WillRoute4Food

Handy Command ...

2011-06-20T22:01:00.003-05:00

Every wonder how to tell if you put a space at the end of your Cisco password? Well, if you have, or want to see if thats the case during troubleshooting try out this command:
show run | i _$

If you have a user like this in the output:
user cisco password cisco

It most likely means that the password cisco is really "cisco_" where the _ is a blank space! This also applies for items like ospf authentication, etc...

RMON - Absolute vs. Delta

2011-03-23T22:04:00.001-05:00

I just wanted to put a link here as this is a topic that I never really chose to look that much into but it finally peaked enough interest tonight to do some research on it. Deepak simplified it so greatly in this post I found no real reason to rewrite it:
http://ieoc.com/forums/p/14069/125716.aspx

Here is Mr. Deepak Arora's post:

"Delta : For values that always increase
Absolute : For values that can increase or decrease
CPU utilization can go up or down (0% to 100%) so it would be an absolute value. Packets entering an interface will always accumulate (until the counters are cleared) so this would be a delta value. We’re (more likely to be*) interested in the number of packets during a certain interval (say the last 5 minutes) instead of the total number of packets since the counters were last cleared.
One of the ways that I determine whether to use absolute or delta is whether or not the “falling-threshold” can be attained. If a task has you configure a falling-threshold that cannot be reached (after the rising-threshold has been met) then I choose to use ‘delta’. For instance, if the task is referring to inbound packets (a value that always increases) and has a rising-threshold of 100 and a falling-threshold of 50, you can use ‘absolute’ but once the rising threshold is breached, the falling-threshold cannot be attained (unless the counters are cleared). This is either a poorly written task…or more likely you should use ‘delta’.
*Sure, we could monitor the absolute value of packets and generate an alarm when packets reach certain value (say 1 million) but that’s a pretty strange/ineffective alarm.

HTH...
Deepak Arora"

Well done sir...well done.

EIGRP Ratio Calculation

2011-03-13T22:26:00.002-05:00

This is a short post to discuss EIGRP ratio calculations. If you are so fortunate to be give a lab task that says.."We want Switch3 to route to 12.0.0.0 via Sw4 and Sw2 in a ratio of 3:1 respectively," this little thread should provide you with enough information to figure this task out on your own. Here goes:

This is our topology, and yes, 12.0.0.0 and the switches in the statement before are actually what we are going to use to do this. Currently all routers are in their the same EIGRP AS, and Sw3's routing and topology table for the route in mention looks like so:

I highlighted some of the pertinent portions of the config snippet. Heres the formula that I learned from Narbik for this type of situation:

3(158720) = 256 ( [10^7/100000] + [5200/10] + x)

Now this deems a bit of explanation...the left side of the equation is the route metric in the examples above, and we are multiplying this by 3 because thats what we want our ratio to be...3:1. So we want to figure out delay on the right (because that is what we want to manipulate here for EIGRP). The other stuff is pretty standard, 10^7/100000 defined by EIGRP for bw calculation, and the 100000 is defined as the minbw in the output above. 5200/10 is the delay in the above output divided by 10 to put it into the "tens of microseconds" category for EIGRP calculations. Finally x is delay, or better yet what we will end up with to add to our delay on the interface. Lets go!

3(158720) = 256 ( [10^7/100000] + [5200/10] + x)
476160 = 256 (100 + 520 + x)
476160 = 256 (620 + x)
1860 = 620 + x //--divided 476160 by 256
1240 = x //--subtracted 620 from 1860

So x = 1240...thats awesome. So do we just plug that in? One would think right, but we actually have one more step. If you were to plug that in, it would get you pretty close, but that needs to be added to what is actually on on our interface already. Lets look:

So our delay on there now is 100 microseconds. lets add that /10, or 10, to our previous x value.

1240 + 10 = 1250

Nice, lets see if that works!

Nope...hmm. Well we know that to do unequal cost load-balancing we need what? Variance of-course!

Now lets take a look..

And as I aptly named the picture...victory! Now I am honestly hoping that I dont get something like this in the real lab as it does take a little time to get it all perfected. Hopefully if I keep replicating the scenario I can get the whole process down to a minute or two. Well I hope this helped someone out there, if it did please leave a comment below! Thanks for the time.

Catalyst 3560 Aggregate Policing (My mind map)

2011-03-04T14:29:00.001-06:00

BGP Conditional Default Route

2011-02-03T21:19:00.000-06:00

Pretty much everyone knows that you can inject a default route to a neighbor in BGP by using a command like so:
router bgp 300
neighbor 164.18.46.8 default-originate

This will unconditionally inject a default route to that neighbor. Note: They will still get all the other BGP routes as the router originating this command will not suppress the other routes just b/c it is injecting a default to them. To conditionally set a default route you can use the route-map option at the end of this neighbor command. See below:
router bgp 300
neighbor 164.18.48.8 default-originate route-map SW2-DEFAULT
neighbor 164.19.26.6 default-originate route-map R6-DEFAULT

ip access-list standard BGP-SW2
permit 192.168.2.0

ip access-list extended BGP-R6
permit ip host 192.168.2.0 host 255.255.255.0

route-map SW2-DEFAULT permit 10
match ip address name BGP-SW2

route-map R6-DEFAULT permit 10
match ip address name BGP-R6

So as you can see here the big difference is the access-lists right? One is a standard ACL, the other is an extended ACL. So whats the difference? Well the first one will allow the default to originate if there in an entry in the routing table that will match that route, no matter the mask (192/8 , 192.168/16, 192.168.2/24) ...all would work. The extended acl actually defines a mask, a /24 to be picky in this case.

This is just something I ran into and found interesting when I was trying to filter using that route-map option originally. I looked it up, and found it here BGP REFERENCE ...strange that I never used this enough to remember it in my CCIP studies!

Just a note for later....

2011-01-30T22:03:00.000-06:00

Forward metric....in regards to OSPF External Type 2 routes

Got hit with this in a lab scenario today...honestly didnt even know it existed until I did a show ip route on a specific entry. I will do a lab this week with a bit more information, but it is definitely interesting.

Still labbing everyday for those listening in. 4-6 hrs per day/7days a week. Still feel weak in some areas, and looking forward to Narbik in 2 weeks!

Selective Packet Discard

2011-01-22T20:51:00.000-06:00

Well I can officially add this hidden ios feature to my "bag of things I will probably not ever use in real life" tricks. It actually serves a cool function to prioritize the "important" router traffic within the input queues on an interface. Control plane traffic such as IP prec 6, IGP traffic, etc...can be placed in additional priority headrooms that will be serviced first over the regular input queue during times of congestion. Here are some Cisco links on it:

Doc 1
Doc 2

INE

2011-01-14T22:05:00.000-06:00

Well as I have mentioned before I purchased Internetwork Experts CCIE v4 self-study package....damn. This is the most challenged...and humbled that I have been since beginning my Cisco certification/career journey several years ago. I originally hit the labs pretty fast and furious, and have in the last week really talked myself into slowing down...and going via best practice of reading the lab...drawing the diagrams, and trying to really understand whats going on in the network that I am working on. Sometimes this is a bit harder than it sounds, especially when you hit a level 9/10 lab, with multiple points of mutual redistribution, ipv6, multicast, rip, ospf, bgp, ospfv3, security, management, and qos....gets rough. But tonight I have had some epiphanies..slowing down and nailing task after task. I should keep it like this for a while...when the foundation is in tact I will work on speed.

Catalyst QoS

2011-01-06T07:50:00.002-06:00

Well I am still here....chugging away with 30+ hours a week or so towards CCIE lab preparation. It IS hard work....I spent the last week going through the two preparatory Lab Books for Narbik's class that I am taking from micronicstraining.com in February. I am really looking forward to this! Since finishing those up though, I am back going through some INE Volume II labs. Did one on Tuesday...got killed with some Catalyst QoS stuff that I had never seen before, and some IP services items that I had just forgotten. I am going back through Vol I today on the portions where I was lacking. I was going to do a brief thing here on Cat QoS, but I found a blog article from the guys at INE that say it better than I ever could.

http://blog.ine.com/tag/per-vlan/

OSPF over Frame-relay

2010-12-23T12:59:00.001-06:00

I just wanted to drop a line that has helped me tremendously the last couple of months. Its hard to remember sometimes what goes into an ospf config when using frame as your medium. Remember this:

"Non-broadcast Needs Neighbors"

If the network type is the default of non-broadcast, or point-to-multipoint non-broadcast you will have to include neighbor statements in your ospf configs. HTH's!

-Jason

Routing Protocols Comparison Poster

2010-12-13T16:17:00.002-06:00

I kind of threw this together for my written. It is a pdf in its natural state, if you want a copy of the pdf email me at willroute4food at gmail dot com. Its just a good quick side-by-side of some of the major routing protocols. If you find an error, or something I should add please let me know in the comments (I do realize some of the numbers were thrown off in the conversion. The data does appear to be in the appropriate containers though). Thanks.

	RIP (version 2)	OSPF	EIGRP	BGP
IP Protocol number, (TCP)	n/a	IP 89	IP 88	TCP 179
Hello Address	224.0.0.9 (can be set to broadcast at the interface level via *ip rip v2-broadcast*)	224.0.0.5 –AllOSPFRtrs 224.0.0.6 –DR/BDR	224.0.0.10	Unicast hello to configured “neighbor”
Administrative Distance(s)	120	110	Internal – 90 External – 170 Summary -- 5	EBGP – 20 IBGP – 200
Metric (calculation) / Limits	Hop Count/ Limit is 15 hops, 16 is inaccessible	Cost = Autocostrefbw/interface bandwidth Default is 100Mb for Autocostrefbw	Cost = 256(BW + Delay) formula with default K values) The maximum number of hops that EIGRP will accept is 100 by default, although the maximum can be configured to 220 with metric maximum hops.*	IBGP – 0 Redistributed routes metric = IGP metric
Timers	Update-30 Invalid-180 Holdown-180 Flush-240	Hello – 10/30 Dead – 40/120	Hello – 5/60 Hold – 15/180	Keepalive – 60 Holdtime -- 180
Adjacency (neighbor) Requirements	Neighbor must be on a subnet off of primary interface included in “network” statement	1. Pass authentication checks 2. Same primary subnet w/mask 3. Same OSPF area 4. Same Area type (flags) 5. NOT duplicate RIDS 6. Hello/Dead timers must match 7. Unless P2P (one must be DR/BDR)	1. Pass authentication checks 2. Must have same AS number 3. Must believe that source IP of neighbor in hello is in that routers primary subnet (no secondary’s) 4. K values must match	1. Source IP in connection request must match something in the local routers “neighbor” statements. 2. Routers ASN must match its corresponding ASN in “neighbor stmt 3. RIDS must be different 4. Must pass MD5 authentication
Passive Interface (yes,no) /Affects	Yes/Shuts off the sending of updates on the passive interface. Will still listen to updates and will update routing table accordingly	Yes/Stops sending hello’s /updates out of that interface. Note though, if included in the network statement the network on that interface will still be advertised to peers.	Yes/suppresses both incoming AND outgoing hellos/updates. Note that it will not allow neighbors to form.	n/a
Auto-summarization	Enabled by default	n/a	Enabled by default (wont summarize route that it does not “own”)	Disabled by default after 12.3 mainline
Summary Address	*(conf-if) ip summary-address rip* ip-address ip-network-mask *default-information originate* [*route-map* map-name]	ABR- area x range ip-address mask {advertise \| no-advertise} cost cost (router) summary-address ip-address mask	(conf-if) ip summary-address eigrp [as] ip-address mask	aggregate-address address mask [as-set] [summary-only] [suppress-map map-name] [advertise-map map-name] [attribute-map map-name] neighbor x.x.x.x default-originate network 0.0.0.0 (OR STATIC ROUTE/REDISTRIBUTE)
Filtering Method(s)	distribute-list {access-list-number \| prefix prefix-list-name [gateway* prefix-list-name]}* in [interface-type interface-number]	Inbound – distribute-list {prefix \| route-map} in In/out – area (number) filter-list prefix (name) {in \| out}	Distribute-list {access-list num/name} {prefix list-name} {in \| out} {int type/num}	Prefix-lists, route-maps, filter-lists, etc….
Authentication	Clear text or MD5 16 character limit *Key chain RIP* *Key 1* *Key-string cisco* *Int fa0/0* *Ip rip authentication key-chain RIP* *Ip rip authentication mode md5*	0 – none, 1 – clear text, 2 – MD5 Int fa0/0 Ip ospf authentication Ip ospf authentication-key {key} Int fa0/0 Ip ospf authentication message-digest Ip ospf message-digest-key {number} md5 {key} You can also declare the authentication type under the router OSPF process	MD5 only *Key chain EIGRP* *Key 1* *Key-string cisco* *Int fa0/0* *Ip authentication mode eigrp [as] md5* *Ip authentication key-chain EIGRP [as] EIGRP*	MD5 only Neighbor x.x.x.x password [pass]
Offsets	Increases incoming or outgoing hop count on routing updates (CAN BE USED TO FILTER BY SETTING HOP COUNT > 15) *Access-list 1 permit 10.10.10.0 0.0.0.255* *Router rip* *Offset-list 1 out 5 serial0* //increases metric by 5 on that route//	n/a	access-list 1 permit 10.1.1.0 0.0.0.255 router eigrp 1 offset-list 1 out 3 FastEthernet0/0	n/a

CCIE R/S Lab Blueprint

2010-11-26T13:02:00.002-06:00

Varies slightly from the written blueprint, so I thought that I would post it.

