The Long Road to Cisco
A while ago Arden Packeer posted about his disapointment regarding the CCIE plaque design recently chosen by Cisco. Many other CCIEs also voiced their disapointment. This post isn’t directly related to the CCIE plaque but may affect the overall desing with a new logo and hopefully they may change the plaque because a new logo will have to be placed on the plaque.
Good news is that the logo isn’t just CCIE logos but also the entire Cisco Certification Triangle.
So I just booked for Networkers at Cisco Live! if you haven’t followed I posted about it back in June and have been looking forward to it since then. This is going to be the first time that Networkers is going to be held outside the USA and the chosen location is Johannesburg, South Africa.
Its great that Networkers is going to be in my back yard like one city over and all but DAAAAMN!!!! this better be the best conference ever because I feel raped after booking, with the invoice coming in at just under $ 1,000 USD.
To break that down its entrance for Networkers at Cisco Live with an $80 USD discount, the Techtorial session, and cause you spending so much money anyway the Social Pass (it better be open bar) to ease the pain and suffering of a long day. I’m still going to commute between cities and skip on the hotel don’t think thats going to fly over well including the ticket price.
So in short Im still majorly stoked to go but this better be the BEST conference EVER for the insane ticket price. I also somehow need to recoup the ticket price in either Keynotes, Super Sessions, Technical Breakout Sessions, Case Studies, Technical Solutions Clinic, Meet the Engineer, Techtorial Session and or Business contacts else I am going to go crazy and pocket my way through branded conference freebies that I can use for marketing/PR/advertising customer give-aways till sometime after 2010.
If you considering going book now, the $80 discout is only valid for a short period of time.
EIGRP builds and maintains three tables,
Creating the Neighbour Table
As previously stated, the neighbour table is maintained through Hello packets (These are multicast announcements that the router is alive).
Each Layer-3 Protocol supported by EIGRP (IPv4, IPv6, IPX and AppleTalk) has its own separate Neighbour Table. Information about neighbours, routes, or costs are not shared between protocols.
Contents of the Neighbour Table (Resource 1, 2)
Becoming a Neighbour
All EIGRP routers periodically announce themselves with the Hello packet using multicast (224.0.0.10). On hearing a Hello (receiving) routers add an entry in the Neighbour Table (the continued receipt of Hello packets maintain the neighbour table).
If a Hello packet is not received from a neighbour within the holdtime (3x the Hello timer) the neighbour is removed from the Neighbour Table.
To become a neighbour, the following conditions must be met:
Creating the Topology Table
After a router knows who neighbours are, it can create a Topology Table, assign Successors and Feasible Successors for each route (The Topology Table has a record of all routes not only Successors and Feasible Successors). The other routes are referred to as possibilities.
The topology table includes the following information:
The Topology Table is built from Update Packets that are exchanged by neighbours and by Replies to Queries sent by the router.
Queries and Responses used by EIGRP are sent reliably as multicast using RTP. If a router does not hear an ACK within the allotted time, it retransmits the packet as a unicast (16 times) after which the router marks the neighbour as dead.
Each time the router sends a packet, RTP increments the sequence number by one. The router must hear an ACK from EVERY router before it can send the next packet.
When all this is done the router has an understanding of the topology, it then runs DUAL to determine the BEST PATHS to the remote network. The result is entered into the Network Table.
Maintaining the Topology Table
The Topology Table may be recalculated because
Adding a Network to the Topology Table
Deleting a Path or Router from the Topology Table
Finding an alternate path to Remote Network
Creating the Routing Table
The Routing Table in EIGRP is built from the Topology Table using DUAL. The Topology Table holds all routing information known to the router and from this information successors and feasible successors are selected. Successors are passed to the Routing Table and used for routing decisions.
EIGRP Path Selection
Go here for more information on the metric.
Updating the Routing Table in Passive Mode with DUAL
When a path is lost, DUAL first looks in the Topology Table for a FD; If none the router stays in passive mode (as opposed to active mode where the router actively queries for alternative paths).
Updating the Routing Table in Active Mode with DUAL
When no alternative route is found in the Routing Table, the following actions occur. The Topology Table of Router A starts with a path (successor) of A to D to G to X. The FD is 20, and the AD from Router D is 15. When Router D dies, Router A must find an alternate path to X.
EIGRP Network Design
Factors that can affect of EIGRP include:
Poorly scaled EIGRP networks result in:
Other factors (poor design) cause some of these symptoms because resources are overwhelmed with assigned tasks.
EIGRP Design Issues
Major concern in scaling an organizations network is controlling advertisements and limiting query range (NB over slow WAN links). Sending less information about the network there is more bandwidth available to clients and servers. This relieves the network and speeds convergence, it provides less information for alternate paths though.
EIGRP automatically summarizes at classful network boundaries because summarization is generally helpful and EIGRP is built to recognize opportunities such as this to optimize the network (Most Admins disable auto summarization because it does not match their needs, instead manually configure it at interface level).
Certain topologies pose problems for EIGRP networks. Like the hub-and-spoke design often used between remote sites and regional offices. Popular dual-hub configuration provides redundancy and allows for potential for routers to reflect queries back to one another. Summarization and filters make network design work well while also allowing queries to be managed effectively.
Guideline to Scaling Issues
I’m very strange. Every time I type Hello, I have a voice in my head going “Hello Kitty”. So share my pain “Hello Kitty”!
I’m going to kick myself later when I read over this post again cause this is going to get stuck in my head again.
