So it's that time again for me to renew my Cisco Certifications. As a result, this post will be based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Named EIGRP Configuration and Verification
Topology
Internet
- Interface e1/0 - connected to ISP1 - IPv6 2001::1/64
- Interface e1/1 - connected to ISP2 - IPv6 2002::1/64
- Interface lo3 - INTERNET ADDRESS - IPv6 2003::1/128
ISP1
- Interface e1/0 - connected to ISP1 - IPv6 2001::2/64
- Interface e1/1 - connected to ISP2 - IP IPv6 2005::1/64
ISP2
- Interface e1/0 - connected to ISP1 - IP IPv6 2002::1/64
- Interface e1/1 - connected to ISP2 - IP IPv6 2004::1/64
LOCAL_SITE
- Interface e1/0 - connected to ISP2 - IPv6 2004::2/64
- Interface e1/1 - connected to ISP1 - IPv6 2005::2/64
- Interface fa0/0 - connected to LAN - IPv6 200a::1/64
Kali Host on Local_site
eth0 - IPv6 200a::2/64
Default Gateway - IPv6 200a::1/64
enable ipv6 routing
configuration:
Internet:
Named EIGRP Config
ISP-1:
|
ISP-2:
Local_Site:
Verification of Configuration:
Looking at the routing table
Looks like the routes were successfully learnt
Taking a look at the neighbor table
Looks like we've successfully lerarnt of 2 neighbors
Topology table looks stable as we currently have all routes in "P" which means passive
Looking from the end client's perspective.
Ping looks successful
Let's, try traceroute.
Traceroute was successful. I take this to mean everything is good with the Named EIGRP config.
That's it for my CCNP studies. Hope you enjoyed this.
Reference:
http://www.cisco.com/c/dam/en/us/products/collateral/ios-nx-os-software/enhanced-interior-gateway-routing-protocol-eigrp/Advances_In_EIGRP.pdf
https://supportforums.cisco.com/blog/11939146/glimpse-eigrp-name-mode-configuration
So it's that time again for me to renew my Cisco Certifications. As a result, this post will be based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Named EIGRP
EIGRP IPv6 and Named EIGRP
- Major difference between EIGRP IPv4 and EIGRP named configuration is how interfaces are configured to participate in EIGRP
- Configuration uses a hierarchical model
- All commands are entered in one place
- Named EIGRP requires fewer commands than regular EIGRP
Differences between EIGRP IPv4 and EIGRP IPv6
- EIGRP IPv6 advertises prefixes not subnet/mask
- Uses neighbor's link local address as next hop
- messages are encapsulates in IPv6 packets
- Cannot perform route summarisation, since there is no concept of route summarization
- Neighbors does not have to be in the same subnet IPv6 subnets to become neighbors
Configuration
- enable ipv6 unicast-routing
- ipv6 router eigrp 10
- Configure address on each interface
- ipv6 enable
- enable on the interface ipv6 eigrp 10
- stop and start process with shutdown or no shutdown
- configure router id
- the EIGRP process must have a router-id or the process won't start
- All connected subnets are advertised except link-local addresses and local routes
- Link local addresses are used to source Hello packets
- Uses multicast address
- Link Local address is never route
- Link local addresses are automatically assigned when the interface is enabled
- Can be configured manually - use prefix FE80 with a prefix length of /10
Reference:
http://www.cisco.com/c/dam/en/us/products/collateral/ios-nx-os-software/enhanced-interior-gateway-routing-protocol-eigrp/Advances_In_EIGRP.pdf
https://supportforums.cisco.com/blog/11939146/glimpse-eigrp-name-mode-configuration
So it's that time again for me to renew my Cisco Certifications. As a result, this post will be based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Cisco CEF
Router planes
- Management Plane
Used for device management SSH, Telnet, HTTPS, etc
- Control Plane
- Used for making forwarding decisions. Used by routing protocols
- Data Plane
- Used for forwarding data
- Control and data plane influcence how fast traffic can pass through a router
Cisco Packet switch modes
- Process switching
- Routing of packets
- CPU becomes involved
- Process switching is enabled by disabling fast switching using "no ip route cache"
- Fast switching
- Dramatically reduces CPU utilzation
- Fast switching uses fast cache
- Fast cache is found on the data plane
- Cisco Express Forwarding (CEF)
- maintains two tables in the data plane
- FIB - maintains layer 3 information
