Home > Ticket 4 – NAT ACL

Ticket 4 – NAT ACL

March 26th, 2011 in TSHOOT Go to comments

Client 1 & 2 are not able to ping the web server 209.65.200.241, but all the routers & DSW1,2 can ping the server.

NAT problem. (use ipv4 Layer 3)
problem on R1 Nat acl

Configuration on R1
ip nat inside source list nat_pool interface s0/0/0/1 overload

ip access-list standard nat_pool
permit 10.1.0.0
!
interface serial0/0/0/1
ip address 209.65.200.225 255.255.255.252
ip nat outside
!
interface Serial0/0/0/0.12
ip address 10.1.1.1 255.255.255.252
ip nat inside
ip ospf message-digest-key 1 md5 TSHOOT
ip ospf authentication message-digest

Answer:add to acl 1 permit ip 10.2.1.0 0.0.0.255

Ans1) R1
Ans2) NAT
Ans3) Add the command permit 10.2.0.0 in the nat_pool access-list

Comments (90) Comments
  1. Anonymous
    September 4th, 2010

    R4, R3, R2 can ping 209.65.200.226

  2. Anonymous
    September 8th, 2010

    config fromTT

    ip nat inside source list nat_pool interface Serial1/1 overload .

    ip access-list standard nat_pool
    permit 10.1.0.0
    permit 10.2.0.0 (fail)

  3. mema
    September 8th, 2010

    @anonymous,
    what do you mean by “permit 10.2.0.0 (fail)”? appears this statement in the ACL from TT?

  4. kk
    September 8th, 2010

    permit 10.2.0.0 is n t appears in this statement in the ACL

  5. nick
    October 11th, 2010

    ya… it isnt there.. and when we put the list there it works fine…
    so y do u get it lailed??

  6. DavidM
    October 12th, 2010

    you guys need to learn how to type english, WTF, how can i cheat without you guys knowing english

  7. CamHarkey
    October 12th, 2010

    wow i still don’t get this, WTF, i think i am just retarded, someone explain to be 10.2.0.0 fail i am a failure :(

  8. terc
    October 13th, 2010

    I think they’re pointing out that in the TT, they failed to put the permit 10.2.0.0 that’s why we need to choose the answer that will enter the said command.

  9. Manju
    October 14th, 2010

    is that permit 10.2.0.0 0.0.255.255 or permit 10.2.1.0 0.0.0.255 can any one reply ?

  10. kk
    October 14th, 2010

    permit 10.2.0.0 0.0.255.255 is not appear in the ip access-list standard nat_pool

  11. Davidlin
    October 19th, 2010

    i try to add permit 10.2.0.0 0.0.255.255 to the access-list 30 but it still fail to ping web server before i delete deny 10.2.1.0 0.0.0.255 why?

  12. SeanC
    October 20th, 2010

    This ticket is dumb and is below me.

  13. JACK
    October 20th, 2010

    啊啊啊啊啊 啊

  14. Tictac
    October 24th, 2010

    I think the access-list looks like this

    access-list 1 permit 10.1.0.0 0.0.255.255
    (implit deny)

    thereby only the routers are allowed through the NAT translation, but adding the
    access-list 1 permit 10.2.0.0 0.0.255.255
    will permit the clients and the ftp server.

    All tho i would make the list like this to permit everything
    access-list 1 permit 10.1.0.0 0.0.255.255
    access-list 1 permit 10.2.0.0 0.0.255.255
    access-list 1 permit 192.168.1.0 0.0.0.255
    access-list 1 deny any

    I dont know why network tut first say “Answer:add to acl 1 permit ip 10.2.1.0 0.0.0.255″
    The in ans3 says
    “Ans3) under NAT access list, enter the command permit 10.2.0.0 0.0.255.255″

  15. mml
    October 25th, 2010

    regarding to
    @tictac question why ur answers are deferent networktut can u explain thank u