Resources:
Notes and Notices:
This is a part of my personal BSCI notes and research to assist myself in learning and understanding the concepts and theory for the BSCI exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BSCI Certification.
Design – Hierarchical
Where networks once were non-hierarchical (layer-1 design, layer-2 design, layer-3 design) they are generally now three-layer hierarchical in design (above). Cisco has been using this model for years and it gave a high-level overview of how a reliable network could be conceived but was largely conceptual because it did not provide specific guidance on “how-to” implement certain things, like:
Design – Enterprise Composite Network Model (ECNM)
Revisions to the hierarchical design showed redundant distribution and core devices and connections to make the hierarchical model more fault tolerant. The switch block design (above) explained how redundancy fit into a network, but still did not really adequately specify other parts of the network design. This lead to the Enterprise Composite Network Model (ECNM) development to address the failures of both the hierarchical model and switch block model.
This ECNM is broken into three large pieces:
ECNM – Campus
The enterprise campus looks very much like the above switch block design with some added details:
The ECNM Campus builds onto the Switch block design but gives specific guidance as to where to place servers and management equipment. Take note that the servers look like a switch block and are redundantly attached (dual-homed) to the switches (not really shown nicely in the diagram).
ECNM – Enterprise Edge
The Enterprise edge shows the connections that the enterprise has with the wide area (other networks) and include:
ECNM – Service Provider Edge
The service provider edge includes the public networks that facilitate wide area (other networks) connectivity:
Multiplexing
Historically voice traffic used one set of circuits and data traffic another. Also if you wanted more than one “number” the telecommunications company installed another physical line to your premises. If you wanted access to a data network they installed a data line for that purpose.
With line technologies like the T-carrier system (USA, Japan, Korea) 24 pulse-code modulated (I don’t know need to ask one the engineers about this), time-division multiplexed speech signals are carried over 2 copper pairs. This type of technology saved the telecommunications companies a lot of money in building out subscriber lines. The problem with T1 as a technology is that it cannot adjust as the customer usage requirements changes (see E-carrier system for Europe and other countries).
As technology changes so does the requirements from that technology; Modern networks are designed to carry voice, video, enterprise applications, normal LAN traffic and management traffic all on the same single secure infrastructure (convergence). The traffic is forced (statistically multiplexed) to share access to the network.
Service-Orientated Network Architecture (SONA) and Intelligent Information Network (IIN)
As covered above “Multiplexing” described the idea of a converged network as a system that integrates what was previously disparate systems (voice, video, data). The traffic types usually found on a converged network would include, but may not be limited to:
Each of the above traffic types has its own requirements and expectations that govern its successful execution. These requirements include security, QoS, transmission capacity, and delay.
To support this kind of multiplexed traffic, Cisco routers are able to implement filtering, compression, prioritization, and policing (dedicating network capacity). Except for the filtering process these processes are collectively known as QoS.
As an alternative to QoS, Cisco has an ideal called the Intelligent Information Network (IIN). This vision describes a network that integrates network and application functionality cooperatively allowing the network to be “smart” about how it handles traffic to minimize the footprint of applications. The IIN evolution is described in three phases:
Service-Orientated Network Architecture (SONA) is the practical application or “how-to” of IIN in enterprise networks. SONA breaks down IIN into three layers;
Resources:
Aragoen Celtdra on BSCI: Network Architecture and Design
Notes and Notices:
This is a part of my personal BSCI notes and research to assist myself in learning and understanding the concepts and theory for the BSCI exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BSCI Certification.
So Arden Packeer has been a busy guy it seems what with passing his CCIE Routing and Switching recently and starting off on the road towards another CCIE (Voice).
Tweeted this morning (for me at least) Arden launched CCIE Magazine and has the inauguration post up. Head on over and support a Networker in his endeavours; leave a comment, subscribe to the RSS feed, Digg, Delicious, and StumbleUpon the content and maybe even take out an ad if you are looking for some exposure for your own product or service (consider the exposure for recruiting advertising and the target audience for CCIE Magazine, thinking about yesterdays post).
It’s early days over at CCIE Magazine but it’s sure to grow into something grand.
Cisco today announced three new Cisco Certified Network Associate (CCNA®) concentrations namely Security, Voice and finally Wireless. All candidates wanting to go for the concentrations must have the CCNA first and then can specialize into one of the fields of interest.
The idea behind this config is to enable Quality of Service (QoS) create access-lists that apply to certain traffic/data (TFTP, FTP and icmp (echo) in this case), define a class, create a policy define precedence and apply those settings to downstream switches. If you remember from previous QoS posts the higher the precedence (voice) the more important and delay sensitive the lower the precedence (www) the less delay sensitive and easier it can handle dropped packets without end-user issues.
