Showing posts with label CCNP Switching. Show all posts
Showing posts with label CCNP Switching. Show all posts

CCNP: MST (Multiple Spanning Tree) Notes and configuration

by Shabeeribm
In PVST,we need to have different calculations for each VLAN. This will be fine for less number of VLANS. But if we have 100's of VLAN this is not easy.For such cases we use MST (Multiple Spanning Tree).

In MST,Instead of calculating a spanning tree for each VLAN we can use instances and map VLANS to each instance. For example consider we have 200 vlans.it can be configured as 

• Instance 1: VLAN 100 – 200.
• Instance 2: VLAN 201 – 300.

Only two spanning tree calculations (instances) are required for all these VLANs.

MST works with the concept of regions. Switches that are configured to use MST need to find out if their neighbors are running MST. When switches have the same attributes they will be in the same region. It's possible to have one or more regions and here are the attributes that need to match

• MST configuration name.
• MST configuration revision number.
• MST instance to VLAN mapping table.

When switches have the same attributes configured they will be in the same region. If the attributes are not the same the switch is seen as being at the boundary of the region. It can be connected to another MST region but also talk to a switch running another version of spanning tree.

We can give any name or number for "MST configuration name" and "MST configuration revision number".VLANs will be mapped to an instance by using the "MST instance to VLAN mapping table". This is something we have to do ourselves.

Within the MST region we will have one instance of spanning tree that will create a loop free topology within the region. When you configure MST there is always one default instance used to calculate the topology within the region. We call this the IST (Internal Spanning Tree). By default Cisco will use instance 0 to run the IST.

By default there will be only instance 0 is available.We can see that all VLANs are currently mapped to instance 0.

Lets do an example.There are two switches-Switch A and Switch B. Don't forget to create trunk between switches.

SwitchA(config)#spanning-tree mode mst
SwitchA(config)#vlan 10
SwitchA(config-vlan)#vlan 20
SwitchA(config-vlan)#vlan 30
SwitchA(config-vlan)#vlan 40
SwitchA(config-vlan)#vlan 50
SwitchA(config-vlan)#vlan 60
SwitchA(config-vlan)#exit

SwitchB(config)#spanning-tree mode mst
SwitchB(config)#vlan 10
SwitchB(config-vlan)#vlan 20
SwitchB(config-vlan)#vlan 30
SwitchB(config-vlan)#vlan 40
SwitchB(config-vlan)#vlan 50
SwitchB(config-vlan)#vlan 60
SwitchB(config-vlan)#exit

We enabled mst and configured vlan 10,20,30,40,50 and 60 in both switch A and Switch B

SwitchA(config)#spanning-tree mst configuration
SwitchA(config-mst)#name sysnetnotes
SwitchA(config-mst)#revision 1
SwitchA(config-mst)#instance 2 vlan 10,20,30
SwitchA(config-mst)#instance 3 vlan 40,50,60
SwitchA(config-mst)#exit

SwitchB(config)#spanning-tree mst configuration
SwitchB(config-mst)#name sysnetnotes
SwitchB(config-mst)#revision 1
SwitchB(config-mst)#instance 2 vlan 10,20,30
SwitchB(config-mst)#instance 3 vlan 40,50,60
SwitchB(config-mst)#exit

This is how we configure MST. First you need the spanning-tree mst configuration command to enter the configuration of MST. We set the name by using the name command[You can set any name]. Don't forget to set a revision number and map the instances with the instance command.

We can use the show spanning-tree mst configuration command to verify our configuration.You can see that we now have two instances. The VLANS are mapped to instance 2 and 3.All the other VLANs are still mapped to instance 0.

To create Root bridge manually in MST
Switch(config)#spanning-tree mst < 0 > priority 4096

This is how I change the priority for MST "instance 0".

To view 
Switch#show spanning-tree mst
Switch#show spanning-tree mst configuration

NOTE : MST will only advertise BPDUs from the IST [(Internal Spanning Tree)] to the outside world
Read More...

What is Loop Guard

by Shabeeribm
While using optic fiber cables,when (transmit or receive) fails we'll have a unidirectional link failure and this can cause spanning tree loops. 

One of the methods we can use to solve our unidirectional link failure is to configure LoopGuard. When a switch is sending but not receiving BPDUs on the interface, LoopGuard will place the interface in the loop-inconsistent state and block all traffic!

Configuration:
Switch(config)#Interface fa 0/10
Switch(config-if)#spanning-tree guard loop
OR
Switch(config)#spanning-tree loopguard default

Use the spanning-tree loopguard default command to enable LoopGuard globally.
Read More...