- adjacency - maintains layer 2 information
- The above tables are populated from the IP routing table and ARP cache
- Does not require the first packet to be processed switch
- entire flow can be forwarded at the data plane
- Enabed by default
- use "ip cef" to enable CEF globally
- can be enabed on the interface by "ip route-cache cef"
- if output states "attached" the network is directly attached
- if output states "receive" the entry is an IP address on the router interface
Policy Based Routing (PBR)
- Overrides the default destination based forwarding
- operates before the CEF table gets involved
- uses route map (uses access list)
- verify config using
- show ip policy
- show route-map
- "default" keyword tells PBR to try default logic which is destination first. Only use PBR when default fails
References:
CCNP official Cert Guide - CCNP Routing and Switching - Route 300-101
http://www.cisco.com/c/en/us/td/docs/ios/12_2/switch/configuration/guide/fswtch_c/xcfcef.html
http://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/17812-cef-incomp.html
So it's that time again for me to renew my Cisco Certifications. As a result, this post will be based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Route Redistribution
Route Redistribution
- Used to take route learned from one routing protocol and inject it into another
- Can be done within the same protocol where different autonomous numbers are used
- must have at a minimum 1 physical interface in each domain
- Uses the "redistribute" command with options
- protocol - the source routing protocol
- process-id - for routing protocols which uses process id
- metric - include bandwidth, delay, etc
- match - matches internal OSPF routes
- tag - unitless integer to redistributed routes
- route-map - used for logic in the referenced route map
- Only information in the routing table is used
- Redistributed routes are treated as external routes
Redistributing EIGRP into OSPF and vice versa
- OSPF creates a type 5 LSA to represent each route
- Type 7 used when redistributed into a not-so-stubby area (NSSA)
- OSPF uses an integer metric
- Route filtering and route summarization can be used at the redistribution router
- when redistributing OSPF into EIGRP the metric must be set using either of:
- default-metric
- metric
- route-map
- Can use "redistribute ospf 1 metric 10000 33 255 1 1500"
- External routes are flagged with EX
- OSPF has its own default metric for redistributing EIGRP routes
- OSPF external routes are either type 1 (E1) or type 2 (E2)
- By default OSPF create type 2 (E2) when redistributing
E1 vs E2 routes
- E2 routes uses external cost only
- E1 routes uses both internal and external cost
- OSPF prefers E1 over E2 when given a prefix/length
When Route Redistribution is not possible?
- Stubby and totally stubby areas cannot do redistribute external routes
References:
CCNP official Cert Guide - CCNP Routing and Switching - Route 300-101
http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/8606-redist.html
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_rip/configuration/xe-3s/irr-xe-3s-book/ip6-rip-route-redist-xe.pdf
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_rip/configuration/15-mt/irr-15-mt-book/ip6-rip-route-redist.html
So it's that time again for me to renew my Cisco Certifications. As a result, this post will is based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Configuring and Verifying RIPng
Topology
Internet
- Interface e1/0 - connected to ISP1 - IPv6 2001::1/64
- Interface e1/1 - connected to ISP2 - IPv6 2002::1/64
- Interface lo3 - INTERNET ADDRESS - IPv6 2003::1/128
ISP1
- Interface e1/0 - connected to ISP1 - IPv6 2001::2/64
- Interface e1/1 - connected to ISP2 - IP IPv6 2005::1/64
ISP2
- Interface e1/0 - connected to ISP1 - IP IPv6 2002::1/64
- Interface e1/1 - connected to ISP2 - IP IPv6 2004::1/64
LOCAL_SITE
- Interface e1/0 - connected to ISP2 - IPv6 2004::2/64
- Interface e1/1 - connected to ISP1 - IPv6 2005::2/64
- Interface fa0/0 - connected to LAN - IPv6 200a::1/64
Kali Host on Local_site
eth0 - IPv6 200a::2/64
Default Gateway - IPv6 200a::1/64
Now that we have our topology in place, the first thing is to enable "ipv6 unicast-routing". This will need to be enabled on all routers in the topology.