PC1 is in VLAN 10 with IP address 192.168.10.200 255.255.255.0 Default Gateway (DG) 192.168.10.1
PC2 is in VLAN 20 with IP Address 192.168.20.250 255.255.255.0 DG 192.168.10.50
Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname DSW1
Enable secret and password
DSW1(config)#enable password cisco
DSW1(config)#enable secret cisco
Setup the console port password
DSW1(config)#line con 0
DSW1(config-line)#password cisco
DSW1(config-line)#login
DSW1(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
DSW1(config)#line vty 0 4
DSW1(config-line)#password cisco
DSW1(config-line)#login
DSW1(config-line)#exit
Setup the default VLAN
DSW1(config)#interface vlan 1
DSW1(config-if)#ip address 192.168.1.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit
Setup VLAN 10
DSW1(config)#interface vlan 10
DSW1(config-if)#ip address 192.168.10.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit
Setup VLAN 20
DSW1(config)#interface vlan 20
DSW1(config-if)#ip address 192.168.20.1 255.255.255.0
DSW1(config-if)#no shut
DSW1(config-if)#exit
Setup Fastethernet Interfaces
DSW1(config)#interface fastethernet 0/1
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/2
DSW1(config-if)#description DSW1 - ASW1
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/3
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/4
DSW1(config-if)#description DSW1 - ASW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/11
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#interface fastethernet 0/12
DSW1(config-if)#description DSW1 - DSW2
DSW1(config-if)#no shut
DSW1(config-if)#exit
Enable QoS Globally
DSW1(config)#mls qos
Create Access Lists
DSW1(config)#access-list 150 permit udp any any eq tftp
DSW1(config)#access-list 150 permit tcp any any eq ftp
DSW1(config)#access-list 150 permit tcp any any eq ftp-data
DSW1(config)#access-list 151 permit udp any any eq echo
DSW1(config)#access-list 151 permit udp any any eq echo-reply
DSW1(config)#access-list 151 permit udp any any eq echo
Create a class map
DSW1(config)#class-map File-Transfer
DSW1(config-cmap)#match access-group 150
DSW1(config-cmap)#exit
DSW1(config)#class-map Echo
DSW1(config-cmap)#match access-group 151
DSW1(config-cmap)#exit
Create a policy map
DSW1(config)#policy-map Precedence
DSW1(config-pmap)#class file-transfer
DSW1(config-pmap-c)#set ip precedence 5
DSW1(config-pmap-c)#exit
DSW1(config-pmap)#class echo
DSW1(config-pmap-c)#set ip precedence 1
DSW1(config-pmap-c)#exit
DSW1(config-pmap)#exit
Associate VLANs with Fe 1 to 4
DSW1(config)#interface range fastethernet 0/1 - 4
DSW1(config-if-range)#speed 100
DSW1(config-if-range)#duplex auto
DSW1(config-if-range)#switchport
DSW1(config-if-range)#switchport trunk encapsulation dot1q
DSW1(config-if-range)#switchport trunk native vlan 1
DSW1(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW1(config-if-range)#switchport mode trunk
Apply QoS Policy
DSW1(config-if-range)#service-policy input precedence
DSW1(config-if-range)#exit
Associate VLANs with Fe 11 and 12
DSW1(config)#interface range fastethernet 0/11 - 12
DSW1(config-if-range)#speed 100
DSW1(config-if-range)#duplex auto
DSW1(config-if-range)#switchport
DSW1(config-if-range)#switchport trunk encapsulation dot1q
DSW1(config-if-range)#switchport trunk native vlan 1
DSW1(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW1(config-if-range)#switchport mode trunk
DSW1(config-if-range)#exit
Aministratively shutdown all ports not connected
DSW1(config)#interface range fastethernet 0/5 - 10
DSW1(config-if-range)#shut
DSW1(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
DSW1(config)#spanning-tree vlan 1 root primary
DSW1(config)#spanning-tree vlan 10 root primary
DSW1(config)#spanning-tree vlan 20 root secondary
Enable Routing and a Protocol
DSW1(config)#ip routing
DSW1(config)#router eigrp 100
DSW1(config-router)#network 192.168.0.0
DSW1(config-router)#exit
Exit Global Configuration Mode
DSW1(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
DSW1#show interfaces status
Check that you configured STP
DSW1#show spanning-tree
Check routing is correct
DSW1#show ip route
Check QoS is enabled
DSW1#show mls qos
Check Access Lists
DSW1#show access-lists
Check class maps
DSW1#show class-map
Check policy map
DSW1#show policy-map
Check that QoS is applied to the interfaces
DSW1#show run | begin interface FastEthernet 0/1
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
DSW1#copy run start
Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname DSW2
Enable secret and password
DSW2(config)#enable password cisco
DSW2(config)#enable secret cisco
Setup the console port password
DSW2(config)#line con 0
DSW2(config-line)#password cisco
DSW2(config-line)#login
DSW2(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
DSW2(config)#line vty 0 4
DSW2(config-line)#password cisco
DSW2(config-line)#login
DSW2(config-line)#exit
Setup the default VLAN
DSW2(config)#interface vlan 1
DSW2(config-if)#ip address 192.168.1.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit
Setup VLAN 10
DSW2(config)#interface vlan 10
DSW2(config-if)#ip address 192.168.10.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit
Setup VLAN 20
DSW2(config)#interface vlan 20
DSW2(config-if)#ip address 192.168.20.50 255.255.255.0
DSW2(config-if)#no shut
DSW2(config-if)#exit
Setup Fastethernet Interfaces
DSW2(config)#interface fastethernet 0/1
DSW2(config-if)#description DSW2 - ASW2
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/2
DSW2(config-if)#description DSW2 - ASW2
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/3
