OSPF Basic Config

Easy Pinpoint OSPF configurations on Cisco Routers OSPF, as we all know is one of the most widely used IGPs today. Having knowledge of OSPF configurations is very important for any Network Engineer. Below are the steps given for OSPF configuration in your network. NOTE:  Bofore starting OSPF configuration on your Router, you must have at least 1 "UP" and active interface. A major part of OSPF routing configuration in Cisco IOS is specifying the interfaces on which you want to run OSPF and the OSPF areas to which these interfaces belong. IOS gives you two configuration mechanisms: 1. The first mechanism is using "network" command within in the OSPF routing process configuration. The "network" command allows you to specify an ACL-like filter that can match multiple interfaces with a single command, significantly reducing the configuration complexity.               Router # configure terminal               Router(config) # router ospf [process-id]         Router(config-router) #network [ip-address] [wildcard-mask] area [area]  EXAMPLE:         Router # configure terminal               Router(config) # router ospf 555         Router(config-router) #network 10.0.0.0 0.255.255.255 area 0 2. The easiest, but less known method of configuring OSPF is via using interface-mode command for enabling OSPF. Syntax for using this command is explained below:         Router # configure terminal         Router(config) # interface [interface-type]  [interface-number]         Router(config-if) # ip ospf [process-id] area [area-id]  EXAMPLE:         Router # configure terminal         Router(config) # interface serial 1/0         Router(config-if) # ip ospf 555 area 0 Both methods would accomplish exactly same task, i.e enabling OSPF on Serial 1/0 with OSPF process-id 555 (before using "network" command, you must have the ip address configured on Serial 1/0 within 10.0.0.0 network range). Other useful OSPF commands are explained in next post. Hope it helped.

Enabling Static Routing on Cisco Devices

Easy Static Routing configuration on Cisco Router / Switches

Static routing occurs when you manually add routes in each router’s routing table. The advantages of static routing are mentioned below:

1) It puts no overhead on the router CPU (dynamic routing protocols eg OSPF, EIGRP, RIP are CPU intensive).

2) There is no bandwidth usage between routers for routing managenent traffic (as for “Routing Updates” in dynamic routing protocols).

3) It adds security because the administrator can choose to allow routing access to certain networks only and can define a specific path for specific traffic etc.

But Static routing also has the following disadvantages:

1) The administrator must really understand the internetwork and how each router is connected in order to configure routes correctly (more responsibility on administrator).

2) If a single network is added to the internetwork, the administrator has to add a route to it on all routers by hand (this can be a lengthy job if you have many routers in your network).

3) If one network or next-hop has gone down, you will have to manually edit the routing entries in all affected routers.

The command syntax to configuring a static route in cisco router’s routing table is:

Router#configure terminal

Router(config)#ip route [destination_network] [destination_mask]  

     [next-hop_address or exit interface]

An example of configuring a static route is mentioned below:

Router#configure terminal

Router(config)#ip route 10.0.0.0 255.0.0.0 15.0.0.2

Where 10.0.0.0 / 255.0.0.0 is destination network and 15.0.0.2 is the next-hop address of far-end router.

How OSPF Router ID is selected?

OSPF Router ID selection algorithm

Every OSPF process running in Cisco IOS requires a router-wide unique router ID. An IP address of an active interface is commonly used as the OSPF router ID; you can also use the router-id address router configuration command to ensure the OSPF router ID does not change even when the interface IP addresses change.

OSPF router ID should not be changed after the OSPF process has been started. OSPF router ID change resets all OSPF adjacencies, resulting in temporary router outage. The router also has to originate new copies of all its LSAs with the new router ID. Stale copies of the LSAs originated by the “old” OSPF process remain in the OSPF topology databases of all routers until they expire (their age increases beyond max-age).

Router ID selection algorithm

If the router-id is specified in the OSPF configuration, the specified IP address is used. If the IP address configured with the router-id command overlaps with the router ID of another already active OSPF process, the router-id command fails.

