Friday, May 25, 2012

IPv6

IPv6 has 128 bits and three types: unicast, multicast and anycast.  Unicast and multicast act the same way as they do in IPv4, anycast is the new type and allows multiple interfaces to have the same address and works by the nearest interface answering the request.

IPv6 Special Addresses

  • Global Unicast - similar to IPv4 publicly routed addresses, start with 2000::/3
  • Link-Local- address for one-one communication not routed internally, starts with FE08:/10
  • Unique-Local- similar to IPv4 private routed addresses, starts with FC00::/7
  • Multicast- similar to IPv4 multicast, starts with FF00::/8
  • Local Host- 0:0:0:0:0:0:0:1
  • DHCP stateful - 0:0:0:0:0:0:0:0
  • IPv6 Mix-mode- 0:0:0:0:0:0:192.168.0.1
  • 6 to 4 Tunneling - 2002::/16

Auto configuration

In IPv6, a host machine has the ability to address themselves with a link-local address and a global unicast address. Stateless auto configuration works by contacting the router getting prefix ID, similar to network ID in IPv4 and using its MAC address padded with 16 bytes, eui-64. Stateless auto-configuration does have one drawback, it doesn't automatically get DNS information from the router.


  1. The host sends out a router solicitation (RS) message to all routers using a multicast address requesting pre-fix information.
  2. The router answers the RS with a router advertisement (RA) including the prefix ID using multicast  as well, RAs are sent out periodically. 


Configuring IPv6 

Router(config)# ipv6 unicast-routing
Router(config-if)#  ipv6 address 2001:db8:3c4d:1::/64 eui-64



ICMPv6 works pretty much the same way it does in IPv6 but it's not a individual layer 3 protocol anymore, it's built into IPv6. My default ICMPv6 prevents fragmentation using MTU discovery. ARP isn't used anymore with IPv6 to discover machines MAC addresses, ICMP neighbor discovery (ND) sends out multicast to host who then reply back with their layer 2 addresses. multicast Listener Discovery has replaced IGMP to notify routers that a host has join a multicast group.

RIPng fundamentally works the same in IPv6 , still uses 15 hops, sends its whole routing table periodically has split-horizon and route poisoning.  Instead of using multicast addresses 224.0.0.9 for updates RIPng uses FF02::9 RIPng is configured at the interface level while additional commands can still be configured at the router level. Words can also be used to ID the router process .

Router(config-if)# ipv6 rip [NUM or WORD ] enable

Router(config)# ipv6 router rip 1


EIGRPv6 works the same as regular EIGRP but is configured differently. EIGRP must be turned on with no shutdown command and configured on each interface instead of using the network command. Instead of using 224.0.0.10 multicast address it uses FF02::A (A=10 in hexadecimal)

Router(config)# ipv6 router eigrp 10
Router(config-rtr)# no shutdown
Router(config-if)# ipv6 eigrp 10


OSPFv3 works the same but is configured different. The RID must be configured manually because RID is a 32 bit field and IPv6 is 128 bits. OSPF is created at the router level along with setting the RID, networks can be added on interfaces. OSPF multicast are sent at FF02::5 (IPv4 224.0.0.5)for OSPF routers and FF02::6 (IPv4 224.0.0.6)for designated routers.


IPv6 Migration 



  • Dual Stacking - allows devices to use both IPv4 and IPv6 simultaneously 
  • 6to4 Tunneling- allows IPv6 network to communicate across IPv4 networks, teredo allows tunnel to use UDP packets to get past NAT





Sunday, May 20, 2012

Frame Relay with OSPF



Using a similar topology from previous Frame Relay lab, I created a OSPF environment . Frame Relay by default doesn't forward broadcast or multicast traffic. Adding the broadcast option at the end of frame map statements allows broadcast to be forwarded.

After configuring OSPF on all the routers, I can see with the show ip protocols command that adjacencies haven't formed yet.  The router ID can be verified here, for R1 it took the loopback address as the RID.

R1#show ip protocols
Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 1.1.1.1
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    1.1.1.1 0.0.0.0 area 0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 110)


Neighbors have not established adjacencies as I can see with the show ip ospf neighbor command.

R1#show ip ospf neighbor

R1#





R1 will need additional commands to make OSPF work because even though I set the PVC to broadcast, OSPF won't send hello packets because it knows it's on a NBMA network. Manually setting the neighbors with the neighbor command will get OSPF working.In a hub and spoke enviroment I want to make sure the hub router is the DR, this can be done by setting the ospf interfaces on the other routers to a priority zero. 


