Showing posts with label CCNP Routing. Show all posts
Showing posts with label CCNP Routing. Show all posts

CCNP Routing notes : IPsec and GRE tunnels

GRE tunnels can run through IPsec tunnels

For a GRE tunnel to be up between two routers,Tunnel interfaces must be in the same subnet.

Benefits of using GRE tunnels with IPsec over using IPsec tunnel alone for building site-to-site VPNs
Allows dynamic routing securely over the tunnel
Supports non-IP traffic over the tunnel

Main steps in configuring GRE tunnel over IPsec on cisco routers
Configure a physical interface or create a loopback interface to use as the tunnel end point
Create the GRE tunnel interfaces
Add the tunnel subnet to the routing process so that it exchanges routing updates across that interface
Add GRE traffic to the crypto access-list so that IPsec encrypts the GRE tunnel traffic

Statements about OP multicast configuration
PIM sparse mode and PIM sparse-dense mode require an RP on the network
PIM dense mode interfaces are always added to the multicast routing table in a router
PIM sparse-dense mode acts as PIM dense mode if an RP is not known

Situations that need use of multiple routing protocols
When using UNIX host-based routers
When migrating from an older interior Gateway Protocol (IGP) to a new IGP

Methods use IPsec to provide secure connectivity from the branch office to the headquarters office
DMVPN
Virtual Tunnel Interface(VTI)

Read More...

OSPF Authentication

OSPF Authentication  

OSPF supports authentication to secure routing updates.We can use either clear-text or an MD5 authentication with OSPF.

Clear Text Authentication
To configure clear-text authentication, the first step is to enable authentication for the area, under the OSPF routing process:
Router(config)#  router ospf 1
Router(config-router)#  network 172.16.0.0 0.0.255.255 area 0
Router(config-router)#  area 0 authentication  
Then, the authentication key must be configured on the interface:
Router(config)#  interface fa 0/0
Router(config-if)#  ip ospf authentication
Router(config-if)#  ip ospf authentication-key MYKEY 
 
MD5 Authentication 
To configure MD5-hashed authentication, the first step is also to enable authentication for the area under the OSPF process:
Router(config)#  router ospf 1
Router(config-router)#  network 172.16.0.0 0.0.255.255 area 0
Router(config-router)#  area 0 authentication message-digest  
Notice the additional parameter message-digest included with the area 0 authentication command. Next, the hashed authentication key must be configured on the interface:
Router(config)# interface fa 0/0
Router(config-router)# ip ospf message-digest-key 10 md5 MYKEY
Router(config-router)# ip ospf authentication message-digest
NOTE: Area authentication must be enabled on all routers in the area, and the form of authentication must be identical (clear-text or MD5). The authentication keys do not need to be the same on every router in the OSPF area, but must be the same on interfaces connecting two neighbors. 

Please note: if authentication is enabled for Area 0, the same authentication must be configured on Virtual Links, as they are “extensions” of Area 0.
Read More...

Configuring Basic OSPF

Configuring Basic OSPF 

Routing protocol configuration occurs in Global Configuration mode. On Router, to configure OSPF:
Router(config)#  router ospf 1
Router(config-router)#  router-id 1.1.1.1
Router(config-router)#  network 172.16.0.0 0.0.255.255 area 1
Router(config-router)#  network 172.17.0.0 0.0.255.255 area 0  
Explanation 
  • The first command, router ospf 1, enables the OSPF process. The “1” indicates the OSPF process ID, and can be unique on each router. The process ID allows multiple OSPF processes to run on the same router. 
  • The router-id command assigns a unique OSPF ID of 1.1.1.1 for this router.
  • Here in OSPF we use wild card mask along with network statement to assagin an interface to a specific area
To change OSPF bandwidth
Router(config)#  interface s0
Router(config-if)#  bandwidth 64 
To change OSPF Cost
Router(config)#  interface fa 0/0
Router(config-if)#  ip ospf cost 10
Changing the cost of an interface can alter which path OSPF selected as “shortest,” and thus should be used with great care.

To alter how OSPF calculates its default metrics for interfaces:  
Router(config)#  router ospf 1
Router(config-router)#  ospf auto-cost reference-bandwidth 100
The above ospf auto-cost command has a value of 100 configured, which is actually the default. This indicates that a 100Mbps link will have a cost of 1 (because 100/100 is 1).Lowest cost is better

OSPF passive interface
As in EIGRP,OSPF will not form neighbor ship,If the Passive interface command is configured
Router(config)#  router ospf 1
Router(config-router)#  network 10.4.0.0 0.0.255.255 area 0
Router(config-router)#  passive-interface default
Router(config-router)#  no passive-interface fa 0/0 
"Passive-interface default" command make all interface passive and "no passive-interface fa 0/0" command will remove passive interface from fa 0/0 interface
Read More...

OSPF LSA and Area Types

OSPF relies on several types of Link State Advertisements (LSAs) to communicate link state information between neighbors. A brief review of the most applicable LSA types:
  • Router LSA (Type 1) – Contains a list of all links local to the router, and the status and “cost” of those links. Type 1 LSAs are generated by all routers in OSPF, and are flooded to all other routers within the local area. 
  • Network LSA (Type 2) – Generated by all Designated Routers in OSPF, and contains a list of all routers attached to the Designated Router. 
  • Network Summary LSA (Type 3) – Generated by all ABRs in OSPF, and contains a list of all destination networks within an area. Type 3 LSAs are sent between areas to allow inter-area communication to occur. 
  • ASBR Summary LSA (Type 4) – Generated by ABRs in OSPF, and contains a route to any ASBRs in the OSPF system. Type 4 LSAs are sent from an ABR into its local area, so that Internal routers know how to exit the Autonomous System. 
  • External LSA (Type 5) – Generated by ASBRs in OSPF, and contain routes to destination networks outside the local Autonomous System. Type 5 LSAs can also take the form of a default route to all networks outside the local AS. Type 5 LSAs are flooded to all areas in the OSPF system. 
  • Type 7 NSSA External LSAs - Used in stub areas in place of a type 5 LSA 
NOTE : LSA types 1 and 2 are found in all areas, and are never flooded outside of an area.