Next, let's enable RIPng
Interface and RIPng Configuration:
In RIP version 1 and 2, to enable an interface to participate in the RIP network, we used the "network" command. In RIPng, RIP is enabled on the interface with "IPv6 rip" RIP Network "enable"
Internet
ISP-1:
ISP-2:
LOCAL_SITE:
Let's verify the configuration from LOCAL_SITE perspective:
From the 2 diagrams above, we see that interfaces e1/0, e1/1 and Fa0/0 are participating in the RIP network. We also see in the additional RIP information.
From above, we see the list of routes learned via RIPng.
Let's see if our end system (kali) can reach the internet 2003::1/128
From the above, we see we can successfully trace from our Kali host internet 2003::1
From the above, we also see we can successfully ping from our Kali host to internet 2003::1. I will take the results of traceroute and ping to conclude that RIPng is working as expected.
Lastly, let's peek into the RIP packet.
Above, we see a RIPng packet containing the networks being advertised to the Internet Router.
That's all for RIPng!!
So it's that time again for me to renew my Cisco Certifications. As a result, this posts is based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on IPv6 Review. In some of my previous posts, I've done work on IPv6. However, this will serve as a refresher. If you wish, you can go back to these for additional guidance.
IPv6 Header Format
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| Traffic Class | Flow Label |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Payload Length | Next Header | Hop Limit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Source Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Destination Address +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Key benefits of IPv6
- greater amount of addresses
- Multiple methods of dynamic address assignments, eg. DHCP and stateless autoconfiguration
- hosts can move around the network while retaining their addresses without loosing current session
- No need for NAT/PAT
- Built in IPSec support
- Improvements in the header such as no need for routers to calculate header checksum for each packet
Flow labels, which allows all packets sent across the same session to be easily identified
- No layer 3 broadcast. Instead multicast is used
Conventions
- 128-bit
- IPv6 uses 32 Hexadecmial numbers, organized into 8 quarters of 4 hex digits separated by a colon
2000:0000:0000:0000:0000:00A0:0000:0001
Hex Binary Table
Decimal Hex Binary
0 0 0000
1 1 0001
2 2 0010
3 3 0011
4 4 0100
5 5 0101
6 6 0110
7 7 0111
8 8 1000
9 9 1001
10 A 1010
11 B 1011
12 C 1100
13 D 1101
14 E 1110
15 F 1111
Conventions for shortening an IPv6 address
- Omit leading 0s
- represents one or more group of 0s with a "::". This can only be done once
- Using the example above (2000:0000:0000:0000:0000:00A0:0000:0001), we can reduce this as follows
2000::A0:0:1
2000:0:0:0:0:A0::1
if we used 2000::A0::1 - This would be INVALID as we cannot have two or more of "::"
IPv6 prefixes are often called IPv6 subnets
Dealing with prefixes
Address: 2000:0000:0000:0000:0000:00A0:0000:0001/64
The address above has a 64 bit prefix, this means that all hosts with the first 64 bits are in the same subnet. Thus we can rewrite the address as
2000:0000:0000:0000::/64 - I use "::" because the host part has now all become 0s.
Using a 56 bit prefix
2000:0000:0000:0000:0000:00A0:0000:0001/56
2000:0000:0000:0000::/56 - Once again "::" was used because the remainder bits are all 0s. However, even though we only used 56 bits we still have to write out the full quartet if our prefix does not fall on a 16-bit boundary
Using 3 bit prefix
2000:0000:0000:0000:0000:00A0:0000:0001/3
2000::/3 - Once again "::" was used because the remainder bits are all 0s. Remember we still have to write out the full quartet once we are not on a 16 bit boundary.
Using 26 bit prefix
2000:0000:0000:0000:0000:00A0:0000:0001/26
2000:0000::/26 - Once again "::" was used because the remainder bits are all 0s. Remember we still have to write out the full quartet once we are not on a 16 bit boundary.
