CCNAv7 SRWE Skills Assessment Super Detailed Mobile Reviewer

What this assessment is really testing

Do not memorize this as random commands. The whole exam is one story: hosts live in VLANs, switches carry those VLANs through trunks and EtherChannel, the router routes between VLANs using subinterfaces, DHCP gives IPv4 addresses, IPv6 is mostly static, then you prove everything with pings.

Router R1
Creates gateways for VLAN 2, 3, and 4 using subinterfaces. Also handles DHCP and default routes to Loopback0.

S1
PC-A is on VLAN 2 at F0/6. S1 trunks to R1 on F0/5 and bundles F0/1-2 to S2 using LACP EtherChannel.

S2
PC-B is on VLAN 3 at F0/18. S2 bundles F0/1-2 to S1 and has management SVI on VLAN 4.

VLAN 5
Parking VLAN only. Unused ports go here and are shut down. There is no router gateway for VLAN 5, and that is intentional.

VLAN and addressing cheat sheet

VLAN	Name	Subnet / Prefix	Gateway / Main Address	Used by
2	Bikes	10.19.8.0/26 2001:db8:acad:a::/64	10.19.8.1 2001:db8:acad:a::1 fe80::1	PC-A, S1 F0/6
3	Trikes	10.19.8.64/27 2001:db8:acad:b::/64	10.19.8.65 2001:db8:acad:b::1 fe80::1	PC-B, S2 F0/18
4	Management	10.19.8.96/29 2001:db8:acad:c::/64	R1: 10.19.8.97 S1: 10.19.8.98 S2: 10.19.8.99	Switch management SVI
5	Parking	No router interface	None	Unused switch ports
6	Native	No IP required	Native VLAN for trunks	Trunk untagged traffic

Exam trap: VLAN 6 is the native VLAN. VLAN 5 is the parking VLAN. Do not mix them up. VLAN 5 is for unused shutdown ports. VLAN 6 is for trunk native VLAN only.

Part 1: Initialize, reload, and secure the devices

This part is worth the most points because it sets the base configuration. If SSH, passwords, hostname, domain name, and IPv6 routing are wrong, later parts can look broken even when the VLANs are okay.

Erase old configs

Use erase startup-config, reload, and for switches delete VLAN data if required by your Packet Tracer/device instructions. On real switches, VLANs can survive because they are stored in vlan.dat.

Switch SDM template

Use sdm prefer dual-ipv4-and-ipv6 default if the switch needs IPv6 support. Reload after changing the template. No reload means IPv6 commands might not behave correctly.

Basic security

Disable DNS lookup, set hostname, domain, enable secret, console password, local admin user, SSH-only VTY, password encryption, and MOTD banner.

Router subinterfaces

Each VLAN that needs routing gets one router subinterface. VLAN 2, 3, and 4 get IPv4 and IPv6. VLAN 6 is native only. VLAN 5 gets no router interface.

Part 2: VLANs, trunks, EtherChannel, access ports, and port-security

Create VLANs first
If the VLAN does not exist, access-port assignment can behave weirdly or show inactive.

Trunk both sides
Native VLAN and allowed VLAN list must match between trunk endpoints.

EtherChannel must match
F0/1 and F0/2 should have the same trunk settings before or with channel-group. LACP active is used.

Enable port-security
Maximum alone is not enough on most IOS versions. Use switchport port-security then set maximum 3.

Common mistake in student configs: typing crypto key generate rsa1024 without the proper syntax. Safer syntax is crypto key generate rsa modulus 1024. Also, on 2960, switchport trunk encapsulation dot1q may not exist because it only supports 802.1Q by default.

Part 3: DHCP and host support

For IPv4, PC-A and PC-B use DHCP. For IPv6, the PCs use static global addresses and the IPv6 default gateway is the router link-local address fe80::1.

VLAN 2 DHCP range
Subnet: 10.19.8.0/26
Usable: 10.19.8.1 to 10.19.8.62
Last 10 usable: 10.19.8.53 to 10.19.8.62
Exclude: 10.19.8.1 to 10.19.8.52

VLAN 3 DHCP range
Subnet: 10.19.8.64/27
Usable: 10.19.8.65 to 10.19.8.94
Last 10 usable: 10.19.8.85 to 10.19.8.94
Exclude: 10.19.8.65 to 10.19.8.84

PC-A IPv6
Address: 2001:db8:acad:a::50/64
Gateway: fe80::1

PC-B IPv6
Address: 2001:db8:acad:b::50/64
Gateway: fe80::1

Part 4: Ping verification path

Test in layers. First same-VLAN/default gateway, then inter-VLAN, then management VLAN, then loopback. Do not randomly ping everything and panic. Be methodical.

