help me regarding ccnp [7:51179]
hi guys i am ajit from india i am ccna and SCSA .can any one tell me that whats books i should read and from where i can get the free dumps and papers so that i can prepare for the exam please guide me ajit __ Do You Yahoo!? HotJobs - Search Thousands of New Jobs http://www.hotjobs.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51179&t=51179 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cisco Press OSPF? [7:50567]
!6TCP/IP V1!7
""Robert D. Cluett"" P4HkO{O"PBNE
:[EMAIL PROTECTED]
> All,
>
> Looking for a book that will cover OSPF in detail outside of the BSCN
book.
> I recently purchased "Internet Routing Architectures" to give me more
> detailed knowledge of BGP, but need to round out the OSPF with another
book.
> Any advice?
>
> Thanks
> Rob Cluett, CCNA
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=51180&t=50567
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Traffic geneartor for SNMP [7:51172]
you can use "show process" to check the router CPU utilization. For SNMP traffic timeout you need to have a snifer to monitor the source and destination ports and check the network status and what is the problem. Regards, -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Sunday, August 11, 2002 3:16 AM To: [EMAIL PROTECTED] Subject: Traffic geneartor for SNMP [7:51172] Hi, Anybody know any traffic geneartor which is available for testing the snmp traffic. I am having a lab configuration with cisco 7500 router and the network management people are syaing that there are lot of SNMP timeouts. I want to pump in lot of UDP packets on to the network and see whether it's the problem of the network? How can u see the udp problem in Cisco routers? Is there any command to see that? How will you see the CPU utilization of the routers? Is there any command? Any help appreciated. gpj __ Pre-order the NEW Netscape 7.0 browser. Reserve your FREE CD and pay only $2.99 shipping and handling. http://cd.netscape.com/promo_one/ Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/ Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51181&t=51172 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cisco Press OSPF? [7:50567]
OSPF Network Design Solutions
Cisco Press
ISBN1-57870-046-9
Thomas M
Thomas II
""Jason Shen"" wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
> !6TCP/IP V1!7
> ""Robert D. Cluett"" P4HkO{O"PBNE
> :[EMAIL PROTECTED]
> > All,
> >
> > Looking for a book that will cover OSPF in detail outside of the BSCN
> book.
> > I recently purchased "Internet Routing Architectures" to give me more
> > detailed knowledge of BGP, but need to round out the OSPF with another
> book.
> > Any advice?
> >
> > Thanks
> > Rob Cluett, CCNA
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=51182&t=50567
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
Responding to my second questions: "Is this to prevent loops?" Well, there is no loop here because neither R2 nor R0 would have received their local AS in the AS_PATH! Pierre-Alex Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51183&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
Everything I have read seems to indicate that R0 and R2 should have received 2 paths to the 172.16.0.0 network. I did a "clear ip bgp *" on R0. And I got the expected result: Network Next HopMetric LocPrf Weight Path * 172.16.0.0 10.10.4.1 0 103 102 101 i *> 10.10.5.10 0 101 i Then I cleared R2. R2 did not get the extra route. Here is R2 Network Next HopMetric LocPrf Weight Path *> 172.16.0.0 10.10.1.20 0 101 i Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51184&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Pix logging to a Freebsd syslog server [7:51124]
I got it working here is what I had to do and it was the syslog config on the freebsd box. 1. Put in /etc/syslog.conf +gate.bpsnetworks.com (or whatever hostname) *.* /var/log/bernie-rtr.log 2. Start syslog with: syslogd -a "gate.bpsnetworks.com:*" ( (your hostname goes there) -Original Message- From: Gaz [mailto:[EMAIL PROTECTED]] Sent: Saturday, August 10, 2002 2:02 PM To: [EMAIL PROTECTED] Subject: Re: Pix logging to a Freebsd syslog server [7:51124] Is it really the source port? Normally the destination port is UDP 514. Does it care what the source port is? Gaz ""HORVATH TAMAS"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Helo! > > To Neal Rauhauser : If you don't specify source port, the PIX (OS 6.x) will > send syslog messages from UDP port 514!! You can change this to whatever > from range 1025-65535 : for example: logging host inside 192.168.11.4 udp/1025 > > So I think this is not a problem, if the FreeBSD syslogd expects the packets > to be sourced from UDP port 514. > > > To Elijah Savage: Did you checked the connections among syslog host and PIX > inside interface, and IP adressess and mask? If they will correct then the > problem will be in the FreeBSD syslogd config, because your PIX config is > good. > > BIe, HT! > > -Original Message- > From: Neal Rauhauser [mailto:[EMAIL PROTECTED]] > Sent: Saturday, August 10, 2002 11:38 AM > To: [EMAIL PROTECTED] > Subject: Re: Pix logging to a Freebsd syslog server [7:51124] > > > The Cisco logging facility on a router uses a random high port as the > source for the syslog packets. I assume the PIX is the same since you're > having trouble. The FreeBSD syslogd expects the packets to be sourced > from port 514. You can try the flag that supposedly allows syslogd to > take random source ports, but it doesn't work :-( > > I'd strongly suggest you do what I did - just modify the syslogd > source so it doesn't check source port, compile it, then install. > > If that is beyond your C programming skills drop me a note and I can > email you the bungholed syslogd.c file and you can take it from there. > > > > Elijah Savage III wrote: > > > > Can anyone help me out with a PIX logging to a Freebsd syslog server. I > > thought I was sure about setting this up but I am not getting any > > messages on the server, see my configs below. > > > > logging on > > > > logging timestamp > > > > logging trap debugging > > > > logging facility 23 > > > > logging host inside 192.168.11.4 > > > > FreeBSD > > > > local7.debug/var/log/cisco.all > > > > I also startes syslogd with these parameters > > > > 29612 ?? Ss 0:00.03 syslogd -a 192.168.11.2/255.255.255.0 > -- > Neal Rauhauser CCNP, CCDP voice: 402-301-9555 > mailto:[EMAIL PROTECTED] fcc : k0bsd > "This is my private email devoted to various mailing lists. If you're > a twerp with an attorney and someone else's money, don't bother my > employer about the things I say, just come see me personally and we'll > discuss the situation. No names, you twerps should know who you are". Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51157&t=51124 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Cisco PIX 3DES [7:51144]
I think list price is about #60 sterling so I would imagine that's about 100 US dollars (list price) Gaz ""Elijah Savage III"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Does anyone know what the price is for ordering the 3DES software for > the pix 501. Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51155&t=51144 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
When I cleared R2, not only did I NOT get the extra path but I lost the second path on R0. Here is R0 (after clearing R2) Network Next HopMetric LocPrf Weight Path *> 172.16.0.0 10.10.5.10 0 101 Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51185&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
Still thinking aloud: it seems that the problem is located at R3. When I do a "show bgp summary" on R2 it apppears that it did not receive any prefix from R3 NeighborVAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.10.1.2 4 10112771269200 00:04:321 10.10.2.2 4 10312661277200 00:01:330 Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51186&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Assitance Required: Gatekeeper Accounting/Logging [7:51187]
Hi group, I am setting up a gatekeeper with a couple of gateways. I have installed a RADIUS server enabled gatekeeper accounting. The problem is that in the log file there is only the gatekeepes's IP address and the H323-ID of the gateways logged: NASIPADDRESS: a.b.c.d ---> IP address of the GK UserName: Alpha---> H323 ID of the Gateway CallingStationId: Aplha---> H323 ID of the Gateway CalledStationId: 12#123456789 > Dialed Number ***(Alpha has originated a call) I was wondering how I could setup the gatekeeper so that the IP address of the GATEWAYS would be logged as well. Any input would be appreciated. Hamid Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51187&t=51187 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
