Routing & Switching

How to configure EIGRP and Standard Access List (ACL) on Cisco Router

2015-09-28T20:31:00.005+08:00

Junpier block traffic
The first term is set to match icmp-echo-request traffic destine for the IP address of 192.168.10.1/24.
The second term is to pass (or accept) all other traffic.
Without the second term all traffic not matching the first term would be dropped.
Lastly the filter is applied to an interface on the inbound direction.

R1#set firewall filter LAN-inbound term BLOCK from destination-address 192.168.10.1/24
R1#set firewall filter LAN-inbound term BLOCK from icmp-type echo-request
R1#set firewall filter LAN-inbound term BLOCK then log
R1#set firewall filter LAN-inbound term BLOCK then discard
R1#set firewall filter LAN-inbound term accept-all-else then accept
R1#set interfaces em1 family inet filter input LAN-inbound

How to configure OSPFv2 on Cisco Router

2015-09-28T20:31:00.002+08:00

R1 connect to R2 via ethernet

R1#set interface em1 unit 0 family inet address 1.1.1.1/24
R1#set interface lo1 unit 0 family inet address 11.11.11.11/24
R1#set protocol ospf area 0.0.0.0 interface em1
R1#set protocol ospf area 0.0.0.0 interface lo1

R2#set interface em1 unit 0 family inet address 2.2.2.2/24
R2#set interface lo2 unit 0 family inet address 22.22.22.22/24

R2#set protocol ospf area 0.0.0.0 interface em1
R2#set protocol ospf area 0.0.0.0 interface lo2

show configuration
show ospf neighbor
show protocols ospf

How to configure inter-VLAN static route and RIPv2

2015-09-28T05:48:00.000+08:00

Juniper inter-vlan

set interfaces em1 vlan-tagging

set interfaces em1 unit 10 vlan-id 10 family inet address 192.168.10.1/24

set interfaces em1 unit 20 vlan-id 20 family inet address 192.168.20.1/24

IPv6 Basic address (+playlist)

2014-06-02T23:55:00.001+08:00

Ipv6 general -prefix

2011-07-22T17:05:00.000+08:00

ipv6 general-prefix command is a great help when its come to configuration of IPv6 address. As we all know that when IPv6 address are 128 bits which is lengthy. When it comes to configuration of interfaces, we need to key in a long strings of hexadecimal digits. The command will make the configuration less tedious.

Take for example, ISP assigned you an IPv6 address 2003:abcd:1234::/48. Most of your interfaces on the router will most probabaly be configured within this prefix.

ipv6 general-prefix ISPIssued 2003:345:ABCD::/48

So if we want to assigned 2003:345:ABCD::1/64 to interface fa0/1

We just simply need to

int fa0/1
ipv6 address ISPIssued ::1/64

That's it. We don't have to worry that we will mistype the wrong prefix for the IPv6 addresses for all our interfaces. Noted that an interface can have more than one IPv6 addresses, so any mistype will need to be manually removed by the negate command.

IPv6 Configuration

2011-06-22T12:13:00.000+08:00

DHCP configuration

2011-05-10T10:12:00.000+08:00

Given a scenario of auto-assigning the range of address 192.168.30.0/24 to your host and to reserve the first 10 ip of the range to your static devices such as servers, printers, routers' interfaces etc ... ...

ip dhcp excluded-address 192.168.30.1 192.168.30.10 => tell dhcp server no to assign 1st 10 address

ip dhcp pool TEST => create a TEST pool to start assigning address
network 192.168.30.0 255.255.255.0
=> range of address to assign, will check with excluded-address to start the ip assignment
default-router 192.168.30.1 => define the default gateway to be used by PC
dns-server 192.168.30.10 => define the dns server to be used for resolving URL to IP address

For Voice configuration support
option 150 ip 192.168.30.1 => assuming CME installed on the router

Why option 150?
Cisco phones require access to a TFTP server that contains device configuration name files (.cnf file format), which enables the device to communicate with Cisco Call Manager.

