Network Administrator
Below is a worked solution for all three questions,
using Cisco IOS commands. Since the examination does not provide the actual router/switch
interface numbers, RADIUS server IP, shared secret, or exact port-to-department
assignments, I have used clearly marked placeholders. Replace them with the
values supplied during the practical examination.
Important assumptions:
- The
router performs inter-VLAN routing using subinterfaces
(router-on-a-stick).
- The
switch connects to the router through a trunk port.
- The
router's ISP next-hop address is 41.59.254.138.
- The
router's OSPF process ID is 10, with router ID 1.1.1.1.
- The
switch supports SSH, VLANs, port security, and RADIUS authentication.
PRACTICAL EXAMINATION
QUESTIONS AND ANSWERS
QUESTION ONE: BASIC DEVICE CONFIGURATION
A. Router Configuration
Perform the following configurations on the
router:
i) Configure SSHv2 access restriction
Question: Deny SSHv2 access
from the host machine with IP address 172.16.10.2.
Answer:
Configure an access control list to deny SSH access from
the specified host and permit other hosts.
enable
configure terminal
ip access-list standard ROUTER_SSH_ACCESS
deny host
172.16.10.2
permit any
exit
line vty 0 4
access-class
ROUTER_SSH_ACCESS in
transport input
ssh
login local
exit
end
ii) Configure basic device security
settings, including:
- Hostname
(use your exam number as hostname)
- Username
and password (both provided as: PSRS123)
- Domain
name: ajira.go.tz
- Login
banner message
Answer:
enable
configure terminal
hostname YOUR_EXAM_NUMBER
enable secret PSRS123
username PSRS123 privilege 15 secret PSRS123
ip domain-name ajira.go.tz
crypto key generate rsa modulus 2048
ip ssh version 2
banner motd #UNAUTHORIZED ACCESS IS PROHIBITED#
end
Replace YOUR_EXAM_NUMBER with your actual examination
number.
iii) Configure login security policy
Question: Set the router to:
- Block
a user for 3 minutes.
- After
3 failed login attempts within 90 seconds.
Answer:
configure terminal
login block-for 180 attempts 3 within 90
end
Explanation:
The router blocks login attempts for 180 seconds (3 minutes) after three
unsuccessful login attempts within 90 seconds.
B. Switch Configuration
i) Configure SSHv2 access and ensure it is
only accessible from the host machine with IP address 172.16.20.2.
Answer:
Configure an access control list that permits only the
specified host to access the switch remotely through SSH.
enable
configure terminal
ip access-list standard SWITCH_SSH_ACCESS
permit host
172.16.20.2
deny any
exit
line vty 0 15
access-class
SWITCH_SSH_ACCESS in
transport input
ssh
login local
exit
end
ii) Configure the following basic security
settings (same as router section ii):
- Hostname
(exam number)
- Username
and password (PSRS123)
- Domain
name: ajira.go.tz
- Login
banner
Answer:
enable
configure terminal
hostname YOUR_EXAM_NUMBER
enable secret PSRS123
username PSRS123 privilege 15 secret PSRS123
ip domain-name ajira.go.tz
crypto key generate rsa modulus 2048
ip ssh version 2
banner motd #UNAUTHORIZED ACCESS IS PROHIBITED#
end
Replace YOUR_EXAM_NUMBER with your actual examination
number.
iii) Configure exec timeout on all remote
sessions to automatically disconnect idle users.
Answer:
Configure the VTY lines to disconnect inactive remote
sessions after five minutes.
configure terminal
line vty 0 15
exec-timeout 5 0
exit
end
copy running-config startup-config
Explanation:
exec-timeout 5 0 automatically disconnects remote users after five minutes of
inactivity.
QUESTION TWO: VLAN DESIGN AND NETWORK
SERVICES
A. VLAN Design and Voice Enablement
Question: Design and
configure the network with the following VLANs:
- VLAN
100 – ICT_DIVISION → 172.16.10.0/24
- VLAN
200 – QUALITY_CONTROL_DIVISION → 172.16.20.0/24
- VLAN
300 – RECRUITMENT_DIVISION → 172.16.30.0/24
- VLAN
400 – IP_CAMERA → 172.16.40.0/25
- VLAN
500 – VOICE (IP Phones) → 172.16.50.0/26
- VLAN
600 – GUEST_WIFI_NETWORK → 172.16.60.0/24
Ensure that all required VLANs are properly configured
and that voice communication is enabled where required.
