Trying to become an Expert - My Ongoing CCIE Journey

EIGRP Practice Test - I scored 10/10...How much you gonna score ?

2012-01-25T23:23:00.000+05:30

https://stormwind.adobeconnect.com/_a983809677/eigrprecall/

HTH...

Deepak Arora

EVIL CCIE

Troubleshooting Challenge - Can you make my telnet work under 10 Mins ?

2012-01-14T21:51:00.002+05:30

So finally when I am done with CCIE Sec Lab, lets get back to some serious business before starting CCIE SP journey. How about starting with a small troubleshooting ticket to get start with.

Here is the quick topology:

so all routers have loopbacks configured as x.x.x.x where x=device number.

Now problem is when we telnet from R1 to R4's loopback we see :

But we want to see the output below red line. Right ?

So make it work under 10 mins :-)

Here are the initials :
##############
R1
---

conf t

ho R1

ip dhcp excluded-address 12.12.12.1 12.12.12.255

ip dhcp pool a

network 12.12.12.0 255.255.255.0

ip dhcp pool b

network 131.13.13.0 255.255.255.0

class-map match-all UDP

match access-group 100

exit

class-map match-all ALICE

match protocol telnet

exit

policy-map COPP

class UDP

drop

exit

policy-map BOB

class ALICE

drop

exit

interface Loopback0

ip address 1.1.1.1 255.255.255.255

no logging con

interface FastEthernet0/0

ip address 12.12.12.1 255.255.255.0

no sh

exit

interface FastEthernet1/0

ip address 13.13.13.1 255.255.255.0

no sh

exit

router eigrp 1234

network 0.0.0.0

no auto-summary

no eigrp log-neighbor-changes

access-list 100 deny udp any any

access-list 100 permit tcp any any

control-plane

service-policy input COPP

service-policy output COPP

line con 0

exec-timeout 0 0

logging synchronous

line vty 0 4

transport input none

transport output none

end

wr mem

======================================

---

conf t

ho R2

interface FastEthernet0/0

ip address dhcp

no sh

exit

interface FastEthernet1/0

ip address 24.24.24.2 255.255.255.0

no sh

exit

router eigrp 1234

network 0.0.0.0

no auto-summary

no logging con

end

wr mem

===================================

---

conf t

ho R3

interface FastEthernet0/0

ip address dhcp

no sh

exit

interface FastEthernet1/0

ip address 34.34.34.3 255.255.255.0

no sh

exit

router eigrp 1234

network 0.0.0.0

no auto-summary

no logging con

end

wr mem

====================

---

conf t

ho R4

interface Loopback0

ip address 4.4.4.4 255.255.255.255

interface FastEthernet0/0

ip address 24.24.24.4 255.255.255.0

no sh

exit

interface FastEthernet1/0

ip address 34.34.34.4 255.255.255.0

no sh

exit

router eigrp 1234

network 0.0.0.0

no auto-summary

no logging con

!
line vty 0 4
no login
!

end

wr mem

HTH...

Deepak Arora

Evil CCIE

PERFECTION

2012-01-11T15:13:00.000+05:30

Fun Time - First Look

2012-01-06T11:04:00.001+05:30

Last Night I was fully toasted after doing almost 14 Hrs of Labbing and Readings. As the lab is approaching I can feel the heat around now. To get rid of this I had a beer and went through some old CCIE funny stuff I remember and no doubt it made me laugh again. Specially the Scott Morris Jokes :-) ... Will add more links here after lab.

http://routing-bits.com/2009/12/21/scott/

https://learningnetwork.cisco.com/thread/4367?start=0&tstart=0

BTW... If you don't know who is Scott Morris and assume yourself as a CCIE Candidate, without any delay shoot yourself :-)

Some more interesting and funny stuff to read :

http://blog.ine.com/2008/10/20/the-top-ten-things-not-to-do-while-taking-the-ccie-lab-exam/

http://blog.ine.com/2008/09/26/the-top-ten-things-to-do-after-passing-the-lab/

http://blog.ine.com/2008/09/25/the-top-ten-indications-you-have-sat-the-lab-too-many-times/

http://blog.ine.com/2009/02/01/the-top-ten-comments-heard-from-the-family-of-a-ccie-student/

http://blog.ine.com/2009/01/17/top-ten-ccie-student-new-year%e2%80%99s-resolutions/

http://blog.ipexpert.com/2011/06/01/top-ten-signs-you-are-ready-for-the-ccie-lab-exam/

HTH...
Deepak Arora
Evil CCIE

Little Story Of Ping - The Story Behind RFC 792

2011-12-28T14:38:00.000+05:30

http://ftp.arl.mil/mike/ping.html

Few More Technical Details - http://tools.ietf.org/pdf/rfc792.pdf

HTH...

Deepak Arora

Evil CCIE

How Well Do You Understand Traceroute

2011-12-20T06:11:00.001+05:30

http://ccie20728.wordpress.com/2008/12/01/ciscos-traceroute-implementation/

http://blog.ine.com/2007/12/28/understanding-traceroute/

http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml

http://www.cisco.com/en/US/tech/tk364/technologies_tech_note09186a00801ae32a.shtml

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080093f22.shtml

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

BTW... Traceroute is a application not an protocol in itself :-)

HTH...

Deepak Arora

Evil CCIE

DMVPN For Dummies - Phase 1 & 2 (Phase 3 Added Too Now)

2011-12-08T00:33:00.003+05:30

R1(HUB)
=======

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address 0.0.0.0

crypto ipsec transform-set TRANSFORMSET esp-des esp-md5-hmac

mode transport

crypto ipsec profile CRYPTOPROFILE

set transform-set TRANSFORMSET

interface Tunnel0

ip address 10.0.0.1 255.255.255.0

ip mtu 1400

ip nhrp authentication cisco

ip nhrp map multicast dynamic

ip nhrp network-id 99

no ip split-horizon eigrp 1

ip tcp adjust-mss 1360

tunnel source f0/0

tunnel mode gre multipoint

tunnel key 100000

tunnel protection ipsec profile CRYPTOPROFILE

no ip next-hop-self eigrp 1 < To Be Removed If Using Phase 3 Configuration

ip nhrp redirect

router eigrp 1

network 10.0.0.1 0.0.0.0

network 1.1.1.1 0.0.0.0

no au

end

##################################################################

R2(SPOKE 1)
===========

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address 0.0.0.0

crypto ipsec transform-set TRANSFORMSET esp-des esp-md5-hmac

mode transport

crypto ipsec profile CRYPTOPROFILE

set transform-set TRANSFORMSET

interface Tunnel0

ip address 10.0.0.2 255.255.255.0

ip mtu 1400

ip nhrp authentication cisco

ip nhrp map 10.0.0.1 123.0.0.1

ip nhrp map multicast 123.0.0.1

ip nhrp network-id 99

ip nhrp nhs 10.0.0.1

ip tcp adjust-mss 1360

tunnel source f0/0

tunnel mode gre multipoint

tunnel key 100000

tunnel protection ipsec profile CRYPTOPROFILE

ip nhrp redirect
ip nhrp shortcut

router eigrp 1

network 10.0.0.2 0.0.0.0

network 2.2.2.2 0.0.0.0

no au

end

##################################################################

R3(SPOKE 2)
===========

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address 0.0.0.0

crypto ipsec transform-set TRANSFORMSET esp-des esp-md5-hmac

mode transport

crypto ipsec profile CRYPTOPROFILE

set transform-set TRANSFORMSET

interface Tunnel0

ip address 10.0.0.3 255.255.255.0

ip mtu 1400

ip nhrp authentication cisco

ip nhrp map 10.0.0.1 123.0.0.1

ip nhrp map multicast 123.0.0.1

ip nhrp network-id 99

ip nhrp nhs 10.0.0.1

ip tcp adjust-mss 1360

tunnel source f0/0

tunnel mode gre multipoint

tunnel key 100000

tunnel protection ipsec profile CRYPTOPROFILE

ip nhrp redirect

ip nhrp shortcut

router eigrp 1

network 10.0.0.3 0.0.0.0

network 3.3.3.3 0.0.0.0

no au

end

Benefit of adding Phase 3 Configuration allows us to reduce control-plane information on Hub Router. Also it allows us to use default routing and perform summarization on Hub.

