achille's lists...

i hate ACL's, firewalls, filters and especially window's stupid firewall...  as a network guy i figure it to be my sworn duty to allow access to the wire, to give john Q user  the unmitigated freedom of  byte exploration... a perfect world... of course it becomes evident that john Q user will eventually get himself or the network in some kind of trouble with this very freedom...  so we first open the door, then slam it shut...

the standard ACL is concerned with the source... not a lot of flexibility there...  however, standard acl's shine  when used with NAT for a quick, painless solution to get the private network users released into the wild...

extended and named acl's are another universe, providing more elegant examples of slamming the door on john Q user...

stepping back...  why are standard acl's best utilized nearest the destination, and extended acl's best utilized nearest the source, besides the fact that cisco and odom and lammle, et al, have been pounding this into our collective minds for years? processing and WAN overhead, that's why... stopping hitler at Munich, like Clemenza said...  filter that shit where it lives (extended) and block that shit before it gets in (standard)

filtering telnet is easy; just turn it off and use SSH and/or VPN instead...

disallowing ICMP onto your private network is another matter...

r2620_01(config)#ip access-list extended no_outside_pings
r2620_01(config-ext-nacl)#deny icmp any any echo log
r2620_01(config-ext-nacl)#permit ip any any
r2620_01(config-ext-nacl)#exit
r2620_01(config)#int s0/1
r2620_01(config-if)#ip access-group no_outside_pings in
r2620_01(config-if)#

then:

r2620_03#ping 10.0.30.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.30.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
r2620_03#

stardate log 2620_01:

r2620_01#
Dec 10 08:13:56.815: %SEC-6-IPACCESSLOGDP: list no_outside_pings denied icmp 10.
0.30.2 -> 10.0.30.1 (8/0), 5 packets
r2620_01#

but do yourself a favor... keep ping  alive on the LAN

frame dash relay...

how to set up a frame relay lab using 3 routers...  the dirty...
 who in the hell uses frame anymore...

take two routers and call me in the morning
here we go...
  router1 will be our frame switch


frame commands per interface on frame switch... frame-relay intf-type dce is a precaution... look at the cables and you won't need those commands...
r1
interface Serial0/0
 no ip address
 encapsulation frame-relay
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 102 interface Serial0/1 103
 end

interface Serial0/1
 no ip address
 encapsulation frame-relay
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 103 interface Serial0/0 102
end

on r2
interface Serial0/0
 ip address 10.0.20.2 255.255.255.0
 encapsulation frame-relay
 frame-relay interface-dlci 102
 frame-relay lmi-type ansi
end

on r3
interface Serial0/0
 ip address 10.0.20.10 255.255.255.0
 encapsulation frame-relay
 frame-relay interface-dlci 103
 frame-relay lmi-type ansi
end

the addresses on  r2 and r3 have to be in the same subnet
the dlci's are the local dlci's on each router...

show frame route is your best friend r1 (frame switch)
r2620_01#sh frame route
Input Intf      Input Dlci      Output Intf     Output Dlci     Status
Serial0/0       102             Serial0/1       103             active
Serial0/1       103             Serial0/0       102             active
r2620_01#

r2620_01#sh frame lmi

LMI Statistics for interface Serial0/0 (Frame Relay DCE) LMI TYPE = ANSI
  Invalid Unnumbered info 0             Invalid Prot Disc 0
  Invalid dummy Call Ref 0              Invalid Msg Type 0
  Invalid Status Message 0              Invalid Lock Shift 0
  Invalid Information ID 0              Invalid Report IE Len 0
  Invalid Report Request 0              Invalid Keep IE Len 0
  Num Status Enq. Rcvd 2                Num Status msgs Sent 2
  Num Update Status Sent 0              Num St Enq. Timeouts 0

