CCIE is not a specialist. But the basis for an expert.: Cisco

Showing posts with label Cisco. Show all posts

Tuesday, May 11, 2010

[Cisco] How can find traffic flow across load-balance


ตัวอย่างต้องการทราบ traffic ที่ flow ผ่านทาง load-balance link ซึ่งโดย default CEF จะ loadbalance by src-dst ip
โดยมีข้อมูลดังนี้
 source address: 192.168.100.1
 destination address: 192.168.200.1

C6509#sh ip route 192.168.200.0
Routing entry for 192.168.200.0/24
 Known via "ospf 100", distance 110, metric 20
 Tag 65001, type extern 1
 Last update from 10.0.0.71 on Port-channel2, 03:51:18 ago
 Routing Descriptor Blocks:
   10.0.0.90, from 10.0.254.98, 03:51:18 ago, via Port-channel2
     Route metric is 20, traffic share count is 1
     Route tag 65001
 * 10.0.0.71, from 10.0.254.20, 03:51:18 ago, via Port-channel2
     Route metric is 20, traffic share count is 1
     Route tag 65001

C6509#sh ip cef exact-route 192.168.100.1 192.168.200.1
192.168.100.1 -> 192.168.200.1 => IP adj out of Port-channel2, addr 10.0.0.90

C6509#sh mls cef exact-route 192.168.100.1 192.168.200.1

Interface: Po2, Next Hop: 10.0.0.90, Vlan: 1014, Destination Mac: 0012.0111.bbbb

C6509#sh etherchannel load-balance 
EtherChannel Load-Balancing Configuration:
       src-dst-ip
       mpls label-ip

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
 IPv4: Source XOR Destination IP address
 IPv6: Source XOR Destination IP address
 MPLS: Label or IP

C6509#sh etherchannel load-balance hash-result int po2 ip 192.168.100.1 192.168.200.1
Computed RBH: 0x1
Would select Te4/2 of Po2


สรุปได้ว่ามี flow ของ 192.168.100.1  ----> 192.168.200.1 จะมี next-hop ไปที่ 10.0.0.90  แต่จะส่งออกทาง interface Te4/2 ซึ่งเป็นสมาชิกของ port-channel2

** อ้างอิง 
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(33)SXI2a

Wednesday, February 10, 2010

[Cisco] Configuration Cisco IPSEC site-to-site



Cisco IPSec SITE-TO-SITE
Diagram:
 (10.0.1.0/24)LAN-------[R1] atm0 ------ back to back ------ atm0 [R2]---LAN(10.0.2.0/24)
!========================================================================== 
[R1]

R1#sh run
Building configuration...

Current configuration : 1622 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
ip subnet-zero
ip cef
!
!
!        
!
no ip domain lookup
!
!
!
username cisco password 0 cisco
!
!
controller DSL 0
mode atm
line-term co
line-mode 4-wire enhanced
dsl-mode shdsl symmetric annex B
line-rate 1024
!
!
crypto isakmp policy 10
encr aes
authentication pre-share
group 5
crypto isakmp key VPNPASSWORD address 192.168.12.2
!
!        
crypto ipsec transform-set TRANSFORM-1 esp-aes esp-sha-hmac
!
crypto map VPN-IPSEC 10 ipsec-isakmp
set peer 192.168.12.2
set transform-set TRANSFORM-1
match address ACL-VPN-CLIENT
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
!
interface ATM0
ip address 192.168.12.1 255.255.255.0
ip access-group BLOCK-ANY-IN in
no atm ilmi-keepalive
pvc 0/100
 encapsulation aal5snap
!
crypto map VPN-IPSEC
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 10.0.1.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.12.2
!
!
no ip http server
no ip http secure-server
!
ip access-list extended ACL-VPN-CLIENT
permit ip 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255
ip access-list extended BLOCK-ANY-IN
permit ip host 192.168.12.2 host 192.168.12.1
ip access-list extended VPN-CLIENT
!
!
!
control-plane
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
logging synchronous
login
!
scheduler max-task-time 5000
end
!==========================================================================
[R2]

R2#sh run
Building configuration...

Current configuration : 1588 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
ip subnet-zero
ip cef
!
!
!        
!
no ip domain lookup
!
!
!
username cisco password 0 cisco
!
!
controller DSL 0
mode atm
line-term cpe
line-mode 4-wire enhanced
dsl-mode shdsl symmetric annex B
line-rate 1024
!
!
crypto isakmp policy 10
encr aes
authentication pre-share
group 5
crypto isakmp key VPNPASSWORD address 192.168.12.1
!
!        
crypto ipsec transform-set TRANSFORM-1 esp-aes esp-sha-hmac
!
crypto map VPN-IPSEC 10 ipsec-isakmp
set peer 192.168.12.1
set transform-set TRANSFORM-1
match address ACL-VPN-CLIENT
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
!
interface ATM0
ip address 192.168.12.2 255.255.255.0
ip access-group BLOCK-ANY-IN in
no atm ilmi-keepalive
pvc 0/100
 encapsulation aal5snap
!
crypto map VPN-IPSEC
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 10.0.2.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.12.1
!
!
no ip http server
no ip http secure-server
!
ip access-list extended ACL-VPN-CLIENT
permit ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255
ip access-list extended BLOCK-ANY-IN
permit ip host 192.168.12.1 host 192.168.12.2
!
!
!
control-plane
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
logging synchronous
login
!
scheduler max-task-time 5000
end

!==========================================================================
[VERIFY]

R1#sh crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection    
K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication

Interface: ATM0
Session status: UP-ACTIVE    
Peer: 192.168.12.2 port 500 fvrf: (none) ivrf: (none)
     Phase1_id: 192.168.12.2
     Desc: (none)
 IKE SA: local 192.168.12.1/500 remote 192.168.12.2/500 Active
         Capabilities:(none) connid:1001 lifetime:23:48:32
 IPSEC FLOW: permit ip 10.0.1.0/255.255.255.0 10.0.2.0/255.255.255.0
       Active SAs: 2, origin: crypto map
       Inbound:  #pkts dec'ed 9 drop 0 life (KB/Sec) 4588216/2912
       Outbound: #pkts enc'ed 9 drop 1 life (KB/Sec) 4588216/2912

R1#sh crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
      K - Keepalives, N - NAT-traversal
      X - IKE Extended Authentication
      psk - Preshared key, rsig - RSA signature
      renc - RSA encryption
IPv4 Crypto ISAKMP SA

C-id  Local           Remote          I-VRF    Status Encr Hash Auth DH Lifetime Cap.

