nsp

To Tests

2012-02-02T17:28:00.001+01:00

CPE sends PADT LAC sends PADT LAC sends CDN LNS sends CDN

PPP#1 - Authentication

2012-02-01T11:39:00.001+01:00

Client/Server authentication "Client" side: ! interface Serial1/0 ip address 192.168.12.1 255.255.255.0 encapsulation ppp ppp chap hostname ROUTER1 ppp chap password 0 CISCO! Server side: ! interface Serial1/0 ip address 192.168.12.2 255.255.255.0 encapsulation ppp ppp authentication chap callin! username ROUTER1 password CISCO ! Same kind of configuration for pap: "Client" side: !

HDLC#1 - Header Compression

2012-01-31T15:11:00.000+01:00

Configure header on HDLC link: R2(config)#interface serial1/0R2(config-if)#compress ? stac stac compression algorithm R2(config-if)#compress stacR2(config-if)#endR2# This is for header compression, not for data compression. Must be configured on both sides.

Reading-list#1

2012-01-25T14:45:00.001+01:00

http://tools.ietf.org/html/rfc1661 - The Point-to-Point Protocol (PPP)http://tools.ietf.org/html/rfc2153 - PPP Vendor Extensionshttp://tools.ietf.org/html/rfc1994 - PPP Challenge Handshake Authentication Protocol (CHAP)http://tools.ietf.org/html/rfc1334 - PPP Authentication Protocols~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=http://tools.ietf.org/html/rfc2516

RFC1483 - DHCP Server & Relay

2012-01-14T19:03:00.005+01:00

LAB#1: BrAS ! hostname BrAS ! ip dhcp excluded-address 192.168.1.1 ! ip dhcp pool Pool-DHCP1 network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 ! interface Loopback0 ip address 192.168.1.1 255.255.255.0 ! interface FastEthernet1/0 no ip address duplex auto speed auto no keepalive ! interface FastEthernet1/0.203 encapsulation dot1Q 203 ip address 192.168.23.2 255.255.255.0

[rbak-nsp] Internal icmp ratelimiting?

2012-01-13T11:38:00.000+01:00

Show card X icmp I think is the command you want. Chris O'Shea 2011/9/16 Mariano Juliá > Yes, there is a hard coded policer for locally bound ICMP packets. > > As a matter of fact, ICMP packets destined to any local IP address never > reach the XCRP, they are always handled by the input traffic card regardless > of whether the interface belong to that card or not.

PTA

2012-01-12T21:43:00.001+01:00

lac: hostname R1 ! no ip domain lookup ! ip cef vpdn enable ! vpdn-group pppoetest accept-dialin protocol pppoe virtual-template 1 ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 ip address 10.10.10.1 255.255.255.0 pppoe enable ! interface Virtual-Template1 mtu 1492 ip unnumbered FastEthernet0/0 peer

LAC - LNS - PPP, PPPoE, L2TP

2012-01-12T21:23:00.000+01:00

LNS: ! hostname LNS ! vpdn enable vpdn multihop ! vpdn-group L2TP-LNS accept-dialin protocol l2tp virtual-template 1 terminate-from hostname LAC local name LNS no l2tp tunnel authentication relay pppoe bba-group PPPoE ! bba-group pppoe PPPoE virtual-template 1 ! interface Loopback0 ip address 10.0.0.3 255.255.255.255 ! interface Loopback999 description

Frame relay and inverse-arp

2011-12-15T15:09:00.001+01:00

no frame-relay inverse arp says that I shall not ask the other end what his IP address is. no arp frame-relay means that if the other end asks me my IP address, I shall not answer him.

Create ACL on eXtreme Network Switches...

2011-11-29T10:34:00.001+01:00

First, create a policy. Enter command: vi no67udp.pol(use a pol extension)(ls command will list the files/configs on the XOS switch...linux) The following is needed in the policy (I add count so I can see the number of packet hits...it's not required):entry drop1 { if match all { protocol udp; source-port 67; } then {

OSPF Authentication

2011-11-27T22:28:00.001+01:00

Three authentication modes: 0 - null, no authentication 1 - clear-text 2 - md5 Per interface authentication r1(config)#interface s1/0 r1(config-if)#ip ospf authentication ? message-digest Use message-digest authentication null Use no authentication If "ip ospf authentication message-digest", then: r1(config-if)#ip ospf message-digest-key 1 md5 ccie_lab If you just entered "

OSPF Virtual links

2011-11-27T22:04:00.001+01:00

OSPF Virtual links are mainly used to avoid partitionned areas. r1 and r2 belongs to area 0. r1 and r3 to area 13, r3's loopback0 belongs to area 13. r2, r3 and r4 to area 234. If the link between r1 and r3 goes down, r3's loopback 0 becomes unreachable because area 13 has no connectivity with area 0 to reach other areas. To avoid this, a virtual-link is established betwen the ABR, r3 and r2.

