NETWORK TIPS &TRICKS

Difference Between RIPv1 and RIPv2

2011-11-20T20:20:00.001+05:30

RIP v1	RIP v2
Distance-Vector	Distance-Vector
Maximum hop count = 15	Maximum hop count = 15
Classful	Classless
Broadcast based	Use Multicast 224.0.0.9
No support for VLSM	Support VLSM
No authentication	Allows MD5 authentication
No support for discontinuous networks	Support discontinuous network

RIP v2

2011-11-19T21:00:00.001+05:30

RIPv2 is a classless, distance vector routing protocol as defined in RFC 1723. Because RIPv2 is a classless routing protocol, which means, it includes the subnet mask with the network addresses in the routing updates. As with other classless routing protocols, RIPv2 supports CIDR supernets, VLSM and discontiguous networks.

Due to the deficiencies of RIPv1, RIP version 2 (RIPv2) was developed sometime in 1993. It’s equipped with the ability to support subnet information and supports Classless Inter-Domain Routing (CIDR). A router that receives routing updates from multiple routers advertising the same classful summary route cannot determine which subnets belong to which summary route. This inability leads to unexpected results including misrouted packets.

However, with RIPv2 automatic summarization can be disabled with the no auto-summary command. Automatic summarization must be disabled to support discontiguous networks.

RIPv2 still maintains the hop count limit of 15 and incorporated a password authentication mechanism. However, passwords were transmitted in clear-text format, which were found insufficient for secure communications on the Internet.

The default version of RIP is version 1. The command version 2 is used to modify RIPv1 to RIPv2.

Use The show ip protocols command to view that RIP is now sending and receiving version 2 updates and whether or not automatic summarization is in effect.

RIPv2 is actually an enhancement of RIPv1's features and extensions rather than an entirely new protocol. Some of these enhanced features include:

•Next-hop addresses included in the routing updates

•Use of multicast addresses in sending updates

•Authentication option available

Like RIPv1, RIPv2 is a distance vector routing protocol. Both versions of RIP share the following features and limitations:

•Use of holddown and other timers to help prevent routing loops.

•Use of split horizon or split horizon with poison reverse to also help prevent routing loops.

•Use of triggered updates when there is a change in the topology for faster convergence.

•Maximum hop count limit of 15 hops, with the hop count of 16 signifying an unreachable network.

SSL Vendor List

2011-08-27T12:30:00.003+05:30

1. Verisign

2. Thawte

3. Geotrust

4. GoDaddy

5. Comodo

6. Entrust

7. Digicert

8. Globalsign

What is Smurf attack & How to prevent it ?

2011-08-27T12:09:00.000+05:30

Smurf attack is the form of generating uncontrolled amount of traffic in victims network.

The process of smurf attack is as follows:

1. Send huge amount of ICMP request to the broadcast address of the victim network(Directed Broadcast Address).

2. Source IP of the attacker must be spoofed.

3. The ICMP request reach the gateway of the victim network.

4. Each host on the victim network will respond to the ICMP request (Amplifying the ping requests)

5. It creates uncontrollable amount of traffic from victim's network.

6. It will consume the useful bandwidth and the server will be down in few minutes.

How to prevent smurf attack ?

1. Configure individual hosts and routers not to respond to ping requests or broadcasts.

2. Configure routers not to forward packets directed to broadcast addresses.

Denial of Service (DOS) attacks

2011-08-27T12:06:00.000+05:30

Denial of Service (DOS) attacks are intended to shut down the servers for a period of time. To make site nonfunctional for a time the main part of attack is DOS attack. DOS attacks are usually doing by following methods:

1. Send unlimited amount of packets to the server.

2. Executing malwares

3. Teardrop attack

4. Application level flood

Sending unlimited packets by ping command is also known as ICMP flood. This method can be done in the following way.