1001  192.168.12.1    192.168.12.2             ACTIVE aes  sha  psk  5  23:51:15    
      Engine-id:Conn-id =  C87X_MBRD:1

IPv6 Crypto ISAKMP SA

R1#sh crypto ipsec sa detail

interface: ATM0
   Crypto map tag: VPN-IPSEC, local addr 192.168.12.1

  protected vrf: (none)
  local  ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)
  remote ident (addr/mask/prot/port): (10.0.2.0/255.255.255.0/0/0)
  current_peer 192.168.12.2 port 500
    PERMIT, flags={origin_is_acl,}
   #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
   #pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
   #pkts compressed: 0, #pkts decompressed: 0
   #pkts not compressed: 0, #pkts compr. failed: 0
   #pkts not decompressed: 0, #pkts decompress failed: 0
   #pkts no sa (send) 1, #pkts invalid sa (rcv) 0
   #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
   #pkts invalid prot (recv) 0, #pkts verify failed: 0
   #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
   #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
   ##pkts replay failed (rcv): 0
   #pkts internal err (send): 0, #pkts internal err (recv) 0

    local crypto endpt.: 192.168.12.1, remote crypto endpt.: 192.168.12.2
    path mtu 4470, ip mtu 4470
    current outbound spi: 0x90625D97(2422365591)

    inbound esp sas:
     spi: 0xF592CE25(4120038949)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       conn id: 1, flow_id: C87X_MBRD:1, crypto map: VPN-IPSEC
       sa timing: remaining key lifetime (k/sec): (4588216/3051)
       IV size: 16 bytes
       replay detection support: Y
       Status: ACTIVE

    inbound ah sas:

    inbound pcp sas:

    outbound esp sas:
     spi: 0x90625D97(2422365591)
       transform: esp-aes esp-sha-hmac ,
       in use settings ={Tunnel, }
       conn id: 2, flow_id: C87X_MBRD:2, crypto map: VPN-IPSEC
       sa timing: remaining key lifetime (k/sec): (4588216/3051)
       IV size: 16 bytes
       replay detection support: Y
       Status: ACTIVE

    outbound ah sas:

    outbound pcp sas:

Monday, January 4, 2010

[Cisco] PPP Multilink Frame-Relay


[R1]
hostname R1
!
interface Multilink1
 ip address 192.168.1.1 255.255.255.0
 ppp multilink
 multilink-group 1
 no clns route-cache
!
interface Serial2/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay interface-dlci 103 ppp Virtual-Template1
 frame-relay interface-dlci 113 ppp Virtual-Template2
 no clns route-cache
!
interface Virtual-Template1
 no ip address
 ppp multilink
 multilink-group 1
 no clns route-cache
!         
interface Virtual-Template2
 no ip address
 ppp multilink
 multilink-group 1
 no clns route-cache
!

===============================================
[R3]

hostname R3
!
interface Multilink1
 ip address 192.168.1.3 255.255.255.0
 ppp multilink
 ppp multilink group 1
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay interface-dlci 301 ppp Virtual-Template1
!
interface Serial1/1
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay interface-dlci 311 ppp Virtual-Template2
!
interface Virtual-Template1
 no ip address
 ppp multilink
 ppp multilink group 1
!
interface Virtual-Template2
 no ip address
 ppp multilink
 ppp multilink group 1
!

===============================================
[Verifiy]

R3#sh ppp multilink 

Multilink1, bundle name is R1
  Endpoint discriminator is R1
  Bundle up for 00:02:47, total bandwidth 200000, load 1/255
  Receive buffer limit 24000 bytes, frag timeout 1000 ms
    0/0 fragments/bytes in reassembly list
    0 lost fragments, 5 reordered
    0/0 discarded fragments/bytes, 0 lost received
    0xE received sequence, 0x10 sent sequence
  Member links: 2 active, 2 inactive (max not set, min not set)
    Vi3, since 00:02:43
    Vi1, since 00:02:38
    Vt1 (inactive)
    Vt2 (inactive)
No inactive multilink interfaces
R3#ping 192.168.1.1 

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/14/36 ms
R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C       192.168.1.1/32 is directly connected, Multilink1
C       192.168.1.0/24 is directly connected, Multilink1
R3#

[Cisco] Config PPPoE Server & Client,Server use VRF, Client get ip address from DHCP



hostname PPPoE-Server
!
ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool CE
   vrf CE 
   network 192.168.1.0 255.255.255.0
!
ip vrf CE
 rd 1:1
!
vpdn enable
!
vpdn-group PPPOE
 accept-dialin
  protocol pppoe
  virtual-template 1
!
username CLIENT password 0 CISCO
!
interface Ethernet0/0
 no ip address
 full-duplex
 pppoe enable
!       
interface Virtual-Template1
 ip vrf forwarding CE
 ip address 192.168.1.1 255.255.255.0
 no peer neighbor-route
 peer default ip address dhcp
 ppp authentication chap callin
 ppp chap hostname SERVER
 ppp chap password 0 CISCO
!
======================================================

hostname PPPoE-Client
!
vpdn enable
!
vpdn-group PPPOE
 request-dialin
  protocol pppoe
!
username SERVER password 0 CISCO
!
interface Ethernet0/0
 no ip address
 full-duplex
 pppoe enable
 pppoe-client dial-pool-number 1
!
interface Dialer1
 ip address dhcp
 encapsulation ppp
 dialer pool 1
 ppp chap hostname CLIENT
 ppp chap password 0 CISCO
!