If OSPF router ID was not set with the router-id configuration command (router-id command was not used in the OSPF configuration or there was a router ID overlap with another OSPF process), OSPF uses an interface IP address as its router ID.

The following algorithm is used to select an interface IP address as the OSPF router ID:

• IP addresses of all applicable loopback interfaces are collected. Addresses already used as OSPF router ID of other OSPF processes are removed. If any addresses are left, the highest IP address is used as the OSPF router ID.

Applicable interfaces are operational (line protocol is up) interfaces in the IP routing table as the OSPF process.

• If the OSPF router ID has not been selected in the first step, IP addresses of all other applicable interfaces are collected. OSPF router IDs of active OSPF processes are removed from the list and the highest IP address is used.
• If the router was still not able to select an OSPF router ID, an error message is logged and the OSPF process does not start.

An OSPF process that failed to select a router ID retries the selection process every time an IP address becomes available (an applicable interface changes its state to up or an IP address is configured on an applicable interface).

Changing the OSPF router ID

Once an OSPF router ID is selected, it is not changed even if the interface that was used to select it changes its operational state or its IP address. Earlier IOS releases changed the OSPF router ID when the underlying interface state changed, resulting in unnecessary network instabilities.

To change the OSPF router ID, you have to reset the OSPF process with the clear ip ospf process command (even when the new router ID was requested with the router-id router configuration command).

AN EXCELLENT CISCO IOS COMMAND

AN EXCELLENT IOS COMMAND


           I just found and amazing Cisco IOS command, that i should have learned years ago. This IOS command is very handy, specially when making lengthy configurations on a large number of routers.

 The said command works as a macro and can actually assigns a "keyword" (which can be a single alphabet) for a lengthy IOS command. This command is issued from global config mode and the syntax of this command is;

          Router(config)# alias (config mode) (your keyword) (complete command)


where,
 config mode:    It is the mode from which the actual command (or keyword) will be issued. This mode can be EXEC, CONFIG, INTERFACE mode etc.
 your keyword: It is your keyword that you want to use in-place of lengthy command.
 complete command: It is the complete command that the router will assume instead of the keyword.



Example 1, To assign keyword "SII" for command "Show Ip Interface" (which in entered in exec mode), you can use following command;



          Router(config)# alias exec SII Show Ip Interface

          Now, when keyword "SII" will be typed in exec-mode (# mode), it will be treated by router as complete command "Show Ip Interface" were entered. 


Example 2, To assign keyword "NS" for command "No Shut" for enabling an interface, we can use this as;

         Router(config)# alias interface NS No Shut


         After that, whenever keyword NS will be entered in any interface configuration mode, it will be treated as complete command "No Shutdown" were entered.


          As a general guideline, I am also showing some most commonly used aliases. You just copy them in the global config mode of your Router / Switch.

          Router(config)# alias configure sir show ip route

          Router(config)# alias configure siib show ip interface brief

          Router(config)# alias exec sir show ip route

          Router(config)# alias exec siib show ip interface brief

          Router(config)# alias exec s sh run

          Router(config)# alias exec c conf t

          Router(config)# alias exec map show frame map

          Router(config)# alias exec pvc show frame pvc

          Router(config)# alias interface ns no shutdown

          Router(config)# alias interface sa switchport mode access

          Router(config)# alias exec w write memory

Easy enabling Secure Shell (SSH) on Cisco Routers & Switches

Easy enabling Secure Shell (SSH) on Cisco Routers & Switches

As most of you know that Telnet has no security mechanisms. Telnet sends passwords in clear-text and these passwords can be easily seen using a packet sniffer like Wireshark, formerly called Ethereal (goto the post Easy capturing Telnet Password using Wireshark Packet Sniffer to view complete procedure). Instead of Telnet, you can use Secure Shell, which creates a more secure session than telnet, which uses an unencrypted data stream. You can understand SSH as an “security-enabled” version of Telnet. Secure Shell (SSH) uses encrypted keys to send data so that your username and password are not sent in the clear text.

