as you might imagine, i am currently lost... i went through a bout of decompression yesterday after finally consolidating CCNP... this has been a dream of mine for a long time and now that it is here it will take some getting used to... but i'm sure i will get used to it...
the fact is there is no celebration going on here... there is only the work, more consolidation, going back to the beginning to move forward again...
there is some relief that there is no test in the coming months... i plan to wait until the first of next year before sitting the CCIE written... and that was always the plan; yesterday has not changed that...
pucker time is over and i am happy about the loneliness of the long distance run ahead... there is no immediate fight; there is no rush; there is only the battle with me now... and for that i am grateful...
back to squares...
but i do like having this to keep me company:
Search insearchofthecert
Showing posts with label ccnp. Show all posts
Showing posts with label ccnp. Show all posts
Thursday, February 14, 2013
Wednesday, February 13, 2013
Sunday, February 10, 2013
quote of the day, ospf design guide...
i never tire of rereading this... this is atrophy remover...
http://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a0080094e9e.shtml
http://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a0080094e9e.shtml
Saturday, February 9, 2013
trace and ttl...
http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml
Three datagrams are sent, each with a Time-To-Live (TTL) field value set to one. The TTL value of 1 causes the datagram to "timeout" as soon as it hits the first router in the path; this router then responds with an ICMP Time Exceeded Message (TEM) indicating that the datagram has expired.
Another three UDP messages are now sent, each with the TTL value set to 2, which causes the second router to return ICMP TEMs. This process continues until the packets actually reach the other destination. Since these datagrams are trying to access an invalid port at the destination host, ICMP Port Unreachable Messages are returned, indicating an unreachable port; this event signals the Traceroute program that it is finished.
The purpose behind this is to record the source of each ICMP Time Exceeded Message to provide a trace of the path the packet took to reach the destination. For all the options about this command, see Trace (privileged).
R1#trace 10.2.1.4
Type escape sequence to abort.
Tracing the route to 10.2.1.4
VRF info: (vrf in name/id, vrf out name/id)
1 10.1.1.2 16 msec 20 msec 20 msec
2 10.1.1.6 28 msec 28 msec 16 msec
3 10.1.1.10 64 msec 64 msec 60 msec
4 10.1.4.6 60 msec 68 msec 64 msec
5 10.2.1.4 64 msec 64 msec 72 msec
R1#
*Feb 9 09:22:22.349: ICMP: time exceeded rcvd from 10.1.1.2
*Feb 9 09:22:22.369: ICMP: time exceeded rcvd from 10.1.1.2
*Feb 9 09:22:22.389: ICMP: time exceeded rcvd from 10.1.1.2
*Feb 9 09:22:22.413: ICMP: time exceeded rcvd from 10.1.1.6
*Feb 9 09:22:22.453: ICMP: time exceeded rcvd from 10.1.1.6
*Feb 9 09:22:22.489: ICMP: time exceeded rcvd from 10.1.1.6
*Feb 9 09:22:22.569: ICMP: time exceeded rcvd from 10.1.1.10
*Feb 9 09:22:22.633: ICMP: time exceeded rcvd from 10.1.1.10
*Feb 9 09:22:22.693: ICMP: time exceeded rcvd from 10.1.1.10
*Feb 9 09:22:22.753: ICMP: time exceeded rcvd from 10.1.4.6
*Feb 9 09:22:22.829: ICMP: time exceeded rcvd from 10.1.4.6
R1#
*Feb 9 09:22:22.893: ICMP: time exceeded rcvd from 10.1.4.6
*Feb 9 09:22:22.965: ICMP: dst (10.1.1.1) port unreachable rcv from 10.2.1.4
*Feb 9 09:22:23.037: ICMP: dst (10.1.1.1) port unreachable rcv from 10.2.1.4
*Feb 9 09:22:23.117: ICMP: dst (10.1.1.1) port unreachable rcv from 10.2.1.4
The Traceroute Command
The traceroute command is used to discover the routes that packets actually take when traveling to their destination. The device (for example, a router or a PC) sends out a sequence of User Datagram Protocol (UDP) datagrams to an invalid port address at the remote host.Three datagrams are sent, each with a Time-To-Live (TTL) field value set to one. The TTL value of 1 causes the datagram to "timeout" as soon as it hits the first router in the path; this router then responds with an ICMP Time Exceeded Message (TEM) indicating that the datagram has expired.
Another three UDP messages are now sent, each with the TTL value set to 2, which causes the second router to return ICMP TEMs. This process continues until the packets actually reach the other destination. Since these datagrams are trying to access an invalid port at the destination host, ICMP Port Unreachable Messages are returned, indicating an unreachable port; this event signals the Traceroute program that it is finished.
The purpose behind this is to record the source of each ICMP Time Exceeded Message to provide a trace of the path the packet took to reach the destination. For all the options about this command, see Trace (privileged).
R1#trace 10.2.1.4
Type escape sequence to abort.
Tracing the route to 10.2.1.4
VRF info: (vrf in name/id, vrf out name/id)
1 10.1.1.2 16 msec 20 msec 20 msec
2 10.1.1.6 28 msec 28 msec 16 msec
3 10.1.1.10 64 msec 64 msec 60 msec
4 10.1.4.6 60 msec 68 msec 64 msec
5 10.2.1.4 64 msec 64 msec 72 msec
R1#
*Feb 9 09:22:22.349: ICMP: time exceeded rcvd from 10.1.1.2
*Feb 9 09:22:22.369: ICMP: time exceeded rcvd from 10.1.1.2
*Feb 9 09:22:22.389: ICMP: time exceeded rcvd from 10.1.1.2
*Feb 9 09:22:22.413: ICMP: time exceeded rcvd from 10.1.1.6
*Feb 9 09:22:22.453: ICMP: time exceeded rcvd from 10.1.1.6
*Feb 9 09:22:22.489: ICMP: time exceeded rcvd from 10.1.1.6
*Feb 9 09:22:22.569: ICMP: time exceeded rcvd from 10.1.1.10
*Feb 9 09:22:22.633: ICMP: time exceeded rcvd from 10.1.1.10
*Feb 9 09:22:22.693: ICMP: time exceeded rcvd from 10.1.1.10
*Feb 9 09:22:22.753: ICMP: time exceeded rcvd from 10.1.4.6
*Feb 9 09:22:22.829: ICMP: time exceeded rcvd from 10.1.4.6
R1#
*Feb 9 09:22:22.893: ICMP: time exceeded rcvd from 10.1.4.6
*Feb 9 09:22:22.965: ICMP: dst (10.1.1.1) port unreachable rcv from 10.2.1.4
*Feb 9 09:22:23.037: ICMP: dst (10.1.1.1) port unreachable rcv from 10.2.1.4
*Feb 9 09:22:23.117: ICMP: dst (10.1.1.1) port unreachable rcv from 10.2.1.4
Friday, February 8, 2013
quote of the day; jeff doyle on ospf...
jeff speaks...
Why does OSPF require all traffic between non-backbone areas to pass through a backbone area (area 0)?
Because inter-area OSPF is distance vector, it is vulnerable to routing loops. It avoids loops by mandating a loop-free inter-area topology, in which traffic from one area can only reach another area through area 0.
