*Distance VectorLink StateHybridDistance Vector vs. Link StateRoute tableTopologyIncremental UpdatePeriodic UpdateRouting by rumorABCDXE

*Distance Vector vs. Link StateDistance VectorUpdates frequentlyEach router is "aware" only of its immediate neighborsSlow convergenceProne to routing loopsEasy to configureLink StateUpdates are event triggeredEach router is "aware" of all other routers in the "area"Fast convergenceLess subject to routing loopsMore difficult to configure

*Comparison ContinuedDistance VectorFewer router resources requiredUpdates require more bandwidthDoes not "understand" the topology of the networkLink StateMore router resource intensiveUpdates require less bandwidthHas detailed knowledge of distant networks and routers

*Link State Routing

*Link StateExampleOSPFIS-IS

OSPF is used for corporate networksIS-IS is used for ISPs

*

*Open Shortest Path First (OSPF)OSPF is an open standards routing protocol This works by using the Dijkstra algorithmOSPF provides the following features:Minimizes routing update trafficAllows scalability (e.g. RIP is limited to 15 hops)Has unlimited hop countSupports VLSM/CIDRAllows multi-vendor deployment (open standard)

*Link StateThere are two types of PacketsHelloLSAs

*OSPF HelloWhen router A starts it send Hello packet uses 224.0.0.5Hello packets are received by all neighborsB will write As name in its neighbor tableC also process the same way

ABC

*"Hello" PacketsSmall frequently issued packetsDiscover neighbours and negotiate "adjacencies"Verify continued availability of adjacent neighboursHello packets and Link State Advertisements (LSAs) build and maintain the topological databaseHello packets are addressed to 224.0.0.5.

*Link State Advertisement(LSA)An OSPF data packet containing link state and routing information that is shared among OSPF routers

LSAs are shared only with routers with whom it has formed adjacencies

LSA packets are used to update and maintain the topology database.

*Link StateThere are three type of tablesNeighborTopologyRouting

*TablesNeighborContain information about the neighborsNeighbor is a router which shares a link on same networkAnother relationship is adjacencyNot necessarily all neighborsLSA updates are only when adjacency is established

*TablesTopologyContain information about all network and path to reach any networkAll LSAs are entered in to topology tableWhen topology changes LSAs are generated and send new LSAsOn topology table an algorithm is run to create a shortest path, this algorithm is known as SPF or dijkstra algorithm

*TablesRouting TableAlso knows as forwarding databaseGenerated when an algorithm is run on the topology databaseRouting table for each router is unique

*OSPF TermsLinkRouter IDNeighboursAdjacencyOSPF AreaBackbone areaInternal routersArea Border Router (ABR)Autonomous System Boundary Router (ASBR)

*LinkA network or router interface assigned to a given networkLink (interface) will have "state" information associated with itStatus (up or down)IP AddressNetwork type (e.g. Fast Ethernet)BandwidthAddresses of other routers attached to this interface

*OSPF Term: LinkA link is a network or router interface assigned to any given network This link, or interface, will have state information associated with it (up or down) as well as one or more IP addresses

*OSPF Term: Link StateStatus of a link between two routersInformation is shared between directly connected routers. This information propagates throughout the network unchanged and is also used to create a shortest path first (SPF) tree.

*Router IDThe Router ID (RID) is an IP address used to identify the router

Cisco chooses the Router ID by using the highest IP address of all configured loopback interfaces

If no loopback interfaces are configured with addresses, OSPF will choose the highest IP address of all active physical interfaces.

You can manually assign the router ID.

The RID interface MUST always be up, therefore loopbacks are preferred

*NeighboursNeighbours are two or more routers that have an interface on a common networkE.g. two routers connected on a serial linkE.g. several routers connected on a common Ethernet or Frame relay networkCommunication takes place between / among neighboursneighbours form "adjacencies"

*AdjacencyA relationship between two routers that permits the direct exchange of route updatesNot all neighbours will form adjacenciesThis is done for reasons of efficiency more later

*OSPF DesignEach router connects to the backbone called area 0, or the backbone area.

Routers that connect other areas to the backbone within an AS are called Area Border Routers (ABRs). One interface must be in area 0.

OSPF runs inside an autonomous system, but can also connect multiple autonomous systems together. The router that connects these ASes together is called an Autonomous System Boundary Router (ASBR).

*OSPF AreasAn OSPF area is a grouping of contiguous networks and routersShare a common area IDA router can be a member of more than one area (area border router)All routers in the same area have the same topology databaseWhen multiple areas exist, there must always be an area 0 (the backbone) to which other areas connect

*Why areas?Decreases routing overheadCompare to multiple smaller broadcast domains instead of one large one

Speeds convergence

Confines network instability (e.g. route "flapping") to single area of the network

Adds considerably to the complexity of setting up OSPFCCNA certification deals only with single-area OSPF

*Area Terminology

*LSAs in AreaLSAs communicate with adjacent routers in the same OSPF area

Subsequently, a change in a link state is "flooded" to all area routers via LSAs

In larger networks, multiple areas may be createdLSAs are sent only to adjacent routers in the same area"Area border routers" connect areas, passing summarized route information between

*Path CalculationChanges to the topological database of a router trigger a recalculation to re-establish the best route(s) to known networksUses the SPF (shortest path first) algorithm developed by a computer scientist named DijkstraThis is done by each individual router using its detailed "knowledge" of the whole networkLeads to rapid and accurate convergenceBased on detailed knowledge of every link in the area and the OSPF "cost" of eachbuilds an OSPF tree with itself at the route

*Terminology: CostVarious criteria can be selected by the administrator to determine the metricUsually, OSPF cost=108/bandwidthDo not forget to configure the bandwidth` command on serial links to ensure correct default OSPF cost

*Pros and ConsNote that OSPF is a more sophisticated routing protocolConverges rapidly and accuratelyCan use a metric calculation that effectively selects the "best" route(s) primarily based on bandwidth, although an OSPF cost can be administratively assignedUse of OSPF requiresMore powerful routing hardwareMore detailed knowledge by the administrator, especially when large multi-area networks are used

*Types of NeighborsOSPF can be defined for three type of neighborsBroadcast Multi Access (BMA) ex- EthernetPoint to PointNon-Broadcast Multi Access (NBMA)

*OSPF Network Types

*AdjacenciesPoint to Point all routers form adjacenciesBMA & NBMA one router is elected as DRDR establish adjacency with every neighbor routerLSA updates are exchanged only to DRDR is the router which has highest priorityAll CISCO routers has priority 1If priority is same then router id is seenThe RID is highest IP address of all interfaces

*Point-to-Point Links Usually a serial interface running either PPP or HDLC No DR or BDR election required OSPF autodetects this interface type OSPF packets are sent using multicast 224.0.0.5All routers form adjacencies

*Multi-access Broadcast Network Generally LAN technologies like Ethernet and Token Ring DR and BDR selection required All neighbor routers form full adjacencies with the DR and BDR only Packets to the DR use 224.0.0.6 Packets from DR to all other routers use 224.0.0.5

*Electing the DR and BDR Hello packets are exchanged via IP multicast. The router with the highest priority is selected as the DR.If Priority is same then Router ID is seen Use the OSPF router ID as the tie breaker.

*Terminology: DRs and BDRsThe designated router (DR) is responsible for generating LSAs on behalf of all routers connected to the same segment

*DR ResponsibilityWhen a router sees a new or changed link-state, it sends an LSA to its DR using a particular multicast address

The DR then forwards the LSA to all the other routers with whom it is adjacentMinimizes the number of formal adjacencies that must be formed and therefore the amount of LSU (link state update) packet traffic in a multi-router network

*OSPF SummaryAD -100Hop count is unlimitedMetric = Cost 108/BWClassless, VLSMLoad balance up to SIX routersRequire more processing power

*Basic OSPF ConfigurationRouter(config)# router ospf 1The number 1 in this example is a process-id # that begins an OSPF process in the routerMore than one process can be launched in a router, but this is rarely necessaryUsually the same process-id is used throughout the entire network, but this is not requiredThe process-id # can actually be any value from 1 to "very large integerThe process-id # cannot be ZEROThis is NOT the same as the AS# used in IGRP and EIGRP

*Configuring OSPF Areas After identifying the OSPF process, you need to identify the interfaces that you want to activate OSPF communications Lab_A#config tLab_A(config)#router ospf 1Lab_A(config-router)#network 10.0.0.0 0.255.255.255area ? OSPF area ID as a decimal valueA.B.C.D OSPF area ID in IP address formatLab_A(config-router)#network 10.0.0.0 0.255.255.255area 0Every OSPF network must have an area 0 (the backbone area) to which other areas connectSo in a multiple area network, there must be an area 0The wildcard mask represents the set of hosts supported by the network and is really just the inverse of the subnet mask.

