Friday, November 6, 2009

AUX back-to-back: poor man's connection

Hi all,

today I have focused my attention on the Aux port, the only free I have in my old 2600's lab....

So, first I have found some old docs on Cisco.com explaining clearly how to connect two routers back-to-back using the AUX port:

Connecting Routers Back-to-Back Through the AUX Ports (Document ID: 10365 )

and then was time to try it:

1) use an old rollover RJ-45 cable to connect AUX ports (pins 1-8 on both sides... as learned in CCNA times)


2) Find the AUX tty number on both sides:

R3#sh line
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
* 0 CTY - - - - - 0 0 0/0 -
65 AUX 9600/9600 - - - - - 0 0 0/0 -
66 VTY - - - - - 0 0 0/0 -
67 VTY - - - - - 0 0 0/0 -
68 VTY - - - - - 0 0 0/0 -
69 VTY - - - - - 0 0 0/0 -
70 VTY - - - - - 0 0 0/0 -

Line(s) not in async mode -or- with no hardware support:
1-64



R5#sh line
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
* 0 CTY - - - - - 0 0 0/0 -
5 AUX 9600/9600 - - - - - 0 0 0/0 -
6 VTY - - - - - 0 0 0/0 -
7 VTY - - - - - 0 0 0/0 -
8 VTY - - - - - 0 0 0/0 -
9 VTY - - - - - 0 0 0/0 -
10 VTY - - - - - 0 0 0/0 -

Line(s) not in async mode -or- with no hardware support:
1-4

As you can see, different hardware/platform can use different tty numbers for AUX port, here we have tty 65 and tty 5

3) configure the AUX port on both sides:

R5(config)#line aux 0
R5(config-line)#transport input all
R5(config-line)#modem inOut
R5(config-line)#flowcontrol hardware
R5(config-line)#speed 115200 !-- better than 9600...
R5(config-line)#end

!-- same on R3


4) Create and configure the async interfaces (each interface uses the tty number of AUX port as point 2)


R5(config)#int async 5 !-- remember the tty number for AUX?
R5(config-if)#encapsulation ppp
R5(config-if)#async dynamic routing
R5(config-if)#async mode dedicated
R5(config-if)#ip address 10.0.0.5 255.255.255.0
R5(config-if)#end
R5#


R3(config)#int async 65 !-- remember the tty number for AUX?
R3(config-if)#encapsulation ppp
R3(config-if)#async dynamic routing
R3(config-if)#async mode dedicated
R3(config-if)#ip address 10.0.0.3 255.255.255.0
R3(config-if)#end



wait a little and you will see messages like

R5#
*Nov 6 16:58:20.237: %LINK-3-UPDOWN: Interface Async5, changed state to up
*Nov 6 16:58:23.394: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async5, changed state to up
R5#


...Now you have a poor man's additional interface for your lab!
You can ping it and use it for dynamic routing (althrough u can't use it for mpls or other advanced features... ;-) )


Marco


NOTE: I have found an additional note on Document ID: 5465 (Configuring Dialout using a Modem on the AUX Port )
that say about the AUX speed:

speed 115200
!--- The AUX port on the 2600 supports a speed of 115200.
!--- Note: If you route through the AUX port, each character generates a
!--- processor interrupt. This is an abnormally high load on the CPU,
!--- which can be resolved if you use a lower AUX port speed.

I guess that in a lab environment the cpu usage will be low.

Monday, October 26, 2009

Another spaghetti rack

I was in a building last week, for some troubleshooting tasks.

When I entered the wiring closet to find a switch port for my laptop, it looked like...



one of the best spaghetti rack ever seen!




and here I found my port ;-)

(2nd switch from above, port 0/45...)

Marco

Thursday, October 22, 2009

Tip-of-day: ip access-list resequence

Hi all,

today's trick is access-list resequence.

Consider an access-list with ugly sequence numbers, maybe derived from several configuration changes, eg:


R6# sh access-lists
Extended IP access list test
1 permit tcp any any eq www
2 permit tcp any any eq 443
3 permit tcp any any eq domain
4 permit tcp 172.16.0.0 0.0.255.255 any eq telnet
5 permit tcp 172.16.0.0 0.0.255.255 any eq ssh
6 deny ip any any

R6#sh run | sec access-list
ip access-list extended test
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq domain
permit tcp 172.16.0.0 0.0.255.255 any eq telnet
permit tcp 172.16.0.0 0.0.255.255 any eq 22
deny ip any any


If I have to modify it, the "old times" method was to remove acl from interfaces, delete it, recreate it and then reapply on interfaces ... but this is an extended acl, you can insert and modify statements since they have sequence numbers.

