Wednesday 25 May 2011

CCIE Routing and Switching

CCIE Routing & Switching

Part I

Chapter 1 - Ethernet Basics:

Straight-through (T568A) = 1-1, 2-2, 3-3, 6-6
Cross-over (T568B) = 1-3, 2-6, 3-1, 6-2

PC NIC transmits on 1,2 and receives on 3,6. Switch does opposite.

Fast Link Pulse (FLP) used to detect speed.
Duplex settings can only be negotiated.

Duplex cannot be set until speed is set manually.

Collisions occur in the first 64 bytes of a frame.
Late collision occur after the 64 bytes were transmitted.

Individual/Group (I/G) bit - binary 0 = unicast, binary 1 = multicast or broadcast
Universal/Local (U/L) bit - binary 0 vendor assigned, binary 1 administratively assigned

Ethernet Field Types:
Protocol Type:
DSAP: 
SNAP:

10Base5 - thicknet coaxial
10Base2 - thinnet coaxial
10Base-T - Ethernet twisted pair
DIX Ethernet V2 - layer 1 and 2 specification - DIX2
IEEE 802.3 - Ethernet MAC
IEEE 802.2 - Ethernet LLC
IEEE 802.3u - Fast Ethernet over copper and optical cabling
IEEE 802.3z - Gigabit Ethernet over optical cabling
IEEE 802.3ab - Gigabit Ethernet over copper cabling

Switch Internal Processing:

Store-and-forward
Cut-through
Fragment-free

UTP Cabling Reference:

Cat1 - telephones, not data
Cat2 - 4Mbps - token ring over UTP
Cat3 - 10Mbps - data over existing telephone wiring
Cat4 - 16Mbps - fast token ring
Cat5 - 1Gbps
Cat5e - 1Gbps - support for copper cabling
Cat6 - 1Gbps+

Ethernet Cabling Standards

Standard Cabling Max Cable Length
==================================================================
10BASE5 Thick coaxial 500m
10BASE2 Thin coaxial 185m
10BASE-T UTP Cat 3,4,5,5e,6 100m
100BASE-FX Two strand multimode 400m
100BASE-T UTP Cat 3,4,5,5e,6 2 pair 100m
100BASE-T4 UTP Cat 3,4,5,5e,6 4 pair 100m
100BASE-TX STP/UTP Cat 3,4,5,5e,6 2 pair 100m
1000BASE-LX Long-wavelength laser, MM/SM 10km (SM) 3km (MM)
1000BASE-SX Short-wavelength laser MM 220m (62.5 micron) 550m (50 micron)
1000BASE-ZX Extended wavelength SM 100km
1000BASE-CS STP, 2 pair 25m
1000BASE-T UTP Cat 5, 5e, 6 4 pair 100m

Chapter 2 - Virtual LANs and VLAN Trunking

VLAN database commands:

#show current
#show proposed
#apply / abort / reset

#switchport access vlan x - creates the VLAN if it does not exist and assigns interface to that VLAN


Normal-range VLANs: 1 - 1005 (advertised by VTP v1 and v2, can be configured in VLAN database mode, stored in vlan.dat)
Extended-range VLANs: 1006 - 4094 (none of the above)

1002 - 1005 - FDDI and translational bridging

Trunking Standards:

ISL - normal and extended range VLANs. Cisco proprietary. No native VLAN support. Encapsulates original frame. Adds a 26 bytes header and a trailer. Uses source address of the device doing the trunking.

802.1q - normal and extended range VLANs. IEEE defined. Native VLAN support. Inserts a 4 byte tag into the original frame.

DTP = Dynamic Trunking Protocol (not supported on routers)
#switchport nonegotiate - disables DTP negotiation

802.1Q-in-Q Tunneling - packets have 2 802.1q tags when crossing the WAN, SP tag stripped off at egress.


