IT Blog

Hierarchical internetworking model

2017-04-16T23:52:00.001-07:00

The Hierarchical internetworking model is a three-layer model for network design first proposed by Cisco. It divides enterprise networks into three layers: core, distribution, and access layer.

Access layer

End-stations and servers connect to the enterprise at the access layer. Access layer devices are usually commodity switching platforms, and may or may not provide layer 3 switching services. The traditional focus at the access layer is minimizing "cost-per-port": the amount of investment the enterprise must make for each provisioned Ethernet port. This layer is also called the desktop layer because it focuses on connecting client nodes, such as workstations to the network.

Distribution layer

The distribution layer is the smart layer in the three-layer model. Routing, filtering, and QoS policies are managed at the distribution layer. Distribution layer devices also often manage individual branch-office WAN connections. This layer is also called the Workgroup layer.

Core layer

The core network provides high-speed, highly redundant forwarding services to move packets between distribution-layer devices in different regions of the network. Core switches and routers are usually the most powerful, in terms of raw forwarding power, in the enterprise; core network devices manage the highest-speed connections, such as 10 Gigabit Ethernet.

Reference

Basic Concept

2017-04-16T23:42:00.003-07:00

Cisco IOS Command Modes:

Command Mode	Access Method	Prompt
User EXEC	Log in.	Router>
Privileged EXEC	From user EXEC mode, use the enable EXEC command.	Router#
Global configuration	From privileged EXEC mode, use the configure terminal privileged EXEC command.	Router(config)#

Some basic Troubleshoot/Show Command for Router/Switch/ASA

2014-05-20T02:35:00.002-07:00

Some basic Troubleshoot/Show Command for Router/Switch/ASA:

Basic Show command:

Router#show clock

Router#show version >> System hardware and software status

Router#show hosts >> IP domain-name, lookup style, nameservers, and host table

Router#show file systems >> Device File Systems

Router#show flash: >> about flash: file system

Router#show running-config >> Current operating configuration
Router#show startup-config >> Startup configuration
Router#copy running-config startup-config >>Save running to startup config
Router#write >>Save running to startup config

Router#show arp >> IP ARP table

Router#show cdp neighbors >> CDP neighbor entries

Show Routing table:

Router#show ip route >> on router/switch

ASA#show route >> on ASA

NAT/PAT:

Router#show ip nat translations >> Translation entries

VLAN Troubleshoot command:

Router#show vtp status >> VTP domain status

Router#show vlan-switch brief >> VTP all VLAN status in brief

Router#show interfaces vlan 1 >> Catalyst Vlans

Router#show interfaces trunk >> Show interface trunk information

Switch#vlan database    >> see vlan info

ACL:

Router#show access-lists 10 >> ACL number

Router#show access-lists abc >> ACL name

How to assign IP address on Router/Switch/ASA

2014-05-20T02:24:00.001-07:00

Some basic configuration for Router/Switch/ASA:

Assign IP Address:

Router>enable

Router#configure terminal

Router(config)#interface fastEthernet 0/0 >> Same as Serial Interface

Router(config-if)#ip address 172.16.100.1 255.255.255.0 >> IP Address

Router(config-if)#no shutdown >> By default shutdown all interface so, you need to UP interface.

Assign IP Address in Router/Switch:

Router#configure terminal

Router(config)#interface vlan 1 >> Create interface as your requirement (vlan 2, vlan 3)

Router(config-if)#ip address 172.16.200.2 255.255.255.0 >> as your requirement

Router(config-if)#no shutdown

Cisco IOS Features

2012-11-18T23:19:00.002-08:00

Keyboard Shortcut for Cisco IOS:
? >> that for show help

q >> exit from anywhere

ctrl+z >> To get back from any configuration mode

ctrl+e >> move the curso to the end of line

ctrl+a >> move the curso to the begining of line

ctrl+c >> to get back from any IOS base wiser mode

Note: More features coming soon

What is VPN IPsec and how they work together

2012-10-16T01:45:00.001-07:00

Why use VPN Connections?

The Virtual Private Network,

Cheaper Connections over public network
Available anywhere the internet is available
Heavily encrypted and secured – very secure and very difficult to break. VPN take lot more overhead on router for connecting of privet line, case it lot more secure and also encrypt anything. Like more processor utilization
Many-to-Many connections – support many to many connections

The different styles of VPN connections: Cisco VPN styles

Site-to-Site (L2L) – connection between different location, provide a privet encrypt, secure connection over public network/internet.

Remote Access – Remote access allow to connect user by username/password, dialup etc. the remote access client usually are installed on PC/Laptop (Cisco vpn client, get from cisco site / in windows has built-in vpn client). (token, user/password, biometric method – like finger print, face recognize, retina scan etc ). Now have some small wireless routers that support VPN, which can be installed on client site (that also support Voice phone through VPN).

Other two new important technique to connect VPN for Remote Access, those are SSL VPN, WEB VPN. Those are same. Here the VPN supported router enables this feature and also provides like a web page for client to connect by using username/password or Token code (For Many users (50, 100) for Remote Access VPN support). Example – someone want to access remote network through VPN enable router that display a web page and asking the username/password or token. After verify user the router installs a mini VPN client tool to PC to established VPN connection. if you close the page, the VPN connection was gone.

What devices can use for VPN and Software :

What is IPSec?

The IPSec (Internet Protocol Security) is a protocol suite for securing IP (Internet Protocol) communications by Authenticating, Encrypting and Protecting each one IP packet of a communication session. (http://en.wikipedia.org/wiki/IPsec)

IPSec Modes of Communication: two type of IPsec Mode are given below.

Transport Mode: Here IPSce is enable LAN environment, everything is encrypted in LAN.

The transport mode in IPsec will encrypts everything from the transport layer and above. So port number, TCP, UDP information at transport layer and all the application layer also encrypted by IPSec (From Diagram DATA, ESP). The IPsec enable VPN style security on LAN, if somebody can grub (wire shark) the data, he don’t do anything cause is encrypted. Because most of the time attacks are initiate from inside of the network.

Tunnel Mode: The tunnel mode to securely connect local network through internet.

Here both remote internal networks connected through VPN over Public Network.

The tunnel Mode in IPSec will encrypt everything from Network layer and above.

Example - (see diagram) Here (Router R1) encrypt everything DATA, IP (Private IP) and ESP, and add new IP header (Public IP) to send other site and when Router R2 receive the packet than decrypt everything (PATA, IP (Private), ESP) and also encrypt IP header (Public IP), MAC for this internal network (LAN2). Same thing happen when Router R2 send something to Router R1.

The pieces that build IPSec:

Now get little bit technical and into the protocols that give the power to do that. The VPN technology work with the protocol that known as IPsec. IPsec is the protocol that makes VPN possible. It is the security protocol that has all of heavy encryption protocol. The IPsec work with TCP/IP protocol (TCP/IP is protocol of communication over network) and IPsec is one of those protocol that actually work at Transport Layer, like TCP or UDP you have choose, so the VPN always choose IPsec to communicating over TCP/IP network.

IPSec is not just one protocol, it combination of many things. IPsec is taking care about Authentication, Data Integrity, and Confidentiality and Anti replay. Every piece in IPSes be changeable, something new may come. It builds of four major categories of protocols:

Negotiation Protocol: This is the engine of IPSec. The negotiation protocol defines how VPN connection was built between two routers and how to implement (It tied to other method of IPsec) all of IPsec pieces like Authentications (MD5, SHA), Encryptions (DES, 3DES, AES) and Protections (also Encryption) (DH (1,2,5,7), RSA) with VPN. There some type of Negotiation Protocols, those are given bellow.

AH(Authentication Header) – AH is original engine that come out with IPsec. The problem is AH could not do Encryption. But support Authentication and Protection (Data integrity)

ESP (Encapsulating Security Payload) – ESP also the engine of IPsec, that allow Encryption (DES, 3DES and AES), Authentication (MD5, SHA), Protection (Data Integrity) (DH1,2,5,7 and RSA)

ESP₊AH – More power full than ESP also more overhead on devices.

Encryption Protocol: You can choose any one from the list for encryption to secure data

DES – (Symmetric encryption Algorithms) (Created by IBM, 56bit key (also can see 64bit key but only work 56bit key encryption )) One of the first encryption and also weak encryption protocol. Handle many connections with less processing (Note – 12 year old girl in swiden breaking the DES encryption formula)

3DES – (Symmetric encryption Algorithms) (56*3=168bit keys) is very secure and difficult to break. Uses three DES key on each block of data to create 168 bit key. Here have 3 key, so data encrypt by first key than second key encrypt the first one and than third key encrypt the second key and send to other. That usage may old router (Netgear FVS318, they use 3DES by default) to create VPN connection. 3DES have 168 bit but not secure then AES.

AES (Advanced Encryption Standard) – (Symmetric encryption Algorithms) (USA Government approve standard, 128 bit, 192 bit, 256 bit keys) Newer, More Efficient algorithm and also Most powerful encryption protocol, provide more secure encryption and also more overhead. Its Symmetric and also more process utilized.

Authentication Protocol (Data Integrity): Its an hashing Algorithms that taking care about “Data Integrity”. Making sure data does not change from source to destination. (Prevent Man-in-the-middle(MIM) attack)

MD5 – (128 bit hash), is secure hashing, but MD5 is proven as unsecure. That not broken yet but may be possibility of broken some way.

SHA-1 – (160 bit hash), most secure hashing algorithm and also not breakable

Protection Protocol (Encryption): that allows you to do all of this over public network. Every source and destination has same encryption key to travel data between them. The encryption formula allows scrambling data before send it, and the destination also has same key and able to unencrypt that data. It is possible, an hacker (MIM ) can grub the key and also change data by having some encryption and decryption process.

So (they are very similar, Secure and also unbreakable) the Diffie-Hellman and RSA protection protocol prevents this type of attack.

DH (Diffie-Hellman) – (Asymmetric encryption Algorithms) (Created formula at 1978 and came up 1997, DH1, DH2, DH5, DH7 (768bit, 1024bit, 1536bit or larger)). Generally used for VPN Connections to allow secure transfer of “Shared secret” keys and also helps to generate “Shared Secret” Keys. (See Details on Asymmetric sections)

RSA (Rivest – Shamir - Adleman)- (Asymmetric encryption Algorithms) (Came up 2000 (512bit, 768bit, 1024bit or larger)). Use for “Miscellanies” encryption (SSH, Secure server, HTTPs, VPN on Cisco devices). Is less process consumed than DH. Like generate 512 bit key on both DH and RSA, here RSA is less process consumed.

How Security over a public Network using encryption:

how is it all work, how is it possible to get true security over public network when send those key to encryption each other and also decrypt.

Two type of encryption keys algorithm:

Symmetric encryption: “Each peer uses the same key to encrypt and decrypt data (Shared Secret)”. Symmetric is uses the same key (generate by router) to encrypt and decrypt data. That uses as known as “Shared Secret” Key (DES, 3DES, AES). Symmetric encryption is really first and less overhead. DES, 3DES, AES are form symmetric encryption cause they use same key to encrypt and decrypt. Example – Router R1 encrypt data using key and send, router R2 receive and uses same key to decrypt data (see diagram).

This is possibility of grub the key by attacker (MIM), so the Diffie-Hellman (DH1, HD2, DH5, DH7) Prevent this attack, that usages in Asymmetric Encryption process.

Asymmetric Encryption: “A peer uses one key to encrypt and another key to decrypt (Public/Private)”. Asymmetric usages Diffie-Hellman (DH) protection. Asymmetric uses two type to key, Public and Private (DH Privet and DH Public). Here, Anything that it encrypt with public key that can be decrypted with privet and also anything encrypt with privet key that can be decrypted with public key. They do both but they completely opposite of each other. Here, Private Key never shares to each other, its use locally and the public key is use to encrypt “Shared Secret” key. The Diffie-Hellman is so sophisticated, secure, impossible to reverse/break the encryption.

Example – Like Site-to-Site VPN, when someone initiates VPN connection, firstly happen is the router receives the connection send a key.

R2 router want connect to R1 router, the R1 generate and send an “DH Public” key to R2 Router (The public key is plain text) and also Router R2 generate and send his “DH Public” Key to Router R1. Now Router R1 generate “Shared Secret” key and encrypt using R2 Public key and send the encrypt data to Router R2 over Internet. Also the Router R2 generate “Shared Secret” key and encrypt using R1 Public key and sent to Router R1 over internet. After exchange “Shared Secret” key, only the router decrypt those key by using the Private Key of the router (DH Private). The (DH Private) key never ever shares to other, cause it local. So both sites can use the “Share Secret” key for all future communication and also allowing secure communication over internet.

