Internetworks

IPv6 eBGP and iBGP

2026-05-14T09:03:04.855+05:30

IPv6 iBGP: The Internal Fabric

In an iBGP setup, the goal is to ensure all routers within your organization know how to reach external destinations.

The Full Mesh Requirement: Since iBGP routers do not re-advertise prefixes learned from one iBGP peer to another (to pr+event loops), you typically need a "Full Mesh" or Route Reflectors.
Next-Hop-Self: Because iBGP doesn't change the next-hop attribute, internal routers often don't know how to reach the original eBGP exit point. Using the next-hop-self command is a standard practice to ensure internal reachability.

IPv6 eBGP: Crossing the Border

eBGP is the handshake between different entities (like your network and an ISP).

Prefix Filtering: Unlike iBGP, you never trust an eBGP peer blindly. Strict prefix-lists and route-maps are essential to ensure you aren't leaking private routes or accepting "bogon" space.
The Link-Local Trap: In IPv6, eBGP can technically peer using Link-Local addresses (fe80::/10), but for stability and clarity, most engineers stick to Global Unicast Addresses (GUA) for peering.

In this blog, we configure the basics of IPv6 eBGP and iBGP.

Topology:

Configure the topology as per the diagram.
Configure the IPv6 addresses as per the topology.
Configure IBGP on router 1 and router 2.
Advertise directly connected.
Configure EBGP on router 3
Configure next-hop-self on router 2 for router 1
Verify the configuration with ping, traceroute and show commands.

R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 address 2001:12::1/64
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface loopback 1
R1(config-if)#ipv6 address fc00:11::1/64
R1(config-if)#no shutdown
R1(config-if)#exit

R2(config)#interface fastethernet 0/0

R2(config-if)#ipv6 address 2001:12::2/64

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface loopback 1

R2(config-if)#ipv6 address fc00:22::1/64

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface serial 2/0

R2(config-if)#ipv6 address 2001:23::1/64

R2(config-if)#no shutdown

R2(config-if)#exit

R3(config)#interface loopback 1

R3(config-if)#ipv6 address fc00:33::1/64

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#interface serial 2/0

R3(config-if)#ipv6 address 2001:23::2/64

R3(config-if)#no shutdown

R3(config-if)#exit

R1(config)#ipv6 unicast-routing

R1(config)#router bgp 6500

R1(config-router)#bgp router-id 1.1.1.1

R1(config-router)#no bgp default ipv4-unicast

R1(config-router)#neighbor 2001:12::2 remote-as 6500

R1(config-router)#address-family ipv6 unicast

R1(config-router-af)#neighbor 2001:12::2 activate

R1(config-router-af)#network fc00:11::/64

R1(config-router-af)#network 2001:12::/64

R1(config-router-af)#exit

R2(config)#ipv6 unicast-routing

R2(config)#router bgp 6500

R2(config-router)#bgp router-id 2.2.2.2

R2(config-router)#no bgp default ipv4-unicast

R2(config-router)#neighbor 2001:12::1 remote-as 6500

R2(config-router)#neighbor 2001:23::2 remote-as 6700

R2(config-router)#address-family ipv6 unicast

R2(config-router-af)#neighbor 2001:12::1 activate

R2(config-router-af)#neighbor 2001:23::2 activate

R2(config-router-af)#network fc00:22::/64

R2(config-router-af)#network 2001:12::/64

R2(config-router-af)#network 2001:23::/64

R2(config-router-af)#exit

%BGP-5-ADJCHANGE: neighbor 2001:12::1 Up

R2(config)#router bgp 6500

R2(config-router)#address-family ipv6 unicast

R2(config-router-af)#neighbor 2001:12::1 next-hop-self

R2(config-router-af)#exit

R3(config)#ipv6 unicast-routing

R3(config)#router bgp 6700

R3(config-router)#bgp router-id 3.3.3.3

R3(config-router)#no bgp default ipv4-unicast

R3(config-router)#neighbor 2001:23::1 remote-as 6500

R3(config-router)#address-family ipv6 unicast

R3(config-router-af)#neighbor 2001:23::1 activate

R3(config-router-af)#network fc00:33::/64

R3(config-router-af)#network 2001:23::/64

R3(config-router-af)#exit

%BGP-5-ADJCHANGE: neighbor 2001:23::1 Up

R1#show ip bgp ipv6 unicast summary

BGP router identifier 1.1.1.1, local AS number 6500

BGP table version is 7, main routing table version 7

5 network entries using 860 bytes of memory

6 path entries using 528 bytes of memory

3/3 BGP path/bestpath attribute entries using 408 bytes of memory

1 BGP AS-PATH entries using 24 bytes of memory

0 BGP route-map cache entries using 0 bytes of memory

0 BGP filter-list cache entries using 0 bytes of memory

BGP using 1820 total bytes of memory

BGP activity 7/2 prefixes, 8/2 paths, scan interval 60 secs

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

2001:12::2 4 6500 24 21 7 0 0 00:16:06 4

R1#show ipv6 route bgp

IPv6 Routing Table - default - 8 entries

Codes: C - Connected, L - Local, S - Static, U - Per-user Static route

B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP

H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea

IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO

ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP

B 2001:23::/64 [200/0]

via 2001:12::2

B FC00:22::/64 [200/0]

via 2001:12::2

B FC00:33::/64 [200/0]

via 2001:12::2

R2#ping fc00:11::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to FC00:11::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/30/40 ms

R2#ping fc00:33::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to FC00:33::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/36 ms

R1#traceroute fc00:33::1

Type escape sequence to abort.

Tracing the route to FC00:33::1

1 2001:12::2 20 msec 28 msec 20 msec

2 2001:23::2 44 msec 64 msec 40 msec

(If you like this blog, please visit our YouTube channel.https://www.youtube.com/@internetworkss

All the methods of Default route Injection in EIGRP

2026-04-20T12:37:00.000+05:30

Default route injection is a critical technique for directing traffic to a gateway of last resort, commonly used in hub-and-spoke topologies, internet breakouts, and redundant network designs. The specific method you use will depend on the routing protocol.

The default route is used to forward any packet with a destination not found in the routing table, which is why it is also called a gateway of last resort. Also can be used at the end location where there is only one exit path for any destination (internet).

Default routes help in reducing the size of your routing table. It’s the last preferred route in the routing table

There are many ways to inject a default route in EIGRP. In this lab, we test four ways of injecting a default route.

The first method to inject a default route into EIGRP is to configure a static default route pointing to Null0, and then redistribute the default route into EIGRP when redistributing a static, connected, or EIGRP route for another autonomous system; the metric does not need to be assigned. The default route will be an external EIGRP route.

The second method for injecting a default route into EIGRP is to configure a network command with 0.0.0.0. You must have the static default route configured; otherwise, with the network 0.0.0.0, all the existing and future directly connected interfaces will be advertised in the AS. The default route will be an internal EIGRP route.

The third method for injecting a default route into EIGRP is to configure the IP summary-address EIGRP interface configuration command. With this command, you are summarizing all the class A, B, and C networks. This means that you are suppressing every route in your routing table, but if you must advertise a specific network, you must leak it. The default route will be an internal EIGRP route.

The fourth method of injecting a default route is to use IP default-network command.

The goal is to perform all the route injection methods in our topology.

Configure the topology as per the diagram
Configure IP addresses as per the topology
Configure IGP EIGRP AS 65100.
Advertise directly connected routes
Configure the first method of route injection (redistribute default route static Null0)
Configure the Second method of route injection (static and network 0.0.0.0)
Configure the third method of route injection (only summary address)
Configure the fourth method of route injection ( IP default-network)

R1(config)#interface serial 2/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface loopback 1
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

R2(config)#interface serial 2/0
R2(config-if)#ip address 192.168.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface loopback 1
R2(config-if)#ip address 20.1.1.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 192.168.20.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit

R1(config)#router eigrp 65100
R1(config-router)#network 192.168.1.0
R1(config-router)#network 10.0.0.0
R1(config-router)#network 192.168.20.0
R1(config-router)#no auto-summary
R1(config-router)#exit

%DUAL-5-NBRCHANGE: EIGRP-IPv4 65100: Neighbor 192.168.1.2 (Serial2/0) is up: new adjacency

R2(config)#router eigrp 65100
R2(config-router)#network 192.168.1.0
R2(config-router)#network 20.0.0.0
R2(config-router)#network 192.168.20.0
R2(config-router)#no auto-summary
R2(config-router)#exit

%DUAL-5-NBRCHANGE: EIGRP-IPv4 65100: Neighbor 192.168.1.1 (Serial2/0) is up: new adjacency

Configure the first method of route injection (redistribute default route static Null0)

R2(config)#ip route 0.0.0.0 0.0.0.0 null0
R2(config)#router eigrp 65100
R2(config-router)#redistribute static
R2(config-router)#exit

R2(config)#end

R2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S*    0.0.0.0/0 is directly connected, Null0
D     10.0.0.0/8 [90/2297856] via 192.168.1.1, 00:07:46, Serial2/0
      20.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        20.0.0.0/8 is directly connected, Loopback1
L        20.1.1.1/32 is directly connected, Loopback1
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, Serial2/0
L        192.168.1.2/32 is directly connected, Serial2/0
      192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.20.0/24 is directly connected, FastEthernet0/0
L        192.168.20.1/32 is directly connected, FastEthernet0/0

R2#show ip eigrp topology 0.0.0.0/0
EIGRP-IPv4 Topology Entry for AS(65100)/ID(20.1.1.1) for 0.0.0.0/0
State is Passive, Query origin flag is 1, 1 Successor(s), FD is 256
Descriptor Blocks:
0.0.0.0, from Rstatic, Send flag is 0x0
      Composite metric is (256/0), route is External
      Vector metric:
        Minimum bandwidth is 10000000 Kbit
        Total delay is 1 microseconds
        Reliability is 0/255
        Load is 0/255
        Minimum MTU is 1500
        Hop count is 0
        Originating router is 20.1.1.1
      External data:
        AS number of route is 0
        External protocol is Static, external metric is 0
        Administrator tag is 0 (0x00000000)
        Exterior flag is set

Configure the Second method of route injection (static and network 0.0.0.0)

R2(config)#router eigrp 65100
R2(config-router)#no redistribute static

R2(config)#ip route 0.0.0.0 0.0.0.0 null0

R2(config)#router eigrp 65100
R2(config-router)#network 0.0.0.0
R2(config-router)#exit

R2#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S*    0.0.0.0/0 is directly connected, Null0
D     10.0.0.0/8 [90/2297856] via 192.168.1.1, 00:13:35, Serial2/0
      20.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        20.0.0.0/8 is directly connected, Loopback1
L        20.1.1.1/32 is directly connected, Loopback1
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, Serial2/0
L        192.168.1.2/32 is directly connected, Serial2/0
      192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.20.0/24 is directly connected, FastEthernet0/0
L        192.168.20.1/32 is directly connected, FastEthernet0/0

.

R2#show ip eigrp topology 0.0.0.0/0
EIGRP-IPv4 Topology Entry for AS(65100)/ID(20.1.1.1) for 0.0.0.0/0
State is Passive, Query origin flag is 1, 1 Successor(s), FD is 256
Descriptor Blocks:
0.0.0.0, from Rstatic, Send flag is 0x0
      Composite metric is (256/0), route is Internal
      Vector metric:
        Minimum bandwidth is 10000000 Kbit
        Total delay is 1 microseconds
        Reliability is 0/255
        Load is 0/255
        Minimum MTU is 1500
        Hop count is 0
        Originating router is 20.1.1.1
      Exterior flag is set

Configure the third method of route injection (only summary address)

R2(config)#router eigrp 65100
R2(config-router)#no redistribute static
R2(config-router)#no network 0.0.0.0
R2(config-router)#exit

R2(config)#interface serial 2/0
R2(config-if)#ip summary-address eigrp 65100 0.0.0.0 0.0.0.0
R2(config-if)#end

%DUAL-5-NBRCHANGE: EIGRP-IPv4 65100: Neighbor 192.168.1.1 (Serial2/0) is resync: summary configured

R2#show ip route eigrp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

D*    0.0.0.0/0 is a summary, 00:00:21, Null0
D     10.0.0.0/8 [90/2297856] via 192.168.1.1, 00:17:20, Serial2/0

R2#show ip eigrp topology 0.0.0.0/0
EIGRP-IPv4 Topology Entry for AS(65100)/ID(20.1.1.1) for 0.0.0.0/0
State is Passive, Query origin flag is 1, 1 Successor(s), FD is 28160
Descriptor Blocks:
0.0.0.0 (Null0), from 0.0.0.0, Send flag is 0x0
      Composite metric is (28160/0), route is Internal
      Vector metric:
        Minimum bandwidth is 100000 Kbit
        Total delay is 100 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 0
        Originating router is 20.1.1.1

DMVPN Phase 2 Dynamic Mapping

2026-03-20T13:12:00.006+05:30

DMVPN (Dynamic Multipoint VPN), introduced by Cisco in late 2000, is a routing technology you can use to build a VPN network with multiple sites (spokes) without having to statically configure all devices. It’s a “hub and spoke” network, where the spokes can communicate with each other directly without having to go through the hub. Encryption is supported through IPsec, which makes DMVPN a popular choice for connecting different sites using regular Internet connections. It’s a great backup or alternative to private networks like MPLS VPN.

In DMVPN Phase 2, hub and spokes are configured as multipoint GRE and spoke-to-spoke tunnels are created. NHRP is required for spokes to register to the hub, and NHRP is also required for spoke-to-spoke resolution.
Phase 2: Spoke-to-Spoke tunnels allowed. Branches can talk directly, offloading the Hub. However, routing can become asymmetrical (traffic takes one path there and a different path back), which can cause issues with firewalls.

NHRP (Next Hop Resolution Protocol)

Think of NHRP as the "DNS for DMVPN."
When a Spoke boots up, it registers its real public IP address with the Hub using NHRP.
When Spoke A wants to talk to Spoke B, it asks the Hub, "Who is Spoke B?"
The Hub responds with Spoke B’s real public IP.
Spoke A then builds a direct IPsec tunnel to Spoke B

The Next Hop Server is a router (typically the Hub) that maintains the authoritative NHRP database for the entire DMVPN cloud. Every spoke registers its real (public) IP address and its tunnel (private) IP address with the NHS.

Topology:-

R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.8
R1(config)#end

R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#ip route 0.0.0.0 0.0.0.0 192.168.2.8
R2(config)#exit

R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#ip route 0.0.0.0 0.0.0.0 192.168.3.8
R3(config)#end

R4(config)#interface fastethernet 0/0
R4(config-if)#ip address 192.168.4.1 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#ip route 0.0.0.0 0.0.0.0 192.168.4.8

switch-1(config)#interface range ethernet0/0-3
switch-1(config-if-range)#no switchport
switch-1(config-if-range)#shutdown
switch-1(config-if-range)#exit

switch-1(config)#interface Ethernet0/0
switch-1(config-if)#no shutdown
switch-1(config-if)# ip address 192.168.1.8 255.255.255.0
switch-1(config-if)#exit
switch-1(config)#interface Ethernet0/1
switch-1(config-if)#no shutdown
switch-1(config-if)# ip address 192.168.2.8 255.255.255.0
switch-1(config-if)#exit
switch-1(config)#interface Ethernet0/2
switch-1(config-if)# no switchport
switch-1(config-if)# ip address 192.168.3.8 255.255.255.0
switch-1(config-if)#exit
switch-1(config)#interface Ethernet0/3
switch-1(config-if)# no switchport
switch-1(config-if)# ip address 192.168.4.8 255.255.255.0
switch-1(config-if)#exit

switch-1(config)#interface range ethernet0/0-3
switch-1(config-if-range)#no switchport
switch-1(config-if-range)#no shutdown
switch-1(config-if-range)#exit

switch-1(config)#ip routing

R1(config)#interface tunnel 1
R1(config-if)#ip address 10.1.1.1 255.255.255.0
R1(config-if)#tunnel source 192.168.1.1
R1(config-if)#tunnel mode gre multipoint
R1(config-if)#ip nhrp network-id 111
R1(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R1#show dmvpn

Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete

N - NATed, L - Local, X - No Socket

# Ent --> Number of NHRP entries with same NBMA peer

NHS Status: E --> Expecting Replies, R --> Responding

UpDn Time --> Up or Down Time for a Tunnel

==========================================================================

Interface: Tunnel1, IPv4 NHRP Details

Type:Hub, NHRP Peers:3,

# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

1 192.168.2.1 10.1.1.2 UP 00:00:27 D

1 192.168.3.1 10.1.1.3 UP 00:00:27 D

1 192.168.4.1 10.1.1.4 UP 00:00:28 D

R2(config)#interface tunnel 1
R2(config-if)#ip address 10.1.1.2 255.255.255.0
R2(config-if)#tunnel source 192.168.2.1
R2(config-if)#tunnel mode gre multipoint
R2(config-if)#ip nhrp network-id 222
R2(config-if)#ip nhrp nhs 10.1.1.1
R2(config-if)#ip nhrp map 10.1.1.1 192.168.1.1
R2(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R2#show dmvpn detail

Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete

N - NATed, L - Local, X - No Socket

# Ent --> Number of NHRP entries with same NBMA peer

NHS Status: E --> Expecting Replies, R --> Responding

UpDn Time --> Up or Down Time for a Tunnel

==========================================================================

Intferface Tunnel1 is up/up, Addr. is 10.1.1.2, VRF ""

Tunnel Src./Dest. addr: 192.168.2.1/MGRE, Tunnel VRF ""

Protocol/Transport: "multi-GRE/IP", Protect ""

IPv4 NHS: 10.1.1.1 RE

Type:Spoke, Total NBMA Peers (v4/v6): 1

# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb Target Network

----- --------------- --------------- ----- -------- ----- -----------------

1 192.168.1.1 10.1.1.1 UP 00:01:06 S 10.1.1.1/32

R3(config)#interface tunnel 1
R3(config-if)#ip address 10.1.1.3 255.255.255.0
R3(config-if)#tunnel source 192.168.3.1
R3(config-if)#tunnel mode gre multipoint
R3(config-if)#ip nhrp network-id 333
R3(config-if)#ip nhrp nhs 10.1.1.1
R3(config-if)#ip nhrp map 10.1.1.1 192.168.1.1
R3(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R4(config)#interface tunnel 1
R4(config-if)#ip address 10.1.1.4 255.255.255.0
R4(config-if)#tunnel source 192.168.4.1
R4(config-if)#tunnel mode gre multipoint
R4(config-if)#ip nhrp network-id 444
R4(config-if)#ip nhrp nhs 10.1.1.1
R4(config-if)#ip nhrp map 10.1.1.1 192.168.1.1
R4(config-if)#exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, hanged state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R1#show ip nhrp
10.1.1.2/32 via 10.1.1.2
Tunnel1 created 00:03:23, expire 01:56:36
Type: dynamic, Flags: unique registered
NBMA address: 192.168.2.1
10.1.1.3/32 via 10.1.1.3
Tunnel1 created 00:03:23, expire 01:56:36
Type: dynamic, Flags: unique registered
NBMA address: 192.168.3.1
10.1.1.4/32 via 10.1.1.4
Tunnel1 created 00:03:24, expire 01:56:35
Type: dynamic, Flags: unique registered
NBMA address: 192.168.4.1

R1#ping 10.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/32/44 ms

R1#ping 10.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/36/48 ms

R1#ping 10.1.1.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/36/48 ms

R1#traceroute 10.1.1.2
Type escape sequence to abort.
Tracing the route to 10.1.1.2
1 10.1.1.2 20 msec 32 msec 28 msec

R1#traceroute 10.1.1.2
Type escape sequence to abort.
Tracing the route to 10.1.1.2
1 10.1.1.2 40 msec 28 msec 28 msec

R1#traceroute 10.1.1.3
Type escape sequence to abort.
Tracing the route to 10.1.1.3
1 10.1.1.3 44 msec 32 msec 28 msec

R1#traceroute 10.1.1.4
Type escape sequence to abort.
Tracing the route to 10.1.1.4
1 10.1.1.4 56 msec 28 msec 28 msec

Route Map Redistribution and configuration

2026-01-24T15:40:00.004+05:30

Why use a route map for redistribution?

Without a route-map, you redistribute everything. That's often a bad idea. You might leak routes you shouldn't, cause routing loops, or create security risks. By default, all the routes are redistributed with the metric and metric-type defined when we configure redistribution. When we want to assign different metrics, metric-type or security, we use a route-map.

