Network Geek 1i651c

” our command is complete. We can press enter for the command to take effect. We

can

now

see

the

time

using

the

command

“show

clock”.

2) Tab Key for command completion:

Referring to the above image when we type “c?” it shows all the commands starts with “c” and the same case for “co?”, “con?” and “conf?”. As we can see that “configure” is the only command that starts with “conf” we can simply use the “Tab” key to complete the command instead of typing the remaining characters. #21

3) Short command.

Since “configure” is the only command starts with “conf” and “terminal” is the only command starts with “t”. “conf t” uniquely identifies “configure terminal”. So every time we can use “conf t” instead of “configure terminal”. Likewise we can use short command for any type of commands by identifying the unique characters.

#22

5. CONFIGURING CISCO ROUTERS 5.1. ROUTER CONFIGURATION: Routers are used to connect different networks, and switches are used to connect PCs of the same network. Hence each interface of the router should have IP address of different networks. Asg the IP address in router,

Router in the above image has two ports : fa0/0 and fa0/1. IP address 192.168.1.1 with subnet mask 255.255.255.0 is assigned to interface fa0/0 and 192.168.2.1 with subnet mask 255.255.255.0 to interface fa0/1. Router>enable Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface fa 0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#no shutdown Router(config-if)#exit Router(config)#interface fa 0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#no shut Router(config-if)#exit Router(config)#

#23

PING COMMAND: Ping is the most used tool in networking. Ping is very useful in checking the connectivity between two hosts. For example: From the command prompt of 192.168.1.2, if you ping 192.168.1.3, then an echo request is sent from source IP 192.168.1.2 to the destination IP 192.168.1.3. 192.168.1.3 sends an echo reply to 192.168.1.2. This shows that both the devices are connected. PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.2.2: bytes=32 time=1ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Ping statistics for 192.168.2.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC> Above image shows how ping works in windows OS. In Windows each time you ping, 4 echo request will be sent and 4 echo replies will be received.

SAVING RUNNING CONFIGURATION: All the configurations we do will be saved in “running configuration file”. If we power off the router, present configuration will not be saved. In order to save the configuration we have to copy the running configuration file to the startup configuration file. Router#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] Router#

ROUTER WITH 3 INTERFACE: NM-1FE2W module is added additionally to have another interface fa1/0.

#24

5.2. NETWORK ADDRESS, BROADCAST ADDRESS AND VALID HOST ADDRESS: Let us consider the series 192.168.1.X with mask 255.255.255.0. X can vary from 0 to 255. So the IP address can range from 192.168.1.0 to 192.168.1.255. Since the mask is 255.255.255.0, the IP address from 192.168.1.0 to 192.168.1.255 are in the same network. First address and the Last address of the network cannot be assigned to any host(device). First address is called as Network address and Last address is called as the Broadcast Address. Rest of the address are called as Valid Host Addresses. Valid Host Addresses can be assigned to any host in the network. Network Address is a single IP address that is used to represent all the IP address in that network. Whereas Broadcast address is used to send a broadcast message to all the PCs in that network. 192.168.1.0 --- Network Address (First address of the network) 192.168.1.1 --- Valid Host Address 192.168.1.2 --- Valid Host Address . . 192.168.1.253 --- Valid Host Address 192.168.1.254 --- Valid Host Address 192.168.1.255 – Broadcast Address (Last address of the network)

#25

5.3. ROUTING TABLE: Routing Table is a table that every router maintains in order to forward the packets. Routing table in Cisco routers looks like the below image.

The image shows that the router has 3 routing entries. “C” states that these networks are directly connected.

5.4. ARP (ADDRESS RESOLUTION PROTOCOL): Consider the below topology.

When 192.168.1.2 pings 192.168.1.3, 192.168.1.2 sends a ping request to 192.168.1.3 along with the details like protocol, src & dest IP, src & dest MAC. #26

The complete traffic looks like the below one. Data

Protocol

Src IP

Dest IP

Src MAC

Dest MAC

Ping Request

ICMP

192.168.1.2

192.168.1.3

2222.2222.2222

???????

192.168.1.2 PC doesn’t know the MAC address of 192.168.1.3 PC. So the destination MAC field is not known. Now to fill this field 192.168.1.2 PC sends an ARP request to 192.168.1.3 PC asking its MAC address.ARP Request from 192.168.1.2 to 192.168.1.3: Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.2

192.168.1.3

2222.2222.2222

FFFF:FFFF:FFFF

Here the Destination MAC address is ‘FFFF:FFFF:FFFFF’. The MAC address ‘FFFF:FFFF:FFFF’ is reserved for Broadcast purpose. If the destination MAC address is ‘FFFF:FFFF:FFFF’ then it will be broadcasted to all the host in that network. So this ARP request will be received by all the hosts in that network. Here in our scenario it will be received by 192.168.1.3 and 192.168.1.4. 192.168.1.4 PC will not respond to this ARP request because the destination IP in the ARP request is 192.168.1.3. 192.168.1.3 PC will respond to this ARP request since its IP address is in the destination IP address field. ARP Reply from 192.168.1.3 to 192.168.1.2: Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.3

192.168.1.2

3333.3333.3333

2222.2222.2222

This ARP reply will be a unicast message, so only 192.168.1.2 PC will receive this ARP reply. Once 192.168.1.2 PC receives this reply it know the MAC address of the 192.168.1.3 PC. This PC saves this information in a table called ARP table. When ARP request and reply is completed the 192.168.1.2 PC knows the MAC address of 192.168.1.3 PC. Now it can fill the destination MAC address in the ping request which it started at first.

#27

Again filling the ping request field now after the knowing the 192.168.1.3 PC MAC address. Data

Protocol

Src IP

Dest IP

Src MAC

Dest MAC

Ping Request

ICMP

192.168.1.2

192.168.1.3

2222.2222.2222

3333.3333.3333

Data + Protocol = Segment; Segment + Src IP + Dest IP = Packet; Packet + Src MAC + Dest MAC = Frame; Frame is the complete traffic that comes out of computer. Now checking the ARP table of 192.168.1.2 PC>ping 192.168.1.3 Pinging 192.168.1.3 with 32 bytes of data: Reply from 192.168.1.3: bytes=32 time=1ms TTL=128 Reply from 192.168.1.3: bytes=32 time=0ms TTL=128 Reply from 192.168.1.3: bytes=32 time=0ms TTL=128 Reply from 192.168.1.3: bytes=32 time=0ms TTL=128 PC>arp -a Internet Address Physical Address Type 192.168.1.3 3333.3333.3333 dynamic PC>

ARP table of 192.168.1.3 PC>arp -a Internet Address 192.168.1.2

Physical Address 2222.2222.2222

Type dynamic #28

Consider the topology below:

Now pinging from 192.168.1.2 to 192.168.2.2 Data

Protocol

Ping Request ICMP

Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.2

192.168.2.2

2222.2222.2222 ???????

Whenever we try to communicate with the host in the different network the destination MAC address will be the Gateway’s MAC address. So now the 192.168.1.2 PC will send an ARP request to 192.168.1.1 asking for its MAC address. ARP Request from 192.168.1.2 to 192.168.1.1: Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.2

192.168.1.1

2222.2222.2222

FFFF:FFFF:FFFF

ARP Reply from 192.168.1.1 to 192.168.1.2: Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.1

192.168.1.2

1111.1111.1111

2222.2222.2222

Again filling the ping frame after knowing the Gateway’s MAC address. Data

Protocol

Ping Request ICMP

Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.2

192.168.2.2

2222.2222.2222

1111.1111.1111

#29

This frame will be sent to router. Now Router will receive this frame into fa0/0 interface and look at the destination IP and forward it to ‘fa0/1’ port. When the frame is shifted from Router’s Fa0/0 interface to Fa0/1 interface. The Src and Dest MAC address field will change. Now Router’s ‘Fa0/1’ port has to send the frame to 192.168.2.2 PC. The Source MAC will be Fa0/1 interface’s MAC address and Dest MAC address will be 192.168.2.2 PC MAC address. Data

Protocol

Ping Request ICMP

Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.2

192.168.2.2

4444.4444.4444

????????

Since the Router doesn’t know the 192.168.2.2 PC’s MAC address, now fa0/1 interface will send an ARP request to 192.168.2.2 PC asking for its MAC address. ARP Request from 192.168.2.1 to 192.168.2.2: Src IP

Dest IP

Src MAC

Dest MAC

192.168.2.1

192.168.2.2

4444.4444.4444

FFFF:FFFF:FFFF

ARP Reply from 192.168.2.2 to 192.168.2.1: Src IP

Dest IP

Src MAC

Dest MAC

192.168.2.2

192.168.2.1

5555.5555.5555

4444.4444.4444

Again filling the frame now after the knowing the Destination PC’s MAC address. Data

Protocol

Ping Request ICMP

Src IP

Dest IP

Src MAC

Dest MAC

192.168.1.2

192.168.2.2

4444.4444.4444

5555.5555.5555

This frame goes out of Fa0/1’s interface and reaches the 192.168.2.2 PC. Now 192.168.2.2 replying to 192.168.1.2 Data

Protocol

Src IP

Dest IP

Src MAC

Dest MAC

Ping Request

ICMP

192.168.2.2

192.168.1.2

5555.5555.5555

4444.4444.4444

#30

Since 192.168.2.2 PC is going to reply to different network the Dest MAC address is going to be the Gateway’s MAC address (i.e) 192.168.2.1‘s MAC address. For ping reply, ARP will not take place since the MAC addresses of the required devices are known during the ping request itself. This frame enters the fa0/1 interface and the router shifts the frame from fa0/1 interface to fa0/0 interface. Now the Fa0/0 interface has to send it to 192.168.1.2 PC. So the source MAC address will be fa0/0 interface’s MAC address and Dest MAC address will be 192.168.1.2 PC’s MAC address. Data

Protocol

Src IP

Dest IP

Src MAC

Dest MAC

Ping Request

ICMP

192.168.2.2

192.168.1.2

1111.1111.1111

2222.2222.2222

*Note that throughout the transit (from ping request to ping reply) source and destination IP address remains the same, but source and destination MAC address keeps changing whenever the frame crosses any router. Pinging from 192.168.1.2 to 192.168.2.2 PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.2.2: bytes=32 time=1ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Ping statistics for 192.168.2.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC>arp -a Internet Address Physical Address Type 192.168.1.1 1111.1111.1111 dynamic PC> ARP table of 192.168.2.2

PC>arp –a Internet Address 192.168.2.1

Physical Address 4444.4444.4444

Type dynamic

#31

6. STATIC ROUTING, DNS AND DH 6.1. STATIC ROUTING: Routers by default route between the networks that are directly connected. But in most of the situations we need to access the networks that are not directly connected to our router. In that situation, we have to tell our router how to forward packets to that particular destination. This kind of routing is called static routing. Consider the topology shown below.

After asg the IP address, the routing table of Router 0 would be like this. Routing table of Router 0: Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# Routing table of Router 1: Router#show ip route Gateway of last resort is not set C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# #32

From the above table we can clearly identify that: Router 0 does not know how to reach 192.168.3.0/24 network and 192.168.4.0/24 network. Router 1 does not know how to reach 192.168.1.0/24 network and 192.168.2.0/24 network. Now we have to manually say the routers how to reach the unknown networks. In Router 0 we have to type the following commands. Router(config)#ip route 192.168.3.0 255.255.255.0 192.168.5.2 Router(config)#ip route 192.168.4.0 255.255.255.0 192.168.5.2 i.e., We say that, to reach 192.168.3.0/24 and 192.168.4.0/24 it has to go via 192.168.5.2 Show let us check the routing table of the Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 S 192.168.3.0/24 [1/0] via 192.168.5.2 S 192.168.4.0/24 [1/0] via 192.168.5.2 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# Now Router 0 knows that, to reach 192.168.3.0/24 and 192.168.4.0/24 it has to go via 192.168.5.2. In the routing table “S” means that this entry is learned via Static Routing. In Router 1 we to have type the following commands. Router(config)#ip route 192.168.1.0 255.255.255.0 192.168.5.1 Router(config)#ip route 192.168.2.0 255.255.255.0 192.168.5.1 i.e.., We say that, to reach 192.168.1.0/24 or 192.168.2.0/24 it can go via 192.168.5.1 Show let us check the routing table of the Router 1 Router#show ip route Gateway of last resort is not set S 192.168.1.0/24 [1/0] via 192.168.5.1 S 192.168.2.0/24 [1/0] via 192.168.5.1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# #33

Now Router 1 knows that to reach 192.168.1.0/24 and 192.168.2.0/24 it has to go via 192.168.5.1. Ping Result: Now let us ping and check our configuration.Pinging from 192.168.1.2 to 192.168.3.2 PC>ping 192.168.3.2 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Pinging from 192.168.1.2 to 192.168.4.2 PC>ping 192.168.4.2 Reply from 192.168.4.2: bytes=32 time=0ms TTL=126 Reply from 192.168.4.2: bytes=32 time=0ms TTL=126 Reply from 192.168.4.2: bytes=32 time=0ms TTL=126 Reply from 192.168.4.2: bytes=32 time=0ms TTL=126 Above results show that we have successfully pinged 192.168.3.2 and 192.168.4.2 from 192.168.1.2. Thus our static routing configurations are correct.

6.2. STATIC ROUTING WITH 3 ROUTERS: Previously we practiced static routing with 2 Routers. Now we are going to practice static routing with 3 routers. Consider the following topology. Solve the tasks below: Task 1: Any PC from 192.168.1.0/24 should be able to ping any PC in 192.168.2.0/24 Task 2: Any PC from 192.168.2.0/24 should be able to ping any PC in 192.168.3.0/24 Task 3: Any PC from 192.168.1.0/24 should be able to ping any PC in 192.168.3.0/24

#34

Before any Stating Routing configuration let us have a look at the routing tables of all the routers. Routing Table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# Routing Table of Router 1 Router#show ip route Gateway of last resort is not set C 192.168.2.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# Routing Table of Router 2 Router#show ip route Gateway of last resort is not set C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.5.0/24 is directly connected, FastEthernet0/1 Router# From the routing table we can see that no static routing has been configured. Now let us solve the given tasks one by one. #35

Task 1: Any PC from 192.168.1.0/24 should be able to ping any PC in 192.168.2.0/24 In order to solve the Task 1 we have to configure static routing on Router 0 and Router 1 Configuring Router 0 Router 0 doesn’t know how to reach 192.168.2.0/24. So let us configure static routing. Router(config)#ip route 192.168.2.0 255.255.255.0 192.168.4.2 Router(config)#exit Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 S 192.168.2.0/24 [1/0] via 192.168.4.2 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# A static entry for 192.168.2.0/24 is added to the routing table of Router 0. Now for reply traffic we have to configure static routing in Router 1. Configuring Router 1 Router 1 doesn’t know how to reach 192.168.1.0/24. So let us configure static routing. Router(config)#ip route 192.168.1.0 255.255.255.0 192.168.4.1 Router(config)#exit Router#show ip route Gateway of last resort is not set S 192.168.1.0/24 [1/0] via 192.168.4.1 C 192.168.2.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# A static entry for 192.168.1.0/24 is added to the routing table of Router 1. Let us ping and check, Pinging from 192.168.1.2 to 192.168.2.2 PC>ping 192.168.2.2 Reply from 192.168.2.2: bytes=32 time=1ms TTL=126 Reply from 192.168.2.2: bytes=32 time=0ms TTL=126 Reply from 192.168.2.2: bytes=32 time=0ms TTL=126 Reply from 192.168.2.2: bytes=32 time=0ms TTL=126 Ping works! Now let us move to Task 2. #36

Task 2: Any PC from 192.168.2.0/24 should be able to ping any PC in 192.168.3.0/24 In order to solve the Task 2 we have to configure static routing on Router 1 and Router 2 Router 1 doesn’t know how to reach 192.168.3.0/24. So let us configure Router 1 Router(config)#ip route 192.168.3.0 255.255.255.0 192.168.5.2 Router(config)#do show ip route Gateway of last resort is not set S 192.168.1.0/24 [1/0] via 192.168.4.1 C 192.168.2.0/24 is directly connected, FastEthernet0/0 S 192.168.3.0/24 [1/0] via 192.168.5.2 C 192.168.4.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router(config)# A static entry for 192.168.3.0/24 is added to the routing table of Router 1. Now for reply traffic we have to configure static routing in Router 2. Configuring Router 2 Router 2 doesn’t know how to reach 192.168.2.0/24. So let us configure static routing. Router(config)#ip route 192.168.2.0 255.255.255.0 192.168.5.1 Router(config)#exit Router#show ip route Gateway of last resort is not set S 192.168.2.0/24 [1/0] via 192.168.5.1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.5.0/24 is directly connected, FastEthernet0/1 Router# A static entry for 192.168.2.0/24 is added to the routing table of Router 2. Let us ping and check, Pinging from 192.168.2.2 to 192.168.3.2 PC>ping 192.168.3.2 Reply from 192.168.3.2: bytes=32 time=1ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Ping works! Now let us move to Task 3. #37

Task 3: Any PC from 192.168.1.0/24 should be able to ping any PC in 192.168.3.0/24 In order to solve the Task 3 we have to configure static routing on Router 0 and Router 2 Configuring Router 0 Router 0 doesn’t know how to reach 192.168.3.0/24. So let us configure static routing. Router(config)#ip route 192.168.3.0 255.255.255.0 192.168.4.2 Router(config)#do show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 S 192.168.2.0/24 [1/0] via 192.168.4.2 S 192.168.3.0/24 [1/0] via 192.168.4.2 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router(config)# A static entry for 192.168.3.0/24 is added to the routing table of Router 0. Now for reply traffic we have to configure static routing in Router 2. Configuring Router 2 Router 2 doesn’t know how to reach 192.168.1.0/24. So let us configure static routing. Router(config)#ip route 192.168.1.0 255.255.255.0 192.168.5.1 Router(config)#do show ip route Gateway of last resort is not set S 192.168.1.0/24 [1/0] via 192.168.5.1 S 192.168.2.0/24 [1/0] via 192.168.5.1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.5.0/24 is directly connected, FastEthernet0/1 Router(config)# A static entry for 192.168.1.0/24 is added to the routing table of Router 2. Let us ping and check, pinging from 192.168.1.2 to 192.168.3.2 PC>ping 192.168.3.2 Reply from 192.168.3.2: bytes=32 time=1ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Reply from 192.168.3.2: bytes=32 time=0ms TTL=126 Ping works! Finally all the 3 tasks has been completed.

#38

6.3. STATIC ROUTING TO ISP: Task: Configure Static Routing in NetworkGeek Router and try to ping Google server and Facebook Server. Use www.google.com and www.facebook.com to visit respective pages. Note: You should configure only the NetworkGeek Router as configuring other routers is not acceptable

Static routing in ISP, Facebook and Google routers configured already. We have to configure static routing only in NetworkGeek router. Configuring static routing to Facebook Network. Router(config)#ip route 173.252.0.0 255.255.0.0 192.168.2.2 Now let us configure static routing to Google Network. Router(config)#ip route 74.0.0.0 255.0.0.0 192.168.2.2 We can check the connectivity by pining the server address. But instead of pinging the server, this time we can check the connectivity using the web browser. From the web browser of 192.168.1.2 ping to Facebook server(http://74.252.110.27) and Google Server(http://74.125.236.87) using its IP address. The ping result yields the respective web page.

#39

6.4. DNS (DOMAIN NAME SYSTEM): DNS is a service offered by DNS server to resolve IP address of a domain name. It is not possible to the IP address of all the servers in the internet. So we go for a solution called DNS. Humans can easily the domain name rather that ing the IP address. So whenever we use the domain names like facebook.com or google.com our computer asks the DNS server to get the IP address of that respective domain name. After resolving the IP address from the DNS server, our computer sends the information with the resolved IP address as the Destination IP address. For practical examples, watch our videos on DNS.

