Firewall Tips & Tricks and all about Network

Clear Cisco Router Configuration Back to Factory Defaults

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:41:00 +0000

Router#erase startup-config

Erasing the nvram filesystem will remove all files! Continue? [confirm]

[ OK]

Erase of nvram: complete

Router#reload

Proceed with reload? [confirm]

Configuration Archiving on Cisco Routers

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:40:00 +0000

Create directory in flash to store arhived configs

Router#cd slot0:

Router#mkdir configs

Create directory filename [ configs] ?

Created dir slot0: /configs

Router#

Configure archiving. Configuration stored in archive every time you do a write memory or copy running-config startup-config.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config) #archive

Router(config-archive) #path slot0: /configs/$h ($h uses hostname, $t uses date/time stamp)

Router(config-archive) #write-memory

Router(config-archive) #time-period 1440 (automatic scheduled archive every 1,440 minutes)

Router(config-archive) #end

Router#

View archives

Router#show archive

There are currently 5 archive configurations saved.

The next archive file will be named slot0: /configs/Router1-5

Archive # Name

1 slot0: /configs/Router1-1

2 slot0: /configs/Router1-2

3 slot0: /configs/Router1-3

4 slot0: /configs/Router1-4 <- Most Recent

Router#

Change number of archive files stored

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config) #archive

Router(config-archive) #maximum 10

Router(config-archive) #end

Router#

Show differences between current running config and an archived config

Router#show archive config differences slot0: /configs/Router1-1

Contextual Config Diffs:

+ip cef

-no ip cef

Router#

Rollback to previous configuration archive file

Router#archive config (store current running config)

Router#configure replace slot0: /configs/Router1-1

This will apply all necessary additions and deletions

to replace the current running configuration with the

contents of the specified configuration file, which is

assumed to be a complete configuration, not a partial

configuration. Enter Y if you are sure you want to proceed. ? [ no] : y

Total number of passes: 1

Rollback Done

Router#

Auto Tuning Buffers on Cisco Router

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:39:00 +0000

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#buffers tune automatic

Router(config) #end

Router#

Router# show buffers tune

Tuning happened for the pool Small

Tuning happened at 22: 43: 19

Oldvalues

permanent: 50 minfree: 20 maxfree: 150

Newvalues

permanent: 62 minfree: 15 maxfree: 78

Tuning happened for the pool Middle

Tuning happened at 22: 43: 19

Oldvalues

permanent: 25 minfree: 10 maxfree: 150

Newvalues

permanent: 36 minfree: 9 maxfree: 45

Router#

Tuning Cisco Router Buffers

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:38:00 +0000

Tuning buffers is usually not necessary and doing so incorrectly can cause serious performance problems.

Use the show buffers command to tell if your buffers need adjusting.

Public Buffers:

Router>show buffers

Small buffers, 104 bytes (total 50, permanent 50) :

50 in free list (20 min, 150 max allowed)

265016 hits, 0 misses, 0 trims, 0 created

0 failures (0 no memory) <-- Look for failures

If you see failures you might need to alter your buffer parameters. Failures indicate the number of times the router has attempted to allocate a buffer and failed, causing it to drop the packet. The no memory counts the number of times a failure occurred because no memory was available which usually is resolved by adding more memory to the router.

Tune public buffer pools example:

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config) #buffers big initial 100

Router(config) #buffers big max-free 200

Router(config) #buffers big min-free 50

Router(config) #buffers big permanent 50

Router(config) #end

Router#

Interface Buffers:

Router>show buffers

Ethernet0 buffers, 1524 bytes (total 32, permanent 32) :

8 in free list (0 min, 32 max allowed)

24 hits, 0 fallbacks

8 max cache size, 8 in cache

30963 hits in cache, 0 misses in cache

As long as misses and fallbacks low, no need to adjust interface buffers.

Tune interface buffer pools example:

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config) #buffers Ethernet0 initial 200

Router(config) #buffers Ethernet0 max-free 300

Router(config) #buffers Ethernet0 min-free 50

Router(config) #buffers Ethernet0 permanent 50

Router(config) #end

Router#

Configure Layer 3 port-channel (EtherChannel) between Cisco Router and Switch

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:36:00 +0000

Router:

interface Port-channel1

ip address 10.4.4.2 255.255.255.252

interface GigabitEthernet0/0/0

no ip address

channel-group 1

no shutdown

interface GigabitEthernet0/0/1

no ip address

channel-group 1

no shutdown

Switch:

interface Port-channel1

no switchport

ip address 10.4.4.1 255.255.255.252

interface GigabitEthernet1/0/3

no switchport

no ip address

channel-group 1 mode on

no shutdown

interface GigabitEthernet2/0/3

no switchport

no ip address

channel-group 1 mode on

no shutdown

IPv6 Quick Facts

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:36:00 +0000

- Successor of IPv4

- 128-bit long addresses

- Customer usually gets a /64 subnet

- Not need for NAT anymore

- No Broadcasts

- No ARP

- Stateless Address Configuration without DHCP

- Improved Multicast

- Easy IP Renumbering

- Minimum MTU Size is 1280

- Mobile IPv6

- Mandatory IPsec support

- Extension Headers

- Jumbograms up to 4 GiB

The "Do" Command on a Cisco Router

noreply@blogger.com (MK) — Sat, 02 Jul 2011 14:33:00 +0000

The "do" Command allows you to run "show" commands while in config mode so that you don't have to exit back to privileged mode to chech your work when you are configuring a router.

Example:

router(config)#do show interface f0/1

router(config-if)#do show run

Subnet Cheat Sheet

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:56:00 +0000

The tables below are commonly used subnet masks and hosts.


Class C

Mask	Notation	Subnets	Hosts
255.255.255.0	/24	1	256
255.255.255.128	/25	2	128
255.255.255.192	/26	4	64
255.255.255.224	/27	8	32
255.255.255.240	/28	16	16
255.255.255.248	/29	32	8
255.255.255.252	/30	64	4
255.255.255.254	/31	128	2
255.255.255.255	/32	256	1

Class B

Mask	Notation	Subnets	Hosts
255.255.0.0	/16	1	65,536
255.255.128.0	/17	2	32,768
255.255.192.0	/18	4	16,384
255.255.224.0	/19	8	8,192
255.255.240.0	/20	16	4,096
255.255.248.0	/21	32	2,048
255.255.252.0	/22	64	1,024
255.255.254.0	/23	128	512
255.255.255.0	/24	256	256

Class A

Mask	Notation	Subnets	Hosts
255.0.0.0	/8	1	16,777,216
255.128.0.0	/9	2	8,388,608
255.192.0.0	/10	4	4,194,304
255.224.0.0	/11	8	2,097,152
255.240.0.0	/12	16	1,048,576
255.248.0.0	/13	32	524,288
255.252.0.0	/14	64	262,144
255.254.0.0	/15	128	131,072
255.255.0.0	/16	256	65,536

Linux Cheat Sheet - Command Line

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:55:00 +0000

COMMAND INPUT

The colors designate the actual Linux command in blue, while the user input (file, numeric value, etc) is red.

Basic Operation

#hostame - Displays the hostname and/or FQDN of the system

#uname -a - Displays the hostname and detailed kernel version

#cat /etc/redhat-release - Displays the version of Linux installed Example:

#cat /proc/cpuinfo - Displays information about the CPU(s)

#df -h - Displays the partitions, their sizes details, and mount points

#free - Displays detail about the system memory and usage

#lsof - Displays all open files

#lsof -nPi:22 - Displays any open files which use port 22

#locate httpd.conf - Displays the full path to any file named httpd.conf

#updatedb - Rebuilds index of files for search using the locate utility

Copy, Move, Delete

#cp file1.txt file2.txt - Copies file1.txt to file2.txt

#mv old.txt new.txt - Renames a file called old.txt to new.txt

#rm file1.txt - Deletes file1.txt

#mkdir httpds - Creates a new directory called httpds

#cp -R httpd httpds - Recursively copies all files from directory httpd to httpds

#cp -PR httpd httpds - Recursively copies all files from directory httpd to httpds and retains all permission settings

#rm -rf httpd - Recursively deletes folder httpd and all contents

#chkconfig --list - Displays all services and their state (start or stop) at each runlevel

#chkconfig --level 35 httpd on - Sets httpd to start on runlevels 35 when machine is booted

#service httpd start - Immediately starts Apache

File Attributes

#chown apache virtualhosts.txt - Changes ownership of the virtualhosts.txt file to user apache

#chgrp apache virtualhosts.txt - Changes membership of the virtualhosts.txt file to group apache

#chmod a+x sniffer.pl - Allows the sniffer.pl file to be executed

CHMOD

7 rwx read, write, execute
6 rw- read, write
5 r-x read, execute
4 r-- read
3 -wx write, execute
2 -w- write
1 --x execute
0 --- no permissions

#chmod 777 passwords.txt - Allows read, write, and execute on the file passwords.txt to anyone

#chmod 000 passwords.txt - Blocks read, write, and execute on the file passwords.txt to anyone

Yum

#yum update -y - Updates all packages without prompting

#yum install iptraf - Installs a package named iptraf

#yum whatprovides */iostat - Searches all repositories and returns RPMs that provide the program iostat

#yum update samba - updates a package named samba

RPM

#rpm -q http - Displays the version of daemon http (apache)

#rpm -qa | grep bind - Displays all packages installed with the word bind. Example:

