Showing posts with label router. Show all posts
Showing posts with label router. Show all posts

Saturday, 28 May 2011

Creating Command Aliases


Problem

You want to create aliases for commonly-used or complex commands.

Solution

You can create command aliases on your router with the alias command:
Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#alias exec rt show ip route
Router1(config)#alias exec on show ip ospf neighbor
Router1(config)#end
Router1#
 

Discussion

Unix system administrators have been using command aliases for many years to help reduce typing and save time. These shortcut commands allow you to reduce long or complex command sequences down to a few simple characters. This is most useful for extremely common commands, or for those that are complex or difficult to remember. You can create an alias for any command, including some or all of its associated keywords or variables.
Here we have created the alias rt for one of the most common commands that we use every day, show ip route:
Router1(config)#alias exec rt show ip route
We can now use this simple two-letter command to display the routing table, saving time and typing:
Router1#rt
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route
   
Gateway of last resort is 172.25.1.1 to network 0.0.0.0
   
S    192.168.10.0/24 [1/0] via 172.22.1.4
     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.2.0 is directly connected, FastEthernet0/0.2
     172.20.0.0/16 is variably subnetted, 3 subnets, 3 masks
O       172.20.10.0/24 [110/74] via 172.20.1.2, 00:52:55, Serial0/0.2
C       172.20.1.0/30 is directly connected, Serial0/0.2
O       172.20.100.1/32 [110/65] via 172.20.1.2, 00:52:55, Serial0/0.2
     172.22.0.0/16 is variably subnetted, 2 subnets, 2 masks
D       172.22.0.0/16 is a summary, 20:31:03, Null0
C       172.22.1.0/24 is directly connected, FastEthernet0/1
Router1#

The key to choosing a good alias command name is to pick something that is short and easy to remember. Of course, it is critical to select an alias that does not conflict with an existing command. In our example, we choose rt as a short and memorable mnemonic for "route table." This abbreviation does not conflict with any existing IOS command.
You can also use a command alias as part of a longer command. For example, we could use our rt alias to shorten the command show ip route 172.16.2.0.
Router1#rt 172.16.2.0
Routing entry for 172.16.2.0/24
  Known via "connected", distance 0, metric 0 (connected, via interface)
  Routing Descriptor Blocks:
  * directly connected, via FastEthernet0/0.2
      Route metric is 0, traffic share count is 1
Router1#
Command aliases are most effective if you use them consistently among all of the routers that you manage. Otherwise, you'll have to remember a different set of alias commands for each group of devices. If you want to use this feature, we recommend that the entire network management team work together to develop a standard set of aliases before implementing them. We also recommend keeping the aliases simple. And, above all, resist the urge to alias every possible command. Instead, create aliases for only the most common commands.
Command aliases are also useful for scripting. You can build a script to perform a task on a router that might be slightly different on each router. For example, suppose you want to clear the counters of a particular access list on a weekly basis. But, some of your routers use a different access list number. You can simply build an alias with the same name on each router, but make the actual commands represented by the alias appropriate to each individual router. Finally, you can build a script to issue the command alias and automate what would otherwise be an extremely onerous task.
The show aliases command displays all of the command aliases configured on the router:
Router1#show aliases
Exec mode aliases:
  h                     help
  lo                    logout
  p                     ping
  r                     resume
  s                     show
  u                     undebug
  un                    undebug
  w                     where
  rt                    show ip route
  on                    show ip ospf neighbor
   
Router1#
If you type this command on any router, you will see that Cisco implements several command aliases by default.

Thursday, 26 May 2011

Redistributing Static Routes into RIP

Problem
You want RIP to redistribute static routes that you have configured on your router.