R2(config)#interface serial 0/0
R2(config-if)#ip ospf priority 0

R3(config)#interface serial 0/0
R3(config-if)#ip ospf priority 0


R1(config-router)#neighbor 172.12.123.2
R1(config-router)#neighbor 172.12.123.3
R1(config-router)#
*Mar  1 00:07:50.767: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Serial0/0 from LOADING to FULL, Loading Done
R1(config-router)#
R1#
R1#show
*Mar  1 00:08:28.168: %SYS-5-CONFIG_I: Configured from console by console
R1#show
*Mar  1 00:08:30.768: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial0/0 from LOADING to FULL, Loading Done


Here the two neighbors can be seen as DR/OTHER meaning they aren't DR or BDR and R1 is the only DR.

R1#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/DROTHER    00:01:53    172.12.123.2    Serial0/0
3.3.3.3           0   FULL/DROTHER    00:01:43    172.12.123.3    Serial0/0


R3#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
1.1.1.1           1   FULL/DR         00:01:39    172.12.123.1    Serial0/0

All routes are learned from LSAs that the DR sends when needed. The show ip route ospf displays the routes learned from OSPF. 

R1#show ip route ospf
     2.0.0.0/32 is subnetted, 1 subnets
O       2.2.2.2 [110/65] via 172.12.123.2, 00:01:16, Serial0/0
     3.0.0.0/32 is subnetted, 1 subnets
O       3.3.3.3 [110/65] via 172.12.123.3, 00:01:16, Serial0/0
     10.0.0.0/24 is subnetted, 2 subnets
O       10.2.2.0 [110/65] via 172.12.123.3, 00:01:16, Serial0/0
O       10.1.1.0 [110/65] via 172.12.123.2, 00:01:16, Serial0/0


Friday, May 18, 2012

Frame Relay Basics

Frame Relay is a popular WAN technology that is cost-effective compared with lease-lines using PPP or HDLC. Frame Relay is a packet-switching network , meaning it doesn't take the same path each time to send data . Frame Relay networks by default are NBMA (non-broadcast multi-access networks) and are made up of hundreds of FR switches. Understanding the FR cloud isn't important because the ISP maintains it, understanding how to tie into the FR cloud is vital. 

Frame Relay uses virtual circuits to send data across the FR cloud. The two types are private virtual circuits (PVC) and switch private circuits (SVC). PVC are more commonly used because they are always up and ready to send data while SVC are up only when data is needed to be sent.

These PVCs are establishment between DTEs while traversing the Frame Relays DCE equipment. Frame Relay uses local management interface (LMI) messages as an heartbeat to keep virtual circuits alive . These keepalives must match between my DTE to the FR's DCE. Cisco routers support three types of LMIs;

  • Cisco
  • Ansi
  • Q933a

Cisco also has an auto-sense feature that sends out all three type of LMIs and configures itself depending on how the FR DCE answers. LMIs are only half of the story.

Data-link Connection Identifiers (DLCIs) are local significant addresses used to identify a PVC to a remote DTE. DLCI addresses are given by the service provider and must be correctly configured to map remote networks.




Configuring Frame Relay on a serial interface requires a couple of steps, first the encapsulation must be changed to frame relay, there are two types of FR encapsulations cisco and ietf, default is Cisco.
Turning frame-relay inverse is a good idea because Frame Relay networks are more stable when manually mapping DLCIs then letting inverse-arp discover the mappings. Mapping frame relay we need the protocol(IP), remote IP address (172.12.123.2 ), local DLCI (112) and broadcast command if broadcasts will be needed across the PVC. 


R1(config)#interface serial 0/0
R1(config-if)#encapsulation frame-relay
R1(config-if)#ip address 172.12.123.1 255.255.255.0
R1(config-if)#frame map ip 172.12.123.2 112 broadcast
R1(config-if)#frame map ip 172.12.123.3 113 broadcast
R1(config-if)#no frame-relay inverse-arp
R1(config-if)#no shutdown

The show frame-relay map command can be used to determine the status of PVCs, LMI type, topology, PVC state;


  • Inactive -problem at the remote DTE
  • Active - DTE to DTE correctly configured
  • Deleted - Local DLCI problem with FR DCE


