GRE Tunnels in a Hub-Spoke Topology w/ EIGRP (Lab) #1

Our company DasBoot Corp. has opened a few offices in Turkey.
The corporate offices are in sunny Izmir and there is one branch in Istanbul, and two in Ankara.

They all have basic Internet connectivity to our trusted ISP: DynamiteBBS. Which by the way is running IS-IS in its backbone with MPLS on top.

As the Network engineer of DasBoot, we decide to create tunnels in a hub-spoke fashion, connecting our branches to the corporate network. We use private addressing in our network (eg. 172.16.0.0). Here's a demonstration of running EIGRP to facilitate full connectivity between our networks. I know not too complicated but good practice and extensible lab anyways. Enjoy..
(Download GNS3 Project files)

My favorite Firefox addons

My browser of choice has been Firefox since the beginning, the 1.0 version in 2004. Before that I had been a longtime user of Opera.
I've been happily using the 3.5 version for a while and here are my favorite addons:

NoScript: It's a must have security addon IMHO.
Session Manager: A successful session manager. Very reliable and uses light resources.
Secure Login: Keeps track of my passwords for Forums/other sites that have low security priority on my list. I try to use different credentials for most sites.
oldbar: Brings back the Old Address Bar from version 2.
gspace: Use your gmail account space as a file cabinet.

ISCW in the bag

I'm almost there, one to go!
Been reading up on ONT for a while, so this should be quick.

Cisco Type 5 and Type 7 passwords

Cisco uses two types of password encryption to store your passwords. Type 7 is the Cisco proprietary method (Vigenere cypher) and is weak. The Type5 is encrypted using MD5 hashing, and is considered pretty strong. The "enable secret" password is stored using Type 5.

One can easily crack the Type7 passwords w/ utilities that are available on the net.
You can also do it straight from inside the IOS. Just create a key chain, and copy paste the encrypted string to the "key-string 7". Here's how:

GRE Tunnel w/ IPsec protection, (and ISAKMP association using RSA keys)

1. Generate an RSA Public Key for our router.

#crypto key generate rsa general-keys label R1

Here you can see the generated key. Do the above for also R2, and copy paste their public keys to each other in next step.

#sh crypto key mypubkey rsa
% Key pair was generated at: 12:35:34 UTC Jan 24 2010
Key name: R1
Usage: General Purpose Key
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D35594 62FB3925
22EBD28E A64B12A7 2D0D44C1 DD28F9BF 8BA52834 516FC231 F1791352 A90ADEE0
A61E77C7 5F132B9E 11193B08 B338D531 D40EE40D 9699E742 DF020301 0001
% Key pair was generated at: 13:35:36 UTC Jan 24 2010
Key name: R1.server
Usage: Encryption Key
Key is not exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00A4764D E3D85AFD
2E9254C0 DBB88E08 CE86FA63 8D82C08C D11F14DF AF9264C9 2F5C1CBC 7081C66D
DFE73BB3 66E5A354 48B73EF0 3773545B F5BACBA7 CEBA55DA 4D3D52A1 0B62BFFD
BA93A21E 9B65D23F 9A843994 FAAEB67E BF565A6F 38A8DC3A D5020301 0001

2. Create a key chain. Addressed to router R2 with its IP address and copy paste its public key in here.

#crypto key pubkey-chain rsa
addressed-key 10.1.1.6
key-string
Enter a public key as a hexidecimal number ....
(PASTE HERE)
and use quit to finish

Download project files for GNS3

IPsec VPN Lab, (using Dynamic crypto Map)

In this lab we connect the 3 sites of our company using secure IPsec VPN connections.

The ISP network consists of 4 Routers which are running EIGRP between them.

Our headquarters is connected to the ISP with the CE_4 router.
The branch offices, CE_5 being Branch1, and CE_8 Branch2.

Networks are 192.168.0.0/21 behing CE_4, edge router.
In Branch 1 we have 192.168.16.0/20 networks. (Simulated with loopback int)
In Branch 2 there are the 192.168.8.0/21 networks.

This setup demonstrates all the IPsec negotiation and tunnel establishment using a dynamic map on CE_4.. The key point is the create the relationship between the static crypto map and the dynamic one.

Due to our ISAKMP Policy we are using a Pre-Shared key for authentication. Which will be defined as a wildcard, so our VPN peers can connect using whichever address they have.