The simple idea of using a route map in redistribution

Filter: only redistribute specific prefixes
Modify: change metrics, tag, or route types during the exchange
Control: apply logic with permit or deny statements

Let's see the configuration:-

Topology:-

Goal:

Configure the topology as per the diagram
Configure the IP addresses as per the topology
Configure OSPF as per the topology in area 0
Configure RIPv2 on router 3 and advertise loopbacks interfaces
Configure ACL permit 192.168.31.0 192.168.32.0 192.168.33.0
Configure route map set metric 2000 for 192.168.31.0
Configure route map set metric 1000 and metric-type 1
Redistribute RIPv2 into OSPF with a route-map

R1(config)#interface serial 5/0
R1(config-if)#ip address 12.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#no keepalive
R1(config-if)#exit

R1(config)#interface loopback 1
R1(config-if)#ip address 192.168.11.1 255.255.255.0
R1(config-if)#exit
R1(config)#interface loopback 2
R1(config-if)#ip address 192.168.12.1 255.255.255.0
R1(config-if)#exit
R1(config)#interface loopback 3
R1(config-if)#ip address 192.168.13.1 255.255.255.0
R1(config-if)#exit
R1(config)#interface loopback 4
R1(config-if)#ip address 192.168.14.1 255.255.255.0
R1(config-if)#exit
R2(config)#interface serial 5/0
R2(config-if)#ip address 12.1.1.2 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface serial 5/1
R2(config-if)#ip address 23.1.1.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 20.1.1.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#no keepalive
R2(config-if)#exit

R2(config)#interface loopback 1
R2(config-if)#ip address 192.168.21.1 255.255.255.0
R2(config-if)#exit
R2(config)#interface loopback 2
R2(config-if)#ip address 192.168.22.1 255.255.255.0
R2(config-if)#exit
R2(config)#interface loopback 3
R2(config-if)#ip address 192.168.23.1 255.255.255.0
R2(config-if)#exit
R2(config)#interface loopback 4
R2(config-if)#ip address 192.168.24.1 255.255.255.0
R2(config-if)#exit

R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#no keepalive
R3(config-if)#exit

R3(config)#interface serial 5/1
R3(config-if)#ip address 23.1.1.2 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#exit

R3(config)#interface loopback 1
R3(config-if)#ip address 192.168.31.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 2
R3(config-if)#ip address 192.168.32.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 3
R3(config-if)#ip address 192.168.33.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 4
R3(config-if)#ip address 192.168.34.1 255.255.255.0
R3(config-if)#exit

R1(config)#router ospf 1
R1(config-router)#router-id 10.1.1.1
R1(config-router)#network 0.0.0.0 0.0.0.0 area 0
R1(config-router)#exit

*Jan 24 11:24:24.267: %OSPF-5-ADJCHG: Process 1, Nbr 20.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R2(config)#router ospf 1
R2(config-router)#router-id 20.1.1.1
R2(config-router)#network 12.0.0.0 0.255.255.255 area 0
R2(config-router)#network 23.0.0.0 0.255.255.255 area 0
R2(config-router)#network 20.0.0.0 0.255.255.255 area 0
R2(config-router)#network 192.168.21.0 255.0.0.0 area 0
R2(config-router)#network 192.168.22.0 255.0.0.0 area 0
R2(config-router)#network 192.168.23.0 255.0.0.0 area 0
R2(config-router)#network 192.168.24.0 255.0.0.0 area 0
R2(config-router)#exit

*Jan 24 11:24:24.167: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R3(config)#router ospf 1
R3(config-router)#router-id 30.1.1.1
R3(config-router)#network 23.0.0.0 0.255.255.255 area 0
R3(config-router)#network 30.0.0.0 0.255.255.255 area 0
R3(config-router)#exit

*Jan 24 11:35:25.335: %OSPF-5-ADJCHG: Process 1, Nbr 20.1.1.1 on Serial5/1 from LOADING to FULL, Loading Done

R3(config)#router rip
R3(config-router)#version 2
R3(config-router)#network 192.168.31.0
R3(config-router)#network 192.168.32.0
R3(config-router)#network 192.168.33.0
R3(config-router)#network 192.168.34.0
R3(config-router)#exit

R3(config)#access-list 10 permit 192.168.31.0 255.0.0.0
R3(config)#access-list 20 permit 192.168.32.0 255.0.0.0
R3(config)#access-list 30 permit 192.168.33.0 255.0.0.0

R3#show access-lists
Standard IP access list 10
    10 permit 0.168.31.0, wildcard bits 255.0.0.0 (1 match)
Standard IP access list 20
    10 permit 0.168.32.0, wildcard bits 255.0.0.0 (1 match)
Standard IP access list 30
    10 permit 0.168.33.0, wildcard bits 255.0.0.0

R3(config)#route-map OSPF permit 10
R3(config-route-map)#match ip address 10
R3(config-route-map)#set metric 2000
R3(config-route-map)#exit

R3(config)#route-map OSPF permit 20
R3(config-route-map)#match ip address 20
R3(config-route-map)#set metric 1000
R3(config-route-map)#set metric-type type-1
R3(config-route-map)#exit

R3(config)#route-map OSPF permit 30
R3(config-route-map)#exit

R3(config)#router ospf 1
R3(config-router)#redistribute rip subnets route-map OSPF
R3(config-router)#exit
R3(config)#end

R3#show route-map OSPF
route-map OSPF, permit, sequence 10
Match clauses:
    ip address (access-lists): 10
Set clauses:
    metric 2000
Policy routing matches: 0 packets, 0 bytes
route-map OSPF, permit, sequence 20
Match clauses:
    ip address (access-lists): 20
Set clauses:
    metric 1000
    metric-type type-1
Policy routing matches: 0 packets, 0 bytes
route-map OSPF, permit, sequence 30
Match clauses:
Set clauses:
Policy routing matches: 0 packets, 0 bytes

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C 192.168.12.0/24 is directly connected, Loopback2

C 192.168.13.0/24 is directly connected, Loopback3

C 192.168.14.0/24 is directly connected, Loopback4

O E2 192.168.31.0/24 [110/2000] via 12.1.1.2, 00:46:06, Serial5/0

192.168.24.0/32 is subnetted, 1 subnets

O 192.168.24.1 [110/65] via 12.1.1.2, 00:46:06, Serial5/0

O 20.0.0.0/8 [110/65] via 12.1.1.2, 00:46:06, Serial5/0

O 23.0.0.0/8 [110/128] via 12.1.1.2, 00:46:06, Serial5/0

C 192.168.11.0/24 is directly connected, Loopback1

192.168.21.0/32 is subnetted, 1 subnets

O 192.168.21.1 [110/65] via 12.1.1.2, 00:46:06, Serial5/0

C 10.0.0.0/8 is directly connected, FastEthernet0/0

192.168.23.0/32 is subnetted, 1 subnets

O 192.168.23.1 [110/65] via 12.1.1.2, 00:46:07, Serial5/0

192.168.22.0/32 is subnetted, 1 subnets

O 192.168.22.1 [110/65] via 12.1.1.2, 00:46:07, Serial5/0

O E2 192.168.34.0/24 [110/20] via 12.1.1.2, 00:46:07, Serial5/0

C 12.0.0.0/8 is directly connected, Serial5/0

O E1 192.168.32.0/24 [110/1128] via 12.1.1.2, 00:46:07, Serial5/0

O E2 192.168.33.0/24 [110/20] via 12.1.1.2, 00:46:07, Serial5/0

O 30.0.0.0/8 [110/129] via 12.1.1.2, 00:46:07, Serial5/0

IF YOU LIKE THIS BLOG, PLEASE VISIT MY YOUTUBE CHANNEL

https://www.youtube.com/@internetworkss

IPv6 Redistribution between EIGRPv3, OSPFv3 and RIPng

2026-01-15T17:45:00.004+05:30

IPv6 Route Redistribution

Route redistribution in IPv6 allows different routing protocols (e.g., OSPFv3, EIGRP for IPv6, BGP, RIPng, IS-IS) to exchange routing information within the same network. This is useful in multi-vendor or multiprotocol environments where migration or integration is required.

**Key Points:**

- Redistribution is typically configured on routers that run multiple routing protocols.

- Careful planning is needed to avoid routing loops, suboptimal paths, or convergence issues.

- Use route filtering, metrics, and administrative distance tuning to control redistribution.

- Default metrics often need manual assignment when redistributing between protocols (e.g., OSPF to EIGRP).

**Example Use Case:**

Connecting an OSPFv3 domain with a BGP IPv6 network, allowing internal routes to be advertised externally and vice versa.

**Configuration Note:**

Always verify routes after redistribution and ensure prefix lengths and next-hop addresses are correctly advertised.

Let's see the configuration:-

Task:

Configure the topology as per the diagram
Configure the IPv6 addresses as per the topology
Configure EIGRPv3 on router 1 and advertise directly
Configure OSPFv3 on router 2 and advertise FastEthernet 2/0 - 3/0
Configure EIGRPv3 on router 2 and advertise FastEthernet 0/0
Configure OSPFv3 on router 3 and advertise FastEthernet 3/0
Configure RIPng on router 3 and advertise FastEthernet 2/0
Configure redistribution between EIGRPv3 and OSPFv3 and vice versa
Configure redistribution between RIPng and OSPFv3 and vice versa
Make sure all the routes are exchanged
ensure the connectivity and verify with show commands

R1(config)#ipv6 unicast-routing
R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 address 2001:1122:1122:1122::1/64
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 address fc00:1111:1111:1111::1/64
R1(config-if)#no shutdown
R1(config-if)#no keepalive
R1(config-if)#exit
R1(config)#

R2(config)#ipv6 unicast-routing
R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 address 2001:1122:1122:1122::2/64
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 address fc00:2222:2222:2222::1/64
R2(config-if)#no shutdown
R2(config-if)#no keepalive
R2(config-if)#exit
R2(config)#interface fastethernet 3/0
R2(config-if)#ipv6 address 2001:2233:2233:2233::1/64
R2(config-if)#no shutdown
R2(config-if)#exit

R3#show ipv6 interface brief
FastEthernet0/0 [administratively down/down]
unassigned
ATM1/0 [administratively down/down]
unassigned
FastEthernet2/0 [up/up]
FE80::C803:A5FF:FE68:38
FC00:3333:3333:3333::1
FastEthernet3/0 [up/up]
FE80::C803:A5FF:FE68:54
2001:2233:2233:2233::2

R1(config)#ipv6 router eigrp 65100
R1(config-rtr)#no shutdown
R1(config-rtr)#router-id 11.11.11.11
R1(config-rtr)#exit

R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

R2(config)#ipv6 router eigrp 65100
R2(config-rtr)#no shutdown
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 eigrp 65100
R2(config-if)#exit

R2(config)#IPv6 router ospf 100
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit

R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 ospf 100 area 0
R2(config-if)#exit

R2(config)#interface fastethernet 3/0
R2(config-if)#ipv6 ospf 100 area 0
R2(config-if)#exit

R3(config)#IPv6 router ospf 100
R3(config-rtr)#router-id 33.33.33.33
R3(config-rtr)#exit

R3(config)#interface fastethernet 3/0
R3(config-if)#ipv6 ospf 100 area 0
R3(config-if)#exit

R3(config)#ipv6 unicast-routing
R3(config)#interface fastEthernet 2/0
R3(config-if)#ipv6 rip internetworks enable
R3(config-if)#exit

R2(config)#ipv6 router ospf 100

R2(config-rtr)#redistribute eigrp 65100 metric 100 metric-type 1 include-connected

R2(config-rtr)#exit

R2(config)#ipv6 router eigrp 65100

R2(config-rtr)#redistribute ospf 100 include-connected metric 1000 2000 255 1 1500

 metric <bw> <delay> <reliability> <load> <mtu>

R2(config-rtr)#exit

R3(config)#ipv6 router ospf 100

R3(config-rtr)#redistribute rip internetworks include-connected metric 100 metric-type 1

R3(config-rtr)#exit

R1#show ipv6 route

IPv6 Routing Table - Default - 8 entries

Codes: C - Connected, L - Local, S - Static, U - Per-user Static route

B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1

I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP

EX - EIGRP external

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

C 2001:1122:1122:1122::/64 [0/0]

via FastEthernet0/0, directly connected

L 2001:1122:1122:1122::1/128 [0/0]

via FastEthernet0/0, receive

EX 2001:2233:2233:2233::/64 [170/3074560]

via FE80::C802:59FF:FE98:0, FastEthernet0/0

C FC00:1111:1111:1111::/64 [0/0]

via FastEthernet2/0, directly connected

L FC00:1111:1111:1111::1/128 [0/0]

via FastEthernet2/0, receive

EX FC00:2222:2222:2222::/64 [170/3074560]

via FE80::C802:59FF:FE98:0, FastEthernet0/0

EX FC00:3333:3333:3333::/64 [170/3074560]

via FE80::C802:59FF:FE98:0, FastEthernet0/0

L FF00::/8 [0/0]

via Null0, receive

R2#show ipv6 protocol

IPv6 Routing Protocol is "connected"

IPv6 Routing Protocol is "eigrp 65100"

EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0

EIGRP maximum hopcount 100

EIGRP maximum metric variance 1

Interfaces:

FastEthernet0/0

Redistribution:

Redistributing protocol ospf 100 with metric 0 include-connected

Maximum path: 16

Distance: internal 90 external 170

IPv6 Routing Protocol is "ospf 100"

Interfaces (Area 0):

FastEthernet3/0

FastEthernet2/0

Redistribution:

Redistributing protocol eigrp 65100 with metric 100 type 1 include-connected

If you like this blog, please visit our YOUTUBE channel https://www.youtube.com/@internetworkss

IPv6 EIGRP: The Next-Generation Routing Protocol

2026-01-12T20:52:00.004+05:30

IPv6 EIGRP: The Next-Generation Routing Protocol

As networks transition to IPv6, routing protocols must evolve too. Enter EIGRP for IPv6 – Cisco’s enhanced interior gateway protocol, now ready for the modern internet.

What is IPv6 EIGRP?

IPv6 EIGRP is the IPv6-enabled version of Cisco’s advanced distance-vector protocol. It retains EIGRP’s popular features – rapid convergence, low bandwidth usage, and support for VLSM – while fully embracing IPv6 addressing and communication.

Key Advantages

Dual-Stack Ready: Runs alongside IPv4 EIGRP, allowing gradual migration

Separate Process: IPv6 EIGRP operates as an independent protocol instance

Link-local addressing: uses IPv6 link-local addresses for neighbor discovery

Same Dual Algorithm: Maintains the reliable loop-free path selection

Configuration Highlights

R1(config)#ipv6 unicast-routing
R1(config)#ipv6 router eigrp 65100
R1(config-rtr)#no shutdown
R1(config-rtr)#router-id 11.11.11.11
R1(config-rtr)#exit
R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

Let's see the configuration :

Topology:

TASK

Configure the topology as per the diagram
Configure IPv6 addresses as per the topology
Configure IPv6 EIGRP AS 65100
Make sure both routers communicate
Verify with show commands

R1(config)#ipv6 unicast-routing

R1(config)#

R1(config)#interface fastethernet 0/0

R1(config-if)#ipv6 address 2001:1122:1122:1122::1/64

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#

R1(config)#interface fastethernet 2/0

R1(config-if)#ipv6 address fc00:1111:1111:1111::1/64

R1(config-if)#no shutdown

R1(config-if)#no keepalive

R1(config-if)#exit

R2(config)#ipv6 unicast-routing

R2(config)#

R2(config)#interface fastethernet 0/0

R2(config-if)#ipv6 address 2001:1122:1122:1122::2/64

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#

R2(config)#interface fastethernet 2/0

R2(config-if)#ipv6 address fc00:2222:2222:2222::1/64

R2(config-if)#no shutdown

R2(config-if)#no keepalive

R2(config-if)#exit

R1(config)#ipv6 router eigrp 65100

R1(config-rtr)#no shutdown

R1(config-rtr)#router-id 11.11.11.11

R1(config-rtr)#exit

R1(config)#

R1(config)#interface fastethernet 0/0

R1(config-if)#ipv6 eigrp 65100

R1(config-if)#exit

R1(config)#

R1(config)#interface fastethernet 2/0

R1(config-if)#ipv6 eigrp 65100

R1(config-if)#exit

R2(config)#ipv6 router eigrp 65100

R2(config-rtr)#no shutdown

R2(config-rtr)#router-id 22.22.22.22

R2(config-rtr)#exit

R2(config)#

R2(config)#interface fastethernet 0/0

R2(config-if)#ipv6 eigrp 65100

R2(config-if)#exit

R2(config)#

R2(config)#interface fastethernet 2/0

R2(config-if)#ipv6 eigrp 65100

R2(config-if)#exit

R1#show ipv6 route

IPv6 Routing Table - Default - 6 entries

Codes: C - Connected, L - Local, S - Static, U - Per-user Static route

B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1

I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP

EX - EIGRP external

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

C 2001:1122:1122:1122::/64 [0/0]

via FastEthernet0/0, directly connected

L 2001:1122:1122:1122::1/128 [0/0]

via FastEthernet0/0, receive

C FC00:1111:1111:1111::/64 [0/0]

via FastEthernet2/0, directly connected

L FC00:1111:1111:1111::1/128 [0/0]

via FastEthernet2/0, receive

D FC00:2222:2222:2222::/64 [90/30720]

via FE80::C802:59FF:FE98:0, FastEthernet0/0

L FF00::/8 [0/0]

via Null0, receive

R1#show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 65100

H Address Interface Hold Uptime SRTT RTO Q Seq

(sec) (ms) Cnt Num

0 Link-local address: Fa0/0 12 00:01:21 906 5000 0 5

FE80::C802:59FF:FE98:0

R1#show ipv6 interface brief

FastEthernet0/0 [up/up]

FE80::C801:A5FF:FED4:0

2001:1122:1122:1122::1

ATM1/0 [administratively down/down]

unassigned

FastEthernet2/0 [up/up]

FE80::C801:A5FF:FED4:38

FC00:1111:1111:1111::1

R1#ping fc00:2222:2222:2222::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to FC00:2222:2222:2222::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/29/56 ms

Cisco IP Source Guard (IPSG) and configuration

2026-01-04T14:23:00.003+05:30

**Cisco IP Source Guard (IPSG)**

**Purpose:**

IP Source Guard is a security feature on Cisco switches designed to prevent IP address spoofing attacks. It restricts IP traffic on untrusted switch ports by filtering traffic based on the DHCP snooping binding database or manually configured IP-to-MAC bindings.

**How It Works:**

1. **DHCP Snooping Dependency:** IPSG relies on the DHCP snooping binding table to learn valid IP-MAC-interface bindings.

2. **Traffic Filtering:** When enabled on an access or untrusted port, the switch drops any IP traffic with a source IP address that does not match a valid binding in the DHCP snooping table (or a static entry).

3. **Dynamic Enforcement:** Initially, only DHCP packets are allowed. After a client receives a valid IP via DHCP, subsequent traffic from that client is permitted only if the source IP matches the assigned address.

**Benefits:**

- Prevents attackers from spoofing another host’s IP address.

- Limits malicious traffic from unauthorized IP addresses.

- Works in conjunction with DHCP snooping and Dynamic ARP Inspection (DAI) for layered security.

**Typical Use:**

Deployed on access switch ports in enterprise networks to ensure endpoint integrity and mitigate man-in-the-middle or spoofing-based attacks.

**Configuration Note:**

IPSG is configured at the interface level (`ip verify source`) and is most effective when DHCP snooping is already enabled.

Let's see the configuration:-

Topology:-

Goal:

Configure the topology as per the diagram
Configure the IP addresses on PCs 192.168.1.51/24 - 192.168.1.53/24
Configure VLAN 50 and assign ports Ethernet 0/0 - 0/3
Configure the IP address to VLAN 50
Configure portfast and portsecurity on the range Ethernet 0/0 - 0/3
Configure DHCP snooping on VLAN 50
Configure static mapping binding IP to MAC
Verify with the show commands

PC1> show ip

NAME : PC1[1]

IP/MASK : 192.168.1.51/24

GATEWAY : 192.168.1.50

DNS :

MAC : 00:50:79:66:68:00

LPORT : 10004

RHOST:PORT : 127.0.0.1:10005

MTU: : 1500

PC2> show ip

NAME : PC2[1]

IP/MASK : 192.168.1.52/24

GATEWAY : 192.168.1.50

DNS :

MAC : 00:50:79:66:68:01

LPORT : 10006

RHOST:PORT : 127.0.0.1:10007

MTU: : 1500

PC3> show ip

NAME : PC3[1]

IP/MASK : 192.168.1.53/24

GATEWAY : 192.168.1.50

DNS :

MAC : 00:50:79:66:68:02

LPORT : 10008

RHOST:PORT : 127.0.0.1:10009

MTU: : 1500

PC4> show ip

NAME : PC4[1]

IP/MASK : 192.168.1.54/24

GATEWAY : 192.168.1.50

DNS :

MAC : 00:50:79:66:68:03

LPORT : 10010

RHOST:PORT : 127.0.0.1:10011

MTU: : 1500

switch(config)#vlan 50

switch(config-vlan)#name internetworks

switch(config-vlan)#interface range ethernet 0/0 - 3

switch(config-if-range)#switchport

switch(config-if-range)#switchport mode access

switch(config-if-range)#switchport access vlan 50

switch(config-if-range)#exit

switch#show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Et1/0, Et1/1, Et1/2, Et1/3

Et2/0, Et2/1, Et2/2, Et2/3

Et3/0, Et3/1, Et3/2, Et3/3

10 VLAN0010 active

50 internetworks active Et0/0, Et0/1, Et0/2, Et0/3

switch(config)#interface vlan 50

switch(config-if)#ip address 192.168.1.50 255.255.255.0

switch(config-if)#no shutdown

switch(config-if)#exit

switch#show arp

Protocol Address Age (min) Hardware Addr Type Interface

Internet 192.168.1.50 - aabb.cc80.0100 ARPA Vlan50

Internet 192.168.1.51 0 0050.7966.6800 ARPA Vlan50

Internet 192.168.1.52 0 0050.7966.6801 ARPA Vlan50

Internet 192.168.1.53 0 0050.7966.6802 ARPA Vlan50

switch(config)#interface range ethernet 0/0 - 3

switch(config-if-range)#switchport port-security

switch(config-if-range)#ip verify source port-security

switch(config-if-range)#exit

switch(config)#ip dhcp snooping

switch(config)#ip dhcp snooping vlan 50

switch(config)#end

switch(config)# ip source binding 0050.7966.6800 vlan 50 192.168.1.51 interface ethernet 0/0

switch(config)# ip source binding 0050.7966.6801 vlan 50 192.168.1.52 interface ethernet 0/1

switch(config)# ip source binding 0050.7966.6802 vlan 50 192.168.1.53 interface ethernet 0/2

switch(config)#end

switch#show ip source binding

MacAddress IpAddress Lease(sec) Type VLAN Interface

------------------ --------------- ---------- ------------- ---- ---------- ----------

00:50:79:66:68:00 192.168.1.51 infinite static 50 Ethernet0 /0

00:50:79:66:68:01 192.168.1.52 infinite static 50 Ethernet0 /1

00:50:79:66:68:02 192.168.1.53 infinite static 50 Ethernet0 /2

Total number of bindings: 3

switch#show ip verify source

Interface Filter-type Filter-mode IP-address Mac-address Vlan

--------- ----------- ----------- --------------- ----------------- ----

Et0/0 ip-mac active 192.168.1.51 00:50:79:66:68:00 50

Et0/1 ip-mac active 192.168.1.52 00:50:79:66:68:01 50

Et0/2 ip-mac active 192.168.1.53 00:50:79:66:68:02 50

Et0/3 ip-mac active deny-all deny-all 50

If you like this blog, visit our YouTube channel https://www.youtube.com/@internetworkss

What is OSPFv3 IPsec authentication? How to configure OSPFv3 authentication?

2025-11-21T16:20:00.002+05:30

If you're coming from an OSPFv2 world, you're used to typing in a simple {IP OSPF AUTHENTICATION-KEY} command. When you jump to IPv6 OSPFv3, you might look for the equivalent command and be surprised to find it's not there.

How does OSPFv3 secure its neighbour relationships and routing updates? The answer is a fundamental shift in design: OSPFv3 relies on IPsec authentication. OSPFv3 doesn't include any authentication capabilities of its own. The OSPFv3 authentication field has been removed from OSPFv3 packet headers. OSPFv3 requires the IPv6 authentication header (AH) or IPv6 ESP header to ensure the integrity, authentication, and confidentiality of routing exchanges.

What are the benefits?

This approach has several benefits:

No more cleartext passwords
Stronger crypto (SHA-256, AES)
Leverages existing infrastructure
Standardization

How does it work?

OSPFv3 supports two methods to implement IPsec.

1. Manual- this is the most straightforward and commonly used method, you manually configure a security policy index (SPI) and a pre-shared key on both routers.