Once the VPN connection is done, the “Shared Secret” key was gone and next time the VPN connection happen than new “Shared Secret” key going to be generated.

The encryptions (Shared Secret) that are being use to encrypt all the data over VPN that are constantly changing, means always being regenerate and renew. At Site-to-Site VPN that always be connected, so after certain amount of time a new (Shared Secret) key will be regenerated and encrypt by using Diffie-Hellman or RSA key to securely exchange data over VPN.

The VPN session has a lifetime either amount of Second (86400) or in Kilobyte (4Mb). When the session reach the amount of time and also send about 4Mb data over VPN the router flash the old “Shared Secret” key and generate new one.

Why need “Shared Secret” Key in Asymmetric (DH)?

The Asymmetric are more overhead and more process consume, hundred time (if have dedicated hardware board inside the router) and it will be thousand times (if do not have dedicated hardware board inside the router) then symmetric and Symmetric is less overhead and Faster. Asymmetric key size is 1024 bit (Most Secure) and Symmetric key size 128 bit (Less Secure). Only thing, you can use those “DH” and other one “RSA” (RSA another standard of Asymmetric encryption) standard to encrypt “Shared Secret” key (the router now in less process). So both work together and provide more secure and faster VPN connection over Internet.

How devices authenticate to an IPSec VPN (Digital Signatures and PKT, The method for authenticating across VPN):

There are many way to authenticate VPN, those are describe below –

Using Username/Password, Biometric: (Remote Access)

VPN allow you to authenticate using username/password or Biometric method. Means you have laptop so you can use like finger print, face recognize, retina scan etc to authenticate

One time password: (Remote Access)

You can see in credit card process, you may use the password one time to authenticate VPN and hit the button of credit card that say your password valid for like 1 or 2 minute after the time expired, you never use this password again cause your password no longer valid.

The above methods (Username/password, “Biometric” or One time Password) are for Remote Access VPN and In Site-to-Site VPN authentication have two primary methods (Pre-Shared key, Certificate). Those are describe below

Pre-Shared Key: (Site-to-Site)

The pre-shared key is just like a password. So same Pre-Shared key configured on both site to authenticate each other. It’s plain security and pretty good security. In addition feature of Pre-shared Key also have the VPN is being tied with those physical address (Public IP).

Example: Here router (R1) wants to start VPN connection and send a packet with pre-shared key “cisco123” to Route (R2). Now Router (R2) check out own pre-shared key, it’s “cisco123”, so Router (R2) allowed the VPN connection with Router (R1).

In the Remote access VPN people are connected to route from anywhere by using username/password, Biometric, Dialup. The problem is that anyone could start attack (Using dictionary attack, trying with different keys) to trying getting access in VPN. So we have to configure trusted physical address (Public IP) list (Access-list) who is allow or not (No body on internet has the same Public IP address). So my key is “cisco123” but I only allow those who have in my trusted list. Here have another problem, what about “IP Spoofing”, people aren’t able to “IP spoofing” in IPsec VPN connection. Cause here to many layer of security happen in IPsec VPN.

The problem of Pre-Shared key on Scalability:

In the diagram we have 5 routers and configure Site-to-Site VPN with different Pre-Shared Key like R1-R2 (cisco1), R1-R5 (cisco2), R1-R4 (cisco3), R1-R3 (cisco4) so on. The Pre-Shared key is use to generate encryption key for VPN, if the same key keep for long time that would be possibility of broken the key by attacker. So the good practice is that those key need to be change periodically basic, once every month, once every six month or once every year.

This is a small network. In large network there has like 50 or 100 or more routers that will be very difficult to change Pre-Shared key to periodically basic. So here is the better solution for the system. Its call “Certificates”

Certificates: (Site-to-Site) “what is Certificate”

In the system that has centralize Certificate Authority (CA) who provide certificate to authentication IPsec VPN connection. Everybody trusts to Certificate Authority. The Certificate authority issue and provides Certificate to everyone to established VPN between them.

Example: Router (R1) would like to stat VPN with you, this Route (R2) says do you have Pre-Shared key? Router (R1) answered to Router (R2) no and also I have something better that is “Certificate” that get from Certificate Authority (CA). So router (R2) trusted R1 and stat VPN. (How they doing that, Having they create two way trusted relationship between every single one of the router with pre-shared key.)

How Certificate works? Why the certificate most trusted?

If Router has a Certificate that says other router about the certificate so other router trusted the certificate and allows access to the whole network.

Every single Router in network has the own certificate that are given by CA. Each Certificate has three (3) parts:

Public Key – Public key of the Router (R1). This is Asymmetric Encryption public key “DH Public” 1024-bit (In IPsec).

Device Signature – is the name of the Router (R1). The name is combined of “hostname+domain name” (R1.tramsit.com) fully qualified domain name, it’s (Router R1) going to sign this certificate with his name. You know in Asymmetric encryption each router has Private Key (DH Private Key) is encrypted with the Device name (R1.tramsit.com) (the private key not often using for encryption but in this case it happen) and create a Signature. What that does, it’s allow the router receiving Public key (its other router public key that encrypted with “Session key or Shared Secret” key) to using it (Public Key) to decrypt the signature, it’s look like the name of R1.tramsit.com. (Remember that, (Asymmetric Encryption) Anything that it encrypt with public key that can be decrypted with privet and also anything encrypt with privet key that can be decrypted with public key. They do both but they completely opposite of each other.)

CA Signature - The certificate Authority who gave you the Certificate (Puts stamp of approval) (it’s may windows 2003, Linux or having special CA Box). The CA is validate this certificate and the public key (its R1 Public key) and the Device Signature (Decrypt by CA, ok its R2.tramsit.com) of the router (R1). So any other router should trust the certificate of R2 cause it validates by CA.

The CA signature is the name of the CA (ca.cas.com). The name is encrypted with CA private key (that is not mean the private key of CA is sitting on the Certificate, nobody has that (Private Key) except the CA). Here everybody who is in the CA trusted list (all the member/route of VPN) they have the “Public key” of CA, that’s part of CA process.

So, everybody got the CA “Public Key” because they trust CA. the part of that trust relationship is to get public key of CA. when they get the certificate they decrypt (they decrypt using the CA “Public key”) the stamp and see the name of CA (ca.cas.com) that they all trust. No one else could sign it that and also encrypt that with “Private Key” of CA except CA.

One another thing if your CA is compromised (The CA “Public Key” and “Private Key” compromise by attacker), this is the solution is to change the CA.

Certificate Standards: industry standard

Public Key Cryptography Standard (PKCS) #7 - PKCS#7 is the standard for signing Certificate. Is “CA Signature” of a Router that signed by CA (Stamp of approval).

Public Key Cryptography Standard (PKCS) #10 - PKCS#10 is the standard format for sending certificate request. The end router send a certificate request using SCEP protocol to CA that request has to flow specific guideline. That has ask for certain thing, sign in certain way etc

RSA (Rivest-Shamir-Adleman) keys - RSA – is use for SSH, secure web services on router, also use for VPN Connection.

X.509 Certificates – Industry standard, this is the Certificate itself having public key of router, signature of router and stamp of approval from CA.

The Cisco routers support CA from the flowing entity:

Entrust, Baltimore, Verisign – well known, Windows 2000, 2003

The Certificate Enrollment Process:

This Process done by SCEP, more details at below:

About PKI(Public Key Infrastructure) – the whole idea of trusting of CA, that can be higher key of CA, the CA is trusted to another CA, if you trust that CA than that CA is well, is a big system that call PKI.

If you want to implementing Certificate Authority in your network so you have to fast enroll your devices with your CA. it’s basically done either on OOB (Out-of-Band) management network or you can do with flash drive (with USB has Certificate). Remember that if the process has compromise the whole system will be broken by attacker.

Example of Enroll process: First I point R1 to CA IP address and request for enroll/trust. The CA send his certificate to router R1 (this is CA certificate not the R1 certificate), the CA certificate has CA “Public key”, “CA Signature”. Now the router (R1) trusts the CA Certificate and adds this into the router configuration (Same thing for all). So all router have the CA certificate and “Public Key”, (that’s the first step) also all router trust the CA. Now CA will send the router (all) their own Certificate and the routers installed that (Second step). (That Describe in Certificate Section above)

Now Router R1 going to establish VPN with Router R2, Router R1 says to Router R2 I got the certificate (have Public key, Device Signature, Stamp of CA)from CA, so router R2 trusted Router R1 and also send him his Certificate. After exchange Certificate they both generate some “Session Key” using like DH formula based on both certificate exchanges and now they communicate using this session key for the VPN. All of this happens without typing “Pre-Shared key” between them and also they trusting the CA system.

Simple Certificate Enrollment Protocol (SCEP) Protocol:

SCEP is a standard, which uses an automated method to send certificates to end devices. By using SCEP protocol the CA sending certificate to the router, wireless, laptop etc.

That done by two Modes:

Manually – Its an manual process, where certificate approve by locale Administrator, nothing is automated. If someone wants to get certificate the administrator manually allow him to the trusted list of CA. this is very difficult process if there have large network.

Example: Router R1will use the SCEP says the CA I would like to trust you and could you send me certificate. Once the request comes in, the Certificate Authority (CA) administrator approve this request manually, here is your certificate.

Pre-Shared - when you have large network and want to approve many devices like Router, laptop etc, than you configure Pre-Shared key (cisco123). So any request comes with the same pre-shared key that will be automatically approved by CA. Once all devices on network have certificate and the pre-shared key is no longer “cisco123” than you might me change it manually. Os at initial setup pre-shared is better solution.

Understanding VPN Architecture and how the IPSec VPN Negotiation process works:

How IPsec VPN Negotiation process work:

Here is the step by step process of how every single VPN connection is established and what happen make the VPN come up. Basically first three steps is the main configuration of VPN. Those steps describe below

Interesting Traffic Triggers VPN:

Is the traffic that matches on a router to transfer across the VPN between both sites. When I setup VPN, first we have to define which network traffic is considering as interesting traffic on both sites. Basically we configure access list to define interesting traffic.

Example: Here 172.16.10.0 is source address for Router R1 and destination address is 192.168.10.0 and also 192.168.10.0 is source address for Router R2 and destination address is 172.16.10.0. (if someone have another address (172.16.11.0) except those address (Like Internet host) that’s not bring up the VPN). So here 172.16.10.0 (R1 site) and 192.168.10.0 (R2 site) address is interesting traffic.

Interesting traffic decision – when router receives traffic that destines through VPN this have three choices:

Choice 1 (Encrypt Using IPSec) –

Route R1 configure access-list for interesting traffic is 172.16.10.0 and destination is 192.168.10.0 and also Router R2 configure access-list for interesting traffic is 192.168.10.0 and destination is 172.16.10.0, all of those IP address was encrypted for VPN connection on both sites.

The encryption has to be identically define on both sites connection otherwise the VPN connection was failed (like, in one site (R1) encrypted half the 172.16.10.0 and other site (R2) encrypted full the 172.16.10.0, so the connection was failed. They has to Identical (says Cryptomap), means this two are the same).

Choice 2 (Send In Clear Text) –

From the above description, the 172.16.10.0 and 192.168.10.0 is encrypted. So if I go with some IP (172.16.10.0 or 172.16.11.0) that not encrypted that will sent in clear text.

That is also calling like Split tunneling. The split tunneling is actually use for “Remote Access” VPN. The Split tunneling is pass traffic across VPN tunnel (site to site) and also split some traffic from tunnel for public internet, which does not match on cryptomap and the encryption list. So the unencrypted/normal traffic not goes through VPN tunnel.

If encrypt all of those traffic (traffic for search internet) which don’t need VPN tunnel, so those traffic first go other site using VPN tunnel and then goes to internet (just adding hops). So identify first what traffic need to be encrypted.

Choice 3 (Discard the Traffic) –

Router R2 has an encryption map (Cryptomap) but he receives a packet from Router R1 that not encrypted, So that will be discarded (Reason of IP Spoofing).

The VPN is not the one tunnel (Its tunnel inside of tunnel), it’s actually having 2 tunnels and the first one is IKE Phase 1 and second one IKE Phase 2 (also called IPsec tunnel).

IKE(Internet key Exchange) Phase 1:

IKE Phase 1, is the initial phase of security, its goal is to exchange VPN keys securely (AES 128bits) between two sites. The most important phase of everything IPSec VPN and it design to negotiate VPN.

In the IKE Phase 1exchange 3 types of message

Message 1 (Exchange and Negotiate Policy) – the first step/message that exchange and negotiate policy between two site. So you can make sure correctly configure policy on both site.