More Details :

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6660/ps6808/prod_white_paper0900aecd8055c34e_ps6658_Products_White_Paper.html

HTH...

Deepak Arora

Evil CCIE

Site To Site VPNs Using IPSEC - Different Variations

2011-12-06T12:19:00.000+05:30

IPSEC LAN TO LAN VPN USING CRYPTOMAP (With host to host routing configured)
***************************************************************************

R1
===

!
crypto isakmp policy 10
encr aes
authentication pre-share
group 5
lifetime 3600
hash sha
!
crypto isakmp key cisco address 23.23.23.3
!
crypto ipsec transform-set PHASE2 esp-3des esp-sha-hmac
!
access-list 100 permit ip 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
crypto map CRYPTOMAP 10 ipsec-isakmp
set peer 23.23.23.3
set transform-set PHASE2
match address 100
!
!
interface FastEthernet0/0
crypto map CRYPTOMAP
!

=========================

R3
===

!
crypto isakmp policy 10
enc aes
hash sha
gr 5
life 3600
authen pre
exit
!
crypto isakmp key cisco address 12.12.12.1
!
crypto ipsec transform-set PHASE2 esp-3des esp-sha-hmac
!
access-l 100 per ip 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
crypto map CRYPTOMAP 10 ipsec-isakmp
set peer 12.12.12.1
set transform PHASE2
match add 100
!
int f0/0
crypto map CRYPTOMAP
!
==========================
###########################################################

IPSEC OVER GRE ( With No host to host routing )
****************************************

R1
===

!
router ospf 1
no network 14.14.14.1 0.0.0.0 area 0
!
interface Tunnel0
ip address 13.13.13.1 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 23.23.23.3
!
router eigrp 1
no au
net 14.14.14.1 0.0.0.0
net 13.13.13.1 0.0.0.0
!
no access-list 100 permit ip 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
access-list 100 permit gre 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
no access-list 100 permit gre 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
access-list 100 permit gre ho 12.12.12.1 ho 23.23.23.3
!

R3
===

!
router ospf 1
no network 35.35.35.3 0.0.0.0 area 0
!
interface Tunnel0
ip address 13.13.13.3 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 12.12.12.1
!
router eigrp 1
no au
net 35.35.35.3 0.0.0.0
net 13.13.13.3 0.0.0.0
!
no access-list 100 permit ip 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
access-list 100 permit gre 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.25
!
no access-list 100 permit gre 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
access-list 100 permit gre ho 23.23.23.3 ho 12.12.12.1
!
=========================================================================
#############################################################################

IPSEC LAN TO LAN Using IPSEC Profile (No host to host routing)
*****************************************************

R1
==
!
crypto ipsec profile IPSEC-PROFILE
set transform-set PHASE2
!
int f0/0
no crypto map CRYPTOMAP
!
int tu0
tunnel protection ipsec profile IPSEC-PROFILE
!

R3
==

!
crypto ipsec profile IPSEC-PROFILE
set transform-set PHASE2
!
int f0/0
no crypto map CRYPTOMAP
!
int tu0
tunnel protection ipsec profile IPSEC-PROFILE
!

=========================================================================
#########################################################################

IPSEC LAN TO LAN Using Static VTI (No host to host routing)
**************************************************

R1
==

!
int tu0
tunnel mode ipsec ipv4
!
no access-list 100 permit gre host 12.12.12.1 host 23.23.23.3
!

R3
==

!
int tu0
tunnel mode ipsec ipv4
!
no access-list 100 permit gre host 23.23.23.3 host 12.12.12.1
!
=========================================================================

HTH...
Deepak Arora
Evil CCIE

Best CCNA Training In Market For Free - Till 31st December 2011

2011-11-22T19:33:00.005+05:30

Yet again INE surprises their customer with Free Access to best CCNA Training in Industry till 31st December, 2011. Since the product is executed and compiled by Brian McGahan so you guys just don't worry at all about quality of material you gonna get. IMHO there will be no match. Here are the URLs :

http://www.ine.com/all-access-pass/training/playlist/ccna-routing-switching-exam-course/introduction-10021222.html

http://www.ine.com/flashcards/

More Details : http://blog.ine.com/2011/11/17/ccna-rs-exam-course-and-ccna-rs-video-flashcards-free-streaming-video-access/

HTH...

Deepak Arora

Evil CCIE

CCIE Sec Lab Booked - New Year Resolution !!!

2011-11-14T20:05:00.001+05:30

HTH...

Deepak Arora

EVIL CCIE

Redistribution Mock Lab - The Crazy Stuff

2011-10-28T22:01:00.004+05:30

Last year while I was preparing for my R&S Lab, I felt I was not well prepared for complex redistribution scenarios. I took a look at Vol-1 workbooks outline from IP Expert and Internetwork Expert but none of them seems to cover Redistribution as part of Technology labs. So I thought to create some ugly redistribution lab my self.

So let me quickly share the physical & logical topology here with you guys along with initials.

Requirement is simple - to perform mutual redistribution at all redistribution points without creating a routing loop.

R1#sh ver | i IOS
Cisco IOS Software, 3600 Software (C3640-JS-M), Version 12.4(17), RELEASE SOFTWARE (fc1)

<<< R1 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R1
!
int lo0
ip add 1.1.1.1 255.255.255.0
ip ospf network point-to-p
exit
!
int f1/0
ip add 15.15.15.1 255.255.255.0
no sh
exit
!
int s0/0
ip add 10.10.10.1 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.2 102 b
frame map ip 10.10.10.3 103 b
frame map ip 10.10.10.4 104 b
frame map ip 10.10.10.1 102
ip ospf network point-to-m
no sh
exit
!
router ospf 1
router-id 111.111.111.111
net 1.1.1.1 0.0.0.0 a 0
net 15.15.15.1 0.0.0.0 a 0
net 10.10.10.1 0.0.0.0 a 0
end
!
!
wr mem
---------------------------

<<< R2 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R2
!
int lo0
ip add 2.2.2.2 255.255.255.0
ip ospf network point-to-p
exit
!
int s0/0
ip add 10.10.10.2 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.1 201 b
frame map ip 10.10.10.2 201
ip ospf network point-to-m
no sh
exit
!
router ospf 1
router-id 222.222.222.222
net 2.2.2.2 0.0.0.0 a 0
net 10.10.10.2 0.0.0.0 a 0
exit
!
int lo1
ip add 12.12.12.12 255.255.255.0
exit
!
int s0/1
ip add 24.24.24.2 255.255.255.0
no sh
exit
!
router eigrp 100
no au
net 12.12.12.12 0.0.0.0
net 24.24.24.2 0.0.0.0
end
!
!
wr mem
------------------------------

<<< R3 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R3
!
int lo0
ip add 3.3.3.3 255.255.255.0
ip ospf network point-to-p
exit
!
int s0/0
ip add 10.10.10.3 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.1 301 b
frame map ip 10.10.10.3 301
ip ospf network point-to-m
no sh
exit
!
int s0/1
ip add 34.34.34.3 255.255.255.0
no sh
exit
!
int lo1
ip add 13.13.13.13 255.255.255.0
exit
!
router ospf 1
router-id 333.333.333.333
net 3.3.3.3 0.0.0.0 a 0
net 10.10.10.3 0.0.0.0 a 0
exit
!
router eigrp 100
no au
net 13.13.13.13 0.0.0.0
net 34.34.34.3 0.0.0.0
exit
!
int lo2
ip add 133.133.133.133 255.255.255.0
exit
!
int f1/0
ip add 63.63.63.3 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 133.133.0.0
net 63.0.0.0
end
!
!
wr mem
------------------------------

