EIGRP routing protocol: Pros and Cons
In medium to large-sized networks consisted of many remote sites with long distance places linked together using router, communication between sites can take place using routing protocols run on each routers. Cisco routers play main role in communication between remote sites that happens, and for the same Cisco routers the dynamic routing protocols used is typically the EIGRP Protocol.
Routing protocols learn routes – the current best routes – and put those subnets in the IP routing table which is typically accomplished by using the distance vector protocol. Distance vector protocols were designed to advertise just the basic routing information across the network to save bandwidth, and take only little processing and memory. Besides distance vector protocol, couple of routing protocols i.e. link-state and balanced hybrid routing protocols can also be used. EIGRP protocol is Cisco proprietary balanced hybrid types routing protocol which converges very fast compared to other routing protocols. Unfortunately this protocol can only work in Cisco routers.
Link-state and balanced hybrid protocols such as EIGRP protocol and OSPF were designed under the assumptions of faster links and more processing power in the routers, but they can gain some important advantages over distance vector protocols – mainly, faster convergence.
Protocol Concept
Besides support two distance vector IP routing protocols—RIP and IGRP, Cisco routers support two link-state IP routing protocols – OSPF and Intermediate System-to-Intermediate System (IS-IS). Furthermore, Cisco supports a single balanced hybrid IP routing protocol – EIGRP protocol. Why Cisco uses balanced hybrids? Because EIGRP has some features that act like distance vector protocols and some that act like link-state protocols.
The following figure shows the typical sequence used by two EIGRP protocol routers that connect to the same subnet. They discover each other as neighbors, and they reliably exchange full routing information. The process is different from OSPF, but the same goal of reliably ensuring that all neighbors receive all routing information is achieved. EIGRP protocol sends and receives EIGRP hello packets to ensure that the neighbor is still up and working (find more)– like OSPF, but with a different Hello packet than OSPF. When link status changes or new subnets are discovered, reliable routing updates are sent, but only with the new information—again, like OSPF.
IGRP and EIGRP protocol have the same formula based bandwidth and delay to calculate the metric associated with a route but EIGRP multiply the number by 256 to accommodate calculations when very high bandwidth values are used.
EIGRP Protocol Loop Avoidance
Most dynamic protocols have the same difficult problem, the loop avoidance. Unlike link-state protocols which have each router keep a full topology of the network to avoid the loop, EIGRP protocol avoids loops by keeping some basic topological information but not full information.
EIGRP protocol runs a simple algorithm to identify which routes could be used immediately after a route failure, without causing a loop. EIGRP then keeps these loop-free backup routes in its topology table and uses them if the currently best route fails.To learn more visit point out website and inform yourself about routing technologies.
EIGRP protocol builds a topology table that includes the currently-best route plus the alternative routes that would not cause loops if they were used. EIGRP calls the best route (the route with the lowest metric) the successor. Any backup routes that could be used without causing a loop are called feasible successors.
EIGRP decides if a route can be a feasible successor if the computed metric for that route on the neighbor is less than its own computed metric.When a route fails and the route has no feasible successor, EIGRP uses a distributed algorithm called Diffusing Update Algorithm (DUAL). DUAL sends queries looking for a loop-free route to the subnet in question. When the new route is found, DUAL adds it to the routing table.
Pros:
EIGRP protocol converges much more quickly than do distance vector protocols, mainly because EIGRP does not need the loop-avoidance features that slow down distance vector convergence.
EIGRP takes less memory and processing than link-state protocols.
Cons:
EIGRP protocol is Cisco proprietary protocols which can only work on Cisco routers. If you have multiple vendor routers within the site, use OSPF instead.
[CCNA/CCNP Certs] Etherchannels And Spanning Tree Protocol (STP)
Cisco CCNA certification looks great on your resume, and it also teaches you vital real-world networking skills. One exam topic that you'll definitely see in today's networks is the configuration of an Etherchannel on a Cisco router. You need to know how to build and verify one - so let's build one right now!
In this Cisco training tutorial, we'll use two switches that are connected at ports 0/11 and 0/12 via crossover cables. SW1 is the root bridge, SW2 is the non-root bridge. Even though there are two separate physical connections, spanning tree protocol (STP) will only allow the use of one, as verified by the partial output of "show spanning vlan 1" on SW2.
Fa0/11 Root FWD 19 128.11 P2p
Fa0/12 Altn BLK 19 128.12 P2p
It's a waste of network resources not to use that second physical path. Additionally, there's going to be a delay in cutting over from 0/11 to 0/12 if the forwarding path goes down for some reason. We can get around both of these issues by creating an Etherchannel. An Etherchannel is a logical bundling of physical paths into one logical path. By configuring an Etherchannel on both 0/11 and 0/12, we will be left with one logical connection that will actually use the full capacity of both physical connections!