LMI Statistics for interface Serial0/1 (Frame Relay DCE) LMI TYPE = ANSI
  Invalid Unnumbered info 0             Invalid Prot Disc 0
  Invalid dummy Call Ref 0              Invalid Msg Type 0
  Invalid Status Message 0              Invalid Lock Shift 0
  Invalid Information ID 0              Invalid Report IE Len 0
  Invalid Report Request 0              Invalid Keep IE Len 0
  Num Status Enq. Rcvd 3                Num Status msgs Sent 3
  Num Update Status Sent 0              Num St Enq. Timeouts 0
r2620_01#

r2620_02#ping 10.0.20.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.20.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/56/56 ms
r2620_02#

r2620_02#sh fram lmi

LMI Statistics for interface Serial0/0 (Frame Relay DTE) LMI TYPE = ANSI
  Invalid Unnumbered info 0             Invalid Prot Disc 0
  Invalid dummy Call Ref 0              Invalid Msg Type 0
  Invalid Status Message 0              Invalid Lock Shift 0
  Invalid Information ID 0              Invalid Report IE Len 0
  Invalid Report Request 0              Invalid Keep IE Len 0
  Num Status Enq. Sent 806              Num Status msgs Rcvd 804
  Num Update Status Rcvd 0              Num Status Timeouts 3
  Last Full Status Req 00:00:55         Last Full Status Rcvd 00:00:55
r2620_02#

just like that... lose the ansi statement on one end and watch it drop...

CHAP crap...

i read somewhere that global service password-encryption would not encrypt a CHAP password... this is false... proof below...

r2620_03#sh run
Building configuration...

Current configuration : 1241 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
 then:
username r2620_01 password 0 cisco
ok... 


r2620_03#config t
Enter configuration commands, one per line.  End with CNTL/Z.
r2620_03(config)#service password-encry
r2620_03(config)#end
r2620_03#

 then show run reveals:

username r2620_01 password 7 0822455D0A16

 CHAP still works and the username password is encrypted, however, from the horses mouth:

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml


 The service password-encryption global configuration command directs the Cisco IOS software to encrypt the passwords, Challenge Handshake Authentication Protocol (CHAP) secrets, and similar data that are saved in its configuration file. Such encryption is useful in order to prevent casual observers from reading passwords, such as when they look at the screen over the muster of an administrator. However, the algorithm used by the service password-encryption command is a simple Vigenère cipher. The algorithm is not designed to protect configuration files against serious analysis by even slightly sophisticated attackers and must not be used for this purpose. Any Cisco IOS configuration file that contains encrypted passwords must be treated with the same care that is used for a cleartext list of those same passwords.

Cisco's advice is:

The feature Enhanced Password Security, introduced in Cisco IOS Software Release 12.2(8)T, allows an administrator to configure MD5 hashing of passwords for the username command. Prior to this feature, there were two types of passwords: Type 0, which is a cleartext password, and Type 7, which uses the algorithm from the Vigenère cipher. The Enhanced Password Security feature cannot be used with protocols that require the cleartext password to be retrievable, such as CHAP.
In order to encrypt a user password with MD5 hashing, issue the username secret global configuration command.

username  secret 

the debugs below (debug ppp authenti, debug ppp negotiation) deserve a look... i switched from hdlc to ppp to force this...

