Cisco CCNA CCNP GNS3 LAB

sdm part 3 search help

2011-05-21T02:00:00.000-07:00

This is the last SDM interface(pages) explaining post because after this post you don't need anyone to explain to you what this interface do anymore cisco offer to you a great help system
let's start with Search SDM features :
this interface explain itself
enter any feature in cisco sdm dhcp ,dns, vpn ,....
in this example I entered interface and click search this is the result
show you any related to interface features in cisco sdm and how you can reach it in a simple and easy way just click it
this is the result after clicking the Search SDM feature
now lets move to the biggest and the most important part SDM help:
this is the Cisco SDM Help cisco document every tiny bit in their Help to provide you a complete help system

in any interface you don't understand it you need any more help or explain to you what this interface do just help help
in this example i click help at security audit
at the left side of cisco help system window you can arrange index (from A to Z ) or related contents
this is the index look like
this is the contents look like
if you want search for any specific thing just click search
click Using Help to get the most form cisco help system

This is cisco glossary cisco explain every acronym they use in this glossary
need more help at bottom for each ( interface or Page ) you found How do I ?
just click select the related question you need and click go

now you are familiar with CISCO SDM and interfaces (pages)
CISCO SDM is a best piratical way if you want learn how to do things in CLI

SDM part 2 menu

2011-05-17T03:19:00.000-07:00

File Menu
save Ruining config to pc: save the current running config to file
write to start up config
write the configuration to start up config
Edit Menu
Preferences
click it and this window will pop up

Preview commands before delivering to router
Choose this option if you want Cisco SDM to display a list of the Cisco IOS configuration commands generated before the commands are sent to the router.
Save signature file to Flash
Choose this option if you want the signature definition file (SDF) that you are working on to be saved to router flash when you click Apply Changes.
Confirm before exiting Cisco SDM
This is Cisco SDM default behavior. Select this option if you would like Cisco SDM to display a dialog box asking for confirmation when you exit Cisco SDM.
Continue monitoring interface status when switching mode/task
This is Cisco SDM default behavior. Cisco SDM begins monitoring interface status when you click Monitor and select Interface status. To have Cisco SDM continue monitoring the interface even if you leave Monitor mode and perform other tasks in Cisco SDM, select this check box and specify the maximum number of interfaces you want Cisco SDM to monitor. The default maximum number of interfaces to monitor is 4.

View Menu:

Home: open Home interface
Configure : open Configure interface
Monitor: open Monitor interface

Running conifg
show you the running configuration
show commands:
click any show command and click show
click save to file button if you want save the show output
SDM default rule
refresh :
reload the SDM
search:
open the search interface
we will explain this interface later
ping
ping any ip address
telnet:
telnet to the router
security audit
open security audit
configuration management :
open configuration management interface

update SDM sub menu
Update from cisco.com if you have cco account
update from local PC
update from CD
Help Topics:
open help window
SDM on CCO
prompt you an interface that ask you to enter your cisco cco username and password
update in this release:
open web window that show you what's new in this release
about this router
prompt you this interface

this is the software details:
hardware software matrix
open cisco web site to get more details

about SDM:

Cisco Secure Access Control Server (ACS)

2011-05-16T06:43:00.000-07:00

Cisco Secure Access Control Server (ACS) is an access policy control platform that helps you comply with growing regulatory and corporate requirements. By integrating with your other access control systems, it helps improve productivity and contain costs. It supports multiple scenarios simultaneously, including:

Device administration: Authenticates administrators, authorizes commands, and provides an audit trail
Remote Access: Works with VPN and other remote network access devices to enforce access policies
Wireless: Authenticates and authorizes wireless users and hosts and enforces wireless-specific policies
Network admission control: Communicates with posture and audit servers to enforce admission control policiec

first the installation

now configure the ACS server
configue a client that will be our Router

give the router IP address and the shared secret cisco we will configure that in our server with the shared secret cisco too

create a user name:

give a password and select the user group
now configuring the user group :
scroll down to tacacs server part and enable shell for exec mode and the privilege

now we finish configuration with ACS server : just simple configuration for login ACS has a lot configuration (^_*)
we move to configure our router to authenticate users using our ACS server
1: enable the aaa with the command aaa new-model
2:create a method that tells the router we need to authenticate our users using tacacs+ server if you don't find tacacs+ server use our local user database
aaa authentication login mylogin group tacacs+ local
3:now we give the router the tacacs server ip address
and configure the shared key
tacacs-server host 10.0.0.50
tacacs-server key cisco

so now we done but we don't enable the mylogin method yet
we will put our method mylogin under the telnet interface to authenticate users using telent to configure our router
line vty 0 4
login authentication mylogin

congratulation we finish configuring our server to authenticate users come by telent to use ACS tacacs server
now time to test ?!
1- you can use telnet 10.0.0.1 to comunicate with our server
i'm using tera term :

enter the user name and password :
dadaaaaaaaaa

GNS3CISCO Help you pass your CCNA CCNP EXAM

2011-05-14T11:11:00.000-07:00

GNS3CISCO.BLOGSPOT.COM
FACEBOOK.COM/GNS3CISCO
http://twitter.com/#!/gns3cisco

GNS3 kiwi syslog

2011-05-12T06:52:00.000-07:00

logging : using kiwi syslog
Step by Step
first installing kiwi syslog
1: as a service start automatically with no user required
2: you have to log in to windows and run the program
this is if you have an active directory and you are using the active directory users
use the first option if you want to use the local system account
the second option if you want use active directory user : remember you have to use an admin with local administration rights

now after the installation complete successfully we have to check our syslog server IP address
at the command line run ipconfig /all
OK now we have to configure the router to send the logging to this ip address
logging that is all you have to type
after we type end the router will send the logging to the syslog server

GNS3 frame-relay poin-to-point full meshd

2011-05-10T18:19:00.000-07:00

the configuration

R1(config)#interface serial 1/0
R1(config-if)#encapsulation frame-relay
R1(config-if)# no shutdown
R1(config)#interface serial 1/0.102 point-to-point
R1(config-subif)#ip address 192.168.1.1 255.255.255.0
R1(config-subif)#frame-relay interface-dlci 102

R1(config)#interface serial 1/0.103 point-to-point
R1(config-subif)#ip address 192.168.3.2 255.255.255.0
R1(config-subif)#frame-relay interface-dlci 103

R1(config)#interface serial 1/0.104 point-to-point
R1(config-subif)#ip address 192.168.4.2 255.255.255.0
R1(config-subif)#frame-relay interface-dlci 104

R1(config)#router eigrp 10
R1(config-router)#network 192.168.1.0 0.0.0.255
R1(config-router)#network 192.168.3.0 0.0.0.255
R1(config-router)#network 192.168.4.0 0.0.0.255

R2(config)#interface serial 1/0
R2(config-if)#encapsulation frame-relay
R2(config-if)# no shutdown
R2(config)#interface serial 1/0.201 point-to-point
R2(config-subif)#ip address 192.168.1.2 255.255.255.0
R2(config-subif)#frame-relay interface-dlci 201

R2(config)#interface serial 1/0.203 point-to-point
R2(config-subif)#ip address 192.168.2.1 255.255.255.0
R2(config-subif)#frame-relay interface-dlci 203