SW1(config)#int fast 0/11
SW1(config-if)#channel-group 1 mode on
Creating a port-channel interface Port-channel 1
The channel-group command must be configured on each physical interface that we want to place into the Etherchannel, so we'll have to configure it on ports 0/11 and 0/12 on both SW1 and SW2. Naturally, the group number used must match among all ports placed into the Etherchannel
Did you notice the router message "creating a port-channel interface port-channel 1"? You can verify the creation of that virtual interface just as you would a physical interface:
SW1#show int port-channel 1
Port-channel1 is up, line protocol is up (connected)
Hardware is EtherChannel, address is 000f.90e1.c24b (bia 000f.90e1.c24b)
Note the readout "Hardware is EtherChannel". Also, where we once saw two physical ports when we ran "show spanning vlan 1", we now see only one - the port-channel. Also note that where the individual ports had a port cost of 19, the Etherchannel has a cost of 12 due to its increased bandwidth capabilities.
Po1 Desg FWD 12 128.65 P2p
Etherchannels give us a performance benefit and a fault tolerance benefit as well. Performance is increased since all physical channels between the two switches can be used, rather than the one STP allows by default. (You can place up to eight separate physical links into a single Etherchannel.) Fault tolerance is also increased, since a physical channel bundled into the Etherchannel can go down without an STP recalculation -- STP sees the Etherchannel as one single connection!
Etherchannels aren't just important to know about for the CCNA exam, they're commonly used in real-world networks as well - so make sure you know how to configure and troubleshoot them!
Source: http://ezinearticles.com/?Cisco-CCNA-Certification-Training:--Etherchannels-And-Spanning-Tree-Protocol-(STP)&id=371780
CCNA/CCNP Certification: OSPF E2 vs. E1 Routes
OSPF is a major topic on both the CCNA and CCNP exams, and it's also the topic that requires the most attention to detail. Where dynamic routing protocols such as RIP and IGRP have only one router type, a look at a Cisco routing table shows several different OSPF route types.
R1#show ip route
Codes:
C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
In this tutorial, we'll take a look at the difference between two of these route types, E1 and E2.
Route redistribution is the process of taking routes learned via one routing protocol and injecting those routes into another routing domain. (Static and connected routes can also be redistributed.) When a router running OSPF takes routes learned by another routing protocol and makes them available to the other OSPF-enabled routers it's communicating with, that router becomes an Autonomous System Border Router (ASBR).
Let's work with an example where R1 is running both OSPF and RIP. R4 is in the same OSPF domain as R1, and we want R4 to learn the routes that R1 is learning via RIP. This means we have to perform route redistribution on the ASBR. The routes that are being redistributed from RIP into OSPF will appear as E2 routes on R4:
R4#show ip route ospf
O E2 5.1.1.1 [110/20] via 172.34.34.3, 00:33:21, Ethernet0
6.0.0.0/32 is subnetted, 1 subnets
O E2 6.1.1.1 [110/20] via 172.34.34.3, 00:33:21, Ethernet0
172.12.0.0/16 is variably subnetted, 2 subnets, 2 masks
O E2 172.12.21.0/30 [110/20] via 172.34.34.3, 00:33:32,
Ethernet0
O E2 7.1.1.1 [110/20] via 172.34.34.3, 00:33:21, Ethernet0
15.0.0.0/24 is subnetted, 1 subnets
O E2 15.1.1.0 [110/20] via 172.34.34.3, 00:33:32, Ethernet0
E2 is the default route type for routes learned via redistribution. The key with E2 routes is that the cost of these routes reflects only the cost of the path from the ASBR to the final destination; the cost of the path from R4 to R1 is not reflected in this cost. (Remember that OSPF's metric for a path is referred to as "cost".)
In this example, we want the cost of the routes to reflect the entire path, not just the path between the ASBR and the destination network. To do so, the routes must be redistributed into OSPF as E1 routes on the ASBR, as shown here.
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#redistribute rip subnets metric-type 1
Now on R4, the routes appear as E1 routes and have a larger metric, since the entire path cost is now reflected in the routing table.