Cisco IP Phones download their configuration from a TFTP server. When a Cisco IP Phone starts, if it does not have both the IP address and TFTP server IP address pre configured, it sends a request with option 150 to the DHCP server to obtain this information.

DHCP Option 150 is Cisco proprietary. The IEEE standard that matches with this requirement is Option 66. Like option 150, option 66 is used to specify the Name of the TFTP server.

Option 66 is an open standard juniper supports it. RFC 2132 defines option 66.

Difference between option 150 and option 66

DHCP option 150 supports a list of TFTP servers (Multiple Server IPs)
DHCP option 66 only supports the IP address or the hostname of a single TFTP server.

Inter-VLAN routing

2011-02-10T10:10:00.000+08:00

Traditional Inter-VLAN
- Separate links are needed for individual VLANs. In the example above, VLAN 10 and VLAN 20 are created. Thus 2 separate fastethernet links are needed to connected to the router.

Configuration on Router2
interface fa0/0
ip address 192.168.10.1 255.255.255.128
no shut
interface fa0/1
ip address 192.168.10.129 255.255.255.128
no shut

Configuration on Switch
=> connection to PC4
interface fa0/10
switchport access vlan 10

=> connection to PC5
interface fa0/20
switchport access vlan 20

=> connection to router2 interface fa0/0
interface fa0/23
switchport access vlan 10

=> connection to router2 interface fa0/1
interface fa0/24
switchport access vlan 20

Router-on-a-stick
- No separate links are needed for individual VLANs. Sub-interfaces are created to connect the Vlans, but ports on switch will need to be set to trunk mode in order for multiple vlans to pass through.

Configuration on Router0
interface fa0/0
no shut
=>good practice to set the sub-interface number to be same as the VLAN id for ease of identification
interface fa0/0.10
encapsulation dot1q 10
ip address 192.168.20.1 255.255.255.128
no shut
interface fa0/1.20
encapsulation dot1q 10
ip address 192.168.20.129 255.255.255.128
no shut

Configuration on Switch
Set the interface connecting to the end device such as client PC to be on the respective VLAN
switchport access vlan 10

Set the interface connecting to another intermediary device such as Router or Switch to be on Trunk mode to enable multiple VLANs to pass through.
switchport mode trunk

**Make sure all the VLAN are created on all the switch if VLAN Trunking Protocol are not configured

Switch-based Inter-VLAN (L3 switch)
- Layer 3 switch allowed one to use the switch as a Layer 3 device to route traffic between different VLANs

Configuration on Multilayer Switch
ip routing => to enable L3 function routing on switch
interface VLAN 10 => gateway for VLAN 10
ip address 192.168.30.1 255.255.255.128
no shut
interface VLAN 20 => gateway for VLAN 20
ip address 192.168.30.129 255.255.255.128
no shut
interface fa0/1 => connected to switch for VLAN 10
switchport access vlan 10

interface fa0/2 => connected to switch for VLAN 20
switchport access vlan 20

Configuration on Switch
Set the interface connecting to the device to be on the respective VLAN
switchport access vlan 10

IPv6 Subnetting

2010-12-16T11:15:00.000+08:00

An ISP is normally allocated a /32 block.
In Singapore, One of the block issued to Singtel is 2001:0C20::/32

| n bits | m bits | 128-n-m bits |
+-----------------------------+---------------+-------------------------------+
| global routing prefix | subnet ID | interface ID |
+-----------------------------+---------------+-------------------------------+
An organization is often allocated a /48 block of IPv6 address space.
Let's use 2001:0C20:A::/48 10th group in the subnet assigned to ISP

The remaining 16 bits of the first half 64 bits will give 65536 /64s

Let's use 0000 for loopback address

2001:0C20:A:0000:0000:0000:0000:0000/64

Router Loopback Addresses
Router loopback addresses are /128 bit host routes
2001:0C20:A:0000:0000:0000:0000:0000/64