*OSPF ConfigurationOSPF Process ID number is irrelevant. It can be the same on every router on the network The arguments of the network command are the network number (10.0.0.0) and the wildcard mask (0.255.255.255) Wildcards - A 0 octet in the wildcard mask indicates that the corresponding octet in the network must match exactly A 255 indicates that you dont care what the corresponding octet is in the network number A network and wildcard mask combination of 1.1.1.1 0.0.0.0 would match 1.1.1.1 only, and nothing else.The network and wildcard mask combination of 1.1.0.0 0.0.255.255 would match anything in the range 1.1.0.01.1.255.255

*OSPF Configuration -110.0.0.120.0.0.120.0.0.230.0.0.130.0.0.240.0.0.110.0.0.240.0.0.2

*OSPF Configuration -1R1#config tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#router ospf 1R1(config-router)#network 10.0.0.0 0.255.255.255 area 0R1(config-router)#network 20.0.0.0 0.255.255.255 area 0 R1(config-router)#^Z

*OSPF Configuration -2200.0.0.16/28200.0.0.8/30200.0.0.12/30200.0.0.32/27

*OSPF Configuration -2200.0.0.17200.0.0.9200.0.0.10200.0.0.13200.0.0.14200.0.0.33200.0.0.18200.0.0.34255.255.255.240 255.255.255.252 255.255.255.252 255.255.255.224

*OSPF Configuration -2200.0.0.17200.0.0.9200.0.0.10200.0.0.13200.0.0.14200.0.0.33200.0.0.18200.0.0.34255.255.255.240 255.255.255.252 255.255.255.252 255.255.255.224 R1#config tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#router ospf 1R1(config-router)#network 200.0.0.16 0.0.0.15 area 0R1(config-router)#network 200.0.0. 8 0.0.0.3 area 0 R1(config-router)#^ZR3#config tEnter configuration commands, one per line. End with CNTL/Z.R3(config)#router ospf 1R3(config-router)#network 200.0.0. 32 0.0.0.31 area 0R3(config-router)#network 200.0.0. 12 0.0.0.3 area 0 R3(config-router)#^Z

*OSPF and Loopback InterfacesConfiguring loopback interfaces when using the OSPF routing protocol is importantCisco suggests using them whenever you configure OSPF on a router Loopback interfaces are logical interfaces, which are virtual, software-only interfaces; they are not real router interfaces Using loopback interfaces with your OSPF configuration ensures that an interface is always active for OSPF processes.The highest IP address on a router will become that routers RID The RID is used to advertise the routes as well as elect the DR and BDR. If you configure serial interface of your router with highest IP Address this Address becomes RID of t is the RID of the router because e routerIf this interface goes down, then a re-election must occurIt can have an big impact when the above link is flapping

*Configuring Loopback Interfaces R1#config tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#int loopback 0R1(config-if)#ip address 172.16.10.1 255.255.255.255R1(config-if)#no shutR1(config-if)#^ZR1#

*show ip protocols Router#Verifies the configured IP routing protocol processes, parameters and statisticsVerifying OSPF Operationshow ip route ospfRouter#Displays all OSPF routes learned by the routershow ip ospf interface Router#Displays the OSPF router ID, area ID and adjacency information

*show ip ospf Router#Displays the OSPF router ID, timers, and statistics

Verifying OSPF Operation (Cont.)show ip ospf neighbor [detail]Router#Displays information about the OSPF neighbors, including Designated Router (DR) and Backup Designated Router (BDR) information on broadcast networks

*The show ip route ospf CommandRouterA# show ip route ospf Codes:C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP, D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP, i - IS-IS, L1 - IS-ISlevel-1, L2 - IS-IS level-2, * - candidate default

Gateway of last resort is not set10.0.0.0 255.255.255.0 is subnetted, 2 subnetsO 10.2.1.0 [110/10] via 10.64.0.2, 00:00:50, Ethernet0

*The show ip ospf interface CommandRouterA# show ip ospf interface e0 Ethernet0 is up, line protocol is up Internet Address 10.64.0.1/24, Area 0 Process ID 1, Router ID 10.64.0.1, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DROTHER, Priority 1 Designated Router (ID) 10.64.0.2, Interface address 10.64.0.2 Backup Designated router (ID) 10.64.0.1, Interface address 10.64.0.1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:04 Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 10.64.0.2 (Designated Router) Suppress hello for 0 neighbor(s)

*The show ip ospf neighbor CommandRouterB# show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface10.64.1.1 1 FULL/BDR 00:00:31 10.64.1.1 Ethernet010.2.1.1 1 FULL/- 00:00:38 10.2.1.1 Serial0

*show ip ospf neighbor detailshow ip ospf database

*Setting Priority for DR Electionip ospf priority numberThis interface configuration command assigns the OSPF priority to an interface.Different interfaces on a router may be assigned different values.The default priority is 1. The range is from 0 to 255.0 means the router is a DROTHER; it cant be the DR or BDR.Router(config-if)#

*

*EIGRPIGRPDVEasy to configureNeighborAdvanced MetricPeriodicBroadcastOSPFLSIncremental UpdatesMulticast Open StandardEIGRPHybridDUALTopology DatabaseRapid ConvergenceReliable

*OverviewEnhanced Interior Gateway Routing Protocol (EIGRP) is a Cisco-proprietary routing protocol based on Interior Gateway Routing Protocol (IGRP).

Released in 1994, Unlike IGRP, which is a classful routing protocol, EIGRP supports CIDR and VLSM.

it is probably one of the two most popular routing protocols in use today.

Compared to IGRP, EIGRP boasts faster convergence times, improved scalability, and superior handling of routing loops.

EIGRP is often described as a hybrid routing protocol, offering the best of distance vector and link-state algorithms.

*Comparing EIGRP with IGRPIGRP and EIGRP are compatible with each other. EIGRP offers multiprotocol support, but IGRP does not. Communication via Reliable Transport Protocol (RTP)Best path selection via Diffusing Update Algorithm (DUAL)Improved convergence timeReduced network overhead

Introducing EIGRPEIGRP supports:Rapid convergenceReduced bandwidth usageMultiple network-layer protocols

*EIGRP TablesEIGRP maintains 3 tables

Neighbor table Topology table Routing table

*Neighbor DiscoveryThere are three conditions that must be met for neighborship establishmentHello or ACK receivedAS numbers matchIdentical metrics (K values)

Hello? AS? KK1 BWK2- DelayK3-LoadK3-ReliabilityK5-MTU

*The metrics used by EIGRP in making routing decisions are (lower the metric the better):bandwidthdelayloadReliabilityMTU

By default, EIGRP uses only:BandwidthDelay

Analogies:Think of bandwidth as the width of the pipe anddelay as the length of the pipe.

Bandwidth is the carrying capacityDelay is the end-to-end travel time.Metric Calculation

*Neighbor TableThe neighbor table is the most important table in EIGRP

Stores address and interface of neighbor

*Topology TableGive me information about all routesNetwork

*Topology TableThe topology table is made up of all the EIGRP routing tables in the autonomous system.

DUAL takes the information and calculates the lowest cost routes to each destination.

By tracking this information, EIGRP routers can identify and switch to alternate routes quickly.

The information that the router learns from the DUAL is used to determine the successor route, which is the term used to identify the primary or best route.

Every EIGRP router maintains a topology table. All learned routes to a destination are maintained in the topology table.

*Routing TablesA successor is a route selected as the primary route to use to reach a destination.DUAL calculates Successor (Primary Route) and places it in the routing table (and topology table) Can have up to 4 successors of equal or unequal valueDUAL calculates Feasible Successor (Backup Route) and places it in the Topology Table.Promoted to successor if the route goes down if it has a lower cost than current successorIf no FS in Table - Send query Multiple feasible successors for a destination can be retained in the topology table although it is not mandatory

*EIGRP Concepts & TerminologyEIGRP routers that belong to different autonomous systems (ASes) dont automatically share routing information

The only time EIGRP advertises its entire routing table is when it discovers a new neighbor and forms an adjacency with it through the exchange of Hello packets

When this happens, both neighbors advertise their entire routing tables to one another

After each has learned its neighbors routes, only changes to the routing table are propagated

*172.16.100.01.544Mbps56Kbps1.544MbpsDist to 172.16.100.0 =100Dist to 172.16.100.0 =100Dist to 172.16.100.0 =35010Mbps10Mbps 1001,544Mbps 25056Kbps -1000Chennai receives an update from Mumbai with a cost of 100, which is Mumbai's cost to reach 172.16.100.0, This cost is referred to as the reported distance (RD)Bangalore will report its cost to reach 172.16.100.0. Bangalore's RD is 350Chennai will compute its cost to reach 172.16.100.0 via Mumbai and Bangalore and compare the metrics for the two pathsChennai's cost via Mumbai is 1100. Chennai's cost via Bangalore is 600. The lowest cost to reach a destination is referred to as the feasible distance (FD) for that destination Chennai's FD to 172.16.100.0 is 600. The next-hop router in the lowest-cost path to the destination is referred to as the successor. A feasible successor is a path whose reported distance is less than the feasible distance, and it is considered a backup route.

*EIGRP TermsFeasible distance (FD) - This is the lowest calculated metric to reach destination. This is the route that you will find in the routing table, because it is considered the best path

Reported distance (RD) - The distance reported by an adjacent neighbor to a specific destination.

Interface information - The interface through which the destination can be reached.

Route status - The status of a route. Routes are identified as being either passive, which means that the route is stable and ready for use, or active, which means that the route is in the process of being recomputed by DUAL

*Successor Current RouteA successor is a route selected as the primary route to use to reach a destination. Successors are the entries kept in the routing table.

