTTP, HTTPS, ICMP, DNS, and SSH traffic from clients on the LAN to the Internet.

20. Send bidirectional HTTP, HTTPS, and FTP traffic between the branch and headquarters.

21. Ping one of the clients on the LAN from the ISP.

22. Launch DDOS attacks from a PC attached the branch router data VLAN to a server located at the headquarters.

23. Launch threats from a host in the Internet to the DMZ servers.

24. Verify translations and statistics, using the show ip nat translations and show ip nat statistics commands.

25. Verify whether the attacks are detected by Cisco IOS IPS and whether the alert messages are logged to the syslog server.

26. Verify QoS, using the show policy-map interface command.

27. Verify NetFlow, using show ip flow command.

All traffic should be Cisco Express Forwarding switched.

Traffic from the branch to headquarters should be encrypted.

Traffic from the branch to headquarters should not be inspected.

Traffic from the branch to the Internet should be inspected.

Inside addresses should be translated to the outside global address when the traffic from the LAN is going out to the Internet. The return traffic from the Internet to the LAN should always be directed to the outside global address of the inside hosts.

QoS should be applied to the traffic, and ZPF should not have any adverse effect on the QoS.

All the Internet traffic should be marked as best-effort.

Traffic should be shaped to 95% of the WAN bandwidth.

The attacks should be detected by Cisco IOS IPS, and appropriate signatures should be triggered.

Actions such as warning, dropping the packets or dropping the session, blocking host should be taken based on a particular signature configuration.

The alert messages related to the attack should be logged to a syslog server.

NBAR should provide bandwidth guarantees to different flows and should detect and stop worms such as NIMDA and CODE RED.

NetFlow statistics collected should be within performance requirements.

The ping should fail.

Passed

Configure WebVPN in clientless mode

1. Configure AAA RADIUS authentication.

2. Configure a trust point with a persistent self-signed certificate.

3. Configure the WebVPN gateway with an IP address, and associate the trust point to the gateway. Enable the WebVPN service.

4. Configure the WebVPN context, and define the URL list and the port list in the context.

5. Configure WebVPN for clientless access with support for intranet web-based applications and Windows File Sharing Common Internet File System (CIFS).

6. Configure the WebVPN policy, and associate the context and gateway to the policy. Enable WebVPN policy.

7. Connect from a remote user from the Internet, using a web browser (Microsoft Internet Explorer 6.0) to the WebVPN gateway.

8. Access web-based applications and shared drives on the intranet.

9. Use either the Cisco IOS CLI or CCP to configure WebVPN.

10. Verify WebVPN functionality, by using the following show commands or by monitoring through CCP:

•show webvpn gateway

•show webvpn context

•show webvpn session context

•show webvpn session user

•show webvpn stats

All traffic should be Cisco Express Forwarding switched.

The remote user should be able to connect to the WebVPN gateway by just using only a web browser, without running any Java applet or application.

The remote user should be able to access branch intranet web-based applications and Windows shared drives.

All the SSL VPN traffic should be accelerated.

Passed

Configure WebVPN in SVC or full tunnel access mode

Note Tunneling Client (also known as Thick Client or Full Tunneling): A larger client (generally around 500K max) is delivered to the end user. The applications that can be accessed are very similar to those available via IPsec VPN. This client is delivered via a web page (the device to which the user is connecting) and never needs to be manually distributed or installed.

The Cisco SSL VPN client (SVC) client configuration requires:

•Configuration of an address pool (very similar to IPsec VPN).

•The address pool to be called in the policy group.

•Turning on SVC with tunnel mode enabled.

1. Configure AAA RADIUS authentication.

2. Configure an IP address pool for SVC.

3. Configure a trust point with persistent self-signed certificate.

4. Configure the WebVPN gateway with an IP address, and associate the trust point to the gateway. Enable the WebVPN service.

5. Configure the WebVPN context.

6. Configure the WebVPN policy, and associate the context and gateway to the policy. Enable WebVPN policy.

7. Associate the address pool in the WebVPN policy.

8. Turn on SVC with tunnel mode enabled.

9. From the remote PC, download the SVC client software and connect.

10. Access web-based applications and shared drives in the intranet.

11. Use either the Cisco IOS CLI or CCP to configure WebVPN.

12. Verify WebVPN functionality, using the following show commands or by monitoring through CCP:

•show webvpn gateway

•show webvpn context

•show webvpn session context

•show webvpn session user

•show webvpn stats

All traffic should be Cisco Express Forwarding switched.

The remote user should be able to connect to the WebVPN gateway, using the SVC client application.

The remote user should be able to access branch intranet web-based applications and Windows shared drives.

All the SSL VPN traffic should be accelerated.

Passed

Enable all the baseline services in the branch and headend routers. The baseline features include BGP routing, OSPF/EIGRP routing, IPsec using DMVPN or GETVPN, ZPF, NAT, IPS, QoS, NBAR, ACL, NetFlow, DHCP, AAA RADIUS server, NTP, syslog, SNMP, WebVPN, PIM-v2, and IGMP v2.

Configure L2 and L3 switching on the access and distribution layer switches.

Enable QoS on the L3 distribution switches.

Figure 1, Private WAN, Cisco Unified CME Mode, or

Figure 2, Private WAN, Cisco Unified SRST Mode, or