Using 32 bit prefix
2000:0000::/32 - In this case we landed on a 16 bit boundarys
Subneting in IPv6
| n bits | m bits | 128-n-m bits |
+------------------------+-----------+----------------------------+
| global routing prefix | subnet ID | interface ID |
+------------------------+-----------+----------------------------+
2000:0000:0000:0000:0000:00A0:0000:0001/48
Before subneting the above has 80 bits for the host field. We will borrow from here for our subnet
No need to worry about the 0 or broadcast subnet in IPv6
This means "global routing prefix" = 2000:0000:0000
subnet ID (16 bits) = 0000
Interface ID (64 bits) = 0000:00A0:0000:0001
From the above we can create multiple subnets by changing the subnet value. eg, 00AD would give us an IPv6 address of
2000:0000:0000:00AD:0000:00A0:0000:0001/64
Likewise subnet ID of E02F = 2000:0000:0000:E02F:0000:00A0:0000:0001/64
Interface ID
- Interface IDs should be unique and thus are based on the interface MAC address
- Converts the 6 byte (48-bit) MAC address to an 8 byte (64-bit) value
- Using MAC address 01:02:03:04:05:06
first split the MAC into 2 3 byte portion - 01:02:03 and 04:05:06
Next in insert FFFE in the middle - 01:02:03:FF:FE:04:05:06
The above extended the 48-bit MAC address to 64-bit
Next to change to EUI-64 bit format, we flip the 7 bit in the leftmost byte
In the address "01:02:03:FF:FE:04:05:06" "01" would be the leftmost byte
01 (hex) = 0000 0001 (Binary)
The 7th bit is "0" when flipped it becomes "1"
New value = Binary: 0000 0011 or Hex 03
The new EUI-64 address is 03:02:03:FF:FE:04:05:06
The above host ID can now be assigned to any device
How IPv6 hosts obtain their IP, DNS, etc
- Stateful DHCP
Similar to DHCP in IPv4
Does not provide default router configuration
Relies on Neighbor Discovery Protocol which occurs between local routers and clients
Uses Stateful and Stateless configuration. In stateful, the server tracks and maintains lease information, in stateless it does not.
In IPv4 DHCP hosts send broadcast, in IPv6 hosts send IPv6 multicast
IPv6 multicast addresses start with FF00::/8
- Stateless Autoconfig
Core tool
allows hosts to learn IP (prefix, host, prefix length), DNS, default router, etc
Uses Neighbor Discover Protocol (NDP)
Derives the EUI-64 address
Stateless DHCP to learn DNS IPv6 addresses
Router Solicitation (uses ICMPv6)
- static configuration
Manually configure the entire 128-bit address
Host uses Network Diccovery Protocol (NDP) to learn DNS, default routers, etc
- Static configuration with EUI-64
Manually configure the prefix and let the device use an EUI-64 address for the interface
Host uses Network Diccovery Protocol (NDP) to learn DNS, default routers, etc
Types of IPv6 address
- Unicast - similar to IPv4. Every interface must have a unique address
- Unique Local
- Similar to IPv4 private addresses
- These addresses should be used within a private organization
- begins with FC00::/7
| 7 bits |1| 40 bits | 16 bits | 64 bits |
+--------+-+------------+-----------+----------------------------+
| Prefix |L| Global ID | Subnet ID | Interface ID |
+--------+-+------------+-----------+----------------------------+
- If L bit set address is locally assigned. This makes the first byte "FD"
- Link Local
- These packets should not leave the local subnet
- Router does not forward packets with Link Local address
- Used on a single subnet
- Used RS and RA messages
- Used by Neighbor Diccovery
- next hop address for IP Routes
- Each host can calculate its own address
- Addresses start with FE80::/10
- Multicast - represents a dynamic group of hosts.
FF02::1 - All IPv6 nodes on a link
FF02::2 - All IPv6 routers on a link
FF02::5, FF02::6 - OSPF
FF02::9 - RIP v2
FF02::A - EIGRP
FF02::1:2 - DHCP Relay Agents
FF05::1:3 - DHCP Servers
FF05::101 - NTP servers
- Anycast - Allows servers that serves the same function to use the same IP. It results in a nearest server first design.