Summary:
  • Type 1 - Represents a router
  • Type 2 - Represents the pseudonode (designated router) for a multiaccess link
  • Type 3 - A network link summary (internal route)
  • Type 4 - Represents an ASBR
  • Type 5 - A route external to the OSPF domain
  • Type 7 - Used in stub areas in place of a type 5 LSA

OSPF Area Configurations:

Stub Area
For an area to become a stub, all routers belonging to it must be configured to operate as such. Stub routers and non-stub routers will not form adjacency.

Router(Config)#router OSPF 1
Router(config-router)# area 10 stub
Totally Stubby Areas
Like stub areas, totally stubby areas do not receive type 4 or 5 LSAs from their ABRs. However, they also do not receive type 3 LSAs; all routing out of the area relies on the single default route injected by the ABR.A stub area is extended to a totally stubby area by configuring all of its ABRs with the no-summary parameter

Router(Config)#router OSPF 1
Router(config-router)# area 10 stub no-summary
To designate a normal (stub) NSSA, all routers in the area must be so configured:
Router(Config)#router OSPF 1
Router(config-router)# area 10 nssa
Type 3 LSAs will pass into and out of the area. Unlike a normal stub area, the ABR will not inject a default route into an NSSA unless explicitly configured to do so. As traffic cannot be routed to external destinations without a default route, you'll probably want to include one by appending default-information-originate
Router(config-router)# area 10 nssa default-information-originate
To expand an NSSA to function as a totally stubby area, eliminating type 3 LSAs, all of its ABRs must be configured with the no-summary parameter:
Router(Config)#router OSPF 1
Router(config-router)# area 10 nssa no-summary
Summary
  • Type 1 - Represents a router
  • Type 2 - Represents the designated router for a multiaccess link
  • Type 3 - A network link summary (internal route)
  • Type 4 - Represents an ASBR
  • Type 5 - A route external to the OSPF domain
  • Type 7 - Used in stub areas in place of a type 5 LSA
Standard areas can contain LSAs of type 1, 2, 3, 4, and 5, and may contain an ASBR. The backbone is considered a standard area.
Stub areas can contain type 1, 2, and 3 LSAs. A default route is substituted for external routes.
Totally stubby areas can only contain type 1 and 2 LSAs, and a single type 3 LSA. The type 3 LSA describes a default route, substituted for all external and inter-area routes.
Not-so-stubby areas implement stub or totally stubby functionality yet contain an ASBR. Type 7 LSAs generated by the ASBR are converted to type 5 by ABRs to be flooded to the rest of the OSPF domain.

Related articles

CCNP : OSPF Quick Notes
CCNP Notes : IPV6 Quick Notes
CCNP Routing: EIGRP Quick Notes
EIGRP Passive Interface
EIGRP Stub
EIGRP Configuration and Troubleshooting commands
Basic notes on BGP (border gateway protocol)
Quick reminder about HSRP
EIGRP Authentication
EIGRP summarization

Read More...

CCNP : OSPF Quick Notes

 

Points to remember

· When priority is set to 0,that router won’t participate in DR/BDR election

· When other routing protocol routes are being redistributed into OSPF, Make sure "Subnet" option is added

· If ping to 224.0.0.5 fails, it means Router have no OSPF neighbors

· When OSPF is enabled across an NBMA network -- DR BDR election will occur. We need to configure neighbor command to build adjacencies

· If no Loopback is configured, Highest IP address will be the DR

· OSPFv3 for IPv6 authentication is supported by IPv6 IPSec.

· By default, redistribution of routes from other routing protocols into OSPF will appear as type E2 routes in OSPF routing table

· When implementing OSPFv3, In interface configuration mode, the IPv6 OSPF process area ID combination assigns interfaces to OSPFv3 areas.

· In OSPF, Router will only establish full adjacency with the DR and BDR on broadcast multi-access networks.

· OSPF Network LSAs are originated by the DR on every multi-access network. They include all attached routers including the DR itself

· In OSPF, If a router is stuck in INIT STATE means that router didn’t receive hello packets from neighboring router

· To make an area "totally stubby" we must apply the "area <area-id> stub no-summary" on the ABR and "area <area-id> stub" commands to all other routers in that area

· Advantages of creating multiple areas in OSPF

o Less frequent SPF calculation

o Smaller routing table

o Reduced LSU overhead

· Three restrictions apply to OSPF stub areas?

o No virtual links are allowed.

o The area cannot be a backbone area.

o No Autonomous System Boundary Routers are allowed.

· The maximum number of routers per OSPF area typically depends on

o the kind of OSPF areas being implemented

o the number of external LSAs in the network

o how well the areas can be summarized

· When verifying the OSPF link state database, which type of LSAs should you expect to see within the different OSPF area types?

o All OSPF routers in stubby areas can have type 3 LSAs in their database.

o All OSPF routers in NSSA areas can have type 3 LSAs in their database.

o All OSPF routers in NSSA areas can have type 7 LSAs in their database.

· When verifying OSPF virtual link problems, which is an important item to check on the two transit OSPF routers?

o OSPF Router ID

· Two statements about route redistribution when implementing OSPF

o OSPF can import routes learned using EIGRP, RIP, and IS-IS.

o OSPF routes can be exported into BGP.

· 3 statements about OSPF areas

o Areas introduce a boundary on the link-state updates.

o All routers within an area have the exact link-state database.

o The calculation of the Dijkstra algorithm on a router is limited to changes within an area.

Show Command

Explanation

show ip ospf database external

will display only the Type 5 LSAs in the OSPF topology database

show ip ospf

command displays the number of times that the OSPF Shortest Path First (SPF) algorithm has

been executed

show ip ospf neighbor

· This command is used to verify the current state of the OSPF database loading process

· To view neighbor adjacencies

S how ip ospf interfaces

view neighbor adjacencies

Show ip protocols

Display OSPF parameters such as filter, default metric, maximum paths, and number of areas configured on router

OSPF LSA

Q: You have been tasked with setting up OSPF on an existing company router usingIPv6. Which command enables OSPF for IPv6 on a router?

