Changing AD in OSPF

As we all know that, the default administrative distance of the OSPF is 110. However, in some cases, we will need to change this value to something else to manipulate the routing table to avoid routing loop or else. We use this following command to accomplish it.

  distance <AD>  <source address> <Mask> <ACL>

In OSPF, the source address is the router-id of the router advertising the network matched in ACL. Therefore, it  is not necessarily the attached routers. See the configuration example below.

We have 4 routers R1,R2,R3,R4. R1 tries to change the administrative distance of the network advertised from R3 from 110 to 50. R3 has the router-id  of 3.3.3.3. Therefore in R1, we can configure as followings.

Here is the routing table of R1


R1
Gateway of last resort is not set

     20.0.0.0/24 is subnetted, 1 subnets
O E2    20.20.20.0 [110/20] via 192.168.1.2, 00:00:01, FastEthernet0/0
O IA 172.16.0.0/16 [110/21] via 192.168.4.1, 00:00:01, FastEthernet0/1
                   [110/21] via 192.168.1.2, 00:00:01, FastEthernet0/0
C    192.168.4.0/24 is directly connected, FastEthernet0/1
     10.0.0.0/32 is subnetted, 1 subnets
C       10.10.10.10 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, FastEthernet0/0
O    192.168.2.0/24 [110/20] via 192.168.1.2, 00:00:01, FastEthernet0/0
O    192.168.3.0/24 [110/20] via 192.168.4.1, 00:00:01, FastEthernet0/1
     30.0.0.0/32 is subnetted, 1 subnets
O       30.30.30.30 [110/21] via 192.168.4.1, 00:00:01, FastEthernet0/1
                    [110/21] via 192.168.1.2, 00:00:01, FastEthernet0/0

Check the ospf database seen by R1


 Routing Bit Set on this LSA
  LS age: 137
  Options: (No TOS-capability, DC)
  LS Type: Router Links
  Link State ID: 3.3.3.3
  Advertising Router: 3.3.3.3
  LS Seq Number: 80000004
  Checksum: 0x8D28
  Length: 60
  Area Border Router
  Number of Links: 3

    Link connected to: a Stub Network
     (Link ID) Network/subnet number: 30.30.30.30
     (Link Data) Network Mask: 255.255.255.255
      Number of TOS metrics: 0
       TOS 0 Metrics: 1

    Link connected to: a Transit Network
     (Link ID) Designated Router address: 192.168.3.2
     (Link Data) Router Interface address: 192.168.3.1
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

    Link connected to: a Transit Network
     (Link ID) Designated Router address: 192.168.2.1
     (Link Data) Router Interface address: 192.168.2.2
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

We can see that R1 receive the LSA database from R3 ( area 0 - same area ).  We apply the distance command to change the AD of ospf network from R3 as followings.



R1 

router ospf 1
 router-id 1.1.1.1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
 distance 50 3.3.3.3 0.0.0.0 1

access-list 1 permit any


This will change the AD for the network 30.30.30.30/32 to 50.


R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     20.0.0.0/24 is subnetted, 1 subnets
O E2    20.20.20.0 [110/20] via 192.168.1.2, 00:05:10, FastEthernet0/0
O IA 172.16.0.0/16 [50/21] via 192.168.4.1, 00:05:10, FastEthernet0/1
                   [50/21] via 192.168.1.2, 00:05:10, FastEthernet0/0
C    192.168.4.0/24 is directly connected, FastEthernet0/1
     10.0.0.0/32 is subnetted, 1 subnets
C       10.10.10.10 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, FastEthernet0/0
O    192.168.2.0/24 [110/20] via 192.168.1.2, 00:05:10, FastEthernet0/0
O    192.168.3.0/24 [110/20] via 192.168.4.1, 00:05:10, FastEthernet0/1
     30.0.0.0/32 is subnetted, 1 subnets
O       30.30.30.30 [50/21] via 192.168.4.1, 00:05:10, FastEthernet0/1
                    [50/21] via 192.168.1.2, 00:05:10, FastEthernet0/0

Interdomain Multicasting

Example configuration

We have 2 Autonomous System in this scenarios. AS 100 and AS 200 each running OSPF as the IGP routing protocol. The requirement in this example is to configure network to forward the multicast traffic from AS 100 to AS 200. The source of multicast traffic is R3 loopback interface and the receiver is sitting at R4 in the AS 200.