Every link state router floods information about itself, its links, and its neighbors to every other router. From this flooded information each router builds an identical link state database. Each router then independently runs a shortest-path-first calculation on its database – a local calculation using distributed information – to derive a shortest-path tree. This tree is a sort of map of the shortest path to every other router.
One of the advantages of link state protocols is that the link state database provides a “view” of the entire network, preventing most routing loops. This is in contrast to distance vector protocols, in which route information is passed hop-by-hop through the network and a calculation is performed at each hop – a distributed calculation using local information. Each router along a route is dependent on the router before it to perform its calculations correctly and then correctly pass along the results. When a router advertises the prefixes it learns to its neighbors it’s basically saying, “I know how to reach these destinations.” And because each distance vector router knows only what its neighbors tell it, and has no “view” of the network beyond the neighbors, the protocol is vulnerable to loops.
The second concept is this:
When link state domains grow large, the flooding and the resulting size of the link state database becomes a scaling problem. The problem is remedied by breaking the routing domain into areas: That first concept is modified so that flooding occurs only within the boundaries of an area, and the resulting link state database contains only information from the routers in the area. This, in turn, means that each router’s calculated shortest-path tree only describes the path to other routers within the area.
The third concept is this:
OSPF areas are connected by one or more Area Border Routers (the other main link state protocol, IS-IS, connects areas somewhat differently) which maintain a separate link state database and calculate a separate shortest-path tree for each of their connected areas. So an ABR by definition is a member of two or more areas. It advertises the prefixes it learns in one area to its other areas by flooding Type 3 LSAs into the areas that basically say, “I know how to reach these destinations.”
Wait a minute – what that last concept described is not link state, it’s distance vector. The routers in an area cannot “see” past the ABR, and rely on the ABR to correctly tell them what prefixes it can reach. The SPF calculation within an area derives a shortest-path tree that depicts all prefixes beyond the ABR as leaf subnets connected to the ABR at some specified cost.
And that leads us to the answer to the question:
Because inter-area OSPF is distance vector, it is vulnerable to routing loops. It avoids loops by mandating a loop-free inter-area topology, in which traffic from one area can only reach another area through area 0.
Why does OSPF require all traffic between non-backbone areas to pass through a backbone area (area 0)?
Because inter-area OSPF is distance vector, it is vulnerable to routing loops. It avoids loops by mandating a loop-free inter-area topology, in which traffic from one area can only reach another area through area 0.
Every link state router floods information about itself, its links, and its neighbors to every other router. From this flooded information each router builds an identical link state database. Each router then independently runs a shortest-path-first calculation on its database – a local calculation using distributed information – to derive a shortest-path tree. This tree is a sort of map of the shortest path to every other router.
One of the advantages of link state protocols is that the link state database provides a “view” of the entire network, preventing most routing loops. This is in contrast to distance vector protocols, in which route information is passed hop-by-hop through the network and a calculation is performed at each hop – a distributed calculation using local information. Each router along a route is dependent on the router before it to perform its calculations correctly and then correctly pass along the results. When a router advertises the prefixes it learns to its neighbors it’s basically saying, “I know how to reach these destinations.” And because each distance vector router knows only what its neighbors tell it, and has no “view” of the network beyond the neighbors, the protocol is vulnerable to loops.
The second concept is this:
When link state domains grow large, the flooding and the resulting size of the link state database becomes a scaling problem. The problem is remedied by breaking the routing domain into areas: That first concept is modified so that flooding occurs only within the boundaries of an area, and the resulting link state database contains only information from the routers in the area. This, in turn, means that each router’s calculated shortest-path tree only describes the path to other routers within the area.
The third concept is this:
OSPF areas are connected by one or more Area Border Routers (the other main link state protocol, IS-IS, connects areas somewhat differently) which maintain a separate link state database and calculate a separate shortest-path tree for each of their connected areas. So an ABR by definition is a member of two or more areas. It advertises the prefixes it learns in one area to its other areas by flooding Type 3 LSAs into the areas that basically say, “I know how to reach these destinations.”
Wait a minute – what that last concept described is not link state, it’s distance vector. The routers in an area cannot “see” past the ABR, and rely on the ABR to correctly tell them what prefixes it can reach. The SPF calculation within an area derives a shortest-path tree that depicts all prefixes beyond the ABR as leaf subnets connected to the ABR at some specified cost.
And that leads us to the answer to the question:
Because inter-area OSPF is distance vector, it is vulnerable to routing loops. It avoids loops by mandating a loop-free inter-area topology, in which traffic from one area can only reach another area through area 0.
arp...
resolving a known l3 address to an unknown l2 address...
i suggest you spend some time here, and with rfc 826... it is not enough to have familiarity...
from: http://www.tcpipguide.com/free/t_ARPMessageFormat.htm
Address resolution using ARP
is accomplished through the exchange
of messages between the source device
seeking to perform the resolution, and the destination device that responds
to it. As with other protocols, a special message format is used
containing the information required for each step of the resolution
process.
ARP messages use a relatively simple
format. It includes a field describing the type of message (its operational
code or opcode) and information on both layer two and layer
three addresses. In order to support addresses that may be of varying
length, the format specifies the type of protocol used at both layer
two and layer three and the length of addresses used at each of these
layers.
The ARP message format is designed
to accommodate layer two and layer three addresses of various sizes.
This diagram shows the most common implementation, which uses 32 bits
for the layer three (“Protocol”) addresses, and 48 bits for the layer
two hardware addresses. These numbers of course correspond to the
address sizes of the Internet Protocol version 4 and IEEE 802 MAC addresses, used by Ethernet.
ccna to ccie...
i have always thought in the past without fully understanding why, that ccie is essentially turbo ccna... i still believe that...
ccnp is terribly important as it fills in the advanced technologies between... those who choose to make the leap directly from ccna to ccie are brave souls indeed... ultimately they end up doing ccnp, without calling it exactly that... it is not possible to get there from here in any equation...
however, ccie is ccna without the creamy center of ccnp...
while i wouldn't say that any of them are fun, i will say that ccnp has been an adagio...
i see the entire thing as a play in three acts...
ccna is the first act of course, laying the foundation for the drama through exposition, character establishment and relationships...
ccnp is the rising action; the attempt to learn new things, character development and confrontation along the way...
ccie is the climax, the second turning point; the resolution of the problems set forth...
ccnp is terribly important as it fills in the advanced technologies between... those who choose to make the leap directly from ccna to ccie are brave souls indeed... ultimately they end up doing ccnp, without calling it exactly that... it is not possible to get there from here in any equation...
however, ccie is ccna without the creamy center of ccnp...
while i wouldn't say that any of them are fun, i will say that ccnp has been an adagio...
i see the entire thing as a play in three acts...
ccna is the first act of course, laying the foundation for the drama through exposition, character establishment and relationships...
ccnp is the rising action; the attempt to learn new things, character development and confrontation along the way...
ccie is the climax, the second turning point; the resolution of the problems set forth...
Thursday, February 7, 2013
stp root switch...
from cisco's 3560/3750 guide which of course you can download...