In this case, as you can see, there's no space between sequence numbers, so today's trick is to resequence the acl with the "ip access-list resequence" command.
( see "Refining an IP Access List" )

Let's try it

R6#sh access-lists
Extended IP access list test
1 permit tcp any any eq www
2 permit tcp any any eq 443
3 permit tcp any any eq domain
4 permit tcp 172.16.0.0 0.0.255.255 any eq telnet (394 matches)
5 permit tcp 172.16.0.0 0.0.255.255 any eq 22
6 deny ip any any (24 matches)

R6# conf t
R6(config)#ip access-list resequence test ?
<1-2147483647> Starting Sequence Number

R6(config)#ip access-list resequence test 10 ?
<1-2147483647> Step to increment the sequence number

R6(config)#ip access-list resequence test 10 10 ?
< cr >

R6(config)#ip access-list resequence test 10 10
R6(config)#do sh ip access-lists test
Extended IP access list test
10 permit tcp any any eq www
20 permit tcp any any eq 443
30 permit tcp any any eq domain
40 permit tcp 172.16.0.0 0.0.255.255 any eq telnet (496 matches)
50 permit tcp 172.16.0.0 0.0.255.255 any eq 22
60 deny ip any any (24 matches)
R6(config)#


et voila', named access-list ready to be modified ;-)

Marco

Wednesday, October 14, 2009

Mpls Vpn review

Hi all,
I'm completely busy on studying CCIE R&S written but I want to share a mpls vpn lab for reviewing mpls arguments.

Here is the topology:



Task list for this lab is:
-R1-R2-R3-R4-R5-R6-R7 (ISP) cannot elect any DR/BDR to speed up convergence
-Any OSPF area 0.0.0.0 neighbor fault must be detected within 1 second or less (NOTE: if you use dynamips, this requirement can be skipped or "relaxed"..., the high cpu % utilization will bring up/down your adjacency when you perform some operations like enable mpls...)
-area 0.0.0.0 must be ready for future traffic engineer configurations
-All ISP loopbacks must be reachable by igp
-R1 act as MpBGP Route Reflector
-CE11, CE12 and CE13 belongs to the same organization named "Customer1", they use EIGRP AS 1 for L3-vpn connections
-CE21, CE22 and CE23 belongs to the same organization named "Customer2", they use BGP as 65222 for L3-vpn connections
-BB1 and BB2 are "the internet", they must declare at least 10.000 prefixes with bgp
-R1 must prefer BB1 for odd networks, BB2 for even networks
-Customers must receive only a default route to reach internet for every customer site

I used gns3 with 7200 for ISP and 3640 for customers.


Here the initial configs, just to speed up the lab start: [+/-]




!-------------------------------
!-- R1 initial config

conf t
hostname R1

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc R1 <-> R3
speed 100
duplex full
ip address 172.16.0.4 255.255.255.254
no shut

int fa 1/0
desc R1 <-> R2
speed 100
duplex full
ip address 172.16.0.2 255.255.255.254
no shut

int fa 1/1
desc R1 <-> R4
speed 100
duplex full
ip address 172.16.0.6 255.255.255.254
no shut

int fa 2/0
desc R1 <-> BB1
speed 100
duplex full
ip address 172.31.0.0 255.255.255.254
no shut

int fa 2/1
desc R1 <-> BB2
speed 100
duplex full
ip address 172.31.0.2 255.255.255.254
no shut

int lo 0
ip address 1.1.1.1 255.255.255.255
end

!-- END R1 initial config
!-------------------------------
!-- R2 initial config

conf t
hostname R2

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc R2 <-> R5
ip address 172.16.0.0 255.255.255.254
speed 100
dupl full
no shut

int fa 1/0
desc R2 <-> R1
speed 100
dupl full
ip addr 172.16.0.3 255.255.255.254
no shut

int lo 0
ip address 2.2.2.2 255.255.255.255
end

!-- END R2 initial config
!-------------------------------
!-- R3 initial config

conf t
hostname R3

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc R3 <-> R1
ip address 172.16.0.5 255.255.255.254
speed 100
dupl full
no shut

int fa 1/0
desc R3 <-> R6
speed 100
dupl full
ip addr 172.16.0.10 255.255.255.254
no shut

int lo 0
ip address 3.3.3.3 255.255.255.255
end

!-- END R3 initial config
!-------------------------------
!-- R4 initial config

conf t
hostname R4

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc R4 <-> R7
ip address 172.16.0.8 255.255.255.254
speed 100
dupl full
no shut