A. ipv6 router ospf process-id

Q: One of the most important characteristics of OSPF is multiple areas ?

A. All computation is kept within the area, with minimum communication between the areas, allowing the network to scale to larger sizes.

Q: When learning a new route, if a LSA received is not found in the topological database, what will an internal OSPF router do?

A. The LSA is flooded immediately out of all the OSPF interfaces, except the interface from which the LSA was received.

 

OSPF LSA type 

·

 OSPF order to form full adjacency

o Down

o INIT

o 2way

o Exstart

o Exchange

o Loading

o Full

 

OSPF adj

Read More...

CCNP Notes : IPV6 Quick Notes

IPV6 Quick Notes 


Make sure you all the below details before appearing for CCNP routing exam

Points to Remember 
  • IPv6 unicast-routing command must be globally enabled on a Cisco router to support IPv6 
  • In IPv6,host can auto configure its address without the aid of a DHCP server 
  • OSPFv3 for IPv6 authentication is supported by IPv6 IPsec. 
  • Type 9 LSA means Intra-area prefix LSA 
  • An automatic 6to4 tunnel allows multiple IPv4 destinations compared 
  • to manually configured  IPv6 in IPv4 tunnel 
  • 6to4 tunnels use IPv6 addresses that concatenate 2002::/16 with the 32-bit IPv4 address of the edge router, creating a 48-bit prefix.  
To configure 6to4 tunneling on a dual-stack edge router 
  • Tunnel mode(6t04) 
  • IPv4 Tunnel Source 
  • 6to4 IPv6 address (within 2002::/16)  
Two rules for compacting IPv6 addresses 
  • The leading zeroes in any 16-bit segment do not have to be written. 
  • Any single, continuous string of one or more 16-bit segments that consists of all zeroes can be represented with a double colon. 
Differences between an IPv4 header and an IPv6 header 
  • An IPv4 header includes a checksum. However, an IPv6 header does not include one.  
  • An IPv6 header is simpler and more efficient than an IPv4 header. 
  • An IPv6 header has twice as many octets as an IPv4 header.  
Two statements are true about using IPv4 and IPv6 simultaneously on a network segment
  • Hosts can be configured to receive both IPv4 and IPv6 addresses via DHCP. 
  • IPv6 allows a host to create its own IPv6 address that will allow it to communicate to other devices on a network configured via DHCP. IPv4 does not provide a similar capability for hosts. 
What is IPv6 router solicitation? 
A request made by a node for the IP address of the local router

What does the command clear ipv6 ospf process accomplish? 
The OSPF database is repopulated. Then the shortest path first (SPF) algorithm is performed.
Read More...

CCNP Routing: EIGRP Quick Notes

EIGRP Quick Notes
Make sure you know all the below concept before appearing for CCNP Routing exam
  • AD of EIGRP Internal Route is 90
  • AD of EIGRP external Route is 170
  • AD of EIGRP summary Route is 5
Passive Interface: In EIGRP (and OSPF) the passive interface command stops sending outgoing hello packets, hence the router cannot form any neighbor relationship via the passive interface. This behavior stops both outgoing and incoming routing updates

Feasible successor is a route whose Advertised Distance is less than the Feasible Distance of the current best path. A feasible successor is a backup route, which is not stored in the routing table but stored in the topology table.

EIGRP stub advertises summary and directly connected routes. EIGRP stub routing feature improves network stability, reduce resources utilization and simplifies stub router configuration. Any neighbor that receives a packet informing it of the stub status will not query the stub router for any routes.EIGRP stub configuration command increases scalability by limiting the
EIGRP query range

Active State: When a route (current successor) goes down, the router first checks its topology table for a feasible successor but it can’t find one. So it goes active on the that route to find a new successor by sending queries out to its neighbors requesting a path to the lost route.

Below is the order of the events happen when EIGRP topology change is detected:
· Dual is notified
· The neighbor adjacency is deleted
· Remove all topology entries learned from that neighbor
· The feasible route is used

Possible causes for EIGRP stuck-In-Active Routers ?
· Some query or reply packets are lost between the routers
· A failure causes traffic on a link between two neighboring routers to flow in only one direction(unidirectional link)

Prefix lists are configured to match an exact prefix length or prefix range.The ge and le keywords ae used to specify a range Prefix lists are configured with permit or deny keywords to either permit or deny the prefix based on matching condition.

EIGRP manual summarization is configured on a per interface basis. The summary address is entered into the routing table and is shown to be sourced from the null0 interface
NOTE : EIGRP performs an auto-summarization each time it crosses a border between two different major networks.

Key Concept of configuring EIGRP stub routing feature in a hub and spoke network ?
· Only remote routers are configured as stubs
· Stub routers are not queried for routes
· A stub router should have only EIGRP hub routers as neighbors

In a frame-relay environment, spoke routers can be configured as EIGRP stubs

Variance 1 in EIGRP means unequal load balancing is disabled ,it supportequal-cost load balancing

In EIGRP, If the multipoint network has different speeds allocated to the VCs,take the lowest CIR and simply multiply it by the number of circuits. This is because in Frame-relay all neighbors share the bandwidth equally, regardless of the actual CIR of each individual PVC, so we have to get the lowest speed CIR rate and multiply it by the number of circuits. This result will be applied on the main interface (or multipoint connection interface).

EIGRP Bandwidth: By default, EIGRP will limit itself to using no more than 50% of the interface bandwidth. The primary benefit of controlling EIGRP’s bandwidth usage is to avoid losing EIGRP packets, which could occur when EIGRP generates data faster than the interface line can absorb it. This is of particular benefit on Frame Relay networks, where the access interface bandwidth and the PVC capacity may be very different.


Notice that the “maximum-paths” command is used to share traffic to equal cost path while the “variance” command can share traffic to unequal cost path.

The ip summary-address eigrp {AS number} {address mask} command is used to configure a summary aggregate address for a specified interface.
Read More...

CCNP : BGP Quick Notes

BGP Quick Notes
Points to remember

A transit AS is an AS that routes traffic from one external AS to another external AS

The “show ip bgp” command is used to display entries in the BGP routing table.