Feasible Successor - A backup routeA feasible successor is a backup route. These routes are selected at the same time the successors are identified, but they are kept in the topology table. Multiple feasible successors for a destination can be retained in the topology table.EIGRP Terminology and Operations

*Reliable Transport Protocol (RTP)Used by EIGRP for its routing updates in place of TCPEIGRP can call on RTP to provide reliable or unreliable service EIGRP uses reliable service for route updatesUnreliable for Hellos

Reliable Transport Protocol (RTP) is a transport layer protocol that guarantees ordered delivery of EIGRP packets to all neighbors. On an IP network, hosts use TCP to sequence packets and ensure their timely delivery. RIP uses UDPHowever, EIGRP is protocol-independent and does not rely on TCP/IP to exchange routing information the way that RIP, IGRP, and OSPF do. EIGRP uses RTP as its own proprietary transport layer protocol to guarantee delivery of routing information.With RTP, EIGRP can multicast and unicast to different peers simultaneously.

*Diffusing Update Algorithm (DUAL)All route computations in EIGRP are handled by DUALOne of DUAL's tasks is maintaining a table of loop-free paths to every destination. This table is referred to as the topology table DUAL saves all paths in the topology table The least-cost path(s) is copied from the topology table to the routing table In the event of a failure, the topology table allows for very quick convergence if another loop-free path is available If a loop-free path is not found in the topology table, a route recomputation must occur DUAL queries its neighbors, who, in turn, may query their neighbors, and so on... Hence the name "Diffusing" Update Algorithm

*VLSM SupportEIGRP supports the use of Variable- Length Subnet Masks

Can use 30-bit subnet masks for point-to-point networks

Because the subnet mask is propagated with every route update, EIGRP also supports the use of discontiguous subnets

Discontiguous network is the one that has two or more subnetworks of a classful network connected together by different classful networks

*Discontiguous Network

*EIGRP & IGRP Metric Calculation

Configuring EIGRPRouter(config-router)#network network-numberSelects participating attached networksRouter(config)#router eigrp autonomous-systemDefines EIGRP as the IP routing protocol

EIGRP Configuration Example

*EIGRP Configuration 200.0.0.17200.0.0.9200.0.0.10200.0.0.13200.0.0.14200.0.0.33200.0.0.18200.0.0.34255.255.255.240 255.255.255.252 255.255.255.252 255.255.255.224 R1#config tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#router eigrp 10R1(config-router)#network 200.0.0.16R1(config-router)#network 200.0.0. 8R1(config-router)#^ZR3#config tEnter configuration commands, one per line. End with CNTL/Z.R3(config)#router eigrp 10R3(config-router)#network 200.0.0. 32 R3(config-router)#network 200.0.0. 12 R3(config-router)#^Z

*Verifying the EIGRP ConfigurationTo verify the EIGRP configuration a number of show and debug commands are available.

These commands are shown on the next few slides.

*show ip eigrp topologyshow ip eigrp topology [active | pending | successors]

*show ip eigrp topologyall-linksshow ip eigrp traffic

*Administrative Distances

*TELNETGetting information about remote deviceCan connect to remote device and configure a devicePassword must be set R1(config)# line vty 0 4Password cisco login

* 2002, Cisco Systems, Inc. All rights reserved.*Discovering Neighbors on the Network

Cisco Discovery Protocol CDP is a proprietary utility that gives you a summary of directly connected switches, routers, and other Cisco devices. CDP discovers neighboring devices regardless of which protocol suite they are running.Runs on the Data link layerPhysical media must support the Subnetwork Access Protocol (SNAP) encapsulation.Only give directly connected deviceBy default enabled, you can enable or disable

Discovering Neighbors with CDPCDP runs on routers with Cisco IOS software Release 10.3 or later and on Cisco switches.Show CDP ?Summary information includes:Device IDLocal Interface Port IDCapabilities listPlatform

*CDP CDP timer is how often CDP packets are transmitted to all active interfaces.

Router(config)#cdp timer 90

CDP holdtime is the amount of time that the device will hold packets received from neighbor devices.Router(config)#cdp holdtime 240

*Using CDP

*Using the show cdp neighbors CommandThe show cdp neighbor command (sh cdp nei for short) delivers information about directly connected devices.

*CDPshow cdp neighbor detail

This command can be run on both routers and switches, and it displays detailed information about each device connected to the device

*Using the show cdp entry CommandThe show cdp entry * command displays the same information as the show cdpneighbor details command.

*Additional CDP CommandsThe show cdp traffic command displays information about interface traffic, including the number of CDP packets sent and received and the errors with CDP.

*CDP CommandsTo disable the CDP on particular interface use the "no cdp enable" command

To disable CDP on the entire router use the "no cdp run" in global configuration mode.

*SummaryCisco Discovery Protocol is an information-gathering tool used by network administrators to get information about directly connected devices.

CDP exchanges hardware and software device information with its directly connected CDP neighbors.

You can enable or disable CDP on a router as a whole or on a port-by-port basis.

The show cdp neighbors command displays information about a routers CDP neighbors.

The show cdp entry, show cdp traffic, and show cdp interface commands display detailed CDP information on a Cisco device.

*

Manage IP traffic as network access growsFilter packets as they pass through the routerWhy Use Access Lists?

*What are ACLs?ACLs are lists of conditions that are applied to traffic traveling across a router's interface.

These lists tell the router what types of packets to accept or deny.

Acceptance and denial can be based on specified conditions.

ACLs can be configured at the router to control access to a network or subnet.

Some ACL decision points are source and destination addresses, protocols, and upper-layer port numbers.

*Reasons to Create ACLsThe following are some of the primary reasons to create ACLs:

Limit network traffic and increase network performance. Provide traffic flow control. Provide a basic level of security for network access. Decide which types of traffic are forwarded or blocked at the router interfacesFor example: Permit e-mail traffic to be routed, but block all telnet traffic. If ACLs are not configured on the router, all packets passing through the router will be allowed onto all parts of the network.

*ACLsDifferent access list for TelnetWhen configuring ISDN you need to use access listImplicit deny at bottomAll restricted statements should be on firstThere are two typesStandardExtended

*NetworkN1N2N3N4N5N6192.168.12.0ABC192.168.34.0192.168.56.0192.168.12.2192.168.12.3

*IP PacketSRC IP AddressDEST IP AddressProtocol typeSRC PortDEST PortThe first 2 bytes in the TCP/UDP header are the source port numberThe next 2 bytes in the TCP/UDP header are the Destination port number

* StandardChecks source addressPermits or denies entire protocol suiteExtendedChecks source and destination addressGenerally permits or denies specific protocolsTypes of Access Lists

How to Identify Access ListsStandard IP lists (1-99) test conditions of all IP packets from source addresses.Extended IP lists (100-199) test conditions of source and destination addresses, specific TCP/IP protocols, and destination ports.Standard IP lists (1300-1999) (expanded range).Extended IP lists (2000-2699) (expanded range).

*Standard ACLsThe full syntax of the standard ACL command is:

Router(config)#access-list access-list-number {deny | permit} source [source-wildcard ]

The no form of this command is used to remove a standard ACL. This is the syntax:Router(config)#no access-list access-list-numberConfig# Access-list 1 deny 192.168.1.0 0.0.0.255Config# access-list 1 permit any

*Wildcard Mask Access-list 99 permit 192.168.1.1 wildcard maskAll 32 bits of an IP Address can be filteredWildcard inverse mask0=must match1= ignore

MASK (192.168.1.1)Matching IP0.0.0.0 (host)192.168.1.10.0.0.255192.168.1.0-2550.0.255.255192.168.0-255.0-2550.255.255.255192.0-255.0-255.0-255255.255.255.2550-255.0-255.0-255.0-255 (any)

*The ANY and HOST keywordAccess-list 1 permit 200.0.0.9 0.0.0.0Orpermit host 200.0.0.9Access-list 1 permit 0.0.0.0 255.255.255.255Orpermit any

Testing Packets with Standard Access Lists

Outbound ACL OperationIf no access list statement matches, then discard the packet.

*Reading an ACLFirst Hit or Best Fit?Access-list 99 deny host 192.168.1.1 0.0.0.0access-list 99 permit any255.255.255.255

Access-list 99 permit 192.168.1.0 0.0.0.255Access-list 99 deny host 192.168.1.1access-list 99 permit any

Access-list 99 deny host 192.168.1.1

Implicit deny at the end of every ACL

*Creating ACLsACLs are created in the global configuration mode. There are many different types of ACLs including standard, extended, IPX, AppleTalk, and others. When configuring ACLs on a router, each ACL must be uniquely identified by assigning a number to it. This number identifies the type of access list created and must fall within the specific range of numbers that is valid for that type of list. Since IP is by far the most popular routed protocol, addition ACL numbers have been added to newer router IOSs. Standard IP: 1300-1999Extended IP: 2000-2699

*The ip access-group command

*Exercise Standard Access ListAccount should be denied access to Sales

To steps to configureCreate a standard Access listApply ACL to proper interface inbound or outboundS0S0E0E0192.168.0.18255.255.255.248S0S1192.168.0.17255.255.255.248192.168.0.5255.255.255.252192.168.0.6255.255.255.252192.168.0.9255.255.255.252192.168.0.10255.255.255.252192.168.0.33255.255.255.240192.168.0.34255.255.255.240

*Exercise Standard Access ListS0S0E0E0192.168.0.18255.255.255.248S0S1192.168.0.17255.255.255.248192.168.0.5255.255.255.252192.168.0.6255.255.255.252192.168.0.9255.255.255.252192.168.0.10255.255.255.252192.168.0.33255.255.255.240192.168.0.34255.255.255.240Config# Access-list 1 deny 192.168.0.18 0.0.0.7Config# access-list 1 permit any Config#int e 0 Config-if# ip access-group 1 out

*Extended ACLsExtended ACLs are used more often than standard ACLs because they provide a greater range of control.

