SISCOMPC

The First Step for Success in CCNA Exam

2011-06-28T22:40:00.000+03:00

Education is indeed the cornerstone of success. It has been the stepping stone for all of us to go the distance and go the extra mile in getting the higher dream. That is why most of us are putting prime attention to the attainment of education and further learning.

We all know for a fact that progress in one’s professional career is to keep learning as continuous as possible. Another fact that we also need to consider is the fact that a higher degree in education would not be a ticket that would surely get you at the peak of your profession. Instead, valuable diplomas and certifications are what we get from these.

In the world of networking, if people in this field would want to take another step in the milestone of their career, what they need to get is a certification coming from the CCNA. This sought-after certification is an acknowledged certification in the networking world. This certificate is granted by the giant in the networking field, Cisco. And for one to attain such certification, one needs to pass the CCNA exam.

However, people who are hoping to take the exam are expected to take practice exam first for them to master the exam little by little.

CCNA certification, gained after passing such exam, is very helpful for a person to gain various skills. Among all the skills that one will get from this is the basic knowledge of networking. Not only that, such person will also be well-versed in the knowledge of hubs, ISO-ISO models, and switches. Since we are talking about networking, person will also be able to learn different kinds of networks. Concentration of the different protocols utilized in the field of networking is also offered by this course. In this kind of practice exam too, aspects that are related to networking and routing processes are also thought.

Network-related companies are among the companies in which the CCNA certification has high regards since it covers installation of different devices used for connecting like the switches and hubs and roughly all the vital aspects of networking like protocols. With these scenarios, we can really say that taking such exam is very difficult but with the proper preparation for the exam through the practiced examination, one will have a greater chance of passing the exam. Of course, the preparation would entail acquaintance for the course’s syllabus, the books that offer such content and websites that offer tips to pass the exam.

Further, one is expected to attend as many practice exam for CCNA before plunging in the actual exam for CCNA. This is such because there are many considerations that must be considered first before taking the exam. If you are going to attend mock exams, you are likely to earn ideas on the prospective questions that might be asked in the actual exam. Not only that, you would be able to maintain also you time which is also your main concern in taking such exam.

Integrated Services Digital Network

2011-06-28T10:38:00.001+03:00

ISDN is a circuit-switched service provided by telecommunications providers to allow voice, data, and video and audio transmissions over existing digital telephone lines. ISDN is often used as a low cost alternative to Frame Relay or T1 connections while still offering a higher connection speed than an analog modem. ISDN service is offered at two levels: Basic Rate Interface (BRI) and Primary Rate Interface (PRI). BRI is typically used in small offices or for home connections, and PRI is used in larger environments because it provides higher bandwidth. ISDN also supports any of the Network layer protocols supported by the Cisco Internetwork Operating System and encapsulates other WAN services such as Point-to-Point Protocol

Teleco providers offer digital connections via ISDN as channels, BRI connections offer three channels: two at 64Kbps and one at 16Kbps for a maximum throughput of 128Kbps. The 64K channels are known as bearer or B-channels because they carry the data for the connection. ISDN BRI connections use the 16Kbps signaling channel, which is also called the D-channel, to control the communications on the link. PRI connections offer 23 B-channels and one 64Kbps D-channel for a bit rate of up to 1.544Mbps. European ISDN PRI service offers 30 64Kbps B-channels and one 64Kbps D-channel yielding a total interface rate of 2.048Mbps. In both ISDN BRI and PRI, a single D-channel is used for signaling information, and the B-channels are used to carry the data. Because the control communications are conducted on a channel that is separate from the data transfer, ISDN is said to be out of band signaling.

ISDN can be used to:

Add bandwidth for telecommuting.
Improve Internet response times.
Carry multiple Network layer protocols.
Encapsulate other WAN services.

Configuring ISDN on Cisco Routers

Accessing ISDN with a Cisco router means that you will need to purchase either a Cisco router with a built-in NT1 (U reference point) or an ISDN modem (called a TA). If your router has a BRI interface (called a TE1), you only need attach an NT1 device to connect to the services. If your router doesn't have a BRI interface (called a TE2), you need to attach a TA and a NT1 to connect to ISDN services.

ISDN supports virtually every upper layer protocol (IP, IPX, AppleTalk), and you can choose PPP, HDLC, or X.25 as the encapsulation protocol.

ISDN Switch Types

To configure a router for the variety of switches it's going to connect to, use the command:

Router(config)#isdn switch-type [identifier]

Supported Switch Types
Identifier	Description
basic-nil	AT&T basic rate switches
basic-5ess	AT&T 5ESS basic rate switches
basic-dms100	Nortel DMS-100 basic rate switches
basic-4ess	AT&T 4ESS primary rate switches
primary-5ess	AT&T 5ESS primary rate switches
primary-dms100	Nortel DMS-100 primary rate switches
vn2	French VN2 ISDN switches
vn3	French VN3 ISDN switches
ntt	Japanese NTT ISDN switches
basic-1tr6	German 1TR6 ISDN switches

Service Profile Identifiers (SPIDs)

A service profile identifier (SPID) is a number provided by the ISDN carrier to identify the line configuration of the BRI service. SPIDs allow multiple ISDN devices, such as voice and data, to share the local loop. Each SPID points to line setup and configuration information. SPIDs are frequently referred to as ISDN phone numbers because their functions are the same. An ISDN device can access each ISDN channel via its SPID number. You can configure the router to utilize a single or multiple SPIDs when making a connection to the ISDN provider.

When a device attempts to connect to the ISDN network, it performs a D channel Layer 2 initialization process that causes a TEI to be assigned to the device. The device then attempts D channel Layer 3 initialization. If SPIDs are necessary but not configured or configured incorrectly on the device, the Layer 3 initialization fails, and the ISDN services cannot be used.

The ISDN provider must assign the SPID numbers for each channel, which is usually an 8 to 14 digit number. There is no standard format for SPID numbers. As a result, SPID numbers vary depending on the switch vendor and the carrier. You can then use those numbers to configure your ISDN dialer connections. You must also identify the type of switch that is used at the CO to which you are connecting. The following commands show an ISDN BRI connection (two SPIDS for 2 B-channels):

Router3(config)#isdn switch-type dms-100

Router3(config)#interface bri 0

Router3(config-if)#isdn spid1 52069145231010

Router3(config-if)#isdn spid2 52069145241010

If you want your Cisco router to answer incoming calls over your ISDN line, you can configure an ISDN subaddress by specifying the local directory number (LDN), which is the seven-digit number assigned by the service provider and used for call routing. The LDN is not necessary for establishing ISDN-based connections, but it must be specified if you want to receive incoming calls on B channel 2. The LDN is required only when two SPIDs are configured (for example, when connecting to a DMS or NI1 switch). Each SPID is associated with an LDN. Configuring the LDN causes incoming calls to B channel 2 to be answered properly. If the LDN is not configured, incoming calls to B channel 2 may fail. The following commands configure LDNs for an ISDN BRI link:

Router3(config)#interface bri0

Router3(config-if)#isdn spid1 0835866201 8358662

Router3(config-if)#isdn spid2 0835866401 8358664

Configure Called Party Number Verification

When multiple devices are attached to an ISDN BRI, you can ensure that only a single device answers an incoming call by verifying the number or subaddress in the incoming call against the device's configured number or subaddress or both. You can specify that the router verify a called-party number or subaddress number in the incoming setup message for ISDN BRI calls, if the number is delivered by the switch. You can do so by configuring the number that is allowed. To configure verification, use the following command in interface configuration mode:

isdn answer1 [called-party-number][:subaddress]

Verifying the called-party number ensures that only the desired router responds to an incoming call. If you want to allow an additional number for the router, you can configure it, too. To configure a second number to be allowed, use the following command in interface configuration mode:

isdn answer2 [called-party-number][:subaddress]

Dial on Demand Routing (DDR)

Dial-on-demand routing (DDR), is used to allow two or more Cisco routers to dial an ISDN dial-up connection on an as-needed basis. DDR is only used for low-volume, periodic network connections using either a PSTN or ISDN. This was designed to reduce WAN cost if you have to pay on a per-minute or per-packet basis. DDR configuration commands define host and ISDN connection information. An access list and DDR dialer group define what kind of traffic should initiate an ISDN call. You can configure multiple access lists to look for different types of interesting traffic. Interesting traffic is traffic that (when it arrives at the router) triggers the router to initiate the ISDN connection.

When a router notices interesting traffic, it refers to its ISDN information and initiates setup of the ISDN call through its BRI or PRI and NT1 devices. When a connection is established, normal routing occurs between the two end devices. After interesting traffic stops being transmitted over the ISDN connection, the connection idle timer begins. When the idle timer expires, the connection is terminated.

Steps of how DDR works

Route to the destination network is determined.
Interesting packet dictates a DDR call.
Dialer information is looked up and connection is made.
Traffic is transmitted.
Call is terminated when no more traffic is being transmitted over a link and the idle-timeout period ends.

Configuring a DDR connection

Router3(config-if)#dial wait-for-carrier time 15

Router3(config-if)#dialer idle-timeout 300

Router3(config-if)#dialer load-threshold 50 either

Router3(config-if)#dialer map ip 192.168.52.1 name CORP speed 56 5205551212

The first command tells the dialer to wait no longer that 15 seconds for the ISDN provider to answer during a DDR connection attempt. The second command tells the dialer to hang-up the connection if the connection does not pass any interesting information for 300 seconds (default is 120 seconds). The third command tells the dialer to only dial additional lines (assuming you have configured multiple ISDN channels for the connection) when any channel is transferring at 50% of the available bandwidth, either inbound or outbound. The fourth command maps the dialer to a specific hostname (CORP), IP address (192.168.52.1), speed (56Kbps, default is 64Kbps if not specified), and phone number (5205551212).

Dialer Map Entries

Dialer map statements relate upper layer addresses to their associated phone numbers.

Specifying Interesting Traffic

In order to define what type of traffic is considered interesting and will in turn bring up the ISDN line, you must use dialer group commands. The following commands show how to use a dialer group and access lists to permit IP traffic on your link, but deny IGRP traffic. The dialer list global configuration command defines the interesting packets, and the dialer group command sets the access list on the BRI interface.

Router3(config)#dialer-list 1 protocol ip list 110

Router3(config)#access-list 110 deny igrp any any

Router3(config)#access-list 110 permit ip any any

Router3(config)#int bri0

Router3(config-if)#dialer-group 1

Access lists are used in ISDN connections to prevent specified traffic from initiating a connection. To control connections, traffic that is desired on the ISDN connection is allowed while everything else is denied.

Encapsulation Methods

When a clear Data Link is established between two DDR peers, internetworking datagrams must be encapsulated and framed for transport across the Dialer media. The encapsulation methods available depend on the physical interface being used. Cisco supports the following encapsulations for DDR:

PPP -- is the recommended encapsulation method because it supports multiple protocols and is used for synchronous, asynchronous, or ISDN connections. In addition, PPP performs address negotiation and authentication and is supported by multiple vendors.
HDLC -- is supported on synchronous serial lines and ISDN connections only. HDLC supports multiple protocols, but it doesn't provide authentication.
SLIP -- works on asynchronous interfaces only, and is supported by IP only. Addresses must be configured manually, it doesn't provide authentication, and is interoperable only with other vendors that use SLIP.
X.25 -- is supported on synchronous serial lines and a single ISDN B channel.

PPP Authentication

Password Authentication Protocol (PAP)
PAP provides a simple method for a remote node to establish its identity using a two-way handshake. This is done only upon initial link establishment. After the PPP link establishment phase is complete, a username/password pair is repeatedly sent by the remote node until authentication is acknowledged, or the connection is terminated.

Passwords are sent across the link in plain text and there is no protection from playback or trail-and-error attacks. The remote node is in control of the frequency and timing of the login attempts. If the local host rejects the username/password, the connection is terminated.

Challenge and Handshake Protocol (CHAP)
CHAP is used to periodically verify the identity of the remote node using a 3-way handshake. This is done upon initial link establishment and can be repeated any time after the link has been established. After the PPP link establishment phase is complete, the host sends a challenge messages to the remote node. The remote node responds with a value calculated using a one-way hash function (typically MD5). The host checks the response against its own calculation of the expected hash value. If the values match, the authentication is acknowledged. Otherwise, the connection is terminated.

CHAP provides protection against playback attack through the use of a variable challenge value that is unique and unpredictable. The use of repeated challenges is intended to limit the time of exposure to any single attack. The host is in control of the frequency and timing of the challenges.

ISDN Configuration Example

This is an example of a connection between a corporate headquarters and a remote site over a BRI ISDN link.

Remote Network

Router Configuration:
Name:REMOTE
E0 IP address:192.168.24.1
Local Network:192.168.24.0
BRI 0 IP address:192.168.49.2

REMOTE(config)#hostname corp password 123pass332

REMOTE(config)#isdn switch-type dms-100

REMOTE(config)#interface bri 0

REMOTE(config-if)#encapsulation ppp

REMOTE(config-if)#ppp authentication chap

REMOTE(config-if)#spid1 5208881111 5270936

REMOTE(config-if)#spid2 5208881212 5270956

REMOTE(config-if)#ip address 192.168.49.2 255.255.255.0

REMOTE(config-if)#dialer idle-timeout 600

REMOTE(config-if)#dialer map ip 192.168.49.1 name corp 7045551212

REMOTE(config-if)#dialer load-threshold 125 either

REMOTE(config-if)#ppp multilink

REMOTE(config-if)#dialer-group 1

REMOTE(config-if)#exit

REMOTE(config)#dialer-list 1 protocol ip permit

REMOTE(config)#ip route 0.0.0.0 0.0.0.0 192.168.49.1

REMOTE(config)#ip route 192.168.49.0 255.255.255.0 192.168.49.1

Corporate network

Router Configuration:
Name:CORP
BRI 1 IP address:192.168.49.1

CORP(config)#hostname remote password 123pass332

CORP(config)#isdn switch-type dms-100

CORP(config)#interface bri 1

CORP(config-if)#encapsulation ppp

CORP(config-if)#ppp authentication chap

CORP(config-if)#spid1 7047773333 5265933

CORP(config-if)#spid2 7047774444 5265944

CORP(config-if)#ip address 192.168.49.1 255.255.255.0

CORP(config-if)#dialer idle-timeout 600

CORP(config-if)#dialer map ip 192.168.49.2 name remote 5205551212

CORP(config-if)#dialer load-threshold 125 either

CORP(config-if)#ppp multilink

CORP(config-if)#dialer-group 1

CORP(config-if)#exit

CORP(config)#ip route 192.168.24.0 255.255.255.0 192.168.49.2

CORP(config)#dialer-list 1 protocol ip list 110

CORP(config)#access-list 110 deny igrp any any

CORP(config)#access-list 110 permit ip any any

The routers are both using PPP encapsulation and CHAP authentication. The username has been set for the opposite router in each configuration and the password is the same on both. Each router has the ability to dial the other. The CORP router is located at the corporate network, which has other connections and uses IGRP to transfer routing tables on the corporate network. However, IGRP is not desired on the ISDN connection, so the CORP router has an access list specifically denying IGRP on the ISDN link. Both routers permit all IP traffic on the ISDN link and all IP traffic will be considered interesting or worth activating the ISDN link for. Multilink is enabled on both routers, and they will dial their additional lines when there is 50% (load-threshold uses a number between 1 and 255, with 255 being 100%) or more utilization on the first channel. The link will be terminated if there is no interesting traffic for 600 seconds (10 minutes). The IP routes are configured such that all traffic destined from the corporate network to 192.168.24.0 will be sent to the REMOTE router. Since the REMOTE router is a remote branch with no other connections, all traffic that is not specifically destined for 192.168.24.0 will be sent to the CORP router. Note that each router has its dialer mapped to the IP address of the other router.