DHCP short notes and Configuration on Multilayer switch

by Shabeeribm
When a computer connected to a Domain having DHCP server it will requests an IP address,Below steps will happen between the requested client and DHCP server

• DHCP Discover
• DHCP Offer
• DHCP Request
• DHCP Acknowledgement

The computer sends an DHCP Discover because it's looking for an IP address. This message is broadcasted within the VLAN. The DHCP server will reply with the DHCP Offer message, this contains all the information the computer needs. The computer will reply with a DHCP request because it likes what it sees. The final step is a DHCP Acknowledgement from the DHCP server.

Configuration to use multilayer switch as DHCP server

Switch(config)#interface vlan 15
Switch(config-if)#ip address 192.168.11.254 255.255.255.0
Switch(config)#interface fa0/1
Switch(config-if)#switchport access vlan 15

First create the SVI, put an IP address on it and make sure Computer  is in VLAN 15.You can also use a routed port if you like instead of SVI

Switch(config)#ip dhcp pool SYSNETNOTES
Switch(dhcp-config)#network 192.168.11.0 255.255.255.0
Switch(dhcp-config)#default-route 192.168.11.254
Switch(config)#ip dhcp excluded-address 192.168.11.254

Above is a simple example of a DHCP pool. You can pick any name you like for the pool.Type in the network and that's it. I've also added a gateway with the default-routecommand. Optionally you can exclude a number of IP addresses

Switch#show ip dhcp binding

NOTE : if the DHCP server is not on the same VLAN, We can use the "ip helper" command
Read More...

EtherChannel Notes and Configuration

by Shabeeribm
In normal case when we add multiple links between two switches for redudantancy,except one link all other links will be blocked by SPanning tree.This is to avoid loops.Etherchannels is a technology that lets you bundle multiple physical links into a single logical link.Its also called link aggregation.Etherchannel will bundle all physical links into a logical link with the combined bandwidth.
 
For example by combining 4x 100 Mbit we will get a 400 Mbit link.Spanning tree sees this link as one logical link so there are no loops!.
 
EtherChannel will do load balancing between the links connected.If any of the links connected goes down,It will work with combained bandwidth of the links that are still active. There’s a maximum to the number of links you can use: 8 physical interfaces.
 
Two protocols used in Etherchannel are:
• PAgP (Cisco proprietary)
• LACP (IEEE standard)
 
These protocols can dynamically configure an etherchannel. It’s also possible to configure a static etherchannel without these protocols doing the negotiation of the link for you. If you are going to create an etherchannel you need to make sure that all ports have the same configuration:
• Duplex has to be the same.
• Speed has to be there same.
• Same native AND allowed VLANs.
• Same switchport mode (access or trunk).
 
PAgp and LACP will check if the configuration of the interfaces that you use are the same.
If you want to configure PAgP you have a number of options you can choose from, an interface can be configured as:
• On (interface becomes member of the etherchannel but does not negotiate).
• Desirable (interface will actively ask the other side to become an etherchannel).
• Auto (Will not start negociation.interface will wait passively for the other side to ask to become an etherchannel).
• Off (no etherchannel configured on the interface).
 
Configuration of PagP
Switch(config)#interface fa0/13
Switch(config-if)#channel-group 1 mode desirable
Switch(config)#interface fa0/14
Switch(config-if)#channel-group 1 mode desirable
 
Switch(config)#interface port-channel 1
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk

Note : Here we use desirable mode.You can choose any mode from above list.Result will be different depends on the mode you choosed.Configure this on both switches where we need to configure EtherChannel.
 
To view :
Switch#show etherchannel 1 port-channel
Switch#show etherchannel summary
Switch#show interfaces fa0/14 etherchannel
 
LACP is similar to PAgP. You also have different options to choose from when you configure the interface:
• On (interfaces becomes member of the etherchannel but does not negotiate).
• Active (interface will actively ask the other side to become an etherchannel).
• Passive (interface will wait passively for the other side to ask to become an etherchannel).
• Off (no etherchannel configured on the interface).
 
LACP Configuration
It’s basically the same thing as PAgP but the terminology is different.
 
