CCNA capstone: diagnose, repair, verify, and explain

In GNS3, right-click SW60 and choose Console before typing. Inspect the release, create both VLANs and place only PC60's port in VLAN 10. Use the exact cable map; do not configure an arbitrary range of ports.

enable
show version
configure terminal
vlan 10
name USERS
vlan 20
name SERVICES
interface GigabitEthernet0/0
switchport mode access
switchport access vlan 10
no shutdown
end

What you should see

Expect the VLAN definitions and PC60 access membership; this alone does not establish routing.

Why this step matters

The access membership is the first logical boundary in the complete path.

In GNS3, right-click SW60 and choose Console before typing. Place Server60 in VLAN 20 and configure the sole router trunk. IOSvL2 supports explicit dot1q encapsulation; do not add this command to platforms that lack that option without checking their guide.

configure terminal
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 20
no shutdown
interface GigabitEthernet0/2
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20
no shutdown
end
show interfaces trunk

What you should see

Expect Gi0/2 trunking with VLANs 10 and 20 available.

Why this step matters

A VLAN existing in the database does not guarantee it traverses the intended trunk.

In GNS3, right-click R60 and choose Console before typing. Record the release and enable IPv6 forwarding. Leave the physical parent without an IP address; VLAN gateways belong to the tagged subinterfaces.

enable
show version
configure terminal
ipv6 unicast-routing
interface GigabitEthernet1
no shutdown
interface GigabitEthernet1.10
encapsulation dot1Q 10
ip address 10.60.10.1 255.255.255.0
ipv6 address 2001:db8:60:10::1/64
end

What you should see

Expect a configured VLAN 10 subinterface; verify link state after the peer trunk is ready.

Why this step matters

Both families need the intended logical attachment, not just a working parent port.

In GNS3, right-click R60 and choose Console before typing. Configure the second tagged network and inspect both route families. These connected routes require no dynamic routing protocol or router default route.

configure terminal
interface GigabitEthernet1.20
encapsulation dot1Q 20
ip address 10.60.20.1 255.255.255.0
ipv6 address 2001:db8:60:20::1/64
end
show ip interface brief
show ipv6 interface brief
show ip route connected
show ipv6 route connected

What you should see

Expect both /24 and both /64 networks when the subinterfaces are operational.

Why this step matters

Installed connected routes are necessary but cannot certify downstream endpoint VLAN placement.

In GNS3 open PC60 Console and Terminal. Use its unmanaged ens3 adapter and no external connection. Set only the declared addresses and routes, disabling RA acceptance on this lab adapter to keep the route plan explicit.

sudo sysctl -w net.ipv6.conf.ens3.accept_ra=0
sudo ip link set ens3 up
sudo ip address add 10.60.10.10/24 dev ens3
sudo ip -6 address add 2001:db8:60:10::10/64 dev ens3
sudo ip route add default via 10.60.10.1 dev ens3
sudo ip -6 route add default via 2001:db8:60:10::1 dev ens3
ip -brief address show ens3

What you should see

Expect the two static addresses and explicit gateways; stop if duplicate or preexisting-state errors appear.

Why this step matters

A repeatable endpoint plan avoids mistaking automatic addressing for the intended configuration.

In GNS3 open Server60 Console and Terminal A. Configure its unmanaged ens3, create an empty temporary directory and serve only one synthetic page. The final command stays in the foreground; keep this terminal open.

sudo sysctl -w net.ipv6.conf.ens3.accept_ra=0
sudo ip link set ens3 up
sudo ip address add 10.60.20.20/24 dev ens3
sudo ip -6 address add 2001:db8:60:20::20/64 dev ens3
sudo ip route add default via 10.60.20.1 dev ens3
sudo ip -6 route add default via 2001:db8:60:20::1 dev ens3
LAB60=$(mktemp -d /tmp/ccna60.XXXXXX)
cd "$LAB60"
python3 -c 'from pathlib import Path; Path("index.html").write_text("CCNA60 HTTP baseline\n", encoding="utf-8")'
python3 -m http.server 8080 --bind 10.60.20.20

What you should see

Expect the listener to start; check IPv6 readiness from Terminal B before tests.

Why this step matters

A known body proves more than a TCP listener alone, while the explicit bind avoids claiming IPv6 HTTP.

Open PC60 Console and Terminal. Wait for link and IPv6 address readiness, then test both address families and the actual service before attaching an ACL. Stop if any baseline test fails.

ping -c 3 -W 2 10.60.20.20
ping -6 -c 3 -W 2 2001:db8:60:20::20
curl --noproxy '*' --max-time 5 -i http://10.60.20.20:8080/

What you should see

Expect both pings to reply and HTTP to return the fixture body; record actual results.

