Showing posts with label cisco. Show all posts

Tuesday, April 19, 2011

Configuring DNS on Cisco IOS routers

Configuration

Client R1#
----------

ip name-server 2.2.2.2
! ip domain-lookup is enabled by default
ip domain-lookup

Server R2#
----------

ip dns server
! ip domain-lookup is enabled by default
ip domain-lookup

ip host R2 2.2.2.2
ip host R1 1.1.1.1
! We can point to another DNS server
ip name-server 61.8.8.8

! but DO NOT point name-server to itself
! NO ip name-server 2.2.2.2

Verification

R1#ping R2

Translating “R2″…domain server (2.2.2.2) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 155.1.0.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/58/60 ms
R1#
*Apr 7 11:35:07.163: Domain: query for R2 type 1 to 2.2.2.2
*Apr 7 11:35:07.195: DOM: dom2cache: hostname is R2, RR type=1, class=1, ttl=1, n=4Reply received ok

R2#debug domain
Domain Name System debugging is on
R2#
*Apr 7 02:18:27.683: DNS: Incoming UDP query (id#2)
*Apr 7 02:18:27.683: DNS: Type 1 DNS query (id#2) for host ‘R2′ from 12.0.0.1(58198)
*Apr 7 02:18:27.683: DNS: Query for my own hostname: R2
*Apr 7 02:18:27.683: DNS: Spoofing reply to query (id#2)
*Apr 7 02:18:27.683: DNS: Finished processing query (id#2) in 0.004 secs

REPRODUCE ROUTER CRASH

Router may crash if we configure it as a DNS server, and also point “ip name-server” to itself.

R2#c
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#ip name-server 2.2.2.2
R2(config)#
R2#
R2#
R2#

!
! The R2 successfully serves the DNS queuries
! for valid hostnames (When “ping R2″ is issued on R1 router)

R1#ping R2

Translating “R2″…domain server (2.2.2.2) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 155.1.0.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/58/60 ms

*Apr 7 11:35:58.539: Domain: query for R2 type 1 to 2.2.2.2
*Apr 7 11:35:58.571: DOM: dom2cache: hostname is R2, RR type=1, class=1, ttl=1, n=4Reply received ok

R2#
*Apr 7 02:19:19.059: DNS: Incoming UDP query (id#3)
*Apr 7 02:19:19.059: DNS: Type 1 DNS query (id#3) for host ‘R2′ from 12.0.0.1(54174)
*Apr 7 02:19:19.059: DNS: Query for my own hostname: R2
*Apr 7 02:19:19.059: DNS: Spoofing reply to query (id#3)
*Apr 7 02:19:19.059: DNS: Finished processing query (id#3) in 0.000 secs
R2#
R2#

! The R2 crashes when “ping R3″ is issued on R1 router

R1#ping R3

Translating “R3″…domain server (2.2.2.2)
*Apr 7 11:36:22.991: Domain: query for R3 type 1 to 2.2.2.2
% Unrecognized host or address, or protocol not running.

timed out

*Apr 7 11:36:55.459: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to down
*Apr 7 11:36:55.459: %OSPF-5-ADJCHG: Process 1, Nbr 12.0.0.2 on Serial0/1 from FULL to DOWN, Neighbor Down: Interface down or detached

! As R2 cannot resolve IP for hostname R3, it tries to forward the queury to
! the next DNS server with IP address of itself. And the request keeps

! looping within R2.
!
!

R2#

DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
Doc CD Navigation

Monday, April 18, 2011

How to configure 802.1Q trunking between Cisco Catalyst switches

How to configure 802.1Q trunking between Cisco Catalyst 4000 - 4500 - 5000 - 5500 - 6000 - 6500 Switches that run CatOS and Cisco IOS System Software.

In 802.1Q trunking, all VLAN packets are tagged on the trunk link, except the native VLAN.

The native VLAN packets are sent untagged on the trunk link.

Therefore, the native VLAN must be the same on both switches configured for trunking.

This makes it easy to deduce to which VLAN a frame belongs when a frame is received with no tag.

By default, VLAN 1 is the native VLAN on all switches.

In Catalyst OS (CatOS), the native VLAN can be changed when the set vlan vlan-id mod/port command is issued, where mod/port is the trunk port.

In Cisco IOS Software, the native VLAN can be changed when the switchport trunk native vlan vlan-id interface command is issued, which is configured on the trunk port.