A simple DOS attack code would be:

ping {ip} -t -l 20000

On command prompt window you can type the following command. This command sends 20000 bytes of data to the ip, in a single packet. The -t is to ping the specified host until stopped and -l is to specify the buffer size. A Teardrop attack involves sending mangled Internet Packet fragments with overlapping, over-sized, payloads to the target machine. In peer to peer attack thousands of computers will try to access a single computer at the same time. It will break down all the connection from the server at last the target machine will fail. Application level flood is by the mis-programming of an application installed on the server.So it will consume a major portion of server computing power and memory.

DOS attack with ping flood will work only if the following cafeterias are satisfied:

1. Attacker should have higher bandwidth than the victim.

2. Victim should respond to the ping requests

IPV4 vs IPV6

2011-04-07T18:19:00.000+05:30

Address Space
IPv4:4 Billion Addresses
IPv6:2^128
79 Octillion times the IPv4 address space

Configuration
IPv4: Manual or use DHCP
IPv6: Universal Plug and Play (UPnP) with or without DHCP
Lower Operation Expenses and reduce error

Broadcast / Multicast
IPv4: Uses both
IPv6: No broadcast and has different forms of multicast
Better bandwidth efficiency

Anycast support
IPv4: Not part of the original protocol
IPv6: Explicit support of anycast
Allows new applications in mobility, data center

Network Configuration
IPv4: Mostly manual and labor intensive
IPv6: Facilitate the re-numbering of hosts and routers
Lower operation expenses and facilitate migration

QoS support
IPv4: ToS using DIFFServ
IPv6: Flow classes and flow labels
More Granular control of QoS

Security
IPv4: Uses IPsec for Data packet protection
IPv6: IPsec becomes the key technology to protect data and control packets
Unified framework for security and more secure computing environment

Mobility
IPv4: Uses Mobile IPv4
IPv6: Mobile IPv6 provides fast handover, better router optimization and hierarchical mobility
Better efficiency and scalability; Work with latest 3G mobile technologies and beyond.

Google Over IPV6

2011-04-07T17:46:00.001+05:30

At Google, we believe that IPv6 is essential to the continued health and openness of the Internet – and that by allowing all devices on a network to talk to each other directly, IPv6 will enable innovation and allow the Internet's continued growth. Typical Google users do not need to do anything to prepare for IPv6, but we are working with network operators to support the transition.

In March 2008, we began offering Google search over IPv6 on IPv6-only websites like ipv6.google.com (IPv6 connection required), but other Google products were not generally available over IPv6.

That's why we created Google over IPv6. If you operate a network that supports IPv6, we may be able to enable Google over IPv6, letting you give users seamless access to most Google services over IPv6 simply by going to the same websites they usually use, such as www.google.com.

How it works

Google over IPv6 uses the IPv4 address of your DNS resolver to determine whether a network is IPv6-capable. If you enable Google over IPv6 for your resolver, IPv6 users of that resolver will receive AAAA records for IPv6-enabled Google services.

Normally, if a DNS resolver requests an IPv6 address for a Google web site,
it will not receive one…

…but a DNS resolver with Google over IPv6 will receive an IPv6 address,
and its users will be able to connect to Google web sites using IPv6.

How to get started using Google over IPv6

To qualify for Google over IPv6, your network must meet a number of requirements. These include:

Low latency, redundant paths to Google using direct peering or reliable transit
Production-quality IPv6 support and reliability
Separate DNS servers for your IPv6 users (not shared with IPv4-only users)
Users who have opted in to IPv6 services and know how to opt out if they experience problems with Google services

Know about IPV6 ?

2011-04-07T17:33:00.001+05:30

IPv6 or IP version 6 is the next generation Internet protocol which will eventually replace the current protocol IPv4. IPv6 has a number of improvements and simplifications when compared to IPv4. The primary difference is that IPv6 uses 128 bit addresses as compared to the 32 bit addresses used with IPv4. This means that there are more available IP addresses using IPv6 than are available with IPv4 alone. For a very clear comparison, in IPv4 there is a total of 4,294,967,296 IP addresses. With IPv6, there is a total of 18,446,744,073,709,551,616 IP addresses in a single /64 allocation.