Exam Sections and Sub-task Objectives

1.00	Implement Layer 2 Technologies	√
1.10	Implement Spanning Tree Protocol (STP)
	(a) 802.1d
	(b) 802.1w
	(c) 801.1s
	(d) Loop guard
	(e) Root guard
	(f) Bridge protocol data unit (BPDU) guard
	(g) Storm control
	(h) Unicast flooding
	(i) Port roles, failure propagation, and loop guard operation
1.20	Implement VLAN and VLAN Trunking Protocol (VTP)
1.30	Implement trunk and trunk protocols, EtherChannel, and load-balance
1.40	Implement Ethernet technologies
	(a) Speed and duplex
	(b) Ethernet, Fast Ethernet, and Gigabit Ethernet
	(c) PPP over Ethernet (PPPoE)
1.50	Implement Switched Port Analyzer (SPAN), Remote Switched Port Analyzer (RSPAN), and flow control
1.60	Implement Frame Relay
	(a) Local Management Interface (LMI)
	(b) Traffic shaping
	(c) Full mesh
	(d) Hub and spoke
	(e) Discard eligible (DE)
1.70	Implement High-Level Data Link Control (HDLC) and PPP
2.00	Implement IPv4
2.10	Implement IP version 4 (IPv4) addressing, subnetting, and variable-length subnet masking (VLSM)
2.20	Implement IPv4 tunneling and Generic Routing Encapsulation (GRE)
2.30	Implement IPv4 RIP version 2 (RIPv2)
2.40	Implement IPv4 Open Shortest Path First (OSPF)
	(a) Standard OSPF areas
	(b) Stub area
	(c) Totally stubby area
	(d) Not-so-stubby-area (NSSA)
	(e) Totally NSSA
	(f) Link-state advertisement (LSA) types
	(g) Adjacency on a point-to-point and on a multi-access network
	(h) OSPF graceful restart
2.50	Implement IPv4 Enhanced Interior Gateway Routing Protocol (EIGRP)
	(a) Best path
	(b) Loop-free paths
	(c) EIGRP operations when alternate loop-free paths are available, and when they are not available
	(d) EIGRP queries
	(e) Manual summarization and autosummarization
	(f) EIGRP stubs
2.60	Implement IPv4 Border Gateway Protocol (BGP)
	(a) Next hop
	(b) Peering
	(c) Internal Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP)
2.70	Implement policy routing
2.80	Implement Performance Routing (PfR) and Cisco Optimized Edge Routing (OER)
2.90	Implement filtering, route redistribution, summarization, synchronization, attributes, and other advanced features
3.00	Implement IPv6
3.10	Implement IP version 6 (IPv6) addressing and different addressing types
3.20	Implement IPv6 neighbor discovery
3.30	Implement basic IPv6 functionality protocols
3.40	Implement tunneling techniques
3.50	Implement OSPF version 3 (OSPFv3)
3.60	Implement EIGRP version 6 (EIGRPv6)
3.70	Implement filtering and route redistribution
4.00	Implement MPLS Layer 3 VPNs
4.10	Implement Multiprotocol Label Switching (MPLS)
4.20	Implement Layer 3 virtual private networks (VPNs) on provider edge (PE), provider (P), and customer edge (CE) routers
4.30	Implement virtual routing and forwarding (VRF) and Multi-VRF Customer Edge (VRF-Lite)
5.00	Implement IP Multicast
5.10	Implement Protocol Independent Multicast (PIM) sparse mode
5.20	Implement Multicast Source Discovery Protocol (MSDP)
5.30	Implement interdomain multicast routing
5.40	Implement PIM Auto-Rendezvous Point (Auto-RP), unicast rendezvous point (RP), and bootstrap router (BSR)
5.50	Implement multicast tools, features, and source-specific multicast
5.60	Implement IPv6 multicast, PIM, and related multicast protocols, such as Multicast Listener Discovery (MLD)
6.00	Implement Network Security
6.01	Implement access lists
6.02	Implement Zone Based Firewall
6.03	Implement Unicast Reverse Path Forwarding (uRPF)
6.04	Implement IP Source Guard
6.05	Implement authentication, authorization, and accounting (AAA) (configuring the AAA server is not required, only the client-side (IOS) is configured)
6.06	Implement Control Plane Policing (CoPP)
6.07	Implement Cisco IOS Firewall
6.08	Implement Cisco IOS Intrusion Prevention System (IPS)
6.09	Implement Secure Shell (SSH)
6.10	Implement 802.1x
6.11	Implement NAT
6.12	Implement routing protocol authentication
6.13	Implement device access control
6.14	Implement security features
7.00	Implement Network Services
7.10	Implement Hot Standby Router Protocol (HSRP)
7.20	Implement Gateway Load Balancing Protocol (GLBP)
7.30	Implement Virtual Router Redundancy Protocol (VRRP)
7.40	Implement Network Time Protocol (NTP)
7.50	Implement DHCP
7.60	Implement Web Cache Communication Protocol (WCCP)
8.00	Implement Quality of Service (QoS)
8.10	Implement Modular QoS CLI (MQC)
	(a) Network-Based Application Recognition (NBAR)
	(b) Class-based weighted fair queuing (CBWFQ), modified deficit round robin (MDRR), and low latency queuing (LLQ)
	(c) Classification
	(d) Policing
	(e) Shaping
	(f) Marking
	(g) Weighted random early detection (WRED) and random early detection (RED)
	(h) Compression
8.20	Implement Layer 2 QoS: weighted round robin (WRR), shaped round robin (SRR), and policies
8.30	Implement link fragmentation and interleaving (LFI) for Frame Relay
8.40	Implement generic traffic shaping
8.50	Implement Resource Reservation Protocol (RSVP)
8.60	Implement Cisco AutoQoS
9.00	Troubleshoot a Network
9.10	Troubleshoot complex Layer 2 network issues
9.20	Troubleshoot complex Layer 3 network issues
9.30	Troubleshoot a network in response to application problems
9.40	Troubleshoot network services
9.50	Troubleshoot network security
10.00	Optimize the Network
10.01	Implement syslog and local logging
10.02	Implement IP Service Level Agreement SLA
10.03	Implement NetFlow
10.04	Implement SPAN, RSPAN, and router IP traffic export (RITE)
10.05	Implement Simple Network Management Protocol (SNMP)
10.06	Implement Cisco IOS Embedded Event Manager (EEM)
10.07	Implement Remote Monitoring (RMON)
10.08	Implement FTP
10.09	Implement TFTP
10.10	Implement TFTP server on router
10.11	Implement Secure Copy Protocol (SCP)
10.12	Implement HTTP and HTTPS
10.13	Implement Telnet

Passed the Written Exam

2010-11-23T21:07:00.000-06:00

Well, I can officially announce that I passed the CCIE R/S written exam today. I actually scored pretty well, but it was a tough test (I thought that I had failed when I clicked the final next). So, I am pretty happy; full-steam ahead on lab prep now.

Sunday

2010-11-21T11:42:00.000-06:00

Well I cant even express or gauge how much time I have put into studying for the CCIE thus far. I have my written scheduled, and just know that it is VERY soon. I am, as always, a bit nervous going into the test...mostly because of the monetary costs, and it being the holidays and all. Luckily my family and I are blessed enough to have the cash to put forward towards such a goal (some are not as fortunate). Knowing this, when I do finally acheive my goal, I will aim to help others do the same. I dont know how I will do this yet, maybe something like Stretch has done with a community lab or something. Anywho, I feel pretty ready for the written, and am just reviewing my 80+ pages of typed notes, and refining them a bit as I go. So, here is what I have used to study this far:

Routing TCP/IP volumes I and II
CCIE v4 Official Exam Certification Guide
ALL of my CCNP books
CCIE Routing and Switching Flash Cards (got these directly from Kevin Wallace's website for 25 bucks! He signed it and everything)
Boson Test Engine ($99 bucks, pretty good)
Cisco.com
Internetwork Experts CoD and lab books ( I bought the entire CCIE self-study package)

We will see...I just need to hit up my weak areas some more, and I have an idea for a pretty cool poster/diagram. For instance...going into today I couldnt really deliniate between a PIM DR, and the winner of the ASSERT process...after a bit of research I finally cracked open my Rtg TCP/IP volume II and just got the answer...(the little things like this are really helping).

Progress towards the CCIE

2010-11-07T14:27:00.002-06:00

Well I HAVE been chugging along for those of you following. I came across this article by Petr Lapukhov over at INE, http://blog.ine.com/2010/10/09/how-to-pass-the-ccie-rs-with-ines-4-0-training-program/. Since I purchased the program, I figured it couldn't hurt to follow how they think we should use it :) So I am coming up on my written day pretty quick...to date I have read the CCIE R/S official cert guide, and Routing TCP/IP volumes 1 and 2 (dont forget I did the CCIP., so I have most the QoS, BGP, and MPLS stuff under my belt already). I am going back through these books now, and refining my notes and knowledge in prep. for the written exam. It is mind-boggling how much stuff there is to cover. I have been labbing frequently as well. In the last week I have done these labs in INE's volume 1 Workbook:
1.1-1.15
2.1-2.8
3.1-3.11
4.1-4.11
5.1-5.12
The labs have been good, some simple, some harder. I have for sure covered all of them in previous years studying for other exams, but the technology or technique has left me over time (use it or lose it!). So I am going to keep going along, revisiting BGP next probably, then back over to QoS one last time. Hunting trip next weekend, but I will be reading at night.

Later.

Another Good Link

2010-10-29T10:22:00.000-05:00

Been having to do alot of switchport troubleshooting recently...heres a good link that explains almost every field in a "show interface" output.

Troubleshooting Switchports

IOS 12.4 Library

2010-10-29T08:05:00.000-05:00

Here's my reference link to the 12.4M configuration library. Very useful for looking stuff up on the fly.

Enter 12.4 Configuration Library

More IPv6

2010-10-24T16:14:00.001-05:00

Well I cruised through most of the ipv6 stuff today in INE V1 WB. Some stuff caught me off guard, others were unsupported by my version of IOS's, so I just studied the book and solutions well. I have IPv6 capabilities on my catalyst 3550's, but even when I have them configured they dont work. Like say I have a diagram like this:

R1------------SW1

I can configure the link for IPv6...doing a ping..the normal ND process shows the NS hitting the router...and he sends the NA back, but it is never received on the 3550. I gave up and just used a router on the other side instead...it works. I am also going to remove my time ticker..I quit keeping track to be honest...it was a hindrance IMO; and I ended up concentrating on it way more than I ever should have...numbers like that are arbitrary for the most part. When I am ready, I am ready...point blank.

So Sorry

2010-10-23T23:15:00.001-05:00

So more like question of the month...I know...
I have been BUSY...took a trip out to Colorado to see some relatives, and we have a huge "cloud" project going on at work including a "bake-off" with most of the major cloud vendors. I have learned a significant amount about FC, FCoE, iSCSI, etc..over the past couple of day, including alot with the Nexus and MDS series switches. Been a great learning experience, but a hinder to my studies. I have been finishing up IPv6, and doing a bit of labbing with it over the w/e as well as some last week. I actually like it! Seems like they got their @#! together for this one.

Question of the Day

2010-10-06T07:49:00.001-05:00

An administrator needs to use an OSPF area id of 0.0.13.1, but the router will not accept it (for whatever reason :)) What would be another number you could enter that would be equivalent to the original area id shown above?

Highlight --> (x*256^3) + (x*256^2) + (x*256) + x = (0) + (0) + (13*256) + (1) = 3329

Tonights Woe's

2010-10-05T21:03:00.001-05:00

Well after working on my studies all day, both reading and labbing, I fired the lab back up tonight to get another hour or so in. Only to find out that my newly configured 2509 was not letting me in...it would boot, but would not let me execute any commands. I savilly found out that through my aux port I could actually hit return...but I hadnt set an enable password :( So what the hell did I do? Can you guess :) I reloaded the thing, and entered the break sequence giving me the > prompt. I went ahead and entered the following:
>o/r 0x2142
>i
when it rebooted I did a copy start run, and then looked at my config....ah glorious, in my terminal server config I managed to do a no exec on the console line *dogh*!!! I took that out, reset the config-register to 0x2102, and voila! Good as new...and my heart stopped at the thought of telling my wife that I had yet another router to buy because one died!

NAT and Security Sections

2010-09-28T12:33:00.000-05:00

Well I finished my NAT and security sections, just finished up the NAT chapter in Routing TCP/IP Vol II. Great read btw. I NEED to do some labbing, but dont want to go all hardcore labbing right away when I should be plugging away at reading and theoretical knowledge. I will probably round the day out with some practice Boson tests, and go from there. I am a bit under the weather, so long, prolonged studying is hard.

Lost Track of Time

2010-09-21T10:35:00.000-05:00

I have to admit I lost track of my study time over the last week and weekend. My ticker may be a bit behind in regards to the actual count...but then again it doesnt really matter that much. I promise I will post something with some content in it today. Work has been absolutely grueling with a huge SAN/Datacenter project, along with some WAN redundancy testing we are doing with some 881G (3G) routers. That project is actually SuperCool, and has some pretty nifty routing and vpn things going into it. Anywho...I am still here and plugging away, so we will talk soon. Does anyone who actually reads this blog have any posting suggestions?? If so please leave a comment and I will get after any of the cool ones!

Multicasting

2010-09-14T10:56:00.000-05:00

Well I plugged through the two multicasting chapters in the exam guide today. Oddly enough I was dreading multicasting but I enjoyed reading about it. Last time that I really looked at it was for my BSCI, and even then my understanding was pretty vague. I feel alot better about the topic now, so I will lab a while this afternoon and see how it goes. I have fallen below the 2 hours/day mark but hope to make up some time with a revamped schedule. I have to remember that this is a pursuit of knowledge...not a race. Though the pay bump would be nice!

Fell Behind...

2010-09-09T07:25:00.002-05:00

Well I went out of town for the holiday weekend and didnt even look at my books :( Making up time now!

Labbing...

2010-08-31T21:09:00.001-05:00

Rented a rack session from INE's graded labs today. All in all, it was a good experience. I did have some times where the lab froze up, and I had to disconnect several times. But, like I said, for the most part it operated as intended. I spend the first part of my day getting used to INE's diagrams out of their Volume 1 WB. Once I got the hang of things I started cranking through labs 1.1 - 1.21. It was a good day, touching on native vlans, dtp, router-on-a-stick configs, vtp, pruning, etherchannels (L2/3), dot1q tunneling, and spanning tree. So all layer 2 stuff basically, and I still have 29 sections to go... I can easily see how CCIE study's can go well beyond the 1000 hour marks :)

BGP...almost done

2010-08-30T20:40:00.001-05:00

Getting a good refresher on BGP, but considering I just finished it up for the CCIP, I am not learning a whole lot that is new to me; but there still are some things. My notes need to be organized again...yaaaa. They are almost 10,000 words, and over 41 pages long now. I think that they will be GREAT review paper for me before I go in for my written. Cant wait.....