r2620_03(config)#int s0/0
r2620_03(config-if)#encap ppp
r2620_03(config-if)#
*Mar  8 07:26:55.435: Se0/0 PPP: Phase is DOWN, Setup
*Mar  8 07:26:55.435: Se0/0 PPP: Using default call direction
*Mar  8 07:26:55.435: Se0/0 PPP: Treating connection as a dedicated line
*Mar  8 07:26:55.435: Se0/0 PPP: Session handle[7F00000B] Session id[0]
*Mar  8 07:26:55.435: Se0/0 PPP: Phase is ESTABLISHING, Active Open
*Mar  8 07:26:55.435: Se0/0 PPP: Authorization required
*Mar  8 07:26:55.439: Se0/0 LCP: O CONFREQ [Closed] id 1 len 15
*Mar  8 07:26:55.439: Se0/0 LCP:    AuthProto CHAP (0x0305C22305)
*Mar  8 07:26:55.439: Se0/0 LCP:    MagicNumber 0x265EC040 (0x0506265EC040)
*Mar  8 07:26:55.443: Se0/0 LCP: I CONFACK [REQsent] id 1 len 15
r2620_03(config-if)#
*Mar  8 07:26:55.443: Se0/0 LCP:    AuthProto CHAP (0x0305C22305)
*Mar  8 07:26:55.447: Se0/0 LCP:    MagicNumber 0x265EC040 (0x0506265EC040)
r2620_03(config-if)#
*Mar  8 07:26:56.479: Se0/0 LCP: I CONFREQ [ACKrcvd] id 218 len 15
*Mar  8 07:26:56.483: Se0/0 LCP:    AuthProto CHAP (0x0305C22305)
*Mar  8 07:26:56.483: Se0/0 LCP:    MagicNumber 0x18E6ABAE (0x050618E6ABAE)
*Mar  8 07:26:56.483: Se0/0 LCP: O CONFACK [ACKrcvd] id 218 len 15
*Mar  8 07:26:56.483: Se0/0 LCP:    AuthProto CHAP (0x0305C22305)
*Mar  8 07:26:56.483: Se0/0 LCP:    MagicNumber 0x18E6ABAE (0x050618E6ABAE)
*Mar  8 07:26:56.483: Se0/0 LCP: State is Open
*Mar  8 07:26:56.483: Se0/0 PPP: Phase is AUTHENTICATING, by both
*Mar  8 07:26:56.487: Se0/0 CHAP: O CHALLENGE id 1 len 29 from "r2620_03"
*Mar  8 07:26:56.491: Se0/0 CHAP: I CHALLENGE id 5 len 29 from "r2620_01"
*Mar  8 07:26:56.491: Se0/0 CHAP: Using hostname from unknown source
*Mar  8 07:26:56.495: Se0/0 CHAP: Using password from AAA
*Mar  8 07:26:56.495: Se0/0 CHAP: O RESPONSE id 5 len 29 from "r2620_03"
*Mar  8 07:26:56.495: Se0/0 CHAP: I RESPONSE id 1 len 29 from "r2620_01"
*Mar  8 07:26:56.495: Se0/0 PPP
r2620_03(confi: Phase is FORWARDING, Attempting Forward
*Mar  8 07:26:56.495: Se0/0 PPP: Phase is AUTHENTICATING, Unauthenticated User
*Mar  8 07:26:56.499: Se0/0 PPP: Sent CHAP LOGIN Request
*Mar  8 07:26:56.499: Se0/0 PPP: Received LOGIN Response PASS
*Mar  8 07:26:56.503: Se0/0 PPP: Phase is FORWARDING, Attempting Forward
*Mar  8 07:26:56.503: Se0/0 PPP: Phase is AUTHENTICATING, Authenticated User
*Mar  8 07:26:56.503: Se0/0 PPP: Sent LCP AUTHOR Request
*Mar  8 07:26:56.503: Se0/0 PPP: Sent IPCP AUTHOR Request
*Mar  8 07:26:56.507: Se0/0 LCP: Received AAA AUTHOR Response PASS
*Mar  8 07:26:56.507: Se0/0 IPCP: Received AAA AUTHOR Response PASS
*Mar  8 07:26:56.507: Se0/0 CHAP: O SUCCESS id 1 len 4
*Mar  8 07:26:56.511: Se0/0 CHAP: I SUCCESS id 5 len 4
*Mar  8 07:26:56.511: Se0/0 PPP: Phase is UP
*Mar  8 07:26:56.511: Se0/0 IPCP: O CONFREQ [Closed] id 1 len 10
*Mar  8 07:26:56.515: Se0/0 IPCP:    Address 10.0.30.2 (0x03060A001E02)
*Mar  8 07:26:56.515: Se0/0 PPP: Sent CDPCP AUTHOR Request
*Mar  8 07:26:56.515: Se0/0 PPP: Process pending ncp packets
*Mar  8 07:26:56.515: Se0/0 IPCP: I CONFREQ [REQsent] id 1 len 10
*Mar  8 07:26:56.519: Se0/0 IPCP:    Address 10.0.30.1 (0x03060A001E01)
*Mar  8 07:26:56.519: Se0/0 AAA/AUTHOR/IPCP: Start.  Her address 10.0.30.1, we w
ant 0.0.0.0
*Mar  8 07:26:56.519: Se0/0 PPP: Sent IPCP AUTHOR Request
*Mar  8 07:26:56.523: Se0/0 AAA/AUTHOR/IPCP: Reject 10.0.30.1, using 0.0.0.0
*Mar  8 07:26:56.523: Se0/0 AAA/AUTHOR/IPCP: Done.  Her address 10.0.30.1, we wa
nt 0.0.0.0
*Mar  8 07:26:56.523: Se0/0 IPCP: O CONFACK [REQsent] id 1 len 10
*Mar  8 07:26:56.523: Se0/0 IPCP:    Address 10.0.30.1 (0x03060A001E01)
*Mar  8 07:26:56.523: Se0/0 CDPCP: Received AAA AUTHOR Response PASS
*Mar  8 07:26:56.527: Se0/0 CDPCP: O CONFREQ [Closed] id 1 len 4
*Mar  8 07:26:56.527: Se0/0 IPCP: I CONFACK [ACKsent] id 1 len 10
*Mar  8 07:26:56.527: Se0/0 IPCP:    Address 10.0.30.2 (0x03060A001E02)
*Mar  8 07:26:56.527: Se0/0 IPCP: State is Open
*Mar  8 07:26:56.531: Se0/0 IPCP: Install route to 10.0.30.1
*Mar  8 07:26:56.531: Se0/0 CDPCP: I CONFREQ [REQsent] id 1 len 4
*Mar  8 07:26:56.535: Se0/0 CDPCP: O CONFACK [REQsent] id 1 len 4
*Mar  8 07:26:56.535: Se0/0 CDPCP: I CONFACK [ACKsent] id 1 len 4
*Mar  8 07:26:56.535: Se0/0 CDPCP: State is Open
*Mar  8 07:26:57.431: Se0/0 IPCP: Install route to 10.0.30.1
*Mar  8 07:26:58.375: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.30.1 (Seri
al0/0) is up: new adjacency
*Mar  8 07:26:58.431: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0,
 changed state to upg-if)#
r2620_03(config-if)#