To also help illustrate the sheer magnitude of available IP addresses using IPv6, you can get 65536 /64 allocations out of a single /48, and then 65536 /48 allocations out of a single /32. Many Service Providers are getting /32 allocations from their Regional Internet Registry (RIR) like ARIN, APNIC, RIPE, etc.

A significant difference between IPv6 and IPv4 is the address notation. IPv4 uses a period (.) between each octet, compared to IPv6 which uses a colon (:). With IPv6, if you have a series of zeroes in a row, the address need not be written out completely. You can use a double colon (::) to represent that series of zeroes, however you can only use that once. For example, if you have an address like "2001:0DB8:0000:0003:0000:01FF:0000:002E", it can be written like "2001:DB8::3:0:1FF:0:2E" or "2001:DB8:0:3:0:1FF::2E", but would never be written like "2001:DB8::3::1ff::2E". You also cannot have three colons in a row (:::).

IPv6 availability depends on your Service Provider, either at home or for work. In a dual-stack environment, IPv4 and IPv6 co-exist along the same connection and don't require any special kind of connection. If dual-stack is not available, you might find yourself using an IP tunneling product or service to bring IPv6 connectivity to you. IPv4 exhaustion, as of this writing, is estimated to happen sometime in early or mid 2011. When this happens, IPv4 won't simply disappear off the face of the Internet, but continued explosive growth requiring more unique IP address assignments will mean using more and more of the abundant IPv6 address space.

Many Operating System platforms have native IPv6 support these days. The UNIX based platforms like Linux, BSD (Free, Open, Net) & MacOSX have had IPv6 support enabled for years now. Microsoft Windows starting having native IPv6 support enabled by default with it's Vista and Windows 2008 products. Earlier Windows versions like 2000/2003/XP had to have it installed optionally, and did not have as robust features that are available in the newer versions of Windows. Even common web browsing and email software will use IPv6 if it is enabled and available, without having to check off an option or special configuration. The transition from IPv4 to IPv6 is being worked on to be as seamless as possible, and many might not even notice the subtle changes in the coming years.

Prepare for IPV6

2011-04-07T17:27:00.000+05:30

Difference between RIP V1 & RIP V2

2011-03-30T12:22:00.000+05:30

Difference between RIP V1 & RIP V2.

RIP V1 : Distance Vector Maximum Hop count of 15 Classful No Support for VLSM No support for Discontigious networks.

RIP V2 : Distance Vector Maximum Hop count of 15 Classless Supports VLSM networks Supports Discontigious networks

Mulitcasting :

Any Communication between a single sender and multiple receivers.

In Networking Multicast messages are sent to a defined subset of the network addresses.

What is classful and classless routing ?

2011-03-30T12:21:00.001+05:30

Classful routing : Routing Protocol that do not send subnet mask information when a route update is sent out. All devices in the network must use the same subnet mask.

Eg : RIP V1

Classless routing : Routing that sends subnet mask information in the routing updates. Classless routing allows VLSM (Variable Length Subnet Masking)

Eg : RIP V2 EIGRP & OSPF.

what is the difference Between BRI & PRI ?

2011-03-30T12:16:00.000+05:30

Both BRI (Basic Rate Interface) and PRI (Primary Rate Interface) provide multiple digital bearer channels over which temporary connections can be made and data can be sent.

Features:

ISDN BRI services 2 B channels (64 kbps) and one D channel (16 kbps). The total bandwidth is 144 kbps.

In North America ISDN PRI service is PRI T1 total bandwidth 1.544 Mbps ( 23 B channel with 64 kbps + 1 D channel with 64 Kbps)

In Europe ISDN PRI service is PRI E1 total bandwidth 2.048 Mbps (30 B channel with 64 kbps + 1 D channel with 64 Kbps)

IPv6 Transition Technology

2011-03-29T19:59:00.002+05:30

IPv4 Vs IPv6

2011-03-29T19:51:00.000+05:30

PUBLIC DNS SERVER

2011-03-29T19:05:00.000+05:30

=> Service provider: Google
Google public dns server IP address:

8.8.8.8
8.8.4.4

=> Service provider: Dnsadvantage
Dnsadvantage free dns server list:

156.154.70.1
156.154.71.1

=> Service provider: OpenDNS
OpenDNS free dns server list / IP address:

208.67.222.222
208.67.220.220

=> Service provider: Norton
Norton free dns server list / IP address:

198.153.192.1
198.153.194.1

=> Service provider: GTEI DNS (now Verizon)
Public Name server IP address:

4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6

=> Service provider: ScrubIt
Public dns server address:

67.138.54.100
207.225.209.66

IPv6 Header

2011-03-29T18:42:00.003+05:30

IPv6 Header:

IPv6 header contains the following things:

Version - This field contains the version of the IP used in the packet. It is of 4-bit in IP version 6.
Traffic class - This is an 8-bits field determining the packet priority. Priority values subdivide into ranges: traffic where the source provides congestion control and non-congestion control traffic.
Flow label - This 20 bits specifies the QoS management. Originally created for giving real-time applications special service, but currently unused.
Payload length - This 16 bits determines the payload length in bytes. When cleared to zero, the option is a "Jumbo payload" (hop-by-hop).
Next header - This 8-bits field specifies the next encapsulated protocol. The values are compatible with those specified for the IPv4 protocol field.
Hop limit - This is an 8-bits field newly introduced in IPv6. It replaces the time to live field of IPv4.
Source Address - This 128 bits field determines the logical address of the host that is sending the packet.
Destination Address - This 128 bits field determines the logical address of the host that is receiving the packet.

Difference Between IPv4 and IPv6

2011-03-29T18:41:00.000+05:30

IPv4

Source and destination addresses are 32 bits (4 bytes) in length.
IPSec support is optional.
IPv4 header does not identify packet flow for QoS handling by routers.
Both routers and the sending host fragment packets.
Header includes a checksum.
Header includes options.
Address Resolution Protocol (ARP) uses broadcast ARP Request frames to resolve an IP address to a link-layer address.
Internet Group Management Protocol (IGMP) manages membership in local subnet groups.
ICMP Router Discovery is used to determine the IPv4 address of the best default gateway, and it is optional.
Broadcast addresses are used to send traffic to all nodes on a subnet.
Must be configured either manually or through DHCP.
Uses host address (A) resource records in Domain Name System (DNS) to map host names to IPv4 addresses.
Uses pointer (PTR) resource records in the IN-ADDR.ARPA DNS domain to map IPv4 addresses to host names.
Must support a 576-byte packet size (possibly fragmented).

IPv6

Source and destination addresses are 128 bits (16 bytes) in length.
IPSec support is required.
IPv6 header contains Flow Label field, which identifies packet flow for QoS handling by router.
Only the sending host fragments packets; routers do not.
Header does not include a checksum.
All optional data is moved to IPv6 extension headers.
Multicast Neighbor Solicitation messages resolve IP addresses to link-layer addresses.
Multicast Listener Discovery (MLD) messages manage membership in local subnet groups.
ICMPv6 Router Solicitation and Router Advertisement messages are used to determine the IP address of the best default gateway, and they are required.
IPv6 uses a link-local scope all-nodes multicast address.
Does not require manual configuration or DHCP.
Uses host address (AAAA) resource records in DNS to map host names to IPv6 addresses.
Uses pointer (PTR) resource records in the IP6.ARPA DNS domain to map IPv6 addresses to host names.
Must support a 1280-byte packet size (without fragmentation).

About IPV6

2011-03-26T21:30:00.000+05:30

How to Configure Switch Security ?

2011-03-17T14:00:00.000+05:30

Cisco Switch Port Security

Conventional network security often focuses more on routers and blocking traffic from the outside. Switches are internal to the organization and designed to allow ease of connectivity, therefore only limited or no security measures are applied.

The following basic security features can be used to secure your switches and network:

* Physically secure the device

* Use secure passwords

* Enable SSH access

* Enable port security

* Disable http access

* Disable unused ports

* Disable Telnet

Lets look at how to implement and configure some of the above mentioned switch security features.

1. How To Configure the privileged EXEC password.

Use the enable secret command to set the password. For this activity, set the password to orbit.