# crypto isakmp key address 0.0.0.0

Here are the lab files for gns3. Download

Good Reading:
Wildcard Pre-Shared Key Enhancement @cisco
Security Commands: crypto dynamic-map through ctype @cisco

IPSEC VPN session status

Status of VPN Sessions

IKE SA	IPsec SAs	VPN Tunnel Status
Exists, active	Exists (flow exists)	UP-ACTIVE
Exists, active	None (flow exists)	UP-IDLE
Exists, active	None (no flow exists)	UP-IDLE
Exists, inactive	Exists (flow exists)	UP-NO-IKE
Exists, inactive	None (flow exists)	DOWN-NEGOTIATING
Exists, inactive	None (no flow)	DOWN-NEGOTIATING
None	Exists (flow exists)	UP-NO-IKE
None	None (flow exists)	DOWN
None	None (no flow exists)	DOWN

SDM Hints

I was using Firefox 3.5.1 and jre 1.6.12 (java6 update 12), some of the wizards were not launching. For example the Site-to-Site VPN and GRE Tunnel wizards.

I downgraded the my JavaVM to jre 1.6.0.3 and now all is working fine.

For documentation, requirements and installations goto SDM@cisco

To connect to your router via SDM:

#ip http server
#ip http secure-server
#ip http authentication local
#username privilege 15 password 0

My Cisco Certifications Plan

Ok, here's my 2 year plan on the certifications front.

22 Jan 2010, CCNP 3/4 ISCW Exam (topics)
19 Feb 2010, CCNP 4/4 ONT Exam (topics)

5 Nov 2010, CCIE R&S Written Exam (topics)
1 July 2011, CCIE R&S Lab in Brussels! (topics)

LDP (Label Distribution Protocol)

LDP is the protocol that distributes label bindings for FECs between LSRs (Label Switching Routers.) The LIB (Label Information Base) of an MPLS enabled router is the table that all the bindings are kept. The LIB is populated by information from LDP, MP-BGP and RSVP.
LDP carries the labels for interior routes, from the IGP.
MP-BGP distributes routes for BGP prefixes, and RSVP is used in MPLS-TE.

LDP Functions:
Discovery of other LSRs
Session establishment, management
Advertisement of Labels
Housekeeping, notification

Two types of Adjacency:

Hello adjacency: LDP Hellos to 224.0.0.2 (all routers multicast), using UDP Port 646 for both source and destination. These hellos are sent on all MPLS enabled interfaces. Hello/Holdtime = 5/15sec default.




Transport session: After the Hello discovery, the LSRs will establish a TCP transport session on TCP/646. One of them will take active role (initiating the TCP connection to port 646, the other will take the passive role, listening on TCP/646) The LSR with the higher transport IP address will take the passive role.

LSRs will exchange session parameters with Initialization Messages, which contain info as LDP version, label distribution method, timer values, etc.

If they agree a Transport Session is established. If not, it is re-tried. This cycle has an LDP initial/maximum backup timers with default 15/120 seconds.

The session is kept open as long as an LDP message or a Keepalive is heard. The session holdtime is 180 seconds. The interval of Keepalive messages is 60 sec.

You can list the ldp parameters used by the router:


Example keep alive messages. Sent back and forth in 60sec intervals.

Useful commands
mpls ldp router-id interface [force]
mpls ldp discovery transport-address {interface | ip-address}
mpls ldp discovery {hello {holdtime | interval} seconds
mpls ldp backoff initial-backoff maximum-backoff
mpls ldp holdtime seconds

show mpls ldp discovery detail
show mpls ldp neighbor neighbor-ip detail
show mpls ldp parameters

Ref: LDP neighbor discovery.. @Networkers-Online

MPLS Header & Labels

Ref:Geert’s blog

MPLS header contains a 20bit Label field.
Labels 0-15 are reserved.

Label 0: Explicit Null
Label 1: Router alert label
Label 2: Explicit Null IPv6
Label 3: Implicit Null
Label 14: OAM alert label

AToM (Any Transport over MPLS) Lab

So here we have a AToM (Any Transport over MPLS) Lab which is also known as a Martini Pseudowire.