If all switches in a network are enabled with default spanning-tree settings, (and when they come out of the box they are wearing their birthday suits) the switch with the lowest MAC address becomes the root switch.
that is gospel...
priority is default at 32768...
that is gospel...
this is the BID of this switch on vlan 10...
dsw1#sh spann
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 32778
32768 + 10 is 32778...
the priority can change all that ONLY if it has been configured to do so... and if it has been configured to do so, the mac doesn't matter...
again, that is if it has been configured to do so...
which means the priority is an afterthought, although we all know you want to be deterministic about the placement of the root switch...
out of the box, MAC is king...
your witness, counselor...
If all switches in a network are enabled with default spanning-tree settings, (and when they come out of the box they are wearing their birthday suits) the switch with the lowest MAC address becomes the root switch.
that is gospel...
priority is default at 32768...
that is gospel...
this is the BID of this switch on vlan 10...
dsw1#sh spann
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 32778
32768 + 10 is 32778...
the priority can change all that ONLY if it has been configured to do so... and if it has been configured to do so, the mac doesn't matter...
again, that is if it has been configured to do so...
which means the priority is an afterthought, although we all know you want to be deterministic about the placement of the root switch...
out of the box, MAC is king...
your witness, counselor...
why ospf area's and other sundries...
these kinds of basic questions are tough on the spot...
why ospf areas? ospf areas are like, like life... yeah...
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094aaa.shtml
Areas limit the scope of route information distribution. It is not possible to do route update filtering within an area. The link-state database (LSDB) of routers within the same area must be synchronized and be exactly the same; however, route summarization and filtering is possible between different areas. The main benefit of creating areas is a reduction in the number of routes to propagate—by the filtering and the summarization of routes.
which really came in handy back when routers had shitty processors and 1k of ram...
An autonomous system boundary router (ASBR) advertises external destinations throughout the OSPF autonomous system. External routes are the routes redistributed into OSPF from any other protocol. In many cases, external link states make up a large percentage of the link states in the databases of every router. A stub area is an area in which you don't allow advertisements of external routes, thus reducing the size of the database even more. Instead, a default summary route (0.0.0.0) is inserted into the stub area in order to reach these external routes. If you have no external routes in your network, then you have no need to define stub areas.
no external routes equals no redistribution equals no stubs...
All areas in an OSPF autonomous system must be physically connected to the backbone area (area 0). In some cases where this physical connection is not possible, you can use a virtual link to connect to the backbone through a non-backbone area. As mentioned above, you can also use virtual links to connect two parts of a partitioned backbone through a non-backbone area. The area through which you configure the virtual link, known as a transit area, must have full routing information. The transit area cannot be a stub area.
good... and you use the area id virtual-link command to accomplish this... then what ospf type is a virtual link... would someone please make up my mind...
doyle calls it a network type...
OSPF defines five network types:
Point-to-point networks
Broadcast networks
Nonbroadcast Multiaccess (NBMA) networks
Point-to-multipoint networks
Virtual links
why ospf areas? ospf areas are like, like life... yeah...
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094aaa.shtml
Areas limit the scope of route information distribution. It is not possible to do route update filtering within an area. The link-state database (LSDB) of routers within the same area must be synchronized and be exactly the same; however, route summarization and filtering is possible between different areas. The main benefit of creating areas is a reduction in the number of routes to propagate—by the filtering and the summarization of routes.
which really came in handy back when routers had shitty processors and 1k of ram...
An autonomous system boundary router (ASBR) advertises external destinations throughout the OSPF autonomous system. External routes are the routes redistributed into OSPF from any other protocol. In many cases, external link states make up a large percentage of the link states in the databases of every router. A stub area is an area in which you don't allow advertisements of external routes, thus reducing the size of the database even more. Instead, a default summary route (0.0.0.0) is inserted into the stub area in order to reach these external routes. If you have no external routes in your network, then you have no need to define stub areas.
no external routes equals no redistribution equals no stubs...
All areas in an OSPF autonomous system must be physically connected to the backbone area (area 0). In some cases where this physical connection is not possible, you can use a virtual link to connect to the backbone through a non-backbone area. As mentioned above, you can also use virtual links to connect two parts of a partitioned backbone through a non-backbone area. The area through which you configure the virtual link, known as a transit area, must have full routing information. The transit area cannot be a stub area.
good... and you use the area id virtual-link command to accomplish this... then what ospf type is a virtual link... would someone please make up my mind...
doyle calls it a network type...
OSPF defines five network types:
Point-to-point networks
Broadcast networks
Nonbroadcast Multiaccess (NBMA) networks
Point-to-multipoint networks
Virtual links
joshua, at cln...
there is a new idea at cln... learn about it here:
https://learningnetwork.cisco.com/docs/DOC-16300#comment-34483
joshua has already done 2 and has another in the works...i suggest you watch them and make an honest assessment of yourself... you will see that something like this is the standard by which you will be measured...
if you think you have have the fundamentals cold, then you don't need this, however the question you must ask yourself, and you must keep asking yourself time and again, all throughout this experience is:
But do I really...
two steps forward, five steps back...
https://learningnetwork.cisco.com/docs/DOC-16300#comment-34483
joshua has already done 2 and has another in the works...i suggest you watch them and make an honest assessment of yourself... you will see that something like this is the standard by which you will be measured...
if you think you have have the fundamentals cold, then you don't need this, however the question you must ask yourself, and you must keep asking yourself time and again, all throughout this experience is:
But do I really...
two steps forward, five steps back...
what is inalienable...
through the fog of time what one thought once inalienable, becomes muted...
back to the beginning again...
recent events have me reevaluating...
what is a trunk and what makes an etherchannel so very different...
from: http://www.ciscopress.com/articles/article.asp?p=29803&seqNum=3
A trunk port is by default a member of all the VLANs that exist on the switch and carry traffic for all those VLANs between the switches. To distinguish between the traffic flows, a trunk port must mark the frames with special tags as they pass between the switches. Trunking is a function that must be enabled on both sides of a link. If two switches are connected together, for example, both switch ports must be configured for trunking, and they must both be configured with the same tagging mechanism (ISL or 802.1Q).
good... an etherchannel does the same thing only it allows for the aggregation of ports into a bundle, thus increasing the total bandwidth available by a factor of the included ports...
from: http://en.wikipedia.org/wiki/EtherChannel
EtherChannel is a port link aggregation technology or port-channel architecture used primarily on Cisco switches. It allows grouping of several physical Ethernet links to create one logical Ethernet link for the purpose of providing fault-tolerance and high-speed links between switches, routers and servers. An EtherChannel can be created from between two and eight active Fast, Gigabit or 10-Gigabit Ethernet ports, with an additional one to eight inactive (failover) ports which become active as the other active ports fail. EtherChannel is primarily used in the backbone network, but can also be used to connect end user machines.
back to the beginning again...
recent events have me reevaluating...
what is a trunk and what makes an etherchannel so very different...
from: http://www.ciscopress.com/articles/article.asp?p=29803&seqNum=3
A trunk port is by default a member of all the VLANs that exist on the switch and carry traffic for all those VLANs between the switches. To distinguish between the traffic flows, a trunk port must mark the frames with special tags as they pass between the switches. Trunking is a function that must be enabled on both sides of a link. If two switches are connected together, for example, both switch ports must be configured for trunking, and they must both be configured with the same tagging mechanism (ISL or 802.1Q).
good... an etherchannel does the same thing only it allows for the aggregation of ports into a bundle, thus increasing the total bandwidth available by a factor of the included ports...
from: http://en.wikipedia.org/wiki/EtherChannel
EtherChannel is a port link aggregation technology or port-channel architecture used primarily on Cisco switches. It allows grouping of several physical Ethernet links to create one logical Ethernet link for the purpose of providing fault-tolerance and high-speed links between switches, routers and servers. An EtherChannel can be created from between two and eight active Fast, Gigabit or 10-Gigabit Ethernet ports, with an additional one to eight inactive (failover) ports which become active as the other active ports fail. EtherChannel is primarily used in the backbone network, but can also be used to connect end user machines.
