LAB 3 VOLUME 4 Notes:

Ticket 1 – RIPv2

• Fix the issue preventing R6 from learning RIPv2 prefixes from BB1.
• Do not change the IP addressing on R6 to resolve this problem.

-Know the scope of the problem.
-Check RIP running config first. Check interfaces running RIP.
-Check interface status up/down
-Check Layer 2 parameters, do ping test.
-PPP can be stuck in LCP exchange, check any authetication issue.
-This ticket is not directly related RIP but rather related to L2 PPP issue on the Serial link running RIP.
-Enable logging console and logging buffered

debug ppp negotiation – Look for “Authentication Failure” for hints.
show ip protocols
show ip route rip
show interface x/x
show frame-relay pvc yyy
show interface virtual-access x | i PPP|packets

Ticket 2 – BGP Peering

• The BGP session between R6 and SW2 is not coming up for some
reason.
• Find what might be causing this and fix the problem applying minimal
changes.

-BGP check – Remember BGP is a layer 4
-Underlying issue maybe related to switch trunking or any layer2 issue.
-Make sure the layer 2 is intact.
-Mark all access and trunk links.
-If using DTP (no switchport noneg) make sure VTP names and password are consistent, else trunks using DTP will not come up.
-Checking of logs is very critical, make sure to familiarized log checking.
-This case is not directly related to any BGP process or layer 4 issue, but rather some layer 2 trunking issue.
-Check BGP decent running config.

show spanntree vlan xxx
show interface fx/x switchport | i Mode
show vtp status
show ip bgp summary.

Ticket 3 – Backup Link

• Users on VLAN42 report terrible performance when connecting the
servers on VLAN5.
• You suspect that the problem is that packets are taking suboptimal path across the backup ISDN link between the two sites.
• Restore optimal performance and ensure the primary path over Frame-Relay cloud is being used.

-This setup is a dual link via Serial p2p and Serial frame-relay ckt.
-FR is down. Check for FR configuration, proper DLCI assignment.
-Check EEK.
-Check OSPF neighbor
-EEK is applied via a map-class, make sure it is consisted on both ends.

debug interface xx
debug ip ospf adj
show ip protocols
show interface xx | i LMI
show frame pvc xxx | s UNUSED
show frame-relay pvc | i DELETED

Ticket 4 – Network Optimization

This ticket requires Tickets 1 and 2 resolved prior to starting.
• After a recent merge process, some networks have been joined together.
• In order to provide end-to-end connectivity, mutual redistribution has been configured between RIP and OSPF on R1, R2, R3, R4 and SW1.
• However, the straight-forward configuration approach resulted in network instabilities and sub-optimal routing.
• Fix the network configuration to ensure optimal routing, which means
using high-speed links (Ethernet and Frame-Relay) for primary data paths.
• The routers behind R5 should receive a single default route to reach the rest of the network.
• R4 may still use the Serial link to reach the networks behind R5.

-Redistribution issue.
A. layout 1

RIP-R2–OSPF—-R1—–OSPF—-R3—
|        |
|__RIP-SW2-RIP__|

Beware of layout 1 when doing mutual redistribution  on all router involved (R1, R2, R3,SW2). The ospf and RIP domain will by default will looped back.

N: At R2 make rip distance lesser than OSPF (e.g. distance 109 – router rip)

B. Redistribution troubleshooting technique.

-Shut down some interfaces to make the topology simple. Check whether you can get expected routes from the neighboring routers.
-Check for filtering in or out direction on the 1. interface, routing process.
-Alternative to bumping up AD of OSPF versus RIP, you can bump down RIP AD targeting only from a specific neighbor.

e.g.

router rip
distance 109 x.x.x.x 0.0.0.0
x.x.x.x is the neighbor.

-this makes routes from neighbor x.x.x.x to have a better distance learned from OSPF.

or it is usually like this:

router ospf 1
distance ospf external 121
! or
distance 110 x.x.x.x 0.0.0.0
! or
router ospf 1
redistribute rip metric 10000 subnets <<<<<<<makes sure the the redistributed routes to OSPF has a worse metric.

General Rule in Redistribution:

1. Native prefixes for one protocol should be reached via this protocol, can have the best metric against others.
2. External prefixes should have AD that is worse than the  AD of the native prefixes from different protocol.
3. When injecting external information into a protocol, assign it a high metric value to make is less preferred.
4. You can safely generate default route for stub domains but watch out and do filter of this default if needed.

