When we configure interfaces as FlexLinks they will not send BPDUs. There is no way to detect loops because we don't run spanning-tree on them. Whenever our active interface fails the backup interface will take over.As simple as that
What is FlexLinks
When we configure interfaces as FlexLinks they will not send BPDUs. There is no way to detect loops because we don't run spanning-tree on them. Whenever our active interface fails the backup interface will take over.As simple as that
EtherChannel Notes and Configuration
For example by combining 4x 100 Mbit we will get a 400 Mbit link.Spanning tree sees this link as one logical link so there are no loops!.
EtherChannel will do load balancing between the links connected.If any of the links connected goes down,It will work with combained bandwidth of the links that are still active. There’s a maximum to the number of links you can use: 8 physical interfaces.
Two protocols used in Etherchannel are:
• PAgP (Cisco proprietary)
• LACP (IEEE standard)
These protocols can dynamically configure an etherchannel. It’s also possible to configure a static etherchannel without these protocols doing the negotiation of the link for you. If you are going to create an etherchannel you need to make sure that all ports have the same configuration:
• Duplex has to be the same.
• Speed has to be there same.
• Same native AND allowed VLANs.
• Same switchport mode (access or trunk).
PAgp and LACP will check if the configuration of the interfaces that you use are the same.
If you want to configure PAgP you have a number of options you can choose from, an interface can be configured as:
• On (interface becomes member of the etherchannel but does not negotiate).
• Desirable (interface will actively ask the other side to become an etherchannel).
• Auto (Will not start negociation.interface will wait passively for the other side to ask to become an etherchannel).
• Off (no etherchannel configured on the interface).
Configuration of PagP
Switch(config)#interface fa0/13
Switch(config-if)#channel-group 1 mode desirable
Switch(config)#interface fa0/14
Switch(config-if)#channel-group 1 mode desirable
Switch(config)#interface port-channel 1
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
Note : Here we use desirable mode.You can choose any mode from above list.Result will be different depends on the mode you choosed.Configure this on both switches where we need to configure EtherChannel.
To view :
Switch#show etherchannel 1 port-channel
Switch#show etherchannel summary
Switch#show interfaces fa0/14 etherchannel
LACP is similar to PAgP. You also have different options to choose from when you configure the interface:
• On (interfaces becomes member of the etherchannel but does not negotiate).
• Active (interface will actively ask the other side to become an etherchannel).
• Passive (interface will wait passively for the other side to ask to become an etherchannel).
• Off (no etherchannel configured on the interface).
LACP Configuration
Switch(config-if)#interface fa0/13
Switch(config-if)#channel-group 1 mode active
Switch(config-if)#interface f0/14
Switch(config-if)#channel-group 1 mode active
Switch(config)#interface port-channel 1
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
Note : Here we use active mode.You can choose any mode from above list
Note : Pagp and LACP configuration has to be done on both switches configuring EtherChannel
To View:
Switch#show etherchannel 1 port-channel
NOTE : The configuration of PAgP and LACP is similar. Keep in mind that PAgP can only be used between Cisco devices while LACP is a IEEE standard, you can use it to form etherchannels between different vendors
Note: We can use the show etherchannel load-balance command to see what the default configuration is. Etherchannel load-balances based on the source MAC address
OSPF Authentication
OSPF supports authentication to secure routing updates.We can use either clear-text or an MD5 authentication with OSPF.
Clear Text Authentication
To configure clear-text authentication, the first step is to enable authentication for the area, under the OSPF routing process:
Router(config)# router ospf 1Then, the authentication key must be configured on the interface:
Router(config-router)# network 172.16.0.0 0.0.255.255 area 0
Router(config-router)# area 0 authentication
Router(config)# interface fa 0/0MD5 Authentication
Router(config-if)# ip ospf authentication
Router(config-if)# ip ospf authentication-key MYKEY
To configure MD5-hashed authentication, the first step is also to enable authentication for the area under the OSPF process:
Router(config)# router ospf 1Notice the additional parameter message-digest included with the area 0 authentication command. Next, the hashed authentication key must be configured on the interface:
Router(config-router)# network 172.16.0.0 0.0.255.255 area 0
Router(config-router)# area 0 authentication message-digest
Router(config)# interface fa 0/0
Router(config-router)# ip ospf message-digest-key 10 md5 MYKEY
Router(config-router)# ip ospf authentication message-digest
Please note: if authentication is enabled for Area 0, the same authentication must be configured on Virtual Links, as they are “extensions” of Area 0.