--

<<< R4 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R4
!
int lo0
ip add 4.4.4.4 255.255.255.0
ip ospf network point-to-p
exit
!
int s0/0
ip add 10.10.10.4 255.255.255.0
en f
no frame inv
frame map ip 10.10.10.1 401 b
frame map ip 10.10.10.4 401
ip ospf network point-to-m
no sh
exit
!
router ospf 1
router-id 444.444.444.444
net 4.4.4.4 0.0.0.0 a 0
net 10.10.10.4 0.0.0.0 a 0
exit
!
int lo1
ip add 14.14.14.14 255.255.255.0
exit
!
int s0/1
ip add 24.24.24.4 255.255.255.0
no sh
exit
!
int s0/2
ip add 34.34.34.4 255.255.255.0
no sh
exit
!
router eigrp 100
no au
net 14.14.14.14 0.0.0.0
net 24.24.24.4 0.0.0.0
net 34.34.34.4 0.0.0.0
exit
!
int f1/0
ip add 100.100.100.4 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 100.0.0.0
end
!
!
wr mem
-------------------------------

<<< R5 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R5
!
int lo0
ip add 5.5.5.5 255.255.255.0
ip ospf net point-to-p
exit
!
int f0/0
ip add 15.15.15.5 255.255.255.0
no sh
exit
!
router ospf 1
router-id 555.555.555.555
net 5.5.5.5 0.0.0.0 a 0
net 15.15.15.5 0.0.0.0 a 0
exit
!
int lo1
ip add 115.115.115.115 255.255.255.0
exit
!
int f1/0
ip add 56.56.56.5 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 115.115.0.0
net 56.0.0.0
end
!
!
wr mem
---------------------------

<<< R6 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R6
!
int lo0
ip add 6.6.6.6 255.255.255.0
exit
!
int f1/0
ip add 63.63.63.6 255.255.255.0
no sh
exit
!
int f0/0
ip add 56.56.56.6 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 6.0.0.0
net 63.0.0.0
net 56.0.0.0
end
!
!
wr mem
---------------------------------

<<< R7 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R7
!
int lo0
ip add 7.7.7.7 255.255.255.0
exit
!
int f0/0
ip add 100.100.100.7 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 7.0.0.0
net 100.0.0.0
end
!
!
wr mem

---------------------------------------

<<< R8 >>>

!
en
!
debug ip ro
!
conf t
!
no ip domain-lo
!
ho R8
!
int lo0
ip add 8.8.8.8 255.255.255.0
exit
!
int f0/0
ip add 100.100.100.8 255.255.255.0
no sh
exit
!
router rip
v 2
no au
net 8.0.0.0
net 100.0.0.0
end
!
!
wr mem

I would like to mention here that I am not looking for optimal routing here after redistribution, R4 has 3 routing protocols running, so make sure all three have mutual redistribution.

All you need to know about redistribution is right here

http://s3.www.ine.com/vSeminars/CCIE%20Route%20Redistribution%20Demystified.htm

http://blog.ine.com/2011/07/08/understanding-route-redistribution-excerpts-from-ccie-rs-atc/

http://blog.ine.com/2011/04/04/understanding-ospf-external-route-path-selection/

http://blog.ine.com/2008/02/09/understanding-redistribution-part-i/

http://blog.ine.com/2008/02/19/understanding-redistribution-part-ii/

http://blog.ine.com/2008/03/17/understanding-redistribution-part-iii/

http://blog.ine.com/2009/02/15/time-based-redistribution-ahhh-the-horror-of-it-all/

http://blog.ine.com/2008/07/19/advanced-route-redistribution-scenario-iewb-rs-v41-vol-ii-lab-2-task-411/

Apart from these :

http://www.cisco.com/application/pdf/paws/8606/redist.pdf

http://www.cs.cmu.edu/~4D/papers/guidelines-inm07.pdf

http://www.cs.cmu.edu/~4d/papers/rr-icnp07.pdf

http://blog.ine.com/2008/01/15/understanding-how-redistribution-works-in-ipv6/

http://rizzitech.blogspot.com/2011/05/nx-os-redistribution-whats-different.html

https://ipexpert.adobeconnect.com/_a748906506/p25923416/

http://cciethebeginning.wordpress.com/2011/10/17/routing-protocol-redistribution-and-path-optimization/

http://cciethebeginning.wordpress.com/2011/12/22/ipv6-routing-protocol-redistribution/

http://blog.ipexpert.com/2012/01/04/ospf-and-bgp-puzzle/

http://blog.ipexpert.com/2012/01/09/follow-up-on-ospf-and-bgp-puzzle/

HTH...

Deepak Arora

Evil CCIE

My Updated Linkedin Profile

2011-10-25T19:13:00.000+05:30

http://in.linkedin.com/pub/deepak-arora/15/9bb/3a0

OSPF Loopback Advertisements With Proper Mask - The Tricky Part

2011-10-11T18:59:00.003+05:30

There is always a talk going on about among CCNP/CCIP/CCIE candidates that why a loopback interface is always treated as Stub Host into OSPF and Advertised as /32 route even the actual mask for the interface was configured differently.

Actually It's based on RFC standard 2328 for OSPF ver2. Here are ref details :

RFC - 2328 http://www.ietf.org/rfc/rfc2328.txt

Protocol - OSPF Ver 2

Section - 9.1

Page - 66

Tag - Interface States > Loopback

Now interestingly Cisco Documentation provides only a one work-around to this by putting command - ip ospf network point-to-point under the loopback interface itself.

But are there any other ways ? ....

What if our Evil CCIE Lab ask to advertise Loopback interfaces with correct mask and we are not allowed use the command mentioned above :-)

Actually there are three ways to do it, lets explore them one by one.

HTH...

Deepak Arora

Evil CCIE

Free INE CCNP Workbook

2011-09-29T04:43:00.000+05:30

Just got this URL today at IEOC.COM where Brian McGahan has provided download URL to INE CCNP Workbook. Though it was written for CCNP Ver 5. But contents are still relavant for current Route and Switch exams.

http://www.ine.com/downloads/ine.ccnp.lab.workbook.1.01.zip

HTH...
Deepak Arora

INE Video – Auto-RP over NBMA Design Issues

2011-08-31T11:22:00.003+05:30

Interview with Jeff Doyle

2011-08-10T13:42:00.000+05:30

http://blog.ccna.com.br/2011/07/07/interview-with-jeff-doyle/

Some More Bridging - Updates

2011-08-02T23:09:00.000+05:30

http://deepakarora1984.blogspot.com/2011/02/transparent-bridging-bridgding-series.html

Some Nice Surprises

2011-08-02T20:59:00.001+05:30

http://blog.ine.com/2011/08/01/congratulations-to-julys-ieoc-winners/

Rate Limit Calculator AKA CAR (Committed Access Rate)

2011-07-29T13:27:00.002+05:30

Recently I have been asked for quick method to calculate " CAR Parameters also known as Rate Limit ".

So don't confuse this CAR with our well known CAR :-)

Anyways... here is a great work done by "Brian" on Cisco learning Network site for your help... awesome work I would say.

https://learningnetwork.cisco.com/docs/DOC-7874

BTW.... In modern days we have QOS tool called " policing " which is essentially modern way of doing CAR using MQC (Moduler QOS CLI).

HTH...

Deepak Arora

BGP Rule Of Synchronization

2011-07-25T13:51:00.002+05:30

Recently I saw lots of discussions going around on Cisco Learning Network (CLN) about BGP Rule Of Synchronization. I feel the rule sounds quiet confusing to most of beginners. Following are the common confusions that people have:

Rule - " Route learned from One IBGP Peer cannot be advertised to another IBGP peer unless it's verified by the IGP Routing or IGP Routing table has match for same route in routing table."

Now to overcome this rule we have few options.

1. Run IGP.... hehe... Simple enough ? :-)

But problem with doing that is you need to redistributed BGP into IGP. If these are few BGP routes that not a big deal, but if we are talking about redistributing entire Global BGP Internet Routing Table... You gonna mess up with Your IGP, since IGPs are not designed to manage Route Tables this big.

2. Make BGP Peerings Full Mesh.

3. Route BGP updtes beteen EDGE BGP Devices of SP core using Tunnels such as GRE... of-course not a scalable solution though.

