2013年7月17日星期三

EIGRP Feasible Successor Election

Question:

I have a quick question Catalyst Switches Price regarding Feasible Successor election process.
I've read that Feasibility Condition is AD<FD

So for example we have the ff feasible distances on R1
        (Cost+AD)
R2     10 + 11     = 21 (Successor)
R3     4  +  20     = 24
R4     6 +  19     = 25

Which would be chosen as the Feasible Successor?
     In this case, we have 2 entries which satisfies the condition: 20<21 ;  19<21
     Will it be both R3 & R4?
If yes, will R3 be more prioritized as the backup route when R2 goes down since it has the lesser metric?

Answer:

I've read that Feasibility Condition is AD<FD

Correct.

So for example we have the ff feasible distances on R1

Be careful here. There are two very strong misunderstandings about the feasible distance:

Some sources say that the feasible distance is the current lowest distance to the destination. This is wrong. Such a distance is simply the current distance.
Some other sources say that the feasible distance is the distance to the destination via a particular neighbor. This is also wrong. Such a distance is called computed distance or total distance.

In reality, the feasible distance is the historical (i.e. not necessarily current) lowest distance to the destination. The history starts anew when the route goes from Active to Passive state. In other words, the feasible distance is a record of the lowest distance since the last time the route entered the Passive state. It is not necessarily equal to the current lowest distance, and most certainly, there is no per-neighbor feasible distance.

In this sense, the feasibility condition says: "If a router is closer to the destination than I have ever been (now or in the past), it can not be on a routing loop."

R2     10 + 11     = 21 (Successor)
R3     4  +  20     = 24
R4     6  +  19     = 25

Which would be chosen as the Feasible Successor?

Assuming that there was no shorter path since the last time the route entered the Passive state, the feasible distance is 21. Every neighbor whose reported distance is less than 21 is a feasible successor. So in this case, both R3 and R4 would be feasible successors.

If yes, will R3 be more prioritized as the backup route when R2 goes down since it has the lesser metric?

Yes, R3 would be the next choice after R2 fails because the total distance through R3 is the next best.

Note a different thing: assume that the costs are as follows:

R2     10 + 11     = 21 (Successor)
R3     4  +  20     = 24 (feasible successor)
R4     6  +  19     = 25 (feasible successor)
R5     1  + 22     = 23

R3 and R4 are feasible successors. R5 is not a feasible successor because it does not meet the feasibility condition, yet, in case R2 fails, R5 provides the next least-cost path.

Most textbooks about EIGRP say that if the successor fails, we'll start using the feasible successor that provides the next shortest path. In this case, it would be R3 - however, the total distance through R3 is 24 while R5, it would be just 23. Staying with R3 would actually cause EIGRP to hang on a worse path than which is currently available.

So what really happens is that if the successor fails, the router will first look up the neighbor that appears to provide the next least-cost path - in this case, R5 - and only then it verifies whether it meets the feasibility condition. If it does, we start using it right away. If it does not, as in this case, we will not start using it, nor will we start using R3. Instead, we will enter the Active state and start sending queries, trying to find out if the R5 is really an appropriate next hop and can be promoted to the successor role. If it can, then after receiving all replies, the feasible distance can be reset and set to the new minimum which is now 23, thereby allowing R5 to pass the feasibility distance and to become the next successor.

Not quite an easy thing to digest, I know, but this is really what happens inside EIGRP.


You're welcome to Catalyst Switches ask further!

Failover question

Question:

I’d like to ask some failover WS-C3560V2-24PS-S  question. Please help me with it.
Thanks in advance.



