Connections, addressing and common configuration rules.

Size: px

Start display at page:

Download "Connections, addressing and common configuration rules."

Solomon Cunningham
5 years ago
Views:

1 Lab #1 r9-1 s2 e1 3/11 VLAN_21 BGP AS 100 s1 3/1 e0 s0 e0 3/2 s1 VLAN_22 BGP AS 200 r1 r2 Ring 4 r4 s0/1 r3 to0/0 s0/0 s0 s1 OSPF Area 33 to0 e0/0 e0 OSPF Area 4 3/4 b0/0 3/3 VLAN_14 VLAN_ c15 OSPF Area ISDN Frame-Relay fxs0/0 fxs0/0 r5 r6 OSPF Area 6 r7 b0/0 s0/0 OSPF Area 0 s0/0 to0/0 e0 fa0/0.25 fa0/0.15 e0/0 3/6 2/1 2/1 3/5 VLAN_25 VLAN_15 RIP 3/10 VLAN_16 OSPF Area 55 OSPF Area 5 r9-0 e0 BGP AS 150 Lab 1 Ring 3 Ring 6 Connections, addressing and common configuration rules. All physical connections, interface type and interface numbers, frame-relay dlci, router names are on the figure. All interfaces of frame-relay switch are DCE. On serial lines between other routers DTE/DCE should be detected. Frame-relay switch is emulated by Cisco AGS+ router. Router r1 connected to interface serial 1 AGS+, router r2 to serial 2 and, so on up to router r7 which is connected to interface serial 7 AGS+. ISDN switch-type is basic-ni, and all others parameters can be found at the table below.

2 r4 bri0/0 r5 bri0/0 spid DN spid DN All Ethernet interfaces are physically connected to Catalyst The Catalyst 5000 has one 24-port 10BaseT Ethernet card (WS-X5010) and one 12 port 100BaseTX Ethernet card (WS-X5113). All Fast Ethernet ports are connected to 100 Mbit card and all Ethernet ports are connected to 10 Mbit card. Port numbers are shown on the figure but it is recommended to detect port numbers from the Catalyst 5000 console. For Token Ring use ring speed 4 Mb. Router r9 is Cisco AGS+ router with 3 Ethernet, 1 Token Ring and 10 Serial. R9 serial interfaces 1-7 used for frame-relay switch emulation. R9 Ethernet interfaces used to provide source of information for different routing protocol, so router r9-0 is router interface Ethernet 0 on r9, r9-1 is router interface Ethernet 1 on r9. Use subinterfaces at frame-relay. Use this addressing schema if one not specified. Use /30 subnet mask on all serial and ISDN interfaces. Use /28 subnet on frame-relay links, use /24 mask on all Ethernet and Token Ring segments. Use /26 subnet mask on all routers loopback interfaces. Use router number as 4 th octet in IP address for Ethernet, Token Ring and Frame-relay. Use first available network address for router with less number and second available network address for router with greater number on networks with other than /24 mask (/26, /28). Phones are connected to ports 0/0. Use phone numbers 501,502 for ports on r5 and 601,602 for ports on r6. For IPX addressing use the following rules. For internal network MAC addresses use 00xx.xxxx.xxxx where x is router number. For point-to-point links use two-digit network number xy, where x is number of first router and y is number of second router. For frame-relay use three or four digit number where each digit is router number. Use five digit number for internal network where each digit is router number. For Ethernet or Token Ring LAN and use ipx network number from vlan number and ring number. You have one class B IP network for addressing your network You may subnet it. VLAN_21 in AS 100 have subnetted class B IP network /24. Recommendations: Put password on all console lines and vty lines. Use moon as password. That will be polite to all future users. I am not sure that you want start the lab by breaking passwords of previous lab users. You may configure all routers by yourself or you can load some or even all configs to take a look how it should be worked. We recommend using these configs on r7 and r9. It will make life easier and save time. But using these configs is absolutely up to you. 2