4. Run MPLS in the SP core and use concept of BGP free Core.

Common Confusions :

1. The Rule only applies to learned routes by IBGP peer from an EBGP Peer or also to it's locally Originated Routes ?

2. By IGP means do we have to run some sort of IGP like OSPF, EIGRP or RIP. Or it means IGP reach-ability in general which means static routing is valid solution too ?

Lets Bring Up the topology and see things in action.

So lets turn on "Synchronization" and see how things are going.

BTW... In most of the modern IOS "Synchronization" is off by Default.

Now as discussed above to overcome " Synchronization" issue, we have few options:

1. Run IGP inside the domain.

2. Create Full Mesh Connectivity.

Since in our scenario, we don't have Full mesh connectivity, so lets turn of synchronization and Configure R3 as Route Reflectors(RR) first.

Route Reflectors and Confederations are two possible solutions BTW to overcome "BGP Rule of Split Horizon" which states that " One IBGP Learned Route Can not be advertised to another IBGP peer"

Lets Turn Sync off now and configure R3 as RR.

Ummm... Seems like we have some Next-Hop Issues. Lets fix those out.

What we have are two options:

1. Tell neighbor to use me as next hop ( nei x.x.x.x next-hop-self)

2. Configure a Route-Map, pointing myself as Next Hop IP and configure it for neighbor. ( nei x.x.x.x route-map out )

But it is important to Note that first options doesn't work if your local router is a RR :-)

See yourself....

Lets turn on "SYNC" back and this time instead of running an IGP, Lets see if I put static routes pointing to Null0 (IGP Reach-ability not IGP in itself) can help us.

Seems like the rule indeed talks about the IGP reach-ability and didn't specifically want us to run IGP Protocol.

Though all routes looks now valid and life looks all good, but when we try to ping R5's loopback from R1 with Source as loopback, the packets don't make through.

Reason being is that, static routes that we added are pointing to Null0. Which essentially is Black Holing all your packets.

Lets fix it :

Now Life Looks all good :-)

HTH...

Deepak Arora

Some More Troubleshooting Fun With EIGRP

2011-07-16T11:51:00.001+05:30

Recently I got this request from a friend working on CCNP. He was looking for some troubleshooting labs. So I thought to help him out with couple of labs and to other people who are preparing for CCNP TS exam.

So to add some fun I created this small troubleshooting lab last night. Below is the topology :

R1 should be able to reach R4's loopback and vice versa. For verification point of view the command - R4#ping 1.1.1.1 so lo0 should have 100% success rate. Also R4 should be able to telnet R1 and get login prompt.

Here are the initial configuration files and GNS topology for you guys :

http://hotfile.com/dl/124210052/99638e1/EIGRP_ISSUE.rar.html

Also recently I saw a nice post from CCIE Anthony at blog.ipexpert.com which might help you along the way:

http://blog.ipexpert.com/2011/07/10/troubleshooting-eigrp-adjacencies

Again... Being a good network engineer, Avoid using "sh run" and instead try to find and fix the problem using other "show" commands.

HTH...
Deepak Arora

MPLS VPN Troubleshooting - Bob Calling For Help !!!

2011-07-05T14:43:00.000+05:30

Finally after a long gap I am back with my tutorials and labs for learning and fun. Few weeks back I posted MPLS VPN Lab topology, So before explaining it step by step I thought to bring it as challenge for people who already know MPLS from R&S lab prospective and are looking for some troubleshooting stuff on it. So I am going to bring today a MPLS VPN TS challenge for them.

So our old friend BOB was sitting free on monday after noon and then he received an email containing the following topology and two fault tickets.

The topology has got two different MPLS VPNs. One is VPN blue and another is VPN red. VPN blue site 1 should be able to reach VPN blue site 2 and vice versa and same case with VPN RED. But both VPNs shouldn't be able to talk to each other.

Below is the link to download initials for lab along with GNS topology and IOS version details to run it. See if you can help BOB with this problem.

BTW.... Avoid removing configurations completely. Also being a excellent engineer, don't use "sh run" to show your skills.

http://hotfile.com/dl/123139611/4ae9ec6/MPLS_VPN_LAB_final_config.rar.html

HTH...
Deepak Arora

MPLS Layer 3 VPN Troubleshooting - My Personal Approach

2011-06-17T19:22:00.000+05:30

While I am going for my Second CCIE R&S Lab attempt soon, I thought before leaving I must post my MPLS TS Strategy in general despite of fact I will get in my TS lab or not :

Ofcourse people who wanna know what went wrong with First attempt, here is the summary : http://ieoc.com/forums/t/15436.aspx

Below are the summary steps:

Step 1

=======

CEF is running on MPLS enabled routers

sh ip cef

Step 2
======

loopback advertised into IGP on CE, Also Check IGP configuration like "no auto summary" and "redistribution seed metric, "autonomous system number in EIGRP VRF Configuration".

sh ip int b | e una

sh run | s r [eor]

Step 3
======

Check if VRF is created and applied to proper interface

sh run | s vrf

sh ip vrf detail

sh run int

Check if CE routes are coming to PE

sh ip route vrf

Step 4
======

Check for VRF route target import and export

sh run | s vrf

Step 5
======

Check if LDP is running all over, mpls ip is configured on MPLS facing interfaces.

sh mpls interface

sh mpls ldp neighbor

Step 6
======

Check for MP-BGP and IGP redistribution,

sh run | s r b

sh run | s r [reo]

Check for redistribute metric, For OSPF look for "match internal external 1 external 2" , For eigrp "redistribution metric" should be mentioned.

Step 7
======

Check for MPBGP Config on all routers, look for things like RR config, neighbor activate, send community extended or both, no synchronization, no auto summary, remote as, update source loopback 0

sh run | s r b

sh ip bgp vpnv4 all summ

sh ip bgp vpnv4 all

Step 8
======

Check for Control plane issues on all routers like:

1. ACL

sh access-list

2. CoPP

sh policy-map control-plane

3. Distribute List, Offset-List

sh run | i distribute offset

4. Route-map

sh route-map

5. Rate Limit

sh run | i rate

6. Next Hop and Route Recursion Issues

7. IGP Timers and Password mistmatch issues

8. PBR

sh run | i policy

HTH...
Deepak Arora

MPLS VPN Lab - All you need to know for CCIE R&S (Coming this weekend)

2011-06-06T15:44:00.000+05:30

Back To Back Frame Relay - Old Days Stuff

2011-05-31T13:56:00.000+05:30

So today I am gonna discuss some old school stuff called "Back To Back Frame-Relay". So the first thing coming in your mind would be "What Exactly is that ?" & Second thing will be "Why do we need this ?"

So coming to Idea of why do we need this. Actually in old days and galaxy far far away everyone was running P2P circuits. As you might be aware on those P2P links we use to run PPP. Though Cisco was cool enough and came up with HDLC.

But the problem was that there was no Native QOS Mechanism supported by PPP or HDLC by own. And of-course in those days we didn't have QOS based on MQC.

So one day one evil engineer came up with idea "Alice - Hey Bob ! I know Frame-Relay supports a native QOS mechanism called FRTS(Frame-Relay Traffic Shaping) so why don't we use to apply QOS on our P2P links? "

But Frame-Relay on Point to Point Circuits ? How we gonna do that ? What we gonna name this thing ?

Hmmm... We call this Back To Back Frame Relay :-)

After this cool story now lets take a look at our simple topology and configuration we require.

We disabled Keep Alive in this implementation since there is no Frame-Relay Switch involved in topology(or in P2P links). Also on both sides we must use the same DLCI number.

So now you know that Back To Back FR was only method in existence in old days to implement QOS on P2P links for stuff like VoIP etc. All you gotta do is to create "map classes" to apply FRTS on these links.

HTH...

Deepak Arora

Cisco.com/univercd - Gone

2011-05-27T12:09:00.000+05:30

Recently I noticed that finally old DOC CD URL - www.cisco.com/univercd has been removed from Cisco's Website.

So new URL is now only way to get to documentation - http://www.cisco.com/cisco/web/psa/configure.html

HTH...