Configuring Basic OSPF
Routing protocol configuration occurs in Global Configuration mode. On Router, to configure OSPF:
Router(config)# router ospf 1Explanation
Router(config-router)# router-id 1.1.1.1
Router(config-router)# network 172.16.0.0 0.0.255.255 area 1
Router(config-router)# network 172.17.0.0 0.0.255.255 area 0
- The first command, router ospf 1, enables the OSPF process. The “1” indicates the OSPF process ID, and can be unique on each router. The process ID allows multiple OSPF processes to run on the same router.
- The router-id command assigns a unique OSPF ID of 1.1.1.1 for this router.
- Here in OSPF we use wild card mask along with network statement to assagin an interface to a specific area
Router(config)# interface s0To change OSPF Cost
Router(config-if)# bandwidth 64
Router(config)# interface fa 0/0Changing the cost of an interface can alter which path OSPF selected as “shortest,” and thus should be used with great care.
Router(config-if)# ip ospf cost 10
To alter how OSPF calculates its default metrics for interfaces:
Router(config)# router ospf 1The above ospf auto-cost command has a value of 100 configured, which is actually the default. This indicates that a 100Mbps link will have a cost of 1 (because 100/100 is 1).Lowest cost is better
Router(config-router)# ospf auto-cost reference-bandwidth 100
OSPF passive interface
As in EIGRP,OSPF will not form neighbor ship,If the Passive interface command is configured
Router(config)# router ospf 1"Passive-interface default" command make all interface passive and "no passive-interface fa 0/0" command will remove passive interface from fa 0/0 interface
Router(config-router)# network 10.4.0.0 0.0.255.255 area 0
Router(config-router)# passive-interface default
Router(config-router)# no passive-interface fa 0/0
EIGRP Configuration and Troubleshooting commands
EIGRP Configuration
Syntax
Router(config)#router eigrp <Autonomous-system-number>
Router(config-router)#network <network address>[wild card-mask] (wild card mask is optional)
Router(config-router)#no auto-summary
Router(config-router)#variance <multiplier> (Optional)
To influence the metric,it is possible to configure bandwidth on the interfaces:
Router(config)#Interface<interface>
Router(config-if)#bandwidth<BW in kbps>
Configure Default paths in EIGRP
Method 1:
Specify a default network:
Router(config)# ip default-network < network_address >
Method 2:
Create a static default route and then include network 0.0.0.0 in
EIGRP:
Router(config)# ip route 0.0.0.0 0.0.0.0 < next_hop_ip >
Router(config)# router eigrp < as_no >
Router(config-router)# network 0.0.0.0
To view exchange process
Router#debug eigrp packets
To view update process
Router#debug ip eigrp
To view the neighbor table:
Router#show ip eigrp neighbors
To view the EIGRP Topology Table, containing all EIGRP route information:
Router# show ip eigrp topology
To view information on EIGRP traffic sent and received on a router:
Router# show ip eigrp traffic
To view the bandwidth, delay, load, reliability and MTU values of an interface:
Router# show interface s0
To view information specific to the EIGRP protocol:
Router# show ip protocols
This command provides us with information on EIGRP timers, EIGRP metrics and summarization
To view the IP routing table:
Router# show ip route
To view a specific route within the IP routing table:
Router# show ip route 10.3.0.0
To debug EIGRP in realtime:
Router# debug eigrp neighbors
Router# debug eigrp packet
Router# debug eigrp route
Router# debug eigrp summary
EIGRP Stub
EIGRP Stub
In EIGRP topology,to prevent unnecessary querying, “spoke” routers in a “hub-and-spoke” environment can be configured as Stub routers. A stub router builds a neighbor adjacency with its hub router(s), and will inform neighbors of its stub status.