Each router loopback address is indicated by its Router # (y):
2001:0C20:A:0000:0000:0000:0000:0001/128
2001:0C20:A:0000:0000:0000:0000:0002/128
2001:0C20:A:0000:0000:0000:0000:FFFE/128
2001:0C20:A:0000:0000:0000:0000:FFFF/128

Point-to-Point Addresses
Point-to-Point are links between only two nodes.
For such networks, we could use one specific set of networks allocated
from the prefix 2001:0C20:A:F000:0000:0000:0000:0000/52

Examples of possible Point to Point subnets:
Point-to-Point Link 1
2001:0C20:A:F001:0000:0000:0000:0001/64
2001:0C20:A:F001:0000:0000:0000:0002/64
...
Point-to-Point Link 10
2001:0C20:A:F00A:0000:0000:0000:0001/64
2001:0C20:A:F00A:0000:0000:0000:0002/64

Server, Printers Subnet Assignment (Static IP)
For such networks, we could use one specific set of networks allocated from the prefix 2001:0C20:A:E000:0000:0000:0000:0000/52

These are examples of possible server subnets:
2001:0C20:A:E001:0000:0000:0000:0000/64
2001:0C20:A:E002:0000:0000:0000:0000/64
...
2001:0C20:A:EFFE:0000:0000:0000:0000/64
2001:0C20:A:EFFF:0000:0000:0000:0000/64

General End-Node Subnets
There are a a few ways you could subnet your end node subnets:
| n bits (48) | b(8) | s(8) | 128-b-s bits (64) |
+-----------------------------+--------------+----------------------------+
| global routing prefix | bldg | Lvl | interface ID |
+-----------------------------+--------------+----------------------------+
OR
| n bits (48) | v(16) | 128-v bits (64) |
+-----------------------------+----------------+----------------------------+
| global routing prefix | VLAN ID | interface ID |
+-----------------------------+----------------+----------------------------+

Building addresses are summarized as: 2001:0C20:A:bb00:0000:0000:0000:0000/56
Level addresses are: 2001:0C20:A:bbll:0000:0000:0000:0000/64

Therefore, Building 45, Level 7 would be: 2001:0C20:A:4507::/64

IPv6 Type of Address

2010-10-14T19:24:00.000+08:00

A)Link-Local (FE80::/10)
When an IPv6 stack is enabled, link-local address is automatically assigned to each interface. The IPv6 link-local prefix FE80::/10 is used and the interface identifier in Extended Unique Identifier 64 (EUI-64) format is appended as the address's low-order 64-bit. Link-local addresses are only for local-link scope and must never be routed between subnets within a site.

Example

RouterA(config-if)#ipv6 address FE80:0:0:0:1001:1234:5678:00AB link-local

The link-local address is configured here. This command with the link-local argument can be used to override the default link-local address assigned by the router.

You can also enable just IPv6 on an interface without specifying an aggregatable global unicast or site-local address by using the ipv6 enable command, as shown here:

Router(config-if)#ipv6 enable

This command also automatically configures the link-local address on the interface.

B)Site-Local (FEC0::/10) - Deprecated in RFC 3879 and replaced with Unique Local IPv6 Unicast Addresses fc00::/7 - RFC 4193, fd00::/8 localli assigned ULA

A site-local address is used only within a site. Site-local addresses are not enabled by default on nodes like link-local addresses, meaning that they must be assigned.
A site-local address is similar to private address spaces in IPv4. A site-local prefix and address may be assigned to any nodes and routers within a site. However, site-local addresses must never be routed on the global IPv6 Internet.

Usage:Printers,Intranet servers, Network switches, bridges, gateways, wireless access points and any servers and routers that must only be reached internally for management purposes

Example

RouterA(config-if)#ipv6 address FEC0:0:0:1001::1/64

The site-local address is configured on the interface. After the completion of this command, the link-local address is automatically configured.

In the following example, the site-local prefix FEC0:0:0:1001::/64 is used to configure the address. The site-local and link-local addresses are automatically configured:

RouterA(config-if)#ipv6 address FEC0:0:0:1::/64 eui-64

***Take note that the Site-local will appear under the Global Unicast Address field same as Aggregate Global Unicast Address, the only way to know that it is site-local is by the first 4 hexadecimal value FEC0.

