The configurationn below only terminates VPN remote users on a cisco router.
This post is still in progress.... (NOT COMPLETE YET)
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp invalid-spi-recovery
!
crypto isakmp client configuration group REMOTEVPNGROUP
key 6 XXXXXXXXX
pool R-VPNpool
acl split-tunnel
crypto isakmp profile REMOTEclient
match identity group REMOTEVPNGROUP
client authentication list REMOTEclient
isakmp authorization list REMOTEclient
client configuration address respond
no keepalive
!
!
crypto ipsec transform-set REMOTE-RM-TS esp-3des esp-md5-hmac
!
crypto dynamic-map REMOTE-map 10
set transform-set REMOTE-RM-TS
set isakmp-profile REMOTEclient
reverse-route
!
!
crypto map REMOTEMAP1 100 ipsec-isakmp dynamic REMOTE-map
!
interface FastEthernet0
description ********
ip address dhcp
ip access-group OutsideTraffic_IN in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
crypto map REMOTEMAP1
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
ip local pool R-VPNpool 10.10.X.X 10.10.X.X
ip forward-protocol nd
!
ip nat inside source route-map nonat interface FastEthernet0 overload
!
remark no remark NAT ACCESS_LIST
ip access-list extended NAT_Exempt
deny ip 192.168.0.0 0.0.0.255 10.10.20.0 0.0.0.255
permit ip 192.168.0.0 0.0.0.255 any
ip access-list extended OutsideTraffic_IN
ip access-list extended split-tunnel
permit ip 192.168.0.0 0.0.0.255 10.10.20.0 0.0.0.255
!
route-map nonat permit 10
match ip address NAT_Exempt
!
Tuesday, February 23, 2010
Wednesday, January 6, 2010
How to Configure a GRE/IPsec VPN
Router1#sho run
Building configuration...
Current configuration : 1015 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router1
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 $1$uL3z$2QfdCX4Vot.YovoIP0pQA/
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
ip cef
!
interface Serial0/0
description ********CONNECTION TO ISP**********
ip address 12.34.56.2 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 12.34.56.1
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
!
!
end
Router1#
*********************************************************************************************************************************************************************************************
ISP#sho run
Building configuration...
Current configuration : 916 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISP
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
ip cef
!
interface Serial0/0
description *******CONNECTION TO R1********
ip address 12.34.56.1 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
description *******CONNECTION TO R2*********
ip address 23.45.67.1 255.255.255.252
serial restart-delay 0
!
interface Serial0/2
description *********CONNECTION TO R3************
ip address 34.56.78.1 255.255.255.252
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
ip http server
no ip http secure-server
!
ip classless
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
ISP#
*********************************************************************************************************************************************************************************************
Router2#sho run
Building configuration...
Current configuration : 993 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router2
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$rz8E$xI0ZPwpwL1BkZlOiRAnlK/
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
!
ip cef
!
interface Serial0/0
description ******CONNECTION TO ISP*********
ip address 23.45.67.2 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
!
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 23.45.67.1
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
!
!
end
Router2#
*********************************************************************************************************************************************************************************************
Router3#sho run
Building configuration...
Current configuration : 1009 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router3
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 $1$ZGoM$cD/Py.DpH/4qW7muT8nrW0
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
ip cef
!
interface Serial0/0
description *****CONNECTION TO ISP*******
ip address 34.56.78.2 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
!
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 34.56.78.1
!
!
!
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
!
!
end
Router3#
*********************************************************************************************************************************************************************************************
IPSEC tunnel between R1 and R2 and R3
This configuration is about how to configure GRE with IPSEC. GRE can be used to transmit routing protocols over the internet, it acts as if the link is a point to point circuit.
Create a tunnel interface on R1 which will communicate with R2
Setting Up the Tunnel.