  16. mml
    November 4th, 2010

    to those who passed the exam congrats and i am really confused cuz on cisco site they said there are 35-40 questions in the exam and all who passed they took about 12 tt, 3-4 mcq, and 1-2 DnD so here is where i get confused this all together not more than 20 q ,,is there another lab or just this one big topology for TT
    so plz some one post about this and which dump is valid and the link for it
    thank u so much guys this site is very helpful

  17. Buddy
    November 4th, 2010

    Dont fet confused man. So far the exam comprises of 12 tt and 4mcq and 1-2 dnd.
    just overlook what was mwntioned before

  18. cisco guru
    November 5th, 2010

    @mml confised because you are dumb as shite

    take it with all this god willing shit , half you lot are cheating Muslims.. read the Koran brother and you will see that the profit said ” at the point of stealing, cheating the Muslim is no longer a believer”

    you have just become a infidel for the sake of a cert. well done

  19. sisko
    November 5th, 2010

    @ cisco guru: i urge u to keep focus on what this forum is meant for so everyone gets benefited. plz avoid religious and political comments. Thnx

  20. Naveed
    November 8th, 2010

    @CCIE interested people
    This is an open invitation for the serious people about CCIE. You are advised to send an email to the below mentioned address for enrolling your willingness. We’ll be utilizing the concept of 1+1 = 11 by putting our minds together to study/practice the right thing. Here it doesn’t require a mention for a CCIE candidate but let me clear one thing, ‘THERE IS NO SHORTCUT TO CCIE’, so any body looking for shortcuts, please accept my advance excuse. However, we’ll try to do our best to find out the fastest way and most effective material of practice/study.
    Kindly, enroll your willingness at following email address. Also if you have any question, send to the same address.
    ask_ccie@yahoo.com

    @networktut
    I wish you could have a managed discussion forum for CCIE as you have for CCNP

  21. Peter
    November 12th, 2010

    Pass today 642-832 now NP next friday
    CCDP hopefully

  22. naggi
    December 4th, 2010

    hi guys how do i know this lay2 or la3 topology is related to this problems plz i need u help guys

  23. naggi
    December 5th, 2010

    hi guys somebody help i am tr to do the demo but there is only 4 tt qu and all releated to l3 topology plz help is there more or just this is it
    and how i know this q releated to which topology my cordial thanks to u guys

  24. CCNP Aspirant
    December 6th, 2010

    Hey Guys. I must say that this blog is truely awesome.I had no idea how to take TSHOOT exam but now things are crystal clear to me. I am planning to take my exam next week, so will appreciate if anyone can provide me for GNS3 topology of the real scenario and its config.

    Congratualtions to all of you who cracked this exam :)

  25. David
    December 18th, 2010

    @networktut

    In the config, i think the IP of serial0/0/0/1 is 209.65.200.225, instead of 209.65.200.224:

    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ip nat outside

  26. matrix
    December 18th, 2010

    @ David,

    Yea u r right. Its just typo mistake.

  27. Gandmaroo of cisco_guru
    December 18th, 2010

    @ cisco guru

    chootya, lund dharya, madarchod, randi ke bacche, bhadwe ki aulaad kahin ja ke aur apni maa chuda… yahan aake apni ma ko randi mat banayiu… madarchod.

  28. Kaibigan
    December 19th, 2010

    @networktut

    ur correct BUT:

    i think better to use access-list 1 permit 10.2.0.0 0.0.255.255 than
    access-list 1 permit 10.2.1.0 0.0.0.255

    to fully justify the exact answer…

  29. kumar
    December 26th, 2010

    Hi,
    In exam the permit 10.2.0.0 is already configured correctly.

    p access-list standard nat_pool
    permit 10.1.0.0
    permit 10.2.0.0 ———>It is preconfigured so, whats the problem
    !
    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ip nat outside
    !
    interface Serial0/0/0/0.12
    ip address 10.1.1.1 255.255.255.252
    ip nat inside
    ip ospf message-digest-key 1 md5 TSHOOT
    ip ospf authentication message-digest

  30. David
    December 27th, 2010

    @kumar,

    Maybe its a typo, IP address of s0/0/0/1 should be ’209.65.200.225′ instead of ’209.65.200.224′

  31. raj
    December 27th, 2010

    @kumar
    I have read the your statement in all tickets, how can you be so confused?? ok have you passed the test or you have some problem?

