M01 - The Divided Network (Capstone)

Lab brief & addressing

The Mission

Your company just bought another company. Your network runs OSPF (R1–R2–R3–R5, three areas). Theirs runs EIGRP (R2–R4–R6–R5). Nobody gets to re-address or re-protocol anything — the merger must work as-is, and every loopback must reach every other loopback by the end.

Three separate problems stand between you and that goal, and each one is a classic exam scenario in its own right:

Area 2 is illegal. It hangs off area 1 with no connection to the backbone. OSPF's rules say its routes go nowhere — you will watch that happen in the LSDB, then fix it with a virtual link.
The two domains can't hear each other. You will join them with mutual redistribution — and step on the most famous landmine in redistribution (the missing seed metric) on purpose, so you recognise its silence forever.
There are two border routers, not one. R2 and R5 both speak both protocols. Two crossing points mean a route can leave its home domain, ride around the other one, and try to sneak back in. You will stop that with route tags — and then read your own tags inside the raw LSAs to prove they're really there.

Finally you will break it the way real networks break: the virtual link gets deleted in a config cleanup — and the network keeps working, silently, over a path nobody designed. Finding that is the capstone's capstone.

You'll be able to

Build multi-area OSPF and prove from the LSDB (not just the routing table) which LSAs exist in which area and why.
Explain the backbone rule — why an area with no area-0 connection is cut off — and repair it with area 1 virtual-link.
Read a virtual link's special properties: transit area, demand circuit, DoNotAge (DNA) LSAs, suppressed hellos.
Run EIGRP with manual summarization and explain the Null0 discard route it creates.
Decode EIGRP's composite metric by hand and verify it against show ip eigrp topology.
Redistribute in both directions at two border routers, seed metrics done right — and explain why EIGRP silently ignores redistribution without one.
Read O E2 vs D EX routes: who sets metric 20, why AD 170 exists, what "forward metric" means.
Implement tag-based loop prevention with route-maps and verify the tags inside type-5 LSAs and EIGRP external data.
Recognise a backdoor path: a failure that doesn't break connectivity, only re-routes it — and why that's more dangerous than an outage.

Before you start

You should have finished C07, C14, E03 and E08. This lab assumes those skills and combines all of them.
Six IOSv routers. Give the topology 5 minutes to boot before you start.
Budget a real session — this is a 3–4 hour build. It saves cleanly at any act boundary (write memory).

Addressing plan

Link	Subnet	Addresses	Domain
R1 Gi0/0 – R2 Gi0/0	10.0.12.0/30	.1 / .2	OSPF area 0
R1 Gi0/1 – R3 Gi0/0	10.0.13.0/30	.1 / .2	OSPF area 1
R3 Gi0/1 – R5 Gi0/0	10.0.35.0/30	.1 / .2	OSPF area 2
R2 Gi0/1 – R4 Gi0/0	10.0.24.0/30	.1 / .2	EIGRP 100
R4 Gi0/1 – R6 Gi0/0	10.0.46.0/30	.1 / .2	EIGRP 100
R5 Gi0/1 – R6 Gi0/1	10.0.56.0/30	.1 / .2	EIGRP 100

Every router also has Loopback0 = n.n.n.n/32 (R1 = 1.1.1.1, … R6 = 6.6.6.6). R6 additionally carries Lo1–Lo4 = 172.16.0.1/24 through 172.16.3.1/24 — four "branch LANs" you will summarise into one /22.

Note who lives where: R2 is in OSPF area 0 and EIGRP. R5 is in OSPF area 2 and EIGRP. Those two are your border routers, and the fact that there are two of them drives the entire second half of the lab.

The one idea behind this lab

Every routing protocol is a rumor mill with its own language and its own rules for whom to trust. OSPF routers share a database of link-state advertisements and all compute paths from the same map; EIGRP routers exchange distance vectors and trust arithmetic done by their neighbors. The two never talk to each other — a router running both simply keeps two separate brains.

Redistribution is you, the operator, standing between the two brains and repeating what one said to the other. Three consequences follow, and all three are this lab:

Translation loses meaning. An OSPF cost can't be converted to an EIGRP metric — the units don't exist in the other language. You must invent a starting value (the seed metric), and if you don't, EIGRP assumes the worst value possible: infinity. Infinity means "unreachable," so it advertises nothing — silently.
Repeated rumors can circle back. With two border routers, a route redistributed into the other domain at R2 can travel around and present itself to R5 for re-import into the domain it came from. If it wins there, traffic loops. The fix is to mark every translated route with a tag and refuse to translate anything carrying your own tag.
Administrative distance is the referee. When one router knows the same prefix from both brains, AD decides: OSPF 110, EIGRP internal 90, EIGRP external 170. That 170 is not an accident — it exists precisely so that recycled, twice-translated routes lose to fresh ones. You will watch AD make three different calls in this lab, and by the end you'll be able to predict each one.

Why this matters for ENCOR: multi-area OSPF design, virtual links, EIGRP metrics, redistribution mechanics, route-maps, tags and AD are each their own exam topic — but the exam's hardest questions combine them, exactly like a merger does. If you can build this lab and explain every table in it, the routing half of ENCOR holds no surprises.

Act I — See & Do OSPF with an illegal area

We build the OSPF side first — and we build it with a design flaw that looks completely reasonable on the diagram: area 0 between R1–R2, area 1 between R1–R3, and area 2 between R3–R5. Chained areas. What could go wrong?

