Reference no: EM133696758

Enterprise and Cloud Networking

The Portfolio requires students to maintain a diary/journal for tutorial questions and/or lab exercises (e.g., screenshots, testing results, reflections, etc.) in a computer lab on a weekly basis from Week 1 to Week 10. This assignment is individual, and students collaborating in a group are required to submit their distinct work separately from others.

Document your responses and answers to the questions specified in the [Portfolio Task] within the weekly tutorial instructions. If, for any reasons, you encounter difficulties in successfully completing the lab exercise, please include a screenshot illustrating the issue and provide an explanation for the potential reasons behind the failure.

Part 1:

Complete the installation and registration of Cisco Packet Tracer, then utilize it to simulate a home network based on the guidance provided in the lecture slides. [Portfolio Task 1] Elaborate your design rationale and enhance your explanation by including a screenshot illustrating your network topology.

Create your Microsoft Azure account by following the instruction but make sure you use your CQUniversity email. Upon completion of your account, you should see below red boxed components in your account. But if they are not present then you have not completed your registration for student account. [Portfolio Task 2] Register the Microsoft train course using the provided training key. Include a screenshot to show you have successfully completed the registration.

[Portfolio Task 3] Explore various services under available Microsoft Azure service under your account and list three in each category.
PaaS
IaaS
SaaS

As per the assessment requirements, it is necessary for you to form a group consisting of 3 to 4 students to complete the Written Assignments as a group project. Please utilize this week tutorial class as an opportunity to get to know your peers and form working groups voluntarily. Due to the ACS requirement, every group should have a minimum of 3 and a maximum of 4 students.

Appendix: Create an account on Cisco Packet Tracer
Cisco Packet Tracer is pre-installed on all Lab computers. To locate the tool, use the Windows search dialogue and search for "Cisco Packet Tracer." Run the application accordingly, and you should see the following interface.

To access the login page, simply click the green button. If you already have an account, please log in using your existing credentials. If you're new to the platform, click on the signup option to begin the registration process. It is recommended to use your student email address for registration purposes.

If you are using your personal computer, please Visit the official website of Cisco Packet Tracer to complete the registration process.

Part 2:

[Portfolio Task 1] Include a screenshot to indicate the successful creation of an Azure virtual machine and record its public IP address, subscription ID and any other information you are interested in.

[Portfolio Task 2] Include a screenshot to indicate the successful creation of an Azure virtual machine and record its public IP address, subscription ID and any other information you are interested in.

[Portfolio Task 3] Explain the concept of a virtual machine and its functions based on the knowledge acquired in this class and from online resources.

Please finalize your group formation and inform your campus tutor about your group details.

Part 3:

[Portfolio Task 1] Include at least two screenshots (see two examples below) to indicate the successful completion of this task. Explain the concept of a cloud storage blob and its functions based on the knowledge acquired in this class and from online resources.

Part 4: In this task, you'll explore Azure Cost Management. First, you will review the options on the Subscriptions page in the Azure portal. Next, you will review the Azure cost management options. Finally, you will create a cost management budget and alert. Note: Once you begin the challenge, you will not be able to pause, save, or return to your challenge. Please ensure that you have set aside enough time to complete the challenge before you start.

[Portfolio Task 1] Include at least two screenshots to indicate the successful completion of this tasks (see two examples below). Explore a potential cost budget for the application scenario in your assignment.

Part 5: Packet Tracer -Network Topology Design Practice

Scenario
In this comprehensive CCNA skills activity, the XYZ Corporation uses a combination of eBGP and PPP for WAN connections. Other technologies include NAT, DHCP, static and default routing, EIGRP for IPv4, inter-VLAN routing, and VLAN configurations. Security configurations include SSH, port security, switch security, and ACLs.
Note:Only HQ, B1, B1-S2, and the PCs are accessible. The user EXEC password is cisco and the privileged EXEC password is class.
Requirements
PPP
• Configure the WAN link from HQ to the Internet using PPP encapsulation and CHAP authentication.
o Create a user ISP with the password of cisco.
• Configure the WAN link from HQ to NewB using PPP encapsulation and PAP authentication.
o Create a user NewB with the password of cisco.
Note: The ppp pap sent-username is not graded by Packet Tracer. However, it must be configured before the link will come up between HQ and NewB.

eBGP
• Configure eBGP between HQ and the Internet.
o HQ belongs to AS 65000.
o The IP address for the BGP router in the Internet cloud is 209.165.201.2.
o Advertise the 192.0.2.0/24 network to the Internet.

