Friday, 26 October 2012

Retrieve Cisco Config with wget

On the router or switch:

#conf t
#ip http server
#ip http authentication local
#username cisco priv 15 pass cisco

Then on your PC:

wget --user cisco --password cisco http://192.168.0.1/level/15/exec/show/running-config/view/full  -O cisco-config.txt

(substitute your IP address for 192.168.0.1). 


Show Tech-support:

wget --user cisco --password cisco http://192.168.0.1/level/15/exec/show/tech-support/CR  -O show-tech.txt

PPP Multilink


username R2 password 0 cisco
! Configure a user account with the hostname of the peer and a matching password
interface Multilink1
 ip address 1.1.1.1 255.255.255.252
 ppp multilink
 ppp multilink group 1
!
interface Serial0/1
 no ip address
 encapsulation ppp
 clock rate 2000000
 ppp authentication chap
 ppp multilink
 ppp multilink group 1
!
interface Serial0/2
 no ip address
 encapsulation ppp
 clock rate 2000000
 ppp authentication chap
 ppp multilink
 ppp multilink group 1

=====================

username R1 password 0 cisco
!
interface Multilink1
 ip address 1.1.1.2 255.255.255.252
 ppp multilink
 ppp multilink group 1
!
interface Serial0/1
 no ip address
 encapsulation ppp
 clock rate 2000000
 ppp authentication chap
 ppp multilink
 ppp multilink group 1
!
interface Serial0/2
 no ip address
 encapsulation ppp
 clock rate 2000000
 ppp authentication chap
 ppp multilink
 ppp multilink group 1

=====================


R1#show ppp multilink

Multilink1, bundle name is R2
  Username is R2
  Endpoint discriminator is R2
  Bundle up for 00:01:29, total bandwidth 4632, load 1/255
  Receive buffer limit 36000 bytes, frag timeout 1000 ms
    0/0 fragments/bytes in reassembly list
    0 lost fragments, 0 reordered
    0/0 discarded fragments/bytes, 0 lost received
    0x4 received sequence, 0x9 sent sequence
  Member links: 2 active, 0 inactive (max not set, min not set)
    Se0/1, since 00:01:29
    Se0/2, since 00:01:29
No inactive multilink interfaces


R2#show interface multilink1
Multilink1 is up, line protocol is up
  Hardware is multilink group interface
  Internet address is 1.1.1.2/30
  MTU 1500 bytes, BW 3088 Kbit/sec, DLY 100000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation PPP, LCP Open, multilink Open
  Open: IPCP, CDPCP, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 2 seconds on reset
  Last input 00:00:52, output never, output hang never
  Last clearing of "show interface" counters 00:36:36
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     1071 packets input, 117686 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     1078 packets output, 132324 bytes, 0 underruns
     0 output errors, 0 collisions, 5 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

#debug ppp authentication

Thursday, 25 October 2012

Switch Based Access Control

  • Control access to and from devices in the same VLAN using MAC address:
#conf t
#vlan access-map MAC_DENY 10
#action drop
#match mac address MAC_DENY_ACL

#mac access-list extended MAC_DENY_ACL

#permit host 0000.0000.0001 host 0000.0000.0002

#vlan filter MAC_DENY vlan-list 100


This means traffic from 0000.0000.0001 to 0000.0000.0002 will be dropped in VLAN 100



  • Control access to and from devices in the same VLAN using IP address:
#conf t

#vlan access-map IP_DENY 10
#action drop
#match ip address 150

#access-list 150 permit ip host 192.168.199.1 host 192.168.199.2

#vlan filter IP_DENY vlan-list 100

This means traffic from 192.168.199.1 to  192.168.199.2 will be dropped in VLAN 100

Thursday, 2 August 2012

RIP over GRE Tunnel with QoS Configuration

In this configuration I have 4 routers R1, R2, R3 and R4. R2 and R3 run External BGP. There is also a GRE tunnel running between R2 and R3 over which we run RIP. R1 and R4 also run RIP. QoS configuration is applied to the tunnel interface via a service policy which shapes the traffic based on which access list it matches. 
This configuration was made on GNS3 with 2691 routers running C2691-ADVENTERPRISEK9-M. 
Irrelevant parts of the config below have been omitted for brevity.


