%CCO% Archives %%page%% - Network Ninja

Tag Archive for 'CCO'

Open Shortest Path First – OSPF Fundamentals – DR and BDR

Published

on February 18, 2009

in BDR, BSCI, BSCI Notes, Certification, Cisco Systems, Concepts and Constructs, DR, OSPF and VLAN

. 8 Comments

When routers are connected to the same broadcast segment (I.O.W. several routers are in the same VLAN, on the same switch you getting the idea). One router is assigned the duty to maintain adjacencies with all other routers on the segment. This is the designated router (DR) and the DR router is selected using information in the Hello messages. For redundancy purposes a backup designated router (BDR) is also elected (There is a reason for this, read on).

DRs are created on multi-access links because the number of adjacencies grows at a quadratic rate. For a network of n routers, the number of adjacencies required would be:

Two (2) routers require the following adjacencies:

Four (4) routers require the following adjacencies:

Ten (10) Routers require the following adjacencies:

Maintaining a OSPF segment consumes more bandwidth and requires more processing resources (CPU and memory) as more routers are added onto a OSPF network (Due to keeping the tables updated and probability of changes occuring more frequently etc).

The DR and maintaining relationships

The purpose of a DR is to be the “one router” (sounds like the matrix) to which all other routers are adjacent (the router that has all the routes on the network). Using a DR reduces the number of adjacencies that consume bandwidth and processing to n – 1 (Larger networks will however still require more processing even if you are using a DR). With a DR the adjacencies scale more effectively and efficiently with the network (as one can see in the below figure and table).

To show this in a graphic way one can see how this “adjacency” relationship works without a DR, with a DR, and with a DR and BDR with a small example network using 5 routers.

Taking this a step further and plotting out the exponential growth requirements of OSPF adjacencies the table below shows the number of adjacencies needed for 1 – 10 routers (imagine the CPU and Memory requirements, not to mention the bandwidth consumption). Plan accordingly when implementing OSPF (at this point you generally use OSPF because you have a non-homogenous network environment and need the open standard because of this fact, I dont really see a point otherwise cause its such a resource hog and mission to setup).

The job of the DR

The role of the DR is to receive updates and distribute these updates to each segment router, making sure that each router acknowledges receipt and has a synchronized copy of the Link-State Database (LSDB).

Routers advertise changes to the “AllDRs” multicast address of 224.0.0.6 where the DR then advertise the Link-State advertisements (LSAs) using the “AllSPF” multicast address 224.0.0.5 where each router then ack receipt.

The BDR listens passively to this exchange and maintains a relationship with all the routers.

If the DR stops producing hellos, the BDR promotes itself and assumes the role of DR.

NB. DRs and BDRs are only useful on multi-access links because they reduce adjacencies. The concept of a DR is not used nor usefull on point-to-point links because there can only be one adjacency.

DRs are still however elected on Point-to-Point Ethernet links (most common type of links in networking these days) which is a rather pointless and resource waste/hog (as a DR is not really needed) which is why you will find that many design guides recommend changing Ethernet links to Point-to-Point mode to stop this from happening.

If a DR fails, the BDR is pomoted. The BDR is elected on the basis of highest OSPF priority, ties in OSPF priority are broken in favour of the highest IP ADDRESS.

The default priority is 1 and a priority of 0 (zero) prevents a router from being elected to the DR or BDR role.

Priority can be set from 0-255 (manually) to change the priority from default from the interface,

Router(config-if)#ip ospf priority number

DRs are inherently seen as stable entities once elected into the position, even if a Router joins a network with a “greater” priority the DR will not change.

To give an example of this an OSPF Segment with 5 Routers ( A – E, with different priorities 0 – 3). Taking what has been discussed previously A would be the DR, B the BDR, and E would never be elected. However this neglects the following set of circumstances:

Imagine the following sequence of events in this small segment,

Router C starts first.
1. Router C sends out Hellos and waits the dead time for a response from other routers.
2. Receiving no Response, Router C conducts an Election and becomes the BDR.
3. As there is no DR on this network, Router C then promotes itself to DR.
Router E starts (priority= 0)
1. Router E will not become the BDR due to its priority setting
Router B starts and becomes the BDR.
Router A starts
Router D starts

In the above scenario the startup sequence of the routers caused the election of the DR and BDR (namely Router C is DR and Router B is BDR) which is not what would have been expected. This is because designated routers do not preempt, the elected DR/BDR serves in its role until reboot/failure (DR and BDR are stable entities on the network once elected).

In this network as it stands now If Router C restarts, Router B promotes itself to DR and Router A is elected BDR while C is down. If Router B goes down, Router A promotes itself and elects Router C or Router D (whichever has the highest IP Address). Finally when the BDR is rebooted, Router B wins the election for BDR.

NOTE: In addition to rebooting, clearing the OSPS process using the the command clear ip ospf process * on the DR will force the DR and BDR election.

Notes and Notices: This is a part of my personal BSCI notes and research to assist myself in learning and understanding the concepts and theory for the BSCI exam. I learn by making notes reading and writing things down and wish to file them where I canâ€™t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BSCI Certification.

Enhanced Interior Gateway Routing Protocol – Introduction

Published

Deon Botha

on August 5, 2008

in BSCI, BSCI Notes, Certification, Cisco Systems, Concepts and Constructs and EIGRP

. 1 Comment

This is the Introduction to Enhanced Interior Gateway Routing Protocol (EIGRP) most of this paragraph you will find here; moving swiftly along EIGRP is a Cisco Proprietary distance vector routing protocol that uses the same sophisticated metric that Interior Gateway Routing Protocol (IGRP) uses plus the Diffusing Update Algorithm (DUAL) convergences algorithm for loop-free routing. EIGRP is able to converge quickly and uses little bandwidth (like OSPF) because it separates keepalives, routing information and uses reliable updates. EIGRP is sometimes referred to as a hybrid routing protocol.

EIGRP was created (maybe read modified/updated) to solve scaling limitations that IGRP faced while still keeping the advantages of distance vector routing protocols (simplicity, economy of memory usage, and economy of processor resources). EIGRP is scalable in terms of hardware resources and network capacity. EIGRP is also very quick.

I use British English there will be a few small differences in spelling versus American English (the English Cisco Uses). Example: Neighbour vs Neighbor

Neighbourship and Reliable Incremental Updates

EIGRP supports several routed protocols independently (IP, IPX, Appletalk and IPv6) This means that each routed protocol has a best path that is not shared between other routed protocols.

EIGRP produces reliable (receiver ACKs the transmission was received and understood) updates by identifying its updates using IP protocol 88.

EIGRP uses five (5) types of packets to communicate:

Hello - Identifies neighbours; Hellos sent via multicast periodically and ACK.
Update – Advertises routes. Updates sent as multicast only when there is a change.
ACK – ACK receipt of an update.
Query – Used to ask about routes for which previous best path has been lost.
- If an update indicates that a path down, multicast queries used to ask other neighbours if they still have path.
- If querying router does not receive reply from each of its neighbours, it repeats query as a unicast to each unresponsive neighbour until it either gets a reply or gives up after sixteen (16) attempts.
Reply – Used to answer query. Each neighbour responds to the query with a unicast reply indicating an alternative path or that it does not have a path.