Deepak Arora

Redistribution Issue - - Troubleshooting Series (Ticket 2)

2011-03-21T12:14:00.000+05:30

Topology

Issue - R3 can't reach 11.x.x.x network

GNS .net file and initials - http://hotfile.com/dl/111154069/83b6586/configs.rar.html

Got Doom Day Date

2011-03-19T13:51:00.002+05:30

Border Gateway Protocol (BGP) Multi-homing: Design and Troubleshooting Video From CLN

2011-03-12T18:57:00.000+05:30

https://supportforums.cisco.com/videos/1787

Transparent Bridging (Lets Build Up A Bridge) -Bridging Series Part 1

2011-02-28T11:46:00.076+05:30

Diagram 1

Lets start a about talking Bridging. Bridging is just like L2 switching. The purpose of Bridging is to make sure two or more hosts/devices on same IP Subnet should be able to communicate with each other without any problem. Which sounds similar to what SWITCHING does too. In short Bridging is a legacy way of doing the same stuff but using Routers rather than Switches.

There are many flavours of Bridging that can be achieved using routers. Some of them are meant to Switch/Bridge Non-IP Traffic between devices and some of them are meant to switch IP traffic among devices.

In this Bridging series we are going to discuss three common type of Bridging used to Bridge IP Traffic.

1. Transparent Bridging

2. CRB - Concurrent Routing and Bridging

3. IRB - Integrated Routing and Bridging

Lets start with Transparent Bridging and see how it works in different designs.

Transparent Bridging :

Transparent bridging forwards frames without modifying them. Transparent bridging takes multiple physical segments and combines them into what appears to the nodes to be a single data-link LAN. The transparent bridge has four distinct functions:

Learning
Forwarding
Filtering
Loop avoidance

Now lets hop on to Devices (Topology 1) and configure things out.

Here is the step by step configuration. In this topology R1 & R3 are acting as end host devices. Where R2 is working as a Bridge Device.

To Configure Bridge device in transparent bridging mode we need to disable "IP Routing" to make "router function as Layer 2 device".

In next step we need to enable Bridge Protocol IEEE with command " Bridge 1 protocol ieee". Where 1 is a random bridge group number.

In 3rd and last step we need to enable bridging on interfaces participating in bridging with command " bridge- group 1".

Keep in mind that when router work as a Bridge device all STP rules are applied to this layer 2 topology.

Now lets hop on to CLI to configure it:

!!! Transparent Bridging !!!

**********************
<<< R1 >>>
!
no ip routing <- To Disable IP Routing on Router to work as end host
!
interface FastEthernet0/0
ip address 13.13.13.1 255.255.255.0
no sh
!
#######################

<<< R3 >>>

!
no ip routing
!
interface FastEthernet0/0
ip address 13.13.13.3 255.255.255.0
no sh
!
#######################
<<< R2 >>> <- Bridge Device

!
no ip routing <- To Convert Router into a Layer 2 Bridge Device
!
bridge 1 protocol ieee <- To Enable Bridge Protocol IEEE to Bridge IP Traffic
!
interface FastEthernet0/0
no sh
bridge-group 1 <- To Enable Bridging under interfaces participating in Bridging
!
interface FastEthernet0/1
no sh
bridge-group 1
!
########################
Verification
*************************
R1(config)#do ping 13.13.13.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/45/108 ms
----------------------------
R3(config)#do ping 13.13.13.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/37/68 ms
----------------------------
R2#sh bridge 1 verbose
Total of 300 station blocks, 298 free
Codes: P - permanent, S - self
BG Hash Address Action Interface VC Age RX count TX count
1 00/0 c212.0908.0000 forward FastEthernet0/1 - 0 11 10
1 00/1 c210.0908.0000 forward FastEthernet0/0 - 0 3401 3398
Flood ports (BG 1) RX count TX count
FastEthernet0/0 2 3
FastEthernet0/1 3 2
-----------------------------
R2#sh spanning-tree 1
Bridge group 1 is executing the ieee compatible Spanning Tree protocol
Bridge Identifier has priority 32768, address c211.0908.0000
Configured hello time 2, max age 20, forward delay 15
We are the root of the spanning tree
Topology change flag not set, detected flag not set
Number of topology changes 2 last change occurred 00:18:52 ago
from FastEthernet0/1
Times: hold 1, topology change 35, notification 2
hello 2, max age 20, forward delay 15
Timers: hello 1, topology change 0, notification 0, aging 300
Port 4 (FastEthernet0/0) of Bridge group 1 is forwarding
Port path cost 100, Port priority 128, Port Identifier 128.4.
Designated root has priority 32768, address c211.0908.0000
Designated bridge has priority 32768, address c211.0908.0000
Designated port id is 128.4, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
BPDU: sent 596, received 0
Port 5 (FastEthernet0/1) of Bridge group 1 is forwarding
Port path cost 100, Port priority 128, Port Identifier 128.5.
Designated root has priority 32768, address c211.0908.0000
Designated bridge has priority 32768, address c211.0908.0000
Designated port id is 128.5, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
BPDU: sent 581, received 0
*****************************

R4#ping 150.150.150.5 r 10

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 150.150.150.5, timeout is 2 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 12/34/80 ms

R4#ping 150.150.150.6 r 10

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 150.150.150.6, timeout is 2 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 12/32/116 ms

---------------------------

R5#ping 150.150.150.4 r 10

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 150.150.150.4, timeout is 2 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 12/32/76 ms

R5#

R5#ping 150.150.150.6 r 10

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 150.150.150.6, timeout is 2 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 16/40/128 ms

---------------------------

R6#ping 150.150.150.4 r 10

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 150.150.150.4, timeout is 2 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 16/29/72 ms

R6#

R6#ping 150.150.150.5 r 10

Type escape sequence to abort.

Sending 10, 100-byte ICMP Echos to 150.150.150.5, timeout is 2 seconds:

!!!!!!!!!!

