MY CCIE TRAINING GUIDE

MPLS VPN

2011-12-12T21:18:00.000+02:00

Ok now the fun stuff start, MPLS VPN’s, I have created nice topology with ISP “someisp.net” and two customers that have connected their branches in NY and Tel Aviv, “google.net” a small company and “shirannet.net” an innovative company working Native IPv6.

Now this time I would go in a different approach instead of talking and talking (I mean writing and writing) I will give you all configurations and .net file I did and let you play around.

MPLS VPN Topology configuration + .net

Some pointers:

1) You can divide the topology into 2 main sections Provider and Customer and 3 virtual divisions (explained below):

a) Provider Back Bone, relatively simple configuration P router are set only with IGP (OSPF flat area 0)
b) PE’s are the complex part, holding both the Customer Interconnecting protocol Provider Topology and doing the conversion between them.
c) Customer Edge again simple configuration

2) ttl propagation in the configuration files I have provided you I have left the default behavior of ttl propagation where the inner ttl field (original packet) is decremented along the path reveling Service Provider path, normally it is not what you will have, and the way to change that behavior is very simple with single command on each PE router see below example:

PE_newyork_someisp.n(config)#no mpls ip propagate-ttl

another scenario is where “shirannet.net” customer is using native IPv6 and you will notice that if you perform a trace and and the ttl propagation is enabled your trace will not function properly and that is because the backbone routers P routers are not IPv6 enabled at all they do not know what is IPv6!!!

! Before diableing ttl propagation 
CE_newyork_shirannet.net#traceroute  2001:CE72:68::2
Type escape sequence to abort.
Tracing the route to 2001:CE72:68::2
  1 2001:CE92:68::1 52 msec 16 msec 8 msec
  2  *  *  *
  3  *
CE_newyork_shirannet.net#ping  2001:CE72:68::2
!
! altoug there is nothing wrong with End To End Connectivity
!
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:CE72:68::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/64/88 ms
!
! After diableing ttl propagation also trace is fine :-)
!
CE_newyork_shirannet.net#traceroute  2001:CE72:68::2
Type escape sequence to abort.
Tracing the route to 2001:CE72:68::2
  1 2001:CE92:68::1 36 msec 36 msec 24 msec
  2 2001:CE72:68::1 52 msec 56 msec 32 msec
  3 2001:CE72:68::2 52 msec 48 msec 60 msec
CE_newyork_shirannet.net#traceroute  2001:CE72:68::2

3) Another last thing I would like to point your attention again concerning IPv6, notice to the vrf configuration, using the new method:

! This is the new way of define vrf's and the only supported
! When working with IPv6 and vrf's
vrf definition shirannet.net
 rd 20000:40
 route-target export 20000:40
 route-target import 20000:40
 !
 address-family ipv6
 exit-address-family
!
!I did both methods just to get your attention on both ways
!
ip vrf google.net
 rd 10000:80
 route-target export 10000:80
 route-target import 10000:80
!

Ok, That is it I hope you will have fun, I think that the basic configuration will allow you to play and test all kind of scenarios and get better understanding on the subject.

The Cisco Learning Network Online Games

2011-12-11T18:39:00.003+02:00

Cisco Online games for geeks

As a network geek you can spend all day playing with this games, as it is very addictive :-)

Personally I would recommend:

Wireless Explorer - The Cisco Learning Network

IPV6 NAT-PT Dynamic

2011-11-04T12:06:00.001+02:00

IPv6 NAT-PT is one of the methods out there for migration between V4 to V6, the NAT-PT is not a normal NAT as with normal NAT you would translate one address to another, in our case NAT-PT we do a translation between 2 different protocols ipv6 to ipv4 (and vice versa).

In the above scenario I have done a simple topology R1 is a host running only IPv6, R2 is my translator between IPv6 to IPv4 and R3 is my gateway out side (Only IPv4), on R3 as you can see from above I have connected it to my home network so I have done Normal IPv4 NAT between the what is coming in from f0/0 and going out f0/1 (my home net)

!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 ipv6 address 2001:100:100::1/64
 ipv6 address FE80::1 link-local
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
!
!
ip http server
no ip http secure-server
!
ipv6 route ::/0 2001:100:100::2
!
!

!
!
!
ipv6 unicast-routing
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 ipv6 address 2001:100:100::2/64
 ipv6 address FE80::2 link-local
 ipv6 nat
!
interface FastEthernet0/1
 ip address 100.100.0.1 255.255.255.0
 duplex auto
 speed auto
 ipv6 nat
!
ip route 0.0.0.0 0.0.0.0 100.100.0.2
!
!
ip http server
no ip http secure-server
!
ipv6 nat v6v4 source list NAT_TRANSLATIONS pool V4POOL
ipv6 nat v6v4 pool V4POOL 100.100.0.101 100.100.0.110 prefix-length 24
ipv6 nat prefix 2001::/96 v4-mapped NAT_TRANSLATIONS
!
!
!
!
ipv6 access-list NAT_TRANSLATIONS
 permit ipv6 any 2001::/96
!

!
!
!
interface FastEthernet0/0
 ip address 100.100.0.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address dhcp
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
!
ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/1 overload
!
access-list 100 permit ip 100.100.0.0 0.0.0.255 any
!

As you can see from above configuration R1 in IPv6 only, and R3 is IPv4 only

IPV6_HOST#ping 2001::808:808
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001::808:808, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 128/142/184 ms
IPV6_HOST#
From above you can see I ping 2001::808:808, the 2001:: is the prefix I use
for the NAT-PT and the 32 last bits 0808:0808 is translated to 8.8.8.8 (Google DNS)

to verify the translation on the NAT-PT router:

NAT_PT_ROUTER#sh ipv nat translations
Prot  IPv4 source              IPv6 source
      IPv4 destination         IPv6 destination
---   ---                      ---
      10.0.0.2                 2001::A00:2
icmp  100.100.0.102,3764       2001:100:100::1,3764
      8.8.8.8,3764             2001::808:808,3764
---   100.100.0.102            2001:100:100::1
      10.0.0.2                 2001::A00:2
---   100.100.0.102            2001:100:100::1
      ---                      ---
NAT_PT_ROUTER#debug ipv6 nat
IPv6 NAT-PT debugging is on
NAT_PT_ROUTER#
*Mar  1 14:12:06.104: IPv6 NAT: icmp src (2001:100:100::1) -> (100.100.0.102), dst (2001::808:808) -> (8.8.8.8)
*Mar  1 14:12:06.236: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
*Mar  1 14:12:06.256: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
*Mar  1 14:12:06.264: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
*Mar  1 14:12:06.280: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
default timeout for the translation rule to expire from the table is 60 sec, to save some
work from the router i would suggest to increase that timeout
ipv nat translation timeout 300 (increase to 5 min)
now with that said you can increase or decrease timeout for tcp , udp , icmp , I would love if there would be also the
option to specifically decrease the timeout for SYN (prevent from SYN flood attack) currently there is an option only 
for FIN or RST flags (and I suggest to decrease their time out.
ipv nat translation finrst-timeout 10

BGP FREE CORE

2011-08-20T22:33:00.001+03:00

In this article I would like to demonstrate the BGP free core power , the simplicity for the ISP as well as for the customer need to have site to site connectivity with out him creating vpns or doing any complex configuration.

R1_VRF_CCIE

R2_VRF_CCIE

R2_VRF_CCDE

R1_VRF_CCDE

R1_VRF_CCIE#sh run
Building configuration...
Current configuration : 641 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1_VRF_CCIE
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
 ip address 1.1.13.1 255.255.255.0
 duplex auto
 speed auto
!
router rip
 version 2
 network 1.0.0.0
 no auto-summary
!
ip http server
no ip http secure-server
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
 login
!
!
end
R1_VRF_CCIE#

R2_VRF_CCIE#sh run
Building configuration...
Current configuration : 717 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2_VRF_CCIE
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface Loopback1
 ip address 1.1.22.2 255.255.255.255
!
interface FastEthernet0/0
 ip address 1.1.42.2 255.255.255.0
 duplex auto
 speed auto
!
router rip
 version 2
 network 1.0.0.0
 network 2.0.0.0
 no auto-summary
!
ip http server
no ip http secure-server
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
 login
!
!
end
R2_VRF_CCIE#

R2_VRF_CCDE#sh run
Building configuration...
Current configuration : 1011 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname R2_VRF_CCDE
!
boot-start-marker
boot-end-marker
!
!
ip subnet-zero
ip cef
!
!
!
no mpls traffic-eng auto-bw timers frequency 0
call rsvp-sync
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 8.8.8.8 255.255.255.255
 no clns route-cache
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
 no clns route-cache
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
 no clns route-cache
!
interface ATM1/0
 no ip address
 no atm enable-ilmi-trap
 no clns route-cache
!
interface ATM1/0.1 point-to-point
 ip address 1.1.48.8 255.255.255.0
 no atm enable-ilmi-trap
 pvc 0/201
  encapsulation aal5snap
 !
!
router eigrp 100
 network 0.0.0.0
 no auto-summary
!
ip classless
!
no ip http server
!
!
!
!
!
!
control-plane
!
!
dial-peer cor custom
!
!
!
!
line con 0
 exec-timeout 0 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 no login
!
!
end

R1_VRF_CCDE#sh run
Building configuration...
Current configuration : 1360 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1_VRF_CCDE
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 6.6.6.6 255.255.255.255
 ip ospf 1 area 0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/0
 ip address 1.1.67.6 255.255.255.0
 encapsulation frame-relay
 ip ospf priority 0
 ip ospf 1 area 0
 clock rate 2000000
 frame-relay map ip 1.1.67.3 201 broadcast
 no frame-relay inverse-arp
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial0/1
 no ip address
 shutdown
 clock rate 2000000
!
interface Serial0/2
 no ip address
 shutdown
 clock rate 2000000
!
interface Serial1/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
router ospf 1
 router-id 6.6.6.6
 log-adjacency-changes
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
 login
!
!
end
R1_VRF_CCDE#

you can see in the configuration there is no VRF configured, I only called them VFR routers as this are the CE connected to the ISP PE routers.

below you can see CE for CCIE the path from R1 to R2 can be (R1 –> R3 –> R4 –> R2) or ( R1 –> R3 –>R5 –> R4 –> R2 )

R1_VRF_CCIE#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
R       1.1.22.2/32 [120/1] via 1.1.13.3, 00:00:11, FastEthernet0/0
R       1.1.42.0/24 [120/1] via 1.1.13.3, 00:00:11, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
R       2.2.2.2 [120/1] via 1.1.13.3, 00:00:11, FastEthernet0/0
R1_VRF_CCIE#ping 2.2.2.2 sou
R1_VRF_CCIE#ping 2.2.2.2 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/77/120 ms
R1_VRF_CCIE#

R1_VRF_CCIE#traceroute 2.2.2.2 source lo0

Type escape sequence to abort.

