Connections, addressing and common configuration rules.

Lab #1 r9-1 s2 e1 3/11 VLAN_21 BGP AS 100 s1 3/1 e0 s0 e0 3/2 s1 VLAN_22 BGP AS 200 r1 r2 Ring 4 r4 s0/1 r3 to0/0 s0/0 s0 s1 OSPF Area 33 to0 e0/0 e0 OSPF Area 4 3/4 b0/0 3/3 VLAN_14 VLAN_13 403 304 c15 OSPF Area 3 405 406 ISDN 504 604 Frame-Relay fxs0/0 fxs0/0 r5 r6 OSPF Area 6 r7 b0/0 s0/0 OSPF Area 0 s0/0 to0/0 e0 fa0/0.25 fa0/0.15 e0/0 3/6 2/1 2/1 3/5 VLAN_25 VLAN_15 RIP 3/10 VLAN_16 OSPF Area 55 OSPF Area 5 r9-0 e0 BGP AS 150 Lab 1 Ring 3 Ring 6 Connections, addressing and common configuration rules. All physical connections, interface type and interface numbers, frame-relay dlci, router names are on the figure. All interfaces of frame-relay switch are DCE. On serial lines between other routers DTE/DCE should be detected. Frame-relay switch is emulated by Cisco AGS+ router. Router r1 connected to interface serial 1 AGS+, router r2 to serial 2 and, so on up to router r7 which is connected to interface serial 7 AGS+. ISDN switch-type is basic-ni, and all others parameters can be found at the table below.

r4 bri0/0 r5 bri0/0 spid1 0835866201 0835866101 DN1 835-8662 835-8661 spid2 0835866401 0835866301 DN2 835-6264 835-6263 All Ethernet interfaces are physically connected to Catalyst 5000. The Catalyst 5000 has one 24-port 10BaseT Ethernet card (WS-X5010) and one 12 port 100BaseTX Ethernet card (WS-X5113). All Fast Ethernet ports are connected to 100 Mbit card and all Ethernet ports are connected to 10 Mbit card. Port numbers are shown on the figure but it is recommended to detect port numbers from the Catalyst 5000 console. For Token Ring use ring speed 4 Mb. Router r9 is Cisco AGS+ router with 3 Ethernet, 1 Token Ring and 10 Serial. R9 serial interfaces 1-7 used for frame-relay switch emulation. R9 Ethernet interfaces used to provide source of information for different routing protocol, so router r9-0 is router interface Ethernet 0 on r9, r9-1 is router interface Ethernet 1 on r9. Use subinterfaces at frame-relay. Use this addressing schema if one not specified. Use /30 subnet mask on all serial and ISDN interfaces. Use /28 subnet on frame-relay links, use /24 mask on all Ethernet and Token Ring segments. Use /26 subnet mask on all routers loopback interfaces. Use router number as 4 th octet in IP address for Ethernet, Token Ring and Frame-relay. Use first available network address for router with less number and second available network address for router with greater number on networks with other than /24 mask (/26, /28). Phones are connected to ports 0/0. Use phone numbers 501,502 for ports on r5 and 601,602 for ports on r6. For IPX addressing use the following rules. For internal network MAC addresses use 00xx.xxxx.xxxx where x is router number. For point-to-point links use two-digit network number xy, where x is number of first router and y is number of second router. For frame-relay use three or four digit number where each digit is router number. Use five digit number for internal network where each digit is router number. For Ethernet or Token Ring LAN and use ipx network number from vlan number and ring number. You have one class B IP network for addressing your network 170.150.0.0. You may subnet it. VLAN_21 in AS 100 have subnetted class B IP network 180.100.100.0/24. Recommendations: Put password on all console lines and vty lines. Use moon as password. That will be polite to all future users. I am not sure that you want start the lab by breaking passwords of previous lab users. You may configure all routers by yourself or you can load some or even all configs to take a look how it should be worked. We recommend using these configs on r7 and r9. It will make life easier and save time. But using these configs is absolutely up to you. 2