DSW2(config-if)#description DSW2 - ASW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/4
DSW2(config-if)#description DSW2 - ASW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/11
DSW2(config-if)#description DSW2 - DSW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
DSW2(config)#interface fastethernet 0/12
DSW2(config-if)#description DSW2 - DSW1
DSW2(config-if)#no shut
DSW2(config-if)#exit
Enable QoS Globally
DSW2(config)#mls qos
Create Access Lists
DSW2(config)#access-list 150 permit udp any any eq tftp
DSW2(config)#access-list 150 permit tcp any any eq ftp
DSW2(config)#access-list 150 permit tcp any any eq ftp-data
DSW2(config)#access-list 151 permit udp any any eq echo
DSW2(config)#access-list 151 permit udp any any eq echo-reply
DSW2(config)#access-list 151 permit udp any any eq echo
Create a class map
DSW2(config)#class-map File-Transfer
DSW2(config-cmap)#match access-group 150
DSW2(config-cmap)#exit
DSW2(config)#class-map Echo
DSW2(config-cmap)#match access-group 151
DSW2(config-cmap)#exit
Create a policy map
DSW2(config)#policy-map Precedence
DSW2(config-pmap)#class file-transfer
DSW2(config-pmap-c)#set ip precedence 5
DSW2(config-pmap-c)#exit
DSW2(config-pmap)#class echo
DSW2(config-pmap-c)#set ip precedence 1
DSW2(config-pmap-c)#exit
DSW2(config-pmap)#exit
Associate VLANs with Fe 1 to 4
DSW2(config)#interface range fastethernet 0/1 - 4
DSW2(config-if-range)#speed 100
DSW2(config-if-range)#duplex auto
DSW2(config-if-range)#switchport
DSW2(config-if-range)#switchport trunk encapsulation dot1q
DSW2(config-if-range)#switchport trunk native vlan 1
DSW2(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW2(config-if-range)#switchport mode trunk
Apply QoS Policy
DSW2(config-if-range)#service-policy input precedence
DSW2(config-if-range)#exit
Associate VLANs with Fe 11 and 12
DSW2(config)#interface range fastethernet 0/11 - 12
DSW2(config-if-range)#speed 100
DSW2(config-if-range)#duplex auto
DSW2(config-if-range)#switchport
DSW2(config-if-range)#switchport trunk encapsulation dot1q
DSW2(config-if-range)#switchport trunk native vlan 1
DSW2(config-if-range)#switchport trunk allowed vlan 1,20,10
DSW2(config-if-range)#switchport mode trunk
DSW2(config-if-range)#exit
Aministratively shutdown all ports not connected
DSW2(config)#interface range fastethernet 0/5 - 10
DSW2(config-if-range)#shut
DSW2(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
DSW2(config)#spanning-tree vlan 1 root secondary
DSW2(config)#spanning-tree vlan 10 root secondary
DSW2(config)#spanning-tree vlan 20 root primary
Enable Routing and a Protocol
DSW2(config)#ip routing
DSW2(config)#router eigrp 100
DSW2(config-router)#network 192.168.0.0
DSW2(config-router)#exit
Exit Global Configuration Mode
DSW2(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
DSW2#show interfaces status
Check that you configured STP
DSW2#show spanning-tree
Check routing is correct
DSW2#show ip route
Check QoS is enabled
DSW2#show mls qos
Check Access Lists
DSW2#show access-lists
Check class maps
DSW2#show class-map
Check policy map
DSW2#show policy-map
Check that QoS is applied to the interfaces
DSW2#show run | begin interface FastEthernet 0/1
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
DSW2#copy run start
Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname ASW1
Enable secret and password
ASW1(config)#enable password cisco
ASW1(config)#enable secret cisco
Setup the console port password
ASW1(config)#line con 0
ASW1(config-line)#password cisco
ASW1(config-line)#login
ASW1(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
ASW1(config)#line vty 0 4
ASW1(config-line)#password cisco
ASW1(config-line)#login
ASW1(config-line)#exit
Default Gateway
ASW1(config-line)#ip default-gateway 192.168.1.1
Setup the default VLAN
ASW1(config)#interface vlan 1
ASW1(config-if)#ip address 192.168.1.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup VLAN 10
ASW1(config)#interface vlan 10
ASW1(config-if)#ip address 192.168.10.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup VLAN 20
ASW1(config)#interface vlan 20
ASW1(config-if)#ip address 192.168.20.100 255.255.255.0
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup Fastethernet Interfaces
ASW1(config)#interface fastethernet 0/1
ASW1(config-if)#description ASW1 - DSW1
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/2
ASW1(config-if)#description ASW1 - DSW1
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/3
ASW1(config-if)#description ASW1 - DSW2
ASW1(config-if)#no shut
ASW1(config-if)#exit
ASW1(config)#interface fastethernet 0/4
ASW1(config-if)#description ASW1 - DSW2
ASW1(config-if)#no shut
ASW1(config-if)#exit
Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface
ASW1(config)#interface fastethernet 0/12
ASW1(config-if)#description ASW1 - PC1
ASW1(config-if)#speed 10
ASW1(config-if)#duplex half
ASW1(config-if)#switchport
Make the port as an access port
ASW1(config-if)#switchport mode access
Make the port an access port for VLAN 10
ASW1(config-if)#switchport access vlan 10
Enable PortFast on end-points
ASW1(config-if)#spanning-tree portfast
ASW1(config-if)#no shut
ASW1(config-if)#exit
Associate VLANs with Fe 1 to 4
ASW1(config)#interface range fastethernet 0/1 - 4
ASW1(config-if-range)#speed 100
ASW1(config-if-range)#duplex auto
ASW1(config-if-range)#switchport
ASW1(config-if-range)#switchport trunk encapsulation dot1q
ASW1(config-if-range)#switchport trunk native vlan 1
ASW1(config-if-range)#switchport trunk allowed vlan 1,20,10
ASW1(config-if-range)#switchport mode trunk