SW1#configure terminal

SW1(config)#enable secret orbit

SW1(config)#

2. How To Configure virtual terminal (Telnet) and console passwords and require users to login.

A password should be required to access the console line. Even the basic user EXEC mode can provide significant information to a malicious user. In addition, the VTY lines must have a password before users can access the switch remotely.

Use the following commands to secure the console and telnet:

SW1(config)#line console 0

SW1(config-line)#password cisco

SW1(config-line)#login

SW1(config-line)#line vty 0 15

SW1(config-line)#password cisco

SW1(config-line)#login

SW1(config-line)#exit

SW1(config)#

3. How To Configure password encryption.

At this stage, the privileged EXEC password is already encrypted. To encrypt the line passwords that you just configured, enter the service password-encryption command in global configuration mode.

SW1(config)#service password-encryption

SW1(config)#

4. How To Configure and test the MOTD banner.

Configure the message-of-the-day (MOTD) using Authorized Access Only as the text. Follow these guidelines:

i. The banner text is case sensitive. Make sure you do not add any spaces before or after the banner text.

ii. Use a delimiting character before and after the banner text to indicate where the text begins and ends. The delimiting character used in the example below is %, but you can use any character that is not used in the banner text.

iii. After you have configured the MOTD, log out of the switch to verify that the banner displays when you log back in.

SW1(config)#banner motd %Authorized Access Only%

SW1(config)#end

SW1#exit

5. How To Configure Port Security

Enter interface configuration mode for FastEthernet 0/11 and enable port security.

Before any other port security commands can be configured on the interface, port security must be enabled.

SW1(config-if)#interface fa0/11

SW1(config-if)#switchport port-security

* Notice that you do not have to exit back to global configuration mode before entering interface configuration mode for fa0/11.

6. How To configure the maximum number of MAC addresses.

To configure the port to learn only one MAC address, set the maximum to 1:

SW1(config-if)#switchport port-security maximum 1

7. How To configure the port to add the MAC address to the running configuration.

The MAC address learned on the port can be added to (“stuck” to) the running configuration for that port.

SW1(config-if)#switchport port-security mac-address sticky

8. How To Configure the port to automatically shut down if port security is violated.

If you do not configure the following command, SW1 only logs the violation in the port security statistics but does not shut down the port.

SW1(config-if)#switchport port-security violation shutdown

Use the show-mac-address- table command to confirm that SW1 has learned the MAC address for the intended devices, in this case PC1.

SW1#show mac-address-table

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

20 0060.5c4b.cd22 STATIC Fa0/11

You can use the show port-security interface fa0/11 command to also verify a security violation with the command.

SW1#show port-security interface fa0/11

Port Security : Enabled

Port Status : Secure-shutdown

Violation Mode : Shutdown

Aging Time : 0 mins

Aging Type : Absolute

SecureStatic Address Aging : Disabled

Maximum MAC Addresses : 1

Total MAC Addresses : 1

Configured MAC Addresses : 1

Sticky MAC Addresses : 0

Last Source Address:Vlan : 00E0.F7B0.086E:20

Security Violation Count : 1

9. How To Secure Unused Ports

Disabling unused switch ports a simple method many network administrators use to help secure their network from unauthorized access. Disabling an unused port stops traffic from flowing through the port(s)

Step 1: Disable interface Fa0/10 on SW1.

Enter interface configuration mode for FastEthernet 0/17 and shut down the port.

SW1(config)#interface fa0/10

SW1(config-if)#shutdown

Step 2: Disable interfaces Fa0/1 to Fa0/24 on SW1

SW1(config)#interface range fa0/1-24

SW1(config-if)#shutdown

Sucure your Cisco Routers

2011-03-17T13:55:00.000+05:30

How to secure your network with Cisco Routers

Security passwords configuration
Pass phrases configuration
Secure administrative access
Secure Telnet and SSH
Maintain Router activity logs

Before we learn how to secure Cisco routers, lets briefly summarise the role routers play in network security

The Role of Routers in Network Security

As you must have known, routers are used to route traffic between different networks based on Layer 3 IP addresses and provide access to network segment and sub networks. So said, that makes routers the definite targets for network attackers. When the border router of an organisation’s network is compromised or gained access to, unauthorized, it poses a potential threat to its sensitive information and other network services and resources.