O E1 5.1.1.1 [110/94] via 172.34.34.3, 00:33:21, Ethernet0
6.0.0.0/32 is subnetted, 1 subnets
O E1 6.1.1.1 [110/100] via 172.34.34.3, 00:33:21, Ethernet0
172.12.0.0/16 is variably subnetted, 2 subnets, 2 masks
O E1 172.12.21.0/30 [110/94] via 172.34.34.3, 00:33:32, Ethernet0
O E1 7.1.1.1 [110/94] via 172.34.34.3, 00:33:21, Ethernet0
15.0.0.0/24 is subnetted, 1 subnets
O E1 15.1.1.0 [110/94] via 172.34.34.3, 00:33:32, Ethernet0
Knowing the difference between E1 and E2 routes is vital for CCNP exam success, as well as fully understanding a production router's routing table.
Source: http://www.articlesbase.com/computers-articles/cisco-ccna-ccnp-certification-ospf-e2-vs-e1-routes-4513237.html
IP Subnet Calculations
1. IP Addressing
At this point you should know that IP, the Internet Protocol, is a network layer (OSI layer 3) protocol, used to route packets between hosts on different networks. To suit this purpose, IP must define an addressing scheme, so that a packet's intended destination can be indicated.
An IP address is composed of 32 bits. These 32 bits are divided into 4 octets of 8 bits each. You may have seen an IP address represented like this: 172.68.15.24. We must remember, however, that the computer understands this number only in binary, so we must often deal with them in binary. Many people are intimidated by this initially, but soon find that it is not difficult. If you do not allow yourself to be flustered, you can master this topic.
IP addresses are assigned to orginazations in blocks. Each block belongs to one of three classes: class A, class B, or class C. You can tell what class an IP address is by the value in its first octet.Class A 1-126
Class B 128-191
Class C 192 -->
An IP address consists of two fields. The first field identifies the network, and the second field identifies the node on the network. Which bits of the address are in the network field and which bits are in the host field is determined by the subnet mask.
When a class A IP license is granted, you are assigned something like this: 99.0.0.0. Only the value of the bits in the first octet are assigned. This means you are free to assign any values you wish in the second, third and fourth octets.
The defualt subnet mask for a class A network is 255.0.0.0. High bits, ones, indicate the bits that are part of the network field of the IP address. The default subnet mask does not create subnets. Therefor, a class A network with the default subnet mask is one network. The three octets that are unassigned and unmasked are part of the host field of the address. There is a total of 24 bits in those three octets. Each bit can be in one of two states. Therefor, 2^24 is the number of host addresses that can be assigned on that network, almost. Two addresses are reserved on every network, x.x.x.0 and x.x.x.255. So the total number of hosts possible on this network is 2^24. 2^24-2=16,777,214 hosts for a class A IP network.
When a class B license is granted, the first two octets are assigned. For example, 172.198.x.x. The default subnet mask for a class B is 255.255.0.0. One network, two octets free, 16 bits for the host address field. 2^16-2=65,534 possible host addresses on a class B IP network.
When a class C license is granted, the first three octets are assigned, for example: 193.52.16.0. The default subnet mask for a class C is 255.255.255.0. Once octet makes up the host address field. 2^8-2=254 host addresses possible on a class C network.
2. Reason for Subnetting
We said that the default subnet mask for a class A IP network is 255.0.0.0. Once octet only of a class A network address identifies the network, with this subnet mask. This leaves three octets of 8 bits each, or 24 bits, to identify the host on that one network. 2^24=16,777,216 addresses. Two addresses are reserved, x.x.x.0 and x.x.x.255. 16,777,214 nodes can be assigned an IP address on this network.
It is highly unlikely that any organization would want one network of 16,777,214 nodes. They might want that many devices connected in a wide area network (WAN), thus capablee of communicating when neccessary, but they will want to subdivide this huge network into mostly self-contained subnetworks of nodes that communicate with each other often. This is called subnetting.
To understand why, consider what would happen in either a broadcast or a token passing network that consisted of over 16,000,000 nodes. Nothing would happen. It simply would not work. Though the problem is not as drastic, class B and class C IP networks are often subnetted, also.
The subnet mask is used to subdivide an IP network into subnets. This is a division that takes place in OSI layer 3, so it is a logical division that is created by the addressing scheme. This logical division is usually combined with a physical division. Many subnets are physically isolated from the rest of the network by a device such as a router or a switch. This aspect of subnetting is discussed in Unit 3--Data Link Layer.
3. How Subnetting Works
The bits of an address that are masked by the subnet mask are the bits that make up the network field of the address. To subnet, the default subnet mask for a network is extended to cover bits of the address that would otherwise be part of the host field. Once these bits are masked, they become part of the network field, and are used to identify subnets of the larger network.