Wednesday, February 6, 2013
boson's tshoot simulator...
119 bucks... is it worth it...
that depends on you... it certainly helps you, you have to give it that... it can't hurt either but it cuts you off at the knees in a lot of areas, especially if you are practicing for speed... yes speed... unfortunately speed is a factor in this thing...
where it helps:
anything that forces you to train, helps... yes virginia, this is training and training is not always fun so suck it up...
you get better simply by forcing yourself to pinpoint problems...
you get better by determining solutions to said pinpointed problems using a limited command set...
where it sucks:
in the limited command set specifically...
no tracert from the pc...
no interface trunk... that's a big one... that is my go to command at l2...
no piping... another big time saver...
you end up using show run an awful lot, which isn't troubleshooting... show run is hunting and pecking... show run does not help you...
but at least if they are going to make you rely on show run, make available show run interface... no show run interface...
face it, it's not real troubleshooting, it's a flash script... which makes me wary of the troubleshoot section in the ccie lab... if they (cisco) are going to use flash scripts for such an important test, they had better issue the limited command set that is supported on the test to the public ahead of time... anything less is dirty pool...
i cannot imagine sitting the ccie lab without benefit of piping... especially with the troubleshoot section which basically gives you ten minutes a ticket... gimme a friggin break here...
that depends on you... it certainly helps you, you have to give it that... it can't hurt either but it cuts you off at the knees in a lot of areas, especially if you are practicing for speed... yes speed... unfortunately speed is a factor in this thing...
where it helps:
anything that forces you to train, helps... yes virginia, this is training and training is not always fun so suck it up...
you get better simply by forcing yourself to pinpoint problems...
you get better by determining solutions to said pinpointed problems using a limited command set...
where it sucks:
in the limited command set specifically...
no tracert from the pc...
no interface trunk... that's a big one... that is my go to command at l2...
no piping... another big time saver...
you end up using show run an awful lot, which isn't troubleshooting... show run is hunting and pecking... show run does not help you...
but at least if they are going to make you rely on show run, make available show run interface... no show run interface...
face it, it's not real troubleshooting, it's a flash script... which makes me wary of the troubleshoot section in the ccie lab... if they (cisco) are going to use flash scripts for such an important test, they had better issue the limited command set that is supported on the test to the public ahead of time... anything less is dirty pool...
i cannot imagine sitting the ccie lab without benefit of piping... especially with the troubleshoot section which basically gives you ten minutes a ticket... gimme a friggin break here...
Tuesday, February 5, 2013
dhcp without rules...
r4 is the dhcp server...
if you make r4 the default router of the pool, that will give the client THAT address as it's gateway...
R4#sh run | b dhcp pool cisco
ip dhcp pool cisco
network 10.2.1.0 255.255.255.0
default-router 10.1.4.5
note also there is no matching domain name, irrelevant...
R4#sh ip domain
lab.local
lab.local
cisco
r4 holds the binding for the pc off asw1...
R4#sh ip dhcp bind
Bindings from all pools not associated with VRF:
IP address Client-ID/ Lease expiration Type State Interface
Hardware address/
User name
10.2.1.3 01e8.9a8f.98a7.03 Feb 06 2013 08:19 AM Automatic Active Unknown
ip helper must support the svi, however...
dsw1#sh run int vlan 10
Building configuration...
Current configuration : 158 bytes
!
interface Vlan10
ip address 10.2.1.1 255.255.255.0
ip helper-address 10.1.4.5
standby 10 ip 10.2.1.254
standby 10 priority 110
standby 10 preempt
end
for my money, i'd rather have the gateway for the pc as the virtual ip of the vlan it belongs to regardless of the router which is governing it... as long as ip helper can get to it, you're done...
R4#sh run | b dhcp
ip dhcp pool cisco
network 10.2.1.0 255.255.255.0
default-router 10.2.1.254
the client has as its gateway the hsrp virtual address and it can ping across to the far end...
if the ip helper points to it from the correct vlan on the switch, you can put the dhcp server in any domain, on any device... but for your own sanity, use the hsrp ip because that's it's reason for being...
R4#debug ip dhcp serv pack
DHCP server packet debugging is on.
R4#
*Feb 5 08:44:01.173: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:44:01.177: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:44:01.181: DHCPD: client's VPN is .
*Feb 5 08:44:01.181: DHCPD: DHCPRELEASE message received from client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:44:01.189: DHCPD: removing ARP entry (10.2.1.3 vrf default).
R4#
*Feb 5 08:44:09.773: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:44:09.773: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:44:09.773: DHCPD: client's VPN is .
*Feb 5 08:44:09.773: DHCPD: DHCPDISCOVER received from client 01e8.9a8f.98a7.03 through relay 10.2.1.1.
*Feb 5 08:44:09.781: DHCPD: Saving workspace (ID=0x40000007)
*Feb 5 08:44:09.781: DHCPD: New packet workspace 0x6956B57C (ID=0xE5000008)
R4#
*Feb 5 08:44:11.781: DHCPD: Reprocessing saved workspace (ID=0x40000007)
*Feb 5 08:44:11.785: DHCPD: DHCPDISCOVER received from client 01e8.9a8f.98a7.03 through relay 10.2.1.1.
*Feb 5 08:44:11.785: DHCPD: Sending DHCPOFFER to client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:44:11.785: DHCPD: unicasting BOOTREPLY for client e89a.8f98.a703 to relay 10.2.1.1.
*Feb 5 08:44:11.785: DHCPD: Freeing saved workspace (ID=0x40000007)
*Feb 5 08:44:11.801: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:44:11.801: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:44:11.801: DHCPD: client's VPN is .
R4#
*Feb 5 08:44:11.801: DHCPD: DHCPREQUEST received from client 01e8.9a8f.98a7.03.
*Feb 5 08:44:11.801: DHCPD: Sending DHCPACK to client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:44:11.801: DHCPD: unicasting BOOTREPLY for client e89a.8f98.a703 to relay 10.2.1.1.
R4#
*Feb 5 08:44:15.317: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:44:15.321: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:44:15.325: DHCPD: client's VPN is .
*Feb 5 08:44:15.325: DHCPD: DHCPINFORM received from client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:44:15.325: DHCPD: Sending DHCPACK to client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:44:15.325: DHCPD: unicasting BOOTREPLY for client e89a.8f98.a703 to relay 10.2.1.1.
R4#
*Feb 5 08:45:28.553: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:45:28.553: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:45:28.553: DHCPD: client's VPN is .
*Feb 5 08:45:28.557: DHCPD: DHCPRELEASE message received from client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:45:28.557: DHCPD: removing ARP entry (10.2.1.3 vrf default).
R4#
*Feb 5 08:45:33.733: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:45:33.737: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:45:33.737: DHCPD: client's VPN is .