The router R1 may have site-to-sit VPN connections with Router R2 and R1 may also have other site-to-site VPN connections. So inside of that router (R1) define multiple policy lists, like Policy 1 (Pre-shared key, DH L5, AES 256bits), Policy 2 (Pre-shared key, DH L2, AES 256bits), Policy 3 (Pre-Shared Key, DH L5, DES) etc (you can create 60 thousand of policy), so the other site router (R2) must having policy that match with one policy of R1 to establish IKE Phase 1 otherwise the negotiation is failed.

You can create different policy for all of your VPN connections, those usage your policy as priority base.

Message 2 (Exchange Diffie Hellman Keys) – start this step after complete Message 1.

In the step both site exchange DH Public key to each other and they also use symmetric encryption algorithm (You know DH is asymmetric, so why use symmetric. The reason is less process consume).

Now they use the public key (magic of DH) on each site and combined with randomize number on both site and also each site will generate an identical symmetric encryption key. So that like the same AES (128-256) bits key will generate on both site and using this key, all future traffic pass through VPN.

Message 3 (Identity Verification) -

So what they do, Send the public key over to each other and verify identity, verify right pre-shared key if using, verify certificates if using that. (This step actually happen in Message 3)

IKE(Internet Key Exchange) Phase 2:

IKE Phase 2 is often called IPsec tunnel Phase/VPN Phase and use for actual data transfer; this is the tunnel inside of tunnel. The IKE Phase 2 is exchange keys (AES 128 bits) and transfer data after successfully complete IKE Phase 2.

“IKE Phase 2” is actually after exchange all your keys in “IKE Phase 1” verifying other site who they are and setup the secure tunnel for your key exchange. Now is start is called IPsec Transform set.

The IPsec Transform set is generate symmetric encryption keys, that would be use for rest of the session (here both site exchange DH public key and setup secure tunnel). Now generate symmetric key based on Transform set (that is actually configuration line), this transform set like AES 256 bits (that’s your Symmetric key) on both sites. The symmetric keys negotiate and exchange now they using those for all over data communicated between two routers. That’s the actually data transmission phase.

VPN Teardown (Lifetime): how long the VPN tunnel will stay? After certain amount of idle time, no one use VPN anymore so it wills timeout until interesting traffic come again. It’s actually based on

Time – once the VPN reach the lifetime (86,400 seconds) (Still exchange data) they renegotiate the keys. The symmetric algorithm is very strong (Not like asymmetric key), so IPsec VPN will generate fresh symmetric key after certain amount of times to continuing VPN connection.

Data – once the certain amount of data exchange (like 4Mb) a fresh symmetric algorithm is come. After 4 Mb of data exchange between two routers the current symmetric key is trash and generate new symmetric key for next 4Mb to keep exchange data over VPN.

If someone tries to breaking key, may be it success after 100 years to breaking the key. There are 50 billion different keys, each time the router takes new key and renegotiation key after trashing old one. This processes same for both symmetric and asymmetric algorithm.

Example of IPSec VPN Configuration:
* How to Configure Site-to-Site IPSec VPN

view VPN session form messages

2012-10-16T01:09:00.000-07:00

"What is VPN IPsec and how they work together"

HQ#

*Mar 1 01:45:36.431: ISAKMP: received ke message (1/1)

*Mar 1 01:45:36.435: ISAKMP:(0:0:N/A:0): SA request profile is (NULL) >> "Requesting profile"

*Mar 1 01:45:36.439: ISAKMP: Created a peer struct for 200.200.1.2, peer port 500 >> creating new peer, ISAKMP port 500

*Mar 1 01:45:36.439: ISAKMP: New peer created peer = 0x64946CF0 peer_handle = 0x80000002

*Mar 1 01:45:36.443: ISAKMP: Locking peer struct 0x64946CF0, IKE refcount 1 for isakmp_initiator

*Mar 1 01:45:36.447: ISAKMP: local port 500, remote port 500

*Mar 1 01:45:36.447: ISAKMP: set new node 0 to QM_IDLE

*Mar 1 01:45:36.451: insert sa successfully sa = 655EB81C

*Mar 1 01:45:36.455: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode.

*Mar 1 01:45:36.455: ISAKMP:(0:0:N/A:0):Looking for a matching key for 200.200.1.2 in default

*Mar 1 01:45:36.459: ISAKMP:(0:0:N/A:0): : success

*Mar 1 01:45:36.459: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 200.200.1.2

*Mar 1 01:45:36.467: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-07 ID >> creating NAT Transparence tunnel

*Mar

HQ# 1 01:45:36.467: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-03 ID

*Mar 1 01:45:36.471: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-02 ID

*Mar 1 01:45:36.471: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

*Mar 1 01:45:36.475: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1 >> IKE phase is ready (Sending packet no 1)

*Mar 1 01:45:36.479: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange

*Mar 1 01:45:36.483: ISAKMP:(0:0:N/A:0): sending packet to 200.200.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE >> sending packet

*Mar 1 01:45:36.715: ISAKMP (0:0): received packet from 200.200.1.2 dport 500 sport 500 Global (I) MM_NO_STATE >> Receiving Packet

*Mar 1 01:45:36.731: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Mar 1 01:45:36.735: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_I_MM2 >> Move into IKE phase 1 to IKE Phase 2 (Still in IKE Phase 1 and packet no 2)

*Mar

HQ# 1 01:45:36.743: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0

*Mar 1 01:45:36.747: ISAKMP:(0:0:N/A:0): processing vendor id payload

*Mar 1 01:45:36.747: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 245 mismatch

*Mar 1 01:45:36.751: ISAKMP (0:0): vendor ID is NAT-T v7

*Mar 1 01:45:36.755: ISAKMP:(0:0:N/A:0):Looking for a matching key for 200.200.1.2 in default >> Try to Matching Pre-shared key of remote

*Mar 1 01:45:36.755: ISAKMP:(0:0:N/A:0): : success

*Mar 1 01:45:36.759: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 200.200.1.2 >> Found Pre-Shared Key of Remote

*Mar 1 01:45:36.759: ISAKMP:(0:0:N/A:0): local preshared key found >> matching with own Pre-shared key, success

*Mar 1 01:45:36.767: ISAKMP : Scanning profiles for xauth ...

*Mar 1 01:45:36.767: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 10 policy >> sending priority 10 policy and checking policy

*Mar 1 01:45:36.771: ISAKMP: encryption AES-CBC

*Mar 1 01:45:36.775: ISAKMP: keylength of 128

*Mar 1 01:45:36.779: ISAKMP: hash SHA

*Mar 1 01:45:36.779: ISAKMP: default group 2

*Mar 1 01:45:36.787: ISAKMP: auth pre-share

*Mar 1 01:45:36.787: ISAKMP: life type in seconds

*Mar 1 01:45:36.787: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80

*Mar 1 01:45:36.803: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0 >> attribute are acceptable

*Mar 1 01:45:36.911: ISAKMP:(0:1:SW:1): processing vendor id payload

*Mar 1 01:45:36.915: ISAKMP:(0:1:SW:1): vendor ID seems Unity/DPD but major 245 mismatch

*Mar 1 01:45:36.915: ISAKMP (0:134217729): vendor ID is NAT-T v7

*Mar 1 01:45:36.915: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Mar 1 01:45:36.915: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2

*Mar 1 01:45:36.919: ISAKMP:(0:1:SW:1): sending packet to 200.200.1.2 my_port 500 peer_port 500 (I) MM_SA_SETUP

*Mar 1 01:45:36.923: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Mar 1 01:45:36.923: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3

*Mar 1 01:45:37.115: ISAKMP (0:134217729): received packet from 200.200.1.2 dport 500 sport 500 Global (I) MM_SA_SETUP

*Mar 1 01:45:37.123: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Mar 1 01:45:37.123: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM3 New State = IKE_I_MM4

*Mar 1 01:45:37.135: ISAKMP:(0:1:SW:1): processing KE payload. message ID = 0

*Mar 1 01:45:37.239: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 0

*Mar 1 01:45:37.239: ISAKMP:(0:0:N/A:0):Looking for a matching key for 200.200.1.2 in default

*Mar 1 01:45:37.243: ISAKMP:(0:0:N/A:0): : success

*Mar 1 01:45:37.243: ISAKMP:(0:1:SW:1):found peer pre-shared key matching 200.200.1.2

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1):SKEYID state generated

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1): processing vendor id payload

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1): vendor ID is Unity

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1): processing vendor id payload

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1): vendor ID is DPD

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1): processing vendor id payload

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1): speaking to another IOS box!

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Mar 1 01:45:37.247: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM4

*Mar 1 01:45:37.251: ISAKMP:(0:1:SW:1):Send initial contact

*Mar 1 01:45:37.255: ISAKMP:(0:1:SW:1):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

*Mar 1 01:45:37.255: ISAKMP (0:134217729): ID payload

next-payload : 8

type : 1

address : 100.100.1.2

protocol : 17

port : 500

length : 12

*Mar 1 01:45:37.255: ISAKMP:(0:1:SW:1):Total payload length: 12

*Mar 1 01:45:37.263: ISAKMP:(0:1:SW:1): sending packet to 200.200.1.2 my_port 500 peer_port 500 (I) MM_KEY_EXCH

*Mar 1 01:45:37.263: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Mar 1 01:45:37.267: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM5

*Mar 1 01:45:37.395: ISAKMP (0:134217729): received packet from 200.200.1.2 dport 500 sport 500 Global (I) MM_KEY_EXCH

*Mar 1 01:45:37.403: ISAKMP:(0:1:SW:1): processing ID payload. message ID = 0

*Mar 1 01:45:37.407: ISAKMP (0:134217729): ID payload

next-payload : 8

type : 1

address : 200.200.1.2

protocol : 17

port : 500

length : 12

*Mar 1 01:45:37.411: ISAKMP:(0:1:SW:1):: peer matches *none* of the profiles

*Mar 1 01:45:37.415: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = 0

*Mar 1 01:45:37.423: ISAKMP:(0:1:SW:1):SA authentication status:

authenticated

*Mar 1 01:45:37.423: ISAKMP:(0:1:SW:1):SA has been authenticated with 200.200.1.2

*Mar 1 01:45:37.427: ISAKMP: Trying to insert a peer 100.100.1.2/200.200.1.2/500/, and inserted successfully 64946CF0.

*Mar 1 01:45:37.431: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH

*Mar 1 01:45:37.435: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM5 New State = IKE_I_MM6

*Mar 1 01:45:37.443: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

*Mar 1 01:45:37.447: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM6 New State = IKE_I_MM6

*Mar 1 01:45:37.459: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

*Mar 1 01:45:37.459: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE

*Mar 1 01:45:37.471: ISAKMP:(0:1:SW:1):beginning Quick Mode exchange, M-ID of 1792755294

*Mar 1 01:45:37.487: ISAKMP:(0:1:SW:1): sending packet to 200.200.1.2 my_port 500 peer_port 500 (I) QM_IDLE

*Mar 1 01:45:37.491: ISAKMP:(0:1:SW:1):Node 1792755294, Input = IKE_MESG_INTERNAL, IKE_INIT_QM

*Mar 1 01:45:37.491: ISAKMP:(0:1:SW:1):Old State = IKE_QM_READY New State = IKE_QM_I_QM1

*Mar 1 01:45:37.495: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

*Mar 1 01:45:37.499: ISAKMP:(0:1:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

*Mar 1 01:45:37.687: ISAKMP (0:134217729): received packet from 200.200.1.2 dport 500 sport 500 Global (I) QM_IDLE

*Mar 1 01:45:37.699: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = 1792755294

*Mar 1 01:45:37.703: ISAKMP:(0:1:SW:1): processing SA payload. message ID = 1792755294

*Mar 1 01:45:37.707: ISAKMP:(0:1:SW:1):Checking IPSec proposal 1

*Mar 1 01:45:37.707: ISAKMP: transform 1, ESP_AES

*Mar 1 01:45:37.707: ISAKMP: attributes in transform:

*Mar 1 01:45:37.711: ISAKMP: encaps is 1 (Tunnel)

*Mar 1 01:45:37.711: ISAKMP: SA life type in seconds

*Mar 1 01:45:37.715: ISAKMP: SA life duration (basic) of 3600

*Mar 1 01:45:37.715: ISAKMP: SA life type in kilobytes

*Mar 1 01:45:37.719: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0

*Mar 1 01:45:37.723: ISAKMP: authenticator is HMAC-SHA

*Mar 1 01:45:37.723: ISAKMP: key length is 128

*Mar 1 01:45:37.727: ISAKMP:(0:1:SW:1):atts are acceptable.