To enable the 802.1Q trunking on a CatOS and integrated Cisco IOS Software (native mode) switch, issue these commands:

In the CatOS switch:

cat6000>set trunk mod/port [on , desirable , auto , nonegotiate] dot1q

In the integrated Cisco IOS (native mode) switch:

cat6500(config-if)#switchport trunk {encapsulation dot1q}

For more information visit:

802.1Q Trunking Between Catalyst Switches Running CatOS and Cisco IOS System Software

Benefits of Obtaining a CCIE Routing and Switching (RS) Certification from Cisco

Quick Overview

What are the benefits of obtaining a CCIE routing and switching certification from Cisco? Read on to learn all about it! It’s an amazing opportunity and one you should definitely take advantage of if this field interests you.

Product Description

Have you ever wanted to show a possible employer that you are knowledgeable in your job or occupation? Did you have a desire to let your customers and clients see that you are serious in your work and strive to achieve perfection as a Cisco certified internetwork expert? Well if so perhaps the idea of obtaining a CCIE Routing and switching certification would benefit you. Cisco has such a course that can bring you more towards achieving these goals in your life.

When you are preparing to sign up for one of the Cisco CCIE certification courses you will notice that there are no formal prerequisites required. Most of the other professional certifications are no longer required by the Cisco training course administrators. The students selected are expected to have an understanding of the various subtleties and the challenges that the networking systems would involve. It is strongly recommended that you have at least three to five productive years on the job in that field prior to attempting to become certified. In order to obtain your CCIE Routing and switching certification you will be required to pass a written qualification exam as well as hands on lab evaluation. This assures that you are qualified and capable of performing the job at hand.

To those who may not be completely knowledgeable of what CCIE stands for. It successfully identifies those verified experts who have the necessary skills and the experience to enable them to handle just about any assignment in the networking field. The CCIE exams receive constant evaluations and are continually updated in order to assure top quality graduates who are favored within the industry. During these revisions the exams are centered upon the most current technology in the industry making Cisco graduates some of the more popular and most desired on the market today.

CCIE is recognized as the most high-level certification one can obtain in the industry today. When applying for a position dealing with networking most industry leaders look favorably upon CCIE Routing and switching certification. Value to the company generally translates of increasing salary in ones paycheck as well. What this boils down to is a great way to increase job security for you and your family’s future.

Often times when it comes down to a selection of possible candidates for a position the difference remains with the Cisco graduates. Various corporations and business tie up a considerable amount of money in their computer network systems and as such they want to ensure that anyone who may be handling this equipment is highly qualified to maintain it. Maintenance of the company’s networks is basic towards protecting their assets and ensuring continual operations. As the various computer environments become more and more complex the need for these qualified professionals is quickly becoming greater than ever before. Certified CCIEs are in high demand in the industry today.

Passing a CCIE exam is not as easy as one may think. Earning the honored CCIE certification requires passing the lab test successfully and there is only one way to prepare for this exam and that is by hands on experience.

Cost wise you will find that the average CCIE student has spent thousands of dollars and a minimum of eighteen months in their efforts to obtain their certification. In fact obtaining this certification is so difficult that the candidates are likely to attempt the lab more than once before they finally achieve their certification but it can be done and the rewards are well worth it.

Additional Information

Certification Level	Expert
Certification Track	CCIE Routing & Switching

GNS3-Topology: CCNA & CCNP Full Mesh Topology Template

Chris sent me a lab which he says has helped him to work on about 95% of his CCNA and CCNP lab requirements. I think this is a clear sign that using Dynamips or GNS3 can be effective in a big way with exam preperation. That 5% left over can be achieved in a few ways - rack space, friends with labs or purchasing switches on ebay and link them into the virtual topology using real interfaces. Nevertheless Its great to see how much we can do without cash, space or budget (electricity bill) to prepare ourselves for these exams.

This lab is just a template lab and has no configs, routing protocols or scenarios to it. I’ll let Chris explain

I created one simple topology that seems to handle 95% of my CCNA & CCNP lab requirements. It isn’t fancy, but it should save people an hour+ of labor (that is how long it took me to create this topology).

I was getting tired of making one lab per exercise in the Cisco Lab Portfolios and the Certification Zone lab exercises. So I whipped up a 6 router setup that could handle the majority of the router scenarios I am using for practice.