Neighbour Discovery and Recovery

EIGRP uses a reliable update procedure; this creates two problems,

The router needs to know how many other routers exist so that it knows how many ACK to expect.
The router needs to know whether a missing advertisement should be interpreted as “no new information” or “neighbour disconnected”.

EIGRP uses neighbourship to address these problems (periodic hellos).

The first hellos build a list of neighbours (Neighbour Table).
following hellos indicate that the neighbours are still alive.

If hellos are missed (for the period of the hold time) then the neighbour is removed from the EIGRP table and routing reconverges.

The discovery process begins with multicast advertisements being sent out and individual routers replying with unicast ACK. The neighbour table tracks replies to make sure that each neighbour responds. If a neighbour does not respond with an ACK a follow-up unicast message is sent, after 16 times attempts the neighbour is removed from the neighbour table and EIGRP continues with its next task.

Sophisticated Metric

EIGRP uses a sophisticated metric that takes into account bandwidth, load, reliability, and delay. The metric equation is:

EIGRP selects paths based on the fastest path (lowest value). To do that it uses K-values (K1 to K5 in the equation). The K-values are constants(don’t change) that are used to adjust the relative contribution of the various parameters to the total metric. The EIGRP K variables are set as follows:

Bandwidth – 107 kbps divided by the slowest link along the path. Because routing protocols select the lowest metric, inverting bandwidth makes faster paths have lower costs.
Load and reliability – 8-bit calculated values based on the performance of the link. Both are multiplied by a zero K-value (neither used).
Delay – a constant value on every interface type, and is stored in terms of microseconds (serial has a delay of 20,000 microseconds and Ethernet has a delay of 1000 microseconds). EIGRP uses a sum of all delays along the path, in microseconds.

By default:

K1 = K3 = 1 and
K2 = K4 = K5 = 0 (if you followed the maths if K5=0 then the metric equals 0).

Because the metric basically = 0 which will not be useful EIGRP ignores everything outside the parentheses.

Using the default K-values the equation then becomes:

Substituting the earlier description of variables, the equation becomes 10,000,000 divided by the chokepoint (worst/slowest link along the path) bandwidth plus the sum of delays:

Exercise to crystallize

This entire section is so that I understand how EIGRP selects the route using the below diagram (from Brent D, Stewarts CCNP book) lets plug in some values and see it work.

If we want to send traffic from Router A to Router D, which path would be used?

The top path ABCD has a chokepoint bandwidth of 768 Kbps and would go along 3 serial lines and look like this in the equation:

The bottom path AED has a chokepoint bandwidth of 512 Kbps and would go across 2 serial lines and look like this in the equation:

The result is that EIGRP chooses ABCD (top path) based on bandwidth.

Diffusing Update Algorithm (DUAL)

EIGRP uses the Diffusing update Algorithm (DUAL) which is a modification to the way distance-vector routing typically works. DUAL allows routers to identify loop-free failover paths. Using the same graphic as above lets do an exercise and figure out how DUAL works.

How DUAL works is that neighbouring routers advertise costs (using the below diagram. Lets say router A wants to send a packets to Router D). The two costs advertised by neighbours are as follows:

To send a packet from A to D the Advertised Distance (AD) is either via BCD or ED and excludes the first hop.
The other advertised metric is the Feasible Distance (FD) which is to send a packet the total distance ABCD or AED.

The idea that a path through a neighbour is loop free if the neighbour is closer is called the feasibility requirement and can be restated as “using a path where the neighbour’s advertised distance is less than our feasible distance will not result in a loop”.

The neighbour with the best path will be referred to as the successor. Neighbours that meet the feasibility requirements are called feasible successors. In emergencies, EIGRP knows that using feasible successors will not cause routing loops and instantly switches to the backup path.

Using the above diagram again I am going to be trying to reach Router D. What I did was plug in values using the same equation from the above exercise, just using each individual router (A, B, C, E) to get to D.

Queries

Having a Feasible Successor provides the best convergence. A feasible successor is a backup path and can be substituted should the active path go down at any point (without the need to change state and ask neighbours for a path). Should an active path go down and no Feasible Successor exist, a router will send out queries to remaining neighbours. If a neighbour does not know of a an alternative path, it will recursively ask neighbours.

Recursive queries can loop, forcing the router to time-out the query. This is known as stuck in active (SIA). EIGRP uses split horizon (a router should not advertise a network down a link from which it learned about the network – CCNA).

Queries will continue until an answer is found or until no one is left to query. When queries are produced the router changes to an Active State (actively querying for an alternative path) and sets a timer (3 minutes default). If the timer expires before an answer is returned the router is considered SIA. SIA typically occurs because queries are not properly limited to an area.

The primary way to limit how far queries travel (called query scoping) is to summarize (also allows quick convergence).

Incremental Updates

EIGRP periodically sends hellos to maintain neighbourship, but only sends updates when a change occurs. When a route is changed or withdrawn, an incremental update is sent including only those changes.

Multicast Addressing for Updates

EIGRP sends some packets using a reliable transport protocol (RTP). An example would be EIGRP sending a single multicast hello packet with an indicator that says it need not be ACK. Other types of packets like updates indicate that packet ACK is required.

EIGRP uses both multicast and unicast addressing.

Some packets are sent using Real-Time protocol (RTP), a Cisco Proprietary (?? Can’t find a source for this ??) protocol that oversees the communication of EIGRP packets. These packets are sent with sequence numbers to make the transmission of data reliable. Hellos and ACKs do not require acknowledgement.

Incremental Updates cannot be anticipated; update, query, and reply packets must be ACK by the receiving neighbour.

Updates are sent using reliable multicast (Reserved Class D address, 224.0.0.10). When a neighbour receives a multicast, it ACKs the receipt with an unreliable unicast.

Unequal-Cost load sharing

All IP routing protocols on Cisco routers support equal-cost load sharing. EIGRP is unique in its support for unequal-cost load sharing.

Unequal-cost load balancing takes the best FD and multiplies it by variance. Any other path with an FD less than this product (the product of multiplication read answer) is used for load sharing. EIGRP also does proportional unequal-cost load sharing.

EIGRP will pass a relative portion of the traffic to each interface (60/40) allowing links to a destination to be used to carry data without saturating the slower links or limiting the faster links.

Resources:

Stewart, Brent, D. 2008, CCNP BSCI Official Exam Certification Guide, 4th Ed. Indianapolis: Cisco Press.

Have a look at EIGRP Aragoen Celtdra notes on the same section of work

Introduction to EIGRP

Internetworking Technology Handbook – EIGRP

EIGRP Technology Whitepaper

The Dual Algorithm

Notes and Notices:

This is a part of my personal BSCI notes and research to assist myself in learning and understanding the concepts and theory for the BSCI exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BSCI Certification.

BSCI Design Foundation – Network Models

Published

Deon Botha

on July 25, 2008

in BSCI, BSCI Notes, Certification, Cisco Systems, Concepts and Constructs, ECNM, Enterprise Architecture, IIN and SONA

. 0 Comments

Design – Hierarchical

Where networks once were non-hierarchical (layer-1 design, layer-2 design, layer-3 design) they are generally now three-layer hierarchical in design (above). Cisco has been using this model for years and it gave a high-level overview of how a reliable network could be conceived but was largely conceptual because it did not provide specific guidance on “how-to” implement certain things, like:

Implementing redundancy,
Adding Internet Access,
Accounting for remote users,
Locating workgroup and enterprise services

Design – Enterprise Composite Network Model (ECNM)

Revisions to the hierarchical design showed redundant distribution and core devices and connections to make the hierarchical model more fault tolerant. The switch block design (above) explained how redundancy fit into a network, but still did not really adequately specify other parts of the network design. This lead to the Enterprise Composite Network Model (ECNM) development to address the failures of both the hierarchical model and switch block model.

