SHISHOLOGY

2012-02-07T03:31:00.002-05:00

CCNP 642-902 Question

access-list 101 permit tcp any any eq www - ACL to catch HTTP traffic

route-map pbr permit 10 match ip address 101 set ip next-hop 10.1.101.1

route map pbr permit 20 - Route Map that sets the next hop address to be ISP1 and permits the rest of the traffic

int fa0/0

ip policy route-map pbr - apply route map on the interface to the server

2012-01-26T05:45:00.001-05:00

Basic Networking Assessment interview and answers

What layer of the OSI reference model to bridges and switches operate.

Bridges and switches are data communications devices that operate principally at Layer 2 of the OSI reference model. As such, they are widely referred to as data link-layer devices.

What is controlled at the link layer?

Bridging and switching occur at the link layer, which controls data flow, handles transmission errors, provides physical (as opposed to logical) addressing, and manages access to the physical medium.

Under one popular classification scheme what are bridges classified as?

Local or Remote: Local bridges provide a direct connection between multiple LAN segments in the same area. Remote bridges connect multiple LAN segments in different areas, usually over telecommunications lines.

What is a switch?

Switches are data link-layer devices that, like bridges, enable multiple physical LAN segments to be interconnected into a single larger network.

Name the different areas of network management.

Configuration, accounting, fault, security, and performance.

What are the goals of performance management?

Measure and make available various aspects of network performance so that internetwork performance can be maintained at an acceptable level.

What are the goals of configuration management?

Monitor network and system configuration information so that the effects on network operation of various versions of hardware and software elements can be tracked and managed.

What are the goals of accounting management?

Measure network utilization parameters so that individual or group uses on the network can be regulated appropriately.

What are the goals of fault management?

Detect, log, notify users of, and automatically fix network problems to keep the network running effectively.

What are the goals of security management?

Control access to network resources according to local guidelines so that the network cannot be sabotaged and so that sensitive information cannot be accessed by those without appropriate authorization.

Shouldn't all 10Base-T networks just be upgraded to 100 Mbps? Why or why not?

Not necessarily-if the current 10Base-T network is repeater-based, replacing the repeaters with 10/100 nonsaturating switches would result in an automatic n times increase in the average available bandwidth for each end station.

Which 100Base version(s) are recommended? Why?

100Base-TX is recommended if the horizontal wiring is Category5 or better UTP. If the horizontal cabling is Category 3, 100BaseT4 can be used, but it may be difficult to acquire (some reports indicate that because 100Base-TX was available more than a year before T4, it captured as much as 95 percent of the market). 100Base-T2 is not available.

Which 1000Base version(s) are recommended? Where would they be used?

1000Base-T, is recommended if the horizontal cabling is Category 5 or better UTP. 1000Base-SX can be used if the horizontal cabling is multimode optical fiber, as well as for some multimode backbones. 1000Base-LX can be used for either single-mode or multimode optical fiber (see Table 7-5). 1000Base-CX can be used for short-haul equipment-room jumpers up to 25 meters.

What cable types should be used for new networks? For upgrading existing networks? Why?

New or replacement UTP links may be Category 5E or better to allow for data rate growth to 1000 Mbps. Multimode fiber may be used as indicated in Table 7-5 for 1000Base-SX, or as noted in the paragraph following Table 7-5 for 1000Base-LX. (These fibers will also provide future support for shorter distances [between 100 and 300 meters, depending on the wavelength] at 10,000 Mbps.) To be truly future-proof and to ensure that you will be able to operate longer-distance backbones, choose single-mode fiber.

How do you know when a network needs to be upgraded? Where do you start?

There are several ways:

§ Your users will tell you (but often only after they have crossed the frustration threshold).

§ Your network management system should be capable of indicating the load characteristics for each DCE port.

§ Your organization is considering adding new applications (such as multimedia) that will require more communication bandwidth.

§ Your organization is growing, and there are not sufficient DCE ports in the right locations to accommodate the additional users.

After you have determined the need, you can consider the options. Remember that the network elements with the longest useful life (the link media, followed by the network servers and network switches) can also be the most expensive to replace. Choose with an eye to future growth, and consider reusing these elements wherever possible.

Token Ring networks differ from Ethernet networks in what ways?

They are deterministic, meaning that the time before the next token will be passed can be calculated. Extra credit: There are fewer collisions on a Token Ring network than on Ethernet.

For what types of applications is this beneficial?

Applications in which delay must be predictable, and applications that require a robust network operation.

Name at least three benefits of implementing HSSI technology in a network.

Benefits include these: HSSI provides high-speed data communication over WAN and LAN links.

HSSI uses differential emitter-coupled logic (ECL), which provides high-speed data transfer with low noise levels.