Configure UplinkFast
ASW1(config-if-range)#spanning-tree uplinkfast
ASW1(config-if-range)#exit
Aministratively shutdown all ports not connected
ASW1(config)#interface range fastethernet 0/5 - 11
ASW1(config-if-range)#shut
ASW1(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
ASW1(config)#spanning-tree vlan 1
ASW1(config)#spanning-tree vlan 10
ASW1(config)#spanning-tree vlan 20
Exit Global Configuration Mode
ASW1(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
ASW1#show interfaces status
Check that you configured STP
DSW1#show spanning-tree
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
ASW1#copy run start
Enter Privelaged Mode
switch>enable
Enter Global Configuration Mode
switch#configure terminal
Change the hostname of the switch
switch(config)#hostname ASW2
Enable secret and password
ASW2(config)#enable password cisco
ASW2(config)#enable secret cisco
Setup the console port password
ASW2(config)#line con 0
ASW2(config-line)#password cisco
ASW2(config-line)#login
ASW2(config-line)#exit
Setup the Virtual Teletype Terminal (VTY) Password
ASW2(config)#line vty 0 4
ASW2(config-line)#password cisco
ASW2(config-line)#login
ASW2(config-line)#exit
Default Gateway
ASW2(config-line)#ip default-gateway 192.168.1.50
Setup the default VLAN
ASW2(config)#interface vlan 1
ASW2(config-if)#ip address 192.168.1.150 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup VLAN 10
ASW2(config)#interface vlan 10
ASW2(config-if)#ip address 192.168.10.150 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup VLAN 20
ASW2(config)#interface vlan 20
ASW2(config-if)#ip address 192.168.20.150 255.255.255.0
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup Fastethernet Interfaces
ASW2(config)#interface fastethernet 0/1
ASW2(config-if)#description ASW2 - DSW2
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/2
ASW2(config-if)#description ASW2 - DSW2
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/3
ASW2(config-if)#description ASW2 - DSW1
ASW2(config-if)#no shut
ASW2(config-if)#exit
ASW2(config)#interface fastethernet 0/4
ASW2(config-if)#description ASW2 - DSW1
ASW2(config-if)#no shut
ASW2(config-if)#exit
Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface
ASW2(config)#interface fastethernet 0/12
ASW2(config-if)#description ASW2 - PC2
ASW2(config-if)#speed 10
ASW2(config-if)#duplex half
ASW1(config-if)#switchport
Make the port as an access port
ASW2(config-if)#switchport mode access
Make the port an access port for VLAN 20
ASW2(config-if)#switchport access vlan 20
Enable PortFast on end-points
ASW2(config-if)#spanning-tree portfast
ASW2(config-if)#no shut
ASW2(config-if)#exit
Associate VLANs with Fe 1 to 4
ASW2(config)#interface range fastethernet 0/1 - 4
ASW2(config-if-range)#speed 100
ASW2(config-if-range)#duplex auto
ASW2(config-if-range)#switchport
ASW2(config-if-range)#switchport trunk encapsulation dot1q
ASW2(config-if-range)#switchport trunk native vlan 1
ASW2(config-if-range)#switchport trunk allowed vlan 1,20,10
ASW2(config-if-range)#switchport mode trunk
Configure UplinkFast
ASW2(config-if-range)#spanning-tree uplinkfast
ASW2(config-if-range)#exit
Aministratively shutdown all ports not connected
ASW2(config)#interface range fastethernet 0/5 - 10
ASW2(config-if-range)#shut
ASW2(config-if-range)#exit
Enable Spanning Tree Protocol on VLANs
ASW2(config)#spanning-tree vlan 1
ASW2(config)#spanning-tree vlan 10
ASW2(config)#spanning-tree vlan 20
Exit Global Configuration Mode
ASW2(config)#exit
Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct
ASW2#show interfaces status
Check that you configured STP
DSW1#show spanning-tree
Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run
ASW2#copy run start
Notes and Notices:
This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.
This post I am going to deviate from how I have done things. In the previous posts I wrote out the entire configurations, in this post all I need is a working configuration. Use the initial config and work from here that has trunk links and setup VTP.
Run the following config on the DSW switches (both of them)
DSW1(config)#interface range fastethernet 0/1 - 4
DSW1(config-if-range)#no switchport trunk allowed vlan 1,100
DSW1(config)#interface range fastethernet 0/11 - 12
DSW1(config-if-range)#no switchport trunk allowed vlan 1,100
And this config on the ASW switches (both of them)
ASW1(config)#interface range fastethernet 0/1 - 4
ASW1(config-if-range)#no switchport trunk allowed vlan 1,100
This is because the top commands restrict the vlans to only allow vlan 1 and vlan 100 on the trunk. By default a trunk link will allow all vlans but one can restrict what vlans are allowed over a trunk through the use of the above commands (slipped it in there didn’t I).
Some comment on VTP is that it is a very funny animal to work with (even if it is dead useful. If you do it wrong you lose all VLANs in the VLAN database because of how an update happens from server to client. This makes VTP a very dangerous beast because in large networks there may be 100s of VLANs (you can double that number if you run voice and use separate vlans for each voice end-point) and if you add a new switch to VTP that’s configured wrong…. POOF…..like magic all VLANs gone 
To begin a VTP configuration see below and notice how I start with the mode command, this is just something I do because I like knowing it starts in the right mode, its paranoia more than anything and getting it wrong enough that makes me do this. You may do it in another way (at your own risk).