LSA Propogation in Different OSPF Area's

2010-08-27T06:29:00.002-05:00

Well I have been doing ALOT! Reading a bunch more on OSPF, and hitting IGP redistribution really hard. I made some video's tonight, mostly doing exactly what the title of this post says. I goofed in the video, but learned alot from it. Normally if I do something stupid, or miss something, I dont post the video...but here I felt like it could be a good learning experience for everyone. It certainly was for me..so a moment of humility on my part will hopefully teach someone, somewhere, a little more about OSPF :) 2 videos...P1 and P2. I have found they are REALLY time-consuming to do..so I might not post to many more in the future...they deter me from my studies a bit. Here's the topology for this lab:

Lmiting Redistributed Prefixes in OSPF

2010-08-21T14:25:00.003-05:00

Cisco Catalyst 3550 Password Recovery

2010-08-21T12:21:00.000-05:00

For those who have ever been lost trying to enter into 3550's rommon to recover a password, quit trying...lol, just follow Cisco's instructions here:
CATALYST 3550 PASSWORD RECOVERY...ALONG WITH SOME OTHERS

Here's a brief synopsis though (taken verbatim from Cisco's site...)

Follow the password recovery procedure below.

Attach a terminal or PC with terminal emulation (for example, Hyper Terminal) to the console port of the switch.
Use the following terminal settings:
- Bits per second (baud): 9600
- Data bits: 8
- Parity: None
- Stop bits: 1
- Flow Control: Xon/Xoff
Note: For additional information on cabling and connecting a terminal to the console port, refer to Connecting a Terminal to the Console Port on Catalyst Switches.
Unplug the power cable.
Power the switch and bring it to the switch: prompt:
For 2900XL, 3500XL, 2940, 2950, 2960, 2970, 3550, 3560, and 3750 series switches, do this:
Hold down the mode button located on the left side of the front panel, while you reconnect the power cable to the switch.
Catalyst Switch Series
LED Behavior and Mode Button Release Action

2900XL, 3500XL, 3550
Release the Mode button when the LED above Port1x goes out.

Catalyst Switch Series	LED Behavior and Mode Button Release Action
2900XL, 3500XL, 3550	Release the Mode button when the LED above Port1x goes out.

Issue the flash_init command.

switch: flash_init
Initializing Flash...
flashfs[0]: 143 files, 4 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 3612672
flashfs[0]: Bytes used: 2729472
flashfs[0]: Bytes available: 883200
flashfs[0]: flashfs fsck took 86 seconds
....done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Parameter Block Filesystem (pb:) installed, fsid: 4
switch:

!--- This output is from a 2900XL switch. Output from 
!--- other switches will vary slightly.

Issue the load_helper command.

switch: load_helper
switch:

Issue the dir flash: command.
Note: Make sure to type a colon ":" after the dir flash.
The switch file system is displayed:

switch: dir flash:
Directory of flash:/
2    -rwx  1803357                  c3500xl-c3h2s-mz.120-5.WC7.bin

!--- This is the current version of software.
4    -rwx  1131                     config.text

!--- This is the configuration file.
5    -rwx  109                      info
6    -rwx  389                      env_vars
7    drwx  640                      html
18   -rwx  109                      info.ver
403968 bytes available (3208704 bytes used)
switch:

!--- This output is from a 3500XL switch. Output from 
!--- other switches will vary slightly.

Type rename flash:config.text flash:config.old to rename the configuration file.

switch: rename flash:config.text flash:config.old
switch:

!--- The config.text file contains the password 
!--- definition.

Issue the boot command to boot the system.

switch: boot
Loading "flash:c3500xl-c3h2s-mz.120-5.WC7.bin"...###############################
################################################################################
######################################################################
File "flash:c3500xl-c3h2s-mz.120-5.WC7.bin" uncompressed and installed, entry po
int: 0x3000
executing...

!--- Output suppressed.
!--- This output is from a 3500XL switch. Output from other switches 
!--- will vary slightly.

Enter "n" at the prompt to abort the initial configuration dialog.

--- System Configuration Dialog ---
At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Continue with configuration dialog? [yes/no]: n 

!--- Type "n" for no.
Press RETURN to get started.

!--- Press Return or Enter.
Switch>

!--- The Switch> prompt is displayed.

Thats the jist of it though. If you want to keep a fresh config just issue a wr, if you want to keep your current config and change the password just follow the rest of the steps in that doc!

OSPF Virtual Link or GRE Tunnel

2010-08-19T22:44:00.001-05:00

100th post!! woot! No really, heres another lab...let me know what you think.

Heres part 2 of this video...

OSPF Summarization Lab

2010-08-18T17:25:00.001-05:00

I am still trying to tweak the quality...dont know why its blurry...

OSPF and all things Cisco

2010-08-15T21:01:00.000-05:00

Well I have begun reading about OSPF...again. Still find it amazing how much you do not retain in your studies. At least this time it is like "oh ya" instead of "what the heck are they talking about?" Good refresher all-in-all actually, and I am finding it easier to hold together the smaller things that used to be kind of hard to digest mentally (like LSA types, propagation, and general design recommendations). Didnt find as much time as I wanted this w/e, but I will take what I can get. I also have officially procured the rest of my lab equipment. Two more 48 port 3550's are on the way at a basement bargain price of $400 dollars. Hope they work :) Just need to get it cabled up now and I should be on my way~

Until next time....
Jason

Lab Time...

2010-08-13T07:31:00.001-05:00

Well I decided to revisit RIP a bit and do the Labs in Narbik's Soup to Nuts WB. Great set of 5 labs that really show you what RIP has to offer in terms of filtering and fine-tuning. I will definately need to run back through the WB and add some notes to my notes pages. This WB is a free offering from Narbik on his website @
MicronicsTraining
You can click on that link. I urge you to check his stuff out...he writes some truly great labs.

More EIGRP

2010-08-11T09:49:00.000-05:00

Well I read Routing TCP/IP's chapters on EIGRP, and have been labbing quite a bit out of Narbik's soup to nuts lab book. Great book btw. I even recorded my session last night using Camtasia. I will try to figure out the best way to embed the video in the blog here.

One of Narbik's tasks was to inject a default into the eigrp domain without using a global command, or a router configuration command. Honestly, I was stumped... Heres the brilliant solution.
(config-if)ip summary-address eigrp 100 0.0.0.0 0.0.0.0

Thats it! It sends the default to the neighbor, and they send it to their neighbors. Worked like a charm.

EIGRP

2010-08-09T08:29:00.000-05:00

Took some useful notes throughout the EIGRP chapter in the official exam certification guide. Notes now approaching 25 pages and have grown to over 5500 words. Amazing how fast they accumulate and I am only starting week 3 of my CCIE studies...

EIGRP

2010-08-08T21:23:00.000-05:00

So I went through basically all of the CLI INE CoD's today regarding EIGRP. They are good, definitely more honed towards the lab, but were a good overall review on EIGRP on the router. I will take the next ~2-3 days and read what the CCIE R/S certification guide has to say on it, and then follow that up with Routing TCP/IP's take on the whole matter. I "might" be falling into a groove, lets hope that I can keep it up.

RIP....basic lab

2010-08-07T13:53:00.002-05:00

Just wanted a short post on what RIP does with auto-summary. Here is the...well, quite simple topology:

So you can probably see what I did here. I first tested RIPv1, and just wanted to see if R2 would pass the /30 over to R1, and if so how R1 would interpret it.

R2#debug ip rip
RIP protocol debugging is on

*Mar 1 00:03:21.227: RIP: sending v1 update to 255.255.255.255 via FastEthernet0/0 (172.16.0.2)
*Mar 1 00:03:21.231: RIP: build update entries - suppressing null update

R1#show ip route
     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.0.0 is directly connected, FastEthernet0/0

Nothing...R2 has the connected routes but is not even advertising it over to R1. This is because RIPv1 is classfull, and even if R1 got the route, it would put a /24 mask to it even though it is a /30, because rip interprets any update without a mask like it has the same mask as one of its connected interfaces within that major network number. As soon as I put "version 2" under the RIP process I got some joy:

R1(config-router)#do show ip route
     172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
R       172.16.1.4/30 [120/1] via 172.16.0.2, 00:00:11, FastEthernet0/0
C       172.16.0.0/24 is directly connected, FastEthernet0/0
R       172.16.1.0/30 [120/1] via 172.16.0.2, 00:00:11, FastEthernet0/0
     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
R       10.10.10.0/24 [120/2] via 172.16.0.2, 00:01:06, FastEthernet0/0
R       10.0.0.0/8 [120/1] via 172.16.0.2, 00:00:11, FastEthernet0/0

I also want you to note that 10.10.10.0/24 network. Originally when I enabled Version 2, I also put on the no auto-summary command. R3 has a loopback of 10.10.10.1/24 and is advertising it into RIP. To show what auto-summary does, I went ahead and disabled it right before I ran the preceding show ip route. Notice the timer on the /24...its getting awfully close to that 180 invalid timer. I went ahead and ran a clear ip route * again, and look at the output now...

R1(config-router)#do show ip route
     172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
R       172.16.1.4/30 [120/1] via 172.16.0.2, 00:00:02, FastEthernet0/0
C       172.16.0.0/24 is directly connected, FastEthernet0/0
R       172.16.1.0/30 [120/1] via 172.16.0.2, 00:00:02, FastEthernet0/0
R    10.0.0.0/8 [120/1] via 172.16.0.2, 00:00:02, FastEthernet0/0

Now because R2 is the one with auto-summary on it is summarizing that major network...10.0.0.0/8 and sending it down the pipe to R1. Heres the debug output:

*Mar 1 00:14:25.451: RIP: sending v2 update to 224.0.0.9 via FastEthernet0/0 (172.16.0.2)
*Mar 1 00:14:25.455: RIP: build update entries
*Mar 1 00:14:25.455:   10.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar 1 00:14:25.459:   172.16.1.0/30 via 0.0.0.0, metric 1, tag 0
*Mar 1 00:14:25.459:   172.16.1.4/30 via 0.0.0.0, metric 1, tag 0

*Mar 1 00:14:35.003: RIP: received v2 update from 172.16.1.2 on FastEthernet1/0
*Mar 1 00:14:35.007:      10.10.10.0/24 via 0.0.0.0 in 1 hops

Now the highlighted portions are important b/c R2 is receiving an update of the /24 version of that network, but is sending just the /8 (the actual class A boundary) to R1. This is the default behavior or RIP:v2, and is reflected in the routing table of R1.

Now you might be wondering...well Jason, why then is the 172.16.1.x/30 routes still showing up in there if auto-summary is enabled...and to be honest I was wondering the same thing. Here's direct quote from the Cisco god himself, Scott Morris:
"Auto-summarization only works when routes are from a differerent classful network than the interface it's received on. So if everything in your network is 10.0.0.0/8 addresses, you won't see much difference (exception = redistribution). But when you see a route come in that's 172.16.1.0, even though you have a /24 mask on the interface, auto-summarization will change that to a /16 in your routing table."

Thanks Scott, that clears it up!

References:
https://learningnetwork.cisco.com/thread/6541

Keep on keeping on...

2010-08-03T20:39:00.000-05:00

Well, full day of studying today...probably around 6 hours. My biggest downfall in all of this is that I cant seem to "stick" to something and study it all the way through. I am finding myself going "ahh, I know this stuff, I can move on" and then later coming to the realization that I have missed some crucial aspect of that particular technology. I must stay focused and stick to the plan...on topic, all the way through and then move on....read, watch video, lab....repeat. Lots today though, brief stuff on IP forwarding, CEF, L3 switching, IP addressing, and PPP, including PPPoE and PPPoFR. Fun stuff really.

Super Spanning-Tree

2010-07-29T08:25:00.004-05:00

Revisiting spanning-tree stuff today. Watching a couple CoD's and reading the appropriate chapters in the CCIE R/S cert guide.

CCIE R/S Work

2010-07-27T14:21:00.002-05:00

Well I have begun! Started watching my Advanced Technologies classes from INE, and reading the corresponding chapters in the CCIE R/S Certification Guide, 4th edition. I am taking detailed notes this time around, trying to create one massive document for all of my CCIE study notes. My current plan is to cruise through layer two over the next couple of weeks using the videos, cert guide, BCMSN guide, and LAN Switching book. After that, I will hash out where to go next....Covered DTP, VTP, trunking, basic ethernet, SPAN's, VLAN's, private vlans (briefly), and some others today. Review mainly, but amazing some of the minute details you forget along the way.

Passed CCIP!

2010-07-22T07:40:00.000-05:00

Well I passed my final CCIP exam yesterday (BGP + MPLS) with an 892. Happy about that as it begins me down the road to the CCIE. I really used this test as prep work towards the CCIE anyways, mainly because with BGP already being a big topic, and MPLS being added, I had hoped that this would give me a leg up as it would dive me a little bit deeper into the technologies than I otherwise would have gone. This was the funnest test to date, and I really enjoyed the certification as a whole. I liked the specialized training on the certain protocols, and have really embraced MPLS and BGP as my new fav's :). Well I am off to develop a training plan, hope you all follow along!

MPLS + BGP

2010-07-15T09:06:00.000-05:00

This test is up next week. I did take a swing at it for free at Cisco Live and unfortunately failed with a 785. I hit my weak points up, and have been doing quite a bit of reading and labbing over the last couple of weeks. I just wanted to show a bit here on allow-as in, and as-override. I used both in this scenario to enable the CE routers to receive routes from the other vpn clients. Heres the topo:

As you can see the customer vpn sites share the same autonomous-system number. This is ok from the SP's perspective, but regular bgp rules will deny updates containing their own as number in the as-path attribute.