R2(config)#interface serial 1/0.204 point-to-point
R2(config-subif)#ip address 192.168.6.2 255.255.255.0
R2(config-subif)#frame-relay interface-dlci 204

R2(config)#router eigrp 10
R2(config-router)#network 192.168.1.0 0.0.0.255
R2(config-router)#network 192.168.2.0 0.0.0.255
R2(config-router)#network 192.168.6.0 0.0.0.255

R3(config)#interface serial 1/0
R3(config-if)#encapsulation frame-relay
R3(config-if)# no shutdown
R3(config)#interface serial 1/0.301 point-to-point
R3(config-subif)#ip address 192.168.3.1 255.255.255.0
R3(config-subif)#frame-relay interface-dlci 301

R3(config)#interface serial 1/0.302 point-to-point
R3(config-subif)#ip address 192.168.2.2 255.255.255.0
R3(config-subif)#frame-relay interface-dlci 302

R3(config)#interface serial 1/0.304 point-to-point
R3(config-subif)#ip address 192.168.5.2 255.255.255.0
R3(config-subif)#frame-relay interface-dlci 304

R3(config)#router eigrp 10
R3(config-router)#network 192.168.2.0 0.0.0.255
R3(config-router)#network 192.168.3.0 0.0.0.255
R3(config-router)#network 192.168.5.0 0.0.0.255

R4(config)#interface serial 1/0
R4(config-if)#encapsulation frame-relay
R4(config-if)# no shutdown
R4(config)#interface serial 1/0.401 point-to-point
R4(config-subif)#ip address 192.168.4.1 255.255.255.0
R4(config-subif)#frame-relay interface-dlci 401

R4(config)#interface serial 1/0.402 point-to-point
R4(config-subif)#ip address 192.168.6.1 255.255.255.0
R4(config-subif)#frame-relay interface-dlci 402

R4(config)#interface serial 1/0.403 point-to-point
R4(config-subif)#ip address 192.168.5.1 255.255.255.0
R4(config-subif)#frame-relay interface-dlci 403

R4(config)#router eigrp 10
R4(config-router)#network 192.168.4.0 0.0.0.255
R4(config-router)#network 192.168.6.0 0.0.0.255
R4(config-router)#network 192.168.5.0 0.0.0.255

download this topology

GNS3 frame-relay poin-to-point

2011-05-10T18:09:00.000-07:00

the configuration

R1(config)#interface serial 1/0
R1(config-if)#encapsulation frame-relay
R1(config-if)# no shutdown
R1(config)#interface serial 1/0.102 point-to-point
R1(config-subif)#ip address 192.168.1.1 255.255.255.0
R1(config-subif)#frame-relay interface-dlci 102

R1(config)#interface serial 1/0.103 point-to-point
R1(config-subif)#ip address 192.168.3.2 255.255.255.0
R1(config-subif)#frame-relay interface-dlci 103

R1(config)#interface serial 1/0.104 point-to-point
R1(config-subif)#ip address 192.168.4.2 255.255.255.0
R1(config-subif)#frame-relay interface-dlci 104

R1(config)#router eigrp 10
R1(config-router)#network 192.168.1.0 0.0.0.255
R1(config-router)#network 192.168.3.0 0.0.0.255
R1(config-router)#network 192.168.4.0 0.0.0.255

R2(config)#interface serial 1/0
R2(config-if)#encapsulation frame-relay
R2(config-if)# no shutdown
R2(config)#interface serial 1/0.201 point-to-point
R2(config-subif)#ip address 192.168.1.2 255.255.255.0
R2(config-subif)#frame-relay interface-dlci 201

R2(config)#router eigrp 10
R2(config-router)#network 192.168.1.0 0.0.0.255

R3(config)#interface serial 1/0
R3(config-if)#encapsulation frame-relay
R3(config-if)# no shutdown
R3(config)#interface serial 1/0.301 point-to-point
R3(config-subif)#ip address 192.168.3.1 255.255.255.0
R3(config-subif)#frame-relay interface-dlci 301

R3(config)#router eigrp 10
R3(config-router)#network 192.168.3.0 0.0.0.255

R4(config)#interface serial 1/0
R4(config-if)#encapsulation frame-relay
R4(config-if)# no shutdown
R4(config)#interface serial 1/0.401 point-to-point
R4(config-subif)#ip address 192.168.4.1 255.255.255.0
R4(config-subif)#frame-relay interface-dlci 401

R4(config)#router eigrp 10
R4(config-router)#network 192.168.4.0 0.0.0.255

download this topology

GNS3 frame-relay multipoint

2011-05-10T17:42:00.000-07:00

Frame-relay mapping
they all connected or mapped to Router 1 because we using hope-and-spoke topology

this is the configuration

R1(config)#interface serial 1/0
R1(config-if)#encapsulation frame-relay
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#frame-relay map ip 192.168.10.2 102 broadcast
R1(config-if)#frame-relay map ip 192.168.10.3 103 broadcast
R1(config-if)#frame-relay map ip 192.168.10.4 104 broadcast
R1(config-if)# no shutdown

R2(config)#interface serial 1/0
R2(config-if)#encapsulation frame-relay
R2(config-if)#ip address 192.168.10.2 255.255.255.0
R2(config-if)#frame-relay map ip 192.168.10.1 201 broadcast
R2(config-if)#frame-relay map ip 192.168.10.3 201 broadcast
R2(config-if)#frame-relay map ip 192.168.10.4 201 broadcast
R2(config-if)# no shutdown

R3(config)#interface serial 1/0
R3(config-if)#encapsulation frame-relay
R3(config-if)#ip address 192.168.10.3 255.255.255.0
R3(config-if)#frame-relay map ip 192.168.10.1 301 broadcast
R3(config-if)#frame-relay map ip 192.168.10.2 301 broadcast
R3(config-if)#frame-relay map ip 192.168.10.4 301 broadcast
R3(config-if)# no shutdown

R4(config)#interface serial 1/0
R4(config-if)#encapsulation frame-relay
R4(config-if)#ip address 192.168.10.4 255.255.255.0
R4(config-if)#frame-relay map ip 192.168.10.1 401 broadcast
R4(config-if)#frame-relay map ip 192.168.10.2 401 broadcast
R4(config-if)#frame-relay map ip 192.168.10.3 401 broadcast
R4(config-if)# no

download this topology

GNS3 VLAN VTP

2011-05-10T06:31:00.000-07:00

the configuration
#SW0

interface FastEthernet1/0
switchport mode trunk
interface FastEthernet1/1
switchport mode trunk
interface FastEthernet1/2
switchport mode trunk
interface FastEthernet1/15
switchport mode trunk

interface range fastethernet 1/0 - 2
switchport mode trunk

at the exec-mode #

vlan database
vtp domain gns3cisco
vlan 10 name accounting
vlan 20 name markting
vlan 30 name operations
vlan 100 name administration
apply

#sw1

interface FastEthernet1/0
switchport mode trunk

vlan database
vtp client

interface range fastethernet 1/10 - 12
switchport mode access
switchport access vlan 100

#sw2

interface FastEthernet1/0
switchport mode trunk

vlan database
vtp client

interface FastEthernet1/10
switchport mode access
switchport access vlan 10
interface FastEthernet1/11
switchport mode access
switchport access vlan 20
interface FastEthernet1/12
switchport mode access
switchport access vlan 30