6.5. DH (DYNAMIC HOST CONFIGURATION PROTOCOL): DH is a very useful service widely used in almost all of the networks today. It is difficult for the Network s to manually configure IP address for every system in the network. Also, it is not a good idea for giving static IP address for Mobile s who stay in the network only temporarily. DH sorts out all the above problems. DH server hands out IP address from its IP address Pool to the clients who connects to the network. Usually when a computer boots or connected to a new network it sends DH request asking an IP address. This request is seen by the DH server and it hands over the next free IP address it has in its IP address pool to the Client PC. If the client PC is inactive for considerable amount time then the DCHP server takes back the IP address it has issued and puts it back to its IP address pool.

#40

7.SUBNETTING 7.1. CLASSIFICATION OF IP ADDRESS: IP address has been classified into 5 classes. Class A,B,C,D & E.

CLASS A: Range: 0.0.0.0 - 127.255.255.255 Default Subnet Mask for Class A – 255.0.0.0 Number of Networks in Class A : 128 Networks Number of IPs in Each Network : 224 = 1,67,77,216 Number of Valid host : 224 – 2 = 1,67,77,214

CLASS B: Range: 128.0.0.0 - 191.255.255.255 Default Subnet Mask for Class B – 255.255.0.0 Number of Networks in Class A : 64 * 256 = 16,384 Networks Number of IPs in Each Network : 216 = 65,536 Number of Valid host : 216 – 2 = 65,534

CLASS C: Range: 192.0.0.0 - 223.255.255.255 Default Subnet Mask for Class C – 255.255.255.0 Number of Networks in Class C : 32 * 256 * 256 = 20,97,152 Networks Number of IPs in Each Network : 28 = 256 Number of Valid host : 28 – 2 = 254

CLASS D: Range : 224.0.0.0 – 239.255.255.255 Subnet Mask : N/A

CLASS E: Range : 240.0.0.0 – 255.255.255.255 Subnet Mask : N/A #41

IP addresses from Class A, B and C are used in internet and Class D & E are used for research purpose and multicast purpose.

BINARY TO DECIMAL: Before we get in to Subnetting, I would like you to read by heart the following values which are put to use in binary to decimal conversion and vice versa. Binary Value

Decimal Value

00000000

0

10000000

128

11000000

192

11100000

224

11110000

240

11111000

248

11111100

252

11111110

254

11111111

255

7.2. SUBNETTING CLASS C ADDRESSES: As we discussed before, in class C we have 20,97,152 networks and each network will have 256 IPs and 254 valid hosts. Now by subnetting the class C addresses we are dividing single a large network into multiple small networks. We can take any one network from Class C to practice subnetting. I would like to practice with 192.168.1.0/24 here.With the default subnet mask 255.255.255.0, First 3 octets represent the network address and 4th octet represents the host address. So the subnet table would look like below. Network Address(NA)

Possible IP(Valid Host)

Broadcast Address(BA)

192.168.1.0

192.168.1.1 – 192.168.1.254

192.168.1.255

#42

Now writing the Subnet mask in binary format. Decimal format -> Binary Format ->

255

.

255

.

255

.

0

11111111 . 11111111 . 11111111 . 00000000

Now we are replacing ‘1’ in the most significant bit of the last octet. The resulting subnet mask would look like. (After Changing) Binary Format ->

11111111 . 11111111 . 11111111 . 10000000

Decimal format ->

255

.

255

.

255

.

128

Now we have changed one ‘0’ to ‘1’ , so the number of bits changed is 1. Let us note that down. No of bit(s) changed: 1 Whenever we change the default subnet mask the network is divided into multiple networks. To know how many networks it is divided into, we have to make a small calculation. No of Networks = 2(no of bits changed) = 21 (since the no of changed bits is 1) = 2. So if we change the mask from 255.255.255.0 to 255.255.255.128 then the network will be divided into two. With the mask 255.255.255.0, 192.168.1.0 to 192.168.1.255 will be in the same network. But with the mask 255.255.255.128 the network is divided into 2 equal halves, so the first half will be a separate network and next half will be a separate network. First half: 192.168.1.0 to 192.168.1.127 Second half: 192.168.1.128 to 192.168.1.255 Now we can practice subnetting by writing the subnet table for different masks.

1) 255.255.255.128 (or) /25 Number of Networks: 2(no of bits changed) = 21 = 2 Total IPs in each Network: 2( no of bits unchanged) = 27 = 128 Valid host in each Network: Total IPs – 2 = 128 -2 = 126.

#43

Network Address(NA)



192.168.1.0

192.168.1.1 – 192.168.1.126

192.168.1.127

192.168.1.128

192.168.1.129 – 192.168.1.254

192.168.1.255

Now let us use the above subnetted networks in the following topology.

Router 0 Configuration: Router>en Router#conf t Router(config)#int fa0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.128 Router(config-if)#no shut Router(config-if)#int fa0/1 Router(config-if)#ip address 192.168.1.129 255.255.255.128 Router(config-if)#no shut Let us ping and check, pinging from 192.168.1.2 to 192.168.1.130 PC>ping 192.168.1.130 Reply from 192.168.1.130: bytes=32 time=1ms TTL=126 Reply from 192.168.1.130: bytes=32 time=0ms TTL=126 Reply from 192.168.1.130: bytes=32 time=0ms TTL=126 Reply from 192.168.1.130: bytes=32 time=0ms TTL=126 Ping works! #44

2) 255.255.255.192 (or) /26 Number of Networks: 2(no of bits changed) = 22 = 4 Total IPs in each Network: 2( no of bits unchanged) = 26 = 64 Valid host in each Network: Total IPs – 2 = 64 -2 = 62. Network Address(NA)



192.168.1.0

192.168.1.1 - 192.168.1.62

192.168.1.63

192.168.1.64

192.168.1.65 - 192.168.1.126

192.168.1.127

192.168.1.128

192.168.1.129 - 192.168.1.190

192.168.1.191

192.168.1.192

192.168.1.193 - 192.168.1.254

192.168.1.255

Now let us use the above subnetted networks in the following topology.

Router 0 IP address Configuration Router(config)#int fa0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.192 Router(config-if)#no shut Router(config-if)#int fa0/1 #45

Router(config-if)#ip address 192.168.1.65 255.255.255.192 Router(config-if)#no shut Router(config-if)#int fa1/0 Router(config-if)#ip address 192.168.1.129 255.255.255.192 Router(config-if)#no shut Router 1 IP address Configuration Router(config)#int fa0/1 Router(config-if)#ip address 192.168.1.130 255.255.255.192 Router(config-if)#no shut Router(config-if)#int fa0/0 Router(config-if)#ip address 192.168.1.193 255.255.255.192 Router(config-if)#no shut Now we have to configure static routing to make this topology work. Router 0 Static routing Configuration: Since 192.168.1.192 is the network address, we have use that address for static routing in Router 0. Router(config)#ip route 192.168.1.192 255.255.255.192 192.168.1.130 Now let us see the routing table of Router 0 Router#show ip route Gateway of last resort is not set 192.168.1.0/26 is subnetted, 4 subnets C 192.168.1.0 is directly connected, FastEthernet0/0 C 192.168.1.64 is directly connected, FastEthernet0/1 C 192.168.1.128 is directly connected, FastEthernet1/0 S 192.168.1.192 [1/0] via 192.168.1.130 Router# Router 1 Static routing Configuration: Since 192.168.1.0 and 192.168.1.64 are network address, we have use those address for static routing in Router 1. Router(config)#ip route 192.168.1.0 255.255.255.192 192.168.1.129 Router(config)#ip route 192.168.1.64 255.255.255.192 192.168.1.129

#46

Now let us see the routing table of Router 1 Router#show ip route Gateway of last resort is not set 192.168.1.0/26 is subnetted, 4 subnets S 192.168.1.0 [1/0] via 192.168.1.129 S 192.168.1.64 [1/0] via 192.168.1.129 C 192.168.1.128 is directly connected, FastEthernet0/1 C 192.168.1.192 is directly connected, FastEthernet0/0 Router# Let us ping and check, pinging from 192.168.1.2 to 192.168.1.194 PC>ping 192.168.1.194 Reply from 192.168.1.194: bytes=32 time=1ms TTL=126 Reply from 192.168.1.194: bytes=32 time=0ms TTL=126 Reply from 192.168.1.194: bytes=32 time=0ms TTL=126 Reply from 192.168.1.194: bytes=32 time=0ms TTL=126

Pinging from 192.168.1.66 to 192.168.1.194 PC>ping 192.168.1.194 Reply from 192.168.1.194: bytes=32 time=1ms TTL=126 Reply from 192.168.1.194: bytes=32 time=0ms TTL=126 Reply from 192.168.1.194: bytes=32 time=0ms TTL=126 Reply from 192.168.1.194: bytes=32 time=0ms TTL=126 Ping works!

3) 255.255.255.224 (or) /27 Number of Networks: 2(no of bits changed) = 23 = 8 Total IPs in each Network: 2(no of bits unchanged) = 25 = 32 Valid host in each Network: Total IPs – 2 = 32 -2 = 30. Network Address(NA)



192.168.1.0

192.168.1.1 - 192.168.1.30

192.168.1.31

192.168.1.32

192.168.1.33 - 192.168.1.62

192.168.1.63

192.168.1.64

192.168.1.65 - 192.168.1.94

192.168.1.95 #47

192.168.1.96 .

192.168.1.97 - 192.168.1.126 .

192.168.1.127 .

.

.

.

192.168.1.224

192.168.1.225 – 192.168.1.254

192.168.1.255

Now let us use the above subnetted networks in the following topology. In the below topology can use any 5 networks out of the 8 networks we have.

Router 0 IP address Configuration Router(config)#int fa0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.224 Router(config-if)#no shut Router(config-if)#int fa0/1 Router(config-if)#ip address 192.168.1.33 255.255.255.224 Router(config-if)#no shut Router(config-if)#int fa1/0 Router(config-if)#ip address 192.168.1.65 255.255.255.224 Router(config-if)#no shut Router 1 IP address Configuration Router(config-if)#int fa0/0 Router(config-if)#ip address 192.168.1.97 255.255.255.224 Router(config-if)#no shut #48

Router(config)#int fa0/1 Router(config-if)#ip address 192.168.1.129 255.255.255.224 Router(config-if)#no shut Router(config-if)#int fa1/0 Router(config-if)#ip address 192.168.1.66 255.255.255.224 Router(config-if)#no shut Now we have to configure static routing to make this topology work. Router 0 Static routing Configuration: Since 192.168.1.96 & 192.168.1.128 are the network address, we have use these address for static routing in Router 0. Router(config)#ip route 192.168.1.96 255.255.255.224 192.168.1.66 Router(config)#ip route 192.168.1.128 255.255.255.224 192.168.1.66 Now let us see the routing table of Router 0 Router#show ip route Gateway of last resort is not set 192.168.1.0/27 is subnetted, 5 subnets C 192.168.1.0 is directly connected, FastEthernet0/0 C 192.168.1.32 is directly connected, FastEthernet0/1 C 192.168.1.64 is directly connected, FastEthernet1/0 S 192.168.1.96 [1/0] via 192.168.1.66 S 192.168.1.128 [1/0] via 192.168.1.66 Router 1 Static routing Configuration: Since 192.168.1.0 & 192.168.1.32 are the network address, we have use these address for static routing in Router 0. Router(config)#ip route 192.168.1.0 255.255.255.224 192.168.1.65 Router(config)#ip route 192.168.1.32 255.255.255.224 192.168.1.65 Now let us see the routing table of Router 1 Router#show ip route Gateway of last resort is not set 192.168.1.0/27 is subnetted, 5 subnets S 192.168.1.0 [1/0] via 192.168.1.65 S 192.168.1.32 [1/0] via 192.168.1.65 C 192.168.1.64 is directly connected, FastEthernet1/0 C 192.168.1.96 is directly connected, FastEthernet0/0 C 192.168.1.128 is directly connected, FastEthernet0/1 Router# After the above configuration all the PCs should be able to ping all other PCs.

#49




192.168.1.0

192.168.1.1 - 192.168.1.14

192.168.1.15

192.168.1.16

192.168.1.17 - 192.168.1.30

192.168.1.31

192.168.1.32

192.168.1.33 - 192.168.1.46

192.168.1.47

192.168.1.48 . . 192.168.1.240

192.168.1.49 - 192.168.1.62 . . 192.168.1.241 – 192.168.1.254

192.168.1.63 . . 192.168.1.255




192.168.1.0

192.168.1.1 - 192.168.1.6

192.168.1.7

192.168.1.8

192.168.1.9 - 192.168.1.14

192.168.1.15

192.168.1.16

192.168.1.17 - 192.168.1.22

192.168.1.23

192.168.1.24 . . 192.168.1.248

192.168.1.25 - 192.168.1.30 . . 192.168.1.249 – 192.168.1.254

192.168.1.31 . . 192.168.1.255

#50




192.168.1.0

192.168.1.1 - 192.168.1.2

192.168.1.3

192.168.1.4

192.168.1.5 - 192.168.1.6

192.168.1.7

192.168.1.8

192.168.1.9 - 192.168.1.10

192.168.1.11

192.168.1.12 . . 192.168.1.252

192.168.1.13 - 192.168.1.14 . . 192.168.1.253 – 192.168.1.254

192.168.1.15 . . 192.168.1.255

For /31 and /32 we won’t get any valid host, so we can stop till /30. But there are situations where we can even use /31 and /32 in real world. We will see the use of /31and /32 later in this course.

7.3. SUBNETTING CLASS B ADDRESSES: As we discussed before, in class B we have 16,384 networks and each network will have 65,536 IPs and 65,534 valid host. Now by subnetting the class B addresses we are dividing single large network into multiple small networks. We can take any one network from Class B to practice subnetting. I would like to practice with 172.16.0.0/16 here. With the default subnet mask 255.255.0.0, First 2 octets represent the network address and last two octets represents the host address. So the subnet table would look like below. Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.255.254

172.16.255.255

#51

EXERCISE: Write the subnet table for the following slash notation. 1) 172.16.0.0/17 2) 172.16.0.0/18 3) 172.16.0.0/19 4) 172.16.0.0/20 5) 172.16.0.0/23 6) 172.16.0.0/24 7) 172.16.0.0/26 8) 172.16.0.0/29 9) 172.16.0.0/30

SOLUTIONS: 1) 172.16.0.0/17 (or) 172.16.0.0 with mask 255.255.128.0 Number of Networks: 2(no of bits changed) = 22 = 2 Total IPs in each Network: 2( no of bits unchanged) = 215 Valid host in each Network: 215 -2 Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.127.254

172.16.127.255

172.16.128.0

172.16.128.1 – 172.16.255.254

172.16.255.255

2) 172.16.0.0/18 (or) 172.16.0.0 with mask 255.255.192.0 Number of Networks: 2(no of bits changed) = 22 = 4 Total IPs in each Network: 2( no of bits unchanged) = 214 Valid host in each Network: 214 -2

#52

Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.63.254

172.16.63.255

172.16.64.0

172.16.64.1 – 172.16.127.254

172.16.127.255

172.16.128.0

172.16.128.1 – 172.16.191.254

172.16.191.255

172.16.192.0

172.16.192.1 – 172.16.255.254

172.16.255.255

3) 172.16.0.0/19 (or) 172.16.0.0 with mask 255.255.224.0 Number of Networks: 2(no of bits changed) = 23 = 8 Total IPs in each Network: 2( no of bits unchanged) = 213 Valid host in each Network: 213 -2 Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.31.254

172.16.31.255

172.16.32.0

172.16.32.1 – 172.16.63.254

172.16.63.255

172.16.64.0

172.16.64.1 – 172.16.95.254

172.16.95.255

172.16.96.0 . . 172.16.224.0

172.16.96.1 – 192.16.127.254 . . 172.16.224.1 – 172.16.255.254

172.16.127.255 . . 172.16.255.2555

4) 172.16.0.0/20 (or) 172.16.0.0 with mask 255.255.240.0 Number of Networks: 2(no of bits changed) = 24 = 16 Total IPs in each Network: 2( no of bits unchanged) = 212 Valid host in each Network: 212 -2 #53

Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.15.254

172.16.15.255

172.16.16.0

172.16.16.1 – 172.16.31.254

172.16.31.255

172.16.32.0

172.16.32.1 – 172.16.47.254

172.16.47.255

172.16.48.0 . . 172.16.240.0

172.16.48.1 – 192.16.63.254 . . 172.16.240.1 – 172.16.255.254

172.16.63.255 . . 172.16.255.2555




172.16.0.0

172.16.0.1 – 172.16.1.254

172.16.1.255

172.16.2.0

172.16.2.1 – 172.16.3.254

172.16.3.255

172.16.4.0

172.16.4.1 – 172.16.5.254

172.16.5.255

172.16.6.0 . . 172.16.254.0

172.16.6.1 – 192.16.7.254 . . 172.16.254.1 – 172.16.255.254

172.16.7.255 . . 172.16.255.2555

6) 172.16.0.0/24 (or) 172.16.0.0 with mask 255.255.255.0 Number of Networks: 2(no of bits changed) = 28 = 256 Total IPs in each Network: 2( no of bits unchanged) = 28 Valid host in each Network: 28 -2

#54

Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.0.254

172.16.0.255

172.16.1.0

172.16.1.1 – 172.16.1.254

172.16.1.255

172.16.2.0

172.16.2.1 – 172.16.2.254

172.16.2.255

172.16.3.0 . . 172.16.255.0

172.16.3.1 – 192.16.3.254 . . 172.16.255.1 – 172.16.255.254

172.16.3.255 . . 172.16.255.2555

7) 172.16.0.0/26 (or) 172.16.0.0 with mask 255.255.255.192 Number of Networks: 2(no of bits changed) = 210 = 1,024 Total IPs in each Network: 2( no of bits unchanged) = 26 = 64 Valid host in each Network: 26 -2 = 62 Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.0.62

172.16.0.63

172.16.0.64

172.16.0.65 – 172.16.0.126

172.16.0.127

172.16.0.128

172.16.0.129 – 172.16.0.190

172.16.0.191

172.16.0.192 . . 172.16.255.192

172.16.0.193 – 192.16.0.254 . . 172.16.255.193 – 172.16.255.254

172.16.0.255 . . 172.16.255.255

8) 172.16.0.0/29 (or) 172.16.0.0 with mask 255.255.255.248 Number of Networks: 2(no of bits changed) = 213 = 8,192 Total IPs in each Network: 2( no of bits unchanged) = 23 = 8 Valid host in each Network: 23 -2 = 6

#55

Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.0.6

172.16.0.7

172.16.0.8

172.16.0.9 – 172.16.0.14

172.16.0.15

172.16.0.16

172.16.0.17 – 172.16.0.22

172.16.0.23

172.16.0.24 . . 172.16.255.248

172.16.0.25 – 192.16.0.30 . . 172.16.255.249 – 172.16.255.254

172.16.0.31 . . 172.16.255.255

9) 172.16.0.0/30 (or) 172.16.0.0 with mask 255.255.255.252 Number of Networks: 2(no of bits changed) = 214 = 16,384 Total IPs in each Network: 2( no of bits unchanged) = 22 = 4 Valid host in each Network: 22 -2 = 2 Network Address(NA)



172.16.0.0

172.16.0.1 – 172.16.0.2

172.16.0.3

172.16.0.4

172.16.0.5 – 172.16.0.6

172.16.0.7

172.16.0.8

172.16.0.9 – 172.16.0.10

172.16.0.11

172.16.0.12 . . 172.16.255.252

172.16.0.13 – 192.16.0.14 . . 172.16.255.253 – 172.16.255.254

172.16.0.15 . . 172.16.255.255

7.4. SUBNETTING CLASS A ADDRESSES: As we discussed before, in class A we have 128 networks and each network will have 1,67,77,216 IPs and 1,67,77,214 valid host. Now by subnetting the class A addresses we are dividing single large network into multiple small networks. #56

We can take any one network from Class A to practice subnetting. I would like to practice with 10.0.0.0/8 here. With the default subnet mask 255.0.0.0, First octet represent the network address and last three octets represents the host address. So the subnet table would look like below. Network Address(NA)