#rpm -qa | grep bind
bind-chroot-9.3.6-16.P1.el5
system-config-bind-4.0.3-4.el5.centos
bind-utils-9.3.6-16.P1.el5
bind-9.3.6-16.P1.el5
bind-libs-9.3.6-16.P1.el5
ypbind-1.19-12.el5

#rpm -ivh proftpd - Interactively installs proftpd

#rpm -Uvh proftpd - Interactive upgrades named proftpd

#rpm -e proftpd - Removes package proftpd

#rpm --rebuilddb - Rebuilds a corrupt RPM database

Compressed files

#unzip package.zip - Unzips the file package.zip

#tar -zvxf stunnel.tar.gz - Decompressed a gzip file named stunnel.tar.gz

Networking

#ifup eth0 - Enables network interface eth0

#ifdown eth0 - Disables network interface eth0

#vi /etc/sysconfig/network-scripts/ifcfg-eth0 - Uses vi to edit network settings on eth0

IP tables

#service iptables status - Displays status of iptables (running or not)

#iptables -L - Displays ruleset of iptables

#iptables -I INPUT -p tcp -m tcp -s 192.168.15.254/26 --dport 22 -j ACCEPT - Accepts incoming SSH connections from IP range 192.168.15.254/26
#iptables -I INPUT -p tcp -m tcp -s 0.0.0.0/0 --dport 22 -j DROP - Blocks SSH connections from everywhere else

#iptables -I INPUT -s "192.168.10.121" -j DROP - Drops all traffic from IP 192.168.10.121

#iptables -D INPUT -s "192.168.10.121" -j DROP - Removes previously allied drop all from IP 192.168.10.121

#iptables -I INPUT -s "192.168.10.0/24" -j DROP - Drops all traffic from IP range 192.168.10.0/24

#iptables -A INPUT -p tcp --dport 25 -j DROP - Blocks all traffic to TCP port 25

#iptables -A INPUT -p tcp --dport 25 -j ACCEPT - Allows all traffic to TCP port 25

#iptables -A INPUT -p udp --dport 53 -j DROP - Blocks all traffic to UDP port 53

#/etc/init.d/iptables save - Saves all IPtables rules and re-applies them after a reboot

Processes

#ps ax - Displays all running processes

#ps aux - Displays all running processes including CPU and memory usage of each

#ps ax | wc -l - Displays the total number of processes

#top - Interactive process manager which allows sorting by criteria

Logs

#tail -f /var/log/messages - Displays the most current entries to the messages log in real-time

#tail -50 /var/log/messages - Displays the last 50 lines of the messages log

#head -50 /var/log/messages - Displays the first 50 lines of the messages log

#cat /var/log/messages - Displays the entire messages log

#cat /var/log/messages | grep "FTP session opened" - Displays any entries in the messages log that contain the ext FTP session opened

#cat /var/log/messages | grep "FTP session opened" > log2.txt - Writes any entries in the messages log that contain the ext FTP session opened to a file named log2.txt

Paths to Common Files

Bind (named)

/var/named - Bind zone files (non chrooted)
/etc/named.conf - Bind configuration file (non chrooted)
/var/named/chroot/var/named - Bind zone files (chrooted)
/var/named/chroot/etc/named.conf - Bind configuration file (chrooted)

Apache (httpd)

/etc/httpd/conf/httpd.conf - Main apache configuration file
/var/www/html - Default directory for serving pages
/var/log/httpd/ - Default location for logs (access and error)

Networking

/etc/hosts - System hosts file
/etc/resolv.conf - DNS lookup configuration file
/etc/sysconfig/network - Network/hostname configuration file
/etc/selinux - SELinux configuration file
/etc/sysconfig/network-scripts/ - Default location of a network setting file
/etc/sysconfig/iptables - Default iptables policy configuration file
/etc/sysconfig/iptables-config - Default iptables daemon configuration file

ScreenOS Cheat Sheet

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:54:00 +0000

COMMAND INPUT

The colors designate the actual ScreenOS command in blue, while the user input (policy name, numeric value, etc) is red.

Basic Operation

get hostame - Displays the hostname of the device

set hostname atlanta-firewall - Sets the hostname to atlanta-firewall

get domain - Displays the domain name of the device

set domain skullbox.net - Sets the domain name to skullbox.net

get chassis - Displays chassis information such as temperature, fan status, and slot information

get system - Displays hardware and software information

get config - Displays the complete running configuration

get zone - Displays all zones present in device

set zone name warehouse - Create new zone named warehouse

unset zone warehouse - Removes zone warehouse

get interface - Displays all physical and sub-interfaces

get interface | include tun - Displayes all intefaces starting with tun (tunnel intefaces)

get interface ethernet0/2 mip - Displays MIP information on specified interface

get arp - Displays all number of sessions, MAC addresses,and IP addresses learned by the device

get ssh - display active management SSH sessions

get counter statistics - Displays statistics for all interfaces

get counter statistics interface ethernet0/2 - Displays statistics for ONLY specific interface

get performance cpu - Displays CPU utilization over the last 1,5, and 15 minutes

get performance session - Displays session utilization over the last 1,5, and 15 minutes

get dns host settings - Displays DNS servers and assigned interfaces

get dhcp - Displays DHCP information and assigned interfaces

get admin - Displays management information such as access ports and filtered IP addresses

get event - See Troubleshooting Section

get session - See Troubleshooting Section

get address untrust - Displays addresses in the untrust zone

get ike gateway - Displays all gateways configured for VPN

get vrouter trust-vr - Displays all vrouter information and routes associated with trust-vr

get sa - Displays information about IKE (VPN) Gateways

get ntp - Displays network time protocol information

get service - Displays protocols both native and custom

set service "RDP" protocol tcp src-port 0-65535 dst-port 3389-3389 Creates a service named RDP with source ports from 0-65535 and a destination port of 3389.

Security

set admin manager-ip 10.15.15.0 255.255.255.0 - Sets administrator access from 10.15.15.0/24

Policies

set policy from Cisco2821 to DMZ902 192.168.105.0/24 Any HTTP permit log - Sets policy from zone Cisco2821 to DMZ902 allowing 192.168.105.0/24 (from Cisco2821) and allows communication to any IP range in zone DMZ902 over port 80 (HTTP) and logs all traffic. This assumes 192.168.105.0/24 is contained in the address list.

set policy from Cisco2821 to DMZ902 192.168.105.0/24 Any ANY nat src permit log - Sets policy from zone Cisco2821 to DMZ902 allowing 192.168.105.0/24 (from Cisco2821) and allows communication to any IP range in zone DMZ902 over any port and logs all traffic. This assumes 192.168.105.0/24 is contained in the address list and this policy also performs NAT.

set policy from Untrust to warehouse Any MIP(216.93.242.16) DNS permit - Sets policy allowing any IP from Untrust (Internet) zone to MIP with IP 216.93.242.16 allowing ONLY DNS traffic

set policy from Untrust to warehouse Any MIP(216.93.242.16) ANY deny log - Sets policy allowing any IP from Untrust (Internet) zone to MIP with IP 216.93.242.16 specifically DENYING ALL traffic and logging it

set policy from Guest to Untrust 192.168.109.0/24 Any HTTP nat src dip-id 5 permit - Sets policy from zone Guest with IP 192.168.109.0/24 to Untrust (Internet) with any IP allowing port 80 (HTTP) performing NAT and using DIP with ID five

set policy from Untrust to warehouse ras.skullbox.net VIP(ethernet0/2) RDP permit log - Sets policy from zone Utrust (Internet) with hostname ras.skullbox.net to zone wharehouse using the specified VIP on Ethernet0/2 allowing RDP traffic and logging it

set policy id 43 disable - Keeps policy id 43 in the configuration, but disables it

set policy id 13 - Modifies policy ID 13
set src-address fin_servers - Adds group fin_servers from address book
set src-address fin_users - Adds group fin_users from address book
set src-address fin_network - Adds group fin_network from address book
set src-address sales_department - Adds group sales_department from address book

set policy id 43 - Modifies policy ID 43
set service DNS - Adds service DNS to policy
set service FTP - Adds service FTP to policy
set service HTTPS - Adds service HTTPS to policy
set service ICMP-ANY - Adds service ICMP-ANY to policy

set zone Untrust screen tear-drop - Sets a screen on interface Untrust for tear drop attacks
set zone Untrust screen syn-flood - Sets a screen on interface Untrust for syn flood attacks
set zone Untrust screen ping-death - Sets a screen on interface Untrust for ping of death attacks
set zone Untrust screen land - Sets a screen on interface Untrust for land attacks

Network Configuration

set interface ethernet0/2 phy full 1000mb - Sets Ethernet0/2 to full-duplex and 1Gbps (not auto-negotiate)

set interface ethernet0/0 ip 216.93.242.12/26 - Sets IP information on Ethernet0/0

set interface ethernet3/0.1 tag 205 zone warehouse - Creates a sub-interface from Ethernet3/0 using 802.11q VLAN tag 205 and puts the new interface into the warehouse zone

set inteface ethernet0/3 route - sets interface Ethernet0/3 to route mode

set inteface ethernet0/5 nat - sets interface Ethernet0/5 to NAT mode

set brgroup 3 0 - Enables group number zero on PIM slot 3. A maximum of 8 bgroups can be configured