It consists of 6 7206 routers in a full mesh topology. Each router has 2 ethernet connections to a dynamips ’switch’, one each in VLAN1 and VLAN2.

Each router has at least 4 frame connections to the other routers in the topology.

Each router also has 1 frame connection to a frame relay switch, with full mesh DLCI between all routers.

I use dynagen, not GNS3. I created a diagram of the topology using the freeware tool called Network Notepad (http://www.networknotepad.com/) so I can keep track of all the different connections.

Some of the CCNA & CCNP stuff calls for using the Cisco SDM. I created one generic_startup.txt config file. It sets the password to cisco for the router, and enables the http server. It also sets the exec-timeout on con0 to infinite, and disables domain lookup (your pings will work quickly now). All you have to do is bridge GNS3 or Dynagen to your physical network card, and you can use the Cisco SDM to interface with the routers. Or SecureACS, the VPN client, VMWare images, etc….

Warning: this topo uses a lot of RAM. When I have all 6 routers running, my memory utilization jumps from 900mb to 3.5GB. When all 6 routers are idle, I am seeing 10-15% CPU utilization - I have an Intel Core2 Quad processor.

Routers Used: 7206

IOS: c7200-advipservicesk9-mz.124-2.T

Image:

Feature of Topology: Full Mesh Ethernet, Frame Relay

Download: GNS3-Labs:: CCNA-CCNP-Full.Mesh.Topology

Saturday, April 16, 2011

How to configure logging in Cisco IOS

Cisco IOS System Message Logging is enabled by default in order to send logging messages to the console.

These messages can be directed to logging buffers, terminal lines or a UNIX syslog server, depending on the configuration.

Issue the logging on command in order to enable logging.

Logging is enabled by default on Cisco routers.

Issue the no logging on command in order to disable logging.

In order to log messages on internal buffers, issue the logging buffered command.

In order to display buffered log messages, issue the show logging command.

In order to log messages on a syslog server, issue the logging command.

In order to log messages on a non-console terminal, issue the terminal monitor command.

For information on how to synchronize unsolicited messages refer to:

Cisco Configuring Synchronization of Logging Messages

For detailed information about system logging message severity levels refer to:

Cisco Limiting the Error Message Severity Level and Facilities

How to configure GLBP

The Gateway Load Balancing Protocol (GLBP) feature was integrated into Cisco IOS Software Release 12.2(15)T.

Highly recommend that you use the Cisco Feature Navigator to find the latest information about platform support and Cisco IOS Software image support.

Before configuring the GLBP feature, ensure that your Cisco routers can support multiple MAC addresses on the physical interfaces.

Several Ethernet (LANCE and QUICC) controllers in low-end Cisco products can only have a single unicast MAC address in their address filter.

To verify this, issue the show interfaces command, and ensure that the displayed hardware is neither LANCE nor QUICC.

These controllers do not support association of multiple MAC addresses with the interface.

Configuring basic GLBP is simple.

The basic configuration closely resembles the Hot Standby Router Protocol (HSRP) configuration.

The following sample configuration sets up two routers R1 and R2 as GLBP gateways serving the 10.1.1.0 network with 10.1.1.1 as the virtual gateway address.

This is the default gateway that would be configured on all the hosts in the 10.1.1.0 network, as shown:

R1# show running interface e0/0

ip address 10.1.1.2 255.255.255.0
glbp 1 ip 10.1.1.1

R2# show running interface e0/0
ip address 10.1.1.3 255.255.255.0
glbp 1 ip 10.1.1.1

The default mode for loadbalancing is round-robin.

This can be changed issuing the glbp 1 load-balancing host-dependent interface command.

When this command is configured, the Active Virtual gateway (AVG) ensures that a specific host gets its Address Resolution Protocol (ARP) mapping with the MAC address of the same AVF all the time.

To perform unequal load balancing, issue the glbp 1 load-balancing weighted command.

For more information on configuration, debug and verification of GLBP refer to:

Gateway Load Balancing Protocol

How to configure RIP v1 and RIP v2

The Routing Information Protocol (RIP) is a distance-vector interior gateway protocol that uses hop count as its metric.

RIP version 1 (v1) is a classfull routing protocol.

RIP version 2 (v2) is classless.

To enable RIP routing on a Cisco router, issue the router rip command in global configuration mode.

To specify a list of networks for the RIP routing process, issue the network command in router configuration mode.

