ADVANCED CCIE RS LAB v2.0

Enterprise Network Design
MPLS Core · Dual DMVPN · MP-BGP · 6PE

Original 20-router topology with MPLS VPN backbone, dual-region DMVPN Phase 3, BGP route reflection, OSPFv3, EIGRP named mode, MPLS-TE, multicast, QoS, and IPv6 6PE. All protocols running simultaneously.

⬡ MPLS CORE — 4 P Routers ⬡ PROVIDER EDGE — 4 PE Routers ⬡ INTERNET BORDER — 2 ASBR ⬡ DMVPN WEST — 5 Routers ⬡ DMVPN EAST — 5 Routers ⬡ CUSTOMER EDGE — 2 CE
20
Routers
20
Lab Scenarios
12+
Protocols
AS 65000
MPLS Domain
Dual-Stack
IPv4 + IPv6

Master Topology — Full 20-Router Diagram

MPLS CORE DMVPN WEST DMVPN EAST CUSTOMER EDGE & INTERNET BORDER CORE-1 10.255.1.1 CORE-2 10.255.1.2 CORE-3 10.255.1.3 CORE-4 10.255.1.4 10.0.12.0/31 10.0.13.0/31 10.0.24.0/31 10.0.34.0/31 EDGE-1 10.255.2.1 10.0.101.0/31 EDGE-2 10.255.2.2 10.0.102.0/31 EDGE-3 10.255.2.3 10.0.103.0/31 EDGE-4 10.255.2.4 10.0.104.0/31 BORDER-1 10.255.3.1 10.0.201.0/31 BORDER-2 10.255.3.2 10.0.204.0/31 CE-CORP-1 10.255.6.1 10.1.100.0/31 CE-CORP-2 10.255.6.2 10.1.200.0/31 HUB-WC-1 10.255.4.1 10.0.210.0/31 HUB-WC-2 10.255.4.2 10.0.211.0/31 SPK-WC-1 172.16.10.1 SPK-WC-2 172.16.10.2 SPK-WC-3 172.16.10.3 HUB-EC-1 10.255.5.1 10.0.220.0/31 HUB-EC-2 10.255.5.2 10.0.221.0/31 SPK-EC-1 172.16.20.1 SPK-EC-2 172.16.20.2 SPK-EC-3 172.16.20.3 LEGEND MPLS Core (P Routers) Provider Edge (PE) Border (ASBR/eBGP) DMVPN Hub DMVPN Spoke Customer Edge (CE) Physical Link DMVPN Tunnel Advanced CCIE RS Lab — 20-Router Enterprise Topology MPLS Core · VPNv4 · Dual DMVPN Phase 3 · MP-BGP · OSPFv3 · 6PE · EIGRP Named Mode Ioannis (John) Alexander Konstas — Cybersecurity & Infrastructure Engineer · Miami, FL AS 65000 — MP-BGP VPNv4 · LDP · OSPF Area 0 172.16.10.0/24 172.16.20.0/24
⚠ This lab is provided for technical reference and educational purposes only. Ioannis (John) Alexander Konstas assumes no responsibility for use in production environments. All configurations are original designs for GNS3/EVE-NG simulation. No passwords, IP addresses, or topology elements are derived from any third-party source.

