CCNP - ENTERPRISE - EIGRP - #sh ip eigrp neigbors cmd

A common question when reviewing the output of the #sh ip eigrp neighbors cmd is 'What on earth does 'H' stand for??'

Well, here it is......

H (handle): A number used internally by the Cisco IOS software to track a neighbor. It records the order in which the neighbors were learned.

 So there you have it...still no clearer why the word Handle was used but at least you now know what it means :o)

Cisco Configuration Guides

I thought I'd log the location of the following site:
http://www.cisco.com/en/US/products/ps6441/products_installation_and_configuration_guides_list.html

This is a fanstatic place to stop and read around a subject. Remember to try and use more than one source of material to give yourself a rounded view of a topic.

CCNP - SWITCH - the Cisco Networking Academy course

Last night saw me sit the end of course exam for the CCNP SWITCH Network Academy course. I bagged a passed with 75% and passed the course with a score of 86%, which will do for me.

I found it interesting chatting to the guys after the exam that the opinion of the exam and of the course in general was that the difficulty had been ramped up a touch. I've attended my Networking Academy with the same guys for 2 years now and I know roughly where we all sit in ability. In general we were all scoring 5-7% less on the new CCNP track compared to the CCNA track or the old CCNP ISCW and BSCI courses.

My thoughts for the new CCNP course are as follows:
Pro's - Course emphasis is much more on practical, hands on lab work and troubleshooting. Learn the labs and the commands inside out. The course material was easy to follow and well presented and I didn't notice the shocking errors in the chapter quiz's/exams that were present in previous versions of the CCNP

Con's - The course material is now in a book instead of being online via the netacad website. For me this was an annoyance as it wasn't made clear prior to enrolling on the course that I needed to purchase said course manual on top of paying my course fees. I for one would have preferred to have the cost of the book bundled in to the course fees and then it could have been handed out on the first night. Instead I had to order it that week so it would be delivered in time for week 2.

Also in having the course presented in a book it meant that I had to keep the weighty manual on me at all times on the off chance I had a quiet moment to continue my reading. Previously I could have just fired up the website and away I go.

Conclusions - I really enjoyed my time on the course and got a lot out of the lab time and the access to the tutor. I guess your experience will depend greatly on the availability of hardware and the quality of the tutor presenting the course however for me this was great value for money and well worth 16 evenings of my time.

If you get an opportunity to enrol on a Cisco Networking Academy course I highly recommend it.

CCNP - SWITCH - Planning topics

Discussions on the web indicate that the CCNP SWITCH exam asks much more about 'Planning' your deployments.

A good point of reference is - http://dhucaby.wordpress.com - written by Dave Hucaby who wrote the Official CCNP SWITCH Certification guide, the blog expands on the topics outline in his book particularly on Planning.

It appears that some of the official Cisco material may be lacking in this area so brush up any gaps via Dave's blog and you shouldn't go wrong.

New Year, New Job!

It's been a while since my last entry. We've had Christmas, New Year, family time, work, and studies. I've also had a recruitment process to contend with.

Last week I was pleased to find that I was successful in my application to become a Cisco specialist at an ISP based in North Yorkshire.

My current role is in doubt and so I decided to jump before I was pushed. In my new role i will be getting to develop those skills learned at the Cisco Networking Academy and I'll be able to get hands on with Service Provider technologies such as MPLS VPNs and BGP.

I start in February and I can't wait :o) , the team I'll be working with are really nice and friendly and already I feel I'm going to enjoy working there.

Game On...

IKE - Functions - Dead Peer Detection

Dead Peer Detection -  use to detect a dead IKE peer and perform IKE peer failover
- If a dead IKE peer is detected then the IKE SA and IPSec SA to that peer is torn down.
- DPD has 2 modes of function:
    A) Defualt setting - where a DPD hello is sent every 10 seconds (unless the router receives a hello
        message from the peer first) but does lead to increased network activity from all the hellos.

    b) On demand - the router sends a DPD hello packet in advance of sending some data. This option    reduces uncessary network traffic but could result in you only finding out there is a network issue when data needs to be sent, not prior.

- Implemented using  -
  #crypto isakmp keepalives [frequency] [retries] [periodic | on-demand]-
   where frequency = number of seconds between DPD messages
             retries = number of seconds between DPD retries id the DPD message fails
             periodic = DPD messages are sent at regular intervals
            on-demand = DPD retries are sent on demand - this is default behaviour.

E.g - #crypto isakmp keepalives 10 3 periodic

By implementiung this you can then specifiy a second remote peer within your IPsexc crypto map to establish your SA:
for example - #crypto map TEST 10 ispec-isakmp
          # set peer 172.31.1.100 default
          # set peer 172.31.1.200

The Default option indicates that this should be used first to establish an SA, the second peer is used if the first remote peer is detected to be dead.

Cisco studies - What next...

Since I attained my CCNP I've been looking at what to do next. Should I continue on to the CCIE? or look at exploring some of the specialisms Cisco has developed in the time it took for me to go through CCNA and then CCNP?

At first I thought I would continue straight on the CCIE R&S but I'm struggling to get over the shear volume of knowledge required to go for the written (yes I appreciate it's supposed to be hard but I've got a young family to factor in...) So after a few very interesting weeks at work I've decided to go for CCDA then CCDP.

Starting in January my next posts will be aligned to the CCDA certification. Here goes...