HSSI uses a subminiature FCC-approved 50-pin connector that is smaller than its V.35 competitor.

The HSSI cable uses the same number of pins and wires as the Small Computer Systems Interface 2 (SCSI-2) cable, but the HSSI electrical specification is more concise.

HSSI makes bandwidth resources easy to allocate, making T3 and other broadband services available and affordable.

HSSI requires the presence of only two control signals ("DTE available" and "DCE available"), making it highly reliable because there are fewer circuits that can fail.

HSSI performs four loopback tests for reliability.

Name the four loopback tests that HSSI performs.

Cable test, DCE test, Telco line test, DTE test.

In downstream-on-demand distribution, how does the upstream LSR know that it needs a label?

The unicast routing protocols distribute the presence of a network. When the upstream LSR needs to forward a frame to the new network, it can request a label from the downstream LSR.

FIB refers to a forwarding information base. How does this differ from an LFIB?

FIB tables are developed from routing protocols such as OSPF, BGP, IS-IS, and so on. LSRs reference these tables whenever they need a label/route binding. The actual bindings are contained in the LFIB that displays destination networks/labels/interfaces in one table.

What are the two LDP modes?

One mode is downstream unsolicited distribution, in which an LSR announces a binding without any request from a neighbor LSR. The other mode is downstream-on-demand, in which an LSR requests a binding.

It is highly recommended that neighbor LSRs operate in the same LDP mode. What might result if an upstream LSR operates in downstream unsolicited distribution mode and the downstream LSR runs in downstream-on-demand mode?

This is a case in which labels would never get distributed. The upstream LSR assumes that it never needs to ask for a binding, while the downstream unit assumes that it should never create one unless explicitly requested. Neither LSR will trigger a label distribution.

If a vendor's router already uses high-speed switching and caching techniques for forwarding frames, then performance may not be a valid motivation for using MPLS. Is there any other reason that might merit deployment of MPLS in such a network?

Traffic engineering could further enhance the network by enabling an administrator to select a path between locations based on policy. The policy may take into consideration parameters such as network loading, security, and several other elements. Otherwise, the administrator leaves the path selection to the destination-based routing protocols.

Name the four key technologies that are used by EIGRP.

EIGRP employs four key technologies, including neighbor discover/recovery, Reliable Transport Protocol (RTP), Diffusing Update ALgorithm (DUAL) finite-state machine, and a modular architecture that enables support for new protocols to be easily added to an existing network.

Explain why EIGRP is more efficient in operation than IGRP.

Unlike most other distance vector routing protocols, EIGRP does not mandate a periodic update of routing tables between neighboring routers. Instead, it employs a neighbor discovery/recovery mechanism to ensure that neighbors remain aware of each other's accessibility. As long as a router receives periodic hello packets from its neighbors, it can assume that those neighbors remain functional. More importantly, it can assume that all of its routes that rely upon passage through those neighbors remain usable. Thus, EIGRP is much more efficient than conventional distance vector routing protocols because it imposes much less overhead on routers and transmission facilities during normal operation.

How does RTP enable improved convergence times?

RTP is responsible for providing guaranteed delivery of EIGRP packets between neighboring routers. However, not all of the EIGRP packets that neighbors exchange must be sent reliably. Some packets, such as hello packets, can be sent unreliably. More importantly, they can be multicast rather than having separate datagrams with essentially the same payload being discretely addressed and sent to individual routers. This helps an EIGRP network converge quickly, even when its links are of varying speeds.

Why does EIGRP tag certain routes?

EIGRP supports both internal and external routes. Routes that are internal to an AS are completely contained within that AS. External routes are those that are learned from neighbors that lie outside the AS. External routes are tagged with information that identifies their origin. This enables a network administrator to develop customized interdomain routing policies.

Can IBGP be used in place of an IGP (RIP, IGRP, EIGRP, OSPF, or ISIS)?

Yes and no. Remember that the next-hop information from EBGP is carried into IBGP. If IBGP does not have a route to reach the next hop, then the route will be discarded. Typically an IGP needs to be used to exchange routes to the next hop, but this can be achieved by using static routes on all the routers running IBGP. So, the answer is yes if you want to use and maintain static routes. Otherwise, the answer is no.

Assume that a BGP router is learning the same route from two different EBGP peers. The AS_path information from peer 1 is {2345,86,51}, and the AS_path information from peer 2 is {2346,51}. What BGP attributes could be adjusted to force the router to prefer the route advertised by peer 1?

Weight and local preference. Both have a higher preference than AS_path length.

Can BGP be used only by Internet service providers?

No. BGP can be used to scale large enterprise networks. A large network can be divided into segments, with each segment running an IGP. Routing information between segments could then be exchanged using BGP.