3 IP connectivity Draw your own picture of the lab or just add IP addresses to figure of lab. Configure all routers according to the schema on the figure. Test that all needed interfaces are up and ping-able from other side of the link. Make exclusion for pinging some interfaces on r9 because r9 is just a source of information for other routers. When finished with lab check this again. Frame-relay Configure R9 as frame-relay switch. Use ietf type of frame-relay encapsulation and ansi type of frame-relay lmi-type. Name all DLCI as tree digit number where first digit will be source interface number on AGS+ (and source router number in the same time), second digit will be 0 and third digit will be destination interface number (and destination router number in the same time). Configure excessive number of dlci-s. Suppose that we use serial interfaces 1-7, each interface should have 6 dlci-s. Do not use subinterfaces on r3, r4, r5, r6. Configure interface Serial 0/0 on r5 so that telnet traffic will set DE bit. Run telnet from r7 to r4. Show on r5 that outgoing traffic set DE bit. Then do the same for dlci from r4 to r5 on r4. Show on r5 that DE bit sets for both outgoing and incoming traffic. Use only defined dlci. ISDN Use ISDN as backup connection between router r5 and r4. Call should be originated always from r5 to r4 and never reverse direction. ISDN should stay down untill frame-relay interface on r5 is up. When ISDN is up OSPF should use this link only when topology changes. ISDN should not stay if traffic does not exist at 100 sec. ISDN should bring second channel up if load exceeds 25%. Use authentication chap. Send different than real router names both from r4 and r5. Check isdn line status and dialer reasons. Check that isdn backup works (ping from r7 to ). Catalyst All Ethernet interfaces shown on the schema, but you also can use CDP protocol at Catalyst console to detect which router is connected to which port. Create all VLANs as shown at figure. VTP domain name LAB. Move ports to VLANs (see figure). Ethernet 0 on r9 - move to VLAN_16, Ethernet 1 on r9 - move to VLAN_21. Name each vlan as shown on schema. Use trunk on r5 FastEthernet 0/0. This trunk should contain vlans 1,15,25. Put sc0 interface of Catalyst 5000 in VLAN_14 as it shown on schema. Set IP address /24. Check that you can ping all router. 3

4 4 Interfaces r3-e0, r4-e0/0, r5-fa0/0.15, r5-fa0/0.25, r6-e0/0 connected to switch. Do some configuration on r3, r4, r5, r6 so Catalyst was able to send multicast traffic to subscribers ports only. Configure Catalyst so it exchanges multicast information with non cgmp router r7. Check multicast routers connected to Catalyst by show command (after complete IP multicast routing/switching section). Configure NTP. NTP server is r4. Ports 3/18-24 have workstations connected to VLAN 14. Do some configuring to make workstation power-up connection time shorter. Configure port 3/18 that only one device that have MAC address could be connected to this port. Port 3/17 have sniffer connected to it. Configure this port to listen to vlans 16. Limit broadcast quantity on port 3/3 VLAN_13. Average packet size for this VLAN is 900 bytes. Limit broadcast bandwidth to 2Mbps. IP Routing. Run OSPF area 0 - on frame-relay and ISDN; area 3 - on VLAN_13; area 33 - on Ring 3; area 4 - on VLAN_14 and on ring 4; area 14 - between r1 and r4; area 5 - on VLAN_15; area 55 - on VLAN_25; area 6 - on ring 6. Area 55 nssa area. Do md5 authentication on OSPF area 0. On frame-relay make ospf update interval twice more than default value. Configure loopback 0 on routers r3-7 that have address x.1/26 where x is router number. Include loopback 0 on r3-r6 to OSPF area 0, loopback 0 on r7 to OSPF area 55. Check routing table. See that loopback networks appear as host routes. Make changes so that route in routing table looks like /26 networks. Area 55 is NSSA area. Let r7 have just default route to outside world and nothing more. Configure loopback 110 on router r7 with address /22 and redistribute it to OSPF. Use type of redistributed route that allows you to see this route increase its cost when passing each hop. Use RIP on VLAN_16. Create loopback on r9. Use address x.9/24 where x is 0-9. Put all this networks to RIP routing. Check by debug that only this routes are advertised to VLAN 16. On r9 - change rip updates interval to 180 seconds, invalid and holddown 360 seconds, flash 420 seconds. Use debug to check time between RIP updates on r6. Set the same timers on r6. On r6 filtering out all received from RIP odd networks.