Success rate is 100 percent (10/10), round-trip min/avg/max = 16/45/192 ms

---------------------------

R1#sh bridge 1 verbose

Total of 300 station blocks, 295 free

Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count

1 00/0 c21f.0d40.0000 forward FastEthernet0/0 - 3 1 0

1 00/1 c222.01d4.0000 forward FastEthernet0/0 - 0 91 90

1 00/2 c221.0d40.0000 forward FastEthernet1/0 - 0 77 76

1 00/3 c223.01d4.0000 forward FastEthernet0/1 - 0 102 95

1 3E/0 0000.0400.023c forward FastEthernet0/0 - 2 1 0

Flood ports (BG 1) RX count TX count

FastEthernet0/0 5 1

FastEthernet0/1 1 5

FastEthernet1/0 0 6

----------------------------

R2#sh bridge 1 verbose

Total of 300 station blocks, 295 free

Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count

1 00/0 c21e.0d40.0000 forward FastEthernet0/0 - 2 1 0

1 00/1 c222.01d4.0000 forward FastEthernet1/0 - 1 92 89

1 00/2 c221.0d40.0000 forward FastEthernet0/0 - 2 42 41

1 00/3 c223.01d4.0000 forward FastEthernet0/0 - 1 60 55

1 3E/0 0000.0400.023c forward FastEthernet0/0 - 2 1 0

Flood ports (BG 1) RX count TX count

FastEthernet0/0 4 2

FastEthernet0/1 0 6

FastEthernet1/0 2 4

----------------------------

R3#sh bridge 1 verbose

Total of 300 station blocks, 294 free

Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count

1 00/0 c21f.0d40.0000 forward FastEthernet0/0 - 4 1 0

1 00/1 c221.0d40.0000 forward FastEthernet0/0 - 1 36 35

1 00/2 c223.01d4.0000 forward FastEthernet1/0 - 1 102 95

1 00/3 c222.01d4.0000 forward FastEthernet0/0 - 1 61 56

1 01/0 c21e.0d40.0001 forward FastEthernet0/0 - 2 1 0

1 3E/0 0000.0400.023c forward FastEthernet0/0 - 2 3 0

Flood ports (BG 1) RX count TX count

FastEthernet0/0 11 1

FastEthernet0/1 0 0

FastEthernet1/0 1 11

----------------------------

R1#sh span br

Bridge group 1

Spanning tree enabled protocol ieee

Root ID Priority 32768

Address c21e.0d40.0000

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768

Address c21e.0d40.0000

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300

Interface Designated

Name Port ID Prio Cost Sts Cost Bridge ID Port ID

-------------------- ------- ---- ----- --- ----- -------------------- -------

FastEthernet0/0 128.4 128 100 FWD 0 32768 c21e.0d40.0000 128.4

FastEthernet0/1 128.5 128 100 FWD 0 32768 c21e.0d40.0000 128.5

FastEthernet1/0 128.6 128 19 FWD 0 32768 c21e.0d40.0000 128.6

---------------------------

R2#sh span br

Bridge group 1

Spanning tree enabled protocol ieee

Root ID Priority 32768

Address c21e.0d40.0000

Cost 100

Port 4 (FastEthernet0/0)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768

Address c21f.0d40.0000

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300

Interface Designated

Name Port ID Prio Cost Sts Cost Bridge ID Port ID

-------------------- ------- ---- ----- --- ----- -------------------- -------

FastEthernet0/0 128.4 128 100 FWD 0 32768 c21e.0d40.0000 128.4

FastEthernet0/1 128.5 128 100 FWD 100 32768 c21f.0d40.0000 128.5

FastEthernet1/0 128.6 128 19 FWD 100 32768 c21f.0d40.0000 128.6

----------------------------

R3#sh span brief

Bridge group 1

Spanning tree enabled protocol ieee

Root ID Priority 32768

Address c21e.0d40.0000

Cost 100

Port 4 (FastEthernet0/0)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768

Address c220.0d40.0000

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300

Interface Designated

Name Port ID Prio Cost Sts Cost Bridge ID Port ID

-------------------- ------- ---- ----- --- ----- -------------------- -------

FastEthernet0/0 128.4 128 100 FWD 0 32768 c21e.0d40.0000 128.5

FastEthernet0/1 128.5 128 100 BLK 100 32768 c21f.0d40.0000 128.5

FastEthernet1/0 128.6 128 19 FWD 100 32768 c220.0d40.0000 128.6

------------------------------

R1#sh span root

Bridge group 1

Root ID Priority 32768

Address c21e.0d40.0000

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

------------------------------

R2#sh span root

Bridge group 1

Root ID Priority 32768

Address c21e.0d40.0000

Cost 100

Port 4 (FastEthernet0/0)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

------------------------------

R3#sh span root

Bridge group 1

Root ID Priority 32768

Address c21e.0d40.0000

Cost 100

Port 4 (FastEthernet0/0)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

###############################

R1#sh span block

Name Blocked Interfaces List

-------------------- ------------------------------------

Number of blocked ports (segments) in the system : 0

###############################

R2#sh span block

Name Blocked Interfaces List

-------------------- ------------------------------------

Number of blocked ports (segments) in the system : 0

###############################

R3#sh span block

Name Blocked Interfaces List

-------------------- ------------------------------------

Bridge group 1 Fa0/1

Number of blocked ports (segments) in the system : 1

###############################

R1#sh vlan-switch

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 1002 1003

1002 fddi 101002 1500 - - - - - 1 1003

1003 tr 101003 1500 1005 0 - - srb 1 1002

1004 fdnet 101004 1500 - - 1 ibm - 0 0

1005 trnet 101005 1500 - - 1 ibm - 0 0

###############################

R3(config)#spanning-tree vlan 1 root primary

VLAN 1 bridge priority set to 8192

VLAN 1 bridge max aging time unchanged at 20

VLAN 1 bridge hello time unchanged at 2

VLAN 1 bridge forward delay unchanged at 15

###############################

R3(config)#spanning-tree vlan 1 p

R3(config)#do sh span root

Bridge group 1

Root ID Priority 32768

Address c21e.0d40.0000

Cost 100

Port 4 (FastEthernet0/0)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

###############################

R3(config)#spanning-tree vlan 1 priority 0

R3(config)#

R3(config)#do sh span root

Bridge group 1

Root ID Priority 32768

Address c21e.0d40.0000

Cost 100

Port 4 (FastEthernet0/0)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

##############################

R3(config)#bridge 1 priority 0

R3(config)#

R3(config)#do sh span root

Bridge group 1

Root ID Priority 0

Address c220.0d40.0000

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

#############################

R3(config)#do sh span block

Name Blocked Interfaces List

-------------------- ------------------------------------

Number of blocked ports (segments) in the system : 0

#############################

R2#sh span block

Name Blocked Interfaces List

-------------------- ------------------------------------

Bridge group 1 Fa0/0

Number of blocked ports (segments) in the system : 1

<<< R1 >>>

!
no ip routing
!
bridge 1 protocol ieee
!
interface FastEthernet0/0
no ip address
bridge-group 1
no sh
!
interface FastEthernet0/1
no ip address
bridge-group 1
no sh
!
interface FastEthernet1/0
no ip address
bridge-group 1
no sh
!
==========================

<<< R2 >>>

!
no ip routing
!
bridge 1 protocol ieee
!
interface FastEthernet0/0
no ip address
bridge-group 1
no sh
!
interface FastEthernet0/1
no ip address
bridge-group 1
no sh
!
interface FastEthernet1/0
no ip address
bridge-group 1
no sh
!
interface FastEthernet2/0
no ip address
bridge-group 1
no sh
!
=============================

<<< R3 >>>

!
no ip routing
!
bridge 1 protocol ieee
!
interface FastEthernet0/0
no ip address
bridge-group 1
no sh
!
interface FastEthernet0/1
no ip address
bridge-group 1
no sh
!
interface FastEthernet1/0
no ip address
bridge-group 1
no sh
!
==============================

<<< R4 >>>

!
no ip routing
!
interface FastEthernet0/0
ip address 45.45.45.4 255.255.255.0
no sh
!
==============================

<<< R5 >>>

!
no ip routing
!
interface FastEthernet0/0
ip address 45.45.45.5 255.255.255.0
no sh
!
==============================

*******************************

R5#ping 45.45.45.4 si 1500 r 3

Type escape sequence to abort.
Sending 3, 1500-byte ICMP Echos to 45.45.45.4, timeout is 2 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 64/88/128 ms

*******************************

R4#ping 45.45.45.5 si 1500 r 3

Type escape sequence to abort.
Sending 3, 1500-byte ICMP Echos to 45.45.45.5, timeout is 2 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 40/109/208 ms
R4#

********************************

R2#sh br 1 v

Total of 300 station blocks, 294 free
Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count
1 00/0 c21b.0a14.0000 forward FastEthernet0/0 - 0 10 8
1 00/1 c21a.0a14.0000 forward FastEthernet1/0 - 3 1 0
1 00/2 c21c.0c84.0000 forward FastEthernet1/0 - 0 9 8
1 01/0 0025.0000.0001 forward FastEthernet0/0 - 2 1 0
1 01/1 c21a.0a14.0001 forward FastEthernet2/0 - 3 1 0
1 3E/0 0000.0400.023c forward FastEthernet0/0 - 3 4 0

Flood ports (BG 1) RX count TX count
FastEthernet0/0 19 11
FastEthernet0/1 0 0
FastEthernet1/0 7 23
FastEthernet2/0 4 26

---------------------------------

R2#sh span br

Bridge group 1
Spanning tree enabled protocol ieee
Root ID Priority 32768
Address c218.0a14.0000
Cost 19
Port 4 (FastEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768
Address c219.0a14.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300

Interface Designated
Name Port ID Prio Cost Sts Cost Bridge ID Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet0/0 128.4 128 19 FWD 0 32768 c218.0a14.0000 128.4
FastEthernet0/1 128.5 128 19 BLK 0 32768 c218.0a14.0000 128.5
FastEthernet1/0 128.6 128 19 FWD 19 32768 c219.0a14.0000 128.6
FastEthernet2/0 128.7 128 19 FWD 19 32768 c219.0a14.0000 128.7