In my network, the network is working well. It can ping 4.2.2.2. In order to test failover,
I shut down the interface Gi 1/12 of Core1 switch. After this,
From Host, it can ping the router 1 outside interface IP, X.X.X.X
And router 1 outside interface can ping 4.2.2.2
But the host is NOT able to ping 4.2.2.2.
And I found that the ASA outside interface can ping 4.2.2.2, but ping 4.2.2.2 with ASA inside interface does NOT work.
I have no idea how to troubleshoot it.
So please help me

Thank you very very much

router config :

……….
no aaa new-model
ip cef
!
ip domain round-robin
ip domain name aaaaa
ip name-server 4.2.2.2
multilink bundle-name authenticated
!
archive
log config
hidekeys
!
interface Loopback100
description mgmt interface
ip address 10.0.100.13 255.255.255.255
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/0
description ISP circuit order 1-111111111111
ip address X.X.X.X 255.255.255.248
ip accounting output-packets
ip nat outside
ip nat enable
no ip virtual-reassembly
duplex full
speed 1000
media-type sfp
no negotiation auto
!
interface GigabitEthernet0/1
description uplink to main-1 interface g 1/0/12
ip address 192.168.2.253 255.255.255.0
ip accounting output-packets
ip nat inside
ip nat enable
no ip virtual-reassembly
duplex full
speed 1000
media-type sfp
no negotiation auto
standby 2 ip 192.168.2.254
standby 2 priority 110
standby 2 preempt
!
interface GigabitEthernet0/2
ip address 192.168.3.253 255.255.255.0
no ip redirects
duplex full
speed 1000
negotiation auto
standby 3 ip 192.168.3.254
standby 3 priority 110
standby 3 preempt
!
interface GigabitEthernet0/3
no ip address
duplex full
speed 1000
no negotiation auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 X.X.X.X
ip route 10.1.0.0 255.255.0.0 192.168.2.1
ip route 10.1.20.0 255.255.255.0 192.168.2.13
no ip http server
!
ip dns server view-group aaaaaaa
ip dns server
ip nat pool mypool X.X.X.X X.X.X.X netmask 255.255.255.252
ip nat inside source list 1 pool mypool overload
!
logging alarm informational
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 1 permit 192.168.3.0 0.0.0.255
!
control-plane
!
gatekeeper
shutdown
!

………..



switch config :
..
ip domain-name xxxxxxxxxxxxxxxxxxxxxxxxx
ip name-server 4.2.2.2
interface Loopback100
ip address 10.0.100.15 255.255.255.255
!
interface FastEthernet0
no ip address
shutdown
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/3
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/4
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/5
description uplink to asa12 port 0/0
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/6
description uplink to router02 port g 0/1
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/10
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/11
description uplink to asa11 port 0/0
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet1/0/12
description uplink to router01 port g 0/1
switchport access vlan 2
switchport mode access
!
interface Vlan1
no ip address
shutdown
!
interface Vlan2
ip address 192.168.2.4 255.255.255.0
!
ip default-gateway 192.168.2.254
!
ip http server
ip http secure-server
!
..
monitor session 1 source interface Gi1/0/12
monitor session 1 destination interface Gi1/0/2
end


ASA config:
.....
interface GigabitEthernet0/3
description STATE Failover Interface
!
interface Management0/0
description LAN Failover Interface
management-only
!
interface GigabitEthernet1/0
media-type sfp
nameif outside
security-level 0
ip address 192.168.2.1 255.255.255.0
!
interface GigabitEthernet1/1
media-type sfp
nameif inside
security-level 100
ip address 192.168.4.1 255.255.255.0
!
interface GigabitEthernet1/2
media-type sfp
nameif inside-backup
security-level 100
ip address 192.168.5.1 255.255.255.0
!
interface GigabitEthernet1/3
media-type sfp
nameif outside-backup
security-level 0
ip address 192.168.3.1 255.255.255.0
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group icmp-type AllowedICMP
icmp-object echo
icmp-object echo-reply
icmp-object traceroute
icmp-object unreachable
icmp-object time-exceeded
access-list EXEMPT extended permit ip 192.168.4.0 255.255.255.0 any
access-list EXEMPT extended permit ip 10.1.0.0 255.255.0.0 any
access-list EXEMPT extended permit ip 192.168.5.0 255.255.255.0 any
access-list no-nat extended permit ip 10.1.0.0 255.255.0.0 host 0.0.0.0
access-list outside_access_in extended permit icmp any any object-group AllowedICMP
access-list outside_access_in extended permit ip host 192.168.2.253 any
access-list outside_access_in extended permit ip 192.168.2.0 255.255.255.0 any
failover
failover lan unit secondary
failover lan interface fobasic Management0/0
failover key *****
failover link fostate GigabitEthernet0/3
failover interface ip fobasic 192.168.200.1 255.255.255.0 standby 192.168.200.2
failover interface ip fostate 192.168.201.1 255.255.255.0 standby 192.168.201.2
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply outside
icmp permit any unreachable outside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside-backup) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group outside_access_in out interface outside
access-group EXEMPT in interface inside
access-group EXEMPT out interface inside
!
router eigrp 10
no auto-summary
network 192.168.2.0 255.255.255.0
network 192.168.3.0 255.255.255.0
network 192.168.4.0 255.255.255.0
network 192.168.5.0 255.255.255.0
redistribute static
!
route outside 0.0.0.0 0.0.0.0 192.168.2.254 1
……
http 10.1.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
!
track 1 rtr 123 reachability
……..
management-access inside
dhcpd dns x.x.x.x
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
!
service-policy global_policy global