Chapter 3 - Spanning Tree Protocol

802.1d STP
Orginal 8021.d bridge ID field = 2 byte priority field, 6 byte mac address field
Newer 802.1d bridge ID field = 4 priority bits, 12 system ID bits (VLAN field), 6 byte mac address field

802.1d Port Costs

Speed Original IEEE Cost Revised IEEE Cost
=======================================================================
10Mbps 100 100
100Mbps 10 19
1Gbps 1 4
10Gbps 1 2

Change port cost:

#int fa0/0
#spanning-tree  vlan 1 cost 100

Setting VLAN STP Priority:

#spanning-tree vlan x root {primary | secondary} [diameter <diameter>]
or:
#spanning-tree vlan x priority 4096 


Portfast - ignore listening and learning states on ports
Uplinkfast - allows a switch to transition an alternate port to a RP in the event of the current RP failing
Backbonefast - detects indirect failures by sending a RLQ BPDU to its neighbouring switch

Port Aggregation Protocol (PAgP) - Cisco proprietary protocol for automatic negotiation of port channels
Link Aggregation Control Protocol (LACP) - IEEE 802.1AD implementation

Use of "Auto" (PAgP) or "Passive" (LACP) on both ends of a link will prevent a port channel from forming dynamically.
Instead use "Desirable" (PAgP) or "Active" (LACP).

Rapid Spanning Tree Protocol - IEEE 802.1w
- waits for only 3 missed hellos (as opposed to 10)
- transitions from disabled to learning (bypasses listening)
- standardization of portfast, uplinkfast and backbonefast
- Allow a backup DP on a segment

Introduce the following new port types:
Alternate Port - an alternative RP
Backup Port - an alternative DP

#spanning-tree mode rapid-pvst

Rapid Per VLAN Spanning Tree Plus (RPVST+)

#spanning-tree mode rapid-pvst

Multiple Spanning Tree 802.1s

#spanning-tree mode mst

BPDU Guard - disables the port on receipt of any BPDU
Root Guard - prevents a port from becoming the root port -  Upon receipt of superior BPDUs, this switch puts the port in a loop-inconsistent state, ceasing forwarding and receiving frames until the superior BPDUs cease.
BPDU Filter - stops transmission of BDPUs on a port - effectively disables STP

Unidirectional Link Detection (UDLD) - used to prevent loops due to one way cable breaks
Loop Guard - when BPDUs are no longer received port goes into a loop-inconsistent state

Protocols and Standards:

Name Standards Body
===============================
RSTP IEEE 802.1w
MST IEEE 802.1s
STP IEEE 802.1d
LACP IEEE 802.1AD
Dot1Q Trunk IEEE 802.1Q
PVST+ Cisco
RPVST+ Cisco
PAgP Cisco


PAgP is Cisco Proprietary Link Aggregation, LACP is an open standard.


  active = Enable LACP unconditionally
  auto = Enable PAgP only if a PAgP device is detected
  desirable = Enable PAgP unconditionally
  on = Enable Etherchannel only
  passive = Enable LACP only if a LACP device is detected


802.1d STP Timers:

Hello = 2 sec
Fwd Delay = 15 sec
Maxage = 20 sec

Part II

Chapter 4 - IP Addressing

- If a subnet is defined with y host bits then there are 2y - 2  valid usable IP addresses in the subnet e.g. 192.168.1.1 /27 = 2*5 - 2 = 30 hosts per subnet.

How to find the subnet number?

- Subtract the value in the interesting octet from 256
- Find the integer multiple of the result that is closest to but not larger than the interesting octet value
        e.g. 172.31.103.41 255.255.252.0
- 256 - 252 = 4 (magic number)
- 100 is a multiple of 4 that is closest to 103 (but not larger)
- Therefore subnet is 172.31.100.0

How to find the subnet broadcast address?

- As above find subnet number
- All numbers to left of the interesting octet are copied through
- All numbers to the right of the interesting octet become 255
- Add the magic number to the subnet number and subtract 1
e.g. 172.31.103.41 255.255.252.0
- 172.31.100.0
- 172.31.x.255
- 100 + 4 - 1 = 103
- 172.31.103.255

How to determine all subnets of a network?