Redistribution commandments notes:

1. ospf to eigrp -> 110 to 170 -> ok
2. eigrp to ospf->  90 to 110 -> ok
3. eigrp(external) to ospf -> 170 to 110 <<<– problem here, not ok, watch out!
4. lower AD wins

TECHNIQUES:

1. route tagging
2. route summarization
3. distance

To the following with redistributing:

1. Check first all native routes per router.
2. Check all external routes per protocol type, perrouter.
3. Think of the redistribution commandments.
4. Can make ospf acts like EIGRP on dealing with external prefixes. (distance ospf external 171)
5. Bump up or bump down certain prefixes. (external or internal).
6. The distance of external EIGRP cannot be changed on a per prefix basis.
7. ping the destination using the source IP address interface on different network
8. debug ip packet detail with an ACL (ACL is permit icmp from any to any or host)
9. Adjust default AD of IGP. RIP->109, OSPF= 121, OSPF External = 171, ospf = 89, depends on the situation and requirments.

Watchout on the following with redistributing.

1. route feedback.
2. manually tag the route with higher AD with put into the redistributed towards the lower AD.
3. lockdown pre-redistribution externals to equal to the native AD (e.g. distance 110 0.0.0.0 255.255.255.255  ACL_EXTERNAL_ALREADY
4. The rest of new routes coming is can be bump up (distance ospf external 171)
5. Item 3,4 are OSPF and EIGRP samples.

-debug ip routing
-show ip route xxx
-show ip rip data
-show ip ospf topology

Ticket 5 – Server Farm

• Two new servers have been recently connected to SW1 port 0/18 and SW2 port 0/19 respectively.
• For the lab purpose, the servers are emulated by L3 ports in SW3 and SW4 respectively.
• The following is the configuration policy for the server block:
o The new servers are assigned to the subnet 192.10.X.0/24
o To ensure security, the servers should not be able to communicate directly.
o The servers should be able to reach and communicate via R4.
• However, the configuration appears to be incomplete, as servers cannot reach to each other.
• Ensure the connectivity via R4 and verify it by using IP addresses assigned to the switchports of SW3 and SW4.

-This case is related to private vlan configurations.

show interface f0/x switchport | i private-vlan
show interface trunk
show vlan id
show ip interface f0/xx | i arp

Ticket 6 – BGP

• AS254 and AS54 cannot exchange routes across AS 100, AS 200 and AS 300.
• Applying changes to BGP configurations only, restore the end-to-end connectivity.
• Do not apply any changes to AS 300 routers to accomplish this.
• The ticked will be resolved when AS 54 and AS 254 could see each other’s routes.

-External BGP loop prevention mechanism uses AS-PATH information.
-The use local-as on the source AS will generate the AS path information.
-Use allowas-in on the far receiving end
-Make user no other L2/L3 issue exist. IGP should be stable at this time. No routing loops occured.
-Check for IBGP relationships and watch out for route-refrelector requirments.

show ip bgp regexp _
show ip bgp neig xxx advertise-routes
show ip bgp sum
show ip bgp neig | i state|neighbor|index|update-group|reflec
show ip bgp update-group

Ticket 7 – L2VPN

• You have tasked a junior system administrator to configure an L2VPN tunnel between VLAN64 and VLAN46 interfaces of R6 and R4.
• Some time after this, he reported that the configuration has been done, but there are some issues preventing it from working properly.
• Find and resolve the issues preventing the Layer 2 VPN tunnel from coming up.

-Watch out for inconsistend ckt id name. Ckt id should be the same on both ends.

show vpdn tunnel
show vpdn session
show l2tun session all
show sss circuits

Ticket 8 – L2VPN Issues

• The Frame-Relay connection between R1 and R2 has been recently replaced with L2 VPN. Soon after this, users on VLAN263 started complaining that they cannot download files from the servers on VLAN42.
• They still could use telnet and ssh to access the servers though.
• Suspecting that this may be caused by Path MTU discovery failures, you configured a workaround by clearing DF bit on all TCP packets received by R2 on its VLAN263 interface.
• However, this does not seem to help and the problem persists. Find the solution to this problem that works for all types of network traffic.