Answer:

You need to add subnets to NAT ACL on the router where hosts are located. I guess they are:

access-list 1 permit 192.168.4.0 0.0.0.255
access-list 1 permit 192.168.5.0 0.0.0.255

And other subnets if you have them. Then remove on the router's interface:

int g0/0
no nat enable

int g0/1
no nat enable

Then try to test again failover it should work.

On the left ASA you're doing NAT so inside LAN subnet 192.168.4.0/24 gets translated into 192.168.2.1. I believe that's why you didn't need to add subnet into ACL. About ASA on the right side I cannot tell for sure. I think there might be NAT haven't been configured. So subnet are not getting translated instead just being forwarded to the router. For sure I can tell only after I see the config. of ASA and switches that WS-C3560V2-48PS-S Price is connected to.


2013年7月16日星期二

Internet access for users in remote location

Question:

i configured MPLS vpn for remote Cisco 3560 Switch locations using cisco 881 at remote side and cisco 2811 on our head-office side with a ip vpn service provider.

the remote user is able to access head office network.

now the problem is he needs internet access, which i only know the way  is we have allow him to use head office internet connection or another MPLS vpn tunnel with service provider for internet connection which will be a huge cost.

whcih our office reluctent to give.

now i am looking for a way to get the internet traffic out from the modem connected to his router cisco 881 and the head- office traffic to go on MPLS vpn

now the traffice flow is like

remote user-------->cisco 881------>internet modem------------------>serivce provide netowrk----------------->head office(cisco 2811)----------->Servers

Any help will be highly appriciated

Answer:

sorry that i didn't say it clearly, you should ping 192.168.1.1 from remote user's computer only after you configure default route to internet (ip route 0.0.0.0 0.0.0.0 192.168.1.1) but not when tunnel is up.

for nat, TRY this out:

access-list 2000 deny ip any HO_net1
access-list 2000 deny ip any YOUR_HEAD_OFFICE_SUBNET2
access-list 2000 permit ip any any

interface FastEthernet4
ip nat outside
interface Vlan1
ip nat inside

ip nat inside source list 2000 interface FastEthernet4 overload

verify nat:

sh access-list

sh nat Cisco 3560

2013年7月14日星期日

Cisco Router 2900 not able to access any DSL commands for ADSL2/2+ or 1ADSL


Question:

When i enter configuration mode Cisco 3560 for ATM any DSL commands are not recognized. Believe i have the right IOS. Any suggestions will help.

ROM: System Bootstrap, Version 15.0(1r)M15, RELEASE SOFTWARE (fc1)
System image file is "flash0:c2900-universalk9-mz.SPA.151-4.M4.bin"
Last reload type: Normal Reload

version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
no ipv6 cef
ip source-route
ip cef
!
multilink bundle-name authenticated
!
vpdn enable
!
redundancy
!
controller VDSL 0/1/0
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 218.12.1.1 255.255.255.0
ip nat inside
no ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/1/0
no ip address
atm bandwidth dynamic
no atm ilmi-keepalive
pvc 0/35
pppoe-client dial-pool-number 1
!
!
interface Ethernet0/1/0
no ip address
shutdown
no fair-queue
!
interface GigabitEthernet0/0/0
no ip address
!
interface GigabitEthernet0/0/1
no ip address
!
interface GigabitEthernet0/0/2
no ip address
!
interface GigabitEthernet0/0/3
no ip address
!
interface Vlan1
no ip address
!
interface Vlan6
no ip address
!
interface Dialer1
description hwic1
mtu 1492
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
keepalive 300
ppp chap hostname @att.net
ppp chap password 0
ppp pap sent-username @att.net password 0
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
!
access-list 1 permit 218.12.1.0 0.0.0.255
dialer-list 1 protocol ip permit
!
control-plane
!
scheduler allocate 20000 1000
Sent from Cisco Technical Support iPad App