Tracing the route to 2.2.2.2

  1 1.1.13.3 32 msec 16 msec 24 msec

  2 1.1.42.4 [MPLS: Labels 19 Exp 0] 28 msec 48 msec 40 msec

  3 1.1.42.2 72 msec *  72 msec

R1_VRF_CCIE#

R1_VRF_CCIE#traceroute 2.2.2.2 source lo0

Type escape sequence to abort.

Tracing the route to 2.2.2.2

  1 1.1.13.3 20 msec 28 msec 16 msec

  2 1.1.35.5 [MPLS: Labels 18/19 Exp 0] 96 msec 80 msec 68 msec

  3 1.1.42.4 [MPLS: Label 19 Exp 0] 68 msec 40 msec 40 msec

  4 1.1.42.2 64 msec *  76 msec

R1_VRF_CCIE#

I the above trace I have demonstrated the 2 path selection, the first it the natural selection and just by shutting the interface between R3 to R4 I have enforced the routers to select the other path (only to show that both paths are valid and working), please noting another interesting thing is to that we see the MPLS path In the next article I will show you how to keep that information out from the customer need to know but as for this demonstration it help me show you how dose it work.

now we see that the CE is simply configured with ip address under the interface (along with the proper L2 configuration) and IGP again that is another decision I made for simplicity, the next step will be to demonstrate a multi home mode however lets not get ahead of our self.

So lets look how is the ISP configured:

R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/24 is subnetted, 3 subnets
C       1.1.35.0 is directly connected, Serial1/1
C       1.1.43.0 is directly connected, Serial1/0
O       1.1.45.0 [110/128] via 1.1.43.4, 00:10:44, Serial1/0
                 [110/128] via 1.1.35.5, 00:10:44, Serial1/1
     3.0.0.0/32 is subnetted, 1 subnets
C       3.3.3.3 is directly connected, Loopback0
     4.0.0.0/32 is subnetted, 1 subnets
O       4.4.4.4 [110/65] via 1.1.43.4, 00:10:44, Serial1/0
     5.0.0.0/32 is subnetted, 1 subnets
O       5.5.5.5 [110/65] via 1.1.35.5, 00:10:44, Serial1/1
# Where is the router to 2.2.2.2 and to 1.1.1.1???!
# Remmeber the VRF?!
R3#sh ip route vrf CCIE
Routing Table: CCIE
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
R       1.1.1.1/32 [120/1] via 1.1.13.1, 00:00:15, FastEthernet0/0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
B       1.1.22.2/32 [200/1] via 4.4.4.4, 4d22h
B       1.1.42.0/24 [200/0] via 4.4.4.4, 4d22h
     2.0.0.0/32 is subnetted, 1 subnets
B       2.2.2.2 [200/1] via 4.4.4.4, 4d22h
R3#
# OK now I can see the routes, but wait I do not have BGP
# Configured on my customers!!!

OK so how dose that work in our topology CE to PE we have IGP configured, On the PE I have the IGP to form route distribution with CE’s, I have IGP to between all the ISP routers only for internal and LDP / TDP (MPLS lable mapping) and I have BGP for distributing Customer routes to the IGP, now you ask your self , YOU SAID this should be BGP FREE ???! please noting to the headline is say BGP FREE CORE and by core I refer to all internal ISP network, in my diagram you can see only one core router R5 however ISP’s are build with far more complex and their core may contain a little more than that.

So lets see what we have on R5 as I have demonstrated an instance where the path is using him :

R5#sh ip route vrf *
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/24 is subnetted, 3 subnets
C       1.1.35.0 is directly connected, Serial0/1
O       1.1.43.0 [110/128] via 1.1.45.4, 00:24:19, Serial0/0
                 [110/128] via 1.1.35.3, 00:24:19, Serial0/1
C       1.1.45.0 is directly connected, Serial0/0
     3.0.0.0/32 is subnetted, 1 subnets
O       3.3.3.3 [110/65] via 1.1.35.3, 00:24:19, Serial0/1
     4.0.0.0/32 is subnetted, 1 subnets
O       4.4.4.4 [110/65] via 1.1.45.4, 00:24:19, Serial0/0
     5.0.0.0/32 is subnetted, 1 subnets
C       5.5.5.5 is directly connected, Loopback0
R5#
# AS You can see there is only main routing table no VRF 
# 
R5#sh ip protocols
Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 5.5.5.5
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    1.1.35.5 0.0.0.0 area 0
    1.1.45.5 0.0.0.0 area 0
    5.5.5.5 0.0.0.0 area 0
 Reference bandwidth unit is 100 mbps
  Routing Information Sources:
    Gateway         Distance      Last Update
    2.2.2.2              110      5d21h
    1.1.1.1              110      6d00h
    3.3.3.3              110      00:25:24
    4.4.4.4              110      00:25:24
  Distance: (default is 110)
R5#
# Only OSPF of the main table! used as I have mentiond for
# Internal ISP communication and LDP / TDP (MPLS lable mapping)

R5#sh mpls forwarding-table
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop
tag    tag or VC   or Tunnel Id      switched   interface
16     Pop tag     1.1.43.0/24       0          Se0/0      point2point
       Pop tag     1.1.43.0/24       0          Se0/1      point2point
17     Pop tag     3.3.3.3/32        4764362    Se0/1      point2point
18     Pop tag     4.4.4.4/32        5707479    Se0/0      point2point
R5#

You can also see the MPLS table is very small the only thing R5 need to know is what to do when receiving label 16 , 17 , 18


R3#sh run
Building configuration...
Current configuration : 2839 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
ip subnet-zero
ip cef
!
!
no ip domain-lookup
!
ip vrf CCDE
 rd 333:2
 route-target export 1001:11
 route-target import 1001:11
!
ip vrf CCIE
 rd 333:1
 route-target export 10000:1
 route-target import 10001:1
!
no mpls traffic-eng auto-bw timers frequency 0
call rsvp-sync
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
 no clns route-cache
!
interface Loopback1
 ip vrf forwarding CCDE
 ip address 33.3.3.3 255.255.255.255
 no clns route-cache
!
interface FastEthernet0/0
 ip vrf forwarding CCIE
 ip address 1.1.13.3 255.255.255.0
 duplex auto
 speed auto
 no clns route-cache
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
 no clns route-cache
!
interface Serial1/0
 ip address 1.1.43.3 255.255.255.0
 mpls ip
 serial restart-delay 0
 no clns route-cache
!
interface Serial1/1
 ip address 1.1.35.3 255.255.255.0
 mpls ip
 serial restart-delay 0
 no clns route-cache
!
interface Serial1/2
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 no frame-relay inverse-arp
 no clns route-cache
!
interface Serial1/2.2 multipoint
 ip vrf forwarding CCDE
 ip address 1.1.67.3 255.255.255.0
 frame-relay map ip 1.1.67.6 102 broadcast
 frame-relay map ip 1.1.67.7 103 broadcast
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
 no clns route-cache
!
router ospf 2 vrf CCDE
 router-id 33.3.3.3
 log-adjacency-changes
 redistribute bgp 10000 subnets
 network 1.1.67.3 0.0.0.0 area 0
 network 33.3.3.3 0.0.0.0 area 0
 neighbor 1.1.67.7
 neighbor 1.1.67.6
!
router ospf 1
 router-id 3.3.3.3
 log-adjacency-changes
 network 1.1.13.3 0.0.0.0 area 0
 network 1.1.35.3 0.0.0.0 area 0
 network 1.1.43.3 0.0.0.0 area 0
 network 3.3.3.3 0.0.0.0 area 0
!
router rip
 !
 address-family ipv4 vrf CCIE
 redistribute bgp 10000 metric 1
 network 1.0.0.0
 no auto-summary
 version 2
 exit-address-family
!
router bgp 10000
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 4.4.4.4 remote-as 10000
 neighbor 4.4.4.4 update-source Loopback0
 !
 address-family ipv4
 neighbor 4.4.4.4 activate
 no auto-summary
 no synchronization
 exit-address-family
 !
 address-family vpnv4
 neighbor 4.4.4.4 activate
 neighbor 4.4.4.4 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf CCIE
 redistribute rip
 no auto-summary
 no synchronization
 exit-address-family
 !
 address-family ipv4 vrf CCDE
 redistribute ospf 2 vrf CCDE
 no auto-summary
 no synchronization
 exit-address-family
!
ip classless
!
no ip http server
!
!
!
!
!
!
control-plane
!
!
dial-peer cor custom
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
!
!
end
R3#

R4#sh run
Building configuration...
Current configuration : 2627 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
ip subnet-zero
ip cef
!
!
no ip domain-lookup
!
ip vrf CCDE
 rd 444:2
 route-target export 1001:11
 route-target import 1001:11
!
ip vrf CCIE
 rd 444:1
 route-target export 10001:1
 route-target import 10000:1
!
no mpls traffic-eng auto-bw timers frequency 0
call rsvp-sync
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
 no clns route-cache
!
interface FastEthernet0/0
 ip vrf forwarding CCIE
 ip address 1.1.42.4 255.255.255.0
 duplex auto
 speed auto
 no clns route-cache
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
 no clns route-cache
!
interface Serial1/0
 ip address 1.1.43.4 255.255.255.0
 mpls ip
 serial restart-delay 0
 no clns route-cache
!
interface Serial1/1
 ip address 1.1.45.4 255.255.255.0
 mpls ip
 serial restart-delay 0
 no clns route-cache
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
 no clns route-cache
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
 no clns route-cache
!
interface ATM2/0
 no ip address
 no atm enable-ilmi-trap
 no clns route-cache
!
interface ATM2/0.2 point-to-point
 ip vrf forwarding CCDE
 ip address 1.1.48.4 255.255.255.0
 no atm enable-ilmi-trap
 pvc 0/102
  encapsulation aal5snap
 !
!
router eigrp 100
 no auto-summary
 !
 address-family ipv4 vrf CCDE
 redistribute bgp 10000 metric 1 1 1 1 1
 network 0.0.0.0
 no auto-summary
 autonomous-system 100
 exit-address-family
!
router ospf 1
 router-id 4.4.4.4
 log-adjacency-changes
 network 1.1.42.4 0.0.0.0 area 0
 network 1.1.43.4 0.0.0.0 area 0
 network 1.1.45.4 0.0.0.0 area 0
 network 4.4.4.4 0.0.0.0 area 0
!
router rip
 !
 address-family ipv4 vrf CCIE
 redistribute bgp 10000 metric 1
 network 1.0.0.0
 no auto-summary
 version 2
 exit-address-family
!
router bgp 10000
 no synchronization
 bgp log-neighbor-changes
 neighbor 3.3.3.3 remote-as 10000
 neighbor 3.3.3.3 update-source Loopback0
 no auto-summary
 !
 address-family vpnv4
 neighbor 3.3.3.3 activate
 neighbor 3.3.3.3 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf CCIE
 redistribute rip
 no auto-summary
 no synchronization
 exit-address-family
 !
 address-family ipv4 vrf CCDE
 redistribute eigrp 100
 no auto-summary
 no synchronization
 exit-address-family
!
ip classless
!
no ip http server
!
!
!
!
!
!
control-plane
!
!
dial-peer cor custom
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
!
!
end
R4#

Please look into the configuration of R3 and R4 (ISP- PE) now you can see I have configured vrf CCIE and CCDE, IGP for PE to CE, IGP for Internal ISP and BGP for distributing customers routes.