Monitoring ISDN

All commands are available via privileged EXEC mode prompt (enable mode)

clear interface bri [#] --- Resets the counters and terminates the connection.
show dialer --- Reports information regarding the DDR connection including the number dialed, the success of the connection, the idle timers, and the number of calls that were rejected due to administrative policy.
show ip route --- Show all routes the router knows about.
show isdn active --- Displays the status of the ISDN connection while the call is in progress.
show isdn status --- Gives status information for ISDN connections.
show interface bri 0 --- Shows you the configuration statistics and speed of your ISDN BRI interface.
show controllers bri 0 --- Shows detailed information about the B and D channels.
debug dialer --- Shows information regarding the cause of a dialing connection and the status of the connection.
debug bri --- Provides information about the B channels of the BRI.
debug isdn q921 --- Used to see layer-2 information. Shows information regarding the D-channel interface. The D-channel is always connected. Connections over the B-channel can't occur without signaling over the D-channel.
debug isdn q931 --- Shows the call setup and teardown. Output can be used to verify acknowledgments and messages. [layer 3 on D-channel]
no debug all --- Use to turn off all debugging.

Lab Practices 6 - OSPF

2011-06-27T15:43:00.000+03:00

Open Shortest Path First (OSPF) Protocol Configuration

Router(config)# router ospf process_ID
Router(config-router)# network network_id wildcard_mask area area_#

Note:

Process id: A value in the range 1–65,535 identifies the OSPF Process ID. OSPF Process ID is a unique number on this router that groups a series of OSPF configuration commands under a specific running process.

Wildcard Mask: The wildcard mask (wildcard_mask) given above is the inverse mask of the subnet mask. A 0 octet in the wildcard mask indicates that the corresponding octet in the network must match exactly. On the other hand, a 255 indicates that you don’t care what the corresponding octet is in the network number. A network and wildcard mask combination of 192.168.10.0 0.0.0.0 would match 192.168.10.0 only, and nothing else.

Area Number: The area_# given above is the Area Number. Area Number can always be zero (0) for small networks, but for larger networks, the Area Number need to be properly planned as all routing updates must traverse Area 0.

Open Shortest Path First (OSPF) Protocol -Lab Practice

The following diagram shows our lab setup. We have three routers, three switches and three hosts connected as below. The host names, IP addresses and the interfaces of the routers are shown in diagram. The IP addresses of the hosts are also shown in the diagram.

Hostname and IP address configuration in Router01

Connect to Router01 console and use the following IOS commands to configure host name as Router01.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Router01
Router01(config)#

Use the following IOS commands to open the fast ethernet interface Fa0/0 configuration mode on Router01 and configure IP address as 172.16.0.1/16.

Router01>enable
Router01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router01(config)#interface fa0/0
Router01(config-if)#ip address 172.16.0.1 255.255.0.0
Router01(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/0 configuration mode on Router01 and configure IP address as 172.17.0.1/16. You have to set a clock rate also using the "clock rate" command on S0/0 interface, since this is the DCE side.

Router01>enable
Router01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router01(config)#interface s0/0
Router01(config-if)#clock rate 64000
Router01(config-if)#ip address 172.17.0.1 255.255.0.0
Router01(config-if)#no shutdown

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Hostname and IP address configuration in Router02

Connect to Router02 console and use the following IOS commands to configure host name as Router02.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Router02
Router02(config)#

Use the following IOS commands to open the fast ethernet interface Fa0/0 configuration mode on Router02 and configure IP address as 172.18.0.1/16.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#interface fa0/0
Router02(config-if)#ip address 172.18.0.1 255.255.0.0
Router02(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/0 configuration mode on Router02 and configure IP address as 172.17.0.2/16.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#interface s0/0
Router02(config-if)#ip address 172.17.0.2 255.255.0.0
Router02(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/1 configuration mode on Router02 and configure IP address as 172.19.0.1/16. You have to set a clock rate also using the "clock rate" command on S0/1 interface, since this is the DCE side.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#interface s0/1
Router02(config-if)#clock rate 64000
Router02(config-if)#ip address 172.19.0.1 255.255.0.0
Router02(config-if)#no shutdown

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Hostname and IP address configuration in Router03

Connect to Router03 console and use the following IOS commands to configure host name as Router03.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Router03
Router03(config)#

Use the following IOS commands to open the fast ethernet interface Fa0/0 configuration mode on Router03 and configure IP address as 172.20.0.1/16.

Router03>enable
Router03#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router03(config)#interface fa0/0
Router03(config-if)#ip address 172.20.0.1 255.255.0.0
Router03(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/1 configuration mode on Router03 and configure IP address as 172.19.0.2/16.

Router03>enable
Router03#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router03(config)#interface s0/1
Router03(config-if)#ip address 172.19.0.2 255.255.0.0
Router03(config-if)#no shutdown

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Open Shortest Path First (OSPF) Protocol configuration in Router01

Connect to Router01 console and use the following IOS commands to configure Open Shortest Path First (OSPF) Protocol in Router01. Please refer the beginning of this lesson to view the Open Shortest Path First (OSPF) Protocol configuration IOS commands.

Using the IOS "network" command, as shown below, we specify only the directly connected networks of this router.

Router01>enable
Router01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router01(config)#router ospf 1
Router01(config-router)#network 172.16.0.0 0.0.255.255 area 0
Router01(config-router)#network 172.17.0.0 0.0.255.255 area 0
Router01(config-router)#exit
Router01(config)#exit
Router01#

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Open Shortest Path First (OSPF) Protocol configuration in Router02

Connect to Router02 console and use the following IOS commands to configure Open Shortest Path First (OSPF) Protocol in Router02. Please refer the beginning of this lesson to view the Open Shortest Path First (OSPF) Protocol configuration IOS commands.

Using the IOS "network" command, as shown below, we specify only the directly connected networks of this router.

Router02>
Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#router ospf 1
Router02(config-router)#network 172.17.0.0 0.0.255.255 area 0
Router02(config-router)#network 172.18.0.0 0.0.255.255 area 0
Router02(config-router)#network 172.19.0.0 0.0.255.255 area 0
Router02(config-router)#exit
Router02(config)#exit

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Open Shortest Path First (OSPF) Protocol configuration in Router03

Connect to Router03 console and use the following IOS commands to configure Open Shortest Path First (OSPF) Protocol in Router03. Please refer the beginning of this lesson to view the Open Shortest Path First (OSPF) Protocol configuration IOS commands.

Using the IOS "network" command, as shown below, we specify only the directly connected networks of this router.

Router03>enable
Router03#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router03(config)#router ospf 1
Router03(config-router)#network 172.19.0.0 0.0.255.255 area 0
Router03(config-router)#network 172.20.0.0 0.0.255.255 area 0
Router03(config-router)#exit
Router03(config)#exit
Router03#

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

How to view the routing table in Router01

After the initial configuration and Open Shortest Path First (OSPF) Protocol configuration in all routers, we can use the "show ip route" to view the routing table in Router01, as shown below.

Router01>enable
Router01#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

C 172.16.0.0/16 is directly connected, FastEthernet0/0
C 172.17.0.0/16 is directly connected, Serial0/0
O 172.18.0.0/16 [110/65] via 172.17.0.2, 00:26:31, Serial0/0
O 172.19.0.0/16 [110/128] via 172.17.0.2, 00:26:21, Serial0/0
O 172.20.0.0/16 [110/129] via 172.17.0.2, 00:24:54, Serial0/0

The "O" character at the beginning of a line in routing table shows that it is a route discovered by Open Shortest Path First (OSPF) Protocol and "C" character shows that it is a directly connected network.

How to view the routing table in Router02

After the initial configuration and Open Shortest Path First (OSPF) Protocol configuration in all routers, we can use the "show ip route" to view the routing table in Router02, as shown below.

Router02>enable
Router02#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

O 172.16.0.0/16 [110/65] via 172.17.0.1, 00:30:20, Serial0/0
C 172.17.0.0/16 is directly connected, Serial0/0
C 172.18.0.0/16 is directly connected, FastEthernet0/0
C 172.19.0.0/16 is directly connected, Serial0/1
O 172.20.0.0/16 [110/65] via 172.19.0.2, 00:28:08, Serial0/1

How to view the routing table in Router03

After the initial configuration and Open Shortest Path First (OSPF) Protocol configuration in all routers, we can use the "show ip route" to view the routing table in Router03, as shown below.

Router03>enable
Router03#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

O 172.16.0.0/16 [110/129] via 172.19.0.1, 00:29:43, Serial0/1
O 172.17.0.0/16 [110/128] via 172.19.0.1, 00:29:43, Serial0/1
O 172.18.0.0/16 [110/65] via 172.19.0.1, 00:29:43, Serial0/1
C 172.19.0.0/16 is directly connected, Serial0/1
C 172.20.0.0/16 is directly connected, FastEthernet0/0

Verify the connectivity between networks using the ping command

To verify the Open Shortest Path First (OSPF) Protocol routes and the connectivity between networks, run the ping command from Host01 (IP address: 172.16.0.10/16) to Host03 (IP address: 172.20.0.10/16).

C:\>ping 172.20.0.10

Pinging 172.20.0.10 with 32 bytes of data:

Reply from 172.20.0.10: bytes=32 time=172ms TTL=125
Reply from 172.20.0.10: bytes=32 time=188ms TTL=125
Reply from 172.20.0.10: bytes=32 time=157ms TTL=125
Reply from 172.20.0.10: bytes=32 time=188ms TTL=125

Ping statistics for 172.20.0.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 157ms, Maximum = 188ms, Average = 176ms

The ping reply from Host03 (IP address: 172.20.0.10/16) shows that the Open Shortest Path First (OSPF) Protocol is configured well in three routers and there is network connectivity between different networks.

Lab Practices 5 - IGRP

2011-06-27T15:32:00.000+03:00

Interior Gateway Routing Protocol (IGRP) can be configured in a router using the following IOS commands. If you have a new router with a latest IOS release, you may not find Interior Gateway Routing Protocol (IGRP) configuration commands because Interior Gateway Routing Protocol (IGRP) is removed from new IOS releases.

Router(config)# router igrp ASN
Router(config-router)# network Network_ID

ASN in the above IOS command stands for Autonomous System Number.

The following diagram shows our lab setup. We have three routers, three switches and three hosts connected as below. The host names, IP addresses and the interfaces of the routers are shown in diagram. The IP addresses of the hosts are also shown in the diagram.

Hostname and IP address configuration in Router01

Connect to Router01 console and use the following IOS commands to configure host name as Router01.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Router01
Router01(config)#

Use the following IOS commands to open the fast ethernet interface Fa0/0 configuration mode on Router01 and configure IP address as 172.16.0.1/16.

Router01>enable
Router01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router01(config)#interface fa0/0
Router01(config-if)#ip address 172.16.0.1 255.255.0.0
Router01(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/0 configuration mode on Router01 and configure IP address as 172.17.0.1/16. You have to set a clock rate also using the "clock rate" command on S0/0 interface, since this is the DCE side.

Router01>enable
Router01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router01(config)#interface s0/0
Router01(config-if)#clock rate 64000
Router01(config-if)#ip address 172.17.0.1 255.255.0.0
Router01(config-if)#no shutdown

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Hostname and IP address configuration in Router02

Connect to Router02 console and use the following IOS commands to configure host name as Router02.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Router02
Router02(config)#

Use the following IOS commands to open the fast ethernet interface Fa0/0 configuration mode on Router02 and configure IP address as 172.18.0.1/16.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#interface fa0/0
Router02(config-if)#ip address 172.18.0.1 255.255.0.0
Router02(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/0 configuration mode on Router02 and configure IP address as 172.17.0.2/16.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#interface s0/0
Router02(config-if)#ip address 172.17.0.2 255.255.0.0
Router02(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/1 configuration mode on Router02 and configure IP address as 172.19.0.1/16. You have to set a clock rate also using the "clock rate" command on S0/1 interface, since this is the DCE side.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)#interface s0/1
Router02(config-if)#clock rate 64000
Router02(config-if)#ip address 172.19.0.1 255.255.0.0
Router02(config-if)#no shutdown

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Hostname and IP address configuration in Router03

Connect to Router03 console and use the following IOS commands to configure host name as Router03.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Router03
Router03(config)#

Use the following IOS commands to open the fast ethernet interface Fa0/0 configuration mode on Router03 and configure IP address as 172.20.0.1/16.

Router03>enable
Router03#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router03(config)#interface fa0/0
Router03(config-if)#ip address 172.20.0.1 255.255.0.0
Router03(config-if)#no shutdown

Use the following IOS commands to open the serial interface S0/1 configuration mode on Router03 and configure IP address as 172.19.0.2/16.

Router03>enable
Router03#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router03(config)#interface s0/1
Router03(config-if)#ip address 172.19.0.2 255.255.0.0
Router03(config-if)#no shutdown

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Interior Gateway Routing Protocol (IGRP) configuration in Router01

Connect to Router01 console and use the following IOS commands to configure Interior Gateway Routing Protocol (IGRP) in Router01. Please refer the beginning of this lesson to view the Interior Gateway Routing Protocol (IGRP) configuration IOS command.

In the IOS "network" command, shown below, we specify only the directly connected networks of this router.

Router01>enable
Router01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router01(config)# router igrp 1
Router01(config-router)# network 172.16.0.0
Router01(config-router)# network 172.17.0.0
Router01(config-router)#exit
Router01(config)#exit
Router01#

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Interior Gateway Routing Protocol (IGRP) configuration in Router02

Connect to Router02 console and use the following IOS commands to configure Interior Gateway Routing Protocol (IGRP) in Router02. Please refer the beginning of this lesson to view the Interior Gateway Routing Protocol (IGRP) configuration IOS command.

In the IOS "network" command, shown below, we specify only the directly connected networks of this router.

Router02>enable
Router02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router02(config)# router igrp 1
Router02(config-router)# network 172.17.0.0
Router02(config-router)# network 172.18.0.0
Router02(config-router)# network 172.19.0.0
Router02(config-router)#exit
Router02(config)#exit
Router02#

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

Interior Gateway Routing Protocol (IGRP) configuration in Router03

Connect to Router03 console and use the following IOS commands to configure Interior Gateway Routing Protocol (IGRP) in Router03. Please refer the beginning of this lesson to view the Interior Gateway Routing Protocol (IGRP) configuration IOS command.

In the IOS "network" command, shown below, we specify only the directly connected networks of this router.

Router03>enable
Router03#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router03(config)# router igrp 1
Router03(config-router)# network 172.19.0.0
Router03(config-router)# network 172.20.0.0
Router03(config-router)#exit
Router03(config)#exit
Router03#

Do remember to run the "copy running-config startup-config" command from enable mode, if you want to save the changes you have made in the router.

How to view the routing table in Router01

After the network is converged after the initial configuration and Interior Gateway Routing Protocol (IGRP) configuration, we can use the "show ip route" to view the routing table in Router01, as shown below.

Router01>enable
Router01#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

C 172.16.0.0/16 is directly connected, FastEthernet0/0
C 172.17.0.0/16 is directly connected, Serial0/0
I 172.18.0.0/16 [120/1] via 172.17.0.2, 00:00:22, Serial0/0
I 172.19.0.0/16 [120/1] via 172.17.0.2, 00:00:22, Serial0/0
I 172.20.0.0/16 [120/2] via 172.17.0.2, 00:00:22, Serial0/0

The "I" character at the beginning of a line in routing table shows that it is a route discovered byInterior Gateway Routing Protocol (IGRP) and "C" character shows that it is a directly connected network.

How to view the routing table in Router02

When the network is converged after the initial configuration and Interior Gateway Routing Protocol (IGRP) configuration, we can use the "show ip route" to view the routing table in Router02, as shown below.

Router02>enable
Router02#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

I 172.16.0.0/16 [120/1] via 172.17.0.1, 00:00:07, Serial0/0
C 172.17.0.0/16 is directly connected, Serial0/0
C 172.18.0.0/16 is directly connected, FastEthernet0/0
C 172.19.0.0/16 is directly connected, Serial0/1
I 172.20.0.0/16 [120/1] via 172.19.0.2, 00:00:20, Serial0/1

The "I" character at the beginning of a line in routing table shows that it is a route discovered by Interior Gateway Routing Protocol (IGRP) and "C" character shows that it is a directly connected network.