The building blocks:

SPI- a number that uniquely identifies the security policy to both routers. It must match on both sides.
Authentication algorithm- the hashing algorithm to use ( SHA1, SHA256).
Encryption key- the actual pre-shared password. It must match on both sides.

2. IPsec profile ( the scalable method)

For larger networks, manually configuring keys on every interface becomes a management headache. This is where the IPsec profile comes in.

An IPsec profile defines the security policy (algorithms, keys, etc) and is then applied to an OSPFv3 process. This applies the policy to all OSPFv3 interfaces, making it much more scalable.
This method is complex to set up, but it is the recommended way for large-scale deployments.

Let's see the configuration- So, we are going to configure OSPv3 authentication interface, and the area authentication.

Topology:-

Goal: ensure the integrity, authentication, and confidentiality of routing exchanges.

Configure the topology as per the diagram
Configure the IPv6 addresses as per the topology
Configure OSPFv3, and both routers are in area 0
Configure OSPFv3 authentication on the interfaces
erase the previous configuration
Reconfigure OSPFv3 authentication for the entire OSPFv3 area 0
Verify with show commands and messages.

R1(config)#interface fastethernet 0/0

R1(config-if)#ipv6 address 2001:1212:12:12::1/64

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#interface fastethernet 2/0

R1(config-if)#ipv6 address fc00:1111:1111:1111::1/64

R1(config-if)#no shutdown

R1(config-if)#exit

R2(config)#interface fastethernet 0/0

R2(config-if)#ipv6 address 2001:1212:12:12::2/64

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface fastethernet 2/0

R2(config-if)#ipv6 address fc00:2222:2222:2222::1/64

R2(config-if)#no shutdown

R2(config-if)#exit

R1(config)#ipv6 unicast-routing

R1(config)#ipv6 router ospf 100

R1(config-rtr)#router-id 10.10.10.10

R1(config-rtr)#exit

R1(config)#interface fastethernet 0/0

R1(config-if)#ipv6 ospf 100 area 0

R1(config-if)#exit

R1(config)#interface fastethernet 2/0

R1(config-if)#ipv6 ospf 100 area 0

R1(config-if)#exit

R2(config)#ipv6 unicast-routing

R2(config)#ipv6 router ospf 100

R2(config-rtr)#router-id 20.20.20.20

R2(config-rtr)#exit

R2(config)#interface fastethernet 0/0

R2(config-if)#ipv6 ospf 100 area 0

R2(config-if)#exit

R2(config)#interface fastethernet 2/0

R2(config-if)#ipv6 ospf 100 area 0

R2(config-if)#exit

%OSPFv3-5-ADJCHG: Process 100, Nbr 20.20.20.20 on FastEthernet0/0 from LOADING to FULL, Loading Done

%OSPFv3-5-ADJCHG: Process 100, Nbr 10.10.10.10 on FastEthe rnet0/0 from LOADING to FULL, Loading Done

R1(config)#interface fastethernet 0/0

R1(config-if)#IPv6 ospf authenticationb ipsec spi 499 md5 abcdef1234567890abcded1234567890

R1(config-if)#end

%IPSECV6-4-RECVD_PKT_NOT_IPSECV6: Rec'd packet not an IPSEC packet. (ip) dest_addr= FF02::5, src_addr= FE80::C802:63FF:FE30:0, prot= 89

%OSPFv3-5-ADJCHG: Process 100, Nbr 20.20.20.20 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired

%IPSECV6-4-RECVD_PKT_NOT_IPSECV6: Rec'd packet not an IPSECv6 packet.

(ip) dest_addr= FF02::5, src_addr= FE80::C802:63FF:FE30:0, prot= 89

R2(config)#interface fastethernet 0/0

R2(config-if)#IPv6 ospf authenticationb ipsec spi 499 md5 abcdef1234567890abcded1234567890

R2(config-if)#end

%OSPFv3-5-ADJCHG: Process 100, Nbr 10.10.10.10 on FastEthernet0/0 from LOADING to FULL, Loading Done

%OSPFv3-5-ADJCHG: Process 100, Nbr 20.20.20.20 on FastEthernet0/0 from LOADING to FULL, Loading Done

R1#show ipv6 ospf neighbor

Neighbor ID Pri State Dead Time Interface ID Interface

20.20.20.20 1 FULL/DR 00:00:33 4 FastEthernet0/ 0

R1#show ipv6 route ospf

IPv6 Routing Table - 7 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

U - Per-user Static route

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

O FC00:2222:2222:2222::/64 [110/2]

via FE80::C802:63FF:FE30:0, FastEthernet0/0

R2#show ipv6 ospf neighbor

Neighbor ID Pri State Dead Time Interface ID Interface

10.10.10.10 1 FULL/BDR 00:00:34 4 FastEthernet0/ 0

R2#show ipv6 route ospf

IPv6 Routing Table - 7 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

U - Per-user Static route

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

O FC00:1111:1111:1111::/64 [110/2]

via FE80::C801:3AFF:FE14:0, FastEthernet0/0

IPv6 Static, Default, and Dynamic routing lab

2025-11-15T17:19:00.006+05:30

In this lab, we see the configuration of IPv6 static, default, and dynamic routing protocols. This lab is divided into three labs:

IPv6 Static routing
IPv6 Default routing
IPv6 Dynamic routing

- starting with IPv6 Static routing

Topology:-

Configure the topology as per the picture.
Configure the IPv6 address as per the topology
Configure IPv6 Static routing
Verify the configuration with ping and show commands

R1(config)#ipv6 unicast-routing

R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 address 2001:1234:1234:1234::1/64
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 address fc00:1111:1111:1111::1/64
R1(config-if)#no shutdown
R1(config-if)#exit

R2(config)#ipv6 unicast-routing
R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 address 2001:1234:1234:1234::2/64
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 address fc00:1111:1111:2222::2/64
R2(config-if)#no shutdown
R2(config-if)#exit

R1#show ipv6 interface brief
FastEthernet0/0 [up/up]
FE80::C801:3FFF:FE40:0
2001:1234:1234:1234::1
ATM1/0 [administratively down/down]
FastEthernet2/0 [up/up]
FE80::C801:3FFF:FE40:38
FC00:1111:1111:1111::1
GigabitEthernet3/0 [administratively down/down]
FastEthernet4/0 [administratively down/down]
FastEthernet4/1 [administratively down/down]

R2#show ipv6 interface brief
FastEthernet0/0 [up/up]
FE80::C802:6CFF:FE10:0
2001:1234:1234:1234::2
ATM1/0 [administratively down/down]
FastEthernet2/0 [up/up]
FE80::C802:6CFF:FE10:38
FC00:1111:1111:2222::2
GigabitEthernet3/0 [administratively down/down]
FastEthernet4/0 [administratively down/down]
FastEthernet4/1 [administratively down/down]

PC2> ip auto
GLOBAL SCOPE : fc00:1111:1111:1111:2050:79ff:fe66:6801/64
ROUTER LINK-LAYER : ca:01:3f:40:00:38

PC7> ip auto
GLOBAL SCOPE : fc00:1111:1111:2222:2050:79ff:fe66:6805/64
ROUTER LINK-LAYER : cc:04:3e:ac:00:00

R1(config)#ipv6 route fc00:1111:1111:2222::/64 2001:1234:1234:1234::2
R1(config)#end

R2(config)#ipv6 route fc00:1111:1111:1111::/64 2001:1234:1234:1234::1
R2(config)#end

R1#show ipv6 route static
IPv6 Routing Table - 7 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
S FC00:1111:1111:2222::/64 [1/0]
via 2001:1234:1234:1234::2

R2#show ipv6 route static
IPv6 Routing Table - 7 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
S FC00:1111:1111:1111::/64 [1/0]
via 2001:1234:1234:1234::1

R1#ping fc00:1111:1111:2222::2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FC00:1111:1111:2222::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/48/64 ms

R1#traceroute fc00:1111:1111:2222::2
Type escape sequence to abort.
Tracing the route to FC00:1111:1111:2222::2
1 FC00:1111:1111:2222::2 36 msec 32 msec 56 msec
PC2> ping 2001:1234:1234:1234::1/64
2001:1234:1234:1234::1 icmp6_seq=1 ttl=64 time=32.271 ms
2001:1234:1234:1234::1 icmp6_seq=2 ttl=64 time=32.632 ms
2001:1234:1234:1234::1 icmp6_seq=3 ttl=64 time=32.318 ms
2001:1234:1234:1234::1 icmp6_seq=4 ttl=64 time=32.362 ms
2001:1234:1234:1234::1 icmp6_seq=5 ttl=64 time=32.418 ms
PC2> ping 2001:1234:1234:1234::2/64
2001:1234:1234:1234::2 icmp6_seq=1 ttl=63 time=128.036 ms
2001:1234:1234:1234::2 icmp6_seq=2 ttl=63 time=79.702 ms
2001:1234:1234:1234::2 icmp6_seq=3 ttl=63 time=95.755 ms
2001:1234:1234:1234::2 icmp6_seq=4 ttl=63 time=80.116 ms
2001:1234:1234:1234::2 icmp6_seq=5 ttl=63 time=80.655 ms
PC2> ping fc00:1111:1111:2222::2/64
fc00:1111:1111:2222::2 icmp6_seq=1 ttl=63 time=80.813 ms
fc00:1111:1111:2222::2 icmp6_seq=2 ttl=63 time=63.469 ms
fc00:1111:1111:2222::2 icmp6_seq=3 ttl=63 time=80.616 ms
fc00:1111:1111:2222::2 icmp6_seq=4 ttl=63 time=64.005 ms
fc00:1111:1111:2222::2 icmp6_seq=5 ttl=63 time=79.650 ms

In the second section, we see the configuration of IPv6 Default routing:

Topology:

Continuing the previous lab and erasing static routing
Configure IPv6 default routing
Verify the configuration with show commands, ping and traceroute

R1(config)#no ipv6 route fc00:1111:1111:2222::/64 2001:1234:1234:1234::2
R2(config)#no ipv6 route fc00:1111:1111:1111::/64 2001:1234:1234:1234::1

R1(config)#ipv6 route 0::/0 2001:1234:1234:1234::2
R1(config)#end

R2(config)#ipv6 route 0::/0 2001:1234:1234:1234::1
R2(config)#end

R1#show ipv6 route static
IPv6 Routing Table - 7 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
S ::/0 [1/0]
via 2001:1234:1234:1234::2

R2#show ipv6 static
IPv6 Static routes
Code: * - installed in RIB
* ::/0 via nexthop 2001:1234:1234:1234::1, distance 1

R1#ping fc00:1111:1111:2222::2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FC00:1111:1111:2222::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/43/56 ms

R1#traceroute fc00:1111:1111:2222::2
Type escape sequence to abort.
Tracing the route to FC00:1111:1111:2222::2
1 FC00:1111:1111:2222::2 56 msec 36 msec 64 msec

R2#ping fc00:1111:1111:1111::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FC00:1111:111\1:1111::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/32/36 ms

R2#traceroute fc00:1111:1111:1111::1
Type escape sequence to abort.
Tracing the route to FC00:1111:1111:1111::1
1 FC00:1111:1111:1111::1 20 msec 36 msec 44 msec

In this third final lab, we see the configuration of IPv6 dynamic routing OSPF:

Topology:

Continuing our previous lab and erasing the previous default route configuration
Configure OSPFv3 routing
Verify the configuration with show commands and ping

R1(config)#no ipv6 route 0::/0 2001:1234:1234:1234::2

R1(config)#end

R2(config)#no ipv6 route 0::/0 2001:1234:1234:1234::1

R2(config)#end

R1(config)#ipv6 router ospf 1

*Nov 13 20:19:41.751: %OSPFv3-4-NORTRID: OSPFv3 process 1 could not pick a router-id,please configure manually

R1(config-rtr)#router-id 100.1.1.1

R1(config-rtr)#exit

R1(config)#interface serial 5/0

R1(config-if)#ipv6 ospf 1 area 0

R1(config-if)#exit

R1(config)#interface fastethernet 2/0

R1(config-if)#ipv6 ospf 1 area 0

R1(config-if)#exit

R1(config)#interface fastethernet 0/0

R1(config-if)#ipv6 ospf 1 area 1

R1(config-if)#exit

*Nov 13 20:26:00.503: %OSPFv3-5-ADJCHG: Process 1, Nbr 200.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading Done

*Nov 13 20:27:53.283: %OSPFv3-5-ADJCHG: Process 1, Nbr 33.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R2(config)#ipv6 router ospf 1

*Nov 13 20:25:17.659: %OSPFv3-4-NORTRID: OSPFv3 process 1 could not pick a router-id, please configure manually

R2(config-rtr)#router-id 200.1.1.1

R2(config-rtr)#exit

R2(config)#interface fastethernet 0/0

R2(config-if)#ipv6 ospf 1 area 1

R2(config-if)#exit

*Nov 13 20:25:59.475: %OSPFv3-5-ADJCHG: Process 1, Nbr 100.1.1.1 on FastEthernet 0/0 from LOADING to FULL, Loading Done

R2(config)#interface fastethernet 2/0

R2(config-if)#ipv6 ospf 1 area 1

R2(config-if)#exit

R3(config)#ipv6 unicast-routing

R3(config)#ipv6 router ospf 1

*Nov 14 09:48:49.883: %OSPFv3-4-NORTRID: OSPFv3 process 1 could not pick a router-id,

please configure manually

R3(config-rtr)#router-id 33.1.1.1

R3(config-rtr)#exit

R3(config)#interface serial 5/0

R3(config-if)#ipv6 ospf 1 area 0

R3(config-if)#exit

*Nov 14 09:49:30.599: %OSPFv3-5-ADJCHG: Process 1, Nbr 100.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R3(config)#interface fastethernet 0/0

R3(config-if)#ipv6 ospf 1 area 0

R3(config-if)#exit

R1#show ipv6 route

IPv6 Routing Table - 10 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

U - Per-user Static route

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

C 2001:33:33:33::/64 [0/0]

via ::, Serial5/0

L 2001:33:33:33::1/128 [0/0]

via ::, Serial5/0

C 2001:1234:1234:1234::/64 [0/0]

via ::, FastEthernet0/0

L 2001:1234:1234:1234::1/128 [0/0]

via ::, FastEthernet0/0

O FC00:33:33:33::/64 [110/65]

via FE80::C805:2BFF:FEE4:0, Serial5/0

C FC00:1111:1111:1111::/64 [0/0]

via ::, FastEthernet2/0

L FC00:1111:1111:1111::1/128 [0/0]

via ::, FastEthernet2/0

O FC00:1111:1111:2222::/64 [110/2]

via FE80::C802:6CFF:FE10:0, FastEthernet0/0

L FE80::/10 [0/0]

via ::, Null0

L FF00::/8 [0/0]

via ::, Null0

R2#show ipv6 route ospf

IPv6 Routing Table - 9 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

U - Per-user Static route

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

OI 2001:33:33:33::/64 [110/65]

via FE80::C801:3FFF:FE40:0, FastEthernet0/0

OI FC00:33:33:33::/64 [110/66]

via FE80::C801:3FFF:FE40:0, FastEthernet0/0

OI FC00:1111:1111:1111::/64 [110/2]

via FE80::C801:3FFF:FE40:0, FastEthernet0/0

R3#ping fc00:1111:1111:2222::2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to FC00:1111:1111:2222::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 68/79/92 ms

R3#traceroute fc00:1111:1111:2222::2

Type escape sequence to abort.

Tracing the route to FC00:1111:1111:2222::2

1 2001:33:33:33::1 44 msec 40 msec 36 msec

2 FC00:1111:1111:2222::2 76 msec 76 msec 60 msec

What is an Offset-list? How to configure EIGRP Offset-list?

2025-08-30T16:49:00.006+05:30

What is an Offset-list?

An Offset-list is an EIGRP and RIPv2 feature that allows you to add a fixed value (an “offset”) to the composite metric of a route that matches an access control list (ACL). You can apply this to inbound (IN) and outbound (OUT) routing updates.

By increasing the metric of a route, you make it less preferable. EIGRP will always choose the path with the lower composite metric. It’s a simple yet powerful way to de-prioritize a path without using a route filter to deny it entirely. Offset value to add to the matric (1-2147483647)

Why would you use one?

Common use cases include:

· Basic load balance: making a primary link preferred while keeping a backup link active by making its metric slightly worse.
· Policy-based routing: influencing outbound traffic to take a specific path based on network policy.
· Cost engineering: simulating a longer path for a route learned from one neighbor compared to another.

let's see the configuration:-

Topology:-

Configure the topology as per the diagram
Configure the IP addresses as per the topology
Configure EIGRP 100 to advertise directly connected interfaces
Configure access-list standard permit 30.1.1.1 network
Make sure router 1 will use the serial 5/0 to reach the 30.1.1.1/8 network
Ensure no load balancing is used with the offset list; add 5000 metrics to the serial 5/3 route.

R1(config)#interface serial 5/0
R1(config-if)#ip address 1.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface serial 5/3
R1(config-if)#ip address 4.4.4.2 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface FastEthernet 0/0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#no keepalive
R1(config-if)#no shutdown
R1(config-if)#exit

R2(config)#interface serial 5/0
R2(config-if)#ip address 1.1.1.2 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface serial 5/1
R2(config-if)#ip address 2.2.2.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface FastEthernet 0/0
R2(config-if)#ip address 20.1.1.1 255.0.0.0
R2(config-if)#no keepalive
R2(config-if)#no shutdown
R2(config-if)#exit

R3(config)#interface serial 5/2
R3(config-if)#ip address 3.3.3.1 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface serial 5/1
R3(config-if)#ip address 2.2.2.2 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface FastEthernet 0/0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#no keepalive
R3(config-if)#no shutdown
R3(config-if)#exit

R4(config)#interface serial 5/2
R4(config-if)#ip address 3.3.3.2 255.0.0.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#interface serial 5/3
R4(config-if)#ip address 4.4.4.1 255.0.0.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#interface FastEthernet 0/0
R4(config-if)#ip address 40.1.1.1 255.0.0.0
R4(config-if)#no keepalive
R4(config-if)#no shutdown
R4(config-if)#exit

R1(config)#router eigrp 100

R1(config-router)#network 10.0.0.0

R1(config-router)#network 1.0.0.0

R1(config-router)#network 4.0.0.0

R1(config-router)#no auto-summary

R1(config-router)#exit

R2(config)#router eigrp 100

R2(config-router)#network 20.0.0.0

R2(config-router)#network 1.0.0.0

R2(config-router)#network 2.0.0.0

R2(config-router)#no auto-summary

R2(config-router)#exit

R3(config)#router eigrp 100

R3(config-router)#network 30.0.0.0

R3(config-router)#network 3.0.0.0

R3(config-router)#network 2.0.0.0

R3(config-router)#no auto-summary

R3(config-router)#exit

R4(config)#router eigrp 100

R4(config-router)#network 40.0.0.0

R4(config-router)#network 3.0.0.0

R4(config-router)#network 4.0.0.0

R4(config-router)#no auto-summary

R4(config-router)#exit

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C 1.0.0.0/8 is directly connected, Serial5/0

D 2.0.0.0/8 [90/2681856] via 1.1.1.2, 00:26:52, Serial5/0

D 3.0.0.0/8 [90/2681856] via 4.4.4.1, 00:26:52, Serial5/3

C 4.0.0.0/8 is directly connected, Serial5/3

D 20.0.0.0/8 [90/2172416] via 1.1.1.2, 00:26:52, Serial5/0

D 40.0.0.0/8 [90/2172416] via 4.4.4.1, 00:26:52, Serial5/3

C 10.0.0.0/8 is directly connected, FastEthernet0/0

D 30.0.0.0/8 [90/2684416] via 4.4.4.1, 00:24:15, Serial5/3

[90/2684416] via 1.1.1.2, 00:24:15, Serial5/0

R1#traceroute 30.1.1.1

Type escape sequence to abort.

Tracing the route to 30.1.1.1

1 4.4.4.1 48 msec

1.1.1.2 28 msec

4.4.4.1 28 msec

2 2.2.2.2 80 msec

3.3.3.1 80 msec

2.2.2.2 80 msec

R1#show ip route 30.1.1.1 255.0.0.0

Routing entry for 30.0.0.0/8

Known via "eigrp 100", distance 90, metric 2684416, type internal

Redistributing via eigrp 100

Last update from 4.4.4.1 on Serial5/3, 00:01:28 ago

Routing Descriptor Blocks:

4.4.4.1, from 4.4.4.1, 00:01:28 ago, via Serial5/3

Route metric is 2684416, traffic share count is 1

Total delay is 40100 microseconds, minimum bandwidth is 1544 Kbit

Reliability 255/255, minimum MTU 1500 bytes

Loading 1/255, Hops 2

* 1.1.1.2, from 1.1.1.2, 00:01:28 ago, via Serial5/0

Route metric is 2684416, traffic share count is 1

Total delay is 40100 microseconds, minimum bandwidth is 1544 Kbit

Reliability 255/255, minimum MTU 1500 bytes

Loading 1/255, Hops 2

(as you can see, both route metrics are the same. So now we are going to add 5000 metric to the serial 5/3 route.

R1(config)#ip access-list standard Offset

R1(config-std-nacl)#permit 30.0.0.0 0.255.255.255

R1(config-std-nacl)#exit

R1(config)#router eigrp 100

R1(config-router)#offset-list Offset in 5000 serial 5/3

R1(config-router)#end

*Aug 30 16:14:11.471: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 4.4.4.1 (Serial5/3) is resync: route configuration changed

R1#clear ip route *

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C 1.0.0.0/8 is directly connected, Serial5/0

D 2.0.0.0/8 [90/2681856] via 1.1.1.2, 00:00:39, Serial5/0

D 3.0.0.0/8 [90/2681856] via 4.4.4.1, 00:00:39, Serial5/3

C 4.0.0.0/8 is directly connected, Serial5/3

D 20.0.0.0/8 [90/2172416] via 1.1.1.2, 00:00:39, Serial5/0

D 40.0.0.0/8 [90/2172416] via 4.4.4.1, 00:00:39, Serial5/3

C 10.0.0.0/8 is directly connected, FastEthernet0/0

D 30.0.0.0/8 [90/2684416] via 1.1.1.2, 00:00:39, Serial5/0

R1#traceroute 30.1.1.1

Type escape sequence to abort.