#sw3

interface FastEthernet1/0
switchport mode trunk

vlan database
vtp client

interface FastEthernet1/10
switchport mode access
switchport access vlan 10
interface FastEthernet1/11
switchport mode access
switchport access vlan 20
interface FastEthernet1/12
switchport mode access
switchport access vlan 30

router 1

R1(config)#interface fastEthernet 0/0
R1(config-if)#no shut
R1(config-if)#interface fastEthernet 0/0.10
R1(config-subif)#encapsulation dot1Q 10
R1(config-subif)#ip address 192.168.10.1 255.255.255.0
R1(config-subif)#no shut

R1(config-if)#interface fastEthernet 0/0.20
R1(config-subif)#encapsulation dot1Q 20
R1(config-subif)#ip address 192.168.20.1 255.255.255.0
R1(config-subif)#no shut

R1(config-if)#interface fastEthernet 0/0.30
R1(config-subif)#encapsulation dot1Q 30
R1(config-subif)#ip address 192.168.30.1 255.255.255.0
R1(config-subif)#no shut

R1(config-if)#interface fastEthernet 0/0.100
R1(config-subif)#encapsulation dot1Q 100
R1(config-subif)#ip address 192.168.100.1 255.255.255.0
R1(config-subif)#no shut

download this topology copy VPcs file : vlansto to the VPCs directory and load it
download VPCs

GNS3 PPP authentication CHAP

2011-05-09T12:10:00.000-07:00

Handshake Authentication Protocol:

router 1 configuration

R1(config)#username R2 password cisco
R1(config)#interface Serial1/0
R1(config-if)#ip address 192.168.6.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#encapsulation ppp
R1(config-if)#ppp authentication chap

router 1 configuration

R2(config)#username R1 password cisco
R2(config)#interface Serial1/0
R2(config-if)#ip address 192.168.6.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication chap

this is the topology if you want to download it

GNS3 PPP authentication PAP

2011-05-09T11:56:00.000-07:00

Password Authentication Protocol :
This is the configuration for both routers

router 1 configuration

R1(config)#username R2 password cisco
R1(config)#interface Serial1/0
R1(config-if)#ip address 192.168.6.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#encapsulation ppp
R1(config-if)#ppp authentication pap
R1(config-if)#ppp pap sent-username R1 password 0 cisco

router 2 configuration

R2(config)#username R1 password cisco
R2(config)#interface Serial1/0
R2(config-if)#ip address 192.168.6.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication pap
R2(config-if)#ppp pap sent-username R2 password 0 cisco

this is the topology if you want to download it

GNS3 PPP protocol

2011-05-09T11:48:00.000-07:00

Point to Point protocol
PPP frames are encapsulated in a lower-layer protocol that provides framing and may provide other functions such as a checksum to detect transmission errors. PPP on serial links is usually encapsulated in a framing similar to HDLC,
why do I use PPP encapsulation
If you want to operate with non-Cisco routers

PPP supports authentication protocols: Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP).

router 1 configuration

R1(config)interface Serial1/0
R1(config-if)ip address 192.168.6.1 255.255.255.0
R1(config-if)no shutdown
R1(config-if)encapsulation ppp

router 2 configuration

R2(config)interface Serial1/0
R2(config-if)ip address 192.168.6.2 255.255.255.0
R2(config-if)no shutdown
R2(config-if)encapsulation

download the topology

SDM part 1 Home

2011-05-06T13:57:00.000-07:00

this is the first interface it's just show information about your Device
as the number on the above image we will try to explain it little bit because SDM not that match easy to explain in one post because you can do a lot of things and you can learn a lot of cisco IOS command
first
1: the menu part we will explain that in another post because it's not part of home
2: the navigator bar
Home : this post
configure
Monitor
search
Help
refresh : refresh the SDM ( cisco security device manager )
save : execute the command copy runing-config startup-config

3: just show the device hostname

4: the device icon type
5: hardware
more information about the device the memory model type flash capacity

6: software
The IOS version and the SDM version

7: feature available in the device

8: interfaces that you have on this devices DHCP server WAN connections

9: firewall
if you enable the firewall in this device you can see a little information here

10: VPN wawww it's the best and beauty of using SDM you can easily manage your VPN
here you can see information about VPN

here you found information about routing protocols the enable in this device and static route

this is just part one

Abdulrahman Obaid

Cisco IOS access lists: 10 things you should know

2011-05-06T07:57:00.000-07:00

If you work with Cisco routers, you're more than likelyfamiliar with Cisco IOS access control lists (ACLs). But that doesn't mean youknow all there is to know about these important gatekeepers. Access lists arean integral part of working with routers, and they're vital to security.

Because ACLs are a fundamental part of router administration,I want to address 10 things you should know about working with these lists. Ifyou're new to working with Cisco routers, this list offers a good foundation toget you started. But even if you've worked with Cisco routers for a while, itnever hurts to review the basics—you might even learn something new.

So, without any further ado, here are 10 things you need toknow about Cisco IOS access lists, beginning with the basic definition of anACL.

What is an access control list?

In the Cisco IOS, an access control list is a record thatidentifies and manages traffic. After identifying that traffic, an administratorcan specify various events that can happen to that traffic.

What's the most common type of ACL?

IP ACLs are the most popular type of access lists because IPis the most common type of traffic. There are two types of IP ACLs: standardand extended. Standard IP ACLs can only control traffic based on the SOURCE IPaddress. Extended IP ACLs are far more powerful; they can identify trafficbased on source IP, source port, destination IP, and destination port.

What are the most common numbers for IP ACLs?

The most common numbers used for IP ACLs are 1 to 99 forstandard lists and 100 to 199 for extended lists. However, many other rangesare also possible.

Standard IP ACLs: 1 to 99 and 1300 to 1999
Extended IP ACLs: 100 to 199 and 2000 to 2699

How can you filter traffic using ACLs?

You can use ACLs to filter traffic according to the "threeP's"—per protocol, per interface, and per direction. You can only have oneACL per protocol (e.g., IP or IPX), one ACL per interface (e.g.,FastEthernet0/0), and one ACL per direction (i.e., IN or OUT).

How can an ACL help protect
my network from viruses?

You can use an ACL as a packet sniffer to list packets thatmeet a certain requirement. For example, if there's a virus on your networkthat's sending out traffic over IRC port 194, you could create an extended ACL(such as number 101) to identify that traffic. You could then use the debug ip packet 101 detail command onyour Internet-facing router to list all of the source IP addresses that aresending packets on port 194.

What's the order of operations in an ACL?

Routers process ACLs from top to bottom. When the routerevaluates traffic against the list, it starts at the beginning of the list andmoves down, either permitting or denying traffic as it goes. When it has workedits way through the list, the processing stops.

That means whichever rule comes first takes precedence. Ifthe first part of the ACL denies traffic, but a lower part of the ACL allowsit, the router will still deny the traffic. Let's look at an example:

Access-list 1 permit anyAccess-list 1 deny host 10.1.1.1Access-list 1 deny any

What does this ACL permit? The first line permits anything.Therefore, all traffic meets this requirement, so the router will permit alltraffic, and processing will then stop.