R1#show frame map
Serial0/0 (up): ip 172.12.123.2 dlci 112(0x70,0x1C00), static,
              broadcast,
              CISCO, status defined, inactive
Serial0/0 (up): ip 172.12.123.3 dlci 113(0x71,0x1C10), static,
              broadcast,
              CISCO, status defined, inactive



R2(config)#interface serial 0/0
R2(config-if)#encapsulation frame-relay
R2(config-if)#no frame inverse-arp
R2(config-if)#ip address 172.12.123.2 255.255.255.0
R2(config-if)#frame map ip 172.12.123.1 221 broadcast
R2(config-if)#frame map ip 172.12.123.3 321 broadcast
R2(config-if)#no shutdown

R2#show frame map
Serial0/0 (up): ip 172.12.123.1 dlci 221(0xDD,0x34D0), static,
              broadcast,
              CISCO, status defined, active
Serial0/0 (up): ip 172.12.123.3 dlci 321(0x141,0x5010), static,
              broadcast,
              CISCO, status defined, inactive



R2#ping 172.12.123.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.12.123.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/34/56 ms

R2#ping 172.12.123.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.12.123.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)


R3(config)#interface serial 0/0
R3(config-if)#encapsulation frame-relay
R3(config-if)#no frame-relay inverse-arp
R3(config-if)#ip address 172.12.123.3 255.255.255.0
R3(config-if)#frame map ip 172.12.123.1 321 broadcast
R3(config-if)#frame map ip 172.12.123.2 321 broadcast
R3(config-if)#no shutdown

R3#show frame map
Serial0/0 (up): ip 172.12.123.1 dlci 321(0x141,0x5010), static,
              broadcast,
              CISCO, status defined, active
Serial0/0 (up): ip 172.12.123.2 dlci 321(0x141,0x5010), static,
              broadcast,
              CISCO, status defined, active


Both PVCs are configured correctly between DTEs and I can verified by pinging both remote routers

R3#ping 172.12.123.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.12.123.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/28/44 ms

R3#ping 172.12.123.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.12.123.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/32/36 ms


Another way to verified Frame Relay is using the show frame lmi command, If sent is higher (increasing )than recd (unchanged) LMIs and if timeouts are increasing, there is a problem with the PVC.

R1#show frame lmi

LMI Statistics for interface Serial0/0 (Frame Relay DTE) LMI TYPE = ANSI
  Invalid Unnumbered info 0             Invalid Prot Disc 0
  Invalid dummy Call Ref 0              Invalid Msg Type 0
  Invalid Status Message 0              Invalid Lock Shift 0
  Invalid Information ID 0              Invalid Report IE Len 0
  Invalid Report Request 0              Invalid Keep IE Len 0
  Num Status Enq. Sent 8                Num Status msgs Rcvd 8
  Num Update Status Rcvd 0              Num Status Timeouts 0
  Last Full Status Req 00:00:30         Last Full Status Rcvd 00:00:30

The command show frame pvc will summarized PVC information including ,PVC states, local DLCIs ,interfaces and FECN/BECN/DE bits. Forward Explicit Congesntion Notification (FECN) sets a notification bit on frames going to the remote router that there in congestion in the FR cloud and it needs to slow down, while Backwards Explicit Congestion Notification (BECN) sets a bit back to the sending router that there is congestion in the FR cloud and to slow down. The Discard Eligibility (DE) set a discard bit on frames (unimportant) so that if frames must be discarded these frames will be discarded first.

R1#show frame pvc

PVC Statistics for interface Serial0/0 (Frame Relay DTE)

              Active     Inactive      Deleted       Static
  Local          2            0            0            0
  Switched       0            0            0            0
  Unused         0            0            0            0

DLCI = 112, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0/0

  input pkts 0             output pkts 0            in bytes 0
  out bytes 0              dropped pkts 0           in pkts dropped 0
  out pkts dropped 0                out bytes dropped 0
  in FECN pkts 0           in BECN pkts 0           out FECN pkts 0
  out BECN pkts 0          in DE pkts 0             out DE pkts 0
  out bcast pkts 0         out bcast bytes 0
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
  pvc create time 00:15:52, last time pvc status changed 00:15:52

DLCI = 113, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0/0

  input pkts 0             output pkts 0            in bytes 0
  out bytes 0              dropped pkts 0           in pkts dropped 0
  out pkts dropped 0                out bytes dropped 0
  in FECN pkts 0           in BECN pkts 0           out FECN pkts 0
  out BECN pkts 0          in DE pkts 0             out DE pkts 0
  out bcast pkts 0         out bcast bytes 0
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
  pvc create time 00:15:55, last time pvc status changed 00:15:55




Network Address Translation (NAT)

Network address translation allows a set of private IP addresses to be translated into another IP address or  addresses, normally publicly routed addresses. This ability comes in handy when there aren't enough public IPv4 addresses to support a large network or when switching internet service providers. Cisco supports three types of NATs static, dynamic and overload (PAT).