Provider Core Routers R1,R2,R3,R4 serve as the label switching MPLS Core. The Provider Edge routers PE_1,PE_2 connect to Customer networks. The IGP running on the provider network is IS-IS.
We have a Customer HQ and a Branch Office which have connections to the same ISP.
A VPN Tunnel is built between the PE_1 <-> PE_2 to connect the customer private network.

GNS3 Project file @ Filefront

Collection of OSPF Labs

Here are some of the labs I've created when studying for the CCNP Exams:

1. OSPF Network w/ two areas connected to the Backbone Area 0. One of the networks being a Totally Stub Area w/ redundant connections to the backbone. Download Project Files



2. Based on project above, with an extra Area 99 added via a Virtual-Link. Download Project Files



3. Backbone Area on a Point to Multipoint Frame-Relay network. A chance to observe different ospf area types. And also the DR/BDR relations and configurations in two different areas. Download

Collection of IS-IS Labs

A collection of IS-IS labs created by me, during CCNP Studies.

1. Based around a Frame-Relay Backbone, with 3 areas and their L1/L2 routers. Download project files



2. A different and more complex topology, with Frame Relay p2p links and other good stuff thrown in. Download

VRRP Timer tips

The default timer for VRRP advertisements by the Master Router is 1 seconds.
The holdtime is 3 times this and is a default around 6 seconds.

VRRP timers must either be the same in the Group or routers "set to learn" these timers. Because if a VRRP Backup router receives a VRRP Advertisement w/ different timer then the one it has configured, the packed will be discarded. This will cause both routers to think they are Masters!

If routers are set the "learn timers", then the adv.time learned from the vrrp adv.packet will override the one in the config.

(config-if)# vrrp 1 timers learn

If you want to use timers in msec, this must be defined in all the vrrp group routers because when using msec timers, learning the timers from the master feature will not work.

R1(config-if)#vrrp 1 timer adv msec 200
R1(config-if)#vrrp 1 timer learn
% cannot learn timer values when millisecond timers are configured
R1(config-if)#

Note: In VRRP, a sub-second hello timer results in a hello timer of 1 second being sent. So if you set msec timer on one router and a non-default non-learning vrrp on another, they won't talk to each other!


Ref: VRRP @ Cisco
Very good investigation of the topic: (HSRP,VRRP,GLBP timers)

NAT Order of Operation

To summarize, there's the old way of NATting (domain-based NAT) and the new way introduced with 12.3(T), NAT Virtual Interface (NVI).

In domain based NAT;
Packets on the outside first get translated then routed.
Packets on the inside interface the routing decision is made first and then the translation and forwarding.

In NVI based NAT
The translation/routing is done in a symmetric manner. Routing lookup is performed twice. First to send the packet to NVI, second to route packet using the post-translated addresses.

References: The Inside and Outside of Nat : CCIE Journey
NAT Order of Operation @ Cisco

VRRP Lab

A fictional company "Kasifler", has connections to two different Service Providers, Avea (Primary) and Vodafone (Secondary).

Router R4 is the PE router for Avea and depicts the Avea network, included are some loopback networks.
Router R5 is the PE router for the Vodafone network which also has loopback interfaces to simulate networks inside Vodafone, or the Internet.

Remaining routers, R0 through R3 belong the our company Kasifler. R0 is really used for a client and test bed to control reachability to the inside/from the outside.

Our primary router R1 is connected the VRRP master, R2 and R3 being backup VRRP routers. They all have their WAN interface "tracked" and in a failure situation this is the prefered fail-over : R1 -> R2 -> R3

There is also BGP peerings with our providers, becareful not to be a transit network here! (Demonstrated with some as-path route maps)

Take down interfaces from R4 -> R1 or R4 -> R2 to test the VRRP action.


Link to Project file on Filefront

E-Carrier, G.703 [wip]

E1-Carrier is a synchronized telecom tech. which uses TDM.
An E1 frame is divided into 32 Timeslots of 64Kbps each. (8 bits sampled 8000 times a second = 64Kbps)

Timeslots 0 - 31



Physical Interface
------------------
Balanced: 120ohm 2 pair twisted wire. RJ-48 (1,2,4,5) and 8P8C connector.
Unbalanced: 75ohm coax pair. Uses BNC connectors.