*Feb 5 08:45:33.737: DHCPD: DHCPDISCOVER received from client 01e8.9a8f.98a7.03 through relay 10.2.1.1.
*Feb 5 08:45:33.737: DHCPD: Saving workspace (ID=0xE5000008)
*Feb 5 08:45:33.741: DHCPD: New packet workspace 0x67EA1BDC (ID=0xA6000009)
R4#
*Feb 5 08:45:35.745: DHCPD: Reprocessing saved workspace (ID=0xE5000008)
*Feb 5 08:45:35.745: DHCPD: DHCPDISCOVER received from client 01e8.9a8f.98a7.03 through relay 10.2.1.1.
*Feb 5 08:45:35.745: DHCPD: Sending DHCPOFFER to client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:45:35.745: DHCPD: unicasting BOOTREPLY for client e89a.8f98.a703 to relay 10.2.1.1.
*Feb 5 08:45:35.745: DHCPD: Freeing saved workspace (ID=0xE5000008)
*Feb 5 08:45:35.765: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:45:35.765: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:45:35.765: DHCPD: client's VPN is .
R4#
*Feb 5 08:45:35.765: DHCPD: DHCPREQUEST received from client 01e8.9a8f.98a7.03.
*Feb 5 08:45:35.765: DHCPD: Sending DHCPACK to client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:45:35.765: DHCPD: unicasting BOOTREPLY for client e89a.8f98.a703 to relay 10.2.1.1.
R4#
*Feb 5 08:45:39.293: DHCPD: Reload workspace interface FastEthernet0/0 tableid 0.
*Feb 5 08:45:39.297: DHCPD: tableid for 10.1.4.5 on FastEthernet0/0 is 0
*Feb 5 08:45:39.301: DHCPD: client's VPN is .
*Feb 5 08:45:39.305: DHCPD: DHCPINFORM received from client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:45:39.305: DHCPD: Sending DHCPACK to client 01e8.9a8f.98a7.03 (10.2.1.3).
*Feb 5 08:45:39.309: DHCPD: unicasting BOOTREPLY for client e89a.8f98.a703 to relay 10.2.1.1.
Monday, February 4, 2013
troubleshooting, from the horse's mouth...
there are a number of links that provide troubleshooting flow charts at cisco.com
eigrp
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094613.shtml
ospf
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800949f7.shtml
bgp
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009478a.shtml
naturally, for just about any technology, you will find more of the same there...
eigrp
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094613.shtml
ospf
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800949f7.shtml
bgp
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009478a.shtml
naturally, for just about any technology, you will find more of the same there...
native vlan and control traffic...
i got involved in a thread on cln here:
https://learningnetwork.cisco.com/message/279101#279101
on that link you can download a packet capture that i attached...
i've read recently some conflicting ideas about the tagging of control traffic when vlan 1 is not present... my original thought sided with marko that l2 control traffic belonged to the switch.. here is marko's post:
http://blog.ipexpert.com/2011/01/19/old-ccie-myths-vlan-1/
he explores this idea at length, but this idea is incorrect...
this idea is refuted here:
http://www.fragmentationneeded.net/2011/01/revisiting-vlan-1-myth-again.html
and from the horse's mouth here:
(from Cisco Lan Switching Fundamentals)
It
is important to understand the significance of VLAN 1. By default, all
switch ports are part of VLAN 1. VLAN 1 contains control plane traffic
and can contain user traffic. It is recommended that user traffic be
configured on VLANs other than VLAN 1, primarily to prevent unnecessary
user broadcast and multicast traffic from being processed by the Network
Management Processor (NMP) of the supervisor. Although VLAN 1 user
traffic can be pruned from a trunk, it is not the case with control
plane traffic. In fact, in older Cisco Catalyst Software versions (5.4
or earlier), VLAN 1 could not be removed at all from a trunk. Control
plane traffic such as VTP, CDP, and PAgP protocols are tagged with VLAN 1
information and are forwarded on a trunk regardless if the trunk has
pruned VLAN 1.
naturally, i wanted to do my own testing, but my caps never showed tagging... i was using a dhcp windows client for monitoring and in the back of my mind my thought was that i'd never see dot1q tags because my windows nic simply didn't support tagging, therefore wouldn't show in the cap... well, breaking my current working topology was an annoying idea simply to prove that so i moved on with what i was currently working at the time...
this morning, of course, it was nagging me so i had to be sure... turns out that is correct... dot1q tags don't show up in my windows box caps, but they do with the linux caps...
note on dsw1 in the below output that vlan 1 is not included in trunking...
in the cap below note that the control traffic is tagged with vlan 1...
in fact all of the control traffic in the cap is tagged 1... but see for yourself, download the cap from the link and draw your own conclusions... also note that the cap is from the tshoot topology, which means that all supported protocols are represented as they would appear in cisco's topology... naturally it is my representation of that topology; it is not gospel...
have fun...
note about topology: vlan's 4 and 8 support the gns3 environment onto the switched network... so don't let those qinq's confuse you...
https://learningnetwork.cisco.com/message/279101#279101
on that link you can download a packet capture that i attached...
i've read recently some conflicting ideas about the tagging of control traffic when vlan 1 is not present... my original thought sided with marko that l2 control traffic belonged to the switch.. here is marko's post:
http://blog.ipexpert.com/2011/01/19/old-ccie-myths-vlan-1/
he explores this idea at length, but this idea is incorrect...
this idea is refuted here:
http://www.fragmentationneeded.net/2011/01/revisiting-vlan-1-myth-again.html
and from the horse's mouth here:
(from Cisco Lan Switching Fundamentals)
naturally, i wanted to do my own testing, but my caps never showed tagging... i was using a dhcp windows client for monitoring and in the back of my mind my thought was that i'd never see dot1q tags because my windows nic simply didn't support tagging, therefore wouldn't show in the cap... well, breaking my current working topology was an annoying idea simply to prove that so i moved on with what i was currently working at the time...
this morning, of course, it was nagging me so i had to be sure... turns out that is correct... dot1q tags don't show up in my windows box caps, but they do with the linux caps...
note on dsw1 in the below output that vlan 1 is not included in trunking...
dsw1#sh int trunk
Port Mode Encapsulation Status Native vlan
Po1 on 802.1q trunking 200
Po2 on 802.1q trunking 200
Port Vlans allowed on trunk
Po1 10,20,200
Po2 10,20,200
Port Vlans allowed and active in management domain
Po1 10,20,200
Po2 10,20,200
Port Vlans in spanning tree forwarding state and not pruned
Po1 10,20,200
Po2 10,20,200
Port Mode Encapsulation Status Native vlan
Po1 on 802.1q trunking 200
Po2 on 802.1q trunking 200
Port Vlans allowed on trunk
Po1 10,20,200
Po2 10,20,200
Port Vlans allowed and active in management domain
Po1 10,20,200
Po2 10,20,200
Port Vlans in spanning tree forwarding state and not pruned
Po1 10,20,200
Po2 10,20,200
in the cap below note that the control traffic is tagged with vlan 1...
in fact all of the control traffic in the cap is tagged 1... but see for yourself, download the cap from the link and draw your own conclusions... also note that the cap is from the tshoot topology, which means that all supported protocols are represented as they would appear in cisco's topology... naturally it is my representation of that topology; it is not gospel...
have fun...
note about topology: vlan's 4 and 8 support the gns3 environment onto the switched network... so don't let those qinq's confuse you...