Static one-to-one mapping  of a private address to a public address
Dynamic many-to-many mapping of  private addresses to a pool of public addresses
PAT many-to-one mapping of a group of private addresses to a public address using port numbers

NAT terms that describe the type of address doing the translation:

Inside local- private IP address before translation
Inside global- public address at the router's interface
Outside local- private IP address after translation
Outside global- destination host address




Router(config)#ip nat inside source static 10.1.1.2 172.16.1.1
Router(config)#int fastEthernet 0/0
Router(config-if)#ip nat outside
Router(config-if)#int fastEthernet 0/1
Router(config-if)#ip nat inside




Verifying NAT translations with show ip nat translations

Inside global = 172.16.1.1 private address after translation
Inside local = 10.1.1.2 private address before translation



Router#show ip nat translations 
Pro  Inside global     Inside local       Outside local      Outside global
icmp 172.16.1.1:8      10.1.1.2:8         192.168.10.2:8     192.168.10.2:8
icmp 172.16.1.1:9      10.1.1.2:9         192.168.10.2:9     192.168.10.2:9


If I wanted to allow the entire 10.1.1.0 network translated to the 172.16.1.0 network , dynamic NAT is the way to go. Dynamic NAT allows pools of addresses to be translated one-to-one, one private to one NAT address.  Access-list are used in Dynamic NAT to specify the range of hosts needing translation.

Router(config)#access-list 10 permit 10.1.1.0 0.0.0.255
Router(config)#ip nat pool Ant 172.16.1.1 172.16.1.254 netmask 255.255.255.0

Router(config)#ip nat inside source list 10 pool Ant
Router(config)#int fastethernet 0/0
Router(config-if)#ip nat inside
Router(config-if)#int fastethernet 0/1
Router(config-if)#ip nat outside


Below I can see that each client in the 10.1.1.0 network got translated to a different NAT address in the 172.16.1.0 network.


Router#show ip nat translations
Pro  Inside global     Inside local       Outside local      Outside global
icmp 172.16.1.1:7      10.1.1.2:7         192.168.10.2:7     192.168.10.2:7
icmp 172.16.1.2:7      10.1.1.3:7         192.168.10.2:7



If I had more private IP addresses that need to be translated then I  had public addresses , I would use NAT overload or PAT . PAT is setup very similar to dynamic NAT with the exception of one extra command, overload.


Router(config)#access-list 10 permit 10.1.1.0 0.0.0.255
Router(config)#ip nat pool Ant 172.16.1.1 172.16.1.1 netmask 255.255.255.0

Router(config)#ip nat inside source list 10 pool Ant overload
Router(config)#int fastethernet 0/0
Router(config-if)#ip nat inside
Router(config-if)#int fastethernet 0/1
Router(config-if)#ip nat outside



Below I can see that both client are using 172.16.1.1 but on different port numbers.


Router#show ip nat translations 
Pro  Inside global     Inside local       Outside local      Outside global
icmp 172.16.1.1:15     10.1.1.2:15        192.168.10.2:15    192.168.10.2:15
icmp 172.16.1.1:20     10.1.1.3:20        192.168.10.2:20    192.168.10.2:20


Router#show ip nat statistics 
Total translations: 0 (0 static, 0 dynamic, 0 extended)
Outside Interfaces: FastEthernet0/1
Inside Interfaces: FastEthernet0/0.10
Hits: 15  Misses: 38
Expired translations: 9
Dynamic mappings:
-- Inside Source
access-list 10 pool Ant refCount 0
 pool Ant: netmask 255.255.255.0
       start 172.16.1.1 end 172.16.1.1
       type generic, total addresses 1 , allocated 0 (0%), misses 0

Tuesday, May 15, 2012

Access Control List

Security is a very important topic when discussing a well designed network.  Trusted and untrusted areas can be created with a layer three device using access control lists (ACL). Cisco has two types of access control lists , standard and extended.