- Calculate the number of subnets based on 2y (y is number of subnet bits)
- Divide 256 by number
- Count up using this the result

e.g. 172.31.0.0 255.255.224.0
- 2y = 2 * 3 = 8
- 256 / 8 = 32
- Therefore subnets are 172.31.0.0, 172.31.32.0.0, 172.31.64.0, 172.31.96.0, 172.31.128.0, 172.31.160.0, 172.31.192.0, 172.31.224.0

RFC 1918 Private Address Space

Range Class Number of Networks
===================================================================
10.0.0.0 to 10.255.255.255 A 1
172.16.0.0 172.31.255.255 B 16
192.168.0.0 192.168.255.255 C 256


Dynamic NAT Config

#interface e0/0
#ip add 10.1.1.3 255.255.255.0
#ip nat inside

#interface s0/0
#ip address 200.1.1.251 255.255.255.0
#ip nat inside source list 1 pool MyPool
#ip nat pool MyPool 200.1.1.1 200.1.1.2 netmask 255.255.255.252
#ip nat inside source list 1 pool MyPool
(Add the "overload" keyword to the end of this line for PAT)

#access-list 1 permit 10.1.1.0 0.0.0.255

Chapter 5 - IP Services

HSRP Virtual MAC = 0000.0C07.ACxx where xx is the hex HSRP group.

VRRP (RFC 3768) multicast virtual MAC 0000.5E00.01xx where xx is the hex VRRP group number

WCCP = Web Cache Communication Protocol (UDP port 2048)
#ip wccp web-cache group-address 239.128.1.100 password cisco
#interface fa0/0
#ip wccp web-cache redirect out

#interface fa0/1
#ip wccp redirect exclude in

[optional]
#ip wccp web-cache redirect-list <acl>
(only filter traffic from certain clients)
#ip wccp web-cache group-list <acl>
(only accept redirected traffic from certain content engines)

IP SLA - can measure Delay, Jitter, packet loss, packet sequencing, path, connectivity, server download time, MOS.

#conf t
#ip sla monitor
#type udpEcho dest-ipaddr 200.1.200.9 dest-port 1330
#frequency 5
#exit
#ip sla monitor schedule 1 life 86400 now

(this sets the source router to send UDP packets every 5 seconds for one day to 200.1.200.9 port 1330. Destination router needs to have "ip sla monitor responder" configured)

#show ip sla monitor statistics

Netflow:

Record - source/destination IP address etc.
Flow Monitors - applied to an interface, collects information about flows
Flow Exporters - export the cached flow to outside systems (netflow collector)
Flow Samplers - specify sample size of traffic

#flow exporter ipv4flowexport
#destination 192.168.1.110
#dscp 8
#transport udp 1333

#flow monitor ipv4flow
#description "Monitors all IPV4 traffic"
#record netflow ipv4 original-input
#cache timeout inactive 600
#cache timeout active 180
#cache entries 5000
#statistics packet protocol

#interface Fa0/0
#ip add 192.168.39.9 255.255.255.0
#ip flow monitor ipv4flow input

#show flow record
#show flow monitor
#show flow exporter
#show flow interface

RITE (Router IP Traffic Export) - export traffic to an external device

#conf t
#ip traffic-export profile export-this
#interface fa0/0
#bidirectional 
#mac-address 0018.0fad.df30
#incoming sample one-in-every 20
#outgoing sample one-in-every 100
#exit

#interface fa0/1
#ip traffic-export apply export-this
#end

Cisco IOS Embedded Event Manager

#event manager applet CLI-cp-run-st
#event cli pattern "wr" sync yes
#action 1.0 syslog msg "$_cli_msg Command Executed"
#set 2.0 _exit_status 1
#end

Implementing RMON:

#show rmon alarm
#show rmon event

FTP on a Router:
#ip ftp username bob
#ip ftp password bobspassword
#ip ftp source-interface fa0/0
#ip ftp passive [optional]

#copy run ftp:

TFTP on a Router:

#tftp-server flash:c1700.bin alias file.bin 11

(allow access to file called c1700.bin which can be referenced by alias file.bin parsed through ACL 11)

SCP on a Router:

#aaa authorization
#ip scp server enable
HTTP and HTTPS Access

#ip http server
#ip http port <port>
#ip http access-class
#ip http client username <name>
#ip http client password <password>
#ip http authentication [aaa | local | enable | tacacs]

#ip http secure-server

Configuring SSH

1. Configure a hostname (#hostname)
2. Configure a domain name (#ip domain-name)
3. #crypto key generate rsa
4. #transport input ssh
Part III

Chapter 6 - IP Forwarding (Routing)

ip classless - If one part of a major network is known, but the subnet toward which the packet is destined within that major network is unknown, the packet is dropped.

Policy Routing
#interface fa0
#ip address 1.1.1.1 255.255.255.0
#ip policy route-map MyPolicy

#access-list 111 permit tcp any any eq telnet
#route-map MyPolicy permit 10
#match ip address 111
#set ip next-hop 1.1.1.10

(For any telnet packets route via 1.1.1.10)

Optimized Edge Routing (OER)
Performance Routing (PfR)

#oermaster
#oerborder

Chapter 7 - EIGRP

EIGRP hellos are multicast to 224.0.0.10

To form a neighbour relationship routers must:
- must pass authentication (if configured)
- must use same AS number
- source IP address of a received hello is in that router's primary connected subnet on that interface
- K Value must match

K values defaults are 0 1 0 1 0 0 (only bandwidth and delay are considered)

EIGRP Updates:
1. Initially full updates are sent
2. Once all routes have been exchanged updates cease
3. Future partial updates occur when one or more routes change
4. If neighbours fail or recover, or new neighbour adjacencies are formed, full updates are sent.

Updates are sent as RTP multicasts

EIGRP metric calculation = 

metric = 256 (10^7 / bandwidth) + 256 (delay)
EIGRP Load Balancing
variance <multiplier>
(any FS route whose metric is less than the variance value multiplied by the FD is added to the routing table)
maximum paths (1 - 6) = maximum number of routes to the same destination alowed in the routing table - default = 4.

EIGRP Authentication

ip authentication mode eigrp <AS> md5
ip authentication key-chain eigrp <AS> <key-name>

EIGRP Auto Summarization

EIGRP summarizes by default - you can turn this off with:
no auto summary

EIGRP Offset Lists

Chapter 8 - OSPF

OSPF Router ID
- use the "router ID" configured under "router ospf"
- use the highest number IP address on any up/up loopback interface
- use the highest number IP address on any up/up non-loopback interface

OSPF Neighbour states:

INIT
2-WAY
EXSTART
EXCHANGE
LOADING
FULL

OSPF Multicast sent to 224.0.0.5 (All OSPF Routers)

To become neighbours they must:

- pass authentication process
- must be in the same primary subent
- must be in the same OSPF area
- must be the same are type
- must not have duplicate RIDs
- OSPF Hello and Dead timers must be equal

OSPF hello interval = 10 Seconds (LAN) or 30 seconds (T1 or slower)
OSPF Dead time = 4 x hello interval

#ip ospf network <type>
Used to configure how / if DR is elected. Possible types are;
Broadcast, Point-to-point, NBMA, Point-to-multipoint, Point-to-multipoint nonbroadcast, Loopback.




To change OSPF costs use the interface level command:


#interface fa0/1
#ip ospf cost 10
! cost value from 1 to 65535


Or the OSPF level command:


#router ospf 1
#area 0 default-cost
! <0-16777215>  Stub's advertised external route metric


Or using a neighbour command (all routes received from that neighbour have this cost:


#router ospf 1
#neighbor <neighbor> cost <value>


Cost is calculated as:
10^8 / bandwidth (bps)
e.g.
10^8 / 1544000 = 64 (serial link)
10^8 / 100000000 = 1 (100Mbps)



Infinite route metric in OSPF is 16,777,215.