This ECNM is broken into three large pieces:

Enterprise Campus,
Enterprise Edge,
Service Provider Edge.

Enterprise Composite Network Model

ECNM – Campus

The enterprise campus looks very much like the above switch block design with some added details:

Campus Backbone (like the core layer of the hierarchical model),
Building Distribution,
Building Access,
Management,
Server Farm (Enterprise Services).

The ECNM Campus builds onto the Switch block design but gives specific guidance as to where to place servers and management equipment. Take note that the servers look like a switch block and are redundantly attached (dual-homed) to the switches (not really shown nicely in the diagram).

ECNM – Enterprise Edge

The Enterprise edge shows the connections that the enterprise has with the wide area (other networks) and include:

E-Commerce,
Remote Access,
Internet Connectivity,
WAN (Internal links to other branches).

ECNM – Service Provider Edge

The service provider edge includes the public networks that facilitate wide area (other networks) connectivity:

Internet Service Provider (ISP),
Public Switched Telephone Network (PSTN) for dialup,
Frame Relay, ATM, and PPP for private connections.

Multiplexing

Historically voice traffic used one set of circuits and data traffic another. Also if you wanted more than one “number” the telecommunications company installed another physical line to your premises. If you wanted access to a data network they installed a data line for that purpose.

With line technologies like the T-carrier system (USA, Japan, Korea) 24 pulse-code modulated (I don’t know need to ask one the engineers about this), time-division multiplexed speech signals are carried over 2 copper pairs. This type of technology saved the telecommunications companies a lot of money in building out subscriber lines. The problem with T1 as a technology is that it cannot adjust as the customer usage requirements changes (see E-carrier system for Europe and other countries).

As technology changes so does the requirements from that technology; Modern networks are designed to carry voice, video, enterprise applications, normal LAN traffic and management traffic all on the same single secure infrastructure (convergence). The traffic is forced (statistically multiplexed) to share access to the network.

Service-Orientated Network Architecture (SONA) and Intelligent Information Network (IIN)

As covered above “Multiplexing” described the idea of a converged network as a system that integrates what was previously disparate systems (voice, video, data). The traffic types usually found on a converged network would include, but may not be limited to:

voice signalling and bearer traffic,
Core application traffic (ERP and CRM),
Transactional traffic related to database interactions (SQL),
Network management traffic for monitoring and maintaining the network structure (including routing protocol traffic),
Multicast multimedia,
Other traffic (web, e-mail, file transfer).

Each of the above traffic types has its own requirements and expectations that govern its successful execution. These requirements include security, QoS, transmission capacity, and delay.

To support this kind of multiplexed traffic, Cisco routers are able to implement filtering, compression, prioritization, and policing (dedicating network capacity). Except for the filtering process these processes are collectively known as QoS.

As an alternative to QoS, Cisco has an ideal called the Intelligent Information Network (IIN). This vision describes a network that integrates network and application functionality cooperatively allowing the network to be “smart” about how it handles traffic to minimize the footprint of applications. The IIN evolution is described in three phases:

Phase 1: Integrated Transport, deals with a converged network, built along a similar fashion of the ECNM and based on open standards (cross-compatibility)
Phase 2: Integrated Services, posits virtualization of resources such as servers, storage and network access; to move to an “on-demand” model. Don’t think marketing/advertising “virtualization” think practical virtualization the ISR routers (routing, switching, voice, network management, security and wireless) designed as an aio (all-in-one) appliance and Vitalizing Servers (if you have proper designed for the job servers) you can’t be trying this on SMB servers or try recycling 10 year old technology and thinking “bargain let’s load 5 operating systems on this”.
Phase 3: Integrated Applications, using application orientated networking (AON) to make the network “aware” allowing the network to actively monitor and participate in service delivery.

Service-Orientated Network Architecture (SONA) is the practical application or “how-to” of IIN in enterprise networks. SONA breaks down IIN into three layers;

SONA Infrastructure Layer is basically the same as IIN Phase 1,
SONA interactive Services Layer maps to IIN Phase 2,
SONA Application Layer has the same concepts as IIN Phase 3.

Resources:

Aragoen Celtdra on BSCI: Network Architecture and Design

Notes and Notices:

New Cisco IOS Software Activation and Licensing Workflows

Published

Deon Botha

on July 22, 2008

in Cisco Systems and Vine

. 7 Comments

I was introduced to this new Cisco IOS Software Activation and Licensing idea at a Partner Enablement session on the 6th of June and my first impression was “Windows Activation on steroids”. A post by Joe Harris has a visual workflow link that explains this process if this whole thing confuses you.

One of my questions to the presenter afterwards was what impact would this have on the simulation software packages like dynamips. My position being that I wasn’t able to build a lab simply for learning/studies even with Cisco discounts at this point in my career. He understood my point of view and knew of many other partners in similar positions but couldn’t really answer me.

What I gathered from my session on the 6th of June was that not all Router and Switch platforms will migrate to this new activation and licensing platform but it will happen over a period of time. This activation and licensing system is being implemented because the “gentlemans agreement” system Cisco has used in the past isn’t working where there is misuse of the current system.

That being said I did ask how this will directly affect me and the answer was that on initial order/sale not a whole lot. When a customer purchases a switch/router they generally purchase what they want with the licensing they want. On a scenario like that the IOS and feature is installed and activated before being shipped to the customer or me and then I go install.

This new system will start becoming a bother when upgrading from IP Base to another feature license. This will require the following steps:

The order of a Product Authorization Key (PAK) from Cisco
The Unique Device Identifier (UDI) from the Router/Switch
Entered this information into the Cisco Licensing Portal
Taking the information from the Portal and installing the license onto the Switch/Router

The installation of the license file can be done using the *.lic file that you receive from the Portal using the Command line interface or the Cisco License Manager software. Using the command line:

Switch#license install tftp://x.x.x.x/license.lic

Alternatively one can use the call-home feature and the PAK Number, this however would mean that you have an internet connection to the Router/Switch and you feel comfortable that you won’t have the *.lic file when things go wrong as the Switch/Router installs this directly from the License Portal:

Switch#license call-home install PAK PAK-NUMBER CCO Username: abcdef CCO Password: !...................... Follow the prompts to install the license

There was talk about an emergency license availability for “emergency purposes” where say for example a customer has a current desperate need for an upgrade feature set this very instant and the order cycle would take a couple of days to fulfil. The emergency license would take a couple of hours at most and last for a finite period while the order process ran its couse.

BCMSN Passed

Published

Deon Botha

on July 21, 2008

in Certification and Cisco Systems

. 17 Comments

I passed the BCMSN exam this morning; I am happy to have passed the exam that being the desired result of writing an exam, yet I am extremely unhappy with myself in that I didn’t feel “on the ball” with alot of the questions.

The testing centre venue was fine by all accounts and standards and the people friendly. You know that you visit enough when the testing people recognize you and know that you are the guy coming in for the Cisco exam of the morning. The exam room air-conditioning unit was set not too high and not too cold for the exam this morning which was actually rather pleasant for a change.