Here is where we begin dealing with both addresses and subnetmasks in binary. Get yourself a cold beverage, stretch, take a deep breath and don't worry. Once you get your brain around the concepts, it is not difficult. You just have to keep trying until the light goes on.
3.1 Translating Binary to Decimal
Both IP addresses and subnet masks are composed of 32 bits divided into 4 octets of 8 bits each. Here is how a single octet translates from binary to decimal. Consider an octet of all ones: 11111111.
128 64 32 16 8 4 2 1
--- -- -- -- - - - -
1 1 1 1 1 1 1 1
128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255
Here's another: 10111001
128 64 32 16 8 4 2 1
--- -- -- -- - - - -
1 0 1 1 1 0 0 1
128 + 0 + 32 +16 + 8 + 0 + 0 + 1 = 185
and 00000000
128 64 32 16 8 4 2 1
--- -- -- -- - - - -
0 0 0 0 0 0 0 0
0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 = 0
3.2 Converting Decimal to Binary
Converting decimal to binary is similar. Consider 175:
128 64 32 16 8 4 2 1
--- -- -- -- - - - -
1 0 1 0 1 1 1 1
128 + 0 + 32 + 0 + 8 + 4 + 2 + 1 = 175
175=10101111
3.3 Simple Subnetting
The simpliest way to subnet is to take the octet in the subnet mask that covers the first unassigned octet in the IP address block, and make all its bits high. Remember, a high bit, a 1, in the subnet mask indicates that that corresponding bit in the IP address is part of the network field. So, if you have a class B network 172.160.0.0, with the subnet mask 255.255.0.0, you have one network with 65, 534 possible addresses. If you take that subnet mask and make all the bits in the third octet high
128 64 32 16 8 4 2 1
--- -- -- -- - - - -
1 1 1 1 1 1 1 1
128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255
you get the subnet mask 255.255.255.0.
172.60. 0. 0
255.255.255.0
Now the third octet of all the addresses on this network are part of the network field instead of the host field. That is one octet, or eight bits, that can be manipulated to create subnets. 2^8=256 possible subnets now on this class B network.
One octet is left for the host field. 2^8-2=254 possible host addressed on each subnet.
3.4 Advanced Subnetting
That is the simplist way to subnet, but it may not be the most desirable. You might not want 256 subnets on your class B network. Instead, you might use a subnet mask like 255.255.224.0. How many subnets would this give you? The first step is to see how many bits are allocated to the network by this mask.
128 64 32 16 8 4 2 1
--- -- -- -- - - - -
1 1 1 0 0 0 0 0
128 + 64 + 32 + 0 + 0 + 0 + 0 + 0 = 224
3 bits are allocated. 2^3=8 subnets.
How many hosts on each subnet? Well, 5 bits from this octet are left for the host field, and 8 bits in the fourth octet, for a total of 13 bits in the host field. 2^13-2=8190 possible hosts on each subnet.
The subnet mask is always extended by masking off the next bit in the address, from left to right. Thus, the last octet in the subnet mask will always be one of these: 128, 192, 224, 240, 248, 252, 254 or 255.
Given the IP address of a host and the subnet address for the network, you need to be able to calculate which subnet that host is on. To do this we compare the binary representation of the pertinent octet of the subnet mask witht he binary representation of the corresponding octet in the IP address. Example:
IP address=172.60.50.2
subnet mask=255.255.224.0
50= 00110010
224=11100000
We perform a logical AND on these two numbers. We will be left with only the bits where there is a one in both octets.
00110010
11100000
--------
00100000=32
This host is on subnet 172.60.32.0.
We also need to be able to find the range of assignable IP addresses on this subnet. To do this, we take the binary that tells us the subnet address, in this case 00100000, and compare it with the subnet mask.
00100000
11100000
The bits convered by the mask we will leave as they are. The rest of the bits we make high. So
00100000
11100000
--------
0011111=63
The range of assignable IP addresses on the subnet 172.60.32.0 is 172.60.32.1-172.60.63.254.
On every network and subnet, two addresses are reserved. At the low end of the range of addresses for the network or subnet, in this case 172.60.32.0, is the address for the network or subnet itself. The address at the high end of the range of addresses, in this case 172.60.63.255, is the broadcast address. Any message sent to the broadcast address will be received by every host on the network.
Learn to reset or recover Cisco Router password
The Recovery process is simple and it hardly takes five minutes, but time depends on how fast is your router boots.
- First of all connect to the console port, start terminal application, and power on the router. When you see the boot process beginning, hit the Break sequence. (Break sequence is usually Ctrl+Page Break, but it might differ according to terminal applications.) Doing this interrupts the boot process and drops the router into ROMMON.