5 Do RIP to OSPF and OSPF to RIP redistribution on r6. Be sure that you do not get all OSPF routes as external routes on OSPF database. Use type of redistributed route that allows you to see this route increase it cost when passing each hop. Do not send any RIP routes from r6 to r9. R1, r9-1 - BGP AS 100. R3, r4, r5, r6 - BGP AS 150. R2 - BGP AS 200. AS100 connected to AS 150 (r1 to r4). AS 200 connected to AS 150 (r2 to r3). Do not run any routing protocols on links r1-r4 and r2-r3. Create loopback on r9. Assign IP addresses x.9 where x is 0-9. Create loopback on r9. Assign IP addresses x.9 where x is 0-5. Put networks x.0/24 and x.0/24 to BGP AS 100. But put x.0/24 with network command, x.0/24 as redistributed connected. Then see differences in bgp table on r4 (origin). Run EIGRP on VLAN_21. Use EIGRP to get all BGP routes on r1 synchronized (see bgp table on r1 before and after running EIGRP). Do not make IBGP between r3 and r5, r3 and r6, r5 and r6. Check that routes from r9 seen on r3, r4, r5, r6. Ping from on r9 to and Switch off bgp synchronization on r9 and do these pings again. Filter out on r4 all route except , , and Configure r4 so that all routers in AS 150 get routes from AS 100 as transit through ASs 110,120 and 130. AS 100 should receives classfull summary of with MED equal 300. Create loopback on r2. Assign IP addresses x.2 where x is 0-9. Create loopback on r2. Assign IP addresses x.2 where x is 0-9. Put networks x.0/24 and x.0/24 to BGP AS 200. R2 should receive classfull summary of from r4. Filter out on r3 all route except , , and Check that r2 get routes from r9 and can ping from Add link between r2 and r9. Use network /0 on this link. R2 send to r9 only and R9 sent to r2 nothing. On r9 for routes received from r2 set local preference 900. Trace ip packets from to Trace ip packets from r7 to Multicast Routing Configure on r3, r4, r5, r6, r7 multicast routing so that VLAN_13, VLAN_14, VLAN_15, VLAN_16, VLAN_25 be able to receive multicast traffic from each other. Join VLAN_13 to multicast group, VLAN_ , VLAN_ , VLAN_ Ping all this addresses from r3, r4, r5, r6, r7. Use sparse-mode for multicast configuration. Firewall / IP access lists 5

6 Configure access-list that have following requirement: - telnet is permitted in any direction. - SNMP is permitted in any direction. - WWW and FTP is permitted only from VLAN_16 to outside. - Ping is permitted in any direction. - SMTP is allowed from outside to VLAN_16. - TFTP allowed any direction - other traffic is disallowed. All required traffic (as OSPF, DLSW+ and other) should be permitted even if not specified. Put this access list as incoming on serial 0/0 on r6. Use named access list. Disable all packets sourced from networks /24, /24, /24, /24, /24 and /24 leave interface serial 0/0 on r5. Use one line access-list to filter out all these networks. Queueing Configure queueing on Serial 0 on r6. Suppose that IP packets have average size 500 byte, IPX packets have average size 300 bytes and appletalk packets have average size 100 bytes. Split bandwidth so that IP get 20%, IPX 60%, Appletalk 20%. Configure queueing on Serial 0/0 on r3. Put dlsw traffic to high priority queue, telnet traffic to medium priority queue, ipx to low priority queue and all other traffic to normal priority queue. DLSW+ Use tcp encapsulation and virtual ring 100. Configure dlsw between Ring 3 and Ring 4. Configure dlsw between VLAN_14 and VLAN_16. Do not configure remote peer on r4. Be sure that only NetBIOS traffic will be allowed from Ring 3 to Ring 4. Configure filter to prevent access to netbios names on Ring 3 that start with bad. Also prevent access to netbios names not?sobad on Ring 3. Be sure that only traffic will be allowed from VLAN_16 is SNA. Prevent sending explorers to detect that there is a host with MAC address a on Ring 6. Add configuration to say that this host is the only host on this ring. Configure bridging between VLAN_14 and Ring 4. 6

7 NTP Set r4 as NTP master. Configure r3, r4, r5, r6 and c15 to get this time. Set on r4 time as 20:00 16-Dec Check that all configure routers and switches have the same date and time. Syslog Configuring r3 to send syslog messages to syslog server on VLAN_25. Syslog server address is Use facility local0 and severity level 6. Voice over IP Phones are connected to ports 0/0. Use phone numbers 501,502 for telephone connected to r5 and 601,602 for telephone connected to r6. Configure r5 and r6 so you be able call each other. Configure r5 so that it call r6 when hang up. IPX Routing Configure IPX on all routers. Do not configure IPX on ISDN and on Ethernet1 r9. Use IPX RIP on LAN. Use any protocol on frame-relay. Configure IPX network 16 with encapsulation snap on interface Ethernet 0 on r9. Configure IPX routes BAD00-09 on loopbacks Configure IPX routes DAD00- DAD09 on loopbacks Configure IPX routes ACE00-ACE09 on loopbacks Sent all this routers with RIP to Ethernet0. Suppose that you do not know type of encapsulation and network number on VLAN_16. Detect encapsulation and network number on r6 Ethernet 0/0. On r6 do route filtering to receive only routes ACE00-ACE09. Configuring two static SAP for file servers PSERVER1 and PSERVER2 on r3, and two static SAP for print-server FSERVER1 and FSERVER2 on r6. Check that all router can see this SAPs. Filtering SAPs on r5 so r7 get only FSERVER1 and PSERVER1 SAPs. Write filter so that clients on VLAN_14 could be attached only to FSERVER1. Configure routers to enable NetBIOS over IPX between VLAN_13, VLAN_14, VLAN_15, VLAN_16 and VLAN_25. Filtering routing updates on r5 so that only even routes of ACE00-09 will appear on r7. 7

