Route Filtering with distribute-list

3 ways to filter routes for redistribution :

- Standard ACL
access-list permit ip 10.0.0.0 0.0.15.255

Match 10.0.0.0/20 but also 10.0.0.0/21 .. 21 etc any smaller mask.

To match also the mask use Extended ACL

-Extended ACL
access-list 101 permit ip 10.0.0.0 0.0.0.0 255.255.248.0 0.0.0.0

Match only 10.0.0.0/20

-Prefix-list
ip prefix-list TEST 10.0.0.0/20

But permit to limit a range of valid mask
ip prefix-list TEST 10.0.0.0/20 le 24
It match 10.0.0.0/24 and also 10.0.4.0/22

ip prefix-list TEST 10.0.0.0/20 ge 24
It match 10.0.0.0/24 but also 10.0.0.0/25 ...

IPExpert V2 Lab2

6.0 redistribution

In case of mutual redistribution between 3 process (R5 & R6), keep in mind to tag redistributed route in the transit area (ospf) with the originating tag.

cycle redistribution RIP -> OSPF -> EIGRP -> RIP

Ex : redistribute rip in ospf with tag 25, redistribute ospf with tag 58 and ospf coming from RIP with tag 25 into eigrp. When redistributing to orignating RIP, filter tag 25, redistribute 58 with tag 58 and EIGRP with tag 20.

7.6 BGP MED

In order to make the R5 route prefered MED must be compared, as R5 set a MED and R6 not, R6 is preferedd.

bgp bestpath med missing-as-worst permits to set a MED TO THE LARGEST VALUE WHEN HE IS NO SET
Easier to do

8.2 NTP Authentication

Authentication permit to authentication the clock source not the recipient and on the demand of the recipient.

Case 1 : Server Y, Client N : sync but no authenticated
Case 2 : Server N, Client Y : no sync
Case 3 : Server Y, Client Y :

Server Side
ntp authentication-key 1 md5 060F1F24545E0C0B11 7
ntp authenticate
ntp master

Client side
ntp authentication-key 1 md5 060F1F24545E0C0B11 7
ntp authenticate
ntp server 10.10.10.4 key 1
ntp trusted-key 1


10.2 Qos

In order to drop traffic and use NBAR, use policy-amp with action drop

policy-map DROP
class P2P
drop

IPExpert V2 Lab1

Review :

1.0 Etherchannel load balancing
Load balance according to where frame are headed : means where frame goes so it's destination mac load-balancing type.

1.4 PPPoE
PPPoE is on aggregation & DSL on the doc CD.
Virtual-template and bba-group on the server side
Dialer with ppp encap on the client side

2.1 Frame-Relay
Don't forget local frame-relay map on physical or multipoint interface to ping ourselves
Broadcast keyword is no necessary for spoke on frame-relay map

3.1 RIP
When more passive than active it's easier to do :
passive-interface default
no passive-interface f0/0

To add dely between rip update

router rip
output-delay 25

7.3 Snmp Trap configuration
Event after snmp-host x.x.x.x configuration don't forget to enable trap
snmp-server enable traps

10.1 DHCP Server Secure ARP
In order arp table secured by dhcp entry

update arp


11.3 RSVP

Activate RSVP on interface
ip rsvp bandwidth

ip rsvp sender-host and ip rsvp reservation-host are used to simulate a PATH message between 2 router and verify that reservation is done on the path.


12.3 EEM
event maanger applet denytcl
event cli pattern "tclsh" sync yes
action syslog msg "Attempted tclsh command by user at $_$event_pub_time"
set _exit_status 0

PPPoE

PPPOE with static IP

Server Configuration

bba-group pppoe PPPOE
virtual-template 1

int f0/0
pppo enable group PPPOE

int virtual-template
ip add 150.50.17.1 255.255.255.0


Client Configuration

int dialer 1
mtu 1492
ip add 150.50.17.2 255.255.255.0
encap ppp
dialer pool 1

int f0/0
pppoe enable
pppoe-client dial-pool-number 1

INE - LAB10 review

3.4 Configure Area 1 without Network Command

Int lo0
ip ospf 1 area 1


3.6 Ospf Authentication

Authentication all area 0 adjacencies without area 0 command :
Don't forget the virtualink authentication

router ospf 1
area 1 virtual-link 150.1.4.4 authentication
area 1 virtual-link 150.1.4.4 authentication-key CISCO

4.2 BGP Summarization

After aggregating all the IGP domain adress space with

aggregate-address 164.1.0.0 255.255.0.0 summary-only

A 164.1.0.0/16 route to Null0 is put on the RIB. As R4 use a default route to join a part of 164.1.0.0 it will use the more specific route to Null0 instead. A way to prevent Null0 from being installed in the RIB is make the distance for the local route 255

router bgp 100
distance 20 200 255

4.3 BGP Default Route

Advertized a BGP default route, only the default, and make it prefered from OSPF default route :

On R1 filter all bgp routes except default

R1
router bgp 300
neighbor 164.1.18.8 default-originate
neighbor 164.1.18.8 prefix-list DEFAULT ou

ip prefix-list DEFAULT seq 5 permit 0.0.0.0/0

On sw2 change the distance for the neighbor lower than distance of ospf 110

Sw2
router bgp 300 distance 100 164.1.18.1 0.0.0.0


4.5 BGP Reachability

During network breakdown, the traffic transit by a non-bgp router causing a routing black hole (non-bgp router doesn't have any bgp route). The idea is then to redistribute bgp onto OSPF. It 's necessary to filter which router redistribute wich AS in

bgp redistribute-internal

Is needed as BGP only redistribute EBGP learned route into IGP by default.


5.4 IGMP Multicast for a group

Prevent a group from being sent to an interface for a given group

int e0/1
ip multicast boundary 1
access-list 1 deny 226.37.1.1
access-list 1 permit any


6.3 RIPng Overs Frame Relay

Don't forget to map pv6 Link Local adress with DLCI for physical or multipoint interface for RIP adjacencies working


7.1 Frame Relay Traffic Shaping

Minimum TC is 10ms.
So for a CIR of 256000 the Bc to configure is 2560
In order packet are fragment to be transmitted in one interval, the size of fragment should be 2560/8 = 320 Bytes

map-class frame-relay DLCI_305
frame-relay cir 256000
frame-relay bc 2560
frame-relay fragment 320

Ping Macro & Tcl

For IOS, use tcl to script ping

tclsh
foreach address {
164.1.1.1
164.2.2.2
} { ping $address
}

For Catalyst

macro name PINGALL
do ping 164.1.1.1
do ping 164.2.2.2
@
macro global apply PINGALL

PPP eap authentication

EAP is client-server authentication. Credentials need to be specified on client side as there is no default use of hostname as identity on contrary to Chap.

Client-side

ppp eap identity R5
ppp eap password CISCO

Server-side using a local stored username.

username R5 password 0 CISCO
ppp authentication eap
ppp eap local