Nat Extendable option

From http://www.cisco.com/en/US/technologies/tk648/tk361/tk438/technologies_white_paper09186a0080091cb9.html


The extendable keyword allows the user to configure several ambiguous static translations, where an ambiguous translations are translations with the same local or global address.


ip nat inside source static <localaddr> <globaladdr> extendable


Example

Telnet and SSH traffic will be redirected to 192.10.112 port 22 and 23 respectively.

192.10.1.0/24  = inside

204.12.1.0/24  = outside

54.1.8.0/24     =  outside

Because we have more than 1 outside interface, it might have some ambiguous translation. Therefore, we need option "extendable" in the NAT commands.

ip nat inside source static tcp 192.10.1.112 22 54.1.8.6 22 extendable 

ip nat inside source static tcp 192.10.1.112 23 54.1.8.6 23 extendable 

ip nat inside source static tcp 192.10.1.112 22 204.12.1.6 22  extendable 

ip nat inside source static tcp 192.10.1.112 23 204.12.1.6 23 extendable 

Parser View

With CLI view, we can restrict which access each network administrator have based on role. Superviews allow a network administrator to easily assign all users within configured CLI views to a superview instead of having to assign multiple CLI views to a group of users. 


Here is the basic configuration of the Parser View.


R2 <----> R3    
192.168.1.1   <---->  192.168.1.2


Task: 

• Allowing telnet access with the username OPERATOR and password CISCO to be able to configure the HTTP feature in the router only.
• Configure Username ADMIN and password CISCO to have access to every feature in the router.

aaa new-model
!
!
aaa authentication login default local
aaa authentication login VTY local
aaa authentication login CON none
aaa authorization exec default local
aaa authorization exec VTY local

username OPERATOR view HTTP password 0 CISCO

username ADMIN privilege 15 password 0 CISCO

parser view HTTP

 secret 5 $1$6ZRJ$CIjM5cdVUvhpinttlR/361

 commands configure include ip http

 commands configure include ip

 commands exec include configure terminal

 commands exec include configure

 commands exec include show running-config

 commands exec include show

Verify configuration

HTTP View

R2#telnet 192.168.1.2

Trying 192.168.1.2 ... Open

User Access Verification

Username: OPERATOR

Password:

R3#show parser view

Current view is 'HTTP'

 

R3(config)#?

Configure commands:

  do    To run exec commands in config mode

  exit  Exit from configure mode

  ip    Global IP configuration subcommands

R3(config)#

Configure commands:

  do    To run exec commands in config mode

  exit  Exit from configure mode

  ip    Global IP configuration subcommands

R3(config)#

---------------------------------------

Change parser view configuration

To be able to change the configuration of the parser view, you need to enter the view root. In this example, to enter the view root, we have to telnet with login as ADMIN and "enable view".

R2#telnet 192.168.1.2

Trying 192.168.1.2 ... Open

User Access Verification

Username: ADMIN

Password:

R3#en view

Password:

R3#

On R3, you will have the syslog message:

*Mar  3 22:24:04.582: %PARSER-6-VIEW_SWITCH: successfully set to view 'root'.

Now, you can change the configuration of the parser view.

R3#

R3#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R3(config)#parser view HTTP ?

  superview  SuperView Commands

  <cr>

R3(config)#parser view HTTP

R3(config-view)#?

View commands:

  commands  Configure commands for a view

  default   Set a command to its defaults

  exit      Exit from view configuration mode

  no        Negate a command or set its defaults

  secret    Set a secret for the current view

BGP Local-AS command

Local-as is useful when we have a change in the AS number of the BGP domain. However, we do not have a change to change the AS number in the bgp process yet. This command will help the neighbor think that it connects to the old AS number.

Followings are the example of the local-as and its option in BGP.
R1 = AS 100
R2 = AS 200
R3 = AS 300
Configure the network to have R1 thinks that R2 is in AS 65001 (Use local-AS)

R1

router bgp 100
 no synchronization
 bgp log-neighbor-changes
 network 1.1.1.0 mask 255.255.255.0
 network 2.2.2.0 mask 255.255.255.0
 network 3.3.3.0 mask 255.255.255.0
 neighbor 192.168.1.2 remote-as 65001
 no auto-summary

Local AS

R2
router bgp 200
 no synchronization
 bgp log-neighbor-changes
 neighbor 192.168.1.1 remote-as 100
 neighbor 192.168.1.1 local-as 65001
 neighbor 192.168.2.2 remote-as 300
 no auto-summary