=~=~=~=~=~=~=~=~=~=~=~= R1=~=~=~=~=~=~=~=~=~=~=~=
hostname R1
!
! Two loopback interfaces to allow us to differentiate the traffic for the class-maps
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface Loopback1
 ip address 11.11.11.11 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 speed 100
 full-duplex
!
interface FastEthernet0/1
 ip address 192.168.0.1 255.255.255.0
 duplex auto
 speed auto
!
! We run RIP to learn routes from R2
router rip
 version 2
 network 1.0.0.0
 network 11.0.0.0
 network 192.168.0.0
 network 192.168.1.0
 no auto-summary
!

=~=~=~=~=~=~=~=~=~=~=~= R2=~=~=~=~=~=~=~=~=~=~=~=
hostname R2
We create two class-maps which match named access lists
class-map match-all CMAP_MATCH11
 match access-group name MATCH11
class-map match-all CMAP_MATCH1
 match access-group name MATCH1
!
We have a policy-map which assigns 8K and 512K to each respective class-map.
! The overall method of the policy maps says, if you match ACL MATCH1 then you 
! will be allocated 8K of bandwidth, if you match ACL MATCH11 then you will get 
! 512K of bandwidth
policy-map TUNNEL
 class CMAP_MATCH1
  shape average 8000
 class CMAP_MATCH11
  shape average 512000
 class class-default
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
We have a tunnel interface with a service policy applied
interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 tunnel source Loopback0
 tunnel destination 3.3.3.3
 service-policy output TUNNEL
!
interface FastEthernet0/0
 ip address 192.168.1.254 255.255.255.0
 speed 100
 full-duplex
!
interface FastEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 speed 100
 full-duplex
We run RIP over the LAN and tunnel interfaces only
router rip
 version 2
 passive-interface default
 no passive-interface FastEthernet0/0
 no passive-interface Tunnel0
 network 10.0.0.0
 network 192.168.1.0
 no auto-summary
! BGP to R3 to carry the tunnel
router bgp 1
 no synchronization
 bgp log-neighbor-changes
 redistribute connected
 neighbor 192.168.2.254 remote-as 2
 neighbor 192.168.2.254 next-hop-self
 no auto-summary
!
! ACLs to match the source and destination loopbacks
ip access-list extended MATCH1
 permit ip host 1.1.1.1 host 4.4.4.4
ip access-list extended MATCH11
 permit ip host 11.11.11.11 host 44.44.44.44
!
!
=~=~=~=~=~=~=~=~=~=~=~= R3 =~=~=~=~=~=~=~=~=~=~=~=
hostname R3
!
!
! Class-map, policy-map and ACLs are basically the reverse of R2
class-map match-all CMAP_MATCH44
 match access-group name MATCH44
class-map match-all CMAP_MATCH4
 match access-group name MATCH4
class-map match-all MyClass
!
!
policy-map TUNNEL
 class CMAP_MATCH4
  shape average 8000
 class CMAP_MATCH44
  shape average 512000
 class class-default
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
!
interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 tunnel source Loopback0
 tunnel destination 2.2.2.2
 service-policy output TUNNEL
!
interface FastEthernet0/0
 ip address 192.168.2.254 255.255.255.0
 speed 100
 full-duplex
!
interface FastEthernet0/1
 ip address 192.168.3.1 255.255.255.0
 speed 100
 full-duplex
!
router rip
 version 2
 passive-interface default
 no passive-interface FastEthernet0/1
 no passive-interface Loopback0
 no passive-interface Tunnel0
 network 10.0.0.0
 network 192.168.3.0
 no auto-summary
!
router bgp 2
 no synchronization
 bgp log-neighbor-changes
 redistribute connected
 neighbor 192.168.2.1 remote-as 1
 neighbor 192.168.2.1 next-hop-self
 no auto-summary
!
ip access-list extended MATCH4
 permit ip host 4.4.4.4 host 1.1.1.1
ip access-list extended MATCH44
 permit ip host 44.44.44.44 host 11.11.11.11
!