Step 1 — Configure the four OSPF routers

Type these exactly. The 0.0.0.0 wildcard means "this one interface address only" — the most precise way to place interfaces into areas, and the style that avoids surprises when interfaces are added later.

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 10.0.12.1 0.0.0.0 area 0
R1(config-router)# network 1.1.1.1 0.0.0.0 area 0
R1(config-router)# network 10.0.13.1 0.0.0.0 area 1   ! R1 touches areas 0 and 1 -> it is an ABR

R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# network 10.0.12.2 0.0.0.0 area 0
R2(config-router)# network 2.2.2.2 0.0.0.0 area 0

R3(config)# router ospf 1
R3(config-router)# router-id 3.3.3.3
R3(config-router)# network 10.0.13.2 0.0.0.0 area 1
R3(config-router)# network 3.3.3.3 0.0.0.0 area 1
R3(config-router)# network 10.0.35.1 0.0.0.0 area 2   ! R3 touches areas 1 and 2 -- but NOT area 0

R5(config)# router ospf 1
R5(config-router)# router-id 5.5.5.5
R5(config-router)# network 10.0.35.2 0.0.0.0 area 2
R5(config-router)# network 5.5.5.5 0.0.0.0 area 2

Within a minute the console logs confirm adjacencies. Real output from this build:

*Jul  5 05:40:43.339: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Jul  5 05:40:49.935: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on GigabitEthernet0/1 from LOADING to FULL, Loading Done

R1#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           1   FULL/DR         00:00:35    10.0.12.2       GigabitEthernet0/0
3.3.3.3           1   FULL/DR         00:00:39    10.0.13.2       GigabitEthernet0/1

R3#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
1.1.1.1           1   FULL/BDR        00:00:37    10.0.13.1       GigabitEthernet0/0
5.5.5.5           1   FULL/DR         00:00:39    10.0.35.2       GigabitEthernet0/1

Read it like an examiner: every neighbor is FULL — databases fully synchronised. All four adjacencies exist. Nothing about the neighbor table is wrong, and that is the trap: adjacency health tells you nothing about route propagation. The flaw in this network is invisible at this layer.

Step 2 — Find the missing routes

Ask R2 (deep in area 0) what OSPF has taught it:

R2#show ip route ospf
      1.0.0.0/32 is subnetted, 1 subnets
O        1.1.1.1 [110/2] via 10.0.12.1, 00:00:23, GigabitEthernet0/0
      3.0.0.0/32 is subnetted, 1 subnets
O IA     3.3.3.3 [110/3] via 10.0.12.1, 00:00:20, GigabitEthernet0/0
      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
O IA     10.0.13.0/30 [110/2] via 10.0.12.1, 00:00:23, GigabitEthernet0/0

Decode each line. O 1.1.1.1 [110/2]: plain O = intra-area, same area as R2; AD 110, cost 2 (1 for the GigabitEthernet hop + 1 for R1's loopback). O IA 3.3.3.3 [110/3]: IA = inter-area — this route crossed an area boundary. R1, as the Area Border Router, translated area 1's routes into type-3 summary LSAs and injected them into area 0. So far the machinery works.

Now look at what is not there: no 5.5.5.5, no 10.0.35.0/30. Everything that lives in area 2 is missing. And on R5 it's worse — ask it for its OSPF routes:

R5#show ip route
      5.0.0.0/32 is subnetted, 1 subnets
C        5.5.5.5 is directly connected, Loopback0
      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C        10.0.35.0/30 is directly connected, GigabitEthernet0/0
C        10.0.56.0/30 is directly connected, GigabitEthernet0/1
L        ...

R5 has a FULL adjacency with R3 and zero OSPF routes. Not one. It can't even reach R3's loopback one hop away. Confirm the damage end to end:

R2#ping 5.5.5.5
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Step 3 — Prove why from the database

The routing table shows the symptom. The LSDB shows the cause. First R3's database — R3 sits on both sides of the break, so it can see everything:

R3#show ip ospf database

            OSPF Router with ID (3.3.3.3) (Process ID 1)

		Router Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         35          0x80000004 0x009263 1
3.3.3.3         3.3.3.3         27          0x80000004 0x004781 2

		Net Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum
10.0.13.2       3.3.3.3         42          0x80000001 0x00A562

		Summary Net Link States (Area 1)

Link ID         ADV Router      Age         Seq#       Checksum
1.1.1.1         1.1.1.1         95          0x80000001 0x0047EC
2.2.2.2         1.1.1.1         42          0x80000001 0x00230C
10.0.12.0       1.1.1.1         95          0x80000001 0x005CC8

		Router Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum Link count
3.3.3.3         3.3.3.3         26          0x80000004 0x00DCDD 1
5.5.5.5         5.5.5.5         24          0x80000005 0x00E89A 2

		Net Link States (Area 2)

Link ID         ADV Router      Age         Seq#       Checksum
10.0.35.2       5.5.5.5         35          0x80000001 0x001FBA

Read the sections. Router Link States = type-1 LSAs, one per router per area, describing that router's own links. Net Link States = type-2, generated by the DR on each multi-access segment. Summary Net Link States = type-3, made only by ABRs, carrying routes between areas. Now the key observation, in two halves:

Area 1's section has type-3 LSAs (1.1.1.1, 2.2.2.2, 10.0.12.0) — all advertised by R1, the working ABR, describing area 0's contents.
Area 2's section has type-1 and type-2 and nothing else. No summary LSAs at all. Nobody is translating routes into or out of area 2.