On my previous post I said that the problem was on R3. It could also have been on R2, if R2 rejected the update I used a debug on R2 to locate the problem. R3 did send the update but R2 rejected it. Please note the keyword "withdrawn" at the end of the output below: R2# 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.1.2 Down User reset 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.2.2 Down User reset 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.1.2 Up 1d11h: BGP(0): 10.10.1.2 computing updates, afi 0, neighbor version 0, table version 1, starting at 0.0.0.0 1d11h: BGP(0): 10.10.1.2 update run completed, afi 0, ran for 0ms, neighbor version 0 , start version 1, throttled to 1 1d11h: BGP(0): 10.10.1.2 rcvd UPDATE w/ attr: nexthop 10.10.1.2, origin i, metric 0, path 101 1d11h: BGP(0): 10.10.1.2 rcvd 172.16.0.0/16 1d11h: BGP(0): Revise route installing 172.16.0.0/16 -> 10.10.1.2 to main IP table 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.2.2 Up 1d11h: BGP(0): 10.10.2.2 computing updates, afi 0, neighbor version 0, table version 2, starting at 0.0.0.0 1d11h: BGP(0): 10.10.2.2 send UPDATE (format) 172.16.0.0/16, next 10.10.2.1, metric 0 , path 101 1d11h: BGP(0): 10.10.2.2 1 updates enqueued (average=46, maximum=46) 1d11h: BGP(0): 10.10.2.2 update run completed, afi 0, ran for 12ms, neighbor version 0, start version 2, throttled to 2 1d11h: BGP(0): 10.10.2.2 rcvd UPDATE w/ attr: nexthop 10.10.2.2, origin i, path 103 1 00 101 1d11h: BGP(0): 10.10.2.2 rcvd 172.16.0.0/16 1d11h: BGP(0): 10.10.1.2 computing updates, afi 0, neighbor version 1, table version 2, starting at 0.0.0.0 1d11h: BGP(0): 10.10.1.2 update run completed, afi 0, ran for 0ms, neighbor version 1 , start version 2, throttled to 2 1d11h: BGP(0): 10.10.2.2 rcv UPDATE about 172.16.0.0/16 -- withdrawn Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51188&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
More supsense R3 sent an update but the message was that 172.16.0.0/16 is unreacheable. That should explain why R2 did not accept the update! R3# 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.2.1 Down User reset 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.3.1 Down User reset 1d12h: %BGP-5-ADJCHANGE: neighbor 10.10.2.2 Down Peer closed the session 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.3.1 Up 1d11h: BGP(0): 10.10.3.1 computing updates, afi 0, neighbor version 0, table version 1, starting at 0.0.0.0 1d11h: BGP(0): 10.10.3.1 update run completed, afi 0, ran for 0ms, neighbor version 0 , start version 1, throttled to 1 1d11h: BGP(0): 10.10.3.1 rcvd UPDATE w/ attr: nexthop 10.10.4.2, origin i, localpref 50, path 100 101 1d11h: BGP(0): 10.10.3.1 rcvd 172.16.0.0/16 1d11h: BGP(0): Revise route installing 172.16.0.0/16 -> 10.10.4.2 to main IP table 1d11h: BGP(0): 10.10.3.1 computing updates, afi 0, neighbor version 1, table version 2, starting at 0.0.0.0 1d11h: BGP(0): 10.10.3.1 update run completed, afi 0, ran for 0ms, neighbor version 1 , start version 2, throttled to 2 1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.2.1 Up 1d12h: %BGP-5-ADJCHANGE: neighbor 10.10.2.2 Up 1d11h: BGP(0): 10.10.2.1 computing updates, afi 0, neighbor version 0, table version 2, starting at 0.0.0.0 1d11h: BGP(0): 10.10.2.1 send UPDATE (format) 172.16.0.0/16, next 10.10.2.2, metric 0 , path 100 101 1d11h: BGP(0): 10.10.2.1 1 updates enqueued (average=48, maximum=48) 1d11h: BGP(0): 10.10.2.1 update run completed, afi 0, ran for 12ms, neighbor version 0, start version 2, throttled to 2 1d11h: BGP(0): 10.10.2.1 rcvd UPDATE w/ attr: nexthop 10.10.2.1, origin i, path 102 1 01 1d11h: BGP(0): 10.10.2.1 rcvd 172.16.0.0/16 1d11h: BGP(0): Revise route installing 172.16.0.0/16 -> 10.10.2.1 to main IP table 1d11h: BGP(0): 10.10.3.1 computing updates, afi 0, neighbor version 2, table version 3, starting at 0.0.0.0 1d11h: BGP(0): 10.10.3.1 NEXT_HOP part 1 net 172.16.0.0/16, next 10.10.2.1 1d11h: BGP(0): 10.10.3.1 send UPDATE (format) 172.16.0.0/16, next 10.10.2.1, metric 0 , path 102 101 1d11h: BGP(0): 10.10.3.1 1 updates enqueued (average=53, maximum=53) 1d11h: BGP(0): 10.10.3.1 update run completed, afi 0, ran for 16ms, neighbor version 2, start version 3, throttled to 3 1d11h: BGP(0): 10.10.2.1 computing updates, afi 0, neighbor version 2, table version 3, starting at 0.0.0.0 1d11h: BGP(0): 10.10.2.1 send unreachable 172.16.0.0/16 1d11h: BGP(0): 10.10.2.1 send UPDATE 172.16.0.0/16 -- unreachable 1d11h: BGP(0): 10.10.2.1 1 updates enqueued (average=26, maximum=26) 1d11h: BGP(0): 10.10.2.1 update run completed, afi 0, ran for 8ms, neighbor version 2 , start version 3, throttled to 3 [Resuming connection 1 to r4 ... ] On my next post, I will attempt to explain why the network was unreacheable! Any one wants to guess? Gheese, am I playing alone? :) Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51189&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
Stuck! Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51190&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Traffic geneartor for SNMP [7:51172]
command is router#sh processes cpu CPU utilization for five seconds: 2%/1%; one minute: 1%; five minutes: 1% PID Runtime(ms) Invoked uSecs5Sec 1Min 5Min TTY Process 1 19292 5630047 3 0.00% 0.00% 0.00% 0 Load Meter router#sh processes memory Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51191&t=51172 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
break via reverse telnet [7:51192]
How do I send a break via reverse telnet? I've never figured this one out and I've got a situation now were this would be really handy to do. -- Neal Rauhauser CCNP, CCDP voice: 402-301-9555 mailto:[EMAIL PROTECTED] fcc : k0bsd Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51192&t=51192 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
* Routing/Subnetting question [7:51193]
I have a 1750 with a /29 assigned to me, and I need to create a DMZ to put a DNS server on so that I can control access using CBAC. My FastEthernet interface is trunked to a Cat 2924. I'd like to have the /29 on one subinterface which talks to PacBell's router, and take a /30 out of the /29 and put it on another subinterface so that I can hang the DNS server off a port on that VLAN using a public IP address. I'd also like to use static NAT addresses out of the /29 including what would be an all zero or all one address out of the /30. My thought is that this would work since the NAT will take place via the subinterface on the /29 (ip nat outside), and the only time the /30 will come into play is with traffic destined to the DNS server, which is not NAT'ed. This would allow me to have routing and CBAC protection for the host on the /30 net and not lose the ability to use those addresses which would normally be lost from the /30 all zeros and all ones addresses by using them for static NAT entries for hosts on the private IP side of my network. When I go to assign an address out of the /30 to the subinterface facing the DMZ I get a message stating that the addresses overlap the other interface. Will this still work the way I believe it will? Would it make a difference if I use my currently shut down Eth0/0 interface instead of the trunked Fa0/0? Thanks for your time/help! -- James D. Wilson, CCDA, MCP Sr. Network/Security Engineer "non sunt multiplicanda entia praeter necessitatem" William of Ockham (1285-1347/49) [GroupStudy.com removed an attachment of type application/x-pkcs7-signature which had a name of smime.p7s] Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51193&t=51193 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: break via reverse telnet [7:51192]
CTRL+SHFT+6+xif you want to make the break character diff for each session you need to add the ASCII ESC-character to the vty of the router you want to exit from. HTH's Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51194&t=51192 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
2509 and AGS+ For sale [7:51195]
For Sale: Cisco 2509 16/16, no octal cables. $500.00 plus shipping. Cisco AGS+ Perfect for your home lab! CSC/4 with 16 meg of dram 4 meg of flash 1 cBus controller Environmental Controller 12 Ethernet/IEEE 802.3 interfaces 4 Token Ring/IEEE 802.5 interfaces 1 FDDI network interface running 11.0 IOS $150.00 plus shipping I also have assorted other things (networking gear, Sparcs, etc) I'm getting rid of at http://www.jpj.net/~benh/stuff.txt Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51195&t=51195 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Fwd: Re: BGP loop [7:51169]