Routers can be compromised in many ways, (Trust exploitation and MITM attacks) and this exposes the internal network configuration or components to scans and attacks.

In summary, two primary roles router plays in a network.

Advertise networks and filter (permit/deny) who can use them.
Provide access to network segments and subnetworks

MAJOR ISP IN INDIA

2011-03-17T13:03:00.000+05:30

MAJOR ISP’S IN INDIA

1. Bharti Airtel Ltd.

2. BSNL.

3. Reliance Communication.

4. Sify Technologies Ltd.

5. Tata Communications Ltd.

6. Tata Teleservices Ltd.

7. Tulip Telecom Ltd.

Acces Control Lists

2011-03-17T12:25:00.000+05:30

Access Control Lists (ACLs)

Access Control List (ACL) are filters that enable you to control which routing updates or packets are permitted or denied in or out of a network. They are specifically used by network administrators to filter traffic and to provide extra security for their networks. This can be applied on routers (Cisco).

ACLs provide a powerful way to control traffic into and out of your network; this control can be as simple as permitting or denying network hosts or addresses. You can configure ACLs for all routed network protocols.

The most important reason to configure ACLs is to provide security for your network. However, ACLs can also be configured to control network traffic based on the TCP port being used.

How ACL works

A router acts as a packet filter when it forwards or denies packets according to filtering rules. As a Layer 3 device, a packet-filtering router uses rules to determine whether to permit or deny traffic based on source and destination IP addresses, source port and destination port, and the protocol of the packet. These rules are defined using access control lists or ACLs.

To simplify how ACL or a router uses packet filtering work, imagine that a guard has been posted at a locked door. The guard's instructions are to allow only people whose names appear on a list to pass through the door. The guard is filtering people based on the condition of having their names on the authorized list.

When a packet arrives at the router, the router extracts certain information from the packet header and makes decisions according to the filter rules as to whether the packet can pass through or be dropped. Packet filtering process works at the Network layer of the Open Systems Interconnection (OSI) model, or the Internet layer of TCP/IP.

Why use ACLs

* Limits network traffic to increase network performance.

* ACLs provide traffic flow control by restricting the delivery of routing updates.

* It can be used as additional security.

* Controls which type of traffic are forwarded or blocked by the router.

* Ability to control which areas a client access.

Types of Access Control Lists

Standard access-list

Standard access lists create filters based on source addresses and are used for server based filtering. Address based access lists distinguish routes on a network you want to control by using network address number (IP). Address-based access lists consist of a list of addresses or address ranges and a statement as to whether access to or from that address is permitted or denied.

Example of the command syntax for configuring a standard numbered IP ACL:

R1(config)# access-list {1-99} {permit | deny} source-addr [source-wildcard]

i. The first value {1-99} specifies the standard ACL number range.

ii. The second value specifies whether to permit or deny the configured source IP address traffic.

iii. The third value is the source IP address that must be matched.

iv. The fourth value is the wildcard mask to be applied to the previously configured IP address to indicate the range.

Extended access lists

Extended access lists create filters based on source addresses, destination addresses, protocol, port number and other features and are used for packet based filtering for packets that traverse the network.

Example of the command syntax for configuring an extended numbered IP ACL:

Router(config)# access-list {100-199} {permit | deny} protocol source-addr [source-wildcard] [operator operand] destination-addr [destination-wildcard] [operator operand] [established]

i. Like the standard ACLs, the first value {100-199 or 2000 - 2699} specifies the ACL number range.

ii. The next value specifies whether to permit or deny according to the criteria that follows.

iii. The third value specifies protocol type (IP, TCP, UDP, or other specific IP sub-protocols). The source IP address and wildcard mask determine traffic source. The destination IP address and its wildcard mask are used to indicate the final destination of the network traffic.