R3#sh ip bgp
BGP table version is 46, local router ID is 192.168.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.0/24       192.168.2.1                            0 200 65001 100 i
*> 2.2.2.0/24       192.168.2.1                            0 200 65001 100 i
*> 3.3.3.0/24       192.168.2.1                            0 200 65001 100 i

When having a "no prepend", R2 will not prepend local-as to the update forwarding to R3. Therefore, the R3 will see only the real AS from R2 (without the 65001)


Local AS with no prepend
R2

router bgp 200
 no synchronization
 bgp log-neighbor-changes
 neighbor 192.168.1.1 remote-as 100
 neighbor 192.168.1.1 local-as 65001 no-prepend
 neighbor 192.168.2.2 remote-as 300
 no auto-summary

R3#sh ip bgp
BGP table version is 40, local router ID is 192.168.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.0/24       192.168.2.1                            0 200 100 i
*> 2.2.2.0/24       192.168.2.1                            0 200 100 i
*> 3.3.3.0/24       192.168.2.1                            0 200 100 i

With the no prepend and replace-as, (neighbor to R3) R2 will not prepend the local as but instead replace the real AS with the local as value and send an update to R3. Therefore, R3 will see 65001 (local-as value) and 100 (AS at R1)


Local AS with no prepend & replace as


R2
router bgp 200
 no synchronization
 bgp log-neighbor-changes
 neighbor 192.168.1.1 remote-as 100
 neighbor 192.168.1.1 local-as 65001 no-prepend replace-as
 neighbor 192.168.2.2 remote-as 300
 neighbor 192.168.2.2 local-as 65001 no-prepend replace-as
 no auto-summary

R3#sh ip bgp

BGP table version is 28, local router ID is 192.168.2.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*> 1.1.1.0/24       192.168.2.1                            0 65001 100 i

*> 2.2.2.0/24       192.168.2.1                            0 65001 100 i

*> 3.3.3.0/24       192.168.2.1                            0 65001 100 i

Mapping Agent (MAP RP)

The functionality of the mapping agent is the map multicast group to the RP in the Auto-RP process. In order to specify which multicast group going to which RP, we use this following command.

ip pim rp-announce-filter rp-list XXX group-list XXX


We can specify RPs in the rp-list and groups in the group-list.

Example


//Mapping agent 

ip pim send-rp-discovery Loopback0 scope 16
!
ip pim rp-announce-filter rp-list R2_RP group-list R2_GROUPS
ip pim rp-announce-filter rp-list R1_RP group-list R1_GROUPS
!
ip access-list standard R1_GROUPS
 permit 224.0.0.0 0.255.255.255
 permit 226.0.0.0 0.255.255.255
 permit 228.0.0.0 0.255.255.255
 permit 230.0.0.0 0.255.255.255
 permit 232.0.0.0 0.255.255.255
 permit 234.0.0.0 0.255.255.255
 permit 236.0.0.0 0.255.255.255
 permit 238.0.0.0 0.255.255.255
!
ip access-list standard R1_RP
 permit 150.1.1.1
!
ip access-list standard R2_GROUPS
 permit 225.0.0.0 0.255.255.255
 permit 227.0.0.0 0.255.255.255
 permit 229.0.0.0 0.255.255.255
 permit 231.0.0.0 0.255.255.255
 permit 233.0.0.0 0.255.255.255
 permit 235.0.0.0 0.255.255.255
 permit 237.0.0.0 0.255.255.255
 permit 239.0.0.0 0.255.255.255
!
ip access-list standard R2_RP
 permit 150.1.2.2

Multilink PPP

The point of Multilink PPP is to take multiple PPP links and “bond” them together to act as a single PPP link. These PPP links that are being bonded could be an ISDN BRI circuit, T1 circuits, or other types of PPP circuits. Also, with multilink PPP, it can breaks large packets into smaller pieces, and send them other multiple physical links simulataneously.

Configuration example

Multilink PPP over Frame Relay (MLPPPoFR)

Configuration
R1
interface Multilink1
 ip address 192.168.1.1 255.255.255.0
 ppp multilink
 ppp multilink interleave
 ppp multilink group 1
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/0
 no ip address
 encapsulation frame-relay
 clock rate 2000000
 frame-relay map ip 192.168.1.2 102
 frame-relay interface-dlci 102 ppp Virtual-Template1
 no frame-relay inverse-arp
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/1
 no ip address
 encapsulation frame-relay
 clock rate 2000000
 frame-relay map ip 192.168.1.2 102
 frame-relay interface-dlci 102 ppp Virtual-Template1
!
interface Virtual-Template1
 ip address 192.168.1.1 255.255.255.0
 ppp multilink
 ppp multilink interleave
 ppp multilink group 1
!