My biggest complaint of most places is not really related to this test venue but a general complaint of events venues. Us Africans don’t know how to use Air-conditioning inside buildings because it’s set either too cold or too hot in relation to the outside temperature. This means that you are either wearing too much or too little clothing and sitting in a closed room for 110 minutes freezing/boiling and your hands/ears/nose are going numb while you are trying to recall information is a pain and not really conducive. Another thing with air-conditioning is that it dries out your eyes and sinuses and when there is no other ventilation in the room half way through the exam all you start caring for is to get out the room because of the headache you getting. Makes one feel that they should start advertising the “room” temperature for the day so that you can dress accordingly for the climate.

The Preparation

My thinking going in for the exam 4 months ago was that the BCMSN switching content “in theory” is fairly straight forward and that it would be easy enough to try and use as a “test” case for the future CCNP courses. That assumption paid off because I think I wouldn’t have made the BSCI exam with the hitch I came up with today.

My test case did pay dividends and I have found something that I will have to sort out post haste for the BSCI and other future exams. My approach with my notes has been up until now focused on getting to know and becoming comfortable with the core theory of the subject matter. This approach served me well enough and enabled me to “pass” the exam although I want to not just pass but pass well and without a doubt and in my opinion what I kept stumbling on (over and over and over) was the deeper technical and practical base knowledge upon which the theory builds.

Changes

Because this stumbling block was not the exception but instead the rule I am going to be adding more in-depth technical and practical “appreciation” to my notes so that these topics will hopefully become part of my knowledge base (KB) and long term memory. This hopefully will help me when I sit the next exam and similar questions come up.

Cisco Partner Enablement Training

Published

Deon Botha

on July 18, 2008

in Cisco Systems and Support

. 0 Comments

I am at the local Cisco offices today for Partner training. It’s basically Cisco letting Partners know where to find what on Cisco.com. For those of you that haven’t tried to find/navigate the Cisco Website it can be a little daunting at first (I remember how it was for me). The nuts and bolts of this training is Cisco letting Partners know what tools are available and giving us a bit of a demo (selling us on them).

I am writing this post so that I can keep these links in a central place; If you find them useful that’s cool. There are more tools available from Cisco like Quote Builder, Competitive Edge Portal, Sales Accelerator and others that I am not covering.

Most if not all of the tools I will be babbling on about will require a valid CCO login and that your CCO be linked to a valid Cisco Partner.

A good place to start if you are a new Cisco partner or just getting started on a new job at a Cisco Partner would be the Partner Enablement Page; from there you can find most of the tools that Cisco provide listen under logical headings that I will describe shortly below.

The first heading you will find is Develop whether this be business development or personal development it’s listed under here. First off the bat we have The Partner Enablement Page that gives you one click access to most of the Cisco tools that you will need under this section. Including tools like the Partner Enablement Navigator that is an online wizard for Partner enablement tools and resources to give you quick access to what you need when you need it. There is also a link to Partner Practice Builder that helps Partners create a strategic development plan for various decision making functions (i.e. whether to do Unified Communications or not?). Finally there is Partner Education Connection that provides online course content for most of their courses; the courses range from free to providing links to where training is available at Cisco Learning Partners.

Next up we have Market and this is a kind of obvious one this is links to tools that either help you market Cisco products (Campaign Builder) or give you specific and relevant information assist you to be more effective in marketing Cisco products (Cisco Customized Partner Intelligence).

Then we have Sell for those in the sales teams or supporting sales teams. Starting off with Cisco Demo Solutions which is a boxed demo solution available for purchase from Cisco. Then we have the Cisco Partner Helpline that gives partners access to technical product information, including assistance with network design and product selection.

Finally Deliver where you can find Steps to Success that has resources for selling, delivering and supporting business solutions throughout the network lifecycle.

Certguard and a Blog

Published

Deon Botha

on June 16, 2008

in Off-Topic

. 2 Comments

Since late last week there has been some waves in the online networking community about a post by Robert Williams from CertGuard. Since that post many things have happened, I am however not going to talk about the specific situation, how it is probably affecting the mentioned CCIE etc. Some notable comment can be read from members of the networking community like Colin McNamara, Arden Packeer and Greg Ferro

I have been following the situation and reading responses and trying to figure this out for myself. I am however finding myself with more questions than answers as I try and get information to make an educated decision as to the this whole story. My main questions are around Certguard.

To kick off why this whole thing is upsetting me and probably many other people. I practice what I do on my good name, If it calls for it I spend extra non-billing hours (working days without sleep) keeping my good name in tact with clients who are not happy with a product or service either I or a competitor placed because my good name and the good name of my vendor of choice is important to me. This extends into daily life where dressing appropriately for functions, being on time for meetings (early ussually) and being affable and amiable in company goes to preserving my good name. I have spent time, been careful and made sure my name is not sullied and not dragged through any mud or tarnished by schoolboy playground antics because people buy products and services from people. Basic marketing theory says that word of mouth is the best and worst marketing where one good experience brings maybe one extra customer; one bad experience sends 10 customers away forever. In the end of the day my good name is very important to me because it is my brand and my image. This situation is upsetting because it has to do directly with this concept and the sullying of someone’s good name in a disgraceful very underhanded way.

CertGuard seems to be a self appointed Information Technology (IT) Watchdog where it concerns test taking and certifications. How this is done around the back-end isn’t so clear to me at this point. I have read that they have no affiliation with Cisco or Pearson Vue (I only care about their links with Cisco I don’t much care whether Microsoft or another vendor uses their products/services). Their website isn’t exactly transparent as to all their specifics but I will outline my thoughts and findings below.

I want to know WHAT they do, they say they keep the industry clean by focusing on braindumps websites. For those who don’t know what braindumps are these are basically compiled documents of test questions that may or may not appear in the exams. A braindump is not certified study material according to the agreement you sign every time you take a Cisco exam. The fact remains to me that they aren’t affiliated with Cisco and they make a leap somewhere from “braindumps websites” to “decertifying individuals” that is a bit far fetched and I don’t know how that happens. This leap is more than just bothering me, its annoying me, I have looked through the CertGuard website, done Google Searches and tried asking others but no one knows WHAT they do other than selling a product type service.

Personally I learnt in grade school that cheating was wrong, I received a degree without trying to write crib notes on various body parts to get them into exams (a girl wrote half the theory on her breasts in one exam thinking it was the only place the invigilator wouldn’t look) and I certainly know that unless I know something outright I am not going to pass any exam (sometime down the line I am going to look stupid if I don’t know how to do something I have written an exam on). The company doesn’t seem to be closing down braindump websites but monitoring them, they dont seem affiliated with Cisco to take away a certifications from individuals and they seem to be selling information based products to end-users and not vendors. This whole thing leaves me with more questions than answers.

What CertGuard is doing is great in theory (noble and almost altruistic) protecting the intrinsic value of something like a certification (which is not like a conferred degree) is in everyones interest that is working towards getting that certification. What is rubbing me raw though is what do they actually do? Are they working for a Vendor at a higher level or are they trying to create a new economy for validating online 3rd party course content information? Are they trying to become the de facto “trusted authority” for who you can use for content and who you cant? Or are they none of the above and I’m just to stupid to see what they really do and don’t do.