Tunnel Source IP address will be the IP address of the Serial interface on the outside of ( Router1 )
Tunnel Destination will be the IP address of R2 Serial interface connecting to the internet ( 23.45.67.2 )
Create Another Tunnel to Router R3
Create another Tunnel source fron R1 (12.34.56.2 ) to R3 The Tunnel Source will be the WAN IP of Router 1
Create another Tunnel Destination to R3 ( 34.56.78.2 ) The Tunnel Destination will also be the WAN IP of R3
And then on Router 1 configure Eigrp to R2 and R3
Once the Eigrp instance has been configured
We now need to configure the Networks that we want to advertise
The first Network will be the LAN IP
The Second Network will be Tunnel IP from Router 1 to Router 2
The Third Network will be the Tunnel IP from Router 1 to Router 3
interface tunnel 0
description GRE Tunnel To Router 2
ip address 192.168.200.1 255.255.255.0
tunnel source 12.34.56.2
tunnel destination 23.45.67.2
interface tunnel 2
Description Tunnel To Router R3
ip address 192.168.201.1 255.255.255.0
tunnel source 12.34.56.2
tunnel destination 34.56.78.2
router eigrp 100
no auto summary
network 192.168.1.0
network 192.168.200.0
network 192.168.201.0
Before Tunnels are established..
Router1#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 12.34.56.1 to network 0.0.0.0
C 192.168.200.0/24 is directly connected, Tunnel0
C 192.168.201.0/24 is directly connected, Tunnel2
12.0.0.0/30 is subnetted, 1 subnets
C 12.34.56.0 is directly connected, Serial0/0
C 192.168.1.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 12.34.56.1
Router1#
**************************************************************************************
Sho ip route state after Tunnels is established
**************************************************************************************
Router1#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 12.34.56.1 to network 0.0.0.0
C 192.168.200.0/24 is directly connected, Tunnel0
C 192.168.201.0/24 is directly connected, Tunnel2
12.0.0.0/30 is subnetted, 1 subnets
C 12.34.56.0 is directly connected, Serial0/0
C 192.168.1.0/24 is directly connected, FastEthernet1/0
D 192.168.2.0/24 [90/297246976] via 192.168.200.2, 00:02:51, Tunnel0
S* 0.0.0.0/0 [1/0] via 12.34.56.1
Router1#
*************************************************************************************
Now we need to connect to Router R2 and configure R2 as shown Below:
**************************************************************************************
R2
interface tunnel 0
description GRE Tunnel To Router 1
ip address 192.168.200.2 255.255.255.0
tunnel source 23.45.67.2
tunnel destination 12.34.56.2
exit
router eigrp 100
no auto summary
network 192.168.2.0
network 192.168.200.0
Router2#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 23.45.67.1 to network 0.0.0.0
23.0.0.0/30 is subnetted, 1 subnets
C 23.45.67.0 is directly connected, Serial0/0
C 192.168.2.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 23.45.67.1
Router2#
*****************************************************************************************************
Show ip route state after Tunnels are established
*****************************************************************************************************
Router2#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 23.45.67.1 to network 0.0.0.0
23.0.0.0/30 is subnetted, 1 subnets
C 23.45.67.0 is directly connected, Serial0/0
C 192.168.200.0/24 is directly connected, Tunnel0
D 192.168.201.0/24 [90/310044416] via 192.168.200.1, 00:00:15, Tunnel0
D 192.168.1.0/24 [90/297246976] via 192.168.200.1, 00:00:15, Tunnel0
C 192.168.2.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 23.45.67.1
Router2#
****************************************************************************************
Now we need to connect to Router R2 and configure R2 as shown Below
****************************************************************************************
R3
interface tunnel 0
description GRE Tunnel To Router 1
ip address 192.168.201.2 255.255.255.0
tunnel source 34.56.78.2
tunnel destination 12.34.56.2
exit
router eigrp 100
no auto summary
network 192.168.3.0
network 192.168.201.0
****************************************************************************************
Show ip route state on R3 before Tunnel is established.
****************************************************************************************
Router3#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 34.56.78.1 to network 0.0.0.0
34.0.0.0/30 is subnetted, 1 subnets
C 34.56.78.0 is directly connected, Serial0/0
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 34.56.78.1
Router3#
****************************************************************************************
Show ip route state on R3 after Tunnel is established.