Thursday, December 24, 2009

[Cisco] Secondary Aggregator Ports Po1A or Po2A are Created

Refer: h**p://www.ciscosystems.org.ro/en/US/tech/tk389/tk213/technologies_configuration_example09186a0080094470.shtml#tshoot
Secondary Aggregator Ports Po1A or Po2A are Created

A secondary aggregator port will be created in the LACP process when the ports you are bundling are not compatible with each other, or with their remote peers. The secondary aggregator port will have the ports which are compatible with others.

Switch#show etherchannel summary
Flags: D - down P - in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator

u - unsuitable for bundling
Number of channel-groups in use: 6
Number of aggregators: 8

Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------
1 Po1(SU) LACP Gi1/16(P) Gi10/1(P) Gi10/2(P)
2 Po2(SD) LACP
2 Po2A(SU) LACP Gi1/15(P) Gi10/3(P) Gi10/4(P)
3 Po3(SU) LACP Gi1/14(P) Gi10/5(P) Gi10/6(P)
4 Po4(SD) LACP
4 Po4A(SU) LACP Gi1/13(P) Gi10/7(P) Gi10/8(P)
5 Po5(SU) LACP Gi1/12(P) Gi10/9(P) Gi10/10(P)
6 Po6(SU) LACP Gi1/11(P) Gi10/11(P) Gi10/12(P)
Configure all LAN ports in an EtherChannel to operate at the same speed and in the same duplex mode. LACP does not support half-duplex. Half-duplex ports in an LACP EtherChannel are put in the suspended state.

If you configure an EtherChannel from trunking LAN ports, verify that the trunking mode is the same on all the trunks. LAN ports in an EtherChannel with different trunk modes can operate unpredictably.

LAN ports with different STP port path costs can form an EtherChannel as long they are compatibly configured with each other. If you set different STP port path costs, the LAN ports are not incompatible for the formation of an EtherChannel.

Friday, November 13, 2009

[Cisco] Cisco Router878 G.SHDSL Back-to-Back Configuration



Cisco Router878 G.SHDSL Back-to-Back Configuration
IOS: c870-advipservicesk9-mz.124-4.T8.bin

[R1]G.SHDSL <-----------> G.SHDSL [R2]

test on wire: RJ11 ,4-wire

R1 as CO
R2 as CPE

[R1]

controller DSL 0
mode atm
line-term co
line-mode 4-wire enhanced
dsl-mode shdsl symmetric annex B
line-rate 2048
!
interface ATM0
ip address 192.168.2.1 255.255.255.0
no atm ilmi-keepalive
pvc 0/100
broadcast
encapsulation aal5snap
!
!


[R2]

controller DSL 0
mode atm
line-term cpe
line-mode 4-wire enhanced
dsl-mode shdsl symmetric annex B
line-rate 2048
!
interface ATM0
ip address 192.168.2.2 255.255.255.0
no atm ilmi-keepalive
pvc 0/100
broadcast
encapsulation aal5snap
!      
!

[Verify]

R1#sh controllers dsL 0

DSL 0 controller UP
SLOT 0: Globespan xDSL controller chipset
Frame mode: Utopia
Configured Line rate: 2048Kbps
Line Mode: Four Wire Enhanced Mode
DSL mode: SHDSL Annex B
Line Re-activated 0 times after system bootup
LOSW Defect alarm: ACTIVE
CRC per second alarm: ACTIVE
Line termination: CO

Line 0 statistics

      Current 15 min CRC: 0
      Current 15 min LOSW Defect: 0
      Current 15 min ES: 0
      Current 15 min SES: 0
      Current 15 min UAS: 19

      Previous 15 min CRC: 0
      Previous 15 min LOSW Defect: 0
      Previous 15 min ES: 0
      Previous 15 min SES: 0
      Previous 15 min UAS: 0


Line 1 statistics

      Current 15 min CRC: 0
      Current 15 min LOSW Defect: 0
      Current 15 min ES: 0
      Current 15 min SES: 0
      Current 15 min UAS: 19

      Previous 15 min CRC: 0
      Previous 15 min LOSW Defect: 0
      Previous 15 min ES: 0
      Previous 15 min SES: 0
      Previous 15 min UAS: 0

Line-0 status
Chipset Version:  0
Firmware Version:  R3.0.1
Modem Status:  Data, Status 1
Last Fail Mode:  No Failure status:0x0
Line rate:  1032 Kbps
Framer Sync Status: In Sync
Rcv Clock Status: In the Range
Loop Attenuation:  0.9 dB
Transmit Power:  7.5 dB
Receiver Gain:  9.7000 dB
SNR Sampling:  38.9000 dB
Line-1 status
Chipset Version:  0
Firmware Version:  R3.0.1
Modem Status:  Data, Status 1
Last Fail Mode:  No Failure status:0x0
Line rate:  1032 Kbps
Framer Sync Status: In Sync
Rcv Clock Status: In the Range
Loop Attenuation:  1.0 dB
Transmit Power:  7.5 dB
Receiver Gain:  9.7000 dB
SNR Sampling:  38.4860 dB
Dying Gasp: Present

R1#sh atm interface aTM 0
Interface ATM0:
AAL enabled:  AAL5  , Maximum VCs: 10, Current VCCs: 1

VCIs per VPI: 1024,
Max. Datagram Size: 4528
PLIM Type: GSHDSL - 2048Kbps, Framing is Unknown,, TX clocking: LINE
3057 input, 3072 output, 0 IN fast, 0 OUT fast
Avail bw = 2048
Config. is ACTIVE

R1#sh atm map
Map list ATM0_ATM_INARP : DYNAMIC
ip 192.168.2.2 maps to VC 1, VPI 0, VCI 100, ATM0
      , broadcast

R1#ping 192.168.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms

Monday, October 5, 2009

[Cisco] Example configuration Load share 2 ADSL lines with NAT and OER/PfR (Optimize Edge Routing)



Example configuration Load share 2 ADSL lines with NAT and OER/PfR (Optimize Edge Routing)


h**p://www.cisco.com/en/US/docs/ios/12_4t/oer/configuration/guide/h_oerstr.html
h**p://www.cisco.com/en/US/docs/ios/12_4t/oer/configuration/guide/h_oerstr.html#wp1054840
h**p://www.netcraftsmen.net/resources/archived-articles/443.html