Tracing the route to 30.1.1.1

1 1.1.1.2 40 msec 32 msec 32 msec

2 2.2.2.2 76 msec 56 msec 72 msec

R1#show ip route 30.1.1.1 255.0.0.0

Routing entry for 30.0.0.0/8

Known via "eigrp 100", distance 90, metric 2684416, type internal

Redistributing via eigrp 100

Last update from 1.1.1.2 on Serial5/0, 00:01:57 ago

Routing Descriptor Blocks:

* 1.1.1.2, from 1.1.1.2, 00:01:57 ago, via Serial5/0

Route metric is 2684416, traffic share count is 1

Total delay is 40100 microseconds, minimum bandwidth is 1544 Kbit

Reliability 255/255, minimum MTU 1500 bytes

Loading 1/255, Hops 2

R1#show ip eigrp topology
IP-EIGRP Topology Table for AS(100)/ID(10.1.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status
P 1.0.0.0/8, 1 successors, FD is 2169856
via Connected, Serial5/0
P 2.0.0.0/8, 1 successors, FD is 2681856
via 1.1.1.2 (2681856/2169856), Serial5/0
P 3.0.0.0/8, 1 successors, FD is 2681856
via 4.4.4.1 (2681856/2169856), Serial5/3
P 4.0.0.0/8, 1 successors, FD is 2169856
via Connected, Serial5/3
P 10.0.0.0/8, 1 successors, FD is 28160
via Connected, FastEthernet0/0
P 20.0.0.0/8, 1 successors, FD is 2172416
via 1.1.1.2 (2172416/28160), Serial5/0
P 30.0.0.0/8, 1 successors, FD is 2684416
via 1.1.1.2 (2684416/2172416), Serial5/0
via 4.4.4.1 (2689416/2177416), Serial5/3
P 40.0.0.0/8, 1 successors, FD is 2172416
via 4.4.4.1 (2172416/28160), Serial5/3

( as you can see, the metric has been increased to 2177416, and previously this metric was 2172416)

I hope you like this lab. Please visit our YouTube channel https://www.youtube.com/@internetworkss

What is IP prefix-list? How to configure IP prefix-list?

2025-08-14T07:22:00.005+05:30

IP Prefix List

An IP prefix list is a network filtering tool used primarily in routing protocols to control which routes are accepted or rejected based on their network prefixes.

Key Characteristics

· Prefix-based filtering: Matches routes based on their network address and prefix length.

· Ordering processing: Entries are processed top-down until a match is found.

· Implicit deny: if no match is found, the prefix is denied by default

R1(config)#ip prefix-list NAME seq 10 deny 192.168.1.1/24?

ge Minimum prefix length to be matched

le Maximum prefix length to be matched

<cr>

Parameters

· Network/len: The network address and prefix length to match.

· Ge: “greater than or equal to” – minimum prefix length to match.

· Le: “less than or equal to” – maximum prefix length to match.

· Seq: optional sequence number for ordering entries.

Prefix lists are widely used in routing protocols like BGP, OSPF, and EIGRP for precise control over route advertisements and redistributions.

Topology:-

Goal:.Configure the topology as per the diagram

Configure the IP addresses as per the topology
Configure IGP protocol EIGRP 100
Advertise the directly connected routes
configure IP Prefix list name INTERNET
Deny 192.168.31.0/24 - 192.168.32.0/24
rest permit
deny 192.168.11.0/24 adjust the SEQ number.
make sure router 2 deny192.168.31.1/24 & 192.168.32.1/24 and 192.168.11.1/24
change the SEQ

R1(config)#interface serial 5/0

R1(config-if)#ip address 12.1.1.1 255.0.0.0

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#interface loopback 1

R1(config-if)#ip address 192.168.11.1 255.255.255.0

R1(config-if)#exit

R1(config)#interface loopback 2

R1(config-if)#ip address 192.168.12.1 255.255.255.0

R1(config-if)#exit

R1(config)#interface loopback 3

R1(config-if)#ip address 192.168.13.1 255.255.255.0

R1(config-if)#exit

R1(config)#interface loopback 4

R1(config-if)#ip address 192.168.14.1 255.2/55.255.0

R1(config-if)#exit

R2(config)#interface serial 5/0
R2(config-if)#ip address 12.1.1.2 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface serial 5/1
R2(config-if)#ip address 13.1.1.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit

R3(config)#interface serial 5/1
R3(config-if)#ip address 23.1.1.2 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#
R3(config)#interface loopback 1
R3(config-if)#ip address 192.168.31.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 2
R3(config-if)#ip address 192.168.32.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 3
R3(config-if)#ip address 192.168.33.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 4
R3(config-if)#ip address 192.168.34.1 255.255.255.0
R3(config-if)#exit

R1(config)#router eigrp 100

R1(config-router)#network 12.0.0.0

R1(config-router)#network 192.168.11.0

R1(config-router)#network 192.168.12.0

R1(config-router)#network 192.168.13.0

R1(config-router)#network 192.168.14.0

R1(config-router)#no auto-summary

R1(config-router)#exit

R2(config)#router eigrp 100

R2(config-router)#network 192.168.21.0

R2(config-router)#network 192.168.22.0

R2(config-router)#network 192.168.23.0

R2(config-router)#network 192.168.24.0

R2(config-router)#network 12.0.0.0

R2(config-router)#network 23.0.0.0

R2(config-router)#exit

R3(config)#router eigrp 100

R3(config-router)#network 23.0.0.0

R3(config-router)#network 192.168.31.0

R3(config-router)#network 192.168.32.0

R3(config-router)#network 192.168.33.0

R3(config-router)#network 192.168.34.0

R3(config-router)#no auto-summary

R3(config-router)#exit

R2(config)#do show ip route eigrp

D 192.168.12.0/24 [90/2297856] via 12.1.1.1, 00:00:33, Serial5/0

D 192.168.13.0/24 [90/2297856] via 12.1.1.1, 00:00:33, Serial5/0

D 192.168.14.0/24 [90/2297856] via 12.1.1.1, 00:00:33, Serial5/0

D 192.168.31.0/24 [90/2297856] via 23.1.1.2, 00:00:24, Serial5/1

D 192.168.11.0/24 [90/2297856] via 12.1.1.1, 00:00:33, Serial5/0

D 192.168.34.0/24 [90/2297856] via 23.1.1.2, 00:00:24, Serial5/1

D 192.168.32.0/24 [90/2297856] via 23.1.1.2, 00:00:24, Serial5/1

D 192.168.33.0/24 [90/2297856] via 23.1.1.2, 00:00:24, Serial5/1

R2(config)#ip prefix-list INTERNET seq 10 deny 192.168.31.0/24

R2(config)#ip prefix-list INTERNET seq 15 deny 192.168.32.0/24

R2(config)#ip prefix-list INTERNET seq 30 permit 0.0.0.0/0 le 32

R2#show ip prefix-list

ip prefix-list INTERNET: 3 entries

seq 10 deny 192.168.31.0/24

seq 15 deny 192.168.32.0/24

seq 30 permit 0.0.0.0/0 le 32

R2(config)#router eigrp 100

R2(config-router)#distribute-list prefix INTERNET in serial 5/1

*Aug 13 14:41:48.487: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 23.1.1.2 (Serial5/1) is resync: route configuration changed

R2(config-router)#end

R2#clear ip route *

R2#show ip route eigrp 100

D 192.168.12.0/24 [90/2297856] via 12.1.1.1, 00:00:19, Serial5/0

D 192.168.13.0/24 [90/2297856] via 12.1.1.1, 00:00:19, Serial5/0

D 192.168.14.0/24 [90/2297856] via 12.1.1.1, 00:00:19, Serial5/0

D 192.168.11.0/24 [90/2297856] via 12.1.1.1, 00:00:19, Serial5/0

D 192.168.34.0/24 [90/2297856] via 23.1.1.2, 00:00:19, Serial5/1

D 192.168.33.0/24 [90/2297856] via 23.1.1.2, 00:00:19, Serial5/1

R2(config)#ip prefix-list INTERNET seq 20 deny 192.168.11.0/24

R2(config)#end

R2(config)#router eigrp 100

R2(config-router)#distribute-list prefix INTERNET in serial 5/0

R2(config-router)#exit

R2#show ip prefix-list

ip prefix-list INTERNET: 4 entries

seq 10 deny 192.168.31.0/24

seq 15 deny 192.168.32.0/24

seq 20 deny 192.168.11.0/24

seq 30 permit 0.0.0.0/0 le 32

R2#show ip route eigrp 100

D 192.168.12.0/24 [90/2297856] via 12.1.1.1, 00:00:41, Serial5/0

D 192.168.13.0/24 [90/2297856] via 12.1.1.1, 00:00:41, Serial5/0

D 192.168.14.0/24 [90/2297856] via 12.1.1.1, 00:00:41, Serial5/0

D 192.168.34.0/24 [90/2297856] via 23.1.1.2, 00:00:41, Serial5/1

D 192.168.33.0/24 [90/2297856] via 23.1.1.2, 00:00:41, Serial5/1

(If you like this blog, please visit our YouTube channel https://www.youtube.com/@internetworkss)

OSPF DR and BDR Explained: The Hidden Heroes of Network Efficiency.

2025-07-27T16:05:00.003+05:30

In the world of networking, OSPF (Open Shortest Path First) is one of the most widely used dynamic routing protocols. But did you know that behind the scenes, two special routers —the **Designated Router (DR)** and **Backup Designated Router (BDR)** — work tirelessly to keep your network running smoothly?

In this blog post, we’ll uncover:

1. What do DR and BDR do for our network?
2. How do they get elected, and why is this election important?
3. What are the Common mistakes in OSPF configuration?
4. What are the best practices for optimizing DR/BDR selection?

Let's dive in-à

· Why do we need DR and BDR?

Ø Imagine a conference room where everyone is shouting updates at the same time--- chaos, right? That’s what happens in an OSPF multi-access network (Ethernet) without a DR and BDR.

· The problem: toooo many LSAs*

Ø Every OSPF router floods Link-State Advertisements (LSAs) to announce network changes. In a large network, this creates excessive traffic and inefficiency.

· The Solution: DR and BDR to the Rescue**

>Designated Router DR -> becomes the central hub for LSA distribution.

> BDR Backup DR-> standby to take over if the DR fails.

> All the other routers (***DROTHERs***) only talk to the DR and BDR, reducing unnecessary chatter.

Ø Result: A cleaner, more efficient OSPF network**

· How does the DR and BDR election work?

Ø Not every router gets to be the DR- there’s a strict election process.

Ø Only routers in ** multi-access networks*** (Ethernet, Frame Relay) elect a DR/BDR.

Ø Point-to-point links (like PPP) don’t need DR/BDR.

· What are the Election Rules?

Ø OSPF Priority (0-255)

Ø Default - ***1***

Ø If OSPF priority is 0, it means the router is ineligible to be elected

Ø If the priorities are equal, the router with the highest RID wins

Ø Router ID is chosen from—manually configured RID, the highest loopback IP, highest active physical IP.

· The surprising Truth: Elections are non-preemptive.

Ø Once elected, the DR/BDR OSPF routers stay in power unless they fail.

Ø A new router with a higher priority won't take over the current DR BDR. Unless the current DR/BDR fails.

· Common DR/BDR configuration mistakes.

Ø Ignoring priority setting > if all routers have default priority 1, the highest router ID wins, which may not be optimal. FIX – manually set priorities on critical routers.

Ø Adding a new high-priority router won’t change the DR unless the current one fails. FIX restart OSPF on the interface if needed.

Ø If router IDs are unstable, for example, if they're based on a physical interface, DR election can be unpredictable. FIX always set a STATIC router ID in OSPF configuration.

· Best practice for DR/BDR optimization.

Ø Set priority 100 on the routers you want as DR/BDR, and set priority 0 on routers that should never become DR.

Ø Avoid DR on low power routers- the DR does extra work, do not make a weak router the DR.

Ø Use the loopback interface for router-ID.

Let's see the configuration=>https://www.youtube.com/@internetworkss

Topology:-

Configure the topology as per the diagram
Configure the IP addresses as per the topology
Configure OSPF 1 and advertise directly connected interfaces
Configure router 1 DR, router 2, and router 3 Drothers
Configure Router 4 as backup DR
VERIFY THE CONFIGURATIONS.

R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.10.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface loopback 1
R1(config-if)#ip address 10.1.1.1 255.255.255.0
R1(config-if)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 192.168.10.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface loopback 1
R2(config-if)#ip address 10.1.1.2 255.255.255.0
R2(config-if)#exit

R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 192.168.10.3 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface loopback 1
R3(config-if)#ip address 10.1.1.3 255.255.255.0
R3(config-if)#exit

R4(config)#interface fastethernet 0/0
R4(config-if)#ip address 192.168.10.4 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#interface loopback 1
R4(config-if)#ip address 10.1.1.4 255.255.255.0
R4(config-if)#exit

R1(config)#router ospf 1
R1(config-router)#router-id 192.168.1.1
R1(config-router)#network 192.168.1.0 255.0.0.0 area 0
R1(config-router)#network 10.1.1.0 255.0.0.0 area 0
R1(config-router)#exit

R2(config)#router ospf 1
R2(config-router)#router-id 192.168.1.2
R2(config-router)#network 192.168.1.0 255.0.0.0 area 0
R2(config-router)#network 10.1.1.0 255.0.0.0 area 0
R2(config-router)#exit

R3(config)#router ospf 1
R3(config-router)#router-id 192.168.1.3
R3(config-router)#network 192.168.1.0 255.0.0.0 area 0
R3(config-router)#network 10.1.1.0 255.0.0.0 area 0
R3(config-router)#exit

R4(config)#router ospf 1
R4(config-router)#router-id 192.168.1.4
R4(config-router)#network 192.168.1.0 255.0.0.0 area 0
R4(config-router)#network 10.1.1.0 255.0.0.0 area 0
R4(config-router)#exit

R1(config)#do ping 10.1.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/44/48 ms

R1(config)#do ping 10.1.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 36/42/48 ms

R1(config)#do ping 10.1.1.4

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.4, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/40/48 ms

R1#show ip ospf interface fastethernet 0/0
FastEthernet0/0 is up, line protocol is up
Internet Address 192.168.10.1/24, Area 0
Process ID 1, Router ID 192.168.1.1, Network Type BROADCAST, Cost: 1
Transmit Delay is 1 sec, State DROTHER, Priority 1
Designated Router (ID) 192.168.1.4, Interface address 192.168.10.4
Backup Designated router (ID) 192.168.1.3, Interface address 192.168.10.3
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:03
Supports Link-local Signaling (LLS)
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 0, maximum is 1
Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 3, Adjacent neighbor count is 2
Adjacent with neighbor 192.168.1.3 (Backup Designated Router)
Adjacent with neighbor 192.168.1.4 (Designated Router)
Suppress hello for 0 neighbor(s)

(In the above output, you see that router 1 is DROTHER and router 3 is BDR, and router 4 is DR. Let's change these to as per our topology.)

R1(config)#interface fastethernet 0/0
R1(config-if)#ip ospf priority ?
<0-255> Priority
R1(config-if)#ip ospf priority 200
R1(config-if)#end

R1#clear ip ospf process
Reset ALL OSPF processes? [no]: y

*Jul 27 15:48:25.023: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.2 on FastEthernet0/0 from 2WAY to DOWN, Neighbor Down: Interface down or detached
*Jul 27 15:48:25.023: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.3 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached
*Jul 27 15:48:25.023: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.4 on FastEthern0/0 from FULL to DOWN, Neighbor Down: Interface down or detached
*Jul 27 15:48:25.275: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.3 on FastEthernet 0/0 from LOADING to FULL, Loading Done
*Jul 27 15:48:25.275: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.4 on FastEthernet 0/0 from LOADING to FULL, Loading Done

R2(config)#interface fastEthernet 0/0
R2(config-if)#ip ospf priority 0
R2(config-if)#exit
R2(config)#exit
R2#clear ip ospf process

Reset ALL OSPF processes? [no]: y

R3(config)#interface fastEthernet 0/0

R3(config-if)#ip ospf pri
R3(config-if)#ip ospf priority 0
R3(config-if)#exit
R3(config)#do clear ip ospf process
Reset ALL OSPF processes? [no]: y

R4(config)#interface fastEthernet 0/0
R4(config-if)#ip ospf priority 150
R4(config-if)#exit
R4(config)#exit
R4#clear ip ospf process
Reset ALL OSPF processes? [no]: y

R1#show ip ospf interface fastEthernet 0/0

FastEthernet0/0 is up, line protocol is up

Internet Address 192.168.10.1/24, Area 0

Process ID 1, Router ID 192.168.1.1, Network Type BROADCAST, Cost: 1

Transmit Delay is 1 sec, State DR, Priority 200

Designated Router (ID) 192.168.1.1, Interface address 192.168.10.1

Backup Designated router (ID) 192.168.1.4, Interface address 192.168.10.4

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

oob-resync timeout 40

Hello due in 00:00:09

Supports Link-local Signaling (LLS)

Index 1/1, flood queue length 0

Next 0x0(0)/0x0(0)

Last flood scan length is 1, maximum is 3

Last flood scan time is 0 msec, maximum is 4 msec

Neighbor Count is 3, Adjacent neighbor count is 3

Adjacent with neighbor 192.168.1.2

Adjacent with neighbor 192.168.1.3

Adjacent with neighbor 192.168.1.4 (Backup Designated Router)

Suppress hello for 0 neighbor(s)

(I hope you like this blog.... please visit our YouTube channel https://www.youtube.com/@internetworkss

What is OSPFv2 (Open Shortest Path First version 2) subcommand?

2025-05-30T16:49:00.006+05:30

OSPFv2 (Open Shortest Path First version 2 is a link-state routing protocol designed for IPv4 networks. It is defined in RFC 2328 and is widely used in enterprise and service provider networks due to its efficiency and scalability.

Key Features of OSPFv2:

1. Link-State Protocol:

Maintains a complete topological map of the network (LSDB - Link-State Database).
Uses the Dijkstra (SPF) algorithm to compute the shortest path to all destinations.

2. Hierarchical Routing (Areas):

Divides networks into areas to reduce routing overhead.
Backbone Area (Area 0) is mandatory; all other areas must connect to it.

Types of areas:

Normal Areas (Standard areas)
Stub Areas (Block external routes)
Totally Stubby Areas (Block external and inter-area routes)
Not-So-Stubby Areas (NSSA) (Allows limited external routes)

Metric (Cost):

Calculated based on interface bandwidth (Cost = Reference BW / Interface BW, default Reference BW = 100 Mbps).

Packet Types:

Hello (Discover/maintain neighbors)
DBD (Database Description) (Exchange LSDB info)
LSR (Link-State Request) (Request specific LSA)
LSU (Link-State Update) (Send LSA updates)
LSAck (Link-State Acknowledgment) (Acknowledge LSUs)

LSA Types (Link-State Advertisements):

Type 1 (Router LSA) – Intra-area router info.
Type 2 (Network LSA) – Multi-access network info.
Type 3 (Summary LSA) – Inter-area routes (ABR-generated).
Type 4 (ASBR Summary LSA) – Location of ASBR.
Type 5 (External LSA) – Routes from other AS (redistributed).
Type 7 (NSSA External LSA) – External routes in NSSA.

Neighbor States:

Down → Init → 2-Way → ExStart → Exchange → Loading → Full

Authentication:

Supports plain-text, MD5, and SHA authentication for security.

Let's see the configuration of the OSPFv2 subcommand.

Topology:-

Configure the topology as per the diagram
Configure the IP addresses as per the topology
Configure OSPFv2 with the subcommand
advertise directly connected routes and loopbacks
Make sure all the routes are exchanged
Verify with ping and show commands

router-1(config)#interface serial 5/0

router-1(config-if)#ip address 12.1.1.1 255.0.0.0

router-1(config-if)#no shutdown

router-1(config-if)#exit

router-1(config)#interface fastethernet 0/0

router-1(config-if)#ip address 13.1.1.1 255.0.0.0

router-1(config-if)#no shutdown

router-1(config-if)#exit

router-1(config)#interface gig 3/0

router-1(config-if)#ip address 14.1.1.1 255.0.0.0

router-1(config-if)#no shutdown

router-1(config-if)#exit

R2(config)#interface serial 5/0

R2(config-if)#ip address 12.1.1.2 255.0.0.0

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface loopback 1

R2(config-if)#ip address 192.168.20.1 255.255.255.0

R2(config-if)#exit

R3(config)#interface fastethernet 0/0

R3(config-if)#ip address 13.1.1.2 255.0.0.0

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#interface loopback 1

R3(config-if)#ip address 192.168.30.1 255.255.255.0

R3(config-if)#exit

router-1(config)#interface serial 5/0

router-1(config-if)#ip ospf 10 area 0

router-1(config-if)#exit

router-1(config)#interface fastethernet 0/0

router-1(config-if)#ip ospf 10 area 0

router-1(config-if)#exit

router-1(config)#interface gig 3/0

router-1(config-if)#ip ospf 10 area 0

router-1(config-if)#exit

*May 30 16:23:05.531: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.20.1 on Serial5/0 from LOADING to FULL, Loading Done

*May 30 16:24:03.999: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.30.1 on FastEthernet0/0 from LOADING to FULL, Loading Done

*May 30 16:25:00.667: %OSPF-5-ADJCHG: Process 10, Nbr 192.168.40.1 on GigabitEthernet3/0 from LOADING to FULL, Loading Done

R2(config)#interface serial 5/0

R2(config-if)#ip ospf 10 area 0

R2(config-if)#exit

*May 30 16:23:05.015: %OSPF-5-ADJCHG: Process 10, Nbr 14.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R2(config)#interface loopback 1

R2(config-if)#ip ospf 10 area 1

R2(config-if)#exit

R3(config)#interface fastethernet 0/0

R3(config-if)#ip ospf 10 area 0

R3(config-if)#exit

*May 30 16:24:03.255: %OSPF-5-ADJCHG: Process 10, Nbr 14.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading Done

R3(config)#interface loopback 1

R3(config-if)#ip ospf 10 area 2

R3(config-if)#exit

R4(config)#interface gig 3/0

R4(config-if)#ip ospf 10 area 0

R4(config-if)#exit

*May 30 16:25:00.579: %OSPF-5-ADJCHG: Process 10, Nbr 14.1.1.1 on GigabitEthernet3/0 from LOADING to FULL, Loading Done

R4(config)#interface loopback 1

R4(config-if)#ip ospf 10 area 3

R4(config-if)#exit

router-1#show ip protocols

Routing Protocol is "ospf 10"

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Router ID 14.1.1.1

Number of areas in this router is 1. 1 normal 0 stub 0 nssa

Maximum path: 4

Routing for Networks:

Routing on Interfaces Configured Explicitly (Area 0):

GigabitEthernet3/0

FastEthernet0/0

Serial5/0

Reference bandwidth unit is 100 mbps

Routing Information Sources:

Gateway Distance Last Update

192.168.40.1 110 00:06:36

192.168.30.1 110 00:06:39

192.168.20.1 110 00:06:39

Distance: (default is 110)

router-1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

192.168.30.0/32 is subnetted, 1 subnets

O IA 192.168.30.1 [110/2] via 13.1.1.2, 00:07:05, FastEthernet0/0

192.168.40.0/32 is subnetted, 1 subnets

O IA 192.168.40.1 [110/2] via 14.1.1.2, 00:07:02, GigabitEthernet3/0

192.168.20.0/32 is subnetted, 1 subnets

O IA 192.168.20.1 [110/65] via 12.1.1.2, 00:07:05, Serial5/0

C 12.0.0.0/8 is directly connected, Serial5/0

C 13.0.0.0/8 is directly connected, FastEthernet0/0

C 14.0.0.0/8 is directly connected, GigabitEthernet3/0

router-1#show ip ospf interface gigabitEthernet 3/0

GigabitEthernet3/0 is up, line protocol is up

Internet Address 14.1.1.1/8, Area 0

Process ID 10, Router ID 14.1.1.1, Network Type BROADCAST, Cost: 1

Enabled by interface config, including secondary ip addresses

Transmit Delay is 1 sec, State DR, Priority 1

Designated Router (ID) 14.1.1.1, Interface address 14.1.1.1

Backup Designated router (ID) 192.168.40.1, Interface address 14.1.1.2

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

oob-resync timeout 40

Hello due in 00:00:03

Supports Link-local Signaling (LLS)

Index 3/3, flood queue length 0

Next 0x0(0)/0x0(0)

Last flood scan length is 0, maximum is 1

Last flood scan time is 0 msec, maximum is 4 msec

Neighbor Count is 1, Adjacent neighbor count is 1

Adjacent with neighbor 192.168.40.1 (Backup Designated Router)

Suppress hello for 0 neighbor(s)

router-1#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/34/40 ms

router-1#

router-1#ping 192.168.30.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.30.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 28/39/60 ms

router-1#

router-1#ping 192.168.40.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.40.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 32/40/48 ms

router-1#show ip ospf database

OSPF Router with ID (14.1.1.1) (Process ID 10)

Router Link States (Area 0)

Link ID ADV Router Age Seq# Checksum Link count

14.1.1.1 14.1.1.1 1097 0x80000006 0x002C55 4

192.168.20.1 192.168.20.1 1192 0x80000002 0x002C4C 2

192.168.30.1 192.168.30.1 1130 0x80000003 0x003AC3 1

192.168.40.1 192.168.40.1 1075 0x80000003 0x009750 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# Checksum

13.1.1.1 14.1.1.1 1153 0x80000001 0x0084FA

14.1.1.1 14.1.1.1 1097 0x80000001 0x00F97A

Summary Net Link States (Area 0)

Link ID ADV Router Age Seq# Checksum

192.168.20.1 192.168.20.1 1187 0x80000001 0x005CE2

192.168.30.1 192.168.30.1 1126 0x80000001 0x00A783

192.168.40.1 192.168.40.1 1071 0x80000001 0x00F224

What is a VLAN Hopping Attack?