****************************************************************************************
Router3#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 34.56.78.1 to network 0.0.0.0
34.0.0.0/30 is subnetted, 1 subnets
C 34.56.78.0 is directly connected, Serial0/0
D 192.168.200.0/24 [90/310044416] via 192.168.201.1, 00:00:14, Tunnel0
C 192.168.201.0/24 is directly connected, Tunnel0
D 192.168.1.0/24 [90/297246976] via 192.168.201.1, 00:00:14, Tunnel0
D 192.168.2.0/24 [90/310046976] via 192.168.201.1, 00:00:14, Tunnel0
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 34.56.78.1
Router3#
Building configuration...
Current configuration : 1015 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router1
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 $1$uL3z$2QfdCX4Vot.YovoIP0pQA/
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
ip cef
!
interface Serial0/0
description ********CONNECTION TO ISP**********
ip address 12.34.56.2 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 12.34.56.1
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
!
!
end
Router1#
*********************************************************************************************************************************************************************************************
ISP#sho run
Building configuration...
Current configuration : 916 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISP
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
ip cef
!
interface Serial0/0
description *******CONNECTION TO R1********
ip address 12.34.56.1 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
description *******CONNECTION TO R2*********
ip address 23.45.67.1 255.255.255.252
serial restart-delay 0
!
interface Serial0/2
description *********CONNECTION TO R3************
ip address 34.56.78.1 255.255.255.252
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
ip http server
no ip http secure-server
!
ip classless
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
ISP#
*********************************************************************************************************************************************************************************************
Router2#sho run
Building configuration...
Current configuration : 993 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router2
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$rz8E$xI0ZPwpwL1BkZlOiRAnlK/
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
!
ip cef
!
interface Serial0/0
description ******CONNECTION TO ISP*********
ip address 23.45.67.2 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
!
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 23.45.67.1
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
!
!
end
Router2#
*********************************************************************************************************************************************************************************************
Router3#sho run
Building configuration...
Current configuration : 1009 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router3
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 $1$ZGoM$cD/Py.DpH/4qW7muT8nrW0
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
ip subnet-zero
!
ip cef
!
interface Serial0/0
description *****CONNECTION TO ISP*******
ip address 34.56.78.2 255.255.255.252
serial restart-delay 0
!
interface Serial0/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial0/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
!
ip http server
no ip http secure-server
!
ip classless
ip route 0.0.0.0 0.0.0.0 34.56.78.1
!
!
!
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
!
!
end
Router3#
*********************************************************************************************************************************************************************************************
IPSEC tunnel between R1 and R2 and R3
This configuration is about how to configure GRE with IPSEC. GRE can be used to transmit routing protocols over the internet, it acts as if the link is a point to point circuit.
Create a tunnel interface on R1 which will communicate with R2
Setting Up the Tunnel.
Tunnel Source IP address will be the IP address of the Serial interface on the outside of ( Router1 )
Tunnel Destination will be the IP address of R2 Serial interface connecting to the internet ( 23.45.67.2 )
Create Another Tunnel to Router R3
Create another Tunnel source fron R1 (12.34.56.2 ) to R3 The Tunnel Source will be the WAN IP of Router 1
Create another Tunnel Destination to R3 ( 34.56.78.2 ) The Tunnel Destination will also be the WAN IP of R3
And then on Router 1 configure Eigrp to R2 and R3
Once the Eigrp instance has been configured
We now need to configure the Networks that we want to advertise
The first Network will be the LAN IP
The Second Network will be Tunnel IP from Router 1 to Router 2
The Third Network will be the Tunnel IP from Router 1 to Router 3
interface tunnel 0
description GRE Tunnel To Router 2
ip address 192.168.200.1 255.255.255.0
tunnel source 12.34.56.2
tunnel destination 23.45.67.2
interface tunnel 2
Description Tunnel To Router R3
ip address 192.168.201.1 255.255.255.0
tunnel source 12.34.56.2
tunnel destination 34.56.78.2
router eigrp 100
no auto summary
network 192.168.1.0
network 192.168.200.0
network 192.168.201.0
Before Tunnels are established..