Standard  (1-99, 1300-1999)  filters traffic using only the source IP address

Extended (100-199, 2000-2699) filters traffic on both source and destination IP address as long with protocol (network layer) and port numbers (transport layer)

Once a ACL is created it must be applied to an interface, inbound or outbound. ACLs have a  implicit deny all at the end of each access list , permit statements are needed or no traffic will pass through interface. ACLs are read from top to bottom, adding entries will put them at the end of the list.

In this example sales department shouldn't have access to marketing but should have access to the internet and finance. A standard access-list will be fine because I'm filtering only by source network.



From the sales PC I ping Marketing  PC before I create and apply ACls.




Sales >ping 172.16.60.2

Pinging 172.16.60.2 with 32 bytes of data:

Reply from 172.16.60.2: bytes=32 time=7ms TTL=127
Reply from 172.16.60.2: bytes=32 time=13ms TTL=127
Reply from 172.16.60.2: bytes=32 time=9ms TTL=127
Reply from 172.16.60.2: bytes=32 time=10ms TTL=127

Ping statistics for 172.16.60.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 7ms, Maximum = 13ms, Average = 9ms

I created a standard ACL closer to the marketing network so that I don't deny Sales from other parts of the network. I used the number 10 to represent a standard access list (1-99) The deny command will prevent the outbound network 172.16.40.0 /24 from getting through interface fe 0/1. Wildcard masks are used in ACL to define a network. The permit any command at the end is need so that other IP traffic can access Marketing. The command ip access-group is used to apply a ACL (outbound or inbound) to an interface .


R1(config)#access-list 10 deny 172.16.40.0 0.0.0.255 
R1(config)#access-list 10 permit any
R1(config)#int fastethernet 0/1
R1(config-if)#ip access-group 10 out


The show running-config command will show which interface the ACL is applied too



interface FastEthernet0/1
 ip address 172.16.60.1 255.255.255.0
 ip access-group 10 out
 duplex auto
 speed auto
!
interface Ethernet1/0
 ip address 172.16.50.1 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
!
!
access-list 10 deny 172.16.40.0 0.0.0.255
access-list 10 permit any
!



The show ip access-list command will show detail information about the ACLlike how many times it has been hit.


R1#show ip access-lists 10
Standard IP access list 10
    deny 172.16.40.0 0.0.0.255 (3 match(es))
    permit any (4 match(es))




Next I tested the ACL, I pinged the Marketing PC and confirmed the access-list is working .




Sales>ping 172.16.60.2

Pinging 172.16.60.2 with 32 bytes of data:

Reply from 172.16.40.1: Destination host unreachable.
Reply from 172.16.40.1: Destination host unreachable.
Reply from 172.16.40.1: Destination host unreachable.
Reply from 172.16.40.1: Destination host unreachable.

Ping statistics for 172.16.60.2:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Standard ACLs can also be used to prevent telnet/ssh access to a router using the access-class command. Here I want to allow access to my host only 192.168.10.2 and to deny everyone else access to vty 0 4.


R1(config)#access-list 5 permit host 192.168.10.2
R1(config)#line vty 0 4
R1(config-line)#access-class 5 in





In this diagram, I want to allow web access to the finance server from host B only and deny access from everyone else. A standard access-list can only filter by source address so an extended ACL will be used. First I created a statement to allow web traffic to finance server from host b then a statement to deny web traffic from the entire subnet.  Lastly a statement to allow all IP traffic anywhere. Order is important here because if I would have deny the entire subnet first, the packet would never gotten a chance to see the permit statement. I applied the ACL to the interface closest to the source for traffic that is destined outbound.


R1(config)#access-list 101 permit tcp host 192.168.177.2 host 172.22.89.26 eq www
R1(config)#access-list 101 deny tcp 192.168.177.0 0.0.0.255 any eq www
R1(config)#access-list 101 permit ip any any
R1(config)#int fastEthernet 0/0
R1(config-if)#ip access-group 101 in


Sunday, May 13, 2012

Inter-VLAN Routing

VLANs can not communicate outside their subnet without the help of a router or layer 3 switch.  A router's interface can be sub-interfaced to allow multiple VLANs layer three access without using an interface for each VLAN. Each sub-interface on a router will be the default gateway for that subnet. Encapsulation must match on both trunk ports (router/switch) and must be define before IP address can be assigned to sub-interface.