But R3 borders areas 1 and 2 — shouldn't R3 be the ABR doing that? Ask it directly:

R3#show ip ospf | include It is|Number of areas
 Number of areas in this router is 2. 2 normal 0 stub 0 nssa

R1#show ip ospf | include It is|Number of areas
 It is an area border router
 Number of areas in this router is 2. 2 normal 0 stub 0 nssa

Both routers touch two areas, but only R1 says It is an area border router. R3 doesn't claim the title, and it's not being modest — it's following the rule this whole act exists to teach:

The backbone rule. A router is only a functioning ABR if one of its areas is area 0. All inter-area traffic must transit the backbone: area 2 → area 0 → area 1, never area 2 → area 1 directly. This is OSPF's loop-prevention design — areas form a star around the backbone, so inter-area routing can never loop. R3 touches areas 1 and 2, neither of which is area 0, so IOS simply refuses to generate type-3 LSAs between them. No error message, no log — the LSAs just don't exist. Area 2 is stranded.

Step 4 — The legal fix: a virtual link

The proper fix would be re-designing so area 2 touches area 0 physically. When that's impossible (merger, geography, budget), OSPF offers a virtual link: a logical extension of area 0 that runs through area 1, from R1 to R3. Once it's up, R3 is connected to the backbone — through the tunnel-like link — and becomes a real ABR. A virtual link is configured between router IDs (not interface addresses), on both ends, naming the transit area it crosses:

R1(config)# router ospf 1
R1(config-router)# area 1 virtual-link 3.3.3.3   ! through area 1, to router-id 3.3.3.3

R3(config)# router ospf 1
R3(config-router)# area 1 virtual-link 1.1.1.1

*Jul  5 05:41:44.514: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on OSPF_VL1 from LOADING to FULL, Loading Done

A new adjacency formed — note the interface name: OSPF_VL1, a virtual interface. Inspect it:

R1#show ip ospf virtual-links
Virtual Link OSPF_VL1 to router 3.3.3.3 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/1
 Topology-MTID    Cost    Disabled     Shutdown      Topology Name
        0           1         no          no            Base
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:04
    Adjacency State FULL (Hello suppressed)

Three details in that output are exam favourites:

Transit area 1 — the virtual link is carried across area 1's topology; if area 1 breaks, the virtual link breaks with it.
Run as demand circuit + Hello suppressed — virtual links don't send periodic hellos once FULL. Remember this: it means a dead virtual link can take a long time to be noticed. That fact returns to haunt us in the Break & Fix.
DoNotAge LSA allowed — LSAs learned over the link are marked DNA so they don't age out despite the lack of periodic refresh across the demand circuit.

And R3's self-image has changed:

R3#show ip ospf | include It is|Number of areas
 It is an area border router
 Number of areas in this router is 3. 3 normal 0 stub 0 nssa
 Number of areas transit capable is 1

It is an area border router — and it now counts 3 areas: area 1, area 2, and area 0 via the virtual link. That third membership is exactly what the backbone rule demanded.

Step 5 — Verify area 2 has joined the network

R2#show ip route ospf
      1.0.0.0/32 is subnetted, 1 subnets
O        1.1.1.1 [110/2] via 10.0.12.1, 00:01:34, GigabitEthernet0/0
      3.0.0.0/32 is subnetted, 1 subnets
O IA     3.3.3.3 [110/3] via 10.0.12.1, 00:00:32, GigabitEthernet0/0
      5.0.0.0/32 is subnetted, 1 subnets
O IA     5.5.5.5 [110/4] via 10.0.12.1, 00:00:32, GigabitEthernet0/0
      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
O IA     10.0.13.0/30 [110/2] via 10.0.12.1, 00:01:34, GigabitEthernet0/0
O IA     10.0.35.0/30 [110/3] via 10.0.12.1, 00:00:32, GigabitEthernet0/0

R2#ping 5.5.5.5
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/11 ms

5.5.5.5 [110/4]: cost 4 = R2→R1 (1) + R1→R3 (1) + R3→R5 (1) + loopback (1). The path crosses three areas, legally, because the middle of it is now backbone. One more look at R2's database shows who is advertising the new summaries — and the DNA flag from the demand circuit:

R2#show ip ospf database | begin Summary
		Summary Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
3.3.3.3         1.1.1.1         112         0x80000001 0x00F436
3.3.3.3         3.3.3.3         3     (DNA) 0x80000001 0x00AE75
5.5.5.5         3.3.3.3         3     (DNA) 0x80000001 0x005CBE
10.0.13.0       1.1.1.1         165         0x80000001 0x0051D2
10.0.13.0       3.3.3.3         3     (DNA) 0x80000001 0x001507
10.0.35.0       3.3.3.3         3     (DNA) 0x80000001 0x0022E3

Milestone. R3 now originates type-3 LSAs into area 0 (advertising router 3.3.3.3), and they carry (DNA) — DoNotAge — because they arrived over the demand-circuit virtual link. The OSPF kingdom is whole. The EIGRP kingdom doesn't exist yet — that's Act II.

Act II — See & Do The EIGRP kingdom and the /22 summary

Now the acquired company's network: R2–R4–R6–R5 run EIGRP AS 100. Note carefully which interfaces join: on R2 and R5 only the EIGRP-facing interface goes into EIGRP. Their OSPF interfaces stay out. One router, two brains, no mixing — yet.