int fa 1/0
desc R2 <-> R1
speed 100
dupl full
ip addr 172.16.0.7 255.255.255.254
no shut

int lo 0
ip address 4.4.4.4 255.255.255.255

!-- END R4 initial config
!-------------------------------
!-- R5 initial config

conf t
hostname R5

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc R5 <-> R2
speed 100
dupl full
ip addr 172.16.0.1 255.255.255.254
no shut

int fa 1/0
desc R5 <-> CE21
speed 100
dupl full
ip address 10.21.0.0 255.255.255.254
no shut

int fa 1/1
desc R5 <-> CE11
speed 100
dupl full
ip address 10.11.0.0 255.255.255.254
no shut

int lo 0
ip address 5.5.5.5 255.255.255.255
end

!-- END R5 initial config
!-------------------------------
!-- R6 initial config

conf t
hostname R6

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc R6 <-> R3
ip address 172.16.0.11 255.255.255.254
speed 100
dupl full
no shut

int fa 1/0
desc R6 <-> CE12
speed 100
dupl full
ip addr 10.11.0.4 255.255.255.254
no shut

int fa 1/1
desc R6 <-> CE22
speed 100
dupl full
ip address 10.21.0.4 255.255.255.254
no shut

int lo 0
ip address 6.6.6.6 255.255.255.255
end

!-- END R6 initial config
!-------------------------------
!-- CE11 initial config

conf t
hostname CE11

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc CE11 <-> R5
ip address 10.11.0.1 255.255.255.254
speed 100
dupl full
no shut

int lo 111
ip address 192.168.1.1 255.255.255.0

int lo 112
ip address 172.17.1.1 255.255.255.128
end

!-- END CE11 initial config
!-------------------------------
!-- CE12 initial config

conf t
hostname CE12

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc CE12 <-> R6
ip address 10.11.0.5 255.255.255.254
speed 100
dupl full
no shut

int lo 121
ip address 192.168.2.1 255.255.255.0

int lo 122
ip address 172.17.1.129 255.255.255.128
end

!-- end CE12 initial config
!-------------------------------
!-- CE13 initial config

conf t
hostname CE13

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc CE13 <-> R7
ip address 10.11.0.3 255.255.255.254
speed 100
dupl full
no shut

int lo 131
ip address 192.168.3.1 255.255.255.0

int lo 132
ip address 172.17.2.1 255.255.255.0
end

!-- END CE13 initial config
!-------------------------------
!-- CE21 initial config

conf t
hostname CE21

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc CE21 <-> R5
ip address 10.21.0.1 255.255.255.254
speed 100
dupl full
no shut

int lo 211
ip address 192.168.0.1 255.255.254.0

int lo 212
ip address 172.17.1.1 255.255.252.0
end

!-- END CE21 initial config
!-------------------------------
!-- CE22 initial config

conf t
hostname CE22

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc CE22 <-> R6
ip address 10.21.0.5 255.255.255.254
speed 100
dupl full
no shut

int lo 221
ip address 192.168.2.1 255.255.254.0

int lo 222
ip address 172.17.4.1 255.255.252.0
end

!-- END CE22 initial config
!-------------------------------
!-- CE23 initial config

conf t
hostname CE23

no ip domain-lookup
line con 0
logging sync
no exec-timeout

int fa 0/0
desc CE23 <-> R7
ip address 10.21.0.3 255.255.255.254
speed 100
dupl full
no shut

int lo 231
ip address 192.168.4.1 255.255.254.0

int lo 232
ip address 172.17.8.1 255.255.252.0
end

!-- END CE23 initial config

Thursday, September 17, 2009

Today's work in a shot

Several boxes are waiting me since a week...

today I've unpacked two 4948 and several 2950, here the shots (only one 2950 already out of box)!





And the 4948s with redundant power supply:


Sunday, September 13, 2009

Back from vacations

Hi all, I'm just back from our fabulous vacations... any idea about the location?

Look:




... right! it's San Franciscooooo!!! ;-)

and what's better to take a shot like this when you pass near San Jose? ,-)



ehehe I hope one day to enter the Cisco Headquarter (ah dreaming.... )

Well, the good news is that from Sep. 20 2009 (it's sunday, I know...) I'll start the great CCIE R&S written course in Bergamo (Italy) made by Europa Networking, with Rocco Tessicini as instructor.
So for 5 sundays I'll wake up early to do 170 Km to reach Bergamo and studying the whole day.
I'll try to do the written exam by the end of 2009, so I imagine that my blog will be a little less active, at least with less labs.

