marcosystems.dev

Tag: ccna

  • Road to CCNP: Day 107 (OSPFv2, OSPFv3)

    3.2.b Configure simple OSPFv2/v3 environments, including multiple normal areas, summarization, and filtering (neighbor adjacency, point-to-point, and broadcast network types, and passive-interface)

    OSPF sends neighbor routers a Link-state advertisement (LSA). Inside the LSA is the link state and metric. Received LSAs are stored in a local database called the LSDB, and a router that receives an LSA floods it out through other links, just as it was received. This process continues until all routers have the same LSDB and picture of the entire network. Then, each router runs Dijkstra’s algorithm (shortest path first/SPF) with itself as the top of the tree.

    This gives the illusion to the router that there is no redundancy. But if a link goes down, the SPF will be recalculated, with the redundancy now in effect.

    Scalability = multiple areas are allowed.

    Should not exceed 50 routers per area. Must have area 0, or a backbone. All non-backbone areas must have an area border router (ABR) with the backbone. Non-backbone ABRs advertise/inject routes into the backbone, which backbone routers flood amongst themselves until they have the same LSDB, and then backbone ABRs then inject non-backbone routes into other non-backbone areas.

    Don’t Interrupt 2 Engineers Exchanging Large Files

    The DR/BDR process distributes LSAs in the following manner, assuming that all OSPF routers (DR, BDR, and DROTHER

    1. As an OSPF router learns of a new route, it sends the updated LSA to the AllDRouters (224.0.0.6) address, which only the DR and BDR accept and process
    2. The DR sends a unicast acknowledgment to the router that sent the initial LSA update
    3. The DR floods the LSA to all the routers on the segment via the AllSPFRouters

    OSPFv3 configuration

    1. First enable IPv6 unicast routing as OSPFv3 messages communicate over IPv6 links
      1. Command ipv6 unicast-routing
      1. Router ospfv3 [process-id]
    2. Define the router ID.
      1. If the router is IPv6 only, then a router-id must be manually assigned. In addition, if the router has no interfaces with IPv4 addresses, a router-id cannot be automatically assigned
      1. Use a manually configured router-id if one exists.
      1. Otherwise, choose the highest IPv4 address on a loopback interface.
      1. If there is no loopback, choose the highest IPv4 address on an active non-loopback interface.
      1. If there are no IPv4 addresses at all, OSPFv3 cannot dynamically pick a RID and effectively has 0.0.0.0; adjacencies won’t form.
      1. Command router-id [router-id]
    3. Enable OSPFv3 on an interface
      1. Command ospfv3 [process-id] ipv6 area [area #]
    4. OSPFv3 does not use the network statement for initializing interfaces.

    Passive interfaces

    • Command passive-interface [interface-id]
    • Passive-interface default
      • Enable per interface with no passive-interface [interface]

    Show commands

    show ip ospfOSPF process, RID, areas, SPF info, reference bandwidth
    show ip ospf neighborNeighbor adjacencies and states
    show ip ospf neighbor detail Detailed neighbor information
    show ip ospf interface brief  Quick view of OSPF-enabled interfaces
    show ip ospf interface  Full interface OSPF parameters
    show ip ospf interface g0/0          OSPF information for one interface
    show ip ospf databaseContents of the LSDB
    show ip route ospf OSPF routes installed in the routing table
    show ip protocols    Routing protocol configuration/parameters

    Summarization to sum up multiple addresses in one routing table entry

    Area [area-id] range [prefix/prefix-length]

    Network types

    OSPFv3 supports the same network types as v2, Broadcast, point-to-point, loopback

    To configure per interface, ospfv3 network [point-to-point/broadcast]

    IPv4 support in OSPFv3

    1. Ensure the IPv4 interface has an IPv6 address because OSPFv3 communication occurs over IPv6 and the router needs a link-local address to talk to neighbors
    2. Enable OSPFv3 on the IPv4 interface with command ospfv3 [process-id] ipv4 area [area-id]

  • Road to CCNP: Day 102

    %       4.0         Network Assurance

                  

    4.1                  Diagnose network problems using such as debugs, conditional debugs, traceroute, ping,

    SNMP, and syslog

    Ping, traceroute, debug command, make access lists to filter better, undebug all command to remove all, syslog

                  

    4.2       Configure and verify Flexible NetFlow

    Capture statistics on who talked to who, how they did, and how much

    Statistics available per host

    Conf t, ip flow-export version #, flow-export destination [IP]

    Navigate to interface, ip flow egress, ip flow egress

    Show ip flow interface, export, show ip cache flow, ip flow-top-talkers (why the hyphen LOL>??)

    WHO talked to WHO, HOW, and HOW MUCH

                 

      4.3        Configure SPAN/RSPAN/ERSPAN

    Same switch, SPAN = Switched Port Analyzer, connect to and configure the switch to duplicate the traffic to another interface

     Remote different switch, RSPAN = Remote Switched Port Analyzer, remote switch sends traffic back to local switch, same layer 2 domain, basically source and destination ports can be on different switches. Send RSPAN traffic over RSPAN vlan. On source switch, Source is interface, destination is remote vlan [number]. Reverse is true for the destination switch.

    Make sure you hit the “remote-span” command on vlan configuration mode

    Remote different device ERSPAN = Encapsulated Remote Switched Port Analyzer, remote device captures and then encapsulates using GRE back to the local network

    Switch(config)# monitor session [number] source interface [interfaces
    Switch(config)# monitor session [ number] destination interface [interface SPAN device is connected to]
    switch#Show monitor session [number]  

                   4.4       Configure and verify IPSLA

    Service provider SLA tracking only provides SLA information within their network. You can use Cisco IPSLA to measure end-to-end SLA. Works as a constant steady stream of ICMP pings (or HTTP messages, if configured that way), measuring specific stats

    • Delay (round trip and one way)
    • Jitter (per direction)
    • Packet loss (per direction)
    • Packet sequencing (fragmented packets arriving in order?)
    • Path
    • Connectivity (per direction)
    • website download time
    • voice quality scores

    5.4       Describe the components of network security design

                                  5.4.a     Threat defense

                                  5.4.b    Endpoint security

                                  5.4.c     Next-generation firewall

                                  5.4.d    TrustSec and MACsec

    Trustsec= apply rules by security group – devices and users are joined to groups, and these groups are used to make policies (eg guest cannot connect to anything NOT guest)

    MACsec aka 802.1AE = layer 2 traffic is only encrypted as it travels, and not in the switch. This allows inspection of the payload itself inside the switch

    Downlink MACsec = encryption of layer 2 traffic between an endpoint and a switch (requires both devices to be MACsec capable. Devices can be configured with ISE or manually per port

    Uplink MACsec = encryption of layer 2 traffic between switches