The AS-PATH attribute is used to prevent BGP routing loops. When receiving an BGP advertisement, the router checks the AS-PATH attribute, if it see it’s own AS number in the AS-Path then it is a routing loop so the router will not install this route in its BGP table.

Local preference is an indication to the AS about which path has preference to exit the AS in order to reach a certain network. A path with a higher local preference is preferred more. The default value for local preference is 100.Unlike the weight attribute, which is only relevant to the local router, local preference is an attribute that routers exchange in the same AS. The local preference is set with the “bgp default local-preference value” command.

MD5 Authentication: You can configure MD5 authentication between two BGP peers, MD5 authentication must be configured with the same password on both BGP peers; otherwise, the connection between them will not be made. If a router has a password configured for a peer, but the other peer does not, a message No MD5 digest from…” will appear on the console while the routers attempt to establish a Multicast Source Discovery Protocol (MSDP) session between them. Similarly, if the two routers have different passwords configured, a message “Invalid MD5 digest from…” will appear on the screen.

Aggregate-Address command: When the aggregate-address command is used within BGP routing, the aggregated address is advertised, along with the more specific routes. The exception to this rule is through the use of the summary-only command. The “summary-only” keyword suppresses the more specific routes and announces only the summarized route.

The weight attribute is a special Cisco attribute that is used in the path selection process when there is more than one route to the same destination. The higher the weight value, the better the path. The default weight is 0.The weight attribute is local to the router and not propagated to other routers.


Below is the list of BGP states in order, from startup to peering:

1 – Idle: the initial state of a BGP connection. In this state, the BGP speaker is waiting for a BGP start event, generally either the establishment of a TCP connection or the re-establishment of a previous connection. Once the connection is established, BGP moves to the next state.

2 – Connect: In this state, BGP is waiting for the TCP connection to be formed. If the TCP connection completes, BGP will move to the OpenSent stage; if the connection cannot complete, BGP goes to Active

3 – Active: In the Active state, the BGP speaker is attempting to initiate a TCP session with the BGP speaker it wants to peer with. If this can be done, the BGP state goes to OpenSent state.

4 – OpenSent: the BGP speaker is waiting to receive an OPEN message from the remote BGP speaker

5 – OpenConfirm: Once the BGP speaker receives the OPEN message and no error is detected, the BGP speaker sends a KEEPALIVE message to the remote BGP speaker

6 – Established: All of the neighbor negotiations are complete. You will see a number (2 in this case), which tells us the number of prefixes the router has received from a neighbor or peer group. 

Memorizing the BGP decision process steps is very useful and you should remember them. The table below lists the complete path selection process:

1. Weight (Bigger is better)
2. Local preference (Bigger is better)
3. Self originated (Locally injected is better than iBGP/eBGP learned)
4. AS-Path (Smaller is better)
5. Origin
6. MED (Smaller is better)
7. External (Prefer eBGP over iBGP)
8. IGP cost (Smaller is better)
9. EBGP Peering (Older is better)
10. Router- ID

There are 4 BGP attribute types:

Well-known Mandatory: recognized by all implementations of BGP and must appear in a BGP update message. If missing, a notification error will be generated.
Well-Known Discretionary: recognized by all implementations of BGP but may not be sent in the BGP update message (include LOCAL_PREF, ATOMIC_AGGREGATOR).
Optional Transitive: may or may not be recognized by all BGP implementations. Because the attribute is transitive, BGP accepts and advertises the attribute even if it is not recognized (include Community attribte).
Optional Nontransitive: may or may not be recognized by all BGP implementations. Whether or not the receiving BGP router recognizes the attribute, it is nontransitive and is not passed along to other BGP peers (include MED). 

Which two conditions can cause BGP neighbor establishment to fail?
·        There is an access list blocking all TCP traffic between the two BGP neighbors.
·        The BGP neighbor is referencing an incorrect autonomous system number in its neighbor statement.

Use of Static Route in BGP: When two EBGP neighbors want to establish neighbor relationship without using the directly connected interfaces (for example, use loopback interface), they must tell each other how to reach their interfaces. A static route is the most simple way to do this, especially when they are in different ASs.

In BGP, “Connections established” is the number of times a TCP and BGP connection have been successfully established while “dropped” is the number of times that a valid session has failed or been taken down.
Read More...

Troubleshooting IP using ICMP (ping and traceroute)

Troubleshooting IP using ICMP

The Internet Control Message Protocol (ICMP) is used for a multitude of informational and error messaging purposes.
The two most common troubleshooting tools that utilize ICMP are:
•  Packet Internet Groper (ping) 
•  Traceroute


Packet Internet Groper (ping) 
Ping command is a very common troubleshooting tool, which utilizes the Echo Request and Echo Reply ICMP messages to determine if an IP address is reachable and responding. Ping will additionally provide the round-trip time between the source and destination, usually measured in milliseconds. Ping can also tell us whether there is any packet loss

 

The ping command first sends an echo request packet to an address, then waits for a reply. The ping is successful only if:

  • The echo request gets to the destination
  • The destination is able to get an echo reply back to the source within a predetermined time called a timeout. The default value of this timeout is two seconds on Cisco routers.

Example :

Router#Ping 192.168.10.1

 

The Extended ping Command

When a normal ping command is sent from a router, the source address of the ping is the IP address of the interface that the packet uses to exit the router. If an extended ping command is used, the source IP address can be changed to any IP address on the router. The extended ping is used to perform a more advanced check of host reachability and network connectivity. The extended ping command works only at the privileged EXEC command line. The normal ping works both in the user EXEC mode and the privileged EXEC mode.

Example

Router A>enable
Router A#ping
Protocol [ip]:
Target IP address: 192.168.40.1

!--- The address to ping.

Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 172.16.23.2

!---Ping packets are sourced from this address.

Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 162.108.21.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 36/97/132 ms 

!--- Ping is successful.


Traceroute command
The traceroute command is used to discover the routes that packets actually take when traveling to their destination. Traceroute will not only identify each router the packet has been forwarded through, but will also measure the delay experienced at each router hop.