Switch(config-if)#interface fa0/13
Switch(config-if)#channel-group 1 mode active
Switch(config-if)#interface f0/14
Switch(config-if)#channel-group 1 mode active
 
Switch(config)#interface port-channel 1
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
 
Note : Here we use active mode.You can choose any mode from above list
Note : Pagp and LACP configuration has to be done on both switches configuring EtherChannel
 
To View:
Switch#show etherchannel 1 port-channel
 
NOTE : The configuration of PAgP and LACP is similar. Keep in mind that PAgP can only be used between Cisco devices while LACP is a IEEE standard, you can use it to form etherchannels between different vendors
 
Note: We can use the show etherchannel load-balance command to see what the default configuration is. Etherchannel load-balances based on the source MAC address
Read More...

Rapid spanning tree (RSTP) Notes

by Shabeeribm
Rapid spanning tree is not a revolution of the original spanning tree but an evolution from it.Behind the scenes some things have been changed to speed up the process.

 In original STP we had 4 port-states.They are
  • Blocking
  • Listening
  • Learning
  • Forwarding
In RSTP,Blocking and Listening state is combined to one and total there are 3 states.They are
  • Discarding
  • Learning 
  • Forwarding
As in original STP,Root bridge election process in RSTP is same.The switch with the best bridge ID (priority + MAC address) becomes the root bridge. The other switches (non-root) have to find the shortest cost path to the root bridge. This is the root port.No change in this.On each segment there can be only one designated port or we’ll end up with a loop. The port will become the designated port if it can send the best BPDU. Root bridge ports are always in designated mode.

Rapid spanning tree and Original STP are compatible.In original STP Root bridge only send BPDU to other non-root switches and they receive it on their root ports.But in RSTP all switches generate BPDUs every two seconds (hello time). This is the default hello time but you can change it.

The original STP uses the max age timer (15 seconds) so MAC addresses could be removed faster from the mac address table. In RSTP, BPDUs uses as a keep-alive mechanism similar to what routing protocols like OSPF or EIGRP use. If a switch misses three BPDUs from a neighbor switch it will assume connectivity to this switch has been lost and it will remove all MAC addresses immediately.

Original STP used to reject inferior BPDU. BUT RSTP accepts inferior BPDU(as the backbone fast feature is enabled)

Rapid spanning doesn't use timers to decide whether an interface can move to the forwarding state or not. It will use a negotiation mechanism for this

Rapid spanning tree can only put interfaces in the forwarding state really fast on edge ports (port-fast in original STP) or point-to-point interfaces. RSTP  uses "Sync" mechanism instead of the “timer-based” mechanism that the Original STP (listening -> learning -> forwarding)

Related articles

Read More...

Interview Questions : What is TCN ?

by Shabeeribm
What is TCN ?

In normal case MAC address tables that age out after 300 seconds works perfectly fine in a stable network but not when the topology changes.

When a switch detects a change in the network (interface going down or into forwarding state) it will advertise this event to the whole switched network.When the switches receive this message they will reduce the aging time of the MAC address table from 300 seconds to 15 seconds (this is the forward delay timer). This message is called the TCN (Topology Change Notification).

In a normal situation a non-root switch will receive BPDUs on its root port but will never send any BPDUs to the root bridge. When a non-root switch detects a topology change it will generate a topology change notification and send it on its root port towards the root bridge.When a switch receives the topology change notification it will send a (TCA) topology change acknowledgement on its designated port towards the downstream switch. 

Once the topology change notification reaches the root bridge it will set the TC (topology change) bit in the BPDUs it will send. These BPDUs will be forwarded to all the other switches in our network so they can reduce their aging time of the MAC address table.Switches will receives these messages on both forwarding and blocked ports.

Related articles

Read More...

Short Note on Etherchannel

by Shabeeribm
Etherchannel is a technology that lets you bundle multiple physical links into a single logical link.We know if we connect two switches via one cable there will not be any loop and no need of STP.But if we connect two or more cables between two switches there will be chance for loops.In normal case STP will run and prevent formation of loops.But the problem is we cant add redundancy between switches.

Etherchannel can bundle all physical links into a logical link with the combined bandwidth.For example if there are 4 fast Ethernet cables between switch A and Switch B,by combining 4x 100 Mbit I now have a 400 Mbit link. Spanning tree sees this link as one logical link so there are no loops!

Etherchannel will do load balancing among the different links that we have and it takes care of redundancy. Once one of the links fails it will keep working and use the links that we have left.we can use upto 8 physical interface in one bundle

We can configure Etherchannel using two protocols
•  PAgP(Cisco proprietary)
•  LACP (IEEE standard)

These protocols can dynamically configure an etherchannel. It’s also possible to configure a static etherchannel without these protocols doing the negotiation of the link for you. PAgp and LACP will check if the configuration of the interfaces that you use are the same.If you are going to create an etherchannel you need to make sure that all ports have the same configuration:

•  Duplex has to be the same.
•  Speed has to be  same.
•  Same native AND allowed VLANs.
•  Same switchport mode (access or trunk).