Step 1 — Configure EIGRP AS 100

R2(config)# router eigrp 100
R2(config-router)# eigrp router-id 2.2.2.2
R2(config-router)# network 10.0.24.1 0.0.0.0        ! ONLY the R4-facing link

R4(config)# router eigrp 100
R4(config-router)# eigrp router-id 4.4.4.4
R4(config-router)# network 10.0.24.2 0.0.0.0
R4(config-router)# network 10.0.46.1 0.0.0.0
R4(config-router)# network 4.4.4.4 0.0.0.0

R5(config)# router eigrp 100
R5(config-router)# eigrp router-id 5.5.5.5
R5(config-router)# network 10.0.56.1 0.0.0.0        ! ONLY the R6-facing link

R6(config)# router eigrp 100
R6(config-router)# eigrp router-id 6.6.6.6
R6(config-router)# network 10.0.46.2 0.0.0.0
R6(config-router)# network 10.0.56.2 0.0.0.0
R6(config-router)# network 6.6.6.6 0.0.0.0
R6(config-router)# network 172.16.0.1 0.0.0.0
R6(config-router)# network 172.16.1.1 0.0.0.0
R6(config-router)# network 172.16.2.1 0.0.0.0
R6(config-router)# network 172.16.3.1 0.0.0.0

R4#show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
1   10.0.46.2               Gi0/1                    12 00:00:30    9   100  0  16
0   10.0.24.1               Gi0/0                    11 00:00:44    7   100  0  10

R4 hears R2 and R6; R6 also peers with R5. Before summarising, look at what R4 learned — four separate branch prefixes from R6:

R4#show ip route eigrp
      6.0.0.0/32 is subnetted, 1 subnets
D        6.6.6.6 [90/130816] via 10.0.46.2, 00:00:28, GigabitEthernet0/1
      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
D        10.0.56.0/30 [90/3072] via 10.0.46.2, 00:00:31, GigabitEthernet0/1
      172.16.0.0/24 is subnetted, 4 subnets
D        172.16.0.0 [90/130816] via 10.0.46.2, 00:00:27, GigabitEthernet0/1
D        172.16.1.0 [90/130816] via 10.0.46.2, 00:00:26, GigabitEthernet0/1
D        172.16.2.0 [90/130816] via 10.0.46.2, 00:00:25, GigabitEthernet0/1
D        172.16.3.0 [90/130816] via 10.0.46.2, 00:00:24, GigabitEthernet0/1

Check the metric yourself. EIGRP's classic composite (default K-values) is 256 × (10⁷/min-bandwidth-kbit + total-delay-μs/10). For a loopback behind one GigabitEthernet hop: bandwidth term = 10⁷/1,000,000 = 10; delay = 10 μs (the Gig link) + 5000 μs (loopback) = 5010 μs → 501. So 256 × (10 + 501) = 130816. Exactly what the table shows. If you can reproduce that arithmetic, EIGRP metrics hold no fear.

Step 2 — Summarise the four branches into one /22

172.16.0.0/24 through 172.16.3.0/24 pack perfectly into 172.16.0.0/22 (four /24s = one /22; check: /22 spans .0.0–.3.255). EIGRP summarises per interface, on the advertising router:

R6(config)# interface Gi0/0
R6(config-if)# ip summary-address eigrp 100 172.16.0.0 255.255.252.0
R6(config-if)# interface Gi0/1
R6(config-if)# ip summary-address eigrp 100 172.16.0.0 255.255.252.0

R4#show ip route eigrp
      6.0.0.0/32 is subnetted, 1 subnets
D        6.6.6.6 [90/130816] via 10.0.46.2, 00:00:55, GigabitEthernet0/1
      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
D        10.0.56.0/30 [90/3072] via 10.0.46.2, 00:00:58, GigabitEthernet0/1
      172.16.0.0/22 is subnetted, 1 subnets
D        172.16.0.0 [90/130816] via 10.0.46.2, 00:00:22, GigabitEthernet0/1

R6#show ip route | include Null0
D        172.16.0.0/22 is a summary, 00:00:24, Null0

Four routes became one on every other router — and R6 grew a strange new route of its own: the /22 pointing at Null0. That discard route is not a bug. If a packet arrives at R6 for, say, 172.16.2.77 and no more-specific /24 matches (imagine Lo3 goes down), the Null0 route swallows it. Without it, R6 would fall back to a less-specific route — potentially right back where the packet came from, creating a loop between R6 and its neighbor. Summary + discard route travel together, always.

Zoom into the summary's topology entry on R4 — this output pattern returns at every important moment in this lab:

R4#show ip eigrp topology 172.16.0.0/22
EIGRP-IPv4 Topology Entry for AS(100)/ID(4.4.4.4) for 172.16.0.0/22
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 130816
  Descriptor Blocks:
  10.0.46.2 (GigabitEthernet0/1), from 10.0.46.2, Send flag is 0x0
      Composite metric is (130816/128256), route is Internal
      Vector metric:
        Minimum bandwidth is 1000000 Kbit
        Total delay is 5010 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
        Originating router is 6.6.6.6

route is Internal — born inside EIGRP AS 100. (130816/128256) = feasible distance / reported distance, the numbers you learned to read in C14. File the word "Internal" away: in Act III a second kind appears.