C)Aggregatable Global Unicast Address

Each global unicast IPv6 address has three parts:

Prefix received from a provider— The prefix assigned to an organization by a provider should be at least a /48 prefix. The /48 prefix represents the high-order 48-bit of the network prefix.
Site— With one /48 prefix allocated to an organization by a provider, it is possible for that organization to enable up to 65,535 subnets (assignment of 64-bit's prefix to subnets).
Host— The host part uses each node's interface identifier. This part of the IPv6 address, which represents the address's low-order 64-bit, is called the interface ID.

Example

RouterA(config-if)#ipv6 address 2001:0c20:0:1001:0:0:0:1abc/64

The aggregatable global unicast address is configured on the interface. After the completion of this command, the link-local address is automatically configured.

In the following example, the aggregatable global unicast prefix 2001:0c20:0:1001::/64 is used to configure the address. The aggregatable global unicast and link-local addresses are automatically configured:

RouterA(config-if)#ipv6 address 2001:0c20:0:1001::/64 eui-64

RIP configuration

2010-07-23T18:54:00.000+08:00

router rip
network
=>enable routing protocol RIP version 1 (classful, same subnet used throughout whole network)
=> routing table send out thru broadcast address 255.255.255.255

router rip
version 2
network

=>enable routing protocol RIP version 2 (classless, able to used different subnet VLSM)
=> routing table send out thru multicast address 224.0.0.9, UDP Port number 520
no auto-summary => no auto summarization

default-information originate => generate a default route into RIP

passive-interface fa0/0 => prevent routing update out thru interface fa0/0

Load Balancing

maximum-paths

=> default 4, maximum 6

=> IOS version 12.3 onwards up to 16

By default, RIP uses broadcast or multicast to push out routing table. If there's a need, we can push update using unicast neighbor

Juniper

R2#set protocol rip group RIPGROUP2 neighbor em2.0

R3#set protocol rip group RIPGROUP3 neighbor em2.0

Group name is local significant

Be default Junos dont advertise route, need to create a policy

R2#set policy-options policy-statement RPOLICY term 1 from protocol rip

R2#set policy-options policy-statement RPOLICY term 1 from protocol direct

R2#set policy-options policy-statement RPOLICY term 1 then accept

R2#set protocol rip group RIPGROUP2 export RPOLICY

R3#set policy-options policy-statement RPOLICY term 1 from protocol rip

R3#set policy-options policy-statement RPOLICY term 1 from protocol direct

R3#set policy-options policy-statement RPOLICY term 1 then accept

R3#set protocol rip group RIPGROUP3 export RPOLICY

show route

Default route

2010-06-18T18:32:00.000+08:00

R1(config)#ip route 0.0.0.0 0.0.0.0 s0/0/1 or
R1(config)#ip route 0.0.0.0 0.0.0.0 200.0.0.2

Send all packets destined for networks not in my routing table to 200.0.0.2 or out interface s0/0/1
**Normally used for connection to ISP

Juniper

set routing-options static route 0.0.0.0/0 next-hop 200.0.0.2

Static route & floating Static route

2010-05-13T18:20:00.000+08:00

Cisco

ip route next-hop address => admin distance of 1

ip route local exit interface => admin distance of 0 like connected interface

e.g. on R1 router

ip route 10.10.30.0 255.255.255.0 10.10.20.2 or

ip route 10.10.30.0 255.255.255.0 s0

** Adding the permanent keyword to a static route statement will keep the static routes in the routing table even if the interface goes down

floating static route (Backup route)

ip route 10.10.30.0 255.255.255.0 s0

ip route 10.10.30.0 255.255.255.0 s0 91

when running eigrp which has a default AD of 90, eigrp route will appear in routing table and only when that route goes down will the floating static route appear. Serves as a backup route.