Noting to 2 new configuration rd (route distinguisher) and route target, the rd provide a uniq id to the NLRI so the router will know if route 192.168.0.0 of Customer A from 192.168.0.0 of Customer B as it is perfectly ok for me to use RFC1918 range in my organization and have the same range used in 10 other organization’s however if all 10 are connected to the same ISP and the ISP need to provide the customer vpn between his sites, he also need to know that when he get communication from the CEO of Microsoft not to deliver it by mistake to the CEO of Cisco when he only wanted to send the communication to the CTO of Microsoft (although it will simply not going to work in the application level, this is a raw example of what we want to avoid).


R4# sh ip bgp vpnv4 all
BGP table version is 58, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 333:1
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
Route Distinguisher: 333:2
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
Route Distinguisher: 444:1 (default for vrf CCIE)
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
*> 1.1.22.2/32      1.1.42.2                 1         32768 ?
*> 1.1.42.0/24      0.0.0.0                  0         32768 ?
*> 2.2.2.2/32       1.1.42.2                 1         32768 ?
Route Distinguisher: 444:2 (default for vrf CCDE)
*> 1.1.48.0/24      0.0.0.0                  0         32768 ?
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
   Network          Next Hop            Metric LocPrf Weight Path
*> 8.8.8.8/32       1.1.48.8            146432         32768 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
R4# sh ip bgp vpnv4 all
BGP table version is 62, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 333:1
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
*>i192.168.0.0      3.3.3.3                  1    100      0 ?
Route Distinguisher: 333:2
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
Route Distinguisher: 444:1 (default for vrf CCIE)
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
*> 1.1.22.2/32      1.1.42.2                 1         32768 ?
*> 1.1.42.0/24      0.0.0.0                  0         32768 ?
*> 2.2.2.2/32       1.1.42.2                 1         32768 ?
*>i192.168.0.0      3.3.3.3                  1    100      0 ?
Route Distinguisher: 444:2 (default for vrf CCDE)
*> 1.1.48.0/24      0.0.0.0                  0         32768 ?
   Network          Next Hop            Metric LocPrf Weight Path
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
*> 8.8.8.8/32       1.1.48.8            146432         32768 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
*> 192.168.0.0      1.1.48.8            146432         32768 ?

Please notice to route 192.168.0.0

R1_VRF_CCIE#sh run int lo10
Building configuration...
Current configuration : 66 bytes
!
interface Loopback10
 ip address 192.168.0.1 255.255.255.0
end
R2_VRF_CCDE#sh run int lo10
Building configuration...
Current configuration : 87 bytes
!
interface Loopback10
 ip address 192.168.0.1 255.255.255.0
 no clns route-cache
end
R2_VRF_CCDE#

R1_VRF_CCDE#ping 192.168.0.1 r 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 44/44/44 ms
R1_VRF_CCDE#
R2_VRF_CCDE#debug ip icmp
ICMP packet debugging is on
R2_VRF_CCDE#
01:37:17: ICMP: echo reply sent, src 192.168.0.1, dst 1.1.67.6
R2_VRF_CCIE#ping 192.168.0.1 r 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 68/68/68 ms
R2_VRF_CCIE#
R1_VRF_CCIE#debug ip icmp
ICMP packet debugging is on
R1_VRF_CCIE#
*Mar  1 01:38:17.739: ICMP: echo reply sent, src 192.168.0.1, dst 1.1.42.2

So that is the power of rd!

Now what is the route target , I will try to explain it in a simple way, between the PE’s we have BGP running, for the IGP routes to be propagated correctly between them I need to tell each vrf what NLRI to import and export from and to the BGP. it should be unique for per customers as the rd is unique.

! R3 Original config
ip vrf CCDE
 rd 333:2
 route-target export 1001:11
 route-target import 1001:11
!
ip vrf CCIE
 rd 333:1
 route-target export 10000:1
 route-target import 10001:1
!
R3(config)#ip vrf CCIE
R3(config-vrf)#route-target import 1001:11
# See what happen on R1 :
R1_VRF_CCIE#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
R       1.1.22.2/32 [120/1] via 1.1.13.3, 00:00:24, FastEthernet0/0
R       1.1.42.0/24 [120/1] via 1.1.13.3, 00:00:24, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
R       2.2.2.2 [120/1] via 1.1.13.3, 00:00:24, FastEthernet0/0
C    192.168.0.0/24 is directly connected, Loopback10
R1_VRF_CCIE#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
R       1.1.22.2/32 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
R       1.1.42.0/24 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
R       1.1.48.0/24 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
R       1.1.67.0/24 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
R       2.2.2.2 [120/1] via 1.1.13.3, 00:00:02, FastEthernet0/0
     33.0.0.0/32 is subnetted, 1 subnets
R       33.3.3.3 [120/1] via 1.1.13.3, 00:00:02, FastEthernet0/0
     6.0.0.0/32 is subnetted, 1 subnets
R       6.6.6.6 [120/1] via 1.1.13.3, 00:00:02, FastEthernet0/0
     8.0.0.0/32 is subnetted, 1 subnets
R       8.8.8.8 [120/1] via 1.1.13.3, 00:00:03, FastEthernet0/0
C    192.168.0.0/24 is directly connected, Loopback10
R1_VRF_CCIE#

by importing CCDE route target I cause a leak and R1 to be aware for routes he do not have any access to

R1_VRF_CCIE#ping 8.8.8.8

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R1_VRF_CCIE#ping 192.168.0.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms

# And even worse I have caused comunication to be replayed from the wrong

# host just because he hold the same IP!!

R2_VRF_CCDE#

02:07:58: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1

02:08:00: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1

02:08:02: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1

02:08:04: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1

02:08:06: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1

I hope that was informative, for now providing you basic understanding to what is BGP FREE CORE advantages and what can cause misunderstanding the basics.

Step By Step MPLS – Basic MPLS Setup

2011-07-12T22:42:00.001+03:00

Initial configuration , very basic with no MPLS, connectivity only to directly connected interfaces.

R1	R2	R3	R4
! ! ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 ip address 10.0.31.1 255.255.255.0 duplex auto speed auto !	! ! interface Loopback0 ip address 2.2.2.2 255.255.255.255 ! interface FastEthernet0/0 ip address 10.0.42.2 255.255.255.0 duplex auto speed auto !	! ! interface Loopback0 ip address 3.3.3.3 255.255.255.255 no clns route-cache ! interface FastEthernet0/0 ip address 10.0.31.3 255.255.255.0 duplex auto speed auto no clns route-cache ! interface Serial1/0 ip address 10.0.43.3 255.255.255.0 serial restart-delay 0 no clns route-cache !	! ! interface Loopback0 ip address 4.4.4.4 255.255.255.255 no clns route-cache ! interface FastEthernet0/0 ip address 10.0.42.4 255.255.255.0 duplex auto speed auto ! interface Serial1/0 ip address 10.0.43.4 255.255.255.0 serial restart-delay 0 no clns route-cache !

adding to the following configuration MPLS labels we will start with default label distribution protocol (on most new IOS’s LDP is the default) you can verify your IOS default

R2(config)#mpls label protocol ?
  ldp  Use LDP (default)
  tdp  Use TDP

now I have enabled on R3 and R4 under all the interfaces MPLS label distribution after I have verified that both are using the LDP by default see example:

R4(config)#int f0/0
R4(config-if)#mp
R4(config-if)#mpls ip
R4(config-if)#int s1/0
R4(config-if)#mpls ip
R4(config-if)#exit
R4(config)#mpl
R4(config)#mpls ip
====================
R3(config)#mpls ip
R3(config)#int f0/0
R3(config-if)#mpls ip
R3(config-if)#int s1/0
R3(config-if)#mpls ip

And I would like to verify LDP has been established correctly

# I see interfaces are configured properly
R3#sh mpls interfaces
Interface              IP            Tunnel   BGP Static Operational
FastEthernet0/0        Yes (ldp)     No       No  No     Yes
Serial1/0              Yes (ldp)     No       No  No     Yes
# But No neighbor???!
R3#sh mpls ldp neighbor
# see below local LDP id and recived LDP id!!! I do not have a route!
R3#sh mpls ldp discovery
 Local LDP Identifier:
    3.3.3.3:0
    Discovery Sources:
    Interfaces:
        FastEthernet0/0 (ldp): xmit
        Serial1/0 (ldp): xmit/recv
            LDP Id: 4.4.4.4:0; no route
R3#
=============================================
#also I can do debug and see, notice below to the connection attempt to open
R4#debug mpls ldp transport events
00:25:43: ldp: Send ldp hello; Serial1/0, src/dst 10.0.43.4/224.0.0.2, inst_id 0
00:25:43: ldp: Rcvd ldp hello; Serial1/0, from 10.0.43.3 (3.3.3.3:0), intf_id 0, opt 0xC
00:25:43: ldp: ldp Hello from 10.0.43.3 (3.3.3.3:0) to 224.0.0.2, opt 0xC
00:25:43: ldp: local idb = Serial1/0, holdtime = 15000, peer 10.0.43.3 holdtime = 15000
00:25:43: ldp: Link intvl min cnt = 2, intvl = 5000, idb = Serial1/0
00:25:43: ldp: Opening ldp conn; adj 0x63D88708, 4.4.4.4 <-> 3.3.3.3
00:25:43: ldp: No route to peer 3.3.3.3; set LDP_CTX_HANDLE_ROUTEUP
=============================================
# as soon as I am setting up a ip route routers for the loopback interface
R4(config)#ip route 3.3.3.3 255.255.255.255 10.0.43.3
R3(config)#ip route 4.4.4.4 255.255.255.255 10.0.43.4
R3(config)#
00:56:41: tagcon: Assign peer id; 4.4.4.4:0: id 0
00:56:41: %LDP-5-NBRCHG: LDP Neighbor 4.4.4.4:0 is UP
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 10.0.31.3
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 10.0.43.3
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 3.3.3.3
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 3.3.3.3/32, label 3 (imp-null) (#2)
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 10.0.31.0/24, label 3 (imp-null) (#4)
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 10.0.43.0/24, label 3 (imp-null) (#6)
00:56:41: tagcon: peer 4.4.4.4:0 (pp 0x63D6E478): advertise 4.4.4.4/32, label 1000 (#8)
00:56:41: tagcon: Allocating address 10.0.42.4 advertised by LDP router-id 4.4.4.4
R3(config)#
00:56:41: tagcon: Allocating address 10.0.43.4 advertised by LDP router-id 4.4.4.4
00:56:41: tagcon: Allocating address 4.4.4.4 advertised by LDP router-id 4.4.4.4
R4(config)#^Z
R4#un all
00:56:40: %LDP-5-NBRCHG: LDP Neighbor 3.3.3.3:0 is UP
00:56:41: %SYS-5-CONFIG_I: Configured from console by console