10.0.0.0

10.0.0.1 – 10.255.255.254

10.255.255.255

EXERCISE: Write the subnet table for the following slash notation. 1) 10.0.0.0/9 2) 10.0.0.0/10 3) 10.0.0.0/11 4) 10.0.0.0/15 5) 10.0.0.0/16 6) 10.0.0.0/20 7) 10.0.0.0/24 8) 10.0.0.0/26 9) 10.0.0.0/30

SOLUTIONS: 1) 10.0.0.0/9 (or) 10.0.0.0 with mask 255.128.0.0 Number of Networks: 2(no of bits changed) = 21 = 2 Total IPs in each Network: 2( no of bits unchanged) = 223 Valid host in each Network: 223 -2

#57

Network Address(NA)



10.0.0.0

10.0.0.1 – 10.127.255.254

10.127.255.255

10.128.0.0

10.128.0.1 – 10.255.255.254

10.255.255.255




10.0.0.0

10.0.0.1 – 10.63.255.254

10.63.255.255

10.64.0.0

10.64.0.1 – 10.127.255.254

10.127.255.255

10.128.0.0

10.128.0.1 – 10.191.255.254

10.191.255.255

10.192.0.0

10.192.0.1 – 10.255.255.254

10.255.255.255




10.0.0.0

10.0.0.1 – 10.31.255.254

10.31.255.255

10.32.0.0

10.32.0.1 – 10.63.255.254

10.63.255.255

10.64.0.0

10.64.0.1 – 10.95.255.254

10.95.255.255

10.96.0.0 . . 10.224.0.0

10.96.0.1 – 10.127.255.254 . . 10.224.0.1 – 10.255.255.254

10.127.255.255 . . 10.255.255.255 #58




10.0.0.0

10.0.0.1 – 10.1.255.254

10.1.255.255

10.2.0.0

10.2.0.1 – 10.3.255.254

10.3.255.255

10.4.0.0

10.4.0.1 – 10.5.255.254

10.5.255.255

10.6.0.0 . . 10.254.0.0

10.6.0.1 – 10.7.255.254 . . 10.254.0.1 – 10.255.255.254

10.7.255.255 . . 10.255.255.255




10.0.0.0

10.0.0.1 – 10.0.255.254

10.0.255.255

10.1.0.0

10.1.0.1 – 10.1.255.254

10.1.255.255

10.2.0.0

10.2.0.1 – 10.2.255.254

10.2.255.255

10.3.0.0 . . 10.255.0.0

10.3.0.1 – 10.3.255.254 . . 10.255.0.1 – 10.255.255.254

10.3.255.255 . . 10.255.255.255

#59

6) 10.0.0.0/20 (or) 10.0.0.0 with mask 255.255.240.0 Number of Networks: 2(no of bits changed) = 212 = 4,096 Total IPs in each Network: 2( no of bits unchanged) = 212 Valid host in each Network: 212 -2 Network Address(NA)



10.0.0.0

10.0.0.1 – 10.0.15.254

10.0.15.255

10.0.16.0

10.0.16.1 – 10.0.31.254

10.0.31.255

10.0.32.0

10.0.32.1 – 10.0.47.254

10.0.47.255

10.0.48.0 . . 10.255.240.0

10.0.48.1 – 10.0.63.254 . . 10.255.240.1 – 10.255.255.254

10.0.63.255 . . 10.255.255.255

7) 10.0.0.0/24 (or) 10.0.0.0 with mask 255.255.255.0 Number of Networks: 2(no of bits changed) = 216 = 65,536 Total IPs in each Network: 2( no of bits unchanged) = 28 = 256 Valid host in each Network: 28 - 2 = 254 Network Address(NA)



10.0.0.0

10.0.0.1 – 10.0.0.254

10.0.0.255

10.0.1.0

10.0.1.1 – 10.0.1.254

10.0.1.255

10.0.2.0

10.0.2.1 – 10.0.2.254

10.0.2.255

10.0.3.0 . . 10.255.255.0

10.0.3.1 – 10.0.3.254 . . 10.255.255.1 – 10.255.255.254

10.0.3.255 . . 10.255.255.255

#60

8) 10.0.0.0/26 (or) 10.0.0.0 with mask 255.255.255.192 Number of Networks: 2(no of bits changed) = 218 = 2,62,144 Total IPs in each Network: 2( no of bits unchanged) = 26 = 64 Valid host in each Network: 26 - 2 = 62 Network Address(NA)



10.0.0.0

10.0.0.1 – 10.0.0.62

10.0.0.63

10.0.0.64

10.0.0.65 – 10.0.0.126

10.0.0.127

10.0.0.128

10.0.0.129 – 10.0.0.190

10.0.0.191

10.0.0.192 . . 10.255.255.192

10.0.0.193 – 10.0.0.254 . . 10.255.255.193 – 10.255.255.254

10.0.0.255 . . 10.255.255.255

9) 10.0.0.0/30 (or) 10.0.0.0 with mask 255.255.255.252 Number of Networks: 2(no of bits changed) = 222 = 41,94,304 Total IPs in each Network: 2( no of bits unchanged) = 22 = 4 Valid host in each Network: 22 - 2 = 2 Network Address(NA)



10.0.0.0

10.0.0.1 – 10.0.0.2

10.0.0.3

10.0.0.4

10.0.0.5 – 10.0.0.6

10.0.0.7

10.0.0.8

10.0.0.9 – 10.0.0.10

10.0.0.11

10.0.0.12 . . 10.255.255.252

10.0.0.13 – 10.0.0.14 . . 10.255.255.253 – 10.255.255.254

10.0.0.15 . . 10.255.255.255

#61

EXERCISE: Find the Network Address and Broadcast Address for the IP Address given below.. 192.168.1.77/28 192.168.1.222/30 172.16.0.56/17 172.16.1.177/28 172.16.56.22/20 10.0.0.1/9 10.0.119.5/26 10.15.15.15/23 10.10.20.20/14

SOLUTIONS: 1) 192.168.1.77/28 Network Address: 192.168.1.64 Broadcast Address: 192.168.1.79

2) 192.168.1.222/30 Network Address: 192.168.1.220 Broadcast Address: 192.168.1.223



#62






7.5. SUBNETTING BASED ON NETWORKS: SCENE 1: An Organization has purchased the Class C address 216.21.5.0/24 and they have decided to use it in a network like this..

#63

Questions: 1) What is the subnet mask u ll suggest in order to make the organization happy with their purchase of IP address class? 2) How much valid Host each network can have with your suggestion? 3) Slash notation for the subnet u suggested ?

SCENE 2: Network: 193.2.120.0/24 Need: 50 networks

Questions: 1) What is the subnet mask u ll suggest in order to satisfy the need? 2) How much valid Host each network can have with your suggestion? 3) Slash notation for the subnet u suggested ?





#64

SOLUTIONS: Scene 1:

1) 255.255.255.224

2) 30

3) /27

Scene 2:

1) 255.255.255.252

2) 2

3) /30

Scene 3:

1) 255.255.254.0

2) 510

3) /23

Scene 4:

1) 255.255.128.0

2) 215 - 2

3) /17

7.6. SUBNETTING BASED ON HOSTS: SCENE 1: An Organization has purchased the Class C address 216.21.5.0/24 and they have decided to use it in a network like this with only 30 host per Network..

Questions: 1) What is the subnet mask u ll suggest in order to make the organization happy with their purchase of IP address class? 2) How much networks are possible? 3) Slash notation for the subnet u suggested ?

SCENE 2: Network: 193.2.120.0/24 Need: 50 host per networks #65

Questions: 1) What is the best subnet mask u ll suggest in order to satisfy the need? 2) How much networks are possible? 3) Slash notation for the subnet u suggested ?

SCENE 3: Network: 140.2.0.0/16 Need: 500 hosts per Network


SCENE 4: Network: 10.0.0.0/8 Need: 100 hosts per network


SOLUTIONS: Scene 1:

1) 255.255.255.224

2) 8

3) /27

Scene 2:

1) 255.255.255.192

2) 4

3) /26

Scene 3:

1) 255.255.254.0

2) 128

3) /23

Scene 4:

1) 255.255.255.128

2) 217

3) /25

*Note: If you can solve the above questions on your own, you have good enough knowledge in subnetting. If not, then practice more. For more questions on subnetting online visit http://www.subnettingquestions.com/ #66

7.7. FEW MORE SHOW COMMANDS: Previously we have learnt few show command like ‘show clock’ and ‘show ip route’ but there are few more show commands we have to learn at this point. 1) To see the IP address & the status of the interface of the router. Router#show ip interface brief Interface IP-Address

OK? Method Status

Protocol

FastEthernet0/0

YES manual up

down

FastEthernet0/1 192.168.2.1 YES manual up Router# 2) To see the running configuration of the router.

down

192.168.1.1

Running configuration has all the configuration of the router. Router#show running-config Building configuration... Current configuration : 561 bytes ! version 12.4 no service timestamps log datetime msec no service timestamps debug datetime msec service -encryption ! hostname Router ! ! spanning-tree mode pvst ! interface FastEthernet0/0 ip address 192.168.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet0/1 ip address 192.168.2.1 255.255.255.0 duplex auto speed auto ! interface Vlan1 no ip address #67

shutdown ! ip classless ! ! line con 0 ! line aux 0 ! line vty 0 4 ! End

#68

8. ROUTER SECURITY AND TELNET 8.1. ROUTER SECURITY: It is always a good practice & important to secure a router with a . In Cisco routers we can set to the ‘enable mode’ using the following command. Router#en Router#conf t Router(config)#enable cisco123 Router(config)# Now our is set to ‘cisco123’. Now when we move from mode to enable mode the router will prompt us a . Router(config)#exit Router#exit Router>en : Router# But the ‘cisco123’ is visible as a clear text in the router running-configuration. We can see the router running configuration with the following command. Router#show running-config Building configuration... Current configuration : 516 bytes ! version 12.4 no service timestamps log datetime msec no service timestamps debug datetime msec no service -encryption ! hostname Router ! ! ! enable cisco123 ! ! Router# It is not good idea to leave the as a clear text. We have to encrypt the so that it is stored as an encrypted text in the running configuration. We can encrypt the using the following command. #69

Router(config)#service -encryption Router(config)# Router(config)#do show running-config Building configuration... Current configuration : 525 bytes ! version 12.4 no service timestamps log datetime msec no service timestamps debug datetime msec service -encryption ! hostname Router ! ! ! enable 7 0822455D0A16544541 ! ! Router(config)# Now the ‘cisco123’ is stored as an encrypted text ‘0822455D0A16544541’. The value 7 means that it uses level 7 encryption. Even this encrypted can be decrypted easily. Many websites are available online to decrypt the level 7 . You can try for yourself in the url http://www.ifm.net.nz/cookbooks/cracker.html

Above image shows that the Type 7 ‘0822455D0A16544541’ is cracked easily. So instead of using Type 7 encryption we have to hash the . Following command is used to hash the .

#70

Router(config)#enable secret cisco123 Router(config)# Router(config)#do show running-config Building configuration... Current configuration : 535 bytes ! version 12.4 no service timestamps log datetime msec no service timestamps debug datetime msec service -encryption ! hostname Router ! ! enable secret 5 $1$mERr$5.a6P4JqbNiMX01usIfka/ ! Router# Now the is hashed using md5 hashing method. It is not easy to break the hash. The only way to break the hash is using the bruteforce attack. It is extremely difficult to break if the is really strong.

CONSOLE CABLE: Console connection is one of the few ways to configure routers using CLI. In fact, a brand new router can be configured only using the console cable. One end of the cable is connected to router and the other end is connected to the laptop. Console cable and console connection images are show below.

(a) Console Cable

(b) Console Connection

#71

Once the cable is connected as shown, we can use terminal emulator software like Putty, TeraTerm, SecureCrt etc. to get the CLI of the router. Once we get the CLI of the router we can configure routers with the commands.

8.2. TELNET CONNECTION: If we are physically near the router then we can use the console cable to configure the router. If we need to access the CLI of the router from remote locations then Telnet & SSH will be the solution. Accessing the router from remote location is called Telnet connection. Telnet is not enabled by default. We have to enable the telnet feature of the router by configuring it through the console connection. Once we make the router ready to listen for remote access, then we can configure the router from remote locations. We going to try telnet connection with the topology below.

Configuring Router 0 Router>en Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#enable secret cisco123 Router(config)#line vty 0 4 Router(config-line)# cisco Router(config-line)#exit Router(config)#

#72

Enable must be assigned for telnet to work. Telnet configuration starts from ‘line vty 0 4’ command. The value ‘0 4’ means ‘0 to 4’ (i.e) 5 people can access the router at the same time remotely. The for telnet is ‘’cisco’. The for enable mode is ‘cisco123’. Now from the command prompt of 192.168.1.2, let us telnet the router using its IP address (i.e) 192.168.1.1.

Above image shows that from a PC we have accessed CLI of the router using the telnet command. First it asks for the telnet & I have given ‘cisco’. It then puts me in the mode of the router. Then when I tried to move to enable mode using the command ‘en’, it asks for the enable and I have given ‘cisco123’ and then it lets me in. Now I can configure the router from the location where I’m in.

#73

9. DYNAMIC ROUTING PROTOCOL 9.1. DYNAMIC ROUTING PROTOCOL – INTRODUCTION: Static routing becomes difficult when the number of routers in our network increases. Dynamic routing provides the solution for that. In CCNA we will discuss about 3 dynamic routing protocols. 1) RIP – Routing Information Protocol. 2) OSPF – Open Short Path First 3) EIGRP – Enhanced Interior Gateway Routing Protocol.

9.2. RIP (ROUTING INFORMATION PROTOCOL): RIP protocol was developed in the year 1969. Even though nobody uses RIP presently, it lays the foundation for the working of dynamic routing protocols. Let us consider some scenarios to understand the working of RIP.

Before making any configuration let us check the routing table of Router 0 and Router 1 Routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 Router#

#74

Routing table of Router 1 Router#show ip route Gateway of last resort is not set C 192.168.2.0/24 is directly connected, FastEthernet0/1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 Router# Now let us configure RIP and check the routing table again. In dynamic routing every router tells (s) the other routers about the network it knows. RIP configuration on Router 0 Router(config)#router rip Router(config-router)#network 192.168.1.0 Router(config-router)#network 192.168.3.0 Router(config-router)#exit Router(config)# Now Router 0 tells the other router that it has 192.168.1.0 network and 192.168.3.0 network. RIP configuration on Router 1 Router(config)#router rip Router(config-router)#network 192.168.2.0 Router(config-router)#network 192.168.3.0 Router(config-router)#exit Router(config)# Now Router 1 tells the other router that it has 192.168.2.0 network and 192.168.3.0 network. Since RIP is configured on both the routers they can listen to what the other router says. Thus automatically updates its routing table. Now let us check the routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/1 R 192.168.2.0/24 [120/1] via 192.168.3.2, 00:00:14, FastEthernet0/0 C 192.168.3.0/24 is directly connected, FastEthernet0/0 Router#

#75

Routing table of Router 1 Router#show ip route Gateway of last resort is not set R 192.168.1.0/24 [120/1] via 192.168.3.1, 00:00:15, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 Router# The letter ‘R’ represents that it has learnt the routing update through RIP protocol. In the RIP entry, we can see [120/1] next to the network address. Actually it stands for [istrative Distance / Hop Count] istrative Distance is a rating given to the protocol. RIP gets the rating of 120. Hop Count means the number of routers it has to cross in order to reach a particular network. In above scenario it has to cross one router Now Router 0came to know about 192.168.2.0 network and Router 1came to know about 192.168.1.0 network. Let us ping and check. Pinging from 192.168.1.2 to 192.168.2.2 PC>ping 192.168.2.2 Reply from 192.168.2.2: bytes=32 time=0ms TTL=126 Reply from 192.168.2.2: bytes=32 time=0ms TTL=126 Reply from 192.168.2.2: bytes=32 time=2ms TTL=126 Reply from 192.168.2.2: bytes=32 time=0ms TTL=126 Ping works!

#76

RIP BETWEEN 3 ROUTERS:

RIP configuration on Router 0 Router(config)#router rip Router(config-router)#network 192.168.1.0 Router(config-router)#network 192.168.4.0 Router(config-router)#exit Router(config)# RIP configuration on Router 1 Router(config)#router rip Router(config-router)#network 192.168.2.0 Router(config-router)#network 192.168.4.0 Router(config-router)#network 192.168.5.0 Router(config-router)#exit Router(config)# RIP configuration on Router 2 Router(config)#router rip Router(config-router)#network 192.168.3.0 Router(config-router)#network 192.168.5.0 Router(config-router)#exit Router(config)#

#77

Routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 R 192.168.2.0/24 [120/1] via 192.168.4.2, 00:00:14, FastEthernet0/1 R 192.168.3.0/24 [120/2] via 192.168.4.2, 00:00:09, FastEthernet0/1 C 192.168.4.0/24 is directly connected, FastEthernet0/1 R 192.168.5.0/24 [120/1] via 192.168.4.2, 00:00:13, FastEthernet0/1 Router# Routing table of Router 1 Router#show ip route Gateway of last resort is not set R 192.168.1.0/24 [120/1] via 192.168.4.1, 00:00:14, FastEthernet0/1 C 192.168.2.0/24 is directly connected, FastEthernet0/0 R 192.168.3.0/24 [120/1] via 192.168.5.2, 00:00:09, FastEthernet1/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet1/0 Router# Routing table of Router 2 Router#show ip route Gateway of last resort is not set R 192.168.1.0/24 [120/2] via 192.168.5.1, 00:00:14, FastEthernet0/1 R 192.168.2.0/24 [120/1] via 192.168.5.1, 00:00:08, FastEthernet0/1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 R 192.168.4.0/24 [120/1] via 192.168.5.1, 00:00:03, FastEthernet0/1 C 192.168.5.0/24 is directly connected, FastEthernet0/1 Router# All three routers know how to reach all the networks. Now we can ping from any system to any other system.

#78

9.3. LOAD BALANCING: According to routers if a particular destination has two are more equal paths then the router sends the traffic equally in all the paths. In below scenario 192.168.1.2 has two equal paths to reach 192.168.2.2. RIP has been already configured on all the 4 routers.

Checking the routing table of Router 3 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet1/0 R 192.168.2.0/24 [120/2] via 192.168.3.2, 00:00:04, FastEthernet0/0 [120/2] via 192.168.4.2, 00:00:25, FastEthernet0/1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 R 192.168.5.0/24 [120/1] via 192.168.3.2, 00:00:04, FastEthernet0/0 R 192.168.6.0/24 [120/1] via 192.168.4.2, 00:00:25, Fast Ethernet0/1 Router# Routing table of Router3 shows that it has two paths to reach 192.168.2.0/24 network, one is through 192.168.3.2 and the other is through 192.168.4.2. So whenever the router receives a packet that is destined to 192.168.2.0/24 network it sends the packet in both the path in a round robin manner. We can also this from 192.168.1.2. From the command prompt we can use the command ‘tracert’ to check the path in which the packet travels. Tracing the path from 192.168.1.2 to 192.168.2.2 #79

The first packet is sent via 192.168.3.2 and the second packet is sent via 192.168.4.2. Thus balancing the traffic. ‘tracert ’ command is widely used in troubleshooting the network issues.

9.4. SUMMARIZATION: Summarization is also called as supernetting. It is a reverse process of subnetting. In subnetting, we split a single network into multiple networks. In summarization we combine multiple networks into a single network. Let us use the logic we used in subnetting.

192.168.1.0/25 192.168.1.0/24

192.168.1.0/24 192.168.1.128/25

As we can see that when we split a network, slash notation increases and when we combine the network slash notation decreases. Now let us combine the following networks:

#80

192.168.0.0/24 192.168.0.0/23 192.168.1.0/24 192.168.0.0/22 192.168.2.0/24 192.168.2.0/23 192.168.3.0/24 192.168.0.0/21 192.168.4.0/24 192.168.4.0/23 192.168.5.0/24 192.168.4.0/22 192.168.6.0/24 192.168.6.0/23 192.168.7.0/24

When we combine 2 networks, slash notation decreases by 1 4 networks, slash notation decreases by 2 8 networks, slash notation decreases by 3 16 networks, slash notation decreases by 4 and goes on. The number of networks that can be combined must be a power of 2 i.e 2,4,8,16….etc Also we have to start combining from even networks only (i.e) we can combine only 192.168.0.0/24 and 192.168.1.0/24, whereas combining 192.168.1.0/24 and 192.168.2.0/24 is not possible.