Step 3 — Stand at the border and look both ways

R2 now holds both worlds in one routing table — but they don't touch:

R2#show ip route
      1.0.0.0/32 is subnetted, 1 subnets
O        1.1.1.1 [110/2] via 10.0.12.1, 00:03:45, GigabitEthernet0/0
      3.0.0.0/32 is subnetted, 1 subnets
O IA     3.3.3.3 [110/3] via 10.0.12.1, 00:02:43, GigabitEthernet0/0
      4.0.0.0/32 is subnetted, 1 subnets
D        4.4.4.4 [90/130816] via 10.0.24.2, 00:01:18, GigabitEthernet0/1
      5.0.0.0/32 is subnetted, 1 subnets
O IA     5.5.5.5 [110/4] via 10.0.12.1, 00:02:43, GigabitEthernet0/0
      6.0.0.0/32 is subnetted, 1 subnets
D        6.6.6.6 [90/131072] via 10.0.24.2, 00:01:03, GigabitEthernet0/1
      ...
      172.16.0.0/22 is subnetted, 1 subnets
D        172.16.0.0 [90/131072] via 10.0.24.2, 00:00:30, GigabitEthernet0/1

O routes out one door, D routes out the other. R2 itself can reach everything — it's standing in both rooms. But R4, one hop away, knows only its own room:

R4#ping 1.1.1.1
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Ships in the night. Running two protocols on one router does nothing by itself. No route ever moves from one protocol's database to the other without explicit redistribution. R4 has no route to 1.1.1.1 at all — the ping dies instantly with ....., not even a timeout pattern from a partial path.

Act III — See & Do Redistribution — stepping on the landmine first

Time to introduce the two kingdoms. We'll do it at R2 first, and we'll make the single most common redistribution mistake on purpose, because its failure signature is silence and you need to have heard that silence once before the exam — or before a 2 a.m. change window.

Step 1 — The classic mistake: no seed metric

R2(config)# router eigrp 100
R2(config-router)# redistribute ospf 1        ! looks fine. IOS accepts it. nothing works.

The command is accepted without a murmur. Wait, then check R4 for the OSPF world's prefixes:

R4#show ip route eigrp
      6.0.0.0/32 is subnetted, 1 subnets
D        6.6.6.6 [90/130816] via 10.0.46.2, 00:02:00, GigabitEthernet0/1
      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
D        10.0.56.0/30 [90/3072] via 10.0.46.2, 00:02:03, GigabitEthernet0/1
      172.16.0.0/22 is subnetted, 1 subnets
D        172.16.0.0 [90/130816] via 10.0.46.2, 00:01:27, GigabitEthernet0/1

R2#show ip eigrp topology 1.1.1.1/32
EIGRP-IPv4 Topology Entry for AS(100)/ID(2.2.2.2)
%Entry 1.1.1.1/32 not in topology table

Nothing. Not even in R2's own EIGRP topology table — the redistribution is failing on the very router configured to do it, before a single packet leaves the box. Why: OSPF's cost has no translation into EIGRP's five-part vector metric, so EIGRP assigns the redistributed routes its default seed metric — which is infinity. Infinite metric = unreachable = not eligible for the topology table. No error, no log. Silence.

Protocol asymmetry worth memorising: OSPF is forgiving in the other direction — redistribute eigrp 100 subnets without a metric quietly uses a default seed of 20. EIGRP is the strict one: no seed metric, no routes. (RIP behaves like EIGRP; BGP->IGP has its own rules. The exam loves this table.)

Step 2 — Redistribute properly, both directions

Give EIGRP an explicit seed: bandwidth 1000000 kbit, delay 10 (tens of μs), reliability 255, load 1, MTU 1500 — "pretend these routes live behind a healthy Gigabit link". And redistribute EIGRP into OSPF with subnets (without that keyword, classless prefixes are skipped — landmine number two, stepped around this time):

R2(config)# router eigrp 100
R2(config-router)# redistribute ospf 1 metric 1000000 10 255 1 1500
R2(config-router)# router ospf 1
R2(config-router)# redistribute eigrp 100 subnets

R4#show ip route eigrp
      1.0.0.0/32 is subnetted, 1 subnets
D EX     1.1.1.1 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0
      2.0.0.0/32 is subnetted, 1 subnets
D EX     2.2.2.2 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0
      3.0.0.0/32 is subnetted, 1 subnets
D EX     3.3.3.3 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0
      5.0.0.0/32 is subnetted, 1 subnets
D EX     5.5.5.5 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0
      ...
D EX     10.0.12.0/30 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0
D EX     10.0.13.0/30 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0
D EX     10.0.35.0/30 [170/5376] via 10.0.24.1, 00:00:30, GigabitEthernet0/0

R4#ping 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 6/7/8 ms

Everything about that first line matters:

D EX — EIGRP external. The route was not born in AS 100; it immigrated.
[170/...] — external AD is 170, not 90. EIGRP deliberately distrusts immigrant routes. This single design decision will quietly save the network in Act IV — watch for it.
5376 — your seed metric, computed: 256 × (10⁷/1,000,000 + 110/10) = 256 × (10 + 11) = 5376. The 110 μs = your seeded 100 μs + 10 μs for the R2–R4 link. The arithmetic still works; only the starting values are invented.

