Oct
17

For Part 2 of this series - click here.

WARNING: You must master subnetting using our course or some other trusted materials before you start using these shortcut approaches. It is a common issue for Cisco candidates to move directly to subnetting shortcuts for the exams without fully understanding exactly how subnetting functions.

ICND1 (CCENT)

Question 3: Your co-worker has decided upon use of the 172.16.0.0 address space for a section of your network. This section requires 15 subnets. What subnet mask will you recommend?

Step 1: I reference the Powers of Two chart I created on my scratch paper when I encountered the first question. The forumla for the number of subnets you can create based on subnet bits is 2^s. From the chart I see if we "borrow" 4 bits we can create 16 subnets.

2^7=128  |  2^6=64  |  2^5=32  |  2^4=16  |  2^3=8  |  2^2-=4 | 2  ^1=2  |  2^0=1

Step 2: Borrowing 4 bits beyond the Class B boundary results in 255.255.128+64+32+16 = 240. Our mask is 255.255.240.0.

Oct
14

Click here for Part 1 of this series.

WARNING: You must master subnetting using our course or some other trusted materials before you start using these shortcut approaches. It is a common issue for Cisco candidates to move directly to subnetting shortcuts for the exams without fully understanding exactly how subnetting functions.

ICND1 (CCENT)

Question 2: You have run the ipconfig command and discovered your IP address and mask are 192.168.20.102 and 255.255.255.224. How many hosts are permitted on your subnet?

Step 1: I reference the Powers of Two chart I created on my scratch paper when I encountered the first question. Adding 128 + 64 + 32 = 224. There are 3 bits used for subnetting and that leaves 5 bits for hosts.

2^7=128  |  2^6=64  |  2^5=32  |  2^4=16  |  2^3=8  |  2^2-=4 | 2  ^1=2  |  2^0=1

Step 2: The equation for the number of hosts per subnet is 2^h - 2 where h is the number of host bits. From the chart I see that 2^5  = 32. 32-2 = 30 hosts per subnet! Too easy!

As always, let us know in the comments if you have a quicker approach.

Jun
05

One of community members found this great subnetting practice page. Enjoy!

Subnetting Practice Page

Nov
08

In this post, we will examine the steps required to ensure full reachability over a Serial interface between two Cisco routers. Here is the network diagram that presents the topology used in this scenario:

Network Diagram

When we are in a lab environment, we can simulate a wide area connection (WAN) between two routers using a simple crossover cable designed for our router interfaces. One end of the cable is the DTE (Data Terminal Equipment), and the other is the DCE (Data Circuit-terminating Equipment). The DTE end synchronizes the connection to the clock rate of the link that is provided by the DCE. Notice that C does not stand for Clock in DCE, but it is a nice way to remember what that function does! Think of the clock on the line like a metronome, setting the "tempo" of communications.

For our first task, we want to determine which router has the DCE connection. We will use the show controllers serial 0/0 command to do this.

R2>enable
R2#show controllers serial 0/0
Interface Serial0/0
Hardware is GT96K
DCE 530, clock rate 2000000
idb at 0x652EE7AC, driver data structure at 0x652F5ED0
wic_info 0x652F64D4
Physical Port 1, SCC Num 1
MPSC Registers:
...

The R2 device has the DCE end connected as we can see in the output from this command. Notice there is a bunch of output from this command we do not need, so I omitted it here in the blog.

Now that we know which interface is which, we are ready to begin configurations. I will start right here on R2 for convenience. Because it is the DCE interface, I will set the clock rate, the bandwidth for the interface, and set the IP address. I want to use PPP (Point-to-Point Protocol), often jokingly called the Planet's Most Popular Protocol, so I will set that on the interface as well. The default protocol for a Serial link in Cisco networking is Cisco's version of HDLC (High-Level Data Link Control). Finally, I will enable the interface with the no shutdown command.

Please note that the bandwidth command is not actually setting the bandwidth, it is responsible for "reporting" the bandwidth to processes like routing protocols.

R2#
R2#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#interface serial0/0
R2(config-if)#clock rate 64000
R2(config-if)#bandwidth 64
R2(config-if)#ip address 192.168.1.2 255.255.255.0
R2(config-if)#encapsulation ppp
R2(config-if)#no shutdown
R2(config-if)#end
R2#
*Mar  1 02:20:51.291: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up
*Mar  1 02:20:51.615: %SYS-5-CONFIG_I: Configured from console by console
R2#

Notice when I set the clock rate I set a real slow speed (64 Kbps). This is to ensure that the interfaces can easily support it in my lab environment. You should also notice the status message received after the configuration. The interface has come up at Layer 1, but has no chance to come up at Layer 2, as we are sure to have an encapsulation mismatch with the other end of the link (running the default HDLC).

Now it is time to configure R1. Notice it is very nearly a mirror of the configuration, the only difference is the IP address and the lack of the clock rate command.

Also, notice the verification steps. We see Layer 1 and Layer 2 come up, and we can ping the far side link IP address.

R1>enable
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#interface serial 0/0
R1(config-if)#bandwidth 64
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#encapsulation ppp
R1(config-if)#no shutdown
R1(config-if)#end
R1#
*Mar  1 02:22:26.343: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up
*Mar  1 02:22:27.031: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 02:22:27.375: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
R1#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/8/20 ms
R1#

Thanks for reading and enjoy your studies!