If a directly connected interface is redistributed into BGP, what value will the origin attribute have for this route?

Any redistributed route will have an origin of incomplete.

When using OSPF, can you have two areas attached to each other where only one AS has an interface in Area 0?

Yes, you can. This describes the use of a virtual path. One area has an interface in Area 0 (legal), and the other AS is brought up and attached off an ABR in Area 1, so we'll call it Area 2. Area 2 has no interface in Area 0, so it must have a virtual path to Area 0 through Area 1. When this is in place, Area 2 looks like it is directly connected to Area 0. When Area 1 wants to send packets to Area 2, it must send them to Area 0, which in turn redirects them back through Area 1 using the virtual path to Area 2.

Area 0 contains five routers (A, B, C, D, and E), and Area 1 contains three routers (R, S, and T). What routers does Router T know exists? Router S is the ABR.

Router T knows about routers R and S only. Likewise, Router S only knows about R and T, as well as routers to the ABR in Area 0. The AS's separate the areas so that router updates contain only information needed for that AS.

What is a VPN?

A VPN is a generic term that describes any combination of technologies that can be used to secure a connection through an otherwise unsecured or untrusted network.

Explain the difference between L2TP's LAC and LSN.

The LAC provides authentication and access concentration for remote users. After a remote user is authenticated, that user's communications session is then forwarded to the LSN, which provides access to that user's home network.

What additional functionality does IPSec offer an L2TP implementation?

L2TP's native security mechanisms build on the assumption that the nature of a point-to-point connection satisfies most of a remote user's security requirements. IPSec complements L2TP by offering a more robust set of technologies for authenticating remote users and for securing data in transit through foreign networks by encrypting data.

What is a tunnel?

A tunnel is a logical structure that encapsulates the frame and data of one protocol inside the Payload or Data field of another protocol. Thus, the encapsulated data frame may transit through networks that it would otherwise not be capable of traversing.

What are MIBs, and how are they accessed?

A Management Information Base (MIB) is a collection of information that is organized hierarchically. MIBs are accessed using a network-management protocol such as SNMP. They are comprised of managed objects and are identified by object identifiers.

SNMP uses a series of _____ and ______to manage the network.

Gets and Puts. SNMP uses a Get object and a Put object to manage devices on a network such as get counters.

Name three of the seven fields of the SNMP v2 GETBULK.

PDU Type, Request ID, Nonrepeaters, Max Repetitions, Variable Bindings (the variable bindings consists of variable object fields that make up the three remaining fields).

On what concept is network caching based?

Based on the assumption that users access the same content over and over.

What are two secondary benefits of implementing caching technology?

1. Secure access and control.

2. Operational logging-administrators can log how many hits sites receive.

Provide a brief description of network-integrated caching technology.

Network-integrated caching technology combines system-level software and hardware. Network-integrated caches must be managed like network equipment, designed like high-density hardware, and transparently inserted into the network.

How do Cisco cache engines ensure that web pages are kept up to date?

By obeying HTTP caching standards that dictate which elements on a page can be cached and which cannot. Those that are not are retrieved from the source every time they are accessed.

Name an object that can be saved in cache memory, and one that cannot.

Saved in cache: rotating banners, GIFs and JPEGs, toolbars, navigation bars. Noncacheable: CGI-generated responses.

2012-01-26T03:14:00.000-05:00

Network Skills Assessment questions and answers

Which layer of the OSI model provides translation of data?

The Presentation layer ( layer 6)

Which layers of the OSI model are not part of the TCP/IP protocol stack?

Presentation and Data Layers

Your company has routers in San Jose and Raleigh. What type of network would connect these routers?

WAN ( Wide Area Network )

Which topology uses a central device for point-to-point connections to other devices?

Star Topology

Name four WAN data-link layer protocols?

SDLC and HDLC, LAPB LAPD

Imagine that you visit a website and download a graphic image called logo.gif. The logo is 4000 bytes. Assuming an MSS of 1480 bytes, how many segments will the server send back to your browser to send you the logo?

MSS refers to the maximum amount of data that a segment can hold - it doesn't include the TCP headers. TCP will segment the data into pieces, typically no larger than 1460 bytes of data. (An mss of 1480 minus the 20 bytes of TCP header leaves 1460 bytes for the data in each segment.) To send 4000 bytes, 3 segments would be required.

Which term defines how many bits per second the service provider commits to pass over a single PVC?

commited information rate (CIR) CIR - is the average bandwidth for a virtual circuit guaranteed by an ISP to work under normal conditions.

Which protocol routes between different autonomous systems?

BGP (Border Gateway Protocol),

What is the high-order bit pattern for a Class B network?

range for class B is 128 thru 191; convert this to binary 1000 0000 -1011 1111

How many frames can pass through a 24-port switch simultaneously, without causing a collision and with full duplex used on all ports?