- At the ROMMON prompt, enter the command confreg 0x2142 to set the configuration register to 0x2142.
- Restart the router by power cycling it or by issuing the command reset.
- When the router reloads, the configuration register setting of 0x2142 instructs the router to ignore the startup-config file in NVRAM. You will be asked if you want to go through Setup mode because the router thinks it has no startup-configuration file. Exit from Setup mode.
- Press Return and enable command enable to go into privileged EXEC command mode. No password is required because the startup config file was not loaded.
- Load the configuration manually by entering copy startup-config running-config.
- Go into the Global Configuration mode using the command configure terminal and change the password with the command enable password password or enable secret password.
- Save the new password by entering copy running-config startup-config.
- Go to the global config prompt, and change the configuration register back to the default setting with the command config-register 0x2102. Exit back to the privileged exec prompt.
- Reboot the router using the reload command. You will be asked to save your changes; you can do so if you have made additional configuration changes.
How To Configure ASA 8 Firewall on GNS3
Cisco ASA 5500 Series Adaptive Security Appliances, or simply Cisco ASA, is Cisco's line of network security devices introduced in 2005. Cisco ASA has generally been intended for the small-to-medium business market as a higher-end product with more features than entry-level products. Expansions are available for anti-virus/malware (dubbed Anti-X), and intrusion detection.
This video will explain you how to configure an ASA 8 firewall in GNS3.
This video will explain you how to configure an ASA 8 firewall in GNS3.
Site to Site IPSEC VPN lab in GNS3
This popular site-to-site VPN solution for connecting remote locations to headquarters provides advanced encryption to secure information in transit and is the premier solution for permanent VPN connections. This video explains you how to create IPSEC Site to Site VPN connection.
How to recover lost enable passwords on a Cisco 2800 series router
This video describes how to recover the enable password and the enable secret passwords. These passwords protect access to privileged EXEC and configuration modes. The enable password password can be recovered, but the enable secret password is encrypted and must be replaced with a new password.
As a CCNA / CCNP candidate you are expected to understand IPv6
During your career as a Cisco network engineer you will have to deal understanding IPv6 address structure.
For your CCNA and CCNP studies you have to at some point confront and understand IPv6. At first glance it can see quite daunting compared to IPv4 that we are all used to, in actual fact IPv6 is quite a simply addressing protocol once you get past the initial shock. In this article we are going to have a look at Neighbour discovery protocol for layer 2 mapping.
When an IPv6 host or router needs to send a packet to some other host on the same network it will first of all look into it's own local neighbour database to find if it has an IPv6 to MAC mapping, if it finds the right mapping the host will use it, if there is no mapping the host will need to resolve the known layer 3 IPv6 address to a currently unknown Layer 2 MAC address and to do this the host uses the Neighbor Discovery Protocol or NDP to discover the MAC address dynamically.
The Sending host will use a multicast message called a Neighbor Solicitation (NS) icmp message to ask the receiving host for it's MAC address, the receiving host will reply with a Neighbor Advertisement (NA) icmp message unicast in return with the requested MAC address.
How IPv6 achieves this is all in the construction of the Neighbor Solicitation message which makes use of a special IPv6 destination address called a "Solicited Node Multicast", this solicited Node Multicast at any given moment represented all of the IPv6 hosts on the link, the last 24 bits of the Solicited Node Address are the last 24 bits of the IPv6 address of the device that a host is requesting the MAC from.
The IPv6 multicast destination address is FF02::1:FF:0/104 the final 24 bits are made up of the last 24 bits of the IPv6 address to which the message is being sent to. For example if a host wanted to discover the MAC address of an IPv6 host addressed as 2222:3333:4444:5555:6666:AAAA:BBBB:CCCC:DDDD/64 then the solicited Node Address will look like the following FF02::1:FF:CC:DDDD/104
When a sending hosts wants to get the MAC address from the IPv6 host of 2222:3333:4444:5555:6666:AAAA:BBBB:CCCC:DDDD/64 it will take the last 24 bits of the known IPv6 address and place them into the remaining 24 bits of the Solicited Node Address and since all IPv6 hosts listen to their own Solicited Node addresses, when they hear their address they will reply with the MAC address.