The stub router will still build the full topology table and it will still receives all routes from its neighbors by default.Once EIGRP stub is configured on router,it will immediately respond to any Query packets with an “Inaccessible” message. Neighbors will eventually stop querying the stub router, which helps EIGRP converge quicker and conserves bandwidth.
.
Syntax:
Router(config)# router eigrp < as_no.>
Router(config-router)# eigrp stub <receive-only / connected/ static/summary/ redistributed>
Example
Router(config)# router eigrp 100
Router(config-router)# eigrp stub connected
EIGRP stub Command Options
Receive-only : Prevents the router from advertising any networks
Connected : Enables the router to advertise connected routes.These must either be included in a network statement or redistributed into EIGRP
Static : Enables the router to advertise static routes. They must be redistributed
into EIGRP
Summary : Enables the router to advertise summary routes, both those created
manually and automatically.
Redistributed: Allows the router to advertise routes redistributed into EIGRP from another protocol or AS
The connected and static parameters will only advertise those networks if they have been injected into the EIGRP process, either using network statements or using route redistribution. By default, EIGRP stubs will only send connected and summary routes to neighbors.
LAB :
EIGRP Load-Balancing
EIGRP Load-Balancing
By default, EIGRP will automatically load-balance across equal-metric routes (four by default, six maximum). EIGRP also supports load-balancing across routes with an unequal metric. We must use the variance command to tell EIGRP to load-balance across unequal-metric links
Syntax
Router(config)# router eigrp 100
Router(config-router)# variance 2
Router(config-router)# maximum-paths 6
The variance command assigns a “multiplier,” in this instance of 2. We multiply this variance value by the metric of our Feasible Distance.Thus, any Feasible Successors with a metric within twice that of our Feasible Distance will now be used for load balancing by EIGRP.
Remember, only Feasible Successors can be used for load balancing.The maximum-paths command adjusts the number of links EIGRP can load-balance across.
Click here for EIGRP MAXIMUM PATH AND VARIANCE Lab with GNS3
EIGRP Authentication
If you don’t use authentication and you are running EIGRP someone could try to form an EIGRP neighbor adjacency with one of your routers and try to hack into your network.We can use MD5 authentication with EIGRP.
By using authentication your router will authenticate the source of each routing update packet that it will receive. it can also used to prevents false routing updates from sources that are not approved. By enabling authentication its possile to ignore malicious routing updates.
Steps
1. Configure a key chain to group the keys.
2. Configure one or more keys within that key chain. The router checks all inbound packets against the list of keys and uses the first valid one it finds.
3. Configure the password or authentication string for that key.Repeat Steps 2 and 3 to add more keys if desired.
4. Optionally configure a lifetime for the keys within that key chain.If you do this, be sure that the time is synchronized between the two routers.
5. Enable authentication and assign a key chain to an interface.
6. Designate MD5 as the type of authentication
Create Key Chain:
R(config)#key chain < key chain name >Applying Authentication:
R(config-keychain)#key < number >
R(config-keychain-key)#key-string < string >
R(config-keychain-key)# send-lifetime < hh:mm:ss > <hh:mm:ss> (optional)
R(config-keychain-key)# accept-lifetime <hh:mm:ss> <hh:mm:ss> (optional)
R(config)#interface < interface >Verify
R(config-subif)#ip authentication mode eigrp <as_no> md5
R(config-subif)# ip authentication key-chain eigrp <as_no> < key chain name>
Router# show key chainClick here for MD5 Authentication Lab
Router# debug eigrp packets
EIGRP summarization
Router(config)# router eigrp 100"No auto-summary" command is needed because by default EIGRP will behave like a classfull routing protocol which means it won’t advertise the subnet mask along the routing information. For example 1.1.1.0/24 and 2.2.2.0/24 will be advertised as 1.0.0.0/8 and 2.0.0.0/8. Disabling auto-summary will ensure EIGRP sends the subnet mask along
Router(config-router)# no auto-summary
Summaries can also be produced manually on any interface
Syntax:
Router(config)# interface < interface >Example:
Router(config-if)# ip summary-address eigrp < as-no> <summarized_network_ip> <summarized_subnet_mask>
Router(config)# interface fa 0/0The manually-created summary route is not advertised as an internal EIGRP route, but instead is classified as an EIGRP summary route. An EIGRP summary route has an Administrative Distance of 5.