*Mar 1 01:45:37.735: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 1792755294

*Mar 1 01:45:37.739: ISAKMP:(0:1:SW:1): processing ID payload. message ID = 1792755294

*Mar 1 01:45:37.759: ISAKMP: Locking peer struct 0x64946CF0, IPSEC refcount 1 for for stuff_ke

*Mar 1 01:45:37.763: ISAKMP:(0:1:SW:1): Creating IPSec SAs

*Mar 1 01:45:37.767: inbound SA from 200.200.1.2 to 100.100.1.2 (f/i) 0/ 0

(proxy 192.168.10.0 to 172.16.10.0)

*Mar 1 01:45:37.771: has spi 0x961E59E3 and conn_id 0 and flags 2

*Mar 1 01:45:37.771: lifetime of 3600 seconds

*Mar 1 01:45:37.779: lifetime of 4608000 kilobytes

*Mar 1 01:45:37.779: has client flags 0x0

*Mar 1 01:45:37.779: outbound SA from 100.100.1.2 to 200.200.1.2 (f/i) 0/0

(proxy 172.16.10.0 to 192.168.10.0)

*Mar 1 01:45:37.783: has spi -1471896333 and conn_id 0 and flags A

*Mar 1 01:45:37.791: lifetime of 3600 seconds

*Mar 1 01:45:37.791: lifetime of 4608000 kilobytes

*Mar 1 01:45:37.791: has client flags 0x0

*Mar 1 01:45:37.799: ISAKMP:(0:1:SW:1): sending packet to 200.200.1.2 my_port 500 peer_port 500 (I) QM_IDLE

*Mar 1 01:45:37.803: ISAKMP:(0:1:SW:1):deleting node 1792755294 error FALSE reason "No Error"

*Mar 1 01:45:37.807: ISAKMP:(0:1:SW:1):Node 1792755294, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH

*Mar 1 01:45:37.811: ISAKMP:(0:1:SW:1):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE

*Mar 1 01:45:37.827: ISAKMP: Locking peer struct 0x64946CF0, IPSEC refcount 2 for from create_transforms

*Mar 1 01:45:37.831: ISAKMP: Unlocking IPSEC struct 0x64946CF0 from create_transforms, count 1

HQ#

How to Configure Site-to-Site IPSec VPN

2012-10-16T00:06:00.001-07:00

This is document about configuring of Site-to-Site IPSec VPN:

"What is VPN IPsec and how they work together"

IKE Phase 1: Define ISAKMP Policy and other Required Elements:

IKE Phase 1 configure for establishing authentication and a secure tunnel for IKE Phase 2 (IPsec Tunnel) exchange data over VPN

The Required elements for IKE Phase 1 on both sites and some of elements must be match on both sites:

Remote peer IP or Hostname (IKE Phase 1) – IP address of both sites or may use hostname “Fully Qualified Domain Name” (Host name also good cause if your router get IP address from DHCP, means your IP constantly changes).

Key distribution method – what level of protection key you use, like DH (1,2,5,7) Asymmetric Algorithm.

Authentication method – you may have “pre-share key” or “Certificate” on both sites that say who you are.

Encryption Algorithm – After complete Asymmetric encryption (once the DH public key exchange), what symmetric encryption you use for Phase 1 encryption tunnel

Hashing Algorithm – may use MD5 or SHA

Lifetime – How long time you want to take for the IPsec VPN timeout (86,400 is Default)

Policy for both Routers of IKE Phase 1:

Encryption: AES 128

Hashing: SHA-1

Authentication: Pre-Shared

Protection: DH2

Lifetime: 86,400

IKE Phase 2: Define IPsec Policy and other Required Elements:

IKE Phase 2 focuses on Establishing secure IPsec tunnel for data transfer. (Once the Phase 1 is completed than bring separate tunnel for data transfer by using those keys)

The Required elements for IKE Phase 2 on both sites and some of elements must be match on both sites:

Transform Set – Set the level of encryption (DES, 3DES, AES) and hashing (MD5, SHA) use for data transfer tunnel

Peer Information – Just about IP address of both (Duplicate information)

Interesting Traffic – Configure Access-list for Interesting Traffic that need to be encrypted from one to other.

Policy for both Routers of IKE Phase 2 (IPsec tunnel):

Encryption – ESP-AES

Hassing – ESP-SHA-HMAC

About ISAKMP (Internet Security Association and Key Management Protocol) – this protocol defined by “RFC 2408” for establishing SA (Security Associations) and cryptographic key in an internet environment. ISAKMP only provides a framework for authentication and key exchange and is designed to be key exchange independent protocols such as IKE (Internet Key Exchange) and KINK (Kerberized Internet Negotiation of Keys) provide authenticated keying material for use with ISAKMP. (Reference:http://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol)

Here I design an simple topology for implement site to site IPsec VPN

Step by Step Configuration of IKE Phase 1 and 2 For IPSec VPN:

IKE Phase 1 Configuration step:

Step 1: Enable ISAKMP: (Must be enable)

HQ(config)#crypto isakmp enable

Step 2: Create ISAKMP Policy (Configure policy as your requirement)

HQ(config)#crypto isakmp policy 10 >> 10 is Priority, Lower is best.

HQ(config-isakmp)#encryption aes 128 > aes with 128 bits

HQ(config-isakmp)#authentication pre-share > use pre-share key

HQ(config-isakmp)#group 2 >>DH Level 2 (1024 bits encryption)

HQ(config-isakmp)#hash sha >> 160 bits

HQ(config-isakmp)#lifetime 86400 > default lifetime

Step 3: Configure ISAKMP Identity (May be Address/Hostname)

HQ(config)#crypto isakmp identity address

Step 4: Configure Pre-Shared Keys

HQ(config)#crypto isakmp key 0 cisco123 address 200.200.1.2 > 0 means password not encrypted.

IKE Phase 2 Configuration Step:

Step 1: Create Transform sets (Set encryption and hashing for data tunnel “IPsec”)

HQ(config)#crypto ipsec transform-set site2site esp-aes 128 esp-sha-hmac

Note: HQ(config)#crypto ipsec transform-set site2site esp-aes 128 esp-sha-hmac mode transport >> enable IPsec transport mode (everything is encrypted) over LAN environment. But tunnel mode is on by default.

Step 2: Configure IPsec Lifetime (Optional, may be time or kilobytes)

HQ(config)#crypto ipsec security-association lifetime “seconds/kilobytes” “number” >> configure as requirement (86400), but careful about Voice network

Step 3: Create access-list (ACLs) for interesting traffic (everything is encrypted)

HQ(config)#ip access-list extended hq2branch

HQ(config-ext-nacl)#permit ip 172.16.10.0 0.0.0.255 192.168.10.0 0.0.0.255

Step 4: Set up IPsec Crypto-map (Crypto-map keep tied everything together)

HQ(config)#crypto map s2s_VPN 10 ipsec-isakmp > one sequence (10) no per interface

HQ(config-crypto-map)#match address hq2branch >> ACL

HQ(config-crypto-map)#set peer 200.200.10.2

HQ(config-crypto-map)#set pfs group2 >> DH L2 for data tunnel (Optional)

HQ(config-crypto-map)#set transform-set site2site

Apply on Interface:

HQ(config)#interface s0/0

HQ(config-if)#crypto map s2s_VPN

Note: Configure as same on other site router (Branch), just change Peer and ACL as your requirement

IPsec VPN Verification Command Lists, for more details check out below:

HQ#show crypto isakmp policy

HQ#show crypto map

HQ#show running-config | section crypto map

HQ#show crypto ipsec transform-set

HQ#show crypto isakmp sa

HQ#show crypto ipsec sa

HQ#debug crypto ipsec

HQ#debug crypto isakmp

HQ#clear crypto sa

IPsec VPN Verification Command with More Details:

HQ#show crypto isakmp policy >> to view isakmp policy that I created

HQ#show crypto map >> to view crypto map

Before apply "HQ(config-if)#crypto map s2s_VPN" command

After apply "HQ(config-if)#crypto map s2s_VPN" command

HQ#show running-config | section crypto map >> to view only such crypto section

HQ#show crypto ipsec transform-set

HQ#show crypto isakmp sa >> SA (Security Association) to show IKE Phase 1 tunnel
View IKE Phase 1 without passing any traffic through tunnel (interesting traffic)

View IKE Phase 1 after passing traffic through tunnel (interesting traffic)

Note: first time you may see there are no entry, when some traffic pass through tunnel than you will see the entry (destination and source addresses, QM_IDLE – means the tunnel is engaged and good to go, Active – means the tunnel is active)

HQ#show crypto ipsec sa >> SA (Security Association) to show IKE Phase 2 tunnel
View IKE Phase 2 without Creating IPsec Session

View IKE Phase 2 after Creating IPsec Session

Note: If something unmatched found on above marked fields, than something was wrong in tunnel 2 (like crypto map, ACL etc).

HQ#debug crypto ipsec

HQ#debug crypto isakmp > to show message how to VPN form

HQ#clear crypto sa > Clear VPN sessions, on #debug crypto iskmp command before apply #clear crypto sa command to see all messages

Important: Here we see more details about all of messages of VPN sessionform.

Running Configuration of all routers on above topology (VPN):

Router HQ:

hostname HQ

crypto isakmp policy 10

encr aes

authentication pre-share

group 2

crypto isakmp key cisco123 address 200.200.1.2

no crypto isakmp ccm

crypto ipsec transform-set site2site esp-aes esp-sha-hmac

crypto map s2s_VPN 10 ipsec-isakmp

set peer 200.200.1.2

set transform-set site2site

match address hq2branch

interface Serial0/0

description "Connected to IPS"

ip address 100.100.1.2 255.255.255.252

serial restart-delay 0

no dce-terminal-timing-enable

crypto map s2s_VPN

interface FastEthernet1/0

description "Connected to HQ Inside Network"

ip address 172.16.10.1 255.255.255.0

duplex auto

speed auto

no ip http server

no ip http secure-server

ip classless

ip route 0.0.0.0 0.0.0.0 Serial0/0

ip access-list extended hq2branch

permit ip 172.16.10.0 0.0.0.255 192.168.10.0 0.0.0.255

end

Router Branch:

hostname Branch

crypto isakmp policy 10

encr aes

authentication pre-share

group 2

crypto isakmp key cisco123 address 100.100.1.2

no crypto isakmp ccm

crypto ipsec transform-set site2site esp-aes esp-sha-hmac

crypto map s2s_VPN 10 ipsec-isakmp

set peer 100.100.1.2

set transform-set site2site

match address branch2hq

interface Serial0/1

description "Connected to ISP"

ip address 200.200.1.2 255.255.255.252

serial restart-delay 0

no dce-terminal-timing-enable

crypto map s2s_VPN

interface FastEthernet1/0

description "Connected to Branch Inside Network"

ip address 192.168.10.1 255.255.255.0

duplex auto

speed auto

no ip http server

no ip http secure-server

ip classless

ip route 0.0.0.0 0.0.0.0 Serial0/1

ip access-list extended branch2hq

permit ip 192.168.10.0 0.0.0.255 172.16.10.0 0.0.0.255

end

Router ISP:

hostname ISP

interface Loopback0

ip address 10.10.10.10 255.255.255.255

interface Serial0/0

description "Connected to HQ"

ip address 100.100.1.1 255.255.255.252

serial restart-delay 0

clockrate 64000

no dce-terminal-timing-enable

interface Serial0/1

description "Connected to Branch"

ip address 200.200.1.1 255.255.255.252

serial restart-delay 0

clockrate 64000

no dce-terminal-timing-enable

no ip http server

no ip http secure-server

ip classless

ip route 100.100.1.0 255.255.255.252 Serial0/0

ip route 200.200.1.0 255.255.255.252 Serial0/1

end

How to configure a Route as Frame Relay Switch

2012-09-26T03:37:00.003-07:00

What is Frame Relay?

Here I am going to configure about how a router act as frame relay switch. One important thing is that Frame-Relay switch must be configured as DCE. (The Frame-Relay switch must be DCE. In GNS3 on both sites serial interface is DCE, whatever that need to configure clock rate. Clock rate depend on cable type you have. Check out about DCE or DTE by typing ##show controller interface s0/1 command)

Topology of network:

Frame-Relay Network Topology:

Step 1: Turn on Frame-Relay PVC switching capable feature on this route.

FrameRelay(config)#frame-relay switching >> Global Config mode

Step 2: Configure Serial interface to provide Frame-Relay switching

FrameRelay(config)#interface serial 0/0

FrameRelay(config-if)#encapsulation frame-relay

FrameRelay(config-if)#clock rate 64000 >> For DCE

FrameRelay(config-if)#frame-relay intf-type dce >> Configure a FR DCE

FrameRelay(config-if)#no frame-relay inverse-arp >> to disable inverse-arp

Step 3: Now configure Frame-Relay router, it’s configure under the interface.