   +----------ATM0/0/0---------> ADSL line
   |
[192.168.1.1/24]---Fa0/0----[Cisco2811]
   |
   +----------Fa0/1----ADSL modem-------> ADSL line


boot-start-marker
boot system flash:c2800nm-adventerprisek9-mz.124-24.T1.bin
boot-end-marker
!
key chain OER
 key 1
   key-string cisco
!
!
oer master
 no max-range-utilization
 logging
 !
 border 10.0.0.1 key-chain OER
  interface FastEthernet0/0 internal
  interface Dialer0 external
  interface Dialer1 external
 !
 learn
  throughput
  delay
  protocol tcp
  protocol udp
  periodic-interval 3
  monitor-period 2
  aggregation-type prefix-length 32
 delay threshold 20
 backoff 180 360
 mode route control
 mode monitor passive
 mode route metric static tag 60000
!
oer border
 logging
 local Loopback0
 master 10.0.0.1 key-chain OER
!
interface Loopback0
 ip address 10.0.0.1 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1460
 duplex auto
 speed auto
!
interface FastEthernet0/1
 description ## Connect to ADSL modem ##
 no ip address
 duplex auto
 speed auto
 pppoe enable group global
 pppoe-client dial-pool-number 2
!
interface ATM0/0/0
 description ## Connect to ADSL line ##
 no ip address
 no atm ilmi-keepalive
 pvc 0/100 
  pppoe-client dial-pool-number 1
 !        
!
interface Dialer0
 bandwidth 8192
 ip address negotiated
 ip flow ingress
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 load-interval 30
 dialer pool 1
 ppp pap sent-username XXXXX1 password 0 XXXX1
!
interface Dialer1
 bandwidth 4096
 ip address negotiated
 ip flow ingress
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 load-interval 30
 dialer pool 2
 ppp pap sent-username XXXXX2 password 0 XXXX2
!
router ospf 1
 log-adjacency-changes
 redistribute static subnets route-map STATIC->OSPF
 network 10.0.0.1 0.0.0.0 area 0
 network 192.168.1.1 0.0.0.0 area 0
!
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip nat inside source route-map NAT_DSL0 interface Dialer0 overload oer
ip nat inside source route-map NAT_DSL1 interface Dialer1 overload oer
!
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
!
route-map STATIC->OSPF permit 10
 match tag 60000
!
route-map NAT_DSL1 permit 10
 match ip address 1
 match interface Dialer1
!
route-map NAT_DSL0 permit 10
 match ip address 1
 match interface Dialer0
!

Router#sh ip nat statistics 
Total active translations: 65 (0 static, 65 dynamic; 65 extended)
Peak translations: 343, occurred 00:01:10 ago
Outside interfaces:
  Virtual-Access2, Virtual-Access3, Dialer0, Dialer1
Inside interfaces: 
  FastEthernet0/0
Hits: 780840  Misses: 0
CEF Translated packets: 779872, CEF Punted packets: 486
Expired translations: 672
Dynamic mappings:
-- Inside Source
[Id: 1] route-map NAT_DSL0 interface Dialer0 refcount 33
[Id: 2] route-map NAT_DSL1 interface Dialer1 refcount 32
Appl doors: 0
Normal doors: 0
Queued Packets: 0

! === Routing table before apply OER
Router#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     58.0.0.0/32 is subnetted, 4 subnets
C       58.8.92.79 is directly connected, Dialer0
C       58.8.88.84 is directly connected, Dialer1
C       58.8.88.1 is directly connected, Dialer1
C       58.8.92.1 is directly connected, Dialer0
     10.0.0.0/32 is subnetted, 1 subnets
C       10.0.0.1 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 is directly connected, Dialer0
               is directly connected, Dialer1

!== Routing table after apply OER

Router#sh ip route static 
     202.170.115.0/32 is subnetted, 1 subnets
S       202.170.115.94 [1/0] via 0.0.0.0, Dialer1
     66.0.0.0/32 is subnetted, 1 subnets
S       66.235.143.118 [1/0] via 0.0.0.0, Dialer1
     202.129.205.0/32 is subnetted, 1 subnets
S       202.129.205.52 [1/0] via 0.0.0.0, Dialer1
     110.0.0.0/32 is subnetted, 1 subnets
S       110.164.86.167 [1/0] via 0.0.0.0, Dialer1
     24.0.0.0/32 is subnetted, 1 subnets
S       24.67.37.33 [1/0] via 0.0.0.0, Dialer1
     58.0.0.0/32 is subnetted, 5 subnets
S       58.97.45.43 [1/0] via 0.0.0.0, Dialer1
     207.200.111.0/32 is subnetted, 1 subnets
S       207.200.111.33 [1/0] via 0.0.0.0, Dialer1
     208.117.252.0/32 is subnetted, 1 subnets
S       208.117.252.103 [1/0] via 0.0.0.0, Dialer1
     203.144.145.0/32 is subnetted, 1 subnets
S       203.144.145.57 [1/0] via 0.0.0.0, Dialer1
S*   0.0.0.0/0 is directly connected, Dialer0
               is directly connected, Dialer1

Router#sh ip route 202.170.115.94
Routing entry for 202.170.115.94/32
  Known via "static", distance 1, metric 0
  Tag 60000
  Redistributing via ospf 1
  Routing Descriptor Blocks:
  * directly connected, via Dialer1
      Route metric is 0, traffic share count is 1
      Route tag 60000     <==== default route tag is 5000
      
Router#sh ip ospf database external 202.170.115.94   <== verify route tag w/ 60000 redistributed into OSPF

            OSPF Router with ID (10.0.0.1) (Process ID 1)

  Type-5 AS External Link States

  LS age: 17
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 202.170.115.94 (External Network Number )
  Advertising Router: 10.0.0.1
  LS Seq Number: 80000001
  Checksum: 0xF50D
  Length: 36
  Network Mask: /32
 Metric Type: 2 (Larger than any link state path)
 TOS: 0 
 Metric: 20 
 Forward Address: 0.0.0.0
 External Route Tag: 60000