Anyway, stay tuned for the most interesting ideas coming from the interaction with Rocco!

byeeee
Marco

Friday, August 14, 2009

WVIC 1MFT-E1 back-to-back for frame relay labs

Hi all,
after my old post "WVIC 1MFT-E1 back-to-back" I've tryed to configure a back-to-back connection between two MFT-E1 in order to use it to emulate a serial connection for frame relay studies.

Obviously, you don't need crossover serial cables, but a crossover Pri cable (RJ-45) as described in the old post ("WVIC 1MFT-E1 back-to-back")
Quick refresh of pins:
1 RX Ring - -> 4 TX Ring -
2 RX Tip + -> 5 TX Tip +
4 TX Ring - -> 1 RX Ring -
5 TX Tip + -> 2 RX Tip +

Well, it was really hard (at least for me) to find how to configure it!

First, let's look on the default config of the MFT E1 controller:


R1#sh run | section controller
controller E1 1/0/0

R1#sh controller e1 1/0/0
E1 1/0/0 is up.
Applique type is Channelized E1 - balanced
No alarms detected.
alarm-trigger is not set
Version info Firmware: 20071129, FPGA: 20, spm_count = 0
Framing is CRC4, Line Code is HDB3, Clock Source is Line.
Data in current interval (89 seconds elapsed):
4 Line Code Violations, 3 Path Code Violations
23 Slip Secs, 0 Fr Loss Secs, 3 Line Err Secs, 0 Degraded Mins
25 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 0 Unavail Secs

R1#show diag 1
Slot 1:
[...NM-HDV installed...]

WIC Slot 0:
E1 (1 Port) Multi-Flex Trunk WAN Daughter Card
Hardware revision 1.0 Board revision B0
Serial number 00000000 Part number 800-04475-03
FRU Part Number VWIC-1MFT-E1=

[....]

HDV firmware: Compiled Fri 19-Nov-04 14:23 by michen
HDV memory size 524280 heap free 193977


then, the necessary steps to configure it as a single E1 DATA connection are:
(this config has to be applied on BOTH sides)
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#controller
R1(config)#controller e1 1/0/0
R1(config-controller)#framing crc4 !-- optional, crc4 it's already the default
R1(config-controller)#linecode hdb3 !-- optional, hdb3 it's default too
R1(config-controller)#clock source internal
R1(config-controller)#channel-group 1 timeslots 1-31 speed 64
*Aug 14 19:16:16.119: %CONTROLLER-5-UPDOWN: Controller E1 1/0/0, changed state to up
*Aug 14 19:16:18.119: %LINK-3-UPDOWN: Interface Serial1/0/0:1, changed state to up
*Aug 14 19:16:19.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0/0:1, changed state to up

R1#sh run | section controller
controller E1 1/0/0
clock source internal
channel-group 1 timeslots 1-31

R1#sh controllers e1
E1 1/0/0 is up.
Applique type is Channelized E1 - balanced
No alarms detected.
alarm-trigger is not set
Version info Firmware: 20071129, FPGA: 20, spm_count = 0
Framing is CRC4, Line Code is HDB3, Clock Source is Internal.
Data in current interval (619 seconds elapsed):
0 Line Code Violations, 0 Path Code Violations
81 Slip Secs, 0 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins
81 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 0 Unavail Secs
Total Data (last 4 15 minute intervals):
5 Line Code Violations, 3294 Path Code Violations,
908 Slip Secs, 2 Fr Loss Secs, 3 Line Err Secs, 0 Degraded Mins,
909 Errored Secs, 0 Bursty Err Secs, 2 Severely Err Secs, 24 Unavail Secs

R1#sh run interface serial 1/0/0:1
Building configuration...

Current configuration : 46 bytes
!
interface Serial1/0/0:1
no ip address
end

R1#


As you can see, an interface Serial is created, then, you can use it as a traditional serial interface, bandwidth is 31 channels x 64k = 1984Kbps.

