Sim 11: Infrastructure Security: CoPP, uRPF and AAA¶
Blueprint 3.1, 3.2, 3.3, 4.1
| Difficulty | Time target | Devices | Faults |
|---|---|---|---|
| Medium | 25 minutes | 4 x IOSv | 3 |
Scenario¶
R1 is a hardened edge router. Administrators manage it over SSH from the management LAN 192.168.100.0/24 behind R2, using a management station (R4, an IOSv acting as a host). R1 protects itself with:
- AAA: VTY logins authenticate and authorise against a TACACS+ server, falling back to the local database when the server cannot be reached. The TACACS+ server at 192.168.100.50 is not built in this lab, so every login uses the fallback.
- VTY access control: a standard ACL allows SSH only from the management LAN.
- uRPF: loose mode on Gi0/0. Routing is deliberately asymmetric (traffic from R2 arrives on Gi0/0, but R1's best path back to R2's networks is through R3), so strict mode cannot be used there.
- CoPP: a control-plane policy drops known-unwanted traffic first, then lets routing protocol traffic through and rate-limits management, ICMP and everything else.
Download the lab
CML lab file · EVE-NG lab file
4 nodes. The lab boots already broken (the faults are in the start-up configs, so skip Break it). CML: Import a lab, then start it. EVE-NG: import the .unl from the lab list; if your image folder names differ, edit each node's image.
Free account required for the rest
The rest of this page is for members. You're seeing a free sample. A free account unlocks everything: every question bank, the timed exams, the cram sheets, the simulations and the lab files.
Unlock the full question banks and cram sheets
A free account opens every question bank, the timed practice exams, the printable cram sheets, all the simulations and the lab files. Without one you see a 5-question sample of each.
No card needed. Study tips by email are optional and off unless you tick the box. Your address is never sold or shared. Privacy policy · Terms
Signed in as . Your account
You're on the free account, so lessons after the first module, question banks, exams and cram sheets show a sample. See Track Pass and All-Access
Also from NetManager Systems: NetManager, network monitoring for multi-vendor networks. Try the NetManager, NetDiag, PCAP Analyzer and OpsDash demos: every new account gets a free 7-day read-only login to each.