Router(config-if)# ip summary-address eigrp 100 79.0.0.0 255.0.0.0
Labs
Related articles
- EIGRP Passive Interface
- EIGRP Notes with Interview Questions
- Access List notes: Numbered and Named ACL
- How to Prepare for NETWORK ENGINEER INTERVIEW QUESTIONS
- Basic notes on BGP (border gateway protocol)
- How to configure Static Routes,Default routes,Floating static routes
- Basic Notes on OSPF (Open Shortest Path First)
- Difference between Linkstate and distance vector protocols
Configuring EIGRP Unicast Neighbors
R(config)# router eigrp < as_no >Verification:
R(config-router)# neighbor <ip-address> <interface>
R# debug ip packetLab:
EIGRP Unicast
EIGRP Passive Interface
EIGRP Passive Interface
In EIGRP (and OSPF) the passive interface command stops sending outgoing hello packets,hence the router cannot form any neighbor relationship via the passive interface.This behavior stops both outgoing and incoming routing updatesTo enable passive interface on one interface:
Router(config)# router eigrp < as_no.>To turn on the passive interface on all interfaces:
Router(config-router)# passive-interface < interface >
Router(config)# router eigrp < as_no.>We can configure all interfaces to be passive using the passive-interface default command, and then individually use the no passive-interface command on the interfaces we do want neighbors to be formed on:
Router(config-router)# passive-interface default
Router(config)# router eigrp < as_no.>To turn off passive interface
Router(config-router)# passive-interface default
Router(config-router)# no passive-interface <interface>
Router(config)# router eigrp < as_no.>
Router(config-router)# no passive-interface <default/interface >
Related articles
- Passive Interface (RIP,OSPF and EIGRP) explained with interview questions
- EIGRP Notes with Interview Questions
- Difference between Linkstate and distance vector protocols
- Access List notes: Numbered and Named ACL
- Cisco password recovery
- Basic Notes on OSPF (Open Shortest Path First)
- OSPF DR and BDR election
- How to Prepare for NETWORK ENGINEER INTERVIEW QUESTIONS
Cisco Discovery Protocol (CDP)
The information shared in a CDP packet about a Cisco device includes the following:
- Name of the device configured with the hostname command
- IOS software version
- Hardware capabilities, such as routing, switching, and/or bridging
- Hardware platform, such as 2600, 2950, or 1900
- The layer-3 address(es) of the device
- The interface the CDP update was generated on
CDP is enabled, by default, on all Cisco devices. CDP updates are generated as multicasts every 60 seconds with a hold-down period of 180 seconds for a missing neighbor.
#cdp run
|
This command enables
cdp globally
|
#no cdp run
|
turns off CDP for
entire router (global config)
|
#no cdp enable
|
turns off CDP on
specific interface
|
#sh cdp neighbor
|
shows directly
connected neighbors
|
#sh cdp int
|
shows which interfaces
are running CDP
|
#sh cdp int eth 0/0
|
show CDP info for
specific interface
|
#sh cdp entry <cdp neighbor here>
|
shows CDP neighbor
detail
|
#cdp timer 120
|
change how often CDP
info is sent (default cdp timer is 60)
|
#cdp holdtime 240
|
how long to wait before
removing a CDP neighbor (default CDP holdtime is 180)
|
#sh cdp run
|
shows if CDP turned on
|
Related articles
- Troubleshooting VLAN Problems
- VLAN Trunking Protocol (VTP) explained with Interview Questions
- EIGRP Notes with Interview Questions
- CCNP Notes : what is Cisco Nonstop Forwarding (NSF)
- Dynamic Trunking Protocol (DTP)
- Difference between Linkstate and distance vector protocols
- Passive Interface (RIP,OSPF and EIGRP) explained with interview questions
CCNP : Configuring VLAN ACLs
Terms used with VLAN ACLs
Access MAP
VACLs use access maps to contain an ordered list of one or more map entries. Each map entry associates a ACLs to an action. Each entry has a sequence number, which allows you to control the precedence of entries.