Thursday, June 11, 2009

[Cisco] QoS ทำการ marking ค่า DSCP แล้ว ไม่เห็นค่าที่ mark

Diagram

[SERVER]-----------[CAT1]---------------[CAT2]----------[CLIENT]

อุปกรณ์เป็น Cisco Catalyst6509 มีการ marking input packet จาก SERVER ที่ตัว CAT1 แล้วมาจับ packet ที่ client พบว่า packet ค่า dscp เป็น 0

เนื่องมาจากว่า catalyst6509 มีค่า default ในการ rewrite packet ToS->DSCP

โดยดูจาก command: show mls qos

QoS is enabled globally

QoS ip packet dscp rewrite enabled globally <---- by default

Input mode for GRE Tunnel is Pipe mode

Input mode for MPLS is Pipe mode

Vlan or Portchannel(Multi-Earl) policies supported: Yes

Egress policies supported: Yes

----- Module [5] -----

QoS global counters:

Total packets: 1795932

IP shortcut packets: 0

Packets dropped by policing: 0

IP packets with TOS changed by policing: 459413

IP packets with COS changed by policing: 57

Non-IP packets with COS changed by policing: 0

MPLS packets with EXP changed by policing: 0

จึงทำให้มีการ rewrite ค่าของ DSCP ที่เรา mark ไว้ตั้งแต่ CAT1 เป็นค่าที่ได้จากการ map ToS ค่าจึงเป็น 0 (พูดถึง default mapping จาก ToS->DSCP)

แต่ถ้าต้องการ disable ทำได้ 2 วิธีคือ

1. ตัว CAT2 ที่ global config mode

conf t

no mls qos rewrite ip dscp

!verify

sh mls qos

QoS is enabled globally

QoS ip packet dscp rewrite disabled globally <--- disable

Input mode for GRE Tunnel is Pipe mode

Input mode for MPLS is Pipe mode

Vlan or Portchannel(Multi-Earl) policies supported: Yes

Egress policies supported: Yes

----- Module [5] -----

QoS global counters:

Total packets: 3631461

IP shortcut packets: 0

Packets dropped by policing: 0

IP packets with TOS changed by policing: 550481

IP packets with COS changed by policing: 169

Non-IP packets with COS changed by policing: 0

MPLS packets with EXP changed by policing: 0

2. ตัว CAT2 ที่ interface ที่ต่อกับ CAT1

interface x/x

mls qos trust dscp

Friday, May 15, 2009

[Cisco] QoS for GRE tunnel

เราต้องการ implement QOS บน tunnel interface เนื่องจาก traffic วิ่งอยู่บน tunnel

pre-config บน physical และ tunnel ปกติครับ

ip access-list extended data
permit ip any host 2.2.2.22
ip access-list extended voice
permit ip any host 2.2.2.2
!
ip route 0.0.0.0 0.0.0.0 Tunnel0

policy-map QOS
class voice
priority 128
class data
bandwidth 1024

int tu0
service-policy output QOS <== เมื่อเราป้อน service-policy บน interface tunnel จะเห็น warnning ว่าไม่สามารถ support
Class Based Weighted Fair Queueing not supported on interface Tunnel0

ปกติถ้ามีการ implement QOS บน physical interface เราจะไม่สามารถ classify packet ได้เพราะมันถูก encasulation ด้วย tunnel ไปแล้ว
แต่ถ้าไป implement บน tunnel ก็จะติดfeature บางอย่างบน tunnel interface

วิธีแก้ดังนี้

Solution:
Reference: h**p://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008017405e.shtml

class-map match-all data
match access-group name data
class-map match-all map-voice
match ip precedence 2
class-map match-all map-data
match ip precedence 6
class-map match-all voice
match access-group name voice
!
!
policy-map QOS
class map-voice
priority 128
class map-data
bandwidth 1024
policy-map QOS-tunnel
class voice
set ip precedence 2
class data
set ip precedence 6

int tu0
qos pre-classify
service-policy output QOS-tunnel
int s1/0
service-policy output QOS

Verify:

AS1_PE1#sh int tu0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.0.0.1/24
MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 192.168.12.1 (Serial1/0), destination 192.168.12.2, fastswitch TTL 255
Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
Tunnel TTL 255
Checksumming of packets disabled, fast tunneling enabled
Last input 00:05:26, output 00:05:26, output hang never
Last clearing of "show interface" counters 00:20:05
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo (QOS pre-classification) <=================== qos pre-classify
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
140 packets input, 24080 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
140 packets output, 17360 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out

! Before test send voice packet

AS1_PE1#sh policy-map int tu0
Tunnel0

Service-policy output: QOS-tunnel

Class-map: voice (match-all)
0 packets, 0 bytes <==== 0 packet
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name voice
QoS Set
ip precedence 2
Packets marked 0

Class-map: data (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name data
QoS Set
ip precedence 6
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
AS1_PE1#sh policy-map int s1/0
Serial1/0

Service-policy output: QOS

Class-map: map-voice (match-all)
10 packets, 1280 bytes <===== 10 packet
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 2
Queueing
Strict Priority
Output Queue: Conversation 264
Bandwidth 128 (kbps) Burst 3200 (Bytes)
(pkts matched/bytes matched) 10/1280
(total drops/bytes drops) 0/0

Class-map: map-data (match-all)
20 packets, 2560 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 6
Queueing
Output Queue: Conversation 265
Bandwidth 1024 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20/2560
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
54 packets, 3736 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

! After test send voice 100 packet
AS1_PE1#ping 2.2.2.2 so lo0 re 100

Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 4/16/44 ms
AS1_PE1#sh policy-map int tu0
Tunnel0

Service-policy output: QOS-tunnel

Class-map: voice (match-all)
100 packets, 10000 bytes <--- match voice 100 packet
5 minute offered rate 2000 bps, drop rate 0 bps
Match: access-group name voice
QoS Set
ip precedence 2
Packets marked 100

Class-map: data (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name data
QoS Set
ip precedence 6
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
AS1_PE1#sh policy-map int s1/0
Serial1/0

