DHCP manually binding

<copy from http://www.cisco.com/en/US/docs/ios/12_0t/12_0t1/feature/guide/Easyip2.html#wp23682>

 The IP address of a client can be assigned manually by an administrator or assigned automatically from a pool by a DHCP server.


Manual bindings are IP addresses that have been manually mapped to the MAC addresses of hosts that are found in the DHCP database. Manual bindings are stored in NVRAM on the DHCP server. Manual bindings are just special address pools. There is no limit on the number of manual bindings but you can only configure one manual binding per host pool.

To configure a manual binding, first create a host pool, then specify the IP address and hardware address of the client or client identifier. The hardware address is the MAC address. The client identifier, which is required for Microsoft clients (instead of hardware addresses), is formed by concatenating the media type and the MAC address of the client. Refer to the "Address Resolution Protocol Parameters" section of RFC 1700, Assigned Numbers, for a list of media type

Example Configuration



ip dhcp pool DHCP-TEST
   host 10.1.2.10 255.255.255.0
   hardware-address c204.07d0.0001 ieee802
   default-router 10.1.2.1
   dns-server 10.1.2.1
!
ip dhcp pool DHCP-TEST1
   host 10.1.2.11 255.255.255.0
   hardware-address 1111.1111.1111 ieee802
!

Verify Configuration


R3#sh ip dhcp binding
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
10.1.2.10           c204.07d0.0001          Infinite                Manual
10.1.2.11           1111.1111.1111          Infinite                Manual

GLBP Load Balancing options

There are 3 different options for the GLBP load balancing

• Host-dependent : load balancing based on MAC address of a host where the same forwarder is used for a particular host while the number of GLBP group members remains unchanged.
• Round-Robin  :   Each active forwarder will in turns forward the packets. This is a default setting of glbp
• Weighted   :  load balancing based on the weighting value advertised by the gateway.

Configuration Command

       glbp group load-balancing [host-dependent | round-robin | weighted]

How to Decrypt Key 7 using IOS

Everyone may experience when we don't remember the password that we put into the configuration. This is a way to decry pt it using the cisco IOS.

Example


You forgot the password for the ntp authentication part
show run | in ntp

ntp authentication-key 1 md5 120D000406060851212E3D 7

Solution
- Create key chain. 



R1(config)#key chain decryptkey
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string 7  120D000406060851212E3D
R1(config-keychain-key)#

R1#sh key chain

Key-chain decryptkey:

    key 1 -- text "testmd5key"

        accept lifetime (always valid) - (always valid) [valid now]

        send lifetime (always valid) - (always valid) [valid now]

Unicast reverse Path

Unicast reverse path check is used as an ingress filter to protect the network from the untrusted networks. When uRPF is enabled, the router checks the source ip address of the packet is reachable via the incoming interface. If it is not, the router will drop the packet.

Note:
uRPF should not be configured if you have the asymmetric network.

To see how this feature works, I have one simple examples to illustrate this. I have R1 - R2 - R3 connected according to the figure below.  They are in the same OSPF area. However, R2 has a static route going to 1.1.1.1 pointing to the 192.168.3.2 (R3 interface ) as opposed to going out via 192.168.1.0 network.

R2:   ip route 1.1.1.1 255.255.255.255 192.168.3.2

// we force the traffic back to 1.1.1.1/32 by going through R3 instead of R1 ( static route higher AD than OSPF) 

We will test the connectivity by PING from R1 to R2 using source IP address of 1.1.1.1. If we do not enable the uRPF check on the R2 interface, the PING is successful.

R1#ping 2.2.2.2 source lo0

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 1.1.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/35/56 ms

R1#

When we enable the uRPF check on the interface R2, the PING will be failed because the traffic R2 going back to R1 will use another route (via R3) instead of going to R1 directly. This violates the RPF check rule.

R2(config-if)#ip verify unicast source reachable-via rx

the ping is failed.

R1#ping 2.2.2.2 source lo0

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 1.1.1.1

.....

Success rate is 0 percent (0/5)

R1#

Netflow Configuration

Netflow allow us to export traffic statistics to the remote workstation. We use this data to gain traffic performance, control, or accounting in the specific network locations.