NAT
• Configure dynamic NAT on HQ
o Allow all addresses for the 10.0.0.0/8 address space to be translated using a standard access list named NAT.
o XYZ Corporation owns the 209.165.200.240/29 address space. The pool, HQ, uses addresses .241 to .245 with a /29 mask.Bind the NAT ACL to the pool HQ. Configure PAT (keyword overload).
o The connections to the Internet and HQ-DataCenter are outside XYZ Corporation.

Inter-VLAN Routing
Inter-VLAN (Virtual Local Area Network) routing refers to the process of allowing communication and routing of network traffic between different VLANs within a network. VLANs are used to logically segment a network into separate broadcast domains, each with its own set of devices. Inter-VLAN routing is necessary when devices in different VLANs need to communicate with each other.
• Configure B1 for inter-VLAN routing.
o Using the addressing table for branch routers, configure and activate the LAN interface for inter-VLAN routing. VLAN 99 is the native VLAN. (dot1qis a vlan protocol. The native VLAN is the VLAN that carries untagged traffic across a trunk link.)

Static and Default Routing
• Configure HQ with a static route to the NewB LAN. Use the exit interface as an argument.
• Configure B1 with a default route to HQ. Use the next-hop IP address as an argument.

EIGRP Routing
EIGRP, which stands for Enhanced Interior Gateway Routing Protocol, is a dynamic routing protocol used in computer networks. EIGRP is designed to efficiently handle routing information within an autonomous system (AS), which is a collection of networks under a common administration and sharing a common routing strategy.
• Configure and optimize HQ and B1 with EIGRP routing.
o Use autonomous system 100.
o Disable EIGRP updates on appropriate interfaces.

VLANs and Trunking Configurations
Note: Logging to the console is turned off on B1-S2 so that the Native VLAN mismatch messages will not interrupt your configurations. If you would prefer to view console messages, enter the global configuration command logging console.
• Configure trunking and VLANs on B1-S2.
o Create and name the VLANs listed in the VLAN Configuration and Port Mappings table on B1-S2 only.
o Configure the VLAN 99 interface and default gateway.
o Set trunking mode to on for F0/1 - F0/4.
o Assign VLANs to the appropriate access ports. (switchport mode access sets the interface to access mode, indicating that it will be used to connect end devices (such as computers or printers) rather than other switches.)
o Disable all unused ports and assign the BlackHoleVLAN.

Port Security
• Use the following policy to establish port security on the B1-S2 access ports:
o Allow two MAC addresses to be learned on the port.
o Configure the learned MAC addresses to be added to the configuration.
o Set the port to send a message if there is a security violation. Traffic is still allowed from the first two MAC addresses learned.

SSH
• Configure HQ to use SSH for remote access.
o Set the modulus to 2048. The domain name is CCNASkills.com.
o The username is admin and the password is adminonly.
o Only SSH should be allowed on VTY lines.
o Modify the SSH defaults: version 2; 60-second timeout; five retries.

DHCP
• On B1, configure a DHCP pool for the Sales VLAN 20 using the following requirements:
o Exclude the first 10 IP addresses in the range.
o The case-sensitive pool name is VLAN20.
o Include the DNS server attached to the HQ LAN as part of the DHCP configuration.
• Configure the Sales PC to use DHCP.

Access List Policy
• Because HQ is connected to the Internet, configure and apply a named ACL called HQINBOUNDin the following order:
o Allow inbound BGP updates (TCP port 179) for any source to any destination.
o Allow inbound HTTP requests from any source to the HQ-DataCenternetwork.
o Allow only established TCP sessions from the Internet.
o Allow only inbound ping replies from the Internet.
o Explicitly block all other inbound access from the Internet.

[Portfolio Task] Include a few screenshots to show the configuration test results as per the questions below and provide an explanation for the reasonableness of these test results.
• Verify full connectivity via ping command.
1. Ping from PC Admin, Sales and Production to 192.0.2.1 should be successful.
2. Ping from PC Outside Host to 192.0.2.1 should fail.
3. Ping from PC Outside Host to 10.255.255.1 should fail.