Service-policy output: QOS

Class-map: map-voice (match-all)
110 packets, 14080 bytes <===== voice increase 100 packet
5 minute offered rate 2000 bps, drop rate 0 bps
Match: ip precedence 2
Queueing
Strict Priority
Output Queue: Conversation 264
Bandwidth 128 (kbps) Burst 3200 (Bytes)
(pkts matched/bytes matched) 110/14080
(total drops/bytes drops) 0/0

Class-map: map-data (match-all)
20 packets, 2560 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 6
Queueing
Output Queue: Conversation 265
Bandwidth 1024 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20/2560
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
61 packets, 4209 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

Wednesday, November 5, 2008

[Troubleshoot] show tcam ที่ apply interface

sh tcam count
sh platform software tcam interface vl10 acl in ip
sh platform software tcam interface vl10 acl out ip

Wednesday, August 6, 2008

[Cisco] ip nat outside source

[PC]<----------[R1]-----------------[R2]

PC = 192.168.2.2/24, no default gateway

[R2]
int lo0
ip add 20.0.0.1 255.255.255.255
int f0/0
ip add 192.168.1.2 255.255.255.0
ip route 10.0.0.1 255.255.255.0 192.168.1.1

[R1]
int f0/0
ip add 192.168.1.1 255.255.255.0
ip nat outside
int f0/1
ip add 192.168.2.1 255.255.255.0
ip nat inside
ip nat inside source static 192.168.2.2 10.0.0.1
ip nat outside source static 20.0.0.1 192.168.2.100 add-route <<<
ip route 0.0.0.0 0.0.0.0 192.168.1.2
ip route 20.0.0.0 255.255.255.0 192.168.1.2 <<<

#sh ip route
20.0.0.0/24 is subnetted, 1 subnets
S 20.0.0.0 [1/0] via 192.168.1.2
192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
S 192.168.1.10/32 [1/0] via 20.0.0.1
C 192.168.1.0/24 is directly connected, FastEthernet0/0
192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
S 192.168.2.10/32 [1/0] via 20.0.0.1
C 192.168.2.0/24 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 192.168.1.2
#sh ip nat tran
Pro Inside global Inside local Outside local Outside global
--- --- --- 192.168.2.10 20.0.0.1
--- 10.0.0.1 192.168.2.2 --- ---

[R2]
R2#ping 10.0.0.1 source lo0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
Packet sent with a source address of 20.0.0.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/15/28 ms

Friday, June 27, 2008

[Cisco] Cisco config DHCPv6

ipv6 dhcp pool DHCPv6POOL
dns-server 2001:FB0:1000:0:192:168:1:1
domain-name domain.co.th

interface GigabitEthernet0/1
des ## LAN ##
ipv6 address 2001:FB0:1::1/64
ipv6 nd other-config-flag
ipv6 dhcp server DHCPv6POOL

* client must support DHCPv6

[Cisco] Config Cisco Multipoint GRE tunnel

Dynamic GRE tunnels (point-to-multipoint)
[R1]--------------[R2]-----------------[R3]

[R1]
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Loopback192
description ## private ip address ##
ip address 192.168.1.1 255.255.255.0
!
interface Tunnel1
ip address 172.16.0.1 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map multicast dynamic
ip nhrp network-id 99
no ip split-horizon
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 1
!
interface Serial1/0.12 point-to-point
ip address 10.3.12.1 255.255.255.0
frame-relay interface-dlci 102
!
router ospf 1
log-adjacency-changes
network 10.1.1.1 0.0.0.0 area 0
network 10.3.12.1 0.0.0.0 area 0
!
router rip
version 2
redistribute connected metric 2 route-map PRIVATE->RIP
network 172.16.0.0
no auto-summary
!
ip access-list standard PRIVATE_192
permit 192.168.1.0
!
!
route-map PRIVATE->RIP permit 10
match ip address PRIVATE_192

R1#sh ip route rip
10.0.0.0/8 is variably subnetted, 12 subnets, 2 masks
R 10.1.3.0/24 [120/2] via 172.16.0.3, 00:00:20, Tunnel1
R 10.1.2.0/24 [120/2] via 172.16.0.2, 00:00:06, Tunnel1
R 192.168.2.0/24 [120/2] via 172.16.0.2, 00:00:06, Tunnel1
R 192.168.3.0/24 [120/2] via 172.16.0.3, 00:00:20, Tunnel1

R1#sh ip route 192.168.3.1
Routing entry for 192.168.3.0/24
Known via "rip", distance 120, metric 2
Redistributing via rip
Last update from 172.16.0.3 on Tunnel1, 00:00:15 ago
Routing Descriptor Blocks:
* 172.16.0.3, from 172.16.0.3, 00:00:15 ago, via Tunnel1
Route metric is 2, traffic share count is 1

R1#ping 192.168.3.1 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/29/52 ms

!------------------------------------------------------------------------------------------------------
[R2]
interface Loopback0
ip address 10.1.2.2 255.255.255.0
!
interface Loopback192
description ### private ip address ###
ip address 192.168.2.1 255.255.255.0
!
interface Tunnel0
ip address 172.16.0.2 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map 172.16.0.1 10.1.1.1
ip nhrp map multicast 10.1.1.1
ip nhrp network-id 99
ip nhrp nhs 172.16.0.1
ip nhrp registration timeout 180
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 1
!
interface Serial1/0.12 point-to-point
ip address 10.3.12.2 255.255.255.0
frame-relay interface-dlci 201
!
interface Serial1/0.23 point-to-point
ip address 10.3.23.2 255.255.255.0
frame-relay interface-dlci 203
!
router ospf 1
log-adjacency-changes
network 10.1.2.2 0.0.0.0 area 0
network 10.3.12.2 0.0.0.0 area 0
network 10.3.23.2 0.0.0.0 area 0
!
router rip
version 2
redistribute connected metric 2 route-map PRIVATE->RIP
network 172.16.0.0
no auto-summary
!
ip access-list standard PRIVATE_192
permit 192.168.2.0
!
route-map PRIVATE->RIP permit 10
match ip address PRIVATE_192