Here are the steps to setting up SSH:

1. Set your hostname:

Router(config)#hostname R_1

2. Set the domain name (both the hostname and domain name are required for the encryption keys to be generated):

R_1(config)#ip domain-name example.com

3. Generate the encryption keys for securing the session:

R_1(config)#crypto key generate rsa general-keys

            Then it will ask for number of bits to use for asynchronous encryption (using public-private keys). You can use 1024 bit keys for most router platforms. Generating 2048 bit keys will be CPU intensive. Generating keys may take few seconds to 15 minutes generate keys, depending upon your platform.

4. Set the max idle timer for a SSH session to 60 socends:

R_1(config)#ip ssh time-out 60

5. Set the max failed attempts for an SSH connection to 2:

R_1(config)#ip ssh authentication-retries 2

6. Then, goto vty lines config mode using following command, the last vty line number changes router-to-router. Use question mark to view last line-number:

                        R_1(config)#line vty 0 ?

                        R_1(config)#line vty 0 4

7. Last, configure SSH and then Telnet as access protocols:

R_1(config-line)#transport input ssh telnet

If you do not use the keyword telnet at the end of the command string, then only SSH will work on the router.

Easy capturing Telnet Password using Wireshark Packet Sniffer

Easy capturing Telnet Password using Wireshark Packet Sniffer

Wireshark is a freeware, open-source packet-sniffer and can be downloaded from www.wireshark.org/download.html  (size:17 MB). Steps to capture telnet passwords using this software are mentioned below:

1. First connect to the LAN segment where passwords are sent using a Hub etc or any other medium where you are able to get telnet packets (as Hub repeats all packets on all ports, except receiving port).

2. Then open Wireshark and on top-left pane, click your interface connecting to that LAN segment (like your Fastethernet interface) and live capture will start.

3. In the Wireshark window, you will see many columns like source, destination, protocol and info etc. In ‘Protocol’ column, you will see written ‘TELNET’. Right-click on that and click ‘Follow TCP Stream’, This step will show you an output like this

...............

...............

User Access Verification

Password: .............P..............ANSI..cisco1

Router>eenn

Password: cisco2

Router#sshhooww  iipp  iinntt  bbrr

Interface               IP-Address     OK?      Status    Protocol

FastEthernet0/0   10.0.0.1           YES      up           up     

FastEthernet0/1   unassigned     YES    up           up   

Router#

 

As you can see, it is not only showing the login and enable secret password, but also the complete session whatever the administrator is doing. In above example, cisco1 is the login password and cisco2 is enable secret password. Also, remember that this output will show some text doubled like “show ip int br” command, but it can still be easily understood.

            So, afraid of using Telnet in your network. Instead of Telnet, use SSH. Refer to post Easy enabling Secure Shell (SSH) on Cisco Routers and Switches for start using SSH on your device).

Easy Functions of Layer-2 Switching

Functions of Layer-2 Switching

            There are three distinct functions performed at OSI layer-2 (the Data-Link layer) namely Learning, Forwarding & Filtering and Loop Avoidence. These functions are explained in following sections;

1) Learning 
When switch starts, the MAC address table has no entry. When a node transmits data on its wire the MAC address of the node is learned by Switch Port connected to that node. In this way all the MAC addresses are learned by respective ports and these entries remain in the cache for a specific time. If during this specific time no new frame arrives from a node MAC address entry for that node is dropped from cache.

2) Forwarding & Filtering

When a MAC address for a port is learnt, packets addressed to that MAC address are forwarded only to the port associated with it, using one of the Switching Methods (i.e Store & Forward, Cut Through & Fragment Free).

3) Loop Avoidance

Switches and Bridges use Spanning Tree Protocol (STP), specified by IEEE 802.1d, or one of its variants to prevent loops. Loops can be caused by multiple connections between switches, established for redundancy.