R2

interface Multilink1
 ip address 192.168.1.2 255.255.255.0
 ppp multilink
 ppp multilink interleave
 ppp multilink group 1
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/0
 no ip address
 encapsulation frame-relay
 clock rate 2000000
 frame-relay map ip 192.168.1.1 201
 frame-relay interface-dlci 201 ppp Virtual-Template1
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/1
 no ip address
 encapsulation frame-relay
 shutdown
 clock rate 2000000
 frame-relay map ip 192.168.1.1 201
 frame-relay interface-dlci 201 ppp Virtual-Template1
!
interface Virtual-Template1
 no ip address
 ppp multilink
 ppp multilink interleave
 ppp multilink group 1

Verify Configuration

Router#show ppp multilink

Multilink1

  Bundle name: Router

  Remote Endpoint Discriminator: [1] Router

  Local Endpoint Discriminator: [1] Router

  Bundle up for 00:10:20, total bandwidth 100000, load 1/255

  Receive buffer limit 12000 bytes, frag timeout 1000 ms

  Interleaving disabled

    0/0 fragments/bytes in reassembly list

    0 lost fragments, 0 reordered

    0/0 discarded fragments/bytes, 0 lost received

    0xF received sequence, 0x16 sent sequence

  Member links: 1 active, 2 inactive (max not set, min not set)

    Vi3, since 00:10:20, 375000 weight, 1496 frag size

    Vi1 (inactive)

    Vt1 (inactive)

No inactive multilink interfaces

Router#

Reference

http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/mlppp_over_fr_ps6441_TSD_Products_Configuration_Guide_Chapter.html#wp1027188

Distribute-list gateway

"distribute-list gateway" is the command that allows us to permit or deny routing update based on source of the updates.

Example Configuration


We have R1, R2 and R3 in the RIP routing domain.  However, we want to receive the routing updates from R3 only. Here is the configuration example to accomplish this.

R2

router rip
 network 2.0.0.0
 network 192.168.1.0
 network 192.168.2.0
 distribute-list gateway R3-ONLY in
 no auto-summary
!
!
ip prefix-list R3-ONLY seq 5 permit 192.168.2.2/32

R2 Routing table

Before putting in the command

R2#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

R    1.0.0.0/8 [120/1] via 192.168.1.1, 00:00:02, FastEthernet0/0

     2.0.0.0/24 is subnetted, 1 subnets

C       2.2.2.0 is directly connected, Loopback0

R    3.0.0.0/8 [120/1] via 192.168.2.2, 00:00:14, FastEthernet0/1

C    192.168.1.0/24 is directly connected, FastEthernet0/0

C    192.168.2.0/24 is directly connected, FastEthernet0/1

R2#

After distribute-list gateway command 

R2#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     2.0.0.0/24 is subnetted, 1 subnets

C       2.2.2.0 is directly connected, Loopback0

R    3.0.0.0/8 [120/1] via 192.168.2.2, 00:00:15, FastEthernet0/1

C    192.168.1.0/24 is directly connected, FastEthernet0/0

C    192.168.2.0/24 is directly connected, FastEthernet0/1

Note: After we put in the command, the network 1.1.1.0/24 disappeared.

Frame-Relay End-to-end Keepalive

Frame-Relay end to end keepalives provides status to verify that end-to-end communications are working and that traffic is getting through.

The Frame-Relay End-to-End keepalive feature can be configured in 4 modes
- biirectional mode 
    -  both the send side and receive side are enable
- request mode
    - only the send side in enabled, and the device sends out and waits for replies to its keepalives requests
- reply mode
    - only the receive side is enabled, and the device waits for and replies to keepalive request.
- passive reply mode
    -  the device only responds to keepalive requests, but does not set any timers or keep track of any events

Example Configuration 


interface Serial1/0
 ip address 192.168.1.1
 encapsulation frame-relay
 shutdown
 serial restart-delay 0
 frame-relay interface-dlci 101
  class END2END_KEEPALIVE
!
map-class frame-relay END2END_KEEPALIVE
 frame-relay end-to-end keepalive mode request
!

Verification
show frame-relay end-to-end keepalive