Answer:
Step 1: Create and Name the VLANs
enable
configure terminal
vlan 100
name ICT_DIVISION
exit
vlan 200
name QUALITY_CONTROL_DIVISION
exit
vlan 300
name
RECRUITMENT_DIVISION
exit
vlan 400
name IP_CAMERA
exit
vlan 500
name VOICE
exit
vlan 600
name
GUEST_WIFI_NETWORK
exit
end
Step 2: Configure Router Subinterfaces for
Inter-VLAN Routing
Assume GigabitEthernet0/0 is the router interface
connected to the switch through a trunk link.
enable
configure terminal
interface gigabitEthernet0/0
no shutdown
exit
interface gigabitEthernet0/0.100
encapsulation
dot1Q 100
ip address
172.16.10.1 255.255.255.0
exit
interface gigabitEthernet0/0.200
encapsulation
dot1Q 200
ip address
172.16.20.1 255.255.255.0
exit
interface gigabitEthernet0/0.300
encapsulation
dot1Q 300
ip address
172.16.30.1 255.255.255.0
exit
interface gigabitEthernet0/0.400
encapsulation
dot1Q 400
ip address
172.16.40.1 255.255.255.128
exit
interface gigabitEthernet0/0.500
encapsulation
dot1Q 500
ip address
172.16.50.1 255.255.255.192
exit
interface gigabitEthernet0/0.600
encapsulation
dot1Q 600
ip address
172.16.60.1 255.255.255.0
exit
end
Step 3: Enable Voice VLAN on IP Phone Ports
Configure voice VLAN 500 on the switch ports connected
to IP phones.
configure terminal
interface fa0/3
switchport mode
access
switchport access
vlan 100
switchport voice
vlan 500
exit
end
Apply the voice VLAN configuration to all other ports
connected to IP phones, using their respective data VLAN assignments.
B. DHCP and Switch Port Configuration
i) Configure DHCP pools for the following
VLANs:
- VLAN
100
- VLAN
200
- VLAN
300
- VLAN
500
- VLAN
600
Answer:
Configure the DHCP server on the router to automatically
assign IP addresses to devices in the specified VLANs.
Step 1: Exclude Default Gateway Addresses
enable
configure terminal
ip dhcp excluded-address 172.16.10.1
ip dhcp excluded-address 172.16.20.1
ip dhcp excluded-address 172.16.30.1
ip dhcp excluded-address 172.16.50.1
ip dhcp excluded-address 172.16.60.1
Step 2: Configure DHCP Pool for VLAN 100
ip dhcp pool ICT_DIVISION
network
172.16.10.0 255.255.255.0
default-router
172.16.10.1
dns-server
8.8.8.8 8.8.4.4
exit
Step 3: Configure DHCP Pool for VLAN 200
ip dhcp pool QUALITY_CONTROL_DIVISION
network
172.16.20.0 255.255.255.0
default-router
172.16.20.1
dns-server
8.8.8.8 8.8.4.4
exit
Step 4: Configure DHCP Pool for VLAN 300
ip dhcp pool RECRUITMENT_DIVISION
network
172.16.30.0 255.255.255.0
default-router
172.16.30.1
dns-server
8.8.8.8 8.8.4.4
exit
Step 5: Configure DHCP Pool for VLAN 500
ip dhcp pool VOICE
network
172.16.50.0 255.255.255.192
default-router
172.16.50.1
dns-server
8.8.8.8
exit
Step 6: Configure DHCP Pool for VLAN 600
ip dhcp pool GUEST_WIFI_NETWORK
network
172.16.60.0 255.255.255.0
default-router
172.16.60.1
dns-server
8.8.8.8 8.8.4.4
exit
end
copy running-config startup-config
ii) Configure switch ports as access ports
and assign them to their respective VLANs.
Answer:
The following example assigns switch ports to their
respective VLANs. The port allocation should be adjusted to match the actual
examination topology.
enable
configure terminal
interface range fa0/3-6
switchport mode
access
switchport access
vlan 100
exit
interface range fa0/7-10
switchport mode
access
switchport access
vlan 200
exit
interface range fa0/11-14
switchport mode
access
switchport access
vlan 300
exit
interface range fa0/15-17
switchport mode
access
switchport access
vlan 400
exit
interface range fa0/18-20
switchport mode
access
switchport access
vlan 600
exit
end
For ports connected to IP phones, configure the
appropriate voice VLAN as demonstrated in Question Two, Section A.
C. VLAN Security – VLAN Hopping Prevention
Question: As a network
administrator, implement security measures to prevent VLAN hopping attacks.
Answer:
Implement the following security measures:
1.