Part 6: Packet Tracer - Configure and Verify a Site-to-Site IPsec VPN

Objectives
- Verify connectivity throughout the network.
- Configure R1 to support a site-to-site IPsec VPN with R3.
Background / Scenario
The network topology shows three routers. Your task is to configure R1 and R3 to support a site-to-site IPsec VPN when traffic flows between their respective LANs. The IPsec VPN tunnel is from R1 to R3 via R2. R2 acts as a pass-through and has no knowledge of the VPN. IPsec provides secure transmission of sensitive information over unprotected networks, such as the Internet. IPsecoperates at the network layer and protects and authenticates IP packets between participating IPsec devices (peers), such as Cisco routers.

Instructions
Part 1: Configure IPsec Parameters on R1
Step 1: Test connectivity.
Ping from PC-A to PC-C. The devices are all configured with routing. Therefore, the ping should succeed.
Step 2: Enable the Security Technology package.
a. On R1, issue the show version command to view the Security Technology package license information.
b. If the Security Technology package has not been enabled, use the following command to enable the package.
R1(config)# license boot module c1900 technology-package securityk9
c. Accept the end-user license agreement.
d. Save the running-config and reload the router to enable the security license.
e. Use the show version command again to verify that the securityk9is listed under current Technology packages.
Step 3: Identify interesting traffic on R1.
Configure ACL 110 to identify the traffic from the LAN on R1 to the LAN on R3 as interesting. This interesting traffic will trigger the IPsec VPN to be implemented when there is traffic between the R1 to R3 LANs. All other traffic sourced from the LANs will not be encrypted. Because of the implicit deny all, there is no need to configure a deny ip any anystatement.
R1(config)# access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
Step 4: Configure the IKE Phase 1 ISAKMP policy on R1.
Configure the crypto ISAKMP policy 10 properties on R1 along with the shared crypto key vpnpa55. Default values do not have to be configured. Therefore, only the encryption method, key exchange method, and DH method must be configured.
Note: The highest DH group currently supported by Packet Tracer is group 5. In a production network, you would configure at least DH 24.
R1(config)# crypto isakmp policy 10
R1(config-isakmp)#encryption aes 256
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#group 5
R1(config-isakmp)# exit
R1(config)# crypto isakmp key vpnpa55 address 10.2.2.2
Step 5: Configure the IKE Phase 2 IPsec policy on R1.
a. Create the transform-set VPN-SET to use esp-aes and esp-sha-hmac.
R1(config)# crypto ipsec transform-set VPN-SET esp-aesesp-sha-hmac
b. Create the crypto map VPN-MAP that binds all of the Phase 2 parameters together. Use sequence number 10 and identify it as an ipsec-isakmp map.
R1(config)# crypto map VPN-MAP 10 ipsec-isakmp
R1(config-crypto-map)# description VPN connection to R3
R1(config-crypto-map)# set peer 10.2.2.2
R1(config-crypto-map)# set transform-set VPN-SET
R1(config-crypto-map)# match address 110
R1(config-crypto-map)# exit
Step 6: Configure the crypto map on the outgoing interface.
Bind the VPN-MAP crypto map to the outgoing Serial 0/0/0 interface.
R1(config)# interface s0/0/0
R1(config-if)#crypto map VPN-MAP
Part 2: Configure IPsec Parameters on R3
Step 1: Enable the Security Technology package.
a. On R3, issue the show version command to verify that the Security Technology package license information has been enabled.
b. If the Security Technology package has not been enabled, enable the package and reload R3.
Step 2: Configure router R3to support a site-to-site VPN with R1.
Configure reciprocating parameters on R3. Configure ACL 110 identifying the traffic from the LAN on R3 to the LAN on R1 as interesting.
R3(config)# access-list 110 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
Step 3: Configure the IKE Phase 1 ISAKMP properties on R3.
Configure the crypto ISAKMP policy 10 properties on R3 along with the shared crypto key vpnpa55.
R3(config)# crypto isakmp policy 10
R3(config-isakmp)# encryption aes 256
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#group 5
R3(config-isakmp)# exit
R3(config)# crypto isakmp key vpnpa55 address 10.1.1.2
Step 4: Configure the IKE Phase 2 IPsec policy on R3.
a. Create the transform-set VPN-SET to use esp-aes and esp-sha-hmac.
R3(config)# crypto ipsec transform-set VPN-SET esp-aesesp-sha-hmac
b. Create the crypto map VPN-MAP that binds all of the Phase 2 parameters together. Use sequence number 10 and identify it as an ipsec-isakmp map.
R3(config)# crypto map VPN-MAP 10 ipsec-isakmp
R3(config-crypto-map)# description VPN connection to R1
R3(config-crypto-map)# set peer 10.1.1.2
R3(config-crypto-map)# set transform-set VPN-SET
R3(config-crypto-map)# match address 110
R3(config-crypto-map)# exit
Step 5: Configure the crypto map on the outgoing interface.
Bind theVPN-MAP crypto map to the outgoing Serial 0/0/1 interface. Note: This is not graded.
R3(config)# interface s0/0/1
R3(config-if)#crypto map VPN-MAP
Part 3: Verify the IPsec VPN
Step 1: Verify the tunnel prior to interesting traffic.
Issue the show crypto ipsecsacommand on R1. Notice that the number of packets encapsulated, encrypted, decapsulated, and decrypted are all set to 0.
Step 2: Create interesting traffic.
Ping PC-C from PC-A.
Step 3: Verify the tunnel after interesting traffic.
On R1, re-issue the show crypto ipsecsacommand. Notice that the number of packets is more than 0, which indicates that the IPsec VPN tunnel is working.
Step 4: Create uninteresting traffic.
Ping PC-B from PC-A. Note: Issuing a ping from router R1 to PC-C or R3 to PC-A is not interesting traffic.
Step 5: Verify the tunnel.
On R1, re-issue the show crypto ipsecsacommand. Notice that the number of packets has not changed, which verifies that uninteresting traffic is not encrypted.
Step 6: Check results.
Your completion percentage should be 100%. Click Check Results to see feedback and verification of which required components have been completed.