One of the links in the pecking order that’s also bothering me is how CertGuard can share/give/pass information as a “trusted authority” to Cisco/Vue (other) and as a trusted authority Cisco/Vue acts on the information by tripping someone of a certification (if at all). My concern here is that I have paid a small fortune to get learning material, certifications, hardware and training from Cisco and/or Cisco Partners, I have spent countless hours in front of books, PEC, and at training losing sleep, weekends and time I could have spent focusing on other activities. If a company who is not affiliated with Cisco, recognized by Cisco and was not given a mandate by Cisco starts to act “as-if” they are working on behalf of Cisco I am going to be a very unhappy camper and would hope Cisco Systems and the community at large cuts them down to size instead of siding with them because you may be next.

I am unsure of CertGuards place in the macro network environment and how they interact with the ecosystem at this point. Is this a fear based marketing and advertising ploy in very bad taste to drum up traffic and in the end sales for their products. Network World seems to rubber stamp them and if not endorse them fully by allowing them a place from which to gather an audience. Their website doesn’t clearly state anything substantial about them, I want specifics, facts and concrete information if they are so important to the industry. I want to know that my future as a small fish in a big pond in the network industry isn’t going to be jepordized by some unknown CEO from a company who you know but also dont know what they do (I don’t trust them nor know anything about nor care about them*) turns my world upside down one sunny day.

The modus operandi of using a highly visible public platform in the network industry to blackball a blogger without prior consultation or attempted mediation is uncouth to say the least. This is something that I don’t think I can agree was/is the correct method(s) or acceptable in the least. As a person who is active online, who writes (in my case notes from various sources) and posts them to a blog, my concern is am I going to be the next lamb to slaughter (probably not but the fear is there). As rational or irrational as that is who will be the next target for Mr Williams? If you note their services they offer Blog & Forum Monitoring (feels like big brother is watching).

I certainly don’t get paid for blogging I also don’t know anyone who does, I am certainly not going to jeopardize my future so that someone can take me out at the knees for something because they feel a need to scratch something that itches.

*An online business without a complete website explaining at least Who they are, What they do, How they do it, Where they come from, How they relate to me, Why I should care, Why they should be there and have a Telephone number and Physical address FOR THE REASON I VISITED THE SITE in plain view without the need to search for it or do a whois on the domain in my experience is trying to scam me in some way.

In this case Who is Certguard to me as a Cisco Networker? What does CertGaurd have to do with Cisco? How does Certguard do what they do with relation to Cisco and Cisco Certification and the mechanics of it? Where is their value proposition with relation to Cisco and Cisco Certification? How this relates to my studies and certification process with Cisco? Why this will and will not affect me and my life? Why CertGaurd should be there and exist at all and affect my life? and where can I call someone if they make my life hell and/or buy a plane ticket to come make someones life hell if need be?

Finally I have probably edited this thing a 100 times to get it to say what I want I am adding links to the Disclaimer and if you want to know about me and finally should anyone try and muck me around thus far all posts fall under the following notice:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

Followup: Ethan Banks is back in action, his blog post can be found here.

Followup: Robert Williams public apology to Ethan Banks and the Network Community.

BCMSN Practical Lab Initial Config

Published

Deon Botha

on June 9, 2008

in BCMSN, Certification and Cisco Systems

. 2 Comments

The Topology

The above topology shows (from the top) a Distribution and Access switched network design with redundant links between Distribution switches and Distribution and Access Layers. Finally there are two attached end-devices (workstations).

The network is going to use the 192.168.1.0 network using the /24 (255.255.255.0) subnet thus allowing for 254 hosts on the network.

Lets say that the DSW switches are MLS switches for argument sake (I know the diagram doesn’t show it).

If you look at the colour key at the bottom you will find that each link colour combination represents a fastethernet port in this case. It’s a fairly simple Lab so its easy to have each link connected on Access Switch fe0/1 and then Distribution Switch fe0/1 on the other end.

I didn’t want to make much work for myself connecting things weird but you can do that by all means. All that means is that you really have to pay attention when you configure when Access Switch fe0/1 connects to Distribution Switch fe0/8 or something weird on one switch and then Access Switch fe0/5 connects to Distribution Switch fe0/12 on the other.

There is however still a catch to this lab layout, notice that from DSW1 to DWS2 the connections flip and the same applies to the ASW1 and ASW2 (meaning DSW1 fe0/1 connects to ASW1 while DSW2 fe0/1 connects to ASW2). Something that means I have to stay awake but not on my toes.

Initial Configuration

The initial configuration entails some things old (CCNA) and some one new command (not drastically new). I am going to go through what I am doing to practice for the exam and annotate the commands and generally what they do.

I am a weird Muppet, I want to know what and more importantly why something has to be used (probably the reason it takes me so long to study things). I can’t make sense of something unless I know command X is used to enable/do Y and relates to the theory in such and such a fashion for a particular reason.

Distribution Switch 1

Step 1: Setup the basics all of the following is CCNA level stuff and should easy if not second nature. This is to get the security and host name down before going onto the interface configuration.

Enter Privileged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname DSW1 Enable secret and password DSW1(config)#enable secret ciscosystems DSW1(config)#enable password cisco Setup a local user database DSW1(config)#username admin@mydomain.com privilege 15 password cisco Setup the console port password DSW1(config)#line con 0 DSW1(config-line)#login local DSW1(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password DSW1(config)#line vty 0 4 DSW1(config-line)#password cisco DSW1(config-line)#login DSW1(config-line)#exit Setup the Auxiliary Password DSW1(config)#line aux 0 DSW1(config-line)#no exec DSW1(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch DSW1(config)#interface vlan 1 DSW1(config-if)#ip address 192.168.1.1 255.255.255.0 DSW1(config-if)#no shut DSW1(config-if)#exit

Step 3: Setup other interfaces

Setup Fastethernet Interfaces DSW1(config)#interface fastethernet 0/1 DSW1(config-if)#description DSW1 - ASW1 DSW1(config-if)#speed 100 DSW1(config-if)#duplex auto DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/2 DSW1(config-if)#description DSW1 - ASW1 DSW1(config-if)#speed 100 DSW1(config-if)#duplex auto DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/3 DSW1(config-if)#description DSW1 - ASW2 DSW1(config-if)#speed 100 DSW1(config-if)#duplex auto DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/4 DSW1(config-if)#description DSW1 - ASW2 DSW1(config-if)#speed 100 DSW1(config-if)#duplex auto DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/11 DSW1(config-if)#description DSW1 - DSW2 DSW1(config-if)#speed 100 DSW1(config-if)#duplex auto DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/12 DSW1(config-if)#description DSW1 - DSW2 DSW1(config-if)#speed 100 DSW1(config-if)#duplex auto DSW1(config-if)#no shut DSW1(config-if)#exit

Alternatively use range command

Setup Fastethernet Interfaces DSW1(config)#interface fastethernet 0/1 DSW1(config-if)#description DSW1 - ASW1 DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/2 DSW1(config-if)#description DSW1 - ASW1 DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/3 DSW1(config-if)#description DSW1 - ASW2 DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/4 DSW1(config-if)#description DSW1 - ASW2 DSW1(config-if)#exit DSW1(config)#interface range fastethernet 0/1 - 4 DSW1(config-if-range)#speed 100 DSW1(config-if-range)#duplex auto DSW1(config-if-range)#no shut DSW1(config-if-range)#exit DSW1(config)#interface fastethernet 0/11 DSW1(config-if)#description DSW1 - DSW2 DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/12 DSW1(config-if)#description DSW1 - DSW2 DSW1(config-if)#exit DSW1(config)#interface range fastethernet 0/11 - 12 DSW1(config-if-range)#speed 100 DSW1(config-if-range)#duplex auto DSW1(config-if-range)#no shut DSW1(config-if-range)#exit