#81

Summarization is done in order to reduce the size to of the routing table. Let us practically implement summarization in the following topology.

Before configuring let us check the routing table of Router 0and Router 1 Routing table of Router 0 Router#show ip route Gateway of last resort is not set C 10.0.0.0/8 is directly connected, FastEthernet0/1 C 192.168.4.0/24 is directly connected, FastEthernet0/0 Router# Routing table of Router 1 Router#show ip route Gateway of last resort is not set C 192.168.0.0/24 is directly connected, FastEthernet0/0 C 192.168.1.0/24 is directly connected, FastEthernet0/1 C 192.168.2.0/24 is directly connected, Ethernet1/1 C 192.168.3.0/24 is directly connected, Ethernet1/0 C 192.168.4.0/24 is directly connected, Ethernet1/2 Router# Now in this example let us configure static routing on Router 0 Router 0 doesn’t know how to reach 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24 & 192.168.3.0/24 networks.

#82

In summarized way: 192.168.0.0/24 192.168.0.0/23 192.168.1.0/24 192.168.0.0/22 192.168.2.0/24 192.168.2.0/23 192.168.3.0/24 As we learned above, these 4 networks can be summarized into 192.168.0.0/22 In Router 0 let us configure static routing in a summarized way. 192.168.0.0/22 means 192.168.0.0 with subnet mask 255.255.252.0 Router(config)#ip route 192.168.0.0 255.255.252.0 192.168.4.1 Routing table of Router 0 Router#show ip route Gateway of last resort is not set C 10.0.0.0/8 is directly connected, FastEthernet0/1 S 192.168.0.0/22 [1/0] via 192.168.4.1 C 192.168.4.0/24 is directly connected, FastEthernet0/0 Router# Now the routing table of Router 0is reduced to single static entry. Whereas if we use normal static routing without summarization it will have 3 more static entries. It is always a good practice to have routing table as small as possible. Let us complete the balance configuration for this topology to work. Configuring static routing on Router 1 Router(config)#ip route 10.0.0.0 255.0.0.0 192.168.4.2

#83

Routing table of Router 1 Router#show ip route Gateway of last resort is not set S 10.0.0.0/8 [1/0] via 192.168.4.2 C 192.168.0.0/24 is directly connected, FastEthernet0/0 C 192.168.1.0/24 is directly connected, FastEthernet0/1 C 192.168.2.0/24 is directly connected, Ethernet1/1 C 192.168.3.0/24 is directly connected, Ethernet1/0 C 192.168.4.0/24 is directly connected, Ethernet1/2 Router# Pinging from 10.0.0.2 to 192.168.0.2, 192.168.1.2, 192.168.2.2, 192.168.3.2

Pingworks!

#84

9.5. LOOPBACK INTERFACE: Loopback interfaces are logical interfaces that can be created in Cisco routers for testing and learning purpose. Loopback interfaces will act same as physical interfaces but we can neither see nor connect any devices to that interfaces. Creating loopback interfaces. We can create maximum of 2147483648 loopback interfaces. From loopback 0 to loopback 2147483647. Since loopback interfaces are on by default, we need not specify ‘no shutdown’ command. Router(config)#int loopback ? <0-2147483647> Loopback interface number Router(config)#int loopback 0 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#exit Router(config)#int loopback 1 Router(config-if)#ip address 192.168.3.1 255.255.255.0 Router(config-if)#exit Router(config)# Loopback interfaces are shown in ‘show ip interface brief’ command. Router#show ip interface brief Interface IP-Address OK? Method Status FastEthernet0/0 192.168.0.1 YES manual up FastEthernet0/1 192.168.1.1 YES manual up FastEthernet1/0 192.168.4.2 YES manual up Loopback0 192.168.2.1 YES manual up Loopback1 192.168.3.1 YES manual up Router#

Protocol up up up up up

9.6. OSPF (OPEN SHORT PATH FIRST): OSPF is an open source protocol & most widely used protocol in today’s world. OSPF has lot of advantages over RIP. OSPF protocol is based on areas. All the routers that runs OSPF must be assigned to certain areas. We’ll understand the advantages of OSPF over RIP later. OSPF uses new field called wildcard bits. Wildcard bits are 4 octets in which ‘255’ represents ‘don’t cares’ and ‘0’ represents ‘look at this’. Wildcard bits are used to networks in OSPF. We’ll understand the use of wildcard bits during the configuration.

#85

Let us simply configure OSPF in the topology below.

Configuring OSPF on Router 0 Router(config)#router ospf ? <1-65535> Process ID Router(config)#router ospf 1 Router(config-router)#network 192.168.1.0 ? A.B.C.D OSPF wild card bits Router(config-router)#network 192.168.1.0 0.0.0.255 area 0 Router(config-router)#network 192.168.2.0 0.0.0.255 area 0 Router(config-router)# While configuring OSPF we must give a Process ID. Process ID is just a number. It can be any number from 1 to 65535. Here I have used a command “network 192.168.1.0 0.0.0.255 area 0”. The wildcard bit is 0.0.0.255, which means in 192.168.1.0, look at 192.168.1(1st three octets) and don’t care 0(last octet) . So after entering the command “network 192.168.1.0 0.0.0.255 area 0” the router will enable OSPF on the interface that has IP address starting with “192.168.1”. In this case fa0/0 has IP address 192.168.1.1. So it will enable OSPF on interface fa0/0. Now the router will the network address of the interface whose IP address is 192.168.1.1/24. This network address is 192.168.1.0/24. Similarly, the command “network 192.168.2.0 0.0.0.255 area 0” will 192.168.2.0/24 network. #86

Configuring OSPF on Router 1 Router(config)#router ospf 1 Router(config-router)#network 192.168.2.0 0.0.0.255 area 0 Router(config-router)#network 192.168.3.0 0.0.0.255 area 0 Router(config-router)# Now Router 1will the 192.168.2.0/24 and 192.168.3.0/24 networks to the other router. Let us check the routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 O 192.168.3.0/24 [110/2] via 192.168.2.2, 00:00:00, FastEthernet0/1 Router# Routing table of Router 1 Router#show ip route Gateway of last resort is not set O 192.168.1.0/24 [110/2] via 192.168.2.1, 00:07:20, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 C 192.168.3.0/24 is directly connected, FastEthernet0/1 Router#

Now Router 0has learned the network 192.168.3.0/24 network from the Router 1s’ ment and vice versa. OSPF has 110 has istrative distance. Lower the istrative distance, better is the protocol. So OSPF is better than the RIP protocol. OSPF doesn’t use hop count. It uses a different formula for path calculation. We discuss later how OPSF calculates the path.

Advantage of Wildcard bits: We can also configure the above topology in a different way by using the advantage of wildcard bits. Now configuring OSPF on Router 0by changing the wildcard bits. Previously we used “0.0.0.255” saying that 1st 3 octets are “look at this”. Now we can use “0.0.255.255” saying that 1st 2 octets are “look at this”. #87

Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Now the Router 0 will the network(s) starting with “192.168”. In this scenario, the router will the networks 192.168.1.0/24 and 192.168.2.0/24. Thus two commands are reduced to one command. Similarly we can configure Router 1 as Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)#

OSPF Router ID: While running OSPF process, each router will have an OSPF Router ID OSPF Router ID of the router will be generated with the following priority

Priority 1: We can manually assign the Static OSPF Router ID using the following command. Router(config)#router ospf 1 Router(config-router)#router-id 1.1.1.1

Priority 2: If we do not assign Static OSPF Router ID, then IP address of the loopback interface will become the OSPF Router ID. If we have multiple loopback interface, then highest IP address of the loopback interfaces will become the OSPF Router ID.

Priority 3: If the router has neither Static Router ID nor loopback interfaces then the highest IP address of physical interface will become the OSPF Router ID.

HELLO PACKET: Whenever we configure OSPF on routers, router will send a hello packet on all the OSPF enabled interfaces. Hello packets will be exchanged between routers. Hello packets will have following information. 1) OSPF Router ID 2) Area * 3) Hello & Dead Timers (10 seconds & 30 seconds respectively)* #88

4) * * marked factors must match between the routers. Router will become neighbor with the peer router whose * field in the hello packet matches. Once they become neighbors, the routing updates will be exchanged between the routers and routing tables will be updated.

HELLO AND DEAD TIMERS: After routing updates are done, routers will still keep sending the hello packet every 10 seconds and expects the same from the peer router. This is called Hello Timer. If the peer router fails to send the hello packet once every 10 seconds then it will wait for a duration of 30 seconds. This is called Dead Timer. If the peer router does not send the hello packet even after the dead timer then it considers the peer router as dead. We can see the OSPF neighbor table of the routers using the following command. In Router 0 Router#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.3.1 1 FULL/DR 00:00:32 192.168.2.2 FastEthernet0/1 Router# Router 0 has one neighbor(Router1) with whom it exchanged the routes. In the ospf neighbor table of Router 0, we can see that the Neighbor ID is 192.168.3.1 which is the OSPF Router ID of the Router 1. Since Router 1 doesn’t have Static OSPF Router ID or loopback interface, the highest IP address of the router becomes the OSPF Router ID. In Router 1 Router#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.2.1 1 FULL/DR 00:00:32 192.168.2.1 FastEthernet0/0 Router# Note: Only directly connected routers can become neighbors.

#89

Let us configure OSPF in the topology below.

Configuring Router 0 Router 0 has two networks (192.168.1.0/24 & 192.168.4.0/24) directly connected. We can use the advantage of wildcard bits here since both the network starts with “192.168” Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Configuring Router 1 Router 1 has two networks (192.168.3.0/24 & 192.168.4.0/24) directly connected. Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Configuring Router 2 Router 2 has two networks (192.168.1.0/24 & 192.168.2.0/24) directly connected. Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# #90

Configuring Router 3 Router 3 has two networks (192.168.2.0/24 & 192.168.3.0/24) directly connected. Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Now let us have a look at the routing table of the routers. Routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 O 192.168.2.0/24 [110/2] via 192.168.1.2, 00:00:29, FastEthernet0/0 O 192.168.3.0/24 [110/2] via 192.168.4.2, 00:00:18, FastEthernet0/1 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# Routing table of Router 1 Router#show ip route Gateway of last resort is not set O 192.168.1.0/24 [110/2] via 192.168.4.1, 00:05:26, FastEthernet0/1 O 192.168.2.0/24 [110/2] via 192.168.3.2, 00:05:26, FastEthernet0/0 C 192.168.3.0/24 is directly connected, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# Routing table of Router 2 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 O 192.168.3.0/24 [110/2] via 192.168.2.2, 00:05:54, FastEthernet0/1 O 192.168.4.0/24 [110/2] via 192.168.1.1, 00:05:54, FastEthernet0/0 Router# Routing table of Router 3 Router#show ip route Gateway of last resort is not set #91

O 192.168.1.0/24 [110/2] via 192.168.2.1, 00:07:17, FastEthernet0/1 C 192.168.2.0/24 is directly connected, FastEthernet0/1 C 192.168.3.0/24 is directly connected, FastEthernet0/0 O 192.168.4.0/24 [110/2] via 192.168.3.1, 00:07:06, FastEthernet0/0 Router# Routing table of all the routers has been updated using the OSPF routing protocol. Let us see the OSPF neighbor table of all the routers OSPF Neighbor table of Router 0 Router#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.2.1 1 FULL/BDR 00:00:31 192.168.1.2 FastEthernet0/0 192.168.4.2 1 FULL/DR 00:00:35 192.168.4.2 FastEthernet0/1 OSPF Neighbor table of Router 1 Router#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.3.2 1 FULL/BDR 00:00:39 192.168.3.2 FastEthernet0/0 192.168.4.1 1 FULL/BDR 00:00:35 192.168.4.1 FastEthernet0/1 OSPF Neighbor table of Router 2 Router#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.4.1 1 FULL/DR 00:00:32 192.168.1.1 FastEthernet0/0 192.168.3.2 1 FULL/DR 00:00:35 192.168.2.2 FastEthernet0/1 OSPF Neighbor table of Router 3 Router#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.4.2 1 FULL/DR 00:00:36 192.168.3.1 FastEthernet0/0 192.168.2.1 1 FULL/BDR 00:00:33 192.168.2.1 FastEthernet0/1 Even though there are 4 routers in this topology, only directly connected router can become neighbors. So each router in this topology will have 2 neighbors.

#92

Let us configure OSPF in the below topology.

This topology has multiple areas (Area 0, Area 1 and Area 2). Configuring OSPF on ‘Area 0,1,2’ Router5 and Router4 area called Area Border Routers. Area Border Router connects networks in two or more different areas. Router5 stays in both Area 0 and Area 1. Likewise Router4 stays in Area 0 and Area 2. Router 0, 1, 2, 3 & 4 has loopback interfaces as well. We can configure OSPF on all routers in Area 0, 1, 2. Configuring Router 0 Router 0 has 2 physical networks (192.168.1.0/24 & 192.168.2.0/24) and 1 loopback network(192.168.10.0/24). We can use the advantage of wildcard bits here since all the networks starts with “192.168” Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)#

#93

Configuring Router 1 Router 1 has 3 physical networks (192.168.1.0/24, 192.168.4.0/24, 192.168.5.0/24) and 1 loopback network (192.168.13.0/24). Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Configuring Router 2 Router 2 has 2 physical networks (192.168.2.0/24 & 192.168.3.0/24) and 1 loopback network(192.168.11.0/24). Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Configuring Router 3 Router 3 has 3 physical networks (192.168.3.0/24, 192.168.4.0/24 & 192.168.6.0/24) and 1 loopback network (192.168.12.0/24). Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# Configuring Router 4 Router 4 is an ABR(Area Border Router). It connects Area 0 and Area 2. Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# network 172.16.0.0 0.0.255.255 area 2 Router(config-router)# Configuring Router 5 Router 5 is also an ABR. It connects Area 0 and Area 1. Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)# network 10.0.0.0 0.255.255.255 area 1 After the above configuration are done, routing table of all the Area 0, 1, 2 routers are updated with the new routes. #94

The routing table of ‘Router 6’ looks like below: ‘Router 6’ is in Area 1. Router#show ip route Gateway of last resort is not set 10.0.0.0/24 is subnetted, 2 subnets O 10.1.1.0 [110/128] via 10.1.2.1, 00:16:48, Serial0/0/0 C 10.1.2.0 is directly connected, Serial0/0/0 172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks O IA 172.16.0.1/32 [110/257] via 10.1.2.1, 00:12:29, Serial0/0/0 O IA 172.16.1.0/24 [110/320] via 10.1.2.1, 00:12:29, Serial0/0/0 O IA 172.16.2.0/24 [110/320] via 10.1.2.1, 00:12:29, Serial0/0/0 O IA 172.16.3.1/32 [110/257] via 10.1.2.1, 00:12:29, Serial0/0/0 O IA 192.168.1.0/24 [110/192] via 10.1.2.1, 00:16:48, Serial0/0/0 O IA 192.168.2.0/24 [110/256] via 10.1.2.1, 00:16:48, Serial0/0/0 O IA 192.168.3.0/24 [110/256] via 10.1.2.1, 00:16:48, Serial0/0/0 O IA 192.168.4.0/24 [110/192] via 10.1.2.1, 00:16:48, Serial0/0/0 O IA 192.168.5.0/24 [110/128] via 10.1.2.1, 00:16:48, Serial0/0/0 O IA 192.168.6.0/24 [110/256] via 10.1.2.1, 00:16:48, Serial0/0/0 192.168.10.0/32 is subnetted, 1 subnets O IA 192.168.10.1 [110/193] via 10.1.2.1, 00:16:48, Serial0/0/0 192.168.11.0/32 is subnetted, 1 subnets O IA 192.168.11.1 [110/257] via 10.1.2.1, 00:16:48, Serial0/0/0 192.168.12.0/32 is subnetted, 1 subnets O IA 192.168.12.1 [110/193] via 10.1.2.1, 00:16:48, Serial0/0/0 192.168.13.0/32 is subnetted, 1 subnets O IA 192.168.13.1 [110/129] via 10.1.2.1, 00:16:48, Serial0/0/0 Router# The code ‘O IA’ means inter-area updates, i.e the networks in different areas. The size of the routing table is big. Similarly all the router in the above topology will have Intra – Area routes and Inter-Area routes.

#95

Summarization in Area Border Routers: In OSPF we can do summarization only in the ABRs. We all know summarization is basically done to reduce the routing table of the router. Configuring summarization in ‘Router 4’ and ‘Router 5’. ‘Router 5’ connect Area 0 and 1. ‘Router 2’ connects Area 0 and 2. In ‘Router 5’ Router(config-router)#area 0 range 192.168.0.0 255.255.0.0 Router(config-router)#area 1 range 10.0.0.0 255.0.0.0 In ‘Router 4’ Router(config-router)#area 0 range 192.168.0.0 255.255.0.0 Router(config-router)#area 1 range 172.16.0.0 255.255.0.0 After configuring summarization, the routing table of ‘Router 6’ looks like below. Router#show ip route Gateway of last resort is not set 10.0.0.0/24 is subnetted, 2 subnets O 10.1.1.0 [110/128] via 10.1.2.1, 00:27:19, Serial0/0/0 C 10.1.2.0 is directly connected, Serial0/0/0 O IA 172.16.0.0/16 [110/257] via 10.1.2.1, 00:00:50, Serial0/0/0 O IA 192.168.0.0/16 [110/128] via 10.1.2.1, 00:06:08, Serial0/0/0 Router# Now we can see the routing table of ‘Router 6’ has been reduced dramatically. All the networks in ‘Area 0’ and ‘Area 2’ has been summarized into a 2 single entries.

#96

9.7. RIP Vs OSPF: OSPF has lot of advantages over RIP. Here let us understand the two main advantages of OSPF over RIP by configuring the following 2 exercises. Configure the below topology with OSPF Area 0.

Both the routers has 4 directly connected networks. As per the condition, the Database Server on each side should not be d to the other router. To configure this topology in RIP is h difficult without the knowledge of advanced subnetting. But in OSPF, it is easy to configure without having enough knowledge on subnetting. Previously we have used the wildcard bits to generalize the ment, (i.e.) if we make use of wildcard bits properly then we can reduce the number of commands in each router. Wildcard bits can also be used in more specific situations. We can use the wildcard bits as “0.0.0.0” saying the router to exactly match the IP address. Configuring Router 0 Router(config)#router ospf 1 Router(config-router)#network 192.168.1.5 0.0.0.0 area 0 Router(config-router)#network 192.168.1.28 0.0.0.0 area 0 Router(config-router)#network 192.168.1.33 0.0.0.0 area 0 Router(config-router# By putting the wildcard bits as “0.0.0.0” the router exactly looks at the IP address and checks whether any of its interface has that particular IP address. If it finds then it automatically s the Network Address to the neighbor router. So after entering the above commands the, Router 0 s the networks 192.168.1.0/28, 192.168.1.24/29 and 192.168.1.32/30. #97

Configuring Router 1 Router(config)#router ospf 1 Router(config-router)#network 192.168.1.34 0.0.0.0 area 0 Router(config-router)#network 192.168.2.1 0.0.0.0 area 0 Router(config-router)#network 192.168.2.65 0.0.0.0 area 0 Router(config-router# So after entering the above commands, the Router 1 s the networks 192.168.2.0/27, 192.168.2.64/27 and 192.168.1.32/30. Routing table of Router 0 Router#show ip route Gateway of last resort is not set 192.168.1.0/24 is variably subnetted, 3 subnets, 3 masks C 192.168.1.0/28 is directly connected, Ethernet1/0 C 192.168.1.16/29 is directly connected, Ethernet1/1 C 192.168.1.24/29 is directly connected, Ethernet1/2 C 192.168.1.32/30 is directly connected, FastEthernet0/0 192.168.2.0/27 is subnetted, 3 subnets O 192.168.2.0 [110/11] via 192.168.1.34, 00:00:34, FastEthernet0/0 O 192.168.2.64 [110/11] via 192.168.1.34, 00:00:34, FastEthernet0/0 Router# Routing table of Router 1 Router#show ip route Gateway of last resort is not set 192.168.1.0/24 is variably subnetted, 3 subnets, 3 masks O 192.168.1.0/28 [110/11] via 192.168.1.33, 00:02:14, FastEthernet0/0 O 192.168.1.24/29 [110/11] via 192.168.1.33, 00:02:14, FastEthernet0/0 C 192.168.1.32/30 is directly connected, FastEthernet0/0 192.168.2.0/27 is subnetted, 3 subnets C 192.168.2.0 is directly connected, Ethernet1/0 C 192.168.2.32 is directly connected, Ethernet1/1 C 192.168.2.64 is directly connected, Ethernet1/2 Router# The Database Server’s network on the side of Router 0 is hidden to the Router 1 and vice versa.