Part 7:

1. In this task, you will create a route table using Azure Marketplace and define static routes.

[Portfolio Task 1] Include at least three screenshots to indicate the successfulcompletion of this task (see examples below).Investigate what firewall rules that can be implemented in a routing table.
2. In this task, you'll configure network access via Azure bash commands.
[Portfolio Task 2] Include at least four screenshots to indicate the successful completion of this task (see examples below). Explain why the access to Port 80 must be enabled before the web page is displayed successfully.

Part 8:

1. In this task, you will configure access to an Azure Key Vault service endpoint from the back-end tier of an application. First, you will create a secret in a key vault, and then you will create an outbound security rule for the back-end subnet in a virtual network. Next, you will configure a virtual network service endpoint to provide access to the key vault secret. Finally, you will verify that you can access the service endpoint. Note: Once you begin the challenge, you will not be able to pause, save, or exit and then return to your challenge. Please ensure that you have set aside enough time to complete the challenge before you start.
[Portfolio Task 1] Include at least fourscreenshots to indicate the successfulcompletion of this task (see examples below).Explore the functionality of an Azure virtual network service.

2. In this task, you will manage Microsoft Entra users and groups. First, you will create a Microsoft Entra tenant, and then you will create a new user account. Next, you will create a new Microsoft Entra group, and then you will add a user to the group. Finally, you will sign in to the Azure portal as the new user, and then you will change the user password. Note: Once you begin the Challenge Lab, you will not be able to pause, save, or exit and then return to your Challenge Lab. Please ensure that you have set aside enough time to complete the Challenge Lab before you start.

[Portfolio Task 2] Include at least five screenshots to demonstrate the successful completion of this task (refer to the examples below). Additionally, discuss with your fellow classmates on how to create groups and users for the assignment application scenario.

Part 9:

1. In this task, you will implement an Azure load balancer. First, you will create an Azure load balancer. Next, you will configure a backend pool for the load balancer, and then you will configure an HTTP health probe. Finally, you will create a load balancing rule. Note: Once you begin the challenge, you will not be able to pause, save, or return to your challenge. Please ensure that you have set aside enough time to complete the challenge before you start.

2. In this task,you will configure high availability by using availability sets. First, you will create an availability set. Next, you will deploy two Azure virtual machines to the availability set. Finally, you will configure load balancing. Note: Once you begin the Challenge Lab, you will not be able to pause, save, or return to your Challenge Lab. Please ensure that you have set aside enough time to complete the Challenge Lab before you start.

[Portfolio Task 2] Include at least three screenshots to indicate the successful completion of this task (see examples below). Explore the functionality of An Azure availability set.