Related articles

Read More...

Gateway Redundancy Protocols (HSRP)

by Shabeeribm
Gateway Redundancy Protocols (HSRP)
Normally we use a single gateway to reach the Internet.But if something goes wrong in that gateway we will be completely isolated from internet.This lack of redundancy may be unacceptable on business-critical systems that require maximum up time. 

 To overcome this issue single point failure and provide redundancy Cisco devices support three protocols that provide redundancy: 
  • Hot Standby Router Protocol (HSRP) 
  • Virtual Router Redundancy Protocol (VRRP) 
  • Gateway Load Balancing Protocol (GLBP)
Hot Standby Router Protocol (HSRP)  
HSRP is a Cisco proprietary protocol that provides a virtual gateway which allowes to connect multiple routers or multilayer switches instead of single gateway. This is accomplished by assigning a virtual IP address to all routers participating in HSRP. All routers are assigned to a single HSRP group (numbered 0-255).

 HSRP routers are elected to specific roles:  
•  Active Router – the router currently serving as the gateway. 
•  Standby Router – the backup router to the Active Router. 
•  Listening Router – all other routers participating in HSRP. 

Only one Active and one Standby router are allowed per HSRP group. HSRP routers regularly send Hello packets (by default, every 3 seconds) to ensure all routers are functioning. If the current Active Router fails, the Standby Router is made active, and a new Standby is elected. 

The HSRP priority can range from 0 – 255.Default priority is 100. The router with the highest (a higher value is better) priority is elected the Active Router; the router with the second highest priority becomes the Standby Router. If all priorities are equal, whichever router has the highest IP Address on its HSRP interface is elected the Active Router. 

 HSRP States  
In HSRP election,router or multilayer switch will progress through several states before settling into a role,They are 

•  Disabled – the interfaces is not configured for HSRP, or is administratively shut down.  
•  Init – this is the starting state when an interface is first brought up.  
•  Learn – the router is waiting to hear hellos from the Active Router, to learn the configured Virtual Address.  
•  Listen – the router has learned the Virtual IP address, but was not elected the Active or Standby Router.  
•  Speak – the router is currently participating in an Active Router election, and is sending Hello packets.  
•  Standby – the router is acting as a backup to the Active Router. Standby routers monitor and send hellos to the Active Router.  
•  Active – the router is currently accepting and forwarding user traffic, using the Virtual IP address. The Active Router actively exchanges hellos with the Standby Router. 

By default, HSRP Hello packets are sent every 3 seconds. 

Routers in a listening state will only listen for and not periodically send hello packets. While the HSRP is fully converged, only the Active and Standby Routers will send hellos. Routers will also send out hellos when Speaking, or electing the Active and Standby routers. 

When electing the Active and Standby routers, the routers will enter a Speaking state. HSRP hellos are used to complete the election process.  

Thus, the three states which send out hello packets as follows: 
•  Speak 
•  Standby 
•  Active 

 HSRP Configuration :
Router#config t
Router(config)#Interface fa 0/0
Router(config-if)#Standby <group number> IP <virtual ip>
Router(config-if)#Standby <group number> priority <priority value>
Router(config-if)#Standby <group number>  preempt

 HSRP preempt command
Case 1
By default,When active router goes down,standby router will becomes active router.But when downed active router comes up,current active router(previous standby router) will not change to standby status.Using preempt command in both router will solve this problem.

 Case 2
if a new router is added to the HSRP group, and it has the best priority, it will not automatically assume the role of the Active router. In fact, the first router to be powered on will become the Active router, even if it has the lowest priority.To force the highest-priority router to assume the role of Active router we use "Standby <group number>  preempt" command which is used above.By using this command ,this switch to force itself as the Active router, if it has the highest priority.

 HSRP Timers
By default, Hello packets are sent every 3 seconds in HSRP.We can change it by following command 
Switch(config-if)#  standby 1 timers 4 12 
 The standby 1 timers command configures the two HSRP timers. The first setting 4 sets the Hello timer to 4 seconds. The second setting 12 sets the holddown timer to 12 seconds. 

 In general, the holddown timer should be three times the Hello timer (the default holddown time is 10 seconds). HSRP Hello packets are sent to the multicast address 224.0.0.2 over UDP port 1985. 