Bgroup Configuration

set interface bgroup 3/0 port ethernet3/1 - Add physical interfaces to Bgroup3/0
set interface bgroup 3/0 port ethernet3/2 - Add physical interfaces to Bgroup3/0
set interface bgroup3/0 zone warehouse - Assigns bgroup3/0 to the warehouse zone

set interface ethernet0/5 phy link-down - Physically disables ports
unset interface ethernet0/5 phy link-down - Physically enables ports

set interface tunnel.5 zone Untrust - Creates tunnel interface with ID 5 assigned to zone Untrust
set interface tunnel.5 ip unnumbered interface ethernet0/2 - Sets tunnel.5 as an unnumbered interface with Ethernet0/2 as a gateway

set interface ethernet3/10 ip managable - Enables management interface on IP address assigned to Ethernet3/10

set interface ethernet3/10 manage ping - Enables ping on Ethernet3/10
set interface ethernet3/10 manage ssh - Enables ssh on Ethernet3/10
set interface ethernet3/10 manage snmp - Enables snmp on Ethernet3/10
set interface ethernet3/10 manage web - Enables web on Ethernet3/10
set interface ethernet3/10 manage telnet - Enables telnet on Ethernet3/10

DHCP Configuration

set interface ethernet3/3 dhcp server service - Enables DHCP server on Ethernet3/3
set interface ethernet3/3 dhcp server option lease 1440 - Sets DHCP lease time (in minutes)
set interface ethernet3/3 dhcp server option gateway 192.168.101.1 - Sets gateway provided by DHCP
set interface ethernet3/3 dhcp server option netmask 255.255.255.0 - Sets subnet mask provided by DHCP
set interface ethernet3/3 dhcp server option domainname skullbox.lan - Sets domain suffix provided by DHCP
set interface ethernet3/3 dhcp server option dns1 8.8.8.8 - Sets DNS provided by DHCP
set interface ethernet3/3 dhcp server option dns1 4.4.4.2 - Sets DNS provided by DHCP
set interface ethernet3/3 dhcp server ip 192.168.115.200 to 192.168.115.200 - Sets range of IP addresses for DHCP lease

set interface ethernet 0/2 dip 4 216.93.242.13 216.93.242.13 - Sets interface Ethernet0/2 with a DIP address (ID four) with a range of 216.93.242.13 to 216.93.242.13

set interface ethernet0/2 mip 216.93.242.14 host 192.168.152.15 netmask 255.255.255.255 vr "trust-vr" - Sets Ethernet0/2 to use 216.93.242.14 as a mapped IP to 192.168.152.15/32 using virtual router trust-vr

set interface ethernet0/2 vip interface-ip 3389 RDP 192.168.131.15

Routing

set route 10.145.12.0/24 interface bgroup3/0 gateway 10.145.12.254 description "extranet" - Sets routing desinated for 10.145.12.0/24 to use interface bgroup3/0 with a gateway of 10.145.12.254 and a description called extranet

set route 192.168.99.0/24 interface tunnel.5 description "dr-vpn" - Sets routing desinated for 10.192.168.99.0/24 to use interface tunnel.5 with a description called dr-vpn

SNMP Configuration

set snmp community "xoop" Read-Write Trap-on traffic version v1 - Specifies a read-write community called xoop
set snmp host "xoop" 10.16.0.92/32 src-interface bgroup3/0 trap v1 - sets the source interface and destination for SNMP (version one) requests
set snmp location "rack 34" - Specifies SNMP location information
set snmp contact "Erik Rodriguez" - Specifies SNMP contact information
set snmp name "corp-firewall" - Specifies SNMP device information
set snmp port listen 161 - Specifies SNMP listen port (default is UDP 161)
set snmp port trap 162 - Specifies SNMP trap port (default is UDP 162)

Syslog Configuration

set syslog config 192.168.105.76 - Sets the syslog destination IP
set syslog config 192.168.105.76 facilities local0 local1 - Sets the syslog facilities
set syslog src-interface ethernet3/2 - Sets the interface used to reach the syslog server
set syslog enable

NTP Configuration

set ntp server 216.93.242.12 - Enables NTP with 216.93.242.12 as time source
set ntp server src-interface ethernet3/0 - Uses interface Ethernet3/0 to reach NTP update source
set clock ntp - Enables system clock to sync with NTP
exec ntp update - Forces snyc of clock with NTP server

Troubleshooting

trace-route 216.93.242.12 from ethernet3/0 - Performs a traceroute from a specific interface

ping 216.93.242.12 count 100 from ethernet3/11 - Performs ping to 216.93.242.12 with 100 ICMP echos from interface Ethernet3/11

Sessions

get session src-ip 192.168.1.35 - Displays session information for source device 192.168.1.35

get session dst-ip 216.93.242.12 - Displays session information for destination device 216.93.242.12

get session src-port 3636 - Displays session information for source port 3636

get session dst-port 3389 - Displays session information for destination port 3389

clear session Immediately clears all software sessions

Events

get event policy-id 35 - Displays any events logged regarding policy ID 35

get event level alert Displays any logged events deemed Alerts (requiring immediate action)

get event start-date 2011-05-03 Displays events starting from May 3rd 2011

get event start-time 21:26:42 Displays events starting from 9:26:42 PM

get event include SPI Displays events which include SPI (IKE activity)

Cisco IOS Cheat Sheet

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:45:00 +0000

ROUTER COMMANDS

TERMINAL CONTROLS:

· Config# terminal editing - allows for enhanced editing commands

· Config# terminal monitor - shows output on telnet session

· Config# terminal ip netmask-format hexadecimal|bit-count|decimal - changes the format of subnet masks

HOST NAME:

· Config# hostname ROUTER_NAME

BANNER:

· Config# banner motd # TYPE MESSAGE HERE # - # can be substituted for any character, must start and finish the message

DESCRIPTIONS:

· Config# description THIS IS THE SOUTH ROUTER - can be entered at the Config-if level

CLOCK:

· Config# clock timezone Central -6
# clock set hh:mm:ss dd month yyyy - Example: clock set 14:35:00 25 August 2003

CHANGING THE REGISTER:

· Config# config-register 0x2100 - ROM Monitor Mode

· Config# config-register 0x2101 - ROM boot

· Config# config-register 0x2102 - Boot from NVRAM

BOOT SYSTEM:

· Config# boot system tftp FILENAME SERVER_IP - Example: boot system tftp 2600_ios.bin 192.168.14.2

· Config# boot system ROM

· Config# boot system flash - Then - Config# reload

CDP:

· Config# cdp run - Turns CDP on

· Config# cdp holdtime 180 - Sets the time that a device remains. Default is 180

· Config# cdp timer 30 - Sets the update timer.The default is 60

· Config# int Ethernet 0

· Config-if# cdp enable - Enables cdp on the interface

· Config-if# no cdp enable - Disables CDP on the interface

· Config# no cdp run - Turns CDP off

HOST TABLE:

· Config# ip host ROUTER_NAME INT_Address - Example: ip host lab-a 192.168.5.1
-or-

· Config# ip host RTR_NAME INT_ADD1 INT_ADD2 INT_ADD3 - Example: ip host lab-a 192.168.5.1 205.23.4.2 199.2.3.2 - (for e0, s0, s1)

DOMAIN NAME SERVICES:

· Config# ip domain-lookup - Tell router to lookup domain names

· Config# ip name-server 122.22.2.2 - Location of DNS server

· Config# ip domain-name cisco.com - Domain to append to end of names

CLEARING COUNTERS:

· # clear interface Ethernet 0 - Clears counters on the specified interface

· # clear counters - Clears all interface counters

· # clear cdp counters - Clears CDP counters
STATIC ROUTES:

· Config# ip route Net_Add SN_Mask Next_Hop_Add - Example: ip route 192.168.15.0 255.255.255.0 205.5.5.2

· Config# ip route 0.0.0.0 0.0.0.0 Next_Hop_Add - Default route
-or-

· Config# ip default-network Net_Add - Gateway LAN network

IP ROUTING:

· Config# ip routing - Enabled by default

· Config# router rip
-or-

· Config# router igrp 100

· Config# interface Ethernet 0

· Config-if# ip address 122.2.3.2 255.255.255.0

· Config-if# no shutdown

IPX ROUTING:

· Config# ipx routing

· Config# interface Ethernet 0

· Config# ipx maximum-paths 2 - Maximum equal metric paths used

· Config-if# ipx network 222 encapsulation sap - Also Novell-Ether, SNAP, ARPA on Ethernet. Encapsulation HDLC on serial

· Config-if# no shutdown
ACCESS LISTS:

IP Standard	1-99
IP Extended	100-199
IPX Standard	800-899
IPX Extended	900-999
IPX SAP Filters	1000-1099

IP STANDARD:

· Config# access-list 10 permit 133.2.2.0 0.0.0.255 - allow all src ip’s on network 133.2.2.0
-or-

· Config# access-list 10 permit host 133.2.2.2 - specifies a specific host
-or-

· Config# access-list 10 permit any - allows any address

· Config# int Ethernet 0

· Config-if# ip access-group 10 in - also available: out

IP EXTENDED:

·  Config# access-list 101 permit tcp 133.12.0.0 0.0.255.255 122.3.2.0 0.0.0.255 eq telnet
    -protocols: tcp, udp, icmp, ip (no sockets then), among others
    -source then destination address
    -eq, gt, lt for comparison
    -sockets can be numeric or name (23 or telnet, 21 or ftp, etc)
-or-