-Do ping test with oversized packet to check fragmentation issues.
-Fragments per packet is controlled by VFR – ip virtual-reassembly max-fragments x command.
-Using ip tcp adjust-mss will keep the router to modify and MSS field in TCP packet header.  MSS is 40 bytes less than the MTU. Only for TCP.
-IP virtual-reassembly, use to set max amount of fragmented packets

There are basically few ways to filter fragmented packets:
1) Using an access-group applied to an interface.
2) Using a policy-map that routes fragmented traffic to Null0.
3) Using a service-policy that drops fragments.
4) Configuring IP virtual-reassembly on interface.
5) Using IOS IPS to drop fragmented traffic.
6) Using CoPPr or Control-Plane policing to restrict packets going to the router.

show ip virtual-reassembly | i Fragments
show ip int xx | i list
show ip ips all
show ip policy

Ticket 9 – NTP

• You have recently re-loaded the configuration for R3 and R4 using the backup copies and soon after that discovered the logging timestamps went wrong.
• You know that NTP has been used for time synchronization on R3 and R4.
• R5 was supposed to be the NTP master for R3 and R4.
• You may assume that R5 is configured correctly and fix the issues in R3 and R4.

-NTP key should match on Server and client.
-Use key chain to decrypt md5 hash on same router.
-if the master NTP server is using ACLS on the peers and clients make sure the clients and peers are allowed on the ACL. Make sure NTP source is allowed.
-NTP authentications need to do “ntp authenticate” command
-NTP key should be manually trusted.

show ntp status
show ntp ass detail

Ticket 10 – Internet Access

• After the recent security policy changes users on VLAN5 started complaining they cannot reach YouTube videos anymore.
• Asking a few questions you found that uses cannot access any other WWW sites as well.
• After a short investigation you found that the uplink used to reach the YouTube website is via BB1.
• Talking to the users you found that only HTTP is being affected, FTP downloads work well.
• Applying minimal changes to the network configuration resolve this problem and restore WWW connectivity.

-Related to WWW access only. Described that FTP traffic is not affected.
-Not Path MTU issue.
-Watch out for TOS value is matched and on the route-map is set to drop it to null0 interface.
-The DF bit can be cleared using route-map. set ip df 0.

-Check MTU issue
-Check local policy-map
-Check ip ips
-Check route-maps applied to the interface, make sure it is not dropping it.
-enable http server on each router as a test to web traffic.

ip http server
ip http path flash:
copy http://x.x.x.x/test null:
sho ip policy
show ip ips all
show ip int virtual-access x | i access

There is sometimes confusion between the two Border Gateway Protocol (BGP) configuration commands bgp deterministic-med and bgp always-compare-med. This document explains the differences in how the bgp deterministic-med and bgp always-compare-med commands can affect Multi Exit Discriminator (MED)-based path selection and how each command changes the behavior of BGP when choosing a best route.
Prerequisites
Requirements

There are no specific requirements for this document.
Components Used

The information in this document is based on the Cisco IOS® Software Release 12.2(10b).

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.
Background Information

There are two BGP configuration commands that can influence the MED-based path selection, the bgp deterministic-med and the bgp always-compare-med commands.

Enabling the bgp deterministic-med command ensures the comparison of the MED variable when choosing routes advertised by different peers in the same autonomous system. Enabling the bgp always-compare-med command ensures the comparison of the MED for paths from neighbors in different autonomous systems. The bgp always-compare-med command is useful when multiple service providers or enterprises agree on a uniform policy for setting MED. Thus, for network X, if Internet Service Provider A (ISP A) sets the MED to 10, and ISP B sets the MED to 20, both ISPs agree that ISP A has the better performing path to X.

Note: The bgp deterministic-med and bgp always-compare-med commands are not enabled by default. Also, the two commands are separate; enabling one does not automatically enable the other.
Command Examples

The examples in this section demonstrate how the bgp deterministic-med and bgp always-compare-med commands can influence MED-based path selection.

Note: Cisco Systems recommends enabling the bgp deterministic-med command in all new network rollouts. For existing networks, the command must either be deployed on all routers at the same time, or incrementally, with care to avoid possible internal BGP (iBGP) routing loops.

For example, consider the following routes for network 10.0.0.0/8:

entry1: AS(PATH) 500, med 150, external, rid 172.16.13.1
entry2: AS(PATH) 100, med 200, external, rid 1.1.1.1
entry3: AS(PATH) 500, med 100, internal, rid 172.16.8.4

The order in which the BGP routes were received is entry3, entry2, and entry1. (Entry3 is the oldest entry in the BGP table, and entry1 is the newest one.)