Extended ACLs check the source and destination packet addresses as well as being able to check for protocols and port numbers.

At the end of the extended ACL statement, additional precision is gained from a field that specifies the optional Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number.

Logical operations may be specified such as, equal (eq), not equal (neq), greater than (gt), and less than (lt), that the extended ACL will perform on specific protocols.

Extended ACLs use an access-list-number in the range 100 to 199 (also from 2000 to 2699 in recent IOS).

*ConfigurationAccess-list acl# {permit/Deny}ProtocolSrc IP src WCMDst IP dst WCMOpetrator portProtocolOSPFEIGRPICMPTCPUDPRPIf you need to Block a routing protocolIPOperatoreqgtltneq

Testing Packets with Extended Access Lists

*Extended ACL Syntax

*Extended ACL LABAccount should be denied Sales Web siteConfig# Access-list 100 deny tcp 200.0.0.10 0.0.0.7 200.0.0.18 0.0.0.15 eq wwwConfig# access-list 100 permit IP any anyConfig#int Fastethernet 0/0 Config-if# ip access-group 100 IN

*Extended ACL LAB -2S0S0E0E0192.168.0.34 should be denied FTP of 192.168.0.18

On Router R1Config# Access-list 100 deny tcp 192.168.0.34 0.0.0.0 192.168.0.18 0.0.0.0 eq 21Config# access-list 100 permit IP any any

Config#int s0Config-if# ip access-group 100 IN192.168.0.18 should be denied website of 192.168.0.34

On Router R3Config# Access-list 100 deny tcp 192.168. 0.18 0.0.0.0 192.168.0.34 0.0.0.0 eq 80Config# access-list 100 permit IP any any

Config#int s0Config-if# ip access-group 100 INS1S0192.168.0.18255.255.255.248192.168.0.17255.255.255.248192.168.0.5255.255.255.252192.168.0.6255.255.255.252192.168.0.9255.255.255.252192.168.0.10255.255.255.252192.168.0.33255.255.255.240192.168.0.34255.255.255.240

*Deny FTPaccess-list 101 deny tcp any any eq 21

access-list 101 permit ip any any

or

access-list 101 deny tcp any any eq ftp

access-list 101 permit ip any any

*RulesFor extended access list apply near to the sourceFor standard access list apply near to the destination

*Named ACLsIP named ACLs were introduced in Cisco IOS Software Release 11.2, allowing standard and extended ACLs to be given names instead of numbers.

The characteristics of named accesslist: Identify an ACL using an alphanumeric name. You can delete individual statements in a named access list Named access lists must be specified as standard or extendedYou can use the ip access-list command to create named access lists.

Named ACLs are not compatible with Cisco IOS releases prior to Release 11.2.

The same name may not be used for multiple ACLs.

*Named ACLsNumbered Access list did not give you any hint, What is filtered

Named ACLs are both basic and advanced filtering tool

Name cannot start with a number or !

Cannot have space in the name

Should not have ? Character anywhere in the name

Name is case sensitive

*Named ACL ExampleR1(config)#ip access-list standard blocksalesR1(config-std-nacl)#deny 172.16.40.0 0.0.0.255R1(config-std-nacl)#permit anyR1(config-std-nacl)#exitR1(config)#^ZR1#

#Int e 0#Ip access-group blocksales out

*Verify Access List

*Basic Rules for ACLsStandard IP access lists should be applied closest to the destination. Extended IP access lists should be applied closest to the source. Use the inbound or outbound interface reference as if looking at the port from inside the router. Statements are processed sequentially from the top of list to the bottom until a match is found, if no match is found then the packet is denied. There is an implicit deny at the end of all access lists. This will not appear in the configuration listing. Access list entries should filter in the order from specific to general. Specific hosts should be denied first, and groups or general filters should come last. Never work with an access list that is actively applied. New lines are always added to the end of the access list. A no access-list x command will remove the whole list. It is not possible to selectively add and remove lines with numbered ACLs. Outbound filters do not affect traffic originating from the local router.

Cisco IOS File System and Devices

Managing Cisco IOS Images

wg_ro_a#show flash

System flash directory:File Length Name/status 1 10084696 c2500-js-l_120-3.bin

[10084760 bytes used, 6692456 available, 16777216 total]16384K bytes of processor board System flash (Read ONLY)Verifying Memory Image Filenames

Creating a Software Image Backup

Upgrading the Image from the Network

LABInstall TFTP server on a virtual machineConnect the machine to a RouterTo see the content of Flash file#show FlashTo copy flash#Copy flash tftp supply IP address of TFTP Server and file nameTo copy running-configuration#copy running-config tftpsupply IP address of TFTP Server and file name

Resolving Host NamesTo use a hostname rather than an IP address to connect to a remote deviceTwo ways to resolve hostnames to IP addressesbuilding a host table on each routerbuilding a Domain Name System (DNS) server

Resolving Host NamesBuilding a host table ip host host_name ip_addressR1(config)#ip host com1 10.0.0.1R1(config)#ip host com2 10.0.0.2

To view tableR1#show hosts

To verify that the host table resolves names, try ping hostnames at a router prompt.

Password RecoveryNormal Boot SequencePOSTBootstrapIOSStartupRunningThis setup is decided by configuration register value

Configuration RegisterDefault2102BitDecimalThis means that bits 13, 8, and 1 are on.To ignore NVRAM the 6th bit should be made ONWhen the 6th bit is turned on the value will be 2142

Password RecoveryShow version will give configuration register valuePassword is stored in NVRAMTo by pass NVRAM during boot sequence we need to change the configuration register valueTo change the CR values press Ctr+Break and go to ROM monitor mode

Password RecoveryRouter 2500 o/r 0x2142iRouter 2600confreg 0x2142>reset

WAN vs LANDistance between WAN and LANWAN speed is lessWAN is leased from Service provider

Remote Access OverviewA WAN is a data communications network covering a relatively broad geographical area.

A network administrator designing a remote network must weight issues concerning users needs such as bandwidth and cost of the variable available technologies.

WAN OverviewService ProviderWANs connect sitesConnection requirements vary depending on user requirements and cost

WAN technology/terminologyDevices on the subscriber premises are called customer premises equipment (CPE). The subscriber owns the CPE or leases the CPE from the service provider. A copper or fiber cable connects the CPE to the service providers nearest exchange or central office (CO). A central office (CO) is sometimes referred to as a point of presence (POP)This cabling is often called the local loop, or "last-mile".

CPE (Customer Premises Equipment) are equipments located at the customers site, they are owned, operated and managed by the customer.

WAN technology/terminology

A demarcation point is where customer premises equipment (CPE) ends, and local loop begins.The local loop is the cabling from demarcation point to Central Office (CO).

WAN technology/terminologyDevices that put data on the local loop are called data communications equipment (DCE). The customer devices that pass the data to the DCE are called data terminal equipment (DTE). The DCE primarily provides an interface for the DTE into the communication link on the WAN cloud.

The DTE/DCE interface uses various physical layer protocols, such as V.35. These protocols establish the codes and electrical parameters the devices use to communicate with each other.

WAN DevicesModems transmit data over voice-grade telephone lines by modulating and demodulating the signal. The digital signals are superimposed on an analog voice signal that is modulated for transmission. The modulated signal can be heard as a series of whistles by turning on the internal modem speaker. At the receiving end the analog signals are returned to their digital form, or demodulated

WANs - Data Link EncapsulationThe data link layer protocols define how data is encapsulated for transmission to remote sites, and the mechanisms for transferring the resulting frames. A variety of different technologies are used, such as ISDN, Frame Relay or Asynchronous Transfer Mode (ATM). These protocols use the same basic framing mechanism, high-level data link control (HDLC)

WAN Technologies OverviewCovers a relative broad areaUse transmission facilities leased from service providerCarries different traffic (voice, video and data)DedicatedT1, E1, T3, E3DSLSONETAnalogDial-up modemsCable modemsWirelessSwitchedCircuit Switched POTS ISDNPacket Switched X.25 Frame RelayATM

Dedicated Digital ServicesDedicated Digital Services provide full-time connectivity through a point-to-point linkT series in U.S. and E series in EuropeUses time division multiplexing and assign time slots for transmissionsT1 = 1.544 Mbps E1 = 2.048 MbpsT3 = 44.736 MbpsE3 = 34.368 Mbps

Digital Subscriber LinesDigital Subscriber Line (DSL) technology is a broadband technology that uses existing twisted-pair telephone lines to transport high-bandwidth data to service subscribers. The two basic types of DSL technologies are asymmetric (ADSL) and symmetric (SDSL). All forms of DSL service are categorized as ADSL or SDSL and there are several varieties of each type. Asymmetric service provides higher download or downstream bandwidth to the user than upload bandwidth.Symmetric service provides the same capacity in both directions.