Access-List and Wildcard Mask

2011-11-26T16:33:00.001+01:00

ACL and Wildcard mask can be determined based on AND (gives the network) and XOR (gives the wildcard mask) operations: Example1: Deny the following hosts in a single access-list statement: 200.0.1.2 200.0.1.10 200.0.1.18 200.0.1.26 200.0.3.2 200.0.3.10 200.0.3.18 200.0.3.26 200.0.1.2 11001000 00000000 00000001 00000010 200.0.1.10 11001000 00000000 00000001

OSPF - Ethernet Network Type BROADCAST and POINT_TO_MULTIPOINT NON_BROADCAST

2011-11-26T11:01:00.001+01:00

BROADCAST and POINT_TO_MULTIPOINT NON_BROADCAST Network Type on Ethernet BROADCAST Ethernet = broadcast (default) broadcast: DR/BDR election multicast updates On r1: r1#show ip ospf interface f0/0 FastEthernet0/0 is up, line protocol is up Internet Address 192.168.123.1/24, Area 0 Process ID 1, Router ID 192.168.123.1, Network Type BROADCAST, Cost: 1

OSPF - Network Types

2011-11-24T21:29:00.001+01:00

OSPF Network Types are: BROADCAST, DR/BDR election, auto neighbor, 10s hello. NON_BROADCAST, DR/BDR election, configured neighbor, 30s hello. POINT_TO_POINT, no DR/BDR election, auto neighbor, 10s hello. POINT_TO_MULTIPOINT, no DR/BDR election, configured neighbor, 30s hello. POINT_TO_MULTIPOINT NON_BROADCAST, no DR/BDR election, configured neighbor, 30s hello. Avoid mixing of OSPF Network

OSPF - Network Type POINT_TO_MULTIPOINT NON_BROADCAST

2011-11-24T21:24:00.001+01:00

POINT_TO_MULTIPOINT NON_BROADCAST is a mix of POINT_TO_MULTIPOINT and NON_BROADCAST network types. The best of each network type is used. POINT_TO_MULTIPOINT means no DR/BDR election. This also signify that the hub sees each adjacency as a point-to point link and that the NEXT-HOP is always the HUB (so, partial mesh frame relay configuration is possible, for example dynamic mapping with no

OSPF - Network Type POINT_TO_MULTIPOINT

2011-11-24T21:17:00.001+01:00

With this OSPF Network type, the network is seen as a collection of logical point-to-point links established between each spoke and the hub. So, with this network type, no DR is elected. Hello packets are still multicast (224.0.0.5). The configuration is quite simple on Hub and Spoke, configure the interface type as point-to-multipoint. On r1: ! interface

OSPF - Network Type NON_BROADCAST

2011-11-24T20:56:00.001+01:00

Default mode for Frame-Relay main interfaces and multipoint subinterfaces. In Hub & Spoke topology, the Hub MUST be the DR. Spoke not always have connectivity with other routers. On the Spokes, configure ip ospf priority 0. In this mode, you have to configure neighbors on the HUB router. There is no need to configure the neighbor on the Spokes: spokes will reply to unicast hellos from

Frame Relay: debugs

2011-11-24T09:47:00.001+01:00

Error message: %Address already in map r1#conf Configuring from terminal, memory, or network [terminal]? Enter configuration commands, one per line. End with CNTL/Z. r1(config)#int s0/0 r1(config-if)#frame-relay map ip 150.0.0.4 104 broadcast %Address already in map r1(config-if)#do clear frame-relay inarp r1(config-if)#frame-relay map ip 150.0.0.4 104 broadcast r1(

NTP Configuration

2011-11-24T08:14:00.001+01:00

Configuring NTP Network Time Protocol (NTP) services are enabled on all interfaces by default. The optional tasks you can perform are documented in the following sections: •Configuring NTP Authentication •Configuring NTP Associations •Configuring NTP Broadcast Service •Configuring NTP Access Restrictions •Configuring the Source IP Address for NTP Packets •Configuring the System as

RIP Unicast

2011-11-24T08:00:00.000+01:00

Enable RIP on the segment composed of r1, r2, r3 and r4. r3 and r4 must not receive updates exchanged between r1 and r2. On r1 and r2, configure the neighbor and configure passive interface. Note that this will not prevent r1 and r2 from receiving multicast updates from r3 nor r4. r3 and r4 will not receive updates from r1 nor r2. On r3 and r4: ! router rip version 2