What about traffic you don't specifically address in an ACL?

At the end of an ACL is an implicit deny statement. Whether you see the statement or not, the routerdenies all traffic that doesn't meet a condition in the ACL. Here's an example:

Access-list 1 deny host 10.1.1.1Access-list 1 deny 192.168.1.0 0.0.0.255

What traffic does this ACL permit? None: The router denies alltraffic because of the implicit deny statement.In other words, the ACL really looks like this:

Access-list 1 deny host 10.1.1.1Access-list 1 deny 192.168.1.0 0.0.0.255Access-list 1 deny ANY

Can I name an ACL?

Numbers—who needs numbers? You can also name your ACLs soyou can more easily identify their purpose. You can name both standard andextended ACLs. Here's an example of using a named ACL:

router(config)# ip access-list ?  extended        Extended Access List  log-update      Control access list log updates  logging         Control access list logging  resequence      Resequence Access List  standard        Standard Access Listrouter(config)# ip access-list extended test router(config-ext-nacl)#router(config-ext-nacl)# 10 deny ip any host 192.168.1.1router(config-ext-nacl)# exitrouter(config)# exitrouter# show ip access-listExtended IP access list test
    10 deny ip any host 192.168.1.1

What's a numbering sequence?

In the "old days," you couldn't edit an ACL—youcould only copy it to a text editor (such as Notepad), remove it, edit it innotepad, and then re-create it. In fact, this is still a good way to edit someCisco configurations.

However, this approach can also create a security risk.During the time you've removed the ACL to modify it, the router isn'tcontrolling traffic as needed. But it's possible to edit a numbered ACL withcommands. Here's an example:

router(config)# access-list 75 permit host 10.1.1.1router(config)#^Zrouter# conf tEnter configuration commands, one per line.  End with CNTL/Z.
router(config)# ip access-list standard 75
router(config-std-nacl)# 20 permit any router(config-std-nacl)# no 10 permit 10.1.1.1router(config-std-nacl)#^Z
router# show ip access-lists 75Standard IP access list 75
    20 permit anyrouter#

How else can I use an ACL?

ACLs aren't just for filtering traffic. You can also usethem for a variety of operations. Let's look at some of their possible otheruses:

To control debug output: You can use the debug list X command to control debug output. By using this command before another debug command, the command only applies to what you've defined in the list.
To control route access: You can use a routing distribute-list ACL to only permit or deny certain routes either into or out of your routing protocol.
As a BGP AS-path ACL: You can use regular expressions to permit or deny BGP routes.
For router management: You can use an ACL to control which workstation or network manages your router with an ACL and an access-class statement to your VTY lines.
For encryption: You can use ACLs to determine how to encrypt traffic. When encrypting traffic between two routers or a router and a firewall, you must tell the router what traffic to encrypt, what traffic to send unencrypted, and what traffic to drop.

To wrap up this review, I'll leave you with one last tip: Don'tforget to use remark statements inyour ACLs. They'll come in handy when you have to troubleshoot something later.

Want to learn moreabout router and switch management? Automaticallysign up for our free Cisco Routers and Switches newsletter, delivered eachFriday!

David Davis has workedin the IT industry for 12 years and holds several certifications, includingCCIE, MCSE+I, CISSP, CCNA, CCDA, and CCNP. He currently manages a group ofsystems/network administrators for a privately owned retail company andperforms networking/systems consulting on a part-time basis.

GNS3 EIRGP Metrics

2011-05-06T06:42:00.000-07:00

is this topology 4 routers connected together
to show you how EIRGP chose the best way depending on the bandwidth and delay
the fastethernet interface in R1 it's bandwidth 12 and delay 3000
and try to find who will become the successor when try to reach the network 192.168.40.0
it's count 1 hop from R1 but the router chose long why because
1 faster
2 the bandwidth is bigger
i hop you will understand

Abdulrahman Obaid

download this topology

Scaling IP Addresses with NAT (Network Address Translation) and PAT (Port Address Translation)

2011-05-05T07:55:00.000-07:00

By Stelios Antoniou
September 13, 2007

A decade ago not too many people thought of having more than one PC at home. But today, having two or more personal computers is almost a necessity for many people. Back then, there was also only a small portion of home computer users subscribing to ADSL or Internet over cable. Currently, more and more people are subscribing to these broadband services.

The IP addressing scheme was not implemented with the extreme growth of the internet and the services related to it in mind. At the beginning, the problem of running out of IP addresses was just a theoretical one that could possibly happen in the far away future. But the future is here! The problem is not theoretical anymore — it is occurring this very moment. More and more users started to require permanent public IP addresses, adding to the problem, and a fast solution was needed.

This solution came with NAT: Network Address Translation and PAT: Port Address Translation. However, NAT does not provide a long-term solution. A more reliable and efficient solution has to do with a completely new addressing scheme called IPv6 which uses 128 bit addresses instead of the 32 used in IPV4.

NAT and PAT

The concept of NAT is based on the fact that every computer sending traffic outside its LAN to the Internet must be assigned a routable IP address. To conserve IP addresses, LAN users make use of a range of private IP addresses for routing local traffic. When a company, for example needs to send traffic to the Internet, via the ISP of course, an address translation takes place. Therefore the range of private IP addresses used by the company is translated to a single (or a small number) IP address.

The ranges of private IP addresses that can be used in the Local network and cannot be routed to the Internet include:

10.0.0.0 – 10.255.255.255/8
172.16.0.0 – 172.31.255.255/12
192.168.0.0 – 192.168.255.255/16

These IP addresses, in NAT terminology, are called “inside networks”. In other words, traffic originated from these networks and is destined for any other network outside private scope needs to be translated to a routable network, known as “outside network”.

Here are the NAT terms defined by Cisco:

Inside local address: Is simply the private IP address assigned to the computer on the inside network.

Inside global address: Is the IP address that is provided as a result of the translation process on the router and it represents the inside local or the range of inside local addresses.

Outside local address: While packets traverse through the Internet to their final destination, they may encounter another translation. The IP address prior to the translation is called outside local since it belongs to an outside network and it’s the one known locally to the inside network.

Outside global address: Is the IP address assigned to a host on the outside network by the host owner as a result of translation and comes from a globally routable address range.

NAT comes in three flavors:

Static NAT: Provides one-to-one mapping between local and global addresses, consequently, every computer on the network must be allocated a single dedicated routable IP address.

Dynamic NAT: A pool of routable IP addresses is configured on the router and dynamically the router assigns addresses from this pool to every machine that requires sending traffic to the “outside world”. This type of NAT needs good planning from the beginning so that the pool of IP addresses is enough to cover the traffic needs of the peak hour traffic to the Internet.

PAT: Port address translation is another variation of NAT and the most popular one. It is also called NAT Overloading because it is designed to map many private IP addresses to just a single registered IP address (overloaded address) by applying different port addresses in the TCP or UDP header.