FrameRelay(config)#interface serial 0/0 >> under this interface

FrameRelay(config-if)#frame-relay route 102 interface serial 0/1 201

FrameRelay(config-if)#frame-relay route 103 interface serial 0/2 301

What the command does? # frame-relay route 103(the incoming DLCI into s0/0) interface serial 0/1(Outgoing interface toward destination DLCI) 301(Destination DLCI)

If we put the “FrameRelay(config-if)#frame-relay intf-type dce” command without having “FrameRelay(config)#frame-relay switching” command than we get this message:

Note: From above example configure all interfaces as your requirement.

Step 4: Configure Frame-Relay client router as point-to-point or multipoint

Frame-Relay Point-to-Point example:

HQ(config)#interface serial 0/0

HQ(config-if)#encapsulation frame-relay

HQ(config-if)#exit

HQ(config-if)#no shutdown >> apply after all configuration

Configure Sub Interface -

HQ(config)#interface serial 0/0.102 point-to-point

HQ(config-subif)#ip address 192.168.1.1 255.255.255.252

HQ(config-subif)#frame-relay interface-dlci 102 >>

HQ(config-subif)#exit

HQ(config)#interface serial 0/0.103 point-to-point

HQ(config-subif)#ip address 192.168.2.1 255.255.255.252

HQ(config-subif)#frame-relay interface-dlci 103 >>

HQ(config-subif)#exit

HQ(config-subif)#frame-relay interface-dlci 103 What the command does? If any time you (Traffic) use this sub interface, make sure that you use this (102 (Local DLCI)) DLCI to go out. No map necessary, no broadcast keyword as like multipoint configuration.

Note: Like same configuration to all routers who act as frame-relay client.

Frame Relay Show or Troubleshoot command:

Frame-Relay Switch (Router):

FrameRelay#show frame-relay pvc

FrameRelay#show frame-relay route >> to show the Frame-Relay route

FrameRelay#show frame-relay lmi

Frame-Relay Client (Router):

HQ#show frame-relay map

HQ#show frame-relay lmi

HQ#show frame-relay pvc

Ping test:

Show Running Configuration of topology routers:

FrameRelay (Router):

interface Serial0/0

no ip address

encapsulation frame-relay

serial restart-delay 0

clockrate 64000

no dce-terminal-timing-enable

no frame-relay inverse-arp

frame-relay intf-type dce

frame-relay route 102 interface Serial0/1 201

frame-relay route 103 interface Serial0/2 301

interface Serial0/1

no ip address

encapsulation frame-relay

serial restart-delay 0

clockrate 64000

no dce-terminal-timing-enable

no frame-relay inverse-arp

frame-relay intf-type dce

frame-relay route 104 interface Serial0/2 401

frame-relay route 201 interface Serial0/0 102

interface Serial0/2

no ip address

encapsulation frame-relay

serial restart-delay 0

clockrate 64000

no dce-terminal-timing-enable

no frame-relay inverse-arp

frame-relay intf-type dce

frame-relay route 301 interface Serial0/0 103

frame-relay route 401 interface Serial0/1 104

HQ (Router):

interface Serial0/0

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial0/0.102 point-to-point

ip address 192.168.1.1 255.255.255.252

frame-relay interface-dlci 102

interface Serial0/0.103 point-to-point

ip address 192.168.2.1 255.255.255.252

frame-relay interface-dlci 103

Branch1 (Router):

interface Serial0/1

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial0/1.104 point-to-point

ip address 192.168.3.1 255.255.255.252

frame-relay interface-dlci 104

interface Serial0/1.201 point-to-point

ip address 192.168.1.2 255.255.255.252

frame-relay interface-dlci 201

Branch2 (Router):

interface Serial0/2

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial0/2.301 point-to-point

ip address 192.168.2.2 255.255.255.252

frame-relay interface-dlci 301

interface Serial0/2.401 point-to-point

ip address 192.168.3.2 255.255.255.252

frame-relay interface-dlci 401

How to configure Frame Relay Point-to-Point

2012-09-26T00:40:00.000-07:00

What is Frame Relay?

Frame Relay Point-to-Point Topology:

Step 1: Configure Frame Relay Switch on GNS3

Step 2: Turn on Frame relay Encapsulation,

HQ(config)#interface serial 1/0

HQ(config-if)#encapsulation frame-relay

HQ(config-if)#exit

HQ(config-if)#no shutdown >> put this command after create all sub interface.

Create sub interface in HQ router:

HQ(config)#interface serial 1/0.102 point-to-point

HQ(config-subif)#ip address 192.168.1.1 255.255.255.252

HQ(config-subif)#frame-relay interface-dlci 102

HQ(config-fr-dlci)#exit

HQ(config)#interface serial 1/0.103 point-to-point

HQ(config-subif)#ip address 192.168.2.1 255.255.255.252

HQ(config-subif)#frame-relay interface-dlci 103

HQ(config-fr-dlci)#exit

Note: same configuration for all sub interfaces

Step 3: Configure branches

Branch1(config)#interface serial 1/0

Branch1(config-if)#encapsulation frame-relay

Branch1(config-if)#exit

Branch1(config-if)#no shutdown >> put this command after create all sub interface.

Create sub interface in Branch router

Branch1(config)#interface serial 1/0.201 point-to-point

Branch1(config-subif)#ip address 192.168.1.2 255.255.255.252

Branch1(config-subif)#frame-relay interface-dlci 201

Branch1(config-fr-dlci)#exit

Note: same configuration for all sub interfaces and also other branches

Frame Relay Troubleshoot Command:

HQ#show frame-relay map

HQ#show frame-relay lmi

HQ#show frame-relay pvc

Here i troubleshoot about (#show frame-relay map) Deleted status of frame-relay MAP:
I going to establish new connection between Branch1(105) and Branch2(501), after complete configuration the status of "#show frame-relay map" command (Same output on both router)

this may happened, cause the DLCI does not on frame-relay switch or configured. so added the DLCI into frame-relay switch.

Frame Relay have slower update process. so wait for some time and see output of command
#show frame-relay map: Everything will be fine...

Running Configuration of all Routers:

Router HQ:

interface Loopback0

ip address 200.200.200.1 255.255.255.0

interface Serial1/0

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial1/0.102 point-to-point

ip address 192.168.1.1 255.255.255.252

frame-relay interface-dlci 102

interface Serial1/0.103 point-to-point

ip address 192.168.2.1 255.255.255.252

frame-relay interface-dlci 103

interface Serial1/0.104 point-to-point

ip address 192.168.3.1 255.255.255.252

frame-relay interface-dlci 104

Router Branch1:

interface Loopback0

ip address 172.16.100.1 255.255.255.0

interface Serial1/0

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial1/0.105 point-to-point

ip address 192.168.4.1 255.255.255.252

frame-relay interface-dlci 105

interface Serial1/0.201 point-to-point

ip address 192.168.1.2 255.255.255.252

frame-relay interface-dlci 201

Router Branch2:

interface Loopback0

ip address 10.100.200.1 255.255.255.0

interface Serial1/0

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial1/0.301 point-to-point

ip address 192.168.2.2 255.255.255.252

frame-relay interface-dlci 301

interface Serial1/0.501 point-to-point

ip address 192.168.4.2 255.255.255.252

frame-relay interface-dlci 501

Router Branch3:

interface Serial1/0

no ip address

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

interface Serial1/0.401 point-to-point

ip address 192.168.3.2 255.255.255.252

frame-relay interface-dlci 401

How to configure Frame Relay Multipoint interface

2012-09-25T23:43:00.000-07:00

What is Frame Relay?

Frame Relay Multipoint Topology:

Step 1: Configure Frame Relay Switch on GNS3

Step 2: Configure HQ router

HQ(config)#interface s1/0

HQ(config-if)#encapsulation frame-relay >> turn on frame relay encapsulation

HQ(config-if)#ip address 192.168.100.1 255.255.255.0 >> specify ip address

HQ(config-if)#frame-relay map ip 192.168.100.2 102 broadcast >> Branch1

HQ(config-if)#frame-relay map ip 192.168.100.3 103 broadcast >> Branch2

HQ(config-if)#frame-relay map ip 192.168.100.4 104 broadcast >> Branch3

Or may create Sub interface to configure Frame-Relay:

HQ(config)#interface s1/0.1 multipoint

HQ(config-subif)#encapsulation frame-relay >> turn on frame relay encapsulation

HQ(config-subif)#ip address 192.168.100.1 255.255.255.0 >> specify ip address

HQ(config-subif)#frame-relay map ip 192.168.100.2 102 broadcast >> Branch1

HQ(config-subif)#frame-relay map ip 192.168.100.3 103 broadcast >> Branch2

HQ(config-subif)#frame-relay map ip 192.168.100.4 104 broadcast >> Branch3

Note: The “Broadcast” keyword only use in Multipoint Frame Relay map

Step 3: Configure Branch1

Branch1(config)#interface s1/0

Branch1(config-if)#encapsulation frame-relay

Branch1(config-if)#ip address 192.168.100.2 255.255.255.0

Branch1(config-if)#frame-relay map ip 192.168.100.1 201 broadcast >> for HQ

Branch1(config-if)#frame-relay map ip 192.168.100.3 201 broadcast >> for Branch2

Branch1(config-if)#frame-relay map ip 192.168.100.4 201 broadcast >> for Branch3

Note: all Branch3, Branch4 Configuration is same as Branch1

Ping status:

Frame Relay Troubleshoot Command:

HQ#show frame-relay map

HQ#show frame-relay lmi

HQ#show frame-relay pvc

Running Configuration of all Routers:

Router HQ:

interface Serial1/0

ip address 192.168.100.1 255.255.255.0

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

frame-relay map ip 192.168.100.2 102 broadcast

frame-relay map ip 192.168.100.3 103 broadcast

frame-relay map ip 192.168.100.4 104 broadcast

interface Serial1/0.1 multipoint

Router Branch1:

interface Serial1/0

ip address 192.168.100.2 255.255.255.0

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

frame-relay map ip 192.168.100.1 201 broadcast

frame-relay map ip 192.168.100.3 201 broadcast

frame-relay map ip 192.168.100.4 201 broadcast

Router Branch2:

interface Serial1/0

ip address 192.168.100.3 255.255.255.0

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

frame-relay map ip 192.168.100.1 301 broadcast

frame-relay map ip 192.168.100.2 301 broadcast

frame-relay map ip 192.168.100.4 301 broadcast

Router Branch3:

interface Serial1/0

ip address 192.168.100.4 255.255.255.0

encapsulation frame-relay

serial restart-delay 0

no dce-terminal-timing-enable

frame-relay map ip 192.168.100.1 401 broadcast

frame-relay map ip 192.168.100.2 401 broadcast

frame-relay map ip 192.168.100.3 401 broadcast

What is Frame Relay and how is work

2012-09-25T23:03:00.000-07:00

Evaluation of Layer 2 Technologies:

X.25
Frame Relay
ATM
MPLS (New)

The Foundation concepts of all technologies are same. The all about are connected through shared bandwidth cloud. The connections are defined by PVC (Privet Virtual Circuit). Each one of them has bandwidth limitation, know as CIR (Committed Information Rate).

Frame Relay: It’s a Standardized WAN technology. Is a second generation technology in packet switching world. That Specifies the Physical and logical link layer. In the scenario, frame relay service provider sells you cheaper connection (Shared bandwidth), cause they don’t have dedicated bandwidth to you. Example - Frame relay provider has total bandwidth 2Gbps bandwidth and they sell like 3.5Gbps to their customer to meet their customer requirement. Cause they monitoring, testing their network to determine that not everybody going to use all their bandwidth at the same time. (this example like as bank)

Frame Relay Terminology: Frame Relay is not like Ethernet or even leased line, so how this connection work to using some terminology.

CIR (Committed Information Rate) – The minimum bandwidth the service provider provides you, like 500Kbps. Some time always your network use (Bosted) bandwidth above CIR, the service provider always monitor their network, so they sagest you to get paid and also upgrade your CIR.

LAR (Local Access Rate) – LAR is how fast the circuit can go. This is one of the big different with Ethernet. Example – in LAN environment you plug-in cable, that cable speed like 100Mbps, if the computer can send 100Mbps data than the cable can handle it.Now in Frame Relay, the link speed like 10Mbps, and your CIR is 512Kbps. So you should be configure the router with 512Kbps as agreement, So here is the different Logical and Physical speed mismatch.