RIP: Default-Information Originate

2011-11-23T15:46:00.001+01:00

r1 must send a default route to r2 and r3. r2 must not advertise 2.0.0.0/8 to r3. r3 must not advertise 3.0.0.0/8 to r3. On r1: ! router rip version 2 redistribute connected metric 2 route-map CONNECTED->RIP network 12.0.0.0 network 13.0.0.0 default-information originate distribute-list prefix F0/0 out ! ip prefix-list F0/0 seq 10 deny 3.0.0.0/8 ip prefix-list F0/0 seq 20 deny

RIP: Controlling RIP Updates

2011-11-23T15:17:00.001+01:00

Controlling RIP Updates Make RIPv2 work. r2 should not receive 3.0.0.0/8 r3 should not receive 2.0.0.0/8 With a prefix-list. r1: ! router rip version 2 redistribute connected route-map CONNECTED->RIP network 12.0.0.0 network 13.0.0.0 distribute-list prefix F0/0 out ! ip prefix-list F0/0 seq 5 permit 1.0.0.0/8 ip prefix-list F0/0 seq 10 permit 13.0.0.0/16ip prefix-list F0/0 seq

EIGRP, Hub & Spoke and split-horizon

2011-11-22T15:04:00.001+01:00

r1 is the hub, r2 and r3 are the spokes. r1 has dlci 102 towards r2 and 103 towards r3. r2 has dlci 201 towards r1. r3 has dlci 301 towards r1. Configure EIGRP to redistribute subnet on FastEthernet0/0. Don't use dynamic mapping. Use main interfaces. On r1: ! interface FastEthernet0/0 ip address 150.123.1.1 255.255.255.0 ! interface Serial1/0 ip address 150.123.0.1 255.255.255.0

Frame Relay: Hub & Spoke

2011-11-22T11:00:00.001+01:00

Frame-Relay: Hub & Spoke Many possibilities to make this working, with or without inarp: Use main interface, on Spicey, Prasit and Aton Use sub-interface, multipoint Use sub-interface, point-to-point on the spokes. First example Use main interface on each router. Do not use inarp. Do not sent duplicate broadcast over the dlci. Spicey: ! interface Serial1/0 ip address

Frame-Relay: back-to-back

2011-11-22T10:51:00.001+01:00

! hostname 6PE1 !

Unicast Reverse Path Forwarding (uRPF)

2009-07-16T17:30:00.003+02:00

Unicast Reverse Path Forwarding (uRPF) uRPF est une feature permettant d'éviter l'IP Spoofing. Lorsque urpf est activé sur une interface, le routeur examine chaque paquet reçu en entrée. Il vérifie ensuite que les paquets arrivent bien par l'interface représentant la 'best return path' vers la source. Pour cela, urpf effectue un reverse lookup dans la table CEF. - Si le paquet arrive par la

Remotely-Triggered Black Hole - RTBH

2009-07-15T11:59:00.018+02:00

RTBH est une technique permettant d'éviter qu'une attaque DDoS surcharge la capacité du réseau opérateur.La technique consiste à envoyer l'ensemble du trafic à destination d'un routeur client vers un black hole.R2 et R4 constituent le cœur de réseau de l'opérateur.R5 est le client.R3 est le routeur permettant l'injection de routes.R1 représente internet.Les routeurs R2, R3 et R4 sont dans le même

Multicast - Génération de trafic

2009-06-22T17:38:00.003+02:00

Pour simuler une source de trafic multicast:SW1#conf tEnter configuration commands, one per line. End with CNTL/Z.SW1(config)#rtr 1SW1(config-rtr)#type udpEcho dest-ipaddr 224.1.1.1 dest-port 12345 source-ipaddr 10.1.37.7 control disableSW1(config-rtr-udp)#frequency 5SW1(config-rtr-udp)#timeout 0SW1(config-rtr-udp)#exitSW1(config)#rtr schedule 1 start nowSW1(config)#endSW1#

Traffic Engineering Tunnel Options

2009-06-20T13:49:00.008+02:00

Options TE:Envoyer le traffic dans un tunnel:1\ PBR (RAS)2\ Static Routing (RAS)3\ AutorouteAutoroute:tunnel mpls traffic-eng autoroute announceLe tail end est accessible via le tunnel.Tous les équipements derrière le tail-end sont également joignable via ce tunnel.Le cost vers le tail end est le même que le 'best path' vers l'igp.Le cost vers les équipements derrière le tail end correspond au

Basic Traffic-Engineering configuration

2009-06-19T11:06:00.019+02:00

Configuration Basique d'un tunnel! En global:mpls traffic-eng tunnels!! Sur les interfaces:interface S1/0 mpls traffic-eng tunnels mpls ip ip rsvp bandwidth 10000!! Configuration de IGP:!OSPF, utilise les ''opaque LSA'', type 10:router ospf 1 mpls traffic-eng area 0 mpls traffic-eng router-id loopback0!! ISIS, utilise les TLV22, TLV134 et TLV135:router isis net 49.0001.0000.000a.00