en
conf t
! BASIC
hostname HQ-CORE
clock timezone UTC +8
ip domain-name qualifier2026.skill39.int
username admin privilege 15 algorithm-type sha256 secret Passw0rd!
enable algorithm-type sha256 secret Passw0rd!
crypto key generate rsa modulus 3072
ip ssh version 2
banner motd AUTHORIZED ACCESS ONLY.
ip access-list standard SSH
permit 10.10.30.0 0.0.0.255
permit 10.20.60.0 0.0.0.255
line vty 0 4
access-class SSH in
login local
transport input ssh
int loop0
ip add 10.255.1.1 255.255.255.255
ipv6 add 2001:db8:10:ff::1/128
no shu
int loop100
ip add 198.51.100.65 255.255.255.255
no shu
int g0/0
ip add 100.64.10.2 255.255.255.252
no shu
int g0/2
ip add 10.10.200.1 255.255.255.252
ipv6 add 2001:db8:10:200::1/64
no shu
int g0/3
ip add 10.10.200.5 255.255.255.252
ipv6 add 2001:db8:10:204::1/64
no shu
! OSPFV2
router ospf 10
router-id 10.255.1.1
network 10.255.1.1 0.0.0.0 area 0
network 10.10.200.0 0.0.0.3 area 0
network 10.10.200.4 0.0.0.3 area 0
area 10 range 10.10.0.0 255.255.224.0
default-information originate metric 50 metric-type 1
redistribute eigrp 100 subnets route-map eigrp_ospf
! OSPFv3
ipv6 unicast-routing
router ospfv3 10
router-id 10.255.1.1
int loop0
ipv6 ospf 10 area 0
int g0/2
ipv6 ospf 10 area 0
int g0/3
ipv6 ospf 10 area 0
! BGP
ip route 198.51.100.64 255.255.255.240 Null 0
ip prefix-list HQ seq 5 permit 198.51.100.64/28
route-map HQ permit 10
match ip address prefix-list HQ
router bgp 65100
neighbor 100.64.10.1 remote-as 65050
neighbor 100.64.10.1 route-map HQ out
network 198.51.100.64 mask 255.255.255.240
exit
! VPN
crypto ikev2 keyring KEY
peer ANY
address 0.0.0.0 0.0.0.0
pre-shared-key NB-VPN-2026
crypto ikev2 profile PROF
match identity remote address 0.0.0.0
authentication local pre-share
authentication remote pre-share
keyring local KEY
crypto ipsec transform-set TRANS esp-aes 256 esp-sha256-hmac
mode transport
crypto ipsec profile VPN
set transform-set TRANS
set ikev2-profile PROF
interface Tunnel10
ip address 172.20.0.1 255.255.255.252
tunnel source GigabitEthernet0/0
tunnel destination 100.64.20.2
tunnel key 999
tunnel protection ipsec profile VPN
exit
! EIGRP
ip prefix-list HQ-sum seq 5 permit 10.10.0.0/19
route-map HQ-sum permit 10
match ip address prefix-list HQ-sum
router eigrp NB-OVERLAY
!
address-family ipv4 unicast autonomous-system 100
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel10
authentication mode hmac-sha-256 Passw0rd!
no passive-interface
exit-af-interface
!
topology base
redistribute ospf 10 metric 10000 100 1 255 1500 route-map ospf-to-eigrp
redistribute bgp 65100 metric 10000 100 1 255 1500 route-map DEF
exit-af-topology
network 10.255.1.1 0.0.0.0
network 172.20.0.0 0.0.0.3
exit-address-family
! redistribution
route-map ospf-to-eigrp deny 5
match tag 10020
route-map ospf-to-eigrp permit 10
match ip address prefix-list HQ-sum
set tag 10010
route-map eigrp-to-ospf deny 5
match tag 10010
route-map eigrp-to-ospf permit 10
set tag 10020
route-map DEF permit 10
set tag 10010
match ip address prefix-list DEF
# NAT
ip access-list standard NAT
permit 10.10.0.0 0.0.31.255 any
ip nat inside source list NAT interface g0/0 overload
ip nat inside source static 10.10.20.10 198.51.100.70
int g0/0
ip nat outside
ip range g0/2-3
ip nat inside
BR-EDGE
en
conf t
! BASIC
hostname BR-EDGE
clock timezone UTC +8
ip domain-name qualifier2026.skill39.int
username admin privilege 15 algorithm-type sha256 secret Passw0rd!
enable algorithm-type sha256 secret Passw0rd!
crypto key generate rsa modulus 3072
ip ssh version 2
banner motd AUTHORIZED ACCESS ONLY.
ip access-list standard SSH
permit 10.10.30.0 0.0.0.255
permit 10.20.60.0 0.0.0.255
line vty 0 4
access-class SSH in
login local
transport input ssh
int loop0
ip add 10.255.2.1 255.255.255.255
no shu
int g0/0
ip add 100.64.20.2 255.255.255.252
no shu
int g0/1
no shu
int g0/1.50
en do 50
ip add 10.20.50.1 255.255.255.0
no shu
int g0/1.60
en do 60
ip add 10.20.60.1 255.255.255.0
no shu
! BGP
router bgp 65110
neighbor 100.64.20.1 remote-as 65050
! VPN
crypto ikev2 keyring KEY
peer ANY
address 0.0.0.0 0.0.0.0
pre-shared-key NB-VPN-2026
crypto ikev2 profile PROF
match identity remote address 0.0.0.0
authentication local pre-share
authentication remote pre-share
keyring local KEY
crypto ipsec transform-set TRANS esp-aes 256 esp-sha256-hmac
mode transport
crypto ipsec profile VPN
set transform-set TRANS
set ikev2-profile PROF
interface Tunnel10
ip address 172.20.0.2 255.255.255.252
tunnel source GigabitEthernet0/0
tunnel destination 100.64.10.2
tunnel key 999
tunnel protection ipsec profile VPN
exit
! EIGRP
router eigrp NB-OVERLAY
!
address-family ipv4 autonomous-system 100
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel10
summary-address 10.20.0.0 255.255.192.0
authentication mode hmac-sha-256 Passw0rd!
no passive-interface
exit-af-interface
!
topology base
exit-af-topology
network 172.20.0.0 0.0.0.3
network 10.255.2.1 0.0.0.0
network 10.20.50.0 0.0.0.255
network 10.20.60.0 0.0.0.255
eigrp stub connected summary
exit-address-family