When the destination IP address and mask are configured, the port number must be specified to match, either by number or by a well-known port name, otherwise all traffic to that destination will be dropped.

Standard and Extended access lists can be applied base on the use of ip access-list command.

Access lists use to deny or permit statement to define which packet is allowed or denied entry into a server or network.

Masks

Masks are used with IP addresses in IP ACLs to specify what should be permitted and denied. Masks in order to configure IP addresses on interfaces start with 255 and have the large values on the left side, for example, IP address 172.16.2.14 with a 255.255.255.0 mask. Masks for IP ACLs are the reverse, for example, mask 0.0.0.255. This is sometimes called an inverse mask or a wildcard mask. When the value of the mask is broken down into binary (0s and 1s), the results determine which address bits are to be considered in processing the traffic. A 0 indicates that the address bits must be considered (exact match); a 1 in the mask is a "no".

Note these ACL equivalents.

· The source/source-wildcard of 0.0.0.0/255.255.255.255 means "any".

· The source/wildcard of 10.1.1.2/0.0.0.0 is the same as "host 10.1.1.2".

If you subtract 255.255.255.0 (normal mask) from 255.255.255.255, it yields 0.0.0.255.

The command below defines an ACL that permits this network 192.168.1.0 0.0.0.255.

access-list acl_permit permit ip 192.168.1.0 0.0.0.255

Inbound traffic to the router is compared to access lists entries based on the order that the entries occur in the router. The router looks through the entries until it has a match. If the router found no match when it reaches the end of the list, the traffic is denied. For this reason, you should have the frequently hit entries at the top of the list. There is an implied deny for traffic that is not permitted. Single-entry access lists with only one deny entry has the effect of denying all traffic. You must have at least one permit statement in an ACL or all traffic is blocked.

Access lists implicitly deny all access that is not expressly permitted.

The following line is auto-appended to all access-lists:

deny ip any any

If it is desirable to over-ride this implicit denial statement, enter a

permit ip any any statement as the last entry in the access-list.

IS-IS

2011-03-17T12:06:00.000+05:30

IS-IS (Intermediate System-Intermediate System)

IS-IS is an Interior Gateway Protocol (IGP) meaning that it is intended for use within an administrative domain or network. It is not intended for routing between Autonomous Systems a job that is the purpose of an Exterior Gateway Protocol, such as Border Gateway Protocol (BGP).

IS-IS is a link-state routing protocol, meaning that it operates by reliably flooding topology information throughout a network of routers. Each router then independently builds a picture of the network's topology. Packets or datagrams are forwarded based on the best topological path through the network to the destination.

The main advantage of a link state routing protocol is that the complete knowledge of topology allows routers to calculate routes that satisfy particular characteristics and features.

A disadvantage of a link state routing protocol is that it does not scale well as more routers are added to the routing domain. Increasing the number of routers increases the size and frequency of the topology updates, and also the length of time it takes to calculate end-to-end routes. This lack of scalability makes a link state routing protocol unsuitable for routing across the Internet, which is the reason why IGPs only route traffic within a single AS.

Similarities between OSPF and IS-IS

They are both link state protocols and uses same algorithm (Dijkstra) for computing the best path to a network or destination.

They both support variable length subnet masks and can use multicast to discorver neighbouring router using hello packets,

They both can authenticate routing updates.

Diffrences

IS-IS can support more routers in an area than OSPF. This makes IS-IS more favoable among ISP’s environments.

IS-IS is neutral regarding the type of network addresses for which it can route. OSPF, on the other hand, was designed for IPv4. Thus IS-IS was easily adapted to support IPv6, while the OSPF protocol needed a major overhaul (OSPF v3).

IS-IS differs from OSPF in the way that "areas" are defined and routed between. In OSPF, areas are delineated on the interface such that an area border router (ABR) is actually in two or more areas at once, effectively creating the borders between areas inside the ABR, whereas in IS-IS area borders are in between routers.