Step 4: Shut down non-used interfaces

Aministratively shut down all ports not connected DSW1(config)#interface range fastethernet 0/5 - 10 DSW1(config-if-range)#shut DSW1(config-if-range)#exit Exit Global Configuration Mode DSW1(config)#exit

Step 5: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct DSW1#show interfaces status show run the running configuration DSW1#show run

Step 6: Save your work

Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)... oops copy start run DSW1#copy run start

Distribution Switch 2

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname DSW2 Enable secret and password DSW2(config)#enable secret cisco DSW2(config)#enable password cisco Setup a local user database DSW2(config)#username admin@mydomain.com privilege 15 password cisco Setup the console port password DSW2(config)#line con 0 DSW2(config-line)#login local DSW2(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password DSW2(config)#line vty 0 4 DSW2(config-line)#password cisco DSW2(config-line)#login DSW2(config-line)#exit Setup the Auxiliary Password DSW2(config)#line aux 0 DSW2(config-line)#no exec DSW2(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch DSW2(config)#interface vlan 1 DSW2(config-if)#ip address 192.168.1.50 255.255.255.0 DSW2(config-if)#no shut DSW2(config-if)#exit

Step 3: Setup other interfaces

Setup Fastethernet Interfaces DSW2(config)#interface fastethernet 0/1 DSW2(config-if)#description DSW2 - ASW2 DSW2(config-if)#speed 100 DSW2(config-if)#duplex auto DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/2 DSW2(config-if)#description DSW2 - ASW2 DSW2(config-if)#speed 100 DSW2(config-if)#duplex auto DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/3 DSW2(config-if)#description DSW2 - ASW1 DSW2(config-if)#speed 100 DSW2(config-if)#duplex auto DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/4 DSW2(config-if)#description DSW2 - ASW1 DSW2(config-if)#speed 100 DSW2(config-if)#duplex auto DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/11 DSW2(config-if)#description DSW2 - DSW1 DSW2(config-if)#speed 100 DSW2(config-if)#duplex auto DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/12 DSW2(config-if)#description DSW2 - DSW1 DSW2(config-if)#speed 100 DSW2(config-if)#duplex auto DSW2(config-if)#no shut DSW2(config-if)#exit

Alternatively use range command

Setup Fastethernet Interfaces DSW2(config)#interface fastethernet 0/1 DSW2(config-if)#description DSW1 - ASW1 DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/2 DSW2(config-if)#description DSW1 - ASW1 DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/3 DSW2(config-if)#description DSW1 - ASW2 DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/4 DSW2(config-if)#description DSW1 - ASW2 DSW2(config-if)#exit DSW2(config)#interface range fastethernet 0/1 - 4 DSW2(config-if-range)#speed 100 DSW2(config-if-range)#duplex auto DSW2(config-if-range)#no shut DSW2(config-if-range)#exit DSW2(config)#interface fastethernet 0/11 DSW2(config-if)#description DSW1 - DSW2 DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/12 DSW2(config-if)#description DSW1 - DSW2 DSW2(config-if)#exit DSW2(config)#interface range fastethernet 0/11 - 12 DSW2(config-if-range)#speed 100 DSW2(config-if-range)#duplex auto DSW2(config-if-range)#no shut DSW2(config-if-range)#exit

Step 4: Shut down non-used interfaces

Aministratively shutdown all ports not connected DSW2(config)#interface range fastethernet 0/5 - 10 DSW2(config-if-range)#shut DSW2(config-if-range)#exit Exit Global Configuration Mode DSW2(config)#exit

Step 5: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct DSW2#show interfaces status show run the running configuration DSW2#show run

Step 6: Save your work

Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)... oops copy start run DSW2#copy run start

Access Switch 1

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname ASW1 Enable secret and password ASW1(config)#enable secret cisco ASW1(config)#enable password cisco Setup a local user database ASW1(config)#username admin@mydomain.com privilege 15 password cisco Setup the console port password ASW1(config)#line con 0 ASW1(config-line)#login local ASW1(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password ASW1(config)#line vty 0 4 ASW1(config-line)#password cisco ASW1(config-line)#login ASW1(config-line)#exit Setup the Auxiliary Password ASW1(config)#line aux 0 ASW1(config-line)#no exec ASW1(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch ASW1(config)#interface vlan 1 ASW1(config-if)#ip address 192.168.1.100 255.255.255.0 ASW1(config-if)#no shut ASW1(config-if)#exit

Step 3: Setup other interfaces

Setup Fastethernet Interfaces ASW1(config)#interface fastethernet 0/1 ASW1(config-if)#description ASW1 - DSW1 ASW1(config-if)#speed 100 ASW1(config-if)#duplex auto ASW1(config-if)#no shut ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/2 ASW1(config-if)#description ASW1 - DSW1 ASW1(config-if)#speed 100 ASW1(config-if)#duplex auto ASW1(config-if)#no shut ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/3 ASW1(config-if)#description ASW1 - DSW2 ASW1(config-if)#speed 100 ASW1(config-if)#duplex auto ASW1(config-if)#no shut ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/4 ASW1(config-if)#description ASW1 - DSW2 ASW1(config-if)#speed 100 ASW1(config-if)#duplex auto ASW1(config-if)#no shut ASW1(config-if)#exit

Alternatively use the range command

Setup Fastethernet Interfaces ASW1(config)#interface fastethernet 0/1 ASW1(config-if)#description DSW1 - ASW1 ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/2 ASW1(config-if)#description DSW1 - ASW1 ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/3 ASW1(config-if)#description DSW1 - ASW2 ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/4 ASW1(config-if)#description DSW1 - ASW2 ASW1(config-if)#exit ASW1(config)#interface range fastethernet 0/1 - 4 ASW1(config-if-range)#speed 100 ASW1(config-if-range)#duplex auto ASW1(config-if-range)#no shut ASW1(config-if-range)#exit

Step 4: This is where the ASW and the DSW switches differ. This connects to the Workstation end-point where the DSW switches use port 11/12 to provide failover for the distribution

Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface ASW1(config)#interface fastethernet 0/12 ASW1(config-if)#description ASW1 - PC1 ASW1(config-if)#speed 10 ASW1(config-if)#duplex half Make the port as an access port ASW1(config-if)#switchport mode access ASW1(config-if)#no shut ASW1(config-if)#exit

Step 5: Shut down non-used interfaces

Aministratively shutdown all ports not connected ASW1(config)#interface range fastethernet 0/5 - 11 ASW1(config-if-range)#shut ASW1(config-if-range)#exit Exit Global Configuration Mode ASW1(config)#exit

Step 5: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct ASW1#show interfaces status show run the running configuration ASW1#show run

Step 6: Save your work

Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)... oops copy start run ASW1#copy run start