Detecting Duplicate Addresses
- Network Discovery Matter
- Neighbor database get queried
- Duplicate Address Detection (DAD)
- Inverse Network Discovery
All IPv6 routing devices send updates either to Unicast or Multicast addresses
IPv6 interface typically have 2 IPv6 addresses, one link local and one global unicast
IPv6 allows for multiple IPs on an interface without the need for secondary address
Hex of all 0s, represent an unknown address
Examples are: - 0000:0000:0000:0000:0000:0000:0000:0000:/128-bit
::/128
The above address can be used as a source IP when a host has no suitable IP
Loopback
0000:0000:0000:0000:0000:0000:0000:0001:/128-bit
1::/128
Reference:
CCNP official Cert Guide - CCNP Routing and Switching - Route 300-101
https://www.ietf.org/rfc/rfc2460.txt
https://tools.ietf.org/html/rfc3513
https://tools.ietf.org/html/rfc4193
So it's that time again for me to renew my Cisco Certifications. As a result, this is be based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Configuring and Verifying Policy Based Routing
Why would you wish to use Policy Based Routing? Let's say you have two Internet links from your office. One can be used for Web based traffic (HTTP, DNS, etc) while the other can be used for management traffic to your remote networks (Telnet, SSH, SNMP, ICMP, etc)
For the purposes of this lab, I will send all Telnet, ICMP and SSH (Management Traffic) traffic through ISP2 and all HTTP and DNS (Web) traffic through ISP1
Topology
This topology consists of one 2 ISPs, 1 Internet and 1 local_site
Internet
- Interface e1/0 - connected to ISP1 - IP 1.0.0.1/24
- Interface e1/1 - connected to ISP2 - IP 2.0.0.1/24
- Interface lo3 - INTERNET ADDRESS - IP 3.0.0.1/32
ISP1
- Interface e1/0 - connected to ISP1 - IP 1.0.0.2/24
- Interface e1/1 - connected to ISP2 - IP 4.0.0.1/24
ISP2
- Interface e1/0 - connected to ISP1 - IP 2.0.0.2/24
- Interface e1/1 - connected to ISP2 - IP 5.0.0.2/24
LOCAL_SITE
- Interface e1/0 - connected to ISP2 - IP 4.0.0.2/24
- Interface e1/1 - connected to ISP1 - IP 5.0.0.2/24
- Interface fa0/0 - connected to LAN - IP 10.0.0.1/32
Kali Host on Branch
eth0 - 10.0.0.2.2/24
Default Gateway - 10.0.0.1
Interface Configuration:
Internet:
ISP-1:
ISP-2:
LOCAL_SITE:
Now that the interfaces are configured, it's time to configure the access lists.
Route Map config
Let's verify the route-map is assigned to an interface.
Excellent!!
Now that the configs are finished, time to verify if the system is working as expected.
Verification - ICMP
For ICMP, I will do a manual traceroute, to verify that ICMP traffic is going through ISP2.
Ping with TTL set to 1
From above, we've successfully hit our own gateway
Ping with TTL set to 2
As we can see above, ICMP traffic is going through ISP-2
Ping with TTL set to 3
As can be seen from above, ICMP traffic successfully got to 3.0.0.1 (Internet)
Let's Verify the rest of the traffic to pass through ISP-2 (Telnet, SSH)
Looks good, SSH traffic is going through ISP-2 (5.0.0.1)
Looks good too, Telnet traffic is going through ISP-2 (5.0.0.1)
Now let's look at HTTP and DNS for ISP-1
Niceee! Just what we wanted to see HTTP traffic is going through ISP-1 (4.0.0.1)
Yep! DNS traffic is also flowing through ISP-1 (4.0.0.1)
Now that we have all of that, let's go back to the router to see what is logged.
Above we see the Management Traffic (port 22) being permitted
Above we see the Web Traffic (port 80) being permitted
Checking the counters of the access lists
Above, we see statistics from the access-lists showing the amount of traffic being logged and or denied.
Checking the counters of the route-map
Above we see statistics which shows the traffic is being processed by the route-map
That's it for configuring and verifying policy based routing.
Hope you enjoyed.
References:
http://www.cisco.com/en/US/products/ps6599/products_white_paper09186a00800a4409.shtml
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/xe-3s/asr1000/iri-xe-3s-asr1000-book/iri-pbr-default-nexthop-route.html