Now notice as after the LDP has been established using multicast UDP a TCP session is created (similar to BGP) sourced from high port to TCP port 646

R4#sh mpls ldp neighbor
    Peer LDP Ident: 3.3.3.3:0; Local LDP Ident 4.4.4.4:0
        TCP connection: 3.3.3.3.646 - 4.4.4.4.11586
        State: Oper; Msgs sent/rcvd: 10/10; Downstream
        Up time: 00:02:36
        LDP discovery sources:
          Serial1/0, Src IP addr: 10.0.43.3
        Addresses bound to peer LDP Ident:
          10.0.31.3       10.0.43.3       3.3.3.3

you can see above the TCP connection parameters, using the loopback interfaces from 4.4.4.4 to 3.3.3.3

next step to allow end to end connectivity and avoid to have and setup multiple static route statements, I have configured OSPF under all 4 routers:

!
router ospf 1
 router-id <loopbcak_ip>
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
!

And verified I have end to end connectivity:

R2#ping 1.1.1.1 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 36/44/56 ms
R2#

Now you ask where is the MPLS here, you have done a simple OSPF setup and that is true, basic MPLS such as that have no benefit, however that is the basic, I do not want to show the complex before we all understand the first step.

So here is my LFIB label forwarding information base:

R2#sh mpls forwarding-table
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop
tag    tag or VC   or Tunnel Id      switched   interface
17     1002        10.0.31.0/24      0          Fa0/0      10.0.42.4
18     1003        1.1.1.1/32        0          Fa0/0      10.0.42.4
19     1000        3.3.3.3/32        0          Fa0/0      10.0.42.4
20     Pop tag     4.4.4.4/32        0          Fa0/0      10.0.42.4
21     Pop tag     10.0.43.0/24      0          Fa0/0      10.0.42.4

each router is building such a table according to the LDP information received and sent.
What is the information you see? Local tag this are the local generated tags used to generate downstream away from the destination, the outgoing tag is used for the upstream labeling to the destination, you cab also see how much bytes of label switching was done, very informative.

Note: I normally like to modify the range of labeling just to sort the table for my self see below.

R4(config)#mpls label range 1000 2000

the default is:

R2#sh mpls label range
Downstream Generic label region: Min/Max label: 16/100000

last issue, you saw from above that the byte counter on R2 is 0 but you remember I did a connectivity check end to end from R2 to R1, so why did it not show as increased?! PHP (not the programming language) penultimate hop popping a long name for short task.

R4#sh mpls forwarding-table
Local  Outgoing      Prefix            Bytes Label   Outgoing   Next Hop
Label  Label or VC   or Tunnel Id      Switched      interface
1000   Pop Label     3.3.3.3/32        0             Se1/0      point2point
1001   Pop Label     2.2.2.2/32        1140          Fa0/0      10.0.42.2
1002   Pop Label     10.0.31.0/24      0             Se1/0      point2point
1003   1001          1.1.1.1/32        1080          Se1/0      point2point
R4#

when I sent ping from 2.2.2.2 to 1.1.1.1 R2 pushed label 1003 to the echo request R4 received 1003 and swap with 1001

R3#sh mpls forwarding-table
Local  Outgoing      Prefix            Bytes Label   Outgoing   Next Hop
Label  Label or VC   or Tunnel Id      Switched      interface
1000   Pop Label     4.4.4.4/32        0             Se1/0      point2point
1001   Pop Label     1.1.1.1/32        1140          Fa0/0      10.0.31.1
1002   Pop Label     10.0.42.0/24      0             Se1/0      point2point
1003   1001          2.2.2.2/32        1080          Se1/0      point2point

R3 received 1001 POP the label and sent to R1

R1#sh mpls forwarding-table
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop
tag    tag or VC   or Tunnel Id      switched   interface
16     1003        2.2.2.2/32        0          Fa0/0      10.0.31.3
17     Pop tag     3.3.3.3/32        0          Fa0/0      10.0.31.3
18     Pop tag     10.0.43.0/24      0          Fa0/0      10.0.31.3
19     1000        4.4.4.4/32        0          Fa0/0      10.0.31.3
20     1002        10.0.42.0/24      0          Fa0/0      10.0.31.3

as you can see R1 byte counters are also clean. R1 received normal ip with icmp echo request, replaying with echo replay now pushing 1003 and R3 swapping 1003 to 1001 and finally R4 popping 1001 sending normal echo replay to R2

R2#ping 1.1.1.1 source lo0 repeat 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 64/64/64 ms
R2#
R4#
01:46:35: MPLS turbo: Fa0/0: rx: Len 118 Stack {1003 0 255} - ipv4 data
01:46:35: MPLS turbo: Se1/0: tx: Len 108 Stack {1001 0 254} - ipv4 data
01:46:35: MPLS turbo: Se1/0: rx: Len 108 Stack {1001 0 254} - ipv4 data
R4#
R3#
01:46:35: MPLS turbo: Se1/0: rx: Len 108 Stack {1001 0 254} - ipv4 data
01:46:35: MPLS turbo: Fa0/0: rx: Len 118 Stack {1003 0 255} - ipv4 data
01:46:35: MPLS turbo: Se1/0: tx: Len 108 Stack {1001 0 254} - ipv4 data
R3#
R1#deb ip pack de
*Mar  1 01:39:04.799: IP: s=2.2.2.2 (FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar  1 01:39:04.803:     ICMP type=8, code=0
*Mar  1 01:39:04.803: ICMP: echo reply sent, src 1.1.1.1, dst 2.2.2.2
*Mar  1 01:39:04.803: IP: tableid=0, s=1.1.1.1 (local), d=2.2.2.2 (FastEthernet0/0), routed via FIB
*Mar  1 01:39:04.803: IP: s=1.1.1.1 (local), d=2.2.2.2 (FastEthernet0/0), len 100, sending
*Mar  1 01:39:04.803:     ICMP type=0, code=0

I hope that was helpful, I would like you to try it for your self so again here is my basic GNS setup:

autostart = False
[127.0.0.1:7200]
    workingdir = C:\Users\shiran\AppData\Local\Temp
    udp = 10000
    [[3640]]
        image = E:\ Root\SOFTWARE\CISCO\c3640-jk9o3s-mz.124-16.bin
        idlepc = 0x605ac320
        ghostios = True
        chassis = 3640
    [[ROUTER R1]]
        model = 3640
        console = 2000
        aux = 2100
        cnfg = R1.cfg
        slot0 = NM-1FE-TX
        f0/0 = R3 f0/0
        x = -533.0
        y = -198.0
    [[ROUTER R2]]
        model = 3640
        console = 2001
        aux = 2101
        cnfg = R2.cfg
        slot0 = NM-1FE-TX
        f0/0 = R4 f0/0
        x = 227.0
        y = -202.0
[127.0.0.1:7201]
    workingdir = C:\Users\shiran\AppData\Local\Temp
    udp = 10100
    [[7200]]
        image = E:\ Root\SOFTWARE\CISCO\c7200-k91p-mz.122-25.S15.bin
        idlepc = 0x608ca290
        ghostios = True
    [[ROUTER R4]]
        console = 2004
        cnfg = C:\Program Files (x86)\GNS3\R4.cfg
        slot0 = C7200-IO-2FE
        f0/0 = R2 f0/0
        slot1 = PA-4T+
        s1/0 = R3 s1/0
        x = -31.0
        y = -87.0
    [[ROUTER R3]]
        console = 2003
        cnfg = C:\Program Files (x86)\GNS3\R3.cfg
        slot0 = C7200-IO-2FE
        f0/0 = R1 f0/0
        slot1 = PA-4T+
        s1/0 = R4 s1/0
        x = -271.0
        y = -87.0
[GNS3-DATA]
    configs = C:\Program Files (x86)\GNS3
    [[NOTE 1]]
        text = s1/0
        x = -6.86874660092
        y = 25.2377529973
        interface = R4 s1/0
    [[NOTE 2]]
        text = f0/0
        x = 69.5349221487
        y = 5.71505408099
        interface = R4 f0/0
    [[NOTE 3]]
        text = s1/0
        x = 72.8687466009
        y = 18.7622470027
        interface = R3 s1/0
    [[NOTE 4]]
        text = f0/0
        x = -3.83092469005
        y = 6.39605862368
        interface = R3 f0/0
    [[NOTE 5]]
        text = f0/0
        x = -6.99933176856
        y = 21.7687899898
        interface = R2 f0/0
    [[NOTE 6]]
        text = f0/0
        x = 72.9993317686
        y = 22.2312100102
        interface = R1 f0/0

Step by Step Into MPLS – VRF LITE

2011-07-11T20:52:00.001+03:00

Although VRF (virtual routing and forwarding) is not actually part of the MPLS you can think of the VRF as a helper for the MPLS in achieving the MPLS VPN infrastructure, now as I would like to make that a very simple to understand guide , I will address here only the VRF part without any MPLS, also known as VRF Lite.

Simple Topology :

R1 Configuration	R2 Configuration
! ip cef no ip domain lookup ! ! ip vrf VRF_GOLD ! ip vrf VRF_SILVER ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/0.1 encapsulation dot1Q 100 ip vrf forwarding VRF_SILVER ip address 10.0.0.1 255.255.255.0 ! interface FastEthernet0/0.2 encapsulation dot1Q 200 ip vrf forwarding VRF_GOLD ip address 20.0.0.1 255.255.255.0 !	! ip cef no ip domain lookup ! ip vrf VRF_GOLD ! ip vrf VRF_SILVER ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/0.1 encapsulation dot1Q 100 ip vrf forwarding VRF_SILVER ip address 10.0.0.2 255.255.255.0 ! interface FastEthernet0/0.2 encapsulation dot1Q 200 ip vrf forwarding VRF_GOLD ip address 20.0.0.2 255.255.255.0 ! !