Access Switch 2

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname ASW2 Enable secret and password ASW2(config)#enable secret cisco ASW2(config)#enable password cisco Setup a local user database ASW2(config)#username admin@mydomain.com privilege 15 password cisco Setup the console port password Setup the console port password ASW2(config)#line con 0 ASW2(config-line)#login local ASW2(config-line)#exit Setup the Auxiliary Password ASW2(config)#line aux 0 ASW2(config-line)#no exec ASW2(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password ASW2(config)#line vty 0 4 ASW2(config-line)#password cisco ASW2(config-line)#login ASW2(config-line)#exit

Step 2: Setup the management interface

Setup the default VLAN ip address from remote ip admin if there was a GUI and to Telnet to the switch ASW2(config)#interface vlan 1 ASW2(config-if)#ip address 192.168.1.200 255.255.255.0 ASW2(config-if)#no shut ASW2(config-if)#exit

Step 3: Setup other interfaces

Setup Fastethernet Interfaces ASW2(config)#interface fastethernet 0/1 ASW2(config-if)#description ASW2 - DSW2 ASW2(config-if)#speed 100 ASW2(config-if)#duplex auto ASW2(config-if)#no shut ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/2 ASW2(config-if)#description ASW2 - DSW2 ASW2(config-if)#speed 100 ASW2(config-if)#duplex auto ASW2(config-if)#no shut ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/3 ASW2(config-if)#description ASW2 - DSW1 ASW2(config-if)#speed 100 ASW2(config-if)#duplex auto ASW2(config-if)#no shut ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/4 ASW2(config-if)#description ASW2 - DSW1 ASW2(config-if)#speed 100 ASW2(config-if)#duplex auto ASW2(config-if)#no shut ASW2(config-if)#exit

Alternatively use the range command

Setup Fastethernet Interfaces ASW2(config)#interface fastethernet 0/1 ASW2(config-if)#description DSW1 - ASW1 ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/2 ASW2(config-if)#description DSW1 - ASW1 ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/3 ASW2(config-if)#description DSW1 - ASW2 ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/4 ASW2(config-if)#description DSW1 - ASW2 ASW2(config-if)#exit ASW2(config)#interface range fastethernet 0/1 - 4 ASW2(config-if-range)#speed 100 ASW2(config-if-range)#duplex auto ASW2(config-if-range)#no shut ASW2(config-if-range)#exit

Step 4: This is where the ASW and the DSW switches differ. This connects to the Workstation end-point where the DSW switches use port 11/12 to provide failover for the distribution

Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface ASW2(config)#interface fastethernet 0/12 ASW2(config-if)#description ASW2 - PC2 ASW2(config-if)#speed 10 ASW2(config-if)#duplex half ASW2(config-if)#no shut Make the port as an access port ASW2(config-if)#switchport mode access ASW2(config-if)#exit

Step 5: Shut down non-used interfaces

Aministratively shutdown all ports not connected ASW2(config)#interface range fastethernet 0/5 - 11 ASW2(config-if-range)#shut ASW2(config-if-range)#exit Exit Global Configuration Mode ASW2(config)#exit

Step 5: Check your work

Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct ASW2#show interfaces status show run the running configuration ASW2#show run

Step 6: Save your work

Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)... oops copy start run ASW2#copy run start

For more information on Commands and why to use a command in a certain place check out the Cisco Command lookup tool (CCO Login required)

Cisco CDP

In a LAB or Real World (RW) situation you would telnet or console into Distribution Switch 1 (DSW1) and work from there. First off I am going to use CDP to discover the network topology. This is old work from the CCNA and useful if you (1) don’t know the network topology, (2) remote into a network to do work and need to hop from one device to another and need network information, (3) have a huge network and never bothered to document growth (ISPs), or (4) you are too lazy or there is a foot thick metal vault door between you and the kit and changing the console cable from one switch/router to another one isn’t going to happen.

The following command gives a basic table of information,
DSW1#show cdp neighbors
To get specific information use,
DSW1#show cdp neighbors detail
With that information you can then do something like this:
DSW1#telnet 192.168.1.50 Trying 192.168.1.50 ... Open User Access Verification Password:_ DSW2#

Terminology:

Two terms that I have been made aware of recently that I need to remember out-of-band management and in-band management.

Out-of-Band Management is the use of a dedicated channel for device maintenance. Example of this would be using the Console port (Serial) or maybe the Auxiliary port (modem – pots – offsite) for management purposes.

In-Band Management is the use of regular channels for device maintenance. Example of this would be using Ethernet for Console Access (when you change the IP Address the session ends).

Notes and Notices:

Cisco and DDNS

Published

Deon Botha

on June 4, 2008

in Cisco Systems, Concepts and Constructs, DDNS and Support

. 3 Comments

A little off-topic (switching being topic at the moment) but I ran into this today again and wanted to jot it down quick.

WARNINGS: The commands below enable public access to internal resources. This should not be done if you do not understand Access Control Lists (ACL) and/or have a proper Firewall (not windows Firewall) installed maybe a PIX or ASA even ISA Server would do. I prefer not doing this at all because it creates a rather obvious place for network attacks to happen. You must know that these commands are what I know to work, you may disagree and I would love to hear what you do/use. I take no responsibility whatsoever as to how you use these commands and you shall be responsible for your losses or your clients losses if you do not implement this correctly or data/information is stolen.

Dynamic Domain Name Service (DDNS) is a service that lets anyone on the internet gain access to resources on a local network when that local network is connected to the internet through a Dynamic (constantly changing) IP Address connection (most ADSL connections).

To understand the concept Domain Name Service (DNS) is the mapping of IP Addresses (192.168.0.1) to human-readable computer hostnames (www.companyweb.org) that is used by routers and other networking infrastructure to delivery information as needed. The internet uses DNS so that we can go to www.google.co.za and not have to remember the IP Address for google and the million other sites online.

DDNS makes it possible for Small, Medium Business (SMB) to allow employees, customers, partners and other stakeholders access to internal resources (mail, intranet, pricelists, documents, etc) without the requirement to pay for static IP address access to the internet. This is not limited to SMB as some larger companies have dynamic connections and also use the service. There are of course security concerns and problems with DDNS.

By enabling DDNS you allow external (untrusted) access to internal (trusted) resources. This leads to not just known (employees, customers, partners and other stakeholders) visitors but unknown (random hits, hackers, etc). If you do not implement the proper security you may and probably will lose information and data without even knowing it.

On the SMB range Cisco Series Routers upward the DDNS command is supported and services like Dyndns can be configured without much hassle. There are some small things to watch out for though that I will cover below.

Step 1: Open an Account with DynDNS (Other services work with Cisco Routers). I however have only used DynDNS and I am happy with them. Check the config guide from Cisco for the other commands. Once you have the DynDNS account setup a free DynDNS hostname they have many options like your-option.domain.com and write down this and your username and password.

Step 2: Add DynDNS.org to your Host list and Statically apply your ISP DNS servers. This works best, you could just not do this but it works better if you do.

Router(config)#ip host members.dyndns.org 63.208.196.96 Router(config)#ip name-server xxx.xxx.xxx.xxx Router(config)#ip name-server xxx.xxx.xxx.xxx

Things to change xxx.xxx.xxx.xxx is your ISP DNS Server address, primary first address, secondary address second.