IP connectivity Draw your own picture of the lab or just add IP addresses to figure of lab. Configure all routers according to the schema on the figure. Test that all needed interfaces are up and ping-able from other side of the link. Make exclusion for pinging some interfaces on r9 because r9 is just a source of information for other routers. When finished with lab check this again. Frame-relay Configure R9 as frame-relay switch. Use ietf type of frame-relay encapsulation and ansi type of frame-relay lmi-type. Name all DLCI as tree digit number where first digit will be source interface number on AGS+ (and source router number in the same time), second digit will be 0 and third digit will be destination interface number (and destination router number in the same time). Configure excessive number of dlci-s. Suppose that we use serial interfaces 1-7, each interface should have 6 dlci-s. Do not use subinterfaces on r3, r4, r5, r6. Configure interface Serial 0/0 on r5 so that telnet traffic will set DE bit. Run telnet from r7 to r4. Show on r5 that outgoing traffic set DE bit. Then do the same for dlci from r4 to r5 on r4. Show on r5 that DE bit sets for both outgoing and incoming traffic. Use only defined dlci. ISDN Use ISDN as backup connection between router r5 and r4. Call should be originated always from r5 to r4 and never reverse direction. ISDN should stay down untill frame-relay interface on r5 is up. When ISDN is up OSPF should use this link only when topology changes. ISDN should not stay if traffic does not exist at 100 sec. ISDN should bring second channel up if load exceeds 25%. Use authentication chap. Send different than real router names both from r4 and r5. Check isdn line status and dialer reasons. Check that isdn backup works (ping from r7 to 181.1.2.9). Catalyst 5000. All Ethernet interfaces shown on the schema, but you also can use CDP protocol at Catalyst console to detect which router is connected to which port. Create all VLANs as shown at figure. VTP domain name LAB. Move ports to VLANs (see figure). Ethernet 0 on r9 - move to VLAN_16, Ethernet 1 on r9 - move to VLAN_21. Name each vlan as shown on schema. Use trunk on r5 FastEthernet 0/0. This trunk should contain vlans 1,15,25. Put sc0 interface of Catalyst 5000 in VLAN_14 as it shown on schema. Set IP address 170.150.14.15/24. Check that you can ping all router. 3

4 Interfaces r3-e0, r4-e0/0, r5-fa0/0.15, r5-fa0/0.25, r6-e0/0 connected to switch. Do some configuration on r3, r4, r5, r6 so Catalyst was able to send multicast traffic to subscribers ports only. Configure Catalyst so it exchanges multicast information with non cgmp router r7. Check multicast routers connected to Catalyst by show command (after complete IP multicast routing/switching section). Configure NTP. NTP server is r4. Ports 3/18-24 have workstations connected to VLAN 14. Do some configuring to make workstation power-up connection time shorter. Configure port 3/18 that only one device that have MAC address 00-11-22-33-44-55 could be connected to this port. Port 3/17 have sniffer connected to it. Configure this port to listen to vlans 16. Limit broadcast quantity on port 3/3 VLAN_13. Average packet size for this VLAN is 900 bytes. Limit broadcast bandwidth to 2Mbps. IP Routing. Run OSPF area 0 - on frame-relay and ISDN; area 3 - on VLAN_13; area 33 - on Ring 3; area 4 - on VLAN_14 and on ring 4; area 14 - between r1 and r4; area 5 - on VLAN_15; area 55 - on VLAN_25; area 6 - on ring 6. Area 55 nssa area. Do md5 authentication on OSPF area 0. On frame-relay make ospf update interval twice more than default value. Configure loopback 0 on routers r3-7 that have address 170.150.x.1/26 where x is router number. Include loopback 0 on r3-r6 to OSPF area 0, loopback 0 on r7 to OSPF area 55. Check routing table. See that loopback networks appear as host routes. Make changes so that route in routing table looks like /26 networks. Area 55 is NSSA area. Let r7 have just default route to outside world and nothing more. Configure loopback 110 on router r7 with address 160.60.60.1/22 and redistribute it to OSPF. Use type of redistributed route that allows you to see this route increase its cost when passing each hop. Use RIP on VLAN_16. Create loopback 120-129 on r9. Use address 199.1.x.9/24 where x is 0-9. Put all this networks to RIP routing. Check by debug that only this routes are advertised to VLAN 16. On r9 - change rip updates interval to 180 seconds, invalid and holddown 360 seconds, flash 420 seconds. Use debug to check time between RIP updates on r6. Set the same timers on r6. On r6 filtering out all received from RIP odd networks.