Configure netflow

• Enable Netflow
• Interface Level : ip route-cache flow
• Export Netflow information.
• global level 
• ip flow-export destination x.x.x.x <port>
• ip flow-export source x.x.x.x

Example configuration

interface Serial0/3/0

 description T1 to remote-sites

 bandwidth 1536

 ip address 10.12.255.138 255.255.255.248

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 rate-limit output access-group 191 256000 32000 48000 conform-action transmit exceed-action drop

 ip route-cache flow

 service-policy output VOIP-LLQ

ip flow-export source Loopback0

ip flow-export destination 10.12.66.82 16384

ip flow-export destination 10.12.64.36 3000

Command Scheduler (KRON)

Command Scheduler allows cutomers to schedule fully-qualified EXEC mode CLI command. It consists of 2 processes. A policy list is configured containing lines of EXEC CLI commands to be run.

KRON configuration example.


kron policy-list TEST_KRON
 cli enable
 cli conf terminal
 cli int f0/1
 cli bandwidth 10000

kron occurrence TEST_KRON in 1    //  occurrence in 1 minute

 policy-list TEST_KRON

Verify configuration

show kron schedule

Router#sh kron schedule

Kron Occurrence Schedule

TEST_KRON inactive, will run again in 0 days 00:00:13

TCP and UDP Small Servers

TCP and UDP small server are services which runs on the router itself for some useful diagnostics.

TCP Small Servers

The TCP small servers are:

• Echo: Echoes back whatever you type through the telnet x.x.x.x echo command.
• Chargen: Generates a stream of ASCII data. Use the telnet x.x.x.x chargen command.
• Discard: Throws away whatever you type. Use the telnet x.x.x.x discard command.
• Daytime: Returns system date and time, if it is correct. It is correct if you run Network Time Protocol (NTP), or have set the date and time manually from the exec level. Use the telnet x.x.x.x daytime command.

Replace x.x.x.x with the IP address of your router. Most routers inside Cisco run the small servers.

UDP Small Servers

The UDP small servers are:

• Echo: Echoes the payload of the datagram you send.
• Discard: Silently pitches the datagram you send.
• Chargen: Pitches the datagram you send, and responds with a 72-character string of ASCII characters terminated with a CR+LF.

Parser View

With CLI view, we can restrict which access each network administrator have based on role. Superviews allow a network administrator to easily assign all users within configured CLI views to a superview instead of having to assign multiple CLI views to a group of users. 


Here is the basic configuration of the Parser View.


R2 <----> R3    
192.168.1.1   <---->  192.168.1.2


Task: 

• Allowing telnet access with the username OPERATOR and password CISCO to be able to configure the HTTP feature in the router only.
• Configure Username ADMIN and password CISCO to have access to every feature in the router.

aaa new-model
!
!
aaa authentication login default local
aaa authentication login VTY local
aaa authentication login CON none
aaa authorization exec default local
aaa authorization exec VTY local

username OPERATOR view HTTP password 0 CISCO

username ADMIN privilege 15 password 0 CISCO

parser view HTTP

 secret 5 $1$6ZRJ$CIjM5cdVUvhpinttlR/361

 commands configure include ip http

 commands configure include ip

 commands exec include configure terminal

 commands exec include configure

 commands exec include show running-config

 commands exec include show

Verify configuration

HTTP View

R2#telnet 192.168.1.2

Trying 192.168.1.2 ... Open

User Access Verification

Username: OPERATOR

Password:

R3#show parser view

Current view is 'HTTP'

 

R3(config)#?

Configure commands:

  do    To run exec commands in config mode

  exit  Exit from configure mode

  ip    Global IP configuration subcommands

R3(config)#

Configure commands:

  do    To run exec commands in config mode

  exit  Exit from configure mode

  ip    Global IP configuration subcommands

R3(config)#

---------------------------------------

Change parser view configuration

To be able to change the configuration of the parser view, you need to enter the view root. In this example, to enter the view root, we have to telnet with login as ADMIN and "enable view".

R2#telnet 192.168.1.2

Trying 192.168.1.2 ... Open

User Access Verification

Username: ADMIN

Password:

R3#en view

Password:

R3#

On R3, you will have the syslog message:

*Mar  3 22:24:04.582: %PARSER-6-VIEW_SWITCH: successfully set to view 'root'.

Now, you can change the configuration of the parser view.

R3#

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#parser view HTTP ?

  superview  SuperView Commands

  <cr>

R3(config)#parser view HTTP

R3(config-view)#?