> >Hey Pierre, > >In this case, AS103 breaks the loop. Keep in mind that in BGP you are >only allowed to advertise your best path for a particular NLRI. In the >case of R3, it learns 172.16 via EBGP from 102, and IBGP from R4. It >prefers the EBGP route due to E vs I preference and only advertises that >outbound which as 102 ignores to due path loop. (in cisco's case, a semi >proprietary split horizon behavior likely stifles the re advertisement but >that point is immaterial wrt this issue). R4 does the same thing, >preferring the AS100 advertisement. Hence, R2 never sees the 172.16 from >R0 and vice versa. When you initially trigger updates, timing issues may >allow a route to flow through such that R3 likes R4's 172.16 prior to >learning R2's 172.16 which results in it initially advertising the route, >and subsequently withdrawing it. > >Hope that helps. > >Pete > > > >At 10:26 PM 8/10/2002 +, you wrote: >>This is the network: >> >>AS101(R1) --- AS102 (R2) --- AS103 (R3)--- (R4)-AS100(R0) to AS101 >>(R1) >> >>(R3 and R4 are IBGP neighbors) >> >>I have route 172.16.0.0 on AS101 (R1) that is advertised via BGP. >>When i do a "show ip bgp", the only routers that have two paths to >>172.16.0.0 are R3 and R4. R0 and and R2 only have on path >> >>Given that I have a loop, I would have expected R0 to also have a path to >>172.16.0.0 via As103 and R2 to also have a path to 172.16.0.0 via AS103. >> >>Do I have a configuration problem or is this the default behavior of BGP >>that it won't accept another path if it already has the information from a >>directly connected neighbor? Is this to prevent loops? Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51196&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: BGP loop [7:51169]
What you are seeing here is R3 liking the IBGP learned R4 route prior to seeing the R2 learned EBGP version. When it sees the EBGP version, it prefers it and must let R2 know of this change. It could do this by sending an update with the same NLRI and different attributes which would be an implicit withdrawal, or it could explicitly send a withdrawal for the NLRI. Because it learned the better route from R2 and Cisco has a split horizon like rule wrt to re advertising prefixes, the best bet is to send the explicit withdrawal which is what you see it do near the end. It At 02:31 PM 8/11/2002 +, Pierre-Alex Guanel wrote: >More supsense > >R3 sent an update but the message was that 172.16.0.0/16 is unreacheable. >That should explain why R2 did not accept the update! > > >R3# >1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.2.1 Down User reset >1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.3.1 Down User reset >1d12h: %BGP-5-ADJCHANGE: neighbor 10.10.2.2 Down Peer closed the session >1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.3.1 Up >1d11h: BGP(0): 10.10.3.1 computing updates, afi 0, neighbor version 0, table >version >1, starting at 0.0.0.0 >1d11h: BGP(0): 10.10.3.1 update run completed, afi 0, ran for 0ms, neighbor >version 0 >, start version 1, throttled to 1 >1d11h: BGP(0): 10.10.3.1 rcvd UPDATE w/ attr: nexthop 10.10.4.2, origin i, >localpref >50, path 100 101 >1d11h: BGP(0): 10.10.3.1 rcvd 172.16.0.0/16 >1d11h: BGP(0): Revise route installing 172.16.0.0/16 -> 10.10.4.2 to main IP >table >1d11h: BGP(0): 10.10.3.1 computing updates, afi 0, neighbor version 1, table >version >2, starting at 0.0.0.0 >1d11h: BGP(0): 10.10.3.1 update run completed, afi 0, ran for 0ms, neighbor >version 1 >, start version 2, throttled to 2 >1d11h: %BGP-5-ADJCHANGE: neighbor 10.10.2.1 Up >1d12h: %BGP-5-ADJCHANGE: neighbor 10.10.2.2 Up >1d11h: BGP(0): 10.10.2.1 computing updates, afi 0, neighbor version 0, table >version >2, starting at 0.0.0.0 >1d11h: BGP(0): 10.10.2.1 send UPDATE (format) 172.16.0.0/16, next 10.10.2.2, >metric 0 >, path 100 101 >1d11h: BGP(0): 10.10.2.1 1 updates enqueued (average=48, maximum=48) >1d11h: BGP(0): 10.10.2.1 update run completed, afi 0, ran for 12ms, neighbor >version >0, start version 2, throttled to 2 >1d11h: BGP(0): 10.10.2.1 rcvd UPDATE w/ attr: nexthop 10.10.2.1, origin i, >path 102 1 >01 >1d11h: BGP(0): 10.10.2.1 rcvd 172.16.0.0/16 >1d11h: BGP(0): Revise route installing 172.16.0.0/16 -> 10.10.2.1 to main IP >table >1d11h: BGP(0): 10.10.3.1 computing updates, afi 0, neighbor version 2, table >version >3, starting at 0.0.0.0 >1d11h: BGP(0): 10.10.3.1 NEXT_HOP part 1 net 172.16.0.0/16, next 10.10.2.1 >1d11h: BGP(0): 10.10.3.1 send UPDATE (format) 172.16.0.0/16, next 10.10.2.1, >metric 0 >, path 102 101 >1d11h: BGP(0): 10.10.3.1 1 updates enqueued (average=53, maximum=53) >1d11h: BGP(0): 10.10.3.1 update run completed, afi 0, ran for 16ms, neighbor >version >2, start version 3, throttled to 3 >1d11h: BGP(0): 10.10.2.1 computing updates, afi 0, neighbor version 2, table >version >3, starting at 0.0.0.0 >1d11h: BGP(0): 10.10.2.1 send unreachable 172.16.0.0/16 >1d11h: BGP(0): 10.10.2.1 send UPDATE 172.16.0.0/16 -- unreachable >1d11h: BGP(0): 10.10.2.1 1 updates enqueued (average=26, maximum=26) >1d11h: BGP(0): 10.10.2.1 update run completed, afi 0, ran for 8ms, neighbor >version 2 >, start version 3, throttled to 3 >[Resuming connection 1 to r4 ... ] > >On my next post, I will attempt to explain why the network was unreacheable! >Any one wants to guess? Gheese, am I playing alone? :) Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51197&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: IOS Firewall IDS Document?? [7:51143]
You can find it under Cisco Security Configuration Guide name. ""Fanglo MA"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Hi, > > Any knows where to locate IOS Firewall IDS Document (Configuration Guide)? > I search on CISCO and cannot find it. Only 12.1 version exist. > > TIA, > Fanglo Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51198&t=51143 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
every sub-area is same area number: was Re: two ABRs for a [7:51199]
Ran across some text in Doyle's V1 that confirms JMcL's comment below (page 462, Partioned Areas section). So, the next question for the group is the following: OSPF doesn't track the area information once the routing information gets injected into the backbone. Suppose you have a network with N different physical locations and each will be configured as sub-area. Each sub-area connects to the backbone via it's own ABR. Is there any reason to use different area numbers in this situation? >From an Ops perspective (say where you have tools to go out and touch the configs on the ABR and sub-area routers), using the same area number will simplify the configs and tool logic. So, is there some benefit to actually use different sub-area IDs? Thanks > bergenpeak wrote: > > > > Suppose I have two ABRs that are supporting the same sub-area. > > The ABRs are not directly connected, but can reach each other > > through links inside the sub-area. > > > > Suppose a link fails causing the two ABRs to not have > > connectivity > > through the sub-area. The sub-area is therefore partitioned. > > > > Suppose the ABRs are not doing route summarization. > > > > Will this cause a problem from the backbone perspective? > > > > Will this cause a problem for traffic which needs to flow from > > one side of the sub-area to the other part of the sub-area? > > > > Thanks > > > > > > I don't believe it will cause any problems. I'm not going to look it up > right now, but I'm sure I've researched this one before. As long as there > is no summarisation (or no overlapping summarisation), the two partitions > are simply treated as two sub-areas. > > JMcL Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51199&t=51199 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: * Routing/Subnetting question [7:51193]