PC-A gets IPv4 DHCP address from VLAN 2 pool, likely 10.19.8.53 to 10.19.8.62. PC-B gets IPv4 DHCP address from VLAN 3 pool, likely 10.19.8.85 to 10.19.8.94. PC-A can ping 10.19.8.1 and 2001:db8:acad:a::1. PC-B can ping 10.19.8.65 and 2001:db8:acad:b::1. Both PCs can ping S1 management 10.19.8.98 and S2 management 10.19.8.99. Both PCs can ping R1 Loopback0 209.165.201.1 and 2001:db8:acad:209::1.

Copyable command blocks

These are cleaned-up versions of the commands from your assessment notes, with a few syntax fixes included.

R1 Full Configuration

enable
configure terminal
no ip domain lookup
hostname R1
ip domain name ccna-lab.com
enable secret ciscoenpass
security passwords min-length 10
username admin secret admin1pass
service password-encryption
banner motd #Unauthorized Access is Prohibited#
ipv6 unicast-routing
line console 0
password ciscoconpass
login
exit
line vty 0 15
login local
transport input ssh
exit
interface g0/0/1.2
encapsulation dot1Q 2
description Bikes
ip address 10.19.8.1 255.255.255.192
ipv6 address 2001:db8:acad:a::1/64
ipv6 address fe80::1 link-local
exit
interface g0/0/1.3
encapsulation dot1Q 3
description Trikes
ip address 10.19.8.65 255.255.255.224
ipv6 address 2001:db8:acad:b::1/64
ipv6 address fe80::1 link-local
exit
interface g0/0/1.4
encapsulation dot1Q 4
description Management
ip address 10.19.8.97 255.255.255.248
ipv6 address 2001:db8:acad:c::1/64
ipv6 address fe80::1 link-local
exit
interface g0/0/1.6
encapsulation dot1Q 6 native
description Native VLAN
exit
interface g0/0/1
no shutdown
exit
interface loopback 0
description Loopback
ip address 209.165.201.1 255.255.255.224
ipv6 address 2001:db8:acad:209::1/64
ipv6 address fe80::1 link-local
exit
crypto key generate rsa modulus 1024
ip ssh version 2
end
copy running-config startup-config

S1 Full Configuration

enable
configure terminal
no ip domain lookup
hostname S1
ip domain name ccna-lab.com
enable secret ciscoenpass
username admin secret admin1pass
service password-encryption
banner motd #Unauthorized Access is Prohibited#
line console 0
password ciscoconpass
login
exit
line vty 0 15
login local
transport input ssh
exit
crypto key generate rsa modulus 1024
ip ssh version 2
vlan 2
name Bikes
vlan 3
name Trikes
vlan 4
name Management
vlan 5
name Parking
vlan 6
name Native
exit
interface vlan 4
description Management Interface
ip address 10.19.8.98 255.255.255.248
ipv6 address 2001:db8:acad:c::98/64
ipv6 address fe80::98 link-local
no shutdown
exit
ip default-gateway 10.19.8.97
interface range f0/1-2
switchport mode trunk
switchport trunk native vlan 6
switchport trunk allowed vlan 2-6
channel-group 1 mode active
exit
interface port-channel 1
switchport mode trunk
switchport trunk native vlan 6
switchport trunk allowed vlan 2-6
exit
interface f0/5
switchport mode trunk
switchport trunk native vlan 6
switchport trunk allowed vlan 2-6
exit
interface f0/6
switchport mode access
switchport access vlan 2
switchport port-security
switchport port-security maximum 3
exit
interface range f0/3-4, f0/7-24, g0/1-2
switchport mode access
switchport access vlan 5
description Unused Interfaces
shutdown
exit
end
copy running-config startup-config