Sep
10

This post was created using GNS3 and follows what I thought was some of the most lab and real-world relevant content from the Cisco ASA documentation in the area of IP Routing:

 

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/ip.html

 

Here is the topology used:

 The Topology

 

Initial Setup

First, we place the necessary IP configurations on the devices for our initial connectivity:

R0:
en
conf t
host R0
line con 0
exec-time 0 0
logg synch
!
int fa0/0
no shut
ip address 192.168.1.100 255.255.255.0
end
R1:
en
conf t
host R1
line con 0
exec-time 0 0
logg synch
int fa0/0
no shut
ip address 10.10.10.100 255.255.255.0
!
interface loopback 20
ip address 10.10.20.100 255.255.255.0
end
R2:
en
conf t
host R2
line con 0
exec-time 0 0
logg synch
int fa0/0
no shut
ip address 172.16.1.100 255.255.255.0
end
FW0:
en
conf t
host FW0
!
int e0
ip address 192.168.1.1 255.255.255.0
nameif outside
no shut
!
int e1
ip address 10.10.10.1 255.255.255.0
nameif inside
no shut
!
int e2
ip address 172.16.1.1 255.255.255.0
nameif DMZ
security-level 50
no shut
!
end

At this point, I will be sure to ping each connected router from the PIX to ensure IP connectivity. Remember, by default you can ping from the PIX and to the PIX, but you cannot ping through the PIX.

Static Routing

First, I will create a simple static route to the "remote" loopback network that I have created on R1. Notice that to create a static route we simply use the route command, followed by the interface name, then the network and mask, and finally the next hop. Notice how similar this is to the syntax for a static route on a router, although one major difference is the command does not begin with ip.

FW0:
conf t
route inside 10.10.20.0 255.255.255.0 10.10.10.100
end  

Verification of this static route can be accomplished with a show route and a ping of the remote destination address 10.10.20.100.

Default Static Routing

In order to configure a default static route, use the route command but with an all 0's network prefix and mask. The PIX/ASA allow a shortcut of 0 and 0 to represent 0.0.0.0 and 0.0.0.0. Here I configure a default static route pointing to our outside router.

FW0:
conf t
route outside 0 0 192.168.1.100
end

Verification for this configuration is a quick show route. The PIX/ASA should now show a gateway of last resort and the static route should be marked as a candidate default.

Static Route Tracking

An issue with the static route we just configured is the fact that if the destination gateway of last resort is down, the route is not removed from the routing table. This issue can be circumvented with the static route tracking capability.

First, I use the Cisco IOS IP Service Level Agreements (SLAs) monitor feature to track the availability of the gateway. This is done with the following commands:

FW0:
conf t
sla monitor 1
type echo protocol ipIcmpEcho 192.168.1.100 interface outside
exit
sla monitor schedule 1 life forever start-time now
end

Notice these commands instruct the SLA monitor to ping the gateway starting now and to do this forever. I picked an SLA_ID of 1 to bind these commands together.

Next, I will associate a tracked static route with the SLA monitoring process using the following commands. Notice here that I have used a Track_ID of 20 and I have recreated our default static route so that it includes the Track_ID. Notice also here that the track command is tied to the SLA monitor with the SLA_ID of 1.

FW0:
conf t
track
20 rtr 1 reachability
route outside 0 0 192.168.1.100 track 20
end

A nifty verification at this point is to move to R0 (the gateway of last resort) and run debug ip icmp. You will find that this router is being pinged every minute by the firewall now as a reachability test.

Next, I create a backup default static route. This is simply another default static route entry that possesses a higher administrative distance than the original static default route:

FW0:
conf t
route outside 0 0 192.168.1.55 22

For verification, you can shut the interface on the default gateway and run a show route on the PIX/ASA to ensure the backup is installed.

Dynamic Routing - OSPF

Now it is time to tackle a dynamic routing protocol configuration. Here I configure an MD5 authenticated neighborship between R2 and FW0. Notice that the network command on the PIX/ASA requires a subnet mask as opposed to a wildcard mask.

R2:
conf t
router ospf 1
network 172.16.1.100 0.0.0.0 area 0
!
interface fastethernet 0/0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco
!
end
FW0:
conf t
router ospf 1
network 172.16.1.1 255.255.255.255 area 0
!
interface e2
ospf authentication message-digest
ospf message-digest-key 1 md5 cisco
!
end

For verification, simply run show ospf neighbor on FW0.

Dynamic Routing - RIP version 2

Next, we will run RIP version 2 on the PIX/ASA and advertise the DMZ subnet to the internal router R1. Here are the configurations:

R1:
conf t
router rip
version 2
no auto-summary
passive-interface default
network 10.0.0.0
no passive-interface fa0/0
end
FW0:
conf t
router rip
version 2
no auto-summary
network 172.16.0.0
network 10.0.0.0
end

 Verification for RIP in this example would include show ip route on R1 and debug rip on FW0.  

Conclusion

I certainly hope you have enjoyed this blog on IP routing with the PIX/ASA. While my goal was to hit the highlights, please keep in mind the fact that there are many features of the dynamic routing protocols that are available and not covered here. In fact, there are even some static routing features that were omitted in this discussion. Just remember that these features should be very easy to find in the documentation link when you are in the heat of battle.

Subscribe to INE Blog Updates