*Mar 1 00:36:45.495: BGP(0): 155.1.1.1 send UPDATE (format) 172.16.10.0/24, next 155.1.1.0, metric 0, path Localclear ip bgp * soft in
R0#
*Mar 1 00:36:53.691: BGP(0): 155.1.1.1 rcv UPDATE w/ attr: nexthop 155.1.1.1, origin i, originator 0.0.0.0, path 100 200, community , extended community
*Mar 1 00:36:53.699: BGP(0): 155.1.1.1 rcv UPDATE about 172.16.20.0/24 -- DENIED due to: AS-PATH contains our own AS;

So what can we do to remedy this situation? Well, two things, as-override on the PE router facing the CE router in the neighbor statement like we did on R1:

...snippet
R1
router bgp 100
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 100
neighbor 3.3.3.3 update-source Loopback0
!
address-family vpnv4
neighbor 3.3.3.3 activate
neighbor 3.3.3.3 send-community extended
exit-address-family
!
address-family ipv4 vrf customer
neighbor 155.1.1.0 remote-as 200
neighbor 155.1.1.0 activate
neighbor 155.1.1.0 as-override
no synchronization
exit-address-family

Or we could do an allow-as in on the CE router facing the PE router in the neighbor statement like we did on R4:

...snippet
router bgp 200
no synchronization
bgp log-neighbor-changes
network 172.16.20.0 mask 255.255.255.0
neighbor 155.1.1.6 remote-as 100
neighbor 155.1.1.6 allowas-in 1
no auto-summary

Either way works, the only difference is that the as-override will override the customers as number in an update message with its own (see below the show ip bgp output of R0):

R0#show ip bgp
BGP table version is 7, local router ID is 172.16.10.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.16.10.0/24   0.0.0.0                  0         32768 i
*> 172.16.20.0/24   155.1.1.1                              0 100 100 i --overwrote the 200

Whereas allow-as in will allow it's own as number in the as-path a pre-determined number of time (1-10). See output below on R4:

R4#show ip bgp
BGP table version is 5, local router ID is 172.16.20.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.16.10.0/24   155.1.1.6                              0 100 200 i ---allowed the bgp route in with 200 in path
*> 172.16.20.0/24   0.0.0.0                  0         32768 i

Lots Going On

2010-07-15T08:50:00.001-05:00

Well I have had a chaotic few weeks. Lots going on at work with remote site deployment, Cisco Live, and a Vacation to Mexico...all over the last 4 weeks. Cisco Live was a BLAST, but very exhausting at the same time. I learned alot, and will take that experience with me into the future. Mexico was of course awesome, and the remote site deployments have been a great time with ASA's flying out of the boxes, MPLS configuration, core equipment configs, VPN's, and quite a bit of routing play.

MPLS VPN's and OSPF in the VRF's

2010-06-10T08:37:00.002-05:00

I wanted to post a quick tidbit today regarding MPLS VPN's that use OSPF in the VRF's. Consider a topology that looks like so:

Now R6 and R5 are the CE routers, and of course R3 and R0 are the PE routers. The PE->CE routing protocol is OSPF in this instance. I want to talk about how the routes look on the CE routers after they are learned via OSPF, redistributed into BGP, sent across the wire, and redistributed back into OSPF and sent to the other CE router. A unique id comes into play here, it is called the OSPF domain-id. This IS a configurable parameter under the OSPF process, but by default is derived from the process id if not specified in the configuration.

Here is my initial OSPF configs on R0, R3, and the routing table on R6 (the CE device):


R0#show run | b ospf
router ospf 200 vrf VRF_B
log-adjacency-changes
redistribute bgp 200 subnets
network 10.0.0.0 0.255.255.255 area 0


R3#show run | b ospf
router ospf 200 vrf VRF_A
log-adjacency-changes
redistribute bgp 200 subnets
network 10.0.0.0 0.255.255.255 area 0

R6#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C       172.16.0.0 is directly connected, Loopback0
192.168.5.0/32 is subnetted, 1 subnets
O IA    192.168.5.5 [110/3] via 10.10.60.10, 00:00:00, FastEthernet0/0
10.0.0.0/24 is subnetted, 2 subnets
O IA    10.10.53.0 [110/2] via 10.10.60.10, 00:00:00, FastEthernet0/0
C       10.10.60.0 is directly connected, FastEthernet0/0

Notice the OSPF process-id's are the same in this instance. Therefore the domain-id derived from the id's is the same, and the routes will show up as OSPF inter-area routes. So what happens if one side is different in regards to the OSPF process-id?


R0#show run | b ospf
router ospf 200 vrf VRF_B
log-adjacency-changes
redistribute bgp 200 subnets
network 10.0.0.0 0.255.255.255 area 0


R3#show run | b ospf
router ospf 2 vrf VRF_A
log-adjacency-changes
redistribute bgp 200 subnets
network 10.0.0.0 0.255.255.255 area 0


R6#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C       172.16.0.0 is directly connected, Loopback0
192.168.5.0/32 is subnetted, 1 subnets
O E2    192.168.5.5 [110/2] via 10.10.60.10, 00:00:00, FastEthernet0/0
10.0.0.0/24 is subnetted, 2 subnets
O E2    10.10.53.0 [110/1] via 10.10.60.10, 00:00:00, FastEthernet0/0
C       10.10.60.0 is directly connected, FastEthernet0/0

Hmmm. Interesting...they show up as OSPF external type 2 routes. This is the normal OSPF redistribution behavior. So it shows as we expected here. So lets take a bit closer look at how we can get them back to inter-area routes if the situation we were facing were to dictate that we could NOT use the same OSPF processes. Here's another code snippet, and I will explain what I did after it:


R0#show run | b ospf
router ospf 200 vrf VRF_B
log-adjacency-changes
redistribute bgp 200 subnets
network 10.0.0.0 0.255.255.255 area 0


R3#show run | b ospf
router ospf 2 vrf VRF_A
domain-id type 0005 value 000000C80200 ---- READ BELOW
log-adjacency-changes
redistribute bgp 200 subnets
network 10.0.0.0 0.255.255.255 area 0


R6#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C       172.16.0.0 is directly connected, Loopback0
192.168.5.0/32 is subnetted, 1 subnets
O IA    192.168.5.5 [110/3] via 10.10.60.10, 00:00:00, FastEthernet0/0
10.0.0.0/24 is subnetted, 2 subnets
O IA    10.10.53.0 [110/2] via 10.10.60.10, 00:00:00, FastEthernet0/0
C       10.10.60.0 is directly connected, FastEthernet0/0

So the one difference in this code from the last code is that one line under the OSPF process on router 3. The DOMAIN-ID command. So how was this derived? Lets first looks at the results of some output on R0 and R3:


R0#show ip bgp vpnv4 all 192.168.5.5
BGP routing table entry for 3.3.3.3:1:192.168.5.5/32, version 22
Paths: (1 available, best #1, no table)
Flag: 0x820
Not advertised to any peer
Local
3.3.3.3 (metric 3) from 3.3.3.3 (33.33.33.33)
Origin incomplete, metric 2, localpref 100, valid, internal, best
Extended Community: RT:3:1 OSPF DOMAIN ID:0x0005:0x000000020200
OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:10.10.53.3:0
mpls labels in/out nolabel/26
BGP routing table entry for 10.10.10.10:1:192.168.5.5/32, version 25
Paths: (1 available, best #1, table VRF_B)
Flag: 0x820
Not advertised to any peer
Local, imported path from 3.3.3.3:1:192.168.5.5/32
3.3.3.3 (metric 3) from 3.3.3.3 (33.33.33.33)
Origin incomplete, metric 2, localpref 100, valid, internal, best
Extended Community: RT:3:1 OSPF DOMAIN ID:0x0005:0x000000020200
OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:10.10.53.3:0
mpls labels in/out nolabel/26




R3(config-router)#do show ip bgp vpn all 172.16.0.6
BGP routing table entry for 3.3.3.3:1:172.16.0.6/32, version 5
Paths: (1 available, best #1, table VRF_A)
Not advertised to any peer
Local, imported path from 10.10.10.10:1:172.16.0.6/32
10.10.10.10 (metric 3) from 10.10.10.10 (10.10.10.10)
Origin incomplete, metric 2, localpref 100, valid, internal, best
Extended Community: RT:10:1 OSPF DOMAIN ID:0x0005:0x000000C80200
OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:10.10.60.10:0
mpls labels in/out nolabel/23
BGP routing table entry for 10.10.10.10:1:172.16.0.6/32, version 3
Paths: (1 available, best #1, no table)
Not advertised to any peer
Local
10.10.10.10 (metric 3) from 10.10.10.10 (10.10.10.10)
Origin incomplete, metric 2, localpref 100, valid, internal, best
Extended Community: RT:10:1 OSPF DOMAIN ID:0x0005:0x000000C80200
OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:10.10.60.10:0
mpls labels in/out nolabel/23

So I highlighted the important parts of these show commands. The domain-id portion. Lets examine further. R0 shows R3's domain-id that is associated with the received routes as "OSPF DOMAIN ID:0x0005:0x000000020200." The first 0x0005 is considered the TYPE portion of it. There are 4 defined types in the IOS that I am using and they are:


0005  Type 0x0005
0105  Type 0x0105
0205  Type 0x0205
8005  Type 0x8005

The second portion being 000000020200 is a bit more interesting. If you take away the first 2 octects on the right you are left with 00000002, converted to binary and back to decimal you will get the domain ID....2. This corresponds with the OSPF process number of 2 on R3.

Lets looks at the other one, the domain-id for R0 as seen by R3. It is "OSPF DOMAIN ID:0x0005:0x000000C80200." Breaking it down again we have a domain-id with a type of 5, and a global administrator id of C8. Again broken down into binary this leaves us with 1100 1000, C and 8 respectively. If we calculate the decimal value of that we will get 200, which is the OSPF process number for R0...brilliant.

So that should give you some insight now, into the command I used above under the R3's OSPF process: domain-id type 0005 value 000000C80200. I merely looked at the output of the show commands above, and made R3's domain-id equal to R0's, and voila, the routes showed back up as inter-area routes instead of external type 2's. There is an easier way to set it though....you can declare null. Hope you enjoyed this. If you have any insight, please feel free to comment!

Work, Work, Work

2010-06-03T12:46:00.000-05:00

Been a while. Sorry, last week took a CVOICE class with New Horizons under the guidance of a one Ken Peterson, CCIE. Great instructor, and a fabulous course. I am not that all into voice right now, but the material and labs were very interesting. Cheers to the guys at .nil as well for their remote voice labs. Those area a hard thing to pull off, and they did it well.

So I have been drudging through the MPLS fundamentals book with Definitive MPLS design "on-deck." I have to say...the fundamentals book is kind of a hard read in my opinion. I am definitely going to have to keep it close for reference as it contains alot of good facts. I have now labbed full MPLS VPN scenarios twice, with both RIP and EIGRP running on the vrf's. I have got my head firmly wrapped around the topics of RD's and RT's, so I have moved on to TE. I will try to post some labbish' stuff shortly. With networkers coming quick though, I need to wrap this stuff up fundamentals wise because I test on it the end of networkers week.

Route Reflection Rules

2010-05-07T08:14:00.001-05:00

I just wanted to go over some route reflection rules in my BGP preparations. I did test all of these in my lab, and the real results I saw on my devices reflect what is depicted in these diagrams. If you have any questions, or anything to say at all please leave a comment.

1. If the route is received from a non-client peer, reflect to clients only (will go to EBGP peers of the AS as well).

2. If the route is received from a RR-client, reflect to all non-client and client peers.

3. If the route is received from an EBGP peer, reflect to all clients and non-clients.

I guess it is a pretty easy concept, but labbing it up definitely helped my understanding out a bit. Cisco also has some great links on route-reflection, but I also like this one:
Wiki dot nil route reflector link...

Suppress and Unsuppress maps

2010-05-05T15:03:00.000-05:00

Not going to dive into any great detail on this, just some notes. Say you have a router hosting these subnets:
10.0.1.0/24
10.0.2.0/24
10.0.3.0/24
10.0.4.0/24

The administrator...you, wants to advertise an aggregate address for these in the form of 10.0.0.0/8, but wants to also advertise theses specific subnets along with the aggregate:

10.0.2.0/24
10.0.3.0/24

On the aggregating router we would enter the following:

access-list 1 deny 10.0.2.0 0.0.0.255
access-list 1 deny 10.0.3.0 0.0.0.255
access-list 1 permit any

route-map SUPPRESS permit 10
match ip address 1

router bgp (as)
aggregate-address 10.0.0.0 255.0.0.0 suppress-map SUPRESS

Seems a bit counter-intuitive huh?!? Well think of it this way. The access list is going to permit any routes we WANT suppressed, and deny any that we do not. So we will advertise this to any other bgp routers. Their routing tables should have these entries:

10.0.0.0/8
10.0.2.0/24
10.0.3.0/24

BUT WAIT.... what if there is a specific neighbor that we want to unsuppress some other routes for...well, guess what? Its access-list time again!

access-list 2 permit 10.0.4.0 0.0.0.255

route-map unSUPRESS permit 10
match ip address 2

router bgp (as)
neighbor (ip address) unsuppress-map unSUPPRESS

dont forget to do a clear ip bgp * (soft) to reset your neighbors.
After that command, that specific neighbors routing table should contain these entries:

10.0.0.0/8
10.0.2.0/24
10.0.3.0/24
10.0.4.0/24

Go ahead, try it out for yourself!

BGP Syncronization

2010-05-04T07:10:00.001-05:00

We all know the BGP rule of syncronization states that BGP speaking routers will not advertise a route within the AS unless all other routers know about the route via an IGP such as EIGRP, RIP, IGRP, etc... This is basically a black hole prevention mechanism. Take the following diagram:

Worry about AS 6501 here. Imagine R0 is hosting a route to 1.1.1.1/32. The only routers running BGP in AS 6501 are R3 and R4. R3, R4, and R7 run EIGRP AS 6501 as their IGP. Now imagine that R3's link to R0 was severed, but R3 was sending packets to 1.1.1.1. It has to go through R7 to reach 1.1.1.1 now, but R7 does not have that in its routing table. It drops the packet, creating the black hole that synchronization works to prevent. This is how you tell if a route is not synchronized:


R3#show ip route 1.0.0.0
% Network not in table
R3#show ip bgp 1.0.0.0
BGP routing table entry for 1.0.0.0/8, version 19
Paths: (1 available, no best path)
Flag: 0x820
  Not advertised to any peer
  1200
    172.16.47.2 (metric 30720) from 172.16.47.2 (172.16.47.2)
      Origin IGP, metric 0, localpref 100, valid, internal, not synchronized

Notice the not synchronized at the bottom of the show ip bgp output. This shows that synchronization has not been accomplished with bgp and the running igp (eigrp). This is true in this case. But say R7 has a default route out the two border routers...it would then be safe to turn off synchronization via the no synch command. Another instance where it would be safe to turn it off is if all routers in the local as were running IBGP.