Logical Presentation
--------------------
Unframed G.703: Allows usage of full bandwidth. 2.048Mbps for E1, 1.544Mbps T1.
Framed G.703: Spec defined by G.704. Timeslot 0 is used for framing, timing, synchronization and alarm signalling. Timeslot 16 is used for Signalling. The rest of the timeslots can be defined to carry data or be idle. There is also the option of using CRC-4.

Line Encoding
-------------
This is the method of physically putting 1s and 0s on the wire. These operate on Layer 2.
HDB3, High-Density Bipolar 3, mostly used in Europe
AMI, B8ZS is used in Nort America.

Clock Source
------------
You can either use clocking from the line, which is provided by your Telecom Company, or internally generated clock of your router/csu-dsu.


Good Introduction to G.703
The FAQs of Life About G.703 @ Patton

Cisco Switches VLAN/STP Instance limits

CCNP 2 more to go

Just passed the BCMSN, gearing up for MPLS/VPN stuff in ISCW. End of January target date.

CEF Fundamentals

# sh ip cef [type mod/num | vlan vlan-id] [detail]
# sh ip cef [prefix-ip prefix-mask] [longer-prefixes] [detail]
# sh adjacency [type mod/num | vlan vlan-id] [summary | detail]

GNS3 Lab w/ pfSense Firewall

Here's a lab I've been working on.
It's based on a company topology from an article on cisco.com, which has access/distribution switches with STP load-balancing between Data/Voice/Service VLANs.
I connected it to an Edge router using EIGRP inside, which then connects to a pfSense VM Appliance Firewall, which in turn connects to an ISP Router. Some good exercises to try in here, security, nat, bgp (with a second ISP connection), pppoe, etc.

802.1w Rapid Spanning Tree Protocol

Uses very similar concepts to 802.1D STP, incorporates Cisco proprietary Portfast,Uplinkfast,BackboneFast techniques, and has an overall faster convergence.

The port states and roles are decoupled to make faster & more intelligent decisions on topology. The neighboring bridges interact with each other using BPDUs instead of just passing the root bridge BPDU. A proposal/agreement mechanism which doesnt depend on any timers, is used to converge the topology, in a very fast manner.

Port Roles
Root Port
Designated
Alternate
Backup

Port States
Blocking (discarding)
Learning
Forwarding

Port Types
Edge Port (connected to a host, Portfast)
P2P (full-duplex connection to another bridge)
Shared (half-duplex)

New BPDU stuff
BPDUs are sent every 3 seconds by every bridge.
If 3 BPDU packets in a row are not heard from a neighbor, he is down.
Additions to the BPDU
Role&State of originating port.
Handles proposal / agreement mechanism
RSTP BDPU are version 2

References:
Understanding Rapid Spanning Tree Protocol (802.1w) @ Cisco
Cisco AVVID Network Infrastructure: Implementing 802.1w and 802.1s in Campus Networks Implementation Guide

PPPoE Lab w/ GNS3

This is a simple lab using a 7200 router as a PPPoE server. Which in turn is querying the Radius server. The Radius server was a VMWare pfSense appliance. This appliance is very handy for testing purposes and AFAIK is also used in production environments. Download Project Files

Spanning Tree Flavours

802.1D ieee STP (Remember from 802.1dog slow)
Uses only a single Spanning tree instance for all VLANs.

PVST Cisco proprietary. Uses a different spanning-tree instance for every VLAN.

802.1w RSTP Rapid STP
RSTP @ Cisco, very good explanation

802.1s MSTP Multiple STP
Cisco whitepaper about MST

Certification plans

CCNP 2/3 BCMSN Exam planned for : Dec 16th

While waiting for the new TSHOOT exam to be released
CCNA Security Exam planned for : 1st of February

Save VLAN.DAT in GNS/Dynamips

You know when you boot your router, the flash: is not saved and the vlan.dat that is saved on it is lost.. To remedy this, use a vlan.dat saved in nvram:

SW0(config)# vtp file nvram:/vlan.dat
SW0#dir nvram:
Directory of nvram:/

  123  -rw-        1683                      startup-config
  124  ----           5                      private-config
    1  -rw-           0                      ifIndex-table
    2  -rw-         780                      vlan.dat

There, now all your vlan/vtp config will be saved..

Etherchannel

Pagp explained and silent/non-silent modes:

Fiber Optic connectors

ST (Straight Tip)


SC (Subscriber Connector)


LC (Lucent Connector)


MT-RJ (Mechanical Transfer Registered Jack)

Reference:
Timbercon Fiber Optic Connectors
The Fiber Optic Association - Tech Topics

VLANs #1

VLANs are seperate broadcast domains.