2025-05-14T10:33:00.002+05:30

What is a VLAN Hopping Attack?

Virtual Local Area Networks (VLANs) play a crucial role in segmenting traffic for security and performance in today's interconnected networks. However, attackers can exploit misconfigurations to bypass these segmentation controls through VLAN hopping attacks.

In this blog, we’ll explore:

What VLAN hopping is
How VLAN hopping attacks work
Types of VLAN hopping attacks
How to prevent VLAN hopping

What is VLAN Hopping?

VLAN hopping is a network attack where an attacker gains unauthorized access to traffic on a different VLAN, bypassing network segmentation. This allows them to intercept, modify, or disrupt traffic for other VLANs.

VLAN hopping is possible due to misconfigured switch ports or exploiting VLAN protocols like Dynamic Trunking Protocol (DTP).

How Does VLAN Hopping Work?

There are two main methods attackers use to perform VLAN hopping:

Switch Spoofing (DTP Exploitation)
Dynamic Trunking Protocol (DTP) is enabled by default, and the interfaces of our switches will be in (dynamic auto) or (dynamic desirable) mode. It means that whenever we receive a DTP packet that requests to form a trunk.
If a switch port is left in "auto" or "desirable" mode, an attacker can connect a rogue switch and send DTP packets to form a trunk.
Once a trunk is established, the attacker can access all VLANs passing through that trunk.

Attack Scenario:

An attacker connects a rogue device (e.g., a laptop running a switch emulator) to an unsecured switch port.
The rogue device sends DTP frames, tricking the switch into enabling trunking.
The attacker now has access to all VLANs on the trunk link.
Double Tagging (VLAN Stacking Attack)
This attack exploits 802.1Q VLAN tagging and requires the attacker to be on the native VLAN.
The attacker sends a frame with two VLAN tags:
The outer tag matches the native VLAN (which is stripped by the first switch).
The inner tag is the target VLAN, which the next switch processes.
Since the first switch removes the outer tag, the second switch forwards the frame to the target VLAN.

Attack Scenario:

The attacker is connected to a port on the native VLAN (e.g., VLAN 1).
They craft a packet with two VLAN tags:
Outer tag: VLAN 1 (native VLAN)
Inner tag: VLAN 20 (target VLAN)
The first switch strips the outer tag and forwards the frame.
The second switch sees only the inner tag (VLAN 20) and sends it to the victim’s VLAN.

Note: Double tagging is a one-way attack (only egress traffic is affected) and works only if the attacker is on the native VLAN.

How to Prevent VLAN Hopping Attacks

To secure your network against VLAN hopping, follow these best practices:

Disable DTP (Dynamic Trunking Protocol)
Configure switch ports as access ports unless trunking is explicitly needed.

Use the following commands on Cisco switches:

Use a Dedicated Native VLAN

Avoid using VLAN 1 (default native VLAN) for user traffic.
Assign an unused VLAN as the native VLAN for trunk ports:

Enable Port Security

Restrict the MAC addresses allowed on a port to prevent unauthorized devices.

Disable Unused Ports

Shut down unused switch ports to prevent unauthorized access.

Implement Private VLANs (PVLANs)

Use PVLANs to further isolate devices within the same VLAN.

Monitor and Audit VLAN Configurations

Regularly check switch configurations for unauthorized trunking.

Use tools like SIEM (Security Information and Event Management) to detect anomalies.

Conclusion

VLAN hopping is a serious security threat that can bypass network segmentation, allowing attackers to intercept sensitive traffic. By disabling DTP, securing trunk ports, and using proper VLAN configurations, organizations can significantly reduce the risk of VLAN hopping attacks.

Best Practices Recap:
✔ Disable DTP on all access ports.
✔ Change the default native VLAN.
✔ Enable port security and disable unused ports.
✔ Regularly audit VLAN configurations.

By implementing these measures, you can strengthen your network security and prevent VLAN hopping exploits.

Have you encountered VLAN hopping in your network? Share your experiences in the comments! 🚀

#NetworkSecurity #CyberSecurity #VLAN #Hacking #InfoSec

What is BGP Allowas-in Feature? How to configure BGP Allowas-in? GNS3

2025-02-18T13:34:00.008+05:30

BGP Allowas-in is a configuration option in Border Gateway Protocol (BGP) routing that allows a router to accept routes with its own AS (Autonomous System) number in the AS_PATH attribute.
There's a risk of creating routing loops if not managed properly. It should be used cautiously and with a clear understanding of network topology.

Purpose: Normally, BGP prevents loops by rejecting routes that contain the local AS number in the AS_PATH. However, in scenarios like multi-homed environments or when dealing with MPLS VPNs, you should allow routes to come back into your AS through different paths.

Functionality: When you configure allowas-in, you specify how many times your AS number is allowed to appear in the AS_PATH. This number can be set between 1 to 10, although this varies by router vendor and model. For example, setting allowas-in 2 would allow routes with up to two instances of your AS number in the path.

Usage Scenario:

Multi-homed Networks: If you have connections to the same ISP in different locations, allowas-in can prevent unnecessary route blackholing by allowing these routes back into your network.
MPLS VPNs: In scenarios where customer routes are sent through a service provider network and back, allowas-in ensures these routes are not dropped.

Configuration Example (Cisco IOS-like syntax):

plaintext
router bgp 65100
neighbor 12.1.1.2 remote-as 65200
neighbor 12.1.1.2 allowas-in 2

end

To allow the re-advertisement of all prefixes that contain duplicate ASNs, use the neighbor allowas-in command in router configuration mode in Router

Risks:

There's a risk of creating routing loops if not managed properly. It should be used cautiously and with a clear understanding of network topology.
It can also lead to suboptimal routing if not configured correctly.

Best Practices:
Use sparingly and only where necessary.
Monitor BGP updates closely when employing this feature.
Combine with route-maps or other BGP policies to control which routes are accepted.
This configuration can significantly affect network reachability and BGP convergence, so it should be deployed with a good understanding of BGP dynamics and network design.

let's see the configuration:-

Topology:-

Goal- allow the same AS routes installed in router 1 and router 5 routing table.

configure the IP addresses as per the topology
configure EBGP IBGP protocols
verify the 10.0.0.0/8 in the router 5 routing table
verify the 50.0.0.0/8 in the router 1 routing table
configure BGP allowas-in feature on routers 1 and 5
ensure route 10.1.1.1 and 50.1.1.1 in router 1 and 5 routing table.
in the end, ensure the connectivity with ping traceroute commands

R1(config)#interface ethernet 5/0

R1(config-if)#ip address 10.1.1.1 255.0.0.0

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#interface serial 4/0

R1(config-if)#ip address 12.1.1.1 255.0.0.0

R1(config-if)#no shutdown

R1(config-if)#exit

R2(config)#interface ethernet 5/0

R2(config-if)#ip address 20.1.1.1 255.0.0.0

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface serial 4/0

R2(config-if)#ip address 12.1.1.2 255.0.0.0

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface serial 4/1

R2(config-if)#ip address 23.1.1.1 255.0.0.0

R2(config-if)#no shutdown

R2(config-if)#exit

R3(config)#interface ethernet 5/0

R3(config-if)#ip address 30.1.1.1 255.0.0.0

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#interface serial 4/0

R3(config-if)#ip address 34.1.1.1 255.0.0.0

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#interface serial 4/1

R3(config-if)#ip address 23.1.1.2 255.0.0.0

R3(config-if)#no shutdown

R3(config-if)#exit

R4(config)#interface ethernet 5/0

R4(config-if)#ip address 40.1.1.1 255.0.0.0

R4(config-if)#no shutdown

R4(config-if)#exit

R4(config)#interface serial 4/0

R4(config-if)#ip address 34.1.1.2 255.0.0.0

R4(config-if)#no shutdown

R4(config-if)#exit

R4(config)#interface serial 4/1

R4(config-if)#ip address 45.1.1.1 255.0.0.0

R4(config-if)#no shutdown

R4(config-if)#exit

R5(config)#interface ethernet 5/0

R5(config-if)#ip address 50.1.1.1 255.0.0.0

R5(config-if)#no shutdown

R5(config-if)#exit

R5(config)#interface serial 4/1

R5(config-if)#ip address 45.1.1.2 255.0.0.0

R5(config-if)#no shutdown

R5(config-if)#exit

R1(config)#router bgp 65100

R1(config-router)#neighbor 12.1.1.2 remote-as 65200

R1(config-router)#network 10.0.0.0 mask 255.0.0.0

R1(config-router)#network 12.0.0.0 mask 255.0.0.0

R1(config-router)#no sync

R1(config-router)#exit

*Feb 18 12:04:32.531: %BGP-5-ADJCHANGE: neighbor 12.1.1.2 Up

R2(config)#router bgp 65200

R2(config-router)#neighbor 12.1.1.1 remote-as 65100

R2(config-router)#neighbor 23.1.1.2 remote-as 65200

R2(config-router)#network 20.0.0.0 mask 255.0.0.0

R2(config-router)#network 12.0.0.0 mask 255.0.0.0

R2(config-router)#network 23.0.0.0 mask 255.0.0.0

R2(config-router)#no sync

R2(config-router)#exit

*Feb 18 12:04:32.687: %BGP-5-ADJCHANGE: neighbor 12.1.1.1 Up

*Feb 18 12:05:30.427: %BGP-5-ADJCHANGE: neighbor 23.1.1.2 Up

R3(config)#router bgp 65200

R3(config-router)#neighbor 34.1.1.2 remote-as 65300

R3(config-router)#neighbor 23.1.1.1 remote-as 65200

R3(config-router)#network 30.0.0.0 mask 255.0.0.0

R3(config-router)#network 34.0.0.0 mask 255.0.0.0

R3(config-router)#network 23.0.0.0 mask 255.0.0.0

R3(config-router)#no sync

R3(config-router)#exit

*Feb 18 12:05:30.535: %BGP-5-ADJCHANGE: neighbor 23.1.1.1 Up

*Feb 18 12:09:19.379: %BGP-5-ADJCHANGE: neighbor 34.1.1.2 Up

R4(config)#router bgp 65300

R4(config-router)#neighbor 34.1.1.1 remote-as 65200

R4(config-router)#neighbor 45.1.1.2 remote-as 65100

R4(config-router)#network 40.0.0.0 mask 255.0.0.0

R4(config-router)#network 34.0.0.0 mask 255.0.0.0

R4(config-router)#network 45.0.0.0 mask 255.0.0.0

R4(config-router)#no sync

R4(config-router)#exit

*Feb 18 12:09:18.955: %BGP-5-ADJCHANGE: neighbor 34.1.1.1 Up

*Feb 18 12:09:56.799: %BGP-5-ADJCHANGE: neighbor 45.1.1.2 Up

R5(config)#router bgp 65100

R5(config-router)#neighbor 45.1.1.1 remote-as 65300

R5(config-router)#network 50.0.0.0 mask 255.0.0.0

R5(config-router)#network 45.0.0.0 mask 255.0.0.0

R5(config-router)#no sync

R5(config-router)#exit

*Feb 18 12:09:56.643: %BGP-5-ADJCHANGE: neighbor 45.1.1.1 Up

R1#show ip bgp

BGP table version is 9, local router ID is 12.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 10.0.0.0 0.0.0.0 0 32768 i

* 12.0.0.0 12.1.1.2 0 0 65200 i

*> 0.0.0.0 0 32768 i

*> 20.0.0.0 12.1.1.2 0 0 65200 i

*> 23.0.0.0 12.1.1.2 0 0 65200 i

*> 30.0.0.0 12.1.1.2 0 65200 i

*> 34.0.0.0 12.1.1.2 0 65200 i

*> 40.0.0.0 12.1.1.2 0 65200 65300 i

*> 45.0.0.0 12.1.1.2 0 65200 65300 I

(as you can see router 1 does not have a 50.1.1.1/8 network in its routing table because of the loop prevention feature)

R5#show ip bgp

BGP table version is 9, local router ID is 50.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 12.0.0.0 45.1.1.1 0 65300 65200 i

*> 20.0.0.0 45.1.1.1 0 65300 65200 i

*> 23.0.0.0 45.1.1.1 0 65300 65200 i

*> 30.0.0.0 45.1.1.1 0 65300 65200 i

*> 34.0.0.0 45.1.1.1 0 0 65300 i

*> 40.0.0.0 45.1.1.1 0 0 65300 i

* 45.0.0.0 45.1.1.1 0 0 65300 i

*> 0.0.0.0 0 32768 i

*> 50.0.0.0 0.0.0.0 0 32768 i

(as you can see router 5 does not have a 10.1.1.1/8 network in its routing table because of the loop prevention feature both routers are in the same AS 65100)

R1(config)#router bgp 65100

R1(config-router)#neighbor 12.1.1.2 allowas-in

R1(config-router)#exit

R1(config)#end

R5(config)#router bgp 65100

R5(config-router)#neighbor 45.1.1.1 allowas-in

R5(config-router)#exit

R5(config)#end

R1#show ip bgp

BGP table version is 10, local router ID is 12.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 10.0.0.0 0.0.0.0 0 32768 i

* 12.0.0.0 12.1.1.2 0 0 65200 i

*> 0.0.0.0 0 32768 i

*> 20.0.0.0 12.1.1.2 0 0 65200 i

*> 23.0.0.0 12.1.1.2 0 0 65200 i

*> 30.0.0.0 12.1.1.2 0 65200 i

*> 34.0.0.0 12.1.1.2 0 65200 i

*> 40.0.0.0 12.1.1.2 0 65200 65300 i

*> 45.0.0.0 12.1.1.2 0 65200 65300 i

*> 50.0.0.0 12.1.1.2 0 65200 65300 65100 i

R5#show ip bgp

BGP table version is 10, local router ID is 50.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 10.0.0.0 45.1.1.1 0 65300 65200 65100 i

*> 12.0.0.0 45.1.1.1 0 65300 65200 i

*> 20.0.0.0 45.1.1.1 0 65300 65200 i

*> 23.0.0.0 45.1.1.1 0 65300 65200 i

*> 30.0.0.0 45.1.1.1 0 65300 65200 i

*> 34.0.0.0 45.1.1.1 0 0 65300 i

*> 40.0.0.0 45.1.1.1 0 0 65300 i

* 45.0.0.0 45.1.1.1 0 0 65300 i

*> 0.0.0.0 0 32768 i

* 50.0.0.0 45.1.1.1 0 65300 65100 i

*> 0.0.0.0 0 32768 I

(as you can see after we allows-in feature both the routers installed same AS routes in to their routing table)

R1#ping 50.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 50.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 132/154/180 ms

R1#traceroute 50.1.1.1

Type escape sequence to abort.

Tracing the route to 50.1.1.1

1 12.1.1.2 20 msec 32 msec 32 msec

2 23.1.1.2 [AS 65200] 72 msec 64 msec 64 msec

3 34.1.1.2 [AS 65200] 96 msec 92 msec 104 msec

4 45.1.1.2 [AS 65300] 148 msec 116 msec 140 msec

R5#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 120/148/180 ms

R5#traceroute 10.1.1.1

Type escape sequence to abort.

Tracing the route to 10.1.1.1

1 45.1.1.1 32 msec 32 msec 32 msec

2 34.1.1.1 [AS 65300] 64 msec 64 msec 64 msec

3 23.1.1.1 [AS 65200] 104 msec 96 msec 96 msec

4 12.1.1.1 [AS 65200] 128 msec 152 msec 132 msec

I hope you like this article if you like it please visit to our YouTube channel

https://www.youtube.com/@internetworkss

What is BGP route dampening? How to configure BGP route Dampening?

2025-02-11T18:07:00.004+05:30

BGP route dampening is a mechanism used in the Border Gateway Protocol (BGP) to mitigate the negative effects of route flapping. Route flapping occurs when a BGP route is repeatedly advertised and withdrawn, causing instability in the network. This instability can lead to increased CPU load on routers, excessive BGP updates, and potential routing loops.

BGP route dampening works by assigning a penalty to a route each time it flaps. If the route continues to flap, the penalty accumulates. Once the penalty exceeds a certain threshold, the route is dampened, meaning it is suppressed and not considered for routing decisions. This prevents the flapping route from causing further disruption to the network.

After some time, the penalty for a dampened route begins to decrease. Once the penalty falls below another threshold, the route is un-dampened and can be used again. This allows the route to recover if the underlying issue causing the flapping has been resolved.

BGP route dampening helps to improve network stability and reduce the load on routers by preventing the propagation of flapping routes. However, it can also lead to temporary loss of connectivity for some destinations if routes are dampened for extended periods. Therefore, it is important to carefully configure the dampening parameters to balance stability and availability.

Note-

BGP route dampening is designed to reduce route processing load caused by unstable routes.
Each time an eBGP route flaps, it gets 1000 penalty points. we cannot modify this configuration.

*Feb 4 13:14:50.315: EvD: charge penalty 1000, new accum. penalty 1000, flap count 1

only eBGP routes are dampened.
if the penalty exceeds the suppress limit the route is dampened and no longer used but if the route penalty is dropped below the threshold the route is again in use and propagated.
a penalty is applied on the individual path in the BGP table, not on the IP prefix. you can see the unreachable routes in the table marked with h.