How many twisted pairs of wires are typically used in a leased line between two routers?

24 because on a 24 port switch, you can forward 24 frames simultaneously out individual ports without causing a collision, with full duplex, CD is turned off and you just punt frames out the port.

During path selection, name metrics that may be used by routing protocols?

§ measuring link utilisation (using SNMP)

§ number of hops (hop count)

§ speed of the path

§ packet loss (router congestion/conditions)

§ latency (delay)

§ path reliability

§ path bandwidth

§ throughput [SNMP - query routers]

§ load

§ MTU

WANs function at which two layers of the OSI model?

WAN operations focus primarily on Layer 1 and Layer 2. WAN access standards typically describe both Physical layer delivery methods and Data Link layer requirements, including physical addressing, flow control, and encapsulation.

How many TCP segments flow between two computers to establish a TCP connection?

The IP address 172.16.12.4 /26 has which subnet mask?

255.255.255.192, /26 means that two of the bits in the last octet are taken

Frame Relay relays packets at which layer of the OSI model?

Frame Relay is a packet switching and encapsulation technology that functions at the Data Link and Physical layers of the OSI model

Which of these commands can be used to load a new version of Cisco IOS software onto a router?

Copy ftp flash

What is flooding a switch?

Switch flooding is an attack that consists of two parts: one part is a denial of service attack, and the other piece (if used) is an attempt to retrieve confidential information from the switch.

In a flooding attack, the switch is flooded with multiple MAC addresses. Normally a MAC address is used to determine which port to switch the frame to, bypassing any clients that should not get the frame.

Since a switch has a limited amount of memory for storing MAC addresses the flooding attack overruns the table and causes a fail-over situation, where the frames are repeated out each port (like a hub) rather than switching to a specific port.

A malicious user with a packet sniffer could possibly be listening for confidential information to be repeated out one of the ports.

How many wires are needed for a PC to successfully send data to and receive data from another PC using an Ethernet LAN cable with RJ-45 connectors?

4, although the RJ-45 connector supports eight wires, the wires inserted in pin positions 1,2,3 and 6 are used by Ethernet for data transmission and reception

What are the Class C addresses? (Choose two.)

Class	Leading bits	Size of network number bit field	Size of rest bit field	Number of networks	Addresses per network	Start address	End address
Class A	0	8	24	128 (2⁷)	16,777,216 (2²⁴)	0.0.0.0	127.255.255.255
Class B	10	16	16	16,384 (2¹⁴)	65,536 (2¹⁶)	128.0.0.0	191.255.255.255
Class C	110	24	8	2,097,152 (2²¹)	256 (2⁸)	192.0.0.0	223.255.255.255

What are the main functions of a router?

to manage the paths along which information is forwarded within a network.

What best describes unicast traffic?

Traffic sent to one device only

What kind of physical interface does a router use to connect to a WAN link?

Serial

Router R4 has two working Ethernet interfaces, and each interface has been configured with an IP address. What is the minimum number of routes that R4 should have in its routing table?

One route for each subnet

2012-01-23T04:46:00.001-05:00

Access Control Lists

Used to specify network traffic, once you specify traffic with an ACL you can then manipulate that traffic (either allow it, deny it , limit it or use it to restrict routing updates. Once an ACL is created it has to be applied to something. Simply creating the ACL does nothing.

Why use ACLs

· Limits network traffic to increase network performance.

· ACLs provides traffic flow control by restricting the delivery of routing updates.

· It can be used as additional security.

· Controls which type of traffic are forwarded or blocked by the router.

· Ability to control which areas a client access.

Two types of ACLs

Standard (1 to 99) – defines only the source of the traffic, only for IP traffic

R1(config)# access-list {1-99} {permit | deny} source-addr [source-wildcard]

· The first value {1-99} specifies the standard ACL number range.

· The second value specifies whether to permit or deny the configured source IP address traffic.

· The third value is the source IP address that must be matched.

· The fourth value is the wildcard mask to be applied to the previously configured IP address to indicate the range.

Extended (100 to 199) – can define the source and destination , along with source and destination port numbers. Can define TCP, UDP , ICMP, ….

Router(config)# access-list {100-199} {permit | deny} protocol source-addr [source-wildcard] [operator operand] destination-addr [destination-wildcard] [operator operand] [established]

· Like the standard ACLs, the first value {100-199 or 2000 - 2699} specifies the ACL number range.

· The next value specifies whether to permit or deny according to the criteria that follows.