· Config# access-list 101 deny tcp any host 133.2.23.3 eq www
-or-

· Config# access-list 101 permit ip any any

· Config# interface Ethernet 0

· Config-if# ip access-group 101 out

IPX STANDARD:

· Config# access-list 801 permit 233 AA3 - source network/host then destination network/host
-or-

· Config# access-list 801 permit -1 -1 - “-1” is the same as “any” with network/host addresses

· Config# interface Ethernet 0

· Config-if# ipx access-group 801 out

IPX EXTENDED:

·  Config# access-list 901 permit sap 4AA all 4BB all
    - Permit protocol src_add socket dest_add socket
    -“all” includes all sockets, or can use socket numbers
-or-

· Config# access-list 901 permit any any all any all
-Permits any protocol with any address on any socket to go anywhere

· Config# interface Ethernet 0

· Config-if# ipx access-group 901 in

IPX SAP FILTER:

· Config# access-list 1000 permit 4aa 3 - “3” is the service type
-or-

· Config# access-list 1000 permit 4aa 0 - service type of “0” matches all services

· Config# interface Ethernet 0

· Config-if# ipx input-sap-filter 1000 - filter applied to incoming packets
-or-

· Config-if# ipx output-sap-filter 1000 - filter applied to outgoing packets

NAMED ACCESS LISTS:

·  Config# ip access-list standard LISTNAME
    -can be ip or ipx, standard or extended
    -followed by the permit or deny list

· Config# permit any

·  Config-if# ip access-group LISTNAME in
    -use the list name instead of a list number
    -allows for a larger amount of access-lists

PPP SETUP:

· Config-if# encapsulation ppp

·  Config-if# ppp authentication chap pap
    -order in which they will be used
    -only attempted with the authentification listed
    -if one fails, then connection is terminated

· Config-if# exit

·  Config# username Lab-b password 123456
    -username is the router that will be connecting to this one
    -only specified routers can connect
-or-

· Config-if# ppp chap hostname ROUTER

·  Config-if# ppp chap password 123456
    -if this is set on all routers, then any of them can connect to any other
    -set same on all for easy configuration

ISDN SETUP:

· Config# isdn switch-type basic-5ess - determined by telecom

· Config# interface serial 0

· Config-if# isdn spid1 2705554564 - isdn “phonenumber” of line 1

· Config-if# isdn spid2 2705554565 - isdn “phonenumber” of line 2

· Config-if# encapsulation PPP - or HDLC, LAPD

DDR - 4 Steps to setting up ISDN with DDR

Configure switch typeConfig# isdn switch-type basic-5ess - can be done at interface config
Configure static routesConfig# ip route 123.4.35.0 255.255.255.0 192.3.5.5 - sends traffic destined for 123.4.35.0 to 192.3.5.5Config# ip route 192.3.5.5 255.255.255.255 bri0 - specifies how to get to network 192.3.5.5 (through bri0)
Configure InterfaceConfig-if# ip address 192.3.5.5 255.255.255.0
Config-if# no shutdown
Config-if# encapsulation ppp
Config-if# dialer-group 1 - applies dialer-list to this interfaceConfig-if# dialer map ip 192.3.5.6 name Lab-b 5551212
connect to lab-b at 5551212 with ip 192.3.5.6 if there is interesting traffic
can also use “dialer string 5551212” instead if there is only one router to connect to
Specify interesting trafficConfig# dialer-list 1 ip permit any
-or-Config# dialer-list 1 ip list 101 - use the access-list 101 as the dialer list
Other OptionsConfig-if# hold-queue 75 - queue 75 packets before dialingConfig-if# dialer load-threshold 125 either
    -load needed before second line is brought up
    -“125” is any number 1-255, where % load is x/255 (ie 125/255 is about 50%)
    -can check by in, out, or either Config-if# dialer idle-timeout 180
    -determines how long to stay idle before terminating the session
    -default is 120

FRAME RELAY SETUP:

· Config# interface serial 0

· Config-if# encapsulation frame-relay - cisco by default, can change to ietf

· Config-if# frame-relay lmi-type cisco - cisco by default, also ansi, q933a

· Config-if# bandwidth 56

· Config-if# interface serial 0.100 point-to-point - subinterface

· Config-if# ip address 122.1.1.1 255.255.255.0

·  Config-if# frame-relay interface-dlci 100
    -maps the dlci to the interface
    -can add BROADCAST and/or IETF at the end

· Config-if# interface serial 1.100 multipoint

· Config-if# no inverse-arp - turns IARP off; good to do

·  Config-if# frame-relay map ip 122.1.1.2 48 ietf broadcast
    -maps an IP to a dlci (48 in this case)
    -required if IARP is turned off
    -ietf and broadcast are optional

· Config-if# frame-relay map ip 122.1.1.3 54 broadcast

SHOW COMMANDS

· Show access-lists - all access lists on the router

· Show cdp - cdp timer and holdtime frequency

· Show cdp entry * - same as next

· Show cdp neighbors detail - details of neighbor with ip add and ios version

· Show cdp neighbors - id, local interface, holdtime, capability, platform portid

· Show cdp interface - int’s running cdp and their encapsulation

· Show cdp traffic - cdp packets sent and received

· Show controllers serial 0 - DTE or DCE status

· Show dialer - number of times dialer string has been reached, other stats

· Show flash - files in flash

· Show frame-relay lmi - lmi stats

· Show frame-relay map - static and dynamic maps for PVC’s

· Show frame-relay pvc - pvc’s and dlci’s

· Show history - commands entered

· Show hosts - contents of host table

· Show int f0/26 - stats of f0/26

· Show interface Ethernet 0 - show stats of Ethernet 0

· Show ip - ip config of switch

· Show ip access-lists - ip access-lists on switch

· Show ip interface - ip config of interface

· Show ip protocols - routing protocols and timers

· Show ip route - Displays IP routing table

· Show ipx access-lists - same, only ipx

· Show ipx interfaces - RIP and SAP info being sent and received, IPX addresses

· Show ipx route - ipx routes in the table

· Show ipx servers - SAP table

· Show ipx traffic - RIP and SAP info

· Show isdn active - number with active status

· Show isdn status - shows if SPIDs are valid, if connected

· Show mac-address-table - contents of the dynamic table

· Show protocols - routed protocols and net_addresses of interfaces

· Show running-config - dram config file

· Show sessions - connections via telnet to remote device

· Show startup-config - nvram config file

· Show terminal - shows history size

· Show trunk a/b - trunk stat of port 26/27

· Show version - ios info, uptime, address of switch

· Show vlan - all configured vlan’s

· Show vlan-membership - vlan assignments

· Show vtp - vtp configs

CATALYST COMMANDS
For Native IOS - Not CatOS

SWITCH ADDRESS:

· Config# ip address 192.168.10.2 255.255.255.0

· Config# ip default-gateway 192.168.10.1

DUPLEX MODE:

· Config# interface Ethernet 0/5 - “fastethernet” for 100 Mbps ports

· Config-if# duplex full - also, half | auto | full-flow-control

SWITCHING MODE:

· Config# switching-mode store-and-forward - also, fragment-free

MAC ADDRESS CONFIGS:

· Config# mac-address-table permanent aaab.000f.ffef e0/2 - only this mac will work on this port

·  Config# mac-address-table restricted static aaab.000f.ffef e0/2 e0/3
    -port 3 can only send data out port 2 with that mac
    -very restrictive security

· Config-if# port secure max-mac-count 5 - allows only 5 mac addresses mapped to this port

VLANS:

· Config# vlan 10 name FINANCE

· Config# interface Ethernet 0/3

· Config-if# vlan-membership static 10

TRUNK LINKS:

· Config-if# trunk on - also, off | auto | desirable | nonegotiate

·  Config-if# no trunk-vlan 2
    -removes vlan 2 from the trunk port
    -by default, all vlans are set on a trunk port

CONFIGURING VTP:

· Config# delete vtp - should be done prior to adding to a network

· Config# vtp server - the default is server, also client and transparent

· Config# vtp domain Camp - name doesn’t matter, just so all switches use the same

· Config# vtp password 1234 - limited security

· Config# vtp pruning enable - limits vtp broadcasts to only switches affected

· Config# vtp pruning disable

FLASH UPGRADE:

· Config# copy tftp://192.5.5.5/configname.ios opcode - “opcode” for ios upgrade, “nvram” for startup config

DELETE STARTUP CONFIG:

· Config# delete nvram

Network Cheatsheet

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:36:00 +0000

###############################################################################

Netmask              Netmask (binary)                 CIDR     Notes    
_____________________________________________________________________________
255.255.255.255  11111111.11111111.11111111.11111111  /32  Host (single addr)
255.255.255.254  11111111.11111111.11111111.11111110  /31  Unuseable
255.255.255.252  11111111.11111111.11111111.11111100  /30    2  useable
255.255.255.248  11111111.11111111.11111111.11111000  /29    6  useable
255.255.255.240  11111111.11111111.11111111.11110000  /28   14  useable
255.255.255.224  11111111.11111111.11111111.11100000  /27   30  useable
255.255.255.192  11111111.11111111.11111111.11000000  /26   62  useable
255.255.255.128  11111111.11111111.11111111.10000000  /25  126  useable
255.255.255.0    11111111.11111111.11111111.00000000  /24 "Class C" 254 useable