Sunday, February 3, 2013
trap receiver...
is a free program that, guess what, receives snmp traps... this can be exciting for about 9 seconds...
you can download it here...
http://www.trapreceiver.com/
setting up snmp is easy...
you can enable all traps or some, then send them to the collector...
dsw1(config)#snmp-server enable traps ?
auth-framework Enable SNMP CISCO-AUTH-FRAMEWORK-MIB traps
bgp Enable BGP traps
bridge Enable SNMP STP Bridge MIB traps
cef Enable SNMP CEF traps
cluster Enable Cluster traps
config Enable SNMP config traps
config-copy Enable SNMP config-copy traps
config-ctid Enable SNMP config-ctid traps
copy-config Enable SNMP config-copy traps
cpu Allow cpu related traps
dot1x Enable SNMP dot1x traps
eigrp Enable SNMP EIGRP traps
energywise Enable SNMP ENERGYWISE traps
entity Enable SNMP entity traps
envmon Enable SNMP environmental monitor traps
errdisable Enable SNMP errdisable notifications
event-manager Enable SNMP Embedded Event Manager traps
flash Enable SNMP FLASH notifications
hsrp Enable SNMP HSRP traps
ipmulticast Enable SNMP ipmulticast traps
etc...
then look at your butterfly collector...
this is a real over simplification, and you already know this... nothing earth shattering here... go watch the superbowl or something...
you can download it here...
http://www.trapreceiver.com/
setting up snmp is easy...
dsw1#sh run | b snmp
snmp-server community ccie RO
snmp-server enable traps vlancreate
snmp-server host 10.2.1.3 snmp vlancreate
snmp-server community ccie RO
snmp-server enable traps vlancreate
snmp-server host 10.2.1.3 snmp vlancreate
you can enable all traps or some, then send them to the collector...
dsw1(config)#snmp-server enable traps ?
auth-framework Enable SNMP CISCO-AUTH-FRAMEWORK-MIB traps
bgp Enable BGP traps
bridge Enable SNMP STP Bridge MIB traps
cef Enable SNMP CEF traps
cluster Enable Cluster traps
config Enable SNMP config traps
config-copy Enable SNMP config-copy traps
config-ctid Enable SNMP config-ctid traps
copy-config Enable SNMP config-copy traps
cpu Allow cpu related traps
dot1x Enable SNMP dot1x traps
eigrp Enable SNMP EIGRP traps
energywise Enable SNMP ENERGYWISE traps
entity Enable SNMP entity traps
envmon Enable SNMP environmental monitor traps
errdisable Enable SNMP errdisable notifications
event-manager Enable SNMP Embedded Event Manager traps
flash Enable SNMP FLASH notifications
hsrp Enable SNMP HSRP traps
ipmulticast Enable SNMP ipmulticast traps
etc...
then look at your butterfly collector...
this is a real over simplification, and you already know this... nothing earth shattering here... go watch the superbowl or something...
ospf authentication...
every now and then i just have to force myself to do this again and again... can't make mistakes with stupid shit like this during pucker time... this'll kill you on the clock... it's gotta be automatic everywhere you can make it automatic... take no prisoners...
R4#debug ip ospf adj
OSPF adjacency debugging is on
R4#
Feb 3 12:42:38.416: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#debug
Feb 3 12:42:47.548: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#debug ip ospf pack
OSPF packet debugging is on
R4#
Feb 3 12:42:57.440: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#
Feb 3 12:42:58.688: OSPF-1 PAK : rcv. v:2 t:1 l:48 rid:3.3.3.3 aid:0.0.0.34 chk:0 aut:2 keyid:1 seq:0x510E5419 from Serial1/0.34
R4#
Feb 3 12:43:07.004: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#
Feb 3 12:43:08.044: OSPF-1 PAK : rcv. v:2 t:1 l:48 rid:3.3.3.3 aid:0.0.0.34 chk:0 aut:2 keyid:1 seq:0x510E5422 from Serial1/0.34
R4#un all
All possible debugging has been turned off
version:ospfv2 t:1 hello l:48 length rid: router id aid: area id chk: checksum aut: authentication type keyid: md5 key seq: sequence number
http://www.cisco.com/en/US/docs/ios/12_3/debug/command/reference/dbg_i2g.html#wp1055528
R4#sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:01
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 5, maximum is 5
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 3.3.3.3
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1
R4#config t
Enter configuration commands, one per line. End with CNTL/Z.
R4(config)#int s1/0.34
R4(config-subif)#no ip ospf authenti mess
R4(config-subif)#no ip ospf message-digest-key 1 md5 cisco
R4(config-subif)#
Feb 3 12:56:56.259: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0.34 from FULL to DOWN, Neighbor Down: Dead timer expired
R4(config-subif)#do sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:01
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 5, maximum is 5
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 0, Adjacent neighbor count is 0
Suppress hello for 0 neighbor(s)
(no messass digest crap here where it's supposed to be)
R4(config-subif)#ip ospf authen mess
R4(config-subif)#ip ospf message-digest-key 1 md5 cisco
R4(config-subif)#end
Feb 3 12:57:42.875: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0.34 from LOADING to FULL, Loading Done
R4(config-subif)#end
R4#
Feb 3 12:57:45.391: %SYS-5-CONFIG_I: Configured from console by console
R4#sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:04
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 5
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 3.3.3.3
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1
R4#debug ip ospf adj
OSPF adjacency debugging is on
R4#
Feb 3 12:42:38.416: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#debug
Feb 3 12:42:47.548: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#debug ip ospf pack
OSPF packet debugging is on
R4#
Feb 3 12:42:57.440: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#
Feb 3 12:42:58.688: OSPF-1 PAK : rcv. v:2 t:1 l:48 rid:3.3.3.3 aid:0.0.0.34 chk:0 aut:2 keyid:1 seq:0x510E5419 from Serial1/0.34
R4#
Feb 3 12:43:07.004: OSPF-1 ADJ Se1/0.34: Send with youngest Key 1
R4#
Feb 3 12:43:08.044: OSPF-1 PAK : rcv. v:2 t:1 l:48 rid:3.3.3.3 aid:0.0.0.34 chk:0 aut:2 keyid:1 seq:0x510E5422 from Serial1/0.34
R4#un all
All possible debugging has been turned off
version:ospfv2 t:1 hello l:48 length rid: router id aid: area id chk: checksum aut: authentication type keyid: md5 key seq: sequence number
http://www.cisco.com/en/US/docs/ios/12_3/debug/command/reference/dbg_i2g.html#wp1055528
R4#sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:01
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 5, maximum is 5
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 3.3.3.3
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1
R4#config t
Enter configuration commands, one per line. End with CNTL/Z.