#98

Configure the below topology with OSPF Area 0

In this topology, 192.168.1.2/24 has two unequal paths to reach 192.168.8.2/24. One is via 192.168.2.2(upper path) and the other one is via 192.168.4.2(lower path). The upper path has 2 hops connected using Ethernet Link (10Mbps). The lower path has 4 hops connected using Fast Ethernet Link (100 Mbps). Even though the lower path has 4 hops it is 10 times faster than the upper path. So lower path will be the best path. Since RIP chooses the best path based on hop counts, if we configure RIP in this topology, the slower upper path will be selected as best path. OSPF doesn’t calculate best path on based on hop count. It uses a special formula for calculating the best path.

OSFP Path calculation:

100 Bandwidth

For Ethernet link the path cost would be (100 ÷ 10 = 10). For Fast Ethernet link (100 ÷ 100 = 1) Ethernet link has path cost of 10 and Fast Ethernet link has path cost of 1.

#99

Topology with OSPF cost on each link.

If Router 0 takes the upper path to reach 192.168.8.0/24 network then the cost would be 10 + 10 + 1 = 21. If it takes the lower path then the cost would be 1 + 1 + 1 + 1 + 1 = 5. Always the path that has lower cost will be chosen as the best path. In this topology, OSPF will decide the lower path as the best path. Let us configure the OPSF in this topology and check. We can configure all the 6 routers with the same command by using proper wildcard bits. Configuring Router 0,1,2,3,4,5 with the commands below. Router>en Router#conf t Router(config)#router ospf 1 Router(config-router)#network 192.168.0.0 0.0.255.255 area 0 Router(config-router)#exit Since all the routers has networks starting with “192.168” we can copy-paste the same commands on every router in this topology. Now let us check the routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/1 C 192.168.2.0/24 is directly connected, Ethernet1/0 O 192.168.3.0/24 [110/14] via 192.168.4.2, 00:14:34, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/0 #100

O 192.168.5.0/24 [110/2] via 192.168.4.2, 00:14:54, FastEthernet0/0 O 192.168.6.0/24 [110/3] via 192.168.4.2, 00:14:34, FastEthernet0/0 O 192.168.7.0/24 [110/4] via 192.168.4.2, 00:14:34, FastEthernet0/0 O 192.168.8.0/24 [110/5] via 192.168.4.2, 00:14:34, FastEthernet0/0 Router#

From the routing table of Router 0 we can see that it uses the lower path to reach 192.168.8.0/24 and the cost is ‘5’ as we expected. Even to reach 192.168.3.0/24 network it uses the lower path as it has only 14 as path cost whereas the path cost of upper path is 20.

9.8. CONVERGENCE AND CONVERGENCE TIME: If we have two unequal paths for a particular destination, routing protocols like RIP and OSPF will always select a best based on the path cost. As we know, RIP uses hop count as path cost and OSPF uses the formula (100 ÷ Bandwidth). The best path enters the routing table of the router. Let’s say if the best path to some destination goes down and we can still reach the destination via a secondary path. This secondary path will now act as the primary one. This is called convergence. The time taken to find the secondary path once the primary path goes down is called convergence time. Each routing protocol will have different convergence time. Let us check the convergence time of the two protocols RIP and OSPF. Now let use the topology below to find the convergence time of RIP and OSPF.

#101

RIP CONVERGENCE TIME: RIP has been already configured in this topology. Router 0 has 2 paths to reach 192.168.7.0/24 network. One path is via 192.168.2.2 and the other one is via 192.168.6.1. The upper path takes 2 hops and lower path takes 3 hops. So the upper path becomes the best path. We can confirm that by seeing the routing table of Router 0. Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 R 192.168.3.0/24 [120/1] via 192.168.2.2, 00:00:12, FastEthernet0/0 R 192.168.4.0/24 [120/2] via 192.168.2.2, 00:00:12, FastEthernet0/0 [120/2] via 192.168.6.1, 00:00:11, FastEthernet0/1 R 192.168.5.0/24 [120/1] via 192.168.6.1, 00:00:11, FastEthernet0/1 C 192.168.6.0/24 is directly connected, FastEthernet0/1 R 192.168.7.0/24 [120/2] via 192.168.2.2, 00:00:12, Router# As we can see now the router uses the upper path (via 192.168.2.2) as best path. We can check the convergence time by pinging unlimited times from 192.168.1.2 to 192.168.7.2 and disconnecting the primary path simultaneously. Once we disconnect the primary path our ping requests will timeout for a while at first. Soon after the alternative path is identified, our pings will start to work. Pinging continuously from 192.168.1.2 to 192.168.7.2

#102

Now on Router 0 let us shutdown the fa0/0(192.168.2.1) interface. Router>en Router#conf t Router(config)#int fa0/0 Router(config-if)#shut Router(config-if)#exit Router(config)exit Router#

After shutting down the interface the ping requests will time out initially and find the alternative path.

We can see that we get destination unreachable and request timed out message for a short time and once our router finds the alternate path through RIP protocol our ping starts to work . Here the convergence time is 10 seconds approximately. The convergence time may differ from one protocol to another. Since RIP sends ments every 30 seconds, the convergence time for RIP may vary from 1 second(best case) to 29 seconds(worst case). #103

OSPF CONVERGENCE TIME: Now let us use the same topology with OSPF protocol running between routers to check the OSPF convergence time. OSPF is already configured in all the routers. Let us check the routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 O 192.168.3.0/24 [110/2] via 192.168.2.2, 00:00:25, FastEthernet0/0 O 192.168.4.0/24 [110/3] via 192.168.2.2, 00:00:25, FastEthernet0/0 [110/3] via 192.168.6.1, 00:00:25, FastEthernet0/1 O 192.168.5.0/24 [110/2] via 192.168.6.1, 00:00:25, FastEthernet0/1 C 192.168.6.0/24 is directly connected, FastEthernet0/1 O 192.168.7.0/24 [110/3] via 192.168.2.2, 00:00:25, FastEthernet0/0 Router# Pinging from 192.168.1.2 to 192.168.7.2

Shutting down the fa0/0(192.168.2.1) interface. Router>en Router#conf t Router(config)#int fa0/0 Router(config-if)#shut Router(config-if)# #104

Pinging from 192.168.1.2 to 192.168.7.2

Here we get only 1 request timed out. That one request timed out also corresponds to the delay due to ARP protocol. So OSPF is very fast in finding the alternate path. The convergence time of OSPF is less than one second.

9.9. EIGRP - Enhanced Interior Gateway Routing Protocol: EIGRP is a dynamic routing protocol developed by Cisco. It was a proprietary protocol till a few years back. Now Cisco made this protocol as Open Source. EIGRP has lot advantages over RIP and OSPF. Configuring EIGRP looks similar to RIP and OSPF. EIGRP is a light weight protocol like RIP and s more features than OSPF. EIGRP doesn’t work based on AREAS like OSPF. Instead of AREA it works based on Autonomous System Number. All routers running EIGRP must be configured with same Autonomous System Number. EIGRP can be configured like OSPF or RIP (i.e.) with or without wildcard mask. Let us configure the below topology with EIGRP protocol. #105

Configuring Router 0 Router#conf t Router(config)#router eigrp ? <1-65535> Autonomous system number Router(config)#router eigrp 1 Router(config-router)#network 192.168.1.0 ? A.B.C.D EIGRP wild card bits Router(config-router)#network 192.168.1.0 0.0.0.255 Router(config-router)#network 192.168.2.0 0.0.0.255 Router(config-router)# We can also configure the Router 0 with the command “network 192.168.0.0 0.0.255.255” for a single line ment. Configuring Router 1 Router#conf t Router(config)#router eigrp 1 Router(config-router)#network 192.168.0.0 0.0.255.255 Router(config-router)# Routing Table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/1 C 192.168.2.0/24 is directly connected, FastEthernet0/0 D 192.168.3.0/24 [90/30720] via 192.168.2.2, 00:00:09, FastEthernet0/0 Router# #106

Routing Table of Router 1 Router#show ip route Gateway of last resort is not set D 192.168.1.0/24 [90/30720] via 192.168.2.1, 00:01:37, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 C 192.168.3.0/24 is directly connected, FastEthernet0/1 Router# EIGRP updates are represented using ‘D’. istrative Distance of EIGRP is 90. The path cost calculation in EIGRP is a very complex formula that will generally result in a very big number. Cost calculation of EIGRP is beyond the scope of CCNA.

EIGRP TOPOLOGY TABLE: Let us configure EIGRP in the below topology to calculate the convergence time.

Configuring Router0, 1, 2 with the same commands below. Router#conf t Router(config)#router eigrp 1 Router(config-router)#network 192.168.0.0 0.0.255.255 Router(config-router)# Now let us check the routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, Ethernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 D 192.168.3.0/24 [90/30720] via 192.168.2.2, 00:00:52, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# #107

Even though Router 0 has two paths to reach 192.168.3.0/24 network, it chooses the Fast Ethernet link since it is 10 times faster than the Ethernet link. EIGRP stores all the possible paths in a table called EIGRP topology table. The best path among all possible paths goes into the routing table. Once the best path goes offline the router chooses the alternative path from the topology table. We can see the EIGRP topology table using the following command. Router#show ip eigrp topology IP-EIGRP Topology Table for AS 1 P 192.168.2.0/24, 1 successors, FD is 28160 via Connected, FastEthernet0/0 P 192.168.4.0/24, 1 successors, FD is 28160 via Connected, FastEthernet0/1 P 192.168.1.0/24, 1 successors, FD is 281600 via Connected, Ethernet1/0 P 192.168.3.0/24, 1 successors, FD is 30720 via 192.168.2.2 (30720/28160), FastEthernet0/0 via 192.168.1.2 (284160/28160), Ethernet1/0 Router# The topology table states that it has two possible paths for 192.168.3.0/24 network. The best path is Fast Ethernet link(192.168.2.2) and the alternative path is Ethernet link(192.168.1.2). Once the Fast Ethernet link goes offline the router will automatically forward the packets through Ethernet link.

EIGRP CONVERGENCE: Now with the same topology let us calculate the convergence time of EIGRP. Pinging from 192.168.4.2 to 192.168.3.3

#108

Let us shutdown the Fast Ethernet(192.168.2.1) link. Router>en Router#conf t Router(config)#int fa0/0 Router(config-if)#shut Router(config-if)# Pinging from 192.168.4.2 to 192.168.3.3

Here we can see only 1 request timed. That one request timed out also corresponds to the delay due to ARP protocol. So EIGRP is very fast in finding the alternate path like OSPF. The convergence time of EIGRP is less than a second.

EIGRP AUTO SUMMARY: Let us configure EIGRP in the topology show below.

#109

Configuring Router 0 Router#conf t Router(config)#router eigrp 1 Router(config-router)#network 192.168.0.0 0.0.255.255 Router(config-router)# Configuring Router 1 Router#conf t Router(config)#router eigrp 1 Router(config-router)#network 192.168.2.0 0.0.0.255 Router(config-router)#network 10.1.1.0 0.0.0.255 Router(config-router)# Routing Table of Router 0 Router#show ip route Gateway of last resort is not set D 10.0.0.0/8 [90/30720] via 192.168.2.2, 00:00:11, FastEthernet0/1 C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 Router# In the routing table of Router 0 we see “10.0.0.0/8” instead of “10.1.1.0/24”. This is because Router 1 automatically summarizes the “10.1.1.0/24” to its default mask 10.0.0.0/8. We can switch off the summarization in Router 1 using the following command. In Router 1 configuring auto-summary. Router#conf t Router(config)#router eigrp 1 Router(config-router)#no auto-summary Router(config-router)# Now again checking the routing table of Router 0 Router#show ip route Gateway of last resort is not set 10.0.0.0/24 is subnetted, 1 subnets D 10.1.1.0 [90/30720] via 192.168.2.2, 00:00:07, FastEthernet0/1 C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 192.168.2.0/24 is directly connected, FastEthernet0/1 Router# Now Router 1 has updated the Router 0 about the exact networks it has. Configure EIGRP in the topology bellow. #110

In Router0, 2 we have to configure ‘no auto-summary’. Configuring Router0, 2 with the following commands Router#conf t Router(config)#router eigrp 1 Router(config-router)#network 192.168.0.0 0.0.255.255 Router(config-router)#network 10.0.0.0 0.255.255.255 Router(config-router)#no auto-summary Router(config-router)exit Router(config)#exit Router# Configuring Router 1, 3, 4 with the following commands. Router#conf t Router(config)#router eigrp 1 Router(config-router)#network 192.168.0.0 0.0.255.255 Router(config-router)#exit Router(config)#exit Router#

EIGRP LOAD BALANCE: Protocols like RIP, OSPF will load balance the traffic if they find two or more equal paths. EIGRP is the only protocol that can do equal and unequal load balancing. Unequal load balancing means it can share the traffic between two unequal paths. Let us solve the below topology with EIGRP to do unequal load balancing.

#111

Let us configure EIGRP in these routers. Configuring Router0, 1, 2 with commands below. Router(config)#router eigrp 1 Router(config-router)#network 192.168.0.0 0.0.255.255 Router(config-router)# Router 0 has one Fast Ethernet link and one Ethernet link to reach 192.168.3.0/24 network. By default EIGRP will not do unequal load balancing. Let us check the routing table of Router 0 Router#show ip route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, Ethernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 D 192.168.3.0/24 [90/30720] via 192.168.2.2, 00:00:26, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# We can see that Router 0 has only one path right now to reach 192.168.3.0/24 network. Configuring load balancing in Router 0 Router(config)#router eigrp 1 Router(config-router)#variance 10 Router(config-router)#do show ip route C 192.168.1.0/24 is directly connected, Ethernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 D 192.168.3.0/24 [90/30720] via 192.168.2.2, 00:00:45, FastEthernet0/0 [90/284160] via 192.168.1.2, 00:00:48, Ethernet1/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# #112

No we can see that after using the variance command with a value ‘10’, Router 0 add the secondary path into its routing table. Now for every 10 packets sending on the Fast Ethernet link it will send 1 packet on the Ethernet link, thus making unequal load balancing. Unequal load balancing of the EIGRP protocol totally depends on the variance value. Formula for unequal load balancing: Bandwidth of the Primary Link X=

100 Mbps =

Variance

= 10 10

So, X = 10. Which means if the bandwidth of the secondary path is greater than or equal to X (i.e.) if X ≤ Bandwidth of the Secondary Path then unequal load balancing will happen. Since the speed of the Ethernet is 10 Mbps and the value of X is also 10. Here, X = Bandwidth of the Secondary Path. So EIGRP will load balance now. Now let us try with the variance value 9. X = 100 ÷ 9 = 11.111, Bandwidth of Secondary Path = 10 Mbps. Now 11.111 > 10 (i.e.) X > Bandwidth of Secondary Path. So with the variance value as ‘9’, unequal load balancing will not happen. Router(config)#router eigrp 1 Router(config-router)#variance 9 Router(config-router)#do show ip route C 192.168.1.0/24 is directly connected, Ethernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 D 192.168.3.0/24 [90/30720] via 192.168.2.2, 00:00:45, FastEthernet0/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# Note that now there is only one path(192.168.2.2) to reach 192.168.3.0. Now let us try with the variance value 11. X = 100 ÷ 11 = 9.090, Bandwidth of Secondary Path = 10 Mbps. #113

Now 9.090 < 10 (i.e.) X < Bandwidth of Secondary Path. So with the variance value as ‘11’, unequal load balancing will happen. Router(config)#router eigrp 1 Router(config-router)#variance 11 Router(config-router)#do show ip route C 192.168.1.0/24 is directly connected, Ethernet1/0 C 192.168.2.0/24 is directly connected, FastEthernet0/0 D 192.168.3.0/24 [90/30720] via 192.168.2.2, 00:00:45, FastEthernet0/0 [90/284160] via 192.168.1.2, 00:00:48, Ethernet1/0 C 192.168.4.0/24 is directly connected, FastEthernet0/1 Router# With the variance value as 11, Router 0 will forward one packet on the secondary link for every 11 packets on the primary link.

#114

10. ACL – ACCESS CONTROL LIST ACLs are widely used in all the networks to restrict access. It is a list of permit and deny statements to grant or deny access. In Cisco routers, ACL is created in configuration mode and applied in the interface of the router. ACLs are of 2 types, 1) Standard ACL – with limited features 2) Extended ACL – with advance features.

STANDARD ACL: Let us solve the below task in the given topology with the help of Standard ACL. Task 1: Should block 1.2 from pinging 2.2 and 2.3 all other pings should be possible.(Try pinging 1.2 to 2.2 and 2.3) Task 2: Should block 1.2 from pinging 4.2, 1.2 should be able to ping all the others hosts. Task 3: Should block 1.2 from pinging any host in 192.168.4.0/24 and 192.168.5.0/24. Task 4: Should block all host from 192.168.2.0/24 except 192.168.2.3 pinging 192.168.5.0/24 network. Task 5: Should block any host from 192.168.1.0/24 from ping any host in 192.168.4.0/24 (Try pinging from 2.2 to 4.2) Task 6: Should block 1.2 pinging from 2.2 alone (ping from 1.2 to 2.3 should be possible)

#115

SOLUTIONS: Task 1: Should block 1.2 from pinging 2.2 and 2.3 all other pings should be possible. (Try pinging 1.2 to 2.2 and 2.3) For this task we have configure ACL in Router 0 Configuring Router 0 for Task1: Router#conf t Router(config)#access-list 1 deny host 192.168.1.2 Router(config)#access-list 1 permit any Router(config)#int fa0/1 Router(config-if)#ip access-group 1 out Router(config-if)#exit Router(config)#do show access-list Standard IP access list 1 deny host 192.168.1.2 permit any Router(config)# Let us discuss about the above configurations step by step. Command – “access-list 1 deny host 192.168.1.2” Description: We are creating ACL with the number 1. The first line on ACL 1 is to deny the host ‘192.168.1.2’. Standard ACLs can use any number between 1 and 99. Command – “access-list 1 permit any” Description: All ACLs will have explicit ‘Deny all’ statement at the last line of the list to deny all other hosts. ‘Permit any’ statement in the second line will by the ‘Deny all’ statement at the end of the list. Generally ACLs will be checked line by line. If it finds a permit or deny statement for any particular IP address, it is called as match statement. Routers will always check the list line by line until it finds a match statement. Once a match statement is found, it will not check the lines below. Command – “ip access-group 1 out” Description: ACLs will be applied in the interface of the router. This list is applied in the fa0/1(192.168.2.1) interface in outbound direction. Applying ACL in the interface fa0/0(192.168.1.1), will also block 192.168.1.2 pinging 192.168.4.0/24 & 192.168.5.0/24 networks. #116

Applying in the interface fa1/0(192.168.3.1) will not solve this task. Thus we apply ACL in the interface fa0/1 . Applying ACL with the direction: ACL can applied in 2 directions. 1) Inbound – ACLs will be checked when packets come towards that interface. 2) Outbound – ACLs will be checked when packets are ready to leave that interface. Here we are saying the router to check the ACLs while any packet is ready to leave fa0/1 interface. Ping from 192.168.1.2 to 192.168.2.2 & 192.168.2.3 PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Ping statistics for 192.168.2.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), PC>ping 192.168.2.3 Pinging 192.168.2.3 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Ping statistics for 192.168.2.3: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), PC> Pings from 192.168.1.2 to 192.168.2.2 and 192.168.2.3 are blocked by ACL configured in the Router 0. #117

Task 2: Should block 1.2 from pinging 4.2. 1.2 should be able to ping all the others hosts.