LMI (Local Management Interface) – LMI is a language you speak between your router to Frame Relay switch. It is a signaling protocol. The service provider send you statistic to use the LMI, like link status, quality of transmission, about dropping packet and also send about DLCI information

DLCI (Data Link Connection Identifier) – on frame relay network DLCI take place instead of MAC Address. DLCIs are locally significant (Means you can duplicate your DLCI number, same DLCI placed in both site, and also in different link, but you can’t add same DLCI in single link where the link act as multiple access). Example - In frame relay network you send data to DLCI (200) as your destination, the service provider take the data through the cloud and comes on DLCI (300) other site.

PVC (Privet Virtual Circuit) – Logical connection between one point to another point in frame relay network. Every single one of PVC has specific CIR. So you pay for each PVC.

Type of Frame Relay Network:

Hub-And-Spoke: Much cheap/inexpensive, one act as hub and all other may spoke, if Hub goes down than all spoke may down. Spoke communicate with other spoke by using hub.

Full Mesh: Much expensive $$. Fully redundant topology. All routers were connected each other. There low possibility of goes down. Exe – Voip, MPLS
Partial Mesh: Some part using hub-and-spoke and other may redundant.

Interface Configuration in Frame Relay:

About “Split Horizon” - Is a loop prevention technique, “Never sent an update back in the same direction that receives from the same interface.”

Multipoint – Same subnet use for all routers. Multiple DLCI is mapped to single interface. Split Horizon problem (Disable on Physical Interface, Enabled on Sub-Interface)
Point to Point – Different subnets is needed to connect to each connection. Point to Point sub-interface created for each peer. No problem with split horizon.

How to Configuration FrameRelay:

Multipoint Frame-Relay configuration Command: (How to Config Multipoint Example)

Router(config)#interface s1/0

Router (config-if)#encapsulation frame-relay >> turn on frame relay encapsulation

Router (config-if)#ip address 192.168.100.1 255.255.255.0 >> specify ip address

Router (config-if)#frame-relay map ip 192.168.100.2 102 broadcast >> for multipoint interface.

Or may create Sub interface to configure Frame-Relay:

Router (config)#interface s1/0.1 multipoint

Router (config-subif)#encapsulation frame-relay >> turn on frame relay encapsulation

Router HQ(config-subif)#ip address 192.168.100.1 255.255.255.0 >> specify ip address

Router (config-subif)#frame-relay map ip 192.168.100.2 102 broadcast >> Frame Relay map for multipoint interface.

What the “broadcast” does?

Router(config-subif)#frame-relay map ip 192.168.100.2 201 broadcast

The broadcast is initiate broadcast to another site router through frame relay. RIP, OSPF, EIGRP either use broadcast or multicast messages, by default the frame relay routers deny those broadcast messages from being sent through the link. So if you do not put the broadcast keyword with the command, you routing protocol wouldn’t work through frame relay network.

Point –to-Point Frame-Relay configuration Command: (Point-to-Point Configure Example) the point to point frame relay mode is only configured on sub interfaces.

Step 1: Turn on Frame-relay on Physical Interface

Router(config)#interface serial 1/0

Router (config-if)#encapsulation frame-relay

Router (config-if)#exit

Router (config-if)#no shutdown >> put this command after create all sub interface.

Step 2: Create point to point Sub Interfaces under the Physical Interfaces to support point to point frame relay.

Router (config)#interface serial 1/0.102 point-to-point

Router (config-subif)#ip address 192.168.1.1 255.255.255.252

Router (config-subif)#frame-relay interface-dlci 102

Router (config-fr-dlci)#exit

#frame-relay interface-dlci 102 >> what the command does?

If any time you (Traffic) use this sub interface, make sure that you use this (102 (Local DLCI)) DLCI to go out. No map necessary, no broadcast keyword as like multipoint configuration.

Frame Relay Troubleshoot command:

Router#show frame-relay lmi >> check (Num status megs send rcvd number)

Router#sho frame-relay pvc >> Check out PVC status.

Router#show frame-relay map

You check detail about frame relay status. Like your remote IP address, your local DLCI, “Static” (Configured by administrator as static), “Broadcast” may active, “Cisco” (Other site must be cisco device), and status active/inactive/deleted.

Active – both site correctly setup and operational
Inactive – your site is configured but other site not
Deleted – you may put an DLCI “345” but the frame relay switch don’t know about this DLCI or does not exist , so this status will be shown as Deleted.

Some Note and Tips:

Router(config-if)##frame-relay lmi-type cisco/ansi/q9eea >> Frame Relay encapsulation for older router. Now on new router able to auto detect LMI using #encapsulation frame-relay

Router(config-subif)#frame-relay map ip 192.168.100.3 301 ietf broadcast >> if you communicate with non cisco router on other site (Industry Standard). By default is cisco proprietary.

Link state Routing Protocol

2012-06-06T00:58:00.003-07:00

Link state Routing Protocol Feature:

Use multicast to build neighbor relationship rather than broadcast
After initial routing tables exchange, routers send small, event-based updates

LS Routing Protocol Advantages:

Much faster to converge
Force you to design your network design correctly
No routing loops issue

LS Routing Protocol Disadvantage:

Demand on router resources
Technical complexity
Requires actual network design

Distance Vector Routing Protocol

2012-06-06T00:37:00.001-07:00

Distance Vector Routing Protocol Feature:

Distance Vector (DV) Routing Protocols exchange entire routing table at specific (30 Second) intervals
Distance Vector (DV) Routing Protocol is easy to configure
Distance Vector (DV) Protocol has looping issues

Distance Vector Routing Protocol Loop Prevention mechanism:

Cisco routers have 5 loop prevention mechanisms to prevent loop issue

Maximum hope count – with rip max 16 hops
Router Poisoning – with rip, manually set 16 hops to kill route.
Triggered Update – trigger update send about any change
Split Horizon – do not sent update, back in the same direction you receive them on network set are being advertise
Hold Down Timer – set hold down timer, Cisco default hold down time is 180 seconds

how to configure eigrp

2012-03-26T22:54:00.001-07:00

Enhanced Interior Gateway Routing Protocol - (EIGRP) (Administrative Distance – Internal EIGRP -90, External EIGRP -170) (Multicast 224.0.0.10) (Only Protocol that remember Backup Route)

EIGRP Features: (All Document Collect from CISCO)

Cisco proprietary and is Hybrid (containing Advanced distance vector and several link-state features)
Fast convergence stores all its neighbors’ routing tables so that it can quickly adapt to alternate routes. If no appropriate route exists, EIGRP queries its neighbors to discover an alternate route which continues until an alternate route is found. (Actually EIGRP dose, that learn 10.10.10.0/24 is best way to get destination so it’s primary route, and put into routing table, if the route get second way, third way, fourth way so on, to get designation, so the second best path keep into the topology table as feasible successor for backup route. If primary route is failed then second one goes into routing table, it take less than 200MS time)
Support for VLSM and discontiguous subnets as a classless routing protocol, EIGRP advertises a subnet mask for each destination network; enabling it to support discontiguous subnetworks and VLSM. Routes are automatically summarized at the major network number boundary, and can be configured to summarize on any bit boundary on any router interface.
Partial updates Sends partial triggered updates as opposed to periodic updates--sent only when the path or metric changes containing information about the changed route. For this reason EIGRP consumes significantly less bandwidth than IGRP. This behavior is different than that of link-state protocols, in which an update is transmitted to all link-state routers within an area.
Support for multiple network-layer protocols EIGRP supports IP, AppleTalk, and Novell NetWare Internet Packet Exchange (IPX) through the use of protocol-dependent modules. The rapid convergence and sophisticated metric structure of EIGRP offers superior performance and stability when implemented in IPX and AppleTalk networks.
Flexible network design
Multicast and unicast instead of broadcast address EIGRP uses multicast and unicast, rather than broadcast. The multicast address used for EIGRP is 224.0.0.10.
Manual summarization at any point or any interfaces on network
100% loop-free classless routing
Easy configuration for WANs and LANs
Load balancing across unequal-cost pathways- you may have redundant link, one is 512Kb (Primary) and other one 256Kb, so EIGRP send 2 packet by using 512Kb link and 1 packet by using 256Kb link. No other protocol can’t do like this.
EIGRP support MD5 authentication

EIGRP Key Technologies:

Neighbor discovery/recovery -- Uses Hello packets between neighbors
Reliable Transport Protocol (RTP) -- Guaranteed, ordered delivery of EIGRP packets to all neighbors.
DUAL finite-state machine -- Selects lowest-cost, loop-free, paths to each destination
Protocol-dependent modules (PDMs) -- EIGRP supports IP, AppleTalk, and Novell NetWare; Each protocol has its own EIGRP module and operates independently from any of the others that may be running.

On EIGRP DUAL uses three separate tables for the route calculation:

Neighbor table: Contains information on all other directly connected (neighbor) routers. A separate table exists for each supported protocol (IP, IPX, etc). Each entry corresponds to a neighbour with the description of network interface and address. In addition, a timer is initialized to trigger the periodic detection of whether the connection is alive. This is achieved through "Hello" packets. If a "Hello" packet is not received from a neighbor for a specified time period, the router is assumed down and removed from the neighbor table.

Topology table: contains the metric (cost information) of all routes to any destination within the autonomous system. This information is received from neighboring routers contained in the Neighbor table. The primary (successor) and secondary/Backup (feasible successor) routes to a destination will be determined with the information in the topology table. Among other things, each entry in the topology table contains the following:

"Feasible Distance (FD)": The calculated metric of a route to a destination within the autonomous system.

"Advertised Distance OR Reported Distance (RD)": The metric to a destination as advertised by a neighboring router. RD is used to calculate the FD, and to determine if the route meets the "feasibility condition".

Route Status: A route is marked either "active" or "passive". "Passive" routes are stable and can be used for data transmission. "Active" routes are being recalculated DUAL algorithm, and/or not available.

Stuck In Active (SIA): The condition when a route becomes unreachable and not all queries for it are answered; adjacencies with unresponsive neighbors are reset

Rules of Feasible Successor: “To be considered a Feasible Successor, The AD Must be less than the FD of the Successor” (The rules is provide the facility loop prevention ) Means if a link to be consider as ‘Feasible Successor’ or Backup route then the link “Advertised Distance (AD)” must be less than the “Feasible Distance (FD)” of the ‘Successor’ or Primary Route.

Example:

FD of Primary Route OR “Successor” = 110 Cost (AD/RD =10 Cost)

AD/RD of which one to be consider as “Feasible Successor” = 20 Cost

“AD” is less than the FD of Primary (20<110), so this link should be consider as FS or Backup route

Example of The Diffusing Update Algorithm (DUAL) Algorithm : (This is the engine that's run EIGRP)

How does EIGRP determine which routes are loop-free?

Each of A’s neighbors is reporting reachability to E: (B with a cost of 10, C with a cost of 10, D with a cost of 30) These three costs are called the reported distance (RD), the distance each neighbor is reporting to a given destination

At A, the total cost to reach E is: (20 through B, 25 through C, 45 through D. The best of these three
paths is the path through B, with a cost of 20. This is the feasible distance (FD)

A uses the FD and the RD to determine which paths are loop-free. The best path (FD) is used as a benchmark; all paths with RDs lower than the FD cannot contain loops. The algorithm may mark
some loop-free paths as loops. However, it is guaranteed never to mark a looped path as loop-free

At A: The path through B is the best path (FD), at 20. C can reach E with a cost of 10; 10 (RD) is less than 20 (FD), so this path is loop-free. D can reach E with a cost of 30; 30 (RD) is not less than 20 (FD), so EIGRP assumes this path is a loop.

Routing table: contains the best route(s) to a destination (in terms of the lowest "metric"). These routes are the successors from the topology table.

DUAL evaluates the data received from other routers in the topology table and calculates the primary (successor) and secondary (feasible successor) routes. The primary path is usually the path with the lowest metric to reach the destination, and the redundant path is the path with the second lowest cost (if it meets the feasibility condition). There may be multiple successors and multiple feasible successors. Both successors and feasible successors are maintained in the topology table, but only the successors are added to the routing table and used to route packets.
For a route to become a feasible successor, its RD must be smaller than the FD of the successor. If this feasibility condition is met, there is no way that adding this route to the routing table could cause a loop.
If all the successor routes to a destination fail, the feasible successor becomes the successor and is immediately added to the routing table. If there is no feasible successor in the topology table, a query process is initiated to look for a new route.