You can use the ospf process level command auto cost reference bandwidth to alter the ratio of calculations otherwise 100Mbps is treated the same (cost = 1) as any higher speed interface.


Costs are overridden by best path type selection:
1. Intra-area routes
2. Interarea routes
3. E1 routes
4. E2 routes

Default LSA Refresh time = 30 minutes
LSA Maxage timer = 60 minutes

LSA Types:


LSA Type 1 - Router  - one per router, list RID and all interface IP addresses.
LSA Type 2 - Network  - one per transit network, created by the DR on the subnet  and represents the subnet and router interfaces connected to the subnet
LSA Type 3 - Net Summary - created by an ABR to represent one area's type 1 and 2 LSAs when being advertised to another area.
LSA Type 4 - ASBR Summary - advertises a host route to an ASBR
LSA Type 5 - AS External  - created by an ASBR, external routes injected into OSPF 
LSA Type 6 - Group Membership  - MOSPF (not supported on IOS)
LSA Type 7 - NSSA External  - created by ASBRs inside an NSSA instead of type 5 LSA
LSA Type 8 - External Attributes - not supported on IOS
LSA type 9 - 11 - Opaque - generic LSAs for future expansion


Stub Area: ABR does not advertise type 5 LSAs (external) into the area but instead advertise a default route. A stub area does accept type 3 LSAs.
Totally Stubby Area: Does not accept LSA type 3 or 5 LSAs from an ABR
Not So Stubby Area: Does accept type 3 LSAs but not type 5 LSAs. Allows creation of type 7 LSAs from ABSR router inside the NSSA area.
Totally Not So Stubby AreaDoes not accept LSA type 3 or 5 LSAs from an ABR. Allows creation of type 7 LSAs from ABSR router inside the NSSA area.


To configure a stub area all routers in the same area need the same stub settings:


NSSA - #area <area-id> nssa
Totally NSSA - #area <area-id> nssa no-summary
Stub - #area <area-id> stub
Totally stubby - #area <area-id> stub no-summary


OSPF Graceful Restart / Non Stop Forwarding
- enabled by default after 12.4(6)T - disable with command:
#nsf [cisco | ietf] helper disable


OSPF Basic Configuration


#interface fa0/0
#ip address 192.168.1.1 255.255.255.0
#ip ospf priority 100
!0 to 255 - higher is better, governs DR election.
#ip ospf dead-interval minimal hello-multiplier 4
! This sets the dead timer to 1 second and sends hellos every 0.25 seconds based on 4 hellos per 1 seconds dead interval. Hello and dead intervals must match for an adjacency to form.


#router ospf 1
#network 192.168.1.0 0.0.0.255 area 0
#router-id 1.1.1.1
#log-adjacency-changes detail


As of 12.3(11)T OSPF can be configured under the interface:


#interface fa0/1
#ip ospf 1 area 0


OSPF Filtering


- Filtering Using Distribute Lists
Only used for inbound filtering of routes (not LSAs)
#ip prefix-list MyPrefix seq 5 deny 192.168.1.0/24
#ip prefix-list MyPrefix seq 10 permit 0.0.0.0/0 le 32

#router ospf 1
#distribute-list prefix MyPrefix in fa0/1
! This configures a prefix list called MyPrefix which denies route 192.168.1.0 /24 and permits all other routes. This is then applied inbound on interface fa0/1

Alternatively it can be done as a route-map.

- LSA-Type 3 Filtering
Used for filter type 3 LSAs on the ABR where they would be created either going in or coming out of an area.