For this task we have to configure ACL on Router 1 Configuring Router 1 for Task2: Router#conf t Router(config)#access-list 1 deny host 192.168.1.2 Router(config)#access-list 1 permit any Router(config)#int fa0/0 Router(config-if)#ip access-group 1 out Router(config-if)# Pinging from 192.168.1.2 to 192.168.4.2 PC>ping 192.168.4.2 Pinging 192.168.4.2 with 32 bytes of data: Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Ping statistics for 192.168.3.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss) Pings from 192.168.1.2 to 192.168.4.2 are blocked by the ACL configured on Router 1.

#118

Task 3: Should block 1.2 from pinging any host in 192.168.4.0/24 and 192.168.5.0/24.

For this task we have to configure ACL on Router 1. Configuring Router 1 for Task3: Router(config)#access-list 1 deny host 192.168.1.2 Router(config)#access-list 1 permit any Router(config)#int fa0/0 Router(config-if)#ip access-group 1 out Router(config-if)#int fa0/1 Router(config-if)#ip access-group 1 out Router(config-if)# ‘ACL 1’ can also be applied in eth1/0(192.168.3.2) interface inbound direction. Pinging from 192.168.1.2 to 192.168.4.2 & 192.168.5.2 PC>ping 192.168.4.2 Pinging 192.168.4.2 with 32 bytes of data: Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. PC>ping 192.168.5.2 Pinging 192.168.5.2 with 32 bytes of data: Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. PC> Pings from 192.168.1.2 to 192.168.4.2 & 192.168.5.2 are blocked by the ACL configured on Router 1. #119

Task 4: Should block all host from 192.168.2.0/24 except 192.168.2.3 pinging 192.168.5.0/24 network.

For this task we have to configure ACL on Router 1. Configuring Router 1 for Task4: Router(config)#access-list 1 permit host 192.168.2.3 Router(config)#access-list 1 deny 192.168.2.0 0.0.0.255 Router(config)#access-list 1 permit any Router(config)#int fa0/1 Router(config-if)#ip access-group 1 out Router(config-if)# Pinging from 192.168.2.3 to 192.168.5.2 PC>ping 192.168.5.2 Pinging 192.168.5.2 with 32 bytes of data: Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Ping statistics for 192.168.5.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms PC>

#120

Pinging from 192.168.2.2 to 192.168.5.2 PC>ping 192.168.5.2 Pinging 192.168.5.2 with 32 bytes of data: Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Ping statistics for 192.168.5.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms PC> Ping from 192.168.2.3 works, whereas pings from 192.168.2.2 is blocked by the ACL configured on Router 1. Task 5: Should block any host from 192.168.1.0/24 from pinging any host in 192.168.4.0/24 (Try pinging from 2.2 to 4.2)

For this task we have to configure ACL on Router 1 Configuring Router 1 for Task5: Router#conf t Router(config)#access-list 1 deny 192.168.1.0 0.0.0.255 Router(config)#access-list 1 permit any Router(config)#int fa0/0 Router(config-if)#ip access-group 1 out Router(config-if)# #121

Pinging from 192.168.1.2 to 192.168.4.2 PC>ping 192.168.4.2 Pinging 192.168.4.2 with 32 bytes of data: Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Ping statistics for 192.168.4.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

Pinging from 192.168.1.3 to 192.168.4.2 PC>ping 192.168.4.2 Pinging 192.168.4.2 with 32 bytes of data: Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Reply from 192.168.3.2: Destination host unreachable. Ping statistics for 192.168.4.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss) Pings from 192.168.1.0 to 192.168.4.0 are blocked by the ACL configured on Router 1.

Task 6: Should block 1.2 pinging from 2.2 alone (ping from 1.2 to 2.3 should be possible) Task 6 is not possible with standard ACL.

#122

EXTENDED ACL: Extended ACL gives us more features like filtering packets based on destination IP, Protocols and port numbers. Standard ACLs are used to filter the traffic based on source IP address. That is why we create and apply ACL on the destination router. Whereas Extended ACL gives us more flexibility like filtering the traffic based on source IP, destination IP, protocols and port number. So we can create and apply Extended ACLs in the source router itself. Let us solve the below task in the given topology with the help of Extended ACL. Task 1: Should block 1.2 from pinging 2.2 and 2.3 all other pings should be possible. (Try pinging 1.2 to 2.2 and 2.3) Task 2: Should block any host from 192.168.1.0/24 from ping any host in 192.168.4.0/24 (Try pinging from 2.2 to 4.2 and from 1.2 to 4.1) Task 3: Should block 1.2 pinging from 2.2 alone (ping from 1.2 to 2.3 should be possible) Task 4: Should block 1.2 pinging from 5.3 alone (ping from 1.2 to 5.2 should be possible) Task 5: Should ping 5.3 from 1.2 and 1.2 should be blocked from accessing the web page of 5.3 Task 6: 1.2 should access the web page of 5.3 and ping from 1.2 to 5.3 should be blocked (ping from 1.2 to 5.2 should be possible).

SOLUTIONS: Task 1: Should block 1.2 from pinging 2.2 and 2.3 all other pings should be possible. (Try pinging 1.2 to 2.2 and 2.3) #123

Configuring Extended ACLs on Router 0. Router(config)#access-list 100 deny ip host 192.168.1.2 192.168.2.0 0.0.0.255 Router(config)#access-list 100 permit ip any any Router(config)#int fa0/0 Router(config-if)#ip access-group 100 in Router(config-if)#exit Router(config)# Command – “access-list 100 permit ip host 192.168.1.2 192.168.2.0 0.0.0.255” Description: We are creating ACL with the number 100. The first line of the ACL is to deny the IP protocol from the source host ‘192.168.1.2’ if the destination is 192.168.2.0/24 networks. Extended ACLs can use any number between 100 and 199. Command – “access-list 100 permit ip any any” Description: Extended ACLs will also have ‘Deny all’ statement at the end. So we are inserting this line that hides the ‘Deny all’ statement. Command – “ip access-group 100 in” Description: Since Extended ACLs can filter traffic based on destination IP address, we can apply ACL in the source interface itself. Here applying the ACL 100 in the interface fa0/0(192.168.1.1) in inbound direction. Ping from 192.168.1.2 to 192.168.2.2 & 192.168.2.3 PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. PC>ping 192.168.2.3 Pinging 192.168.2.3 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. PC>

Pings from 192.168.1.2 to 192.168.2.2 & 192.168.2.3 are blocked by ACL configured in Router 0 #124

Task 2: Should block any host from 192.168.1.0/24 from pinging any host in 192.168.4.0/24 (Try pinging from 2.2 to 4.2 and from 1.2 to 4.1)

Configuring Router 0 for Task2: Router#conf t Router(config)#access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255 Router(config)#access-list 100 permit ip any any Router(config)#int fa0/0 Router(config-if)#ip access-group 100 in Router(config-if)# Pinging from 192.168.1.2 to 192.168.4.2 PC>ping 192.168.4.2 Pinging 192.168.4.2 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Ping statistics for 192.168.4.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss) Pings from 192.168.1.0 to 192.168.4.0 are blocked by the ACL configured on Router 0.

#125

Task 3: Should block 1.2 pinging from 2.2 alone (ping from 1.2 to 2.3 should be possible)

Configuring Router 0 for Task3: Router#conf t Router(config)#access-list 100 deny ip host 192.168.1.2 host 192.168.2.2 Router(config)#access-list 100 permit ip any any Router(config)#int fa0/0 Router(config-if)#ip access-group 100 in Router(config-if)#exit Router(config)#exit Router# Ping from 192.168.1.2 to 192.168.2.2 & 192.168.2.3 PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Ping statistics for 192.168.2.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), PC>ping 192.168.2.3 Pinging 192.168.2.3 with 32 bytes of data: Reply from 192.168.2.3: bytes=32 time=0ms TTL=127 Reply from 192.168.2.3: bytes=32 time=0ms TTL=127 #126

Reply from 192.168.2.3: bytes=32 time=0ms TTL=127 Reply from 192.168.2.3: bytes=32 time=0ms TTL=127 Ping statistics for 192.168.2.3: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC> Pings from 192.168.1.2 to 192.168.2.2 is blocked, whereas ping from 192.168.1.2 to 192.168.2.3 works. Task 4: Should block 1.2 from pinging 5.3 alone (ping from 1.2 to 5.2 should be possible)

Configuring Router 0 for Task4: Router#conf t Router(config)#access-list 100 deny ip host 192.168.1.2 host 192.168.5.3 Router(config)#access-list 100 permit ip any any Router(config)#int fa0/0 Router(config-if)#ip access-group 100 in Router(config-if)#exit Router(config)#exit Router#

Ping from 192.168.1.2 to 192.168.5.2 & 192.168.5.3 PC>ping 192.168.5.2 Pinging 192.168.5.2 with 32 bytes of data: Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 #127

Reply from 192.168.5.2: bytes=32 time=0ms TTL=127 Ping statistics for 192.168.5.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC>ping 192.168.5.3 Pinging 192.168.5.3 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Ping statistics for 192.168.5.3: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), PC> Ping from 192.168.1.2 to 192.168.5.3 is blocked, whereas ping from 192.168.1.2 to 192.168.5.2 works.

Task 5: Should ping 5.3 from 1.2 and 1.2 should be blocked from accessing the web page of 5.3

Configuring Router 0 for Task4: Router#conf t Router(config)#access-list 100 deny t host 192.168.1.2 host 192.168.5.3 eq 80 Router(config)#access-list 100 permit ip any any Router(config)#int fa0/0 Router(config-if)#ip access-group 100 in Router(config-if)#exit Router(config)#exit #128

Since http protocol uses port 80, here we are denying port 80. Pinging from 192.168.1.2 to 192.168.5.3 PC>ping 192.168.5.3 Pinging 192.168.5.3 with 32 bytes of data: Reply from 192.168.5.3: bytes=32 time=0ms TTL=127 Reply from 192.168.5.3: bytes=32 time=0ms TTL=127 Reply from 192.168.5.3: bytes=32 time=0ms TTL=127 Reply from 192.168.5.3: bytes=32 time=0ms TTL=127 Ping statistics for 192.168.5.3: Packets: Sent = 4, Received = 4, Lost = 0(0% loss), PC>

From 192.168.1.2, accessing the webpage of 192.168.5.3

From 192.168.1.2 to 192.168.5.3, http protocol has been blocked(web page blocked) and ping works.

#129

Task 6: 1.2 should access the web page of 5.3 and ping from 1.2 to 5.3 should be blocked (ping from 1.2 to 5.2 should be possible).

Configuring Router 0 for Task4: Router#conf t Router(config)#access-list 100 deny icmp host 192.168.1.2 host 192.168.5.3 Router(config)#access-list 100 permit ip any any Router(config)#int fa0/0 Router(config-if)#ip access-group 100 in Router(config-if)#exit Router(config)#exit Router# Since ping uses ICMP protocol, here we are denying ICMP. Pinging from 192.168.1.2 to 192.168.5.3 PC>ping 192.168.5.3 Pinging 192.168.5.3 with 32 bytes of data: Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Reply from 192.168.1.1: Destination host unreachable. Ping statistics for 192.168.5.3: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

#130

From 192.168.1.2 accessing the webpage of 192.168.5.3

From 192.168.1.2 to 192.168.5.3, ICMP protocol is blocked(ping blocked) and all other protocols are allowed.

#131

NAMED ACL: In Numbered Access list, it is not possible to edit or rearrange the list. Whereas in Named access list, it is easy to edit or rearrange the list. Named Access List uses the sequence number to edit or rearrange the list. Instead of using numbers for Access List, we can use a name. Router#en Router(config)#ip access-list standard NetworkGeek Router(config-std-nacl)#deny 192.168.1.0 0.0.0.255 Router(config-std-nacl)#deny 192.168.2.0 0.0.0.255 Router(config-std-nacl)#do show access-list Standard IP access list NetworkGeek 10 deny 192.168.1.0 0.0.0.255 20 deny 192.168.2.0 0.0.0.255 Router(config-std-nacl)#5 permit host 192.168.1.3 Router(config-std-nacl)#15 permit host 192.168.2.3 Router(config-std-nacl)#do show access-list Standard IP access list NetworkGeek 5 permit host 192.168.1.3 10 deny 192.168.1.0 0.0.0.255 15 permit host 192.168.2.3 20 deny 192.168.2.0 0.0.0.255 Router(config-std-nacl)#exit Router(config)#int fa0/0 Router(config-if)#ip access-group NetworkGeek in Router(config-if)#exit Router(config)#exit Router#

#132

11. NETWORK ADDRESS TRANSLATION (NAT) 11.1. PUBLIC IP Vs PRIVATE IP: CLASS A: Class A Range - 0.0.0.0 - 127.255.255.255 Subnet Mask for Class A – 255.0.0.0 Private Address Range – 10.0.0.0 – 10.255.255.255

CLASS B: Class B Range - 128.0.0.0 - 191.255.255.255 Subnet Mask for Class B – 255.255.0.0 Private Address Range– 172.16.0.0 - 172.31.255.255

CLASS C: Class C Range - 192.0.0.0 - 223.255.255.255 Subnet Mask for Class C – 255.255.255.0 Private Address Range – 192.168.0.0 -192.168.255.255

11.2. NAT – NETWORK ADDRESS TRANSLATION: Network address translation is process of translating the Private IP to Public IP and vice versa. NAT saves us tons and tons IP address. It plays a major role in saving the IP addresses. Let us solve the following topology to understand the concepts of NAT.

#133

Router 0 has 1 private IP (192.168.1.1) and 1 public IP (200.1.1.1). We have to configure Router 0 in a way that all the 192.168.1.0/24 address are translated into 200.1.1.1 address. Configuring Router 0: NAT slightly depends on ACL. We have configure ACL and include them in NAT configuration. In Router 0 the interface fa0/0 has Private IP(192.168.1.1) and interface fa0/1 has public IP(200.1.1.1) Router#conf t Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255 Router(config)#ip nat inside source list 1 interface fa0/1 Router(config)#int fa0/1 Router(config-if)#ip nat outside Router(config-if)#int fa0/0 Router(config-if)#ip nat inside Router(config-if)# Command – “access-list 1 permit 192.168.1.0 0.0.0.255” Description: Creating an access list to permit 192.168.1.0/24 network. Command – “ip nat inside source list 1 interface fa0/1” Description: IP addresses permitted in the access list 1 will be translated into the IP address of the interface fa0/1. Here fa0/1 has the public IP 200.1.1.1 Command – “ip nat outside” Description: Interface that has public IP will be the outside interface. #134

Command – “ip nat inside” Description: Interface that has private IP will be the inside interface. Now let us ping from 192.168.1.2 to 200.2.2.2 PC>ping 200.2.2.2 Pinging 200.2.2.2 with 32 bytes of data: Reply from 200.2.2.2: bytes=32 time=0ms TTL=127. Reply from 200.2.2.2: bytes=32 time=0ms TTL=127. Reply from 200.2.2.2: bytes=32 time=0ms TTL=127. Reply from 200.2.2.2: bytes=32 time=0ms TTL=127. Ping statistics for 200.2.2.2: Packets: Sent = 4, Received = 4, Lost = 0(0% loss), PC>

Configure NAT in the below topology:

Configuring NAT in SSN College Router (Router0): Router#conf t Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255 Router(config)#ip nat inside source list 1 interface fa0/0 Router(config)#int fa0/0 #135

Router(config-if)#ip nat outside Router(config-if)#int fa0/1 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip route 70.1.1.0 255.255.255.0 200.1.1.2 Router(config)# Here in Router 0 interface fa0/0 has public IP(200.1.1.1) and interface fa0/1 has private IP(192.168.1.1). Static route has been configured for 70.1.1.0/24 network. Now accessing Google webpage from SSN College’s 192.168.1.2 PC.

Configuring NAT in SRM College Router (Router1): Router#conf t Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255 Router(config)#ip nat inside source list 1 interface fa0/0 Router(config)#int fa0/0 Router(config-if)#ip nat outside Router(config-if)#int fa0/1 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip route 70.1.1.0 255.255.255.0 100.1.1.2 Router(config)# Here in Router 1 interface fa0/0 has public IP (100.1.1.1) and interface fa0/1 has private IP (192.168.1.1). Static route has been configured for 70.1.1.0/24 network. #136

Now accessing Google webpage from SRM College’s 192.168.1.2 PC.

Configure NAT in the following topology:

#137

Configuring NAT in SSN College Router (Router0): Router>en Router#conf t Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255 Router(config)#ip nat inside source list 1 interface fa0/0 Router(config)#int fa0/0 Router(config-if)#ip nat outside Router(config-if)#int fa0/1 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip route 0.0.0.0 0.0.0.0 200.1.1.2 Router(config)#exit Router# Here in Router 0 interface fa0/0 has public IP(200.1.1.1) and interface fa0/1 has private IP(192.168.1.1). Default route has been configured in Router 0. Configuring NAT in SRM College Router (Router1): Router#conf t Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255 Router(config)#ip nat inside source list 1 interface fa0/0 Router(config)#int fa0/0 Router(config-if)#ip nat outside Router(config-if)#int fa0/1 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip route 0.0.0.0 0.0.0.0 100.1.1.2 Router(config)# Here in Router 1 interface fa0/0 has public IP(100.1.1.1) and interface fa0/1 has private IP(192.168.1.1). Default route has been configured in Router 1. Configuring Static NAT in Google Router (Router3): Google Server’s Public IP: 74.125.224.72 Router#conf t Router(config)#ip nat inside source static 192.168.1.2 74.125.224.72 Router(config)#int fa0/0 Router(config-if)#ip nat outside Router(config-if)#int fa0/1 Router(config-if)#ip nat inside #138

Router(config-if)#exit Router(config)#ip route 0.0.0.0 0.0.0.0 199.1.1.1 Router(config)# Here in Router 3 we don’t need to create an access list since we are mapping the public IP (74.125.224.72) to Google Server’s IP(192.168.1.2). This is called Static NAT. Default route has been configured in Router 3. Configuring Static NAT in Facebook Router (Router4): Facebook Server’s Public IP: 69.171.247.21 Router#conf t Router(config)#ip nat inside source static 192.168.1.2 69.171.247.21 Router(config)#int fa0/0 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#int fa0/1 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip route 0.0.0.0 0.0.0.0 70.1.1.1 Router(config)#exit Router# Here in ‘Router4’ we don’t need to create an access list since we are mapping the public IP (69.171.247.21) to Facebook Server’s IP (192.168.1.2). Default route has been configured in ‘Router4’. Now accessing Google Server (http://74.125.224.72) and Facebook Server (http://69.171.247.21) from SSN College’s 192.168.1.2 PC.

#139

Now accessing Google Server (http://74.125.224.72) and Facebook Server (http://69.171.247.21) from SRM College’s 192.168.1.2 PC.

#140

12. FIRST HOP REDUNDANCY PROTOCOL (FHRP) First Hop Redundancy Protocols are redundancy protocols configured in routers for redundancy purposes. These protocols are designed to protect the default gateway used on a network by allowing two or more routers to provide backup for that address. When the active routers fails, the backup router will take over the address. We have 3 types redundancy protocols, 1) HSRP – Hot Standby Router Protocol 2) VRRP – Virtual Router Redundancy Protocol 3) GLBP – Gateway Load Balancing Protocol In CCNA we will cover only HSRP configurations.