Do RIP to OSPF and OSPF to RIP redistribution on r6. Be sure that you do not get all OSPF routes as external routes on OSPF database. Use type of redistributed route that allows you to see this route increase it cost when passing each hop. Do not send any RIP routes from r6 to r9. R1, r9-1 - BGP AS 100. R3, r4, r5, r6 - BGP AS 150. R2 - BGP AS 200. AS100 connected to AS 150 (r1 to r4). AS 200 connected to AS 150 (r2 to r3). Do not run any routing protocols on links r1-r4 and r2-r3. Create loopback 20-29 on r9. Assign IP addresses 181.1.x.9 where x is 0-9. Create loopback 30-39 on r9. Assign IP addresses 183.1.x.9 where x is 0-5. Put networks 181.1.x.0/24 and 183.1.x.0/24 to BGP AS 100. But put 181.1.x.0/24 with network command, 181.3.x.0/24 as redistributed connected. Then see differences in bgp table on r4 (origin). Run EIGRP on VLAN_21. Use EIGRP to get all BGP routes on r1 synchronized (see bgp table on r1 before and after running EIGRP). Do not make IBGP between r3 and r5, r3 and r6, r5 and r6. Check that routes from r9 seen on r3, r4, r5, r6. Ping from 181.1.2.9 on r9 to 170.150.7.1 and 170.150.6.1. Switch off bgp synchronization on r9 and do these pings again. Filter out on r4 all route except 181.1.2.0, 181.1.4.0, 183.1.2.0 and 183.1.6.0. Configure r4 so that all routers in AS 150 get routes from AS 100 as transit through ASs 110,120 and 130. AS 100 should receives classfull summary of 170.150.0.0 with MED equal 300. Create loopback 20-29 on r2. Assign IP addresses 191.1.x.2 where x is 0-9. Create loopback 30-39 on r2. Assign IP addresses 193.1.x.2 where x is 0-9. Put networks 191.1.x.0/24 and 193.1.x.0/24 to BGP AS 200. R2 should receive classfull summary of 170.150.0.0 from r4. Filter out on r3 all route except 191.1.4.0, 191.1.8.0, 193.1.4.0 and 193.1.8.0. Check that r2 get routes from r9 and can ping 181.1.2.9 from 191.1.4.2. Add link between r2 and r9. Use network 92.92.92/0 on this link. R2 send to r9 only 160.60.0.0 and 170.150.0.0. R9 sent to r2 nothing. On r9 for routes received from r2 set local preference 900. Trace ip packets from 181.1.2.9 to 170.150.7.1. Trace ip packets from r7 to 181.1.2.9. Multicast Routing Configure on r3, r4, r5, r6, r7 multicast routing so that VLAN_13, VLAN_14, VLAN_15, VLAN_16, VLAN_25 be able to receive multicast traffic from each other. Join VLAN_13 to 224.8.8.3 multicast group, VLAN_14 224.8.8.4, VLAN_15 224.8.8.5, VLAN_16 224.8.8.6. Ping all this addresses from r3, r4, r5, r6, r7. Use sparse-mode for multicast configuration. Firewall / IP access lists 5