As you can see from above I have done something very simple, 2 VRF’s GOLD and SILVER, I have configured sub interface for FastEthernet 0/0 and each is assigned to its own VRF with the ip vrf forwarding <VRF_NAME> command.

see what happen if I try to see my routing table:

R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set

What happen here?! where are my connected interfaces ?!

Well this is the VRF, as you can see from above configuration I have configured only interface assigned to VRF, and the VRF job is to take my router and give each VRF a totally separate virtual ip routing table. you can see the same result is with R2 main routing table.

R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set

So , where is the routing table I have created?!

R1#sh ip route vrf VRF_GOLD
Routing Table: VRF_GOLD
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     20.0.0.0/24 is subnetted, 1 subnets
C       20.0.0.0 is directly connected, FastEthernet0/0.2
R1#sh ip route vrf VRF_SILVER
Routing Table: VRF_SILVER
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.0.0 is directly connected, FastEthernet0/0.1

R2#sh ip vrf
  Name                             Default RD          Interfaces
  VRF_GOLD                         <not set>           Fa0/0.2
  VRF_SILVER                       <not set>           Fa0/0.1
R2#sh ip route vrf VRF_GOLD
Routing Table: VRF_GOLD
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     20.0.0.0/24 is subnetted, 1 subnets
C       20.0.0.0 is directly connected, FastEthernet0/0.2

Now lets check simple connectivity:

R2#ping 20.0.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 20.0.0.2, timeout is 2 seconds:
.....

Now what is going on?! I am pinging my own interface!!!

Relax again, when working with VRF everything need to be referred with the VRF, ping traceroute…

R2#ping vrf VRF_GOLD 20.0.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 20.0.0.2, timeout is 2 seconds:
!!!!!
R2#ping vrf VRF_GOLD 20.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 20.0.0.1, timeout is 2 seconds:
.!!!!
R2#ping vrf VRF_SILVER 10.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
.!!!!

Now I would like to take it one step further and show you that the VRF is locally significant, meaning the router it self have virtual separation there is no tagging or added header’s or anything like MPLS.

R2(config)#ip vrf VRF_A
R2(config-vrf)#ip vrf VRF_B
R2(config-vrf)#int f0/0.1
R2(config-subif)#ip vrf f
R2(config-subif)#ip vrf forwarding VRF_A
% Interface FastEthernet0/0.1 IP address 10.0.0.2 removed due to enabling VRF VRF_A
R2(config-subif)#ip add 10.0.0.2 255.255.255.0
R2(config-subif)#int f0/0.2
R2(config-subif)#ip vrf forwarding VRF_B
% Interface FastEthernet0/0.2 IP address 20.0.0.2 removed due to enabling VRF VRF_B
R2(config-subif)#ip add 20.0.0.2 255.255.255.0
R2(config-subif)#^Z
R2#sh
*Mar  1 00:08:58.651: %SYS-5-CONFIG_I: Configured from console by console
R2#sh ip int b
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES unset  up                    up  
FastEthernet0/0.1          10.0.0.2        YES manual up                    up  
FastEthernet0/0.2          20.0.0.2        YES manual up                    up  
R2#sh ip vrf
  Name                             Default RD          Interfaces
  VRF_A                            <not set>           Fa0/0.1
  VRF_B                            <not set>           Fa0/0.2
  VRF_GOLD                         <not set>
  VRF_SILVER                       <not set>

as you can see from above I have configured 2 new VRF’s and reassign them to the interfaces, replacing old VRF_GOLD and VRF_SILVER, notice I had to reconfigure the ip address, as when assigning VRF to an interface the ip address is removed (I have just assigned the same to each interface)

Now lets test

R2#ping vrf VRF_A 10.0.0.1 repeat 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 200/200/200 ms

Success !!!

Now If you have any doubts

R1#debug ip packet detail
IP packet debugging is on (detailed)
R1#
*Mar  1 00:09:20.979: IP: tableid=1, s=10.0.0.2 (FastEthernet0/0.1), d=10.0.0.1 (FastEthernet0/0.1), routed via RIB
*Mar  1 00:09:20.979: IP: s=10.0.0.2 (FastEthernet0/0.1), d=10.0.0.1 (FastEthernet0/0.1), len 100, rcvd 3
*Mar  1 00:09:20.983:     ICMP type=8, code=0
*Mar  1 00:09:20.983: IP: tableid=1, s=10.0.0.1 (local), d=10.0.0.2 (FastEthernet0/0.1), routed via FIB
*Mar  1 00:09:20.983: IP: s=10.0.0.1 (local), d=10.0.0.2 (FastEthernet0/0.1), len 100, sending
*Mar  1 00:09:20.983:     ICMP type=0, code=0
R1#un all

Now I could have made it more confusing and switch the names, but why go there take below .net file for GNS and play your self:

autostart = False
[127.0.0.1:7200]
    workingdir = D:\DYN\Work
    udp = 10000
    [[3640]]
        image = D:\DYN\C3640-JK.BIN
        idlepc = 0x6060d328
        ghostios = True
        chassis = 3640
    [[ROUTER R1]]
        model = 3640
        console = 2000
        cnfg = R1.cfg
        slot0 = NM-1FE-TX
        f0/0 = R2 f0/0
        x = -221.0
        y = -91.0
    [[ROUTER R2]]
        model = 3640
        console = 2001
        cnfg = R2.cfg
        slot0 = NM-1FE-TX
        f0/0 = R1 f0/0
        x = 144.0
        y = -83.0
[GNS3-DATA]
    configs = .
    [[NOTE 1]]
        text = f0/0
        x = -6.99933176856
        y = 21.7687899898
        interface = R2 f0/0
    [[NOTE 2]]
        text = f0/0
        x = 72.9993317686
        y = 22.2312100102
        interface = R1 f0/0

This is the very basic VRF , If you understand that it is the first step to understanding MPLS VPN’s

IPv6 6to4 Tunnel using Linux

2011-06-19T22:44:00.010+03:00

I have created for my self a script that allow me to create a 6to4 tunnel in one command, I would like to share with you the results:

#!/bin/bash
# 
# Shiran  Guez CCIE 20572
# 
# Create a 6to4 IPv6 tunnel, allow an easy step into the IPv6 world
#  
# should run the script with root or sudo
# curl is needed for External IP address retrive 
# 
# GENERAL Note :
#
# The below is an example of a tcpdump output from the test performed by this script, you can see that first we generate an IPv6 packet that is translated and sent to the anycast and answer is recived back from anycast address.
#12:13:29.215403 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 64) 2002:5744:2e00::1 > 2a00:1450:400c:c01::69: [icmp6 sum ok] ICMP6, echo request, length 64, seq 1
#12:13:29.215417 IP (tos 0x0, ttl 200, id 0, offset 0, flags [DF], proto IPv6 (41), length 124)
#    10.0.0.4 > 192.88.99.1: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 64) 2002:5744:2e00::1 > 2a00:1450:400c:c01::69: [icmp6 sum ok] ICMP6, echo request, length 64, seq 1
#12:13:29.583505 IP (tos 0x80, ttl 245, id 0, offset 0, flags [DF], proto IPv6 (41), length 124)
#    192.88.99.1 > 10.0.0.4: IP6 (class 0x80, hlim 55, next-header ICMPv6 (58) payload length: 64) 2a00:1450:400c:c01::69 > 2002:5744:2e00::1: [icmp6 sum ok] ICMP6, echo reply, length 64, seq 1
#12:13:29.583505 IP6 (class 0x80, hlim 55, next-header ICMPv6 (58) payload length: 64) 2a00:1450:400c:c01::69 > 2002:5744:2e00::1: [icmp6 sum ok] ICMP6, echo reply, length 64, seq 1
#
#
_START_6TO4_ () {
                LOCAL_IP_ADDR=`ifconfig | grep "inet " | grep -v "127.0." | awk -F : '{print $2}' | awk '{print $1}'`
                EXTEN_IP_ADDR=`curl corz.org/ip`
                ARRR_6TO4_IPV6=$(printf "2002:%02x%02x:%02x%02x::1" $(echo $EXTEN_IP_ADDR | tr "." " "))
                NETWORK_PREFIX=$(printf "2002:%02x%02x:%02x%02x:1::/64" $(echo $EXTEN_IP_ADDR | tr "." " "))
                ETH0_IPV6=$(printf "2002:%02x%02x:%02x%02x:1::1/64" $(echo $EXTEN_IP_ADDR | tr "." " "))
                #               
                # Create the tunnel
                ip tunnel add tun6to4 mode sit ttl 200 remote any local $LOCAL_IP_ADDR
                ip link set dev tun6to4 up
                ip -6 addr add $ARRR_6TO4_IPV6/48 dev tun6to4
                ip -6 addr add $ETH0_IPV6 dev eth0
                ip -4 addr add $EXTEN_IP_ADDR dev tun6to4
                #Comment:        RFC 3068 
                #Comment:        http://www.rfc-editor.org/rfc/rfc3068.txt
                #Comment:        This block is used by the multiple, separately operated networks 
                #Comment:        and often originates from many different Autonomous Systems.
                #Comment:        The below add a route redirecting the outgoing traffic to the anycast address.
                ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1
                ip -6 route add $NETWORK_PREFIX dev eth0 metric 1
                # Display and test results
                _SHOW_
}
_STOP_ALL_ () {
        ip -6 route flush dev tun6to4
        ip -6 route flush scope global
        ip -6 addr flush scope global
        ip link set dev tun6to4 down
        ip tunnel del tun6to4
}
_REFRESH_TUNNEL_ () {
                _STOP_ALL_
                _START_6TO4_
}
_SHOW_ () {
        echo " =============== 6to4 Dynamic Tunnel ===================="
        echo " ETH0 IPV6 ADDR : $(echo "`ip -6 addr | grep -A 2 eth0 | grep inet6 | awk '{print $2}'`")"
        echo " TUNNEL IPV6 ADDR : $(echo "`ip -6 addr | grep -A 2 tun6to4 | grep inet6 | awk '{print $2}'`")"
        echo " Testing Connectivity please wait..."
        # TEST IS PERFORMED TO ONE OF GOOGLE.COM IPV6 ADDR 2a00:1450:400c:c01::69
        echo " TEST RESULT : $(ping6 -c 1 2a00:1450:400c:c01::69 > /dev/null && echo "SUCCESS" || echo "FAILED TO CONNECT" ;)"
}
case "$1" in
  start)
        _START_6TO4_
    ;;
  stop)
        _STOP_ALL_
   ;;
  show)
        _SHOW_
    ;;
  refresh)
        _REFRESH_TUNNEL_
        ;;
  *)
    echo "Usage: tunnel6 {start|stop|refresh|show}"
    exit 1
    ;;
esac
exit 0