Solution

The redistribute static command tells RIP to forward static routes in addition to the directly connected routes and the routes that have been learned from other RIP routers, which it forwards by default:
Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#ip route 192.168.10.0 255.255.255.0 172.22.1.4
Router1(config)#router rip
Router1(config-router)#redistribute static
Router1(config-router)#end
Router1#
You can define how these routes look to other routers when they are redistributed:
Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#ip route 192.168.10.0 255.255.255.0 172.22.1.4
Router1(config)#router rip                  
Router1(config-router)#redistribute static metric 5
Router1(config-router)#distribute-list 7 out static
Router1(config-router)#exit
Router1(config)#access-list 7 permit 192.168.10.0
Router1(config)#end
Router1#

Discussion

The biggest potential problem that you will encounter with redistributing routes into RIP comes from breaking network class boundaries. RIP is classful, so you have to be rather careful about how you distribute routing information from other sources that may be classless. In this recipe, Router1 redistributes a static route for the Class C network 192.168.10.0. But if we tried instead to redistribute a larger range (such as 192.168.12.0/22), RIP would not generate any errors—the router would just quietly refuse to forward this route.
Looking at the RIP database on a router with IOS level 12.0(6)T or higher shows the redistributed static route:
Router1#show ip rip database 192.168.10.0 255.255.255.0
192.168.10.0/24    redistributed
    [5] via 0.0.0.0, 
Router1#
After configuring the second example, the output of show ip protocols includes information about the filtering. This command also tells you what protocols RIP is distributing:
Router1#show ip protocols 
Routing Protocol is "rip"
  Sending updates every 30 seconds, next due in 5 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Outgoing update filter list for all interfaces is not set
    Redistributed static filtered by 7
  Incoming update filter list for all interfaces is not set
  Redistributing: static, rip
  Default version control: send version 2, receive version 2
    Interface             Send  Recv  Triggered RIP  Key-chain
    FastEthernet0/0.1     2     2 
    Serial0/0.2           2     2                                    
    FastEthernet0/1       2     2                                    
   Automatic network summarization is in effect
  Maximum path: 4
  Routing for Networks:
    172.22.0.0
    172.25.0.0
  Routing Information Sources:
    Gateway         Distance      Last Update
    172.25.1.7           120      00:00:03
    172.25.2.2           120      00:00:06
    172.22.1.4           120      00:00:08
  Distance: (default is 120)
Router1#
In addition to static routes, you can distribute information from other dynamic routing protocols with RIP simply by specifying which protocol's routes you want RIP to use. For example, if you have an EIGRP network that uses process number 65530 on the same router, you would redistribute the EIGRP routes into RIP like this:
Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#router eigrp 65530
Router1(config-router)#network 192.168.1.0
Router1(config-router)#exit
Router1(config)#router rip
Router1(config-router)#redistribute eigrp 65530
Router1(config-router)#end
Router1#
If you look at the show ip protocols command, you can see that RIP redistributes routes it learns from EIGRP, but EIGRP does not redistribute routes learned from RIP. If you also want EIGRP to redistribute RIP routes, you must explicitly configure it to do so. 
Router1#show ip protocols   
Routing Protocol is "rip"
  Sending updates every 30 seconds, next due in 0 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Outgoing update filter list for all interfaces is 
  Incoming update filter list for all interfaces is 
  Redistributing: static, rip, eigrp 65530
   

  Default version control: send version 1, receive any version
    Interface        Send  Recv   Key-chain
    FastEthernet0/0.1     2     2 
    Serial0/0.2           2     2                                    
    FastEthernet0/1       2     2                                    
   Automatic network summarization is in effect
  Maximum path: 4
  Routing for Networks:
    172.22.0.0
    172.25.0.0
  Routing Information Sources:
    Gateway         Distance      Last Update
    172.25.1.7           120      00:00:03
    172.25.2.2           120      00:00:06
    172.22.1.4           120      00:00:08
  Distance: (default is 120)
   
Routing Protocol is "eigrp 65530"
  Outgoing update filter list for all interfaces is 
  Incoming update filter list for all interfaces is 
  Default networks flagged in outgoing updates
  Default networks accepted from incoming updates
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Redistributing: eigrp 65530
  Automatic network summarization is in effect
  Routing for Networks:
    192.168.1.0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: internal 90 external 170
   

Monday, 23 May 2011

Frame Relay Switch Configuration By Chris Bryant, CCIE #12933


Many CCNA certification candidates want to add a frame relay switch to their Cisco router lab, but aren't quite sure how to configure one.