How to view the routing table in Router03

Router03>enable
Router03#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is not set

I 172.16.0.0/16 [120/2] via 172.19.0.1, 00:00:02, Serial0/1
I 172.17.0.0/16 [120/1] via 172.19.0.1, 00:00:02, Serial0/1
I 172.18.0.0/16 [120/1] via 172.19.0.1, 00:00:02, Serial0/1
C 172.19.0.0/16 is directly connected, Serial0/1
C 172.20.0.0/16 is directly connected, FastEthernet0/0

The "I" character at the beginning of a line in routing table shows that it is a route discovered by Interior Gateway Routing Protocol (IGRP) and "C" character shows that it is a directly connected network.

Verify the connectivity between networks using the ping command

To verify the Interior Gateway Routing Protocol (IGRP) routes and the connectivity between networks, run the ping command from Host01 (IP address: 172.16.0.10/16) to Host03 (IP address: 172.20.0.10/16).

C:\>ping 172.20.0.10

Pinging 172.20.0.10 with 32 bytes of data:

Reply from 172.20.0.10: bytes=32 time=172ms TTL=125
Reply from 172.20.0.10: bytes=32 time=188ms TTL=125
Reply from 172.20.0.10: bytes=32 time=157ms TTL=125
Reply from 172.20.0.10: bytes=32 time=188ms TTL=125

Ping statistics for 172.20.0.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 157ms, Maximum = 188ms, Average = 176ms

The ping reply from Host03 (IP address: 172.20.0.10/16) shows that the Interior Gateway Routing Protocol (IGRP) is configured well in three routers and there is network connectivity between different networks.

Lab Practice 4 - Frame Relay

2011-06-27T14:33:00.002+03:00

In this second CCNA TechLab you will learn how to configure a simple frame relay network. Frame relay is a layer 1 and 2 protocol used for WAN connection. It is used by many companies to provide links between branch offices and the company headquarters.

If you haven’t already, set up the router's basic configuration (hostname, passwords, telnet access, etc.) If don't know how to do these things then refer to the TechLab "Configuring a RIP network". Here is our example network:

CONFIGURING THE FRAME RELAY SWITCH

First we will configure the frame relay switch (in my lab the 2520). It has links to all of the endpoints via back-to-back serial cables. It will be the DCE for all connections.

STEP 1. Change the router's name to frame-switch

Enter configuration mode by using the following command:
Router# configure terminal

Change the host name of the router to frame-switch by using the following command:
Router(config)# hostname frame-switch
frame-switch(config)#

STEP 2. Enable the router to become a frame-relay switch

Configure the router to act as a frame relay switch by using the following command:
frame-switch(config)# frame-relay switching

STEP 3. Configure the frame relay switch's interfaces

Enter interface configuration mode for the first connected serial interface, e.g. serial 0:
frame-switch(config)# interface serial 0

Remove the IP address:
frame-switch(config-if)# no ip address

Set the clock rate to 64000:
frame-switch(config-if)# clock rate 64000

Set the encapsulation type to Frame Relay:
frame-switch(config-if)# encapsulation frame-relay

Set the LMI type to ANSI:
frame-switch(config-if)# frame-relay lmi-type ansi

Set the Frame Relay interface type to dce:
frame-switch(config-if)# frame-relay intf-type dce

Enable the interface:
frame-switch(config-if)# no shutdown

Repeat the commands above for the other connected interfaces on the frame relay switch.

STEP 4. Configuring the end-point routers and their interfaces

Change the host name of the router to 2501-A, 2501-B, or 2501-C, as shown in the network diagram by using the following command:
Router(config)# hostname 2501-A

Enter interface configuration mode for the connected serial interface:
2501-A(config)# interface serial 0

Assign the IP address as shown in the diagram (ie. for router 2501-A, use 10.10.12.2 with subnet 255.255.255.240):
2501-A(config-if)# ip address 10.10.12.2 255.255.255.240

Set the encapsulation type to Frame Relay:
2501-A(config-if)# encapsulation frame-relay

Set the LMI type to ANSI:
2501-A(config-if)# frame-relay lmi-type ansi

Enable the interface:
2501-A(config-if)# no shutdown

Repeat the steps above for the other end-point routers.

STEP 5. Verify your progress

On the frame-switch, use the show interface command to verify the operation for all connected interfaces. The output should be as following:

frame-switch# show interface serial 1
Serial1 is up, line protocol is up
Hardware is CD2430 in sync mode
MTU 1500 bytes, BW 115 Kbit, DLY 20000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation FRAME-RELAY, loopback not set
Keepalive set (10 sec)
LMI enq sent 42, LMI stat recvd 0, LMI upd recvd 0
LMI enq recvd 44, LMI stat sent 1, LMI upd sent 0, DCE LMI up
LMI DLCI 0 LMI type is ANSI Annex D frame relay DCE
FR SVC disabled, LAPF state down
Broadcast queue 0/64, broadcasts sent/dropped 0/0, interface broadcasts 0
Last input 00:00:09, output 00:00:09, output hang never
Last clearing of "show interface" counters 00:18:29
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/64/0 (size/max total/threshold/drops)
Conversations 0/1/32 (active/max active/max total)
Reserved Conversations 0/0 (allocated/max allocated)
Available Bandwidth 86 kilobits/sec
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
45 packets input, 630 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
44 packets output, 616 bytes, 0 underruns
0 output errors, 0 collisions, 36 interface resets
0 output buffer failures, 0 output buffers swapped out
29 carrier transitions
DCD=up DSR=up DTR=up RTS=up CTS=up

STEP 6. Configure DLCI mappings

Now we need to configure the DLCI mappings for each interface by using the frame-relay route command. The format for this command is:

frame-switch(config-if)# frame-relay route interface

You need to configure the appropriate mappings on all the connected interface on the frame relay switch. Following are the commands that need to be configured for our example network.

frame-switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
frame-switch(config)# interface serial 1
frame-switch(config-if)# frame-relay route 100 interface s3 101
frame-switch(config-if)# frame-relay route 300 interface s2 301

frame-switch(config-if)# interface serial 2
frame-switch(config-if)# frame-relay route 201 interface s3 200
frame-switch(config-if)# frame-relay route 301 interface s1 300

frame-switch(config-if)# interface serial 3
frame-switch(config-if)# frame-relay route 200 interface s2 201
frame-switch(config-if)# frame-relay route 101 interface s1 100
CTRL-Z

STEP 7. Verify configuration and connection

Go to one of the endpoints and look at the output of some of the "show frame-relay" commands. You can see the DLCI mappings have propagated to the endpoints. You don't need to set them up on the endpoints, only on the switch.

Display the frame relay DLCI mappings by using the following command:

2501-A# show frame-relay map
Serial0 (up): ip 10.10.12.3 dlci 201(0xC9,0x3090), dynamic,
broadcast,, status defined, active
Serial0 (up): ip 10.10.12.4 dlci 301(0x12D,0x48D0), dynamic,
broadcast,, status defined, active

Display the frame relay pvc statistics by using the following command:

2501-A# show frame-relay pvc
PVC Statistics for interface Serial0 (Frame Relay DTE)

DLCI = 201, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0

input pkts 7	output pkts 6	in bytes 580
out bytes 550	dropped pkts 1	in FECN pkts 0
in BECN pkts 0	out FECN pkts 0	out BECN pkts 0
in DE pkts 0	out DE pkts 0

pvc create time 00:05:03, last time pvc status changed 00:04:13

DLCI = 301, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0

input pkts 16	output pkts 6	in bytes 1110
out bytes 550	dropped pkts 0	in FECN pkts 0
in BECN pkts 0	out FECN pkts 0	out BECN pkts 0
in DE pkts 0	out DE pkts 0

pvc create time 00:04:45, last time pvc status changed 00:04:35

Ping the other two end-point routers from 2501-A:

2501-A# ping 10.10.12.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echoes to 10.10.12.3, timeout is 2 seconds: !!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/60/60 ms

2501-A# ping 10.10.12.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echoes to 10.10.12.4, timeout is 2 seconds: !!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/59/60 ms

As you can see (if you configured everything correctly) the end-point routers can communicate with each other without a routing protocol or static routes being configured on the frame relay switch.

You can display the switching table on the router by using the following command:

frame-switch# show frame route

Input Intf	Input Dlci	Output Intf	Output Dlci	Status
Serial1	100	Serial3	101	active
Serial1	300	Serial2	301	active
Serial2	201	Serial3	200	active
Serial2	301	Serial1	300	active
Serial3	101	Serial1	100	active
Serial3	200	Serial2	201	active

Lap Practice 3 - RIP

2011-06-27T14:21:00.001+03:00

This first CCNA TechLab covers a couple of basic configuration tasks, such as setting passwords and enabling IP routing using RIP. You will need a lab setup similar to the network diagram below:

Before you start, make sure you clear both routers' configuration using the Router#erase startup-config command. First we will configure RouterA, after the router reboots, the following message will be displayed:

% Please answer 'yes' or 'no'.
Would you like to enter the initial configuration dialog? [yes/no]

Type no and press ENTER. Press ENTER again when the message Press RETURN to get startedenable at the Router> command prompt to enter Privileged Exec mode, notice the prompt chances to Router#.

CONFIGURING THE FIRST ROUTER

STEP 1. Change the router's host name to RouterA

Enter configuration mode using the following command:
Router#configure terminal

Change the host name of the router to RouterA using the following command :
Router(config)#hostname RouterA
RouterA(config)#
Notice how changing the hostname immediately affects the prompt. Remember that you are configuring the running configuration.

STEP 2. Disable domain lookups

To prevent the router from interpreting every incorrectly typed command as a host name and trying to resolve it to an IP address to setup a telnet connection with it, use the following command:
RouterA(config)#no ip domain-lookup

STEP 3. Configure passwords

First set the enable password to cisco123 using the following command:
RouterA(config)#enable secret cisco123

Next, set the password for telnet connections to cisco456 using the following commands:
RouterA(config)#line vty 0 4
RouterA(config-line)#password cisco456
RouterA(config-line)#login

Although the enable secret command is used to encrypt the enable password, other passwords stored in the router's configuration should be encrypted as well. To do this, use the following command:
RouterA(config)#service password-encryption

STEP 4. Configuring the Ethernet interface

Enter Interface configuration mode for the Ethernet interface, using the following command:
RouterA(config)#interface Ethernet 0

Give it the description "Connected to LAN" using the following command:
RouterA(config-if)#description Connected to LAN1

Configure the IP address (see diagram for correct address) for the interface using the following command:
RouterA(config-if)#ip address 192.168.11.1 255.255.255.0

Enable the interface using the following command:
RouterA(config-if)#no shutdown

STEP 5. Configure the serial WAN interface

Switch to Interface configuration mode for the first Serial interface, using the following command:
RouterA(config)#interface Serial 0

Give it the description "Direct connection to RouterB" using the following command:
RouterA(config-if)#description connected to RouterB

Configure the IP address (see diagram for correct address) for the interface using the following command:
RouterA(config-if)#ip address 192.168.22.5 255.255.255.0

Configure the interface to use PPP encapsulation using the following command:
RouterA(config-if)#encapsulation ppp

Enable the interface using the following command:
RouterA(config-if)#no shutdown

STEP 6. Configure RIP

Use the following command to enable RIP on RouterA:
RouterA(config)#router rip

Configure the router to receive and send only RIP Version 2 packets using the following command:
RouterA(config-router)#version 2

Use the following commands to specify the networks directly connected to the router:
RouterA(config-router)#network 192.168.11.0
RouterA(config-router)#network 192.168.22.0

STEP 7. Save configuration

To copy the currently running active configuration to NVRAM, so it will be used the next time you reload the router, use the following command:
RouterA#copy running-config startup-config

STEP 8. Configuration second router

To configure the other router, RouterB, repeat the steps above. Use the network diagram to determine the correct addressing and names. To enable the back-to-back serial connection between te routers, you need to configure one router as DCE using the following command in Interface configuration mode for the serial connection on RouterB:
RouterB(config-if)#clock rate 64000

STEP 9. Verify and test the configuration

Verify using the ping command Host A to Host B, make sure you configured both hosts to use the nearest router's interface as the default gateway in the TCP/IP settings.

On both routers, run the following command in Privileged Exec mode to determine which device is the DCE:
Router#show controllers s0

On one of the routers, run the following command in Privileged Exec mode to display the parameters and current state of the active routing protocol process, and examine the output:
Router#show ip protocols

Use the following command to verify routing table entries on both routers:
Router#show ip route

Use the following command to list a summary of the interface's IP information and status on both routers, and examine the output:
Router#show ip interface

Use the same command with the brief option, and the notice output:
Router#show ip interface brief appears.

Lap Practice 2 - EIGRP

2011-06-27T14:14:00.000+03:00

Question:

After adding R3 router, no routing updates are being exchanged between R3 and the new location. All other inter connectivity and Internet access for the existing locations of the company are working properly.
The task is to identify the fault(s) and correct the router configuration to provide full connectivity between the routers.

Access to the router CLI can be gained by clicking on the appropriate host. All passwords on all routers are cisco.

IP addresses are listed in the chart below.

R1 Fa0/0: 192.168.77.33 S1/0: 198.0.18.6 S0/1: 192.168.60.25	R2 Fa0/0: 192.168.60.97 Fa0/1: 192.168.60.113 S0/0: 192.168.36.14
R3 Fa0/0: 192.168.77.34 Fa0/1: 192.168.60.65 Fa1/0: 192.168.60.81	R4 Fa0/0: 192.168.60.129 Fa0/1: 192.168.60.145 S0/1: 192.168.60.26

Answer and explanation:

We should check the configuration of the new added router first because it does not function properly while others work well. From the command line interface of R3 router, enter the show running-config command

From the output above, we know that this router was wrongly configured with an autonomous number (AS) of 22. When the AS numbers among routers are mismatched, no adjacency is formed.
(You should check the AS numbers on other routers for sure)

To solve this problem, we simply re-configure router R3 with the following commands:

R3>enable (you have to enter cisco as its password here)
R3#configure terminal
R3(config)#no router eigrp 22
R3(config)#router eigrp 212
R3(config-router)#network 192.168.60.0
R3(config-router)#network 192.168.77.0 R3(config-router)#no auto-summary R3(config-router)#end R3#copy running-config startup-config

Check R1 router with the show running-config command:

Notice that it is missing a definition to the network R3. Therefore we have to add it so that it can recognize R3 router

R1>enable (you have to enter cisco as its password here)
R1#configure terminal
R1(config)#router eigrp 212
R1(config-router)#network 192.168.77.0 R1(config-router)#end R1#copy running-config startup-config

Now the whole network will work well. You should check again with ping command from router R3 to other routers!

Lap Practice 1- Simulation

2011-06-27T14:07:00.001+03:00

This topology contains 3 routers and 1 switch. Complete the topology.

Drag the appropriate device icons to the labeled Device
Drag the appropriate connections to the locations labeled Connections.
Drag the appropriate IP addresses to the locations labeled IP address

(Hint: use the given host addresses and Main router information)
To remove a device or connection, drag it away from the topology.