Now the OSPF side of the translation. On R1:

R1#show ip route ospf
      ...
O E2     4.4.4.4 [110/20] via 10.0.12.2, 00:00:27, GigabitEthernet0/0
O E2     6.6.6.6 [110/20] via 10.0.12.2, 00:00:27, GigabitEthernet0/0
O E2     10.0.24.0/30 [110/20] via 10.0.12.2, 00:00:27, GigabitEthernet0/0
O E2     10.0.46.0/30 [110/20] via 10.0.12.2, 00:00:27, GigabitEthernet0/0
O E2     10.0.56.0/30 [110/20] via 10.0.12.2, 00:00:27, GigabitEthernet0/0
      172.16.0.0/22 is subnetted, 1 subnets
O E2     172.16.0.0 [110/20] via 10.0.12.2, 00:00:27, GigabitEthernet0/0

R1#show ip route 172.16.0.0 255.255.252.0
Routing entry for 172.16.0.0/22
  Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 1

O E2 = OSPF external, type 2 (the default): metric is fixed at 20 everywhere in the domain — it does not grow hop by hop. The internal cost to reach the ASBR is tracked separately as forward metric 1. (Type 1 externals, E1, add internal cost to external metric; use them when you need routers to prefer the nearer exit.) The summary /22 crossed protocols intact — summarisation done in EIGRP survives translation into OSPF.

Proof the whole chain works, from the far EIGRP edge across both domains:

R6#traceroute 1.1.1.1 numeric
  1 10.0.46.1 7 msec 5 msec 3 msec
  2 10.0.24.1 5 msec 7 msec 9 msec
  3 10.0.12.1 11 msec 8 msec 9 msec

R6 → R4 → R2 (the border) → R1. Clean.

Step 3 — The second border: R5 joins the game

One border router is a design with a single point of failure. Add the same mutual redistribution at R5:

R5(config)# router eigrp 100
R5(config-router)# redistribute ospf 1 metric 1000000 10 255 1 1500
R5(config-router)# router ospf 1
R5(config-router)# redistribute eigrp 100 subnets

Now look at R1's external LSAs — every EIGRP prefix appears twice:

R1#show ip ospf database | begin AS External
		Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
4.4.4.4         2.2.2.2         110         0x80000001 0x00F295 0
4.4.4.4         5.5.5.5         28          0x80000001 0x0098E3 0
6.6.6.6         2.2.2.2         110         0x80000001 0x0096E9 0
6.6.6.6         5.5.5.5         28          0x80000001 0x003C38 0
10.0.24.0       2.2.2.2         110         0x80000001 0x000E6B 0
10.0.24.0       5.5.5.5         28          0x80000001 0x00B3B9 0
10.0.46.0       2.2.2.2         110         0x80000001 0x001B48 0
10.0.46.0       5.5.5.5         28          0x80000001 0x00C096 0
10.0.56.0       2.2.2.2         110         0x80000001 0x00ACAC 0
10.0.56.0       5.5.5.5         28          0x80000001 0x0052FA 0
172.16.0.0      2.2.2.2         110         0x80000001 0x0017C7 0
172.16.0.0      5.5.5.5         28          0x80000001 0x00BC16 0

Two ASBRs (advertising routers 2.2.2.2 and 5.5.5.5) each inject the full set of type-5 LSAs. Redundancy achieved: if R2 dies, area 2's border still connects the domains. Also look hard at that last column — Tag: 0 on every LSA. The tag is a free-form field carried inside every type-5 LSA, currently unused. Act IV exists because of that column.

Meanwhile R5's own table quietly demonstrates the AD referee at work:

R5#show ip route | include 4.4.4.4
D        4.4.4.4 [90/131072] via 10.0.56.2, 00:04:10, GigabitEthernet0/1

Why D and not O E2? R5 hears about 4.4.4.4 twice: as EIGRP internal (AD 90, via R6) and as OSPF E2 (AD 110, injected by R2, arriving via R3). 90 < 110: the internal, native-domain route wins. AD is doing exactly its job — preferring first-hand information (a route still inside its home protocol) over a translated rumor. Keep this mechanism in mind; it is the safety net under everything in Act IV.

Act IV — Now You Close the loophole with route tags

Here is the uncomfortable truth about what you just built: it works, and it is one topology change away from not working. Trace the threat before you fix it.

A prefix native to OSPF — say 10.0.35.0/30 — is redistributed into EIGRP at R2. It travels R4 → R6 → R5 as D EX. R5 is also an OSPF router, and it is configured to redistribute EIGRP into OSPF. Nothing in the config says "…except routes that were OSPF's to begin with." Today, AD 170 > 110 means the EIGRP copy loses on R5's table and never gets re-exported — the referee saves you. But AD is comparing routes on that one router. Change the timing (a flapping link, a router reloading, a route briefly withdrawn from OSPF while alive in EIGRP) and the recycled copy can win, get re-injected into OSPF as a fresh external, and now two domains are feeding each other the same route in a circle. This failure mode is real, intermittent, and miserable to debug at 2 a.m.

The professional fix costs four lines per border: stamp every route at the border, and refuse re-entry to your own stamp. Plan:

Direction	Stamp	Refuse
EIGRP → OSPF (route-map `E2O`)	set tag 100	deny anything tagged 200
OSPF → EIGRP (route-map `O2E`)	set tag 200	deny anything tagged 100

Read the deny rules again until they click: a route tagged 100 is an EIGRP-native route already translated into OSPF once — it must never be translated back into anything, so O2E refuses it. Symmetrically for 200. The tags ride inside the LSAs/updates across the whole domain, so both borders see them.