IPIP tunnel creator via bash

2010-11-03T22:21:00.002+02:00

   1:  #!/bin/bash

   2:  #

   3:  # Tunnel ipip Automation

   4:  # Creator: Shiran Guez

   5:  #

   6:  TUN_ETH="eth0"

   7:  IP_DEST_EXT=""

   8:  TUNNEL_IP_SRC=""

   9:  TUNNEL_IP_DST=""

  10:  _CREATE_ () {

  11:  echo "Please enter the name of your local interface [eth0 is default]: "

  12:  echo "[ To Skip enter >>>skip<<< ]"

  13:  while :;

  14:  do

  15:      read COMM_ETH

  16:      if [ "$COMM_ETH" == "skip" ] ;then

  17:          break

  18:      elif [ "$COMM_ETH" == "eth0" ] ;then

  19:          break

  20:      else

  21:          ifconfig "$COMM_ETH" >/dev/null

  22:          if [ $? -eq 0 ] ;then

  23:              TUN_ETH="$COMM_ETH"

  24:              break

  25:          else

  26:              echo "You have entered a wrong ethernet interface"

  27:              echo "Please try again: "

  28:          fi

  29:      fi

30:

  31:  done

  32:  localip=$(ifconfig $TUN_ETH | grep Bcast | awk '{print $2}' | awk -F: '{print $2}')

  33:  echo "Please enter the destination IP for the tunnel: "

  34:  while :;

  35:  do

  36:      read IP_DEST_EXT

  37:      echo "Are you sure $IP_DEST_EXT is a valid IP [Y]:"

  38:      read ANS_ME

  39:      ANS_ME=$(echo $ANS_ME | tr a-z A-Z)

  40:      if [ "$ANS_ME" == "Y" ] ;then

  41:          break

  42:      else

  43:          echo "Please enter destination again:"

  44:       fi

  45:  done

  46:  echo "Please enter tunnel IP and Peer Address: "

  47:  while :;

  48:  do

  49:      echo "IP : "

  50:          read TUNNEL_IP_SRC

  51:      echo "Peer : "

  52:      read TUNNEL_IP_DST

  53:      echo "Peer subnet mask [ /16 , /24 ...]: "

  54:      read TUNNEL_IP_DST_MASK

  55:      echo "Tunnel IP will be $TUNNEL_IP_SRC and its peer address will be $TUNNEL_IP_DST using subnet mask $TUNNEL_IP_DST_MASK"

  56:      echo "Please confirm [Y]:"

  57:          read ANS_ME_NOW

  58:          ANS_ME_NOW=$(echo $ANS_ME_NOW | tr a-z A-Z)

  59:          if [ "$ANS_ME_NOW" == "Y" ] ;then

  60:                  break

  61:          else

  62:                  echo "Please enter again:"

  63:          fi

64:

  65:  done

  66:  ip tu ad ipiptun mode ipip local $localip remote $IP_DEST_EXT ttl 64 dev $TUN_ETH

  67:  ip ad ad dev ipiptun $TUNNEL_IP_SRC peer $TUNNEL_IP_DST/$TUNNEL_IP_DST_MASK

  68:  ifconfig ipiptun up

  69:  }

70:

  71:  _DESTROY_ () {

  72:  ip add | grep ipiptun > /dev/null

  73:  if [ $? -eq 0 ] ;then

  74:      ifconfig ipiptun down

  75:      echo "Tunnel was removed"

  76:  else

  77:      echo "No Tunnel to remove"

  78:  fi

  79:  }

80:

  81:  lsmod | grep ipip > /dev/null

  82:  if [ $? -eq 0 ] ;then

  83:      while :;

  84:      do

  85:          echo "Please enter 1 to create or 2 for removing a tunnel"

  86:          read SELECTION

  87:          if [ "$SELECTION" == "1" ] ; then

  88:              _CREATE_

  89:              break

  90:          elif [ "$SELECTION" == "2" ] ; then

  91:              _DESTROY_

  92:              break

  93:          fi

94:

  95:      done

  96:  else

  97:      echo "ipip module is not loaded try to first load the ipip module and then run the tool again, Thank you!"

  98:  fi

OT : mp4 to mp3 conversion tool

2010-09-22T13:29:00.002+02:00

Hi All I have decided to share with you something I did for my self as I found my self doing many conversion of mp4 to mp3 for my iPhone, i did an automation script that takes the path of a directory or file and convert all mp4 to mp3.

#!/bin/bash

# mp4tomp3

# Cool Tool created to automate the conversion process of mp4 files to mp3

# Creator : Shiran Guez

# Created under ubuntu but should work on any linux distribution

# That have ffmpeg installed

CONVERTER_PATH=$1

if [ -z $1 ] ; then

    CONVERTER_PATH=$(echo "`pwd`")

fi

if [ -d $CONVERTER_PATH ] ; then

    for i in *.mp4

do

        ffmpeg -i "$i" -f mp3 -ab 192000 -vn $(echo $i | sed 's/.\mp4/.\mp3/')

    done

    echo "Done"

else

    file $CONVERTER_PATH | grep "MPEG v4"

    if [ $? -eq 0 ] ;then

        ffmpeg -i "$CONVERTER_PATH" -f mp3 -ab 192000 -vn $(echo $CONVERTER_PATH | sed 's/.\mp4/.\mp3/')

    else

        echo "That is not a valid format of mp4 file to convert"

        echo "either provide a path of  directory containing mp4 extensions"

        echo "or provide a path to a valid mp4 file"

fi

fi

I moved the script to /usr/sbin and added excutable priv “chmod +x /usr/sbin/mp4tomp3” to run it simply run the command from cli example:

sudo mp4tomp3 <path_of_dir or file_name>

or just under the directory you have files to convert

cd /to/desired/path sudo mp4tomp3

enjoy

eBgp-Multihop vs. ttl-security

2010-09-07T06:29:00.002+03:00

Today I have answered one of the Cisco CCIE groupstudy questions on the relation between the two features.

To understand the relation first lets explore what each feature job and purpose in life:
eBgp-multihop – like in IGP the default ttl for packets is 1 and that is to ensure delivery only to the directly connected network node, but unlike IGP eBgp is often (in real networks) established via interface loopback and because packet generated / sourced from Interface loopback going out the router using its next hop interface that break the communication as 1-1 = 0 and 0 TTL mean packet can’t be delivered to destination, so

what to do?!
increase TTL (is the answer :-))
using the eBgp-multihop is like simply indicating what TTL should be set to the packet to ensure delivery to the desired network

ttl-security – so we now understand the eBgp affect packet going out of our system by manipulating its TTL,
How do I prevent neighbor coming 10 hops away from me?!
you set the ttl-security.

Now you will say, if you didn't want to be neighbor do not set him up on your side and that would be also ok, but lets say you have neighbor relation with 2 router and each is 3 hops away (normally) now one router experienced a link fail causing it to change route to reach you and now he is 5 hops away, and your policy is to maintain neighbor relation with no more then 3 hops away.

but again you would say, so set the eBgp-multihop to 3 (or 4 if using the loopback) and you would be again correct.

so why ttl-security, mainly it is to prevent DoS attack!

hope this helped in some way to understand the difference and each feature job in life.

OT : DropBox Very Cool

2010-08-06T11:05:00.001+03:00

I have discovered that service just last week and my life was changed since then, dropbox provide a share with all your PC’s with versioning of files and other very cool features.

How many times you transferred a file from your home pc to work pc or the other way around and if you like me that have 2 pc at work laptop and 2 pc at home well… I hope you get the picture :-)

https://www.dropbox.com/referrals/NTk3NTUxNzY5

How I Started?!

2010-06-25T11:37:00.001+03:00

My first encounter with Cisco was at year 2000 when I had just started in a small startup as MS sys admin, the company wanted to develop some proprietary voice codec as that was not very successful they wanted to channel there knowledge to make money and VoIP calling cards was the way, in 2000 it was something very fresh and not high quality (very buggy) but the main goal was to save for the card distributers and make some money.

So why am I telling you all thins, I realized that I have never did a VoIP article although that was one of the first topics I learned and worked with Cisco products, I think I should dedicate some words to that part of my past.

May be I will start and tell you how our first setup looked like back then component wise and lets see where it takes us, so “what we had there” (small joke for all Israeli):

Israel Side
3640 with 4 E1 voice cards module IOS was I think 12.0 or 12.1 with voice feature set (sorry cant remember)
US Side (Hudson 60)
Nortel PBX connected to several Cisco 7200
Monitoring and Billing
Monitoring System (HPOV, yes full HPOV over Solaris version 7 or 8 )
AAA and Billing System (some home made Russian using “freeradius” for the AAA)

This is showing the very start:

Very Basic diagram of how it looked like, on the Israel Side first we where connected to the local PSTN and on the US Side we where connected to a privet PBX that was connected in Hudson 60 to many carriers, the IP Side we used first GW to GW setup very basic but as the operation grown and we needed to connect more GW’s and more Global Distributed Termination Providers the management had become less and less efficient, that where (after ~30 Different Interconnected termination points) we moved to a central call management system using a better design using Gatekeeper (until year 2004 we worked only h323) . first system we used was VoiceMaster (by sysmaster.com) I traveled to san Francisco to both learn and adapt that system to our need’s as until we came they where working only with Quintum Voice GW’s, I helped then integrate their system with Cisco Voice Gateways.

The main integration work was on adjusting the TCL scripts for the PrePaid system, we used IVR based on TCL script running in the Cisco pulling voice prompts from a tftp those where the days :-)

First CCA's

2010-06-17T17:46:00.001+03:00

L2L IPSec Tunnel ASA to IOS

2010-03-18T22:53:00.002+02:00

I would like to share with you a case I got that allowed me to explore the ASA, as I am no ASA expert I hope that is not to dumb and will provide some added value but if not then ok I will share it anyway

For the case study here lets say there is no network beside the diagram you will see bellow

First I would like to share configuration and some debug commands (and there output).