Router1#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 12.34.56.1 to network 0.0.0.0
C 192.168.200.0/24 is directly connected, Tunnel0
C 192.168.201.0/24 is directly connected, Tunnel2
12.0.0.0/30 is subnetted, 1 subnets
C 12.34.56.0 is directly connected, Serial0/0
C 192.168.1.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 12.34.56.1
Router1#
**************************************************************************************
Sho ip route state after Tunnels is established
**************************************************************************************
Router1#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 12.34.56.1 to network 0.0.0.0
C 192.168.200.0/24 is directly connected, Tunnel0
C 192.168.201.0/24 is directly connected, Tunnel2
12.0.0.0/30 is subnetted, 1 subnets
C 12.34.56.0 is directly connected, Serial0/0
C 192.168.1.0/24 is directly connected, FastEthernet1/0
D 192.168.2.0/24 [90/297246976] via 192.168.200.2, 00:02:51, Tunnel0
S* 0.0.0.0/0 [1/0] via 12.34.56.1
Router1#
*************************************************************************************
Now we need to connect to Router R2 and configure R2 as shown Below:
**************************************************************************************
R2
interface tunnel 0
description GRE Tunnel To Router 1
ip address 192.168.200.2 255.255.255.0
tunnel source 23.45.67.2
tunnel destination 12.34.56.2
exit
router eigrp 100
no auto summary
network 192.168.2.0
network 192.168.200.0
Router2#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 23.45.67.1 to network 0.0.0.0
23.0.0.0/30 is subnetted, 1 subnets
C 23.45.67.0 is directly connected, Serial0/0
C 192.168.2.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 23.45.67.1
Router2#
*****************************************************************************************************
Show ip route state after Tunnels are established
*****************************************************************************************************
Router2#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 23.45.67.1 to network 0.0.0.0
23.0.0.0/30 is subnetted, 1 subnets
C 23.45.67.0 is directly connected, Serial0/0
C 192.168.200.0/24 is directly connected, Tunnel0
D 192.168.201.0/24 [90/310044416] via 192.168.200.1, 00:00:15, Tunnel0
D 192.168.1.0/24 [90/297246976] via 192.168.200.1, 00:00:15, Tunnel0
C 192.168.2.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 23.45.67.1
Router2#
****************************************************************************************
Now we need to connect to Router R2 and configure R2 as shown Below
****************************************************************************************
R3
interface tunnel 0
description GRE Tunnel To Router 1
ip address 192.168.201.2 255.255.255.0
tunnel source 34.56.78.2
tunnel destination 12.34.56.2
exit
router eigrp 100
no auto summary
network 192.168.3.0
network 192.168.201.0
****************************************************************************************
Show ip route state on R3 before Tunnel is established.
****************************************************************************************
Router3#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 34.56.78.1 to network 0.0.0.0
34.0.0.0/30 is subnetted, 1 subnets
C 34.56.78.0 is directly connected, Serial0/0
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 34.56.78.1
Router3#
****************************************************************************************
Show ip route state on R3 after Tunnel is established.
****************************************************************************************
Router3#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 34.56.78.1 to network 0.0.0.0
34.0.0.0/30 is subnetted, 1 subnets
C 34.56.78.0 is directly connected, Serial0/0
D 192.168.200.0/24 [90/310044416] via 192.168.201.1, 00:00:14, Tunnel0
C 192.168.201.0/24 is directly connected, Tunnel0
D 192.168.1.0/24 [90/297246976] via 192.168.201.1, 00:00:14, Tunnel0
D 192.168.2.0/24 [90/310046976] via 192.168.201.1, 00:00:14, Tunnel0
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 34.56.78.1
Router3#
Wednesday, December 23, 2009
OSPF in my own words
OSPF is a link state protocol, it does not exchange routes and metrics. The only thing that OSPF exchanges is the state of it's link and the cost associated with the link. As link state advertisement arrives from OSPF neighbors, the OSPF routers perform a series of computation on the LSA's and this gives the OSPF router a complete picture of the Network.