IPSec - the basics

Following on from GRE (which I'll come back to on another occasion), IPSec is an IETF standard (RFC 2401 - 2412) which can be considered to be a 'suite' of protocols.

IPsec operates at the Nework layer of the OSI model, and authenticates every packet, offers data integrity for every packet, and provides confidentiality.

IPsec is available from IOS 11.3(T) and PIX OS 5.0 or later.

IPsec is main up of 3 components:

1. Internet Key Exchange (IKE) - UDP 500, which is a framework for negotiating security parameters and authentication keys.
2. Encapsulation Security Payload (ESP)  - IP port 50, encrypts (using DES, 3DES, AES), secures (MD5 or SHA-1), and authenticates data (MD5 or SHA-1).
3.  Authentication Header (AH) - IP port 51, offers secures data and offers authentication (MD5 or SHA-1).

 IPsec creates secure tunnels, known as Security Associations (SA), between 2 peers such as routers. Tunnels are unidirectional and are established via ESP or AH.

Internet Key Exchange Overview
IPsec uses IKE to authenticate peers and generate symmetrical encryption keys for data communications
Symmetrical keys are generated by Diffe Helman (DH)

IKE also manages the negotiation between peers for settings such as what data to be protected, key strengths, hash method to use (outlined later).

You can manually set the parameters in IPSec for the generation of keys, refresh interval of the keys, an SA characteristics however it's much easier to have IKE configure this automatically. IKE achieves this using ISAKMP or Internet Security Association and Key Management Protocol.

IKE has 2 phases in its method for setting up an IPSec tunnel.
Phase1 - Authenticates the actual peer so each peer knows the other peer is who it says it is. Operates in either 'Main Mode' or 'Agressive Mode'
Phase1.5 - is optional and it is at this stage you can authenticate an actual user. This may be via a RADIUS server, local accounts on the terminating peer (i.e router), or other means.
Phase2 - Establishes the actual IPSec tunnel and operates in 'Quick Mode'

IKE Modes
Main Mode - consists of 3 exchanges, the initiator sends a propsal to the peer containing what encryption, authentication, key duration settings to use (amoungst others).
The remote peer selects an appropriate proposal and replies
DH public keys and then exchanged resulting in all further comms being encryped in the inital IKE tunnel (SA)
A 3rd exchange authenticates the ISAKMP session.
Once complte phase 2 ocurs.
Aggressive Mode - Everything is sent over in a single exchange and the remote peer then responds accordingly
Quick Mode - Within IKE phase2, the IPSec SA is established but comms are protected by the IKE SA configured in Phase1.
Quick mode negotiates the SA for data to be exchanged.

Welcome to NetworkStudies.co.uk

The new home of CiscoStudies.co.uk

Thanks

Jonathan

Generic Routing Encapsulation – GRE

• GRE is IP protocol 47 (that's Protocol NOT port)
  
• GRE can encapsulate a wide variety of protocol packets inside IP tunnels
• Creates virtual Point-to-Point links to Cisco router (proprietary)
• Uses IP for transport
• Additional Header supports any other layer3 protocol in the payload (eg IPX, AppleTalk, et al)
• Stateless – Tunnel end point doesn’t keep any information on the state/availability of the remote end point.
• Offers NO security, confidentiality, integrity checking, data authentication
• Uses 24-byte overhead by default – 20-byte IP header plus 4-byte GRE header
• 4-byte header contains GRE flag setting out a checksum, key (if used), sequence number, version number, protocol type id field.
• Protocol typre id field is used to identify the protocol of the payload, e.g, 0x800 indicates IP. This is the field that allows GRE to tunnel any protocol.

 Benefits:

•  Good at tunneling
•  Supports multiple protocols
• Allows routing protocols (OSPF, EIGRP) to be used

Costs:

• Poor security – only plain text authentication used
• Cannot accommodate confidentiality, integrity, and data authentication

GRE and IPSEC

•  GRE can be used in conjunction with IPSEC
•  IPSEC offers confidentiality via 3DES or AES (for example)
•  Authentication is provided via a HMAC such as MD5 or SHA-1
•  Integrity is via MD5 or SHA-1
•  IPSEC is not perfect though, older IOS’ don’t support IP multicast
•  IPSEC was designed to support IP only

 Configure a basic GRE tunnel in IOS

•  Here is a typical GRE tunnel config.
• Each router needs needs a tunnel interface on the end points of the tunnel
• Simplest type of tunnel

 R1(config)#int tu0
R1(config-if)#tunnel source S0/0
R1(config-if)#tunnel dest 192.168.20.1
R1(config-if)#ip address 172.16.10.1 255.255.255.0

R2(config)#int tu0
R2(config-if)#tunnel source s0/1
R2(config-if)#tunnel dest 192.168.10.1
R2(config-if)#ip address 172.16.10.2 255.255.255.0

*use the ? to inspect further options in tunnel interface mode

Note

• The ‘int tu0’ cmd creates the GRE tunnel
• ‘ip address’ is a network used exclusively by the tunnel end points
•  ‘tunnel source’ is a physical interface on the route
•  ‘tunnel dest’ is the ip of the physical interface on the remote router
•  Default mode of the tunnel is GRE and so we have not needed to configure the mode in this example
• GRE can pass OSPF/EIGRP so you use this in association with IPSEC (which cannot) if you are wishing to distribute routing information
• Where you use IPSEC and GRE the ipsec crypto map will be assigned to the physical interface NOT the tunnel interface
• IPSEC will be discussed in further detail later.