In this scenario, we need to configure Interdomain MSDP. We have selected R1 and R2 as a RPs for each AS. They form the MSDP neighbor together to accomplish this. Here is the configuration.

R1
router bgp 100

 bgp log-neighbor-changes
 neighbor 192.168.1.2 remote-as 200
 !
 address-family ipv4
  redistribute ospf 1
  neighbor 192.168.1.2 activate
  no auto-summary
  no synchronization
  network 1.1.1.0 mask 255.255.255.0
 exit-address-family
 !
 address-family ipv4 multicast
  neighbor 192.168.1.2 activate
  no auto-summary
  no synchronization
 exit-address-family
!
ip forward-protocol nd

ip pim rp-address 1.1.1.1

ip msdp peer 2.2.2.2 connect-source Loopback0 remote-as 200

!

R2

router bgp 200

 bgp log-neighbor-changes

 neighbor 192.168.1.1 remote-as 100

 !

 address-family ipv4

  redistribute ospf 1

  neighbor 192.168.1.1 activate

  no auto-summary

  no synchronization

  network 2.2.2.0 mask 255.255.255.0

 exit-address-family

 !

 address-family ipv4 multicast

  neighbor 192.168.1.1 activate

  no auto-summary

  no synchronization

 exit-address-family

!

ip forward-protocol nd

!

!

no ip http server

no ip http secure-server

ip pim rp-address 2.2.2.2

ip msdp peer 1.1.1.1 connect-source Loopback0 remote-as 100

!

R3

ip pim rp-address 1.1.1.1

R4

ip pim rp-address 2.2.2.2

Verify configuration

R1#sh ip msdp summary

MSDP Peer Status Summary

Peer Address     AS    State    Uptime/  Reset SA    Peer Name

                                Downtime Count Count

2.2.2.2          200   Up       00:06:54 0     0     ?

R1#

R3#ping 239.1.1.1

Type escape sequence to abort.

Sending 1, 100-byte ICMP Echos to 239.1.1.1, timeout is 2 seconds:

Reply to request 0 from 10.1.1.2, 388 ms

R3#

R2#sh ip mroute

IP Multicast Routing Table

Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,

       L - Local, P - Pruned, R - RP-bit set, F - Register flag,

       T - SPT-bit set, J - Join SPT, M - MSDP created entry,

       X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,

       U - URD, I - Received Source Specific Host Report,

       Z - Multicast Tunnel, z - MDT-data group sender,

       Y - Joined MDT-data group, y - Sending to MDT-data group

Outgoing interface flags: H - Hardware switched, A - Assert winner

 Timers: Uptime/Expires

 Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 239.1.1.1), 01:02:18/00:03:19, RP 2.2.2.2, flags: SJC

  Incoming interface: Null, RPF nbr 0.0.0.0

  Outgoing interface list:

    FastEthernet0/1, Forward/Sparse, 01:02:18/00:03:19

(172.16.1.2, 239.1.1.1), 00:00:26/00:02:33, flags: M

  Incoming interface: FastEthernet0/0, RPF nbr 192.168.1.1

  Outgoing interface list:

    FastEthernet0/1, Forward/Sparse, 00:00:26/00:03:19

(*, 224.0.1.40), 01:08:40/00:03:21, RP 2.2.2.2, flags: SJCL

  Incoming interface: Null, RPF nbr 0.0.0.0

  Outgoing interface list:

    FastEthernet0/0, Forward/Sparse, 01:05:16/00:02:25

    FastEthernet0/1, Forward/Sparse, 01:08:40/00:03:21

undefined

Configuring Netflow for multicast traffic

This section was copied from cisco.com

Configuring NetFlow for Multicast IP Traffic

To configure NetFlow for multicast IP traffic, perform this task:

	Command	Purpose
Step 1	Router(config)# ip multicast netflow output-counters	(Optional) Enables the calculation of output bytes/packets for an ingress flow.
Step 2	Router(config)# ip multicast netflow rpf-failure	(Optional) Enables NetFlow for multicast data that fails the RPF check.
Step 3	Router(config)# interface{vlan vlan_ID} | {type slot/port} | {port-channel port_channel_number}	Selects a Layer 3 interface to configure.
Step 4	Router(config-if)# ip flow{ingress | egress}	Enables NetFlow multicast traffic on the specified interface (for RP and PFC). •Specify ingress to enable NetFlow multicast ingress accounting. •Specify egress to enable NetFlow multicast egress accounting.

How to Decrypt Key 7 using IOS

Everyone may experience when we don't remember the password that we put into the configuration. This is a way to decry pt it using the cisco IOS.

Example


You forgot the password for the ntp authentication part
show run | in ntp

ntp authentication-key 1 md5 120D000406060851212E3D 7

Solution
- Create key chain. 



R1(config)#key chain decryptkey
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string 7  120D000406060851212E3D
R1(config-keychain-key)#

R1#sh key chain

Key-chain decryptkey:

    key 1 -- text "testmd5key"

        accept lifetime (always valid) - (always valid) [valid now]

        send lifetime (always valid) - (always valid) [valid now]

Zone-based policy Firewall

Zone based policy firewall is one of the feature of the Cisco router to act as if it is a firewall. The way zone based policy firewall works is that it creates zones for the interfaces. When there is a traffic go across zones, the zone-based policy firewall comes to play.

Here is the guideline how to configure the zone-based policy firewall in the Cisco router.
1. Create Zone security
2. Create Zone pair to pair two zone together. The zone pair will be unidirectional. Therefore, if you need to have bi-directional traffic you can do both ways back and forth or do a traffic inspection in the policy
3  Create Policy map to allow / deny the traffic matching the criteria specified in the class-map

Example


We have R1 - R2 -R3. We will setup a zone-based firewall allowing only host 1.1.1.1 from R1 to ping host 3.3.3.3 on R3. Other traffic is not allowed.

Configuration Example
R2


class-map type inspect match-all ICMP
 match access-group 100
!
!
policy-map type inspect R1_R3_RULE
 class type inspect ICMP
  inspect
   // inspect the out going traffic and permit the return of this traffic back to R1
 class class-default
  drop
   // drop all other traffic.
!
zone security INSIDE
 description R1_SIDE
zone security OUTSIDE
 description R3_SIDE
zone-pair security R1-R3 source INSIDE destination OUTSIDE
 service-policy type inspect R1_R3_RULE
 // Create zone pair which has f0/0 (to R1)  as an inside interface and f0/1 (to R3) as an outside interface.
!

interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 zone-member security INSIDE
   // assign the interface to the zone.
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 zone-member security OUTSIDE
 duplex auto
 speed auto

access-list 100 permit icmp host 1.1.1.1 host 3.3.3.3

access-list 100 permit ospf any any

Verification

Ping with the f0/0 source address ( 192.168.1.1)

R1#ping 3.3.3.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R1#

Ping with the lo0 source address (1.1.1.1)

R1#

R1#

R1#ping 3.3.3.3 source lo0

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

Packet sent with a source address of 1.1.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/40/76 ms

R1#

multicast helper-map

Multicast Helper-map
Broadcast : 255.255.255.255
Multicast  :  224.0.0.0 - 239.255.255.255
Broadcast address / subnet.


http://blog.ine.com/2008/05/06/understanding-the-ip-multicast-helper-map-command/

EIGRP PE-CE

Sample Configuration of the EIGRP VRF
R1  -  R2


PE (R1)
int f0/0
ip vrf forwarding VPNA
ip address 192.168.1.1 255.255.255.0

router eigrp 1
address-family ipv6 unicast vrf VPNA
  network 192.168.1.0 0.0.0.255
  autonomous-system 1
  no auto-summary


CE (R2)
int f0/0
ip address 192.168.1.2 255.255.255.0

router eigrp 1
  network 192.168.1.0 0.0.0.255
  no auto-summary