so there...

rapid-pvst

it's stp per vlan, and faster... go figure...  yes virginia, every vlan has it's own christmas tree with a load balancing ornament on top...  tuning the priority will allow some of the members of the vlan to use one of the supported links while other members of the vlan will use the one's normally blocked by stp, instead of all using the same forwarding link...

all output guaranteed from my NOHO...  (new office home office)

sw2950_02#sh spann vlan 2

VLAN0002
  Spanning tree enabled protocol rstp
  Root ID    Priority    32770
             Address     0009.b73f.ce80
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32770  (priority 32768 sys-id-ext 2)
             Address     0009.b73f.ce80
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg BLK 19        128.1    P2p
Fa0/2            Desg BLK 19        128.2    P2p
Fa0/9            Desg BLK 19        128.9    P2p
Fa0/23          Desg FWD 19        128.23   P2p
Fa0/24          Desg BLK 19        128.24   P2p

a minor adjustment gives us this...

sw2950_02#config t
Enter configuration commands, one per line.  End with CNTL/Z.
sw2950_02(config)#int fa0/24
sw2950_02(config-if)#spann vlan 2 port-priority 0
sw2950_02(config-if)#end
sw2950_02#
2w0d: %SYS-5-CONFIG_I: Configured from console by console
sw2950_02#sh spann vl 2

VLAN0002
  Spanning tree enabled protocol rstp
  Root ID    Priority    4098
             Address     0009.b73f.ce80
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    4098   (priority 4096 sys-id-ext 2)
             Address     0009.b73f.ce80
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Fa0/2            Desg FWD 19        128.2    P2p
Fa0/9            Desg FWD 19        128.9    P2p
Fa0/23          Desg FWD 19        128.23   P2p
Fa0/24          Desg FWD 19          0.24   P2p

sw2950_02#

aaaaaahhhhhhhhhhhhh...

ARP, ARP, baby...

ARP- address resolution protocol

according to wikipedia : http://en.wikipedia.org/wiki/Address_Resolution_Protocol

Address Resolution Protocol (ARP) is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826

and there you have it...

a host wants to send an unknown host a mess,
DNS supplies the host  unkown's IP address
layer 2 has no clue
it ARP's for the cue
so IP is assigned a hardware address

sorry...

show inventory...

r2620_01#sh inventory
NAME: "2620XM chassis", DESCR: "2620XM chassis"
PID: C2620XM-1FE       , VID: 2.0, SN: JAE08030E04

NAME: "WAN Interface Card - Serial (1T) on Slot 0 Subslot 0", DESCR: "WAN Interf
ace Card - Serial (1T)"
PID: WIC-1T=           , VID: 1.0, SN: 19265316

NAME: "WAN Interface Card - Serial (1T) on Slot 0 Subslot 1", DESCR: "WAN Interf
ace Card - Serial (1T)"
PID: WIC-1T=           , VID: 1.1, SN: 11326988

NAME: "C2600 4 port Voice PM on Slot 1", DESCR: "C2600 4 port Voice PM"
PID: NM-2V=            , VID: 1.1, SN: 31474446

NAME: "Two port FXS voice interface daughtercard on Slot 1 Subslot 0", DESCR: "T
wo port FXS voice interface daughtercard"
PID: VIC-2FXS=         , VID: 1.1, SN: 25080702


r2620_01#

phone home...

posts on this coming soon...

somebody call the WANbulance...