By default, RIP enabled routers run RIP v1.

To specify a Routing Information Protocol (RIP) version used globally by the router, issue the version command in router configuration mode.

A RIP router might need to be able to exchange updates with both v1 and v2 routers.

To specify a Routing RIP version to send on an interface basis, issue the ip rip send version command in interface configuration mode.

To specify a Routing Information Protocol (RIP) version to receive on an interface basis, issue the ip rip receive version command in interface configuration mode.

For more information refer to:

Configuring RIP

How to configure default routing so different default routes are used based on the source of the packet (Policy Based Routing)

How to configure default routing so different default routes are used based on the source of the packet, such as based on which devices or users are originating the packets.

The default route is already configured on the router, and you want to policy route certain users to different Internet Service Providers (ISPs).

Issue the set ip default next-hop command in the route-map command configuration mode.

Configure Policy Based Routing (PBR) specifying a different default IP next hop for interested traffic by issuing a route-map command.

This is a sample configuration for the traffic sourced from 10.1.1.0/24, coming in on interface Ethernet0, policy routed to next-hop x.x.x.x:

int Ethernet0
ip address 10.1.1.1 255.255.255.0
ip policy-map new-gateway

route-map new-gateway permit 10
match ip address 10
set ip default next-hop x.x.x.x

access-list 10 permit 10.1.1.0 0.0.0.255

Note: The traffic that does not match the policy uses the default route configured in the router.

For more information on PBR refer to:

Configuring IP Routing Protocol-Independent Features

Policy-Based Routing

For more information on default routes refer to:

Configuring a Gateway of Last Resort Using IP Commands

How to configure static routes

Routers send packets to various networks based on the information available in the routing table.

They learn about the networks that are directly connected, based on the IP addresses configured on their interfaces.

These networks are automatically included in the routing table, which is then used for sending packets to destinations belonging to them.

For routers to send or forward packets to networks that are not directly connected, they must know the path to reach the destination network.

One way for the router to know the path to such networks is to configure a static route, which adds this particular route to the routing table.

To configure a static route, issue the ip route prefix mask {ip-address | interface-type interface-number [ip-address]} [distance] [name] [permanent] [tag tag] command in global configuration mode.

For example, issue the command ip route 192.168.20.0 255.255.255.0 192.168.17.254 to configure a static route for the network 192.168.20.0/24 pointing to the next-hop IP address 192.168.17.254.

The next-hop IP address should either be directly connected or should be reachable by recursive routing table lookup if not connected directly.

For more information on specifying next-hop IP addresses for static routes refer to:

Specifying a Next Hop IP Address for Static Routes

How does load balancing work?

Cisco How-To Tutorials

To address the need for high availability and scalability, networks often use multiple parallel links.

To provide aggregate bandwidth greater than that available with a single link, parallel links are used.

Load balancing occurs when traffic destined to a network is forwarded over multiple parallel paths.

Routers prefer routes learned through protocols with lower administrative distance.

For load balancing to work, the parallel routes are learned through a single routing protocol.

This protocol should have the least administrative distance among all the routing protocols running on the router.

These multiple routes to a destination are compared by their metrics, and the shortest path is installed in the routing table.

If there is more than one path with the same least metric value, all least-metric routes are installed in the routing table.

Some protocols, such as Enhanced Interior Gateway Routing Protocol (EIGRP), can be configured to install multiple paths.

This may occur even if the paths are not of equal metric.

To determine the number of routes that be installed based on the value configured for the protocol, issue the maximum-paths command.

The maximum number of parallel paths installed is Cisco IOS Software and protocol dependent.

Once multiple paths are installed, routers will load balance on the paths on a per-packet or per-destination basis.

A router load balancing on a per-packet basis uses the parallel paths in a round-robin fashion, only forwarding a single packet on a path before moving on to the next one.

A router load balancing on a per-destination basis uses the parallel routes in a round-robin fashion, but forwards an entire destination-based flow in each pass.

Per-packet or per-destination load balancing is dependent on the switching mechanism configured on the interface.

Interfaces configured for process switching load balance on a per-packet basis.

Interfaces configured for fast or optimum switching load balance on a per-destination basis.

Meanwhile, interfaces configured for Cisco Express Forwarding (CEF) can load balance on a per-packet basis or per-source-destination basis.

For more information refer to these documents:

How Does Load Balancing Work?