 HSRP Virtual MAC Address:
The HSRP group is also assigned a virtual MAC address. By default, a reserved MAC address is used:  
0000.0c07.acxx  
…where xx is the HSRP group number in hexadecimal. For example, if the HSRP Group number was 8, the resulting virtual MAC address would be:  
0000.0c07.ac08 

 HSRP Authentication:
Authentication can be configured for HSRP. All HSRP routers in the group must be configured with the same authentication string. 

 To specify a clear-text authentication string:  
Switch(config-if)#standby 1 authentication CISCO 

To specify an MD5-hashed authentication string:  
Switch(config-if)#standby 1 authentication md5 key-string 7 CISCO

 HSRP interface tracking:
Syntax:
Router(config)#Interface fa 0/1
Router(config-if)#standby <group number> track <interface name> <value to decrement>

 Note :
Track <interface name> - Here we want to provide the interface need to be tracked.
<Value of decrement> - How much priority has to be decreased.Range is from <1-255>.By default decreased priority is 10

 HSRP interface tracking is used to track other end of the router where HSRP is enabled.In normal case HSSP enabled router don't know whether other end is shut down or broken

 For example
In a working environment if something happen to the other end of active HSRP router,that router must change status to standby,else there wont be communication to the outside world.But by default this wont happpen and HSRP router send hello packet like normal without noticicng the other end.

 So to get rid of this we need to enable HSRP interface tracking.By enabling this we can tell HSRP active router to monitor other end of the interface.if other interface state goes down,HSRP active will decrease its own priority to some value we set (by default its 10).Usually less value will be than the priority of standby router.So something heppen to active HSRP router it will decrease priority and standby router will be active one.

 Show commands for HSRP
#Show standby
#show standby brief

 Lets look at a  example
Configuration
Switch1(config)#  int fa0/10 
Switch1(config-if)#  no switchport 
Switch1(config-if)#  ip address 192.168.1.5 255.255.255.0
Switch1(config-if)#  standby 1 priority 50 
Switch1(config-if)#  standby 1 preempt 
Switch1(config-if)#  standby 1 ip 192.168.1.1 
Switch1(config-if)#  standby 1 authentication CISCO 

Switch2(config)#  int fa0/10 
Switch2(config-if)#  no switchport 
Switch2(config-if)#  ip address 192.168.1.6 255.255.255.0 
Switch2(config-if)#  standby 1 priority 75 
Switch2(config-if)#  standby 1 preempt 
Switch2(config-if)#  standby 1 ip 192.168.1.1 
Switch2(config-if)#  standby 1 authentication CISCO 
Switch2(config-if)#  standby 1 track  fa0/12 50 

 Explanation :

  • The no switchport command specifies that interface fa0/10 is a Layer-3 (routed) port. 
  • Both switches are assigned a unique ip address to their local interfaces
  • Enabled HSRP by "standby" command in both routers. "1" is the HSRP group number(need to be same on both switches).we set priority 50 in switch one and priority 75 in switch2.As we know switch2 is in active mode.
  • Enabled preempt
  • Set virtual IP address.Both need to be same on each switch
  • Enabled authentication in both switch
  • Enabled tracking on switch2

Related articles

Read More...

Quick reminder about HSRP

by Shabeeribm
In this article we will discuss about brief about HSRP 
Quick reminder about HSRP
  • Hot Standby Router Protocol (HSRP) is a Cisco proprietary protocol.
  • With HSRP, two or more devices support a virtual router with a fictitious MAC address and unique IP address
  • Hosts use this IP address as their default gateway and the MAC address for the Layer 2 header
  • The virtual router’s MAC address is 0000.0c07.ACxx , in which xx is the HSRP group. Multiple groups (virtual routers) are allowed.
  • The Active router forwards traffic. The Standby router is backup and monitors periodic hellos (multicast to 224.0.0.2,
  • UDP port 1985) to detect a failure of the active router.
  • The active router is chosen because it has the highest HSRP priority (default priority is 100). In case of a tie, the router
  • with the highest configured IP address wins the election
  • A new router with a higher priority does not cause an election unless it is configured to preempt.

HSRP States
  • Initial: HSRP is not running.
  • Learn: The router does not know the virtual IP address and is waiting to hear from the active router.
  • Listen: The router knows the IP and MAC of the virtual router, but it is not the active or standby router.
  • Speak: Router sends periodic HSRP hellos and participates in the election of the active router.
  • Standby: Router monitors hellos from active router and assumes responsibility if active router fails.
  • Active: Router forwards packets on behalf of the virtual router.

Related articles

    Read More...