Your turn — build and apply the route-maps on R2 and R5

You know route-maps from E08. Write E2O and O2E per the table, then re-attach both redistribution commands with their route-map. Do it on both border routers — identical config. Try it before opening the answer.

Reveal: the border policy (same on R2 and R5)

R2(config)# route-map E2O deny 5
R2(config-route-map)# match tag 200
R2(config-route-map)# route-map E2O permit 10
R2(config-route-map)# set tag 100
R2(config-route-map)# route-map O2E deny 5
R2(config-route-map)# match tag 100
R2(config-route-map)# route-map O2E permit 10
R2(config-route-map)# set tag 200
R2(config-route-map)# router ospf 1
R2(config-router)# redistribute eigrp 100 subnets route-map E2O
R2(config-router)# router eigrp 100
R2(config-router)# redistribute ospf 1 metric 1000000 10 255 1 1500 route-map O2E

The deny entries have no set; the permit entries have no match — an empty match means "everything else". Sequence 5 runs before 10, so refusal happens before stamping.

Verify like a professional — read your tags in the wild

First, does anything still work? Both domains should look exactly as before (tags don't change path selection):

R1#ping 172.16.3.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/11 ms

Now the real verification. The tag is carried inside the type-5 LSA — the same output you saw in Act III, last column no longer zero. On R1:

R1#show ip ospf database external 172.16.0.0

		Type-5 AS External Link States

  LS age: 51
  ...
  Link State ID: 172.16.0.0 (External Network Number )
  Advertising Router: 2.2.2.2
  Network Mask: /22
	Metric Type: 2 (Larger than any link state path)
	Metric: 20 
	Forward Address: 0.0.0.0
	External Route Tag: 100

  LS age: 37
  ...
  Advertising Router: 5.5.5.5
  Network Mask: /22
	Metric Type: 2 (Larger than any link state path)
	Metric: 20 
	External Route Tag: 100

External Route Tag: 100 from both ASBRs — every EIGRP-native prefix entering OSPF now carries its passport stamp. And on the EIGRP side, the stamp shows up in the topology table's external data block. On R6, for an OSPF-native prefix:

R6#show ip eigrp topology 1.1.1.1/32
EIGRP-IPv4 Topology Entry for AS(100)/ID(6.6.6.6) for 1.1.1.1/32
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 5376
  Descriptor Blocks:
  10.0.56.1 (GigabitEthernet0/1), from 10.0.56.1, Send flag is 0x0
      Composite metric is (5376/5120), route is External
      Vector metric:
        ...
        Hop count is 1
        Originating router is 5.5.5.5
      External data:
        AS number of route is 1
        External protocol is OSPF, external metric is 3
        Administrator tag is 200 (0x000000C8)
  10.0.46.1 (GigabitEthernet0/0), from 10.0.46.1, Send flag is 0x0
      Composite metric is (5632/5376), route is External
      Vector metric:
        ...
        Hop count is 2
        Originating router is 2.2.2.2
      External data:
        AS number of route is 1
        External protocol is OSPF, external metric is 2
        Administrator tag is 200 (0x000000C8)

This one output is a small masterclass — take it apart:

R6 holds two descriptor blocks for 1.1.1.1: one via R5 (metric 5376, 1 hop) and one via R2's side (5632, 2 hops). Both borders are injecting; EIGRP keeps both and prefers the cheaper.
External data remembers the route's biography: it came from OSPF, where its metric was 3, and which ASBR translated it (Originating router).
Administrator tag is 200 — your O2E stamp, carried inside EIGRP's update across the whole AS. If this route ever returns to a border, route-map E2O's match tag 200 → deny stops the re-import cold. The loop is now impossible by policy, not merely improbable by AD.

Milestone. Full reachability, dual redundant borders, provable loop prevention. From this build's final verification: a 24-ping mesh (R1, R3, R4, R6 sourced from their loopbacks to every other loopback) returned 100% on all 24.

Act V — Solo Challenge Prove you can read the merged network

Your goal

No new config in this act — the challenge is evidence and explanation, the skill the ENCOR sim questions actually test. Produce and defend four artifacts:

Path audit: from R6, traceroute to 3.3.3.3. State which border router the path crosses and why that one (hint: compare the two D EX descriptor blocks for 3.3.3.3/32 on R6, like the 1.1.1.1 example above).
AD prediction: before looking, write down what route type R5 uses for 4.4.4.4 (O E2? D? D EX?) and its AD. Then check show ip route 4.4.4.4 on R5. Explain the outcome in one sentence naming the two losing candidates.
Tag audit: find one prefix in R2's table that carries Route tag 200 (try show ip route 5.5.5.5 after Act VI's break, or any D EX entry's detail view now). Explain who stamped it and which route-map entry would block its re-import.
Summary defence: on R6, show the Null0 route and explain, in two sentences, the loop it prevents.

Pass condition: each claim backed by a command output, each output explained in your own words. If you can do this cold, you can do any redistribution question the exam asks.

Act VI — Break & Fix The virtual link dies — and nobody notices

Six months later, a colleague "cleans up" the OSPF config and deletes the virtual link from both R1 and R3. Here's the punchline up front: no user will open a ticket. Watch.

Step 1 — Record the healthy baseline

R5#show ip route 1.1.1.1
Routing entry for 1.1.1.1/32
  Known via "ospf 1", distance 110, metric 3, type inter area
  ...
R5#traceroute 1.1.1.1 numeric
  1 10.0.35.1 6 msec 6 msec 5 msec
  2 10.0.13.1 11 msec 7 msec 7 msec

Two hops: R5 → R3 → R1, the direct OSPF path, inter-area via the virtual link.