BGP Conditional Advertisements

2010-04-27T14:39:00.001-05:00

I am still preparing for my BGP exam, and found myself going through Narbiks old Soup-to-Nuts BGP labs. They are very interesting. One thing that caught me off guard was conditional route advertisements in bgp. They were not discussed in either of the BGP books I read unfortunately. So, I decided to post a bit here. Take the following topo:

Now suppose R1 is the hub in AS 100, the other two are in AS 200, 300. The only router with an EBGP peering with all other routers is R1. So we want R1 to only advertise 2.2.2.2 to R3 only if 1.1.1.1 is present in the BGP table. If 1.1.1.1 disappears we want 2.2.2.2 to also not be advertised to R3. So how can we do this...well by advertise maps is how. The config looks like this....first we create access-lists and route-maps to identify those two routes:

Then we configure our neighbor statement under our BGP process:

So lets go through what this means...To neighbor 131.1.13.3 we want to advertise NotThere (2.2.2.2) only if advertise (1.1.1.1) *exists*. So if 1.1.1.1 is present, 2.2.2.2 is advertised to R3 as well. If its not present, and 2.2.2.2 is, 2.2.2.2 is pulled from the advertisements. Its worth mentioning that there is also a non-exist-map you can use to say advertise this when this (non-advertise-map) is absent from the bgp table. Handy little tools. You can verify with the "show ip bgp neighbor [ip address] advertised-routes" command, or this:

You should see the condition-map line third up from the bottom. It tells you the route-map mappings by name, and also the status of the condition-map. Here it is advertise because the 1.1.1.1 route is up. If I were to shut down that interface the status would move to withdrawn. On a side note, today when I initially set this up I got a status uninitialized message. After quite a bit of digging, thanks Brian McGahan, I found a groupstudy post that mentioned that there was a bug in the 12.0(T) release that made this happen. I upgraded the IOS and got some joy from my router. Thanks for listening.

BGP Route Dampening

2010-04-15T07:45:00.016-05:00

Quick run through BGP Route Dampening this morning. I'm in a hurry, so I might not hit all the details. Heres the topology:

So in this scenario R1 and R0 are running OSPF between them, and RT1 is running EBGP with R2 in AS3. R2 and R3 are running IBGP with each other in AS3. RT1 is redistributing bgp routes into OSPF. Now, R2's route to 172.16.220.0/24 is flapping. The admin of AS1 wants to apply route dampening to that route, and suppress it if it goes over a certain penalty.
Half Life - 20 minutes
reuse-limit - 950
suppress-limit- 2500
max-suppress-time- 80 minutes

Heres the commands:

You should be able to see where I used the requirements above to plug in damening values into the route-map set statements. Here is the output, after I bounced the route for 172.16.220.0/24 a couple of times:

The first one shows the route after it has flapped twice. You can see that it has a penalty of 1932, below the 2500 that we set the suppression penalty to. So the route is not suppressed yet. It is important to note that the penalty slowly decreases over time as the route is stable. This is how a route recovers from dampening also. The next show ip bgp output actually shows the route after it has flapped 3 times. Now it is suppressed, notice the message "suppressed due to dampening." The dampinfo now shows the penalty 2841 (> 2500). This is awesome!!! So now the route is going to be suppressed until the penalty falls below 950. I originally thought this would be in 9 minutes 49 seconds...but when this number go to 0, the penalty was only at 2032, and it restarted the timer at like 10 minutes. Check it out:

Of course you can manually clear the dampening if you, or the administrator, feel that the route is stable again:

Here is some termonoligy from Cisco on dampening:

Understanding Route Dampening Terms

The following terms are used when describing route dampening:

•Flap—A route is available, then unavailable, or vice versa.

•History state—After a route flaps once, it is assigned a penalty and put into history state, meaning the router does not have the best path, based on historical information.

•Penalty—Each time a route flaps, the router configured for route dampening in another autonomous system assigns the route a penalty of 1000. Penalties are cumulative. The penalty for the route is stored in the BGP routing table until the penalty exceeds the suppress limit. At that point, the route state changes from history to damp.

•Damp state—In this state, the route has flapped so often that the router will not advertise this route to BGP neighbors.

•Suppress limit—A route is suppressed when its penalty exceeds this limit. The default value is 2000.

•Half-life—Once the route has been assigned a penalty, the penalty is decreased by half after the half-life period (which is 15 minutes by default). The process of reducing the penalty happens every 5 seconds.

•Reuse limit—As the penalty for a flapping route decreases and falls below this reuse limit, the route is unsuppressed. That is, the route is added back to the BGP table and once again used for forwarding. The default reuse limit is 750. The process of unsuppressing routes occurs at 10-second increments. Every 10 seconds, the router finds out which routes are now unsuppressed and advertises them to the world.

•Maximum suppress limit—This value is the maximum amount of time a route can be suppressed. The default value is four times the half-life.

The routes external to an autonomous system learned via iBGP are not dampened. This policy prevent the iBGP peers from having a higher penalty for routes external to the autonomous system.

Cisco BGP Config Guide 12.2

EtherChannel Mishaps

2010-04-09T14:06:00.000-05:00

So we implemented Cisco's Virtual Switching System at work this week, and almost flawlessly I might add. We ran into a small mishap on our final 2 switches while configuring the multi-chassis etherchannels. Now we configured the channels correctly, but there was one statement that bit us:

switchport trunk allowed vlan [list]

This, on the server distribution switches, was different on the physical interfaces. One of the physical interfaces had one more vlan in the list than the other. Now, the channel came up, and looked good on the core end, and on the server distribution switch end...except that the port with the most vlans in the allowed list was suspended from the port channel (its actual state was up/down). We began having intermittent connectivity problems to some of our servers. Weird. Upon investigation I found that suspended port on the server switches. First I noticed the up/down state in a show ip int b; then the suspended port in a show interface status. A quick look at the log showed the problem (different vlan/mask). I quickly added the vlan manually to the port-channel interface and the physical interface came up, and began operations in the channel-group once again. After a quick bit of labbing I confirmed the problem. The intermittent connectivity was indeed because of the load-balancing algorithm, and etherchanneling protocol in use. We were using src-dst-ip load balancing on both ends. Because we used channel-group mode on, as our statement, the core end of the channel saw the suspended port as still in the channel (had we used PaGP we would not have had the problem). Because it was still in the channel, the XOR calculation was still using the port index as a transmit link. So when the XOR hit...the link was used to transmit packets. When packets chased down the link, they were silently discarded by the suspended port. Funny how things work! Luckily, we were able to quickly identify the problem, and resolve it. TAC confirmed our suspicions.

XOR with 2 links...

gig0/1 -- index 0
gig0/2 -- index 1

Use the last bit of the IP address for XOR calculations (2^1 give you 2)

192.168.100.1 --> 192.168.100.2
1 in binary 00000001
2 in binary 00000010

XOR 1 and 0 = 1 (Use link gig0/2)

XOR breakdown
0 and 0 = 0
0 and 1 = 1
1 and 0 = 1
1 and 1 = 0

BGP Studies

2010-04-09T13:50:00.001-05:00

Well I finally got through the "theory" portion of Internet Routing Architectures, and am going through chapter 11 which actually begins the configuration portion as it pertains to Cisco. I am doing the labs with Halabi as he explains them in the book. Lots of redistribution stuff at first, and a backdoor lab as well. I will note the backdoor lab here. Topology is as such:

So the key here is that RTC is going to get 2 different routes to the 192.68.10.0/24 network. The ospf connection is the more desirable one, check out the administrative distances:
BGP(external)-20
OSPF (internal)-110

So notice the route that shows up in the routing table:
Gateway of last resort is not set

     172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
B       172.16.220.0/24 [20/0] via 172.16.20.2, 00:24:31
C       172.16.20.0/24 is directly connected, Serial3/0
B       172.16.1.0/24 [20/0] via 172.16.20.2, 00:24:31
B       172.16.65.1/32 [20/65] via 172.16.20.2, 00:17:28
B    192.68.10.0/24 [20/0] via 172.16.20.2, 00:20:24
C    192.68.11.0/24 is directly connected, Loopback0
B    192.68.5.0/24 [20/20] via 172.16.20.2, 00:15:46
C    192.68.6.0/24 is directly connected, FastEthernet0/0

Its the less desirable BGP route. So how do you remedy this? Well, the easiest way is to simply use what is known as the BGP "backdoor." This command:

3640-RTC(config)#router bgp 1
3640-RTC(config-router)#network 192.68.10.0 backdoor

Now, its seems weird that you do this on RTC...but using this command does not advertise the network, it simply changes the AD of the BGP route to 200. If I were to sever the OSPF link, the bgp route would show back up...check it out.

3640-RTC(config)#int fa0/0
3640-RTC(config-if)#shut
02:32:50: %OSPF-5-ADJCHG: Process 2, Nbr 192.68.10.1 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached
3640-RTC(config-if)#do show ip route
Gateway of last resort is not set

     172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
B       172.16.220.0/24 [20/0] via 172.16.20.2, 00:45:13
C       172.16.20.0/24 is directly connected, Serial3/0
B       172.16.1.0/24 [20/0] via 172.16.20.2, 00:45:13
B       172.16.65.1/32 [20/65] via 172.16.20.2, 00:38:11
B    192.68.10.0/24 [200/0] via 172.16.20.2, 00:00:04
C    192.68.11.0/24 is directly connected, Loopback0
B    192.68.5.0/24 [20/20] via 172.16.20.2, 00:36:28
O    192.68.6.0/24 [110/1] via 192.68.6.2, 00:00:04, FastEthernet0/0

So that is how easy, and cool bgp backdoor is!

BGP

2010-03-30T14:18:00.000-05:00

So I am working on my BGP skills at the moment. This is going to be a fun exam I think, as the content is rich, and labbing will be plentiful. I still have a streaming subscription to CBTnuggets for a little while, so I breezed through the CCIE Certification Series BGP videos. Jeremy did a fantastic job on those, and I took pretty good notes throughout. I am going to continue on by reading a book that just arrived...Internet Routing Architectures. The first couple of chapters are a bit dry, but provide a good history in the internet, and ISP's in general. I will update you all as I go, but bid you farewell for now!

Passed Qos 642-642

2010-03-23T16:56:00.001-05:00

Well I cleared the exam today. I'm not going to sit here and say it was easy either. It was a good hard test. I did get hit with some off-the-wall stuff, but for the most part if you knew your QoS you will be fine. Finished with about 15 minutes to spare, and an 869 score. I was a bit shocked looking at my report though, one category was in the 50%, and two in the 75'ish area. I did pretty strong in the others areas though, and I think that pulled my score up. Thanks guys, onward to BGP!

Last nights problem...

2010-03-20T13:17:00.000-05:00

So my post last night was concerned with the fragment size noted in the show ppp multilink command. Well, I figured it out after about an hour of thinking; I then verified this morning. If you calculate the fragment size at 160 bytes, LFI is automatically going to halve that for a multilink with 2 attached links (because each additional link comprises that percentage of the overall bandwidth). Now the 72 number is funny, because it should be 80 right? Well, turns out LFI is smart enough to know 80bytes is the maximum packet size on that link in order to get the 10ms serialization time. It is also smart enough to know that using ppp you are going to have 6 bytes of ppp header overhead added to each fragment, as well as another 2 bytes to keep track of the fragments. So all in all, you have 72 + 6 + 2 = 80...and voila.

So check it out. I killed serial 0/1, and the bandwidth changes, but not the fragment size...proving that it calculated the fragment size, and then halved it because there were two equal bandwidth links. Nice. I still need to find out what the weight number is there...little research after this to find that out.

MLP Fragmenting and Interleaving

2010-03-19T22:47:00.000-05:00

I mainly wanted to post this here for future reference, but I labbed up link fragmentation and interleaving on PPP links tonight. Cisco recommends this on links slower than 768kbps. MLP interleaving determines fragment size based on the configured link bandwidth, and what you as the network admin put as the delay within the ppp mulitlink fragment statement. For those math lovers out there, the formula is:
delay in seconds * configured bandwidth (i.e. 10ms on 128k line would be .01 * 128000 = 1280 bits/160bytes

Here was my interface configs:


interface Multilink1
ip address 172.16.12.2 255.255.255.0
fair-queue 10 512 14
ppp multilink
ppp multilink fragment delay 10
ppp multilink interleave
ppp multilink group 1
!
interface Serial0/0
bandwidth 64
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1
bandwidth 64
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1

Notice that the delay is put in ms in the ppp multilink fragment delay command. Here is some interesting output:

Now the bandwidth here is configured at 64kbps per interface, with 2 in the bundle...so 128k combined. I configured the delay at 10ms, so if we use our formula we should get: .01* 128000 = 1280/8 = 160 bytes. But what the duece! Why does it say right there that the frag size is 72? The QoS book says that it should be 160bytes as well. Now I know multilink PPP will split the traffic among the lines, but I am a bit confused. Any clarification on why this is happening would be awesome.

Oh and btw...to clear that pesky neighbor route thats comes with PPP anyways:



C       172.16.12.1/32 is directly connected, Multilink1

just issue the no peer neighbor-route on your multilink interface...annoying.

Shaping...Cont.

2010-03-19T08:24:00.000-05:00

I was having some trouble after looking at the output pasted in my previous post regarding shaping. What is the difference in these commands:

shape average 64000
shape peak 64000

Both have a byte limit of 2000 bytes per Tc, the same Tc, and average rate. The only differences were the target rate, and increment bytes. Well, the difference was truly in those numbers. Sure, both can send 2000 bytes per interval, if the bytes are in the bucket. But the true difference is that with the shape peak command, the higher number of bits can be realized. This is because of the increment bytes. When you shape to the peak you get Bc + Be replenished every Tc, letting you truly send 2000 bytes per interval. When you shape to the average you only get Bc every Tc, so under periods of high congestion you will only be able to send 1000 bytes, even though you have the ability to send 2000, because your Be bucket is empty, and only your Bc is getting filled back up every Tc. Once the network becomes a little less congested, you should once again be able to send those 2000 bytes. Thanks to great archived posts on techexams.net and INE's blog by Petr for clearing this up in my head.

I scheduled my exam for Tues. the 23rd.