Analog ServicesDial-up Modems (switched analog)Standard that can provides 56 kbps download speed and 33.6 kbps upload speed.With the download path, there is a digital-to-analogue conversion at the client side.With the upload path, there is a analogue-to-digital conversion at the client side.

Cable Modems (Shared Analog)Cable TV provides residential premises with a coaxial cable that has a bandwidth of 750MHz The bandwidth is divided into 6 MHz band using FDM for each TV channel A "Cable Modem" is a device that allows high-speed data access (Internet) via cable TV network. A cable modem will typically have two connections because a splitter delivers the TV bands to TV set and the internet access bands to PC via a cable box The splitter delivers the TV bands to TV set and the internet access bands to PC via a cable box

WirelessTerrestrialBandwidths typically in the 11 Mbps range Cost is relatively lowLine-of-sight is usually requiredUsage is moderate

SatelliteCan serve mobile users and remote usersUsage is widespreadCost is very high

Circuit Switched ServicesIntegrated Services Digital Network (ISDN)Historically important--first dial-up digital serviceMax. bandwidth = 128 kbps for BRI (Basic Rate Interface)2 B channels @ 64kps and 1 D channel @ 16kpsB channels are voice/data channels; D for signaling

Integrated Services Digital Network

Asynchronous Transfer Mode (ATM)Communications providers saw a need for a permanent shared network technology that offered very low latency and jitter at much higher bandwidths. ATM has data rates beyond 155 Mbps.ATM is a technology that is capable of transferring voice, video, and data through private and public networks. It is built on a cell-based architecture rather than on a frame-based architecture. ATM cells are always a fixed length of 53 bytes. The 53 byte ATM cell contains a 5 byte ATM header followed by 48 bytes of ATM payload. Small, fixed-length cells are well suited for carrying voice and video traffic because this traffic is intolerant of delay. Video and voice traffic do not have to wait for a larger data packet to be transmitted.The 53 byte ATM cell is less efficient than the bigger frames and packets of Frame RelayA typical ATM line needs almost 20% greater bandwidth than Frame Relay

WAN Connection TypesLeased linesIt is a pre-established WAN communications path from the CPE, through the DCE switch, to the CPE of the remote site, allowing DTE networks to communicate at any time with no setup procedures before transmitting data. Circuit switchingSets up line like a phone call. No data can transfer before the end-to-end connection is established.

WAN Connection TypesPacket switchingWAN switching method that allows you to share bandwidth with other companies to save money. As long as you are not constantly transmitting data and are instead using bursty data transfers, packet switching can save you a lot of money. However, if you have constant data transfers, then you will need to get a leased line. Frame Relay and X.25 are packet switching technologies.

Defining WAN Encapsulation ProtocolsEach WAN connection uses an encapsulation protocol to encapsulate traffic while it crossing the WAN link.

The choice of the encapsulation protocol depends on the underlying WAN technology and the communicating equipment.

Defining WAN Encapsulation ProtocolsTypical WAN encapsulation types include the following:

Point-to-Point Protocol (PPP)Serial Line Internet Protocol (SLIP)High-Level Data Link Control Protocol (HDLC)X.25 / Link Access Procedure Balanced (LAPB)Frame RelayAsynchronous Transfer Mode (ATM)

Determining the WAN Type to UseAvailabilityEach type of service may be available in certain geographical areas.BandwidthDetermining usage over the WAN is important to evaluate the most cost-effective WAN service.CostMaking a compromise between the traffic you need to transfer and the type of service with the available cost that will suit you.

Max. WAN Speeds for WAN Connections

WAN TypeMaximum Speed Asynchronous Dial-Up56-64 KbpsX.25, ISDN BRI128 KbpsISDN PRI E1 / T1Leased Line / Frame RelayE3/T3

Leased LineCircuit-switchedPPP, SLIP, HDLCHDLC, PPP, SLIPPacket-switchedX.25, Frame Relay, ATMTypical WAN Encapsulation Protocols: Layer 2TelephoneCompanyServiceProvider

WAN ProtocolsPoint to Point - HDLC, PPPMultipoint- Frame Relay, X.25 and ATME0S0S0WANLANNetworkDatalinkPhysicalHDLC Proprietary cisco device default

PPP - Open

FlagAddressControlDataFCSFlagHDLCSupports only single protocol environments FlagAddressControlProprietaryDataFCSFlagCisco HDLCHDLC Frame FormatCiscos HDLC has a proprietary data field to support multiprotocol environments

HDLC CommandRouter(config-if)#encapsulation hdlcEnable hdlc encapsulationHDLC is the default encapsulation on synchronous serial interfaces

PPP EncapsulationPPP is open standardHDLC is only for encapsulationPPP provides encapsulation and authenticationPPP is made up of LCP and NCPLCP is for link control and NCP for multiple protocol support and call back Link setup and control using LCP in PPP An Overview of PPP

Feature How It OperatesProtocolAuthenticationPAPCHAPPerform Challenge HandshakeRequire a password CompressionCompress data at source; reproduce data at destinationError DetectionAvoid frame loopingMonitor data dropped on linkMultilinkLoad balancing across multiple linksMultilink Protocol (MP)PPP LCP Configuration Options

PPP Authentication OverviewTwo PPP authentication protocols: PAP and CHAP

PPP Session Establishment 1Link Establishment Phase2Optional Authentication Phase 3 Network-Layer Protocol PhaseDialup or Circuit-Switched Network

Passwords sent in clear textSelecting a PPP Authentication ProtocolRemote Router(SantaCruz)Central-Site Router (HQ)Hostname: santacruzPassword: boardwalk username santacruzpassword boardwalk PAP 2-Way Handshakesantacruz, boardwalkAccept/Reject

Selecting a PPP Authentication Protocol (cont.)Remote Router(SantaCruz)Central-Site Router (HQ)Hostname: santacruzPassword: boardwalk username santacruzpassword boardwalk CHAP3-Way HandshakeChallengeResponseAccept/RejectUse secret known only to authenticator and peer

Configuring PPP and Authentication OverviewService ProviderVerify who you are.Router to Be Authenticated(The router that initiated the call.) ppp encapsulation hostname username / password ppp authenticationAuthenticating Router(The router that received the call.)

ppp encapsulation hostname username / password ppp authenticationEnabling PPPEnabling PPP AuthenticationEnabling PPPEnabling PPP Authentication

Configuring PPPRouter(config-if)#encapsulation pppEnable PPP encapsulation

Configuring PPP AuthenticationRouter(config)#hostname nameAssigns a host name to your routerRouter(config)#username name password passwordIdentifies the username and password of authenticating router

Configuring PPP Authentication(cont.)Router(config-if)#ppp authentication {chap | chap pap | pap chap | pap}Enables PAP and/or CHAP authentication

Configuring CHAP Examplehostname R1username R2 password cisco!int serial 0 ip address 10.0.1.1 255.255.255.0 encapsulation ppp ppp authentication CHAP

hostname R2username R1 password cisco!int serial 0 ip address 10.0.1.2 255.255.255.0 encapsulation ppp ppp authentication CHAP

R1R2PSTN/ISDN

Verifying HDLC and PPP Encapsulation ConfigurationRouter#show interface s0Serial0 is up, line protocol is up Hardware is HD64570 Internet address is 10.140.1.2/24 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, rely 255/255, load 1/255 Encapsulation PPP, loopback not set, keepalive set (10 sec) LCP Open Open: IPCP, CDPCP Last input 00:00:05, output 00:00:05, output hang never Last clearing of "show interface" counters never Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 0/75, 0 drops 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 38021 packets input, 5656110 bytes, 0 no buffer Received 23488 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 38097 packets output, 2135697 bytes, 0 underruns 0 output errors, 0 collisions, 6045 interface resets 0 output buffer failures, 0 output buffers swapped out 482 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

Verifying PPP Authentication with the debug ppp authentication Command

4d20h: %LINK-3-UPDOWN: Interface Serial0, changed state to up4d20h: Se0 PPP: Treating connection as a dedicated line4d20h: Se0 PPP: Phase is AUTHENTICATING, by both4d20h: Se0 CHAP: O CHALLENGE id 2 len 28 from left"4d20h: Se0 CHAP: I CHALLENGE id 3 len 28 from right"4d20h: Se0 CHAP: O RESPONSE id 3 len 28 from left"4d20h: Se0 CHAP: I RESPONSE id 2 len 28 from right"4d20h: Se0 CHAP: O SUCCESS id 2 len 44d20h: Se0 CHAP: I SUCCESS id 3 len 44d20h: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to up

debug ppp authentication successful CHAP outputR1R2Service Providerdebug ppp authentication

What is ISDN?Provider networkDigital PBXSmall officeHome office Voice, data, videoTelecommuterCentral site

Why ISDN?ISDN - Integrated Services Digital NetworkTelephone services -> Telecommunication servicesUsed for voice, data and video

BRI and PRI are used globally for ISDNChannel Mostly Used forBCircuit-switched data (HDLC, PPP)Capacity64 kbpsD2BISDN Access OptionsSignaling informationD16/64 kbps23 or 30BBRIPRID

Advantages of ISDN (2)Bandwidth on Demandadding new channels to the bundle of channels Multiple devicesphone, fax, PC, videoconferencing system, router