Other candidates aren't quite sure what a frame relay switch is, or what Cisco routers can serve as such a switch. This CCNA case study will examine how to add one of these pivotal devices to a Cisco lab.

A Cisco lab's frame relay switch is not a switch at all; it's a Cisco router. Almost any Cisco router can serve as your frame switch, but you will need multiple serial interfaces to make a router particularly effective in this role.

I recommend you get a Cisco router with at least four serial interfaces. Cisco 2520s make excellent frame switches, and by doing a search on eBay for "frame relay switch", you'll quickly find several others that can as well.

The frame relay switch is going to play the role of the frame provider in your lab. In essence, you've got a one-switch frame relay cloud, which gives you a tremendous opportunity to practice frame relay scenarios.

In this example, I've got three Cisco routers that are going to be the production routers in my lab - R1, R2, and R3. I have a fourth router that will serve as the frame relay switch. The DLCI assignments I've come up with are as follows:
  • R1 is the hub and will use DLCI 122 to reach R2, DLCI 123 to reach R3.
  • R2 is a spoke router and will use DLCI 221 to reach both R1 and R3.
  • R3 is a spoke router and will use DLCI 321 to reach both R1 and R2.
The physical connections are as follows. All connections are using DTE/DCE cables with the DCE end of the cable connected to the frame relay switch.
  • R1 is connected to the frame switch's Serial1 port.
  • R2 is connected to the frame switch's Serial2 port.
  • R3 is connected to the frame switch's Serial3 port.
On the frame switch, the global command frame-relay switching is required to make the router act as a frame relay switch. Let's take a look at the commands we'll need on the frame switch's Serial1 port, which is connected to R1.

interface Serial1
 no ip address
 encapsulation frame-relay
 logging event subif-link-status
 logging event dlci-status-change
 clockrate 56000
 no frame-relay inverse-arp
 frame-relay intf-type dce
 frame-relay route 122 interface Serial2 221
 frame-relay route 123 interface Serial3 321

Note that there is no IP address on the port, and frame relay encapsulation is enabled. The clockrate command is necessary on the DCE end of the connection, so you see it here.

You also see that the interface is hard-coded as a DCE with theframe-relay intf-type dce command. Not all current IOS versions require this; just make sure you have the DCE end of the cable attached to the frame switch and verify that with show controller serial x.

Finally, we come to the frame-relay route command. The syntax seems a little tricky, but once you break it down it's pretty simple.
  • frame-relay route 122 = the incoming DLCI
  • interface serial2 = data coming in on DLCI 122 is sent out this port
  • 221 = data sent out interface serial2 will use this DLCI
Getting those statements correct is the hardest part of configuring your frame relay switch. The good part is that once you have your frame switch configured and working properly, you can just leave the configuration there.

We'll take a look at how to verify your frame switch configuration in just a moment, but first, let's review the important section of the frame switch configuration we've talked about here.

hostname FRAME_SWITCH
!
!
ip subnet-zero
no ip domain-lookup
frame-relay switching
!
!
!
interface Ethernet0
 no ip address
 no ip directed-broadcast
 shutdown
!
interface Serial0
 no ip address
interface Serial1
 no ip address
 no ip directed-broadcast
 encapsulation frame-relay
 logging event subif-link-status
 logging event dlci-status-change
 clockrate 56000
 no frame-relay inverse-arp
 frame-relay intf-type dce
 frame-relay route 122 interface Serial2 221
 frame-relay route 123 interface Serial3 321