R2#show ip bgp

BGP table version is 20, local router ID is 192.168.4.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*>i1.1.1.0/24 192.168.1.1 0 100 0 i

h 3.3.3.0/24 192.168.3.1 0 0 65300 i

*>i10.0.0.0 192.168.1.1 0 100 0 i

*> 30.0.0.0 192.168.3.1 0 0 65300 i

*> 40.0.0.0 192.168.4.1 0 0 65400 i

* i192.168.1.0 192.168.1.1 0 100 0 i

*> 0.0.0.0 0 32768 i

* 192.168.3.0 192.168.3.1 0 0 65300 i

*> 0.0.0.0 0 32768 i

* 192.168.4.0 192.168.4.1 0 0 65400 i

*> 0.0.0.0 0 32768 i

configure the topology as per the diagram
configure IP addresses as per the topology
configure iBGP and eBGP as per the topology
configure BGP dampening on router 2 AS 65100
manually flaps the route loopback 3.3.3.3 in an AS 65300
make sure 3.3.3.3/24 in h state in the routing table and dampened

R1(config)#interface loopback 1

R1(config-if)#ip address 1.1.1.1 255.255.255.0

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#interface fastethernet 2/0

R1(config-if)#ip address 10.1.1.1 255.0.0.0

R1(config-if)#no keepalive

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#interface fastethernet 0/0

R1(config-if)#ip address 192.168.1.1 255.255.255.0

R1(config-if)#no shutdown

R1(config-if)#exit

R2(config)#interface fastethernet 0/0

R2(config-if)#ip address 192.168.1.2 255.255.255.0

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface serial 4/0

R2(config-if)#ip address 192.168.4.2 255.255.255.0

R2(config-if)#no keepalive

R2(config-if)#no shutdown

R2(config-if)#exit

R2(config)#interface serial 4/1

R2(config-if)#ip address 192.168.3.2 255.255.255.0

R2(config-if)#no shutdown

R2(config-if)#exit

R3(config)#interface loopback 1

R3(config-if)#ip address 3.3.3.3 255.255.255.0

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#interface fastethernet 2/0

R3(config-if)#ip address 30.1.1.1 255.0.0.0

R3(config-if)#no keepalive

R3(config-if)#no shutdown

R3(config-if)#exit

R3(config)#interface serial 4/1

R3(config-if)#ip address 192.168.3.1 255.255.255.0

R3(config-if)#no shutdown

R3(config-if)#exit

R4(config)#interface loopback 1

R4(config-if)#ip address 4.4.4.4 255.255.255.0

R4(config-if)#no shutdown

R4(config-if)#exit

R4(config)#interface fastethernet 2/0

R4(config-if)#ip address 40.1.1.1 255.0.0.0

R4(config-if)#no keepalive

R4(config-if)#no shutdown

R4(config-if)#exit

R4(config)#interface serial 4/0

R4(config-if)#ip address 192.168.4.1 255.255.255.0

R4(config-if)#no shutdown

R4(config-if)#exit

R1(config)#router bgp 65100

R1(config-router)#neighbor 192.168.1.2 remote-as 65100

R1(config-router)#network 10.0.0.0

R1(config-router)#network 1.1.1.0 mask 255.255.255.0

R1(config-router)#network 192.168.1.0 mask 255.255.255.0

R1(config-router)#no auto-summary

R1(config-router)#no synchronization

R1(config-router)#exit

R2(config)#router bgp 65100

R2(config-router)#neighbor 192.168.1.1 remote-as 65100

R2(config-router)#neighbor 192.168.4.1 remote-as 65400

R2(config-router)#neighbor 192.168.3.1 remote-as 65300

R2(config-router)#network 192.168.1.0 mask 255.255.255.0

R2(config-router)#network 192.168.3.0 mask 255.255.255.0

R2(config-router)#network 192.168.4.0 mask 255.255.255.0

R2(config-router)#neighbor 192.168.1.1 next-hop-self

R2(config-router)#bgp log-neighbor-changes

R2(config-router)#no synchronization

R2(config-router)#no auto-summary

R2(config-router)#exit

R3(config)#router bgp 65300

R3(config-router)#neighbor 192.168.3.2 remote-as 65100

R3(config-router)#network 3.3.3.0 mask 255.255.255.0

R3(config-router)#network 30.0.0.0

R3(config-router)#network 192.168.3.0 mask 255.255.255.0

R3(config-router)#bgp log-neighbor-changes

R3(config-router)#no synchronization

R3(config-router)#no auto-summary

R3(config-router)#exit

R4(config)#router bgp 65400

R4(config-router)#neighbor 192.168.4.2 remote-as 65100

R4(config-router)#network 40.0.0.0

R4(config-router)#network 4.0.0.0 mask 255.255.255.0

R4(config-router)#network 192.168.4.0 mask 255.255.255.0

R4(config-router)#no auto-summary

R4(config-router)#no synchronization

R4(config-router)#bgp log-neighbor-changes

R4(config-router)#exit

R1#show ip bgp

BGP table version is 11, local router ID is 1.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 1.1.1.0/24 0.0.0.0 0 32768 i

*>i3.3.3.0/24 192.168.1.2 0 100 0 65300 i

*> 10.0.0.0 0.0.0.0 0 32768 i

*>i30.0.0.0 192.168.1.2 0 100 0 65300 i

*>i40.0.0.0 192.168.1.2 0 100 0 65400 i

* i192.168.1.0 192.168.1.2 0 100 0 i

*> 0.0.0.0 0 32768 i

*>i192.168.3.0 192.168.1.2 0 100 0 i

*>i192.168.4.0 192.168.1.2 0 100 0 i

R2(config)#router bgp 65100

R2(config-router)#bgp dampening

R2(config-router)#end

R2#show ip bgp dampening parameters

dampening 15 750 2000 60 (DEFAULT)

Half-life time : 15 mins Decay Time : 2320 secs

Max suppress penalty: 12000 Max suppress time: 60 mins

Suppress penalty : 2000 Reuse penalty : 750

R2(config)#router bgp 65100

R2(config-router)#neighbor 192.168.1.1 advertisement-interval 1

R3(config)#interface loopback 1

R3(config-if)#shutdown

R3(config-if)#no shutdown

R3(config-if)#shutdown

R3(config-if)#no shutdown

*Feb 4 13:14:50.315: EvD: charge penalty 1000, new accum. penalty 1000, flap count 1

*Feb 4 13:14:50.319: BGP(0): charge penalty for 3.3.3.0/24 path 65300 with half life-time 15 reuse/suppress 750/2000

*Feb 4 13:14:50.319: BGP(0): flapped 1 times since 00:00:00. New penalty is 1000

*Feb 4 13:14:50.655: EvD: accum. penalty decayed to 1000 after 0 second(s)

R2#show ip bgp dampening flap-statistics

BGP table version is 17, local router ID is 192.168.4.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network From Flaps Duration Reuse Path

*> 3.3.3.0/24 192.168.3.1 1 00:00:39 65300

R2#show ip bgp 3.3.3.3

BGP routing table entry for 3.3.3.0/24, version 17

Paths: (1 available, best #1, table Default-IP-Routing-Table)

Flag: 0x820

Advertised to update-groups:

1 2

65300

192.168.3.1 from 192.168.3.1 (3.3.3.3)

Origin IGP, metric 0, localpref 100, valid, external, best

Dampinfo: penalty 936, flapped 1 times in 00:01:32

R2#show ip bgp

BGP table version is 20, local router ID is 192.168.4.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*>i1.1.1.0/24 192.168.1.1 0 100 0 i

h 3.3.3.0/24 192.168.3.1 0 0 65300 i

*>i10.0.0.0 192.168.1.1 0 100 0 i

*> 30.0.0.0 192.168.3.1 0 0 65300 i

*> 40.0.0.0 192.168.4.1 0 0 65400 i

* i192.168.1.0 192.168.1.1 0 100 0 i

*> 0.0.0.0 0 32768 i

* 192.168.3.0 192.168.3.1 0 0 65300 i

*> 0.0.0.0 0 32768 i

* 192.168.4.0 192.168.4.1 0 0 65400 i

*> 0.0.0.0 0 32768 i

What is uplinkfast?

2025-01-05T19:11:00.002+05:30

Spanning tree UplinkFast is a Cisco-specific enhancement to the Spanning Tree Protocol (STP). It's designed to improve the convergence time in the event of a direct link failure, especially in access-layer switches with redundant links to the distribution layer.

Here's how it works:

Quick Recovery: When the primary uplink fails, UplinkFast allows the switch to quickly transition the blocked port to forwarding, bypassing the usual listening and learning states.

Preventing Loops: It modifies the Bridge Protocol Data Units (BPDUs) to prevent loops by increasing the path cost and setting the local bridge priority.

Immediate Restoration: This feature ensures that connectivity is restored almost immediately, reducing downtime significantly.

UplinkFast is typically used in access-layer switches and should be deployed carefully to avoid potential issues with MAC address tables.

Key points:-

legacy/cisco proprietary feature
uplinkfast is for speeding convergence when a direct link to an upstream switch fails.
when uplinkfast is enabled, it is enabled for the entire switch and all VLANs.

this feature is not allowed on the root bridge switch.
when uplinkfast is configured, the bridge priority is changed to 49,152 so that this switch will not be selected as root.

We have three switches. Switch-1 is our Root, and two others are non-root switches. Switch-1's ports are Desg FWD because it's a root. Switch-2's gig0/0 port is a Root FWD, and gig 0/1 is a Desg FWD. Switch-3's gig0/0 is Root FWD, and gig1/0 is an Altn BLK state port. so that's what we have, now switch-3 uses gig0/0 to reach the root bridge, what if the port shuts down? how long does it take for switch-3 to make a transition? let's see.

switch-1#show spanning-tree vlan 1
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0c58.a85e.0000
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 24577 (priority 24576 sys-id-ext 1)
Address 0c58.a85e.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0 Desg FWD 4 128.1 Shr
Gi0/1 Desg FWD 4 128.2 Shr

switch-2#show spanning-tree vlan 1
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0c58.a85e.0000
Cost 4
Port 1 (GigabitEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0c2e.adf7.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0 Root FWD 4 128.1 Shr
Gi0/1 Desg FWD 4 128.2 Shr

switch-3#show spanning-tree vlan 1
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0c58.a85e.0000
Cost 4
Port 1 (GigabitEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0c33.c353.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0 Root FWD 4 128.1 Shr
Gi0/1 Altn BLK 4 128.2 Shr

switch-3#debug spanning-tree events

Spanning Tree event debugging is on

switch-3(config)#interface gigabitEthernet 0/0

switch-3(config-if)#shutdown

*Jan 5 08:15:36.684: STP: VLAN0001 new root port Gi0/1, cost 8

*Jan 5 08:15:36.684: STP: VLAN0001 Gi0/1 -> listening

*Jan 5 08:15:36.684: STP[1]: Generating TC trap for port GigabitEthernet0/0

*Jan 5 08:15:36.685: STP: VLAN0100 we are the spanning tree root

*Jan 5 08:15:38.685: STP: VLAN0001 sent Topology Change Notice on Gi0/1

*Jan 5 08:15:51.686: STP: VLAN0001 Gi0/1 -> learning

*Jan 5 08:16:06.686: STP[1]: Generating TC trap for port GigabitEthernet0/1

*Jan 5 08:16:06.686: STP: VLAN0001 Gi0/1 -> forwarding

switch-3#show spanning-tree vlan 1
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0c58.a85e.0000
Cost 8
Port 2 (GigabitEthernet0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0c33.c353.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1 Root FWD 4 128.2 Shr

after a long time of listening and learning forwarding. our previous Gig0/1 Altn BLK port is now Root FWD. This process takes time. now we have configure the Cisco Uplinkfast feature.

switch-3(config)#interface gigabitEthernet 0/0

switch-3(config-if)#no shutdown

switch-3(config-if)#exit

switch-3(config)#do show spanning-tree vlan 1
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0c58.a85e.0000
Cost 4
Port 1 (GigabitEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0c33.c353.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 15 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0 Root FWD 4 128.1 Shr
Gi0/1 Altn BLK 4 128.2 Shr

switch-3(config)#spanning-tree uplinkfast

switch-3(config)#end

switch-3#debug spanning-tree events

Spanning Tree event debugging is on

*Jan 5 08:22:15.071: STP: VLAN0001 new root port Gi0/1, cost 3008

*Jan 5 08:22:15.071: %SPANTREE_FAST-7-PORT_FWD_UPLINK: VLAN0001 GigabitEthernet0/1 moved to Forwarding (UplinkFast).

wooo no listening no learning direct forwarding) this is Uplinkfast....

switch-3#show spanning-tree vlan 1
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 24577
Address 0c58.a85e.0000
Cost 3008
Port 2 (GigabitEthernet0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 49153 (priority 49152 sys-id-ext 1)
Address 0c33.c353.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Uplinkfast enabled
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1 Root FWD 3004 128.2 Shr

you see after we configure the Uplinkfast feature this switch means switch-3 bridge ID priority is changed. now this switch will never be a root bridge. unless we disable uplink fast. so never configure Uplink fast on the root switch.

What is layer 3 etherchannel? How to configure layer 3 etherchannel?

2024-09-07T14:50:00.001+05:30

EtherChannel technology allows us to bundle multiple physical links into one logical link. It is used to increase the bandwidth and provide redundancy between multiple layer 2 / layer 3 interfaces. Layer 2 EtherChannel operates on the data link layer, but layer 3 EtherChannel operates at the network layer, allowing it to route traffic. Ether-channel load balances traffic over all the links in the bundle. We can use a maximum 8 physical interfaces to configure the bundle into a single logical link.

Note:- when we configure the port channel (layer 3) we must configure No switchport command before using the command port-channel. if we do not configure no switchport command. the port channel will be the default layer 2 channel and we can not change it. To avoid this, configure no switchport command.

let's see the configuration of layer 3 EtherChannel:-

Topology:-

Goal: configure layer 3 port-channel verify with show commands and configure routing verify with ping.

configure the topology as per the diagram
configure the IP addresses as per the topology
configure portchannel
verify port-channel
configure routing EIGRP
configure IP on VLAN 1
verify with show commands.
ping

IOU1(config)#interface range ethernet 0/0-3
IOU1(config-if-range)#no switchport

IOU1(config-if-range)#channel-group 10 mode on
Creating a port-channel interface Port-channel 10
IOU1(config-if-range)#exit

IOU1(config)#interface port-channel 10
IOU1(config-if)#ip address 192.168.10.1 255.255.255.0
IOU1(config-if)#no shutdown
IOU1(config-if)#exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel10, changed state to up

IOU2(config)#interface range ethernet 0/0-3
IOU2(config-if-range)#no switchport
IOU2(config-if-range)#channel-group 10 mode on
Creating a port-channel interface Port-channel 10
IOU2(config-if-range)#exit

IOU2(config)#interface port-channel 10

IOU2(config-if)#ip address 192.168.10.2 255.255.255.0
IOU2(config-if)#no shutdown
IOU2(config-if)#exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel10, changed state to up

IOU1#show etherchannel port-channel
                Channel-group listing:
                ----------------------

Group: 10
----------
                Port-channels in the group:
                ---------------------------

Port-channel: Po10
------------

Age of the Port-channel   = 0d:00h:29m:12s
Logical slot/port   = 16/0          Number of ports = 4
GC                  = 0x00000000      HotStandBy port = null
Passive port list   = Et0/0 Et0/1 Et0/2 Et0/3
Port state          = Port-channel L3-Ag Ag-Inuse
Protocol            =    -
Port security       = Disabled

Ports in the Port-channel:

Index   Load   Port     EC state        No of bits
------+------+------+------------------+-----------
0     00     Et0/0    On                 0
0     00     Et0/1    On                 0
0     00     Et0/2    On                 0
0     00     Et0/3    On                 0

Time since last port bundled:    0d:00h:29m:12s    Et0/3

IOU2#show etherchannel
                Channel-group listing:
                ----------------------

Group: 10
----------
Group state = L3
Ports: 4   Maxports = 4
Port-channels: 1 Max Port-channels = 1
Protocol:    -
Minimum Links: 0

IOU1(config)#ip routing

IOU1(config)#router eigrp 100
IOU1(config-router)#network 10.0.0.0
IOU1(config-router)#network 192.168.10.0
IOU1(config-router)#no auto-summary
IOU1(config-router)#exit

IOU2(config)#ip routing

IOU2(config)#router eigrp 100
IOU2(config-router)#network 20.0.0.0
IOU2(config-router)#network 192.168.10.0
IOU2(config-router)#no auto-summary
IOU2(config-router)#exit

%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.10.1 (Port-channel10) is up: new adjacency

%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.10.2 (Port-channel10) is up: new adjacency

IOU1(config)#interface ethernet 1/0
IOU1(config-if)#switchport
IOU1(config-if)#switchport mode access
IOU1(config-if)#switchport access vlan 1
IOU1(config-if)#exit

IOU1(config)#interface vlan 1
IOU1(config-if)#ip address 10.1.1.1 255.0.0.0
IOU1(config-if)#no shutdown
IOU1(config-if)#exit

%LINK-3-UPDOWN: Interface Vlan1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up

IOU2(config)#interface ethernet 1/0
IOU2(config-if)#switchport
IOU2(config-if)#switchport mode access
IOU2(config-if)#switchport access vlan 1
IOU2(config-if)#exit

IOU2(config)#interface vlan 1
IOU2(config-if)#ip address 20.1.1.1 255.0.0.0
IOU2(config-if)#no shutdown
IOU2(config-if)#exit

%LINK-3-UPDOWN: Interface Vlan1, changed state to up
\%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up

IOU2#ping 10.1.1.1 source 20.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 20.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/6 ms

IOU2#traceroute 10.1.1.1
Type escape sequence to abort.
Tracing the route to 10.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.10.1 1 msec 5 msec 0 msec

What is PPP PAP and CHAP? How to configure PPP PAP CHAP authentication?

2024-08-29T17:34:00.003+05:30

WAN Protocols

Higher level Data Link Control Protocol HDLC is a Cisco proprietary WAN protocol that provides reliable delivery of data frames over a network or communication link. HDLC does not support authentication like PPP. HDLC is the default protocol on serial links.

PPP Point-to-Point Protocol is used in serial links, ethernet, frame Relay, atm, etc. PPP is a standard protocol that supports authentication, compression & error correction. PPP is not enabled by default we need to configure this on the serial link.

Password Authentication Protocol PAP provides a simple and easiest method for a remote node simply to establish and develop its identity. PAP is done only upon initial link establishment. PAP is not a strong authentication protocol because the username and password are sent across the link in clear text. PPP PAP supports almost all the network products in the market today and on different systems. but PAP has some disadvantages like a security risk because username are sent in clear text meaning that they can be easily accessed. PPP PAP offers no protection against replay attacks.

Challenge Handshake Authentication Protocol CHAP is an encrypted authentication method that is required to verify the identity of the peer. Once the PPP link establishment phase is complete. the local router sends a unique "challenge" message to the remote node. the remote node responds with a value (MD5) the local router checks the response against its own calculation of the expected hash value. clear text username MD5 hashed password and also CHAP has the replay protection.

lets see the configuration of PAP and CHAP:-https://youtu.be/ZXOXJLSXCG4?si=9qrXCMT8GRDlX8pJ

Topology:

Goal: first we configure CHAP authentication between router-1 and router-2, second we configure PAP between router-2 and router-3. in extra, we configure routing between routers.

Configure the topology as per the diagram
Configure the IP addresses as per the topology
make sure interfaces and the default line protocol are UP
Configure PPP on serial 5/0
Configure CHAP authentication between router-1 and router-2 Serial link 5/0
verify with show commands before and after applying CHAP
Configure PAP authentication between router-2 and router-3
verify with show commands before and after results.

Site-A-R-(config)#interface serial 5/0
Site-A-R-(config-if)#ip address 192.168.1.1 255.255.255.0
Site-A-R-(config-if)#no shutdown
Site-A-R-(config-if)#exit

Site-A-R-(config)#interface fastethernet 0/0
Site-A-R-(config-if)#ip address 10.1.1.1 255.0.0.0
Site-A-R-(config-if)#no shutdown
Site-A-R-(config-if)#exit

Headoffice-R-(config)#interface serial 5/0
Headoffice-R-(config-if)#ip address 192.168.1.2 255.255.255.0
Headoffice-R-(config-if)#no shutdown
Headoffice-R-(config-if)#exit

Headoffice-R-(config)#interface serial 5/1
Headoffice-R-(config-if)#ip address 192.168.2.1 255.255.255.0
Headoffice-R-(config-if)#no shutdown
Headoffice-R-(config-if)#exit

Site-B-R-(config)#interface serial 5/1
Site-B-R-(config-if)#ip address 192.168.2.2 255.255.255.0
Site-B-R-(config-if)#no shutdown
Site-B-R-(config-if)#exit

Site-B-R-(config)#interface fastethernet 0/0
Site-B-R-(config-if)#ip address 30.1.1.1 255.0.0.0
Site-B-R-(config-if)#no shutdown
Site-B-R-(config-if)#no keepalive
Site-B-R-(config-if)#exit

Site-A-R-(config)#router eigrp 1
Site-A-R-(config-router)#network 10.0.0.0
Site-A-R-(config-router)#network 192.168.1.0
Site-A-R-(config-router)#no auto-summary
Site-A-R-(config-router)#exit

Site-B-R-(config)#router eigrp 1
Site-B-R-(config-router)#network 30.0.0.0
Site-B-R-(config-router)#network 192.168.2.0

Site-B-R-(config-router)#no auto-summary
Site-B-R-(config-router)#exit

*Aug 28 17:44:41.883: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.2.1 (Serial5/1) is up: new adjacency

Site-A-R-#show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.1.1.1        YES manual up                    up
Serial5/0                  192.168.1.1     YES manual up                    up

Headoffice-R-#show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
Serial5/0                  192.168.1.2     YES manual up                    up
Serial5/1                  192.168.2.1     YES manual up                    up

Site-A-R-#show interfaces serial 5/0

Serial5/0 is up, line protocol is up

Hardware is M4T

Internet address is 192.168.1.1/24

MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation HDLC, crc 16, loopback not set

Keepalive set (10 sec)

Restart-Delay is 0 secs

Last input 00:00:04, output 00:00:01, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: weighted fair

Output queue: 0/1000/64/0 (size/max total/threshold/drops)

Conversations 0/1/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1158 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

212 packets input, 14595 bytes, 0 no buffer

Received 140 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

242 packets output, 16267 bytes, 0 underruns

0 output errors, 0 collisions, 2 interface resets

0 output buffer failures, 0 output buffers swapped out

3 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

Site-A-R-(config)#interface serial 5/0
Site-A-R-(config-if)#encapsulation PPP

Site-A-R-(config-if)#PPP authentication ?
chap        Challenge Handshake Authentication Protocol (CHAP)
eap         Extensible Authentication Protocol (EAP)
ms-chap     Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
ms-chap-v2 Microsoft CHAP Version 2 (MS-CHAP-V2)
pap         Password Authentication Protocol (PAP)

Site-A-R-(config-if)#PPP authentication chap
Site-A-R-(config-if)#exit

Site-A-R-(config)#username Headoffice-R- password internetworks
Site-A-R-(config)#end

*Aug 28 17:52:18.371: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.1.2 (Serial5/0) is down: interface down
*Aug 28 17:52:21.099: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial5/0, changed state to down
*Aug 28 17:54:43.275: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial5/0, changed state to up
*Aug 28 17:54:44.035: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.1.2 (Serial5/0) is up: new adjacency

Headoffice-R-(config)#interface serial 5/0
Headoffice-R-(config-if)#encapsulation PPP
Headoffice-R-(config-if)#PPP authentication chap
Headoffice-R-(config-if)#exit

Headoffice-R-(config)#username Site-A-R- password internetworks

*Aug 28 17:53:15.747: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial5/0, changed state to up
*Aug 28 17:53:16.727: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.1.1 (Serial5/0) is up: new adjacency

Site-A-R-# show interface serial 5/0
Serial5/0 is up, line protocol is up
Hardware is M4T
Internet address is 192.168.1.1/24
MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, LCP Open
Open: IPCP, CDPCP, crc 16, loopback not set
Keepalive set (10 sec)
Restart-Delay is 0 secs
Last input 00:00:01, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:02:55
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/64/0 (size/max total/threshold/drops)
     Conversations 0/1/256 (active/max active/max total)
     Reserved Conversations 0/0 (allocated/max allocated)
     Available Bandwidth 1158 kilobits/sec
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
     179 packets input, 5542 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     177 packets output, 4729 bytes, 0 underruns
     0 output errors, 0 collisions, 30 interface resets
     0 output buffer failures, 0 output buffers swapped out
     30 carrier transitions     DCD=up DSR=up DTR=up RTS=up CTS=up

{Second lab of PAP}

Headoffice-R-#show interface serial 5/1
Serial5/1 is up, line protocol is up
Hardware is M4T
Internet address is 192.168.2.1/24
MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation HDLC, crc 16, loopback not set
Keepalive set (10 sec)
Restart-Delay is 0 secs
Last input 00:00:04, output 00:00:04, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/64/0 (size/max total/threshold/drops)
     Conversations 0/1/256 (active/max active/max total)
     Reserved Conversations 0/0 (allocated/max allocated)
     Available Bandwidth 1158 kilobits/sec
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
     330 packets input, 21907 bytes, 0 no buffer
     Received 177 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     362 packets output, 25021 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 output buffer failures, 0 output buffers swapped out
     3 carrier transitions     DCD=up DSR=up DTR=up RTS=up CTS=up

Headoffice-R-(config)#interface serial 5/1
Headoffice-R-(config-if)#encapsulation PPP

Headoffice-R-(config-if)#PPP authentication ?
chap        Challenge Handshake Authentication Protocol (CHAP)
eap         Extensible Authentication Protocol (EAP)
ms-chap     Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
ms-chap-v2 Microsoft CHAP Version 2 (MS-CHAP-V2)
pap         Password Authentication Protocol (PAP)

Headoffice-R-(config-if)#PPP authentication pap
Headoffice-R-(config-if)#PPP pap sent-username Headoffice-R- password google
Headoffice-R-(config-if)#exit

Headoffice-R-(config)#username Site-B-R- password google


Site-B-R-#show interface serial 5/1
Serial5/1 is up, line protocol is up
Hardware is M4T
Internet address is 192.168.2.2/24
MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, LCP Open
Open: IPCP, CDPCP, crc 16, loopback not set
Keepalive set (10 sec)
Restart-Delay is 0 secs
Last input 00:00:04, output 00:00:01, output hang never
Last clearing of "show interface" counters 00:06:14
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/64/0 (size/max total/threshold/drops)
     Conversations 0/1/256 (active/max active/max total)
     Reserved Conversations 0/0 (allocated/max allocated)
     Available Bandwidth 1158 kilobits/sec
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
     511 packets input, 14034 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     507 packets output, 12266 bytes, 0 underruns
     0 output errors, 0 collisions, 24 interface resets
     0 output buffer failures, 0 output buffers swapped out
     24 carrier transitions     DCD=up DSR=up DTR=up RTS=up CTS=up

Site-B-R-(config)#interface serial 5/1
Site-B-R-(config-if)#encapsulation PPP
Site-B-R-(config-if)#PPP authentication pap
Site-B-R-(config-if)#PPP pap sent-username Site-B-R- password google
Site-B-R-(config-if)#exit
Site-B-R-(config)#end

Site-B-R-(config)#username Headoffice-R- password google

Site-B-R-#show interface serial 5/1

Serial5/1 is up, line protocol is up

Hardware is M4T

Internet address is 192.168.2.2/24

MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation PPP, LCP Open

Open: IPCP, CDPCP, crc 16, loopback not set

Keepalive set (10 sec)

Restart-Delay is 0 secs

Last input 00:00:04, output 00:00:01, output hang never

Last clearing of "show interface" counters 00:06:14

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: weighted fair

Output queue: 0/1000/64/0 (size/max total/threshold/drops)

Conversations 0/1/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1158 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

511 packets input, 14034 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

507 packets output, 12266 bytes, 0 underruns

0 output errors, 0 collisions, 24 interface resets

0 output buffer failures, 0 output buffers swapped out

24 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

How to configure the DHCP server on a Cisco ASA device?