#ip prefix-list MyPrefix seq 5 deny 192.168.1.0/24
#ip prefix-list MyPrefix seq 10 permit 0.0.0.0/0 le 32

#router ospf 1
#area 3 filter-list prefix MyPrefix out

Filtering Type 3 LSAs using "area-range"
Allows route summarization at ABRs, use the "not-advertise" option to prevent the route being advertised.
#router ospf 1
#area 1 range 192.168.1.0 255.255.255.0 not-advertise

- OSPF Virtual Links
#router ospf 1
#area 1 virtual-link 2.2.2.2
#area 1 virtual-link 2.2.2.2 authentication-key <value>
! This means create a virtual link across area 1 with router with RID 2.2.2.2. The authentication section is optional


- OSPF Authentication
Configured at the interface level with the ip ospf authentication command
Type 0 - No authentication - ip ospf authentication null
Type 1 - Clear Text - ip ospf authentication and ip ospf authentication-key <key>Type 2 - MD5 - ip ospf authentication message-digest and ip ospf message-digest key <key> md5 <key-value>

Alternatively it can be enabled under the OSPF process for all interfaces in that area:
#router ospf 1
#area 0 authentication [message-digest]

- OSPF Stub Router Configuration
Allows an ASBR to wait before announcing transit routes:
#router ospf 1
#max-metric router-lsa on-startup
or
#max-metric router-lsa on-startup wait-for-bgp



Chapter 9 - IGP Route Redistribution, Route Summarization, Default Routing and Troubleshooting

Administrative Distance:

Connected = 0
Static = 1
EIGRP summary route = 5
EBGP = 20
EIGRP (internal) = 90
IGRP = 100
OSPF = 110
IS-IS = 115
RIP = 120
EIGRP (external) = 170
iBGP = 200
Unreachable 255

- Route Redistribution

#router eigrp 1
#redistribute ospf 1 metric 1544 5 255 1 1500
#no auto-summary
! redistribute routes learned from ospf process 1 into eigrp process 1 using the defined values. No auto-summary is used so that subnets are redistributed.


Metric can be set by one of these three methods (in this order of preference)

1. Call a route-map from the redistribute command
2. Use a metric option on the redistribute command
3. Use the default-metric command under the router command 

To change the OSPF AD:

#router ospf 1
#distance ospf [external | internal] 150

You can also configure distance based on a neighbour or a set of learned routes:

#distance  {distance-value ip-address {wildcard-mask} [ip-standard-list] [ip-extended-
  list] 

- IGP Order of preference (considered before metric)
EIGRP - Internal then external
OSPF - Intra-area, inter-area, E1 then E2
ISIS - L1, L2 then external

- EIGRP Route Summarization:
#interface fa0
#ip summary-address eigrp as-number network-address subnet-mask [admin-distance]

- OSPF Route Summarization:

On ABR:
#area area-id range ip-address mask [advertise | not-advertise] [cost cost]

On ABSR:
#summary-address {{ip-address mask} | {prefix mask}} [not-advertise] [tag tag]

- IP classless:
If ip classless is configured a packet which does not have a match with destination in the routing table will be forwarded to the default route. If no ip classless is configured the router will check to see if any part of the destination network's classful network is in the routing table and if so it will not use the default route. 

default-information originate can be used in OSPF to advertise a default route if 0.0.0.0/0 exists in the routing table. Use the keyword always to originate the route even if 0.0.0.0/0 is not in the routing table.

ip-default-network <net-number> is used to inject a default route when the net-number is present in the routing table

- Creating Default Summary Routes
#interface fa0/0
#ip summary-address eigrp 1 0.0.0.0 0.0.0.0 <admin-distance>




Chapter 10 - Fundamentals of BGP Operations

BGP router id is defined as follows:
 - bgp router-id command
 - Highest IP of up/up loopback interface
 - Highest IP of other interface

BGP Neighbour States:


  • Idle
  • Connect
  • Active
  • Open Sent
  • Open Confirm
  • Established
BGP Message Types:
  • Open
  • Keepalive
  • Update 
  • Notification




=-=-=-




pg 403