255.255.254.0    11111111.11111111.11111110.00000000  /23    2  Class C's
255.255.252.0    11111111.11111111.11111100.00000000  /22    4  Class C's
255.255.248.0    11111111.11111111.11111000.00000000  /21    8  Class C's
255.255.240.0    11111111.11111111.11110000.00000000  /20   16  Class C's
255.255.224.0    11111111.11111111.11100000.00000000  /19   32  Class C's
255.255.192.0    11111111.11111111.11000000.00000000  /18   64  Class C's
255.255.128.0    11111111.11111111.10000000.00000000  /17  128  Class C's
255.255.0.0      11111111.11111111.00000000.00000000  /16  "Class B"
     
255.254.0.0      11111111.11111110.00000000.00000000  /15    2  Class B's
255.252.0.0      11111111.11111100.00000000.00000000  /14    4  Class B's
255.248.0.0      11111111.11111000.00000000.00000000  /13    8  Class B's
255.240.0.0      11111111.11110000.00000000.00000000  /12   16  Class B's
255.224.0.0      11111111.11100000.00000000.00000000  /11   32  Class B's
255.192.0.0      11111111.11000000.00000000.00000000  /10   64  Class B's
255.128.0.0      11111111.10000000.00000000.00000000  /9   128  Class B's
255.0.0.0        11111111.00000000.00000000.00000000  /8   "Class A"
  
254.0.0.0        11111110.00000000.00000000.00000000  /7
252.0.0.0        11111100.00000000.00000000.00000000  /6
248.0.0.0        11111000.00000000.00000000.00000000  /5
240.0.0.0        11110000.00000000.00000000.00000000  /4
224.0.0.0        11100000.00000000.00000000.00000000  /3
192.0.0.0        11000000.00000000.00000000.00000000  /2
128.0.0.0        10000000.00000000.00000000.00000000  /1
0.0.0.0          00000000.00000000.00000000.00000000  /0   IP space

For wildcard netmasks (aka reverse netmasks), subtract each octet of a standard netmask from 255.
  Example 1: 255.255.255.0 becomes 0.0.0.255
  Example 2: 255.255.252.0 becomes 0.0.3.255

###############################################################################

                                   Net     Host    Total
Net      Addr                      Addr    Addr    Number
Class   Range      NetMask         Bits    Bits   of hosts
----------------------------------------------------------
A        0-127    255.0.0.0         8      24     16777216   (i.e. 114.0.0.0)
B      128-191    255.255.0.0      16      16        65536   (i.e. 150.0.0.0)
C      192-254    255.255.255.0    24       8          256   (i.e. 199.0.0.0)
D      224-239    (multicast)
E      240-255    (reserved)
F      208-215    255.255.255.240  28       4           16
G      216/8      ARIN - North America
G      217/8      RIPE NCC - Europe
G      218-219/8  APNIC
H      220-221    255.255.255.248  29       3            8   (reserved)
K      222-223    255.255.255.254  31       1            2   (reserved)
(ref: RFC1375 & http://www.iana.org/assignments/ipv4-address-space )
(               http://www.iana.org/numbers.htm                    )
----------------------------------------------------------

The current list of special use prefixes:
 0.0.0.0/8 
 127.0.0.0/8
 192.0.2.0/24
 10.0.0.0/8
 172.16.0.0/12
 192.168.0.0/16
 169.254.0.0/16
 all D/E space
(ref: RFC1918 http://www.rfc-editor.org/rfc/rfc1918.txt   )
(       or     ftp://ftp.isi.edu/in-notes/rfc1918.txt     )
(rfc search:   http://www.rfc-editor.org/rfcsearch.html   )
(              http://www.ietf.org/ietf/1id-abstracts.txt )
(              http://www.ietf.org/shadow.html            )


Martians: (updates at: www.iana.org/assignments/ipv4-address-space )
 no ip source-route
 access-list 100 deny   ip host 0.0.0.0 any
  deny ip 0.0.0.0         0.255.255.255  any log  ! antispoof
  deny ip 0.0.0.0 0.255.255.255  0.0.0.0 255.255.255.255 ! antispoof
  deny ip any             255.255.255.128 0.0.0.127 ! antispoof
  deny ip host            0.0.0.0        any log  ! antispoof
  deny ip host            [router intf]  [router intf] ! antispoof
  deny ip xxx.xxx.xxx.0   0.0.0.255      any log  ! lan area
  deny ip 0/8             0.255.255.255  any log  ! IANA - Reserved
  deny ip 1/8             0.255.255.255  any log  ! IANA - Reserved
  deny ip 2/8             0.255.255.255  any log  ! IANA - Reserved
  deny ip 5/8             0.255.255.255  any log  ! IANA - Reserved
  deny ip 7/8             0.255.255.255  any log  ! IANA - Reserved
  deny ip 10.0.0.0        0.255.255.255  any log  ! IANA - Private Use
  deny ip 23/8            0.255.255.255  any log  ! IANA - Reserved
  deny ip 27/8            0.255.255.255  any log  ! IANA - Reserved
  deny ip 31/8            0.255.255.255  any log  ! IANA - Reserved
  deny ip 36-37/8         0.255.255.255  any log  ! IANA - Reserved
  deny ip 39/8            0.255.255.255  any log  ! IANA - Reserved
  deny ip 41-42/8         0.255.255.255  any log  ! IANA - Reserved
  deny ip 50/8            0.255.255.255  any log  ! IANA - Reserved
  deny ip 58-60/8         0.255.255.255  any log  ! IANA - Reserved
  deny ip 69-79/8         0.255.255.255  any log  ! IANA - Reserved
  deny ip 82-95/8         0.255.255.255  any log  ! IANA - Reserved
  deny ip 96-126/8        0.255.255.255  any log  ! IANA - Reserved
  deny ip 127/8           0.255.255.255  any log  ! IANA - Reserved
  deny ip 169.254.0.0     0.0.255.255    any log  ! link-local network
  deny ip 172.16.0.0      0.15.255.255   any log  ! reserved
  deny ip 192.168.0.0     0.0.255.255    any log  ! reserved
  deny ip 192.0.2.0       0.0.0.255      any log  ! test network
  deny ip 197/8           0.255.255.255  any log  ! IANA - Reserved
  deny ip 220/8           0.255.255.255  any log  ! IANA - Reserved
  deny ip 222-223/8       0.255.255.255  any log  ! IANA - Reserved
  deny ip 224.0.0.0       31.255.255.255 any log  ! multicast
  deny ip 224.0.0.0       15.255.255.255 any log  ! unless MBGP-learned routes
  deny ip 224-239/8       0.255.255.255  any log  ! IANA - Multicast
  deny ip 240-255/8       0.255.255.255  any log  ! IANA - Reserved

filtered source addresses
  0/8                 ! broadcast
  10/8                ! RFC 1918 private
  127/8               ! loopback
  169.254.0/16        ! link local
  172.16.0.0/12       ! RFC 1918 private
  192.0.2.0/24        ! TEST-NET
  192.168.0/16        ! RFC 1918 private
  224.0.0.0/4         ! class D multicast
  240.0.0.0/5         ! class E reserved
  248.0.0.0/5         ! reserved
  255.255.255.255/32  ! broadcast

ARIN administrated blocks: (http://www.arin.net/regserv/IPStats.html)
   24.0.0.0/8 (portions of)
   63.0.0.0/8
   64.0.0.0/8
   65.0.0.0/8
   66.0.0.0/8
  196.0.0.0/8
  198.0.0.0/8
  199.0.0.0/8
  200.0.0.0/8
  204.0.0.0/8
  205.0.0.0/8
  206.0.0.0/8
  207.0.0.0/8
  208.0.0.0/8
  209.0.0.0/8
  216.0.0.0/8

###############################################################################

well known ports: (rfc1700.txt)
 www.iana.org/assignments/port-numbers

protocol numbers:
 www.iana.org/assignments/protocol-numbers
 www.iana.org/numbers.htm

Protocol     Protocol Number
--------     ---------------
ICMP  1
IGRP  9
EIGRP  88
OSPF  89
IPv6  41
GRE  47
IPX in IP 111
L2TP  115

###############################################################################

digital signal X

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:35:00 +0000

Digital signal X is a term for the series of standard digital transmission rates or levels based on DS0, a transmission rate of 64 kilobits per second (Kbps), the bandwidth normally used for one telephone voice channel. Both the North American T-carrier system and the European E-carrier system of transmission operate using the DS series as a base multiple. The digital signal is what is carried inside the carrier system.

DS0 is the base for the digital signal X series. DS1, used as the signal in the T1 carrier, is 24 DS0 (64 Kbps) signals transmitted using pulse-code modulation (PCM)

and time-division multiplexing (TDM). DS2 is four DS1 signals multiplexed together to produce a rate of 6.312Mbps. DS3, the signal in the T3 carrier, carries a multiple of 28 DS1 signals or 672 DS0s or 44.736 Mbps.

Digital signal X is based on the ANSI T1.107 guidelines. The ITU-TS guidelines differ somewhat. The following table summarizes the set of signals and relates them to the T-carrier and E-carrier systems.

Digital Signal Designator	Data Rate	DS0 Multiple	T-Carrier	E-Carrier
DS0	64 Kbps	1	-	-
DS1	1.544 Mbps	24	T1	-
-	2.048 Mbps	32	-	E1
DS1C	3.152 Mbps	48	-	-
DS2	6.312 Mbps	96	T2	-
-	8.448 Mbps	128	-	E2
-	34.368 Mbps	512	-	E3
DS3	44.736 Mbps	672	T3	-
-	139.264 Mbps	2048	-	E4
DS4/NA	139.264 Mbps	2176	-	-
DS4	274.176 Mbps	4032	-	-
-	565.148 Mbps	4 E4 channels	-	E5

The speed of...