2024-07-10T10:03:00.005+05:30

How to configure the DHCP server on a Cisco ASA device?

DHCP (Dynamic Host Configuration Protocol) servers provide all the basic information the client wants to operate on the network, including DNS address, Default Gateway, IP addresses, and subnet. masks and many more.

In this blog, we configure the Cisco ASA firewall to act as a DHCP (Dynamic Host Configuration Protocol) server. DHCP simplifies the process of IP address assignment in your network. In this scenario, we’ll set up the ASA to provide IP addresses to internal LANs using different DHCP scopes.

let's see the configuration:

Topology:-

configure the topology as per the diagram
configure the IP addresses on ASA and configure security
configure DHCP server on ASA
verify the configuration with show commands and ping.

ciscoasa(config)# interface gigabitEthernet 0

ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0

ciscoasa(config-if)# security 100

ciscoasa(config-if)# nameif inside

ciscoasa(config-if)# no shutdown

ciscoasa(config-if)# exit

ciscoasa(config)# dhcpd address 192.168.1.2-192.168.1.240 inside

ciscoasa(config)# dhcpd dns 8.8.8.8

ciscoasa(config)# dhcpd domain internetworks

ciscoasa(config)# dhcpd option 3 ip 192.168.1.1

ciscoasa(config)# dhcpd lease 3000

ciscoasa(config)# dhcpd enable inside

ciscoasa(config)# exit

ciscoasa# show dhcpd binding

IP address Client Identifier Lease expiration Type

192.168.1.2 0100.5079.6668.00 2399 seconds Automatic

192.168.1.3 0100.5079.6668.01 2941 seconds Automatic

192.168.1.4 0100.5079.6668.02 2949 seconds Automatic

192.168.1.5 0100.5079.6668.03 2956 seconds Automatic

192.168.1.6 0100.5079.6668.04 2963 seconds Automatic

192.168.1.7 0100.5079.6668.05 2970 seconds Automatic

192.168.1.8 0100.5079.6668.06 2977 seconds Automatic

ciscoasa# show dhcpd statistics

DHCP UDP Unreachable Errors: 0

DHCP Other UDP Errors: 0

Address pools 1

Automatic bindings 7

Expired bindings 0

Malformed messages 0

Message Received

BOOTREQUEST 0

DHCPDISCOVER 7

DHCPREQUEST 14

DHCPDECLINE 0

DHCPRELEASE 0

DHCPINFORM 0

Message Sent

BOOTREPLY 0

DHCPOFFER 7

DHCPACK 14

DHCPNAK 0

ciscoasa# show dhcpd state

Context Configured as DHCP Server

Interface inside, Configured for DHCP SERVER

PC2> ip dhcp

DORA IP 192.168.1.3/24 GW 192.168.1.1

PC2> show ip

NAME : PC2[1]

IP/MASK : 192.168.1.3/24

GATEWAY : 192.168.1.1

DNS : 8.8.8.8

DHCP SERVER : 192.168.1.1

DHCP LEASE : 2565, 3000/1500/2625

DOMAIN NAME : internetworks

MAC : 00:50:79:66:68:01

LPORT : 10017

RHOST:PORT : 127.0.0.1:10018

MTU: : 1500

What is Cisco Management VLAN? How to configure VLAN management? | CCNA Security

2024-06-30T14:18:00.004+05:30

What is a Management VLAN?

Management VLAN is a VLAN that is used for Managing and monitoring network devices like routers, switches, and other devices from a remote location by using protocols such as telnet, SSH, SNMP,syslog, etc. The purpose of the management VLAN is to configure designated the VLAN for configuration purposes. Cisco recommends not to use VLAN 1 and not to use any VLAN that carries user data traffic as management VLAN. Normally the Management VLAN is VLAN1, but you can use any VLAN as a management VLAN. Once you configure the Management VLAN for administration, the data plane traffic and management traffic will be isolated this reduces the interference, and also with this VLAN security will be enhanced for management traffic.

Let’s see the configuration for better understanding.

Topology:-

C2960-(config)#VLAN 100
C2960-(config-vlan)#name Account
C2960-(config-vlan)#exit

C2960-(config)#VLAN 200
C2960-(config-vlan)#name Sales
C2960-(config-vlan)#exit

C2960-(config)#VLAN 900
C2960-(config-vlan)#name Management
C2960-(config-vlan)#exit
C2960-(config)#end

C2960-#show vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

100 Account active

200 Sales active

900 Management active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

C2960-(config)#interface range ethernet 0/0-3 , ethernet 1/0-2

C2960-(config-if-range)#switchport

C2960-(config-if-range)#description VLAN-Account

C2960-(config-if-range)#switchport mode access

C2960-(config-if-range)#switchport access vlan 100

C2960-(config-if-range)#exit

C2960-(config)#interface range ethernet 1/3 , ethernet 2/0-3 , ethernet 3/0-1

C2960-(config-if-range)#switchport

C2960-(config-if-range)#description VLAN-Sales

C2960-(config-if-range)#switchport mode access

C2960-(config-if-range)#switchport access vlan 200

C2960-(config-if-range)#exit

C2960-(config)#interface range ethernet 3/2-3

C2960-(config-if-range)#switchport

C2960-(config-if-range)#description VLAN-Management

C2960-(config-if-range)#switchport access vlan 900

C2960-(config-if-range)#exit

C2960-(config)#interface vlan 900
C2960-(config-if)#ip address 192.168.2.1 255.255.255.0
C2960-(config-if)#no shutdown
C2960-(config-if)#exit

*Jun 29 10:57:14.970: %LINK-3-UPDOWN: Interface Vlan900, changed state to up

C2960-(config)#interface vlan 1

C2960-(config-if)#shutdown

C2960-(config-if)#exit

C2960-#show ip interface brief

Interface IP-Address OK? Method Status Protocol

Ethernet0/0 unassigned YES unset up up

Ethernet0/1 unassigned YES unset up up

Ethernet0/2 unassigned YES unset up up

Ethernet0/3 unassigned YES unset up up

Ethernet1/0 unassigned YES unset up up

Ethernet1/1 unassigned YES unset up up

Ethernet1/2 unassigned YES unset up up

Ethernet1/3 unassigned YES unset up up

Ethernet2/0 unassigned YES unset up up

Ethernet2/1 unassigned YES unset up up

Ethernet2/2 unassigned YES unset up up

Ethernet2/3 unassigned YES unset up up

Ethernet3/0 unassigned YES unset up up

Ethernet3/1 unassigned YES unset up up

Ethernet3/2 unassigned YES unset up up

Ethernet3/3 unassigned YES unset up up

Vlan1 unassigned YES unset administratively down down

Vlan900 192.168.2.1 YES manual up up

C2960-#ping 192.168.2.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/13/17 ms

C2960-(config)#username admin password admin

C2960-(config)#line vty 0 4
C2960-(config-line)#password admin
C2960-(config-line)#login
C2960-(config-line)#exit

C2960-(config)#enable secret admin
C2960-(config)#end

PC15#ping 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 16/18/24 ms

PC15#telnet 192.168.2.1 /source-interface fastEthernet 0/0

Trying 192.168.2.1 ... Open

NTERNETWORKS.

User Access Verification

Password:

C2960->enable

Password:

C2960-#conf t

C2960-(config)#do show interface status

Port Name Status Vlan Duplex Speed Type

Et0/0 VLAN-account connected 100 auto auto unknown

Et0/1 VLAN-account connected 100 auto auto unknown

Et0/2 VLAN-account connected 100 auto auto unknown

Et0/3 VLAN-account connected 100 auto auto unknown

Et1/0 VLAN-account connected 100 auto auto unknown

Et1/1 VLAN-account connected 100 auto auto unknown

Et1/2 VLAN-account connected 100 auto auto unknown

Et1/3 VLAN-Sales connected 200 auto auto unknown

Et2/0 VLAN-Sales connected 200 auto auto unknown

Et2/1 VLAN-Sales connected 200 auto auto unknown

Et2/2 VLAN-Sales connected 200 auto auto unknown

Et2/3 VLAN-Sales connected 200 auto auto unknown

Et3/0 VLAN-Sales connected 200 auto auto unknown

Et3/1 VLAN-Sales connected 200 auto auto unknown

Et3/2 VLAN-Management connected 900 auto auto unknown

Et3/3 VLAN-Management connected 900 auto auto unknown

C2960-(config)#

C2960-#

[Connection to 192.168.2.1 closed by foreign host]

PC15#

C2960-#

*Jun 29 11:11:47.937: %SYS-5-CONFIG_I: Configured from console by vty0 (192.168. 2.10)

C2960-#

if you like this blog please visit our YouTube channel https://www.youtube.com/@internetworkss

Cisco ASA access management with ASDM, SSH, telnet and dedicated management interface.

2024-06-27T16:22:00.003+05:30

A Cisco ASA firewall is a barrier between LAN and WAN networks (trusted and untrusted networks), we configure the firewall in the forwarding path of the network so each packet has to be checked by our firewall. Cisco ASA firewall offers several ways to connect and interact. The Administrative user can access the ASA using Telnet, Secure Shell SSH, and ASDM.

Cisco ASA supports In-band management and Out-band management.

In-band management ASA uses the same data network that carries regular user traffic and protocols like Telnet, SSH, or HTTPS over the same network interfaces that handle user traffic. Inband management uses the same transit path as user traffic. (data plane + management plane)

you can see the data plane traffic (normal traffic) and management plane ( Telnet, SSH, and ASDM traffic) using the same transit path. it can be any interface fast ethernet, gigabyte ethernet serial interface, or loopback but not a dedicated management interface.

Now this kind of topology has advantages and disadvantages. It's easy to configure because of the existing network infrastructure and no need for separate dedicated management interfaces. Disadvantages are a security risk, dependent on network availability and shared resources.

Out-band management

Out-band management Cisco ASA offers a dedicated management interface separate from regular data interfaces. The administrator uses a dedicated management physical port on the ASA to access the device and this interface is only used for outbound management purposes.

Out-band management isolates management traffic from normal data traffic. The console port and management physical port both are out-band management.

let's see the configuration of all the methods to access the ASA firewall,

in the first lab, we are going to configure the Talent
in the second lab, we are going to configure the Secure Shell
in the third lab, we are going to configure a dedicated management interface
in the fourth lab, we are going to configure the ASDM

First lab topology:-

configure the topology as per the diagram
configure the IP addresses as per the topology
configure the zone inside and outside
enable telnet because by default telnet is disabled on ASA
configure router-1 to act as a PC for verification.

R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 192.168.1.10 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

ciscoasa(config)# interface gigabitEthernet 0
ciscoasa(config-if)# security 100
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# ping 192.168.1.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/32/50 ms

ciscoasa(config)# interface gigabitEthernet 1
ciscoasa(config-if)# security 0
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# ip address 12.12.12.1 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# username admin password admin
ciscoasa(config)# telnet 192.168.1.0 255.255.255.0 inside

R1#telnet 192.168.1.1 /source-interface fastEthernet 0/0
Trying 192.168.1.1 ... Open

User Access Verification
Password:

ciscoasa> enable
Password:

ciscoasa# show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0 192.168.1.1 YES manual up up
GigabitEthernet1 12.12.12.1 YES manual up up
GigabitEthernet2 unassigned YES unset administratively down up
GigabitEthernet3 unassigned YES unset administratively down up
ciscoasa#
ciscoasa# exit
Logoff

[Connection to 192.168.1.1 closed by foreign host]
R1#
R1#

in the second lab, we are going to configure the Secure Shell

Topology:-

configure the topology as per the diagram
configure the IP addresses as per the topology
configure the zone inside and outside
configure AAA authentication on LOCAL
configure Secure shell
configure username and password
configure router-1 to act as a PC for verification.

R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 192.168.1.10 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

ciscoasa(config)# interface gigabitEthernet 0
ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
ciscoasa(config-if)# security 100
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# interface gigabitEthernet 1
ciscoasa(config-if)# ip address 12.12.12.1 255.255.255.0
ciscoasa(config-if)# security 0
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0 192.168.1.1 YES manual up up
GigabitEthernet1 12.12.12.1 YES manual up up

ciscoasa(config)# username admin password admin

ciscoasa(config)# crypto key generate rsa modulus 1024
INFO: The name for the keys will be: <Default-RSA-Key>
Keypair generation process begin. Please wait...

ciscoasa(config)# aaa authentication ssh console LOCAL
ciscoasa(config)# ssh 192.168.1.0 255.255.255.0 inside
ciscoasa(config)# ssh version 2

ciscoasa(config)# show run user
username admin password eY/fQXw7Ure8Qrz7 encrypted

R-1-acting-PC-#
R-1-acting-PC-#ssh -l admin 192.168.1.1
Password:

ciscoasa>
ciscoasa> enable
Password:
ciscoasa# show run user
username admin password eY/fQXw7Ure8Qrz7 encrypted privilege 15
ciscoasa# show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0 192.168.1.1 YES manual up up
GigabitEthernet1 12.12.12.1 YES manual up up

Logoff

[Connection to 192.168.1.1 closed by foreign host]

R-1-acting-PC-#

in the third lab, we are going to configure a dedicated management interface

Topology:-

configure the topology as per the diagram
configure the IP addresses as per the topology
configure the zone inside and outside
configure the IP address on the dedicated management interface for management traffic.
configure the IP address on normal fastethernet 0/0 for normal data traffic
configure talent for access to the ASA firewall

ciscoasa(config)# username admin password admin
ciscoasa(config)# telnet 192.168.1.0 255.255.255.0 inside

R1#telnet 192.168.1.1 /source-interface fastEthernet 0/0
Trying 192.168.1.1 ... Open

User Access Verification
Password:

ciscoasa> enable
Password:

ciscoasa# show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES unset administratively down up
GigabitEthernet0/1 unassigned YES unset administratively down down
GigabitEthernet0/2 unassigned YES unset administratively down down
GigabitEthernet0/3 unassigned YES unset administratively down down
GigabitEthernet0/4 unassigned YES unset administratively down down
GigabitEthernet0/5 unassigned YES unset administratively down down
GigabitEthernet0/6 unassigned YES unset administratively down down
Management0/0 192.168.1.1 YES manual up up

in the fourth lab, we are going to configure the ASDM

Topology:-

configure the topology as per the diagram
configure the IP addresses as per the topology
configure the zone inside and outside
configure IP address VMware net interface on PC-1
configure SSH on Cisco ASA
configure ASDM and access the ASA with GUI ASA.

C:\Users\Dell>ipconfig
Ethernet adapter VMware Network Adapter VMnet9:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::7827:ff4c:a645:b047%19
IPv4 Address. . . . . . . . . . . : 192.168.1.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1

C:\Users\Dell>ping 192.168.1.1
Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes=32 time=7ms TTL=255
Reply from 192.168.1.1: bytes=32 time=3ms TTL=255
Reply from 192.168.1.1: bytes=32 time=2ms TTL=255
Reply from 192.168.1.1: bytes=32 time=3ms TTL=255
Ping statistics for 192.168.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 7ms, Average = 3ms

(configure the IP address on the management 0/0 interface )

(enabling the HTTP server and configure username and password)

(now start the ASDM )

If you like this blog, please visit our YouTube channel https://www.youtube.com/@internetworkss . if you have any issues with these labs please let me know. I think ASDM might be complicated for many of us because pictures can be confusing and missing steps. let me know I will make the video and upload it on our YouTube channel.

What is Cisco IOS Zone Based Firewall on router? How to configure ZBF on Cisco Routers?

2024-06-18T11:15:00.006+05:30

Zone Based Firewall

ZBF (Zone Based Firewall) is the stateful firewall that is available on Cisco IOS routers, introduced in 2006. ZBF supports deep packet inspection just like an ASA. ZBF works based on the concept of security zones. You can name the zones whatever you want. In ZBF we don’t assign access-list to the interface. We create zones and the interface will be configured to the different zones (one interface can only be a member of one zone) and security policies will be assigned. The default policy is to block all the traffic unless we explicitly allow it.

Zone-Based Model: Interfaces are assigned to zones, and inspection policy is applied to traffic moving between these zones.
Flexible Configuration: Allows for more granular control of traffic based on zones rather than just interfaces.
Stateful Inspection: Maintains the state of active sessions and inspects traffic accordingly.
Successor to CBAC: ZBF is considered the successor to Context-Based Access Control (CBAC), offering enhanced security features.

let's see the configuration on ZBF:-

Topology:-

Goal:

configure the topology as per the topology
assign IP addresses as per the topology
configure EIGRP 100 and advertise all the interfaces
configure router-2 for ZBF.
configure zones INSIDE for LAN and OUTSIDE zone for internet
configure ACL extended
allow PC 2 to ping server 30.1.1.11
allow telnet from INSIDE
leave rest for the default
verify the configurations telnet, ping, and show commands.

(first, configure the IP addresses on PC-1 and PC-2 inside the zone)

PC1> ip 10.1.1.10 255.0.0.0 10.1.1.1
Checking for duplicate address...
PC1 : 10.1.1.10 255.0.0.0 gateway 10.1.1.1

PC1> show ip
NAME : PC1[1]
IP/MASK : 10.1.1.10/8
GATEWAY : 10.1.1.1
DNS :
MAC : 00:50:79:66:68:00
LPORT : 10026
RHOST:PORT : 127.0.0.1:10027
MTU: : 1500

PC2> ip 10.1.1.11 255.0.0.0 10.1.1.1
Checking for duplicate address...
PC1 : 10.1.1.11 255.0.0.0 gateway 10.1.1.1

PC2> show ip
NAME : PC2[1]
IP/MASK : 10.1.1.11/8
GATEWAY : 10.1.1.1
DNS :
MAC : 00:50:79:66:68:01
LPORT : 10028
RHOST:PORT : 127.0.0.1:10029
MTU: : 1500

PC1> ping 10.1.1.11
84 bytes from 10.1.1.11 icmp_seq=1 ttl=64 time=0.583 ms
84 bytes from 10.1.1.11 icmp_seq=2 ttl=64 time=0.495 ms
84 bytes from 10.1.1.11 icmp_seq=3 ttl=64 time=0.511 ms
84 bytes from 10.1.1.11 icmp_seq=4 ttl=64 time=0.780 ms
84 bytes from 10.1.1.11 icmp_seq=5 ttl=64 time=0.759 ms

Configure the IP addresses between the routers and LAN interfaces

R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface serial 4/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit

R2(config)#interface serial 4/0
R2(config-if)#ip address 192.168.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface serial 4/1
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit

R3(config)#interface serial 4/1
R3(config-if)#ip address 192.168.2.2 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit

R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#exit

Configure the IP addresses on server-1 and server-2 in the outside zone

server2> ip 30.1.1.10 255.0.0.0 30.1.1.1
Checking for duplicate address...
PC1 : 30.1.1.10 255.0.0.0 gateway 30.1.1.1

server2> show ip
NAME : server2[1]
IP/MASK : 30.1.1.10/8
GATEWAY : 30.1.1.1
DNS :
MAC : 00:50:79:66:68:04
LPORT : 10034
RHOST:PORT : 127.0.0.1:10035
MTU: : 1500

server> ip 30.1.1.11 255.0.0.0 30.1.1.1
Checking for duplicate address...
PC1 : 30.1.1.11 255.0.0.0 gateway 30.1.1.1

server> show ip
NAME : server[1]
IP/MASK : 30.1.1.11/8
GATEWAY : 30.1.1.1
DNS :
MAC : 00:50:79:66:68:05
LPORT : 10036
RHOST:PORT : 127.0.0.1:10037
MTU: : 1500

Configure routing between routers and advertise directly connected interfaces

R1(config)#router eigrp 100
R1(config-router)#network 192.168.1.0
R1(config-router)#network 10.0.0.0
R1(config-router)#no auto-summary
R1(config-router)#exit

R2(config)#router eigrp 100
R2(config-router)#network 192.168.1.0
R2(config-router)#network 192.168.2.1
R2(config-router)#no auto-summary
R2(config-router)#exit

R3(config)#router eigrp 100
R3(config-router)#network 192.168.2.0
R3(config-router)#network 30.0.0.0
R3(config-router)#no auto-summary
R3(config-router)#exit

verify the connectivity with ping from PC-1 to server-1

PC1> show ip
NAME : PC1[1]
IP/MASK : 10.1.1.10/8
GATEWAY : 10.1.1.1

PC1> ping 30.1.1.10
84 bytes from 30.1.1.10 icmp_seq=1 ttl=61 time=115.597 ms
84 bytes from 30.1.1.10 icmp_seq=2 ttl=61 time=94.468 ms
84 bytes from 30.1.1.10 icmp_seq=3 ttl=61 time=94.519 ms
84 bytes from 30.1.1.10 icmp_seq=4 ttl=61 time=78.793 ms
84 bytes from 30.1.1.10 icmp_seq=5 ttl=61 time=78.209 ms

As you can see the connectivity is good, now configure the telnet config on router-1 and router-2 for testing do not configure the login password.