Interfaces and DevicesTE1TE2TANT12W4WISDN ReadyBRI PortAnalog devices:phone, Serial portAfter connecting to TA it becomes TE1S/T interfaceU interfaceISDN Switch

Interfaces and DevicesFunction Group A set of functions implemented by a device or softwareReference Point The interface between two function group

Reference Points

LAB-ISDNE0Router(config)#hostname R1R1(config)#username R2 password ciscoR1(config-if)#int bri 0 R1(config-if)# ip address 10.0.0.1 255.0.0.0R1(config-if)#enacapsulation pppR1(config-if)#PPP authentication CHAPR1(config-if)#no shutStatic Routes or default routeR1(config)#ip route 0.0.0.0 0.0.0.0 10.0.0.2R1(config)#isdn switch-type basic-net3Access ListR1(config)#dialer-list 1 protocol ip permitR1(config)#int bri 0R1(config-if)# dialergroup 1 R1(config-if)#dialer map ip 10.0.0.2 name R2 20R1(config-if)#no shutR1(config-if)#dialer idle-timeout 100

ISDN DDR configuration Commands

CommandDescriptioniprouteGlobal command that configure static route or default routeusername name name password secretGlobal command that configure CHAP username and passwordaccess-listGlobal command that creates ACLs to define a subset of traffic as interestingdialer-list 1 protocol IPGlobal command that creates a dialer list that makes all IP traffic interesting or reference to ACL for subset dialergroup 1Interface subcommand that references dialer list to define what is interestingdialer idle-timeout 100Interface subcommand that settles idle time out valuesdialer string numberInterface subcommand that define dial numbersint bri 0Global command that selects BRI interface

Packet Switched ServicesX.25 (Connection-oriented)Reliable--X.25 has been extensively debugged and is now very stable--literally no errors in modern X.25 networksStore & Forward--Since X.25 stores the whole frame to error check it before forwarding it on to the destination, it has an inherent delay (unlike Frame Relay) and requires large, expensive memory buffering capabilities.

Frame Relay (Connectionless)More efficient and much faster than X.25Used mostly to forward LAN IP packets

Frame Relay BasicsFR is WAN layer2 protocolFR developed in 1984, its a faster packet switching technologyIn 1990 FR consortium was developed and extension added

TerminologyFrame Relay NetworkR2R1End DeviceInterface DeviceEncapsulate DataFR NetworkDCE Dedicated FR Switches, can be one or multipleAccess LineTrunk LineVirtual Circuit an end to end connection between interface device - PVC or SVCData Link connection Identifiers (DLCI) number is the identification for VC, 16-1007Committed Information Rate or CIR - agreed-upon bandwidthFrame Relay there are two encapsulation types: Cisco and IETFLocal Management Interface (LMI) is a signaling standard used between your router and the first Frame Relay switch i - Cisco, ANSI, and Q.933A.

Frame RelayFrame Relay differs from X.25 in several aspects. Much simpler protocol that works at the data link layer, not the network layer. Frame Relay implements no error or flow control. The simplified handling of frames leads to reduced latency, and measures taken to avoid frame build-up at intermediate switches help reduce jitter.Most Frame Relay connections are PVCs rather than SVCs. Frame Relay provides permanent shared medium bandwidth connectivity that carries both voice and data traffic.

LAB - Frame Relay192.168.1.2/24192.168.2.2/24R2FR SwitchS0192.168.2.1/24R1E0S0192.168.1.1/24192.168.3.9/29E0100200192.168.3.10/29DCEDCEFrame Relay SwitchRouter#config tRouter(config)#hostname FRSwitchFRSwitch(config)# frame-relay switchingFRSwitch(config)# int s 1/0FRSwitch(config-if)#enacapsulation frame-relayFRSwitch(config-if)# frame-relay intf-type DCEFRSwitch(config-if)# clock rate 64000FRSwitch(config-if)# frame-relay route 100 int serial 1/1 200FRSwitch(config-if)#no shutR1Router#config tRouter(config)#hostname R1R1(config)# int s 0R1(config-if)#ip address 192.168.3.9 255.255.255.248R1(config-if)#enacapsulation frame-relayR1(config-if)# frame-relay intf-type DTER1(config-if)# frame-relay interface-dlci 100 R1(config-if-dlci)# exit R1(config-if)#framerelay map ip 192.168.3.10 100R1(config-if)#no shut

*DV- the router D will tell C that I know network X, and C will tell B that I know network X and so on, route A does not know anything beyond its neighbor, so its routing by tumor. This also uses periodic update, it also sends the entire routing table, these protocls are based in the early days of internet and some of them are class based.Link state gives much more information, here the link is defined with its interface, IP address, Mask, the type of network its on and its neighbors SO Router A will tell My IP. This information is passed to router to router and maintain two databases.The topology table is important and its because of topology table the robustness comes. The topology table contains Link state advertisements and the router knows the network topology, any network fails the convergence is faster.

*DV will send entire routing table will waste the bandwidth. Link states exchange updates about only Link statesSuitable for very large networks******Draw diagram to explain router ID**If the two routers are the only routers on the network, an adjacency should form. If there are more than two routers on the network, adjacencies only form with the designated router (DR) and backup designated router (BDR). If the two routers have already formed adjacencies with the DR and the BDR, they cannot form adjacencies with each other *Backbone Router: Has an interface connected to the backbone (Area 0). Area Border Router (ABR): Has interfaces in multiple areas with at lest one interface in area 0. Connects other areas to the backbone and maintains routing information for each connected area. Autonomous System Boundary Router (ASBR): Router located between OSPF autonomous system and a non-OSPF network. Used to redistribute routing information between networks. Must reside in a non-stub area. *OSPF routers and links are grouped logically into areas that are identified by assigned numbers. All OSPF networks have at least one area with the default being area 0. If more than one area exists, area 0 is defined as the backbone area and is used to connect all other areas. Each area has its own link state databases. **Area 0 should not have more than 30 routers*******In order to ensure that a router will become the OSPF DR for any given segment, there are a number of options. One way is to manually configure the interface priority as described in option A above using the "ip ospf priority" interface configuration command. The second method is described in option C. OSPF routers will always use the loopback interface IP address as the router ID, when configured, and the router with the highest IPaddress will be chosen as the DR when the priorities are the same. The final method is to change the priority of the other routers in the segment to zero. When the OSPF priority is set to 0, the router is ineligible to become the DR or the BDR. Important Note: The OSPF DR/BDR election process is not pre-emptive, so any changes to the network regarding the DR/BDR election process will only occur when the routers are restarted.***When the OSPF process starts, the Cisco IOS uses the highest local active IP address asits OSPF router ID. If there is no active interface, the OSPF process will not start. If theactive interface goes down, the OSPF process has no router ID and therefore ceases tofunction until the interface comes up again.

***EIGRP scales the metric of IGRP by a factor of 256. That is because EIGRP uses a metric that is 32 bits long, and IGRP uses a 24-bit metric. EIGRP can multiply or divide by 256 to easily exchange information with IGRP

*Purpose: The figure introduces the IGRP routing protocol. IGRP is a sophisticated distance vector routing protocol.Emphasize: The Interior Gateway Routing Protocol (IGRP) is a dynamic distance-vector routing protocol designed by Cisco in the mid-1980s for routing in an autonomous system that contains large, arbitrarily complex networks with diverse bandwidth and delay characteristics. Historically, IGRP became one of the success factors for the early Cisco IOS software capabilities because of its superiority to RIP version 1.The important IGRP characteristics are as follows:More scalability than RIP Fast response to network changesSophisticated metricMultiple-path support

*EIGRP MetricsAnother really sweet thing about EIGRP is that unlike many other protocols that use a singlefactor to compare routes and select the best possible path, EIGRP can use a combination of four:

Bandwidth

Delay

Load

Reliability**EIGRP routers that belong to different autonomous systems (ASes) dont automatically share routing information and they dont become neighbors. This behavior can be a real benefit when used in larger networks to reduce the amount of route information propagated through a specific AS. The only catch is that you might have to take care of redistribution between the different ASes manually.The only time EIGRP advertises its entire routing table is when it discovers a new neighbor and forms an adjacency with it through the exchange of Hello packets. When this happens, both neighbors advertise their entire routing tables to one another. After each has learned its neighbors routes, only changes to the routing table are propagated from then on.When EIGRP routers receive their neighbors updates, they store them in a local topology table. This table contains all known routes from all known neighbors, and serves as the raw material from which the best routes are selected and placed into the routing table.

EIGRP routers keep route and topology information readily available in RAM, so they can react quickly to changes.

Like OSPF, EIGRP saves this information in several tables and databases.

*Route source - The identification number of the router that originally advertised that route. This field is populated only for routes learned externally from the EIGRP network.