Configure access-list that have following requirement: - telnet is permitted in any direction. - SNMP is permitted in any direction. - WWW and FTP is permitted only from VLAN_16 to outside. - Ping is permitted in any direction. - SMTP is allowed from outside to VLAN_16. - TFTP allowed any direction - other traffic is disallowed. All required traffic (as OSPF, DLSW+ and other) should be permitted even if not specified. Put this access list as incoming on serial 0/0 on r6. Use named access list. Disable all packets sourced from networks 199.100.99.0/24, 199.100.103.0/24, 199.96.103.0/24, 199.100.103.0/24, 195.96.99.0/24 and 199.96.99.0/24 leave interface serial 0/0 on r5. Use one line access-list to filter out all these networks. Queueing Configure queueing on Serial 0 on r6. Suppose that IP packets have average size 500 byte, IPX packets have average size 300 bytes and appletalk packets have average size 100 bytes. Split bandwidth so that IP get 20%, IPX 60%, Appletalk 20%. Configure queueing on Serial 0/0 on r3. Put dlsw traffic to high priority queue, telnet traffic to medium priority queue, ipx to low priority queue and all other traffic to normal priority queue. DLSW+ Use tcp encapsulation and virtual ring 100. Configure dlsw between Ring 3 and Ring 4. Configure dlsw between VLAN_14 and VLAN_16. Do not configure remote peer on r4. Be sure that only NetBIOS traffic will be allowed from Ring 3 to Ring 4. Configure filter to prevent access to netbios names on Ring 3 that start with bad. Also prevent access to netbios names not?sobad on Ring 3. Be sure that only traffic will be allowed from VLAN_16 is SNA. Prevent sending explorers to detect that there is a host with MAC address 0066.99a5.1824 on Ring 6. Add configuration to say that this host is the only host on this ring. Configure bridging between VLAN_14 and Ring 4. 6

NTP Set r4 as NTP master. Configure r3, r4, r5, r6 and c15 to get this time. Set on r4 time as 20:00 16-Dec-2001. Check that all configure routers and switches have the same date and time. Syslog Configuring r3 to send syslog messages to syslog server on VLAN_25. Syslog server address is 170.150.14.100. Use facility local0 and severity level 6. Voice over IP Phones are connected to ports 0/0. Use phone numbers 501,502 for telephone connected to r5 and 601,602 for telephone connected to r6. Configure r5 and r6 so you be able call each other. Configure r5 so that it call r6 when hang up. IPX Routing Configure IPX on all routers. Do not configure IPX on ISDN and on Ethernet1 r9. Use IPX RIP on LAN. Use any protocol on frame-relay. Configure IPX network 16 with encapsulation snap on interface Ethernet 0 on r9. Configure IPX routes BAD00-09 on loopbacks 130-139. Configure IPX routes DAD00- DAD09 on loopbacks 140-149. Configure IPX routes ACE00-ACE09 on loopbacks 150-159. Sent all this routers with RIP to Ethernet0. Suppose that you do not know type of encapsulation and network number on VLAN_16. Detect encapsulation and network number on r6 Ethernet 0/0. On r6 do route filtering to receive only routes ACE00-ACE09. Configuring two static SAP for file servers PSERVER1 and PSERVER2 on r3, and two static SAP for print-server FSERVER1 and FSERVER2 on r6. Check that all router can see this SAPs. Filtering SAPs on r5 so r7 get only FSERVER1 and PSERVER1 SAPs. Write filter so that clients on VLAN_14 could be attached only to FSERVER1. Configure routers to enable NetBIOS over IPX between VLAN_13, VLAN_14, VLAN_15, VLAN_16 and VLAN_25. Filtering routing updates on r5 so that only even routes of ACE00-09 will appear on r7. 7

Local area mobility Do possible for users with notebook to work on VLAN_13, VLAN_14, VLAN_15, VLAN_16, VLAN_25. All users should have permanent IP address from network 177.77.77.0/24. Put ip address 177.77.77.0/24 to Ethernet 2 on r9 show that configuration made correctly by moving port 3/12 on Catalyst 5000 between vlan 13,14,15,16,25. Troubleshooting Clear all routers and switch configurations. Use configuration files stored in Tshooting batch configs folder. Try to find out as much faults as possible. Make list of this faults. Compare your list to list in file Lab1 Error list.txt. Tips If you use batch files for configuring routers, then keep in mind you need to set some delay between entering lines to avoid input buffer overflowing. If you use HyperTerminal Private Edition then it is: Property for connection, then Settings, then ASCII setup and Line delay. Set value 100-500 and it should help. You can find answers to most of your questions at Cisco web site. On the next page, there are links that may help save time. Use notepad to prepare something like the template that has common commands for all routers. Use aliases to save time. Your can find few examples below: alias exec c conf t alias exec w write alias exec z show running alias exec i show ip route alias exec x show ipx route alias exec o show ip ospf alias exec e show ip eigrp alias exec b show ip bgp alias exec ib show ip int brief alias exec xb show ip int brief alias exec xs show ip ipx servers alias exec d clear ip route * alias exec q clear ip bgp * To detect type (DTE/DCE) of serial interface use command show controllers serial N. N is number of serial inteface. To find out what port of Catalyst 5000 belong to what router use command show cdp neighbors. At this moment router should have hostname and Ethernet interface 8