    EIGRP Stub

    by Shabeeribm

    EIGRP Stub

    In EIGRP topology,to prevent unnecessary querying, “spoke” routers in a “hub-and-spoke” environment can be configured as Stub routers. A stub router builds a neighbor adjacency with its hub router(s), and will inform neighbors of its stub status.

     

    The stub router will still build the full topology table and it will still receives all routes from its neighbors by default.Once EIGRP stub is configured on router,it will immediately respond to any Query packets with an “Inaccessible” message. Neighbors will eventually stop querying the stub router, which helps EIGRP converge quicker and conserves bandwidth. 

    .

    Syntax:

    Router(config)# router eigrp < as_no.>

    Router(config-router)# eigrp stub <receive-only / connected/ static/summary/ redistributed> 

    Example
    Router(config)#  router eigrp 100
    Router(config-router)#  eigrp stub connected

     

    EIGRP stub Command Options

    Receive-only : Prevents the router from advertising any networks 

    Connected : Enables the router to advertise connected routes.These must either be included in a network statement or redistributed into EIGRP

    Static : Enables the router to advertise static routes. They must be redistributed

    into EIGRP

    Summary : Enables the router to advertise summary routes, both those created

    manually and automatically.

    Redistributed: Allows the router to advertise routes redistributed into  EIGRP  from another protocol or AS

     

    The connected and static parameters will only advertise those networks if they have been injected into the EIGRP process, either using network statements or using route redistribution. By default, EIGRP stubs will only send connected and summary routes to neighbors.

     

    LAB :

    Read More...

    CCNP : Configuring VLAN ACLs

    by Shabeeribm
    VLAN ACL (VACL)
    We know ACL (Access list) is used to permit and deny traffic.By using VACL,we can control forwarding or denying of packets that are routed into or out of a VLAN or are bridged within a VLAN. VACLs are strictly for security packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by direction (ingress or egress).

    Terms used with VLAN ACLs

     Access MAP
    VACLs use access maps to contain an ordered list of one or more map entries. Each map entry associates a ACLs to an action. Each entry has a sequence number, which allows you to control the precedence of entries.

    Actions
    Each VLAN access map entry can specify one of the following actions:
    • Forward—Sends the traffic to the destination determined by normal operation of the switch.
    • Redirect—Redirects the traffic to one or more specified interfaces.
    • Drop—Drops the traffic. If you specify drop as the action, you can also specify that the device logs
    the dropped packets.
    In access map configuration mode, you use the action command to specify the action for a map entry

    Creating of VLAN ACL includes 3 steps

    1. Create Access-List
    2. Create Access MAP
    3. Apply on VLAN
    Configuring Access list
    1. Switch#conf terminal
    2. Switch(config)#ip access-list standard 10
    3. Switch(config-std-nacl)#permit 172.120.40.0 0.0.0.255
    4. Switch(config-std-nacl)#exit
    Create Access MAP
    1. Switch(config)#vlan access-map SYSNET 1 
    2. Switch(config-access-map)#match ip address 10
    3. Switch(config-access-map)#action forward
    4. Switch(config-access-map)#exit
    5. Switch(config)# vlan access-map SYSNET 2
    6. Switch(config-access-map)# action drop
    7. Switch(config-access-map)# exit
    Explanation  

    1. ”1″ is the line number 1 of the access-map named “SYSNET”
    2. ”10″ is the access-list number used to identify the ACL 
    3. This is the action that will be applied to the traffic matched on ACL “10″ .Here we need to allow traffic so we give "action forward
    4. Even there is a implicit deny at the end like normal ACL,here we giving "action drop" statement to deny other traffic

    Apply on VLAN
    Switch(config)#vlan filter SYSNET vlan-list 20Switch(config)#(config)#exit
    Applies the VLAN access-map named “SYSNET” to vlan 20.

    To remove VLAN ACL
    Switch(config)#no vlan access-map map-name [sequence-number]

    Related articles

    Read More...

    CCNP switching : AAAdot1x Lab with explanation

    by Shabeeribm
    In computer security,AAA stands for Authentication, Authorization and Accounting:

    •  Authentication: Verify the identity of the user, who are you? 
    •  Authorization: What is the user allowed to do? what resources can he/she access? 
    •  Accounting: Used for billing and auditing. 

    AAA is  used in a scenario where a user has to authenticate before getting access to the network. 
    Before authentication user wont even get an IP address. The only thing the user is allowed to do is send his/her credentials which will be forwarded to the AAA server. If user credentials are OK the port will be unblocked and user will be granted access to the network. 