Example: EIGRP Tables:

EIGRP Neighbor Status:

#show ip eigrp neighbor

H (handle): A number used internally by the Cisco IOS software to track a neighbor.
Address: The neighbor’s network-layer address.
Interface: The interface on this router through which the neighbor can be reached.
Hold timer – Seconds remaining before declaring neighbor down. By default hello timer on EIGRP once every 5 seconds, its say hello, if miss 3 hello in 15 seconds, that have the neighbor goes down.
Uptime – How long since the last time neighbor was discovered.
Smooth Round Trip Timer (SRTT): The average numbers of milliseconds it takes for an EIGRP packet to be sent to this neighbor and for the local router to receive an acknowledgment of that packet. This timer is used to determine the retransmit interval, also known as the retransmit timeout (RTO).
RTO: The amount of time, in milliseconds, that the router waits for an acknowledgment before retransmitting a reliable packet from the retransmission queue to a neighbor.
Queue count: The number of packets waiting in the queue to be sent out. If this value is constantly higher than 0, a congestion problem (Link Problem) might exist. A 0 indicates that no EIGRP packets are in the queue.
Seq Num: The sequence number of the last update, query, or reply packet that was received from this neighbor.

EIGRP packet types:

Hello: used by routers for neighbor discovery. Packets are sent as multicast (224.0.0.10) and do not require an acknowledgment.If the neighbor replay Hello, than build neighbor relationship
Update: Update packets contain route change information (Routing Table). They are sent reliably to the affected routers only. These updates can be unicast or multicast.
Query: Router performs route computation and does not have a feasible successor, it sends a reliable query packet to its neighbors to determine if they have a feasible successor (Backup route) for the destination. Queries are normally multicast but can be retransmitted as unicast packets in certain cases. (Here we see the distance vector feature, if the neighbor reply more than 15 hope, so that destination is unreachable (like - 10.10.10.0/24 16h))
Reply: A router sends a reply packet in response to a query packet. Replies are unicast reliably to the originator of the query.
ACK: The acknowledgment (ACK) packet acknowledges update, query, and reply packets. ACK packets are unicast hello packets and contain a nonzero acknowledgment number.

Initial Route Discovery on EIGRP:

This metric can be based on five criteria, but EIGRP uses only two of these criteria by default:

Bandwidth: The smallest bandwidth between source and destination
Delay: The cumulative interface delay along the path Other criteria can be used, but are not recommended, because they typically result in frequent recalculation of the topology table:
Reliability: This value represents the worst reliability between source and destination, based on keepalives.
Loading: This value represents the worst load on a link between source and destination, computed based on the packet rate and the configured bandwidth of the interface.
MTU: This criterion represents the smallest MTU in path. MTU is included in the EIGRP routing update but is not actually used in the metric calculation.

(EIGRP metric is IGRP metric multiplied by 256)

(By default, EIGRP metric: Metric = bandwidth (slowest link) + delay (sum of delays) )

Some Troubleshooting Commands:

Router#show ip route
Router#show ip eigrp interfaces

Router#show ip eigrp neighbors

Router#show ip eigrp topology

Router#show ip eigrp traffic

Router#clear ip eigrp neighbors

Router#debug ip eigrp [packet | neighbors]

EIGRP Configuration Commands and Tips:

Router#enable

Router#configure terminal

Router(config)#router eigrp 100 >> “100” is Autonomous system number

Router(config-router)#network 192.168.110.0 0.0.0.255 >> NW NM

Router(config-router)#redistribute static >> for Static routes

Router(config-router)#no auto-summary >> never advertise class full (Default class)

Router(config-router)#exit

What does the EIGRP networks command?

HQ(config-router)#network 172.16.0.0 0.0.255.255

> Feature of the network command, is that send hello to form neighbor relationship and advertise about this network to other

> Here check only network bit based on wildcard mask, and leave all from the host bit.

> Send hello on any of 172.16.0.0 network. Means the router send hello to all network that is started with 172.16. based on network command (wildcard Mask)

> And advertise about 172.30.0.0 network to other network that is connected to this router under EIGRP.

Specific interface Advertise:

R2(config-router)#network 192.168.100.2 0.0.0.0

> specific wildcard mask for an interface

> Only Specific interface (int s2/0, ip add 192.168.100.2 255.255.255.252) that only allow to send out hello message to form neighbor relationship.

Configure default network on EIGRP:

R2(config)#ip default-network 10.100.200.00

> The static route marked with “s*” (* - Candidate default route) on HQ router. Configure ip default network on EIGRP, after apply this command, On branch router it marked with “D*”

#ip route 0.0.0.0 0.0.0.0 nexthop

> if this default command apply in eigrp, that may advertise all network to the neighbor..

#default information originate

EIGRP Passive Interface:

EIGRP should not form neighbor relationships on any interface where other EIGRP routers do not exist.

R2(config-router)#router eigrp 100

R2(config-router)#passive-interface fastEthernet 1/0

> This command prevent sending hello to neighbor and no neighbor relationship is form, but will still advertise network. (If you remove network command for the network then it also prevent advertise network)

If you need to configure many interface as passive, first

HQ(config-router)#passive-interface default >> for all interfaces than

HQ(config-router)#no passive-interface serial 2/0 >> which one not passive

EIGRP Summary route :

Which interface advertise summary route, its depend on network topology.

HQ(config)#interface serial 2/0 >> exit point of router

HQ(config-if)#ip summary-address eigrp 100 172.16.0.0 255.255.248.0 >> configure as required

Important rule of routing: AD, Matrix, Edge of router doesn’t matter, If anyone has more specific route about any network than router was always choose that way to route all

EIGRP Unequal Load balancing:

EIGRP by default Variance is 1 >> means actually load lance of equal cost link

If I type Variance 2 >> means I want to load balance between unequal cost link (rules – variance 2 means, actually the primary FD is multiple by 2, if 3 than multiple by 3 with primary FD (two time bad, three time bad), if the result match with the FD of backup (successor) link, that may consider as unequal load balance link. (check out # show ip eigrp topology) )

HQ(config-router)#variance 2 >> load balance between 2 unequal link

Example Topology: post soon

How to Configure RIP

2012-03-12T02:28:00.000-07:00

Routing Information Protocol (RIP) (V1, V2) (Administrative Distance - 120) (224.0.0.9)

The Routing Information Protocol (RIP) is a distance-vector routing protocol.
RIP v1 don't support VLSM, whether RIP v2 support VLSM
RIP v1 don't support Authentication, whether RIP v2 Support Authentication
RIP v1 is broadcast whether RIP v2 is Multicast (Multicast IP 224.0.0.9)
The hold down time is 180 seconds.
Exchange full routing table at 30 second interval
Limits the size of networks that RIP can support.
Hop count as a routing metric. The maximum number of hops allowed 15.
A hop count of 16 is considered an infinite distance and used to deprecate inaccessible, inoperable, or otherwise undesirable routes in the selection process.
RIP prevents routing loops by implementing a limit on the number of hops allowed in a path from the source to a destination.

Configuration Command:

Router#enable

Router#configure terminal

Router(config)#router rip

Router(config-router)#version 1 or 2 >> you define your required version

Router(config-router)#network 192.168.110.0 >> you mention as your requirement

Router(config-router)#redistribute static >> for Static routes

Router(config-router)#default-information originate >> Distribute a default route

Router(config-router)#no auto-summary

Router(config-router)#exit

How to Configure Default Route

2012-03-12T02:18:00.001-07:00

A default route, also known as the gateway of last resort, is the network route used by a router when no other known route exists for a given IP packet's destination address. All the packets for destinations not known by the router's routing table are sent to the default route. This route generally leads to another router, which treats the packet the same way: If the route is known, the packet will get forwarded to the known route. If not, the packet is forwarded to the default-route of that router which generally leads to another router. And so on. Each router traversal adds a one-hop distance to the route

Configuration Command:

Router(config)#ip route 0.0.0.0 0.0.0.0 serial 0/0/0 >> exit interface OR

Router(config)#ip route 0.0.0.0 0.0.0.0 172.16.10.2 >> next hope (router) address

Cisco ASA Configuration Command:
ASA(Config)#route outside 0.0.0.0 0.0.0.0 10.100.200.1 1

How to Configure Static Route

2012-03-12T02:13:00.001-07:00

Static route: (Administrative Distance - 1)

Configuration Commands:
Router#enable

Router#configure terminal

Router(config)#ip route 192.168.110.0 255.255.255.0 serial 0/0/0 >> exit interface OR

Router(config)#ip route 192.168.110.0 255.255.255.0 172.16.10.2 >>next hope (router) address

How to Configuring IOS DHCP Clients

2012-03-11T23:35:00.000-07:00

Task 1: Configure the hostnames on routers R1 and Sw1 as illustrated in the topology.

Task 2: Configure VLAN 100 on Sw1 and name it DHCP_VLAN. Assign port Fa0/2 and Fa0/3 to this VLAN. Enable the ports to automatically transition to the Spanning Tree Forwarding state.

Task 3: Assuming the DHCP server is correctly configured, configure R1 F0/0 to receive IP addressing via DHCP. Verify that R1 has received automatic configuration information via DHCP

DHCP Server Config:

Running Config of R1:

R1#show running-config

Building configuration...

Current configuration : 438 bytes

version 12.4

no service timestamps log datetime msec

no service timestamps debug datetime msec

no service password-encryption

hostname R1

interface FastEthernet0/0

ip address dhcp

duplex auto

speed auto

interface FastEthernet0/1

no ip address

duplex auto

speed auto

shutdown

interface Vlan1

no ip address

shutdown

ip classless

line con 0

line vty 0 4

end

Running Config of SW1:

sw1#show running-config

Building configuration...

Current configuration : 1735 bytes

version 12.2

no service timestamps log datetime msec

no service timestamps debug datetime msec

no service password-encryption

hostname sw1

interface FastEthernet0/1

switchport access vlan 50

switchport mode access

spanning-tree portfast

interface FastEthernet0/2

switchport access vlan 50

switchport mode access

spanning-tree portfast

interface FastEthernet0/3

switchport access vlan 50

switchport mode access

spanning-tree portfast

interface FastEthernet0/4

spanning-tree portfast

interface FastEthernet0/24

spanning-tree portfast

interface Vlan1

no ip address

shutdown

line con 0

line vty 0 4

line vty 5 15

end

how to assignig ip on linux

2012-02-23T03:09:00.001-08:00

Assigning IP Address on Linux:

To check IP address:

# ifconfig >> to see all interfaces

# ifconfig eth0      >> to see specific interface

Required File to Edit:
#vi /etc/sysconfig/network-scripts/ifcfg-eth0   >> edit ifcfg-eth0 file to add IP detail
#Vi etc/resolv.conf >> to add NameServer or dns
# vi /etc/sysconfig/network >> add GATEWAY & Hostname etc
#vi /etc/hosts    >> To Name Resolv

To up/down interfaces:

# ifconfig eth0 up >> to up eth0

#ifconfig eth0 down >> to down eth0

Assigning IP Address Temporary on interface: (After restarting this IP address will gone)

# ifconfig eth0 172.16.2.21 netmask 255.255.255.0 up >> set IP on eth0 interface

# route add default gw 172.16.2.1 eth0 >> set getaway on eth0 interface

Assigning IP Address Permanently on interface: (For this situation you have to edit mamually and also using netconfig command)

Using netconfig command:

# netconfig >>(Press Enter Key, Now you get an interface, where you configure IP address). Then

# service network restart (Press Enter Key, that will done)

(N.B. As soon as possible i provide more details screen shot)

Manually Assigning IP address:

# cat /etc/sysconfig/network-scripts/ifcfg-eth0 >> just view the configuration file

# vi /etc/sysconfig/network-scripts/ifcfg-eth0 >> edit ifcfg-eth0 file to add IP detail

To add default gateway (location - /etc/sysconfig/network)

# vi /etc/sysconfig/network >> add GATEWAY

To Add NameServer ( /etc/resolv.conf)

Vi etc/resolv.conf >> to add NameServer

# services network restart >> run this command to enable changes .

Now you see the change of "ifcfg-eth0" file. # cat /etc/sysconfig/network-scripts/ifcfg-eth0

Add Virtual interface address permanently:

# vi /etc/sysconfig/network-scripts/ifcfg-eth0:1 >> to create new virtual interface and assign IP

check out the created virtual interface

# services network restart >> run this command to enable changes .

# cat /etc/sysconfig/network-scripts/ifcfg-eth0:1 >> to view interface

Some other Ping commands:
#ping 4.2.2.2 -s 2048 >> to ping load
#ping 4.2.2.2 -c 5 >> number of time to ping
#ping 172.168.1.0 -b >> Broadcast ping

How to reset centos password

2012-02-20T01:49:00.000-08:00

CentOS Password Resetting (GRUB):

Step 1: The first step is to reboot your Server/PC

Step 2: At during rebooting, you see the following screen. Press any key to hold booting

Step 3: After pressing key, you get the screen. (Cause I have GRUB Password)

Step 4: Now you press “P” for entering GRUB Password

Step 5: After entering GRUB Password, you get the screen, now you press “e” for edit

Step 6: You get 3 options. You select “Kernel /vmlinez” line and press “e” again.