Use information gathered from the Main router to complete the configuration of any additional routers. No passwords are required to access the Main router. The config terminal command has been disabled for the HQ router. The router does not require any configuration.
Configure each additional router with the following: Configure the interfaces with the correct IP address and enable the interfaces.
Set the password to allow console access to consolepw
Set the password to allow telnet access to telnetpw
Set the password to allow privilege mode access to privpw

Note: Because routes are not being added to the configurations, you will not be able to ping through the internetwork.
All devices have cable autosensing capabilities disabled.
All hosts are PC’s

Answer and explanation:

Specify appropriate devices and drag them on the "Device" boxes

For the device at the bottom-right box, we notice that it has 2 interfaces Fa0/2 and Fa0/4; moreover the link connects the PC on the right with the device on the bottom-right is a straight-through link -> it is a switch

The question stated that this topology contains 3 routers and 1 switch -> two other devices are routers

Place them on appropriate locations as following:

(Host D and host E will be automatically added after placing two routers. Click on them to access neighboring routers)

Specify appropriate connections between these devices:

+ The router on the left is connected with the Main router through FastEthernet interfaces: use a crossover cable
+ The router on the right is connected with the Main router through Serial interfaces: use a serial cable
+ The router on the right and the Switch: use a straight-through cable
+ The router on the left and the computer: use a crossover cable

(To remember which type of cable you should use, follow these tips:

- To connect two serial interfaces of 2 routers we use serial cable
- To specify when we use crossover cable or straight-through cable, we should remember:
Group 1: Router, Host, Server
Group 2: Hub, Switch
One device in group 1 + One device in group 2: use straight-through cable
Two devices in the same group: use crossover cable

For example: we use straight-through cable to connect switch to router, switch to host, hub to host, hub to server... and we use crossover cable to connect switch to switch, switch to hub, router to router, host to host... )

Assign appropriate IP addresses for interfaces:

From Main router, use show running-config command:

(Notice that you may see different IP addresses in the real CCNA exam, the ones shown above are just used for demonstration)

From the output we learned that the ip address of Fa0/0 interface of the Main router is 192.168.152.177/28. This address belongs to a subnetwork which has:

Increment: 16 (/28 = 255.255.255.240 or 1111 1111.1111 1111.1111 1111.1111 0000)
Network address: 192.168.152.176 (because 176 = 16 * 11 and 176 < 177)
Broadcast address: 192.168.152.191 (because 191 = 176 + 16 - 1)

And we can pick up an ip address from the list that belongs to this subnetwork: 192.168.152.190 and assign it to the Fa0/0 interface the router on the left

Use the same method for interface Serial0/0 with an ip address of 192.168.152.161

Increment: 16
Network address: 192.168.152.160 (because 160 = 16 * 10 and 160 < 161)
Broadcast address: 192.168.152.175 (because 176 = 160 + 16 - 1)

-> and we choose 192.168.152.174 for Serial0/0 interface of the router on the right

Interface Fa0/1 of the router on the left

IP (of the computer on the left) : 192.168.152.129/28

Increment: 16
Network address: 192.168.152.128 (because 128 = 16 * 8 and 128 < 129)
Broadcast address: 192.168.152.143 (because 143 = 128 + 16 - 1)

-> we choose 192.168.152.142 from the list

Interface Fa0/0 of the router on the right

IP (of the computer on the left) : 192.168.152.225/28

Increment: 16
Network address: 192.168.152.224 (because 224 = 16 * 14 and 224 < 225)
Broadcast address: 192.168.152.239 (because 239 = 224 + 16 - 1)

-> we choose 192.168.152.238 from the list

Let's have a look at the picture below to summarize

Configure two routers on the left and right with these commands:

Router1 = router on the left

Assign appropriate IP addresses to Fa0/0 & Fa0/1 interfaces:

Router1>enable
Router1#configure terminal
Router1(config)#interface fa0/0
Router1(config-if)#ip address 192.168.152.190 255.255.255.240
Router1(config-if)#no shutdown

Router1(config-if)#interface fa0/1
Router1(config-if)#ip address 192.168.152.142 255.255.255.240
Router1(config-if)#no shutdown

Set passwords (configure on two routers)

+ Console password:

Router1(config-if)#exit
Router1(config)#line console 0
Router1(config-line)#password consolepw
Router1(config-line)#login
Router1(config-line)#exit

+ Telnet password:

Router1(config)#line vty 0 4
Router1(config-line)#password telnetpw
Router1(config-line)#login
Router1(config-line)#exit

+ Privilege mode password:

Router1(config)#enable password privpw

Save the configuration:

Router1(config)#exit
Router1#copy running-config startup-config

Configure IP addresses of Router2 (router on the right)

Router2>enable
Router2#configure terminal
Router2(config)#interface fa0/0
Router2(config-if)#ip address 192.168.152.238 255.255.255.240
Router2(config-if)#no shutdown

Router2(config-if)#interface serial0/0
Router2(config-if)#ip address 192.168.152.174 255.255.255.240
Router2(config-if)#no shutdown

and set console, telnet and privilege mode passwords for Router2 as we did for Router1, remember to save the configuration when you finished

Cisco Switches Password Recovery

2011-06-26T16:30:00.000+03:00

The following steps will help you to explain the password recovery methods for the Cisco layers 2 switches. You can use these steps also to recover the Cisco layers 3 switches (for example 3550 and 3750 series).

Follow the step-by-step procedures to recover the lost Cisco switches password:
First make sure, you have connected your PC to the console port of switch using any emulation software.

Now turn the power switch off and back on to recycle the power then release the mode button for few seconds after the LED above port 1 turns off.
Now your switch first prompt will look like this:
switch:

First run the flash_init command to initialize the flash.
switch: flash_init

After running the flash_init command, the following information will appear as under:

1. switch: flash_init

2. Initializing Flash...

3. flashfs[0]: 21 files, 2 directories

4. flashfs[0]: 0 orphaned files, 0 orphaned directories

5. flashfs[0]: Total bytes: 7741440

6. flashfs[0]: Bytes used: 4499456

7. flashfs[0]: Bytes available: 3241984

8. flashfs[0]: flashfs fsck took 7 seconds.

9. ...done initializing flash.

10. Boot Sector Filesystem (bs:) installed, fsid: 3

11. Parameter Block Filesystem (pb:) installed, fsid: 4

Now run the load_helper command to load any helper images.
switch: load_helper

Issue the dir flash: command to view configuration file name with detail.

switch: dir flash:

Now type the rename flash:config.text flash:config.old command to rename the previous configuration file.

switch: rename flash:config.text flash:config.text.old

Here run the boot command to restart the switch.

switch: boot

Now after booting process, type enable to enter enable mode at the switch prompt.
Switch> enable

Now again type the rename flash:config.old flash:config.text command to rename the previous configuration file.

Switch#rename flash:config.old flash:config.text

Here run the copy command to transfer the configuration file to running-config

Switch#copy flash:config.text system:running-config

Now go to global configuration mode and set the new password.

Switch# configure terminal

Switch (config)# enable secret password (type here new password)

At the end saves the running configuration to NVRAM.

Switch# write memory

Cisco Router Password Recovery Steps

2011-06-26T16:25:00.000+03:00

Turn the power switch off and back on to recycle the power.

Press the Break key or key sequence to put the router into ROM Monitor mode. The break key varies by computer or terminal software. The sequence might be CTRL-D, CTRL-Break or another combination.

At the > prompt, type 0 to record the current value of the configuration register normally 0x2102, or 0x102.

Configuration register = 0x2102 at last boot

Bit# Configuration register option settings:

15 Diagnostic mode disabled.

Type o/r 0x2142 to tell the router to boot from flash without loading the configuration in NVRAM at the next reload.

Type i to have the router reboot. The router ignores the configuration in NVRAM.

The router runs the setup dialog, Type no or press Ctrl-C to skip the initial setup Dialog.

Type enable ate the Router> prompt to go to privileged exec mode.

Copy the startup configuration to the running configuration by using the configure memory or copy startup-config running-config commands. Do not type configure terminal. If you use the configure terminal command, you overwrite the configuration stored in NVRAM.

View the configuration by typing write terminal or show running-config. View the configured line, vty and enable passwords. Any encrypted passwords need to be changed.

Enter the configuration mode by typing configure terminal. Change the line of enable passwords as necessary.

All interfaces are in a shutdown state. Issue the no shutdown command on every interface that is to be used.

Type config-register 0x2102 to return the router to normal operation at the next reloads.

Exit configuration mode by pressing Ctrl-Z

Save your changes by typing write memory or copy running-config startup-config.

Reload the router and verify the passwords.

IPv6

2011-06-26T16:17:00.000+03:00

IPv4, upon which our ability to communicate is presently dependent, is going to run out of addresses for us to use. IPv4 has only about 4.3 billion addresses available—in theory, and we know that we don’t even get to use all of those. There really are only about 250 million addresses that can be assigned to devices. Sure, the use of Classless Inter-Domain Routing (CIDR) and Network Address Translation (NAT) has helped to extend the inevitable dearth of addresses, but we will run out of them, and it’s going to happen within a few years.

To be honest with you, the theme about IPv6 is a little bit like the theme for the global warming. Probably most of you (like me) have own public IP at home. But this is the way of thinking "Well, I have aircondition too, so I don't care about the global warming". I can't imagine what a disaster can be some hurricane, but I can imagine what a disaster will be if someday I can't connect to the NET, because all of the IPs are used (huh!).

An IPv6 address is actually 128 bits in length, which is 3.4 x 10³⁸ addresses. There is no such thing as a broadcast in IPv6 because it uses multicast traffic instead. And there are two other types of communication as well: unicast, which is the same as it is in IPv4, and a new type called anycast. Anycast communication allows the same address to be placed on more than one device so that when traffic is sent to one device addressed in this way, it is routed to the nearest host that shares the same address.

Here it is one IPv6 example address:

2001:0db8:3c4d:0015:0000:0000:5678:ef12

Global prefix | sub| Interface ID

So as you can now see, the address is truly much larger. Notice that it has eight groups of numbers instead of four and also that those groups are separated by colons instead of periods. The address is expressed in hexadecimal just like a MAC address is, so you could say this address has eight 16-bit hexadecimal colon-delimited blocks.

When you use a web browser to make an HTTP connection to an IPv6 device, you have to type the address into the browser with brackets around the literal address. A colon is already being used by the browser for specifying a port number. So basically, if you don’t enclose the address in brackets, the browser will have no way to identify the information. Here’s an example of how this looks:

http://[2001:0db8:3c4d:0015:0000:0000:5678:ef12]/index.php

The good news is there are a few tricks to help rescue us when writing these monster addresses. For one thing, you can actually leave out parts of the address to abbreviate it, but to get away with doing that you have to follow a couple of rules. First, you can drop any leading zeros in each of the individual blocks. After you do that, the sample address from earlier would then look like this:

2001:db8:3c4d:15:0:0:5678:ef12

Again referring to our sample address, we can remove the two blocks of zeros by replacing them with double colons, like this:

2001:db8:3c4d:15::5678:ef12

The rule you have to follow to get away with this is that you can only replace one contiguous block of zeros in an address. So if my address has four blocks of zeros and each of them were separated, I just don't get to replace them all; remember the rule is that you can only replace one contiguous block with a double colon. Check out this example:

2001:0000:0000:0123:0000:0000:4567:89ab

Wrong: 2001::0123::4567:89ab

Correct: 2001::0123:0:0:4567:89ab

In IPv6 we have the following address types:

· Global unicast addresses - These are your typical publicly routable addresses, and they’re the same as they are in IPv4.

· Link-local addresses - These are like the private addresses in IPv4 in that they’re not meant to be routed. Think of them as a handy tool that gives you the ability to throw a temporary LAN together for meetings or for creating a small LAN that’s not going to be routed but still needs to share and access files and services locally.

· Unique local addresses - These addresses are also intended for non-routing purposes, but they are nearly globally unique, so it’s unlikely you’ll ever have one of them overlap. Unique local addresses were designed to replace site-local addresses, so they basically do almost exactly what IPv4 private addresses do—allow communication throughout a site while being routable to multiple local networks. Site-local addresses were denounced as of September 2004.

· Multicast - Again, same as in IPv4, packets addressed to a multicast address are delivered to all interfaces identified by the multicast address. Sometimes people call them one-to-many addresses. It’s really easy to spot a multicast address in IPv6 because they always start with FF.

· Anycast - Like multicast addresses, an anycast address identifies multiple interfaces, but there’s a big difference: the anycast packet is only delivered to one address—actually, to the first one it finds defined in terms of routing distance. And again, this address is special because you can apply a single address to more than one interface. You could call them one-to-one-ofmany addresses, but just saying “anycast” is a lot easier.

Also there are a lot of special reserved addresses. Here we have listed some of them:

· 0:0:0:0:0:0:0:0 - Equals ::. This is the equivalent of IPv4’s 0.0.0.0, and is typically the source address of a host when you’re using stateful configuration.

· 0:0:0:0:0:0:0:1 - Equals ::1. The equivalent of 127.0.0.1 in IPv4.

· 0:0:0:0:0:0:192.168.100.1 - This is how an IPv4 address would be written in a mixed IPv6/IPv4 network environment.

· 2000::/3 - The global unicast address range.

· FC00::/7 - The unique local unicast range.

· FE80::/10 - The link-local unicast range.

· FF00::/8 - The multicast range.

· 3FFF:FFFF::/32 - Reserved for examples and documentation.

· 2001:0DB8::/32 - Also reserved for examples and documentation.

· 2002::/16 - Used with 6to4, which is the transition system—the structure that allows IPv6 packets to be transmitted over an IPv4 network without the need to configure explicit tunnels.

Network Address Translation (NAT)

2011-06-26T16:01:00.000+03:00

Whether your network is the home or the corporate type, if it uses the private IP addresses, you have to translate your private inside addresses to a global outside address by using NAT. The main idea is to conserve Internet global address space, but it also increases network security by hiding internal IP addresses from external networks. In NAT terminology, the inside network is the set of networks that are subject to translation. The outside network refers to all other addresses - usually those located on the Internet.

However, just to help confuse you, it’s important to understand that you can translate packets coming into the private network as well. NAT operates on a Cisco router - generally only connecting two networks together - and translates your private (inside local) addresses within the internal network, into public (inside global) addresses before any packets are forwarded to another network. This functionality gives you the option to configure NAT so that it will advertise only a single address for your entire network to the outside world. Doing this effectively hides the internal network from the whole world really well, giving you some much - needed additional security.

There are different flavors of NAT:

· Static NAT - Designed to allow one-to-one mapping between local and global addresses. This flavor requires you to have one real Internet IP address for every host on your network.

· Dynamic NAT - Designed to map an unregistered IP address to a registered IP address from out of a pool of registered IP addresses. You don’t have to statically configure your router to map an inside to an outside address as in static NAT, but you do have to have enough real IP addresses for everyone who wants to send packets to and from the Internet.

· Overloading - This is the most popular type of NAT configuration. Overloading is a form of dynamic NAT that maps multiple unregistered IP addresses to a single registered IP address (many-to-one) by using different ports. Therefore, it’s also known as port address translation (PAT). By using PAT (NAT Overload), you can have thousands of users connect to the Internet using only one real global IP address-pretty slick! NAT Overload is the reason we have not run out of valid IP address on the Internet.

On Fig. are shown the logic diagram for NAT point of view and some of the terminology.

Most typical NAT features change only the IP address of “inside” hosts. The outside host IP address can also be changed with NAT. When that occurs, the terms outside local and outside global are used to denote the IP address used to represent that host in the inside network and the outside network, respectively. The following table summarizes the terminology and meanings.

Term	Meaning
Inside local	In a typical NAT design, the term “inside” refers to an address used for a host inside an enterprise. An inside local is the actual IP address assigned to a host in the private enterprise network. A more descriptive term might be“inside private,” because when using RFC 1918 addresses in an enterprise, the inside local represents the host inside the enterprise, and it is a private RFC 1918 address.
Inside global	In a typical NAT design, the term “inside” refers to an address used for a host inside an enterprise. NAT uses an inside global address to represent the inside host as the packet is sent through the outside network, typically the Internet. A NAT router changes the source IP address of a packet sent by an inside host from an inside local address to an inside global address as the packet goes from the inside to the outside network. A more descriptive term might be “inside public,” because when using RFC 1918 addresses in an enterprise, the inside global represents the inside host with a public IP address that can be used for routing in the public Internet.
Outside global	In a typical NAT design, the term “outside” refers to an address used for a host outside an enterprise-in other words, in the Internet. An outside global is the actual IP address assigned to a host that resides in the outside network, typically the Internet. A more descriptive term might be “outside public,”because the outside global represents the outside host with a public IP address that can be used for routing in the public Internet.
Outside local	In a typical NAT design, the term “outside” refers to an address used for a host outside an enterprise-in other words, in the Internet. NAT uses an outside local address to represent the outside host as the packet is sent through the private enterprise network (inside network). A NAT router changes a packet’s destination IP address, sent from an inside host to the outside global address, as the packet goes from the inside to the outside network. A more descriptive term might be “outside private,” because when using RFC 1918 addresses in an enterprise, the outside local represents the outside host with a private IP address from RFC 1918.