View commands:

  commands  Configure commands for a view

  default   Set a command to its defaults

  exit      Exit from view configuration mode

  no        Negate a command or set its defaults

  secret    Set a secret for the current view

Embedded Event Manager

Embedded event manager is a very nice feature of the CISCO IOS. This feature will track the event which occur on a router and notify or automatically configure a router for us. EEM uses event detector and actions to provide the notification of those events.

Example of the events of EEM are as followings.

Router(config-applet)#event ?
  application   Application specific event
  cli                     CLI event
  counter             Counter event
  interface           Interface event
  ioswdsysmon    IOS WDSysMon event
  none                 Manually run policy event
  oir                    OIR event
  resource           Resource event
  snmp                SNMP event
  syslog               Syslog event
  timer                Timer event
  track                Tracking object event

Action that EEM provides are as followings.

 - generating syslog messages

 - reload the router

 - generate SNMP traps

 - Executing the Cisco IOS command 

 - etc

Sample Configuration of EEM


event manager applet TEST_EEM
 event none
 action 1.1 cli command "enable"
 action 1.2 cli command "conf t"
 action 1.3 cli command "int f0/1"
 action 1.4 cli command "ip address 192.168.1.1 255.255.255.0"
 action 1.5 cli command "exit"
!

When launching this command. " event manager run TEST_EEM", because the event is NONE, the router will immediately do actions according to the configured actions. 

So the interface f0/1 will be configured the IP address as 192.168.1.1/24.

Result

Router#sh ip int brief

Interface                  IP-Address      OK? Method Status                Protocol

FastEthernet0/0            unassigned      YES unset  administratively down down

FastEthernet0/1            192.168.1.1     YES manual administratively down down

Router#

Switch Database Template (SDM)

We can use SDM template to configure the switch to optimize support for specific features depending on how the switched is used in the network. There are 3 types of features.

1. Routing : maximizes system resources for unicast routing.
2. VLANs : Maximizes number of unicast MAC address.
3. Default :  balancing to all functions

Here is the approximate number of feature resources allowed by each template.

Configuration 

In configuration mode.

-sdm prefer vlan 

-sdm prefer routing 

Verification

show sdm prefer

Test_switch#sh sdm prefer

 The current template is "desktop default" template.

 The selected template optimizes the resources in

 the switch to support this level of features for

 8 routed interfaces and 1024 VLANs.

  number of unicast mac addresses:                  6K

  number of IPv4 IGMP groups + multicast routes:    1K

  number of IPv4 unicast routes:                    8K

    number of directly-connected IPv4 hosts:        6K

    number of indirect IPv4 routes:                 2K

  number of IPv4 policy based routing aces:         0

  number of IPv4/MAC qos aces:                      0.75K

  number of IPv4/MAC security aces:                 1K

On-Demand Routing (ODR)

On Demand Routing uses CDP to advertise the connected IP prefix of the stub router via CDP and transmit to HUB router. The stub router will have a default route installed in its routing table. When configuring ODR, make sure that there is no routing protocol running on the router.

Command to enable ODR.
In global configuration
router odr

Example

R1 is a HUB. R2 and R3 are spoke routers. Note that we do not have any routing process on R3 and R2. R1 only have IP reachability to R2 and R3. Configuration is only done on R1.

Configuration



R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#router odr
R1(config)#router odr
R1(config-router)#

Verify Configuration

R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     1.0.0.0/32 is subnetted, 1 subnets
o       1.1.1.1 [160/1] via 192.168.1.2, 00:00:01, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
o       2.2.2.2 [160/1] via 192.168.2.2, 00:00:35, FastEthernet0/1
C    192.168.1.0/24 is directly connected, FastEthernet0/0
C    192.168.2.0/24 is directly connected, FastEthernet0/1
R1#

Spoke Routing table

R2#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.2.1 to network 0.0.0.0

     2.0.0.0/32 is subnetted, 1 subnets

C       2.2.2.2 is directly connected, Loopback1

C    192.168.2.0/24 is directly connected, FastEthernet0/0

o*   0.0.0.0/0 [160/1] via 192.168.2.1, 00:00:48, FastEthernet0/0

DHCP Snooping

DHCP snooping prevents attacks that use DHCP. It only allows dhcp message on the configured trusted port to communicate to clients. Otherwise, it will drop the packets. When enabling the dhcp snooping on the switch, all ports are as default an untrusted port. Therefore, we need to specify which port connects to the DHCP server to allow DHCP message being forward by the switch.