Example

Router#traceroute 34.0.0.4

 

The Extended traceroute Command

The extended traceroute command is a variation of the traceroute command. An extended traceroute command can be used to see what path packets take in order to get to a destination. The command can also be used to check routing at the same time. This is helpful for when you troubleshoot routing loops, or for when you determine where packets are getting lost (if a route is missing, or if packets are being blocked by an Access Control List (ACL) or firewall). You can use the extended ping command in order to determine the type of connectivity problem, and then use the extended traceroute command in order to narrow down where the problem occurs.

 

Example

Router A>enable
Router A#traceroute
Protocol [ip]:
Target IP address: 192.168.40.2  

!--- The address to which the path is traced.

Source address: 172.16.23.2
Numeric display [n]:
Timeout in seconds [3]:
Probe count [3]:
Minimum Time to Live [1]:
Maximum Time to Live [30]:
Port Number [33434]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Type escape sequence to abort.
Tracing the route to 192.168.40.2

  1 172.31.20.2 16 msec 16 msec 16 msec
  2 172.20.10.2 28 msec 28 msec 32 msec
  3 192.168.40.2 32 msec 28 msec *  

!--- The traceroute is successful.

Read More...

EIGRP Configuration and Troubleshooting commands

EIGRP Configuration

Syntax

Router(config)#router eigrp <Autonomous-system-number>
Router(config-router)#network <network address>[wild card-mask] (wild card mask is optional)
Router(config-router)#no auto-summary
Router(config-router)#variance <multiplier> (Optional)
 

To influence the metric,it is possible to configure bandwidth on the interfaces:

Router(config)#Interface<interface>
Router(config-if)#bandwidth<BW in kbps>

Configure Default paths in EIGRP
Method 1:
Specify a default network:

Router(config)# ip default-network < network_address >

Method 2:
Create a static default route and then include network 0.0.0.0 in
EIGRP:

Router(config)# ip route 0.0.0.0 0.0.0.0 < next_hop_ip >
Router(config)# router eigrp < as_no >
Router(config-router)# network 0.0.0.0

To view exchange process

Router#debug eigrp packets

To view update process

Router#debug ip eigrp

To view the neighbor table:

Router#show ip eigrp neighbors

To view the EIGRP Topology Table, containing all EIGRP route information: 

Router#  show ip eigrp topology

To view information on EIGRP traffic sent and received on a router: 

Router#  show ip eigrp traffic

To view the bandwidth, delay, load, reliability and MTU values of an interface: 

Router#  show interface s0

To view information specific to the EIGRP protocol: 

Router#  show ip protocols

This command provides us with information on EIGRP timers, EIGRP metrics and summarization

To view the IP routing table: 

Router#  show ip route

To view a specific route within the IP routing table: 

Router#  show ip route 10.3.0.0

To debug EIGRP in realtime: 

Router#  debug eigrp neighbors
Router#  debug eigrp packet
Router#  debug eigrp route
Router#  debug eigrp summary
Read More...

EIGRP Load-Balancing

EIGRP Load-Balancing

By default, EIGRP will automatically load-balance across equal-metric routes (four by default, six maximum). EIGRP also supports load-balancing across routes with an unequal metric. We must use the variance command to tell EIGRP to load-balance across unequal-metric links

Syntax

Router(config)#  router eigrp 100
Router(config-router)#  variance 2
Router(config-router)#  maximum-paths 6

The variance command assigns a “multiplier,” in this instance of 2. We multiply this variance value by the metric of our Feasible Distance.Thus, any Feasible Successors with a metric within twice that of our Feasible Distance will now be used for load balancing by EIGRP. 

 

Remember, only Feasible Successors can be used for load balancing.The maximum-paths command adjusts the number of links EIGRP can load-balance across.

 

Click here for EIGRP MAXIMUM PATH AND VARIANCE Lab with GNS3

Read More...

EIGRP Authentication

EIGRP Authentication
If you don’t use authentication and you are running EIGRP someone could try to form an EIGRP neighbor adjacency with one of your routers and try to hack into your network.We can use MD5 authentication with EIGRP.
 
By using authentication your router will authenticate the source of each routing update packet that it will receive. it can also used to prevents false routing updates from sources that are not approved. By enabling authentication its possile to ignore malicious routing updates.
Steps
1. Configure a key chain to group the keys.
2. Configure one or more keys within that key chain. The router checks all inbound packets against the list of keys and uses the first valid one it finds.
3. Configure the password or authentication string for that key.Repeat Steps 2 and 3 to add more keys if desired.
4. Optionally configure a lifetime for the keys within that key chain.If you do this, be sure that the time is synchronized between the two routers.
5. Enable authentication and assign a key chain to an interface.
6. Designate MD5 as the type of authentication
 
Create Key Chain:
R(config)#key chain < key chain name >
R(config-keychain)#key < number >
R(config-keychain-key)#key-string < string >
R(config-keychain-key)# send-lifetime < hh:mm:ss > <hh:mm:ss>  (optional)
R(config-keychain-key)# accept-lifetime <hh:mm:ss> <hh:mm:ss> (optional)
Applying Authentication:
R(config)#interface < interface >
R(config-subif)#ip authentication mode eigrp <as_no> md5
R(config-subif)# ip authentication key-chain eigrp <as_no> < key chain name>
Verify
Router# show key chain
Router# debug eigrp packets
Click here for MD5 Authentication Lab
Read More...

EIGRP summarization

By default,Auto summarizing is enabled in EIGRP.Automatic summarization can be disabled using the following command:     
Router(config)#  router eigrp 100
Router(config-router)#  no auto-summary
"No auto-summary" command is needed because by default EIGRP will behave like a classfull routing protocol which means it won’t advertise the subnet mask along the routing information. For example 1.1.1.0/24 and 2.2.2.0/24 will be advertised as 1.0.0.0/8 and 2.0.0.0/8. Disabling auto-summary will ensure EIGRP sends the subnet mask along

Summaries can also be produced manually on any interface
Syntax:
Router(config)# interface < interface >
Router(config-if)# ip summary-address eigrp < as-no> <summarized_network_ip> <summarized_subnet_mask>
Example:

Router(config)#  interface fa 0/0
Router(config-if)#  ip summary-address eigrp 100 79.0.0.0 255.0.0.0
The manually-created summary route is not advertised as an internal EIGRP route, but instead is classified as an EIGRP summary route. An EIGRP summary route has an Administrative Distance of 5.