HSRP: HSRP is a Cisco proprietary and most widely used redundancy protocol in the world. HSRP protocol is configured with two routers. One router will be the primary and the other one will be backup/secondary router. Both the primary and backup routers will be connected to separate ISPs. When the primary router goes offline or the ISP connected the primary routers goes down then secondary router will take over the network. Virtual IP will be configured on both the routers. That virtual IP will be default gateway for all the clients in that network. Here in our example, we going to have IP 192.168.1.1 as the virtual IP configured. We can use the IP address 192.168.1.2 & 192.168.1.3 on the physical interfaces on both the routers as show in the image below. In HSRP, the router with the highest priority value will be selected as primary router. By default the priority for HSRP routers will be 100. Since both the routers have same priority value, the tie breaker is the IP address. The router with highest physical IP address will become the primary (or) master router. So the router with IP address 192.168.1.3 will become the Primary(master) router and the router with the IP address 192.168.1.2 will become the Secondary(slave) router. Both the master and slave routers will send hello packets for every 3 seconds and dead timer is 10 seconds by default. This hello and dead timers are used as a keep alive mechanism. If the slave router dint receive hello from the master router for 10 seconds, it will take over the network assuming that the master is down.

#141

Configuring HSRP in the below topology.

As the above image shows, ‘Router 1’ is the primary router and ‘Router 2’ is the secondary router. Both primary & secondary routers are configured with physical IPs 192.168.1.3 & 192.168.1.2 respectively. Both the routers configured with the virtual IP 192.168.1.1.

#142

Configuring Router 1 (Primary/Master) Router>en Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#int fa0/0 Router(config-if)#standby 1 ip 192.168.1.1 Router(config-if)#

Configuring Router 2 (Secondary/Slave) Router>en Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#int fa0/0 Router(config-if)#standby 1 ip 192.168.1.1 Router(config-if)#

Checking the HSRP config in Router 1: Router(config-if)#do show standby FastEthernet0/0 - Group 1 (version 2) State is Active 9 state changes, last state change 00:35:17 Virtual IP address is 192.168.1.1 Active virtual MAC address is 0000.0C9F.F001 Local virtual MAC address is 0000.0C9F.F001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 0.069 secs Preemption disabled Active router is local Standby router is 192.168.1.2 Priority 100 (default 100) Group name is hsrp-Fa0/0-1 (default) Router(config-if)# From the above config we can see that ‘Router 1’ is the Active router (i.e) primary/master router. The standby/secondary/slave router is 192.168.1.2.

#143

Checking the HSRP config in Router 2: Router(config-if)#do show standby FastEthernet0/0 - Group 1 (version 2) State is Standby 3 state changes, last state change 00:39:03 Virtual IP address is 192.168.1.1 Active virtual MAC address is 0000.0C9F.F001 Local virtual MAC address is 0000.0C9F.F001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.672 secs Preemption disabled Active router is 192.168.1.3 Standby router is local Priority 100 (default 100) Group name is hsrp-Fa0/0-1 (default) Router(config-if)# From the above config we can see that ‘Router 2’ is the standby router (i.e) secondary/slave router. The active/primary/master router is 192.168.1.3. Now pinging from 192.168.1.4 to its Gateway (192.168.1.1) PC>ping 192.168.1.1 Pinging 192.168.1.1 with 32 bytes of data: Reply from 192.168.1.1: bytes=32 time=0ms TTL=255 Reply from 192.168.1.1: bytes=32 time=0ms TTL=255 Reply from 192.168.1.1: bytes=32 time=0ms TTL=255 Reply from 192.168.1.1: bytes=32 time=3ms TTL=255 Ping statistics for 192.168.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 3ms, Average = 0ms PC>arp -a Internet Address Physical Address Type 192.168.1.1 0000.0c9f.f001 dynamic PC>

#144

Now we getting reply from the master router. ‘0000.0c9f.f001’ is the virtual MAC address. The master router is replying for the virtual IP address ‘192.168.1.1’ with the virtual MAC address ‘0000.0c9f.f001’. Now let us check the MAC address table in the switch. Switch#show mac-address-table Mac Address Table ------------------------------------------Vlan Mac Address Type ---- ------------------ ----1 0000.0c9f.f001 1 0010.11c1.2d70 1 0060.3e83.a901 1 0060.5ccc.3001 Switch#

Ports

DYNAMIC Fa0/4 DYNAMIC Fa0/2 DYNAMIC Fa0/4 DYNAMIC Fa0/5

Now the virtual MAC address is connected to ‘fa0/4’ port where the master router is connected. Now let us continuously ping the Google server from the PC 192.168.1.4. PC>ping -t 74.125.224.72 Pinging 74.125.224.72 with 32 bytes of data: Reply from 74.125.224.72: bytes=32 time=1ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=1ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=15ms TTL=125 Reply from 74.125.224.72: bytes=32 time=9ms TTL=125 . . Ping reply goes on….

Now to make the master router down let us shutdown the ‘fa0/0’ interface of the master router. Once we shut the interface of the master router, slave router won’t be receiving hello messages. So slave router will be taking care of the virtual IP ‘192.168.1.1’ and virtual MAC address ‘0000.0c9f.f001’. The slave router will send a gratuitous ARP to the change MAC address table of the switch. #145

So after couple of ‘request timed out’ ping starts to work again via the slave router. . . Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Request timed out. Request timed out. Reply from 74.125.224.72: bytes=32 time=12ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Reply from 74.125.224.72: bytes=32 time=0ms TTL=125 Ping statistics for 74.125.224.72: Packets: Sent = 24, Received = 19, Lost = 2 (3% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 12ms, Average = 2ms PC>

Now let us check the MAC address table in the switch. Switch#show mac-address-table Mac Address Table ------------------------------------------Vlan Mac Address Type ---- ------------------ ----1 0000.0c9f.f001 1 0010.11c1.2d70 1 0060.3e83.a901 1 0060.5ccc.3001 Switch#

Ports

DYNAMIC Fa0/5 DYNAMIC Fa0/2 DYNAMIC Fa0/4 DYNAMIC Fa0/5

Now the virtual MAC address ‘0000.0c9f.f001’ is connected to ‘fa0/5’ port where the slave router is connected.

#146

In master router ‘fa0/1’ is the outside interface connected to ISP router. If the fa0/1 interface of master router is down, then the master router won’t be able to route the traffic to the internet. But still hello messages are exchanged between the master and slave routers. In this case slave router can’t take over the network because it gets hello message from the master router. This is where the priority is used. By default both the routers will have the priority of ‘100’. Usually the master router will be configured with the priority higher than the slave. Here we can configure the priority as ‘105’. We can enable interface tracking in the master router. Once the interface tracking is enabled for ‘fa0/1’ interface, whenever the ‘fa0/1’interface goes down, the priority value of the master router will be reduced. Say, here the priority will be reduced to 95 from 105. If the slave router with higher priority has to take over the master router with lower priority, then preemption has to be enabled in the slave router. Configuring Master router with higher priority and interface tracking: Router(config)#int fa0/0 Router(config-if)#standby 1 priority 105 Router(config-if)#standby 1 track fa0/1 Router(config-if)#do show standby FastEthernet0/0 - Group 1 (version 2) State is Active 11 state changes, last state change 01:22:30 Virtual IP address is 192.168.1.1 Active virtual MAC address is 0000.0C9F.F001 Local virtual MAC address is 0000.0C9F.F001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 2.471 secs Preemption disabled Active router is local Standby router is 192.168.1.2, priority 105 (expires in 7 sec) Priority 105 (configured 105) Track interface FastEthernet0/1 state Up decrement 10 Group name is hsrp-Fa0/0-1 (default) Router(config-if) Now we can see the priority has been configured with 105. Once we shut the ‘fa0/1’ interface then the priority will be decremented to 95.

#147

Configuring Preemption in Slave router: Router(config)#int f0/0 Router(config-if)#standby 1 preempt Router(config-if)#

Now let us shutdown the ‘fa0/1’ interface of the master router. Router(config)#int fa0/1 Router(config-if)#shutdown Router(config-if)#do show standby FastEthernet0/0 - Group 1 (version 2) State is Standby 15 state changes, last state change 01:41:14 Virtual IP address is 192.168.1.1 Active virtual MAC address is 0000.0C9F.F001 Local virtual MAC address is 0000.0C9F.F001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.37 secs Preemption disabled Active router is 192.168.1.2, priority 95 (expires in 7 sec) MAC address is 0000.0C9F.F001 Standby router is local Priority 95 (configured 105) Track interface FastEthernet0/1 state Down decrement 10 Group name is hsrp-Fa0/0-1 (default) Router(config-if)# From the above config we can see that the priority has been decremented to 95 and the master router has become standby router. Slave router has become the Active router. Now the slave router will send a gratuitous ARP to change the MAC address table of the switch. So even the internet connection of the master router goes down, PCs in that network will be able access internet via Slave router.

#148

13. INTERNET PROTOCOL - VERSION 6 (IPV6) 13.1. IPV6: IPv6 is introduced because we are running out of IPv4 addresses. We tried saving IPv4 address with solutions like Subnetting and NAT. But still the amount of internet s are exponentially increasing every year and each individual has at least 2 to 3 devices that connect with the internet. Below image shows how fast the world population grows every decade.

Below image shows the exponential growth in the number of internet s from the year 1993 to 2014.

#149

Below image shows IPv4 address allocation by countries:

Mostly countries like USA, Japan are comfortable with IPv4 itself but countries like India, Philippines, Pakistan need immediate IPv6 transition. In the year 2014 the number internet s is around 300 crores. It has been predicted that by the year 2050, 90% of the world’s population (i.e.) 850 crore people will be using internet. By that time each will have access to internet from multiple devices like laptop, mobile, tablet, eyeglass, watch etc. Worse will be the case when home appliances like TV, Air Conditioner, Microwave oven, Refrigerator, Washing machine etc will need an IP address to control remotely. We will be in need of atleast 10,000 crore public IPs to satisfy the need. This is where IPv6 comes in to picture and takes control of the internet. #150

IPV6 ADDRESS EXAMPLE: IPv6 is a 128 bit address. In 2607:f0d0:1002:0051:2342:2354:0983:0004

hexadecimal

notation

it

looks

like

Total Number of Address in IPv6 : 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456 In IPv4: 32 bits in total, Total Number of Addresses in IPv4: 232 = 429,49,67,296 IPv6 address is a hexadecimal address. Each character can vary from 0 to F. So IPv6 address have 32 hexadecimal characters. 4 hexadecimal character are be separated by colon (“:”).

13.2. RULES TO REDUCE IPV6 ADDRESS: RULE #1: Eliminate Groups of consecutive zeros with a double colon(::) Example: 2001:0050:0000:0000:0000:0000:2345:0342 Can be written as 2001:0050::2345:0342

RULE #2: Drop Leading Zeros Example: 2001:0050:0000:0000:0000:0000:2345:0342 Can be written as 2001:50:0:0:0:0:2345:342

After applying Rule 1 and Rule 2: IPv6 address can be written as 2001:50::2345:342

#151

EXERCISE: Write the minimum form of the following IPv6 address. 1) 2001:0000:0000:0000:0010:0000:0000:2323 2) 2001:0000:0000:1000:2000:0001:4356:0002 3) FE80:0000:0000:0000:3042:3FF2:F564:6B71 4) 2001:0056:0000:0000:0000:0000:0000:0001

SOLUTIONS: 1) 2001::10:0:0:2323 or 2001:0:0:0:10::2323 (Note that the double colon can be used only once in a address ) 2) 2001::1000:2000:1:4356:2 3) FE80::3042:3FF2:F564:6B71 4) 2001:56::1

13.3. TYPES OF ADDRESSES: In IPv6 each system can take one or more IP addresses. IPv6 address has 3 types of address. 1) Link Local – In IPv6 each system will have permanent link local address. Link Local address are generated from the MAC address of the System. 2) Site Local – Similar to Private addresses in IPv4 3) Global – Similar to Public addresses in IPv4

13.4. TYPES OF COMMUNICATIONS: 1) Unicast – One to One 2) Multicast – One to Many 3) Anycast – One to Closest location. #152

13.5. MAC ADDRESS TO IPV6 LINK LOCAL ADDRESS: MAC address is 48 bits, and IPv6 address is 128 bits. The conversion proceeds step by step: 1. Take the mac address: for example 52:74:f2:b1:a8:7f (to find your computer’s mac address use “ifconfig /all” command in command prompt.) 2. Throw ff:fe in the middle: 52:74:f2:ff:fe:b1:a8:7f 3. Reformat to IPv6 notation 5274:f2ff:feb1:a87f 4. Convert the first 2 hexadecimal character to binary: here in 52, 5-> 0101 & 2 -> 0010, So 52 -> 01010010 5. Invert the bit at index 7 : 01010010 -> 01010000 6. Convert binary back to hexadecimal: 0101 -> 5 & 0000 -> 0 so, 01010000 -> 50 7. Replace first 2 hexadecimal characters with newly calculated one: 5074:f2ff:feb1:a87f 8. Prepend the link-local prefix: fe80::5074:f2ff:feb1:a87f, ‘fe80’ is reserved for link local addresses. 9. Done! After calculating your computer’s link local address, you can check your result in the url http://www.networkgeek.in/mac-to-linklocal.php Note:* So far the IANA has given only address starting with the prefix 2 and 3 to the public.

#153

13.6. STATIC ROUTING IN IPV6:

Let us assign the IPv6 address on Router 0 and Router 1 as mentioned in the image. Configuring Router 0: By default IPv6 are disabled in Cisco devices. We can enable IPv6 feature using the command “ipv6 unicast-routing”. IPv6 uses subnet mask in slash notation. Router(config)#ipv6 unicast-routing Router(config)#int fa0/0 Router(config-if)#ipv6 address 2001:1::1/64 Router(config-if)#no shutdown Router(config-if)#int fa0/1 Router(config-if)#ipv6 address 2001:2::1/64 Router(config-if)#no shutdown Router(config-if)# Configuring Router 1: Router(config)#ipv6 unicast-routing Router(config)#int fa0/0 Router(config-if)#ipv6 address 2001:3::1/64 Router(config-if)#no shutdown Router(config-if)#int fa0/1 Router(config-if)#ipv6 address 2001:2::2/64 Router(config-if)#no shutdown Router(config-if)# #154

Now configuring static routing on Router 0: Router(config)#ipv6 route 2001:3::0/64 2001:2::2 (or) Router(config)#ipv6 route 2001:3::/64 2001:2::2 Now configuring static routing on Router 1: Router(config)#ipv6 route 2001:1::0/64 2001:2::1 (or) Router(config)#ipv6 route 2001:1::/64 2001:2::1 Pinging from 2001:1::2 to 2001:3::2 PC> Pinging 2001:3::2 with 32 bytes of data: Reply from 2001:3::2: bytes=32 time=1ms TTL=126 Reply from 2001:3::2: bytes=32 time=1ms TTL=126 Reply from 2001:3::2: bytes=32 time=0ms TTL=126 Reply from 2001:3::2: bytes=32 time=1ms TTL=126 Ping statistics for 2001:3::2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 1ms, Average = 0ms PC> Ping works!

#155

13.7. Dynamic Routing in IPV6: RIP-NG(Routing Information Protocol – Next Generation): Configuring RIP in the same topology we used for static routing: In ‘Router 0’ Router(config)#ipv6 router rip NetworkGeek Router(config-rtr)#exit Router(config)#int fa0/0 Router(config-if)#ipv6 rip NetworkGeek enable Router(config-if)#int fa0/1 Router(config-if)#ipv6 rip NetworkGeek enable Router(config-if)#exit In ‘Router 1’ Router(config)#ipv6 router rip NetworkGeek Router(config-rtr)#exit Router(config)#int fa0/0 Router(config-if)#ipv6 rip NetworkGeek enable Router(config-if)#int fa0/1 Router(config-if)#ipv6 rip NetworkGeek enable Router(config-if)#exit Routing table of ‘Router 0’ Router(config-if)#do show ipv6 route C 2001:1::/64 [0/0] via ::, FastEthernet0/0 L 2001:1::1/128 [0/0] via ::, FastEthernet0/0 C 2001:2::/64 [0/0] via ::, FastEthernet0/1 L 2001:2::1/128 [0/0] via ::, FastEthernet0/1 R 2001:3::/64 [120/2] via FE80::20A:F3FF:FEA8:1E02, FastEthernet0/1 L FF00::/8 [0/0] via ::, Null0 Router(config-if)

#156

OSPF v3: Configuring OSPF in the same topology. In ‘Router 0’ Router(config)#ipv6 router ospf 1 %OSPFv3-4-NORTRID: OSPFv3 process 1 could not pick a router-id,please configure manually Router(config-rtr)#router-id 1.1.1.1 Router(config-rtr)#exit Router(config)#int fa0/0 Router(config-if)#ipv6 ospf 1 area 0 Router(config-if)#int fa0/1 Router(config-if)#ipv6 ospf 1 area 0 Router(config-if)# In ‘Router 1’ Router(config)#ipv6 router ospf 1 %OSPFv3-4-NORTRID: OSPFv3 process 1 could not pick a router-id,please configure manually Router(config-rtr)#router-id 2.2.2.2 Router(config-rtr)#exit Router(config)#int fa0/0 Router(config-if)#ipv6 ospf 1 area 0 Router(config-if)#int fa0/1 Router(config-if)#ipv6 ospf 1 area 0 Router(config-if)# Routing table of ‘Router 0’ Router(config-if)#do show ipv6 route C 2001:1::/64 [0/0] via ::, FastEthernet0/0 L 2001:1::1/128 [0/0] via ::, FastEthernet0/0 C 2001:2::/64 [0/0] via ::, FastEthernet0/1 L 2001:2::1/128 [0/0] via ::, FastEthernet0/1 O 2001:3::/64 [110/2] via FE80::20A:F3FF:FEA8:1E02, FastEthernet0/1 L FF00::/8 [0/0] via ::, Null0 #157

EIGRP: Configuring EIGRP in the same topology. In ‘Router 0’ Router(config)#ipv6 router eigrp 1 Router(config-rtr)#eigrp router-id 1.1.1.1 Router(config-rtr)#exit Router(config)#int fa0/0 Router(config-if)#ipv6 eigrp 1 Router(config-if)#int fa0/1 Router(config-if)#ipv6 eigrp 1 Router(config-if)# In ‘Router 1’ Router(config)#ipv6 router eigrp 1 Router(config-rtr)#eigrp router-id 2.2.2.2 Router(config-rtr)#exit Router(config)#int fa0/0 Router(config-if)#ipv6 eigrp 1 Router(config-if)#int fa0/1 Router(config-if)#ipv6 eigrp 1 Router(config-if)# Routing table of ‘Router 0’ Router(config-if)#do show ipv6 route C 2001:1::/64 [0/0] via ::, FastEthernet0/0 L 2001:1::1/128 [0/0] via ::, FastEthernet0/0 C 2001:2::/64 [0/0] via ::, FastEthernet0/1 L 2001:2::1/128 [0/0] via ::, FastEthernet0/1 D 2001:3::/64 [90/30720] via FE80::20A:F3FF:FEA8:1E02, FastEthernet0/1 L FF00::/8 [0/0] via ::, Null0 Router(config-if)#

#158

13.8. ACL in IPV6: In IPv6 we don’t have standard ACLs. We have only extended ACLs. No more numbered ACLs IPv6. Only named ACLs we have in IPv6. Configuring ACL in the same topology we use for Static and Dynamic routing. Task : Blocking the host 2001:1::2/64 from pinging 2001:3::2/64

Router(config)#ipv6 access-list NetworkGeek Router(config-ipv6-acl)#deny ipv6 host 2001:1::2 host 2001:3::2 Router(config-ipv6-acl)#permit ipv6 any any Router(config-ipv6-acl)#exit Router(config)#do show access-list IPv6 access list NetworkGeek deny ipv6 host 2001:1::2 host 2001:3::2 permit ipv6 any any Router(config)#int fa0/0 Router(config-if)#ipv6 traffic-filter NetworkGeek in Router(config-if)#

#159

14. SWITCHING AND VLAN 14.1. SWITCHING: How switches make switching decisions? Like routers make routing decisions based on Routing Table, switches make switching decisions based on a table called ‘MAC Address Table’. Whenever switches receives any traffic it reads the source and destination MAC address in that traffic. This is why switches are called as Layer 2(Datalink Layer) devices. Consider the below topology:

The MAC address table in Cisco switch looks like the below one: Switch#show mac-address-table Mac Address Table ------------------------------------------Vlan Mac Address Type Ports ---- ------------------ ----1 0030.a383.8a66 DYNAMIC Fa0/1 1 0030.a3b7.d873 DYNAMIC Fa0/2 1 000b.beca.5001 DYNAMIC Fa0/3 Switch# MAC address table shows that the device with MAC address ‘0030.a383.8a66’ is connected to the port Fa0/1 and respectively for the other ports as well.