=~=~=~=~=~=~=~=~=~=~=~= R4 =~=~=~=~=~=~=~=~=~=~=~=
hostname R4
Again, R4 is basically a mirror of R1
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
!
interface Loopback1
 ip address 44.44.44.44 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.3.254 255.255.255.0
 speed 100
 full-duplex
!
interface FastEthernet0/1
 ip address 192.168.4.1 255.255.255.0
 speed 100
 full-duplex
!
router eigrp 1
 network 0.0.0.0
 no auto-summary
!
router rip
 version 2
 network 44.0.0.0
 network 0.0.0.0
 no auto-summary
!

=~=~=~=~=~=~=~=~=~=~=~= Verification~=~=~=~=~=~=~=~=~=~=~=
A ping from R1 lo0 to R4 lo0 goes via the tunnel interface
R1#traceroute 4.4.4.4 source 1.1.1.1

Type escape sequence to abort.
Tracing the route to 4.4.4.4

  1 192.168.1.254 48 msec 24 msec 16 msec
  2 10.0.0.2 44 msec 44 msec 28 msec
  3 192.168.3.254 96 msec *  68 msec

An extended ping with a larger packet size - note the average RTT is 482ms
R1#ping 4.4.4.4 source 1.1.1.1 size 500 rep 50

Type escape sequence to abort.
Sending 50, 500-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (50/50), round-trip min/avg/max = 40/482/1008 ms

An extended ping but this time we specify the other loopbacks as source and destination so we hit the QoS policy with a higher bandwidth - note the much better average RTT of 58ms
R1#ping 44.44.44.44 so 11.11.11.11 size 500 rep 50

Type escape sequence to abort.
Sending 50, 500-byte ICMP Echos to 44.44.44.44, timeout is 2 seconds:
Packet sent with a source address of 11.11.11.11
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (50/50), round-trip min/avg/max = 20/58/92 ms

On R2 if we issue the policy map interface command we see the following. Note how we see delayed packets on the CMAP_MATCH1 class and none on the CMAP_MATCH11 class.
R2#sh policy-map interface
 Tunnel0

  Service-policy output: TUNNEL

    Class-map: CMAP_MATCH1 (match-all)
      361 packets, 184332 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: access-group name MATCH1
      Traffic Shaping
           Target/Average   Byte   Sustain   Excess    Interval  Increment
             Rate           Limit  bits/int  bits/int  (ms)      (bytes)
             8000/8000      2000   8000      8000      1000      1000

        Adapt  Queue     Packets   Bytes     Packets   Bytes     Shaping
        Active Depth                         Delayed   Delayed   Active
        -      0         361       175776    174       87000     no

    Class-map: CMAP_MATCH11 (match-all)
      460 packets, 239040 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: access-group name MATCH11
      Traffic Shaping
           Target/Average   Byte   Sustain   Excess    Interval  Increment
             Rate           Limit  bits/int  bits/int  (ms)      (bytes)
          5120000/5120000   32000  128000    128000    25        16000

        Adapt  Queue     Packets   Bytes     Packets   Bytes     Shaping
        Active Depth                         Delayed   Delayed   Active
        -      0         460       228000    0         0         no

    Class-map: class-default (match-any)
      139 packets, 15568 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any


Monday, 16 July 2012

Multi VRF

The configuration below shows how to configure the PE and CE routers to extend a VRF to a customer site. This allows a CE (customer) router to support two separate routing tables. This configuration was created on GNS3 with IOS version c2691-adventerprisek9-mz.124-25d.bin. Parts of the configuration below have been omitted for brevity:


! PE (Provider Edge) Router Configuration

!
hostname PE-Router
!
! Create two VRFs 
ip vrf VRF1
 rd 1:100
 route-target export 1:100
 route-target import 1:100
!
ip vrf VRF2
 rd 2:100
 route-target export 2:100
 route-target import 2:100
!
! Create a loopback interface to act as the BGP router ID, note it is not part of
! a vrf
interface Loopback0
 ip address 100.1.1.1 255.255.255.255
!
! Create two more loopback interfaces, one in each VRF. This was just done to 
! illustrate that you can use overlapping address space
interface Loopback1
 ip vrf forwarding VRF1
 ip address 1.1.1.1 255.255.255.255
!
interface Loopback2
 ip vrf forwarding VRF2
 ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
 no ip address
 speed 100
 full-duplex
!
! Create two subinterface with a dot1q tag and assign to each vrf
interface FastEthernet0/0.1
 encapsulation dot1Q 1 native
 ip vrf forwarding VRF1
 ip address 192.168.1.1 255.255.255.0
!
interface FastEthernet0/0.2
 encapsulation dot1Q 2
 ip vrf forwarding VRF2
 ip address 192.168.2.1 255.255.255.0
!
! Configure the BGP section
router bgp 1
 no synchronization
 bgp router-id 100.1.1.1
 bgp log-neighbor-changes
 no auto-summary
 !
 address-family ipv4 vrf VRF2
  redistribute connected
  neighbor 192.168.2.254 remote-as 100
  neighbor 192.168.2.254 activate
  no synchronization
 exit-address-family
 !
 address-family ipv4 vrf VRF1
  redistribute connected
  neighbor 192.168.1.254 remote-as 100
  neighbor 192.168.1.254 activate
  no synchronization
 exit-address-family
!

===============================================================


! CE (Customer Edge) Router Configuration

!
hostname CE-Router
!
! On this router we just create one VRF - the other received routes are going
! to go into the global routing table
ip vrf VRF2
 rd 2:100
!
interface FastEthernet0/0
 no ip address
 speed 100
 full-duplex
!
! Create subinterfaces with dot1q tags - note that only Fa0/0.2 has
! a vrf forwarding statement
interface FastEthernet0/0.1
 encapsulation dot1Q 1 native
 ip address 192.168.1.254 255.255.255.0
!
interface FastEthernet0/0.2
 encapsulation dot1Q 2
 ip vrf forwarding VRF2
 ip address 192.168.2.254 255.255.255.0
!
interface FastEthernet0/1
 no ip address
 speed 100
 full-duplex
!
! BGP configuration - note how one neighbour statement is in the global
! section and one is in the "address-family ipv4" section
router bgp 100
 no synchronization
 bgp log-neighbor-changes
 redistribute connected
 neighbor 192.168.1.1 remote-as 1
 no auto-summary
 !
 address-family ipv4 vrf VRF2
  redistribute connected
  neighbor 192.168.2.1 remote-as 1
  neighbor 192.168.2.1 activate
  no synchronization
 exit-address-family
!

===============================================================

On the PE router:

! Only the loopback0 interface is in the global routing table
PE-Router#sh ip ro
     100.0.0.0/32 is subnetted, 1 subnets
C       100.1.1.1 is directly connected, Loopback0

PE-Router#sh ip route vrf VRF1
     1.0.0.0/32 is subnetted, 1 subnets
C       1.1.1.1 is directly connected, Loopback1
C    192.168.1.0/24 is directly connected, FastEthernet0/0.1

PE-Router#sh ip route vrf VRF2
     1.0.0.0/32 is subnetted, 1 subnets
C       1.1.1.1 is directly connected, Loopback2
C    192.168.2.0/24 is directly connected, FastEthernet0/0.2

PE-Router#sh ip bgp vpnv4 all
BGP table version is 14, local router ID is 100.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 1:100 (default for vrf VRF1)
*> 1.1.1.1/32       0.0.0.0                  0         32768 ?
*  192.168.1.0      192.168.1.254            0             0 100 ?
*>                  0.0.0.0                  0         32768 ?
Route Distinguisher: 2:100 (default for vrf VRF2)
*> 1.1.1.1/32       0.0.0.0                  0         32768 ?
*  192.168.2.0      192.168.2.254            0             0 100 ?
*>                  0.0.0.0                  0         32768 ?