· The third value specifies protocol type ( IP, TCP, UDP, or other specific IP sub-protocols). The source IP address and wildcard mask determine traffic source. The destination IP address and its wildcard mask are used to indicate the final destination of the network traffic. When the destination IP address and mask are configured, the port number must be specified to match, either by number or by a well-known port name, otherwise all traffic to that destination will be dropped.

2012-01-22T23:32:00.001-05:00

VPN’s and IPSec

IPSec Basics

IPsec allows the establishment of a secure connection between two hosts, the IPSec protocol sets up a unidirectional SA(security association), because the association is unidirectional an SA is created on both ends, resulting in two SAs per IPSec tunnel.

IPSec tunnels are often used as a backup to a WAN link failure, if a p2p WAN circuit drops, an IPSec tunnel can be configured to automatically be established over the internet to the remote site, when the primary WAN circuit comes back the IPSec tunnel is disconnected.

Floating Static Routes

Configuring an IPSec tunnel to activate when a primary link drops is commonly implemented as a floating static route, the idea is to configure to IPSec VPN as a static route, but with an administrative distance higher than that of the WAN routing protocols. IF the primary route is active, the backup link is not placed into the routing table because it AD is higher. If the primary route foes down, the static route becomes active.

R1(config)#ip route prefix mask address|interface distance_value

Make sure you define a higher AD value at the end

VPN Tunnels

One of the major problems with standard IPSec sessions is that they do not support broadcast or multicast traffic. IF you want to use an IPSec VPN in an “always on” fashion, then the tunnel needs to allow routing information to pass through, dynamic routing protocols use broadcast or multicast to send hellos and updates thus there is a problem. The solution is a tunnel within a tunnel, a generic tunnel can be configured within the IPSec tunnel to allow routing protocol information in four ways:

1. DMVPM and GET VPN – both allow the creation of secure, on demand multipoint tunnels

2. Virtual Tunnel Interface(VTI) - a secure “always-on” tunnel that supports multicast traffic, this allows routing protocols to operate within it.

3. Generic Routing Encapsulation (GRE) – the most common, also the default tunnel mode. GRE tunnels support many layer 3 protocols and allow multicast traffic across the tunnel. Though they add an additional 20bytes to the IP Header as well as a 4 byte GRE tunnel header.

Branch Office Connectivity

Cisco ISR routers are often a good choice for branch sites as they support a wide variety of incoming services. In smaller offices, a single ISR may be used for both remote connectivity and inter_VLAN routing. In that case, know that an Ethernet Switch Module would be required for the ISR router.

DSL

DSL (digital Subscriber Line) can be used as a backup WAN connection to a branch office, DSL uses frequencies not used by TDM phone systems on a phone line – allowing the extra bandwidth to be used for data connectivity.
ADSL (Asymmetrical DSL) has higher downstream bandwidth than upstream while symmetric DSL have the same.

Two primary methods for pushing L2 data across a DSL line:

1. PPoE – P2P over Ethernet , most common and encapsulates PPP traffic into Ethernet frames.

2. PPoA – P2P over ATM is less common and routes PPP traffic over an ATM network between the customer and the DSL service provider.

Both options can be configured on a router to terminate the DSL connectivity. PPoE is helpful because it frees the user computers from running PPoE

2012-01-20T01:01:00.002-05:00

History of TCP/IP

In the 1960s and 1970s, many different networks were running their own

protocols and implementations. Sharing of information among these networks

soon became a problem and there was a need for a common protocol to be

developed. The Defense Advanced Research Projects Agency (DARPA) funded

the exploration of this common protocol and the ARPANET protocol suite, which

introduced the fundamental concept of layering. The TCP/IP protocol suite then

evolved from the ARPANET protocol suite and took its shape in 1978. With the

use of TCP/IP, a network was created that was mainly used by government

agencies and research institutes for the purpose of information sharing and

research collaboration.

In the early 1980s TCP/IP became the backbone protocol in multivendor networks

such as ARPANET, NFSNET and regional networks. The protocol suite was2 IP Network Design Guide

integrated into the University of California at Berkeley′ s UNIX operating system

and became available to the public for a nominal fee. From this point on TCP/IP

became widely used due to its inexpensive availability in UNIX and its spread to

other operating systems.

Today, TCP/IP provides the ability for corporations to merge differing physical

networks while giving users a common suite of functions. It allows interoperability

between equipment supplied by multiple vendors on multiple platforms, and it

provides access to the Internet.

The Internet of today consists of large international, national and regional

backbone networks, which allow local and campus networks and individuals

access to global resources. Use of the Internet has grown exponentially over the

last three years, especially with the consumer market adopting it.

So why has the use of TCP/IP grown at such a rate?