#160

HOW SWITCHES POPULATE THE MAC ADDRESS TABLE? Devices like Routers and PCs will be getting an IP address either by static assignment or using DH. If we assign IP address statically, the device will send broadcast message checking whether any other devices on the same network uses the same IP address. In this broadcast message, the source MAC address will be the MAC address of the sender PC and the destination MAC address will be the broadcast address (ffff.ffff.ffff). This broadcast message will be received by the switch. Whenever the switch receives any kind of traffic, it will update the MAC address-table using the source MAC address in that traffic. In this way whenever we assign the IP address to a system the switch will automatically update the MAC address table. If the PC is going to get the IP address using DH it will send DH request in first case. In that DH request the source MAC address will be the MAC address of the PC and the destination MAC address will be the broadcast address (ffff.ffff.ffff). Even by this method the switch will receive a traffic from that PC and will be able populate its MAC address table. So in either case, the MAC address of the PCs will be known by the switch. This is how the switch populates the MAC address table.

HOW SWITCHES FORWARD A FRAME TO THE DESTINATION PORT? Pinging from 192.168.1.2 to 192.168.1.3 How frame looks likes? Data Ping Request

Protocol ICMP

Src IP 192.168.1.2

Dest IP 192.168.1.3

Src MAC Dest MAC 0030.a383.8a66 0030.a3b7.d873

This Frame enters the switch port fa0/1 Now switches will look at the destination MAC address and will check with its MAC address table. In MAC address table it finds an entry that the PC with MAC address “0030.a3b7.d873” is connected to the port fa0/2. Now the switch will forward the frame into the fa0/2 port. This is how switches takes the switching/forwarding decisions.

PINGING DIFFERENT NETWORK: Pinging from 192.168.1.2 to 192.168.2.2 As we studied in our ARP classes, if we ping a different network, then the destination MAC address will be the MAC address of the Gateway.

#161

How frame looks likes? Data Ping Request

Protocol ICMP

Src IP 192.168.1.2

Dest IP 192.168.2.2

Src MAC Dest MAC 0030.a383.8a66 000b.beca.5001

This Frame enters the switch port fa0/1 Now switches will look at the destination MAC address and will check with its MAC address table. In MAC address table it finds an entry that the host with MAC address “000b.beca.5001” is connected to the port fa0/3. Now the switch will forward the frame into the fa0/3 port. This frame will be received by the Router.

14.2. VLAN – VIRTUAL LOCAL AREA NETWORK: VLAN is the concept of breaking one physical switch into multiple logical switches. Usually if we need to have 3 different networks in our topology, our design will be like the one below. i.e., PCs in same network will be connected to a single switch. Likewise if we need 3 different networks then we will require 3 switches.

In the above topology, we are actually wasting more number of ports in each switch. Without using the 24 ports in the first switch we are moving to the 2 nd and 3rd switch just for the sake of putting them in a different network. This design costs us more. So instead of placing the PCs in three different switches we can go for the design like the below one, where we can place all the PCs in a same switch.

#162

This kind of design will save us 2 switches comparitively. But there many vulnerabilities in this kind of design since 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24 are in same broadcast domain. Now we have to create a separate broadcast domain for each network by asg the PCs of the network 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24 to individual VLANs. VLANs are identified by a VLAN number. By default all the ports in a switch will be in VLAN 1. Here let us use VLAN 10, for 192.168.1.0/24 VLAN 20, for 192.168.2.0/24 VLAN 30, for 192.168.3.0/24 Configuring VLANs in switch: As we can see from the image the PCs with IP 192.168.1.2 & 192.168.1.3 are connected to the port fa0/1 and fa0/2 of the switch respectively. Similarly 192.168.2.2, 2.3, 3.2, 3.3 are connected to fa0/3, 0/4, 0/5, 0/6 respectively. Switch#conf t Switch(config)#vlan 10 Switch(config-vlan)#name VLAN10 Switch(config)#vlan 20 Switch(config-vlan)#name VLAN20 Switch(config)#vlan 30 Switch(config-vlan)#name VLAN30 Switch(config-vlan)#exit Switch(config)#int fa0/1 Switch(config-if)#switchport access vlan 10 Switch(config-if)#int fa0/2 #163

Switch(config-if)#switchport access vlan 10 Switch(config-if)#int fa0/3 Switch(config-if)#switchport access vlan 20 Switch(config-if)#int fa0/4 Switch(config-if)#switchport access vlan 20 Switch(config-if)#int fa0/5 Switch(config-if)#switchport access vlan 30 Switch(config-if)#int fa0/6 Switch(config-if)#switchport access vlan 30 Switch(config-if)# Now checking the VLAN information using show command. Switch(config-if)#do show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------1 default active Fa0/7, Fa0/8, Fa0/9, Fa0/10 Fa0/11, Fa0/12, Fa0/13, Fa0/14 Fa0/15, Fa0/16, Fa0/17, Fa0/18 Fa0/19, Fa0/20, Fa0/21, Fa0/22 Fa0/23, Fa0/24, Gig1/1, Gig1/2 10 VLAN10 active Fa0/1, Fa0/2 20 VLAN20 active Fa0/3, Fa0/4 30 VLAN30 active Fa0/5, Fa0/6 Switch(config-if)# Now the switch has 4 VLANs. As we can see from the result fa0/1 and fa0/2 has been assigned to VLAN 10, fa0/3 & fa0/4 has been assigned to VLAN 20, fa0/5 & fa0/6 has been assigned to VLAN 30. Rest of the ports are in the default VLAN 1. Since the switch has 4 VLANs, logically it has been divided into 4 individual switches. If a PC in VLAN 10, sends a broadcast message, it will be received only by the PCs that are in the VLAN 10. So in order to communicate between different networks we need a router.

Consider the below topology: In this topology we have two different switches and VLANS are configured as mentioned above.

#164

The fa0/7 interface in 1st switch and fa0/4 interface in the 2nd switch are used to connect the switches, and those ports are in the default VLAN. Let’s say now we have to ping from 192.168.1.2 to 192.168.1.4. Both PCs are in the same VLAN i.e VLAN 10, whereas the interface connecting two switches are in VLAN1. Switches will not allow traffic from one VLAN to another. So we have two options here. 1) Changing fa0/7 of 1st switch & fa0/4 of 2nd switch to VLAN 10. But this options will not allow 192.168.2.2 to 192.168.2.4 & 192.168.3.2 to 192.168.3.4 to communicate. 2) The second option is making fa0/7 of 1st switch & fa0/4 of 2nd switch as trunk port.

TRUNK PORT: Trunk port is switch port mode, which allows all VLANs to through that port. Configuring trunk port in both the switches. 1st Switch: Switch#conf t Switch(config)#interface fa0/7 Switch(config-if)#switchport mode trunk Switch(config-if)#

#165

2nd Switch: Switch#conf t Switch(config)#interface fa0/4 Switch(config-if)#switchport mode trunk Switch(config-if)# Pinging from 192.168.1.2 to 192.168.1.4 PC>ping 192.168.1.4 Pinging 192.168.1.4 with 32 bytes of data: Reply from 192.168.1.4: bytes=32 time=0ms TTL=128 Reply from 192.168.1.4: bytes=32 time=0ms TTL=128 Reply from 192.168.1.4: bytes=32 time=0ms TTL=128 Reply from 192.168.1.4: bytes=32 time=0ms TTL=128 Ping statistics for 192.168.1.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC> Pinging from 192.168.2.2 to 192.168.2.4 PC>ping 192.168.2.4 Pinging 192.168.2.4 with 32 bytes of data: Reply from 192.168.2.4: bytes=32 time=0ms TTL=128 Reply from 192.168.2.4: bytes=32 time=0ms TTL=128 Reply from 192.168.2.4: bytes=32 time=0ms TTL=128 Reply from 192.168.2.4: bytes=32 time=0ms TTL=128 Ping statistics for 192.168.2.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC>

#166

Adding Router to the Present Topology:

Now we have connected fa0/8, 0/9, 0/10 to Router’s fa0/0, 0/1, 1/0 ports respectively. Configuring 1st Switch: Switch(config)#int fa0/8 Switch(config-if)#switchport access vlan 10 Switch(config-if)#int fa0/9 Switch(config-if)#switchport access vlan 20 Switch(config-if)#int fa0/10 Switch(config-if)#switchport access vlan 30 Switch(config-if)# Configuring Router: Router(config)#int fa0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#no shut Router(config-if)#int fa0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#no shut Router(config-if)#int fa1/0 Router(config-if)#ip address 192.168.3.1 255.255.255.0 Router(config-if)#no shut #167

Now pinging from 192.168.1.2 to 192.168.2.2 PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Ping statistics for 192.168.2.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC> Ping works!

ROUTER-ON-A-STICK: We cannot afford single interface for each VLAN. Most of the organizations uses design with 20+ VLANs. In that case it is practically not possible for routers to have that many interfaces.

Here we can create a sub-interface in the router and make them to work like real interfaces. VLAN configuration on Switch: Switch#conf t Switch(config)#vlan 10 Switch(config-vlan)#name VLAN10 Switch(config)#vlan 20 Switch(config-vlan)#name VLAN20 Switch(config-vlan)#exit #168

Switch(config)#int fa0/1 Switch(config-if)#switchport access vlan 10 Switch(config-if)#int fa0/2 Switch(config-if)#switchport access vlan 10 Switch(config-if)#int fa0/3 Switch(config-if)#switchport access vlan 20 Switch(config-if)#int fa0/4 Switch(config-if)#switchport access vlan 20 Switch(config)#int fa0/5 Switch(config-if)#switchport mode trunk Switch(config-if)# Sub-Interface configuration on Router: Router#conf t Router(config)#int fa0/0 Router(config-if)#no shut Router(config-if)#exit Router(config)#int fa0/0.10 Router(config-subif)#encapsulation dot1Q 10 Router(config-subif)#ip address 192.168.1.1 255.255.255.0 Router(config-subif)#int fa0/0.20 Router(config-subif)#encapsulation dot1Q 20 Router(config-subif)#ip address 192.168.2.1 255.255.255.0 Router(config-subif)# The number ‘10’ in command “encapsulation dot1Q 10” says the VLAN number 10. Pinging from 192.168.1.2 to 192.168.2.2 PC>ping 192.168.2.2 Pinging 192.168.2.2 with 32 bytes of data: Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Reply from 192.168.2.2: bytes=32 time=0ms TTL=128 Ping statistics for 192.168.2.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), PC> Ping works!

#169

14.3. SPANNING TREE PROTOCOL: Spanning tree protocol is used to avoid loops in switches. Consider the topology below.

In this kind of topology looping will happen. To stop looping issues, spanning tree protocol will block one link. The working of spanning tree will be described using below topology. Consider the below topology,

Even in this topology there is a loop happening. To avoid this loop a Root Bridge will be elected. The switch with lowest Bridge ID will be elected as Root Switch or Root Bridge. How Bridge ID of a switch is calculated? Bridge ID = Priority & MAC-address-of-the-switch. By default the Priority value will be set to 32768 + VLAN Number. Since here we have only the default VLAN (i.e) VLAN number 1. So the priority will be set to (32768 + 1) = 32769. So the Bridge ID of Switch1 = 32769 & 1111.1111.1111,

#170

Switch2 = 32769 & 2222.2222.2222, Switch3 = 32769 & 3333.3333.3333, Priority value of the switch will be given 1st preference & MAC address will be given 2nd preference. So while electing the root bridge, if the priority value of all the switches are same, then the switch with lowest MAC address will be chosen as Root. Since all the switches has the default priority value, the switch with lowest MAC address will be chosen as Root. Here Switch1 will be elected as Root switch. Now the Non Root switches will open its port that is connected to the Root Switch. Here ‘fa0/2’ of switch2 and ‘fa0/2’ of switch 3 are connected to the Root Switch and they called as ‘Root Port’. Root Switch will always open its port. Here ‘fa0/1’ & ‘fa0/2’ of Root Switch will be open. The two Non-Root switches are switches are Switch2 and Switch3. Among them Switch 2 has lowest Bridge ID. So ‘fa0/1’ interface of Switch 2 will be open and ‘fa0/1’ interface of Switch 3 will be in blocked state.

We can the same in the above switches. In Switch 1: Switch#show spanning-tree VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32769 Address 1111.1111.1111 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

#171

Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 1111.1111.1111 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20 Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------Fa0/1 Desg FWD 19 128.1 P2p Fa0/2 Desg FWD 19 128.2 P2p Switch# The configuration shows that Switch1 is the Root Switch. ‘Fa0/1’ and ‘Fa0/2’ are in the forwarding state (i.e) they are open to receive traffic. In Switch 2: Switch#show spanning-tree VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32769 Address 1111.1111.1111 Cost 19 Port 2(FastEthernet0/2) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 2222.2222.2222 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20 Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------Fa0/1 Desg FWD 19 128.1 P2p Fa0/2 Root FWD 19 128.2 P2p Switch# Here ‘Fa0/2’ is the Root Port. Fa0/1 is not connected to Root switch, but is in forwarding state. In Switch 3: Switch#show spanning-tree VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32769 Address 1111.1111.1111 Cost 19 Port 2(FastEthernet0/2) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 3333.3333.3333 #172

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20 Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------Fa0/2 Root FWD 19 128.2 P2p Fa0/1 Altn BLK 19 128.1 P2p Switch# Here ‘Fa0/2’ is the Root port. Each switch port can be in 3 different roles. 1) Root Port – The port that is used to reach the Root Switch. Those ports will be in forwarding state. 2) Designated Port – These ports are Non-Root ports. They are in forwarding state as well. 3) Alternate Port – These ports are Non-Root ports and they are in blocked state. By the changing the priority value, you can decide which switch has to become Root. You can change priority of the switch using the following command. Switch>en Switch#conf t Switch(config)#spanning-tree vlan 1 priority 4096 Switch(config)#

Cost of the link: Usually the best path to the root switch will be chosen using the cost. Lower the cost, better is the path .

Link Speed

Cost

Ethernet(10Mbps)

100

FastEthernet(100Mbps)

19

Gigabit Ethernet(1Gbps)

4

10 Gigabit Ethernet(10Gbps)

2

#173

Consider the topology below:

Here Switch1 remains as the Root Switch. Now if Switch2 needs to reach Root switch it can use the ‘Fa0/2’ or it can use ‘Gi1/1’. But if it uses the Fast Ethernet link the cost will be 19, whereas if it uses the Gigabit link the cost will be 8 (4+4). Since the cost for Gigabit link is low now the Switch2 uses the ‘Gi 1/1’ as ‘Root Port’ and Fa0/2 port becomes the blocked port. Now let us this in all the 3 switches. In Switch 1: Switch#show spanning-tree VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32769 Address 1111.1111.1111 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 1111.1111.1111 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20 Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------Fa0/1 Desg FWD 19 128.1 P2p Gi1/1 Desg FWD 4 128.25 P2p Switch#

#174

In Switch 2: Switch#show spanning-tree VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32769 Address 1111.1111.1111 Cost 8 Port 25(GigabitEthernet1/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 2222.2222.2222 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20 Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------Fa0/2 Altn BLK 19 128.2 P2p Gi1/1 Root FWD 4 128.25 P2p Switch# Here we can notice the cost as 8 and ‘Gi 1/1’ has become Root Port. Even though ‘Fa0/2’ is directly connected to the root switch, that port has become a blocked port.

PVSTP – Per VLAN Spanning Tree Protocol: In PVSTP we can configure different root switch for different VLAN. It is a cisco propriety protocol. It is used to share the load among multiple switches configured with multiple VLANs.

RSTP – Rapid Spanning Tree Protocol: The convergence time in normal STP protocol is around 45 seconds. RSTP protocol makes the switches to converge fast. You can use the following command to change the switch mode from STP to RSTP. All the switches in the network should run RSTP to converge fast. Switch>en Switch#conf t Switch(config)#spanning-tree mode rapid-pvst Switch(config)#

#175

14.4. SWITCH SECURITY: Since switches can see Src & Dest MAC address of any traffic ing through it, it can be used to secure the network in many ways. Consider the topology below:

The PC with MAC address 00D0.BCA4.6683 is connected to Fa0/1 port and PC with MAC address 0001.4286.EDD5 is connected to Fa0/2. Now we can ask the switch to take appropriate action when some other different PC is connected to the Fa0/1. When some other PC is connected to that port, MAC address of the PC is going to be different. So we can achieve this by asking the switch to allow only the traffic with the source MAC address of our authorized PC. This can be done using the following commands. Switch>en Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#int fa0/1 Switch(config-if)#switchport mode access Switch(config-if)#switchport port-security Switch(config-if)#switchport port-security maximum 1 Switch(config-if)#switchport port-security mac-address 00D0.BCA4.6683 Switch(config-if)#switchport port-security violation shutdown Switch(config-if)# Command: “switchport mode access” Description: Making this port as an access port. Switch port can be two modes. 1) Trunk mode – Trunk mode means that another switch or hub is connected to this port. 2) Access mode – Access mode means that a PC is connected to this port. #176

Here we are mentioning that this port is used by PC and not by a switch or a hub. Command: “switchport port-security” Description: Making this port a secure one. Command: “switchport port-security maximum 1” Description: Maximum number of PCs allowed in this port is set to 1. Command: “switchport port-security mac-address 00D0.BCA4.6683” Description: The PC with MAC address ‘00D0.BCA4.6683’ is only allowed into this port. Command: “switchport port-security violation shutdown” Description: If this rule is violated then this port of the switch has to be shutdown. It is difficult to identify the MAC address of every PC and very difficult to configure the switch security commands in each port. So here we can use the sticky command. Sticky command will take MAC address of the 1st PC connected to that port. Switch>en Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#int fa0/1 Switch(config-if)#switchport mode access Switch(config-if)#switchport port-security Switch(config-if)#switchport port-security maximum 1 Switch(config-if)#switchport port-security mac-address sticky Switch(config-if)#switchport port-security violation shutdown Switch(config-if)# Interface Range command: We can select more than one interface at a time using the following command. Switch(config)#interface range fa0/1 - 24 Switch(config-if-range)#switchport mode access Switch(config-if-range)#switchport port-security Switch(config-if-range)#switchport port-security maximum 1 Switch(config-if-range)#switchport port-security mac-address sticky Switch(config-if-range)# switchport port-security violation shutdown Switch(config-if-range)# All the above commands have been applied from fa0/1 to fa0/24. It saves us a lot of time. #177

Network Geek 1i651c

Overview 5o1f4z

More details 6z3438

Related Documents c2h70

Network Geek 1i651c

Geek 4niq

Mind Geek 1yk1v

Geek Girl (geek Girl, Book 1) 3bh57

Geek Squad Handbook 2z4u6i

Cozinha Geek - Jeff Potter 5u1r44

More Documents from "Selvi" 724r3k

Bph 1t6u3h

Makalah Bipolar Selvi 4a4a1u

Ival Oru Puthu Kavithai.pdf 6j6y4l

Avertebrata Laut Adalah 4a4c1u

Network Geek 1i651c

Nathiyoram (part 2) - Mr.pdf 1nz2m