Note: When BGP receives multiple routes to a particular destination, it lists them in the reverse order that they were received, from the newest to the oldest. BGP then compares the routes in pairs, starting with the newest entry and moving toward the oldest entry (starting at top of the list and moving down). For example, entry1 and entry2 are compared. The better of these two is then compared to entry3, and so on.
Example 1: Both Commands Disabled

Entry1 and entry2 are compared first. Entry2 is chosen as the better of these two because it has a lower router ID. The MED is not checked because the paths are from a different neighbor autonomous system. Next, entry2 is compared to entry3. Entry2 is chosen as the best path because it is external.
Example 2: bgp deterministic-med Disabled, bgp always-compare-med Enabled

Entry1 is compared to entry2. These entries are from different neighbor autonomous systems, but since the bgp always-compare-med command is enabled, MED is used in the comparison. Of these two entries, entry1 is better because it has a lower MED. Next, entry1 is compared to entry3. The MED is checked again because the entries are now from the same autonomous system. Entry3 is chosen as the best path.
Example 3: bgp deterministic-med Enabled, bgp always-compare-med Disabled

When the bgp deterministic-med command is enabled, routes from the same autonomous system are grouped together, and the best entries of each group are compared. The BGP table looks like this:

entry1: AS(PATH) 100, med 200, external, rid 1.1.1.1
entry2: AS(PATH) 500, med 100, internal, rid 172.16.8.4
entry3: AS(PATH) 500, med 150, external, rid 172.16.13.1

There is a group for AS 100 and a group for AS 500. The best entries for each group are compared. Entry1 is the best of its group because it is the only route from AS 100. Entry2 is the best for AS 500 because it has the lowest MED. Next, entry1 is compared to entry2. Since the two entries are not from the same neighbor autonomous system, the MED is not considered in the comparison. The external BGP route wins over the internal BGP route, making entry1 the best route.
Example 4: Both Commands Enabled

The comparisons in this example are the same as in Example 3, except for the last comparison between entry2 and entry1. The MED is taken into account for the last comparison because the bgp always-compare-med command is enabled. Entry2 is selected as the best path.

One of the issues facing network and security engineers is defending the network against dynamic threats. This means traffic that cannot easily be identified by regular means, such as an application that changes layer 4 ports or tunnels within an existing protocol. Because of this, a solution is needed to match and filter based on specific information within the packet that is unique to the application you want to block.

Enter “Flexible Packet Matching”, otherwise known as FPM. FPM works by loading XML files called “Protocol Header Description Files” that define fields within the protocol header: IP, TCP, UDP, ICMP, etc…. Once defined, information within the fields can be matched and acted on using MQC.

As a simple example, we’re going to allow ICMP but block echo requests that come from 192.168.9.10 with a length greater than 500.

To enable FPM, you need to first load the PHDFs for the protocol stack you’ll be working with. We’ll be using ETHER, IP and ICMP, so those files are loaded with the “load” command:

load protocol system:/fpm/phdf/ether.phdf
load protocol system:/fpm/phdf/ip.phdf
load protocol system:/fpm/phdf/icmp.phdf

Next you have to tell FPM the correct protocol stack to examine. This is done with a class-map type stack. Notice that we start at layer 2, match the ethertype for IP, then move to layer 3, matching IP protocol 1 or ICMP.

class-map type stack match-all IP_ICMP
stack-start l2-start
match field ether type eq 0×800 next IP
match field layer 3 IP protocol eq 1 next ICMP

With the stack defined, we’re now free to match the specific information we’re after, FPM uses “class-map type access-control”.

class-map type access-control match-all BAD_ICMP
match field icmp type eq 8
match field ip source-addr eq 10.6.6.6
match field ip length gt 500

Now we’ll create a “policy-map type access-control” to drop any traffic that is a part of this class. This policy map is then nested within another policy map that matches our previously defined protocol stack. It is then applied to the interface:

policy-map type access-control DROP_BAD_ICMP
class BAD_ICMP
drop
policy-map type access-control FPM
class IP_ICMP
service-policy DROP_BAD_ICMP
!
int fa0/1
service-policy type access-control input FPM

Verification is simple. First we’ll ping from a router with an interface IP of 192.168.2.10 with no options:

R2# ping 10.6.6.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.6.6.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 50/58/60 ms

The ping is successful as expected. It matches the stack, ICMP type and source address, but not the size. Now we can repeat the ping, upping the size:

R2# ping 10.6.6.6 size 1000
Type escape sequence to abort.
Sending 5, 1000-byte ICMP Echos to 10.6.6.6, timeout is 2 seconds:
….
Success rate is 0 percent (0/5)

This time the packets were dropped. We can further verify by checking the policy-map on the router using FPM. Notice that we have lots of packets matching the stack class-map, but only our 5 echo requests were dropped:

R1#sho policy-map type access-control interface
FastEthernet0/1

Service-policy access-control input: FPM

Class-map: IP_ICMP (match-all)
136 packets, 15468 bytes
5 minute offered rate 0 bps
Match: field ETHER type eq 0×800 next IP
Match: field layer 3 IP protocol eq 1 next ICMP

Service-policy access-control : DROP_BAD_ICMP

Class-map: BAD_ICMP (match-all)
5 packets, 5070 bytes
5 minute offered rate 0 bps
Match: field ICMP type eq 8
Match: field IP length gt 500
Match: field IP source-addr eq -1062729462
drop

This is a fairly basic example that is easy to verify and learn with. FPM can be much more detailed, even going so far as to match specific strings within the data payload itself. The preferred method of applying this in the field is to sniff the traffic you’re interested in, find something that is unique to this traffic and match based on it.

To All,

First of all I would like to apologize for the delay.

Secondly, please excuse any typos, I kind of rushed to get this out so you guys will enjoy the lab.

Once again there are no registrations, no sign-ins or any other requirements to download the lab.

Please go to

http://www.micronicstraining.com/classes/index.php?dispatch=categories.view&category_id=93

And then, click on *CCIE Routing and Switching Trouble Shooting Workbook* and then, click on *Download FREE sample chapter*.

Please let me know if you experience any problems.

The initial config file is also included. You need to have winrar to unzip the directory, it also includes the diagrams.

This lab is one of the 10 Troubleshooting Mock labs and hope it would NOT be a waste of your precious time. PLease go through and read the answers and see the steps that one has to go through to resolve a trouble ticket.

I have also included another FREE lab work book that you guys can download; it has 338 pages of good labs (They help reduce your blood pressure, whereas, the TS labs help reducing the cholestrol). You should see it there as well.

The security work book and the SP will be our next priority and they should be completed before the end of the year.

There will also be a FREE VOD on ZBFW, that should be finished within a week or so.

Enjoy and I hope to see you guys later.

–
Narbik Kocharians
CCSI#30832, CCIE# 12410 (R&S, SP, Security)
www.MicronicsTraining.com
Sr. Technical Instructor
YES! We take Cisco Learning Credits!

• Achieve Optimal Routing and Reduce BGP Memory Consumption
  28/Feb/2008
• BGP Best Path Selection Algorithm
  24/May/2006
• BGP Case Studies
  30/Oct/2008
• BGP Peer Groups
  30/Oct/2008
• BGP Policy Accounting and BGP Policy Accounting Output Interface Accounting Features
  29/Dec/2005
• Configuring a Gateway of Last Resort Using IP Commands
  10/Aug/2005
• Host and Subnet Quantities
  10/Aug/2005
• How BGP Routers Use the Multi-Exit Discriminator for Best Path Selection
  10/Aug/2005
• How Does Load Balancing Work?
  10/Aug/2005
• How the bgp deterministic-med Command Differs from the bgp always-compare-med Command
  10/Aug/2005
• How to Block One or More Networks From a BGP Peer
  11/May/2006
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• Removing Private Autonomous System Numbers in BGP
  10/Aug/2005
• Route Selection in Cisco Routers
  02/Jan/2008
• Route-Maps for IP Routing Protocol Redistribution Configuration
  10/Aug/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• The “%TUN-5-RECURDOWN” Error Message and Flapping EIGRP/OSPF/BGP Neighbors Over a GRE Tunnel
  10/Aug/2005
• Troubleshooting BGP
  01/Jan/2008
• Troubleshooting Flapping BGP Routes (Recursive Routing Failure)
  10/Aug/2005
• Troubleshooting High CPU Caused by the BGP Scanner or BGP Router Process
  25/Jul/2008
• Troubleshooting When BGP Routes Are Not Advertised
  24/Jul/2006
• Understanding Policy Routing
  10/Aug/2005
• Understanding Redistribution of OSPF Routes into BGP
  10/Aug/2005
• Understanding Route Aggregation in BGP
  10/Aug/2005
• Using Regular Expressions in BGP
  10/May/2006
• Using the Extended ping and Extended traceroute Commands
  28/Jul/2006
• What Does the “#%BGP-3-INSUFCHUNKS: Insufficient chunk pools for aspath” Error Message Mean?
  12/Apr/2005
• What Is Administrative Distance?
  06/Mar/2007
• When Are ICMP Redirects Sent?
  24/Jun/2008
• Why Do BGP Neighbors Toggle Between Idle, Connect, and Active States?
  10/Aug/2005

• Host and Subnet Quantities
  10/Aug/2005
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006