Shaping--Part 2

2010-03-18T22:02:00.001-05:00

Just following up a bit after my last post. Remember I ended up shaping to the average with 64000 bps as my shaping rate? I ended up with a policy that looked like this:

Now I went in a did a bit of reconfiguration. Heres what I did:


R2(config)#policy-map shape_all
R2(config-pmap)#class class-default
R2(config-pmap-c)#no shape average 64000
R2(config-pmap-c)#shape peak 64000

Now look at the output of a show policy-map interface:

So here you can probably see some differences from above. Right off the bat you should notice that the target rate is double what we had originally configured! Our bucket of tokens now is Bc + Be, instead of just Bc in our previous example. We get our target shaping rate from the following formula:
Rate = configured rate(1 + Be/Bc) or 64000 (1+(8000/8000)) or 64000(2)....128

So essentially this guy is configured to send up to 2000 bytes (8000 bits x 2) each 125ms interval (if the bucket(s) have that many tokens of course!). But also notice the increment bytes in this example. They are double what they were in the previous example. This is because when you shape to the peak, Bc + Be are going to be replenished each Tc.

QoS on a Catalyst 2950

2010-03-18T21:37:00.000-05:00

Well, hacked away using some commands on a 2950 today, and pushed through the QoS exam guide by Wendell Odom for the second time (this time hand-writing notes). I feel really comfortable now with the theory, and am trying to apply some hands-on training. Too bad there are not that many QoS labs guides out there. Here's what I did...I'll try to explain along the way:


2950(config-if)#mls qos trust device cisco-phone

*Feb 28 18:41:56 CST: CDP-PA: version 2 packet sent out on FastEthernet0/1no shut
*Feb 28 18:41:56 CST: %TB-5-TRUST_DEVICE_LOST: cisco-phone no longer detected on port Fa0/1, port set to untrusted. \\This happened when I unplugged the phone\\

2950#sh mls qos int fa0/1
FastEthernet0/1
trust state: not trusted
trust mode: not trusted
COS override: dis
default COS: 0
pass-through: none
trust device: cisco-phone

This is a simple...trust the cos values sent by the ip phone if it is discovered on the port using CDP version 2. The switch here is telling it to overwrite packets sent from any connected pc with a COS of 0, or best effort.


2950(config-if)mls qos trust cos
2950(config-if)mls qos cos 7

FastEthernet0/1
trust state: trust cos
trust mode: trust cos
COS override: dis
default COS: 7
pass-through: none
trust device: none

Here we are trusting the COS markings that come in, and remarking any untagged frames with a COS of 7.



2950(config-if)#mls qos cos override

FastEthernet0/1
trust state: not trusted
trust mode: not trusted
COS override: ena
default COS: 7
pass-through: none
trust device: none

Here we use the override command to say, "I dont care if your tagged with a COS value..we are re-writing you with a COS of 7." You can see the COS override is set to ena...or enabled. This command also turns the trust state to untrusted, so that ALL COS values are overwritten.


2950(config-if)mls qos trust cos

interface FastEthernet0/1
switchport access vlan 19
switchport mode access
mls qos cos 7
mls qos trust cos
spanning-tree portfast
end

2950(config-if)#do sh mls qos int fa0/1
FastEthernet0/1
trust state: trust cos
trust mode: trust cos
COS override: dis
default COS: 7
pass-through: none
trust device: none

This last little bit was just to show that re-using the mls qos trust cos, resets the trust cos, and disables the cos override flag.

Shaping Calculations

2010-03-16T22:03:00.006-05:00

Small post here on traffic shaping calculations. I am thinking of taking the 642-642 QoS test next Tuesday, so I am really trying to re-read the book, and drive the topics home with some note-taking and lab exercises. Basically I have a topology that looks like this (sorry for the lack of visio!):

Host1(client)---R1---R2----Server1 (HTTP/FTP)

The access rate of the link (i.e. clock rate is 128000bps), the CIR given by the ISP is 64kbps. So we need to configure shaping so that our ISP does not drop our traffic. This is a REALLY basic example guys. Here is the config on R2 to shape traffic back to R1:


policy-map shape_all
class class-default
shape average 64000
!
interface Serial0/1
bandwidth 64
ip address 172.16.12.2 255.255.255.0
service-policy output shape_all

I then initiated a huge file download using both FTP and HTTP to engage the shaper. Here is the output of my show policy-map interface serial 0/1:

This, needs a bit of explaining. You can clearly see that the offered rate is at or below our configured shaping rate (63,000 bps at the top). Our target rate is what we configured, 64000. The "byte limit" is correct at 2000 bytes because it equals Bc + Be (8000+8000/8). This is how much the router can send per time interval (125ms). So every 125ms the router will send 2000 bytes in order to conform the traffic to 64kpbs. The Bc bucket is 8000 bits, and by default the Be bucket is = Bc bucket. These values were derived from the shaping rule (if shaping rate is < 320kbps then Bc = 8000; if it is greater than 320kbps then Tc defaults to .025 and Bc can be calculated by the formula Bc = Tc*CIR). The last item is the Increment bytes. Tokens are replenished at Bc per Tc. So every 125ms, Bc (or 1000 bytes) will be put back into the buckets.

EEM

2010-03-15T12:52:00.002-05:00

A post on techexams.net prompted me to look farther into this. It is a pretty handy little scripting tool built into the IOS. I played with a basic one in GNS3 today:


event manager applet ISR_CISCO
 event syslog pattern "Interface FastEthernet0/0, changed state to down"
 action 1.0 cli command "enable"
 action 2.0 cli command "conf t"
 action 3.0 cli command "interface fa0/0"
 action 4.0 cli command "no shut"
 action 5.0 cli command "ip address 192.168.0.1 255.255.255.0"

This will track if fa0/0 goes down, and if it does it will perform a no shut on it...and assign it an IP address. Ya, I was just playing, but take a look:


Router(config)#int fa0/0
Router(config-if)#shut
Router(config-if)#
*Mar  1 00:04:06.723: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar  1 00:04:07.723: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down
*Mar  1 00:04:08.299: %SYS-5-CONFIG_I: Configured from console by vty0
*Mar  1 00:04:10.051: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Mar  1 00:04:11.051: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
Router(config-if)#
Router(config-if)#
Router(config-if)#
Router(config-if)#exit
Router(config)#exit
Router#w
*Mar  1 00:04:17.815: %SYS-5-CONFIG_I: Configured from console by consolsh ip int b
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            192.168.0.1     YES manual up                    up
FastEthernet0/1            unassigned      YES unset  administratively down down

Pretty slick...heres a link. I will have to come back to this sometime. But I can see its usefulness.
Cisco EEM

Saturday!

2010-03-13T12:23:00.002-06:00

Well I am finishing off the 642-642 CBTNuggets today, and purchasing stuff of ebay for my CCIE home rack. I am planning on using INE's topology, so I am building around that. Here's what I am getting:

Device	Type	WAN	LAN
R1	2620XM	(2) WIC-1T	FE
R2	2620XM	(2) WIC-1T	FE
R3	2611XM	NM-4A/S	(2)FE
R4	3640	(2) WIC-1T	(2)FE
R5	3640	NM-4T	(2)FE
R6	3640	(1) WIC-1T	(2)FE

SW1	3550
SW2	3550
SW3	3550
SW4	3550

BB1	2620XM	NM-8A/S
BB2	2509		(1) AUI Trans	octal
BB3	2509	1	(1) AUI Trans	octal

Rack-28U

If its yellow I already have it. The white ones I still need to get. I am planning on selling (if he still wants it), my current desktop rack (12U) and 24-port 2950 to a co-worker. I am pretty stoked, I think that its going to be a cool journey.

Juniper SRX 240's

2010-03-12T22:13:00.003-06:00

Well we got a pair of these bad boys at work....We clustered them and have them configured for stateful failover. I am happy to say that for about 3 months I have been immersed in Junos. All in all, it is a pretty decent operating system. Coming from Cisco, the information is kind-of similiar, but not really (if that makes any sense). I did learn through the process that a firm understanding of the technology is needed to be successful. For a while, I was approaching these guys from a "Cisco" perspective; but I finally accepted the Juniper way of doing things, and it all seemed to work out. They fail over nicely. The one HUGE complaint I have is their misrepresented "dynamic" vpn. First off, every users needs their own IKE gateway, ipsec policy, dynamic-vpn gateway, and vpn acl. It is ALOT of administrative overhead to get someone configured. They say this all will be fixed with version 11 next year...we are on 10.1. Anywho...in order for the "dynamic IPSEC vpn to work...you have to have HTTPS enabled on the external interface they are coming in on.....ridiculous...it make it impossible to NAT anything through 443 on that same IP. Yet I digress. They are now working, and will probably be implemented in 2 months after we do VSS on our core switches next month. Back out to transfer my homebrew into the fermenter :)

QoS 642-642 Progress

2010-03-10T19:59:00.001-06:00

So, I finished the QoS book by Odom....awesome read! I need to go through and make some notes for the chapters though...sort of a second "glance through." I also picked up the nugget monthly streaming subscription; and am a pretty good way through them now. Good progress, I need some lab reinforcement and I should be good. Anyone know any good QoS labs (I have the ONT portfolio....).

Core IOS Upgrades Today

2010-03-10T19:54:00.001-06:00

So we updated our two Catalyst 6509's in preparations for the deployment of Cisco's Virtual Switching System next month. Ran into a weird problem though...well not really a problem, but something funny that I wanted to share. We all know that these guys parse your configs as they load, well our 6500's must have "parsed" too much. When we attempted to log in through the console port we kept getting an: % Error in authentication. It did this about 10 times before it finally gave us the glorious username prompt. Just a funny issue more than anything. Anyone else ever heard of this? Both cores did it...we upgraded to an SXI3 release. BTW: Here were are sup720 upgrade steps

1) TFTP'd the new ios into the sup-bootflash:
2) issued "boot system flash sup-bootflash:" for the new ios...used the "no" version to remove the old statement.
3) checked our boot variables with the show boot command. Should show the path you put in above.
4) We currently run HSRP, so only for a brief moment was connectivity lost (reboot secondary, then primary).

Reading QoS

2010-02-27T11:58:00.000-06:00

Well I bought the Cisco QoS Exam Certification Guide, as well as the CCIE Routing and Switching Certification Guide (4th ed.). Though I am returning the R&S guide because the companion cd was not in there! They are sending me another though, so all is well. I am about 105~ pages into the QoS guide, mostly refresher, but Odom writes quite elegantly on the subject. I really want to just knock this one out in a couple weeks, so after reading the books I will contemplate purchasing the CBT Nuggets to get Jeremy's perspective on it, and then a little labbing before the exam. I really have some QoS work to do at work...so this is pretty beneficial to everyone involved. More to come...sorry for the delayed writing. BTW...probably changing blog sites soon...will know shortly.

Passed ONT, CCNP is complete!!!

2010-02-21T21:10:00.000-06:00

Well, delayed posting, but I did past my ONT last Saturday with a 956! My CCNP journey is now complete, and I am starting preparations now for my CCIE R&S studies. I covered ALOT of material during my CCNP studies, some of which I am sure that I have forgotten. So I will have to hit those topics again on my journey. Now for my experiences on the test! Nothing was unexpected, everything on the blueprint was pretty much tested on. I was a little disappointed that one area I studied pretty hard in had no questions on my test :( but such is life I guess. Overall it was very fair, and the lab/sims were fairly straightforward and easy. *But* they do test your knowledge on the matter! Dont underestimate or under-read them. It is important that you pay close attention to the question that they are asking, and answer it accordingly. Also, wireless...ahhh wireless. Just know your stuff, security, setup, etc. They test on all of it.

Been Quiet

2010-02-07T21:32:00.000-06:00

I dont know if anyone actually follows this or not, but I've been a bit quiet lately. Trying to re-read some of the areas in the book that I think I am a bit deficient in like wireless, wireless system specs, wireless security, etc...The little things like EAP, LEAP, EAP-FAST seem to be escaping me and I am not doing well at retaining them. So, I scheduled my exam for this coming Saturday regardless. I will hopefully cap my CCNP this weekend then, and move on to studying the things I have forgotten in lieu to my CCIE written exam. Stay tuned, tomorrow I have drawn up a lab so that I can physically (using wireshark) see the differences in IPSEC tunnel/transport modes, and also go in-depth on the pre-classify commands (I saw a really good article on Cisco Ninja that I want to replicate).

Shaping and Policing Traffic

2010-01-31T15:00:00.001-06:00

Sorry I have been quiet lately. Been reading alot in the Exam Guide, and hitting some labs up. I recently downloaded the INE V1 Free Chapter, which was actually QoS stuff, and worked through it. I grabbed some pretty good info, inluding how to configure sla monitors as jitters to generate voice traffic on a network. Heres the config for that:


[on the router you want to generate traffic]
ip sla monitor 1
 type jitter dest-ipaddr 172.16.11.3 dest-port 16384 codec g729a
 freq 1
timeout 1000
ip sla monitor schedule 1 life forever start-time now

[on the router you want to send packets back]
rtr responder, OR ip sla monitor responder

You can of course change the port numbers, ip address, and codec used. It works pretty darn good if you want to make sure your classes and or policies are doing what they are suppose to.

I was also going through the Lab Portfolio for the exam and found a couple of different ways to police and shape traffic. You can actually do it in your policy-maps, or at the interface level which is the legacy configuration method. The policy-maps just allow you a bit more granularity, and flexibility as you can apply them to multiple interfaces. Here are the configs:

Traffic Shaping


[GTS (Generic Traffic Shaping)]
interface multilink 1
traffic-shape rate  

[MQC]
policy-map DEFAULT_SHAPING
 class class-default
  shape average [bps]
interface multilink 1
 service-policy output DEFAULT_SHAPING

Rate-Limiting (aka policing)


[CAR (committed access rate policing)] 
interface multilink 1
rate-limit output 56000 1500 4000 conform-action continue exceed-action drop
 
[MQC]
policy-map DEFAULT_POLICING
 class class-default
  police rate 56000 conform-action transmit exceed-action drop 
interface multilink 1
 service-policy output DEFAULT_POLICING

Now you can do other things that transmitting or dropping the packets like marking, or re-marking them. I just wanted to show you all a basic example of how this could be done within a policy-map, or at the interface level. Good to know more than one way to do things when troubleshooting a problem, or attempting the CCIE lab :)

Good link:http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008017405e.shtml

NBAR (Network-based application recognition)

2010-01-15T20:17:00.008-06:00

So I HAVE been studying every night this week, and have found myself putting off my blogging in order to play COD:MW2 :) So I am going to try and write a couple of these out tonight. First, NBAR!
Cisco Link: NBAR!!!