Shortest path first Algorithm(SPF). This is the series of computation performed by OSPF routers on received link state advertisement. Once the computation is complete, the result is what you see when you execute the command:
#Show ip ospf database
Before any LSA's adjencency is formed a neighbour relationship must be formed or must be discovered, LSA's are only sent if there is a change in the link status.
Shortest path first Algorithm(SPF). This is the series of computation performed by OSPF routers on received link state advertisement. Once the computation is complete, the result is what you see when you execute the command:
#Show ip ospf database
Before any LSA's adjencency is formed a neighbour relationship must be formed or must be discovered, LSA's are only sent if there is a change in the link status.
Tuesday, October 13, 2009
Running GNS3 0.6.1 on Mac OS X
GNS3 0.6.1 on Mac OS X
Below is the Steps required to install and run GNS 0.6.1.
Here is the Step by step guide.
Method 1.
1. Install the Apple Devs Tools (on your Mac OS X DvD or download it on ADC account).
2. Download python 2.5.1 (or higher) for MacOS X on http://www.python.org/download/ and install it.
3. Download qt-mac-opensource-4.3.4.dmg on http://trolltech.com/developer/downloads/qt/mac and install it.
4. Download SIP http://www.riverbankcomputing.com/Downloads/sip4/sip-4.7.tar.gz, compile and install it.
5. Download PyQt hhttp://www.riverbankcomputing.com/Downloads/PyQt4/GPL/PyQt-mac-gpl-4.3.tar.gz, compile and install it.
6. Start GNS3.
Method 2.
Download the DMG package, it includes two binary versions of Dynamips: one for OSX Tiger and the other for OSX Leopard.
Obviously Method 2 is out of the question. Method 1 is also a bit unclear for people with no compiling experience.
Let’s start from the top.
1. Install the Apple Devs Tools (on your Mac OS X DvD or download it on ADC account).
If you don’t have an ADC account, Use your Leopard DVD if you have any. Open the Optional Installs folder and you will see the Xcode Tools folder. In that folder, run and install XcodeTools.mpkg.
2. Download python 2.5.1 (or higher) for MacOS X on http://www.python.org/download/ and install it.
This step is pretty straightforward. Download, mount, and install from the .dmg file. For reference, I grabbed the 2.6.2 disc image.
3. Download qt-mac-opensource-4.3.4.dmg on http://trolltech.com/developer/downloads/qt/mac and install it.
The link is no longer active, but a quick google search yielded a few download sources. I grabbed qt-mac-opensource-4.3.4 from here. http://www.python.org/ftp/python/2.6.2/python-2.6.2-macosx2009-04-16.dmg"
Again, mount and install from the .dmg disk image.
4. Download SIP http://www.riverbankcomputing.com/Downloads/sip4/sip-4.7.tar.gz, compile and install it.
Unfortunately, all the riverbankcomputing.com links in the README are invalid. This is where I grabbed sip 4.7. http://service-spi.web.cern.ch/service-spi/external/tarFiles/sip-4.7.tar.gz
After downloading the file, we come to the fun part.
Open terminal and cd into the folder you downloaded the tar file and compile via the following commands:
Macintosh:$ tar xvzf sip-4.7.tar.gz
Macintosh:$ cd sip-4.7
Macintosh:sip-4.7$ python configure.py
Macintosh:sip-4.7$ make
Macintosh:sip-4.7$ make installHopefully everything ran smoothly and installed without a hitch.
5. Download PyQt hhttp://www.riverbankcomputing.com/Downloads/PyQt4/GPL/PyQt-mac-gpl-4.3.tar.gz, compile and install it.
I couldn’t find 4.3, so I downloaded 4.3.1 from here.
Again, run the following commands to decompress and compile PyQt.
Macintosh:$ tar xvzf PyQt-mac-gpl-4.3.1.tar.gz
Macintosh:$ cd PyQt-mac-gpl-4.3.1
Macintosh:PyQt-mac-gpl-4.3.1$ python configure.py
Macintosh:PyQt-mac-gpl-4.3.1$ make
Macintosh:PyQt-mac-gpl-4.3.1$ make installPretty simple and it should look a lot like step 4.