S2 Full Configuration

enable
configure terminal
no ip domain lookup
hostname S2
ip domain name ccna-lab.com
enable secret ciscoenpass
username admin secret admin1pass
service password-encryption
banner motd #Unauthorized Access is Prohibited#
line console 0
password ciscoconpass
login
exit
line vty 0 15
login local
transport input ssh
exit
crypto key generate rsa modulus 1024
ip ssh version 2
vlan 2
name Bikes
vlan 3
name Trikes
vlan 4
name Management
vlan 5
name Parking
vlan 6
name Native
exit
interface vlan 4
description Management Interface
ip address 10.19.8.99 255.255.255.248
ipv6 address 2001:db8:acad:c::99/64
ipv6 address fe80::99 link-local
no shutdown
exit
ip default-gateway 10.19.8.97
interface range f0/1-2
switchport mode trunk
switchport trunk native vlan 6
switchport trunk allowed vlan 2-6
channel-group 1 mode active
exit
interface port-channel 1
switchport mode trunk
switchport trunk native vlan 6
switchport trunk allowed vlan 2-6
exit
interface f0/18
switchport mode access
switchport access vlan 3
switchport port-security
switchport port-security maximum 3
exit
interface range f0/3-17, f0/19-24, g0/1-2
switchport mode access
switchport access vlan 5
description Unused Interfaces
shutdown
exit
end
copy running-config startup-config

DHCP and Default Route on R1

configure terminal
ip route 0.0.0.0 0.0.0.0 loopback 0
ipv6 route ::/0 loopback 0
ip dhcp excluded-address 10.19.8.1 10.19.8.52
ip dhcp pool VLAN2-Bikes
network 10.19.8.0 255.255.255.192
default-router 10.19.8.1
domain-name ccna-a.net
exit
ip dhcp excluded-address 10.19.8.65 10.19.8.84
ip dhcp pool VLAN3-Trikes
network 10.19.8.64 255.255.255.224
default-router 10.19.8.65
domain-name ccna-b.net
exit
end
copy running-config startup-config

Verification Commands

show ip interface brief
show ipv6 interface brief
show vlan brief
show interfaces trunk
show etherchannel summary
show port-security interface f0/6
show port-security interface f0/18
show ip dhcp binding
show ip dhcp pool
show running-config | section dhcp
show running-config interface g0/0/1.2
show running-config interface g0/0/1.3
show running-config interface g0/0/1.4
show ip route
show ipv6 route
ping 10.19.8.1
ping 10.19.8.65
ping 10.19.8.97
ping 10.19.8.98
ping 10.19.8.99
ping 209.165.201.1
ping 2001:db8:acad:a::1
ping 2001:db8:acad:b::1
ping 2001:db8:acad:c::1
ping 2001:db8:acad:c::98
ping 2001:db8:acad:c::99
ping 2001:db8:acad:209::1

Troubleshooting flowchart

PC did not get DHCP?

Check access VLAN, trunk to router, router subinterface, DHCP excluded-address range, and whether R1 G0/0/1 is no shutdown.

show vlan brief
show interfaces trunk
show ip dhcp binding
show running-config | section dhcp

Switch management cannot ping?

Check SVI VLAN 4 IP, default-gateway 10.19.8.97, VLAN 4 exists, trunks allow VLAN 4, and R1 subinterface G0/0/1.4 is up.

show ip interface brief
show vlan brief
show interfaces trunk

EtherChannel not forming?

Both physical links need matching settings. Same trunk mode, native VLAN, allowed VLANs, speed/duplex if configured, and same channel-group mode.

show etherchannel summary
show run interface f0/1
show run interface f0/2

IPv6 ping fails?

Check ipv6 unicast-routing on R1, correct IPv6 address on subinterfaces, correct PC IPv6 address, and gateway set to fe80::1.

show ipv6 interface brief
show ipv6 route

Interactive quiz

Flashcards

Tap to start

Quick memory drill for exam day.

Final exam-day order

Erase/reload devices, set switch SDM if needed.
Configure R1 basic security, SSH, IPv6 routing, subinterfaces, loopback.
Configure S1 and S2 basic security, SSH, management SVI, default gateway.
Create VLANs on both switches.
Configure trunks and EtherChannel.
Configure PC access ports and port-security.
Park and shut down unused ports.
Configure DHCP and default routes on R1.
Configure PCs: IPv4 DHCP, IPv6 static.
Verify with show commands and pings.