So NBAR provides to your network basically the equivalent of an application layer packet sniffer. It was originally conceived to assist in providing quality of service more granularly to applications that traverse the network. You can call out things such as http, gnutella, bittorrent, etc....and you router or device can recognize the data and place it, or classify it, however you saw fit. Here is a good example of an NBAR config:




lunde-edge(config)#class-map match-all MATCH_HTTP
lunde-edge(config-cmap)#match protocol http ? \\this is NBAR
c-header-field Client general Header Field
host Server Host Name
mime Match MIME Type
s-header-field Server general Header Field
url Match URL String \\you can match a url!

lunde-edge(config-cmap)#match protocol http
lunde-edge(config)#policy-map MATCH_HTTP \\create your policy-map
lunde-edge(config-pmap)#class MATCH_HTTP \\bind your class to policy
lunde-edge(config-pmap-c)#drop \\your **action**
lunde-edge(config)#int vlan1
lunde-edge(config-if)#service-policy [input\output] MATCH_HTTP \apply your policy

lunde-edge#show class-map \\display your class-map
Class Map match-all MATCH_HTTP (id 2)
Match protocol http

Class Map match-any class-default (id 0)
Match any

lunde-edge#show policy-map \\display your policy map
Policy Map MATCH_HTTP
Class HTTP_MATCH
Class MATCH_HTTP
drop

Some IOS's have different applications installed on them, but Cisco releases PLDM's, or packet description module language packs that you can install on your system to add more, or to update application signatures. This is a pretty cool feature, that as you can see, can also double as a security measure, stopping unwanted traffic at the application level. I did not show any here (I simply dropped http packets), but you can apply different ip precendence, and DSCP marking to traffic that matches an NBAR match statement.

QoS, Classification and Marking

2010-01-10T22:23:00.001-06:00

Wow, 2 days worth of notes to write on here so I will probably just get started. Again, they probably will not help anyone else out, but I found that if I watch videos/read, and take notes while doing it I get pretty good results. But if I take those notes, and let them sit for a few days while I ponder them, and them place them into this blog I retain the information much better. So here we go.

ToS, or type of service markings are used primarily as L3 markings, whereas Cos, or Class of service is L2.
Here are the bits/meanings of them:

Sorry, not the best chart I have ever made up, but this was the interpretation I got from the videos that I watched. I will see what the exam study guide says bout it in the next couple of days. Some common L2 markings are as such:

Frame Relay Discard Eligible (DE) bit (a 1 or 0, 0 if not eligible for discard, 1 if it is)
MPLS experimental bit
Ethernet trunk CoS (3 bits)

L3 markings are these two:

DSCP (differentiated services code point)
IP precedence (older)

So, ToS markings basically can be carried from router to router as they are L3 markings that will survive the hop, unlike L2 markings. To alleviate some of this, a conversion is done from L2 CoS to L3 ToS, such as a CoS to DSCP conversion. Traditionally IP precedence could use up to 8 bits, however only used the left-most 3 out of the eight. DSCP took this a bit further saying "hey, we can use all 8 of those and have some more granular results." What this became is this:

000 | 000 | 00
PHB (per-hop behavior) | drop reliability | flow control

Now DSCP is backwards-compatible with ip precedence because of those 3 left-most bits. Where DSCP differs itself is with the next 3 bits, the drop reliability. If you look back to that chart above you will see that decimal values 7 and 6 are reserved for network traffic, and that each 0-5 are assigned named values like assured or expedited forwarding. Now here higher is better; i.e. 101 or 5 is the best rating the packet can get according to the RFC. 000 being the worst. Drop probability on the other hand is opposite...higher is worse. Now drop reliability does NOT use all 3 of those bits...only the two left-most ones, so there are three possible combinations:

11x (High drop packet)
10x (Medium drop packet)
01x (Low drop)

So these two fields combined make up your DSCP value. So if you have a
AF13, you have assured forwarding 1, with a drop rating of high
AF41, you have assured forwarding 4, with a drop rating of low
If a router had to choose one to drop it would drop AF13 every time because it has a lower rating in both the IP precedence and drop rating.

They can also be viewed as decimal values:
10 = 001 010

So be careful when comparing two decimal values in terms of DSCP because higher or lower is not necessarily always better. Tomorrow night....dadada NBAR. Cant wait, see you then.

Cisco Modular QoS CLI (MQC)

2010-01-08T20:49:00.003-06:00

Define class-maps (define "what" to match)
Define policy-map (define what to do with your matches)
Assign service policy (apply what you have defined to an interface)

2 SHOW COMMANDS
show class-map
show policy-map (interface)

class-map [word, match-all, match-any]

match [access-group, protocol, etc...] option

policy-map [name] ***ONE POLICY MAP PER INTERFACE PER DIRECTION***

class-map [name]

what do we want to do with it???

(interface)service-policy [input, output] [name]

QOS

2010-01-07T21:00:00.000-06:00

So I began yet another QOS venture tonight. Watched the nuggets video(s). Here are just some random notes. They will probably be of no use to anybody but me, but here they are:

TOP NETWORK CULPRITS (in terms of good service over the wire!)

Lack of bandwidth
Packet loss
Delay
Jitter (variation of delay...i.e. on packet has 20ms delay, next 5, next 55...

QOS MODELS

Best Effort (it gets there when it gets there!! like a bitchy old mail lady who is disgruntled with her job)
Integrated Services Model (reserved bandwidth from point A ----> point B using RSVP) intserv
Differentiated Services Model (this is the best...puts up and breaks down as packets traverse interface)

IMPLEMENTING QOS

Do a network audit and identify the critical applications
Identify the application requirements (i.e. what protocols...bandwidth...etc)
Divide that traffic into groups (i.e. classify it into approx. 4-11 groups)
Create and apply policy to those groups

-Qos is basically just classifying and marking traffic

CONGESTION AVOIDANCE MECHANIMS

FIFO and Tail-drop
Random early detection (RED)
Weighted random early detection (WRED)

-Policing traffic drops all packets after a certain threshold is reached (i.e. you say no more after 200kbps)
-Shaping traffic merely queues packets when a pre-defined limit is reached

METHODS OF IMPLEMENTING QOS

CLI (hardest method)
MQC (modular QOS CLI)
AutoQOS (cisco proprietary)
SDM
QPM (plug-in of CiscoWorks)

POTS setup on FXS ports

2010-01-06T20:34:00.002-06:00

Here is just a basic setup where the two routers have FXS ports with regular analog telephones sitting on them. The two routers are connected via some kind of ethernet link, and share IP addresses on the same subnet. Here is the visio with embedded configs:

Also just some basic "show" commands to post here:
show voice port summary
show dial-peer voice summary
debug voip dial-peer

....noted

Back for the ONT!

2010-01-04T21:13:00.000-06:00

Sorry dudes...been out for the holidays. Back and cranking on the ONT. Passed the ISCW a while back with a decent score, but really want to kill this one to complete the CCNP. Here we go...

Default Cisco Voice sample size is 20ms
***Large sample sizes cause more coding delay, and result in greater, more noticeable ruined audio if the packet is lost or dropped.

http://www.voip-calculator.com/calculator -- a good voip calculator

Total packet size/payload size = total bandwidth requirement/total codec requirement
so to get total bandwidth requirement take:
total packet size * codec requirement / payload size = total bandwidth required

so for G.729 on a frame relay take this:
(6 (for frame header)+40 (l3 and l4)+ 20 (payload size for g.729) * 8kbps (codec req.)
_________________________________________________________________________________
20 (payload size for g.729)

= 26.4 kbps(multiply by total number of calls you expect at 1 time)

VAD- Voice activity detection is a mechanism that stops sending traffic during periods of silence

Thats a start. Also watched the VOIP design considerations video. Contained tidbits about call managers, phones, voip design models, and call admission controls.

Security Services

2009-10-31T09:52:00.000-05:00

Went through sdm one-touch lockdown, and scanned with nmap. Also used cli's autosecure mechanism. Both actually work pretty nicely. Then did a brief "Services" lab where the portfolio had me disable services globally, and on an interface. Here is the code:


Router(config)#no ip finger
Router(config)#no service udp-small-servers
Router(config)#no service tcp-small-servers
Router(config)#service tcp-keepalives-in
Router(config)#service tcp-keepalives-out
Router(config)#no cdp run
Router(config)#no service pad
Router(config)#no ip bootp server
Router(config)#no ip http server
Router(config)#ip http secure-server
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

*Mar  1 07:06:02.235: %SSH-5-ENABLED: SSH 1.99 has been enabled

Router(config)#no ip source-route
Router(config)#no ip gratuitous-arps
Router(config)#int fa0/0
Router(config-if)#no ip redirects
Router(config-if)#no ip proxy-arp
Router(config-if)#no ip unreachables
Router(config-if)#no ip directed-broadcast
Router(config-if)#no ip mask-reply
Router(config-if)#no mop enabled

Read about what each of these items was in the book. Hopefully I can use this page as notes later to quiz myself. LAB 5-3 ISCW portfolio

IPSEC VTI (virtual tunnel interface)

2009-10-30T21:04:00.004-05:00

So imagine R2 in the middle there is the ISP, and the two bottom routers...we will call them R1 and R2 are the customer. They both have an internet connection, but they also have a leased line inbetween them for internal communications. Basically this IPSEC VTI we are going to use, is an encrypted tunnel over the internet that is used ONLY IF the leased line is down for some reason. It is a brilliant idea really, and worked quite flawlessly. Basically just set up a regular isakmp and ipsec profiles/transform-sets. I then, instead of creating a crypto map, created a crypto profile, and then a modified tunnel interface config. It went something like this:


R1(config)#crypto ipsec profile myprofile
R1(ipsec-profile)#set transform-set mytrans

R1(config)#int tunnel 0
R1(config-if)#ip address 172.16.113.1 255.255.255.0
R1(config-if)#tunnel source serial 0/0
R1(config-if)#tunnel destination 192.168.23.3
R1(config-if)#tunnel mode ipsec ipv4
R1(config-if)#tunnel protection ipsec profile myprofile

So, the preferred path to the loopback off of R3 learned via eigrp, was over the leased line (obviously because of the lower bandwidth and delay value for the ethernet connection). But when the ethernet interface was severed, eigrp recalculated and inserted the feasible successor into the routing table with the path over the encrypted tunnel. Brilliant!

Securing MGMT Protocols, IPS, Cisco Firewall

2009-10-28T21:05:00.000-05:00

Got to be honest, didn't take real good notes here. I have seen this stuff before, and basically just played along on my home router while watching the videos. I REALLY need to get caught up on my reading. I have been slacking on that the past couple of days. I may hash out some labs to do tomorrow night, and try to read some during the day tomorrow at work. We will see. I did learn that there can be in-band and out-of-band management networks. Out-of-band is completely segregated from the production network. I personally work in an in-band mgmt network. It is integrated into our day to day production network. The differences between the two were pretty interesting, and Jeremy even spoke of putting the different servers into private vlan to segregate them even within their parent vlan. We spoke about ssh, and how to enable it requires a host and domain name. You can specify timeout and authentication parameters by saying:
ip ssh timeout [#] //idle logon timeout value
ip ssh authentication-retries [#] //specifies how many times a person can attempt continous logons

LOGGING
logging buffered [level]
logging [ip]
logging trap [level]
logging origin-id hostname \\specifies a hostname instead of ip address]
logging facility [type] \\specifies another virtual log table for organizational efforts

SNMP
snmp-server community [word [ro/rw] [acl]
snmp-server engineID [word]
snmp-server group [word] v3 [authentication]
snmp-server user [word] [group] v3 ...

NTP
ntp server [ip]
show ntp association
ntp master [stratum number]
ntp authentication-key [#] [word]
ntp peer [ip] key [#]
ntp trusted key [#]

IP INSPECT
show ip insepect sessions
ip inspect [word] [rule] [option]
(config-if)ip insepct [word] in/out

IPS
Actions of IPS

alarm
drop
reset

Configuring

Download/install sdf file
create ips rule
adjust ips settings
apply to interface
configure logging (SDEE, security device event exchange)

(no) ip ips sdf builtin
ip ips sdf location flash://[file]
ip ips name [word] [acl]
ip ips signature [#]
(config-if)ip ips [name] in/out
ip ips notify [log, sdee]

Sorry so brief.....need the post for notes!

Random Security Measures

2009-10-26T21:36:00.001-05:00

security password min-length [0-16] \\sets a minimum password length for all future passwords
no service password-recovers \\very dangerous...you cant recover passwords or ios's after this point
security authentication failure rate [#] log \\locks user out for x seconds if failed login x times

login block-for [seconds] attemps [#] within [seconds] \\blocks a user for x seconds after x attempts within x seconds...

login quiet-mode access-class [name] \\if login is blocked...this sets an acl that still allows groups of users access
login delay [#] \\sets a delay after a failed login
login on-failure log \\logs login failures after # attempts

show login

motd options ( $(line) $(domain) $(hostname) )

ENABLING VIEWS
aaa new-model \\enable aaa
enable view (enter secret password at prompt)

parser view [name]

secret [password]

(configure options)

secure boot-image \\locks ios image
secure boot-config \\locks config file
no secure [option] \\requires console access

reload in [minutes] \\good if entering say access lists on a remote router

reload cancel

ACL TYPES
standard
extended
dynamic
established
time-based
context based

cool command of the day

ip access-list resequence [name/num] [start num] [variance]

time-range [name]

absolute/periodic

P2P IPSEC CLI Config & Automatic Device Lockdown Methods

2009-10-25T22:21:00.001-05:00

Did the point to point ipsec cli config tonight. I covered it in another post, but had some trouble tonight right off of the bat. I think it was because I manually deleted yesterdays config instead of wiping my routers clean. Something must have messed up todays config...but I wr erased, reloaded, and re-configd' and all was well in the world of ipsec tunnels.

I also watched the nuggets regarding cisco's auto secure, sdm one-touch, and step-by-step security audits. Now, I had known about the sdm's functionality, but the auto secure is pretty neat as well. Basically just type:
# auto secure
and follow the prompts. Pretty good stuff!