James, See Inline.. - Original Message - From: "James Wilson" To: Sent: Sunday, August 11, 2002 12:34 PM Subject: * Routing/Subnetting question [7:51193] > I have a 1750 with a /29 assigned to me, and I need to create a DMZ to put > a DNS server on so that I can control access using CBAC. My FastEthernet > interface is trunked to a Cat 2924. I'd like to have the /29 on one > subinterface which talks to PacBell's router, and take a /30 out of the > /29 and put it on another subinterface so that I can hang the DNS server > off a port on that VLAN using a public IP address. NT: Why would you vlan traffic from you ISP instead of using the extra interface(eth0/0) You must consider a number of things when using your existing design. Firstly, the interface you're referring to as a FE interface is shown in the cisco catalog as a 10/100 ethernet interface. Secondly, please note that based on your current traffic utilization what kind of performance could be achieved/expected on the physical interface(the subs are technically part of the same physical NIC/transiciever). On the area of addressing you might want to take a look at the following links which could answer some of your questions as they apply to addressing(VLSM in particular). http://www.3com.com/other/pdfs/infra/corpinfo/en_US/501302.pdf (watch the wrap) http://www.ietf.org/rfc/rfc3021.txt?number=3021 >I'd also like to use > static NAT addresses out of the /29 including what would be an all zero or > all one address out of the /30. My thought is that this would work since > the NAT will take place via the subinterface on the /29 (ip nat outside), > and the only time the /30 will come into play is with traffic destined to > the DNS server, which is not NAT'ed. This would allow me to have routing > and CBAC protection for the host on the /30 net and not lose the ability > to use those addresses which would normally be lost from the /30 all zeros > and all ones addresses by using them for static NAT entries for hosts on > the private IP side of my network. When I go to assign an address out of > the /30 to the subinterface facing the DMZ I get a message stating that > the addresses overlap the other interface. Will this still work the way I > believe it will? Would it make a difference if I use my currently shut > down Eth0/0 interface instead of the trunked Fa0/0? IMHO, based on what you're trying to accomplish here's my recomendations... 1. Depending on the type of connection you make to your provider(10MB or 100MB) I would configure the port(and that port only) for connectivity to my provider. I'm not sure if you currently have a requirment to be connected to your provider at 100MB, but if you did, I would suggest you look into purshasing another device like the 2620/21 or 265x model. 2. I would again recomend that you follow the links I listed above. Also, please note most of your presumptions are incorrect. What you observed in the message "overlap the other interface" is correct. With a /29 of any address block you only have 2 bits to be used as subnet bits. Furthermore, if you were to use a /30 mask on the interface then the all 1s and all 0s are unusable using NAT or not. The emphasis here is that although the router's NAT configuration might(haven't comfirmed this) allow you to create the static mapping, the end host will not allow you to assign the 1s and 0s using the /30 mask. 3. Your options here are as follows.. Request your provider to allow you to make the /29 into /30(or even a /31[1]) on WAN connection. (Assuming you're not using any dynamic routing protocols, this would simply require a static route(for the /29) in the provider' edge device This would then allow you to make more efficient use of the /29 and provide address space to fill you DMZ requirement. So let's say you have the address 172.16.10.0/29, this would then allow the following; 172.16.10.0/30 with the valid IPs being .1, .2, and .3 for broadcast. 172.16.10.4/30 with the valid IPs being .4, .5, and .6 broadcast. Doing this now allows you to configure the ISP connection, and it allows for the use of an additional device on the DMZ apart from the DNS server you noted. Finally, you can now implement NAT (using rfc1918 compliant address) on what you determine to be the inside network connection/interface. Your NAT configurations would have to be configured for overlaping(makes use of port mappings) In this design you will not have a need to manually configure any static NAT mappings for services on the DMZ. As well, you should have no problem using CBAC as you noted to monitor and filter traffic to and from the DMZ. HTH Nigel [1] I'm not sure of how many providers(ISP) currently use or will allow their customers to use the /31 subnet. However, the /30 shouldn't be a problem. > > Thanks for your time/help! > > -- > James D. Wilson, CCDA, MCP > Sr. Network/Security Engineer > "non sunt mu
anyone ever tried to convert a 2502 to a 2501 ? [7:51201]
8/11/2002 2:05pm Sunday Professional's, Like a lot of other people preparing for the CCIE lab I have several 2502's & a Catalyst 3920 Now that token ring is OFF the CCIE R/S lab has anyone devised a way to replace that interface with a 10baseT interface ? Even if it were $100 per router, that would be cool to do . Richard // Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51201&t=51201 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Fwd: Re: BGP loop [7:51169]
Hey Pete, Thanks for the explaination. It does make sense now! There were two things I was not aware of: 1) Routers prefers the EBGP routes due to E vs I preference 2) You are only allowed to advertise your best path for a particular NLRI I went back to my books and tried to find references on the first point. This is what I found: (Doyle, TCP IP vol2 : page 115) 1) Prefer path with the highest administrative weight 2) Prefer path with highest Local_Pref value 3) Prefer path originated locally i.e. from an IGP 4) Prefer path with shortest AS_Path 5) Prefer path with lowerst origin code 6) Prefer path with lowest multi_exit_disc value 7) Prefer EBGP paths over IBGP path 8) Prefer path with shortest path to bgp next_hop 9 install equal-cost routes in the Loc-RIB (maximum-path enabled) 10)prefer path with lowest BGP router ID (maximum-path not enabled) There is no mention of EBGP path versus IBGP. Worse, if I was to go by the rules above I would have to conclude that R4 should have chosen the path via AS102 because of the highest LocPref. (see below) R4>sib BGP table version is 3, local router ID is 192.168.250.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next HopMetric LocPrf Weight Path *> 172.16.0.0 10.10.4.2 0 100 101 i * i 10.10.2.1 100 0 102 101 i There must be a set of rules out there that precede the rules above ... Where did you learn about those? Are they published some place? Thanks, Pierre-Alex Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51202&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Fwd: Re: BGP loop [7:51169]
Hi Pete, Here is the reference for rule 2: You are only allowed to advertise your best path for a particular NLRI Internet Routing Architecture (Second Edition), Sam Halabi page 155 "The best routes, as identified by the decision process, are placed in the Loc-RIB. These routes become candidates that can be advertised to other peers or placed in the IP routing table. If a route is not placed int he Loc-RIB, it cannot be placed in the Adj-RIB-Out for advertisement to peers" Still looking for a reference to Rule 1 Pierre-Alex Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51203&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: anyone ever tried to convert a 2502 to a 2501 ? [7:51201]
nettable_walker, The changes in the lab to remove token ring as "Howard" suggested now makes equipment affordable to just about anyone. The emphasis here being..token or ethernet, they all provide a way to test the theory and your understanding of protocol implementation. With the 3920 and some token ring NICs in you PC.. you should have the full lab complement. Question? why would you want to spend 100$(ea) to make the conversion, anyway! Nigel - Original Message - From: "nettable_walker" To: Sent: Sunday, August 11, 2002 3:03 PM Subject: anyone ever tried to convert a 2502 to a 2501 ? [7:51201] > 8/11/2002 2:05pm Sunday > > Professional's, Like a lot of other people preparing for the CCIE lab I > have several 2502's & a Catalyst 3920 > Now that token ring is OFF the CCIE R/S lab has anyone devised a way to > replace that interface with a 10baseT interface ? > > Even if it were $100 per router, that would be cool to do . > > Richard > > // Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51204&t=51201 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: * Routing/Subnetting question [7:51193]