Source: http://www.articlesbase.com/networks-articles/ccna-ccnp-training-ipv6-addressing-3375312.html
Cisco ASA 5510 Firewall : Basic Configuration Tutorial
Cisco ASA 5510 security appliance is the second model in the ASA series (ASA 5505, 5510, 5520 etc) and is fairly popular since is intended for small to medium enterprises. Like the smallest ASA 5505 model, the 5510 comes with two license options: The Base license and the Security Plus license. The second one (security plus) provides some performance and hardware enhancements over the base license, such as 130,000 Maximum firewall connections (instead of 50,000), 100 Maximum VLANs (instead of 50), Failover Redundancy, etc. Also, the security plus license enables two of the five firewall network ports to work as 10/100/1000 instead of only 10/100.
Next we will see a simple Internet Access scenario which will help us understand the basic steps needed to setup an ASA 5510. Assume that we are assigned a static public IP address 100.100.100.1 from our ISP. Also, the internal LAN network belongs to subnet 192.168.10.0/24. Interface Ethernet0/0 will be connected on the outside (towards the ISP), and Ethernet0/1 will be connected to the Inside LAN switch.
The firewall will be configured to supply IP addresses dynamically (using DHCP) to the internal hosts. All outbound communication (from inside to outside) will be translated using Port Address Translation (PAT) on the outside public interface. Let's see a snippet of the required configuration steps for this basic scenario:
Step1: Configure a privileged level password (enable password)
By default there is no password for accessing the ASA firewall, so the first step before doing anything else is to configure a privileged level password, which will be needed to allow subsequent access to the appliance. Configure this under Configuration Mode:
ASA5510(config)# enable password mysecretpassword
Step2: Configure the public outside interface
ASA5510(config)# interface Ethernet0/0
ASA5510(config-if)# nameif outside
ASA5510(config-if)# security-level 0
ASA5510(config-if)# ip address 100.100.100.1 255.255.255.252
ASA5510(config-if)# no shut
Step3: Configure the trusted internal interface
ASA5510(config)# interface Ethernet0/1
ASA5510(config-if)# nameif inside
ASA5510(config-if)# security-level 100
ASA5510(config-if)# ip address 192.168.10.1 255.255.255.0
ASA5510(config-if)# no shut
Step 4: Configure PAT on the outside interface
ASA5510(config)# global (outside) 1 interface
ASA5510(config)# nat (inside) 1 0.0.0.0 0.0.0.0
Step 5: Configure Default Route towards the ISP (assume default gateway is 100.100.100.2)
ASA5510(config)# route outside 0.0.0.0 0.0.0.0 100.100.100.2 1
Step 6: Configure the firewall to assign internal IP and DNS address to hosts using DHCP
ASA5510(config)# dhcpd dns 200.200.200.10
ASA5510(config)# dhcpd address 192.168.10.10-192.168.10.200 inside
ASA5510(config)# dhcpd enable inside
The above basic configuration is just the beginning for making the appliance operational. There are many more configuration features that you need to implement to increase the security of your network, such as Static and Dynamic NAT, Access Control Lists to control traffic flow, DMZ zones, VPN etc.
Source:http://www.articlesbase.com/networks-articles/cisco-asa-5510-firewall-basic-configuration-tutorial-833644.html
Notes for OSPF DR/BDR Peering priority
- Higher priority value (0-255) is better.
- Default value is 1
- Can be set via neighbor command or interface command.
- Neighbor command sets neighbor priority while interface command sets its own interface priority. Thus, both commands will not interfere each other. Again, one is for neighbor and other is for its own interface.
- If the local interface priority is set and the other router uses neighbor priority command, then interface priority will take precedence.
hostname R2
interface Serial0/0
ip ospf priority 255
hostname R1
R1(config-router)#do sh run | s router ospf
router ospf 1
neighbor 10.1.1.2 priority 0
R1(config-router)#do sh ip ospf nei 2.2.2.2 | i priority|DR
Neighbor priority is 255 (configured 0), State is FULL, 7 state changes
DR is 10.1.1.2 BDR is 10.1.1.1
R1(config-router)#do sh ip ospf nei | I 2.2.2.2
2.2.2.2 255 FULL/DR 00:01:51 10.1.1.2 Serial0/0
hostname R2
interface Serial0/0
ip ospf priority 0
R1(config-router)#do sh run | s router ospf
router ospf 1
neighbor 10.1.1.2 priority 255
R1(config-router)#do sh ip ospf nei 2.2.2.2 | i priority|DR
Neighbor priority is 0 (configured 255), State is FULL, 7 state changes
DR is 10.1.1.1 BDR is 10.1.1.1
R1(config-router)#do sh ip ospf nei | I 2.2.2.