!
interface Serial2
 no ip address
 no ip directed-broadcast
 encapsulation frame-relay
 logging event subif-link-status
 logging event dlci-status-change
 clockrate 56000
 no frame-relay inverse-arp
 frame-relay intf-type dce
 frame-relay route 221 interface Serial1 122
interface Serial3
 no ip address
 no ip directed-broadcast
 encapsulation frame-relay
 logging event subif-link-status
 logging event dlci-status-change
 clockrate 56000
 no frame-relay inverse-arp
 frame-relay intf-type dce
 frame-relay route 321 interface Serial1 123

To verify that your frame relay configuration is functioning correctly, run the global command show frame route on the frame relay switch. If you see active next to all frame routes as shown below, you're in good shape.

CCNA Certification Lab  Frame Relay Switch Config

If you see anything else - say, the word "inactive" - then there is a problem.

Troubleshooting A Frame Relay Switch

The key to troubleshooting your frame switch is that you cannotconcentrate on the frame switch's config. You can get that part perfect, but if you're using other DLCIs on your routers or there's a physical issue - perhaps you forgot to open some interfaces - you're not going to get the active frame routes you want.

Just make sure you're got all the appropriate interfaces open, don't forget the clockrate and frame-relay route commands on the frame switch, and you'll successfully add this important device to your Cisco lab!

Scroll down for two CCNA training videos on frame relay switching - and take advantage of this exclusive CCNA training opportunity!



Tuesday, 17 May 2011

Access-list questions part 2


Question 1
The following access list below was applied outbound on the E0 interface connected to the 192.169.1.8/29 LAN:
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 20 any
access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 21 any
How will the above access lists affect traffic?
A – FTP traffic from 192.169.1.22 will be denied
B – No traffic, except for FTP traffic will be allowed to exit E0
C – FTP traffic from 192.169.1.9 to any host will be denied
D – All traffic exiting E0 will be denied
E – All FTP traffic to network 192.169.1.9/29 will be denied

Answer: D
Explanation:
There is always an implicit “deny all” command at the end of every access list, so if an access list doesn’t have any “permit” command, it will block all the traffic. If we use the command “access-list 135 permit ip any any” at the end of this access list then the answer should be C – FTP traffic from 192.169.1.9 to any host will be denied.
Question 2
The access control list shown in the graphic has been applied to the Ethernet interface of router R1 using the ip access-group 101 in command. Which of the following Telnet sessions will be blocked by this ACL? (Choose two)

A – from host PC1 to host 5.1.1.10
B – from host PC1 to host 5.1.3.10
C – from host PC2 to host 5.1.2.10
D – from host PC2 to host 5.1.3.8

Answer: B D
Explanation
Below is the simple syntax of an extended access list:
access-list access-list-number {deny | permit} {ip|tcp|udp|icmp} source [source-mask] dest [dest-mask] [eq dest-port]
Notice that this access list is applied to the Ethernet interface of R1 in the “in direction” so in this case, it will filter all the packets originated from E1 network (host PC1 and PC2) with these parameters:
Source network: 5.1.1.8 0.0.0.3 which means 5.1.1.8/252 (just invert all the wildcard bits to get the equivalent subnet mask) -> Packets from 5.1.1.8 to 5.1.1.11 will be filtered.
Destination network: 5.1.3.0 0.0.0.255 which means 5.1.3.0/24-> Packets to 5.1.3.0/24 will be filtered
Therefore packets originated from 5.1.1.8 to 5.1.1.11 and have the destination to the host 5.1.3.x (via Telnet) will be denied.
Question 3
The following configuration line was added to router R1
Access-list 101 permit ip 10.25.30.0 0.0.0.255 any
What is the effect of this access list configuration?
A – permit all packets matching the first three octets of the source address to all destinations
B – permit all packet matching the last octet of the destination address and accept all source addresses
C – permit all packet matching the host bits in the source address to all destinations
D – permit all packet from the third subnet of the network address to all destinations