The reasons include the availability of common application functions across

differing platforms and the ability to access the Internet, but the primary reason is

that of interoperability. The open standards of TCP/IP allow corporations to

interconnect or merge different platforms. An example is the simple case of

allowing file transfer capability between an IBM MVS/ESA host and, perhaps, an

Apple Macintosh workstation.

TCP/IP also provides transport for other protocols such as IPX, NetBIOS or SNA.

For example, these protocols could make use of a TCP/IP network to connect to

other networks of similar protocol.

One further reason for the growth of TCP/IP is the popularity of the socket

programming interface, which is the programming interface between the TCP/IP

transport protocol layer and TCP/IP applications. A large number of applications

today have been written for the TCP/IP socket interface. The Request for

Comments (RFC) process, overseen by the Internet Architecture Board (IAB) and

the Internet Engineering Task Force (IETF), provides for the continual upgrading

and extension of the protocol suite.

2012-01-20T00:56:00.003-05:00

IPv6

IPv4 addresses are 32bits long and in decimal format
IPv6 are 128 bits and are in hexadecimal format, the first 64 bits of an IPv6 address are reserved for the network portion, the last 64 are for the host and the middle 16 are the subnet, IPv6 uses the / notation not the 255.255.0.0 notation. Enabling IPv6:

                                R1(config)#ipv6 unicast-routing
                                R1(config)#int G0/1
                                R1(config-if)#ipv6 address 21:1:0:20A:987E/64

Unicast – for sending traffic to a single interface, in IPv6 there are two different unicast types’ global unicast and link-local unicast

Multicast – unlike IPv4 IPv6 does not support broadcasts, instead it has being replaced with multicast, and this is used for send traffic to a group of devices

Anycast-new, allows the same address to be used on multiple devices for load balancing and redundancy, used for sending traffic to nearest interface in a group.

In IPv6 an interface can be assigned multiple addresses: unicast, link-local, loopback(::1/128), all nodes multicast (FF00::1), site-local multicast(FF02::2), solicited-nodes multicast, default route(::0)

IPv6 shorthand

Shortening IPv6 is important to understand because it makes reading and writing them easier, there are two ways to condense an IPv6 address, leading 0’s can be removed in any section:

0021:0001:0000:030A:0000:0000:0000:0987E becomes
21:1:0:30A:0:0:0:987E

And sequential sections of all zeroes can be shortened to a single double colon, though this can only be used once per address

21:1:0:30A::987E

Address assignment

3 ways devices are assigned an IP address, manual config, stateless autoconfig, using DHCPv6

Manual - Enabling IPv6:

                                R1(config)#ipv6 unicast-routing
              R1(config)#int G0/1
              R1(config-if)#ipv6 address 21:1:0:20A:987E/64

Stateless – allows a device to self-assign, for use locally without any outside info. Remember that interfaces using IPv6 will often have more than one address assigned, local-link addresses are created by starting with the prefix FE80:: and appending the devices MAC address. Link local address are not routable, used for admin. To make sure the IPv6 address is unique on the network NDP packets are used(ICMP) with the neighbour discovery process.

R1(config)#int g 1/1
R1(config-if)#ipv6 address autoconfig

IPv6 Routing

Static routes

R1(config)#ipv6 route ::/0 s1/1 - default route

R1(config)#ipv6 route 2003:2:1:A::/64 2003:2:1:F::1

To view IPv6 routes:

R1(config)#sh ipv6 route

IPv6 EIGRP

Multicast address FF02::A
messages changed using the link-local address as source, there is no network command EIGRP routing is enabled on each participating interface. Requires a Router ID, for is of an IPv4 address and is non-routable. Process starts in the shutdown state, must issue a no shut to bring it up on the router.

                R1(config)#ipv6 unicast-routing
       R1(config-rtr)#router-id ipv4address
       R1(config-rtr)#no shut
       R1(config-rtr)#exit
       R1(config)#int type number
       R1(config)#ipv6 eigrp AS

OSPFv3

Updated ver of OSPF for IPv6.
OSPFv3 uses multicast address FF02::5 and FF02::6, uses its link-local address as the source in advertisements, possible to run multiple instances of OSPFv3 on each link, a ipv4Router ID must be manually created, RID assigned will then be used to determine the DR an BDR on segment (highest wins)

                R1(config)#ipv6 router ospf 100
       R1(config-rtr)#router-id 10.10.10.1
       R1(config-rtr)#area 1 stub no-summary
       R1(config-rtr)#exit
       R1(config)#int g1/1
       R1(config-if)#ipv6 address 2003:2:1:2::1/64
       R1(config-if)#ipv6 ospf 100 area 0
       R1(config-if)#exit

       R1(config)#int g 1 /2
       R1(config-if)#ipv6 address 2003:2:1:A::1/64
       R1(configif)#ipv6 ospf 100 area 1
       R1(config)#ipv6 ospf priority 30