We’re now in the home stretch.
6. Start GNS3.
Grab the tar from the GNS3 homepage. We have one last step here, which is basically just decompressing the tar file.
Macintosh:$ tar xvzf GNS3-0.6.1-src.tar.gzThat’s it. We’re done! If you look in the folder you just created, you will see a GNS3 executable. Run it and GNS3 will launch.
What’s great is it pulled all my settings from GNS3-0.5 so I did not have to mess with configuring and setting up directories, idle values, etc.
I hope this has been useful and let me know if anything is unclear.
Below is the Steps required to install and run GNS 0.6.1.
Here is the Step by step guide.
Method 1.
1. Install the Apple Devs Tools (on your Mac OS X DvD or download it on ADC account).
2. Download python 2.5.1 (or higher) for MacOS X on http://www.python.org/download/ and install it.
3. Download qt-mac-opensource-4.3.4.dmg on http://trolltech.com/developer/downloads/qt/mac and install it.
4. Download SIP http://www.riverbankcomputing.com/Downloads/sip4/sip-4.7.tar.gz, compile and install it.
5. Download PyQt hhttp://www.riverbankcomputing.com/Downloads/PyQt4/GPL/PyQt-mac-gpl-4.3.tar.gz, compile and install it.
6. Start GNS3.
Method 2.
Download the DMG package, it includes two binary versions of Dynamips: one for OSX Tiger and the other for OSX Leopard.
Obviously Method 2 is out of the question. Method 1 is also a bit unclear for people with no compiling experience.
Let’s start from the top.
1. Install the Apple Devs Tools (on your Mac OS X DvD or download it on ADC account).
If you don’t have an ADC account, Use your Leopard DVD if you have any. Open the Optional Installs folder and you will see the Xcode Tools folder. In that folder, run and install XcodeTools.mpkg.
2. Download python 2.5.1 (or higher) for MacOS X on http://www.python.org/download/ and install it.
This step is pretty straightforward. Download, mount, and install from the .dmg file. For reference, I grabbed the 2.6.2 disc image.
3. Download qt-mac-opensource-4.3.4.dmg on http://trolltech.com/developer/downloads/qt/mac and install it.
The link is no longer active, but a quick google search yielded a few download sources. I grabbed qt-mac-opensource-4.3.4 from here. http://www.python.org/ftp/python/2.6.2/python-2.6.2-macosx2009-04-16.dmg"
Again, mount and install from the .dmg disk image.
4. Download SIP http://www.riverbankcomputing.com/Downloads/sip4/sip-4.7.tar.gz, compile and install it.
Unfortunately, all the riverbankcomputing.com links in the README are invalid. This is where I grabbed sip 4.7. http://service-spi.web.cern.ch/service-spi/external/tarFiles/sip-4.7.tar.gz
After downloading the file, we come to the fun part.
Open terminal and cd into the folder you downloaded the tar file and compile via the following commands:
Macintosh:$ tar xvzf sip-4.7.tar.gz
Macintosh:$ cd sip-4.7
Macintosh:sip-4.7$ python configure.py
Macintosh:sip-4.7$ make
Macintosh:sip-4.7$ make installHopefully everything ran smoothly and installed without a hitch.
5. Download PyQt hhttp://www.riverbankcomputing.com/Downloads/PyQt4/GPL/PyQt-mac-gpl-4.3.tar.gz, compile and install it.
I couldn’t find 4.3, so I downloaded 4.3.1 from here.
Again, run the following commands to decompress and compile PyQt.
Macintosh:$ tar xvzf PyQt-mac-gpl-4.3.1.tar.gz
Macintosh:$ cd PyQt-mac-gpl-4.3.1
Macintosh:PyQt-mac-gpl-4.3.1$ python configure.py
Macintosh:PyQt-mac-gpl-4.3.1$ make
Macintosh:PyQt-mac-gpl-4.3.1$ make installPretty simple and it should look a lot like step 4.