Today, given a choice, companies tend to simply use private addressing to avoid the need to translate both IP addresses in each packet. Also, the NAT router needs a static entry for every server in the overlapped network number-a potentially painstaking task. By using private addresses, you can use NAT to connect the network to the Internet, reduce the number of registered IP addresses needed, and have to perform only the NAT function for the private address in each packet.

Access Lists

2011-06-26T16:00:00.000+03:00

IP Access Control List Security

Network security is a crucial element of any network strategy. Cisco routers can be used as part of your network security strategy. The most important tool in Cisco IOS software used as part of that strategy are Access Control Lists (ACLs). ACLs define rules that can be used to prevent some packets from flowing through the network and should be part of an organization's security policy. IP access control lists (ACLs) cause a router to discard some packets based on criteria the network engineer defines by means of filters. The goal of these filters is to prevent unwanted traffic in the network. Access lists.

There are two main categories of IOS IP ACLs:
• Standard ACLs, which use simpler logic; and
• Extended ACLs, which use more-complex logic.

Standard IP Access Control Lists

Filtering logic could be configured on any router and on any of its interfaces. Cisco IOS software applies the filtering logic of an ACL either as a packet enters an interface or as it exits the interface. In other words, IOS associates an ACL with an interface, and specifically for traffic either entering or exiting the interface. After you have chosen the router on which you want to place the access list, you must choose the interface on which to apply the access logic, as well as whether to apply the logic for inbound or outbound packets.

The key features of Cisco ACLs are:
• Packets can be filtered as they enter an interface, before the routing decision.
• Packets can be filtered before they exit an interface, after the routing decision.
• Deny is the term used in Cisco IOS software to imply that the packet will be filtered.
• Permit is the term used in Cisco IOS software to imply that the packet will not be filtered.
• The filtering logic is configured in the access list.
• If a packet does not match any of your access list statements, it is blocked.

Access lists have two major steps in their logic: matching, which determines whether it matches the access-list statement; and action, which can be either deny or permit. Deny means to discard the packet, and permit implies that the packet should be allowed. However, the logic that IOS uses with a multiple-entry ACL can be much more complex. Generally, the logic can be summarized as follows:

Step 1: The matching parameters of the access-list statement are compared to the packet.

Step 2: If a match is made, the action defined in this access-list statement (permit or deny) is performed.

Step 3: If a match is not made in Step 2, repeat Steps 1 and 2 using each successive statement in the ACL until a match is made.

Step 4: If no match is made with an entry in the access list, the deny action is performed.

Extended IP Access Control Lists

Extended IP access lists are similar to standard IP ACLs in that you enable extended access lists on interfaces for packets either entering or exiting the interface. IOS then searches the list sequentially. The first statement matched stops the search through the list and defines the action to be taken. The key difference between the extended ACLs and standard ACLs is the variety of fields in the packet that can be compared for matching by extended access lists. A single extended ACL statement can examine multiple parts of the packet headers, requiring that all the parameters be matched correctly in order to match that one ACL statement. That matching logic is what makes extended access lists both much more useful and much more complex than standard IP ACLs. You can configure extended ACL to match the IP protocol type, which identifies what header follows the IP header. You can specify all IP packets, or those with TCP headers, UDP headers, ICMP, etc, by checking the Protocol field. You can also check the source and destination IP addresses, as well as the TCP source and destination port numbers.

An extended access list is more complex than standard access lists. Therefore the configuration commands are more complex. The configuration command for extended access lists is:
• access-list access-list-number action protocol source source-wildcard destination destination-wildcard [log | log-input], which can be used to enable access lists;

Wildcard Masks

IOS IP ACLs match packets by looking at the IP, TCP, and UDP headers in the packet. Standard IP access lists can also examine only the source IP address. You can configure the router to match the entire IP address or just a part of the IP address. When defining the ACL statements you can define a wildcard mask along with the IP address. The wildcard mask tells the router which part of the IP address in the configuration statement must be compared with the packet header. The wildcard masks look similar to subnet masks, in that they represent a 32-bit number. However, the wildcard mask's 0 bits tell the router that those corresponding bits in the address must be compared when performing the matching logic. The binary 1s in the wildcard mask tell the router that those bits do not need to be compared. Thus, wildcard mask 0.0.0.0, which in binary form is 00000000.00000000.00000000.00000000, indicates that the entire IP address must be matched, while wildcard mask 0.0.0.255, which in binary form is 00000000.00000000.00000000.11111111, indicates that the first 24 bits of the IP address must be matched, and wildcard mask 0.0.31.255, which in binary form is 00000000.00000000.00011111.11111111, indicates that the first 24 bits of the IP address must be matched.

Router Bootup Process

2011-06-26T15:49:00.000+03:00

A router typically goes through five steps when booting up:

1. The router loads and runs POST (located in ROM), testing its hardware components, including memory and interfaces.
2. The bootstrap program is loaded and executed.
3. The bootstrap program finds and loads an IOS image: Possible locations of the IOS image include flash, a TFTP server, or the Mini-IOS in ROM.
4. Once the IOS is loaded, the IOS attempts to find and load a configuration file, which is normally stored in NVRAM if the IOS cannot find a configuration file, it starts up the System Configuration Dialog.
5. After the configuration is loaded, you are presented with the CLI interface (remember that the first mode you are placed into is User EXEC mode.

If you are connected to the console port, you’ll see the following output as your router boots up:

System Bootstrap, Version 11.0(10c), SOFTWARE
Copyright (c) 1986-1996 by cisco Systems
2500 processor with 6144 Kbytes of main memory
F3: 5593060+79544+421160 at 0×3000060
Cisco Internetwork Operating System Software
IOS ™ 2500 Software (C2500-I-L), Version 12.0(5)
Copyright (c) 1986-1999 by cisco Systems, Inc.
Compiled Tue 15-Jun-99 19:49 by phanguye
Image text-base: 0×0302EC70, data-base: 0×00001000

<–output omitted–>

cisco 2501 (68030) processor (revision N) with 6144K/2048K bytes of memory.
Processor board ID 18086269, with hardware revision 00000003
Bridging software.
X.25 software, Version 3.0.0.
Basic Rate ISDN software, Version 1.1.
1 Ethernet/IEEE 802.3 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
00:00:22: %LINK-3-UPDOWN: Interface Ethernet0, changed state to up
00:00:22: %LINK-3-UPDOWN: Interface Serial0, changed state to up
00:00:22: %LINK-3-UPDOWN: Interface Serial1, changed state to up
00:00:23: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0, changed state to up
00:03:13: %LINK-5-CHANGED: Interface Serial0, changed state to administratively down
00:03:13: %LINK-5-CHANGED: Interface Serial1, changed state to administratively down
Cisco Internetwork Operating System Software

IOS ™ 2500 Software (C2500-I-L), Version 12.0(5)
Copyright (c) 1986-1999 by cisco Systems, Inc.
Compiled Tue 15-Jun-99 19:49 by phanguye

Press RETURN to get started!

There are a few things to point out here. First, notice that the router is loading the bootstrap program (System Bootstrap, Version 11.0(10c)) and then the IOS image (IOS ™ 2500 Software (C2500-I-L), Version 12.0(5)). During the bootup process, you cannot see the actual POST process.

However, you will see information about the interfaces going up and/or down this is where the IOS is loading the configuration and bringing up those interfaces that you previously activated.

Sometimes, if the router has a lot of interfaces, the Press RETURN to get started! message is mixed in with the interface messages. Once the display stops, just hit ENTER to access User EXEC mode. This completes the bootup process of the router.

Bootstrap Program
As you saw in the bootup code example, the bootstrap program went out and found the IOS and loaded it. The bootstrap program goes through the following steps when trying to locate and load the IOS image:

1. Examine the configuration register value. This value is a set of four hexadecimal digits. The last digit affects the bootup process. If the last digit is between 0×2 and 0xF, then the router proceeds to the next step. Otherwise, the router uses the values shown in Table 6-1 to determine how it should proceed next.
2. Examine the configuration file in NVRAM for boot system commands, which tell the bootstrap program where to find the IOS. These commands are shown in the following paragraph.
3. If no boot system commands are found in the configuration file in NVRAM, use the first valid IOS image found in flash.
4. If there are no valid IOS images in flash, generate a TFTP local broadcast to locate a TFTP server (this is called a netboot and is not recommended because it is very slow and not very reliable for large IOS images).
5. If no TFTP server is found, load the Mini-IOS in ROM (RXBOOT mode).
6. If there is Mini-IOS in ROM, then the Mini-IOS is loaded and you are taken into RXBOOT mode; otherwise, the router either retries finding the IOS image or loads ROMMON and goes into ROM Monitor mode.

As below table contains the three common configuration register values in the fourth hex character of the configuration register that are used to influence the bootup process. The values in the configuration register are represented in hexadecimal, the register being 16 bits long.

Value in Last Digit	Bootup Process
0×0	Boot the router into ROMMON mode
0×1	Boot the router into RXBOOT mode using the Mini-IOS
0×2-0xF	Boot the router using the default boot sequence

For step 2 of the bootup process described in the last paragraph, here are the boot system commands that you can use to influence the order that the bootstrap program should use when trying to locate the IOS image:

Router(config)# boot system flash name_of_IOS_file_in_flash
Router(config)# boot system tftp IOS_image_name IP_address_of_server
Router(config)# boot system rom

The boot system flash command tells the bootstrap program to load the specified IOS file in flash when booting up.

Note that, by default, the bootstrap program loads the first valid IOS image in flash. This command tells the bootstrap program to load a different image. You might need this if you perform an upgrade and you have two IOS images in flash the old one and new one.

By default, the old one still loads first unless you override this behavior with the boot system flash command or delete the old IOS flash image.

You can also have the bootstrap program load the IOS from a TFTP server this is not recommended for large images, since the image is downloaded via the UDP protocol, which is slow.

And last, you can tell the bootstrap program to load the Mini-IOS in ROM with the boot system rom command. To remove any of these commands, just preface them with the no parameter.

Wide Area Network Protocols

2011-06-26T15:45:00.000+03:00

This page introduces various protocols and technologies used in Wide Area Network (WAN) environments. Sections include point-to-point links, circuit switching, packet switching, virtual circuits, dialup services, and WAN devices.

To begin with, a WAN is a data communications network that covers a relatively broad geographic area and often uses transmission facilities provided by common carriers, such as telephone companies. WAN technologies function at the lower three layers of the OSI reference model: the physical layer, the data link layer, and the network layer.

Point-to-Point Links

A point-to-point link provides a single, preestablished WAN communications path from the customer premises through a carrier network, such as a telephone company, to a remote network. A point-to-point link is also known as a leased line because its established path is permanent and fixed for each remote network reached through the carrier facilities.

Circuit Switching

Circuit switching is a WAN switching method in which a dedicated physical circuit is established, maintained, and terminated through a carrier network for each communication session. Circuit switching accommodates two types of transmissions: datagram transmissions and data-stream transmissions. Used extensively in telephone company networks, circuit switching operates much like a normal telephone call. Integrated Services Digital Network (ISDN) is an example of a circuit-switched WAN technology.

Packet Switching

Packet switching is a WAN switching method in which network devices share a single point-to-point link to transport packets from a source to a destination across a carrier network. Statistical multiplexing is used to enable devices to share these circuits. Asynchronous Transfer Mode (ATM), Frame Relay, Switched Multimegabit Data Service (SMDS), and X.25 are examples of packet-switched WAN technologies.

WAN Virtual Circuits

A virtual circuit is a logical circuit created to ensure reliable communication between two network devices. Two types of virtual circuits exist: switched virtual circuits (SVCs) and permanent virtual circuits (PVCs).

SVCs are virtual circuits that are dynamically established on demand and terminated when transmission is complete. SVCs are used in situations in which data transmission between devices is sporadic, largely because SVCs increase bandwidth used due to the circuit establishment and termination phases, but decrease the cost associated with constant virtual circuit availability.

A PVC is a permanently established virtual circuit that consists of one mode: data transfer. PVCs are used in situations in which data transfer between devices is constant. PVCs decrease the bandwidth use associated with the establishment and termination of virtual circuits, but increase costs due to constant virtual circuit availability.

WAN Dialup Services

Dialup services offer cost-effective methods for connectivity across WANs. Two popular dialup implementations are dial-on-demand routing (DDR) and dial backup.

DDR is a technique whereby a router can dynamically initiate and close a circuit-switched session as transmitting end station demand. A router is configured to consider certain traffic interesting (such as traffic from a particular protocol) and other traffic uninteresting. DDR can be used to replace point-to-point links and switched multiaccess WAN services.

Dial backup is a service that activates a backup serial line under certain conditions. The secondary serial line can act as a backup link that is used when the primary link fails or as a source of additional bandwidth when the load on the primary link reaches a certain threshold.

WAN Devices

WAN Switch
A WAN switch is a multiport internetworking device used in carrier networks. These devices typically switch such traffic as Frame Relay, X.25, and SMDS and operate at the data link layer of the OSI reference model.

Access Server
An access server acts as a concentration point for dial-in and dial-out connections.

Modem
A modem is a device that interprets digital and analog signals, enabling data to be transmitted over voice-grade telephone lines.

CSU/DSU
A CSU/DSU (channel service unit/digital service unit) is a digital-interface device that adapts the physical interface on a DTE (Data Terminal Equipment) device to the interface of a DCE (Data Circuit-Terminating) device in a switched-carrier network. The CSU/DSU also provides signal timing for communication between these devices.

ISDN Terminal Adapter
An ISDN terminal adapter is a device used to connect ISDN Basic Rate Interface (BRI) connections to other interfaces, such as EIA/TIA-232. A terminal adapter is essentially an ISDN modem.

High-Speed Serial Interface
The High-Speed Serial Interface (HSSI) is a DTE/DCE interface developed by Cisco Systems to address the need for high-speed communication over WAN links. HSSI defines both the electrical and the physical DTE/DCE interfaces. It therefore corresponds to the physical layer of the OSI reference model. The flexibility of the HSSI clock and data-signaling protocol makes user (or vendor) bandwidth allocation possible. The DCE controls the clock by changing its speed or by deleting clock pulses. In this way, the DCE can allocate bandwidth between applications. HSSI assumes a peer-to-peer intelligence in the DCE and DTE. The control protocol is simplified, with just two control signals required ("DTE available" and "DCE available"). Both signals must be asserted before the data circuit is valid. The DCE and DTE are expected to be able to manage the networks behind their interfaces. HSSI technical characteristics are summarized as follows:

Characteristic	Value
Maximum signaling rate	52 Mbps
Maximum cable length	50 feet
Number of connector pins	50
Interface	DTE-DCE
Electrical technology	Differential ECL
Typical power consumption	610 mW
Topology	Point-to-point
Cable type	Shielded twisted-pair wire

WAN Connection Types:

Leased Lines	Typically referred to as a point-to-point connection or dedicated connection. Is is a pre-established WAN communications path from the CPE, through the DCE switch, to the CPE of the remote site, allowing DTE networks to communicate at any time with no setup procedures before transmitting date. It uses synchronous serial lines up to 45Mbps.
Circuit Switching	Sets up like a phone call. No data can transfer before the end-to-end connection is established. Uses dial-up modems and ISDN. It is used for low-bandwidth data transfers.
Packet Switching	WAN switching method that allows you to share bandwidth with other companies to save money. As long as you are not constantly transmitting data and are instead using bursty data data transfers, packet switching can save you a lot of money. However, if you have a constant data transfers, you will need to use a leased line. Frame Relay and X.25 are packet switching technologies. Speeds can vary from 56Kbps to 2.048Mbps.