MP-BGP

An ipv4 address must be configured as a router ID, not done at interface level
neighbours must be first defined under router BGP and then activated under IPv6 address-family mode submode, networks and parameters also configure under IPv6 address-family mode submode

R1(config)#ipv6 unicast-routing
R1(config)#router bgp 600
R1(config-rtr)#router-id 10.10.10.10
R1(config-rtr)#neighbour 2003:76:1:1::10 remote-as 700
R1(config-rtr)#address-family ipv6 unicast
R1(config-rtr-af)#neighbour 2003:76:1:1::10 activate
R1(config-rtr-af)#network 2003:2:2::/48
R1(config-rtr-af)#exit
R1(config-rtr)#exit

Migrating to IPv6

Three options exist for the transition: dual stack, tunnelling or NAT

1. Dual Stack – involves running ipv4 alongside ipv6 on the same system

Allows servers, clients and apps to be slowly moved to ipv6, both protocols run concurrently neither communicating with each other, if both ipv4 and ipv6 are running on a server then ipv6 will be used.

                R1#config t
       R1(config)#ipv6 unicast-routing
       R1(config)#ipv6 cef
       R1(config-if)#ip address 192.168.1.1
       R1(config-if)#ipv6 address 2001:1:3:1::1/64

2. Tunnelling – allows you to encapsulate ipv6 traffic within an ipv4 header

Manual tunnels – from one router to another, source router(A) encapsulates the ipv6 traffic in ipv4 headers then forwards it to the other end of the tunnel(B). B then decapsulates the packets and forwards them on to their destination using native ipv6. Manual ipv6 tunnels are easy to configure using the tunnel mode ipv6ip command:

                RouterA(config)#int tunnel0
       RouterA(config-if)#ipv6 address 2001:2:0:7::/64
       RouterA(config-if)#tunnel source 10.1.1.1
       RouterA(config-if)#tunnel destination 10.3.3.1
       RouterA(config-if)#tunnel mode ipv6ip
       RouterA(config-if)#exit

GRE Tunnels – default tunnel, very flexible and work over most protocols. Configuration is exactly the same as Manual tunnel but you do not have to specify the tunnel mode, routing protocols can be enabled on GRE tunnel int just as if they were physical interfaces

6to4 Tunnels- similar to manual tunnels but setup the tunnel dynamically, uses 2002::/16 ipv6 address in from of the 32 bit ipv4 address of the edge router creating a 48 bit prefix. Each router on both sides of the tunnel needs a route to its peer, only support static and BGP routes. Configure then tunnel as if it was a manual tunnel using the IPv4 address as the source, do not enter a destination. The tunnel requires an ipv6 address. Use the command tunnel mode ipv6ip 6to5

3. NAT – New NAT NAT-PT allows IPv6-toIPv4 translation

Translation is unique solution because it allows ipv4 devices to communicate with ipv6 devices without the dual stack requirement. NAT-PT allows bidirectional translation services. To enable NAT-PT ipv4 to IPv6 on a router use the ipv6 nat command on each int participating in the translation, then doing as least on the NAT-PT prefix. Only traffic matching the prefix will be translated. To apply it globally on the router enter ipv6nat prefix/prefix_length in interface configuration submode. Then define the address mappings using:

Static NAT-PT:

R1(config)#ipv6 nat v6v4 source ipv6_address ipv4_address

Dynamic NAT-PT: pool of addresses created and router temporarily assigns them to hosts as they need them.

R1(config)#ipv6 nat v4v6 pool name beginning_ipv6 ending_ipv6 prefix-length
R1(config)#ipv6 nat v4v6 source list (access-list_number | Name) pool name

2012-01-19T05:31:00.002-05:00

Routing Fundamentals

Static Routes

o Manually configured on each router.

o Used when there is only a single path to a network

o When connecting to an ISP and configuring it as a default (static) route

o Failure to scale well

o Does not automatically react/recover to changes in network

o Tedious to configure

o R1(config)#ip route prefix mask address|interface [distance]

The prefix and the mask are the destination and the subnet mask. You can use address to define
to define the address of the next hop towards the destination network or specify a local router interface
that the router will use to send traffic out to the destination network. The optional distance descriptive can be used to manually define the administrative distance for the route

Static Default Routes

Most common use of static routes is for creating a default route. These are often cases when you want to forward packets that are not defined in a specific route out an interface or towards another router. Common example is when connecting to an ISP, if traffic is destined for an address range not defined within your organization then it makes sense to configure a default route towards your ISP or other organization.