Its an idea to go over the table I have on this page regarding the VTP Modes so that you understand why you use a certain mode at a certain times. If you need to for example add a switch to a network where the switch must NEVER participate in VTP for example you use transparent
Step 1.1: Configure VTP
Enter Global Configuration Mode
ASW1#configure terminal
Set the VTP Mode
ASW1(config)#vtp mode transparent
Set the VTP Version 1/2 and 3 (higher level switch platforms)
ASW1(config)#vtp version 2
Set the password and domain to prevent unauthorized joining to the VTP domain
ASW1(config)#vtp password cisco
ASW1(config)#vtp domain ciscolabnet
Exit Global Configuration Mode
ASW1(config)#exit
Step 1.2: Add VLANs
Enter VLAN Database Mode
ASW1#vlan database
Create a VLAN and assign it a name
ASW1(vlan)#vlan 100 name Marketing
VLAN 100 added:
Name: Marketing
Create another VLAN and assign it a name
ASW1(vlan)#vlan 150 name Sales
VLAN 150 added:
Name: Sales
APPLY your config (it will do this anyway on the next step but just make sure it applies changes)
ASW1(vlan)#apply
Exit VLAN Database Mode
ASW1(vlan)#exit
APPLY completed.
Exiting.......
Repeat the above steps exactly on ASW2. The VTP process is now running on both ASW switches. To check that this is the case:
ASW2#show vtp status
The DSWs I am going to make clients to the ASWs (bottom-up)
Step 2: Configure VTP on the DSW switches
Enter Global Configuration Mode
DSW1#configure terminal
Set the VTP Mode
DSW1(config)#vtp mode client
Set the VTP Version 1/2 and 3 (higher level switch platforms)
DSW1(config)#vtp version 2
Set the password and domain to prevent unauthorized joining to the VTP domain
DSW1(config)#vtp password cisco
DSW1(config)#vtp domain cisco
Exit Global Configuration Mode
DSW1(config)#exit
Step 3: Change the VTP Mode on the ASW switches
Do the same config on DSW2 making sure you configure the mode as client. After this is done go back to the ASWs and change them to servers:
ASW1#configure terminal
ASW1(config)#vtp mode server
ASW2#configure terminal
ASW2(config)#vtp mode server
After you have done this go to all the switches and try the following command
ASW2#show vlan
You should see the Sales and Marketing VLANS propogated on all the switches.
Notes and Notices:
This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.
VLAN Hopping
VLAN Hopping is a network attack whereby an end-device sends packets to/or collects packets from a VLAN that should not be accessible to that end-device. This is done by tagging the invasive traffic with a specific VLAN ID (VID) or by negotiating a trunk link to send or receive traffic on penetrated VLANs. VLAN hopping can be done by switch spoofing or double tagging.
In a Switch spoofing attack the attacker configures an end-device to spoof itself as a switch (this can be a linux pc). The attack emulates Inter-Switch Link (ISL) or 802.1Q signaling along with Dynamic Trunk Protocol (DTP). This is signaling to attempt to establishing a trunk connection with the company switch.
Any switch port configured with DTP auto, upon receipt of a DTP packet generated by the attacking device, will become a trunk port and then accept traffic destined for any VLAN supported on any trunk on that link. The attacker can then send/collect packets from/to any VLAN.
Double Tagging is another method of VLAN Hopping, this is when a workstation generates frames for two 802.1Q headers, this causes the switch to forward the frames onto a VLAN that would normally be inaccessible to the attacker through legitimate means.
The first switch to encounter the double tagged 802.1Q frame strips the first header frame (native VLAN), and forwards the frame out a trunk link, the second switch then forwards the frame according to the other 802.1Q frame header. Should the tag not match the native VLAN of the attacker, the frame will go untagged and flooded to only the original frame.
Best Practices to Mitigate VLAN Hopping
Configuration
To Mitigate against VLAN hopping attacks the following is the config. First select a range of interfaces:
switch#configure terminal
switch(config)#interface range gigabitethernet 0/1-48
Now configure the ports as access ports this in turn will turn off DTP
switch(config-if)#switchport mode access
Assign the ports to an unused VLAN (not the Native VLAN)
switch(config-if)#switchport access vlan vlan-id
NB the above commands will not work in VoIP (voice) networks. Cisco IP Phones use trunks (DTP).
VLAN Access Control Lists
There are three kinds of ACLs:
Cisco Catalyst switches support four ACL lookups per packet*:
This following section all went over my head or just about and I have no idea whether this works or not or is correct or not for more information.
There are cases where certain Access Control Entries (ACEs) must be combined in each ACLs due to limitations of TCAM hardware. The merge process is also responsible for other functions like expanding ACEs due to a lack of Layer 4 Operations Pointers (L4Op Pointers) or Logical Operational Units (LOUs).
Cisco catalyst Switches use two features to perform a merge
Order Independent Merge (OIM) is based on Binary Decision Diagrams(BDD), ACLs are merged from a series of oder-dependant actions to a set of order-independent masks and patterns. The resulting ACE can be very large, and processor and memory intensive.
Order Dependant Merge (ODM) is not bit-based. The computation is much faster and is less processor intensive.
RACLs are supported in hardware through IP standard and IP extended ACSs, with permit and deny actions. ACL processing is an intrinsic part of the packet forwarding process. ACL entries are programmed in hardware. Lookups occur in the pipeline, whether ACLs are configured or not. With RACLs access list statistics and logging are not supported.
*You can get some switches with two security lookups and 1 QoS lookup in each direction (6 total).
Configuring VACLs
VACLs apply to all traffic on a VLAN. VACLs use standard and extended Cisco IOS IP and IPX ACLs, and MAC Layer-named ACLs and VLAN access-maps.
VACLs follow route-map conventions, in which map sequences are check in order (top-down).