Answer:

check your config/hardware


"controller VDSL 0/1/0"


its a VDSL and not ADSL, for the option that you are looking for are available depending on the card , some cards are VA which has VDSL as well as ADSL some are just V(ie VDSL)

Hence check what your current hardwar is Cisco 3560V2 Price or what you are looking for.

http://www.cisco.com/en/US/docs/routers/access/interfaces/software/feature/guide/vdsl2_hwic.pdf

2013年7月3日星期三

how to configure ipsla monitor in IOS XR Software, Version 4.2.3?


Question:

how to configure ipsla WS-C3750X-48P-L Price monitor in IOS XR Software, Version 4.2.3?

I don't see ipsla commands in IOS XR Software, Version 4.2.3. Any other ways to detect ethernet WAN links to trigger HSRP on ASR 9000 series routers? I don't even see track commands.

RP/0/RSP0/CPU0:grx-rtr2(config)#ip
iphc  ipv4  ipv6
RP/0/RSP0/CPU0:grx-rtr2(config)#t
tacacs-server  tacacs  taskgroup  tcam
tcp            telnet  template   tftp


Answer:

1. configure
2. track track-name
3. type line-protocol state
4. interface type interface-path-id
5. exit
6. (Optional) delay {up seconds|down seconds}
7. Use one of the following commands:
end
commit

Please see if the commands in this link are available to you on cli

http://www.cisco.com/en/US/docs/routers/asr9000/software/asr9k_r4.2/system_management/configuration/guide/b_sysman_cg42asr9k_chapter_01110.html

And then to use the track command in HSRP

hsrp [group-number] track type interface-path-id [priority-decrement]

I'm not sure if these are required.

As demonstrated here:

RP/0/0/CPU0:router(config)# router hsrp
RP/0/0/CPU0:router(config-hsrp)# interface TenGigE 0/2/0/1
RP/0/0/CPU0:router(config-hsrp-if)# hsrp track TenGigE 0/1/0/1
RP/0/0/CPU0:router(config-hsrp-if)# hsrp track TenGigE 0/3/0/1
RP/0/0/CPU0:router(config-hsrp-if)# hsrp preempt
RP/0/0/CPU0:router(config-hsrp-if)# hsrp ipv4 192.92.72.46 WS-C3750X-24S-S  

Cisco 2821 for home office use & voip?


Question:

Would the above router be Catalyst 3560X Price a good choise for a home office setup for use with WAN speeds upto 30Mbps and VOIP?

Any other, preferable serjestionns welcomed?

Thanks in advance for any input.

Answer:

With 2821 you will be able to go up to 87Mbps.
http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf

This router should handle Catalyst 3560X  everything you need for home office and VoIP.

2013年7月1日星期一

Redistribute 0.0.0.0 0.0.0.0 route only on Eigrp


Question:

I have configured the Catalyst Switches eigrp routing protocol. At the main router I have many static routes and I want to redistribute only the default route (0.0.0.0 0.0.0.0). But now every static route is distributed on each router. How to distribute the default route only.

I have got the backup router of the main router and I want to redistribute the R1 default route only to other routers and in the failure of R2 I want to redistribue the R2 default route to other routers. The destination of default route of R1 and R2 is different. Is this possible or not.

Answer:

if you want to redistribute the default route only:
ip prefix-list REDIST_STATIC permit 0.0.0.0/0
route-map REDIST_STATIC permit 10
match ip add prefix REDIST_STATIC
router eigrp 10
redistribute static route-map Cisco 3560 Price  REDIST_STATIC