*Reliable Transport ProtocolThe EIGRP transport mechanism uses a mix of multicast and unicast packets, using reliable delivery when necessary. All transmissions use IP with the protocol type field set to 88. The IP multicast address used is 224.0.0.10. DUAL requires guaranteed and sequenced delivery for some transmissions. This is achieved using acknowledgments and sequence numbers. So, for example, update packets (containing routing table data) are delivered reliably (with sequence numbers) to all neighbors using multicast. Acknowledgment packets--with the correct sequence number--are expected from every neighbor. If the correct acknowledgment number is not received from a neighbor, the update is retransmitted as a unicast. The sequence number (seq num) in the last packet from the neighbor is recorded to ensure that packets are received in sequence. The number of packets in the queue that might need retransmission is shown as a queue count (QCnt), and the smoothed round trip time (SRTT) is used to estimate how long to wait before retransmitting to the neighbor. The retransmission timeout (RTO) is the time the router will wait for an acknowledgment before retransmitting the packet in the queue. Some transmissions do not require reliable delivery. For example, hello packets are multicast to all neighbors on an Ethernet segment, whereas acknowledgments are unicast. Neither hellos nor acknowledgments are sent reliably. EIGRP also uses queries and replies as part of DUAL. Queries are multicast or unicast using reliable delivery, whereas replies are always reliably unicast. Query and reply packets are discussed in more detail in the next section. *All route computations in EIGRP are handled by DUAL. One of DUAL's tasks is maintaining a table of loop-free paths to every destination. This table is referred to as the topology table. Unlike traditional DV protocols that save only the best (least-cost) path for every destination, DUAL saves all paths in the topology table. The least-cost path(s) is copied from the topology table to the routing table. In the event of a failure, the topology table allows for very quick convergence if another loop-free path is available. If a loop-free path is not found in the topology table, a route recomputation must occur, during which DUAL queries its neighbors, who, in turn, may query their neighbors, and so on... hence the name "Diffusing" Update Algorithm. *Slide 1 of 2Purpose: This figure explains how to use the router igrp and network commands to configure an IGRP process.Emphasize: Note that the AS keyword is required for IGRP.You can use multiple network commands to specify all networks that are to participate in the IGRP process. Only those networks specified will be published to other routers.

*Purpose: The figure shows how the IGRP commands operate on the example network.Emphasize: An administrator only specifies directly connected networks that should be published to other routers.Without the network command, nothing is advertised. With a network command, the router will advertise every subnet within the Class A, B, or C network specified in the configuration.*# Show users will show connected users# Clear line 1 will disconnect the session on line 1

*Purpose: This chapter introduces the Cisco IOS CLI on the Catalyst 1900 switch and router. Timing: This chapter should take about 2 hours to present.Note: The Catalyst 1900 switch only has a subset of the router Cisco IOS commands available.Contents: Introduction to Cisco IOS. Explain to the student what is IOS?Cisco Device startup procedures in general. IOS configuration source.General introduction to the IOS CLI.Cat 1900 switch startup procedures.Intro to Cat 1900 CLI. This part covers the basic configuration on the switch, like setting the IP address and hostname. More details about the various Cat 1900 switch configuration commands are explained in Chapter 6 and 7. Router startup procedures. More details on the router startup process is discussed in chapter 5. Router IOS CLI.* Note: CDP is sent using multicast frames with the MAC address 0100.0ccc.cccc.CDP is a Cisco proprietary data link layer protocol that operates over any medium that supports the Subnetwork Access Protocol (SNAP) encapsulation (LANs, most WANs, and ATM). It is important to understand that because CDP operates at Layer 2 (data link layer of the OSI model), it functions independently of the Layer 3 (network) protocol (IP or IPX). CDP is on by default, but it can be disabled. In many cases, CDP is disabled on dial backup links, such as ISDN, so as to not keep the link up constantly.

CDP One dependency, the media type at the physical layer must support SNAP. SNAP was created because all protocols does not work well for 802.3 Ethernet frame as 802.3 had no type filed any longer. The original Ethernet had type filed, But the 802.3 had replaced this with length field, so When we bring SNAP at layer 2 it brings back type field. Frame relay, Ethernet, ATM, Token ring all support SNAP*Device ID. The hostname of the neighboring deviceLocal Interface. The interface on which this router received information about the neighboring device. Holdtime. The amount of time the router will store this information before dropping it from memory, if additional CDP packets are not received. Capability. The type of device that announced itself using CDP.Platform. The hardware platform of the neighboring equipment.Port ID. The port from which the CDP packet was sent on the neighboring device.

Emphasize: CDP is media- and protocol-independent and runs on all Cisco-manufactured equipment including routers, access servers, switches, and some managed hubs. With CDP, network management applications can retrieve the device type and SNMP agent address of neighboring devices. This capability enables applications to send SNMP queries to neighboring devices. CDP allows network management applications to dynamically discover Cisco devices that are neighbors. CDP runs on all media that support the Subnetwork Access Protocol, including LAN and Frame Relay. CDP runs over the data link layer only, not the network layer. Therefore, two systems that support different network-layer protocols can learn about each other.Cached CDP information is available to network management applications. Cisco devices never forward a CDP packet. When new information is received, old information is discarded. The holdtime determines how long to keep existing information from a neighbor.

*Note: Some of the CDP commands are not available on the Catalyst 1900 switch, like cdp run, show cdp traffic, and show cdp entry.

Its important to remember that CDP packets arent passed through a Ciscoswitch, and that you see only whats directly attached. So this means that if your router is connected to a switch, you wont see any of the devices hooked up to that switch.*Emphasize: This graphic shows the show cdp neighbors command initiated from a router, which displays a summary of the capabilities and access details for the CDP neighbors. The show cdp neighbors detail command shows detailed information about the same devices. Note: If the neighbor is a Catalyst 1900 switch, the switch MAC address is also displayed. If the switch is a 2900xl, its MAC address is not displayed.Device ID. The hostname of the neighboring deviceLocal Interface. The interface on which this router received information about the neighboring device. Holdtime. The amount of time the router will store this information before dropping it from memory, if additional CDP packets are not received. Capability. The neighbors capability, such as router, switch, or repeater. The capability codes are listed at the top of the command output.Platform. The hardware platform of the neighboring equipment.(Cisco 2509, Cisco 2511, andCatalyst 5000)Port ID. The port from which the CDP packet was sent on the neighboring device.

*Emphasize: The example shows what information can be obtained about RouterAs neighbor. CDP is one way to learn about other Cisco devices on the network.

*Note: The holdtime indicates how long the neighbor information will be kept in the local CDP table. *181-37*Purpose: This slide discuss the initial configurations on the routers and switches. Note: There is no setup mode on the Catalyst 1900 switch. *Layer 2 of 2Emphasize: An access list is a mechanism for identifying particular traffic. One application of an access list is for filtering traffic into or out of a router interface.

*Permission for routerManage IP TrafficFilter packet which pas thruEither can permit or Deny*If u want to permit only one from a network then permit shud be first*Layer 3 of 3Purpose: Describe an inbound versus outbound access list on an interface.*Layer 3 of 3Emphasize: Layer 3Adds the Novell IPX access lists covered in Chapter 11, Configuring Novell IPX, and the number ranges for these types of access lists. As of Release 11.2.4(F), IPX also supports named access lists.Point out that number ranges generally allow 100 different access lists per type of protocol. When a given hundred-number range designates a standard access list, the rule is that the next hundred-number range is for extended access lists for that protocol. Exceptions to the numbering classification scheme include AppleTalk and DECnet, where the same number range can identify various access list types. For the most part, number ranges do not overlap between different protocols. Note: With Cisco IOS 12.0, the IP access-lists range has been expanded to also include: IP standard access list (expanded range) IP extended access list (expanded range) *Purpose: This graphic gives an overview of the type of TCP/IP packet tests that standard access lists can filter. It uses the encapsulation graphic and diamond decision graphic to remind students of material presented earlier in this course.

*Layer 3 of 3Purpose: Shows a deny result of the access list test. Emphasize: Now the packet is discarded into the packet discard bucket. The unwanted packet has been denied access to the outbound interface. The Notify Sender message shows a process like ICMP, returning an administratively prohibited message back to the sender.

*Explain how the access list process, here there are three ACLS. Can give the example with a host IP address 192.168.1.1 and host 192.168.1.2 what happens on all the three ACLS***Purpose: This graphic gives an overview of the type of TCP/IP packet tests that extended access lists can filter. It uses the encapsulation graphic and diamond decision graphic to remind students of material presented earlier in this course.

**Named access lists allow you to use names to both create and apply either standard orextended access lists. There is nothing new or different about these access lists aside from beingable to refer to them in a way that makes sense to humans.