should be up. Be sure that cdp is running on this interface. For some reason I could not see Fast Ethernet ports from r5 and r6 with cdp, but you can see them on schema. If you have full mesh dlci in frame-relay cloud then they all could be up. To avoid this use no frame-relay inverse-arp command on the interface. To check active dlci use show fram-relay map. To check DE packets use show frame-relay pvc command then use telnet and chech that DE counter is increased. To check interface backup it is not enough to shutdown interface s0/0 on r5. You need to disconnect the cable or shutdown the interface serial 5 on r9. When loopback interface network is included to OSPF, it will appear as host route in router table on other routers. To fix this use ip ospf network point-to-point on loopback interface. When you need hand over some external route over the nssa area, it will pass this area as lsa-type 7. See it in routing tables on r5 and r7. For multicast sparse mode use ip pim nbma-mode on frame-relay hub interface and ip pim rp-address x.x.x.x on frame-relay spoke interface. Use set multicast router command to let Catalyst know where is multicast router (if this router do not run cgmp). Remember that chap with different usernames can t have different password the same time (untill we do not use tacacs server). Use extended trace to save time. One of parameters makes the trace shorter than default 30 times (Maximum Time to Live). For access-lists in point of view of voice we should know that phone call setup 2 tcp connection. One connection uses port greater than 11000 as source and port 1720 as destination, and second connection uses both ports greater than 11000. Any IPX routing protocol for frame-relay almost always mean EIGRP because of split horizon. To detect IPX encapsulation type - create 4 subinterfaces. Configure different network numbers and encapsulation type on each and then run debug ipx packets. Local area mobility could be checked by connecting device with permanent ip address to network and finding new host route in routing table with mark M. In this lab it is Ethernet 2 interface on r9. To speed up appearance of mobile route in routing table make ping to 177.77.77.1 on r9. 9

Links Understanding Frame Relay Subinterfaces http://www.cisco.com/warp/public/779/smbiz/service/knowledge/wan/subifs.htm Configuring Frame Relay Subinterfaces http://www.cisco.com/warp/public/125/16.html Frame-Relay broadcast-queue http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/wan_r/wrdfrely.htm#xtocid1494010 Configuring Frame Relay Backup http://www.cisco.com/warp/public/125/19.html#19-b Configuring Dynamic and Static Mapping for Multipoint Subinterfaces http://www.cisco.com/warp/public/125/17.html Initial Configurations for OSPF over Frame Relay Subinterfaces http://www.cisco.com/warp/public/104/22.html Bandwidth Management and Queuing http://www.cisco.com/warp/public/cc/pd/ibsw/ibdlsw/prodlit/dlsw5_rg.htm Designing DLSw+ Internetworks http://www.cisco.com/univercd/cc/td/doc/cisintwk/idg4/nd2007.htm#xtocid209610 Basic DLSw+ Configurations http://www.cisco.com/warp/public/701/45.html DLSw+ SAP/MAC Filtering Techniques http://www.cisco.com/warp/public/697/dlswfilter.shtml Local-Area Mobility http://www.cisco.com/warp/public/cc/pd/iosw/ioft/lam/tech/lamso_wp.htm Syslog http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/dialnms/syslog.htm NTP, SNMP, and Syslog http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/as5xipmo/sysmgt.htm Understanding and Troubleshooting Common Novell IPX Issues http://www.cisco.com/warp/public/473/33.html Congestion Management Overview http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/qos_c/qcpart2/qcconman.htm Configuring ISDN Backup for Frame Relay http://www.cisco.com/warp/public/125/fr_isdn_backup.html