WAN types

Leased line- dedicated, always on circuit between two endpoints. More expensive than packet switched

Dial/circuit switched- dedicated bandwidth per call duration, cheaper than leased especially when constant connectivity is not essential.  A good back up for packet switched or leased

Packet switched- virtual circuits between two points, contracted traffic rates.  Consists of a leased line from the site to provider network and usually cheaper than leased

DCE is always the clock rate provider

HDLC and PPP provision data delivery across a single serial point to point link

HDLC and  PPP can use Synchronous serial; PPP can also use Asynchronous.

Synchronous WAN datalink protocols are frame oriented.

HDLC and PPP define idle frames, sending back and forth signal transitions to maintain clock synchronization. 

Synchronous protocols allow more throughput than do asynchronous, but async uses less expensive hardware because transitions do not need to be monitored to adjust clock rate.  Between routers, synchronous is usually preferred.  A PC through a modem to an ISP uses Async. 

Both PPP and HDLC perform error detection using an FCS in the frame trailer.  Frames with errors are discarded.  Error recovery may be performed by the datalink layer protocol, a higher layer protocol or not at all.  Error recovery results in the retransmission of  errored or lost frames.  Again error detection is just that, and errored frames are discarded.

HDLC has a proprietary protocol type field; PPP has a standardized protocol type field.  This field defines the type of packet encapsulated in the frame. 

HDLC only supports synchronous without error correction, while PPP supports async and sync, and error correction is supported but not on by default.

Encap PPP will place the interface in PPP mode.  No encap PPP will place the interface in HDLC and remove all traces of PPP, including other config commands.  Encap hdlc also accomplishes this.

PPP has more features than HDLC, and is therefore preferred. To wit:

PPP has at it’s heart LCP (link control protocol)  LCP provides:

   Error detection in the form of Link Quality Monitoring.  LQM determines the quality of a link based on its errored percentage.  It will take a link down based on a configuration determined amount of loss.

    Looped link detection using Magic Number.  Magic number messages are passed among routers.  Receipt of a magic number means the link is looped.  A config setting determines whether or not a link should be shut (in redundant routes)

    Multilink using Multilink PPP.  Fragmented packets are load balanced across multiple links.

    Authentication using PAP or CHAP.  PAP and CHAP can exchange identities on each of the links. (security) PAP is clear message, CHAP uses MD5 hashing. The username is the opposite routers hostname, and vice versa, the passwords are the same. Until there is a match on both sides, the link will come down.

disclaimer...

none of the information on here is original, however it is not copy and paste unless otherwise attributed...  all of this information is available in books and on the internet, at cisco's site... what i've done here is sift the information through my addled brain, rewrite it, and re-present it... in so doing it helps me understand the salient points better...

you are much better off  dissecting Odom, Lammle, Bryant, Scott Morris, cisco's site, forums, youtube tutorials, GNS3, et al, than to trust my information... AGAIN, this is for me, not you...take it all with a grain of salt, or don't take it at all...

ICMP is your lover...

ICMP

Part of the network layer; instrumental in controlling and managing, troubleshooting.  There is no transport header, the ICMP message resides inside an IP packet.  Rfc 792

Echo request/reply

Sent and received by ping.  Pinging means sending an echo request.  Any data sent in echo request is returned in echo reply.  See extended ping.

Destination unreachable

1) network unreachable-no match in routing table at destination- sent by router

2) host unreachable- routes to destination network but no host response- sent by router

3)  can’t fragment- don’t fragment bit is set and a router must fragment in order to forward the packet (packet too large)- sent by router

4) protocol unreachable(unlikely, TCP or UDP)- delivered to host but layer 4 (transport) protocol is not available- sent by host

5) port unreachable- delivered to host, but destination port is not open- sent by host

ping codes: ! = echo received

                   . = nothing received before ping time out

                 U = unknown host

                 N = unknown network

                 P = unreachable port

                Q = source quench

                M = can’t fragment code

                 ? = packet unknown

Time exceeded

TTL (time to live) field in IP header has expired, therefore discarded (decremented by a router before forwarding; at zero, see ya) TRACE uses time exceeded

Redirect 

Used to tell the host there is a better local router to ship the packet to