• AppleTalk Module for EIGRP
  28/Jan/2008
• Configuration Notes for the Implementation of EIGRP over Frame Relay and Low Speed Links
  10/Aug/2005
• Configuring a Gateway of Last Resort Using IP Commands
  10/Aug/2005
• Filtering Routing Updates on Distance Vector IP Routing Protocols
  10/Aug/2005
• Host and Subnet Quantities
  10/Aug/2005
• How Does Load Balancing Work?
  10/Aug/2005
• How Does the Passive Interface Feature Work in EIGRP?
  28/Mar/2005
• How Does Unequal Cost Path Load Balancing (Variance) Work in IGRP and EIGRP?
  03/Jun/2009
• Introduction to EIGRP
  10/Aug/2005
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• OSPF and EIGRP Neighbor Loss, RIP and IGRP Update Loss after Upgrading to Cisco IOS 11.2 or Later
  01/Jan/2008
• Preventing Duplicate EIGRP Router IDs
  18/Jan/2008
• Redistributing Between Classful and Classless Protocols: EIGRP or OSPF into RIP or IGRP
  10/Aug/2005
• Redistributing Routing Protocols
  07/Sep/2006
• Route Selection in Cisco Routers
  02/Jan/2008
• Route-Maps for IP Routing Protocol Redistribution Configuration
  10/Aug/2005
• Setting a Preferred Route by Influencing EIGRP Metrics
  10/Aug/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• The “%TUN-5-RECURDOWN” Error Message and Flapping EIGRP/OSPF/BGP Neighbors Over a GRE Tunnel
  10/Aug/2005
• Troubleshooting EIGRP
  21/Jul/2008
• Understanding IPX-EIGRP
  04/Oct/2005
• Understanding Policy Routing
  10/Aug/2005
• Using the Extended ping and Extended traceroute Commands
  28/Jul/2006
• What Does the EIGRP DUAL-3-SIA Error Message Mean?
  10/Aug/2005
• What Is Administrative Distance?
  06/Mar/2007
• When Are ICMP Redirects Sent?
  24/Jun/2008

• Configuring a Gateway of Last Resort Using IP Commands
  10/Aug/2005
• Host and Subnet Quantities
  10/Aug/2005
• How Does Load Balancing Work?
  10/Aug/2005
• Intermediate System-to-Intermediate System (IS-IS) TLVs
  10/Aug/2005
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• IS-IS Network Types and Frame Relay Interfaces
  10/Aug/2005
• IS-IS Route Leaking Overview
  13/May/2008
• MTU Mismatch Problem in IS-IS
  10/Aug/2005
• Redistributing Routing Protocols
  07/Sep/2006
• Route Selection in Cisco Routers
  02/Jan/2008
• Route-Maps for IP Routing Protocol Redistribution Configuration
  10/Aug/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• Understanding IS-IS Pseudonode LSP
  10/Aug/2005
• Understanding Policy Routing
  10/Aug/2005
• Uses of the Overload Bit with IS-IS
  25/Oct/2005
• Using the Extended ping and Extended traceroute Commands
  28/Jul/2006
• What Is Administrative Distance?
  06/Mar/2007
• When Are ICMP Redirects Sent?
  24/Jun/2008

• Behavior of RIP and IGRP When Sending and Receiving Updates
  10/Aug/2005
• Configuring a Gateway of Last Resort Using IP Commands
  10/Aug/2005
• Fast IGRP Details
  10/Aug/2005
• Filtering Routing Updates on Distance Vector IP Routing Protocols
  10/Aug/2005
• Host and Subnet Quantities
  10/Aug/2005
• How Does Load Balancing Work?
  10/Aug/2005
• How Does Unequal Cost Path Load Balancing (Variance) Work in IGRP and EIGRP?
  03/Jun/2009
• How Split Horizon Affects RIP/IGRP Routing Updates when Secondary Addresses Are Involved
  18/Aug/2005
• IGRP Metric
  10/Aug/2005
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• OSPF and EIGRP Neighbor Loss, RIP and IGRP Update Loss after Upgrading to Cisco IOS 11.2 or Later
  01/Jan/2008
• Redistributing Between Classful and Classless Protocols: EIGRP or OSPF into RIP or IGRP
  10/Aug/2005
• Redistributing Routing Protocols
  07/Sep/2006
• Route Selection in Cisco Routers
  02/Jan/2008
• Route-Maps for IP Routing Protocol Redistribution Configuration
  10/Aug/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• Understanding Policy Routing
  10/Aug/2005
• Using the Extended ping and Extended traceroute Commands
  28/Jul/2006
• What Is Administrative Distance?
  06/Mar/2007
• When Are ICMP Redirects Sent?
  24/Jun/2008
• Why Doesn’t RIP or IGRP Support Discontiguous Networks?
  10/Aug/2005
• Why Don’t RIPv1 and IGRP Support Variable-Length Subnet Mask?
  12/Aug/2005

• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• What Is Administrative Distance?
  06/Mar/2007

• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006

• Common Routing Problem with OSPF Forwarding Address
  29/Dec/2005
• Configuring a Gateway of Last Resort Using IP Commands
  10/Aug/2005
• Guide to OSPF Application on the CSS 11000
  03/May/2004
• Host and Subnet Quantities
  10/Aug/2005
• How Does Load Balancing Work?
  10/Aug/2005
• How Does OSPF Generate Default Routes?
  10/Aug/2005
• Initial Configurations for OSPF over Non-Broadcast Links
  29/Dec/2005
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• OSPF and EIGRP Neighbor Loss, RIP and IGRP Update Loss after Upgrading to Cisco IOS 11.2 or Later
  01/Jan/2008
• OSPF Demand Circuit Feature
  21/Jul/2005
• OSPF Neighbor Problems Explained
  10/Aug/2005
• OSPF Neighbor States
  10/Aug/2005
• OSPF Not-So-Stubby Area (NSSA)
  10/Aug/2005
• OSPF show Commands Respond Slowly
  10/Aug/2005
• Problems with Running OSPF in NBMA and Broadcast Mode over Frame Relay
  29/Dec/2005
• Redistributing Between Classful and Classless Protocols: EIGRP or OSPF into RIP or IGRP
  10/Aug/2005
• Redistributing Connected Networks into OSPF
  29/Dec/2005
• Redistributing Routing Protocols
  07/Sep/2006
• Route Selection in Cisco Routers
  02/Jan/2008
• Route-Maps for IP Routing Protocol Redistribution Configuration
  10/Aug/2005
• Scalable ISDN Backup Strategy for Large OSPF Networks
  25/May/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• Suboptimal Routing When Redistributing Between OSPF Processes
  01/Jan/2008
• The “%TUN-5-RECURDOWN” Error Message and Flapping EIGRP/OSPF/BGP Neighbors Over a GRE Tunnel
  10/Aug/2005
• The Effects of the Forwarding Address on Type 5 LSA Path Selection
  28/Mar/2005
• Troubleshooting Duplicate Router IDs with OSPF
  16/Mar/2007
• Troubleshooting OSPF
  15/Sep/2008
• Understanding Policy Routing
  10/Aug/2005
• Using the Extended ping and Extended traceroute Commands
  28/Jul/2006
• What Are OSPF Areas and Virtual Links?
  18/Dec/2005
• What Do %OSPF-4-ERRRCV Error Messages Mean?
  10/Aug/2005
• What Does the show ip ospf interface Command Reveal?
  10/Aug/2005
• What Does the show ip ospf neighbor Command Reveal?
  10/Aug/2005
• What Is Administrative Distance?
  06/Mar/2007
• When Are ICMP Redirects Sent?
  24/Jun/2008
• Why Are OSPF Neighbors Stuck in Exstart/Exchange State?
  10/Aug/2005
• Why Are Some OSPF Routes in the Database but Not in the Routing Table?
  15/Sep/2008
• Why Does the show ip ospf neighbor Command Reveal Neighbors in the Init State?
  10/Aug/2005
• Why Does the show ip ospf neighbor Command Reveal Neighbors Stuck in Two-Way State?
  10/Aug/2005
• Why Doesn’t OSPF Form Adjacency on a PRI, BRI, or Dialer Interface?
  10/Aug/2005
• Why Is the ip ospf interface-retry 0 Configuration Command Added to All Interfaces?
  01/Jan/2008
• Why OSPF Demand Circuit Keeps Bringing Up the Link
  10/Aug/2005