Labs


Read More...

Configuring EIGRP Unicast Neighbors

EIGRP usually uses a multicast to IP address 224.0.0.10 for its messages.There is an option to configure it to use a unicast address with the command neighbor ip-address .
R(config)# router eigrp < as_no >
R(config-router)# neighbor <ip-address> <interface>
Verification:

R# debug ip packet
Lab:
EIGRP Unicast 

Read More...

EIGRP Passive Interface

EIGRP Passive Interface

In EIGRP (and OSPF) the passive interface command stops sending outgoing hello packets,hence the router cannot form any neighbor relationship via the passive interface.This behavior stops both outgoing and incoming routing updates
 
To enable passive interface on one interface:
Router(config)# router eigrp < as_no.>
Router(config-router)# passive-interface < interface > 
To turn on the passive interface on all interfaces:
Router(config)# router eigrp < as_no.>
Router(config-router)# passive-interface default 
We can configure all interfaces to be passive using the passive-interface default command, and then individually use the no passive-interface command on the interfaces we do want neighbors to be formed on:
Router(config)# router eigrp < as_no.>
Router(config-router)# passive-interface default
Router(config-router)#  no passive-interface <interface> 
To turn off passive interface
Router(config)# router eigrp < as_no.>
Router(config-router)# no passive-interface <default/interface >
Read More...

Access List notes: Numbered and Named ACL

Access Control Lists (ACLs)
Access control lists (ACLs) are set of rules which allows you to permit or deny packets based on source and destination IP address, IP protocol information, or TCP or UDP protocol information. You can configure the following types of ACLs:

Standard – Permits or denies packets based on source IP address. Valid standard ACL IDs are 1 – 99
Extended – Permits or denies packets based on source and destination IP address and also based on IP protocol information. Valid extended ACL IDs are a number from 100 – 199

Access-lists use wildcard masks to match traffic.Access control lists (ACLs) can be used for two purposes on Cisco devices:
•  To filter traffic
•  To identify traffic


When filtering traffic, access lists are applied on interfaces. As a packet passes through a router, the top line of the rule list is checked first, and the router continues to go down the list until a match is made. Once a match is made, the packet is either permitted or denied.
 
NOTE : There is an implicit ‘deny all’ at the end of all access lists. We cant delete it.So an access lists that contain only deny statements will prevent all traffic.If you want ACL to allow traffic there must be a permit statement
 
Access lists are applied either inbound (packets received on an interface, before routing), or outbound (packets leaving an interface, after routing). Only one access list per interface, per protocol, per direction is allowed.
 
Even filtering traffic is the primary use of access lists, there are several instances when it is necessary to identify traffic using ACLs, including: 
•  Identifying interesting traffic to bring up an ISDN link or VPN tunnel
•  Identifying routes to filter or allow in routing updates
•  Identifying traffic for QoS purposes


Types of Access List 
There are two categories of access lists: 

Numbered ACL .it is the basic one.You cannot remove individual lines from a numbered access list. The entire access list must be deleted and recreated. All new entries to a numbered access list are added to the bottom. Best practice is to use a text editor to manage your access-lists.
There are two common types of numbered access lists:
  1. IP standard access lists 
  2. IP extended access lists
Named ACL provide more flexibility than Numbered access list.We can give names to identify your access-lists. individual lines can be removed from a named access-list. All new entries are  added to the bottom of the access list like numbered ACL
There are two common types of named access lists:
  1. IP standard named access lists 
  2. IP extended named access lists 
How to permit or deny a specific host in Access list ?
we can use an example of 172.16.10.1 .As we want to block a specific address(host) in a network, we can use wildcard mask "0.0.0.0" .all octet in wildcard mask set to "0" means every octet  must be matched.
 
There are actually two ways we can match a host:
•  Using a wildcard mask "0.0.0.0" – 172.16.10.1 0.0.0.0
•  Using the keyword “host” – host 172.16.10.1

 
Above method is use to match exactly a host.So how what we do to match the all address ?
There are actually two ways we can match all addresses:
•  Using a wildcard mask  "255.255.255.255" -  0.0.0.0 255.255.255.255
•  Using the keyword “any” – any source or destination

 
Standard IP Access List
Syntax
access-list [1-99] [permit | deny] [source address] [wildcard mask]
Standard IP access-lists are based upon the source host or network IP address, and should be placed closest to the destination network. Range of standard access list is from 1-99
Example
Qn : Block network 172.20.0.0 from accessing the 172.19.0.0 network

  • Router(config)#  access-list 20 deny 172.20.0.0 0.0.255.255 
  • Router(config)#  access-list 20 permit any
Note : Access list must be created on the router which is close to destination
  • First line deny all hosts on the 172.20.x.x network.
  • The second line uses a keyword of "any", which will match (permit) any other address. 
Always remember that you must have at last one permit statement in your access list.otherwise all traffic will be blocked because of implicit deny at the end 

Creating a access-list wont do anything it the network.It must be applied on an interface.To apply this access list, we would configure the following on Router:

  •   Router(config)#  int s0 
  •   Router(config-if)#  ip access-group 20 in
To view all IP access lists configured on the router:  
  Router#  show ip access-list  
To view what interface an access-list is configured on: 
  • Router#  show ip interface
  • Router#  show running-config
Extended IP Access List
Syntax
access-list [100-199] [permit | deny] [protocol] [source address] [wildcard mask] [destination address] [wildcard mask] [operator] [port]
Extended IP access-lists block based upon the source IP address, destination IP address, and TCP or UDP port number. Extended access-lists should be placed closest to the source network.
Example :
  • access-list 100 deny tcp host 1.1.1.1 host 2.2.2.2 eq 23
  • access-list 100 deny tcp 3.3.3.0 0.0.0.255 any eq 80
  • access-list 100 permit ip any any 
  1. The first line deny host 1.1.1.1 from accessing host 2.2.2.2 via telnet (port 23) 
  2. The second line deny http (eq port 80)access of 3.3.3.0 network 
  3. The third line allows all other traffic 
Like our earlier example this ACL also be applied on interface to take effect.To apply this access list, we would configure the following command
  • int fa 0/0
  • ip access-group 100 in 
In the above example we used eq port 80 to block http.Click here to view the list of common ports used
 