R2# sh ip route rip
10.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
R 10.1.3.0/24 [120/3] via 172.16.0.3, 00:00:19, Tunnel0
R 192.168.1.0/24 [120/2] via 172.16.0.1, 00:00:19, Tunnel0
R 192.168.3.0/24 [120/3] via 172.16.0.3, 00:00:19, Tunnel0
!-------------------------------------------------------------------------------------------
[R3]
interface Loopback0
ip address 10.1.3.3 255.255.255.0
!
interface Loopback192
description ### private ip address ###
ip address 192.168.3.1 255.255.255.0
!
interface Tunnel0
ip address 172.16.0.3 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map 172.16.0.1 10.1.1.1
ip nhrp map multicast 10.1.1.1
ip nhrp network-id 99
ip nhrp nhs 172.16.0.1
ip nhrp registration timeout 180
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 1
!
interface Serial1/0.23 point-to-point
ip address 10.3.23.3 255.255.255.0
frame-relay interface-dlci 302
!
router ospf 1
log-adjacency-changes
network 10.1.3.3 0.0.0.0 area 0
network 10.3.23.3 0.0.0.0 area 0
!
router rip
version 2
redistribute connected metric 2 route-map PRIVATE->RIP
network 172.16.0.0
no auto-summary
!
ip access-list standard PRIVATE_192
permit 192.168.3.0
!
route-map PRIVATE->RIP permit 10
match ip address PRIVATE_192
!

R3#sh ip route rip
10.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
R 10.1.2.0/24 [120/3] via 172.16.0.2, 00:00:00, Tunnel0
R 192.168.1.0/24 [120/2] via 172.16.0.1, 00:00:00, Tunnel0
R 192.168.2.0/24 [120/3] via 172.16.0.2, 00:00:00, Tunnel0
!---------------------------------------------------------------------------------------------

[Cisco] Config TACACS+

aaa authentication login TACPLUS group tacacs+ local
aaa authentication login CONSOLE local group tacacs+ none
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec TACPLUS group tacacs+ local none
aaa authorization exec CONSOLE local none
aaa authorization commands 0 TACPLUS group tacacs+ local none
aaa authorization commands 0 CONSOLE local none
aaa authorization commands 1 TACPLUS group tacacs+ local none
aaa authorization commands 1 CONSOLE local none
aaa authorization commands 15 TACPLUS group tacacs+ local none
aaa authorization commands 15 CONSOLE local none
aaa accounting exec TACPLUS start-stop group tacacs+
aaa accounting exec CONSOLE start-stop group tacacs+
aaa accounting commands 0 TACPLUS start-stop group tacacs+
aaa accounting commands 1 TACPLUS start-stop group tacacs+
aaa accounting commands 1 CONSOLE start-stop group tacacs+
aaa accounting commands 15 TACPLUS start-stop group tacacs+
aaa accounting commands 15 CONSOLE start-stop group tacacs+

username admin privilege 15 password 0 admin

ip tacacs source-interface Loopback0
tacacs-server host 192.168.1.1
tacacs-server key CISCO

line con 0
authorization commands 0 CONSOLE
authorization commands 1 CONSOLE
authorization commands 15 CONSOLE
authorization exec CONSOLE
accounting commands 15 CONSOLE
accounting commands 1 CONSOLE
accounting exec CONSOLE
login authentication CONSOLE

line vty 0 4
authorization commands 0 TACPLUS
authorization commands 1 TACPLUS
authorization commands 15 TACPLUS
authorization exec TACPLUS
accounting commands 1 TACPLUS
accounting commands 15 TACPLUS
accounting exec TACPLUS
login authentication TACPLUS
!

Monday, April 28, 2008

Friday, April 11, 2008

[Cisco] config cisco กับ tacacs+

ต้วอย่างการ config cisco กับ tacacs+ เพื่อ authen, authorize user ที่ login เข้ามาใช้งาน อุปกรณ์

aaa new-model
aaa authentication login default none
aaa authentication login AUTH_TACACS group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default none
aaa authorization exec AUTH_TACACS group tacacs+ local none
aaa authorization commands 1 AUTH_TACACS group tacacs+ local none
aaa authorization commands 15 AUTH_TACACS group tacacs+ local none
aaa accounting exec AUTH_TACACS start-stop group tacacs+
aaa accounting commands 1 AUTH_TACACS start-stop group tacacs+
aaa accounting commands 15 AUTH_TACACS start-stop group tacacs+

tacacs-server host 192.168.1.2
tacacs-server key TACACS_KEY

line vty 0 4
authorization commands 1 AUTH_TACACS
authorization commands 15 AUTH_TACACS
authorization exec AUTH_TACACS
login authentication AUTH_TACACS

!-----------------------------------------
! tac_plus.cfg

key = TACACS_KEY

default authentication = file /etc/passwd
accounting file = /var/log/tac_acc.log

user = $enab15$ {
login = cleartext "enable15"
}

######### GROUP DECLARATION #########

group = Administrator {
default service = permit

# example configuration for authorize commands
cmd = ping {
permit .*
}
cmd = reload {
deny .*
}
cmd = write {
deny .*
}
cmd = copy {
deny .*
}
cmd = show {
deny config
deny running
permit .*
}

cmd = ip {
deny "route 0.0.0.0 0.0.0.0"
permit .*
}
cmd = username {
deny .*
}
cmd = enable {
deny password
deny secret
permit .*
}

cmd = no {
deny "ip route 0.0.0.0 0.0.0.0"
deny "username .*"
deny "enable password .*"
deny "enable secret .*"
permit .*
}

}
user = kitti { service = exec { priv-lvl =15 } member = Administrator }

Wednesday, February 27, 2008

[Cisco] เมื่อเรา enable control plane policing แล้ว ping ตัวเอง

[R1] f0/0 ------------------------------ f1/1 [R2]

[R1]
int f0/0
ip add 150.1.1.1 255.255.255.0

ip access-list extended ICMP
permit icmp and and

class-map ICMP
match access-group name ICMP
policy-map ICMP
class ICMP

control-plane
service-policy input ICMP

#deb ip packet detail
#sh policy-map control-plane
Control Plane

Service-policy input: ICMP

Class-map: ICMP (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps
Match: access-group name ICMP