2.2.2.2 0 FULL/DROTHER 00:01:41 10.1.1.2 Serial0/0
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
EIGRP Overview
EIGRP Facts
Enhanced IGRP is a Cisco-proprietary balanced hybrid routing protocol that combines the best features of distance vector and link state routing. EIGRP:
- Sends the subnet mask in the routing update. It supports route summarization and VLSM.
- Supports automatic classful route summarization at major network boundaries (this is the default in EIGRP). Unlike IGRP and RIP, manual route summarization can also be configured on arbitrary network boundaries to reduce the routing table size.
- Is not susceptible to routing loops. Instead, EIGRP uses built-in loop avoidance techniques. Under certain conditions, EIGRP will use split horizon, but not hold downs or flush timers.
- Is scalable and does not have the 16 hop limitation of RIP.
- Uses hello packets to discover neighbor routers. Hello intervals on EIGRP routers do not need to match.
- Exchanges the full routing table at startup, and then partial routing updates thereafter.
- Uses unicasts or multicasts to 224.0.0.10 for routing updates. Hello packets always use the multicast address.
- Uses bandwidth, delay, reliability, and load for the route metric. The metric is expressed as the number of microseconds.
- The degree to which each value is used to calculate the metric can be customized by modifying one of five K values.
- By default, K1 and K3 are set to 1, while K2, K4, and K5 are set to 0. These settings mean that with the default configuration, only delay and bandwidth have an effect on the metric.
- On serial links, a default bandwidth of 1544 is used. EIGRP does not detect the actual bandwidth on the link. You must manually configure bandwidth values for accurate metric calculations.
- Uses an autonomous system (AS) number to identify routers that are to share EIGRP information. The AS number on both routers must match.
- Maintains partial network topology information in addition to routes.
- Supports load balancing on equal-cost and unequal cost links. This means that EIGRP can keep multiple paths to a single network, even if they have a different cost. With IOS 12.4 and above, EIGRP supports up to 16 paths (earlier versions supported up to 6), with the default being 4 equal-cost paths.
- Minimizes network bandwidth usage for routing updates. During normal operation EIGRP transmits only hello packets across the network. EIGRP does not send periodic routing updates like RIP and IGRP. When change occurs, only routing table changes are propagated in EIGRP not the entire table.
- Requires less processing and memory than link state protocols.
- Converges more quickly than distance vector protocols. In some cases, convergence can be almost instantaneous because an EIGRP router stores backup routes for destinations. If no appropriate route or backup exists in the routing table, EIGRP will query neighbor routers to discover an alternate route. In this manner, EIGRP can quickly adapt to alternate routes when changes occur.
- Uses the DUAL link-state algorithm for calculating routes.
- Supports multiple protocols. EIGRP can exchange routes for IP, AppleTalk and IPX/SPX networks.
- Uses a neighbors table to keep track of neighbor routers. The neighbors table includes the following for each neighbor:
- A hold time. Each hello packet includes a hold time that identifies how long the hello information is valid. If the hold time expires without receipt of a hello packet, the neighbor is assumed to be unreachable.
- Round-trip timers that help the router identify cost values to reach the neighbor router.
- Uses a topology database to keep track of all known networks.
- The topology table has a list of each destination network and all neighbor routers that reported routes to that network.
- The best routes that will be used for routing packets are copied from the topology table into the routing table.
- The topology table holds up to 16 known routes (previously up to 6 before IOS version 12.4).
| Term | Definition |
| Advertised Distance (AD) | The advertised distance (AD) is the cost to the destination network as reported by the neighbor router. The AD is also called the reported distance (RD). |
| Feasible Distance (FD) | The feasible distance (FD) is the lowest total cost to a destination network. The feasible distance is identified for each destination network, and is determined as follows: # For each neighbor, a total cost to the network through the neighbor is calculated by adding the AD to the cost required to reach the neighbor router (the cost of the link used to reach the neighbor router).
|
| Successor | A successor is the route to a destination network with the lowest total cost. * When a new route is first learned, the total cost to the successor route is used as the feasible distance to that network.
|
| Feasible Successor | A feasible successor is an alternate route to a destination network. The total cost to the route through the feasible successor is higher than the total cost of successor routes. A route must meet the following condition to qualify as a feasible successor route: The advertised distance of the route through that neighbor must be less than the feasible distance used for that network (AD < FD). Be aware of the following regarding feasible successors: * Satisfying the AD < FD condition ensures that the route is loop free. In other words, the router knows for sure that the route does not include itself in the path if the AD is lower than the FD. Note: Successor routes must also meet this condition.
|
- All known routes to a destination are kept in the topology table. Only successor routes are copied to the routing table.