Inside Local Source Address Translation

Figure 1: NAT Example

The diagram above shows a router translating an inside source IP address to a source IP address for the outside network. Translation process follows these steps:

User at host 10.0.0.3 begins to send traffic to the router, destined for host at 212.31.80.2.
Upon receiving the first packet, the router checks its NAT table.
1. If dynamic NAT is configured, the router picks up a free global address from its dynamic address pool (in the above example 179.2.2.80) and creates a translation entry into its NAT table.
2. If static NAT is configured, the router automatically translates the inside local address: 10.0.0.3 with its equivalent global IP address: 179.2.2.80, and forwards the packet.
User at 212.31.80.2 replies to host 10.0.0.3 using the inside global destination address 179.2.2.80 (Destination address=179.2.2.80).
When the router receives the replied packet, it checks its NAT table again to find an entry for the inside global address 179.2.2.80. If a match is found, then the router translates the address back to its respective local address 10.0.0.3 and forwards it to the user.
The router continues to perform all the above steps for each packet it receives.

Static NAT Configuration

To configure static inside source address translation for the example shown in Figure 1, the following need to be performed on the router:

Specify the inside interface:
- Router(config)#interface ethernet0
- Router(config-if)# ip nat inside
Specify the outside interface:
- Router(config)#interface serial0
- Router(config-if)# ip nat outside
Enter static translation entry ¹:
- Router(config)# ip nat inside source static 10.0.0.3 179.2.2.80

Dynamic NAT Configuration

To configure dynamic inside source address translation for the example shown in figure 1, the following need to be performed:

Specify the inside interface:
- Router(config)#interface ethernet0
- Router(config-if)# ip nat inside
Specify the outside interface:
- Router(config)#interface serial0
- Router(config-if)# ip nat outside
Define an Access List to permit the inside local addresses to be translated ²:
- Router(config)#access-list 1 permit 10.0.0.0 0.0.0.255
Define a pool of global addresses ³:
- Router(config)# ip nat pool figure1 179.2.2.65 179.2.2.90 netmask 255.255.255.224
Enter dynamic translation entry ⁴:
- Router(config)# ip nat inside source list 1 pool figure1

Inside Global Address Overloading

Figure 2: NAT Overloading

From the above image, it can be seen that NAT overloading conserves register inside global IP addresses on the router. Inside local IP addresses are translated to a common global IP address and are distinguished between them by the use of different port numbers. Outside hosts do not see this translation; they believe they are talking to the same host with IP address 179.2.2.80, though they are actually talking to two different hosts.

NAT Overloading Configuration

To configure NAT Overloading for the example shown in figure 2, the following need to be performed:

Specify the inside interface:
- Router(config)#interface ethernet0
- Router(config-if)# ip nat inside
Specify the outside interface:
- Router(config)#interface serial0
- Router(config-if)# ip nat outside
Define an Access List to permit the inside local addresses to be translated:
- Router(config)#access-list 1 permit 10.0.0.0 0.0.0.255
Enter dynamic translation entry ⁵:
- Router(config)# ip nat inside source list 1 interface serial0 overload

Conclusion

NAT’s contribution to the reliability and existence of the Network society as known today has turned out to be extremely valuable. Although it does not provide a stable long-term solution it offers a lot of benefits. Conservation of IP addresses is the primary benefit of NAT through NAT Overloading. Theoretically up to 65000 hosts can be served by a single global IP address by using PAT. Security is another important benefit of NAT. Private networks hide their real identity therefore remain secure without revealing their network topology to the outside world.

Something important to keep in mind is that Cisco’s NAT implementation tries to preserve the original source port all the way through the translation. In the real world, NAT implementation assigns source port numbers dynamically and it’s up to the user’s instructions to allocate specific source port numbers.

¹ Router(config)# ip nat inside source static [local IP address] [global IP address]
² Router(config)# access-list [access list number] permit [source address] [source address wildcard]
³ Router(config)# ip nat pool [pool name] [start IP address] [end IP address] netmask [netmask]
⁴ Router(config)# ip nat inside source list [access list number] pool [pool name]
⁵ Router(config)# ip nat inside source list [access list number] interface [interface] overload

IPv6 Address Types from technet

2011-05-05T07:48:00.001-07:00

IPv6 Address Types

IPv6 has three types of addresses, which can be categorized by type and scope:

Unicast addresses. A packet is delivered to one interface.
Multicast addresses. A packet is delivered to multiple interfaces.
Anycast addresses. A packet is delivered to the nearest of multiple interfaces (in terms of routing distance).

IPv6 does not use broadcast messages.

Unicast and anycast addresses in IPv6 have the following scopes (for multicast addresses, the scope is built into the address structure):

Link-local. The scope is the local link (nodes on the same subnet).
Site-local. The scope is the organization (private site addressing).
Global. The scope is global (IPv6 Internet addresses).

In addition, IPv6 has special addresses such as the loopback address. The scope of a special address depends on the type of special address.

Much of the IPv6 address space is unassigned.

Unicast IPv6 Addresses

IPv6 has several major unicast address types.

Unicast global addresses

IPv6 unicast global addresses are similar to IPv4 public addresses. Also known as aggregatable global unicast addresses, global addresses are globally routable. The structure of an IPv6 unicast global address creates the three-level topology shown in the following illustration.

Table 1.7 explains each field in a unicast global address.

Table 1.7 Fields in a Unicast Global Address

Field	Description
001	Identifies the address as an IPv6 unicast global address.
Top Level Aggregation Identifier (TLA ID)	Identifies the highest level in the routing hierarchy. TLA IDs are administered by IANA, which allocates them to local Internet registries, which then allocate a given TLA ID to a global ISP.
Res	Reserved for future use (to expand either the TLA ID or the NLA ID).
Next Level Aggregation Identifier (NLA ID)	Identifies a specific customer site.
Site Level Aggregation Identifier (SLA ID)	Enables as many as 65,536 (216) subnets within an individual organization’s site. The SLA ID is assigned within the site; an ISP cannot change this part of the address.
Interface ID	Identifies the interface of a node on a specific subnet.

Unicast site-local addresses

IPv6 unicast site-local addresses are similar to IPv4 private addresses. The scope of a site-local address is the internetwork of an organization’s site. (You can use both global addresses and site-local addresses in your network.) The prefix for site-local addresses is FEC0::/48.

The following illustration shows the structure of a site-local address.

The initial 48 fixed bits are followed by a 16-bit Subnet ID field, which provides as many as 65,536 subnets in a flat subnet structure. Alternatively, you can subdivide the high-order bits of the Subnet ID field to create a hierarchical routing infrastructure. The last field is a 64-bit Interface ID field that identifies the interface of a node on a specific subnet.

Note

Global addresses and site-local addresses share the same structure after the first 48 bits — the 16-bit SLA ID of a global address and the 16-bit Subnet ID of a site-local address both identify the subnets of an organization’s site. Because of this, you can assign a specific subnet number to identify a subnet that is used for both global and site-local unicast addresses.

Unicast link-local addresses (FE80::/64)

IPv6 unicast link-local addresses are similar to IPv4 APIPA addresses used by computers running Microsoft Windows. Hosts on the same link (the same subnet) use these automatically configured addresses to communicate with each other. Neighbor Discovery provides address resolution. The prefix for link-local addresses is FE80::/64. The following illustration shows the structure of a link-local address.

Unicast unspecified address

The IPv6 unicast unspecified address is equivalent to the IPv4 unspecified address of 0.0.0.0. The IPv6 unspecified address is 0:0:0:0:0:0:0:0:, or a double colon (::).