Configure trunk ports manually instead of
using dynamic trunk negotiation.
2.
Use an unused VLAN as the native VLAN.
3.
Allow only required VLANs on trunk ports.
4.
Disable unused switch ports.
5.
Configure access ports as static access
ports.
Commands:
enable
configure terminal
! Create an unused native VLAN
vlan 999
name
NATIVE_UNUSED
exit
! Configure the trunk port
interface gigabitEthernet0/1
switchport mode
trunk
switchport trunk
native vlan 999
switchport trunk
allowed vlan 100,200,300,400,500,600
switchport
nonegotiate
exit
end
Disable unused switch ports:
configure terminal
interface range fa0/21-24
switchport mode
access
switchport access
vlan 999
shutdown
exit
end
Explanation:
These measures reduce the risk of unauthorized VLAN access and VLAN hopping
attacks.
D. Port Security Configuration
Question: Configure switch
port security on ports 3 to 24 with the following requirements:
- Allow
only 2 MAC addresses per port.
- Set
violation mode to shutdown when a security violation occurs.
Answer:
enable
configure terminal
interface range fa0/3-24
switchport mode
access
switchport
port-security
switchport
port-security maximum 2
switchport
port-security violation shutdown
switchport
port-security mac-address sticky
exit
end
copy running-config startup-config
Explanation:
- switchport
port-security enables port security.
- switchport
port-security maximum 2 permits a maximum of two MAC addresses per port.
- switchport
port-security violation shutdown shuts down the port when a security
violation occurs.
- switchport
port-security mac-address sticky dynamically learns and saves permitted
MAC addresses.
E. RADIUS Server Configuration
Question: Configure remote
access authentication using a RADIUS server:
- Use
the provided server IP address.
- Use
the shared secret key provided in the exam.
- Ensure
remote authentication is properly enforced.
Answer:
Configure AAA and RADIUS authentication on the network
device.
The following example uses 172.16.10.10 as the RADIUS
server address and RADIUS_SECRET as the shared key. Replace both with the
actual values provided in the examination.
enable
configure terminal
aaa new-model
radius-server host 172.16.10.10 key RADIUS_SECRET
aaa authentication login default group radius local
aaa authorization exec default group radius local
end
copy running-config startup-config
Explanation:
- aaa
new-model enables AAA services.
- radius-server
host specifies the RADIUS server IP address and shared secret.
- aaa
authentication login default group radius local authenticates users
through RADIUS, with local authentication as a fallback.
- aaa
authorization exec default group radius local authorizes EXEC sessions
through RADIUS, with local fallback.
For strict RADIUS-only authentication, remove the local
fallback only if that is explicitly required by the examination.
QUESTION THREE: OSPF ROUTING CONFIGURATION
A. OSPF Process Configuration
Question: Configure OSPF
routing with process ID 10.
Answer:
enable
configure terminal
router ospf 10
end
B. Area Assignment
Question: Assign networks to
OSPF areas as follows:
- VLAN
100 → Area 0
- VLAN
200 → Area 10
- VLAN
300 → Area 20
- VLAN
400 → Area 30
- VLAN
600 → Area 40
- ISP
WAN Link → Area 50
Answer:
Configure the respective network statements under OSPF
process 10.
|
Network |
Wildcard Mask |
OSPF Area |
|
172.16.10.0/24 |
0.0.0.255 |
0 |
|
172.16.20.0/24 |
0.0.0.255 |
10 |
|
172.16.30.0/24 |
0.0.0.255 |
20 |
|
172.16.40.0/25 |
0.0.0.127 |
30 |
|
172.16.60.0/24 |
0.0.0.255 |
40 |
|
41.59.254.136/30 |
0.0.0.3 |
50 |
Commands:
configure terminal
router ospf 10
network 172.16.10.0 0.0.0.255 area 0
network 172.16.20.0 0.0.0.255 area 10
network 172.16.30.0 0.0.0.255 area 20
network 172.16.40.0 0.0.0.127 area 30
network 172.16.60.0 0.0.0.255 area 40
! ISP WAN network
network 41.59.254.136 0.0.0.3 area 50
exit
end
The WAN network 41.59.254.136/30 is derived from the
given next-hop address 41.59.254.138, assuming a /30 WAN subnet.
C. Router ID Configuration
Question: Set the OSPF Router
ID to 1.1.1.1.
Answer:
configure terminal
router ospf 10
router-id 1.1.1.1
exit
end
If OSPF is already running, use the following command to
make the new router ID take effect:
clear ip ospf process
Confirm the operation if prompted.