In addition, depending on how many NVRAM is allocated to your HDV (see show diag under "HDV memory size") you can create multiple serial interfaces by reducing the number of channels on channel-group.

eg:

R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#controller e1 1/0/0
R1(config-controller)#no channel-group 1 timeslots 1-31
% Not all config may be removed and may reappear after reactivating the logical-interface/sub-interfaces
R1(config-controller)#channel-group 1 timeslots 1-8 speed 64
*Aug 14 19:35:29.475: %LINK-3-UPDOWN: Interface Serial1/0/0:1, changed state to up
*Aug 14 19:35:30.475: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0/0:1, changed state to up
R1(config-controller)#channel-group 2 timeslots 9-16 speed 64
R1(config-controller)#
*Aug 14 19:35:41.303: %LINK-3-UPDOWN: Interface Serial1/0/0:2, changed state to up
*Aug 14 19:35:42.303: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0/0:2, changed state to up

R1#sh run int serial 1/0/0:1 | beg int
interface Serial1/0/0:1
no ip address
end

R1#sh run int serial 1/0/0:2 | beg int
interface Serial1/0/0:2
no ip address
end

R1#sh diag 1 | beg WIC
WIC Slot 0:
E1 (1 Port) Multi-Flex Trunk WAN Daughter Card
Hardware revision 1.0 Board revision B0
Serial number 00000000 Part number 800-04475-03
FRU Part Number VWIC-1MFT-E1=

[...]

HDV firmware: Compiled Fri 19-Nov-04 14:23 by michen
HDV memory size 524280 heap free 625

R1#


note the "HDV memory size 524280 heap free 625", displayed if the MFT is installed into a NM-HDV module, doesn't allow you to create more channel-groups (unless you have channels 17-31 unallocated) because your HDV free memory is insufficent.... it you try this, you'll receive an error message like:

R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#controller e1 1/0/0
R1(config-controller)#channel-group 3 timeslots 17-31 speed 64
Channel setup failed!!! s:t:c 1:0:3
HDV slot 1 DRAM size 524280 free 625 need 124992

%Insufficient resources to create channel group
R1(config-controller)#



If the MFT-E1 is installed on a HVic standard slot, the error is similar:


R2(config)#controller e1 0/2/0
R2(config-controller)#channel-group 1 timeslots 1-8 speed 64
*Aug 14 19:37:25.797: %LINK-3-UPDOWN: Interface Serial0/2/0:1, changed state to up
*Aug 14 19:37:26.797: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/2/0:1, changed state to up
R2(config-controller)#channel-group 2 timeslots 9-16 speed 64
*Aug 14 19:37:32.937: %LINK-3-UPDOWN: Interface Serial0/2/0:2, changed state to up
*Aug 14 19:37:33.937: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/2/0:2, changed state to up
R2(config-controller)#channel-group 3 timeslots 17-24 speed 64
%Channel-groups per port limit exceeded
%Insufficient resources to create channel group


Now we have two serial interfaces on each router, we can use them for frame relay, even with the "trick" of creating two vrfs on one router, to simulate a point-to-point topology, with the router without vrfs acting as fr switch.

eg:
R1#sh run
[...]
!-- only relevant parts displayed...
!
ip vrf one
rd 1:1
!
ip vrf two
rd 2:2
!
controller E1 1/0/0
clock source internal
channel-group 1 timeslots 1-8
channel-group 2 timeslots 9-16
!
interface Serial1/0/0:1
ip vrf forwarding one
ip address 172.16.0.1 255.255.255.0
encapsulation frame-relay
frame-relay interface-dlci 102
!
interface Serial1/0/0:2
ip vrf forwarding two
ip address 172.16.0.2 255.255.255.0
encapsulation frame-relay
frame-relay interface-dlci 201
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!-- on the other side, only relevant parts
!
R2#sh run
!
frame-relay switching
!
controller E1 1/0/0
clock source internal
channel-group 1 timeslots 1-8
channel-group 2 timeslots 9-16
!
!
interface Serial1/0/0:1
no ip address
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay intf-type dce
clock rate 512000
frame-relay route 102 interface Serial1/0/0:2 201
!
interface Serial1/0/0:2
no ip address
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay intf-type dce
clock rate 512000
frame-relay route 201 interface Serial1/0/0:1 102


let's verify it:
R1#sh ip route | beg Gateway
Gateway of last resort is not set

!--global routing table is completely empty

R1#sh ip route vrf one | beg Gateway
Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C 172.16.0.0 is directly connected, Serial1/0/0:1

R1#sh ip route vrf two | beg Gateway
Gateway of last resort is not set

172.16.0.0/24 is subnetted, 1 subnets
C 172.16.0.0 is directly connected, Serial1/0/0:2

R1#ping vrf one 172.16.0.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/12/16 ms

R1#ping vrf two 172.16.0.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/13/16 ms
R1#


Now we can enjoy Frame Relay labs with cheap hand-made Rj-45 cables (but with expensive VWIC MFT-E1 cards ;-) )