**********************************

R1#sh br 1 v

Total of 300 station blocks, 293 free
Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count
1 00/0 c219.0a14.0000 forward FastEthernet0/0 - 0 1 0
1 00/1 c21b.0a14.0000 forward FastEthernet1/0 - 1 13 8
1 00/2 c21a.0a14.0000 forward FastEthernet0/0 - 4 1 0
1 00/3 c21c.0c84.0000 forward FastEthernet0/0 - 1 9 9
1 01/0 c219.0a14.0001 forward FastEthernet0/1 - 0 1 0
1 01/1 c21a.0a14.0001 forward FastEthernet0/0 - 4 1 0
1 3E/0 0000.0400.023c forward FastEthernet0/0 - 1 3 0

Flood ports (BG 1) RX count TX count
FastEthernet0/0 18 11
FastEthernet0/1 4 25
FastEthernet1/0 7 22

-------------------------------------

R1#sh span br

Bridge group 1
Spanning tree enabled protocol ieee
Root ID Priority 32768
Address c218.0a14.0000
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768
Address c218.0a14.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300

Interface Designated
Name Port ID Prio Cost Sts Cost Bridge ID Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet0/0 128.4 128 19 FWD 0 32768 c218.0a14.0000 128.4
FastEthernet0/1 128.5 128 19 FWD 0 32768 c218.0a14.0000 128.5
FastEthernet1/0 128.6 128 19 FWD 0 32768 c218.0a14.0000 128.6

***************************************

R3#sh br 1 v

Total of 300 station blocks, 294 free
Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count
1 00/0 c218.0a14.0000 forward FastEthernet0/0 - 1 1 0
1 00/1 c21b.0a14.0000 forward FastEthernet0/0 - 0 11 9
1 00/2 c21c.0c84.0000 forward FastEthernet1/0 - 0 10 9
1 01/0 0025.0000.0001 forward FastEthernet0/0 - 2 3 0
1 10/0 c219.0a14.0010 forward FastEthernet0/0 - 2 1 0
1 3E/0 0000.0400.023c forward FastEthernet0/0 - 2 5 0

Flood ports (BG 1) RX count TX count
FastEthernet0/0 29 3
FastEthernet0/1 0 0
FastEthernet1/0 3 29
---------------------------------------

R3#sh span br

Bridge group 1
Spanning tree enabled protocol ieee
Root ID Priority 32768
Address c218.0a14.0000
Cost 38
Port 4 (FastEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768
Address c21a.0a14.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300

Interface Designated
Name Port ID Prio Cost Sts Cost Bridge ID Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet0/0 128.4 128 19 FWD 19 32768 c219.0a14.0000 128.6
FastEthernet0/1 128.5 128 19 BLK 19 32768 c219.0a14.0000 128.7
FastEthernet1/0 128.6 128 19 FWD 38 32768 c21a.0a14.0000 128.6

*****************************************

R1#sh span root
Bridge group 1
Root ID Priority 32768
Address c218.0a14.0000
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
#########################################

R2#sh span root
Bridge group 1
Root ID Priority 32768
Address c218.0a14.0000
Cost 19
Port 4 (FastEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

#########################################

R3#sh span root
Bridge group 1
Root ID Priority 32768
Address c218.0a14.0000
Cost 38
Port 4 (FastEthernet0/0)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
#########################################

!!! Transparent Bridging With Multiple-Links !!!

**********************

<<< R1 >>>

!
no ip routing
!
interface FastEthernet0/0
ip address 13.13.13.1 255.255.255.0
no sh
!
#######################

<<< R3 >>>

!
no ip routing
!
interface FastEthernet0/0
ip address 13.13.13.3 255.255.255.0
no sh
!
#######################

<<< R2 >>>

!
no ip routing
!
bridge 1 protocol ieee
!
interface FastEthernet0/0
no ip address
bridge-group 1
no sh
!
interface FastEthernet0/1
no ip address
bridge-group 1
no sh
!
interface FastEthernet1/0
no ip address
bridge-group 1
no sh
!
interface FastEthernet2/0
no ip address
bridge-group 1
no sh
!
########################

*************************

R1(config)#do ping 13.13.13.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/45/108 ms

----------------------------

R3(config)#do ping 13.13.13.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/37/68 ms

----------------------------

R2#sh bridge 1 verbose

Total of 300 station blocks, 298 free
Codes: P - permanent, S - self

BG Hash Address Action Interface VC Age RX count TX count
1 00/0 c214.0de0.0000 forward FastEthernet0/0 - 0 5 4
1 00/1 c216.0de0.0000 forward FastEthernet1/0 - 0 5 5

Flood ports (BG 1) RX count TX count
FastEthernet0/0 2 3
FastEthernet0/1 0 0
FastEthernet1/0 3 2
FastEthernet2/0 0 0

-----------------------------

R2#sh span brief

Bridge group 1
Spanning tree enabled protocol ieee
Root ID Priority 32768
Address c215.0de0.0000
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768
Address c215.0de0.0000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300

Interface Designated
Name Port ID Prio Cost Sts Cost Bridge ID Port ID
-------------------- ------- ---- ----- --- ----- -------------------- -------
FastEthernet0/0 128.4 128 100 FWD 0 32768 c215.0de0.0000 128.4
FastEthernet0/1 128.5 128 100 BLK 0 32768 c215.0de0.0000 128.4
FastEthernet1/0 128.6 128 19 FWD 0 32768 c215.0de0.0000 128.6
FastEthernet2/0 128.7 128 19 BLK 0 32768 c215.0de0.0000 128.6
*****************************

Some More Cool Dancing - Off Topic

2011-02-28T11:19:00.000+05:30

EIGRP Offset-List Not Working - Troubleshooting Series(Ticket 1)

2011-02-26T21:07:00.007+05:30

Today I am going to start a 12 ticket long troubleshooting series for all readers. The tickets will be posted in every week or two followed by solutions for old ones every week too. There will be 48 Hrs time line for solving each ticket starting from time of posting. Who so ever will solve all 12 tickets within the time line with following details will win exiting gift :-)

1. What is root cause of problem ?
2. How we can fix it with minimal changes in pre-configuration?

The winner will win CCNP TSHOOT Exam Certification Guide Hard Copy.

Take a look at topology and configuration below and determine why EIGRP offset-list is not working.

HTH...
Deepak Arora

I wish I could dance like this - Fun Post

2011-02-20T17:10:00.000+05:30

How To Prepare For CCNA - An Insight Look

2011-02-20T14:28:00.002+05:30

In Recent months I have received so many email from all around the world from people asking about how to prepare for CCNA.

So today as I am resuming blogging back so thought to start with this. I mean how I passed my CCNA back in sep 2005.

Back in 2005 there were not much resources available to prepare for CCNA like today. I was working for a company as System Support Engineer (Desktops, Servers, High Speed Line Printers etc). Life was pretty hard and income was quiet less...actually 75 USD a month. At that time a close friend and mentor SUSHIL SHARDA who was working for same client like I was on behalf of another company asked me to try my luck in Networking Industry. He encouraged me to go for CCNA. I took his suggestion and started preparing for CCNA 640-801 exam.

I used the following material or In brief CCNA Complete Study package written by great CCIE Instructor Chris Bryant (CCIE#12933).

http://www.thebryantadvantage.com/UltimateCCNAStudyPackage.html

The CCNA package has got everything you need to pass CCNA exam like :

1. CCNA Study Book
2. CCNA Lab Book (Containing CCNA Lab Scenarios for practice and to put
    your theory and skills on test for practice)
3. Binary Maths book which covers all you need to know about Subnetting
4. A book covering how to convert from Binary to hex and decimal
   and vice versa.
5. CCNA Practice Engine
6. CCNA command handbook etc

This all stuff is gonna cost you just 25 USD.

Apart from this I used CCNA Book from Todd Lammle. In those days GNS was not available so I used most of time on real equipments and Boson's CCNA Simulator. But for current CCNA most of stuff can be practiced on GNS. But still getting some hands on with real equipment will be an added advantage.

Here is link to another subnetting quiz tool which I found extremely helpful to get rid of my bad subnetting calculation skills:

http://www.nybi.org/subnet-2.php

Apart from this I would suggest you to join some instructor lead class in-case you have enough money to spend on it to gain hands on experience with real equipments.

But there are certain things which I would like to suggest you before joining instructor lead classes.