###ASA

crypto isakmp enable <outside-if-name>
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 1
lifetime 86400

access-list IPSec-traffic extended permit ip <SOURCE_NET_SERVER_FARM> <DESTINATION_NET_HOSTS>
crypto ipsec transform-set TS esp-des esp-md5-hmac
crypto map IPSEC 10 match address IPSec-traffic
crypto map IPSEC 10 set peer <C2800-DST-IP>
crypto map IPSEC 10 set transform-set TS
crypto map IPSEC interface <outside-if-name>

tunnel-group <C2800-DST-IP> type ipsec-l2l
tunnel-group <C2800-DST-IP> ipsec-attributes
pre-shared-key <PASSWORD>

###ROUTER

#IKE PHASE 1
crypto isakmp policy 10
hash md5
authentication pre-share
crypto isakmp key <PASSWORD> address 0.0.0.0 0.0.0.0

#IKE PHASE 2 IPSEC
crypto ipsec transform-set TS esp-des esp-md5-hmac
crypto dynamic-map DYN 10
set transform-set TS
crypto map IPSEC 10 ipsec-isakmp dynamic DYN

interface <X>
crypto map IPSEC

# ASA SOME SHOW/DEBUG COMMANDS

ciscoasa(config)# sh isakmp sa detail

Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: <C2800-DST-IP>
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
    Encrypt : des             Hash    : MD5
    Auth    : preshared       Lifetime: 86400
    Lifetime Remaining: 57501

ciscoasa(config)# sh ipsec sa detail
interface: outside
Crypto map tag: IPSEC, seq num: 10, local addr: <ASA-SRC-IP>

      access-list IPSec-traffic permit ip <SOURCE_NET_SERVER_FARM> <DESTINATION_NET_HOSTS>
      local ident (addr/mask/prot/port): (SOURCE_NET/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (DESTINATION_NET/255.255.255.0/0/0)
      current_peer: <C2800-DST-IP>

      #pkts encaps: 71917, #pkts encrypt: 71917, #pkts digest: 71917
      #pkts decaps: 71903, #pkts decrypt: 71903, #pkts verify: 71903
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 71917, #pkts comp failed: 0, #pkts decomp failed: 0
      #pkts no sa (send): 0, #pkts invalid sa (rcv): 0
      #pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
      #pkts invalid prot (rcv): 0, #pkts verify failed: 0
      #pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
      #pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
      #pkts replay failed (rcv): 0
      #pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
      #pkts internal err (send): 0, #pkts internal err (rcv): 0

local crypto endpt.: <ASA-SRC-IP>, remote crypto endpt.: <C2800-DEST-IP>

path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: E1C2DB71

    inbound esp sas:
      spi: 0xE8F3372E (3908253486)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: IPSEC
         sa timing: remaining key lifetime (kB/sec): (4274983/1861)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xE1C2DB71 (3787643761)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: IPSEC
         sa timing: remaining key lifetime (kB/sec): (4274983/1861)
         IV size: 8 bytes
         replay detection support: Y

# ISAKMP DEBUG

ciscoasa# debug crypto isakmp

HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 192
%ASA-7-713236: IP = <C2800-DEST-IP>, IKE_DECODE RECEIVED Message (msgid=c49feb32) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 192
%ASA-7-715047: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, processing hash payload
%ASA-7-715047: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, processing SA payload
%ASA-7-715047: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, processing nonce payload
%ASA-7-715047: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, processing ID payload
%ASA-7-714011: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, ID_IPV4_ADDR_SUBNET ID received-SOURCE_NET_SERVER_FARM
%ASA-7-715047: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, processing ID payload
%ASA-7-714011: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, ID_IPV4_ADDR_SUBNET ID received--DESTINATION_NET_HOSTS
%ASA-7-715047: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, processing notify payload
%ASA-7-713906: Responder Lifetime decode follows (outb SPI[4]|attributes):
%ASA-7-713906: 0000: 37D453FB 80010001 00020004 00000E10 7.S.............
%ASA-5-713073: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, Responder forcing change of IPSec rekeying duration from 28800 to 3600 seconds
%ASA-7-713906: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, loading all IPSEC SAs
%ASA-7-715001: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, Generating Quick Mode Key!
%ASA-7-715001: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, Generating Quick Mode Key!
%ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x37D453FB) between <ASA-SRC-IP> and <C2800-DEST-IP>(user= <C2800-DEST-IP>) has been created.
%ASA-5-713049: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, Security negotiation complete for LAN-to-LAN Group (<C2800-DEST-IP>) Initiator, Inbound SPI = 0x24d888f2, Outbound SPI = 0x37d453fb
%ASA-7-713906: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, oakley constructing final quick mode
%ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0x24D888F2) between <ASA-SRC-IP> and <C2800-DEST-IP> (user= <C2800-DEST-IP>) has been created.
%ASA-7-714006: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, IKE Initiator sending 3rd QM pkt: msg id = c49feb32
%ASA-7-713236: IP = <C2800-DEST-IP>, IKE_DECODE SENDING Message (msgid=c49feb32) with payloads : HDR + HASH (8) + NONE (0) total length : 72
%ASA-7-715007: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, IKE got a KEY_ADD msg for SA: SPI = 0x37d453fb
%ASA-7-715077: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, Pitcher: received KEY_UPDATE, spi 0x24d888f2
%ASA-6-713905: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, Starting P2 Rekey timer to expire in 3420 seconds
%ASA-5-713120: Group = <GRP-NAME>, IP = <C2800-DEST-IP>, PHASE 2 COMPLETED (msgid=c49feb32)

# IPSEC DEBUG
ciscoasa# debug crypto ipsec

%ASA-3-713119: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, PHASE 1 COMPLETED
%ASA-7-713121: IP = <C2800-DEST-IP>, Keep-alive type for this connection: DPD
%ASA-7-713906: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Starting phase 1 rekey timer: 82080000 (ms)
%ASA-7-715006: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, IKE got SPI from key engine: SPI = 0xeaa54840
%ASA-7-713906: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, oakley constucting quick mode
%ASA-7-715046: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, constructing blank hash payload
%ASA-7-715046: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, constructing IPSec SA payload
%ASA-7-715046: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, constructing IPSec nonce payload
%ASA-7-715001: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, constructing proxy ID
%ASA-7-713906: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Transmitting Proxy Id:
Local subnet: SOURCE_NET_SERVER_FARM mask 255.255.255.0 Protocol 0 Port 0
Remote subnet: DESTINATION_NET_HOSTS Mask 255.255.255.0 Protocol 0 Port 0
%ASA-7-714007: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, IKE Initiator sending Initial Contact
%ASA-7-715046: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, constructing qm hash payload
%ASA-7-714004: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, IKE Initiator sending 1st QM pkt: msg id = 0b0b91e2
%ASA-7-713236: IP = <C2800-DEST-IP>, IKE_DECODE SENDING Message (msgid=b0b91e2) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 192
%ASA-7-713236: IP = <C2800-DEST-IP>, IKE_DECODE RECEIVED Message (msgid=b0b91e2) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 192
%ASA-7-715047: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, processing hash payload
%ASA-7-715047: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, processing SA payload
%ASA-7-715047: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, processing nonce payload
%ASA-7-715047: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, processing ID payload
%ASA-7-714011: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, ID_IPV4_ADDR_SUBNET ID received--SOURCE_NET_SERVER_FARM
%ASA-7-715047: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, processing ID payload
%ASA-7-714011: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, ID_IPV4_ADDR_SUBNET ID received--DESTINATION_NET_HOSTS
%ASA-7-715047: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, processing notify payload
%ASA-7-713906: Responder Lifetime decode follows (outb SPI[4]|attributes):
%ASA-7-713906: 0000: 18C33FE5 80010001 00020004 00000E10 ..?.............

%ASA-5-713073: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Responder forcing change of IPSec rekeying duration from 28800 to 3600 seconds
%ASA-7-713906: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, loading all IPSEC SAs
%ASA-7-715001: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Generating Quick Mode Key!
%ASA-7-715001: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Generating Quick Mode Key!
%ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x18C33FE5) between <ASA-SRC-IP> and <C2800-DEST-IP> (user= <C2800-DEST-IP>) has been created.
%ASA-5-713049: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Security negotiation complete for LAN-to-LAN Group (<C2800-DEST-IP>) Initiator, Inbound SPI = 0xeaa54840, Outbound SPI = 0x18c33fe5
%ASA-7-713906: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, oakley constructing final quick mode
%ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0xEAA54840) between <ASA-SRC-IP> and <C2800-DEST-IP> (user= <C2800-DEST-IP>) has been created.
%ASA-7-714006: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, IKE Initiator sending 3rd QM pkt: msg id = 0b0b91e2
%ASA-7-713236: IP = <C2800-DEST-IP>, IKE_DECODE SENDING Message (msgid=b0b91e2) with payloads : HDR + HASH (8) + NONE (0) total length : 72
%ASA-7-715007: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, IKE got a KEY_ADD msg for SA: SPI = 0x18c33fe5
%ASA-7-715077: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Pitcher: received KEY_UPDATE, spi 0xeaa54840
%ASA-6-713905: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, Starting P2 Rekey timer to expire in 3420 seconds
%ASA-5-713120: Group = <C2800-DEST-IP>, IP = <C2800-DEST-IP>, PHASE 2 COMPLETED (msgid=0b0b91e2)

THERE WILL BE CONTINUE…

GOOGLE BUZZ

2010-03-11T15:26:00.000+02:00

RIP V2 Analysis

2010-03-11T07:32:00.002+02:00

it is very basic stuff but will give you some prospective on how the RIP process works on Cisco router.
When you start the RIP process initially until you define the first network under it you will not see any process running

as you can see from above print once I have entered a network 3 process came up, RIP Router the main process RIP send and RIP Timers each name is simply enough self explanatory. now after I have added my own network I will send a request for receiving the full routing table

How do you know that this is a request well just by looking into the wireshark you can see he did the hard work for you but actually it is not that hard as the first byte is either 1 or 2. 1 for request, 2 for response the whole algorithm is laying on this 2 messages, another interesting part about this message is that the metric is set to 16 witch is infinity in RIP world.

now, once I start adding more network’s to be advertised the router start sending response packet every almost 30 seconds the router actually calculate a random time between 25 – 30 seconds and then send the response.

the response contain the full rip routing table, the max number of routes that can be sent in such packet is 25 any thing else will be sent in additional packet, now in case you add a network the router will send immediately a route update contain the single or the number of networks you advertise, but it will not reset the original response timer so you may have as the example bellow:

packet 11 show that he was sent after 26.9884 sec
packet 12 I have added a subnet so it was sent immediately, it just happen to be after 10 sec from the last full update
packet 13 after 16 sec from the partial update the router send a full table
So you see that the router didn't update his time due to the update

Now I have added Authentication see the diff between clear text and MD5 beside the obvious see if you can tell

I hope you found it, but if not I will tell you!!!
see the number of networks without authentication and with authentication!!
Yes with authentication (clear text) the router remove the last prefix and insert the authentication at the top

Now when adding a key chain and assigning it to the interface you can select the mode of authentication, the default is clear text but you have also an MD5 option
you need to remember that when adding MD5 the authentication is growing 100% from 20byte to 40byte what makes the largest possible RIP packet to 532byte instead of 512byte with default or no authentication.

Now the last part, when removing a network the router advertise the network you removed with metric 16 and that is to poison the routers and telling them that network no longer exist in my routing.

Over all you can see that RIP is very basic protocol no fancy neighbor relationships no reliable mechanism, very simple to implement and troubleshoot.