R1(config)#interface fastEthernet 0/0
R1(config-if)#no shutdown

%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

R1(config)#interface fastEthernet 0/0.10

%LINK-5-CHANGED: Interface FastEthernet0/0.10, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.10, changed state to up

R1(config-subif)#encapsulation dot1Q 10
R1(config-subif)#ip address 192.168.10.1 255.255.255.0

R1(config-subif)#interface fastEthernet 0/0.20

%LINK-5-CHANGED: Interface FastEthernet0/0.20, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.20, changed state to up

R1(config-subif)#encapsulation dot1q 20
R1(config-subif)#ip address 192.168.20.1 255.255.255.0


R1(config)#interface fastEthernet 0/1
R1(config-if)#no shutdown

%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

R1(config-if)#interface fastethernet 0/1.100

%LINK-5-CHANGED: Interface FastEthernet0/1.100, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.100, changed state to up

R1(config-subif)#encapsulation dot1q 100
R1(config-subif)#ip address 10.1.1.1 255.255.255.0
R1(config-subif)#interface fastethernet 0/1.120

%LINK-5-CHANGED: Interface FastEthernet0/1.120, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.120, changed state to up
R1(config-subif)#encapsulation dot1q 120
R1(config-subif)#ip address 10.1.2.1 255.255.255.0





OSPF/EIGRP Review Questions



Written Questions


1. What four routed protocols are supported by EIGRP?
2. When is redistribution required for EIGRP?
3. What command would be used to enable EIGRP with an autonomous system number of 300?
4. What command will tell EIGRP that it is connected to network 172.10.0.0?
5. What type of EIGRP interface will neither send nor receive Hello packets?
6. Write the command that will enable OSPF process 101 on a router.
7. Write the command that will display details of all OSPF routing processes enabled on a router.
8. Write the command that will display interface-specific OSPF information.
9. Write the command that will display all OSPF neighbors.
10. Write the command that will display all different OSPF route types that are currently known by the router.

Review Questions

1. There are three possible routes for a router to reach a destination network. The first route is from OSPF with a metric of 782. The second route is from RIPv2 with a metric of 4. The third is from EIGRP with a composite metric of 20514560. Which route will be installed by the router in its routing table?

A. RIPv2 
B. EIGRP
C. OSPF
D. All three
2. Which EIGRP information is held in RAM and maintained through the use of Hello and update packets? (Choose two.)
A. Neighbor table
B. STP table
C. Topology table
D. DUAL table
3. Which of the following describe the process identifier that is used to run OSPF on a router? (Choose two.)

A. It is locally significant.
B. It is globally significant.
C. It is needed to identify a unique instance of an OSPF database.
D. It is an optional parameter required only if multiple OSPF processes are running on the router.
E. All routes in the same OSPF area must have the same Process ID if they are to exchange routing information.
4. Where are EIGRP successor routes stored?

A. In the routing table only
B. In the neighbor table only
C. In the topology table only
D. In the routing table and neighbor table
E. In the routing table and the topology table
F. In the topology table and the neighbor table
5. Which command will display all the EIGRP feasible successor routes known to a router?

A. show ip routes *
B. show ip eigrp summary
C. show ip eigrp topology
D. show ip eigrp adjacencies
E. show ip eigrp neighbors detail
6. You get a call from a network administrator who tells you that he typed the following into his router:
Router(config)#router ospf 1
Router(config-router)#network 10.0.0.0 255.0.0.0 area 0
He tells you he still can’t see any routes in the routing table. What configuration error did the administrator make?

A. The wildcard mask is incorrect.
B. The OSPF area is wrong.
C. The OSPF Process ID is incorrect.
D. The AS configuration is wrong.
7. Which of the following protocols support VLSM, summarization, and discontiguous networking? (Choose three.)

A. RIPv1
B. IGRP
C. EIGRP
D. OSPF
E. RIPv2
8. Which of the following are true regarding OSPF areas? (Choose three.)

A. You must have separate loopback interfaces configured in each area.
B. The numbers you can assign an area go up to 65,535.
C. The backbone area is also called area 0.
D. If your design is hierarchical, then you don’t need multiple areas.
E. All areas must connect to area 0.
F. If you have only one area, it must be called area 1.
9. Which of the following network types have a designated router and a backup designated router assigned? (Choose two.)

A. Broadcast
B. Point-to-point
C. NBMA
D. NBMA point-to-point
E. NBMA point-to-multipoint
10. A network administrator needs to configure a router with a distance-vector protocol that allows classless routing. Which of the following satisfies those requirements?