Unicast loopback address

The IPv6 unicast loopback address is equivalent to the IPv4 loopback address, 127.0.0.1. The IPv6 loopback address is 0:0:0:0:0:0:0:1, or ::1.

Unicast 6to4 addresses (2002::/16)

IPv6 uses 6to4 addresses to communicate between two IPv6/IPv4 nodes over the IPv4 Internet. A 6to4 address combines the prefix 2002::/16 with the 32 bits of the public IPv4 address of the node to create a 48-bit prefix — 2002:WWXX:YYZZ::/48, where WWXX:YYZZ is the colon-hexadecimal representation of w.x.y.z, a public IPv4 address. Therefore, the IPv4 address 157.60.91.123 translates into a 6to4 address prefix of 2002:9D3C:5B7B::/48.

The following illustration shows the structure of a 6to4 address.

However, this is often written using the hexadecimal prefix: 2002:WWXX:YYZZ:SLA ID:Interface ID.

The following example shows how the WWXX:YYZZ portion of the address is translated from colon-hexadecimal notation to dotted-decimal notation. In this example, 9D3C:5B7B translates to 157.60.91.123, as illustrated in the following example.

Notation Type	Use a calculator to convert each constituent number from one notation type to the other
Colon-hexadecimal	9D 3C 5B 7B
Dotted-decimal	157 60 91 123

For more information about 6to4 tunneling, see "Routing IPv6 Traffic over an IPv4 Infrastructure" later in this chapter.

Unicast ISATAP addresses

IPv6 uses ISATAP addresses to communicate between two IPv6/IPv4 nodes over an IPv4 intranet. An ISATAP address combines a 64-bit unicast link-local, site-local, or global prefix (a global prefix might be a 6 to 4 prefix) with a 64-bit suffix constructed of the ISATAP identifier 0:5EFE, followed by the IPv4 address assigned to an interface of the host. The prefix is known as the subnet prefix. Although a 6to4 address can incorporate only a public IPv4 address, an ISATAP address can incorporate either a public or a private IPv4 address.

The following illustration shows the structure of an ISATAP address.

Table 1.8 shows an example of each type of ISATAP address.

Table 1.8 Examples of ISATAP addresses

Type of ISATAP Address	ISATAP Address
With link-local prefix	FE80::5EFE:131.107.129.8*
With site-local prefix	FEC0::1111:0:5EFE:131.107.129.8*
With global prefix	3FFE:1A05:510:1111:0:5EFE:131.107.129.8*
With global 6to4 prefix	2002:9D36:1:2:0:5EFE:131.107.129.8*

*Alternatively, the IPv4 address (in this example, 131.107.129.8) can be written in hexadecimal (in this example, 836B:8108).

By default, the IPv6 protocol for Windows XP and members of Windows Server 2003 automatically configures the ISATAP address of FE80::5EFE:w.x.y.z for each IPv4 address that is assigned to the node. This link-local ISATAP address allows two hosts to communicate over an IPv4 network by using each other’s ISATAP address.

For more information about ISATAP tunneling, see "Routing IPv6 Traffic over an IPv4 Infrastructure" later in this chapter.

Multicast IPv6 Addresses

IPv6 multicast addresses are similar to IPv4 multicast addresses. Packets addressed to a multicast address are delivered to all interfaces that the address identifies.

The following illustration shows the structure of an IPv6 multicast address.

Table 1.9 explains each field in an IP multicast address. The prefix for multicast addresses is FF00::/8.

Table 1.9 Fields in a Multicast Address

Field	Description
1111 1111	Identifies the address as an IP multicast address.
Flags	Currently, the only defined flag is the Transient (T) flag. Set to zero, the T flag identifies the address as a permanently assigned multicast address. Set to 1, it identifies a transient address.
Scope	Indicates the scope of the multicast traffic, such as interface-local, link-local, site-local, organization-local, or global scope.
Group ID	identifies the multicast group.

Multicast solicited node address

The IPv6 multicast solicited node address is used for efficient address resolution. The IPv4 ARP Request frame is sent to the MAC-level broadcast, which disturbs all nodes on the network segment. The multicast solicited node address combines the prefix FF02::1:FF00:0/104 with the last 24 bits of the IPv6 address being resolved. IPv6 uses the solicited node multicast address for the Neighbor Solicitation message (the IPv6 equivalent to the ARP Request frame) that resolves an IPv6 address to its link-layer address, disturbing few nodes during the address resolution process.

Anycast IPv6 Addresses

Anycast IPv6 addresses are similar to but more efficient than the anycast addresses in IPv4, which are used primarily by large ISPs. Anycast addresses use the unicast address space but function differently from other unicast addresses. IPv6 uses anycast addresses to identify multiple interfaces. IPv6 delivers packets addressed to an anycast address to the nearest interface that the address identifies. In contrast to a multicast address, where delivery is from one to many, an anycast address delivery is from one to one-of-many. Currently, anycast addresses are assigned only to routers and are used only as destination addresses.

http://technet.microsoft.com/en-us/library/cc757359%28WS.10%29.aspx

Why IPv6: What CCNA Candidates Need to Know About IPv6

2011-05-05T07:42:00.000-07:00

By Tracey Wilson
February 10, 2010

One of the components of the current CCNA Exam (640-802) is a basic understanding of the new IPv6 protocol and some transition steps to utilize IPv6 in existing IPv4 network implementations.

But before you begin to study the formats and functionality of IPv6 for your CCNA exam, you should have a firm grasp of why this new protocol is needed and its role in the future of networking.

In this article, we will walk the history of this protocol, investigate some of the issues driving IPv6 to the forefront, and finally look at who is using IPv6 today and what can be expected in the future.

A Brief History of IPv6

As early as 1990, experts began to predict the current IPv4 address space with its current rate of growth would soon run out.

The unicast available IP Classes at the time were A, B, and C. In 1992, Classless Internet Domain Routing, or CIDR, was introduced to summarize IPv4 blocks more efficiently and slow the exponential growth pattern of the global Internet routing table.

Later in 1993, the Internet Engineering Task Force (IETF) recognized the need for a new protocol to address many of the current IPv4 shortcomings and started a working group designated IP Next Generation (IPng) to organize its development.

In 1994, many of the Internet standards committees approved this new protocol and it was assigned version number 6.

As part of early deployments, IPv6 test beds were created to generate exposure to the new protocol starting with the first IPv6 backbone, 6bone, which was created in 1996. The first IPv6 exchange point, 6TAP, was developed one year later at the Chicago STARTAP exchange point.

In 1999, the regional Internet registries (RIRs), the organizations responsible for assigning IP address space, began assigning the first block of global IPv6 prefixes for widespread use. As early as 1996 operating system providers were developing specialized patches to support the new protocol, but most mainline releases were not available with some basic IPv6 capability until 1999.

In 2001, the IPng working group officially changed its name to IPv6.

A Look at the IPv6 Issues

Now that we’re aware of the brief history of this new protocol, let us look more in depth at some of the reasons for why it was needed.

In this article, we will focus on three of the primary issues:

IPv4 address exhaustion,
growth of the global Internet routing table,
and the disparity in regional allocation of addresses.