Load Balancing with CEF

How to configure OSPF

Open Shortest Path First (OSPF) is an interior gateway, link-state routing protocol.

OSPF routers exchange information about the state of the links in the network, and this information is entered into the topology database.

The Shortest Path First (SPF) algorithm is then run on the contents of the topology or link state database to build the routing table.

Basic OSPF configuration involves enabling an OSPF routing process on a router and specifying a range of IP addresses associated with the routing process along with the corresponding area ID.

To configure an OSPF routing process, issue the router ospf command in global configuration mode.

To define the interfaces on which OSPF runs and to define the area ID for those interfaces, issue the network area command in router configuration mode.

Depending on the topology, additional configuration, such as explicitly defining neighbors and controlling Designated Router (DR) and Backup Designated Router (BDR), might be necessary.

For additional information on basic OSPF configuration and other OSPF configuration options refer to:

Configuring OSPF

For information on how to design and deploy OSPF in large networks refer to the:

OSPF Design Guide

How to configure NAT

NAT is very useful in these instances:

	Conserving IP address space.
	Implementing TCP load distribution.
	Connecting networks with overlapping addresses.
	During network migration, which involves the renumbering of nodes.
	Connecting a private network using an unregistered address to a public network like the Internet.
	Distributing other Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) based services.

A router configured for NAT maintains a translation table that has the mapping between the addresses used in the translation.

Configuring NAT involves identifying the NAT inside and NAT outside interfaces, then configuring the way the addresses are to be translated, depending on the requirement.

A router configured with NAT translates only traffic that is forwarded between the inside and outside interfaces, and the flow that matches the criteria specified for translation.

Traffic that does not meet these conditions is forwarded without any translation.

To configure the inside and outside interfaces, issue the ip nat inside and ip nat outside commands under the respective interfaces.

A static NAT configuration creates a one-to-one mapping and translates a specific address to another address.

This type of configuration creates a permanent entry in the NAT table, as long as the configuration is present and is useful when users on both inside and outside networks need to initiate a connection.

To configure static NAT, issue the ip nat inside source static or ip nat outside source static commands in global configuration mode, depending on where the host is located.

Static NAT can also be used to redirect traffic using a particular port to a different port on a host.

This is helpful when the users belonging to the inside network use a particular port number to access a particular application (like a web server) available on the inside or outside network.

The same application is accessed by users from the outside network using a different port number.

To redirect traffic to a different port, issue the ip nat inside source {static {tcp|udp local-ip local-port global-ip global-port} [extendable] or ip nat outside source {static tcp|udp global-ip global-port local-ip local-port} [extendable] commands in global configuration mode, depending on whether the inside or outside network is available.

Another type of configuration is dynamic NAT, which is useful when a limited number of addresses is available instead of the actual number of hosts to be translated.

The addresses used for translation are configured by issuing the ip nat pool command in global configuration mode.

The hosts to be translated are specified by issuing the access-list command or match statements in the route-map command.

The pool and the list of hosts to be translated are linked together by issuing the ip nat inside source list name pool name command or the ip nat inside source route-map name pool name command in global configuration mode.

The command can be issued for an outside network by replacing the keyword "inside" with "outside".

Dynamic NAT creates an entry in the NAT table, when the host initiates a connection and establishes a one-to-one mapping between the addresses.

But the mapping could vary depending on the address available in the pool at the time of communication.

Dynamic NAT allows sessions to be initiated from inside or outside networks for which it is configured.

Dynamic NAT entries are removed from the translation table if the host does not communicate for a specific period of time, which is configurable, and the address is returned to the pool for use by another host.

Another form of dynamic translation is overloading or Port Address Translation (PAT), which allows many hosts to be mapped to a single address at the same time.

When PAT is configured, the router makes use of the source port numbers to distinguish the sessions from different hosts.

PAT creates an extended translation entry in the NAT table by including the protocol as well as the port information.

PAT is configured by adding the overload option to the dynamic NAT configuration command, which binds the hosts and the pool.

Static and dynamic NAT can be configured simultaneously when it is required.

This occurs in cases where many addresses are not available for translation, and certain devices must be statically configured for NAT at the same time.

For more information on configuring NAT refer to these documents:

NAT: Local and Global Definitions

Configuring Static and Dynamic NAT Simultaneously

Configuring Network Address Translation: Getting Started