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:33:00 +0000

This table shows the stated data rates for the most important end-user and backbone transmission technologies.

Technology Speed Physical Medium Application

GSMmobile telephone service 9.6 to 14.4 Kbps RF in space (wireless) Mobile telephone for business and personal use

High-Speed Circuit-Switched Data service (HSCSD) Up to 56 Kbps RF in space (wireless) Mobile telephone for business and personal use

Regular telephone service (POTS) Up to 56 Kbps twisted pair Home and small business access

Dedicated 56Kbps on frame relay 56 Kbps Various Business e-mail with fairly large file attachments

DS0 64 Kbps All The base signal on a channel in the set of Digital Signal levels

General Packet Radio System (GPRS) 56 to 114 Kbps RF in space (wireless) Mobile telephone for business and personal use

ISDN BRI: 64 Kbps to 128 Kbps
PRI: 23 (T-1) or 30 (E1) assignable 64-Kbps channels plus control channel; up to 1.544 Mbps (T-1) or 2.048 (E1) BRI: Twisted-pair
PRI: T-1 or E1 line BRI: Faster home and small business access
PRI: Medium and large enterprise access

IDSL 128 Kbps Twisted-pair Faster home and small business access

AppleTalk 230.4 Kbps Twisted pair Local area network for Apple devices; several networks can be bridged; non-Apple devices can also be connected

Enhanced Data GSM Environment (EDGE) 384 Kbps RF in space (wireless) Mobile telephone for business and personal use

satellite 400 Kbps (DirecPC and others) RF in space (wireless) Faster home and small enterprise access

frame relay 56 Kbps to 1.544 Mbps Twisted-pair or coaxial cable Large company backbone for LANs toISP
ISP to Internet infrastructure

DS1/T-1 1.544 Mbps Twisted-pair, coaxial cable, oroptical fiber Large company to ISP
ISP to Internet infrastructure

Universal Mobile Telecommunications Service (UMTS) Up to 2 Mbps RF in space (wireless) Mobile telephone for business and personal use (available in 2002 or later)

E-carrier 2.048 Mbps Twisted-pair, coaxial cable, oroptical fiber 32-channel European equivalent of T-1

T-1C (DS1C) 3.152 Mbps Twisted-pair, coaxial cable, or optical fiber Large company to ISP
ISP to Internet infrastructure

IBM Token Ring/802.5 4 Mbps (also 16 Mbps) Twisted-pair, coaxial cable, or optical fiber Second most commonly-used local area network after Ethernet

DS2/T-2 6.312 Mbps Twisted-pair, coaxial cable, or optical fiber Large company to ISP
ISP to Internet infrastructure

Digital Subscriber Line (DSL) 512 Kbps to 8 Mbps Twisted-pair (used as a digital,broadband medium) Home, small business, and enterprise access using existing copper lines

E-2 8.448 Mbps Twisted-pair, coaxial cable, or optical fiber Carries four multiplexed E-1 signals

cable modem 512 Kbps to 52 Mbps
(see "Key and explanation" below) Coaxial cable (usually uses Ethernet); in some systems, telephone used for upstream requests Home, business, school access

Ethernet 10 Mbps 10BASE-T (twisted-pair); 10BASE-2 or -5 (coaxial cable); 10BASE-F (optical fiber) Most popular business local area network (LAN)

IBM Token Ring/802.5 16 Mbps (also 4 Mbps) Twisted-pair, coaxial cable, or optical fiber Second most commonly-used local area network after Ethernet

E-3 34.368 Mbps Twisted-pair or optical fiber Carries 16 E-l signals

DS3/T-3 44.736 Mbps Coaxial cable ISP to Internet infrastructure
Smaller links within Internet infrastructure

OC-1 51.84 Mbps Optical fiber ISP to Internet infrastructure
Smaller links within Internet infrastructure

High-Speed Serial Interface (HSSI) Up to 53 Mbps HSSI cable Between router hardware and WAN lines
Short-range (50 feet) interconnection between slower LAN devices and faster WAN lines

Fast Ethernet 100 Mbps 100BASE-T (twisted pair);100BASE-T (twisted pair);100BASE-T (optical fiber) Workstations with 10 Mbps Ethernet cards can plug into a Fast Ethernet LAN

Fiber Distributed-Data Interface (FDDI) 100 Mbps Optical fiber Large, wide-range LAN usually in a large company or a larger ISP

T-3D (DS3D) 135 Mbps Optical fiber ISP to Internet infrastructure
Smaller links within Internet infrastructure

E-4 139.264 Mbps Optical fiber Carries 4 E3 channels
Up to 1,920 simultaneous voice conversations

OC-3/SDH 155.52 Mbps Optical fiber Large company backbone
Internet backbone

E-5 565.148 Mbps Optical fiber Carries 4 E4 channels
Up to 7,680 simultaneous voice conversations

OC-12/STM-4 622.08 Mbps Optical fiber Internet backbone

Gigabit Ethernet 1 Gbps Optical fiber (and "copper" up to 100 meters) Workstations/networks with 10/100 Mbps Ethernet plug into Gigabit Ethernet switches

OC-24 1.244 Gbps Optical fiber Internet backbone

SciNet 2.325 Gbps (15 OC-3 lines) Optical fiber Part of the vBNS backbone

OC-48/STM-16 2.488 Gbps Optical fiber Internet backbone

OC-192/STM-64 10 Gbps Optical fiber Backbone

OC-256 13.271 Gbps Optical fiber Backbone

This table shows the stated data rates for the most important end-user and backbone transmission technologies.
Technology	Speed	Physical Medium	Application
GSMmobile telephone service	9.6 to 14.4 Kbps	RF in space (wireless)	Mobile telephone for business and personal use
High-Speed Circuit-Switched Data service (HSCSD)	Up to 56 Kbps	RF in space (wireless)	Mobile telephone for business and personal use
Regular telephone service (POTS)	Up to 56 Kbps	twisted pair	Home and small business access
Dedicated 56Kbps on frame relay	56 Kbps	Various	Business e-mail with fairly large file attachments
DS0	64 Kbps	All	The base signal on a channel in the set of Digital Signal levels
General Packet Radio System (GPRS)	56 to 114 Kbps	RF in space (wireless)	Mobile telephone for business and personal use
ISDN	BRI: 64 Kbps to 128 Kbps PRI: 23 (T-1) or 30 (E1) assignable 64-Kbps channels plus control channel; up to 1.544 Mbps (T-1) or 2.048 (E1)	BRI: Twisted-pair PRI: T-1 or E1 line	BRI: Faster home and small business access PRI: Medium and large enterprise access
IDSL	128 Kbps	Twisted-pair	Faster home and small business access
AppleTalk	230.4 Kbps	Twisted pair	Local area network for Apple devices; several networks can be bridged; non-Apple devices can also be connected
Enhanced Data GSM Environment (EDGE)	384 Kbps	RF in space (wireless)	Mobile telephone for business and personal use
satellite	400 Kbps (DirecPC and others)	RF in space (wireless)	Faster home and small enterprise access
frame relay	56 Kbps to 1.544 Mbps	Twisted-pair or coaxial cable	Large company backbone for LANs toISP ISP to Internet infrastructure
DS1/T-1	1.544 Mbps	Twisted-pair, coaxial cable, oroptical fiber	Large company to ISP ISP to Internet infrastructure
Universal Mobile Telecommunications Service (UMTS)	Up to 2 Mbps	RF in space (wireless)	Mobile telephone for business and personal use (available in 2002 or later)
E-carrier	2.048 Mbps	Twisted-pair, coaxial cable, oroptical fiber	32-channel European equivalent of T-1
T-1C (DS1C)	3.152 Mbps	Twisted-pair, coaxial cable, or optical fiber	Large company to ISP ISP to Internet infrastructure
IBM Token Ring/802.5	4 Mbps (also 16 Mbps)	Twisted-pair, coaxial cable, or optical fiber	Second most commonly-used local area network after Ethernet
DS2/T-2	6.312 Mbps	Twisted-pair, coaxial cable, or optical fiber	Large company to ISP ISP to Internet infrastructure
Digital Subscriber Line (DSL)	512 Kbps to 8 Mbps	Twisted-pair (used as a digital,broadband medium)	Home, small business, and enterprise access using existing copper lines
E-2	8.448 Mbps	Twisted-pair, coaxial cable, or optical fiber	Carries four multiplexed E-1 signals
cable modem	512 Kbps to 52 Mbps (see "Key and explanation" below)	Coaxial cable (usually uses Ethernet); in some systems, telephone used for upstream requests	Home, business, school access
Ethernet	10 Mbps	10BASE-T (twisted-pair); 10BASE-2 or -5 (coaxial cable); 10BASE-F (optical fiber)	Most popular business local area network (LAN)
IBM Token Ring/802.5	16 Mbps (also 4 Mbps)	Twisted-pair, coaxial cable, or optical fiber	Second most commonly-used local area network after Ethernet
E-3	34.368 Mbps	Twisted-pair or optical fiber	Carries 16 E-l signals
DS3/T-3	44.736 Mbps	Coaxial cable	ISP to Internet infrastructure Smaller links within Internet infrastructure
OC-1	51.84 Mbps	Optical fiber	ISP to Internet infrastructure Smaller links within Internet infrastructure
High-Speed Serial Interface (HSSI)	Up to 53 Mbps	HSSI cable	Between router hardware and WAN lines Short-range (50 feet) interconnection between slower LAN devices and faster WAN lines
Fast Ethernet	100 Mbps	100BASE-T (twisted pair);100BASE-T (twisted pair);100BASE-T (optical fiber)	Workstations with 10 Mbps Ethernet cards can plug into a Fast Ethernet LAN
Fiber Distributed-Data Interface (FDDI)	100 Mbps	Optical fiber	Large, wide-range LAN usually in a large company or a larger ISP
T-3D (DS3D)	135 Mbps	Optical fiber	ISP to Internet infrastructure Smaller links within Internet infrastructure
E-4	139.264 Mbps	Optical fiber	Carries 4 E3 channels Up to 1,920 simultaneous voice conversations
OC-3/SDH	155.52 Mbps	Optical fiber	Large company backbone Internet backbone
E-5	565.148 Mbps	Optical fiber	Carries 4 E4 channels Up to 7,680 simultaneous voice conversations
OC-12/STM-4	622.08 Mbps	Optical fiber	Internet backbone
Gigabit Ethernet	1 Gbps	Optical fiber (and "copper" up to 100 meters)	Workstations/networks with 10/100 Mbps Ethernet plug into Gigabit Ethernet switches
OC-24	1.244 Gbps	Optical fiber	Internet backbone
SciNet	2.325 Gbps (15 OC-3 lines)	Optical fiber	Part of the vBNS backbone
OC-48/STM-16	2.488 Gbps	Optical fiber	Internet backbone
OC-192/STM-64	10 Gbps	Optical fiber	Backbone
OC-256	13.271 Gbps	Optical fiber	Backbone