IPv4 Address Exhaustion

As I mentioned before, the IPv4s address space was seen to be limited and with the development of the World Wide Web, exhaustion of those addresses became more and more apparent.

To illustrate this issue, let us look at the current IP address allocation (Figure 1) computed from data recorded for the Internet Assigned Numbers Authority (IANA) as of January 2010. The IANA is the organization responsible for coordinating the DNS root domain, allocating IP addresses to the RIRs, and managing various Internet protocol number assignments.

As you can see from the chart, the unassigned portion of the IPv4 space is now only 10% and other addresses are either private or are not usable as they have been designated for multicast or still slotted for testing or further use (Class D and E addresses).

In 2002, this unassigned portion of addresses was at 28%. Various experts on IP allocation and address exhaustion continue to debate the timeframe when the addressing space will run out. Dates vary from late 2011 to early 2015, but the majority of them believe that 2013 is the most likely target.

The IPv4 address structure is comprised of 32 bits for a total of 232 or 4,294,967,296 addresses. With all the subtractions for network numbers, broadcast addresses, and private or unusable address blocks, the number of usable addresses is much less. IPv6 has a 128 bit structure which supports a total of 2128 or 3.4 x1038 addresses, seemingly enough to provide addresses for the next few decades.

A colleague of mine, who has served on IETF working groups, once told me, “There are enough IPv6 addresses for every blade of grass on the planet.” I believe he might be right.

The Growth of the Global Internet Routing Table

Another issue that has promoted the need for a new IP layer protocol is the rapid growth of the global Internet routing table.

Ever since 1992, the Internet routing table has been on an exponential growth curve. CIDR with its route summarization and the addition of route aggregates have slowed the growth, but the table today does not have a well defined hierarchy and as the size continues to grow, efficient routing will become more difficult.

IPv6 was designed to have a much more hierarchical structure to support aggregate routes for more efficient and scalable routing. To provide a better understanding of the growth issue, Figure 2 shows the growth pattern of the routing table over the past two decades.

Figure 2: Global Internet Routing Table Growth from www.cidr-report.org.

The Disparity in Regional Allocation of Addresses

The last issue we will cover today is the regional assignment of the current IPv4 address space. As I mentioned before, the five RIRs are responsible for assigning IP addresses. Each RIR covers a specific region as shown below:

ARIN – North America and parts of the Caribbean and North Atlantic Islands
AfriNIC – Africa and parts of the Indian Ocean
APNIC – Portions of Asia and the Pacific Ocean
LACNIC – Latin American and part of the Caribbean
RIPE NCC – Europe, the Middle East, and central Asia

Due to the fast growth of the Internet in the North American region, nearly 75% of the IPv4 address space has been allocated in that region. Many countries like India, China, and other densely populated areas were left with minimal allocations.

In response to this issue, the IPv6 protocol was designed with a Global Prefix structure that includes plenty of addresses to support balanced allocations across the world.

Who is Using IPv6 Today and What Might We Expect?

Today, IPv6 is deployed in various countries around the world. IPv6 can be deployed as a native IP protocol or “dual-stacked” with IPv4 running on the same interfaces.

China has deployed two of the world’s largest native IPv6 networks and over 50% of South Korean homes utilize broadband connections with IPv6. Japan has developed a nationwide dual-stacked network and European countries are rolling out IPv6 for commercial and government use.

In the United States, the use of this protocol has not been as pronounced. Much of the commercial world has not embraced the need at this time due to the availability of IPv4 addresses in the region. However, the United States Government Office of Management and Budget issued a directive requiring all federal agencies to be IPv6 compliant by June 30, 2008.

IPv6 was not intended to be running on all agencies networks, but all hardware and software must support the new protocol and plans must be in place for a smooth transition to a dual-stacked or native implementation.

This implementation plan and the ever approaching exhaustion of IPv4 addresses will eventually move the North American commercial world to utilize IPv6 mainstream, but only time will tell.

Cool Subnetting Tricks with Variable Length Subnet Mask

2011-05-05T07:25:00.000-07:00

Cool Subnetting Tricks with Variable Length Subnet Mask

By Stelios Antoniou
April 8, 2008

A few months back, I showed you how to organize your network into smaller subnets. My post covered the details of the concept of subnetting. So if you missed that article, I would suggest taking a look at it to make sure you understand VLSM and this article in its entirety. For now, I will assume that you are already familiar with subnetting and know how to divide a network into smaller subnets.

In today’s article, we’ll subnet an already subnetted network into multiple subnets with variable subnet masks and then allocate them within our sample network.

Variable Length Subnet Mask (VLSM) is a key technology on large scalable networks. Mastering the concept of VLSM is not an easy task, but it’s well worth it. The importance of VLSM and its beneficial contribution to networking design is unquestionable. At the end of this article you will be able to understand the benefits of VLSM and describe the process of calculating VLSMs. I will use a real world example to help you understand the whole process and its beneficial effects.

Benefits of VLSM

VLSM provides the ability to subnet an already subnetted network address. The benefits that arise from this behavior include:

Efficient use of IP addresses: IP addresses are allocated according to the host space requirement of each subnet.

IP addresses are not wasted; for example, a Class C network of 192.168.10.0 and a mask of 255.255.255.224 (/27) allows you to have eight subnets, each with 32 IP addresses (30 of which could be assigned to devices). What if we had a few WAN links in our network (WAN links need only one IP address on each side, hence a total of two IP addresses per WAN link are needed).

Without VLSM that would be impossible. With VLSM we can subnet one of the subnets, 192.168.10.32, into smaller subnets with a mask of 255.255.255.252 (/30). This way we end up with eight subnets with only two available hosts each that we could use on the WAN links.

The /30 subnets created are: 192.168.10.32/30, 192.168.10.36/30, 192.168.10.40/30, 192.168.10.44/30, 192.168.10.48/30, 192.168.10.52/30, 192.168.10.56/30 192.168.10.60/30.

Support for better route summarization: VLSM supports hierarchical addressing design therefore, it can effectively support route aggregation, also called route summarization.

The latter can successfully reduce the number of routes in a routing table by representing a range of network subnets in a single summary address. For example subnets 192.168.10.0/24, 192.168.11.0/24 and 192.168.12.0/24 could all be summarized into 192.168.8.0/21.

Address Waste Without VLSM

The following diagram shows a sample internetwork which uses a network C address 192.168.10.0 (/24) subnetted into 8 equal size subnets (32 available IP addresses each) to be allocated to the various portions of the network.

This specific network consists of 3 WAN links that are allocated a subnet address range each from the pool of available subnets. Obviously 30 IP address are wasted (28 host addresses) since they are never going to be used on the WAN links.

Implementing VLSM

In order to be able to implement VLSMs in a quick and efficient way, you need to understand and memorize the IP address blocks and available hosts for various subnet masks.

Create a small table with all of this information and use it to create your VLSM network. The following table shows the block sizes used for subnetting a Class C subnet.

Having this table in front of you is very helpful. For example, if you have a subnet with 28 hosts then you can easily see from the table that you will need a block size of 32. For a subnet of 40 hosts you will need a block size of 64.

Example: Create a VLSM Network

Let us use the sample network provided above to implement VLSM. According to the number of hosts in each subnet, identify the addressing blocks required. You should end up with the following VLSM table for this Class C network 192.168.10.0/24.