Nigel, The router itself calls the 100M interface fastethernet0/0, which is why I referred to it as such, and the trunking was because I am running lab configurations with more than two subnets on the private side and I need to be able to route between them as well as filter between them for security. The ISP is PacBell and for enhanced DSL they only give you a /29, and they take one of the addresses for their side of the connection. The reason I am leaving a host with a public address in the DMZ is because it is a DNS server, and there are issues with BIND and Solaris when the DNS server does not use the same IP address and name as that which is listed as authoritive for the domain (i.e. the domain server knows itself as on 10.50.0.65 in /etc/hosts but has the address 216.103.77.99 as its address within its zone.) If I want to protect that host with CBAC, I need to put the router between it and the ISP. Remember that the traffic is coming from the ISP via a DSL MODEM 10 M ethernet connection and not a WAN connection to the router. The addresses which would be valid in the /29 but not in the /30 would only be referenced as static NAT entries which would be translated on the interface with the /29 which is facing the ISP. Once the traffic for that address enters the Fa0/0 it would be translated to an RFC1918 address and sent out to the host on the 10. net, so the host would not know it is being referenced by the public address. I realize that this is not a standard type configuration for this, but PacBell will only give me a /29, and I'm trying to find a way to meet BIND's requirements for the DNS server and have the server protected by CBAC plus have other public IP addresses for static NAT entries for other servers on my net (I've got a number of different servers on my net and want to have public address to different services i.e. web server, mail server, application servers. Thanks! -- James D. Wilson, CCDA, MCP Sr. Network/Security Engineer "non sunt multiplicanda entia praeter necessitatem" William of Ockham (1285-1347/49) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Nigel Taylor Sent: Sunday, August 11, 2002 11:51 AM To: [EMAIL PROTECTED] Subject: Re: * Routing/Subnetting question [7:51193] James, See Inline.. - Original Message - From: "James Wilson" To: Sent: Sunday, August 11, 2002 12:34 PM Subject: * Routing/Subnetting question [7:51193] > I have a 1750 with a /29 assigned to me, and I need to create a DMZ to put > a DNS server on so that I can control access using CBAC. My FastEthernet > interface is trunked to a Cat 2924. I'd like to have the /29 on one > subinterface which talks to PacBell's router, and take a /30 out of the > /29 and put it on another subinterface so that I can hang the DNS server > off a port on that VLAN using a public IP address. NT: Why would you vlan traffic from you ISP instead of using the extra interface(eth0/0) You must consider a number of things when using your existing design. Firstly, the interface you're referring to as a FE interface is shown in the cisco catalog as a 10/100 ethernet interface. Secondly, please note that based on your current traffic utilization what kind of performance could be achieved/expected on the physical interface(the subs are technically part of the same physical NIC/transiciever). On the area of addressing you might want to take a look at the following links which could answer some of your questions as they apply to addressing(VLSM in particular). http://www.3com.com/other/pdfs/infra/corpinfo/en_US/501302.pdf (watch the wrap) http://www.ietf.org/rfc/rfc3021.txt?number=3021 >I'd also like to use > static NAT addresses out of the /29 including what would be an all zero or > all one address out of the /30. My thought is that this would work since > the NAT will take place via the subinterface on the /29 (ip nat outside), > and the only time the /30 will come into play is with traffic destined to > the DNS server, which is not NAT'ed. This would allow me to have routing > and CBAC protection for the host on the /30 net and not lose the ability > to use those addresses which would normally be lost from the /30 all zeros > and all ones addresses by using them for static NAT entries for hosts on > the private IP side of my network. When I go to assign an address out of > the /30 to the subinterface facing the DMZ I get a message stating that > the addresses overlap the other interface. Will this still work the way I > believe it will? Would it make a difference if I use my currently shut > down Eth0/0 interface instead of the trunked Fa0/0? IMHO, based on what you're trying to accomplish here's my recomendations... 1. Depending on the type of connection you make to your provider(10MB or 100MB) I would configure the port(and that port only) for connectivity to my provider. I'm not sure if you currently have a requirment to be connected to your provi
RE: Fwd: Re: BGP loop [7:51169]
Pierre, comments inline At 07:26 PM 8/11/2002 +, Pierre-Alex Guanel wrote: >Hey Pete, > >Thanks for the explaination. It does make sense now! > >There were two things I was not aware of: > >1) Routers prefers the EBGP routes due to E vs I preference >2) You are only allowed to advertise your best path for a particular NLRI > >I went back to my books and tried to find references on the first point. >This is what I found: (Doyle, TCP IP vol2 : page 115) > >1) Prefer path with the highest administrative weight >2) Prefer path with highest Local_Pref value >3) Prefer path originated locally i.e. from an IGP >4) Prefer path with shortest AS_Path >5) Prefer path with lowerst origin code >6) Prefer path with lowest multi_exit_disc value >7) Prefer EBGP paths over IBGP path >8) Prefer path with shortest path to bgp next_hop >9 install equal-cost routes in the Loc-RIB (maximum-path enabled) >10)prefer path with lowest BGP router ID (maximum-path not enabled) > >There is no mention of EBGP path versus IBGP. Worse, if I was to go by the >rules above I would have to conclude that R4 should have chosen the path via >AS102 because of the highest LocPref. (see below) See the below step 7. Always remember much of this is implementation specific (ie this is Cisco's way of doing things) http://www.cisco.com/warp/public/459/25.shtml For the ietf defined performance, see 9.1.1.2 section d of: http://search.ietf.org/internet-drafts/draft-ietf-idr-bgp4-17.txt I believe Cisco supercedes the step 7 above by imposing an AD (internal degree of preference) of 20 on EBGP routes and 200 on IBGP which hard codes hot-potato routing. >R4>sib >BGP table version is 3, local router ID is 192.168.250.4 >Status codes: s suppressed, d damped, h history, * valid, > best, i - >internal >Origin codes: i - IGP, e - EGP, ? - incomplete > >Network Next HopMetric LocPrf Weight Path >*> 172.16.0.0 10.10.4.2 0 100 101 i >* i 10.10.2.1 100 0 102 101 i > >There must be a set of rules out there that precede the rules above ... >Where did you learn about those? Are they published some place? First off, always be wary of secondary source information. Books are a great way to learn about concepts, history, design strategy etc, but are not necessarily accurate in all details. Tech publishers print most anything these days to capitalize on a willing market which often results is less than accurate information circulating about. There are many exceptions of course (and Jeff's above in my opinion is certainly one) but it's always wise to understand that just because it was written and published doesn't mean its credible. For clarification of small details like the above, it is always best to consult the primary reference. With that in mind, I think it's key to stay up to date with both the IETF standard sets (ie drafts/rfc's etc) along with the various vendor implementations of the specs. Often the two differ in many aspects. Furthermore, the IETF endeavors to standardize behaviors and semantics to ensure inter operability, but expressly attempts not to impose limitations or guidelines governing how a particular vendor implements code for a particular application. That is to say, they leave the interpretation of how to best implement a spec to the vendor community which leads to numerous (hopefully) inter operable solutions that may vary greatly in their composition. >Thanks, > >Pierre-Alex Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51206&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: every sub-area is same area number: was Re: two ABRs for a [7:51207]