1. How many CCNA students have passed so far from them. Try to get in touch with someone among those and take feedback.

2. Do they have enough equipments so that you don't need to sit and wait for too long to wait for your turn to practice on real equipments.

3. The equipments they have are able to run all IOS command set and features which you need to practice for CCNA.

I have heard about many CCNA institutes which have old equipments that can't run features like SDM, No Wireless Equipments to practice wireless section, Old routers and IOS which cannot run IPv6 etc.

4. Read from books about basics of networking and ask for a demo class session to see if you and instructor have good understanding.

Just don't go blank to attend any certification class...that's the tip of the day.

Remember that practice is the key. But make sure you are good enough with theory before getting into lab and practice stuff.

Also don't under estimate CCNA exam like many other who claims it's an easy one to pass. From my personal experience I can tell you that It's not an easy exam to pass.

Also make sure you test all theory you read using equipments or GNS to make sure there is no gap. One common mistake I have seen people making while learning Cisco (including me) is that some times we take things on little grant and assumes what's written in book can't be wrong. Also it depends upon how you inter prate Author's wording. It might look to you that particular thing is gonna work one way while author was trying to tell it's gonna work in that particular way under particular conditions.

Also in case you have any CCNA queries you can always come back to me and I'll try to help you guys with those in best way I can. But there is another forum forum where you can post your queries and to get help.

www.ieoc.com

All you need to do is to create a free login and post your queries on forum.

So best of luck with your CCENT and CCNA study guys... Enjoy every moment of learning.

Further Ref : https://learningnetwork.cisco.com/thread/15662

HTH...
Deepak Arora

Getting Back Into Action

2011-02-20T13:43:00.001+05:30

Finally after about 2 months of break from Studies because on my health issues I am returning back to normal life slowly. Though I am not fully recovered but things are getting better day by day. Finally doctors here in India were able to find out reason behind my problem which is known as - CVS (Computer Vision Syndrome). Though it was not a major problem in itself but time it took to figure it out for me definately build up some pressure in my life.

http://hubpages.com/hub/Computer-Vision-Syndrome

I would like to thank all blog visiters, friends and followers for their support and best wishes.

In the mean while I would suggest to read about CVS and some guidelines about how to prevent it on web since it's quiet common among people who work more than 4 hours a day before computer.

Thanks Again Everyone !!!

Seeking Blessings From Followers & Friends

2011-01-17T17:26:00.000+05:30

It's been three weeks since I post something new here. Actually I am going through some health issues since 25th December.

Everthing was going fine till 24th December when I posted my last tech post on OSPF troubleshooting here. But from very next day I have this issue. When on 25th morning I woke up I felt my eye sight was not normal. Technically Finding myself unable to read books and work on my laptop. Though I can see and read everything fine but still I can feel that there is some difference compare to my normal eye sight. Because of this problem I am feeling stress these days.

Without going much deeper talking about my health problem. I would request you to spend two mins of your time to pray for my health. I hope you guys won't mind. I am not looking for sympthy but prayers from you. Because in the end of day I feel that God can make me alright.

I hope to return back soon to blog once I feel I am fine now. You guys can imagine how tough life can become in an over night when you are a IT Engineer who must work on laptop and study documents all the time but things get change in just a matter of a night.

I am also returning back to India for better medical treatment.

Hope you guys will find 2 mintues to pray for me.

OSPF Troubleshooting Lab - It's All About LSA Magic

2010-12-24T16:06:00.000+05:30

Yesterday I got this OSPF Troubleshooting Challenge sent by one CCIE candidate friend on email. So I thought to share it with you guys.

With that being said , here is the topology {Which I redraw to look better of course :-) } & quick requirements.

Note: Click Images To Enlarge

Requirements :
---------------------

On R3 we have redistribute the Loopback interfaces into OSPF process using "redistribute connected subnets" command. Over R2 we have configured "Summary x.x.x.x x.x.x.x" command under OSPF process to summarize these loopbacks of R3. But R1 is still seeing the all more specific routes for R3's loopbacks. In short it's not getting the summary route from R2.

So how we gonna fix it ?

Ummm.... Interesting ? .... May Be :-)

Lets hop on to all three routers and check the basic configuration already done for us.

So based on this we can see that it's just a normal misconfiguration. Because to summarize the External Routes we need to put this command on R3 since it's the one who is ASBR. Or in short - Only ASBR can summarize the external prefixes not ABR. It looks simple and meaningful though but I have seen many people with this misconception that since as most of books we read says in OSPF the summarization can only be done at Boundary Routers so they assume that external routes can also be summarized by ABR. Which we can see here is that not the case. Or may be they should have mentioned this behavior explicitly :-)

So by that same token if we configure "Summary x.x.x.x x.x.x.x" command on R3 instead of R2 in that case it will work just fine.

But that will be two simple... how about if we are not allowed to put this command on R3 ?

Ummm.... that will actually make life more complicated. Lets check the database on R2 and see how it looks like with command "sh ip ospf database"

So R2 sees those prefixes as LSA Type - 5 and we are Adv router (Originator) is 33.33.33.33 which is Router ID (RID) of R3 which I setup manually.

Ummm.... so only LSA 5 Originator can summarize the prefixes by using "Summary" command.

Is there any way we can take charge of these prefixes and convert them to LSA Type 5 with Originator set being Ourself ?

How about NSSA ? :-)

Because if convert Area 1 into NSSA in that case we will see those external prefixes being advertised by R3 as Type 7 LSA. Since R2 is the ABR it will convert LSA 7 into LSA 5 before advertising into Area 0. So in that sense we are now originator of LSA - 5 and very well can use summary command.

Lets see this on command line by configuring AREA 1 as NSSA on R2 & R3:

Now lets take a look at database on R2 again:

Lets see if this worked for us just fine by taking a look at R1's Routing Table.

So far so good. :-) Time for Celebration

But what if we are not even allowed to make Area 1 as NSSA ? ..... horrible ?

See if you can make it work with this restriction before I present the solution which came from a great Network Engineer and friend Michael Miller.

Take it as challenge and see if you can make this work with this last restriction by not configuring Area 1 as NSSA.

I'll post the solution though some time next week.

And Of course.... Merry Christmas Everyone

HTH...

Deepak Arora

CCIE - 0::0/0 Null0

IPv6 Routing For Dummies (Coming Soon)

2010-12-23T17:37:00.001+05:30

My First Grammy Award

2010-12-23T14:35:00.001+05:30

Finally on Dec 21st INE put my name on it's blog with a little thanks note and a lovely gift. Though CCIE is not finished yet but it's nice to see that a major CCIE vendor and elite team of experts recognized your name.

Feels like I got my first Grammy Award.

But CCIE number is yet to come. So need to put lots of hard work in coming months.

But another thing I forgot to mention above is that it was second time when I found my name on INE blog. :-)

Check here for rest of the story :

http://blog.ine.com/2010/03/04/tshoot-sample-exam-questions/

http://blog.ine.com/2010/12/21/ine-online-community-deepak-arora/

HTH...

Deepak Arora

CCIE - 0::0/0 Null0

Few Words On CCIE From The Guy Who Can Make You Fall In Love With Cisco

2010-12-23T12:02:00.000+05:30

Operational differences between HSRP, VRRP & GLBP - Cliff Notes

2010-12-22T22:07:00.001+05:30

HTH...

Deepak Arora

CCIE - 0::0/0 Null0

CCIE Voice Preparation - This is how life becomes once you go for CCIE :-)

2010-12-22T21:30:00.000+05:30

Routing-Bits Handbook for R&S AKA CCIE R&S Short Notes - From Dual CCIE Ruhann

2010-12-22T12:41:00.000+05:30

Just yesterday morning I got my official copy of Routing-Bits Handbook on my email and good part was that it was free of any charge :-) since I buy very first version of this couple of months back.

Not to mention that if you are working on CCIE R&S like me then you should definitely check this out .

Also Ruhann is going to release his SP Handbook in coming month too. Which I am definitely gonna buy :-) as my ultimate goal is to learn SP technologies at Expert Level.

HTH...

Deepak Arora

CCIE - 0::0/0 Null0