**Emphasize: In Cisco IOS Release 12.0, there are new copy commands. These new commands treat the RAM, Flash, NVRAM, TFTP, FTP, and so on as a file system. Since this class was developed when the most common Cisco IOS in the field is pre-12.0, these 12.0 commands are not covered in detail in this class. *Emphasize: This section introduces topics on managing your configuration file and Cisco IOS image.*Emphasize: The show flash command is an important tool to use to gather information about your router memory and image file. Caution students that they must know that they are loading the correct and appropriate image. The name for the Cisco IOS image file contains multiple parts, each with a specific meaning:The first part of the image name contains the platform on which the image runs. In this example, the platform is C2500.The second part of the name identifies the special capabilities of the image file. A letter or series of letters identifies the feature sets supported in that image. In this example, the j indicates this is an enterprise image, and the s indicates it contains extended capabilities.The third part of the name specifies where the image runs and if the file is compressed. In this example, l indicates the file is relocatable and not compressed. Relocatable means the Cisco IOS can be run from Flash or from RAM. You should be careful in reading the Cisco IOS image filename. Some fonts display the lowercase letter l and the number 1 as the same character. How you enter the characters will impact the ability of the router to load the files correctly. The fourth part of the name indicates the version number. In this example, the version number is 12.0 (3).The final part of the name is the file extension. The .bin extension indicates this file is a binary executable file. The Cisco IOS software naming conventions, name part field meaning, image content, and other details are subject to change. Refer to Cisco Connection Online (CCO) for updated details.*Purpose: This slide discusses how to create a backup version of a Cisco IOS software image to a TFTP server. Emphasize: Routers by default come with Flash memory that has a preloaded copy of the Cisco IOS software. Although Flash is extremely reliablegood for 65 years and 100,000 rewritesit is a good idea to make a backup copy of the Cisco IOS software if you have a TFTP server available. If you have to replace Flash memory for some reason, you will have a backup copy at the revision level currently running on your network.The copy command screen output varies depending on the Cisco IOS software level.Determine the platform type of your TFTP server prior to beginning the backup procedure. The TFTP server may be running Windows, UNIX, Mac, or other OS. Filename and directory access procedures may vary depending on the TFTP server platform and platform version. *Purpose: This slide describes how to load a backup version of a Cisco IOS software image from a TFTP server to the router. Emphasize: If you need more Flash space to load a copy of the Cisco IOS software, you must first erase the Flash memory. You cannot erase a single imageyou must erase all copies of Cisco IOS software from Flash. However, if Flash memory on the router is partitioned, you can erase one or more of the parts.After the TFTP transfer is completed, use the show flash command to view the file size to compare its size with that of the original on the server.If the Cisco IOS is running from Flash, then the Flash is in the read-only state. To change the Flash to a writeable state, you can use the boot system TFTP command to boot a Cisco IOS from a TFTP server and the Cisco IOS will be run from RAM, or you can go to the Rxboot mode to perform the copy.

*To change the register back -- R1(config)#config-register 0x2102*Purpose: This figure introduces students to WAN connections.Emphasize: Highlight the interconnected WAN connections between the various company sites. The site graphically present a mobile dial-up user, a telecommuter using a DDR connection, and two office sites with multiple connections.This course teaches students how to configure a WAN. Tell students a WAN is a data communications network that serves users across a broad geographic area.Transition: Following are the various physical connections that will connect these sites.*CPE, which is usually a connection to a CSU/DSU or ISDN interface.

*A dialed call is connected locally to other local loops, or non-locally through a trunk to a primary center. It then goes to a sectional center and on to a regional or international carrier center as the call travels to its destination.**E3/T3 34 Mbps or 45 Mbps *Purpose: This figure introduces students to various encapsulation options to use over the various physical connections.Emphasize: In order to exchange traffic over a WAN link, the packets must be encapsulated into a Layer 2 frame. There are a variety of Layer 2 encapsulation types available that can be used, depending on the WAN connection being used. Some of the types are listed on the figure.Encapsulation must be configured on the router when configuring the interface. Some of these encapsulation types will be seen again in the following chapters.In an ISDN environment, Point-to-Point (PPP) is the B channels Layer 2 encapsulation. Link Access Procedure on the D channel (LAPD) is the encapsulation for the D channel.Either the proprietary Cisco or Internet Engineering Task Force (IETF) (defined in RFC 1490) encapsulations are the Layer 2 encapsulations for Frame Relay.Note: Other encapsulations not shown include AppleTalk Remote Access Protocol (ARAP), Compressed Serial Link Internet Protocol (CSLIP), or Synchronous Data Link control (SDLC).Transition: We will first look at the HDLC encapsulation.*Purpose: This figure introduces students to HDLC encapsulation.Emphasize: HDLC is the default layer 2 protocol for Cisco router serial interfaces. Ciscos proprietary enhancement to HDLC incorporates a protocol or type field to allow multiple protocols to be carried on a single link*Purpose: This figure describes how to configure HDLC on a serial connection.Emphasize: encapsulation hdlc is the default encapsulation on a Cisco routers serial connection.Transition: If the network consists of Cisco and non-Cisco devices, you should PPP instead of HDLC.

*Purpose: This figure presents an overview of PPP.Emphasize: The figure illustrates the multiple protocols NCP supports.The two arrows pointing to the router interfaces is where PPP encapsulation occurs. The first bullet summarizes the role of NCP. The second bullet summarizes the role of LCP options that the administrator can use to set up and control the data link.Several RFCs are used to specify aspects of PPP. RFC 1548 is the major specification for the major PPP NCP and LCP operations.

*Purpose: The figure presents an overview of the most popular PPP features.Emphasize: The table in the figure lists and describes the various LCP options. PPP compression is offered in Ciscos Compression Control Protocol (CCP). RFC 1548 covers the Internet Engineering Task Force (IETF) approved PPP options in detail. RFC 1717 defines Multilink Protocol. RFC 1990, The PPP Multilink Protocol (MP), obsoletes RFC 1717.Note: To further enhance security, Cisco IOS Release 11.1 offers callback over PPP. With this LCP option, a Cisco router can act as a callback client or as a callback server. The client makes the initial DDR call requests that it be called back, and terminates its initial call. The callback server answers the initial call and makes the return call to the client based on its configuration statements. This option is described in RFC 1570.Reference: Students will only learn how to configure PAP and CHAP authentication in this course. To learn how to configure the other LCP options, students should attend the Building Cisco Remote Access (BCRAN) course.

*Purpose: This graphic presents the PPP authentication overview.Emphasize: A PPP session establishment has three phases:Link establishment phaseIn this phase, each PPP device sends LCP packets to configure and test the data link. Authentication phase (optional)After the link has been established and the authentication protocol decided on, the peer may be authenticated. PPP supports two authentication protocols: PAP and CHAP. Both of these protocols are detailed in RFC 1334, PPP Authentication Protocols. However, RFC 1994, PPP Challenge Handshake Authentication Protocol, obsoletes RFC 1334. Network-layer protocol phaseIn this phase, the PPP devices send NCP packets to choose and configure one or more network-layer protocol. *Purpose: This figure presents the PPP authentication protocol, PAP.Emphasize: PPP sets line controls for the call. There are two types of authentication protocols: PAP and CHAP. PAP provides a simple method for a remote node to establish its identity using a two-way handshake. PAP is done only upon initial link establishment.PAP is not a strong authentication protocol. It provides no encryption. It may be fine in DDR environments when the password changes each time one authenticates.CHAP is the preferred protocol.*Purpose: This figure presents the PPP authentication protocol, CHAP.Emphasize: CHAP is done upon initial link establishment and can be repeated any time after the link has been established.CHAP transactions occur only when a link is established. The local access server does not request a password during the rest of the session. (The local access server can, however, respond to such requests from other devices during a session.) CHAP is specified in RFC 1334. It is an additional authentication phase of the PPP Link Control Protocol.Transition: Now that you know how PPP and PPP authentication operates, the following section describes how to configure it on an IOS router.

*Purpose: This figure provides a sign post highlighting the tasks to complete to enable PPP and PPP authentication.Emphasize: Highlight the steps the student must take to enable PPP authentication.*Purpose: This figure describes how to encapsulate PPP on an interface.

*Purpose: This figure describes how to set the hostname on the local device and a remote devices username and password. Emphasize: Correct configuration is essential since PAP and CHAP will use these parameters to authenticate. The names and password are case sensitive.

*Purpose: This figure continues with the PPP authentication configuration commands.Emphasize: If both PAP and CHAP are enabled, then the first method specified will be requested during link negotiation. If the peer suggests using the second method or simply refuses the first method, then the second method will be tried.

*Purpose: This page shows an example of CHAP configuration between two routers.Emphasize: When you configure the usernames and passwords for the local databases, the passwords on both systems must be identical. Usernames and passwords are case sensitive.Transition: The next section shows how to verify that the connection is operating as intended.

*Purpose: This graphic presents the show interface command, which is used to verify that PPP encapsulation is configured on the interface. The same command is used to verify proper HDLC configuration.

*Purpose: This page shows an example of debug ppp authentication output. The output illustrates of a successful CHAP authentication challenge. Emphasize: The debug ppp authentication command displays the authentication exchange sequence as it occurs.

*Purpose: this figure describes various ISDN environments.Emphasize: The icons in the cloud represent ISDN switches. The figure displays different sites that may use ISDN.*used for studo quality sound and moving images*Purpose: The figure explains BRI and PRI.Emphasize: Be aware of geographic variations regarding ISDN services. With PRI, for example, there are 23 B channels in the United States and Japan and 30 in Europe.Highlight that LAPD is the data link protocol on the D channel and PPP is typically seen on the B channels.

***1) TWO ROUTERs WHICH SUPPORTS BRI2) ISDN Switch3) R1, BRI should be connected to 20 line of ISDN switch4) ISDN status can give the call establishing

*dialer map command is used to associate an ISDN phone numberwith the next hop router address.

ping and telnet Great IP tools for any network. However, your interesting traffic restrictionmust dictate that Ping and Telnet are acceptable as interesting trafficin order to bring up a link. Once a link is up, you can ping or telnet toyour remote router regardless of your interesting traffic lists.show dialer Gives good diagnostic information about your dialer and shows thenumber of times the dialer string has been reached, the idle-timeout valuesof each B channel, the length of the call, and the name of the routerto which the interface is connected.show isdn active Shows the number called and whether a call is in progress.show isdn status

*frame-relay lmi-type