  32. akhalaf
    December 28th, 2010

    Hi guys
    good evening….
    Please if someone has the GNS3 TOPOLOGY, upload it to let all of use practice very well before booking to exam

  33. load
    January 29th, 2011

    @kumar
    “Hi,
    In exam the permit 10.2.0.0 is already configured correctly.
    p access-list standard nat_pool
    permit 10.1.0.0
    permit 10.2.0.0 ———>It is preconfigured so, whats the problem
    !
    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ip nat outside”

    In the real exam the ip address of serial 0/0/1 is 209.65.200.224? the is the network address…

    209.65.200.224 – Network address
    209.65.200.225 – Available address
    209.65.200.226 – Available address
    209.65.200.227 – Broadcast address

  34. Thanks in Advance
    February 1st, 2011

    Please someone answer :
    R1(conf)# int ser0/0/0/0.12
    (conf-if)# ip nat inside

    R1(conf)# ip access-list stand name1
    permit 192.168.1.0

    R1(conf)# ip nat inside source list name1 ser 1/0 overload

    Now if any packet with source other than 192.168.1.0 is received by interface s0/0/0/0.12 , will it be routed without natting or it will be discarded since ACL name1 denies it?

  35. Egypt in my HEART
    February 3rd, 2011

    @all

    ip nat inside source list nat_pool interface s0/0/0/1 overload

    ip access-list standard nat_pool
    permit 10.1.0.0
    permit 10.2.0.0 ( should be here to permit this subnet to be NATted when any traffic come with this subnet as a source IP to be able to exchange traffic with the Web Server trough the ISP without this permit command it will not be able to get a real IP through NAT to be routed for outside and get a reply back from it)
    !
    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252 “this is a network ID please do not get confused “==> ip address should be 209.65.200.225 255.255.255.252
    ip nat outside
    !
    interface Serial0/0/0/0.12
    ip address 10.1.1.1 255.255.255.252
    ip nat inside

    @ Thanks in advance

    this will be according to the routing table contents if it has an entry with the “other network” or has a default route it will be routed if not it will be discarded as the access-list has “deny any any” by default in the end of its lines

    @ Kumar

    did you take the test? please let us know if it is for real in the exam permit 10.2.0.0 already exist as i will write my paper next saturday and i really do not need any surprises

    Thank you
    I hope this helps if it right….

  36. Nirmala
    February 9th, 2011

    Hi everyone! I’m going to take the exam next week. Guys please let me know if there is anything changed or updated.

    Are these questions still valid?

    Please help me……!

    Thank you

  37. Nirmala
    February 19th, 2011

    I did the exam yesterday and got 1000……………..!

    Thanks for everybody here supporting me for this achievement.

    All the questions in the exam are the things appear here. Nothing has been changed.

    But i would like to give an important advice for the people who wish to take the exam soon.

    Please read the comments in following link by Geno and Lisa. Those instructions were really

    helpful to me…!

    http://www.networktut.com/tshoot-ticket-1

  38. AhMAAAAADD
    March 2nd, 2011

    Dear All;
    just passed Tshoot,& um CCNP.Got 1000 ;i ve got the following:
    4 MCQ
    NO Drag & Drop.
    12 TT (1 new TT,the old TT with wrong ip 209.56.200.241 has been removed)all other TT are VALID.
    Thanks Networktut for charing knowledge.

  39. Star2010
    March 6th, 2011

    Ahmad,
    congrats, could you please share with the forum the new TT that you had on your exam?

    Thanks

  40. strikeforce betting
    March 23rd, 2011

    Awsome article !! What blog platform do you use on your www ?