Having all sub-areas use the same area-id is functionally possible, but imposes some key limitations. First off, you can only have ABRs that terminate 1 sub-area as they have no mechanism for differentiating more than one. If one were to connect multiple, similarly identified yet separate areas to the ABR, you would end up with one area thereby defeating your original goal. This is about the only key limitation I can think of off hand, but is highly restrictive and certainly overcomes any desire to optimize config script tools. pete At 06:12 PM 8/11/2002 +, bergenpeak wrote: >Ran across some text in Doyle's V1 that confirms JMcL's comment >below (page 462, Partioned Areas section). > >So, the next question for the group is the following: > >OSPF doesn't track the area information once the routing information >gets injected into the backbone. Suppose you have a network with N >different physical locations and each will be configured as sub-area. >Each sub-area connects to the backbone via it's own ABR. > >Is there any reason to use different area numbers in this situation? > > >From an Ops perspective (say where you have tools to go out and touch >the configs on the ABR and sub-area routers), using the same area number >will simplify the configs and tool logic. > >So, is there some benefit to actually use different sub-area IDs? > >Thanks > > > > > > > bergenpeak wrote: > > > > > > Suppose I have two ABRs that are supporting the same sub-area. > > > The ABRs are not directly connected, but can reach each other > > > through links inside the sub-area. > > > > > > Suppose a link fails causing the two ABRs to not have > > > connectivity > > > through the sub-area. The sub-area is therefore partitioned. > > > > > > Suppose the ABRs are not doing route summarization. > > > > > > Will this cause a problem from the backbone perspective? > > > > > > Will this cause a problem for traffic which needs to flow from > > > one side of the sub-area to the other part of the sub-area? > > > > > > Thanks > > > > > > > > > > I don't believe it will cause any problems. I'm not going to look it up > > right now, but I'm sure I've researched this one before. As long as there > > is no summarisation (or no overlapping summarisation), the two partitions > > are simply treated as two sub-areas. > > > > JMcL Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51207&t=51207 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: break via reverse telnet [7:51192]
Try Ctrl+Shft+6, then b ""John McCartney"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > CTRL+SHFT+6+xif you want to make the break character diff for each > session you need to add the ASCII ESC-character to the vty of the router you > want to exit from. > > HTH's Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51208&t=51192 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: every sub-area is same area number: was Re: two ABRs for a [7:51209]
nothing bad will happen unless you have overlapping subnets. idle curiousity - in a situation like this, why OSPF as opposed to EIGRP or RIPv2 or ODR, for that matter? ""bergenpeak"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Ran across some text in Doyle's V1 that confirms JMcL's comment > below (page 462, Partioned Areas section). > > So, the next question for the group is the following: > > OSPF doesn't track the area information once the routing information > gets injected into the backbone. Suppose you have a network with N > different physical locations and each will be configured as sub-area. > Each sub-area connects to the backbone via it's own ABR. > > Is there any reason to use different area numbers in this situation? > > From an Ops perspective (say where you have tools to go out and touch > the configs on the ABR and sub-area routers), using the same area number > will simplify the configs and tool logic. > > So, is there some benefit to actually use different sub-area IDs? > > Thanks > > > > > > > bergenpeak wrote: > > > > > > Suppose I have two ABRs that are supporting the same sub-area. > > > The ABRs are not directly connected, but can reach each other > > > through links inside the sub-area. > > > > > > Suppose a link fails causing the two ABRs to not have > > > connectivity > > > through the sub-area. The sub-area is therefore partitioned. > > > > > > Suppose the ABRs are not doing route summarization. > > > > > > Will this cause a problem from the backbone perspective? > > > > > > Will this cause a problem for traffic which needs to flow from > > > one side of the sub-area to the other part of the sub-area? > > > > > > Thanks > > > > > > > > > > I don't believe it will cause any problems. I'm not going to look it up > > right now, but I'm sure I've researched this one before. As long as there > > is no summarisation (or no overlapping summarisation), the two partitions > > are simply treated as two sub-areas. > > > > JMcL Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51209&t=51209 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: every sub-area is same area number: was Re: two ABRs for a [7:51210]
Hi Peter, Thanks for the response. Yes, the assumption is that each ABR terminates a single sub-area. The topology supports this assumption. In a response I was preparing for Chuck's comment, there is one other item I should add-- future service needs might result in the need for TE. I believe the current OSPF specs only supports carrying TE information within an area. Given how OSPF works today, I'd expect that TE would also work, across areas, without the need to carry the actual area ID information. But I'm guessing Thanks Peter van Oene wrote: > > Having all sub-areas use the same area-id is functionally possible, but > imposes some key limitations. First off, you can only have ABRs that > terminate 1 sub-area as they have no mechanism for differentiating more > than one. If one were to connect multiple, similarly identified yet > separate areas to the ABR, you would end up with one area thereby defeating > your original goal. This is about the only key limitation I can think of > off hand, but is highly restrictive and certainly overcomes any desire to > optimize config script tools. > > pete > > At 06:12 PM 8/11/2002 m??, bergenpeak wrote: > >Ran across some text in Doyle's V1 that confirms JMcL's comment > >below (page 462, Partioned Areas section). > > > >So, the next question for the group is the following: > > > >OSPF doesn't track the area information once the routing information > >gets injected into the backbone. Suppose you have a network with N > >different physical locations and each will be configured as sub-area. > >Each sub-area connects to the backbone via it's own ABR. > > > >Is there any reason to use different area numbers in this situation? > > > > >From an Ops perspective (say where you have tools to go out and touch > >the configs on the ABR and sub-area routers), using the same area number > >will simplify the configs and tool logic. > > > >So, is there some benefit to actually use different sub-area IDs? > > > >Thanks > > > > > > > > > > > > > bergenpeak wrote: > > > > > > > > Suppose I have two ABRs that are supporting the same sub-area. > > > > The ABRs are not directly connected, but can reach each other > > > > through links inside the sub-area. > > > > > > > > Suppose a link fails causing the two ABRs to not have > > > > connectivity > > > > through the sub-area. The sub-area is therefore partitioned. > > > > > > > > Suppose the ABRs are not doing route summarization. > > > > > > > > Will this cause a problem from the backbone perspective? > > > > > > > > Will this cause a problem for traffic which needs to flow from > > > > one side of the sub-area to the other part of the sub-area? > > > > > > > > Thanks > > > > > > > > > > > > > > I don't believe it will cause any problems. I'm not going to look it up > > > right now, but I'm sure I've researched this one before. As long as > there > > > is no summarisation (or no overlapping summarisation), the two partitions > > > are simply treated as two sub-areas. > > > > > > JMcL Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51210&t=51210 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: Stange thing [7:50911]