Juniper

set routing-options static route 10.10.30.0/24 next-hop 10.10.20.2

IPv6
Cisco - ipv6 route 2001:db8::/32 s0 fe80::1/64
Juniper - set routing-options rib inet6.0 static route 2001:200:20:1::1/128 next-hop 2001:200:30:2::2

Show Version

2010-04-15T18:04:00.000+08:00

Router# show version
Cisco Internetwork Operating System Software IOS (tm) 3600 Software (C3640-J-M), Version 11.2(6)P, SHARED PLATFORM, RELEASE SOFTWARE (fc1) Copyright (c) 1986-1997 by cisco Systems, Inc. Compiled Mon 12-May-97 15:07 by tej Image text-base: 0x600088A0, data-base: 0x6075C000 ROM: System Bootstrap, Version 11.1(7)AX [kuong (7)AX], EARLY DEPLOYMENT RELEASE SOFTWARE (fc2) Router uptime is 1 week, 1 day, 38 minutes System restarted by power-on System image file is "flash:c3640-j-mz_112-6_P.bin", booted via flash Host configuration file is "3600_4-confg", booted via tftp from 171.69.83.194 cisco 3640 (R4700) processor (revision 0x00) with 107520K/23552K bytes of memory. Processor board ID 03084730 R4700 processor, Implementation 33, Revision 1.0 Bridging software. SuperLAT software copyright 1990 by Meridian Technology Corp). X.25 software, Version 2.0, NET2, BFE and GOSIP compliant. TN3270 Emulation software. Primary Rate ISDN software, Version 1.0. 2 Ethernet/IEEE 802.3 interface(s) 97 Serial network interface(s) 4 Channelized T1/PRI port(s) DRAM configuration is 64 bits wide with parity disabled. 125K bytes of non-volatile configuration memory. 16384K bytes of processor board System flash (Read/Write) Configuration register is 0x2102

IOS image version and features => c3640-j-mz_112-6_P.bin
Dynamic(Volatile) RAM => 107520K/23552K bytes total = 107520k + 23552k = 131072k
NVRAM => 125K
Flash memory => 16384K

Show command with pipe

2010-03-18T17:47:00.000+08:00

show ip interface brief | exclude unassigned
=> show interface with IP address

show running-config | begin router
=> show routing protocol configuration

show ip protocols
=> show the various routing protocols configured, its participating network and its various running timer

show interface trunk
=> show the interface which are configured as trunk and using 802.1q or ISL encapsulation

show ip route
=>show the routing table
R => RIP
O => OSPF
D => EIGRP
B => BGP
C => connected
S => static
* => default route

Enable Port security

2010-02-11T11:38:00.000+08:00

configure terminal

interface fast ethernet (port)

switchport mode access =>change dynamic to access mode

switchport port-security =>enable port security

switchport port-security mac-address sticky =>remember mac-address

switchport port-security maximum 1 =>only allow 1 mac address

switchport port-security violation shutdown =>shutdown if detect other mac

Enable faster convergence of switch

2010-01-21T11:37:00.000+08:00

For port assign to PC, remember to enable portfast so that it will not be involve in the spanning tree re-calculation

configure terminal

interface fast ethernet (port)

spanning-tree portfast

Stop those translating time

2009-12-11T12:17:00.000+08:00

If you do not have DNS enable. You can stop those annoying translating time when you accidentally hit enter when typing anything

configure terminal

no ip domain-lookup

Prefix and Subnet

2009-11-19T11:51:00.000+08:00

Number of Usable IP addresses

Prefix	Subnet mask	binary form	Total IPs	Usable IPs
/32	255.255.255.255	11111111.11111111.11111111.11111111	XX	XX
/31	255.255.255.254	11111111.11111111.11111111.11111110	2	XX
/30	255.255.255.252	11111111.11111111.11111111.11111100	4	2
/29	255.255.255.248	11111111.11111111.11111111.11111000	8	6
/28	255.255.255.240	11111111.11111111.11111111.11110000	16	14
/27	255.255.255.224	11111111.11111111.11111111.11100000	32	30
/26	255.255.255.192	11111111.11111111.11111111.11000000	64	62
/25	255.255.255.128	11111111.11111111.11111111.10000000	128	126
/24	255.255.255.0	11111111.11111111.11111111.00000000	256	254
/23	255.255.254.0	11111111.11111111.11111110.00000000	512	510
/22	255.255.252.0	11111111.11111111.11111100.00000000	1024	1022
/21	255.255.248.0	11111111.11111111.11111000.00000000	2048	2046
/20	255.255.240.0	11111111.11111111.11110000.00000000	4096	4094
/19	255.255.224.0	11111111.11111111.11100000.00000000	8192	8190

/18 and so on ... ...