  41. DEE
    April 11th, 2011

    AhMAAAAADD,

    I’m taking the test this weekend. Did the test goes in order just like the trouble tick in this forum?

  42. Confused
    April 11th, 2011

    so is the correct answer on this question:

    add the command permit 10.2.0.0 to the nat_pool access list??

    and NOT:

    add to acl 1 permit ip 10.2.1.0 0.0.0.255

    correct?

  43. Anonymous
    April 14th, 2011

    Has anyone seen the TSHOOT 642-832 Dump for Testinside? It has not Trouble tickets questions. Something is really wrong there…

  44. Anonymous
    April 16th, 2011

    The 642-832 TSHOOT Topology made available by cisco on the PDF is not the same as their online Topology demo. Could someone please confirm the actually topology used in the real exam?

  45. Anonymous
    April 22nd, 2011

    Can anybody give me an example of exactly how the TT Questions are asked i the exam?

  46. cris
    April 26th, 2011

    guys i failed the exam last week i made a comment on the share ur experience also , guys i am little bit confused with this ticket cus the nat (permit statement) was missing in two TT i met in one i thought it was the access list cus it had a deny statement in the end blocking 10.2.0.0 n/W and in the mean time the nat acl also was missing !!!! guys pls guide me in this cus i am reseating for the exam end of the month

    and please explain me about commment also its confusing

    @kumar
    “Hi,
    In exam the permit 10.2.0.0 is already configured correctly.
    p access-list standard nat_pool
    permit 10.1.0.0
    permit 10.2.0.0 ———>It is preconfigured so, whats the problem
    !
    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ip nat outside”
    In the real exam the ip address of serial 0/0/1 is 209.65.200.224? the is the network address…
    209.65.200.224 – Network address
    209.65.200.225 – Available address
    209.65.200.226 – Available address
    209.65.200.227 – Broadcast address

  47. Romok
    April 27th, 2011

    @cris,
    Then why did’nt u correct the ip address from network address (209.65.200.224) to .225 ?

  48. Pocbucibucibu
    April 27th, 2011

    If you add only “permit 10.2.1.0″ the assumed wildcard will be 0.0.0.0 …this will cause nat translation only for ip sources of 10.2.1.0/32.—this is a ccna issue.
    I’m wondering how many of you have read at least one time a certification guide or a book for this exam because I’ve seen people asking crazy questions or waiting for a confirmation instead of just doing a little research.
    Respect for those who make efforts to prepare not just memorize topics…and for the rest: try to learn the basics, the certificate it’s not really important in real life! The knowledge it’s what really matters!!

  49. cris
    April 29th, 2011

    Romak!!! sorry for the late respond the ip address were correct in the ticket, but i am trying to figure out where i went wrong in this 2 tickets !!!! in R1 if its blocked by and access group for the Network 10.1.0.0 then it cant ping the wan interface, in my case in both the tickets i met i could ping the wan and n/w 10.2.0.0 was not permitted in the nat acl !! so where can i go wrong !!!

  50. Anonymous
    April 30th, 2011

    Does the CCNP 642-832 TSHOOT exam ROUTERS and SWITCHES resetS themselves, or do we have logout of all DEVICES after every Trouble Ticket?

  51. Anonymous
    May 2nd, 2011

    Hi,

    Can anybody tell me if it’s possible to go back and forward between the questions inside the ticket (I mean go to question three first, then answer question 1)?

  52. Anonymous
    May 2nd, 2011

    you can abort a ticket to compare config with another ticket

  53. DBW
    May 3rd, 2011

    How does the routers refreshes themselves between trouble tickets

  54. Felcor
    May 5th, 2011

    Hello everybody, I did the test today with 930/1000 – there is a tt of bgp and drag drop a question that is not available on the site that went into my exam, the rest are equal.
    Thank you!