Step 2 — Break it

R1(config)# router ospf 1
R1(config-router)# no area 1 virtual-link 3.3.3.3
R3(config)# router ospf 1
R3(config-router)# no area 1 virtual-link 1.1.1.1

Give it a minute, then examine the wreckage — starting with R3's self-image:

R3#show ip ospf | include It is|Number of areas
 Number of areas in this router is 2. 2 normal 0 stub 0 nssa

The line It is an area border router is gone. No backbone connection, no ABR status, no type-3 LSAs for area 2 — we are back to Act I's stranded area. On R1, every area-2 prefix has vanished from OSPF (compare with Act I: 5.5.5.5 and 10.0.35.0/30 are missing again). So R5 must be cut off from area 0… right?

R5#show ip route 1.1.1.1
Routing entry for 1.1.1.1/32
  Known via "eigrp 100", distance 170, metric 5888
  Tag 200, type external
  Redistributing via ospf 1, eigrp 100
  Last update from 10.0.56.2 on GigabitEthernet0/1, 00:01:07 ago
  Routing Descriptor Blocks:
  * 10.0.56.2, from 10.0.56.2, 00:01:07 ago, via GigabitEthernet0/1
      Route metric is 5888, traffic share count is 1
      ...
      Route tag 200

R5#traceroute 1.1.1.1 numeric
  1 10.0.56.2 9 msec 5 msec 5 msec
  2 10.0.46.1 10 msec 8 msec 9 msec
  3 10.0.24.1 10 msec 10 msec 8 msec
  4 10.0.12.1 13 msec 10 msec 14 msec

R5#ping 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/11/12 ms

Read R5's new route entry against the old one, line by line:

Known via "ospf 1" → "eigrp 100", AD 110 → 170, and a Route tag 200 — this is R2's OSPF→EIGRP redistribution, received the long way around.
The traceroute now reads R5 → R6 → R4 → R2 → R1: four hops through the EIGRP domain instead of two through OSPF.
The ping: 100%. Area 0 reaches area 2 the same way in reverse (check R2: show ip route 5.5.5.5 now shows D EX … Tag 200 via R4).

Why this is the scariest kind of failure. When the OSPF path evaporated, the recycled EIGRP copy of the same prefixes — AD 170, previously the loser — became the best remaining route, automatically. Users lose nothing; your monitoring sees latency up a few ms. The area-2 branch is now one EIGRP link failure away from total isolation, its "redundant" design silently consumed, and the only symptoms are a changed route type and a longer traceroute. This is why professionals alert on path changes (route type, tag, hop count), not just reachability. Note the delicious irony: the backdoor works because your tags allowed exactly one legal translation — the recycled route is doing precisely what you designed it to be allowed to do, and nothing more.

Lab-image footnote observed during this build: because the virtual link is a demand circuit (hellos suppressed), deleting it on only ONE side isn't detected by the other for a long time — R3 kept claiming the link was "up" and stale DNA LSAs kept feeding R5 an inter-area route into a blackhole. Real IOSv behavior, worth remembering: after virtual-link surgery, always check both ends.

Step 3 — Fix it and prove restoration

Re-add the virtual link on both routers (you know the commands — Act I, Step 4). Within a minute:

*Jul  5 06:06:03.666: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on OSPF_VL2 from LOADING to FULL, Loading Done

R5#show ip route 1.1.1.1
Routing entry for 1.1.1.1/32
  Known via "ospf 1", distance 110, metric 3, type inter area
  ...
R5#traceroute 1.1.1.1 numeric
  1 10.0.35.1 7 msec 4 msec 8 msec
  2 10.0.13.1 8 msec 6 msec 5 msec

AD 110 beats 170: the moment the O IA route reappeared, it displaced the backdoor automatically. Two hops again. Baseline restored — and you can prove it, because you recorded the baseline first.

Done check — the capstone scorecard

Command	Must show	What it proves
`R3# show ip ospf \| include It is`	`It is an area border router`, 3 areas	Virtual link connects R3 to the backbone; area 2 is legal
`R1# show ip ospf virtual-links`	`OSPF_VL… is up`, transit area 1, hello suppressed	You can read a VL's demand-circuit nature and its transit-area dependency
`R6# show ip route \| include Null0`	`172.16.0.0/22 … Null0`	Manual summary with its discard route on the originator
`R4# show ip route eigrp`	OSPF-world prefixes as `D EX [170/…]`	Seed metric present; external AD distrust working
`R1# show ip ospf database \| begin AS External`	Each EIGRP prefix from ASBRs 2.2.2.2 and 5.5.5.5, Tag 100	Dual redundant borders, tagged at translation
`R6# show ip eigrp topology 1.1.1.1/32`	Two descriptor blocks, `Administrator tag is 200`	Both borders inject; your anti-loop stamp rides inside EIGRP
Loopback-to-loopback ping mesh	100% everywhere	The merger works
Break & Fix evidence	1.1.1.1 on R5: O IA ↔ D EX flip with traceroute 2 ↔ 4 hops	You can detect and explain a silent backdoor failover

All device output on this page was captured live from the 6-router IOSv build on 2026-07-05. Metrics, LSA checksums and timers are real; if yours differ slightly (ages, sequence numbers, DR elections), that's normal.