BGP

2011-03-17T12:05:00.000+05:30

BGP (Border Gateway Protocol)

BGP is an Exterior Gateway Protocol (EGP), which means that it exchanges routing information between Autonomous Systems (ASs). This is different from purely IGPs(interior gateway Protocols), such as RIP, EIGRP, and OSPF, which we discussed earlier.

It uses a different basic algorithm for building a loop-free topology than any of those protocols. RIP is a distance vector protocol, OSPF is a link state protocol, and EIGRP is a distance vector protocol that incorporates many of the advantages of a link state protocol. BGP, on the other hand, uses a path vector algorithm. This means that instead of reducing each route's relative importance in the routing table to a single metric or cost value, BGP keeps a list of every AS that the path passes through. It uses this list to eliminate loops, because a router can check whether a route has already passed through a particular AS by simply looking at the path.

BGP is especially used for exchanging routing information between all of the major Internet Service Providers (ISPs), as well between larger client sites and their respective ISPs. And, in some large enterprise networks, BGP is used to interconnect different geographical or administrative regions.

Primarily to support the complexity of the public Internet, Cisco has added several clever and useful features to its BGP implementation. Some of the primary attributes of BGP is the use of pieces of information about a known route, where it came from, and how to reach it, A BGP router will also generate an error message if it receives a route that is missing these are mandatory attributes.

Whenever a router passes along a route that it has learned via BGP to another BGP router, it must include all of the well-known attributes that came with this route, including any discretionary attributes learned, Of course, the router may need to update some of these attributes before passing them along, to include itself in the path.

There are some optional attributes too; these are not necessarily supported by all BGP implementations. Optional attributes can be either transitive or non-transitive, which is specified by a special flag in the attribute type field. If a router receives a route with a transitive optional attribute, it will pass this information along intact to other BGP routers, even if it doesn't understand the option. The router will mark the Partial bit in the attribute flags to indicate that it was unable to handle this attribute, however.

OSPF

2011-03-17T12:02:00.002+05:30

OSPF (Open Shortest Path First)

OSPF Open Shortest Path First is a link-state routing protocol that was developed in 1991. In 1998, The current version of OSPF for IPv4 is OSPFv2 introduced in RFC 1247 and updated in RFC 2328 by John Moy. In 1999, OSPFv3 for IPv6 was published in RFC 2740.

OSPF was developed as a replacement for the distance vector routing protocol RIP. It operates as a classless routing protocol that uses the concept of areas for network scalability. RFC 2328 defines the OSPF metric as an arbitrary value called cost. The Cisco IOS uses bandwidth as the OSPF cost metric.

OSPF's major advantages over RIP are its fast convergence and its scalability to much larger network implementations.

OSPF has a default administrative distance of 110. As a classless routing protocol, it does not use a Transport layer protocol, as OSPF packets are sent directly over IP.

OSPF Hello Packets

The OSPF Hello packet is used to establish neighbour adjacencies. By default, OSPF Hello packets are sent :

i. Every 10 seconds on multiaccess and point-to-point segments

ii. Every 30 seconds on non-broadcast multiaccess (NBMA) segments (Frame Relay, X.25, ATM).

OSPF Dead Intervals

OSPF dead interval is measured as the period of time an OSPF router will wait before terminating adjacency with a neighbor. The Dead interval is four times the Hello interval, by default.

i. For multiaccess and point-to-point segments, this period is 40 seconds.

ii. For NBMA networks, the Dead interval is 120 seconds.

For routers to become adjacent, their Hello interval, Dead interval, Network types and subnet masks must match.

OSPF Router IDs

The OSPF router ID is used to exclusively identify each router in the OSPF routing domain. Cisco routers derive the router ID based on three criteria and with the following preference:

1. the Use of the IP address configured with the OSPF router ID command.

2. If the router ID is not configured, the router chooses highest IP address of any of its loopback interfaces.

3. If no loopback interfaces are configured, the router chooses highest active IP address of any of its physical interfaces.

OSPF Area IDs

The area ID refers to the OSPF network domain area. An OSPF area is a group of routers that share link-state information. All OSPF routers in the same domain area must have the same link-state information - received from neighbours - in their link-state databases