WAN Protocols:

Frame Relay	A packet switching technology that emerged in the early 1990's. Frame Relay is a Date Link and Physical Layer specification that provides high performance. Frame Relay assumes that the facilities used are less error prone than when X.25 was being implemented and that they use less overhead. Frame Relay is more cost-effective than point-to-point links and can run at speeds of 64Kbps to 45Mbps. Frame Relay provides features for dynamic-bandwidth allocation and congestion control.
X.25	ITU-T standard that defines how connections between DTE and DCE are maintained for remote terminal access and computer communications in PDNs(Public Data Networks). X.25 specifies LAPB, a data link layer protocol, and PLP, a network layer protocol. Frame Relay has to some degree superseded X.25.
ISDN	Integrated Services Digital Network is a set of digital services that transmit voice and data over existing phone lines. ISDN can offer a cost-effective solution for remote users who need a higher-speed connection than an analog dial-up link offers. ISDN is also a good choice as a backup link for other types of links such as Frame Relay or a T-1 connection.
LAPB	Link Access Procedure Balanced was created to be used as a connection-oriented protocol at the Data Link layer for use with X.25. It can also be used as a simple Data Link transport. LAPB has a tremendous amount of overhead because of its strict timeout and windowing techniques. You can use LAPB instead of the lower-overhead HDLC if your links are very error prone. However, that typically is not a problem anymore.
HDLC	High-Level Data Link Control was derived from Synchronous Data Link Control (SDLC), which was created by IBM as a Data Link connection protocol. HDLC is a connection-oriented protocol at the Data Link layer, but it has very little overhead compared to LAPB. HDLC was not intended to encapsulate multiple Network layer protocols across the same link. The HDLC header carries no identification of the type of protocol being carried inside the HDLC encapsulation. Because of this, each vendor that uses HDLC has their own way of identifying the Network layer protocol, which means that each vendor's HDLC is proprietarty for their equipment.
SDLC	Synchronous Data Link Control. SNA data link layer communications protocol. SDLC is a bit-oriented, full-duplex serial protocol that has spawned numerous protocols, including HDLC and LAPB.
PPP	Point-to-Point protocol is an industry standard protocol. Because many versions of HDLC are proprietary, PPP can be used to create point-to-point links between different vendor's equipment. It uses a Network Control Protocol field in the Data Link header to identify the Network layer protocol. It allows authentication and multilink connections and can be run over asynchronous and synchronous links.

Cisco Router’s CLI Modes

2011-06-26T15:28:00.002+03:00

The first thing a CCNA student must know is the CLI modes. These mode are structured in a hierarchical fashion, and each mode allows a group of specific commands. To access the CLI, you can use the console port or a remote access protocol such as Telnet or Secure Shell (CLI’s modes are part of the CCNA syllabus). Some of the CLI modes you’ve to familiarize with are described below:

User EXEC:

To access this mode you must log in the router by using the console port or a remote access technique (telnet, ssh…). At this mode, the prompt displays Router>, and you can telnet into a device, ping an IP address, displays the actual remote connections, Change terminal settings, and so on. But you cannot reload the router or configure anything because the privilege level is 1. To exit from the user EXEC mode issue the logout or exit command.

Privileged EXEC:

From user EXEC mode, issue the enable command to access the privileged EXEC. The enable statement is equivalent to enable 15 statement, and tells the router to enables the use of privileged commands. In this mode, the prompt displays Router#. The privileged mode allows you to troubleshoot and verify your configuration using the show and debug command. Additionally, this mode support a set of commands used to manage the router configuration files, backup/restore IOS image files, configure the router’s date and time, and reload the router. Issue the disable command or the exit command to exit from the privileged mode and return to user EXEC mode. If you’re in the configuration mode (global, interface, router…), you can go back to the privileged EXEC mode using the end command.

Global configuration:

To configure the router, you have to enter the global configuration mode. To do this, issue the configure terminal command from the privileged EXEC mode, and in this mode, the prompt displays Router(config)#. All the configurations are done in this mode, and if you wish to execute a privileged EXEC command such as the show command, you can precede it by the do command.

Interface configuration:

To configure an interface, you have to enter the interface’s configuration mode. To do this, issue the interface command from the global configuration mode or other configuration mode (line, router…), and in this mode, the prompt displays Router(config-if)#. If you wish to execute a privileged EXEC command such as the show command, you can precede it by the do command. You can go back to the privileged EXEC mode by pressing CTRL+Z. To exit from this mode, issue the exit command, and you’ll be moved to the global configuration mode.

Line configuration:

To configure access to the router using the console port or remotely, you have to enter the configuration mode of the specific line(s). To do this, issue the line command from the global configuration mode or other configuration mode (interface, router…), and in this mode, the prompt displays Router(config-line)#. If you wish to execute a privileged EXEC command such as the show command, you can precede it by the do command. You can go back to the privileged EXEC mode by pressing CTRL+Z. To exit from this mode, issue the exit command, and you’ll be moved to the global configuration mode.

Router configuration:

To configure a router protocol, you have to enter the configuration mode of a specific routing protocol. To do this, issue the router command from the global configuration mode or other configuration mode (line, interface…), and in this mode, the prompt displays Router(config-router)#. If you wish to execute a privileged EXEC command such as the show command, you can precede it by the do command. You can go back to the privileged EXEC mode by pressing CTRL+Z. To exit from this mode, issue the exit command, and you’ll be moved to the global configuration mode.

Routing

2011-06-26T15:19:00.000+03:00

Routing is a relay system by which packets are forwarded from one device to another. Each device in the network as well as the network itself has a logical address so it can be identified and reached individually or as part of a larger group of devices. For a router to act as an effective relay device, it must be able to understand the logical topology of the network and to communicate with its neighboring devices.

The router understands several different logical addressing schemes and regularly exchanges topology information with other devices in the network. The mechanism of learning and maintaining awareness of the network topology is considered to be the routing function while the movement of traffic through the router is a separate function and is considered to be the switching function. Routing devices must perform both a routing and a switching function to be an effective relay device.

A router receiving a packet from a host, the router will need to make a routing decision based on the protocol in use; the existence of the destination network address in its routing table; and the interface that is connected to the destination network. After the decision has been made the router will switch the packet to the appropriate interface on the router to forward it out. If the destination logical network does not exist in the routing table, routing devices will discard the packet and to generate an Internet Control Message Protocol (ICMP) message to notify the sender of the event.

Routing Tables

A routing table is a database repository that holds the router's routing information that represents each possible logical destination network that is known to the router. The entries for major networks are listed in ascending order and, most commonly, within each major network the subnetworks are listed in descending order. If the routing table entry points to an IP address, the router will perform a recursive lookup on that next-hop address until the router finds an interface to use. The router will switch the packet to the outbound interfaces buffer. The router will then determine the Layer 2 address that maps to the Layer 3 address. The packet will then be encapsulated in a Layer 2 frame appropriate for the type of encapsulation used by the outbound interface. The outbound interface will then place the packet on the medium and forward it to the next hop. The packet will continue this process until it reaches its destination.

There are two ways in which a routing table can be populated: a route can be entered manually, this is called static routing, or a router can dynamically learning a route. Once a router learns a route, it is added to its route table.

Static Routing

A statically defined route is a route is manually entered into the router. The purpose of this is to add routes to a router's routing table. Thus, static routing consists of individual configuration commands that define a route to a router. A router can forward packets only to subnets in its routing table. The router always knows about directly connected routes. By adding static routes, a router can be told how to forward packets to subnets that are not attached to it.

A static route can be entered into the router in global configuration mode with the following command:

ip route destination_ip_address subnet_mask { ip-address | interface } [ distance ]

In the ip route command, the destination_ip_address and subnet_mask is the IP address and subnet mask for the destination host. The ip-address parameter is the IP address of the next hop that can be used to reach the destination and interface is the router interface to use. The optional distance parameter specifies the administrative distance.

The advantages to using static routes in an internetwork are the administrator has total control of what is in the routers routing table and there is no network overhead for a routing protocol. The disadvantage of using only static routes is they do not scale well.

Dynamic Routing

Dynamic routing is a process in which a routing protocol will find the best path in a network and maintain that route. Once a route fails, the routing protocol will automatically find an alternate route to the destination. Routing protocols are easier to use than static routes. However, a routing protocol will consume more CPU cycles and network bandwidth than a static route.

Routing Protocols

There are two types of dynamic routing protocols: Interior Gateway Protocols (IGP) and External Gateway Protocols (EGP). IGPs are used to exchange routing information within an autonomous system (AS), which is a collection of routing domains under the same administrative control the same routing domain. An EGP, on the other hand, is used to exchange routing information between different ASs.

IGPs can be broken into two classes: distance-vector and link-state, and can also be broken into two categories: classful routing protocols and classless routing protocols.

Distance-Vector Routing

Distance-vector routing is consists of two parts: distance and vector. Distance is the measure of how far it is to reach the destination and vector is the direction the packet must travel to reach that destination. The latter is determined by the next hop of the path. Distance-vector routing protocols will learn routes from its neighbors. This is called routing by rumor. Examples of distance-vector routing protocols are: Routing Information Protocol (RIP), Interior Gateway Routing Protocol (IGRP), and Enhanced Interior Gateway Routing Protocol (EIGRP).

Link-State Routing

Link-state routing differs from distance-vector routing in that each router knows the exact topology of the network. This reduces the number of bad routing decisions that can be made because every router in the process has an identical view of the network. Each router in the network will report on its state, the directly connected links, and the state of each link. The router will then propagate this information to all routers in the network. Each router that receives this information will take a snapshot of the information. This ensures all routers in the process have the same view of the network, allowing each router to make its own routing decisions based upon the same information.

In addition, link-state routing protocols generate routing updates only when there is a change in the network topology. When a link, i.e., a point on a route, changes state, a link-state advertisement (LSA) concerning that link is created by the device that detected the change and propagated to all neighboring devices using a multicast address. Each routing device takes a copy of the LSA, updates its topological database and forwards the LSA to all neighboring devices. An LSA is generated for each link on a router. Each LSA will include an identifier for the link, the state of the link, and a metric for the link. With the use of LSAs, linkstate protocols reduces routing bandwidth usage.

Examples of link-state routing protocols are: Open Shortest Path First (OSPF) and Integrated Intermediate System to Intermediate System (IS-IS). Another protocol, Enhanced Interior Gateway Routing Protocol (EIGRP) is considered a hybrid protocol because it contains traits of both distance-vector and link-state routing protocols. Most link-state routing protocols require a hierarchical design, especially to support proper address summarization. The hierarchical approach, such as creating multiple logical areas for OSPF, reduces the need to flood an LSA to all devices in the routing domain. The use of areas restricts the flooding to the logical boundary of the area rather than to all devices in the OSPF domain. In other words, a change in one area should only cause routing table recalculation in that area, not in the entire domain.

Internetworking

2011-06-26T12:33:00.000+03:00

Networks and networking have grown exponentially over the last 15 years. They’ve had to evolve at light speed just to keep up with huge increases in basic missioncritical user needs such as sharing data and printers, as well as more advanced demands such as voice and video conferencing. Unless everyone who needs to share network resources is located in the same office area (an increasingly uncommon situation), the challenge is to connect the sometimes many relevant networks together so all users can share the network resources.

It’s also likely that at some point, you’ll have to break up one large network into a number of smaller ones because user response has decresed to a trickle as the network grew and grew and LAN traffic congestion reached overwhelming proportions. Breaking up a larger network into a number of smaller ones is called network segmentation, and it’s accomplished using routers, switches, and bridges. Possible causes of LAN traffic congestion are:

· Too many hosts in a broadcast domain

· Broadcast storms

· Multicasting

· Low bandwidth

· Adding hubs for connectivity to the network

· A large amount of ARP or IPX traffic (IPX is a Novell routing protocol)

Routers are used to connect networks together and route packets of data from one network to another. Cisco became the de facto standard of routers because of their high-quality router products, great selection, and fantastic service. Routers, by default, break up a broadcast domain, which is the set of all devices on a network segment that hear all broadcasts sent on that segment. Breaking up a broadcast domain is important because when a host or server sends a network broadcast, every device on the network must read and process that broadcast—unless you’ve got a router. When the router’s interface receives this broadcast, it can respond by basically saying“Thanks, but no thanks,” and discard the broadcast without forwarding it on to other networks. Even though routers are known for breaking up broadcast domains by default, it’s important to remember that they break up collision domains as well. Two advantages of using routers in your network are:

· They don’t forward broadcasts by default.

· They can filter the network based on layer 3 (Network layer) information (i.e., IP address).

Four router functions in your network can be listed as:

· Packet switching

· Packet filtering

· Internetwork communication

· Path selection

Switches aren’t used to create internetworks, they’re employed to add functionality to an internetwork LAN. The main purpose of a switch is to make a LAN work better—to optimize its performance—providing more bandwidth for the LAN’s users. And switches don’t forward packets to other networks as routers do. Instead, they only “switch”frames from one port to another within the switched network.

Unlike layer 2 switches that forward or filter frames, routers (layer 3 switches) use logical addressing and provide what is called packet switching. Routers can also provide packet filtering by using access-lists (discussed later), and when routers connect two or more networks together and use logical addressing (IP), this is called an internetwork. Lastly, routers use a routing table (map of the internetwork) to make path selections and to forward packets to remote networks.

Switches create separate collision domains, but a single broadcast domain. Routers provide a separate broadcast domain for each interface.

Notice that the router is found at center stage, and that it connects each physical network together! The best network connected to the router is the LAN switch network on the left, because each port on that switch breaks up collision domains. But it’s not all good—all devices are still in the same broadcast domain. If your broadcast domains are too large, the users have less bandwidth and are required to process more broadcasts, and network response time will slow to a level that could cause office riots.

Obviously, the best network is one that’s correctly configured to meet the business requirements of the company it serves. LAN switches with routers, correctly placed in the network, are the best network design. This book will help you understand the basics of routers and switches so you can make tight, informed decisions on a case-by-case basis.

Collision Domains vs. Broadcast Domains

2011-06-26T11:05:00.000+03:00

A switch uses layer two of the OSI model, so the switch uses MAC addresses to send the packet to the correct device. Rather than sending it to all ports a switch only sends the packet out one port, if it has the MAC address in its MAC address table. If not the switch will send the packet on all ports except for the port in which the packet was received on. Switches provide separate collision domains on each port. This provides dedicated bandwidth to that device. This also allows simultaneous conversations between devices on different ports. Each port can be operated at full-duplex so the device can send and receive information at the same time.

A broadcast domain is like a collision domain, the definition of a broadcast domain is a set of devices that if one device sends a broadcast frame all other devices will receive that frame in the same broadcast domain. So if devices are in the same IP network they will be able to receive a broadcast message. Having a smaller broadcast domain can improve network performance and improve against security attacks. The more PCs and network devices connected to a single broadcast domain, the more broadcast messages you will have. Remember a broadcast message goes to every PC and network device. An example is when the router gets a packet that is destined to a host (192.168.1.124) on its Ethernet interface (192.168.1.0/24 network) the router will send an ARP request saying who is 192.168.1.124? That packet will go to every PC on the network, each PC has to look at the packet and then discard it if it is not 192.168.1.124. But only be processed by the PC that is 192.168.1.124. So a broadcast message can be just like a collision domain and affect network performance. The only devices that can block or not send broadcast messages are routers because they separate networks. Each interface on a router is a different network.

Functions of Switches, Routers and Hubs

2011-06-26T10:59:00.001+03:00

Layer 2 switch is A network device that forwards traffic based on MAC layer (Ethernet or Token Ring) addresses.

Bridging technology has been around since the 1980s (and maybe even earlier). Bridging involves segmentation of local-area networks (LANs) at the Layer 2 level. A multiport bridge typically learns about the Media Access Control (MAC) addresses on each of its ports and transparently passes MAC frames destined to those ports. These bridges also ensure that frames destined for MAC addresses that lie on the same port as the originating station are not forwarded to the other ports. For the sake of this discussion, we consider only Ethernet LANs.

Layer 2 switches effectively provide the same functionality. They are similar to multiport bridges in that they learn and forward frames on each port. The major difference is the involvement of hardware that ensures that multiple switching paths inside the switch can be active at the same time.