Also, DHCP snooping builds a table of IP address and port mapping based on legitimate DHCP messages on trusted ports called DHCP snooping binding table. This table will be used by arp inspection and IP source guard feature.

Configuration 

SWICH Configuration

ip dhcp snooping vlan 10
no ip dhcp snooping information option
ip dhcp snooping

interface FastEthernet0/1

 switchport access vlan 10

 switchport mode access

 ip dhcp snooping trust

 ip dhcp snooping limit rate 100

interface FastEthernet0/3

 switchport access vlan 10

 switchport mode access

Verify Configuration

Switch#sh ip dhcp snooping

Switch DHCP snooping is enabled

DHCP snooping is configured on following VLANs:

10

DHCP snooping is operational on following VLANs:

10

DHCP snooping is configured on the following L3 Interfaces:

Insertion of option 82 is disabled

   circuit-id format: vlan-mod-port

    remote-id format: MAC

Option 82 on untrusted port is not allowed

Verification of hwaddr field is enabled

DHCP snooping trust/rate is configured on the following Interfaces:

Interface                            Trusted     Rate limit (pps)

------------------------     -------     ----------------

FastEthernet0/1                   yes           100

Switch#show ip dhcp snooping binding

MacAddress               IpAddress        Lease(sec)      Type               VLAN    Interface

------------------      ---------------   ----------     -------------       ----       --------------------

00:14:22:F9:B3:3D      192.168.1.11       69287       dhcp-snooping   10         FastEthernet0/7

Total number of bindings: 1

Switch#

Error Disable

Error-disable can occur from many different ways. Here are various reason that makes interface go to errdisable state.

• Duplex mismatch
• Port channel misconfiguration
• BPDU guard violation
• UniDirectional Link Detection (UDLD) condition
• Late-collision detection
• Link-flap detection
• Security violation
• Port Aggregation Protocol (PAgP) flap
• Layer 2 Tunneling Protocol (L2TP) guard
• DHCP snooping rate-limit
• Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable
• Address Resolution Protocol (ARP) inspection
• Inline power

When the interface goes into error-disable state, the only way to bring it back up after fixing the issue is to "no shutdown" it. However, there is an IOS command which helps network devices automatically enable the port from err-disable. The command is as followings

R1(config)# errdisable recovery cause ?

 all                                   Enable timer to recover from all error causes
  arp-inspection            Enable timer to recover from arp inspection error disable state
  bpduguard                  Enable timer to recover from BPDU Guard error
  channel-misconfig    Enable timer to recover from channel misconfig error
  dhcp-rate-limit            Enable timer to recover from dhcp-rate-limit error
  dtp-flap                         Enable timer to recover from dtp-flap error
  gbic-invalid                  Enable timer to recover from invalid GBIC error
  inline-power               Enable timer to recover from inline-power error
  l2ptguard                     Enable timer to recover from l2protocol-tunnel error
  link-flap                       Enable timer to recover from link-flap error
  loopback                    Enable timer to recover from loopback error
  mac-limit                    Enable timer to recover from mac limit disable state
  pagp-flap                   Enable timer to recover from pagp-flap error
  port-mode-failure     Enable timer to recover from port mode change failure
  psecure-violation     Enable timer to recover from psecure violation error
  security-violation      Enable timer to recover from 802.1x violation error
  sfp-config-mismatch  Enable timer to recover from SFP config mismatch error
  storm-control            Enable timer to recover from storm-control error
  udld                            Enable timer to recover from udld error
  vmps                          Enable timer to recover from vmps shutdown error

Example 

We configure R1 to automatically re-enable the port if the cause of err-disable was from link flap. We can use following command to accomplish this obejctive.

R1(config)#errdisable recovery cause link-flap

When the event occurs we will see that the router automatically enable the port after specific interval ( in this case, it is default )

Show Logging buffered

Feb  5 20:21:38: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Feb  5 20:21:43: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

Feb  5 20:21:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Feb  5 20:21:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

Feb  5 20:22:09: %PM-4-ERR_DISABLE: link-flap error detected on Gi0/1, putting Gi0/1 in err-disable state

Feb  5 20:22:10: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

Feb  5 20:27:09: %PM-4-ERR_RECOVER: Attempting to recover from link-flap err-disable state on Gi0/1

Feb  5 21:41:35: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up

Feb  5 21:41:37: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up