Part 10: Packet Tracer - Connecting a Wired and Wireless LAN

Addressing Table

Objectives
Part 1: Connect to the Cloud
Part 2: Connect Router0
Part 3: Connect Remaining Devices
Part 4: Verify Connections
Part 5: Examine the Physical Topology
Background
When working in Packet Tracer (a lab environment or a corporate setting), you should know how to select the appropriate cable and how to properly connect devices. This activity will examine device configurations in Packet Tracer, selecting the proper cable based on the configuration, and connecting the devices. This activity will also explore the physical view of the network in Packet Tracer.
Part 1: Connect to the Cloud
Step 1: Connect the cloud to Router0.

a. At the bottom left, click the orange lightning icon to open the available Connections.
b. Choose the correct cable to connect Router0 Fa0/0 to Cloud Eth6. Cloud is a type of switch, so use a Copper Straight-Through connection. If you attached the correct cable, the link lights on the cable turn green.
Step 2: Connect the cloud to Cable Modem.
Choose the correct cable to connect Cloud Coax7 to Modem Port0.
If you attached the correct cable, the link lights on the cable turn green.
Part 2: Connect Router0
Step 1: Connect Router0 to Router1.
Choose the correct cable to connect Router0 Ser0/0/0 to Router1 Ser0/0. Use one of the available Serial cables.
If you attached the correct cable, the link lights on the cable turn green.
Step 2: Connect Router0 to netacad.pka.
Choose the correct cable to connect Router0 Fa0/1 to netacad.pka Fa0. Routers and computers traditionally use the same wires to transmit (1 and 2) and receive (3 and 6). The correct cable to choose consists of these crossed wires. Although many NICs can now autosense which pair is used to transmit and receive, Router0 and netacad.pka do not have autosensing NICs.
If you attached the correct cable, the link lights on the cable turn green.
Step 3: Connect Router0 to the Configuration Terminal.
Choose the correct cable to connect Router0 Console to Configuration Terminal RS232. This cable does not provide network access to Configuration Terminal, but allows you to configure Router0 through its terminal.
If you attached the correct cable, the link lights on the cable turn black.
Part 3: Connect Remaining Devices
Step 1: Connect Router1 to Switch.
Choose the correct cable to connect Router1 Fa1/0 to Switch Fa0/1.
If you attached the correct cable, the link lights on the cable turn green. Allow a few seconds for the light to transition from amber to green.
Step 2: Connect Cable Modem to Wireless Router.
Choose the correct cable to connect Modem Port1 to Wireless Router Internet port.
If you attached the correct cable, the link lights on the cable will turn green.
Step 3: Connect Wireless Router to Family PC.
Choose the correct cable to connect Wireless Router Ethernet 1 to Family PC.
If you attached the correct cable, the link lights on the cable turn green.
Part 4: Verify Connections
Step 1: Test the connection from Family PC to netacad.pka.
a. Open the Family PC command prompt and ping netacad.pka.
b. Open the Web Browser and the web address https://netacad.pka.
Step 2: Ping the Switch from Home PC.
Open the Home PC command prompt and ping the Switch IP address of to verify the connection.
Step 3: Open Router0 from Configuration Terminal.
a. Open the Terminal of Configuration Terminal and accept the default settings.
b. Press Enter to view the Router0 command prompt.
c. Type show ip interface brief to view interface statuses.
Part 5: Examine the Physical Topology
Step 1: Examine the Cloud.
a. Click the Physical Workspace tab or press Shift+P and Shift+L to toggle between the logical and physical workspaces.
b. Click the Home City icon.
c. Click the Cloud icon. How many wires are connected to the switch in the blue rack?
d. Click Back to return to Home City.
Step 2: Examine the Primary Network.
a. Click the Primary Network icon. Hold the mouse pointer over the various cables. What is located on the table to the right of the blue rack?
b. Click Back to return to Home City.
Step 3: Examine the Secondary Network.
a. Click the Secondary Network icon. Hold the mouse pointer over the various cables. Why are there two orange cables connected to each device?
b. Click Back to return to Home City.
Step 4: Examine the Home Network.
a. Why is there an oval mesh covering the home network?
b. Click the Home Network icon. Why is there no rack to hold the equipment?
c. Click the Logical Workspace tab to return to the logical topology.

[Portfolio Task] Include at least three screenshots to indicate the successful completion of Part 4 (Step 1 - Step 3). Document your responses to the questions in Part 5, specifically addressing 5(1)c, 5(2)a, 5(3)a, 5(4)a, and 5(4)b.