***Subnet mask will begin with series of '1' and end with series of '0', there will not be combination of '1' between '0' and '0' between '1'.

***Total IPs formula 2 to the power of n where n is equal to the number of '1'

***Usable IPs = Total IPs - 2 (2 IPs is due to network and broadcast address)

Switch Password Reset

2009-11-13T12:13:00.000+08:00

Press mode button when powered-up

Screen saying password-recovery mechanism started

flash_init

load_helper

dir flash:

rename flash:config.txt flash:config.bak

boot

no to initial configuration dialog

enable

rename flash:config.bak config.txt

copy flash:config.txt system:running-config

copy running-config startup-config

Reset password

2009-10-14T11:04:00.000+08:00

Press break or Control-C when powered-up

in ROMMON

confreg 0x2142

reset

no to System Configuration Dialog

enable

configure memory

copy startup-config running-config

exit

configure terminal

configure-register 0x2102

write memory

Restore back to default

2009-09-16T10:59:00.000+08:00

configure terminal

configure-register 0x2142

reload

=>no need to save system config

no to System Configuration Dialog

configure terminal

configure-register 0x2102

write memory

reload

Download the IOS to the rommon

2009-08-13T15:06:00.000+08:00

rommon 1 > set

PS1=rommon ! >

BSI=0

RET_2_RUTC=0

RET_2_RTS=

?=1

rommon 2 > IP_ADDRESS=192.168.0.2

rommon 3 > IP_SUBNET_MASK=255.255.255.0

rommon 4 > TFTP_SERVER=192.168.0.3

rommon 5 > TFTP_FILE=c1841-xxxxxx-xx.xxx-xx.xx.bin

rommon 6 > DEFAULT_GATEWAY=192.168.0.1

rommon 7 > tftpdnld

IP_ADDRESS: 192.168.0.2

IP_SUBNET_MASK: 255.255.255.0

DEFAULT_GATEWAY: 192.168.0.1

TFTP_SERVER: 192.168.0.3

TFTP_FILE: c1841-xxxxxxx-xx.xxx-xx.xx.bin

Invoke this command for disaster recovery only.

WARNING: all existing data in all partitions on flash will be lost!

Do you wish to continue? y/n:  [n]:  y

Receiving c1841-xxxxxxx-xx.xxx-xx.xx.bin from 192.168.0.3

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

File reception completed.

Copying file c1841-xxxxxxx-xx.xxx-xx.xx.bin to flash.

Erasing flash at 0x60fc0000

program flash location 0x60e70000

rommon 8 >

simple OSPF config

2009-07-24T14:40:00.000+08:00

configure terminal

Router ospf (process id) e.g. 1

Network (interface ip starting address) (wildcard) area 0

wildcard hint:

0.0.0.0 host address

0.0.0.3 subnet mask : /30 255.255.255.252

0.0.0.7 subnet mask: /29 255.255.255.248

0.0.0.15 subnet mask: /28 255.255.255.240

0.0.0.31 subnet mask: /27 255.255.255.224

0.0.0.63 subnet mask: /26 255.255.255.192

0.0.0.127 subnet mask: /25 255.255.255.128

0.0.0.255 subnet mask: /24 255.255.255.0

Copy the IOS from router to the PC

2009-07-23T15:03:00.000+08:00

copy c1841-12-4.xxxx.bin tftp://192.168.0.2

IP address of PC 192.168.0.2

IP address of ethernet interface of router 192.168.0.1