     The IEEE 802.1X standard defines a client-server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports. The authentication server authenticates each client connected to a switch port before making available any services offered by the switch or the LAN. 

     Check out the below example


    Acme is a small shipping company that has an existing enterprise network comprised of 2 switches DSW1 and ASW1. The topology diagram indicates their layer 2 mapping. VLAN 40 is a new VLAN that will be used to provide the shipping personnel access to the server. 

     For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:
    - Users connecting to ASW1′s port must be authenticate before they are given access to the network.
    - Authentication is to be done via a Radius server:
    - Radius server host: 172.120.39.46
    - Radius key: rad123
    - Authentication should be implemented as close to the host device possible.
    - Devices on VLAN 20 are restricted to in the address range of 172.120.40.0/24.
    - Packets from devices in the address range of 172.120.40.0/24 should be passed on VLAN 20.
    - Packets from devices in any other address range should be dropped on VLAN 20.
    - Filtering should be implemented as close to the server farm as possible.

     The Radius server and application servers will be installed at a future date. You have been tasked with implementing the above access control as a pre-condition to installing the servers.
    You must use the available IOS switch features.

     Solution
    NOTE : Authentication should be Implemented as close to the host device as possible in this case “ASW1″. VLAN filtering should be Implemented as close to the server farm as possible in this case “DSW1″.

     This scenario in particular mentions that there is a new VLAN 40 added to the network, however, it does not tell you to configure anything using VLAN 40 so you can ignore it. 
    Only ports on VLAN 20 are required to be secured using dot1x authentication and the only port configured on VLAN 20 is fa0/1 (this is why ports Fa0/2 and Fa0/3 are not configured with authentication).

     Only  172.120.40.0/24 network should be passed on VLAN 20 and packets from devices in any other address range should be dropped on VLAN 20. This suggests that vlan 20 is the only vlan where you need to configure on access-map
    First we have to enable aaa authentication on ASW1
    1. ASW1(config)#aaa new-model 
    2. ASW1(config)#radius-server host 172.120.39.46 key rad123 
    3. ASW1(config)#aaa authentication dot1x default group radius 
    4. ASW1(config)#dot1x system-auth-control 
     Explanation
    1. This is an important command.it enable AAA on the switch globally
    2. We configure ASW1 with the IP address of RADIUS server given and given the radius key "rad123" as per requirement.
    3. This is how we configure ASW1 to use the RADIUS server for authentication for 802.1X enabled interfaces. You can create multiple groups with RADIUS servers if you want.here we have one RADIUS server which is in the default group. 
    4. We need to use the dot1x system-auth-control command globally before 802.1X works

    Configure Fa0/1 to use 802.1x:
    1. ASW1(config)#interface fastEthernet 0/1
    2. ASW1(config-if)#switchport mode access (Optional)
    3. ASW1(config-if)#switchport access vlan 20(Optional)
    4. ASW1(config-if)#dot1x port-control auto
    5. ASW1(config-If)#no shut
    6. ASW1(config-If)#exit
    On the interface level we need to use the "dot1x port-control auto" command.In auto mode no client connected to that port will be allowed to pass user traffic until the port has been authorized by the authorization server.

     NOTE :Verify configuration using "Show run" command and save the configuration using "copy run start"

     Configuring DSW1 Switch

     We need to configure VLAN ACL here.Creating of VLAN ACL includes 3 step
    1. Create Access-List
    2. Create Access MAP
    3. Applying to a VLAN
    Configuring Access list
    1. DSW1#conf terminal
    2. DSW1(config)#ip access-list standard 10
    3. DSW1(config-std-nacl)#permit 172.120.40.0 0.0.0.255
    4. DSW1(config-std-nacl)#exit
    Create Access MAP
    1. DSW1(config)#vlan access-map MYMAP 1 
    2. DSW1(config-access-map)#match ip address 10
    3. DSW1(config-access-map)#action forward
    4. DSW1(config-access-map)#exit
    5. DSW1(config)# vlan access-map MYMAP 2
    6. DSW1(config-access-map)# action drop
    7. DSW1(config-access-map)# exit
    Explanation 
    1. ”1″ is the line number 1 of the access-map named “MYMAP”
    2. ”10″ is the access-list number used to identify the ACL 
    3. This is the action that will be applied to the traffic matched on ACL “10″ .Here we need to allow traffic so we give "action forward"
    4. Even there is a implicit deny at the end like normal ACL,here we giving "action drop" statement to deny other traffic
    Apply on VLAN
    1. DSW1(config)#vlan filter MYMAP vlan-list 20
    2. DSW1(config)#exit
    NOTE : Applies the VLAN access-map named “MYMAP” to vlan 20 DSW1.Verify and save the configuration

    Related articles

    Read More...