- If the successor route goes down and there are no feasible successors, routes whose advertised distance is greater than the feasible distance for the route are not used because they might be routes that include loops.
- When the last feasible successor route to a network is lost, the router recalculates all routes for the lost neighbor. Instead of using other routes that are not feasible successor routes, it first communicates with neighbor routers. If necessary, the router recalculates the feasible distance for the route.
- A route whose AD is greater than the FD does not prove that a loop exists, only that a loop might exist. After the last feasible successor route is lost, a previously unacceptable route could be identified as a feasible successor route as long as its AD is less than the newly-calculated FD.
- By default, EIGRP uses equal-cost load balancing. To use unequal-cost load balancing, configure the variance value. The variance is a multiplier that identifies the degree to which alternate paths can be used.
- The variance value ranges from 1 to 255.
- The default variance is 1, meaning that only routes that match the best route can be used.
- Setting the variance to 2 allows alternate routes to be used whose total costs are within a factor of 2 (double or less) of the best cost route.
- Only feasible successor routes can be used. This means that a route whose AD is greater than the FD cannot be used as an alternate route, even if its total cost is within the variance amount.
- Both routers are on the same subnet with the same subnet mask.
- If used, authentication checks must pass.
- Both routers must be configured with the same AS number.
- Metric weight values (K values) must match on both routers.
EIGRP Command List
You configure EIGRP just the same as you would configure IGRP. The following table lists the applicable commands.| Command | Function |
| Router(config)#router eigrp number | Defines an EIGRP process. The number must match between routers for information to be shared. |
Router(config-router)#network n.n.n.n Router(config-router)#network n.n.n.n w.w.w.w
Identifies a network that participates in the routing process.
Networks can be specified with or without the wildcard mask. If you do not use a wildcard mask, the network address you add will be automatically truncated based on classful network boundaries.
You must use a wildcard mask to identify VLSM subnets.
-->
Router(config-router)#no auto-summary
Turn off automatic route summarization.
With automatic route summarization, subnets are summarized based on classful boundaries when advertising routes on networks with a different class boundary. You must disable automatic summarization if you have a network address (such as 10.0.0.0) subnetted into smaller subnets and separated by a network with a different classful network address (such as 12.0.0.0).
Example
The following commands enable EIGRP on a router and define three networks that participate in the routing process.
Router(config)#router eigrp 2
Router(config-network)#network 172.16.1.0 0.0.0.255
Router(config-network)#network 172.16.2.0 0.0.0.255
Router(config-network)#network 172.16.3.0 0.0.0.255
Use the following commands to manage and monitor EIGRP.
| Command | Features |
show ip route
View EIGRP-learned routes.
-->
show eigrp neighbors
View neighboring routers from which EIGRP routes can be learned. Lists the IP address of the connected router.
-->
show eigrp interfaces
View the interfaces that are running EIGRP and the number of connected routers.
LAB
You have two routers connected as shown in the network diagram. Router Jujuy has already been configured to share route information using EIGRP with an autonomous system number of 100. Your task in this lab is to configure the Salta router to share routing information using EIGRP with the Jujuy router.
All interfaces have been configured and enabled. Your task is to:
- Configure the Salta router to share information about all directly-connected routes with the Jujuy router.
- When you are finished, save your changes.
Task SummaryActions you were required to perform
- Run EIGRP on Fa0/0 for AS 100
- Run EIGRP on Fa0/1 for AS 100
- Run EIGRP on s0/1/1 for AS 100
When configuring EIGRP, all routers that share information must use the same autonomous system number. In this scenario, use router eigrp 100 to configure the Salta router. Add network statements to identify networks on which to run EIGRP.
Use the following commands:
Salta>enable
Salta#config t
Salta(config)#router eigrp 100
Salta(config-router)#network 192.168.1.0
Salta(config-router)#network 192.168.2.0
Salta(config-router)#network 172.17.150.140 0.0.0.3
(Press Ctrl + Z)
Be aware of the following when configuring EIGRP:
- Using a network statement without a wildcard mask makes an entry using classful network boundaries.
- To run EIGRP on the Salta s0/1/1 interface, you could have also used the following command: network 172.17.0.0. This classful network entry would match the IP address assigned to the s0/1/1 interface, thereby enabling EIGRP on that interface.
- You can enable EIGRP on all interfaces on a router using a single command as follows: network 0.0.0.0 255.255.255.255. This wildcard mask value matches every possible network, enabling EIGRP on all IP interfaces.
Inscription à :
Articles (Atom)