Take a deep breath … we’re almost done. We have identified the necessary block sizes for our sample network.

The final step is to allocate the actual subnets to our design and construct our VLSM network. We will take into account that subnet-zero can be used in our network design, therefore the following solution will really allow us to save unnecessary addressing waste:

With VLSM we have occupied 140 addresses. Nearly half of the address space of the Class C network is saved. The address space that remains unused is available for any future expansion.

Isn’t that amazing? We have reserved a great amount of addresses for future use. Our sample network diagram is finalized as shown on the following diagram:

Final Thoughts

Variable Length Subnet Mask is an extremely important chapter in Network Design. Honestly, if you want to design and implement scalable and efficient networks, you should definitely learn how to design and implement VLSM.

It’s not that difficult once you understand the process of block sizes and the way to allocate them within your design. Don’t forget that VLSM relates directly to the subnetting process, therefore mastering the subnetting process is a prerequisite for effectively implementing VLSM. And feel free to go through my subnetting articles a couple of times to get a hang of the whole process.

gns3 IPV6 CCNA

2011-05-03T21:42:00.000-07:00

simple topology about IPV6 for CCNA this is the topolgy that used in CBTNUGGETS VIDEO

download the topology

GNS3 connect to cisco security Device Manager

2011-05-01T01:42:00.000-07:00

how to connect to cisco security Device Manager

1- create a loopback adapter
2- drag a cloud and router
3- configure the cloud to connect to the loopback adapter that we create

4- open a command promt and type ipconfig /all to see if the interface has an IP address if so get the ip address if the interface haven't got any IP address give it an IP address

5-connect the cloud to the router and run the router and open the router console

GOOOOOOOOOOOooood and we are at the configuration part connect the router and configure it with the following command
1- give the router a name :hostname example hostname gns3cisco
2- enter the router into a domain :ip domain-name example : ip domain-name gns3cisco3- congfige a username with a privilege 15 to access the router
username privilege 15 password or secret
example username xmt privilege 15 password cisco
4-as you know to ssh protocol is encrypted so we need to define the encryption and the key size
crypto key generate rsa and Enter then Enter the key size the default is 512 but i enter 1024

5-now we trun the ssh to the version 2 maybe some ISO or routers don't support this command
ip ssh version 2
6-enable the http and the https protocol
ip http server * up to you
ip http secure-server * you have to...

7-configure the VTY port
line vty 0 4 *check your iso you can configue up to 15 vty ports
trun on the login local database to verify the username and password
login local
transport input ssh telnet
if you don't want to allow telent don't include it in the line

now the vty port is ready we need to trun on the interface that is connect with the colud and give it an IP address
8- first check the interfaces with the command
show ip interface brief
we only have one interface
so we type
interface fastethernet 0/0
we give the interface an IP address in the same subnet of our loopback interface
ip address
example IP address 10.0.0.1 255.255.255.0
no shutdown
this comand to trun the interface up
and finally we virviy our connection with the ICMP protocol Ping
ping 10.0.0.2
ooooooooki our connection is fine

now it's time to connect to our router using cisco security device manager
run the cisco sdm launcher enter the ip address and check this device has https enabled and i want to user it
and click launch
internet explorer or any other default browser will popup it IE and this alert popup
the this windows will show up and anther windows
check it and click yes
maybe anther windows show up and ask you for username and password enter the user name that you configure example xmt cisco

now the cisco security device manager is loading
congratulation you cisco SDM is ready to go....

Sincerely
Abdulrahman Obaid

GNS3 STP ICND2

2011-04-29T17:07:00.000-07:00

download the topology
no need for VPCs because i use in this topology router on a stick

GNS3 EIRGP ICND2

2011-04-29T16:58:00.001-07:00

download the topology
download the VPCs file

note
change the directory of the routers image with the you router image location in topology.net file
copy the VPCs file to the VPCs directory and load it using the comand load with the file name
example load route

GNS3 OSPF ICND2

2011-04-28T06:14:00.001-07:00

GNS3 topology for CCNA ICND2
download this topology
download VPCs pcs copy it to VPCs location and type load route

GNS3 and VPCs

2011-04-28T04:58:00.000-07:00

http://gns3cisco.blogspot.com/2011/04/virtual-pc-simulator.html
in pervious post we explain a little bit about VPCs now open VPCs and give pcs IP address
run show command to view pcs ip address and gateway and Lport and Rport

Drag a Cloud
configure the cloud

every cloud represent one VPCs ( PC )

1. go into NIO UPD tab
2. configure Local port and Remote port with Lport and Rport on VPCs
3. click add then OK
now if you want change the symbol of the cloud to lock like PC

now our PCS is ready you can now connect it with an switch and ping it or traceroute

Sincerely
Abdulrahman Obaid

Cisco CCNA CCNP GNS3 LAB

sdm part 3 search help

SDM part 2 menu

Cisco Secure Access Control Server (ACS)

GNS3CISCO Help you pass your CCNA CCNP EXAM

GNS3 kiwi syslog

GNS3 frame-relay poin-to-point full meshd

GNS3 frame-relay poin-to-point

GNS3 frame-relay multipoint

GNS3 VLAN VTP

GNS3 PPP authentication CHAP

GNS3 PPP authentication PAP

GNS3 PPP protocol

SDM part 1 Home

Cisco IOS access lists: 10 things you should know

What is an access control list?

What's the most common type of ACL?

What are the most common numbers for IP ACLs?

How can you filter traffic using ACLs?

How can an ACL help protectmy network from viruses?

What's the order of operations in an ACL?

What about traffic you don't specifically address in an ACL?

Can I name an ACL?

What's a numbering sequence?

How else can I use an ACL?

GNS3 EIRGP Metrics

Scaling IP Addresses with NAT (Network Address Translation) and PAT (Port Address Translation)

NAT and PAT

Inside Local Source Address Translation

Static NAT Configuration

Dynamic NAT Configuration

Inside Global Address Overloading

NAT Overloading Configuration

Conclusion

IPv6 Address Types from technet

Unicast IPv6 Addresses

Unicast global addresses

Unicast site-local addresses

Unicast link-local addresses (FE80::/64)

Unicast unspecified address

Unicast loopback address

Unicast 6to4 addresses (2002::/16)

Unicast ISATAP addresses

Multicast IPv6 Addresses

Multicast solicited node address

Anycast IPv6 Addresses

Why IPv6: What CCNA Candidates Need to Know About IPv6

A Brief History of IPv6

A Look at the IPv6 Issues

IPv4 Address Exhaustion

The Growth of the Global Internet Routing Table

The Disparity in Regional Allocation of Addresses

Who is Using IPv6 Today and What Might We Expect?

Cool Subnetting Tricks with Variable Length Subnet Mask

Cool Subnetting Tricks with Variable Length Subnet Mask

Benefits of VLSM

Address Waste Without VLSM

Implementing VLSM

Example: Create a VLSM Network

Final Thoughts

gns3 IPV6 CCNA

GNS3 connect to cisco security Device Manager

GNS3 STP ICND2

GNS3 EIRGP ICND2

GNS3 OSPF ICND2

GNS3 and VPCs

How can an ACL help protect
my network from viruses?