Thank you again. Here is the detail information about RTS=down I have 5 routers, and configured the 2520 as Frame Relay Switch. Four 2501 routers connected to it. All other three serial interfaces's singal of 2520 are DCD=up DSR=up DTR=up RTS=up CTS=up, only serial 1's interface status is DCD=up DSR=up DTR=up RTS=down CTS=up. and I have changed cable and routers to the s1, The RTS still down. But it did and do work well. So I want to know "Is RTS meaningless"? The configuration and show output of 2520's serial 1 R7#sh ru in s1 Building configuration... Current configuration: ! interface Serial1 no ip address no ip directed-broadcast encapsulation frame-relay clockrate 125000 frame-relay lmi-type ansi frame-relay intf-type dce frame-relay route 501 interface Serial0 105 end R7# Serial1 is up, line protocol is up Hardware is HD64570 MTU 1500 bytes, BW 1544 Kbit, DLY 2 usec, rely 255/255, load 1/255 Encapsulation FRAME-RELAY, loopback not set, keepalive set (10 sec) LMI enq sent 0, LMI stat recvd 0, LMI upd recvd 0 LMI enq recvd 105, LMI stat sent 105, LMI upd sent 0, DCE LMI up LMI DLCI 0 LMI type is ANSI Annex D frame relay DCE Broadcast queue 0/64, broadcasts sent/dropped 0/0, interface broadcasts 0 Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters 00:17:24 Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/1/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 148 packets input, 4350 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 168 packets output, 5832 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions DCD=up DSR=up DTR=up RTS=down CTS=up R7# R7# sh fr pvc PVC Statistics for interface Serial0 (Frame Relay DCE) DLCI = 102, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE, INTERFACE = Serial0 input pkts 41output pkts 211 in bytes 2624 out bytes 79455 dropped pkts 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 0 out bcast bytes 0Num Pkts Switched 41 pvc create time 00:51:45, last time pvc status changed 00:51:35 DLCI = 103, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE, INTERFACE = Serial0 input pkts 133 output pkts 102 in bytes 10216 out bytes 7776 dropped pkts 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 0 out bcast bytes 0Num Pkts Switched 133 pvc create time 00:51:48, last time pvc status changed 00:38:08 DLCI = 105, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE, INTERFACE = Serial0 input pkts 135 output pkts 321 in bytes 9172 out bytes 31736 dropped pkts 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 0 out bcast bytes 0Num Pkts Switched 135 pvc create time 00:51:49, last time pvc status changed 00:51:40 PVC Statistics for interface Serial1 (Frame Relay DCE) DLCI = 501, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE, INTERFACE = Serial1 input pkts 322 output pkts 135 in bytes 31848 out bytes 9172 dropped pkts 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 0 out bcast bytes 0Num Pkts Switched 322 pvc create time 00:51:50, last time pvc status changed 00:51:40 >you can see that serial 1 is working, because it switched 322 packets PVC Statistics for interface Serial2 (Frame Relay DCE) DLCI = 201, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE, INTERFACE = Serial2 input pkts 212 output pkts 42 in bytes 79519 out bytes 2688 dropped pkts 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 0 out bcast bytes 0Num Pkts Switched 212 pvc create time 00:51:55, last time pvc status changed 00:51:46 PVC Statistics for interface Serial3 (Frame Relay DCE) DLCI = 301, DLCI USAGE = SWITCHED, PVC STATUS = ACTIVE, INTERFACE = Serial3 input pkts 103 output pkts 134 in bytes 7848 out bytes 10280 dropped pkts 0
RE: help me regarding ccnp [7:51179]
www.cisco.com There is a Training/Certification section, which lists the topics and I think there is recommended training section also for each exam. www.ciscopress.com should be your only source for books with this certifiation, the site is broken down into Certs so knock yourself out. Do some research, I'm sure you can find what you need Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51212&t=51179 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: every sub-area is same area number: was Re: two ABRs for a [7:51213]
I wasn't suggesting that the topology didn't support this setup, I was suggesting that the setup was unwise. With respect to TE, yes, you are correct that inter-area TE isn't available for ISIS or OSPF. However, this has nothing to do with your area-id's, but rather the flooding scope of the type 10 LSA (in the case of OSPF). Furthermore, drafts are in progress to address this limitation, but again, these are ospf area-id agnostic. At 07:39 PM 8/11/2002 -0600, bergenpeak wrote: >Hi Peter, > >Thanks for the response. Yes, the assumption is that each ABR >terminates >a single sub-area. The topology supports this assumption. > >In a response I was preparing for Chuck's comment, there is one other >item I should add-- future service needs might result in the need >for TE. I believe the current OSPF specs only supports carrying TE >information >within an area. Given how OSPF works today, I'd expect that TE would >also work, across areas, without the need to carry the actual area ID >information. But I'm guessing > >Thanks > > > >Peter van Oene wrote: > > > > Having all sub-areas use the same area-id is functionally possible, but > > imposes some key limitations. First off, you can only have ABRs that > > terminate 1 sub-area as they have no mechanism for differentiating more > > than one. If one were to connect multiple, similarly identified yet > > separate areas to the ABR, you would end up with one area thereby defeating > > your original goal. This is about the only key limitation I can think of > > off hand, but is highly restrictive and certainly overcomes any desire to > > optimize config script tools. > > > > pete > > > > At 06:12 PM 8/11/2002 m??, bergenpeak wrote: > > >Ran across some text in Doyle's V1 that confirms JMcL's comment > > >below (page 462, Partioned Areas section). > > > > > >So, the next question for the group is the following: > > > > > >OSPF doesn't track the area information once the routing information > > >gets injected into the backbone. Suppose you have a network with N > > >different physical locations and each will be configured as sub-area. > > >Each sub-area connects to the backbone via it's own ABR. > > > > > >Is there any reason to use different area numbers in this situation? > > > > > > >From an Ops perspective (say where you have tools to go out and touch > > >the configs on the ABR and sub-area routers), using the same area number > > >will simplify the configs and tool logic. > > > > > >So, is there some benefit to actually use different sub-area IDs? > > > > > >Thanks > > > > > > > > > > > > > > > > > > > bergenpeak wrote: > > > > > > > > > > Suppose I have two ABRs that are supporting the same sub-area. > > > > > The ABRs are not directly connected, but can reach each other > > > > > through links inside the sub-area. > > > > > > > > > > Suppose a link fails causing the two ABRs to not have > > > > > connectivity > > > > > through the sub-area. The sub-area is therefore partitioned. > > > > > > > > > > Suppose the ABRs are not doing route summarization. > > > > > > > > > > Will this cause a problem from the backbone perspective? > > > > > > > > > > Will this cause a problem for traffic which needs to flow from > > > > > one side of the sub-area to the other part of the sub-area? > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > > > I don't believe it will cause any problems. I'm not going to look > it up > > > > right now, but I'm sure I've researched this one before. As long as > > there > > > > is no summarisation (or no overlapping summarisation), the two > partitions > > > > are simply treated as two sub-areas. > > > > > > > > JMcL Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51213&t=51213 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: every sub-area is same area number: was Re: two ABRs for a [7:51214]