R1(config)#line vty 0 4
R1(config-line)#no login
R1(config-line)#exit

*Jun 17 11:54:55.771: %SYS-5-CONFIG_I: Configured from console by console
R1#telnet 192.168.2.2
Trying 192.168.2.2 ... Open

R3>
R3>
R3>
R3>

Our inside router-1 can telnet router-3, same way configure telnet on router-3

R3(config)#line vty 0 4
R3(config-line)#lo
R3(config-line)#no login
R3(config-line)#exit
R3(config)#end
R3#
R3#
R3#telnet 192.168.1.1
Trying 192.168.1.1 ... Open
R1>
R1>
R1>
R1>

Now configure zone name INSIDE for our LAN traffic and OUTSIDE zone

R2(config)#zone security INSIDE
R2(config-sec-zone)#exit
R2(config)#zone security OUTSIDE
R2(config-sec-zone)#exit

R2(config)#interface serial 4/0
R2(config-if)#zone-member security INSIDE
R2(config-if)#exit

R2(config)#interface serial 4/1
R2(config-if)#zone-member security OUTSIDE
R2(config-if)#exit

the default policy is to block all the traffic unless we explicitly allow it. so now configure ACL and permit 10.1.1.11 to ping and permit 10.1.1.1 for telnet.

R2(config)#ip access-list extended 150
R2(config-ext-nacl)#permit icmp host 10.1.1.11 any echo
R2(config-ext-nacl)#permit tcp host 10.1.1.1 host 30.1.1.1 eq telnet
R2(config-ext-nacl)#exit

R2#show access-lists 150
Extended IP access list 150
10 permit icmp host 10.1.1.11 any echo (3 matches)
30 permit tcp host 10.1.1.1 host 30.1.1.1 eq telnet (1 match)

configure a class map to classify the traffic for inspected

R2(config)#class-map type inspect INSIDE-OUTSIDE-CLASS
R2(config-cmap)#match access-group 150

R2(config-cmap)#exit

configure policy map to define ZBF policies on classified traffic

R2(config)#policy-map type inspect INSIDE-OUTSIDE-POLICY
R2(config-pmap)#class type inspect INSIDE-OUTSIDE-CLASS
R2(config-pmap-c)#inspect
R2(config-pmap-c)#exit
R2(config-pmap)#exit

configure zone pair

R2(config)#zone-security INSIDE-OUTSIDE-PAIR source INSIDE destination OUTSIDE
R2(config-sec-zone-pair)#service-policy type inspect INSIDE-OUTSIDE-POLICY
R2(config-sec-zone-pair)#exit

from router-1 try to access router-3 with telnet

R1#telnet 30.1.1.1 telnet /source-interface fastEthernet 0/0
Trying 30.1.1.1 ... Open
R3>
R3>
R3>
R3>show ip interface br
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 30.1.1.1 YES manual up up
Serial4/1 192.168.2.2 YES manual up up

as you can see router-1 can access router-3 remotely with telnet, because we allow it

R3#telnet 10.1.1.1 /source-interface fastEthernet 0/0
Trying 10.1.1.1 ...
% Connection timed out; remote host not responding

but router-3 can not access router-1 with telnet because we didn't allow it. by default, all the traffic is blocked.

PC1> show ip
NAME : PC1[1]
IP/MASK : 10.1.1.10/8
GATEWAY : 10.1.1.1

PC1> ping 30.1.1.11
30.1.1.11 icmp_seq=1 timeout
30.1.1.11 icmp_seq=2 timeout
30.1.1.11 icmp_seq=3 timeout
30.1.1.11 icmp_seq=4 timeout
30.1.1.11 icmp_seq=5 timeout

from the above output, you see that PC-1 can not ping servers because we didn't allow it. we allow PC-2 10.1.1.11 too ping any network

PC2> show ip
NAME : PC2[1]
IP/MASK : 10.1.1.11/8
GATEWAY : 10.1.1.1

PC2> ping 30.1.1.11
84 bytes from 30.1.1.11 icmp_seq=1 ttl=61 time=127.289 ms
84 bytes from 30.1.1.11 icmp_seq=2 ttl=61 time=94.466 ms
84 bytes from 30.1.1.11 icmp_seq=3 ttl=61 time=94.540 ms
84 bytes from 30.1.1.11 icmp_seq=4 ttl=61 time=93.967 ms
84 bytes from 30.1.1.11 icmp_seq=5 ttl=61 time=94.784 ms

R2#show zone-pair security
Zone-pair name INSIDE-OUTSIDE-PAIR
Source-Zone INSIDE Destination-Zone OUTSIDE
service-policy INSIDE-OUTSIDE-POLICY

R2#show access-lists 150
Extended IP access list 150
10 permit icmp host 10.1.1.11 any echo (3 matches)
30 permit tcp host 10.1.1.1 host 30.1.1.1 eq telnet (1 match)

R2#show zone security INSIDE
zone INSIDE
Member Interfaces:
Serial4/0

R2#show zone security OUTSIDE
zone OUTSIDE
Member Interfaces:
Serial4/1

if you like this blog please visit to our YouTube channel https://www.youtube.com/@internetworkss

What are TACACS+ RADIUS and Diameter protocols? How to configure TACACS+ RADIUS in cisco packet tracer? CCNA security

2024-06-15T15:10:00.001+05:30

What are TACACS+ RADIUS and Diameter protocols?

TACACS+ RADIUS and Diameter is a protocol to provide a centralized management system for AAA Authentication, Authorization, and Accounting. An ACS (Access Control Server) supports RADIUS and TACACS+ protocols and is commonly used in enterprise environments. TACACS+, RADIUS, and Diameter have some key differences. (if you are not familiar with AAA please click here )

Types of AAA Protocols

Terminal access controller access-control system plus (TACACS+)
Remote authentication dial-in user service (RADIUS)
Diameter

TACACS+ (Terminal Access Controller Access Control System) is an enhancement to TACACS developed by Cisco. Which means TACACS+ is Cisco's proprietary protocol. TACACS+ is mainly used for device administration using ACS (Access Control Server). TACACS+ is used for the communication between the client and the Cisco ACS server. TACACS+ is a reliable protocol because it uses TCP port 49 for communication and the TACACS+ communication is encrypted means all the packets is encrypted. TACACS+ provides more control over accounting and authorization. TACACS+ combines authentication and authorization in one step.

Remote Access Dial-In User Service (RADIUS) is the IEFT standard protocol. The RADIUS protocol is used for communication between any vendor (cisco or non-cisco) AAA client and ACS server. If you are using multiple vendors devices then you can use RADIUS. In RADIUS communication is faster but a bit less reliable uses UDP port 1645/1812 for authentication and 1646/1813 for accounting. In a single process authentication and authorization can be done. RADIUS key with MD5 is used to hide the user password.

The Diameter protocol is a AAA protocol that works with Long-Term Evolution (LTE) and multimedia networks. Diameter is an advanced Authentication, Authorization, and Accounting (AAA) protocol that evolved from the earlier RADIUS protocol. It’s part of the application layer protocols in the Internet protocol suite.

let's see the configuration of the AAA TACACS+ and RADIUS server:

Topology:-

Goal: TACACS+

configure the topology as per the diagram
configure the IP addresses as per the topology
configure dynamic routing between the network
configure AAA authentication and key internet same for both (router and server)
verify with telnet from PC-1 192.168.10.30
configure RADIUS server
verify with telnet from remote PC- 192.168.30.10

ROUTER-1(config)#interface gigabitEthernet 0/1
ROUTER-1(config-if)#ip address 192.168.10.1 255.255.255.0
ROUTER-1(config-if)#no shutdown
ROUTER-1(config-if)#exit

ROUTER-1(config)#interface gigabitEthernet 0/0
ROUTER-1(config-if)#ip address 192.168.20.1 255.255.255.0
ROUTER-1(config-if)#no shutdown
ROUTER-1(config-if)#exit

ROUTER-2(config)#interface gigabitEthernet 0/0
ROUTER-2(config-if)#ip address 192.168.20.2 255.255.255.0
ROUTER-2(config-if)#no shutdown
ROUTER-2(config-if)#exit

ROUTER-2(config)#interface gigabitEthernet 0/1
ROUTER-2(config-if)#ip address 192.168.30.1 255.255.255.0
ROUTER-2(config-if)#no shutdown
ROUTER-2(config-if)#exit

ROUTER-1(config)#router eigrp 100

ROUTER-1(config-router)#network 192.168.10.0

ROUTER-1(config-router)#network 192.168.20.0

ROUTER-1(config-router)#no auto-summary

ROUTER-1(config-router)#exit

%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.20.1 (GigabitEthernet0/0) is up: new adjacency

ROUTER-2(config)#router eigrp 100

ROUTER-2(config-router)#network 192.168.20.0

ROUTER-2(config-router)#network 192.168.30.0

ROUTER-2(config-router)#no auto-summary

ROUTER-2(config-router)#exit

%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.20.1 (GigabitEthernet0/0) is up: new adjacency

ROUTER-1(config)#username admin password internet
ROUTER-1(config)#tacacs-server host 192.168.10.10
ROUTER-1(config)#tacacs-server key cisco123

ROUTER-1(config)#aaa new-model
ROUTER-1(config)#aaa authentication login cisco123 group tacacs+ local

ROUTER-1(config)#line console 0
ROUTER-1(config-line)#login authentication cisco123
ROUTER-1(config-line)#exit
ROUTER-1(config)#end

User Access Verification

Username: user1

Password:

ROUTER-1>

ROUTER-1>password is user1

C:\>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::2D0:D3FF:FEBA:44B2

IP Address......................: 192.168.10.30

Subnet Mask.....................: 255.255.255.0

Default Gateway.................: 192.168.10.1

(let's create another user with the name user2 and password user2)

(now verify with telnet from PC- 192.168.10.30)

ROUTER-1#show aaa sessions

Total sessions since last reload: 3

Session Id:4

Unique Id:4

User Name:user2

IP Address:192.168.10.30

Idle Time: 0

CT Call Handle: 0

now see the configuration of the RADIUS server with the same topology:

check the connectivity between the radius server and PC 192.168.30.10

configure router 2 to use external server RADIUS

configure the password the same as the previous lab.

ROUTER-2>enable

ROUTER-2(config)#username admin password cisco123
ROUTER-2(config)#radius-server host 192.168.10.20
ROUTER-2(config)#radius-server key cisco123

ROUTER-2(config)#aaa new-model
ROUTER-2(config)#aaa authentication login cisco123 group radius local

ROUTER-2(config)#line consol 0
ROUTER-2(config-line)#login authentication cisco123
ROUTER-2(config-line)#exit

ROUTER-2(config)#line vty 0 4
ROUTER-2(config-line)#login authentication cisco123
ROUTER-2(config-line)#exit

User Access Verification

Username: admin1
Password:
ROUTER-2>enable

C:\>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::201:42FF:FEB5:6E2E

IP Address......................: 192.168.30.10

Subnet Mask.....................: 255.255.255.0

Default Gateway.................: 192.168.30.1

(now everything is working fine but as see we configure backup authentication on local routers, so let down the RADIUS server and verify the backup authentication)

now let's verify with telnet from PC 192.168.30.10

as you can see our task is completed and everything is fine. if you like this blog please visit our YouTube channel https://www.youtube.com/@internetworkss

What is AAA Authentication, Authorization, and Accounting? What is ACS server? Cyber security

2024-06-13T20:41:00.006+05:30

What is AAA Authentication, Authorization, and Accounting?

Authentication, Authorization, and Accounting (AAA) is a standard-based framework that provides a set of security services. Which device or computer is permitted to use the network resources with the help of AAA authentication and what they are allowed to do means use the internet or access CLI with telnet or SSH through AAA authorization and AAA accounting captures all the information about that particular user means time and date and what actions user performed while accessing the network. AAA combined process is essential for our network security, AAA helps us to ensure that only authorized users can access network resources and AAA also records the actions performed by the user in the network.

Authentication-

Authentication is the process by which AAA identifies the user, a user wants permission to use the network resource and AAA authentication asks for some credentials such as username and password, USB key, or fingerprint. Now AAA system verifies these credentials against a database to identify the authenticated user. If the user-provided credentials match with the AAA database credentials the user is authenticated and if the credentials do not match then the user can not use the network resources. You can use the local database for AAA authentication on route or a switch but for big organizations, you must use an external server such as the ACS server. Authentication is a must for network access or device access.

Authorization

An authenticated user gained access after the authentication process now AAA authorization means what resources that particular user is allowed to access and what action the user can perform. For example, if a member of the IT team's junior network engineer wants to access the router and configure some routing configuration but this user should not access all these resources the administrator can create a view and allow show commands and ping commands only in that view. Now the junior network engineer is only authorized to perform show commands and ping commands. The administrator can use authorization methods how the user is authorized for network resources through the local database or ACS server.

Accounting

AAA accounting monitors and captures user activity, while the user is logged in to the network. Accounting collects information on how long the user is active in the network, the data the user sends or receives, the IP address, the URI they used, and the different services the user accessed. Accounting is very useful for analyzing user activity.

AAA implementation

AAA implementation can be done by using the local database on devices such as routers or switches. We can also implement AAA with an external server like an ACS access control server. If you have a small number of devices then you can use the local database on the router but if you have a big organization then use an external server such as ACS.

Let’s take the overview of both methods:

Local database

Local database- we can implement an AAA local database on a router or a switch. We should create user authentication for each user, then configure AAA authorization to assign privilege levels for each user to define what this user is authorized for and what commands this user can execute on the device. After that configure AAA accounting for the device to log user activities like login time and the commands users execute.

ACS Server

External server ACS is the most common method used for AAA implementation in the network. First authentication- a user or device like a printer sends an authentication request to the ACS server, ACS holds the user credentials and compares them to the database. Second authorization ACS server provides information about the network and what resources the user can access. Third accounting ACS server records user actions and generates reports.

Types of AAA Protocols

Remote authentication dial-in user service (RADIUS)
Terminal access controller access-control system plus (TACACS+)
Diameter

(in the next blog we will see AAA protocols and the ACS server)

Let's see the configuration of the AAA Local database:

Topology:

Goal:

configure the IP addresses as per the topology
ensure the reachability between the PC and router
configure AAA authentication with local database
configure AAA authentication list name (internet)
configure login authentication on console and line vty
verify the authentication from PC

Router(config)#interface gigabitEthernet 0/0
Router(config-if)#ip address 10.1.1.1 255.0.0.0
Router(config-if)#no shutdown
Router(config-if)#exit

Router(config)#username admin password admin

Router(config)#aaa new-model
Router(config)#aaa authentication login internet local
Router(config)#line console 0
Router(config-line)#login authentication internet
Router(config-line)#exit

Router(config)#line vty 0 4
Router(config-line)#login authentication internet
Router(config-line)#exit
Router(config)#end
Router#exit

Router con0 is now available

User Access Verification

Username: admin
Password:
Router>enable
Router#show aaa sessions
Total sessions since last reload: 3

(IF YOU LIKE THIS BLOG PLEASE VISIT OUR YOUTUBE CHANNEL https://www.youtube.com/@internetworkss

Internetworks

IPv6 eBGP and iBGP

IPv6 iBGP: The Internal Fabric

IPv6 eBGP: Crossing the Border

All the methods of Default route Injection in EIGRP

DMVPN Phase 2 Dynamic Mapping

Route Map Redistribution and configuration

Why use a route map for redistribution?

The simple idea of using a route map in redistribution

R3(config)#interface fastethernet 0/0R3(config-if)#ip address 30.1.1.1 255.0.0.0R3(config-if)#no shutdownR3(config-if)#no keepaliveR3(config-if)#exit

IPv6 Redistribution between EIGRPv3, OSPFv3 and RIPng

**IPv6 Route Redistribution**

Let's see the configuration:-

R3#show ipv6 interface briefFastEthernet0/0 [administratively down/down] unassignedATM1/0 [administratively down/down] unassignedFastEthernet2/0 [up/up] FE80::C803:A5FF:FE68:38 FC00:3333:3333:3333::1FastEthernet3/0 [up/up] FE80::C803:A5FF:FE68:54 2001:2233:2233:2233::2

R1(config)#ipv6 router eigrp 65100R1(config-rtr)#no shutdownR1(config-rtr)#router-id 11.11.11.11R1(config-rtr)#exit

R1(config)#interface fastethernet 0/0R1(config-if)#ipv6 eigrp 65100R1(config-if)#exit

R1(config)#interface fastethernet 2/0R1(config-if)#ipv6 eigrp 65100R1(config-if)#exitR2(config)#ipv6 router eigrp 65100R2(config-rtr)#no shutdownR2(config-rtr)#router-id 22.22.22.22R2(config-rtr)#exit

R2(config)#interface fastethernet 0/0R2(config-if)#ipv6 eigrp 65100R2(config-if)#exit (adsbygoogle = window.adsbygoogle || []).push({});

R2(config)#IPv6 router ospf 100R2(config-rtr)#router-id 22.22.22.22R2(config-rtr)#exitR2(config)#interface fastethernet 2/0R2(config-if)#ipv6 ospf 100 area 0R2(config-if)#exitR2(config)#interface fastethernet 3/0R2(config-if)#ipv6 ospf 100 area 0R2(config-if)#exit

IPv6 EIGRP: The Next-Generation Routing Protocol

IPv6 EIGRP: The Next-Generation Routing Protocol

What is IPv6 EIGRP?

Key Advantages

Configuration Highlights

Cisco IP Source Guard (IPSG) and configuration

What is OSPFv3 IPsec authentication? How to configure OSPFv3 authentication?

What are the benefits?

How does it work?

2. IPsec profile ( the scalable method)

IPv6 Static, Default, and Dynamic routing lab

What is an Offset-list? How to configure EIGRP Offset-list?

What is an Offset-list?

Why would you use one?

What is IP prefix-list? How to configure IP prefix-list?

OSPF DR and BDR Explained: The Hidden Heroes of Network Efficiency.

In this blog post, we’ll uncover:

R4(config)#interface fastethernet 0/0R4(config-if)#ip address 192.168.10.4 255.255.255.0R4(config-if)#no shutdownR4(config-if)#exitR4(config)#interface loopback 1R4(config-if)#ip address 10.1.1.4 255.255.255.0R4(config-if)#exit

R4(config)#router ospf 1R4(config-router)#router-id 192.168.1.4R4(config-router)#network 192.168.1.0 255.0.0.0 area 0R4(config-router)#network 10.1.1.0 255.0.0.0 area 0R4(config-router)#exit

What is OSPFv2 (Open Shortest Path First version 2) subcommand?

What is a VLAN Hopping Attack?

What is a VLAN Hopping Attack?

In this blog, we’ll explore:

What is VLAN Hopping?

How Does VLAN Hopping Work?

There are two main methods attackers use to perform VLAN hopping:

Attack Scenario:

Attack Scenario:

How to Prevent VLAN Hopping Attacks

Use a Dedicated Native VLAN

Enable Port Security

Disable Unused Ports

Implement Private VLANs (PVLANs)

Conclusion

What is BGP Allowas-in Feature? How to configure BGP Allowas-in? GNS3

What is BGP route dampening? How to configure BGP route Dampening?

What is uplinkfast?

Here's how it works:

What is layer 3 etherchannel? How to configure layer 3 etherchannel?

What is PPP PAP and CHAP? How to configure PPP PAP CHAP authentication?

WAN Protocols

{Second lab of PAP}

How to configure the DHCP server on a Cisco ASA device?

How to configure the DHCP server on a Cisco ASA device?

What is Cisco Management VLAN? How to configure VLAN management? | CCNA Security

What is a Management VLAN?

Topology:-

if you like this blog please visit our YouTube channel https://www.youtube.com/@internetworkss

Cisco ASA access management with ASDM, SSH, telnet and dedicated management interface.

Cisco ASA supports In-band management and Out-band management.

let's see the configuration of all the methods to access the ASA firewall,

in the second lab, we are going to configure the Secure Shell

Topology:-

in the third lab, we are going to configure a dedicated management interface

Topology:-

in the fourth lab, we are going to configure the ASDM

What is Cisco IOS Zone Based Firewall on router? How to configure ZBF on Cisco Routers?

Zone Based Firewall

Topology:-

(first, configure the IP addresses on PC-1 and PC-2 inside the zone)

Configure the IP addresses between the routers and LAN interfaces

R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#no keepalive
R3(config-if)#exit

IPv6 Route Redistribution

R3#show ipv6 interface brief
FastEthernet0/0 [administratively down/down]
unassigned
ATM1/0 [administratively down/down]
unassigned
FastEthernet2/0 [up/up]
FE80::C803:A5FF:FE68:38
FC00:3333:3333:3333::1
FastEthernet3/0 [up/up]
FE80::C803:A5FF:FE68:54
2001:2233:2233:2233::2

R1(config)#ipv6 router eigrp 65100
R1(config-rtr)#no shutdown
R1(config-rtr)#router-id 11.11.11.11
R1(config-rtr)#exit

R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

R2(config)#ipv6 router eigrp 65100
R2(config-rtr)#no shutdown
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 eigrp 65100
R2(config-if)#exit

R2(config)#IPv6 router ospf 100
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit

R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 ospf 100 area 0
R2(config-if)#exit

R2(config)#interface fastethernet 3/0
R2(config-if)#ipv6 ospf 100 area 0
R2(config-if)#exit

R4(config)#interface fastethernet 0/0
R4(config-if)#ip address 192.168.10.4 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#interface loopback 1
R4(config-if)#ip address 10.1.1.4 255.255.255.0
R4(config-if)#exit

R4(config)#router ospf 1
R4(config-router)#router-id 192.168.1.4
R4(config-router)#network 192.168.1.0 255.0.0.0 area 0
R4(config-router)#network 10.1.1.0 255.0.0.0 area 0
R4(config-router)#exit