There are three distinct functions of layer 2 switching

Address learning

Layer 2 switches and bridges remember the source hardware address of each frame received on an interface, and they enter this information into a MAC database called a forward/filter table.

Forward/filter decisions

When a frame is received on an interface, the switch looks at the destination hardware address and finds the exit interface in the MAC database. The frame is only forwarded out the specified destination port.

Loop avoidance

If multiple connections between switches are created for redundancy purposes, network loops can occur. Spanning Tree Protocol (STP) is used to stop network loops while still permitting redundancy.

Cisco Router Components & their functions:

Cisco routers (and switches) generally contain four types of memory:

ROM (Read-Only Memory)

Flash

NVRAM (Non-Volatile RAM)

RAM (Random-Access Memory)

CPU
The CPU executes operating system instructions, such as system initialization, routing functions, and switching functions.

RAM
RAM stores the instructions and data needed to be executed by the CPU.

RAM is used to store these components:

Operating System: The Cisco IOS (Internetwork Operating System) is copied into RAM during bootup.

Running Configuration File: This is the configuration file that stores the configuration commands that the router IOS is currently using. With few exceptions, all commands configured on the router are stored in the running configuration file, known as running-config.
IP Routing Table: This file stores information about directly connected and remote networks. It is used to determine the best path to forward the packet.
ARP Cache: This cache contains the IPv4 address to MAC address mappings, similar to the ARP cache on a PC. The ARP cache is used on routers that have LAN interfaces such as Ethernet interfaces.

Packet Buffer: Packets are temporarily stored in a buffer when received on an interface or before they exit an interface.

RAM is volatile memory and loses its content when the router is powered down or restarted. However, the router also contains permanent storage areas, such as ROM, flash and NVRAM.

ROM
ROM is a form of permanent storage. Cisco devices use ROM to store:

The bootstrap instructions

Basic diagnostic software

Scaled-down version of IOS.

ROM uses firmware, which is software that is embedded inside the integrated circuit. Firmware includes the software that does not normally need to be modified or upgraded, such as the bootup instructions. Many of these features, including ROM monitor software, will be discussed in a later course. ROM does not lose its contents when the router loses power or is restarted.

Flash Memory
Flash memory is nonvolatile computer memory that can be electrically stored and erased. Flash is used as permanent storage for the operating system, Cisco IOS. In most models of Cisco routers, the IOS is permanently stored in flash memory and copied into RAM during the bootup process, where it is then executed by the CPU. Some older models of Cisco routers run the IOS directly from flash. Flash consists of SIMMs or PCMCIA cards, which can be upgraded to increase the amount of flash memory.Flash memory does not lose its contents when the router loses power or is restarted.

NVRAM
NVRAM (Nonvolatile RAM) does not lose its information when power is turned off. This is in contrast to the most common forms of RAM, such as DRAM, that requires continual power to maintain its information. NVRAM is used by the Cisco IOS as permanent storage for the startup configuration file (startup-config). All configuration changes are stored in the running-config file in RAM, and with few exceptions, are implemented immediately by the IOS. To save those changes in case the router is restarted or loses power, the running-config must be copied to NVRAM, where it is stored as the startup-config file. NVRAM retains its contents even when the router reloads or is powered off.

Hub:

· It is a networking device working on a Physical Layer.

· It is physically Star but Logically bus topology.

· It is an unintelligent device.

· It is also called Multiport Repeater.

· It supports only half way communication.

· Whenever the data sends to one port, the hub just forward it to all ports. So here flooding take place.

Virtual Local Area Networks

2011-06-26T10:30:00.000+03:00

A virtual LAN (VLAN) is a group of hosts or network devices, such as routers (running transparent bridging) and bridges, that forms a single bridging domain. There can be several VLANs defined on a single switch. A VLAN can also span multiple switches. Using layer 2 protocols such as IEEE 802.1q and ISL (Inter-Switch Link) allow a VLAN to span across multiple switches. VLANs are formed to group related users together regardless of the physical connections of their hosts to the network. The users can be spread across a campus network or even across geographically isolated locations. Users can be organized into separate VLANs according to their department, location, function, application, address (logical or physical), or protocol used. The goal with VLANs is to group users into separate VLANs so their traffic will stay within the VLAN. When you configure VLANs, the network can take advantage of the following benefits:

Benefits of using VLANs

Broadcast Control - Just as switches physically isolate collision domains for attached hosts and only forward traffic out a particular port, VLANs refine this concept further and provide complete isolation between VLANs. A VLAN is a bridging domain, and all broadcast and multicast traffic is contained within it.
Security - VLANs provide security in two ways:

High-security users can be grouped into a VLAN, possibly on the same physical segment, and no users outside of that VLAN can communicate with them.
Because VLANs are logical groups that behave like physically separate entities, inter-VLAN communication can only be achieved through a router. When inter-VLAN communication occurs through a router, all the security and filtering functionality that routers traditionally provide can be used. In the case of nonroutable protocols, there can be no inter-VLAN communication. All communication must occur within the same VLAN.

Performance - You can isolate users that require high performance networks for bandwidth intensive projects, VLANs can isolate them and the rest of the network from each other.
Network Management - Software on the switch allows you to assign users to VLANs and, later, reassign them to another VLAN. Recabling to change connectivity is no longer necessary in the switched LAN environment because network management tools allow you to reconfigure the LAN logically in seconds.

Routers by default only send broadcasts within the originating network, but switches forward them to all segments. This is known as a flat network because it's one big broadcast domain. Switches and VLANs are used to replace the flat network. All members of a VLAN are in the same broadcast domain and receive all broadcasts. By default the broadcasts are filtered from all ports on a switch that aren't in the same VLAN. Routers, layer 3 switches, or Route Switch Modules (RSM) must be used in conjunction with switches to provide connections between networks (VLANs), which can stop broadcasts from propagating throughout the entire internetwork.

VLAN Organizations

A traditional collapsed backbone consists of a router with separate networks attached to its interfaces. Each node attached to the physical network need to have the same network number in order to communicate on the internetwork. On switches you can group users into communities of interest called VLAN Organizations. In a VLAN, network nodes of each VLAN can communicate with other nodes in the same VLAN, the nodes in one VLAN need to go through a router or other layer 3 device in order to communicate with other VLANs.

VLAN Memberships

VLANs are usually created by administrators who assign switch ports to VLANs. These are called static VLANs. Dynamic VLANs are configured by assigning all the host devices' hardware addresses into a database.

Static VLAN

Static VLANs are the typical method of creating VLANs and are the most secure. The switch port you assign a VLAN association to always maintains that association until an administrator changes the port assignment.

Dynamic VLAN

Dynamic VLANs determine a node's VLAN assignment automatically. Using intelligent management software, you can enable MAC addresses, protocols, or even applications to create dynamic VLANs. For example, if the MAC address is in a centralized database, and if it connects to a switch port, the VLAN management database can lookup the address and configure the port for the correct VLAN. If the user moves, the switch will automatically assign them to their correct VLAN.

Layer 2 Switching

2011-06-26T10:02:00.001+03:00

Layer 2 switching is hardware based, it uses the host's Media Access Control (MAC) address.

Switches use Application Specific Integrated Circuits (ASIC) to build and maintain filter tables.

Switches tend to be faster than Routers, because they don't look at the logical address (Network layer headers), they instead use the hardware address defined at the Data Link (MAC) layer to decide whether to forward or discard the frame.

Layer 2 switching is so efficient because it doesn't modify the data packet only the frame encapsulating the packet; this also causes it to be less error prone.

Uses Layer 2 switching for network connectivity and network segmentation (each port is a separate collision domain).

Be careful how you segment your network, ensure that the users spend 80% of their time on their local segment, and all the segments of a switch are still in the same broadcast domain. Use routers to split up broadcast domains.

Benefits of LAN Switches

An individual Layer 2 switch might offer some or all of the following benefits:

Bandwidth---LAN switches provide excellent performance for individual users by allocating dedicated bandwidth to each switch port (for example, each network segment). This technique is known as microsegmenting.

VLANs---LAN switches can group individual ports into logical switched workgroups called VLANs, thereby restricting the broadcast domain to designated VLAN member ports. VLANs are also known as switched domains and autonomous switching domains. Communication between VLANs requires a router.

Automated packet recognition and translation---Cisco's unique Automatic Packet Recognition and Translation (APaRT) technology recognizes and converts a variety of Ethernet protocol formats into industry-standard CDDI/FDDI formats. With no changes needed in either client or server end stations the Catalyst solution can provide an easy migration to 100-Mbps server access while preserving the user's investment in existing shared 10Base-T LANs.

Spanning Tree Protocol

STP is a Layer 2 link management protocol that provides path redundancy while preventing undesirable loops in the network. For an Ethernet network to function properly, only one active path must exist at Layer 2 between two stations. STP operation is transparent to end stations, which do not detect whether they are connected to a single LAN segment or a switched LAN of multiple segments.

The Catalyst series switches use STP (IEEE 802.1D bridge protocol) on all Ethernet virtual LANS (VLANs). When you create fault-tolerant internetworks, you must have a loop-free path between all nodes in a network. In STP, an algorithm calculates the best loop-free path throughout a Catalyst-switched network. The switches send and receive spanning-tree packets at regular intervals (2 seconds). The switches do not forward the packets, but use the packets to identify a loop-free path. The default configuration has STP enabled for all VLANs.

Multiple active paths between stations cause loops in the network. If a loop exists in the network, you might receive duplicate messages. When loops occur, some switches see stations on both sides of the switch. This condition confuses the forwarding algorithm and allows duplicate frames to be forwarded.

To provide path redundancy, STP defines a tree that spans all switches in an extended network. STP forces certain redundant data paths into a standby (blocked) state. If one network segment in the STP becomes unreachable, or if STP costs change, the spanning-tree algorithm reconfigures the spanning-tree topology and reestablishes the link by activating the standby path.

Defined as IEEE 802.1d

It first elects a root bridge (only 1 per network), root bridge ports are called designated ports which operate as forwarding-state ports. Forwarding-state ports can send and receive traffic. Other switches in your network are nonroot bridges.

The nonroot bridge's port with the fastest link to the root bridge is called the root port, and it sends and receives traffic.

Ports that have the lowest cost to the root bridge are called designated ports. The other ports on the bridge are considered non designated and will not send or receive traffic, (blocking mode).

Switches or bridges running STP, exchange information with what are called Bridge Protocol Data Units (BPDU). BPDUs send configuration information using multicast frames, BPDUs are also used to send the bridge ID of each device to other devices. The bridge ID is used to determine the root bridge in the network and to determine the root port. The Bridge ID is 8 bytes long, includes priority and MAC address. The default priority of devices using IEEE STP is 32,768 (2¹⁵).

To determine the root bridge the priority and the MAC addresses are combined, if priority is the same, the MAC address is used to determine the who has the lowest ID, which determines who will be the root bridge.

Path Cost is used to determine which ports will be used to communicate with the root bridge (designated ports). STP cost is the total accumulated path cost based on the bandwidth of the links. The slower the link the higher the cost.

Spanning Tree Protocol Port States

Blocking - doesn't forward any frames, but still listens to BPDUs. Ports default to blocking when the switch powers on. Used to prevent network loops. If a blocked port is to become the designated port, it will first enter listening state to ensure that it won't create a loop once it goes into forwarding state.

Listening - listens to BPDUs to ensure no loops occur on the network before passing data frames.

Learning - learns MAC addresses and builds filter table, doesn't forward frames.

Forwarding - sends and receives all data on the bridge ports. A forwarding port has been determined to have the lowest cost to the root bridge.

LAN Switching Modes

Store and Forward - the entire frame is copied into its buffer and computes the Cyclic Redundancy Check (CRC). Since it copies the entire frame, latency varies with frame length. If the frame has a CRC error, is too short (<64 bytes), or is too long (>1518 bytes) it is discarded. If no error, the destination address (MAC) is looked up in the filter table and is sent to the appropriate interface. Is the default state for 5000 series switches.

Cut Through - fastest switching mode as only the destination address is copied. It will then look up the address in its filter table and send the frame to the appropriate interface.

Fragment Free - modified form of Cut Through switching. The switch waits for the first 64 bytes to pass before forwarding the frame. If the packet has an error, it usually occurs in the first 64 bytes of the frame. Default mode for 1900 switches.

Limitations of Layer 2 Switching

Since we commonly stick layer 2 switching into the same category as bridged networks, we also tend to think it has the same hang-ups and issues that bridged networks do. Keep in mind that bridges are good and helpful things if we design the network correctly, keeping their features as well as their limitations in mind. And to design well with bridges, the two most important considerations are:

· We absolutely must break up the collision domains correctly.

· The right way to create a functional bridged network is to make sure that its users spend 80 percent of their time on the local segment.

Bridged networks break up collision domains, but remember, that network is still one large broadcast domain. Neither layer 2 switches nor bridges break up broadcast domains by default— something that not only limits your network’s size and growth potential, but can also reduce its overall performance.

Broadcasts and multicasts, along with the slow convergence time of spanning trees, can give you some major grief as your network grows. These are the big reasons why layer 2 switches and bridges cannot completely replace routers (layer 3 devices) in the internetwork.

Bridging vs. LAN Switching

It’s true—layer 2 switches really are pretty much just bridges that give us a lot more ports, but there are some important differences you should always keep in mind:

· Bridges are software based, while switches are hardware based because they use ASIC chips to help make filtering decisions.

· A switch can be viewed as a multiport bridge.

· Bridges can have only one spanning-tree instance per bridge, while switchescan have many. (I’m going to tell you all about spanning trees in a bit.)

· Switches have a higher number of ports than most bridges.

· Both bridges and switches forward layer 2 broadcasts.

· Bridges and switches learn MAC addresses by examining the source address of each frame received.

· Both bridges and switches make forwarding decisions based on layer 2 addresses.

Subnetting Practice Examples

2011-06-25T15:52:00.002+03:00

Practice Example #1C: 255.255.255.192 (/26)

Let’s use the Class C subnet mask from the preceding example, 255.255.255.192, to see how much simpler this method is than writing out the binary numbers. We’re going to subnet the network address 192.168.10.0 and subnet mask 255.255.255.192.

192.168.10.0 = Network address

255.255.255.192 = Subnet mask

Now, let’s answer the big five:

_ How many subnets? Since 192 is 2 bits on (11000000), the answer would be 22.

_ How many hosts per subnet? We have 6 host bits off (11000000), so the equation would be 26 – 2 = 62 hosts.

_ What are the valid subnets? 256 – 192 = 64. Remember, we start at zero and count in our block size, so our subnets are 0, 64, 128, and 192.

_ What’s the broadcast address for each subnet? The number right before the value of the next subnet is all host bits turned on and equals the broadcast address.

_ What are the valid hosts? These are the numbers between the subnet and broadcast address. The easiest way to find the hosts is to write out the subnet address and the broadcast address. This way, the valid hosts are obvious. The following table shows the 0, 64, 128, and 192 subnets, the valid host ranges of each, and the broadcast address of each subnet:

The subnets (do this first) 0 64 128 192

Our first host (perform host addressing last) 1 65 129 193

Our last host 62 126 190 254

The broadcast address (do this second) 63 127 191 255

Practice Example #1B: 255.255.192.0 (/18)

172.16.0.0 = Network address

255.255.192.0 = Subnet mask

_ Subnets? 22 = 4.

_ Hosts? 214 – 2 = 16,382 (6 bits in the third octet, and 8 in the fourth).

_ Valid subnets? 256 – 192 = 64. 0, 64, 128, 192. Remember the subnetting is performed in the third octet, so the subnet numbers are really 0.0, 64.0, 128.0, and 192.0, as shown in the next table.

_ Broadcast address for each subnet?

_ Valid hosts?

The following table shows the four subnets available, the valid host range, and the broadcast address of each:

Subnet 0.0 64.0 128.0 192.0

First host 0.1 64.1 128.1 192.1

Last host 63.254 127.254 191.254 255.254

Broadcast63.255 127.255 191.255 255.255

Practice Example #1A: 255.255.0.0 (/16)

Class A addresses use a default mask of 255.0.0.0, which leaves 22 bits for subnetting since you must leave 2 bits for host addressing. The 255.255.0.0 mask with a Class A address is using 8 subnet bits.