I wasn't suggesting that the topology didn't support this setup, I was suggesting that the setup was unwise. With respect to TE, yes, you are correct that inter-area TE isn't available for ISIS or OSPF. However, this has nothing to do with your area-id's, but rather the flooding scope of the type 10 LSA (in the case of OSPF). Furthermore, drafts are in progress to address this limitation, but again, these are ospf area-id agnostic. various drafts of note wrt to inter-area TE http://search.ietf.org/internet-drafts/draft-kompella-mpls-multiarea-te-03.txt http://search.ietf.org/internet-drafts/draft-vasseur-mpls-ospf-pcsd-discovery-00.txt http://search.ietf.org/internet-drafts/draft-vasseur-mpls-isis-pcsd-discovery-01.txt At 01:43 AM 8/12/2002 +, you wrote: >Hi Peter, > >Thanks for the response. Yes, the assumption is that each ABR >terminates >a single sub-area. The topology supports this assumption. > >In a response I was preparing for Chuck's comment, there is one other >item I should add-- future service needs might result in the need >for TE. I believe the current OSPF specs only supports carrying TE >information >within an area. Given how OSPF works today, I'd expect that TE would >also work, across areas, without the need to carry the actual area ID >information. But I'm guessing > >Thanks > > > >Peter van Oene wrote: > > > > Having all sub-areas use the same area-id is functionally possible, but > > imposes some key limitations. First off, you can only have ABRs that > > terminate 1 sub-area as they have no mechanism for differentiating more > > than one. If one were to connect multiple, similarly identified yet > > separate areas to the ABR, you would end up with one area thereby defeating > > your original goal. This is about the only key limitation I can think of > > off hand, but is highly restrictive and certainly overcomes any desire to > > optimize config script tools. > > > > pete > > > > At 06:12 PM 8/11/2002 m??, bergenpeak wrote: > > >Ran across some text in Doyle's V1 that confirms JMcL's comment > > >below (page 462, Partioned Areas section). > > > > > >So, the next question for the group is the following: > > > > > >OSPF doesn't track the area information once the routing information > > >gets injected into the backbone. Suppose you have a network with N > > >different physical locations and each will be configured as sub-area. > > >Each sub-area connects to the backbone via it's own ABR. > > > > > >Is there any reason to use different area numbers in this situation? > > > > > > >From an Ops perspective (say where you have tools to go out and touch > > >the configs on the ABR and sub-area routers), using the same area number > > >will simplify the configs and tool logic. > > > > > >So, is there some benefit to actually use different sub-area IDs? > > > > > >Thanks > > > > > > > > > > > > > > > > > > > bergenpeak wrote: > > > > > > > > > > Suppose I have two ABRs that are supporting the same sub-area. > > > > > The ABRs are not directly connected, but can reach each other > > > > > through links inside the sub-area. > > > > > > > > > > Suppose a link fails causing the two ABRs to not have > > > > > connectivity > > > > > through the sub-area. The sub-area is therefore partitioned. > > > > > > > > > > Suppose the ABRs are not doing route summarization. > > > > > > > > > > Will this cause a problem from the backbone perspective? > > > > > > > > > > Will this cause a problem for traffic which needs to flow from > > > > > one side of the sub-area to the other part of the sub-area? > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > > > I don't believe it will cause any problems. I'm not going to look it >up > > > > right now, but I'm sure I've researched this one before. As long as > > there > > > > is no summarisation (or no overlapping summarisation), the two >partitions > > > > are simply treated as two sub-areas. > > > > > > > > JMcL Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51214&t=51214 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Fwd: Re: BGP loop [7:51169]
Thanks Pete!!! I will spend more time reading the rfcs. Pierre-Alex Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51215&t=51169 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: break via reverse telnet [7:51192]
That's correct... If you want to use a different escape character use the command "escape-character" followed by the ASCII number Example: config t line vty 0 4 escape-character 1 where: 1=A 2=B 3=C etc... Pierre-Alex Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51216&t=51192 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Why ATM IP's are not listed in the ARP table of the router [7:51217]
Hi, I have ATM IP for each DSLAMs connected to the network.This goes through an ATM gateway. But, when I look at the ARP table of the router (7500), I can't see the IP/Mac addresses of the DSLAM's.But from the router, I can ping each of the DSLAM's.Even the gateway Address is also not listed in the ARP table. I can see all the Ethernet IP's in the ARP table. Is it possible to use the Etherial Sniffer If I want to see the traffic going from an Ethernet I/F on the router to a particular DSLAM which is having an IP but on the ATM interface? I am sorry, I don't have the config now. any help?? GPJ __ Pre-order the NEW Netscape 7.0 browser. Reserve your FREE CD and pay only $2.99 shipping and handling. http://cd.netscape.com/promo_one/ Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/ Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51217&t=51217 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Reverse Telnet on Cisco [7:51218]
Hi All, I have a scenario like this. one 2509 is acting as the console access server for several routers. each of these router's console is connected to a tty line of 2509, and from 2509 I can access any routers console using reverse telnet. Now my problem is that I want send break command to these reverse telnet accessible console, so that I can break the booting of these routers and force them enter ROMMON. Is it possible to send break via reverse telnet ? If yes how ? Thanks in advance. regards Rajesh Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51218&t=51218 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Pix logging to a Freebsd syslog server [7:51124]
Hello! To GAZ: Yes 514 is both the source and the destination port. See: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/gl.htm#xtocid15 I dont't know why the source port is important, maybe security reason. Best regards, Tamas Horvath network engineer Tel.: +36 22/515-452, Fax: +36 22/327-532 E-Mail: [EMAIL PROTECTED] -Original Message- From: Gaz [mailto:[EMAIL PROTECTED]] Sent: Saturday, August 10, 2002 8:02 PM To: [EMAIL PROTECTED] Subject: Re: Pix logging to a Freebsd syslog server [7:51124] Is it really the source port? Normally the destination port is UDP 514. Does it care what the source port is? Gaz ""HORVATH TAMAS"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Helo! > > To Neal Rauhauser : If you don't specify source port, the PIX (OS 6.x) will > send syslog messages from UDP port 514!! You can change this to whatever > from range 1025-65535 : for example: logging host inside 192.168.11.4 udp/1025 > > So I think this is not a problem, if the FreeBSD syslogd expects the packets > to be sourced from UDP port 514. > > > To Elijah Savage: Did you checked the connections among syslog host and PIX > inside interface, and IP adressess and mask? If they will correct then the > problem will be in the FreeBSD syslogd config, because your PIX config is > good. > > BIe, HT! > > -Original Message- > From: Neal Rauhauser [mailto:[EMAIL PROTECTED]] > Sent: Saturday, August 10, 2002 11:38 AM > To: [EMAIL PROTECTED] > Subject: Re: Pix logging to a Freebsd syslog server [7:51124] > > > The Cisco logging facility on a router uses a random high port as the > source for the syslog packets. I assume the PIX is the same since you're > having trouble. The FreeBSD syslogd expects the packets to be sourced > from port 514. You can try the flag that supposedly allows syslogd to > take random source ports, but it doesn't work :-( > > I'd strongly suggest you do what I did - just modify the syslogd > source so it doesn't check source port, compile it, then install. > > If that is beyond your C programming skills drop me a note and I can > email you the bungholed syslogd.c file and you can take it from there. > > > > Elijah Savage III wrote: > > > > Can anyone help me out with a PIX logging to a Freebsd syslog server. I > > thought I was sure about setting this up but I am not getting any > > messages on the server, see my configs below. > > > > logging on > > > > logging timestamp > > > > logging trap debugging > > > > logging facility 23 > > > > logging host inside 192.168.11.4 > > > > FreeBSD > > > > local7.debug/var/log/cisco.all > > > > I also startes syslogd with these parameters > > > > 29612 ?? Ss 0:00.03 syslogd -a 192.168.11.2/255.255.255.0 > -- > Neal Rauhauser CCNP, CCDP voice: 402-301-9555 > mailto:[EMAIL PROTECTED] fcc : k0bsd > "This is my private email devoted to various mailing lists. If you're > a twerp with an attorney and someone else's money, don't bother my > employer about the things I say, just come see me personally and we'll > discuss the situation. No names, you twerps should know who you are". Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=51219&t=51124 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