We’re now in the home stretch.
6. Start GNS3.
Grab the tar from the GNS3 homepage. We have one last step here, which is basically just decompressing the tar file.
Macintosh:$ tar xvzf GNS3-0.6.1-src.tar.gzThat’s it. We’re done! If you look in the folder you just created, you will see a GNS3 executable. Run it and GNS3 will launch.
What’s great is it pulled all my settings from GNS3-0.5 so I did not have to mess with configuring and setting up directories, idle values, etc.
I hope this has been useful and let me know if anything is unclear.
Monday, October 12, 2009
VLAN
Learn How to configure Cisco Routers
How to configure Router on a Stick aka 802.1q This is a Cisco Web Blog that will help you learn how to Design, Configure and Manage a Cisco router.
The first technology that we are going to try and master will be VLAN.
I guess the best way to start learning about VLAN is from configuring Router on a Stick.
Before you can configure Router on a Stick you need to know what a VLAN is
What is VLAN ?
What is Vlan and what does it mean to a non technical person ?. VLAN stands for Virtual Local Area Network. It's a way of virtually separating a switch physical ports into different Logical Networks an each Nework behaving as if they were configured on a different Logical Switch.
The diagram above shows 2 VLANS configured on a switch connected to a router. This is known as Router on a Stick. This Layer 2 Cisco switch carries two VLANs (VLAN 10 – RED and VLAN 20 – GREEN) with two hosts connected on them as shown on the diagram above. The first host belongs to Network 10.10.10.0/24 (VLAN10) and the second one to 20.20.20.0/24 (VLAN20). By default, if the switch is just a normal Layer 2 switch the two hosts can not communicate between them because they belong to different VLANs and there is no routing between the 2 VLANS.Howevere, if we want to provide network connectivity between the two VLANs we need to have a Layer 3 device somewhere in the network. We can either do this with a layer 3 switch or a router. In this example I will use a router to provide Layer 3 connectivity as shown in our diagram.
The router uses just a single interface connected to a trunk port on the switch. The Router interface can be divided into two subinterfaces, with each subinterface belonging to the appropriate VLAN. The switch port connected to the router must be a trunk in order to be able to carry both VLANs towards the router port. Lets see the configuration below:
SWITCH CONFIGURATION
(config)# vlan database
(config-vlan)# vlan 10 name RED
(config-vlan)# vlan 20 name GREEN
(config-vlan)# exit
(config)# interface FastEthernet1/0/1
(config-if)# description trunk-to-router-on-a-stick
(config-if)# switchport trunk encapsulation dot1q
(config-if)# switchport mode trunk
(config-if)# exit
(config)# interface FastEthernet1/0/2
(config-if)# description connection-to-RED-VLAN
(config-if)# switchport mode access
(config-if)# switchport access vlan 10
(config-if)# exit
(config)# interface FastEthernet1/0/3
(config-if)# description connection-to-GREEN-VLAN
(config-if)# switchport mode access
(config-if)# switchport access vlan 20
(config-if)# exit
(config)# exit
# copy run start
ROUTER CONFIGURATION
# conf t
(config)# interface fastethernet 0/0.10
(config-if)# encapsulation dot1q 10
(config-if)# ip address 10.10.10.2 255.255.255.0
(config-if)# exit
(config)# interface fastethernet 0/0.20
(config-if)# encapsulation dot1q 20
(config-if)# ip address 20.20.20.2 255.255.255.0(
config-if)# exit
Now, in order for the two hosts to communicate between them, they must set as default gateway the IP address of the corresponding router subinterface address (e.g for host in VLAN 10 the gateway must be 10.10.10.2 and for host in VLAN 20 the gateway must be 20.20.20.2).
What is a Trunk ?
A trunk according to Cisco is a link that can carry frames for more than one VLAN
at once. A trunk can also be used to connect two switches so that devices in either VLAN can talk to device in the second switch in the same VLAN. When we talk about VLAN in most intances we are talking about Switches, However, Routers's can also connect to VLAN'S as Mentioned above (Router on a Stick).