A. IGRP
B. OSPF
C. RIPv1
D. EIGRP
E. IS-IS
11. You need the IP address of the devices with which the router has established an adjacency. Also, the retransmit interval and the queue counts for the adjacent routers need to be checked. What command will display the required information?

A. show ip eigrp adjacency
B. show ip eigrp topology
C. show ip eigrp interfaces
D. show ip eigrp neighbors
12. For some reason, you cannot establish an adjacency relationship on a common Ethernet link between two routers. Looking at the output below, what is the cause of the problem?
RouterA#
Ethernet0/0 is up, line protocol is up
  Internet Address 172.16.1.2/16, Area 0
  Process ID 2, Router ID 172.126.1.2, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 172.16.1.2, interface address 172.16.1.1
  No backup designated router on this network
  Timer intervals configured, Hello 5, Dead 20, Wait 20, Retransmit 5

RouterB#
Ethernet0/0 is up, line protocol is up
  Internet Address 172.16.1.1/16, Area 0
  Process ID 2, Router ID 172.126.1.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 172.16.1.1, interface address 172.16.1.2
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
A. The OSPF area is not configured properly.
B. The priority on RouterA should be set higher.
C. The cost on RouterA should be set higher.
D. The Hello and Dead timers are not configured properly.
E. A backup designated router needs to be added to the network.
F. The OSPF Process ID numbers must match.
13. Which is true regarding EIGRP successor routes? (Choose two.)

A. A successor route is used by EIGRP to forward traffic to a destination.
B. Successor routes are saved in the topology table to be used if the primary route fails.
C. Successor routes are flagged as “active” in the routing table.
D. A successor route may be backed up by a feasible successor route.
E. Successor routes are stored in the neighbor table following the discovery process.
14. Which type of OSPF network will elect a backup designated router? (Choose two.)

A. Broadcast multi-access
B. Non-broadcast multi-access
C. Point-to-point
D. Broadcast multipoint
15. Which two of the following commands will place network 10.2.3.0/24 into area 0? (Choose two.)
A. router eigrp 10
B. router ospf 10
C. router rip
D. network 10.0.0.0
E. network 10.2.3.0 255.255.255.0 area 0
F. network 10.2.3.0 0.0.0.255 area0
G. network 10.2.3.0 0.0.0.255 area 0
16. With which network type will OSPF establish router adjacencies but not perform the DR/BDR election process?

A. Point-to-point
B. Backbone area 0
C. Broadcast multi-access
D. Non-broadcast multi-access
17. What are three reasons for creating OSPF in a hierarchical design? (Choose three.)

A. To decrease routing overhead
B. To speed up convergence
C. To confine network instability to single areas of the network
D. To make configuring OSPF easier
18. What is the administrative distance of OSPF?

A. 90
B. 100
C. 110
D. 120
19. You have an internetwork as shown in the following illustration. However, the two networks are not sharing routing table route entries. Which command is needed to fix the problem?



A. version 2
B. no auto-summary
C. redistribute eigrp 10
D. default-information originate
20. If routers in a single area are configured with the same priority value, what value does a router use for the OSPF Router ID in the absence of a loopback interface?

A. The lowest IP address of any physical interface
B. The highest IP address of any physical interface
C. The lowest IP address of any logical interface
D. The highest IP address of any logical interface

Written Answers:
1. The four routed protocols supported by EIGRP are IP, IPv6, IPX, and AppleTalk.
2. Redistribution is required when more than one EIGRP session or process is running and they are identified with different ASNs. Redistribution shares topology information between EIGRP sessions.
3. router eigrp 300
4. network 172.10.0.0
5. Passive interface
6. router ospf 101
7. show ip ospf
8. show ip ospf interface
9. show ip ospf neighbor
10. show ip route ospf