  55. rishan
    May 7th, 2011

    congrats Felcor, dear could u plz tell me how long did u take to finish ur exam out of 2 hrs 45 mins….??? hope Felcor will read ma comment and reply me m waiting…. if any other guy who lately passed this exam plz share wid us the time he or she took to finish the exam….
    thx and regards
    rishan

  56. tanvir
    May 7th, 2011

    hey guys i passed my tshoot exam today,i got 972/1000 ……….
    i got 2 drag and drops,2 mcq with 13 tickets.1 drag and drop is not there in the dump……….,bgp tickets is valid,i did not got eigrp ticket,rest other tickets r same as on networktut.com, if u want to pass tshoot exam,refer to networktut.com,u will find all the tickets which r valid…..thank u felcor……….u gave me confidence for giving exam………..thanks ………

  57. max
    May 7th, 2011

    @tanvir
    please can u tell me what is the drag and drop ticket

  58. TSM
    May 13th, 2011

    I was testing this scenario, and I was wondering about two things:
    - what layer two protocol is used on the serial links between R1 and R2?
    - is there an outgoing access-list on the interface towards the Web-server? Or how is traffic blocked in that direction?

    Cheers!

  59. DBW
    May 15th, 2011

    I have completed my CCNP certification today by passing my last exam TSHOOP.
    The exam itself was kind of straight forward with almost all of the TT well know
    as state on this site. I had 2 DD, 2 MCQ & 13 TT

    One of the issues with this TSHOOP exam is that you have to constantly move windows around whiles you are trying to keep your concentration. I was also working on small screen. (Frustrating)

    TIP
    Have a strategy with your PING command
    Make sure you properly exit all devices after each ticket.
    Abort and move to the next TT if you can’t find the problem. (You can always come back)

    I think cisco should have offered a PRINT OUT OF THE TOPOLOGY to all candidates on exam day and collect them afterwards. Anyway! I have a good dump. Interested? Drop me a line donald.bart-williams@stjohns.surrey.sch.uk

    I am now going to be focus on ASA5510 firewall

    To all you CCNP Candidates on this forum including SWITCH & ROUTE, Good Luck and have a nice summer. It has been fun

  60. David
    June 6th, 2011

    Hello,
    please correct the wrong ip in the output :

    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252

    ip address must be 209.65.200.225 like on the schema.

    Thx :)

  61. TefanO
    June 6th, 2011

    Hello David.

    Good point ..thanx … your are a troubleshooter ;)

  62. betmen
    June 6th, 2011

    Hi,

    As i see it:

    Configuration on R1
    ip nat inside source list nat_pool interface s0/0/0/1 overload

    ip access-list standard nat_pool
    permit 10.1.0.0 255.255.255.255 <—- already configured
    permit 10.1.0.0 255.255.255.255 <—- already configured
    permit 10.2.1.0 0.0.0.255 <———- you neeed to add this
    !
    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ip nat outside
    !
    interface Serial0/0/0/0.12
    ip address 10.1.1.1 255.255.255.252
    ip nat inside
    ip ospf message-digest-key 1 md5 TSHOOT
    ip ospf authentication message-digest

  63. JT
    June 13th, 2011

    Hello Guys,
    Need CBT Nuggets TSHOOT .Pls call if anybody has got it. Happy to share Route and Switch study and P4S Q&A plus all Sims for route and switch. Routes in GNS3 and Switch in Packet Tracer.
    Thanks
    email:kripa.jyoti@gmail.com

  64. Morpheus
    June 16th, 2011

    Folks , you are confusing people more then helping !
    Do not post contradictory comments and configurations. If you have been on the exam , just share/correct only if the general answer provided is wrong .
    Please!!
    And thanks a lot!

  65. Morpheus
    June 16th, 2011

    @betmen- the issue is that both client1&2 can not reach the server and they are in different subnets if you check the topology.
    The answer would maximum be to add 10.2.0.0/16
    As I said above, please stop confusing people!