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

R1#ping 150.1.1.1 re 1 <----- ping count 1

Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 150.1.1.1, timeout is 2 seconds:
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 1/1/1 ms
R1#
00:12:24: IP: s=150.1.1.1 (local), d=150.1.1.1 (FastEthernet0/0), len
100, sending
00:12:24: ICMP type=8, code=0
00:12:24: IP: s=150.1.1.1 (FastEthernet0/0), d=150.1.1.1, len 100, rcvd 2
00:12:24: ICMP type=8, code=0
00:12:24: IP: s=150.1.1.1 (FastEthernet0/0), d=150.1.1.1, len 100, stop
process pak for forus packet
00:12:24: ICMP type=8, code=0
00:12:24: IP: s=150.1.1.1 (local), d=150.1.1.1 (FastEthernet0/0), len
100, sending
00:12:24: ICMP type=0, code=0
00:12:24: IP: s=150.1.1.1 (FastEthernet0/0), d=150.1.1.1, len 100, rcvd 2
00:12:24: ICMP type=0, code=0
00:12:24: IP: s=150.1.1.1 (FastEthernet0/0), d=150.1.1.1
R1#, len 100, stop process pak for forus packet
00:12:24: ICMP type=0, code=0

R1#sh policy-map control-plane

Control Plane

Service-policy input: ICMP

Class-map: ICMP (match-all)
2 packets, 228 bytes <---- สังเกตุว่าเมื่อแสดง log พบว่า match
icmp 2 packet ทั้งๆที่เรา ping count = 1
5 minute offered rate 0 bps
Match: access-group name ICMP

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

เมื่อเราใช้ ethereal จับ packet ดู
No. Time Source Destination Protocol
Info
1 0.000000 ca:00:1c:34:00:00 ca:00:1c:34:00:00 LOOP
Reply

Frame 1 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 27, 2008 10:26:20.228782000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:loop:data]
Ethernet II, Src: ca:00:1c:34:00:00 (ca:00:1c:34:00:00), Dst:
ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
Destination: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
Address: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..1. .... .... .... .... = LG bit: Locally administered
address (this is NOT the factory default)
Source: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
Address: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..1. .... .... .... .... = LG bit: Locally administered
address (this is NOT the factory default)
Type: Loopback (0x9000)
Configuration Test Protocol (loopback)
skipCount: 0
Relevant function:
Function: Reply (1)
Receipt number: 0
Data (40 bytes)

0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 ........

No. Time Source Destination Protocol
Info
3 9.987619 ca:00:1c:34:00:00 ca:00:1c:34:00:00 LOOP
Reply

Frame 3 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 27, 2008 10:26:30.216401000
[Time delta from previous captured frame: 2.968997000 seconds]
[Time delta from previous displayed frame: 2.968997000 seconds]
[Time since reference or first frame: 9.987619000 seconds]
Frame Number: 3
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:loop:data]
Ethernet II, Src: ca:00:1c:34:00:00 (ca:00:1c:34:00:00), Dst:
ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
Destination: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
Address: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..1. .... .... .... .... = LG bit: Locally administered
address (this is NOT the factory default)
Source: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
Address: ca:00:1c:34:00:00 (ca:00:1c:34:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..1. .... .... .... .... = LG bit: Locally administered
address (this is NOT the factory default)
Type: Loopback (0x9000)
Configuration Test Protocol (loopback)
skipCount: 0
Relevant function:
Function: Reply (1)
Receipt number: 0
Data (40 bytes)

0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 ........

พบว่ามันเป็น protocol LOOP ผมเลยไปค้นหาจาก wiki.wireshark.org
h**p://wiki.wireshark.org/Loop?action=show&redirect=Protocols%2Floop

Tuesday, February 5, 2008

[Cisco] ต้องการให้ user ใน LAN ต้อง authentication ก่อนการใช้งาน internet

conf t

aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
aaa authorization auth-proxy default local

ip auth-proxy auth-proxy-banner http ^C
Please authentication first before access internet !!!
^C
ip auth-proxy name PROXY_AUTH http inactivity-time 10
!
int f0/0
des ## LAN ##
ip access-group FW in
ip auth-proxy PROXY_AUTH
no sh
!
ip http server
ip http access-class 55
access-list 55 deny any
!
ip access-list extended FW
deny ip any any

##
sh ip access-list FW <-- เมื่อ authen ผ่าน acl จะสร้างโดยอัติโนมัติ
sh ip auth-proxy cache
!
!
User ต้องเรียก web อะไรก็ได้จากนั้นจะถูก redirect page เพื่อไป authentication และเมื่อ username และ password ถูกก็จะสามารถใช้งาน internet ได้

Monday, February 4, 2008

[Cisco] ต้องการดูว่าใครกำลังติดต่ออยู่กับใคร ด้วย ip flow

conf t
ip flow-top-talkers
top 50
sort-by-bytes
int g0/1
des ## connect to internet ##
ip flow ingress
ip flow egress

#sh ip flow top-talker

[Cisco] แก้ไข Numbering Access-list

เมื่อก่อนเวลาเราแก้ไข access-list ที่เป็นตัวเลข เราไม่สามารถลบบางบรรทัดได้ ใน IOS รุ่นใหม่สามารถแก้ไขได้ทำได้โดยใช้ command เหมือนกับ naming access-list
ตัวอย่างเรามี access-list
access-list 100 permit ip 1.1.1.1 0.0.0.0 any
access-list 100 permit ip 2.2.2.2 0.0.0.0 any
access-list 100 permit ip 3.3.3.3 0.0.0.0 any
ต้องการลบ access-list บรรทัดที่ 2
ip access-list extended 100
no permit ip 2.2.2.2 0.0.0.0 any
ต้องการ verify
sh ip access-list 100
access-list 100 permit ip 1.1.1.1 0.0.0.0 any
access-list 100 permit ip 3.3.3.3 0.0.0.0 any