On the CE router:

CE-Router#sh ip ro
     1.0.0.0/32 is subnetted, 1 subnets
B       1.1.1.1 [20/0] via 192.168.1.1, 00:44:36
C    192.168.1.0/24 is directly connected, FastEthernet0/0.1

CE-Router#sh ip route vrf VRF2
     1.0.0.0/32 is subnetted, 1 subnets
B       1.1.1.1 [20/0] via 192.168.2.1, 00:39:49
C    192.168.2.0/24 is directly connected, FastEthernet0/0.2

CE-Router#sh ip bgp summary
BGP router identifier 192.168.1.254, local AS number 100
BGP table version is 4, main routing table version 4
2 network entries using 234 bytes of memory
3 path entries using 156 bytes of memory
3/2 BGP path/bestpath attribute entries using 372 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 786 total bytes of memory
BGP activity 5/1 prefixes, 7/1 paths, scan interval 60 secs

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4     1      54      53        4    0    0 00:45:31        2

CE-Router#sh ip bgp vpnv4 all
BGP table version is 7, local router ID is 192.168.1.254
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 2:100 (default for vrf VRF2)
*> 1.1.1.1/32       192.168.2.1              0             0 1 ?
*  192.168.2.0      192.168.2.1              0             0 1 ?
*>                  0.0.0.0                  0         32768 ?


Friday, 6 July 2012

VRF Lite

VRF Lite (I hate the word lite - a real toe-curling Americanism - can't we call it VRF Basic or VRF - Beginner's Edition?) is a way of using VRF on a router without BGP.
In its simplest form VRF is a way of creating separate forwarding instances and routing tables on a single router. Different customers can then connect to the same router via different interfaces and all traffic is kept separate. Different customer can even have overlapping address spaces because each VRF gets its own routing table. 
The configuration below was created in GNS3, the routers are 2961s and the IOS version used is: c2691-adventerprisek9-mz.124-25d.bin.


I have only included the config for R3 here as that is the thing doing the VRF bit. There is nothing unusual about the configs for the other routers - to them they are not aware that VRF is taking place. R1 and R4 are part of Site_A and R2 and R5 are part of Site_B. Irrelevant bits of the R3 config have been omitted for brevity.

!
hostname R3
!
ip cef
!
!
! Create two VRF instances for our two sites with different route distinguishers
ip vrf Site_A
 rd 100:1
!
ip vrf Site_B
 rd 100:2
!
! This interface is in VRF Site_A
interface FastEthernet0/0
 ip vrf forwarding Site_A
 ip address 10.0.0.254 255.255.255.0
 duplex auto
 speed auto
!
This interface is in VRF Site_B
 interface Serial0/0
 ip vrf forwarding Site_B
 ip address 10.0.1.254 255.255.255.0
 clock rate 8000000
!
This interface is in VRF Site_A

interface FastEthernet0/1
 ip vrf forwarding Site_A
 ip address 192.168.0.254 255.255.255.0
 duplex auto
 speed auto
!
This interface is in VRF Site_B - note how it uses the same address as Fa0/1
interface FastEthernet1/0
 ip vrf forwarding Site_B
 ip address 192.168.0.254 255.255.255.0
 speed 100
 full-duplex
!
! We enable EIGRP for Site_A, note how the majority of the configuration now goes under
! "address-family ipv4" section

router eigrp 1 auto-summary
 !
 address-family ipv4 vrf Site_A
  network 10.0.0.0
  network 192.168.0.0
  no auto-summary
  autonomous-system 1
 exit-address-family
!
! We enable OSPF for Site_B - looks a bit different than the EIGRP bit doesn't it?

router ospf 1 vrf Site_B
 log-adjacency-changes
 network 10.0.1.0 0.0.0.255 area 0
 network 192.168.0.0 0.0.0.255 area 0
!
!
end

That is it for the config side of thing. Some show commands to illustrate the point:

Show ip route on the router shows no routes, not even connected ones, this is because all interfaces are part of a VRF so the global routing table has no visibility of them.