8 Local area mobility Do possible for users with notebook to work on VLAN_13, VLAN_14, VLAN_15, VLAN_16, VLAN_25. All users should have permanent IP address from network /24. Put ip address /24 to Ethernet 2 on r9 show that configuration made correctly by moving port 3/12 on Catalyst 5000 between vlan 13,14,15,16,25. Troubleshooting Clear all routers and switch configurations. Use configuration files stored in Tshooting batch configs folder. Try to find out as much faults as possible. Make list of this faults. Compare your list to list in file Lab1 Error list.txt. Tips If you use batch files for configuring routers, then keep in mind you need to set some delay between entering lines to avoid input buffer overflowing. If you use HyperTerminal Private Edition then it is: Property for connection, then Settings, then ASCII setup and Line delay. Set value and it should help. You can find answers to most of your questions at Cisco web site. On the next page, there are links that may help save time. Use notepad to prepare something like the template that has common commands for all routers. Use aliases to save time. Your can find few examples below: alias exec c conf t alias exec w write alias exec z show running alias exec i show ip route alias exec x show ipx route alias exec o show ip ospf alias exec e show ip eigrp alias exec b show ip bgp alias exec ib show ip int brief alias exec xb show ip int brief alias exec xs show ip ipx servers alias exec d clear ip route * alias exec q clear ip bgp * To detect type (DTE/DCE) of serial interface use command show controllers serial N. N is number of serial inteface. To find out what port of Catalyst 5000 belong to what router use command show cdp neighbors. At this moment router should have hostname and Ethernet interface 8

9 should be up. Be sure that cdp is running on this interface. For some reason I could not see Fast Ethernet ports from r5 and r6 with cdp, but you can see them on schema. If you have full mesh dlci in frame-relay cloud then they all could be up. To avoid this use no frame-relay inverse-arp command on the interface. To check active dlci use show fram-relay map. To check DE packets use show frame-relay pvc command then use telnet and chech that DE counter is increased. To check interface backup it is not enough to shutdown interface s0/0 on r5. You need to disconnect the cable or shutdown the interface serial 5 on r9. When loopback interface network is included to OSPF, it will appear as host route in router table on other routers. To fix this use ip ospf network point-to-point on loopback interface. When you need hand over some external route over the nssa area, it will pass this area as lsa-type 7. See it in routing tables on r5 and r7. For multicast sparse mode use ip pim nbma-mode on frame-relay hub interface and ip pim rp-address x.x.x.x on frame-relay spoke interface. Use set multicast router command to let Catalyst know where is multicast router (if this router do not run cgmp). Remember that chap with different usernames can t have different password the same time (untill we do not use tacacs server). Use extended trace to save time. One of parameters makes the trace shorter than default 30 times (Maximum Time to Live). For access-lists in point of view of voice we should know that phone call setup 2 tcp connection. One connection uses port greater than as source and port 1720 as destination, and second connection uses both ports greater than Any IPX routing protocol for frame-relay almost always mean EIGRP because of split horizon. To detect IPX encapsulation type - create 4 subinterfaces. Configure different network numbers and encapsulation type on each and then run debug ipx packets. Local area mobility could be checked by connecting device with permanent ip address to network and finding new host route in routing table with mark M. In this lab it is Ethernet 2 interface on r9. To speed up appearance of mobile route in routing table make ping to on r9. 9

10 Links Understanding Frame Relay Subinterfaces Configuring Frame Relay Subinterfaces Frame-Relay broadcast-queue Configuring Frame Relay Backup Configuring Dynamic and Static Mapping for Multipoint Subinterfaces Initial Configurations for OSPF over Frame Relay Subinterfaces Bandwidth Management and Queuing Designing DLSw+ Internetworks Basic DLSw+ Configurations DLSw+ SAP/MAC Filtering Techniques Local-Area Mobility Syslog NTP, SNMP, and Syslog Understanding and Troubleshooting Common Novell IPX Issues Congestion Management Overview Configuring ISDN Backup for Frame Relay

Connections, addressing and common configuration rules.

Connections, addressing and common configuration rules. Lab #2 r9-1 r7 Lab 2 BGP AS 100 VLAN_21 r5 e1 3/11 fa0/0.25 fa0/0.15 3/6 2/1 2/1 VLAN_25 VLAN_15 IGRP AS 5 OSPF Area 5 BGP AS 65005 ISDN 3/1 504 Frame-Relay OSPF Area 0 VLAN_22 604 EIGRP AS 6 r9-0 OSPF