R4(config)#int s1/0.34
R4(config-subif)#no ip ospf authenti mess
R4(config-subif)#no ip ospf message-digest-key 1 md5 cisco
R4(config-subif)#
Feb 3 12:56:56.259: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0.34 from FULL to DOWN, Neighbor Down: Dead timer expired
R4(config-subif)#do sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:01
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 5, maximum is 5
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 0, Adjacent neighbor count is 0
Suppress hello for 0 neighbor(s)
(no messass digest crap here where it's supposed to be)
R4(config-subif)#ip ospf authen mess
R4(config-subif)#ip ospf message-digest-key 1 md5 cisco
R4(config-subif)#end
Feb 3 12:57:42.875: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0.34 from LOADING to FULL, Loading Done
R4(config-subif)#end
R4#
Feb 3 12:57:45.391: %SYS-5-CONFIG_I: Configured from console by console
R4#sh ip ospf int s1/0.34
Serial1/0.34 is up, line protocol is up
Internet Address 10.1.1.10/30, Area 34, Attached via Network Statement
Process ID 1, Router ID 10.1.4.9, Network Type POINT_TO_POINT, Cost: 64
Topology-MTID Cost Disabled Shutdown Topology Name
0 64 no no Base
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:04
Supports Link-local Signaling (LLS)
Cisco NSF helper support enabled
IETF NSF helper support enabled
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 5
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 3.3.3.3
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1
bgp states...
the ccie is your super bowl... the ccie doesn't happen after the super bowl, or during the halftime show... the ccie doesn't get postponed by reruns of breaking bad or the latest zombie stupidity out there... the ccie is always there, taunting you, telling you you're not good enough... get pissed...
do you have these memorized? are they second nature? if this ever gets old you will never be ccie... does scott morris sleep? of course not... wake up...
do you know all of ospf's lsa's... the opaque's too...
router, network, network summary, summary asbr, external, nssa... that's 1,2,3,4,5 and 7... 6 is group or mospf, 8 is external, 9,10,11 are opaque, link-local scope, area local scope, AS scope
what are the eigrp packet types, there are 7?
hello, update, query, reply, ack, sia query, sia reply...
which ones require an ack? hint, it's not hello or ack...
ospf neighbor states:
down, attempt (nbma), init, two way, exstart, exchange, loading, full
ip packet header:
v,hl,diffserv,total length,identification,flags,frag offset,ttl,protocol, header checksum, sa,da,options,data
ospf network types:
broadcast, nbma, point-to-point, multipoint b'cast, and mpoint nbma
bgp attribute preference:
w,lp,local origination,as-path,origin code, lowest med, ebgp/ibgp, ibgp to bgp next hop, age, rid
ospf router types:
bb, internal, abr,asbr
ospf packets:
hello, dbd, lsr, lsu, lsa
ospf areas:
bb,standard, stub, totally stub, nssa, virtual link
what are you waiting for? get back to your lab...
here is a nice little write up from this guy...
http://ipexptobe.blogspot.com/2011/09/bgp-neighbor-states_15.html
do you have these memorized? are they second nature? if this ever gets old you will never be ccie... does scott morris sleep? of course not... wake up...
do you know all of ospf's lsa's... the opaque's too...
router, network, network summary, summary asbr, external, nssa... that's 1,2,3,4,5 and 7... 6 is group or mospf, 8 is external, 9,10,11 are opaque, link-local scope, area local scope, AS scope
what are the eigrp packet types, there are 7?
hello, update, query, reply, ack, sia query, sia reply...
which ones require an ack? hint, it's not hello or ack...
ospf neighbor states:
down, attempt (nbma), init, two way, exstart, exchange, loading, full
ip packet header:
v,hl,diffserv,total length,identification,flags,frag offset,ttl,protocol, header checksum, sa,da,options,data
ospf network types:
broadcast, nbma, point-to-point, multipoint b'cast, and mpoint nbma
bgp attribute preference:
w,lp,local origination,as-path,origin code, lowest med, ebgp/ibgp, ibgp to bgp next hop, age, rid
ospf router types:
bb, internal, abr,asbr
ospf packets:
hello, dbd, lsr, lsu, lsa
ospf areas:
bb,standard, stub, totally stub, nssa, virtual link
what are you waiting for? get back to your lab...
here is a nice little write up from this guy...
http://ipexptobe.blogspot.com/2011/09/bgp-neighbor-states_15.html
1. IDLE State : veryfing route to neighbor
BGP refuses all incoming connections. No BGP resources are allocated in Idle state, and no incoming BGP connections are allowed.
2. Connect State :
BGP
waits for a TCP connection to be completed. If successful, the BGP
state machine moves into OpenSent state after sending the OPEN message
to the peer. Failure in this state could result in either going into
Active state or Connect state, or reverting back to Idle state,
depending on the failure reasons.
3. Active State : attempting connectivity to neighbor
In
this state, a TCP connection is initiated to establish a BGP peer
relationship. If successful, BGP sends its OPEN message to the peer and
moves to OpenSent state. Failure can result in going to the Active or
Idle states.
4. OpentSent State : open message sent to neighbor
After sending an OPEN message to the peer, BGP waits in this state for the OPEN reply.
If
a successful reply comes in, the BGP state moves to OpenConfirm and a
keepalive is sent to the peer. Failure can result in sending the BGP
state back to Idle or Active.
5. OpenConfirm State : neighbor replied with open message
The BGP state machine is one step away from reaching its final state (Established).
BGP
waits in this state for keepalives from the peer. If successful, the
state moves to Established; otherwise, the state moves back to Idle
based on the errors.
6. Established State : connection between neighbors established
This
is the state in which BGP can exchange information between the peers.
The information can be updates, keepalives, or notification.
archive..
set up your tftp server and automatically archive configs...
simple enough
R2#sh run | b archive
archive
path tftp://10.2.1.3/$h
write-memory
time-period 720
$h gets replaced by the hostname... write-memory will cause an archive to occur upon copy run start and the time period is minutes (1440 would be once a day)
R2#sh archive
The maximum archive configurations allowed is 10.
The next archive file will be named tftp://10.2.1.3/R2--1
Archive # Name
1 tftp://10.2.1.3/R2Feb--3-07-54-52.616-0 <- most="" recent="" span="">
2
3
4
5
6
7
8
9
10 ->
happy backupping...
simple enough
R2#sh run | b archive
archive
path tftp://10.2.1.3/$h
write-memory
time-period 720
$h gets replaced by the hostname... write-memory will cause an archive to occur upon copy run start and the time period is minutes (1440 would be once a day)
R2#sh archive
The maximum archive configurations allowed is 10.
The next archive file will be named tftp://10.2.1.3/R2-
Archive # Name
1 tftp://10.2.1.3/R2Feb--3-07-54-52.616-0 <- most="" recent="" span="">
2
3
4
5
6
7
8
9
10 ->
happy backupping...
Saturday, February 2, 2013
more enterprise tshoot...
i added hostnames...
dsw1#sh run | b ip host
ip host ASW2 192.168.1.132
ip host ASW1 192.168.1.131
ip host DSW2 10.2.1.2 10.2.2.1 192.168.1.130
ip host DSW1 10.2.1.1 10.2.2.2 192.168.1.129
ip host R4 10.1.1.10 10.1.4.5 10.1.4.10
ip host R3 10.1.1.6 10.1.1.9
ip host R2 10.1.1.2 10.1.1.5
ip host R1 10.1.1.1 209.65.200.225
asw1#trace 209.65.200.241
Type escape sequence to abort.