    CCNP Notes : what is Cisco Nonstop Forwarding (NSF)

    by Shabeeribm
    Cisco Nonstop Forwarding (NSF)
    Cisco Nonstop Forwarding (NSF) is a redundancy protocol works with the Stateful Switchover (SSO) feature in Cisco IOS software. NSF works with SSO to minimize the amount of time a network is unavailable to its users following a switchover. The main objective of Cisco NSF is to continue forwarding IP packets following a Route Processor (RP) switchover.

    Usually, when a networking device restarts, all routing peers of that device detect that the device went down and then came back up. This transition results in what is called a routing flap, which could spread across multiple routing domains. Routing flaps caused by routing restarts create routing instabilities, which are detrimental to the overall network performance. Cisco NSF helps to suppress routing flaps in SSO-enabled devices, thus reducing network instability.

    Cisco NSF allows for the forwarding of data packets to continue along known routes while the routing protocol information is being restored following a switchover. With Cisco NSF, peer networking devices do not experience routing flaps.  After the routing has reconverged and a new RIB is built, the old CEF entries are removed.        

    Main Characteristics

    • Uses the FIB table
    • Maintains L3 continuity
    • Prevents route flapping

    Related articles

    Read More...

    CCNP Notes : What is Cisco Express Forwarding (CEF)

    by Shabeeribm
    Cisco Express Forwarding (CEF) 
    Cisco Express Forwarding (CEF) is a packet-switching technique that is the default for many of Cisco’s router.It provides the ability to switch packets through a device in a very quick efficient way while also keeping the load on the router’s processor low.CEF is made up of two different main components: the Forwarding Information Base (FIB) and the Adjacency Table. These are automatically updated at the same time as the routing table

     Forwarding Information Base (FIB)

     The FIB contains destination reachability information as well as next hop information. This information is then used by the router to make forwarding decisions. 

     Adjacency Table

     The FIB is combined along with an adjacency table. For a node to be considered adjacent it must be reachable within a single hop of the data link layer (e.g. ethernet hop). The adjacency table is tasked with maintaining the layer 2 next-hop information for the FIB.

     The adjacency table contains a number of different types of adjacency:

         Host route adjacency: A host route adjacency entry is used to specify that a specific host is within one layer two hop.

         Null adjacency: This is used for packets which are destined for the Null0 interface.

         Glean adjacency: A glean adjacency is used when a device is connected to multiple hosts off the same interface. In this case, the entry contains a prefix for the subnet not just for a specific host entry.

         Punt adjacency: This is used for those packets that utilize features not currently supported by CEF and which must be forwarding to the next switching level (often to be process switched).

         Discard adjacency: A discard adjacency entry is used for those packets that are to be automatically dropped.

         Drop adjacency: A drop adjacency entry is used for those packets which dropped but only after the prefix is checked.

     Source : http://www.petri.co.il

    Related articles

    Read More...

    CCNP Notes : what is syslog

    by Shabeeribm
    Netwok Monitoring with Syslog

    Syslog is a powerful network monitoring tool which helps administrators to manage complex networks.it aggrigate logs/events from multiple sources and helps administrator to monitor from a single location.The logging server software must simplify log management, and help admins filter and focus on messages that truly matter

     Syslog protocols are used to send logging/event messages to a separate network devices called syslog servers.

     Syslog messages usually include information to help identify basic information about where, when, and why the log was sent: ip address, timestamp, and the actual log message.Syslog messages are plain text sent using UDP port 514. 

     Every syslog message contains two parts, a severity level and a facility.  The severity level goes from 0 to 7 with 0 being the most severe to 7 being simply informational.Facilities are service identifiers that categorize events and messages for easier reporting
    Syslog Priority (highest to lowest):
    0
      Emergency (highest)
     system is ususable
    1
      Alert
     action must be taken immediately
    2
      Critical
     critical conditions
    3
      Error
     error conditions
    4
      Warning
     warning conditions
    5
      Notice
     Normal but significant conditions
    6
      Informational
    Informational messages
    7
      Debug (lowest)
     debug level messages
    The most common facilities related errors are
    • IP
    • OSPF
    • SYS (operating system related)
    • Route Switch Processor (RSP)
    • Interface (IF)

    Related articles

    Read More...