For those with ISPs that love changing their DNSs regularly (I know some ISPs change their DNS servers monthly, they have a list of DNSs and the active ones any given month would be any persons lucky assumption) this is great if you charge by the hour and bad for your client because they will see you every month (i.e. bad for Cisco’s image because a client thinks his Cisco kit breaks every month).

Via Etherealmind you can give OpenDNS a try. OpenDNS is DNS with a little extra as they inlcude Phising protection and spelling correction in their service.

Step 3: This is tricky because it uses a special character, play around with this and see what happens. When you get to the special character in the line press Ctrl+V to allow for the character input in IOS

Router(config)#ip ddns update method dyndns Router(DDNS-update-method)#HTTP Router(DDNS-HTTP)#http://DYNDNS-USERNAME:DYNDNS-PASSWORD@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a> Router(DDNS-update-method)#interval maximum 0 28 0 0

If you don’t get it, the special character I mentioned is the question mark, which won’t be allowed to be input without the CTRL+V. Things to Change DYNDNS-USERNAME is your DynDNS Username and DYNDNS-PASSWORD is your DynDNS Password

Step 4: On the Dialer interface (not the ATM, fastethernet, gigabitethernet interfaces). This could also be put on the Serial interface (say for a flapping link, if you have a Leased line for internet but then you would probably have a static IP address) why you would use DDNS then I dont know but it could and would probably work.

Router(config)#interface Dialer1 Router(config-if)#ip ddns update hostname your-option.domain.com Router(config-if)#ip ddns update dyndns host members.dyndns.org

Things to change your-option.domain.com is the choice for the domain you made at DynDNS like game-server.dyndns.org.

Step 5: We are doing this for a reason and the reason behind DDNS is to have a private resource available to the public internet. To achieve this in IPv4 NAT or PAT is used when a single Internet connection is available. NAT basically takes multiple internal addresses and allows all those addresses to access the internet at once through a single internet connection. For this to work you need to configure your NAT inside and NAT outside.

Router(config)#interface Dialer1 Router(config-if)#nat outside Router(config-if)#exit Router(config)#interface vlan VLAN-Number Router(config-if)#nat inside

I use a VLAN and map the VLAN to an fastethernet or gigabitethernet interface, you may or may not do it this way.

Step 6: Configure NAT extend a internal resource to the public. I am say doing this for Small Business Server 2003 (SBS) for Exchange Outlook Web Access (OWA). This uses HTTP port 80 and HTTPS port 443. Consider only doing this if you have Premium Edition (comes with ISA Server) so that you can excercise some control over what you publish and what you dont publish.

Router(config-if)#ip nat inside source list 101 interface Dialer1 overload Router(config-if)#ip nat inside source static tcp xxx.xxx.xxx.xxx 80 interface Dialer1 80 Router(config-if)#ip nat inside source static tcp xxx.xxx.xxx.xxx 443 interface Dialer1 443

Things to change here would be the xxx.xxx.xxx.xxx which is the SBS IP address (default is 192.168.16.2)

Step 7: Disable the Router HTTP and HTTPS server so that you won’t be getting the routers login page when you try access the your-option.domain.com. Which is both annoying, could break the functionality and also is a security risk.

Router(config-if)#no ip http server Router(config-if)#no ip http secure-server

This command will disable the WEB GUI!!!! If this is a problem consider not configuring DDNS. This command may break functionality because it also uses HTTP port 80 meaning that if you type the url the router wont know whether to give you OWA or WEB GUI. It’s a security problem because everyime someone comes to the external website on port 80 the router will ask for level 15 login and password (Cisco specific information and anyone that knows network kit knows this means Cisco kit lurks yonder) and they may well actually get into the router and factory-reset it for you should they be able to login or you haven’t chosen a secure password (which is not good).

Step 8: Configure ACLs (at least) for WAN traffic). Some ISR routers come with options of Firewall consider configuring that too. Disable CDP on external facing interfaces etc (IOW take due care and dilligence in setting up a proper secure router plus some more because you are letting the outside world into the private network).

Step 9: To Verify DDNS using the show commands

Router(config)#show ip ddns update

Alternatively you can use the debug command

Router(config-if)#debug ip ddns update

Step 10 :I’m not paranoid (all this talk of security), I just don’t like gambling with lady luck. Exposing any part of the internal network to the outside world is a security risk that can be mitigated (not totally) but controlled. Consider this and how to mitigate the risk before exposing something like SBS (which by all accounts is the Business Nervous System in a SMB).

Notes and Notices:

Anything free is meant to be taken with a pound of salt. I take no responsibility for loss or damage from implementation of the above commands on routers or networks without proper consultation and documentation done by myself in person with end-users. I do not suggest this configuration, by writing this I do not imply that this is a good idea to implement or configure in all situations.

In good afrikaans “Die is als voets-toets”.

Switch Security Layer-2 Attacks – Four

Published

Deon Botha

on May 28, 2008

in ACL, BCMSN, CDP, Certification, Cisco Systems, Concepts and Constructs, SSH, Telnet and VTY

. 0 Comments

CDP

Cisco Discovery Protocol (CDP) is a useful and great protocol when you are sitting on the other side of the office/country/planet and don’t know what you are working with on a network but CDP has some holes for attackers to leverage that can cause problems.

CDP uses clear-text and unauthenticated to send information about network topology between network devices. An attacker can use a packet sniffer to get information about network infrastructure that we don’t really want them to have.

CDP isn’t needed on ports that no network management is done (this isn’t the case for Cisco IP Phones). You can also go ballistic and disable CDP totally thats up to you. To disable CDP use the following commands

CDP per-port

switch(config)#configure terminal switch(configp)#interface gigabitethernet 0/1 switch(config-if)#no cdp enable

CDP Globally

switch(config)#configure terminal switch(config)#no cdp run

Be careful with this, CDP is used in conjunction with or as support for other Cisco protocols

Telnet

Telnet has a few problems:

All usernames, passwords, and data sent over a public network (read: Internet) is sent in clear text and is thus vulnerable.
A user with an account on the system can gain elevated privelages.
A remote attacker could crash the Telnet service, preventing legitimate service rendering.
A remote attacker could find an enabled guest account that may be present anywhere in the trusted domain of the server.

iow Dont Telnet over the internet

SSH

SSH is a client and server protocol used to log in to another computer over a network. It provides strong authentication and secure communication over a public communication network. SSH may be “more” secure many vendors implementations of SSH is vulnerable.

switch(config)#configure terminal switch(config)#line vty 0-15 switch(config-line)#transport input ssh

VTY Access Control Lists (ACL)

One can associate ACLs to permit or deny access to a vty port to a switch.

The Number of VTYs differ make sure you get it right and configure an ACL on ALL the VTY connections and don’t leave one open

switch(config)#configure terminal switch(config)#access-list 12 permit 192.168.0.0 0.0.255.255 switch(config)#line vty 0 15 switch(config-line)#access-class 12 in

Notes and Notices:

Network Ninja

Tag Archive for 'CCO'

Open Shortest Path First – OSPF Fundamentals – DR and BDR

Enhanced Interior Gateway Routing Protocol – Introduction

BSCI Design Foundation – Network Models

New Cisco IOS Software Activation and Licensing Workflows

BCMSN Passed

Cisco Partner Enablement Training

Certguard and a Blog

BCMSN Practical Lab Initial Config

Cisco and DDNS

Switch Security Layer-2 Attacks – Four

Search

About

Latest

Archives

Categories