Each VLAN access map can consist of one or more map sequence, each sequence with a match clause and an action clause. The match clause specifices IP, IPX, or MAC ACLs for traffic filtering and the action clause specifies the action to be taked when a match occurs. When a flow matches a permit ACL entry, the assciated action is taken and the flow is not checked against the remaining sequences. When a flow matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next sequence. If aflow does not match any ACL entry and at least on ACL is configured for that packet, the packet is denied.
Three VACL actions are permitted:
Two features are supported on Catalyst 6500 only:
VACL Capturewhere Forwarded packets are captured on the capture port. The capture option is only permit ACEs. The capture port can be an IDS port or an Ethernet port. The capture port must be an egress VLAN for layer-3 switched traffic.
VACL Redirect where matching packets are redirected to specific ports. You can configure up to five redirect ports. Redirect ports must be in a VLAN where a VACL is applied.
Define a VLAN Access MAP
switch#configure terminal
switch(config)#vlan access-map map-name seq# insert to/delete from
Configure the match clause in a VLAN access map sequence
switch(config-access-map)#match options
Configure actions
switch(config-access-map)#action options
Apply the VACL to VLANs
switch(config)#vlan filter map-name vlan-list list
Verify configuration
switch(config)#show vlan access-map map-name
Source for this Config document Section
Internet Service Providers (ISP) often have devices from multiple clients, in addition to their own servers resident on a single demilitarized zone(DMZ) segment of VLAN. Cisco Catalyst 6500/4500 switches Private Virtual Local Area Networks (PVLAN) to keep some switch ports shared and some switch ports isolated, even if the ports exist in the same VLAN. The 2950 and 3550 support “protected ports”, which are functionally the same on a per-switch basis.
Traditionally ISPs used one VLAN per customer, with each VLAN having its own subnet. A layer 3 device the provides interconnectivity between VLANs and Internet destinations. Problems with this method:
PVLANs provide Layer-2 isolation between ports within the same VLAN, thereby eliminating the need for VLAN and IP subnet per customer.
A Port in a PVLAN can be one of three types:
Trunks carry all VLAN traffic so isolated, promiscuous and community PVLAN traffic may enter and leave a switch through trunks
PVLAN ports are associated with a set of supporting VLANs that are used to create the PVLAN structure.
A promiscuous port can service only one primary VLAN. A promiscuous port can service one isolated VLAN or many community VLANs.
Configuring
Step 1: Set VTP Mode to Transparent
switch#configure terminal
switch(config)#vtp mode transparent
You may also want to check VTP version, password and domain while you are at VTP configuration
Step 2: Create the secondary VLANs (Isolated and community VLANs are secondary VLANs)
switch#configure terminal
switch(config)#vlan 102
switch(config-vlan)#private-vlan isolated
switch(config-vlan)#end
switch#show vlan private-vlan type
Step 3: Create the primary VLAN
switch#configure terminal
switch(config)#vlan 100
switch(config-vlan)#private-vlan primary
switch(config-vlan)#end
switch#show vlan private-vlan type
Step 4: Associate the secondary VLAN with the primary VLAN. Only one isolated VLAN can be mapped to a primary VLAN, but more than one community VLAN can be mapped to a primary VLAN
switch#configure terminal
switch(config)#vlan 100
switch(config-vlan)#private-vlan association add 102
switch(config-vlan)#end
switch#show vlan private-vlan type
When associating secondary VLANs with primary VLANs use these best practices:
Step 5: Configure an interface as an isolated or community port.
switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport mode private-vlan host
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport
Step 6: Associate the isolated port or community port with the primary/secondary VLAN pair
switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport private-vlan mapping 100 102
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport
Step 7: Configure an interface as a promiscuous port
switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport mode private-vlan promiscuous
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport
Step 8: Map the promiscuous port to the primary/secondary VLAN pair
switch#configure terminal
switch(config)#interface gigabitethernet 0/1
switch(config-if)#switchport private-vlan host-association mapping 100 102
switch(config-if)#end
switch#show interfaces gigabitethernet 0/1 switchport
Step 9: Permit Routing of Secondary VLAN Ingress Traffic
switch#configure terminal
switch(config)#interface vlan 100
switch(config-if)#private-vlan mapping add 102
switch(config-if)#end
switch#show interfaces private-vlan mapping
The sources for this config section include this Cisco 4500 document and this document. Finally CCIE Blog gave me a some insight and hint as to WTF the difference between the host and promiscious ports on the interface config was.
Definition
Logical Operation Unit (LOU) are hardware registers used to store {operator, operand} tuplesfor Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port numbers specified in an IP extended ACL, VACL, or QoS ACL. These tuples are called Layer 4 Operations (L4Op).
Notes and Notices:
This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.
References I want to rememeber:
Hucaby, D. (2007). CCNP Self-Study: CCNP BCMSN Official Exam Certification Guide, Fourth Ed, VLAN Access Lists (page. 413-414). Indianapolis: Cisco Press.
Open Shortest Path First – OSPF Fundamentals – Configuring Options On an Internal Router
To allow you to tune OSPF on an Internal Router you have the following options available at your disposal:
Defining the Router ID and Loopback interface
The Router ID (when thinking about OSPF Domains) is used to identify any given Router in the Link State Advertisements (LSAs) in an OSPF Database. A given Router on a network requires an ID (Router ID) to participate in an OSPF Domain. The Router ID can be assigned/set in one of two fashions:
In most configurations the Router ID is set by the administrator as this makes it easier to track events, internal documentation, and system-administration remotely or even on the router itself.