Step 7: you get the screen…

Step 8: On the screen you type “single” keyword with “Space” (Make sure the space before “single” keyword), don’t wary see the screen….

Step 9: After typing “Single” keyword, you press Enter. Then you get the screen again. Now you press “b” to boot the system into single user mode.

Step 10: After complete booting you get the screen. Now you can able to change the password.

Step 11: On the screen you just type “password” keyword and press enter to type your new password.

Step 12: After changing password you just type “reboot” to reboot your system. You can login with your system with new password. . I hope that will be fine….

Routing protocol

2012-01-09T02:47:00.000-08:00

Routing protocol configuration (Short note and Example):

Note: I will try to make this document. You will see all documents very soon……

Routing protocol types:

1. Static routing (AD - 1)

2. Default routing

3. Dynamic routing (Two type of dynamic Interior Gateway Protocol (IGP) & Exterior Gateway Protocol (EGP))

3.1. Interior Gateway Protocol (IGP): An interior gateway protocol (IGP) is a routing protocol that is used to exchange routing information within an autonomous system (AS). Two type of IGP – Distance Vector & Link State routing protocol.

3.1.1. Distance-Vector routing protocol:

3.1.1.1. Routing Information Protocol (RIP)(V1, V2)(AD-120)(224.0.0.9)(UDP 520)

3.1.1.2. Interior Gateway Routing Protocol (IGRP) (AD - 100)

3.1.2. Link State routing protocol:

3.1.2.1. Intermediate System To Intermediate System (IS-IS): (AD - 115)

                 3.1.2.2. Open Shortest Path First (OSPF)(AD-110) (224.0.0.5)

          3.1.3. Hybrid Routing Protocol:
                 3.1.3.1. Enhanced Interior Gateway Routing Protocol -(EIGRP)(224.0.0.10)

(AD-Internal EIGRP-90, External EIGRP-170), Its Cisco proprietary

3.2. Exterior Gateway Protocol (EGP): (AD - 140), Path Vector Routing Protocol, BGP is Exterior Gateway Protocol. BGP have two types (1-64511 Public AS, 64512-65535 Private AS)

3.2.1. Internal Border Gateway Protocol (IBGP): (AD - 200)

3.2.2. External Border Gateway Protocol (EBGP): (AD - 20)

Note: I will try to make this document. You will see all documents very soon……

list of IPv6 multicast address

2012-01-02T23:46:00.000-08:00

Below lists some reserved and well-known IPv6 multicast address in the reserved multicast address range (FF00:: to FF0F::) -->

Multicast Address	Multicast Group
FF01::1	All IPv6 nodes within the node-local scope
FF01::2	All IPv6 routers within the node-local scope
FF02::1	All IPv6 nodes within the link-local scope
FF02::2	All IPv6 routers within the link-local scope
FF02::5	All OSPFv3 routers within the link-local scope
FF02::6	All OSPFv3 designated routers within the link-local scope
FF02::9	All RIPng routers within the link-local scope
FF02::A	All EIGRP routers within the link-local scope
FF02::D	All PIM routers within the link-local scope
FF02::1:2	All DHCPv6 agents (servers and relays) within the link-local scope
FF05::2	All IPv6 routers within the site-local scope
FF02::1:FF00:0/104	IPv6 solicited-node multicast address within the link-local scope

List of Run Commands in Windows 7

2011-12-16T23:01:00.000-08:00

Program Name                                                       Run Command
About Windows                   :winver
Action Center                   :wscui.cpl2
Add a Device                   :devicepairingwizard
Add Hardware Wizard         :hdwwiz
Advanced User Accounts         :netplwiz
Authorization Manager            :azman.msc
Backup and Restore               :sdclt
Calculator                                                              :calc
Certificates                   :certmgr.msc
Change Computer Performance Settings       :systempropertiesperformance
Change Data Execution Prevention Settings             :systempropertiesdataexecutionprevention
Change Printer Settings                                           :printui
Character Map                                                       :charmap
ClearType Tuner                                                     :cttune
Color Management                                                 :colorcpl
Command Prompt                                                  :cmd
Component Services                                               :comexp.msc
Component Services                                               :dcomcnfg
Computer Management                                           :compmgmt.msc
Computer Management                                           :compmgmtlauncher
Connect to a Network Projector                              :netproj
Connect to a Projector                                             :displayswitch
Control Panel                                                           :control
Create A Shared Folder Wizard                               :shrpubw
Create a System Repair Disc                                    :recdisc
Credential Backup and Restore Wizard                    :credwiz
Data Execution Prevention                                       :systempropertiesdataexecutionprevention
Date and Time                                                         :timedate.cpl2
Default Location                                                      :locationnotifications
Device Manager                :devmgmt.msc
Device Manager                                                      :hdwwiz.cpl2
Device Pairing Wizard                                             :devicepairingwizard
Diagnostics Troubleshooting Wizard                         :msdt
Digitizer Calibration Tool                                          :tabcal
DirectX Diagnostic Tool                                           :dxdiag
Disk Cleanup                                                           :cleanmgr
Disk Defragmenter                                                   :dfrgui
Disk Management                                                    :diskmgmt.msc
Display                                                                    :dpiscaling
Display Color Calibration                                         :dccw
Display Switch                                                         :displayswitch
DPAPI Key Migration Wizard     :dpapimig
Driver Verifier Manager           :verifier
Ease of Access Center         :utilman
EFS REKEY Wizard                                               :rekeywiz
Encrypting File System Wizard                                 :rekeywiz
Event Viewer                                                           :eventvwr.msc
Fax Cover Page Editor                                            :fxscover
File Signature Verification        :sigverif
Font Viewer                :fontview4
Game Controllers                                                    :joy.cpl2
Getting Started            :gettingstarted
IExpress Wizard                                                      :iexpress
Infrared                 :irprops.cpl2
Install or Uninstall Display Languages       :lusrmgr
Internet Explorer                                                     :iexplore1
Internet Options                                                      :inetcpl.cpl2
iSCSI Initiator Configuration Tool                            :iscsicpl
iSCSI Initiator Properties                                         :iscsicpl
Language Pack Installer                                           :lpksetup
Local Group Policy Editor                                       :gpedit.msc
Local Security Policy                                               :secpol.msc
Local Users and Groups            :lusrmgr.msc
Location Activity                                                     :locationnotifications
Magnifier                                                                 :magnify
Malicious Software Removal Tool                            :mrt
Manage Your File Encryption Certificates                 :rekeywiz
Math Input Panel                                                     :mip1
Microsoft Management Console           :mmc
Microsoft Support Diagnostic Tool                           :msdt
Mouse                       :main.cpl2
NAP Client Configuration                                         :napclcfg.msc
Narrator                                                                   :narrator
Network Connections                                               :ncpa.cpl2
New Scan Wizard                                                    :wiaacmgr
Notepad                                                                   :notepad
ODBC Data Source Administrator                            :odbcad32
ODBC Driver Configuration                                      :odbcconf
On-Screen Keyboard                                                :osk
Paint                    :mspaint
Pen and Touch                                                           :tabletpc.cpl2
People Near Me                                                        :collab.cpl2
Performance Monitor            :perfmon.msc
Performance Options                                                :systempropertiesperformance
Phone and Modem                                                    :telephon.cpl2
Phone Dialer                                                             :dialer
Power Options                                                          :powercfg.cpl2
Presentation Settings                                                  :presentationsettings
Print Management                                                      :printmanagement.msc
Printer Migration                                                        :printbrmui
Printer User Interface                                                 :printui
Private Character Editor                                             :eudcedit
Problem Steps Recorder                                            :psr
Programs and Features                                               :appwiz.cpl2
Protected Content Migration                                       :dpapimig
Region and Language                                                  :intl.cpl2
Registry Editor                                                            :regedit
Registry Editor                                                            :regedt325
Remote Access Phonebook                                        :rasphone
Remote Desktop Connection        :mstsc
Resource Monitor               :resmon
Resource Monitor                                                       :perfmon /res
Resultant Set of Policy           :rsop.msc
SAM Lock Tool                                                         :syskey
Screen Resolution               :desk.cpl2
Securing the Windows Account Database                   :syskey
Services                   :services.msc
Set Program Access and Computer Defaults               :computerdefaults
Share Creation Wizard         :shrpubw
Shared Folders                                                           :fsmgmt.msc
Snipping Tool                   :snippingtool
Sound                    :mmsys.cpl2
Sound Recorder             :soundrecorder
SQL Server Client Network Utility :cliconfg
Sticky Notes                                                              :stikynot
Stored User Names and Passwords       :credwiz
Sync Center             :mobsync
System Configuration                                                  :msconfig
System Configuration Editor                                        :sysedit
System Information                                                     :msinfo32
System Properties                                                       :sysdm.cpl2
System Properties (Advanced Tab) :systempropertiesadvanced
System Properties (Computer Name Tab)                   :systempropertiescomputername
System Properties (Hardware Tab)       :systempropertieshardware
System Properties (Remote Tab)           :systempropertiesremote
System Properties (System Protection Tab)                 :systempropertiesprotection
System Restore                                                           :rstrui
Tablet PC Input Panel                                                 :tabtip1
Task Manager                                                             :taskmgr
Task Scheduler                                                           :taskschd.msc
Trusted Platform Module (TPM) Management         :tpm.msc
User Account Control Settings                                     :useraccountcontrolsettings
Utility Manager                                                            :utilman
Version Reporter Applet                                              :winver
Volume Mixer                :sndvol
Windows Activation Client                                           :slui
Windows Anytime Upgrade Results    :windowsanytimeupgraderesults
Windows CardSpace                                                   :infocardcpl.cpl2
Windows Disc Image Burning Tool       isoburn
Windows DVD Maker               :dvdmaker1
Windows Easy Transfer                                                :migwiz1
Windows Explorer                                                        :explorer
Windows Fax and Scan                                                :wfs
Windows Features            :optionalfeatures
Windows Firewall                                                         :firewall.cpl2
Windows Firewall with Advanced Security    :wf.msc
Windows Journal                                                          :journal1
Windows Media Player                                                 :dvdplay3
Windows Media Player                                                :wmplayer1
Windows Memory Diagnostic Scheduler                       :mdsched
Windows Mobility Center                                             :mblctr
Windows Picture Acquisition Wizard                            :wiaacmgr
Windows PowerShell                                                   :powershell1
Windows PowerShell ISE                                            :powershell_ise1
Windows Remote Assistance           :msra
Windows Repair Disc                                                  :recdisc
Windows Script Host         :wscript
Windows Update                                                         :wuapp
Windows Update Standalone Installer                           :wusa
WMI Management                   :wmimgmt.msc
WordPad                   :write
XPS Viewer                                                                 :xpsrchvw

How to configure OSPF Virtual Link with IPV6

2011-11-03T00:44:00.000-07:00

Step 1: Enable IPv6 In Global Mode

R1#configure terminal

R1(config)#ipv6 cef

R1(config)#ipv6 unicast-routing

Step 2: Assing IPv6 Address

R1#configure terminal

R1(config)#interface f0/0

R1(config-if)#ipv6 address a:a:a:a::1/64

Step 3: IPv6 Support OSPFv3 (Config)

R1(config)#ipv6 router ospf 1

R1(config-rtr)#router-id 1.1.1.1 (must

configured IPv4 for DR BDR election)

Ospf apply in Interface

R1(config)#interface f0/0

R1(config-if)#ipv6 ospf 1 area 0

Step 4: Create Virtual Link For Area 0 to Area 45

R2(config)#ipv6 router ospf 1

R2(config-rtr)#area 11 virtual-link 3.3.3.3

R3(config)#ipv6 router ospf 1

R3(config-rtr)#area 11 virtual-link 2.2.2.2

Some Show Command:

R1#show ipv6 route

R1#show ipv6 ospf

R1#show ipv6 interface brief

Topology Lab:

Running Configuration of all routers:

R1#sho running-config

hostname R1

ip cef

no ip domain lookup

no ip dhcp use vrf connected

ipv6 unicast-routing

ipv6 cef

no crypto isakmp ccm

interface Loopback0

no ip address

ipv6 address FEC0:1::1/128

ipv6 ospf 1 area 0

interface FastEthernet0/0

no ip address

duplex auto

speed auto

ipv6 address A:A:A:A::1/64

ipv6 ospf 1 area 0

ipv6 router ospf 1

router-id 1.1.1.1

log-adjacency-changes

control-plane

end

R1#show ipv6 route

IPv6 Routing Table - 10 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

U - Per-user Static route

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

C A:A:A:A::/64 [0/0]

via ::, FastEthernet0/0

L A:A:A:A::1/128 [0/0]

via ::, FastEthernet0/0

OI B:B:B:B::/64 [110/65]