Answer: A

Access-list questions part 1


Question 1
Your boss is learning a CCNA training course, refer to the exhibit. The access list has been configured on the S0/0 interface of router RTB in the outbound direction. Which two packets, if routed to the interface, will be denied? (Choose two)

access-list 101 deny tcp 192.168.15.32 0.0.0.15 any eq telnet
access-list 101 permit ip any any
A. source ip address: 192.168.15.5; destination port: 21
B. source ip address:, 192.168.15.37 destination port: 21
C. source ip address:, 192.168.15.41 destination port: 21
D. source ip address:, 192.168.15.36 destination port: 23
E. source ip address: 192.168.15.46; destination port: 23
F. source ip address:, 192.168.15.49 destination port: 23

Answer: D E

Question 2
Refer to the graphic. It has been decided that PC1 should be denied access to Server. Which of the following commands are required to prevent only PC1 from accessing Server1 while allowing all other traffic to flow normally? (Choose two)
accesslist2
A – Router(config)# interface fa0/0
Router(config-if)# ip access-group 101 out
B – Router(config)# interface fa0/0
Router(config-if)# ip access-group 101 in
C – Router(config)# access-list 101 deny ip host 172.16.161.150 host 172.16.162.163
Router(config)# access-list 101 permit ip any any
D – Router(config)# access-list 101 deny ip 172.16.161.150 0.0.0.255 172.16.162.163 0.0.0.0
Router(config)# access-list 101 permit ip any any

Answer: B C
Question 3
Refer to the exhibit. Why would the network administrator configure RA in this manner?

A. to give students access to the Internet
B. to prevent students from accessing the command prompt of RA
C. to prevent administrators from accessing the console of RA
D. to give administrators access to the Internet
E. to prevent students from accessing the Internet
F. to prevent students from accessing the Admin network

Answer: B
Explanation
Although the access-list is used to “permit” network 10.1.1.0/24 but the best answer here is “to prevent students from accessing the command prompt of RA”. From the picture above, we know that 10.1.1.0/24 is the “Admin” network. This access list is applied to “line vty 0 4″ so it will permit only Telnet traffic from “Admin” to RA while drop all other traffic (because of the implicit “deny all” command at the end of the access list). Therefore we can deduce that it will “prevent students from accessing the command prompt of RA”.
This access list only filters Telnet traffic (because it is applied to vty line) so it will not prevent or allow anyone to access the Internet -> A, D, E are not correct.
C is not correct as this access list allows administrators to access the console of RA.
F is not correct as this access list does not proceed TCP, UDP or IP traffic so the students still access the Admin network.
(Notice that the “command prompt” here implies telnet as telnet is the only way to remotely access RA)
Question 4
A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?
A – access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
B – access-list 101 deny tcp 192.168.1.128 0.0.0.240 192.168.1.5 0.0.0.0 eq 23
access-list 101 permit ip any any
C – access-list 1 deny tcp 192.168.1.128 0.0.0.255 192.168.1.5 0.0.0.0 eq 21
access-list 1 permit ip any any
D – access-list 1 deny tcp 192.168.1.128 0.0.0.15 host 192.168.1.5 eq 23
access-list 1 permit ip any any

Answer: A
Explanation:
First the question asks to block only Telnet access so the port we have to use is 23 -> C is not correct.
Next we need to block traffic from hosts on the subnet 192.168.1.128/28, which is 192.168.1.128 0.0.0.15 if we convert to wildcard mask (just invert all bits of the subnet mask,from 0 to 1 and from 1 to 0 we will get the equivalent wildcard mask of that subnet mask) -> so B is incorrect
In this case, we have to use extended access list because we need to specify which type of traffic (TCP) and which port (23) we want to block -> so D is incorrect because it uses standard access list.
Question 5
As a network administrator, you have been instructed to prevent all traffic originating on the LAN from entering the R2 router. Which the following command would implement the access list on the interface of the R2 router?