Setting the Router ID
The Router ID as discussed previously must be present for a Router to participate in an OSPF Domain. This Router ID can be set in one of two methods:
Setting the Router ID – Method One (Less Preferred)
The OSPF Router ID can be defined using the router-id (background link) command found in IOS.
Using the Router-ID command isn’t always the best idea when combining BGP and OSPF as both technologies employ the same method in electing a Router ID. So manually setting a Router ID (using the Router-id command) for OSPF could cause BGPs Router ID to differ from BGP which causes administration problems as well as could cause other problems at a later stage when combining the two technologies.
Should you still want to change the Router ID using this method anyway the command is:
Router(config)#router ospfRouter(config-if)#router-id ip-address
Dissecting the above when the Router ID has been chosen/assigned using the router-id command, the Router ID is kind of stable and may possibly change (barring a power cycle or a OSPF process reset). This is an important factor because changing the Router ID post (after) configuration could possibly break some OSPF configurations, such as virtual links (which as the name implies don’t exist, and could take some thinking to logically get working again).
Setting the Router ID – Method Two (Preferred)
Should the router-id command not be present/available on the router IOS you are using, and you want a more reliable method (sticky) that spans, the Router ID is automatically elected via:
I inherently look for the easier easier solution to a problem that will work long term, more work once off doesn’t matter (first off config) the solution must stick and continue working through power outages, reboots and the CEO trying his hand at “setting up” his own hardware, voice being a good example i.e. putting each end point into it’s own vlan thus ensuring QoS while the organization grows (there are limitations in the number of vlans, but I have yet to reach them).
Looking at the top the better method to control the Router ID (using automatic means) is through the use of the Loopback interface IP address. A loopback interface is a virtual interface (duh) that will always be active (cannot flap) and will be the first active interface (*shrug* logic dictates as it becomes the Router-ID, comments as I haven’t tested this out?).
The command to use a loopback is as follows (CCNA topic):
Router(config)#interface loopback inerface-numberRouter(config-if)#ip address ip-address subnet-mask
Consider assigning loopbacks a /32 mask 255.255.255.255 (1 end point) to minimize the ip space usage of the virtual interface(s) on the network (use it dont use it). I have come across some places that say that loopbacks wont work with the /32 mask (cant find source again), I will verify once I setup my kit again. In that case use the smallest (/31 or /30).
What I want to take away from this is should the Router ID be chosen/assigned using the loopback interface, the Router ID is stable and wont change. What’s important here is that a Loopback interfaces is NOT a physical interface thus cannot go up and down (flap) and therefore is not as unstable element in the network (i.e. loopback is stable) and thus is more desirable. Even in the event of a power cycle the loopback will once again be the Router ID.
Think about including the Loopback interface in the general network commands even if you aren’t configuring OSPF. This gives you an easy point to ping to should there be a need to troubleshoot (can I reach point A from point B) this should tell you alot about Layer 1 if the interface is un-shut and it has an ip-address.
Changing the COST
The COST metric on a Cisco is calculated as 100,000,000 bps divided by the bandwidth of the interface in bits per seconds. Sometimes when using a fast interface type (FE and GE) or when dealing with inter-vendor situations (Cisco / 3COM / HP) changing the default cost metric becomes a requirement (this is due to (1) faster link speeds not calculating correctly (2) or the metric equations being different between inter-vendor kit).
The command to change default cost:
Router(config-if)#ip ospf cost costThe cost variable is a 16-bit value (0 to 65,535). The lower values being the more preferred costs while higher being less preferred (shown below).
As you can see in the above table Fast Ethernet is the “drop off point” (where all things being 1) for the “fast” links (Fast Ethernet and Gigabit Ethernet both equal 1). In this case it would be better to manipulate the default cost so that the Gigabit Ethernet link is preferred over the Fast Ethernet Link. This would mean changing the cost per interface.
Another way to deal with high-bandwidth paths is to change the way a Cisco calculates cost (mess with the equation). We adjust the numerator in the automatic calculation (the Cisco automatic formula) to make some things happen in this case. To do this use the ospf auto-cost reference-bandwidth command on IOS, the default is 100 (Fast Ethernet) adjust it to 1000 (Gigabit Ethernet) and you will “fix” the equation.
Router(config-router)#ospf auto-cost reference-bandwidth reference bandwidthTwo very important NOTES (1) ospf auto-cost reference-bandwidth should be applied to all routers in an area if it is applied at all and the command (2) ip ospf cost overrides the calculated cost calculated by auto-cost reference-bandwidth
Determining the DR with the Priority Command
The hello field includes a priority field (if you can still remember) thus providing a mechanism by which designated router (DR) and backup designated Router (BDR) gets elected.
To be eligible for election, the priority must be a positive integer between 1 and 255 (if the priority is 0 (zero) the router cannot participate in the election process).
The highest priority wins (Cisco Router Default is 1) the election process.
Because the default is 1, to break all ties the Cisco Router ID is used as the deciding factor in the election process (ergo why hard coding the Router ID is a bad idea). The command to adjust priority (interface-by-interface mind you):
Router(config-if)#ip ospf priority numberNotes and Notices: This is a part of my personal BSCI notes and research to assist myself in learning and understanding the concepts and theory for the BSCI exam. I learn by making notes reading and writing things down and wish to file them where I cannot lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BSCI Certification.
If I added some value to your Cisco Experience with this post please add some value to my studies and leave a comment, question, suggestion, note of thanks or encouragement for me to hurry up and complete my certifications. My reasoning for wanting some interaction is that the last Recruiter said I need CCNP, Juniper and a Specialization track. The LOOOOONG Road to Cisco Indeed. Thanks Deon