D. Default Route Configuration
Question: Configure a default
route pointing to the ISP WAN:
Next-hop IP: 41.59.254.138/30
Answer:
Configure a static default route pointing to the ISP
next-hop address.
enable
configure terminal
ip route 0.0.0.0 0.0.0.0 41.59.254.138
router ospf 10
default-information originate
exit
end
copy running-config startup-config
Explanation:
The static default route directs unknown traffic to the ISP router. The OSPF
default-information originate command advertises the default route to other
OSPF routers.
E. Passive Interface Configuration
Question: Configure all LAN
interfaces as passive interfaces in OSPF.
Answer:
Configure all OSPF interfaces as passive by default,
then enable OSPF neighbor communication on the WAN interface.
Assuming GigabitEthernet0/1 is the WAN interface:
configure terminal
router ospf 10
passive-interface
default
no passive-interface
gigabitEthernet0/1
exit
end
Explanation:
Passive interfaces advertise their connected networks through OSPF but do not
send OSPF hello packets or form OSPF neighbor relationships on those
interfaces.
F. Access Control for Guest Network
Question: Configure an Access
Control List (ACL) to restrict the Guest WiFi network (VLAN 600) from accessing
internal LAN resources.
Answer:
Create an extended ACL to block Guest Wi-Fi users from
accessing the internal departmental networks while permitting access to other
destinations.
The internal networks are:
- VLAN
100 – 172.16.10.0/24
- VLAN
200 – 172.16.20.0/24
- VLAN
300 – 172.16.30.0/24
- VLAN
400 – 172.16.40.0/25
- VLAN
500 – 172.16.50.0/26
Commands:
enable
configure terminal
ip access-list extended GUEST_WIFI_ACL
deny ip 172.16.60.0 0.0.0.255 172.16.10.0 0.0.0.255
deny ip 172.16.60.0 0.0.0.255 172.16.20.0 0.0.0.255
deny ip 172.16.60.0 0.0.0.255 172.16.30.0 0.0.0.255
deny ip 172.16.60.0 0.0.0.255 172.16.40.0 0.0.0.127
deny ip 172.16.60.0 0.0.0.255 172.16.50.0 0.0.0.63
permit ip 172.16.60.0 0.0.0.255 any
exit
interface gigabitEthernet0/0.600
ip access-group
GUEST_WIFI_ACL in
exit
end
copy running-config startup-config
Explanation:
- The
ACL denies Guest Wi-Fi users access to the internal departmental networks.
- The
final permit statement allows guest users to communicate with other
destinations, including the internet, subject to the network's other
security policies.
- The
ACL is applied inbound on the VLAN 600 router subinterface.
ADDITIONAL: NETWORK CONFIGURATION
VERIFICATION
After completing all configurations, use the following
commands to verify the network.
1. Router Verification
show running-config
show ip interface brief
show ip ssh
show login
show access-lists
show ip route
show ip ospf neighbor
show ip ospf interface brief
show ip route ospf
show ip dhcp pool
show ip dhcp binding
2. Switch Verification
show vlan brief
show interfaces trunk
show port-security
show port-security interface fa0/3
show running-config
show ip ssh
show access-lists
3. Save Configuration
copy running-config startup-config
IMPORTANT PRACTICAL EXAMINATION NOTES
1.
Replace YOUR_EXAM_NUMBER with your actual
examination number.
2.
Replace the illustrative RADIUS IP address
and shared secret with the actual values supplied in the examination.
3.
Confirm the router and switch interface
names before applying the configurations.
4.
The router LAN and WAN connections must use
different physical interfaces.
5.
The WAN network 41.59.254.136/30 is inferred
from the supplied ISP next-hop address 41.59.254.138.
6.
The ISP router must participate in OSPF for
an OSPF neighbor relationship to form across the WAN link.
7.
The example switch port allocation should be
adjusted according to the actual examination topology.
8.
VLAN 400 does not have a DHCP pool because
the examination specifically requests DHCP pools for VLANs 100, 200, 300, 500
and 600.
9.
The five-minute switch EXEC timeout is an
example idle-session policy because the question does not specify an exact
timeout duration.
10.
Ensure that the RADIUS server is reachable
and that its shared secret matches the configured value before testing remote
authentication.
END OF ICT OFFICER II – NETWORK
ADMINISTRATOR PRACTICAL EXAMINATION QUESTIONS AND ANSWERS
The Mwalimu Nyerere Memorial Academy (MNMA)
Dar es Salaam Maritime Institute (DMI)