Why this step matters

Policy effects cannot be isolated until the unfiltered path and application are known to work.

In GNS3, right-click R60 and choose Console before typing. Build CAP60 completely, then attach it inbound on the VLAN 10 subinterface. It permits only the declared source/destination ICMP and TCP 8080 tests; it does not filter IPv6.

configure terminal
ip access-list extended CAP60
10 permit icmp host 10.60.10.10 host 10.60.20.20
20 permit tcp host 10.60.10.10 host 10.60.20.20 eq 8080
30 deny ip any any
exit
interface GigabitEthernet1.10
ip access-group CAP60 in
end
show ip interface GigabitEthernet1.10
show access-lists CAP60

What you should see

Expect CAP60 inbound on Gi1.10 with the two exact permits before denial.

Why this step matters

Policy is a combination of entries, order and attachment; the IPv6 boundary remains explicit.

Open PC60 Console and Terminal. Repeat the three positive tests, then add .30 as a secondary source while leaving .10 and its route intact. Bind only the negative HTTP test to .30 and remove it immediately afterward.

ping -c 3 -W 2 10.60.20.20
ping -6 -c 3 -W 2 2001:db8:60:20::20
curl --noproxy '*' --max-time 5 -i http://10.60.20.20:8080/
sudo ip address add 10.60.10.30/24 dev ens3
curl --noproxy '*' --max-time 5 --interface 10.60.10.30 -i http://10.60.20.20:8080/
sudo ip address del 10.60.10.30/24 dev ens3

What you should see

Expect positive tests to pass and .30 HTTP to fail. Inspect R60 CAP60 counters via its console before faulting.

Why this step matters

The baseline includes preserved denial, so a later repair cannot be judged only by restored connectivity.

In GNS3, right-click SW60 and choose Console before typing. Record current server membership, then move only Gi0/1 to VLAN 10 in this isolated project. Keep the server addresses, process, trunk and router policy unchanged.

show interfaces GigabitEthernet0/1 switchport
configure terminal
interface GigabitEthernet0/1
switchport access vlan 10
end
show vlan brief
show interfaces trunk

What you should see

Expect the link to remain connected but Server60's access membership to be VLAN 10.

Why this step matters

One changed variable creates a diagnosable defect without weakening the ACL or renumbering hosts.

Open PC60 Console and Terminal. Repeat the original three positive tests with the same source and destinations. Preserve failures as observations; do not immediately edit routes or disable filtering.

ping -c 3 -W 2 10.60.20.20
ping -6 -c 3 -W 2 2001:db8:60:20::20
curl --noproxy '*' --max-time 5 -i http://10.60.20.20:8080/

What you should see

Expect the server tests to fail after its membership moves; record any deviation rather than claiming predicted output.

Why this step matters

Shared failure across families and service directs attention to the shared attachment, but switch evidence confirms the cause.

In GNS3, right-click SW60 and choose Console before typing. Compare the observed VLAN with the documented server plan. Restore only Gi0/1 to VLAN 20 and inspect both access and trunk state before testing again.

configure terminal
interface GigabitEthernet0/1
switchport access vlan 20
end
show interfaces GigabitEthernet0/1 switchport
show vlan brief
show interfaces trunk

What you should see

Expect the original membership with no router, endpoint or ACL edits.

Why this step matters

The narrow inverse repairs the demonstrated cause while preserving all other baseline assumptions.

Open PC60 Console and Terminal. Repeat both pings, allowed HTTP and denied alternate-source HTTP. Remove the temporary address even when a test fails and record actual status and content.

ping -c 3 -W 2 10.60.20.20
ping -6 -c 3 -W 2 2001:db8:60:20::20
curl --noproxy '*' --max-time 5 -i http://10.60.20.20:8080/
sudo ip address add 10.60.10.30/24 dev ens3
curl --noproxy '*' --max-time 5 --interface 10.60.10.30 -i http://10.60.20.20:8080/
sudo ip address del 10.60.10.30/24 dev ens3

What you should see

Expect the complete pre-fault matrix restored, including the intended denial.

Why this step matters

A recovered service is not enough if the repair accidentally broadened access.

In GNS3, right-click R60 and choose Console before typing. Capture attachment, counters and connected routes. Then open Server60 Console Terminal A and press Ctrl+C to stop its foreground server. Stop all four nodes and restore the saved clean project and VM baselines after retaining your notes.

show ip interface GigabitEthernet1.10
show access-lists CAP60
show ip route connected
show ipv6 route connected

What you should see

Expect the documented policy and routes retained. Server shutdown and baseline restoration remove temporary lab state, not the already-preserved evidence.

Why this step matters

The final report distinguishes measured recovery, preserved policy and untested services without a whole-course completion claim.