We can use several other operators for port numbers:
  1. eq  Matches a specific port 
  2. gt  Matches all ports greater than the port specified 
  3. lt  Matches all ports less than the port specified 
  4. neq  Matches all ports except for the port specified 
  5. range  Match a specific inclusive range of ports
The following will match all ports greater than 100:
Router(config)#  access-list 101 permit tcp any host 172.16.10.10 gt 100
The following will match all ports less than 1024:
Router(config)#  access-list 101 permit tcp any host 172.16.10.10 lt 1024
The following will match all ports that do not equal 443:
Router(config)#  access-list 101 permit tcp any host 172.16.10.10 neq 443
The following will match all ports between 80 and 88:
Router(config)#  access-list 101 permit tcp any host 172.16.10.10 range 80 88
Named Access Lists
Named access lists provide us with two advantages over numbered access lists. First, we can apply an identifiable name to an access list, for documentation purposes. Second, we can remove individual lines in a named access-list, which is not possible with numbered access lists. 


Please note, though we can remove individual lines in a named access list, we cannot insert individual lines into that named access list. New entries are always placed at the bottom of a named access list

 
To create a standard named access list, the syntax would be as follows:   
  • Router(config)#  ip access-list standard NAME
  • Router(config-std-nacl)#  deny 172.18.0.0 0.0.255.255
  • Router(config-std-nacl)#  permit any 
To create an extended named access list, the syntax would be as follows:  
  • Router(config)#  ip access-list extended NAME
  • Router(config-ext-nacl)# permit tcp 172.18.0.0 0.0.255.255 host 172.16.10.10 eq 80
  • Router(config-ext-nacl)#  deny ip 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255
  • Router(config-ext-nacl)#  permit ip any any
Troubleshooting
  • show access-lists [<number> | <name>]
  • show ip access-lists [<number> | <name>]
  • show ip access-lists interface <interface>
  • show ip access-lists dynamic
  • show ip interface [<interface>]
GNS3 Labs :


Read More...

EIGRP Notes with Interview Questions

EIGRP (Enhanced Interior Gateway Routing Protocol)

Important points about EIGRP
  • EIGRP  is  a Cisco proprietary protocol which means it will work only on Cisco routers.
  • EIGRP is also called advanced distance vector or Hybrid routing protocol.
  • Multicast or unicast is used for exchange of information.
  • Multiple network layer protocols are supported.
  • 100% loop-free.
  • By default,EIGRP will limit itself to use no more than 50% of the interface bandwidth
  • Maximum Hop-Count is 255[ 100 by default]
  • EIGRP is classless protocol
  • EIGRP supports VLSM and authentication
  • EIGRP uses Diffusing Update Algorithm (DUAL) to determine the best path among all “feasible” paths. DUAL also helps ensure a loop-free routing environment.
  • EIGRP will form neighbor relationships with adjacent routers in the same Autonomous System (AS)
  • EIGRP uses RTP (Reliable Transport Protocol) and its function is to deliver EIGRP packets between neighbors in a reliable and ordered way.
  • All EIGRP routing information are exchanged between neighbors via multicast using  the address 224.0.0.10
  • EIGRP routers do not send periodic, full-table routing updates.  Updates are sent when a change occurs, and include only the change
  • K-Values are used for calculating metric. By default EIGRP consider k1 and k3 only
  • EIGRP having internal Administrative distance as 90 and external AD as 170 
  • EIGRP summary route AD value is 5
  • In EIGRP Summarization is enabled by default."No auto-summary" command is needed because by default EIGRP will behave like a classfull routing protocol which means it won’t advertise the subnet mask along the routing information. For example 1.1.1.0/24 and 2.2.2.0/24 will be advertised as 1.0.0.0/8 and 2.0.0.0/8. Disabling auto-summary will ensure EIGRP sends the subnet mask along.
  • EIGRP converges rapidly after link failure
  • EIGRP can load balance on both equal and unequal cost paths."Variance" command is used to configure load balancing
  • EIGRP supports up to 6 loop-free paths with a metric lowers than the product of variance and the best metric
  • Manual summarization can be enabled at any interface 
  • If a packet is not acknowledged,EIGRP re transmit the packet to the non responding neighbor as a unicast.No other traffic is sent to this neighbor until it responds.After 16 unacknowledged re-transmissions,the neighbor is removed from the neighbor table
  • The process of neighbor discovery and route exchange between two EIGRP router is as follows
    • Router A sends out a hello
    • Router B sends back a hello and an update.The update contains routing information
    • Router A acknowledges the update
    • Router A sends its update
    • Router B acknowledges
  •  A neighbor is considered as lost if no hello is relieved within 3 hello periods
Why do we call EIGRP an advanced distance vector or hybrid routing protocol?
Because it shares features of both distance vector and link state protocols. For example  EIGRP advertise routes to directly connected neighbors  like a distance vector protocols and it uses a series of tables like link state protocols 

Advantages of EIGRP 
  • EIGRP uses AS (Autonomous system) number ranging from  1-65535 to identify collection of routers that share same information.
  • EIGRP have less convergent time and is more efficient
  • EIGRP supports both auto and manual route summarization
  • Supports multiple routed protocols like IP ,IPX and apple talks
  • EIGRP converges rapidly in the event of link failure
  • EIGRP can load balance equal and unequal cost path.By default EIGRP supports 4 load balancing path.It can be extended to 6 paths 
EIGRP Packet types 
There are 5 packet types
  1. Hello Packet – In normal scenarios  Hello packets are send in 5 seconds .Hello packets are send between directly connected neighbors. Hello packets are send as Multicast
  2. Update – Update packet are used to send triggered updates. EIGRP won’t send periodic updates like distance vector protocols. They  send triggered updates only when a chance is occurred .Update packets are send as Multicast or unicast
  3. Query – Query packets are send when the successor path is failed and there is no feasible successor (back up path).Query packets are send as multicast
  4. Reply – Reply for query packets. Reply packets are send as unicast
  5. ACK – Ack packets are send as Acknowledgement for update and Reply packet. Send as Unicast

 NOTE : Hello packets don’t have to be acknowledged since EIGRP uses a holddown time. If a
router doesn’t receive hello packets in an X amount of time it will drop the neighbor adjacency.