Actions
Each VLAN access map entry can specify one of the following actions:
• Forward—Sends the traffic to the destination determined by normal operation of the switch.
• Redirect—Redirects the traffic to one or more specified interfaces.
• Drop—Drops the traffic. If you specify drop as the action, you can also specify that the device logs
the dropped packets.
In access map configuration mode, you use the action command to specify the action for a map entry
Creating of VLAN ACL includes 3 steps
- Create Access-List
- Create Access MAP
- Apply on VLAN
Create Access MAP
- Switch#conf terminal
- Switch(config)#ip access-list standard 10
- Switch(config-std-nacl)#permit 172.120.40.0 0.0.0.255
- Switch(config-std-nacl)#exit
Explanation
- Switch(config)#vlan access-map SYSNET 1
- Switch(config-access-map)#match ip address 10
- Switch(config-access-map)#action forward
- Switch(config-access-map)#exit
- Switch(config)# vlan access-map SYSNET 2
- Switch(config-access-map)# action drop
- Switch(config-access-map)# exit
- ”1″ is the line number 1 of the access-map named “SYSNET”
- ”10″ is the access-list number used to identify the ACL
- This is the action that will be applied to the traffic matched on ACL “10″ .Here we need to allow traffic so we give "action forward
- Even there is a implicit deny at the end like normal ACL,here we giving "action drop" statement to deny other traffic
Apply on VLAN
Switch(config)#vlan filter SYSNET vlan-list 20Switch(config)#(config)#exitApplies the VLAN access-map named “SYSNET” to vlan 20.
To remove VLAN ACL
Switch(config)#no vlan access-map map-name [sequence-number]
Related articles
- CCNP switching : AAAdot1x Lab
- Configuring VLAN
- What is Multi VLAN port ?
- How to configure Private VLAN
- What is QinQ ( 802.1Q tunneling ) ?
- What is VLAN Hopping
- VLAN explained with Interview Questions
- What is the difference between static VLAN and dynamic VLAN?
- Difference between End-to-end VLANs and Local VLANs
- Troubleshooting VLAN Problems
Configuring VLAN
Switch# conf tAssigning to an interface:
Switch(config)# vlan 50
Switch(config-vlan)# name sysnet
Switch(config-vlan)# exit
Switch(config)# int fa 1/3To delete a VLAN:
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 50
Switch(config-if)# no shut
Switch(config)# no vlan 50VLAN Verification
To determine the trunking status of an interface:
# show int fa 1/24 trunk OR # show trunk.For more detailed switchport information:
# show int fa 1/24 switchportTo determine the physical status of a link:
# show int fa 1/24 statusTo see a list of VLANs and their assigned interfaces:
# show vlan briefTo check if an interface is assigned to a specific VLAN:
# show vlan id 100This command is especially helpful as it displays all ports belonging to the VLAN as well as the MTU of each assigned port and type.To see a complete detailed interface list for all VLANs:
# show vlan
How to configure Static Routes,Default routes,Floating static routes
Did You Enjoy this Article ?
If yes, Then enter your email below to getmore articles on CCNA and CCNP in your inbox
For FREE !
Related articles
How to configure Private VLAN
Related articles
Setting Passwords on router
Setting the password for console access:
- enable secret <give password here> - set encrypted password for privileged access
- enable password <give password here> - set password for privileged access
Set password for virtual terminal (telnet) access (password must be set to access router through telnet):
- (config)#line console 0
- (config-line)#login
- (config-line)#password <put password here>
Set password for auxiliary (modem) access:
- (config)#line vty 0 4
- (config-line)#login
- (config-line)#password <put password here>
- (config)#line aux 0
- (config-line)#login
- (config-line)#password <put password here>