R1(config)ip router 0.0.0.0 0.0.0.0 address|interface

Floating Static Routes

There are circumstances when it makes sense to use a static route as a backup to a dynamic routing protocol. In order for this to work, the default administrative distance value on the static route must be raised so it will have a lower priority than the dynamic routing protocol

Dynamic Routing

Dynamic routing protocols can dynamically respond to changes in the network, the routing protocol is configured on each router and the routers learn about both each other and remote networks.

Examples: RIP v1 & 2, EIGRP, IS-IS, OSPF, BGP

Distance Vector vs. Link State

Distance Vector, when routers run a distance vector dynamic routing protocol, they periodically send information about their known routers to their connected neighbours. This is how the router knows whether changes have been made to the network. They compare their routing table against the information they receive from their neighbours, if it matches their good. If not, they update their routing tables to reflect the changes. E.g. RIP

Link State, routers send information about the state of their links to the entire network. In this way each router understands the entire network topology and must run an algorithm every time a network changes in announced the recalculate the best routes. This makes link state routing protocols much more processor intensive.
Second major difference in link state routing is that updates are only sent when a change on a routers link occurs. This helps keep bandwidth utilization low, unlike distance vector protocols which send out reoccurring updates regardless if a change has occurred. E.g. OSPF and IS-IS

Advanced Distance Vector, title Cisco gives to EIGRP. Borrows the best attributes of both distance vector and link state. EIGRP does send periodic route information, send updates only when changes occur. EIGRP forms neighbour relationships with it directly connected peers and only updates them not the entire network.

Classful Concepts

IP routing protocols are either classful or classless and that determines how the present route information.

Classful

Classful routing protocols (RIPv1) do not include the subnet mask in routing updates. When an update is sent the packet online contains the major network information on whether it is a class A, B, or C address.
A route to network 172.16.10.0/24 would be advertised as 172.16.0.0/16 because its classful boundary is a class B address. Obviously if you have broken your major network boundaries up into smaller subnets that are more granular than the major classful boundaries, this will not work well and that’s the reason almost all modern routing protocols are classless.

Classless

Classless routing protocols (RIPv2, EIGRP, IS-IS, OSPF, EIGRP) include the subnet mask in routing updates allowing for VLSM support and supernetting.

Administrative Distance

Routers need a way of determining which path to use to a destination network if two or more routing protocols are in use and both advertise a route. Administrative distance is the answer. Cisco has assigned an AD to each routing protocol that outlines which protocol a router will prefer. The AD values can be between 0 and 255 with the lowest values being used for routing.

Connected interface	0
Static Route	1
EIGRP Summary Route	5
External BGP	20
Internal EIGRP	90
OSPF	110
IS-IS	115
RIP	120
External EIGRP	170
Internal BGP	200
Unreachable	255

	RIPv2	EIGRP	IS-IS	OSPF	BGP
Distance Vector	X	X			X
Link State			X	X
Hierarchical Topology			X	X
Automatic Summarization	X	X			X
VLSM Support	X	X	X	X	X
Convergence Time	Slow	Very Fast	Fast	Fast	Slow

2012-01-18T02:20:00.002-05:00

Subnetting (VLSM)

128	64	32	16	8	4	2	1
128	192	224	240	248	252	254	255

The table above shows the amount the network sections are split into for their subnets. So a 255.255.240.0 subnet will have networks incrementing in 16.

Eg. What valid host range is the IP address 172.17.100.124/28 a part of?
a /28 subnet is 255.255.255.240

So the last octet has network subnets that increase by 16, 172.17.100.0 then 172.17.100.16 then 172.17.100.32

So the address 172.17.100.124 is part of the 172.17.100.112 network
the first usable host is 172.17.100.112 and the broadcast address is 172.17.100.127

Network Tools and Uses

2012-01-18T01:24:00.002-05:00

Network Tools and Uses

Tool	Description
Trisul	Trisul is a Linux based 24x7 solution that allows you to track current network activity as well as carry out a variety of retrospective analysis
NatGeo	Database and collection of Perl scripts used to map IP addresses and AS numbers to geographical locations.
ScriptRoute	Network measurement and debugging system.
ScriptLogic	Dozens of network management and network monitoring tools into a single, integrated interface
TheDude	Network Monitor
OpenNMS	Network Management Application
Just For Fun Network Management System	serious NMS that can help you look after your routers, switches, servers and other network equipment.

Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment (eg. routers), computer equipment and even devices like UPSs. Most NMS programs gather SNMP data and from there can be used for monitoring. Alert emails and alarms are configured in the NMS server, usually when a server or router goes down, or when connectivity is lost.

Packet Analyzers are used to watch the traffic between two points. This is easier the more you know about the network scenario, seeing a packet sent to a 224.x.x.x address a network engineer can identify that as a multicast address and know that it may be an EIGRP hello packet or a EAPOL packet for authentication or something else.