Stuck in Active: When a route (current successor) goes down, the router first checks its topology table for a feasible successor. If  backup path(feasible successor) is not present, it goes active(actively checking to find new route)  on the that route to find a new successor by sending queries out to its neighbors requesting a path to the lost route. Such state of router while waiting for a reply for a query packet is called Stuck in Active. In normal working condition router running EIGRP protocols is in passive state(P).If there is a failure in successor path and there is no back up path, then router will be in Active state(A).

Conditions to form EIGRP neighbors
Must receive HELLO PACKET from neighbor router
AS number must be same
Must have identical K-values or Metric
Adjacencies will not form unless the primary IP addresses on connecting interfaces are on the same subnet.

EIGRP maintain 3 tables 
•  Neighbor table – list of all neighboring routers. Neighbors must belong to the same Autonomous System
•  Topology table – list of all routes in the Autonomous System
•  Routing table – contains the best route for each known network

EIGRP Neighbors 
EIGRP forms neighbor relationships, called adjacencies, with other routers in the same AS by exchanging Hello packets. Routers share routing information after forming adjacencies. Hello packets are sent as
multicasts to address 224.0.0.10.  By default, EIGRP Hellos are sent every 5 seconds. On slower connections, EIGRP Hellos are sent every 60 seconds by default.

The EIGRP Hello timer can be adjusted on a per interface basis:
Router(config)#Interface fa 0/1
Router(config-if)#  ip hello-interval eigrp 20 15
The above command allows us to change the hello timer to 15 seconds for Autonomous System 20.

In addition to the Hello timer, EIGRP neighbors have a Hold timer. The Hold timer indicates how long a router should wait before marking a neighbor inactive, if it stops receiving hello packets from that neighbor. 

By default, the Hold timer is three times the Hello timer. On high-speed links the timer is set to 15 seconds, and on slower links the timer is set to 180 seconds.

The Hold timer can also be adjusted on a per interface basis: 
Router(config)#Interface fa 0/1
Router(config-if)#  ip hold-interval eigrp 20 21 
The above command allows us to change the hold timer to 21 seconds for Autonomous System 20. 

Changing the Hello timer does not automatically change the Hold timer. Additionally, Hello and Hold timers do not need to match between routers for an EIGRP neighbor relationship to form.

Successor Path and Feasible Successor path 
EIGRP enabled routers will send HELLO Packets to each other and become neighbors. EIGRP neighbors will exchange routing information which will be saved in the topology table. The best path from the topology table will be copied in the routing table. Such path are called Successor. Metric of the successor path is called Feasible distance.

After finding the successor path ,EIGRP will find another path as a back up path to successor to give redundancy is called Feasible successor. The metric used to find  feasible successor is called Advertised distance (AD) or Reported distance (RD).This Advertised distance (AD) is the distance between neighbor of the source and destination . 
In short,
Advertised distance: How far the destination is away for your neighbor.
Feasible distance: The total distance to the destination. 
successor : The best path to the destination

Condition for choosing Feasible successor
Advertised distance (AD) must be less than the metric of successor path 
Advertised distance of feasible successor < Feasible distance of successor.

Note : While calculation best paths, one thing you must keep in mind is  Split horizon rule which states “whatever you learn on an interface you don’t advertise back out of the same interface.”

Feasible Successors provide EIGRP with redundancy, without forcing routers to re-converge when a topology change occurs. If no Feasible Successor exists and a link fails, a route will enter an Active (converging) state until an alternate route is found.

EIGRP Route States 
An EIGRP route can exist in one of two states, in the topology table:
•  Active state
•  Passive State

A Passive state indicates that a route is reachable, and that EIGRP is fully converged. A stable EIGRP network will have all routes in a Passive state.

A route is placed in an Active state when the Successor and any Feasible Successors fail, forcing the EIGRP to send out Query packets and re-converge. Multiple routes in an Active state indicate an unstable EIGRP network. If a Feasible Successor exists, a route should never enter an Active
state.

You can check the status of states by using
Router#  show ip eigrp topology 
To view only active routes in the topology table:  
Router#  show ip eigrp topology active 
EIGRP Metrics 
EIGRP can utilize 5 separate metrics to determine the best route to a
destination:
  1. Bandwidth (K1)
  2. Load (K2
  3. Delay of the Line (K3
  4. Reliability (K4)
  5. MTU (K5)

By default, only Bandwidth and Delay of the Line are used 
K1 = 1, K2 = 0, K3 = 1, K4 = 0, K5 = 0

Graceful Shutdown
When an EIGRP process is shut down, the router sends out “goodbye” messages to its neighbors (in the form of hello packets).   The neighbors can then immediately begin recalculating paths to destinations that went through the shutdown router without having to wait for the hold timer to expire.

GNS3 Labs:

Interview Questions 
What is EIGRP?
What are the different tables in EIGRP?
Why EIGRP is called hybrid protocol
What are the different packets in EIGRP?
What are the advantages of EIGRP other routing protocol ?
What type of Authentication is supported by EIGRP ?
What is the use of "variance" Command in EIGRP?
Internal and external Administrative distance in EIGRP ?
What is Feasible successor ?
What is Advertised distance ?
What is successor  ?
What is the muticast address used by EIGRP to send Hello packets ?
What is "Stuck in Active" ?
what is "Graceful shutdown" ?
what is "Goodbye" message recieved in EIGRP ?
Maximum path load balanced by EIGRP ?
How EIGRP support unequal load balancing ?
What happen when we enable passive interface in EIGRP ?
Conditions for EIGRP neigbours
what is meant by active and passive states in EIGRP ?
What are the different K-values used in EIGRP ?
Read More...