frame-relay full mesh

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:26:00 +0000

The formula N(N-1)/2 calculates the number of connections needed for a full mesh.
5 routers for example need 10 pvc’s for the full mesh. 5*4/2=10.
It’s easier to make a table and write down the connections first before configuering frame-relay.
For example here are the serial interfaces with the dlci.
S1 Â Â Â S2Â Â Â Â Â S3 Â Â Â S4Â Â Â Â Â S5
101—201
102 ———-301
103 ——————-401
104 —————————501
——–202–302
——–203———-402
——–204——————-502
—————-303–403
—————-304———–503
———————-404—–504
So if you have configured Router1 with
int s0
encap frame
frame-relay interface-dlci 101
frame-relay interface-dlci 102
frame-relay interface-dlci 103
frame-relay interface-dlci 104
and so on with the other routers r2,r3,r4
your have to configure the siwtch like this:
frame-relay switching
conf t
int s1
encap frame
frame-relay intf-type dce
frame-relay route 101 serial 2 201
frame-relay route 102 serial 3 301
frame-relay route 103 serial 4 401
frame-rleay route 104 serial 5 501
and so on with the other router, like in the table configured before.

point-to-point vs. multipoint in frame-relay

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:25:00 +0000

The comment’s on this i found have not been very clearly. I figured out that it might be no really difference between these two configurations.
There is a hard limit in the number of subinterfaces at about 300.
But generally it seems to be a better choice to use point-to-point subinterfaces.
On a point-to-point subinterface, you have to use the frame-relay interface-dlci command to associate a DLCI with the subinterface. There’s no inverse ARP – any IP address that matches the address/subnet-mask is assumed
to be at the end of the DLCI.
On a point-to-multipoint you can either use the frame-relay interface-dlci command and let the inverse-arp generate the frame-relay map, or you can use
the frame-relay map command.
Remember, the frame switch doesn’t know about sub-interfaces, only about a collection of DLCIs. It communicates active DLCI numbers via the ILMI
protocol to the router. The router then has to know which DLCIs are assigned to which subinterfaces. If you haven’t specified which subinterface a DLCI belongs to with either a “frame-relay interface-dlci” or a “frame-relay map” then the DLCI is put under the main interface by default.
The inverse ARP protocol is end-to-end between the routers – it has nothing to do with the switches in between.
The difference is also, that it is not possible to configure more than one dlci on a point-to-point interface. The error message is:
%PVC already assigned to sub-interface Serial0/0.3
So if you want to configure more than one dlci on an subinterface, you have to use multipoint. But also pysical interface are multipoint by default.

inverse-arp in frame-relay

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:25:00 +0000

What does inverse arp in frame-relay?
With inverse-arp something is similiar done like with inverse arp in the IP world. The router is trying to map a Layer 2 adresse to a Layer 3 adress.
With show frame-relay map you can list those mappings.
With inverse arp these are dynamic mappings. It’s also possible to map statically.
frame-relay map [ip] [dlci] broadcast
When you configure point-to-point subinterface inverse arp is not needed, as it is disabled be default on each subinterface.

static and dynamic mappings in frame-relay

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:25:00 +0000

It is possible to map an ip dynamically or static on an serial interface. With inverse arp the dynamic address resolution is done by the router, trying to find out it’s mapping to the remote device and to make an entry in the local adress table. In this adress table all static and dynamic mappings are recorded.
Another definition is:
The information that correlates to the next-hop router’s Layer 3 address, and the Layer 2 address used to reach it, is called mapping. Mapping is needed on multiaccess networks.
show frame-relay map
inverse arp on the physical interface is enabled by default for configured network protocols (IP, IPX, Appletalk) on cisco routers.
Inverse ARP dynamically creates a mapping between the Layer 3 address (for example, the IP address) and the Layer 2 address (the DLCI). The end result of Inverse ARP is the same as IP ARP on a LAN: The router builds a mapping between a neighboring Layer 3 address and the corresponding Layer 2 address.
Note, “ip routing” must be enabled on a router for frame-relay inverse-arp to work.

frame-relay map ip dlci broadcast

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:24:00 +0000

The Broadcast keyword means, to allow the specified DLCI to forward broadcast and multicast packets. This is usefull for OSPF.

debugging frame-relay

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:24:00 +0000

To debug frame-relay there are several possibilities.
The first useful command is:
sh frame-relay pvc
With this command you could list all currently configured pvc’s.
This may look like:
DLCI = 314, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial1/1
input pkts 1 output pkts 0 in bytes 30
out bytes 0 dropped pkts 0 in pkts dropped 0
out pkts dropped 0 out bytes dropped 0
in FECN pkts 0 in BECN pkts 0 out FECN pkts 0
out BECN pkts 0 in DE pkts 0 out DE pkts 0
out bcast pkts 0 out bcast bytes 0
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
pvc create time 00:23:07, last time pvc status changed 00:23:07
Note the pcv ACTIVE status. This indicates the pvc is up and running and lmi messages are being send to and from the frame-relay switch .
The PVC can have four possible states. These are shown by the PVC STATUS field as follows:

ACTIVE – PVC is up and functioning normally.
INACTIVE – PVC is not up end-to-end. This may be because either there is no mapping (or incorrect mapping) for the local DLCI in the frame-relay cloud or the remote end of the PVC is Deleted.
DELETED – Either the Local Management Interface (LMI) is not exchanged between the router and the local switch, or the switch does not have DLCI configured on the local switch.
STATIC – no keepalive configured on the frame-relay interface of the router.

It’s also a good idea, if you have change frame-relay your configuration on an interface, to reload the router. Just to make sure, no old configuration settings are interferring.
The DLCI status can be one of the following:
The DLCI USAGE field contains one of the following entries:

SWITCHED – the router or access server is used as a switch.
LOCAL – the router or access server is used as data terminal equipment (DTE).
UNUSED – the data-link connection identifier (DLCI) is not referenced by user-entered configuration commands on the router.

To find out something about the lmi layer 2 communications between the frame-relay devices you can use:
debug frame-relay lmi
This could also show some information about the satus of the frame-relay link:
*Mar 1 08:51:53.615: Serial1/1(out): StEnq, myseq 43, yourseen 41, DTE up
*Mar 1 08:51:53.615: datagramstart = 0x7B00854, datagramsize = 13
*Mar 1 08:51:53.615: FR encap = 0xFCF10309
*Mar 1 08:51:53.615: 00 75 01 01 00 03 02 2B 29
*Mar 1 08:51:53.615:
*Mar 1 08:51:53.631: Serial1/1(in): Status, myseq 43, pak size 45
*Mar 1 08:51:53.631: RT IE 1, length 1, type 0
*Mar 1 08:51:53.631: KA IE 3, length 2, yourseq 42, myseq 43
*Mar 1 08:51:53.631: PVC IE 0×7 , length 0×6 , dlci 311, status 0×0 , bw 0
*Mar 1 08:51:53.631: PVC IE 0×7 , length 0×6 , dlci 312, status 0×0 , bw 0
*Mar 1 08:51:53.631: PVC IE 0×7 , length 0×6 , dlci 314, status 0×2 , bw 0
R3#
*Mar 1 08:51:53.631: PVC IE 0×7 , length 0×6 , dlci 315, status 0×2 , bw 0
As you can see the lines with “status 0×0″ or “status 0×2″ this could tell you:
Notice the status of “DLCI 314″ in the output above. The possible values of the status field are explained below:

0×0-Added/inactive means that the switch has this DLCI programmed but for some reason (such as the other end of this PVC is down), it is not usable.
0×2-Added/active means the Frame Relay switch has the DLCI and everything is operational. You can start sending it traffic with this DLCI in the header.
0×3-0×3 is a combination of an active status (0×2) and the RNR (or r-bit) that is set (0×1). This means that the switch – or a particular queue on the switch – for this PVC is backed up, and you stop transmitting in case frames are spilled.
0×4-Deleted means that the Frame Relay switch doesn’t have this DLCI programmed for the router. But it was programmed at some point in the past. This could also be caused by the DLCIs being reversed on the router, or by the PVC being deleted by the telco in the Frame Relay cloud. Configuring a DLCI (that the switch doesn’t have) will show up as a 0×4.
0×8-New/inactive
0x0a-New/active

List your static and dynamic mappings and show also witch link is active or has a differnt status:
show frame-relay map
Serial0/0 (up): ip 183.1.0.3 dlci 405(0×195,0×6450), static,
CISCO, status deleted
Serial0/0 (up): ip 183.1.0.5 dlci 405(0×195,0×6450), static,
broadcast,
CISCO, status deleted

or for example:
Serial0/0 (up): ip 183.1.0.4 dlci 504(0x1F8,0x7C80), static,
broadcast,
CISCO, status defined, active
Serial0/0 (up): ip 54.1.1.6 dlci 504(0x1F8,0x7C80), dynamic,
broadcast,, status defined, active
Source:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s12/12sfrsdg.htm
http://www.cisco.com/en/US/tech/tk713/tk237/technologies_tech_note09186a008014f8a7.shtml

Frame-Relay and traffic shaping (FRTS)

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:22:00 +0000

Frame-Relay congestion control can be done on a DLCI basis. Real flow control is done by upper layer protocols. Remember frame-relay is just a layer 2 protocol. So frame-relay just throws packets away and only notifies about congestion. This could be done, for example, by TCP.
So with frame-relay the mechanisms are called congestion-notification. So if a sender is sending to quick, frame-relay is sending a congestion-notification to the sender to slow down. Frame-relay in the meantime, just throws away packets. If a packet is lost, the receiving device has to request e retransmition.
The following terms are important.

FECN – Forward-explicit congestion notification
BECN – Backward-explicit congestion notification
DE – Discard Eligibility
CIR – Committed Information Rate

Both informations FECN and BECN, are carried as single bit in the frame-relay header.

The header also includes a DE bit, which is responsible for dropping and marking no to important traffic in times of congestion. A frame with the DE bit set, has low priority and can be dropped in case of congestion.

CIR is an agreement about the normal transmission rate over a link in a certain time.

BECN – indicates to the receiving device that frames sent in the opposite direction may experience congestion.

FECN – indicates to the receiving device that the frame has experienced congestion.

DE – discard eligible, which mean, when the DE bit is set in a frame, the packet could be selected for discarding, it’s even possible to set this DE bit, for certain protocols

Terms to know about frame-relay traffic shaping and you can configure them on an interface dlci with a map-class command:

EIR is the rate that you can exceed CIR before the ingress port will discard your frames.
```
 
```

CIR – Committed information rate

is the average rate that you can transmit at measured over a time period Tc without having the ingress port on the Frame network flag your frames as over contract by setting the DE bit. If you have multiple connections, the aggregated total of the CIR for all PVC’s should not exceed the physical port speed.

BC – committed burst

is the maximum amount of data that a network will transfer in one interval of time (Tc) or in other words is the total number of bits that you can send in period Tc and not have the frames marked with DE.

BE – Burst in excess

is the maximum amount of data that the network will transfer above Bc in one interval of time. When transmitting data at excess burst (Be) these frames would either be dropped by the network at ingress or marked discard eligible (DE) and potentially dropped somewhere else in the network if congestion is experienced
or you can say is the total number of bits in addition to Bc that you can send in period Tc that the switch will allow before discarding any excess traffic at the ingress port to the Frame network.

MINCIR – minimum committed information rate

The actual guaranteed rate obtained from service provider in bps. This value should be the minimum rate you should drop to in the event of congestion (dropping below this rate implies you are not getting the bandwidth you are paying for). In certain cases the mincir and cir values must be the same. The value of mincir is half of the CIR value in bps by default.

TC the default is 1/8 = 0.125 seconds, BC=CIR*TC

For example, if you have a CIR of 64000 Bits per second and want for voice a TC of 10 ms (0,01) or 1/100, than BC would be 640 bits. 10 ms is the smallest value for TC.

Parameters you configure:

Example 1.

1. setup the interface for shaping

interface Serial0/0
ip address 152.2.0.1 255.255.255.0
encapsulation frame-relay
frame-relay traffic-shaping
frame-relay interface-dlci 103
class to-router3

2. define a map class containing shaping parameters

map-class frame-relay to-router3
frame-relay cir 32000

32000 Bits per second is the average amount of data on the agreed rate with the service provider. The default an an interface is 57000 bps. Make sure, that the sum of all cir’s configured for one interface does not exceed the bandwidth of the interface. If your remote router does only 16000 Bits per seconds, this CIR rate would be “frame-relay cir 16000″.

Example 2.

1. Setup the interface for frame-relay traffic-shaping

interface Serial0/0
ip address 152.2.0.1 255.255.255.0
encapsulation frame-relay
frame-relay traffic-shaping
frame-relay interface-dlci 103
class to-router3

2. define a map class containig shaping parameters

map-class frame-relay to-router3
frame-relay cir 32000
frame-relay bc 320

So here i use a TC of 10 ms or 0,01 seconds for the configured BC. The advantage is that the router is more able to prioritize certain traffic, would be needed for voice. Because the shorter choosen intervals per second.

CIR = BC/TC

32000=BC/0,01

=> 320=BC

Example 3.

Your Frame-Relay provider gives you a line with a 512k circuit and a CIR of 384k to your network. You would configure it like this.

interface Serial0/0
ip address 152.2.0.1 255.255.255.0
encapsulation frame-relay
frame-relay traffic-shaping
frame-relay interface-dlci 103
class to-router3

map-class frame-relay to-router3
frame-relay cir 512000
frame-relay mincir 384000
frame-relay bc 64000
frame-relay be 128000

Whitch calculates as follows:

CIR = port speed
mincir = commited rate from prvider
be= port – commited rate
bc = port speed / 8

These parameters are inter-related.
CIR = Bc/Tc
BC = CIR * Tc
TC = BC / CIR

BE = Portspeed – CIR
EIR = Be/Tc
Source:
http://www.groupstudy.com/archives/ccielab/200209/msg01962.html
http://www.cisco.com/warp/public/125/traffic_shaping_6151.html
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/frame.htm#wp1020620
http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cg/hwan_c/ch05/h_afrts.htm#wp1015437

A simple explanation FECN / BECN

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:21:00 +0000

These are technices used for congestion control within frame-relay.

A Bit marking 0 or 1 in the BECN oder FECN field, telling there is congestion.

Frame-relay is a layer 2 protocol and does no error checking. Another layer 3 protocol has to do this. But Frame-relay can send congestion notifications on the links, informing there is congestion and to slow down the sending device. It depends on the implementation of the remote device, if these notifications are noted.
Here is what can happen and when one of these are used. If congestion occurs, there are two possible ways of notifying this.

With FECN it’s possbile to send a notifcation to the receiving router, that congestion occured. If in case the receiving router does not have the bandwidth and would be overwhelmed.
With BECN it’s possible to send a notification to the sending local router, that congestion occured.

Source:

http://www.groupstudy.com/archives/ccielab/200209/msg01962.html

http://www.cisco.com/en/US/docs/internetworking/technology/handbook/Frame-Relay.html

different kinds of frame-relay connections, dynamic, static, broadcast

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:13:00 +0000

There can be differnet kinds of frame-relay connections. You can lookup the status with “show frame-relay map” to see what kind of conenction you have.

dynamic mapping – if frame-relay uses inverse arp to dynamically map the dlci with the ip address, it’s a dynamic mapping
static mapping – if you use a map statement to statically map the given dlci to an ip address, this is called a static connection.
broadcast – pon point-to-point links there a “frame-relay interface-dlci” statement can “setup” mapping. So this would show up as neither dynamic or static, than broadcast.

Set Cisco Stack Master Placement in Switch Stack

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:12:00 +0000

- Multiple Catalyst 2960-S or 3750-X switches configured in stack

- One switch in stack (Master Switch) controls operation of stack

- When 3 or more switches in stack configure switch that does not have uplinks as master switch

Set Stack Master Switch:

switch [switch number] priority 15

Ensure original master MAC address remains stack MAC address after failure:

stack-mac persistent timer 0

Enable Stateful Switchover (SSO) on Cisco Switch Supervisor Modules

noreply@blogger.com (MK) — Sat, 02 Jul 2011 13:09:00 +0000

Stateful Switchover (SSO) synchronizes process and configuration information between supervisor modules to enable a fast transparent failover.

Router(config)# redundancy

Router(config-red)# mode sso

Router(config-red)# end

Router# show redundancy states

my state = 13 -ACTIVE

peer state = 8 -STANDBY HOT

Mode = Duplex

Unit = Primary

Unit ID = 5

Redundancy Mode (Operational) = sso

Redundancy Mode (Configured) = sso

Split Mode = Disabled

Manual Swact = Enabled

Communications = Up

client count = 29

client_notification_TMR = 30000 milliseconds

keep_alive TMR = 9000 milliseconds

keep_alive count = 1

keep_alive threshold = 18

RF debug mask = 0x0

Router#