Tracing the route to 209.65.200.241
1 DSW1 (192.168.1.129) 8 msec 4 msec 4 msec
2 R4 (10.1.4.5) 20 msec 8 msec 8 msec
3 R3 (10.1.1.9) 28 msec 28 msec 32 msec
4 R2 (10.1.1.5) 48 msec 48 msec 52 msec
5 R1 (10.1.1.1) 68 msec 68 msec 72 msec
6 209.65.200.226 88 msec 84 msec 80 msec
7 209.65.200.241 100 msec 104 msec *
and hsrp for the three vlans...
dsw1#sh stand brie
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Vl10 10 110 P Active local 10.2.1.2 10.2.1.254
Vl20 20 90 P Standby 10.2.2.1 local 10.2.2.254
Vl200 200 110 P Active local 192.168.1.130 192.168.1.134
i mixed the etherchannels up a bit, routed between the dsw's, lacp and ON...
dsw1#sh etherch summ | b Group
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) - Fa0/19(P) Fa0/20(P)
2 Po2(SU) LACP Fa0/21(P) Fa0/22(P)
3 Po3(RU) LACP Fa0/23(P) Fa0/24(P)
i made r1 the ntp server...
asw1#debug ntp pack
NTP packets debugging is on
asw1#sh ntp assoc
address ref clock st when poll reach delay offset disp
*~10.1.1.1 127.127.1.1 3 50 64 377 59.8 -14.50 3.2
* master (synced), # master (unsynced), + selected, - candidate, ~ configured
asw1#
Feb 2 19:27:26: NTP: xmit packet to 10.1.1.1:
Feb 2 19:27:26: leap 0, mode 3, version 3, stratum 4, ppoll 64
Feb 2 19:27:26: rtdel 0F4D (59.769), rtdsp 04A7 (18.173), refid 0A010101 (10.1)
Feb 2 19:27:26: ref D4B7E6DE.4DA05C2A (14:26:22.303 est Sat Feb 2 2013)
Feb 2 19:27:26: org D4B7E6DE.4266B18C (14:26:22.259 est Sat Feb 2 2013)
Feb 2 19:27:26: rec D4B7E6DE.4DA05C2A (14:26:22.303 est Sat Feb 2 2013)
Feb 2 19:27:26: xmt D4B7E71E.3AE43F2B (14:27:26.230 est Sat Feb 2 2013)
Feb 2 19:27:26: NTP: rcv packet from 10.1.1.1 to 192.168.1.131 on Vlan200:
Feb 2 19:27:26: leap 0, mode 4, version 3, stratum 3, ppoll 64
asw1#
Feb 2 19:27:26: rtdel 0000 (0.000), rtdsp 001D (0.443), refid 7F7F0101 (127.12)
Feb 2 19:27:26: ref D4B7E70F.8C1D3D25 (14:27:11.547 est Sat Feb 2 2013)
Feb 2 19:27:26: org D4B7E71E.3AE43F2B (14:27:26.230 est Sat Feb 2 2013)
Feb 2 19:27:26: rec D4B7E71E.3F56E7AF (14:27:26.247 est Sat Feb 2 2013)
Feb 2 19:27:26: xmt D4B7E71E.40559F25 (14:27:26.251 est Sat Feb 2 2013)
Feb 2 19:27:26: inp D4B7E71E.4C71E8A4 (14:27:26.298 est Sat Feb 2 2013)
added syslog on a dhcp client...
it never stops...
dsw1#sh run | b ip host
ip host ASW2 192.168.1.132
ip host ASW1 192.168.1.131
ip host DSW2 10.2.1.2 10.2.2.1 192.168.1.130
ip host DSW1 10.2.1.1 10.2.2.2 192.168.1.129
ip host R4 10.1.1.10 10.1.4.5 10.1.4.10
ip host R3 10.1.1.6 10.1.1.9
ip host R2 10.1.1.2 10.1.1.5
ip host R1 10.1.1.1 209.65.200.225
asw1#trace 209.65.200.241
Type escape sequence to abort.
Tracing the route to 209.65.200.241
1 DSW1 (192.168.1.129) 8 msec 4 msec 4 msec
2 R4 (10.1.4.5) 20 msec 8 msec 8 msec
3 R3 (10.1.1.9) 28 msec 28 msec 32 msec
4 R2 (10.1.1.5) 48 msec 48 msec 52 msec
5 R1 (10.1.1.1) 68 msec 68 msec 72 msec
6 209.65.200.226 88 msec 84 msec 80 msec
7 209.65.200.241 100 msec 104 msec *
and hsrp for the three vlans...
dsw1#sh stand brie
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Vl10 10 110 P Active local 10.2.1.2 10.2.1.254
Vl20 20 90 P Standby 10.2.2.1 local 10.2.2.254
Vl200 200 110 P Active local 192.168.1.130 192.168.1.134
i mixed the etherchannels up a bit, routed between the dsw's, lacp and ON...
dsw1#sh etherch summ | b Group
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) - Fa0/19(P) Fa0/20(P)
2 Po2(SU) LACP Fa0/21(P) Fa0/22(P)
3 Po3(RU) LACP Fa0/23(P) Fa0/24(P)
i made r1 the ntp server...
asw1#debug ntp pack
NTP packets debugging is on
asw1#sh ntp assoc
address ref clock st when poll reach delay offset disp
*~10.1.1.1 127.127.1.1 3 50 64 377 59.8 -14.50 3.2
* master (synced), # master (unsynced), + selected, - candidate, ~ configured
asw1#
Feb 2 19:27:26: NTP: xmit packet to 10.1.1.1:
Feb 2 19:27:26: leap 0, mode 3, version 3, stratum 4, ppoll 64
Feb 2 19:27:26: rtdel 0F4D (59.769), rtdsp 04A7 (18.173), refid 0A010101 (10.1)
Feb 2 19:27:26: ref D4B7E6DE.4DA05C2A (14:26:22.303 est Sat Feb 2 2013)
Feb 2 19:27:26: org D4B7E6DE.4266B18C (14:26:22.259 est Sat Feb 2 2013)
Feb 2 19:27:26: rec D4B7E6DE.4DA05C2A (14:26:22.303 est Sat Feb 2 2013)
Feb 2 19:27:26: xmt D4B7E71E.3AE43F2B (14:27:26.230 est Sat Feb 2 2013)
Feb 2 19:27:26: NTP: rcv packet from 10.1.1.1 to 192.168.1.131 on Vlan200:
Feb 2 19:27:26: leap 0, mode 4, version 3, stratum 3, ppoll 64
asw1#
Feb 2 19:27:26: rtdel 0000 (0.000), rtdsp 001D (0.443), refid 7F7F0101 (127.12)
Feb 2 19:27:26: ref D4B7E70F.8C1D3D25 (14:27:11.547 est Sat Feb 2 2013)
Feb 2 19:27:26: org D4B7E71E.3AE43F2B (14:27:26.230 est Sat Feb 2 2013)
Feb 2 19:27:26: rec D4B7E71E.3F56E7AF (14:27:26.247 est Sat Feb 2 2013)
Feb 2 19:27:26: xmt D4B7E71E.40559F25 (14:27:26.251 est Sat Feb 2 2013)
Feb 2 19:27:26: inp D4B7E71E.4C71E8A4 (14:27:26.298 est Sat Feb 2 2013)
added syslog on a dhcp client...
it never stops...
Subscribe to:
Posts (Atom)