Review Answers:
1. B. Only the EIGRP routes will be placed in the routing table because it has the lowest administrative distance (AD), and that is always used before metrics.
2. A, C. EIGRP maintains three tables in RAM: neighbor, topology, and routing. The neighbor and topology tables are built and maintained with the use of Hello and update packets.
3. A, C. The Process ID for OSPF on a router is only locally significant and you can use the same number on each router, or each router can have a different number—it just doesn’t matter. The numbers you can use are from 1 to 65,535. Don’t get this confused with area numbers, which can be from 0 to 4.2 billion.
4. E. Successor routes are going to be in the routing table since they are the best path to a remote network. However, the topology table has a link to each and every network, so the best answer is topology table and routing table. Any secondary route to a remote network is considered a feasible successor, and those routes are found only in the topology table and used as backup routes in case of primary route failure.
5. C. Any secondary route to a remote network is considered a feasible successor, and those routes are found only in the topology table and used as backup routes in case of primary route failure. You can see the topology table with the show ip eigrp topology command.
6. A. The administrator typed in the wrong wildcard mask configuration. The wildcard should have been 0.0.0.255 or even 0.255.255.255.
7. C, D, E. RIPv1 and IGRP are true distance-vector routing protocols and can’t do much, really—except build and maintain routing tables and use a lot of bandwidth! RIPv2, EIGRP, and OSPF build and maintain routing tables, but they also provide classless routing, which allows for VLSM, summarization, and discontiguous networking.
8. C, D, E. Loopback interfaces are created on a router, and the highest IP address on a loopback (logical) interface becomes the RID of the router but has nothing to do with areas and is optional, so option A is wrong. The numbers you can create an area with are from 0 to 4,294,967,295—option B is wrong. The backbone area is called area 0, so option C is correct. All areas must connect to area 0, so option E is correct. If you have only one area, it must be called area 0, so option F is incorrect. This leaves option D, which must be correct; it doesn’t make much sense, but it is the best answer.
9. A, C. No DR is assigned on any type of point-to-point link. No DR/BDR is assigned on the NBMA point-to-multipoint due to the hub/spoke topology. DR and BDR are elected on broadcast and non-broadcast multi-access networks. Frame Relay is a non-broadcast multi-access (NBMA) network by default.
10. D. In this question, we’re calling EIGRP just plain old distance vector. EIGRP is an advanced distance-vector routing protocol, sometimes called a hybrid routing protocol because it uses the characteristics of both distance-vector and link-state routing protocols.
11. D. The show ip eigrp neighbors command allows you to check the IP addresses as well as the retransmit interval and queue counts for the neighbors that have established an adjacency.
12. D. The Hello and Dead timers must be set the same on two routers on the same link or they will not form an adjacency (relationship). The default timers for OSPF are 10 seconds for the Hello timer and 40 seconds for the Dead timer.
13. A, D. Successor routes are the routes picked from the topology table as the best route to a remote network, so these are the routes that IP uses in the routing table to forward traffic to a remote destination. The topology table contains any route that is not as good as the successor route and is considered a feasible successor, or backup route. Remember that all routes are in the topology table, even successor routes.
14. A, B. DR and BDR are elected on broadcast and non-broadcast multi-access networks. Frame Relay is a non-broadcast multi-access (NBMA) network by default. No DR is assigned on any type of point-to-point link. No DR/BDR is assigned on the NBMA point-to-multipoint due to the hub/spoke topology.
15. B, G. To enable OSPF, you must first start OSPF using a Process ID. The number is irrelevant; just choose a number from 1 to 65,535 and you’re good to go. After you start the OSPF process, you must configure interfaces on which to activate OSPF using the network command with wildcards and specification of an area. Option F is wrong because there must be a space after the parameter area and before you list the area number.
16. A. No DR is assigned on any type of point-to-point link. No DR/BDR is assigned on the NBMA point-to-multipoint due to the hub/spoke topology. DR and BDR are elected on broadcast and non-broadcast multi-access networks. Frame Relay is a non-broadcast multi-access (NBMA) network by default.
17. A, B, C. OSPF is created in a hierarchical design, not a flat design like RIP. This decreases routing overhead, speeds up convergence, and confines network instability to a single area of the network.
18. C. The administrative distance (AD) is a very important parameter in a routing protocol. The lower the AD, the more trusted the route. If you have IGRP and OSPF running, by default IGRP routes would be placed in the routing table because IGRP has a lower AD of 100. OSPF has an AD of 110. RIPv1 and RIPv2 both have an AD of 120, and EIGRP is the lowest, at 90.
19. B. The network in the diagram is considered a discontiguous network because you have one classful address subnetted and separated by another classful address. Only RIPv2, OSPF, and EIGRP can work with discontiguous networks, but RIPv2 and EIGRP won’t work by default. You must use the no auto-summary command under the routing protocol configuration.
20. B. At the moment of OSPF process startup, the highest IP address on any active interface will be the Router ID (RID) of the router. If you have a loopback interface configured (logical interface), then that will override the interface IP address and become the RID of the router automatically.




Questions come from , I added my own explanations.
  • CCNA Cisco Certified Network Associate Study Guide, (Includes CD-ROM)