R3#sh ip ro
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

R3#


Ah, this is more like it - now we can see all the routes for Site_A VRF including connected interfaces. Note the "D" showing that we have EIGRP learned routes

R3#sh ip ro vrf Site_A

Routing Table: Site_A
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     4.0.0.0/32 is subnetted, 1 subnets
D       4.4.4.4 [90/409600] via 192.168.0.1, 01:01:18, FastEthernet0/1
     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.0.0 is directly connected, FastEthernet0/0
C    192.168.0.0/24 is directly connected, FastEthernet0/1

We see something similar for Site_B, note the "O" for OSPF learned routes

R3#sh ip ro vrf Site_B

Routing Table: Site_B
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     5.0.0.0/32 is subnetted, 1 subnets
O       5.5.5.5 [110/2] via 192.168.0.1, 00:46:17, FastEthernet1/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.1.0 is directly connected, Serial0/0
C    192.168.0.0/24 is directly connected, FastEthernet1/0

Show ip EIGRP neighbours on R3 shows no neighbours, again because they are part of the VRF rather than global to the router (am I labouring the point a bit..?)

R3#sh ip eigrp neighbors
IP-EIGRP neighbors for process 1

Here they are:

R3#sh ip eigrp vrf Site_A neighbors
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
1   10.0.0.1                Fa0/0             11 01:03:41  206  1236  0  15
0   192.168.0.1             Fa0/1             14 01:09:27   41   246  0  8

This is a handy command too:

R3#sh ip vrf interfaces
Interface              IP-Address      VRF                              Protocol
Fa0/1                  192.168.0.254   Site_A                           up
Fa0/0                  10.0.0.254      Site_A                           up
Fa1/0                  192.168.0.254   Site_B                           up
Se0/0                  10.0.1.254      Site_B                           up

Thursday, 5 July 2012

Cisco NAT with multiple WAN connections

With reference to: 
https://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a00808d2b72.shtml


This configuration allows you to run NAT over two WAN connections and load balance over them. Created and tested in GNS3. An example of where you would use this is if you had a single router connected to two different service providers and you wanted to NAT over both of them for load balancing. Should one of them go down NAT should continue to work over the other connection (though in practice I found that if you had an active NAT translation over one connection and you pulled that WAN link it would not failover automatically and you would have to kill that session and restart it - I was using pretty old IOS on GNS3 though).
It is not shown here but you can control which source address gets NAT'ted on which connection through the use of policy routing.


! Create two ip sla monitors to track the next hop of each WAN connection
ip sla monitor 1
 type echo protocol ipIcmpEcho 123.123.123.2 source-interface FastEthernet0/0
 timeout 1000
 threshold 40
 frequency 3
ip sla monitor schedule 1 life forever start-time now
ip sla monitor 2
 type echo protocol ipIcmpEcho 124.124.124.2 source-interface FastEthernet1/0
 timeout 1000
 threshold 40
 frequency 3
ip sla monitor schedule 2 life forever start-time now
!
!
! Create two tracking objects to track the state of the ip sla monitors
track timer interface 5
!
track 123 rtr 1 reachability
 delay down 15 up 10
!
track 345 rtr 2 reachability
 delay down 15 up 10
!
Fa0/0 defined as an outside NAT interface
interface FastEthernet0/0
 description WAN Connection 1
 ip address 123.123.123.1 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
Fa0/1 defined as an inside NAT interface
interface FastEthernet0/1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
Fa1/0 defined as an outside NAT interface
interface FastEthernet1/0
 description WAN Connection 2
 ip address 124.124.124.1 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 speed 100
 full-duplex
!
! Static routes configured to follow the tracked objects
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 123.123.123.2 track 123
ip route 0.0.0.0 0.0.0.0 124.124.124.2 track 345
!
! NAT overload statements for each WAN interface referencing their own 
! route-map
ip nat inside source route-map nat1 interface FastEthernet0/0 overload
ip nat inside source route-map nat2 interface FastEthernet1/0 overload
!
! ACL defining the "inside" network
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
!
! Route-map referencing the ACL and matching one interface
route-map nat2 permit 10
 match ip address 100
 match interface FastEthernet1/0
!
Route-map referencing the same ACL and matching the other interface
route-map nat1 permit 10
 match ip address 100
 match interface FastEthernet0/0
!