• Behavior of RIP and IGRP When Sending and Receiving Updates
  10/Aug/2005
• Configuring a Gateway of Last Resort Using IP Commands
  10/Aug/2005
• Filtering Routing Updates on Distance Vector IP Routing Protocols
  10/Aug/2005
• Host and Subnet Quantities
  10/Aug/2005
• How Does Load Balancing Work?
  10/Aug/2005
• How Split Horizon Affects RIP/IGRP Routing Updates when Secondary Addresses Are Involved
  18/Aug/2005
• ICMPv6 Packet Types and Codes
  10/Aug/2005
• IP Addressing and Subnetting for New Users
  26/Sep/2005
• OSPF and EIGRP Neighbor Loss, RIP and IGRP Update Loss after Upgrading to Cisco IOS 11.2 or Later
  01/Jan/2008
• Redistributing Between Classful and Classless Protocols: EIGRP or OSPF into RIP or IGRP
  10/Aug/2005
• Redistributing Routing Protocols
  07/Sep/2006
• Route Selection in Cisco Routers
  02/Jan/2008
• Route-Maps for IP Routing Protocol Redistribution Configuration
  10/Aug/2005
• Specifying a Next Hop IP Address for Static Routes
  30/Oct/2006
• Understanding Policy Routing
  10/Aug/2005
• Using the Extended ping and Extended traceroute Commands
  28/Jul/2006
• What Is Administrative Distance?
  06/Mar/2007
• When Are ICMP Redirects Sent?
  24/Jun/2008
• Why Doesn’t RIP or IGRP Support Discontiguous Networks?
  10/Aug/2005
• Why Don’t RIPv1 and IGRP Support Variable-Length Subnet Mask?
  12/Aug/2005

I found the above link from Cisco’s website very usefule.

Happy Labbing!

To find out more information regarding updates to the CCIE Lab and scoring format, please click here to go to the CCIE Q&A section.

Training session Webex Recordings

Cisco IOS Zone-Based Firewall Concept, Configuration, and Troubleshooting

https://ciscosupport.webex.com/ciscosupport/ldr.php?AT=pb&SP=MC&rID=1908767&rKey=af5f55c7874a225b

Cisco IOS Intrusion Prevention System Overview and Troubleshooting

https://ciscosupport.webex.com/ciscosupport/ldr.php?AT=pb&SP=MC&rID=1922807&rKey=22339b09e0dc96d0

Diagram:

R4-s0/1<<——–Serial-back-2-back———>>s0/1-R5

Question:

Configure PPP on the Serial connection between R4 and R5 using dialer
interfaces.

Answer:

R4 and R5

interface Serial0/1
no ip address
encapsulation ppp
dialer in-band
dialer pool-member 1
pulse-time 1

interface Dialer0
ip address 45.45.45.x 255.255.255.0
encapsulation ppp
dialer pool 1
dialer idle-timeout 0
dialer persistent
end

Routing Table:

C       45.45.45.x/32 is directly connected, Dialer0
C       45.45.45.0/24 is directly connected, Dialer0

R4#sh dialer

Se0/1 – dialer type = IN-BAND SYNC NO-PARITY
Dialer pool 1, priority 0
Idle timer (never), Fast idle timer (20 secs)
Wait for carrier (30 secs), Re-enable (15 secs)
Dialer state is data link layer up
Interface bound to profile Di0
Time until disconnect never
Connected to <unknown phone number> (<unknown phone number>)

Di0 – dialer type = DIALER PROFILE
Idle timer (never), Fast idle timer (20 secs)
Wait for carrier (30 secs), Re-enable (15 secs)
Dialer state is data link layer up
Number of active calls = 1

Dial String      Successes   Failures    Last DNIS   Last status

Trivia: PPP – I dont want the /32 in you.

We always see a /32 host route every time we use PPP. What if you dont like and want it? What

will you do?

Diagram:

R1-s0/1<<—–Serial-Connection——>s0/1-R2

Answer Configuration: use “no peer neighbor-route” interface command.

R1 and R2

interface Serial0/1
ip address 12.12.12.x 255.255.255.0
encapsulation ppp
no peer neighbor-route

Routing Table:

12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       12.12.12.0/24 is directly connected, Serial0/1
C       12.12.12.2/32 is directly connected, Serial0/1 <<<<< Get rid of this!

After:

Gateway of last resort is not set

12.0.0.0/24 is subnetted, 1 subnets
C       12.12.12.0 is directly connected, Serial0/1

Verification:

R1#ping 12.12.12.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.12.12.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/38/56 ms
R1# ping 12.12.12.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.12.12.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 52/68/120 ms
R1#

Show to know:

R1#sh int s0/1 | i Open
Encapsulation PPP, LCP Open
Open: IPCP, CDPCP, crc 16, loopback not set
R1#

That’s it!

• SW1 and SW2 should see each other as CDP neighbors via SW3
across the routed link that connects them.

Diagram:

SW1———-f0/1–SW3–f0/2———SW2

Answer:

SW2:

interface FastEthernet0/1
l2protocol-tunnel cdp
no cdp enable

interface FastEthernet0/2
l2protocol-tunnel cdp
no cdp enable

That’s it!