A – access-list 101 in
B – access-list 101 out
C – ip access-group 101 in
D – ip access-group 101 out

Answer: C

Monday, 16 May 2011

Cisco 2500 Series Router Password Reset


Lab Objectives
   Break the boot sequence when powering on the Cisco 2500 Series router to place yourself in rom monitor mode.
   Change the configuration register to 0×2142 to make the router bypass the contents of NVRAM when booting then initialize the router (boot the router into IOS)
   (Option 1) – Once booted, place yourself into privileged mode and copy the start up-config to the running config. Afterward, you may change the line password or enable password and write the configuration by to NVRAM by issuing the copy run start    (Option 2) – Once booted, place yourself into privileged mode and do a write erase to clear the contents of the NVRAM.
   Now change the configuration register back to 0×2102 to boot set the router to boot normally and load the NVRAM contents upon boot.
Lab Instruction
As shown below is a Cisco 2501 router that has a console password on the device. With such a password you cannot access exec mode without authenticating this password correctly. When buying routers used, you may commonly be faced with scenario.
Router con0 is now available
 
Press RETURN to get started.
 
 
User Access Verification
 
Password:
Step 1. Power cycle the router or power on the router initially. While the router is booting you’ll need to break the boot sequence to boot the router into bootrom, you do this by holding down CTRL and pressing PAUSE BREAK. Do this repeatedly till you are placed at the bootrom prompt.
System Bootstrap, Version 11.0(10c), SOFTWARE
Copyright (c) 1986-1996 by cisco Systems
2500 processor with 14336 Kbytes of main memory
 
Abort at 0x10B1F3C (PC)
>
Step 2. Change the configuration register so that the router will ignore the contents of the NVRAM when booting into Cisco IOS. Set the configuration register to 0×2142 and initialize the router (Boot the router to IOS).
>o/r 0×2142
>i
Step 4 (Option 1) – After the router has booted into Cisco IOS, you’ll be prompted by the initial configuration dialog, type n here and press enter and you’ll be placed into user mode. Now you’re able to place your self into privileged mode by typing enable. Once in privileged mode you can copy the startup configuation to the running configuration and then change the passwords manually then saved the configuration by to NVRAM by typing copy run start.
— System Configuration Dialog —
 
Would you like to enter the initial configuration dialog? [yes/no]: n
 
 
Press RETURN to get started!
 
Router>enable
Router#copy start run
Destination filename [running-config]?
506 bytes copied in 3.868 secs (168 bytes/sec)
ARCVRSR01#configure terminal
ARCVRSR01(config)#enable secret NEWENABLEPASSWORD
ARCVRSR01(config)#line con 0
ARCVRSR01(config-if)#password NEWPASSWORD
ARCVRSR01(config-if)#end
ARCVRSR01#copy run start
Destination filename [startup-config]?
Building configuration…
[OK]
ARCVRSR01#
Step 4 (Option 2) – After the router has booted into Cisco IOS, you’ll be prompted by the initial configuration dialog, type n here and press enter and you’ll be placed into user mode. Now you’re able to place your self into privileged mode by typing enable. Once in privileged mode you can erase the contents of NVRAM by issuing the write erase command.
— System Configuration Dialog —
 
Would you like to enter the initial configuration dialog? [yes/no]: n
 
 
Press RETURN to get started!
 
Router>enable
Router#write erase
Erasing the nvram filesystem will remove all files! Continue? [confirm]
[OK]
Erase of nvram: complete
Router#
Step 5. Once you’ve performed a password reset or NVRAM sanitation, you’ll need to set the configuration register back to 0×2102 so the router will boot normally and load the NVRAM contents upon a reboot or power failure.
Router#configure terminal
Router(config)#config-register 0×2102
Router(config)#end