  66. Morpheus
    June 16th, 2011

    @Betmen – scratch that! My mistake mate! Apologise! Was watching a different diagram on my desktop! :-)

  67. shah
    June 20th, 2011

    Guy.. Any changes in the current update????? if any1 of u got updated dumps. plz update me on shariq2009@live.com

  68. Anonymous
    June 24th, 2011

    All my Dears, friend and brother.I have a problum my TSHOOT Paper exam date 5-July-2011
    If anyone have Updat Pass4Sure, and Dumps. so plz send to my E-mail.

    k_afridi1@hotmail.com

    kgul@etisalat.ae

  69. Someguy
    July 15th, 2011

    I disagree with the use of the wildcard mask 0.0.255.255. The trouble ticket says only client 1 and client 2. They fall under 10.2.1.0/24.

    By using a mask of 0.0.255.255 you are not only including the client subnet (vlan 10) but you are also including the server subnet of 10.2.2.0/24 and the /30 link of DSW1 and DSW2.

    Also, by using a permit statement without a wildcard mask, you are specifying a mask of 0.0.0.0, a single host, therefor adding just “permit 10.2.0.0″ will NOT work, see below for test.

    I tested this using GNS3.
    2 Cisco 2691′s running 12.4(25c).
    One host.
    Host configured with a DG of the R1 FA0/1 port IP, directly connected. (10.1.2.1). Host IP’ed 10.1.2.254.
    On R2 a loopback port was IP’ed with 10.1.24.1.
    The FA0/0 port between routers IP’ed 10.0.0.1 & 2 /24.
    EIGRP running between them with a network 10.0.0.0 command with auto-summary turned off.

    Pings sourced from either Lo0 or FA0/0 on R2 could hit the client

    Access list filter applied INBOUND on R1 FA0/0.
    Filter line 10, permit 10.0.0.2 (to allow EIGRP updates)
    Filter line 20, permit 10.1.0.0 (This should have allowed the pings, according to the logic in the answer)

    Ping from R2, source FA 0/0 5/5 success
    Ping from R2, source Lo0 0/5 failed

    Added line 30 permit 10.1.24.0

    tried pinging again, pings falied from Lo0, succeeded from FA0/0

    Added line 40 permit 10.1.24.1

    pings worked from both interfaces

    Also, It’s very, very bad practice, security wise, to allow more access than is needed. You dont want someone web surfing on your FTP server, now do you? It’s like using a 10 lb hammer to drive a nail, sure it’ll work, but it wont be safe. It’s also like putting “permit any any” at the bottom of your security ACL’s. The ACL’s will process every packet alright, and let everything through.

    Will someone else please replicate my test to provide proof?

  70. Anonymous
    July 22nd, 2011

    what’s the lastest info on TTs

  71. Anonymous
    July 24th, 2011

    Hi guys,

    can any one give me the lab in .pkt but not configured.i mean without correcting the problems.

    thanks

  72. business review
    July 31st, 2011

    ..Hi everyone ..Just for the record and as excuse for silly questions I am.completely new in configuring routers…I have following problem .We have a modempool with a cisco 2511 router. Static IPs for.Video LAN.!.ip dhcp pool Pool0.import all.network 192.168.0.0 16.dns-server 194.90.1.5 212.143.212.143.!.ip dhcp pool Pool1.network 192.168.1.0 24.default-router 192.168.1.1.lease 30.!.ip dhcp pool Pool2.network 172.16.2.0 24.default-router 192.168.2.1.lease 30.!.interface vlan 1. Static IPs for.Video LAN.!.ip dhcp pool Pool0.import all.network 192.168.0.0 16.dns-server 194.90.1.5 212.143.212.143.!.ip dhcp pool Pool1.network 192.168.1.0 24.default-router 192.168.1.1.lease 30.!.ip dhcp pool Pool2.network 172.16.2.0 24.default-router 192.168.2.1.lease 30.!.interface vlan 1.