Lab Scenarios — 20 Labs

MPLS Core & VPN (Labs 01–05)
LAB 01
MPLS Core LDP Label Distribution
LDP neighbor authentication, custom label range 1000–9999, BFD fast detection, OSPF area 0 backbone with autoconfig.
MPLS LDP OSPF Area 0 BFD
Open Lab → CORE-1 · CORE-2 · CORE-3 · CORE-4
LAB 02
MPLS L3VPN — VRF CORP End-to-End
VRF CORP RD 65000:100, PE-CE OSPF redistribution, MP-BGP VPNv4, route-target import/export, CE-to-CE ping verification.
MPLS VPN VRF MP-BGP VPNv4
Open Lab → EDGE-1 · EDGE-4 · CE-CORP-1/2
LAB 03
MPLS VPN — PE-CE BGP with AS Override
PE-CE BGP session, AS override to solve same-AS problem, allow-as-in on CE, prefix filtering with maximum-prefix safety.
PE-CE BGP AS Override AS 65500
Open Lab → EDGE-1 · EDGE-4 · CE-CORP-1/2
LAB 04
MPLS VPN — VRF Internet Access
Route leaking from global to VRF, NAT for VRF customers, import map with internet RT 65000:9999, static default in VRF.
Route Leaking NAT Default Route
Open Lab → EDGE-1 · BORDER-1 · CE-CORP-1
LAB 05
MPLS VPN — OSPF Sham-Link
Backdoor link suppression using sham-link, loopback VRF CORP, area sham-link config on ABR, intra-area preference verification.
Sham-Link OSPF Backdoor
Open Lab → EDGE-1 · EDGE-4 · CE-CORP-1/2
DMVPN Phase 3 (Labs 06–08)
LAB 06
DMVPN Phase 3 — West Region Dual-Hub
mGRE multipoint tunnel, NHRP Phase 3 shortcut, dual NHS priority/cluster redundancy, spoke-to-spoke shortcut verification.
DMVPN Phase 3 NHRP mGRE
Open Lab → HUB-WC-1/2 · SPK-WC-1/2/3
LAB 07
DMVPN Phase 3 — East Region with QoS
DMVPN East region, EIGRP named mode, bandwidth/delay tuning, DSCP classification, LLQ voice priority on Tunnel0.
DMVPN Phase 3 QoS DSCP
Open Lab → HUB-EC-1/2 · SPK-EC-1/2/3
LAB 08
DMVPN EIGRP — Summarization and Stub
Hub summary injection toward core, spoke stub mode, leak-map for selective prefix advertisement, split-horizon on hub tunnel.
EIGRP Stub Leak-Map
Open Lab → HUB-WC-1 · SPK-WC-1/2/3
BGP Advanced (Labs 09–12)
LAB 09
BGP Route Reflection
CORE-1/2 as co-RRs in cluster 1, client peer-groups, ORIGINATOR_ID and CLUSTER_LIST verification, non-client full mesh.
Route Reflector MP-BGP Cluster
Open Lab → CORE-1/2 · All EDGE/BORDER
LAB 10
BGP Confederation
Sub-AS 65010/65020/65030 structure, confederation identifier 65000, EBGP between sub-ASs, AS-path confederation segment verification.
Confederation Sub-AS AS-Path
Open Lab → CORE-1/2/3/4 · EDGE-1/4
LAB 11
BGP Communities — Policy Control
Community tagging at BORDER routers, community-list matching at CORE, local-pref policy centralization, send-community configuration.
Communities Local-Pref Route Maps
Open Lab → BORDER-1/2 · EDGE-1/4 · CORE-1
LAB 12
BGP Prefix Filtering — ORF
Prefix-list with ge/le operators, ORF capability negotiation, distribute-list comparison, maximum-prefix safety limits.
Prefix-List ORF Security
Open Lab → BORDER-1/2 · EDGE-1/4
OSPF, EIGRP & IPv6 (Labs 13–15)
LAB 13
OSPF Multi-Area — Stub, NSSA, Filtering
Totally-stubby areas on CE segments, NSSA for ASBR CE redistribution, Type-3 LSA filtering at ABR, area filter-list.
OSPF NSSA LSA Filter
Open Lab → EDGE-1/4 · CE-CORP-1/2
LAB 14
OSPFv3 Dual-Stack IPv6 Backbone
OSPFv3 area 0 on backbone, IPsec AH authentication, dual-stack parallel to OSPFv2, BFD for IPv6 adjacencies, LSA types 8 and 9.
OSPFv3 IPv6 Dual-Stack
Open Lab → CORE-1/2/3/4 · EDGE-1/4
LAB 15
EIGRP Named Mode — Wide Metrics
address-family IPv4+IPv6 under named EIGRP, wide 64-bit metrics, af-interface per-AF tuning, stub control per address-family.
EIGRP Named Wide Metrics IPv4+IPv6
Open Lab → HUB-WC-1/2 · SPK-WC-1/2/3
Traffic Engineering & Advanced (Labs 16–20)
LAB 16
MPLS Traffic Engineering — TE Tunnels
RSVP bandwidth reservation, explicit path CORE-1→CORE-4, auto-bandwidth, OSPF-TE opaque LSAs, CSPF path computation.
MPLS TE RSVP Explicit Path
Open Lab → CORE-1/2/3/4
LAB 17
Multicast PIM-SM — Auto-RP and MSDP
RP on CORE-2, Auto-RP and BSR redundancy, shared tree vs SPT switchover, MSDP between BORDER-1 and BORDER-2 for inter-domain multicast.
PIM-SM Auto-RP MSDP
Open Lab → CORE-2 · BORDER-1/2 · EDGE-1/4
LAB 18
QoS on DMVPN — HQoS and Shaping
Hierarchical QoS with parent shaper + child CBWFQ/LLQ, DSCP trust boundary, voice EF strict priority, per-AF bandwidth allocation.
QoS/HQoS DSCP LLQ
Open Lab → SPK-WC-1/2/3 · HUB-WC-1
LAB 19
6PE — IPv6 over MPLS without P IPv6
mpls ipv6 source-interface, iBGP labeled IPv6 unicast, two-label stack (transport + IPv6), CE-to-CE IPv6 reachability via IPv4 MPLS.
6PE Labeled Unicast IPv6
Open Lab → EDGE-1/4 · CORE-1/2 · CE-CORP-1/2
LAB 20 — CAPSTONE
Full Integration — All 20 Routers
All protocols running simultaneously: MPLS VPN + DMVPN Phase 3 + MP-BGP + OSPFv3 + EIGRP Named + Multicast + QoS + 6PE. Systematic verification checklist.
MPLS VPN DMVPN MP-BGP Multicast QoS 6PE
Open Capstone Lab → ALL 20 ROUTERS
⬡
Ioannis (John) Alexander Konstas
Cybersecurity & Infrastructure Engineer · Miami, FL · 10+ years enterprise
Cisco MPLS BGP DMVPN WireGuard Snort Wazuh VMware Telecom HF Radio

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.