VLAN Numbers are 1-1005 (1 and 1002-1005 are reserved)
Extended VLANs are 0-4095. (0,1 and 4095 are reserved)

ISL Trunking
Cisco proprietary protocol. Encapsulates the whole Ethernet frame.
Adding a 26 byte header and 4 byte trailer. (Total of 30 bytes)

802.1Q Trunking
Standards based. Adds a tagging field to the Ethernet Frame.
This is 4 bytes of overhead. With 2 bytes of TPID (Tag Protocol Identifier, alwasys 0x8100), 3 bits of Priority field for CoS (Class of Service), 1 bit CFI, and 12 bits of VLAN Identifier.

Has concept of Native VLan. Frames that belong to native vlan are not encapsulated with any tagging information.

Because default Ethernet frames are 1518 bytes (1500 bytes of MTU and 18 bytes Ethernet header), with the addition of 802.1Q, Ethernet frame size is increased to 1522 bytes.

Kendi CCIE Lab'ini yaratmak

4 gerçek switch, 10+ NIC, dynamips ve vmware kullanarak tüm lab ihtiyaçlarını karşılamak mümkün. Örnek:

@7200
HOWTO Connect Real Switches Using One NIC & QinQ

IPv6 in XP and v6 tunneling

@ipv6int.net

DDoS attacks history and timeline

I was a sophomore in Iowa when all this started.

Dittrich Timeline

The Cyber Crime Hall of Fame

EIGRP Load Balancing

Equal load balancing & Unequal load balancing

@IExpert

Passed the BSCI

Alright, on to the next.. BCMSN and then when the new courses become available, TSHOOT.

OSPF NSSA Tricks

Check:
@Cisco: OSPF Not-So-Stubby Area (NSSA)

EIGRP Study Notes

Features:
Advanced Distance Vector routing protocol.
DUAL Algorithm
Neighbor relations
Sends only incremantal updates
Unequal-Cost Load Sharing

Packet Types:
Hello
Update
Query
Reply
Ack

Neighborship Requirements:
Receive Hello from neighbor
AS Number must match
K values must match

Simplified Metric

            10^7            total delay
256 * ( ------------   +      in tens     ) 
        Min.BW(Kbit)      of microseconds

3 Tables
Neighbor
Topology
Routing

Feasibility condition :
For a route to be considered feasible successor, the FD > AD.

Commands
ip hello-interval eigrp as-number seconds
ip hold-time eigrp autonomous-system-number seconds
bandwidth
ip bandwidth-percent eigrp as-number percent
variance
eigrp stub { receive-only | connected | summary | static }
ip summary-address as-number address mask

BGP Best Path Selection

1) Weight (highest)
2) Local Preference (highest)
3) Self Originated
4) AS_PATH
5) Origin
6) MED (highest)
7) External Route (EBGP over IBGP)
8) IGP Cost
9) RID (lowest)
10) Neighbor IP address (lowest)

BGP Case Studies @ Cisco

BGP Attributes

Well-known Mandatory
Origin
AS-Path
Next-Hop

Well-Known Discretionary
Local-Preference
Atomic aggregate

Optional Transitive
Community
Aggregator

Optional Nontransitive
MED (Multiexit Discriminator)

BGP Case Studies @ Cisco

BGP Study Notes

Path Vector protocol, uses TCP/179 as transport.
EBGP Routes have AD of 20, IBGP have 200.

BGP Syncronization Rule: Don't use or propagate a route learned by IBGP, that is not also known by another source. (an IGP)

3 Tables: BGP Forwarding, BGP Neighbor, Routing tables.

Message Types:
Open, sent to establish adj. A keepalive is sent for confirmation.
Keepalive; sent in 60 second intervals.
Update
Notification; sent in response to errors/special conditions

Neighbor States:
Idle
Connect
Open Sent
Open Confirm
Established

Attributes:
Origin
AS-Path
Next-Hop
MED
Local Pref.
Community

Commands:
Hard/soft(w/o flap) reset
# clear ip bgp {* | address}[soft [in | out]]

Send MD5 hashed password w/ every packet
# neighbor ip-address password password