  73. Ahmed
    August 2nd, 2011

    please help me…the ticket of bgb was in my exam but there is a very strange matter..all three questions and their answers repeated for all 13 tickets and so i want to ask about all other topics..why only bgp in the exam..the answers of each three Qs for all 13 tickets are the same..is this logical?..I know nature of Qs and the topologies. i mean that in each ticket under a Q like how to fix it …i found answers of each ticket are the same

  74. Ali
    August 2nd, 2011

    @ Ahmed

    Please visit the link http://www.cisco.com/web/learning/le3/le2/le37/le10/tshoot_demo.html

    This is Cisco Demo, like the real exam. Demo has only 4 tickets, real exam has about 13 tickets.

    Demo will give to you some advicess how is tickets on real exam.
    Many tickets have same question because problem is “Client doesn’t reach web server. What is solution” but tickets have different problem points. Please check the cisco demo.

    Thanks

  75. Anonymous
    August 15th, 2011

    Do we correct the configuration for the devices or just answer the multiple Qs for each ticket?

  76. has
    August 25th, 2011

    Hi ,

    Brothers Please tell me Which dumps are valid in this two :

    1). 642-832 pass4sure 51q. gb16
    2). 642-832 ( TSHOOT ) Actultest.

  77. professional q8
    August 25th, 2011

    Dums still valid
    Has. … Pass4sur 5o eq
    Special thanks for networktut
    Pass to day. :)

  78. suni
    August 29th, 2011

    plz help me, i want to write TSHOOT exam in this week but im not understanding question & how to answer for that question.

  79. JOE
    September 1st, 2011

    Please cal this guy Pranay my friend, he will be be giving exam too he can explain you as well
    9890114838
    Thanks

  80. Donald
    November 6th, 2011

    Are there any social site like 9tut for CCNP Security?

  81. steven
    November 15th, 2011

    i got this TT wrong on my exam..

    In exam the permit 10.2.0.0 is already configured correctly.
    p access-list standard nat_pool
    permit 10.1.0.0
    permit 10.2.0.0 ———>It is preconfigured so, whats the problem???
    !
    interface serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ip nat out

  82. Octavian
    November 20th, 2011

    The problem is basic ACL configuration in your head!

    Every ACL that has only an IP as permit or deny, without a wildcard mask associated, would be the equivalent of host IP, meaning that single IP mentioned.

    That is the reason why you would have to enter permit 10.1.0.0 0.0.0.255 and permit 10.2.0.0 0.0.255.255 or whatever mask/networks you would want to permit beeing NATed.

  83. Bilal Al-Masri
    November 27th, 2011

    Today, I have passed TSHOOT with full mark Alhamdulleah (thanks for GOD). All the dumps are valid.

    13 TT (EIGRP AS ticket is not in the exam).

    All 13 TT is the same.

  84. NKR
    December 4th, 2011

    All,
    Octavian is absolutely right. Cisco is saying that and even I simulated it and prooved that. Have to add wildcard mask there.
    ip access-list standard nat_pool
    permit 10.1.0.0 >> This will permit / NAT only HOST – 10.1.0.0/32
    permit 10.2.0.0 >> This will permit / NAT only HOST – 10.2.0.0/32

    So this acl will not allow any traffic from client 1 or 2 to be NATed and the ping will failed.

    You have to add there:
    permit 10.1.0.0 0.0.255.255 >> This will permit / NAT 10.1.0.0/16
    permit 10.2.0.0 0.0.255.255 >> This will permit / NAT 10.2.0.0/16 which includes Client 1&2

    (of course you may use different wildcard mask just be sure clients are included in that mask..)

    NetworkTut is missleading in this point. However give us great picture where the problem lies.
    ..Hope it helps..

    BTW: BIG BIG Thanks to all TUT pages, GREAT JOB!!