GRE Tunnel....Experimenting with different routing instances

2009-10-24T23:20:00.001-05:00

This was my diagram. I started by assigning ip addresses to all links, and loopbacks on the spoke routers. I ran eigrp as 1 over all the connected links, and did not advertise the loopbacks. Then configured the GRE tunnels as follows (I give you one...the other is a mirror):

int tunnel 0
tunnel source serial 0/0
tunnel destination 192.168.23.3
ip address 172.16.13.1 255.255.255.0

After configuring the other side I tested with pings to the other tunnel interface....success.

Then I configured eigrp as 2, and advertised those loopbacks, and the tunnel interfaces (which happened to all be covered by the network statement 172.16.0.0). A show ip eigrp neighbors 2 confirmed the adjancency, and a show ip route eigrp 2 confirmed the updated routes. I can see how this could be useful over a public link, and especially encrypted within an IPSEC tunnel.

I also did the P2P IPSEC SDM config tonight. Not as much fun as the CLI....not at all. But the SPAN setup was cool, and capturing...actually seeing the encrypted data was really neat.

Cisco's EasyVPN Server SDM Setup & KISS

2009-10-23T22:50:00.000-05:00

Went through the cert guide's chapter on easy vpn server setup, and IPSEC failover. Probably need to read the IPSEC failover chapter again, but I got the just of it. The easy vpn server stuff in the book was VERY vague, but the nuggets covered it well, and I worked along with my local router and SDM. Split tunneling was a misunderstood issue for me, but now it makes sense. Basically allowing a user to split the tunnel; the admin can say WHAT is secured through the tunnel, and what is still accessed via the users local lan. Cool feature that can be supported via ACL's.

Then KISS, or keeping it simply secure....ha Here are the common security vulnerabilities described in the nugs...

Physical
Environmental/Maintenance
Reconnaissance (sniffers, sweepers, scanners)
Access attacks
DOS
Virus's/Worms/Trojans
Management protocol attacks (telnet, ssh, syslog, snmp, tftp, ntp, etc..)

He discussed both the attacks, and mitigation techniques. I should be able to remember these...we will see!

IPSEC, SDM, GRE over IPSEC...or vice-versa!

2009-10-22T22:14:00.000-05:00

So I actually read about 2 more chapters in the Official Exam Cert Guide today, and watched two nuggets. I reinforced what I learned last night about IPSEC tunnel CLI configuration on GNS3 at work today. I actually configured everything from memory, and got it correct the first time! Again the order is:

Configure ISAKMP SA (P1)
Configure IPSEC SA (P2)
Define interesting traffic via extended ACL
Configure Crypto map
Bind crypto map to interface
(Configure NAT ACL as necessary)

So I was actually pretty proud of that, and everything made perfect sense as I was configuring it. So today I finished up the IPSEC chapters in the book, and watched the SDM IPSEC Tunnel config, and the GRE/IPSEC videos. Basic GRE tunnel is as follows:

int tunnel [number]

ip address [ip] [netmask]

tunnel source [int type][num]

tunnel destination [ip]

tunnel mode [type][type] //default is gre ip

So GRE is great in that it can transport routing protocols, which IPSEC cannot do. However it is inherently insecure, and so IPSEC over GRE is a great option. GRE adds about 24 bytes to the header, and has an additional 12 bytes it can add as well as optional attributes. Some of the newer IOS versions do allow the passing of multicast traffic through an IPSEC tunnel. I will be configuring a IPSEC/GRE tunnel via cli later, but tonight was over the SDM config of the tunnel. Good stuff, can wait to dive into the labs for these sections.

Site 2 Site IPSEC Tunnel CLI Config

2009-10-21T22:24:00.000-05:00

Well, IPSEC tunnels tonight guys and gals! There are five increments that a router goes through in regards to IPSEC tunnels:

Define interesting traffic
IKE Phase 1 ISAKMP SA
IKE Phase 2 IPSEC SA
Data is transmitted through IPSEC tunnel
Tunnel is tore down

The steps to get this thing going in the CLI are as follows:

SET ISAKMP POLICY

crypto isakmp policy [policy number (lowest to highest)]

authentication [pre-share, rsa, etc...]

encryption [aes, des, 3des]

group [1, 2, 5] \\defines DH group

hash [sha, md5]

lifetime [0-86400] \default is 24 hours or 86400

crypto isakmp key 0 [word] [ address] [ip] [no-xauth]

SET IPSEC TRANSFORM SET

cryptp ipsec transform-set [word] [encryption] [authentication]

DEFINE INTERESTING TRAFFIC

ip access-l ext 101

permit ip [source] [destination]

SET CRYPTO MAP

crypto map [word] [sequence num] [ipsec-isakmp]

set peer [ip address]

set transform-set [t-set]

match address [access-list]

APPLY CRYPTO MAP TO INTERFACE

crypto map [name]

IF NATTING!!!!
\\deny source-destination in nat access-list

show crypto isakmp sa

show crypto ipsec sa

MPLS wrap-up & IPSEC Intro.

2009-10-20T21:57:00.001-05:00

Well I finished up MPLS today by finishing the rest of my reading, looking over weak areas, and doing shows and debugs from my already constructed labs. Trying to explain everything to another guy on the networking team felt like it helped my understanding out as well. We looked through the MPLS VPN lab, and traced labels throughout the topology, and also verified them against the routes in the routing tables (both the main routing table, and the vrf's). Very much worth the time! Also, by chance, learned that the command show ip protocols vrf [name] had ALOT of pertinent information in it...especially regarding redistributed protocols/AS's as well as neighbors.

Then I watched the nuggets regarding IPSEC introduction. Much of it a review for me at this point, but still learned some good stuff. IPSEC attempts to achieve:

Authentication
Data Integrity (SHA1 -{160 bit}, MD5 {128 bit}, etc...)
Confidentiality (DES, 3DES, AES, RSA)
Anti-replay

These are negotiated via IKE (internet key exchange)

There are 2 IPSEC modes:
Transparent and Tunnel

Symmetric encryption == both ends have the same keys (DES, 3DES, AES)
Asymmetric encryption == public/private keys (RSA, DH)

IPSEC is a "protocol suite"

MPLS

2009-10-19T21:58:00.000-05:00

So...I am trying to MASTER the MPLS portion of the ISCW before moving on to the next topic. I have spent about 3 days on it thus far, and will probably give it through tomorrow. I have read all the MPLS chapters in the ISCW Authorized Self Study guide, watched the nuggets, and completed the labs in the portfolio. Man, I really dont even know where to begin...there is soooo much with MPLS, and only a portion of it is even covered by this exam. I do however feel that my knowledge on the matter is growing, and it is something that peaks my interest. Lets go over the labs first:

4-1 Frame Mode MPLS
Diagram (sorry!):
[R1]----------[R2]----------[R3]

Easy enough! Started by configuring loopbacks and serial IP's to the interfaces. I then ran eigrp on the interfaces and advertised all loopbacks and serials. Ensured end-to-end connectivity by pinging from R1's loopback to R3's loopback interfaces, checking routing tables, and show ip eigrp commands. Then configured MPLS as follows:

(config) ip cef \\enabled cisco express forwarding
(config-if) mpls ip \\enabled mpls on all mpls interfaces
(config-if) mpls label protocol ldp \\set ldp as the label distro. protocol
(config-if) mpls mtu 1512 \\set the mtu to 12 > than 1500 to accomodate 3 X 4 byte labels

Verified with:

show mpls ldp bindings
show mpls forwarding-table
show mpls interfaces [type] [number] [detail]

This was a basic frame mode mpls configuration. As you can tell this is done over ethernet, thus the "frame" mode. This is opposed to mpls over atm; which is known as mpls cell mode.

The next lab was a bit more challenging....guess thats why it is called the "challenge" lab.
Lab 4-2 MPLS VPN's
[HQ]-------[SP1]-------[SP2]--------[SP3]---------[Branch]

This is hard to even explain....

Set up interfaces with loopbacks, ip's, etc...
Configured ospf over service provider network
configured MPLS in SP domain
Configured a virtual routing and forwarding table for the "customer"

ip vrf "name"
rd 100:1 \\route distinguisher...unique for each "customer"
route-target both 1:100 \\will help if the customer uses multiple vpn's
(config-if) ip vrf forwarding "name" \\do this on the customer facing interface

Verify with ping vrf "name" [ip]

Configured eigrp AS 1 on both customer routers advertising networks
Configured eigrp AS 100 on PE routers SP1 and 3 and then set up the ipv4 vrf

address-family ipv4 vrf customer
autonomous-system 1 \\customers as
no auto
network [ip]

Verify with show ip route vrf "name"

BGP setup on PE routers SP1 and SP3

router bgp as
neighbor [ip] remote-as [as]
neighbor [ip] update-sourec loop0
address-family vpnv4
neighbor [ip] activate
neighbor [ip] send-community both
exit
address-family ipv4 vrf customer
redistribute eigrp 1

Redistribute bgp routes into eigrp

address-family ipv4 vrf customer
redistribute bgp [as] metric 64 1000 255 1 1500

And done....that one was a real brainwasher. Made me re-evaluate everything I thought that I knew about MPLS. Like I said...I will do some re-study tomm. and probably move on to the next topic by Wednesday.

MPLS

2009-10-16T22:01:00.001-05:00

LSR - Label Switch Router
LIB - Label Information Base
LFIB (Action table) - Label Forwarding Information Base
PE - Provider Edge
LDP - Label Distribution Protocol
VRF - Virtual Routing and Forwarding

Placing the label = "Pushing" the lable
Removing the label = "Popping" the label

Control Plane - L3 routing exists here, label exchanging protocols LDP operates here
Data Plane - "Forwarding plane", send data at L2/L3, and does the label swapping

I'm tired....

MPLS FRAME MODE CONFIGURATION...

(config) ip cef
(config-if) mpls ip
(config_if)mpls label protocol ldp
(config-if)mpls mtu 1512

show mpls ldp neighbor
show mpls ldp bindings

Route Distinguisher - 64 bit tag prepened to IPv4 address and routes that works to identify a particular customer (i.e. "customer1", "cust23")
Route Target - allows a customer to belong to multiple vpns....need to look more into this...

Good night...i'm exhausted from work and study and family

ISCW Chapters 1, 2, 3

2009-10-15T22:04:00.001-05:00

I went with the official exam certification guide again for this exam. I have officially conquered chapters 1, 2, and 3...which I have to say were boring as shit. All about SONA, IIN, and cable/dsl technologies. I also watched the Nugget vids on the topics as well, which in fact, cheered me up a bit about it all. Also, went through a basic PPPoE config that went as follows:

int dialer [#] - (1-255) Creates the virtual dialer interface
ip address negotiation (negotiates with carrier for ip address)
ecapsulation ppp (designates encap type)
ip mtu 1492 (interstingly enough ethernet is 1500, but dsl adds an 8 byte header...this proves more effecient)
ip nat outside (do it here rather than the physical interface)
ppp authentication [pap/chap] callin (the "callin ensures that you are not authenticating the ISP)
ppp [pap/chap] sent-username [word] password [word]
dialer pool [#] - assign everything to a pool that you can reference on the physical interface
interface [physical wan connection]
pppoe enable
pppoe dial-pool-name [# from above dial-pool callout]
debug ppoe event
debug ppp authentication
show pppoe session

And that was pretty much it...except for the rest of the internal NAT stuff that remains to be completed. Showed some good debug output in the videos, and hopefully this stuff will sink in...I will start labbing in about 1 week I think.

The Great ISCW Race!

2009-10-12T21:45:00.000-05:00

Well I started tonight on the adventures of the ISCW. Due to the pending changes in the CCNP curriculum, looks like I have to finish by March 2010 with the ONT/ISCW combo. Shouldn't be really difficult..but we will see. I will post more tomorrow now that my introductory nuggets are done!

ISCW

2009-10-10T13:47:00.002-05:00

Update: I did pass the BCMSN and am going to start the ISCW on Monday. More posts to follow...go CCNP!

Messing with ether-channels

2009-09-16T20:00:00.000-05:00

No Etherchannel, one end isl, the other dot1q:
Results: Trunk and lines showed up and up, no data would pass over line (could not get pings going)

Etherchanneled two ports, configured one Po interfaces as isl, the other as dot1q
Results: Portchannel went down, the ports on the side I changed to dot1q started trunking as dot1q even though I had hard coded them with isl.....I only changed the Portchannel interface to dot1q and it reprogrammed the individual ports in the channel groups encapsulation values!

I also tested those rules regarding what has to be in place for an etherchannel to form:

Duplex settings must match
speed settings must match
Native Vlans must match
channeling protocol

Back in the mix

2009-09-15T21:58:00.001-05:00

Well, I am still not 100% healthy, but have been studying none-the-less. As you can see I have started to add links to the blog. Most are going to be direct cisco links to whitepages and topic areas for exams. I pretty much blew away all the transcender tests scoring 100% on all their "compiled mock exams." They were fairly straightforward and easy...I am not expecting the exam to be that simple.

I did do some labbing tonight, and really wrapped my head around the fairy simple technology that is VTP. I just needed to verify some things, and I did. I also went back over DAI in the cisco documentation. Then I reconfigured VACL's on the rack. Those seem pretty straightforward as well at this point. At work I dove pretty deep into STP features, and re-read all of them (they could be of some use to us at work as well!). Last night I got freaked out about wireless, and did some additional reading on LWAPP. Again, I think that as long as I recognize that there is both control and data traffic on UDP ports 12222, and 12223, I should be ok. The technology is not that difficult for me to identify with.

Lastly, I read some really good CCIE stories on IEOC.com. And another techexam.net member passed his CCIE SP lab recently as well. Hearing stories like this makes me realize that the goal is obtainable, it just requires a great deal of effort. I still have hopes of 2011 being my year! Oh ya, this saturday is my rescheduled BCMSN exam...hopefully this will place me halfway through my CCNP track!

Sick!

2009-09-11T16:21:00.001-05:00

Got sick! Sicker than shit actually. Had to delay the exam until next Saturday the 19th of Sept. Bummer, I was extremely ready to knock this bad boy out! I'll let you all know. Still killing the Transcender exams. Got 100% first time through on all the voice topics (28/28). Happy with that.