_ Subnets? 28 = 256.

_ Hosts? 216 –2 = 65,534.

_ Valid subnets? 256 – 255 = 1. 0, 1, 2, 3, etc. (all in the second octet). The subnets would be 10.0.0.0, 10.1.0.0, 10.2.0.0, 10.3.0.0, etc., up to 10.255.0.0.

_ Broadcast address for each subnet?

_ Valid hosts?

The following table shows the first two and last two subnets, valid host range, and broadcast addresses for the private Class A 10.0.0.0 network:

Subnet 10.0.0.0 10.1.0.0 … 10.254.0.0 10.255.0.0

First host 10.0.0.1 10.1.0.1 … 10.254.0.1 10.255.0.1

Last host 10.0.255.254 10.1.255.254 …10.254.255.254 10.255.255.254

Broadcast 10.0.255.255 10.1.255.255 …10.254.255.255 10.255.255.255

Solving the Mysteries of Subnetting

2011-06-25T15:05:00.000+03:00

Subnetting is a complicated topic that has confused students for a very long time. However, subnetting is an important topic for many different certifications with various vendors, including Cisco. In the real world environment, people are used to just punching in the numbers in many of the free subnet calculators that are readily available on the internet. For exam purposes, you still have to do this in a very fast manner since many exams are time-based and you don't have the luxury of spending those precious minutes on any single question. This Networking training whitepaper will solve some of those age-old and complicated subnetting puzzles.

Why Do We Subnet?

Why can't you take the numbers provided by the providers? The answer is simple - because YOU know your network, your provider doesn't. Only you know the details such as how many users you would want in each network. Only you know how many of these networks (sub-networks/broadcast domains) you need. Various design classes will give you different specs on how big the broadcast domain should be (answer depending on the application needs you have). We also do subnetting because you might want to create a manageable, doable, and realistic set of numbers rather than the defaults, which might not work for your needs or could be overkill.

Note: Each router interface is its own broadcast domain, since routers, by default, terminate broadcasts. Also, VLAN = broadcast domain since you need a L3 device (router) to interconnect different broadcast domains/Vlans/subnets. Yes subnets = broadcast domain = vlan. We use these terms interchangeably, but subnet is a L3 concept and vlan is a L2 concept.

There are three classes of addresses that we use for unicast (one-to-one communication) purposes in our IPv4 network (32 bit addresses): Class A, Class B, and Class C. There are some default assumptions for each class, indicating which octets (8 bits) are network and which octets are host. The defaults are:

Class A	Network	Host	Host	Host	First 8 bits for network; last 24 bits for host
Class B	Network	Network	Host	Host	First 16 bits for network; last 16 bits work; last 16 bits
Class C	Network	Network	Network	Host	First 24 bits for network; last 8 bits for host

Since we are working with binary here, we can easily calculate the number of hosts possible in each class of addresses.

Class A has 24 bits of host possibilities, which comes to 224 -2 number of hosts. This comes to 16,777,214 hosts in each class A network.

With the Class B address, we have 16 bits of host possibilities. 216-2 = 65,534 hosts in each class B network.

With the Class C address, we have 8 bits of host possibilities. 28-2 = 254 hosts in each class C network.

The reason we subtracted 2 from each of these ranges is that the first and the last number in the range has a special meaning to the system. The very first number in the range (all bits in binary off) indicates the network/subnetwork you are on. The last number in the range (all bits in binary ON) indicates the directed broadcast on that network/subnetwork).

I don't know of any network that has the capability to support in a flat segment 16,777,214 users with Class A (or 65,534 hosts for Class B). Since these numbers are not realistic, you need to subnet them, based on your needs. With class C, you get 254 hosts in each segment, which is possible but can still be subnetted to accommodate smaller networks (like point-to-point WAN networks with 2 hosts or other possibilities).

With all subnetting questions, first you have to ask yourself with what class of address you are working. This always tells you which octets are network octets so you can take it from there and manipulate the host bits based upon your needs.

Remember your ranges of addresses:

Class A address range is from 1 - 127 Class B address range is from 128 - 191 Class C address range is from 192 - 223

Let’s dig in to an example.

Let's use RFC 1918 Class B address 172.16.0.0. In this scenario we are going to work on this to get eight subnets. (This is a random number I picked, based on eight different VLANs I might want to configure in my network).

The default subnet mask for class B is 255.255.0.0

In binary, the subnet mask is 11111111.11111111.00000000.00000000

Note that there are 16 consecutive zeros, which indicate the number of hosts (as previously discussed). Remember that we have 65,534 hosts possible, but in ONE big, flat network. We don't want that for this scenario; we need eight different subnets. So lets do it.

Ask yourself how many bits you need to get 8 subnets. The formula for this is

2n = # of subnets where n is the number of bits to use for subnets

In this scenario

2n=8 so using basic math n=3 (three occurrences of 2 to get 8 -> 2x2x2)

Since we said earlier that zeros identify the number of hosts you have (from right to left in the 32-bit subnet mask), the same works for subnets. Subnets are indicated by the number of contiguous ones we have (from left to right in the 32 bit subnet mask). We just determined that we need 3 bits for this example where we need eight subnets. Remember now that subnets are indicated by contiguous ones from left to right.

The subnet mask we had for class B is
11111111. 11111111. 00000000. 00000000

Now that we need to borrow three additional bits, let’s write this down. (Remember, this will be from left to right in what was the host portion of the mask)

11111111. 11111111. 11100000. 00000000 (now thirteen bits left for host, indicated by 13 zeroes, so 213 – 2 would give us 8,190 hosts in each subnet).

This gives us 255.255.224.0 for our subnet mask. The way I got 224 here is the addition of the first three bits that are ON now in the third octet – remember the binary value of first three bits are 128, 64, and 32 – adding up to 224.

Once you determine the mask, you need to write that down in binary. In this case, the number is
255.255.224.0

255. 255. 224. 0

11111111. 11111111. 11100000. 00000000

Now, here is a tricky part. After the first subnet (subnet zero), the decimal value of the lowest active bit is your second subnet (after subnet zero). Then you increment that number by itself until you reach the mask. This will give you all the subnets. Another trick that some people use is to subtract 224 (our subnet mask number) from 256 which will also give us 32 (our increment for subnets).
Let’s see it step-by-step:

Decimal value of the lowest active bit.
Active means 1, not active means 0.
Remember, the binary place holders for all eight bits in the octet.

In this example, only the first three bits are on. The decimal values of those bits are 128, 64, and 32; 32 is the lowest active bit versus 64 or 128.

2⁷2⁶ 2⁵ 2⁴ 2³ 2²2¹ 2⁰
128 64 32 16 8 4 2 1

Let’s increment 32 by itself until we get the mask (224).

32 – Second subnet
64 – Third subnet
96 – Fourth subnet
128 – Fifth subnet
160 – Sixth subnet
192 – Seventh subnet
224 – Eighth subnet

This just gave us all of our eight subnets (with subnet 0 being the first subnet). Let’s write these numbers down for clarity and get our range of host addresses within each subnet. (Range is the smallest number possible to the biggest number possible).

172.16.0.0-> 172.16.31.255 First subnet all possible numbers in the range
172.16.32.0 -> 172.16.63.255 Second subnet all possible numbers in the range
172/16.64.0 -> 172.16.95.255 Third subnet all possible numbers in the range
172.16.96.0 -> 172.16.127.255 Fourth subnet all possible numbers in the range
172.16.128.0 -> 172.16.159.255 Fifth subnet all possible numbers in the range
172.16.160.0 -> 172.16.191.255 Sixth subnet all possible numbers in the range
172.16.192.0 -> 172.16.223.255 Seventh subnet all possible numbers in the range
172.16.224.0 -> 172.16.255.255 Eighth subnet all possible numbers in the range

Do not forget. When we were calculating the number of hosts, we kept subtracting 2 from our host range (the first and the last one). The first and the last one have special meanings. The first number in the range is the subnet itself (the wire that the people are plugged into). The last number is the directed broadcast for all the hosts on that subnet.

So, the valid list of hosts is every number in the range except for the first and the last number.
For the first subnet, it will be 172.16.0.1 to 172.16.31.254.
For the second subnet, it will be 172.16.32.1 to 172.16.63.254 and so on for all subnets.

Also note that we got the end number in the range very fast, because it is one number less than the next subnet. Since the first subnet (third octet here) was 0 and the next subnet was 32 it was easy to see that the first subnet will end at one less than the next number; 31 in our example. We applied the same logic for the next range of subnets. Take a look at the third subnet which is 64 which means that the previous subnet (32) will end at one less than 64; which is true and it ends at 63. Some do point out that those numbers also are increments of 32 so if you can do the additions in your head and not mess up – more power to you.

Most of my clients implement 255.255.255.0 in their network (/24), so they are used to seeing the third octet increment by one. That is not the case here. We saw that the second subnet for example goes from 172.16.32.1 to 172.16.63.254 (valid host ranges). This means the first valid host address is 172.16.32.1, followed by 172.16.32.2 and then 172.16.32.3 and so on. What do you think the number will be when you get to 172.16.32.254? If you said 172.16.32.255 then you are correct and the host after that will be 172.16.33.0. These numbers are perfectly valid for host addresses. I don’t want you to just panic because there is a 0 or a 255 in the address and call them subnetwork or broadcast addresses. Always keep in mind that the subnetwork is the first number possible in the range and the directed broadcast is the last number possible in the range. Everything in between is a valid host address, regardless of how weird it looks.

Verify Your Work

This is how to verify your work in binary, if you didn’t like the easy “trick” method approach. How do you verify that the three bits we got will give you eight subnets? If you write down all possibilities of 0s and 1s, you will see that there are only eight possibilities:
000 – First subnet 100 – Fifth subnet
001 – Second subnet 101 – Sixth subnet
010 – Third subnet 110 – Seventh subnet
011 – Fourth subnet 111 – Eighth subnet

Don’t forget that these are all the possibilities with the first three bits we have borrowed. We still have 13 bits left after using these first three bits (in the third octet so we have five bits in the third octet and 8 bits in the fourth octet left, which is a total of 13 bits).

Pick any of the above three bit combinations and write them down twice (lets say we pick 011 for our example).

172.16. 011 __ __ __ __ __. __ __ __ __ __ __ __ __
172.16. 011 __ __ __ __ __. __ __ __ __ __ __ __ __

Now fill in the first one with all zeros in the 13 bits left blank and the next one with ones in the last 13 bits (remember the first number in the range is all zeros and the last number in the range is all ones).
172.16. 011 0 0 0 0 0. 0 0 0 0 0 0 0 0 which in decimal is 172.16.96.0
172.16. 011 1 1 1 1 1. 1 1 1 1 1 1 1 1 which in decimal is 172.16.127.255

WOW! This gave us the same set of numbers that we got with our short, trick method. This second verification method is not bad either, but we were lucky that we only had to write down all possibilities of 0s and 1s of only three bits. If we had a big number, we will be spending some quality time writing down ones and zeroes, which we might not appreciate.

This is end of subnetting for now, but ask yourself one question. Consider the possibility if one of these subnets was meant for a point-to-point circuit. Remember from our previous discussion that there are only two points in a point-to-point circuit, so why do we have 13 bits for hosts? With 13 bits left for host (all zeros) we get 8190 hosts per subnet. But this is a point-to-point subnet, and we will NEVER need 8190 addresses. This is a waste of addresses and not what you would want to do in a properly designed network. This is especially true when we are complaining that we are running out of IPv4 addresses and are coming up with alternate solutions like IPv6 to fix the problem of not enough addresses. To solve this problem of point-to-point interface addressing, we take the subnetting to the next step called VLSM (variable-length subnet masking). What we have done so far is FLSM (Fixed-length subnett masking). Since our host needs are not the same across the organization, we will be doing VLSM all the time, which is not a stretch from the FLSM case study we have done here and we explore VLSM in our ICND2 and the CCNA Boot Camp curricula at Global Knowledge. I can’t wait to see you there to go into more detail about VLSM.

IPv4 subnetting

2011-06-25T14:46:00.000+03:00

The process of subnetting involves the separation of the network and subnet portion of an address from the host identifier. This is performed by a bitwise AND operation between the IP address and the (sub)network prefix. The result yields the network address or prefix, and the remainder is the host identifier.

Determining the network prefix

An IPv4 network mask consist of 32 bits, a sequence of ones (1) followed by a block of 0s. The last block of zeros (0) designate that part as being the host identifier.

The following example shows the separation of the network prefix and the host identifier from an address (192.168.5.130) and its associated /24 network mask (255.255.255.0). The operation is visualized in a table using binary address formats.

	Binary form	Dot-decimal notation
IP address	11000000.10101000.00000101.10000010	192.168.5.130
Subnet mask	11111111.11111111.11111111.00000000	255.255.255.0
Network prefix	11000000.10101000.00000101.00000000	192.168.5.0
Host part	00000000.00000000.00000000.10000010	0.0.0.130

The mathematical operation for calculating the network prefix is the binary and. The result of the operation yields the network prefix 192.168.5.0 and the host number 130 of a possible maximum of 256 addresses.

Special addresses and subnets

Internet Protocol version 4 uses specially designated address formats to facilitate recognition of special address functionality. The first and the last subnets obtained by subnetting have traditionally had a special designation and, early on, special usage implications. In addition, IPv4 uses the all ones host address, i.e. the last address within a network, for broadcast transmission to all hosts on the link.

Subnet zero and the all-ones subnet

The first subnet obtained from subnetting has all bits in the subnet bit group set to zero (0). It is therefore called subnet zero. The last subnet obtained from subnetting has all bits in the subnet bit group set to one (1). It is therefore called the all-ones subnet.

Subnet and host counts

The number of subnetworks available, and the number of possible hosts in a network may be readily calculated. In the example (above) two bits were borrowed to create subnetworks, thus creating 4 (2²) possible subnets.

Network	Network (binary)	Broadcast address
192.168.5.0/26	11000000.10101000.00000101.00000000	192.168.5.63
192.168.5.64/26	11000000.10101000.00000101.01000000	192.168.5.127
192.168.5.128/26	11000000.10101000.00000101.10000000	192.168.5.191
192.168.5.192/26	11000000.10101000.00000101.11000000	192.168.5.255

The RFC 950 specification reserves the subnet values consisting of all zeros (see above) and all ones (broadcast), reducing the number of available subnets by two. However, due to the inefficiencies introduced by this convention it was abandoned for use on the public Internet, and is only relevant when dealing with legacy equipment that does not implement CIDR. The only reason not to use the all-zeroes subnet is that it is ambiguous when the prefix length is not available. All CIDR-compliant routing protocols transmit both length and suffix. RFC 1878 provides a subnetting table with examples.

The remaining bits after the subnet are used for addressing hosts within the subnet. In the above example the subnet mask consists of 26 bits, leaving 6 bits for the host identifier. This allows for 64 combinations (2⁶), however the all zeros value and all ones value are reserved for the network ID and broadcast address respectively, leaving 62 addresses.

In general the number of available hosts on a subnet is 2ⁿ−2, where n is the number of bits used for the host portion of the address.

RFC 3021 specifies an exception to this rule when dealing with 31-bit subnet masks (i.e. 1-bit host identifiers). In such networks, usually point-to-point links, only two hosts (the end points) may be connected and a specification of network and broadcast addresses is not necessary.

A /24 network may be divided into the following subnets by increasing the subnet mask successively by one bit. This affects the total number of hosts that can be addressed in the /24 network (last column).

CIDR notation	Network mask	Available subnets	Usable hosts per subnet	Total usable hosts
/24	255.255.255.0	1	254	254
/25	255.255.255.128	2	126	252
/26	255.255.255.192	4	62	248
/27	255.255.255.224	8	30	240
/28	255.255.255.240	16	14	224
/29	255.255.255.248	32	6	192
/30	255.255.255.252	64	2	128
/31	255.255.255.254	128	2 ^*	256