  85. Aleemuddin
    December 29th, 2011

    Aleemuddin December 29th, 2011 Alhumdullilah I have passed my exam with score 945. Thanks to Allah and network tut.

    aleemyousuf@gmail.com

  86. Mostafa ElMeligy
    December 31st, 2011

    I just have a question… In the real exam, will the question mention that “all the routers & DSW1,2 can ping the server” or it’ll just say that the 2 clients can’t ping the server???
    Thanks in advance…

  87. Belal
    January 8th, 2012

    Passed my TShoot Exam on 5th January, 2012 with 1000/1000, Allhamdulilah.
    “Networktut” website and my brother Sohaib Fouzi helped me to prepare this exam, thanks for both of you.
    All TTs are still valid and same as mentioned under “networktut”. I got multiple choices and 13 TTs. Except EIGRP AS all TTs came. In All TTS Client1 will have valid IPs (except 4 TTs of 169.x.x.x).
    I did my complete exam using only “ipconfig”, “ping” and “show run” commands and never felt to use any other command. One thing is very important that you should have complete understandings of TTs other wise you will not able to understand 2 or 3 TTs because Cisco made very minor changes in mulitple choices or in configuration. The IP scheme between R4, DSW1 and DSW2 is 10.1.4.x.
    When i entered in LAB, before starting my exam i wrote the below lines on the provided sheet and then it became very easy to solve the TTs. To solve the TTs i followed the following scheme and order: (remember to use “ipconfig” and “ping” always in Client1 for all TTs)

    ->> If it is 169.x.x.x there are 4-TTs
    1.ASW1 – port security (show-run ASW1 if 1/0/1 and 1/0/2 are in Vlan10, apply sh int for both)
    2.ASW1 – access vlan 10 (show-run and check ASW1 if 1/0/1 and 1/0/2 are in Vlan1, if they are… stop!)
    3.ASW1 – switch-to-switch (show-run ASW1)
    4.R4 – DHCP excluded (show-run R4)
    ——————————————————————-

    ->> If client got IP address then 2 options:
    -First, if client1 can ping 10.1.1.1 not to server 209.65.200.241 (3TT) ALL IN R1
    1.R1 – NAT (10.2.0.0) (show-run R1)(sh ip BGP summary)
    2.R1 – BGP (56-65) (show-run R1)(sh ip BGP summary)
    3.R1 – ACL (show-run R1)(sh ip BGP summary)
    -Second , Client can’t ping 10.1.1.1 but it can ping to 10.1.1.2) then: (1TT)
    4-R1 – OSPF authentication (show-run R1 + R2)
    -Thirdly, if client1 cannot ping 10.1.1.1, then (4 TTs)
    1. DSW1(ASW1) – vlan access map(vlan acl port) *** this one cannot ping even gateway (Check vlan-filter command, which contain vlan access-map, this contain access-list no., now check access-list no. It can drop the packet for PC conntected to ASW1.)
    2. R4 – Route redistribution: (show-run R4)(EIGRP->OSPF is created and EIGRP-TO-OSPF is used)
    3. R4 – EIGRP Passive Interface: passive interface (show-run R4)(sh IP protocols )
    4-R4-EIGRP AS: AS number of EIGRP is different is used To verify – show IP protocols.
    ——————————————————————-

    ->> Finally, there are 2 distinct TTs,
    - HSRP on DSW1: Check DSW1 Use track 10 instead of track 1 (show run) and this is the only question you will see tracking.
    - OSPF IPv6 on R2: On serial interface use area 0, not area 12 (show run), you will recognize this TT by reading ticket because it is the only TT which says about IPv6.

    Note: The above scheme i copied from one comment under “networktut”, i dont remember the name. Sory to mention under my comments but it was just to help others. Please feel free for any query, my email address belal_fouzi@yahoo.com

  88. Ahmed M. Alkalsh
    January 13th, 2012

    @netwoktut
    interface Serial0/0/0/1
    ip address 209.65.200.224 255.255.255.252
    ???
    ip address should be 209.65.200.225
    thanks

  89. Help !!!
    January 27th, 2012

    A big congratulations to everyone who just passed THOOT paper, if possible please share the Dump of TSHOOT to this mail please and thanks a lot ! kkk278@hotmail.co.uk also if you have any packet tracer software 5.3+ pls send me one and really appreciated ! (Urgent)

  90. Muaadh Farhan
    February 11th, 2012

    You can search the internet (google) about your transistor .

Add a Comment