Some IPv6 Basics

2010-03-03T00:18:00.006+02:00

IPv6 is one of my favorite topics as it looks very complex but it is really nice and easy.

easy deployed
easy to manage

IPv6 Header as you can see constructed of

8 bit – Version 8 bit - Traffic Class (also known as TOS byte) 20 bit – Flow Label 20 bit - Payload Length 8 bit – Next Header 8 bit – Hop Limit (similar to TTL idea) 128 bit – S. Address 128 bit – D. Address

Total 40byte header

Compare it to the IPv4 Header:

You can see a smaller header 20byte but much more complex and with the options it can be extended up to 60byte so that is much more then IPv6 Ok now I would like to get to some demonstration of how easy just to get you the taste of IPv6 On my PC (OS-Win7) i didn't configure any IPv6 manually, by default OS win7 and most linux distributions are IPv6 enabled once installed, what that mean you ask?! It mean ipv6 link local address is configured automatically, now for those of you that are new to IPv6 you will ask me, what is link local IPv6 address?! Link Local – it is a non routable ipv6 address that is unique to the local segment, a link local address start with the following FE80::/10 in Cisco the link local address is created from FE80:: + MAC address after taking the 7th bit and converting it (if it was 0 –> 1 and if 1 –>0) so example from my router

HOME-GUEZ(config-if)#do sh int vl16 Vlan16 is up, line protocol is up Hardware is EtherSVI, address is 0017.5922.8114 (bia 0017.5922.8114)

Take 0017.5922.8114 7th bit is 0 change it to 1 makes it 0217.5922.8114 and in the middle inserting 0xFFFE so the full address should look like:

FE80:0000:0000:0000:0217:59FF:FE22:8114 = 128 bit or in short FE80::217:59FF:FE22:8114 and as you can see from the show bellow I was correct :-)

HOME-GUEZ(config-if)#do sh ipv6 int vl16 Vlan16 is up, line protocol is up IPv6 is enabled, link-local address is FE80::217:59FF:FE22:8114

Now I would like to show you something, I have enabled debug of ipv6 packets and under my vlan interface I have added a unicast global ipv6 address and at that moment like magic you can see the router starting working automaticly

HOME-GUEZ#debug ipv6 packet detail IPv6 unicast packet debugging is on (detailed) HOME-GUEZ#term mon HOME-GUEZ# HOME-GUEZ#conf t Enter configuration commands, one per line. End with CNTL/Z. HOME-GUEZ(config)#int vl16 HOME-GUEZ(config-if)#ipv6 address 2001::1/64 HOME-GUEZ(config-if)# Mar 2 21:05:53.956: IPV6: source :: (local) Mar 2 21:05:53.956: dest FF02::1:FF22:8114 (Vlan16) #### prot 58 is ICMPv6, Routers with IPv6 use ICMPv6 control messages to solicit and advertise neighbors, also notice to the use of the last 24 bits 22:8114 at the end of the destination address, the router is sending his own link local last 24 bits to verify that he is the only one of the link local with such address, also called DAD (Duplicate Address Detection) #### I didnt mention this before as I wanted to show you before I talk about it, but the next headed filed job in the ipv6 header is to indicate what is coming after the ipv6 header #### In the first packet you so prot 58 witch is ICMPv6, but in the next you can see prot 0 and that mean hop by hop option is directly after the ipv6 header, #### unlike the ipv4 the ipv6 options are not really part of the ipv6 header, the hop by hop header job is informative extension that each routing node should know about #### not very interesting to us now. Mar 2 21:05:53.956: traffic class 224, flow 0x0, len 64+16, prot 58, hops 255, originating Mar 2 21:05:53.956: IPv6: Sending on Vlan16 Mar 2 21:05:53.960: IPV6: source :: (local) Mar 2 21:05:53.960: dest FF02::16 (Vlan16) Mar 2 21:05:53.960: traffic class 224, flow 0x0, len 76+0, prot 0, hops 1, originating Mar 2 21:05:53.960: IPv6: Sending on Vlan16 Mar 2 21:05:53.960: IPV6: source :: (local) Mar 2 21:05:53.960: dest FF02::16 (Vlan16) Mar 2 21:05:53.960: traffic class 224, flow 0x0, len 76+0, prot 0, hops 1, originating Mar 2 21:05:53.960: IPv6: Sending on Vlan16 Mar 2 21:05:53.960: IPV6: source :: (local) Mar 2 21:05:53.960: dest FF02::16 (Vlan16) Mar 2 21:05:53.960: traffic class 224, flow 0x0, len 76+0, prot 0, hops 1, originating Mar 2 21:05:53.960: IPv6: Sending on Vlan16 Mar 2 21:05:53.960: IPV6: source :: (local) Mar 2 21:05:53.960: dest FF02::16 (Vlan16) Mar 2 21:05:53.960: traffic class 224, flow 0x0, len 76+0, prot 0, hops 1, originating Mar 2 21:05:53.964: IPv6: Sending on Vlan16 Mar 2 21:05:54.456: IPV6: source :: (local) Mar 2 21:05:54.456: dest FF02::16 (Vlan16) Mar 2 21:05:54.456: traffic class 224, flow 0x0, len 76+0, prot 0, hops 1, originating Mar 2 21:05:54.456: IPv6: Sending on Vlan16 #### Here is neighbor advertisement Mar 2 21:05:54.956: IPV6: source FE80::217:59FF:FE22:8114 (local) Mar 2 21:05:54.956: dest FF02::1 (Vlan16) Mar 2 21:05:54.956: traffic class 224, flow 0x0, len 72+8, prot 58, hops 255, originating Mar 2 21:05:54.956: IPv6: Sending on Vlan16 #### And that is a Router Advertisement after my PC had received the router advertisement it already configured him self with a global unicast ipv6 address #### IPv6 Address. . . . . . . . . . . : 2001::6df4:5c91:aac1:9a36(Preferred) Mar 2 21:05:54.956: IPV6: source FE80::217:59FF:FE22:8114 (local) Mar 2 21:05:54.956: dest FF02::1 (Vlan16) Mar 2 21:05:54.956: traffic class 224, flow 0x0, len 104+1396, prot 58, hops 255, originating

And you can see I could ping my router IPv6 global unicast ipv6 address

C:\Users\shiran>ping 2001::1

Pinging 2001::1 with 32 bytes of data: Reply from 2001::1: time=4ms Reply from 2001::1: time=1ms Reply from 2001::1: time=1ms Reply from 2001::1: time=1ms

Ping statistics for 2001::1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 4ms, Average = 1ms

Now I made the debugging shorter then it is but let me show you how dose the router advertisement look like and that will be the last for this post:

Now I know that this post is not very organized and it should contain much more explanation but I wanted to give you some 10000 feet view on how it looks complex but at the end I did on my router only 2 commands and I had my home network running IPv6

ipv6 unicast-routing <under the interface> ipv6 address 2001::1/64

Now yes that is not a grand design but think what you had to do if you wanted the same simple network for ipv4….

See how a lunch in 1989 impacted our life today and for many years to come

2010-02-28T13:01:00.002+02:00

For those of you that need introduction “Yakov Rekhter” is one of the fathers of BGP and MPLS Architecture, I hope you will all enjoy this Lecture (disregard the Juniper logo :-))

[ OFF TOPIC ] Wet iPhone

2010-02-28T10:56:00.002+02:00

Few days ago I have been driving my motorcycle back from work to my home, there was at the time an unexpected pouring rain, needless to say I was wet to my bones When I have arrived home I saw that my iPhone suffered a wet shower, I didn’t know if it damaged my iPhone as it was functioning, so I went to sleep. the next day I tried to open my phone and my precious iPhone refused to function properly, the screen was really dark, I started to cry (not really) then I went to my friend to search for a solution, I saw that someone had saved his blackberry using a bawl of rice, I was skeptic and started to plan the funeral but I have inserted my precious to a bawl of rice (Persian rice), then after almost 2 nights I have opened my iPhone and like magic it started speaking to me again.

conclusion:

driving in motorcycle in the rain can damage your iPhone!
A bawl off rice can be more then a Chinese side dish

[ OFF TOPIC ] VMWARE ESX Clone

2010-02-26T09:53:00.004+02:00

Ok, I wish to share with you a tool I created and is helping me in my day to day work. for thouse of you that are using ESX or ESXi (especialy the ESXi as it is free) without the Virtual Center you probebly noticed that there is no clone option, now it is no problem for us tech people to overcome this problem, but some times we are lazy (dont tell that to anyone). I have done a simple shell script that run under the ESX or ESXi console (in the ESXi there is the unsupported console) please noice as I written it very fast and for my use it has almost no tolerance for user error so play with care. Get it here

TCP Over Satellite communications

2010-02-25T22:17:00.003+02:00

First I would like to say it has been a very long time since my last article, but now I am in the mode for writing so I would like to share my expireance with TCP and Satellite Communication challanges. I am working at Expand Networks and one of our advantages is in optimizing TCP communication in challanging enviorments such as Satellite, so what is so challanging you ask??

The Satellites we use for communication are up in the sky ~35000 kilometer away from ground also called GEO Sat
Communication between ground station to the Satellite easly impacted from enviorment (clouds, rain, snow, solar events...)
Satellite is a shared resource

All the Satellite set a big challange in TCP communication, one of the main is RTT (round trip time), the other is packet loss due to channel error's the satellite may encounter.

To overcome this challanges we use some of the avilable TCP enhancments avilable such as: proxying the TCP session and in the session over the satelite increasing Window Size using the window scale options. additional to that selecting the congestion control that is most suitable for the enviorment we are in. the congestion control as his name indicate is an algorithem that tells the TCP when to back off because a congestion was detected or when to continue and at what level to send the tcp traffic.

Here are Some of the Congestion Control Algorithems:

Reno - the most common used today by default (linux implement NewReno), basicly during the slow start increasing 1/cwnd for each ACK recived and decrease by 0.5 if a loss was detected

BIC - binary increase congestion as the name imply it uses some binary search algorithem to esitimate the correct cwnd

CUBIC - another algorithem considered some kind of enhancment to the BIC algorithem

Hybla - some kind of a hot topic in congestion control algorithem over satellite communication

Vegas, illinois,Veno, Westwood....

basicly you can see that there are many algorithms out there and all are created due to diffrent challanges sattelite , wireless or even wired communication had brought over the years.

There is no ultimate algorithem that can handle all sitiuations (as of today), each have his advantages and disadvantages, Reno is ok when delay is going +-20ms + RTT but more then that if you had +-100ms + RTT with Reno you would be in a problem as it would often back off the window by half.

Re-certified CCIE 20572

2009-08-30T09:27:00.004+03:00

Finally done with that on last Friday 28th, that test was like a stone over my chest, with all my work and family I had almost no time for studding but I did it anyhow. So now for additional 2 years I can unchange my signature :-). The test was not that hard (ver3) I think the hard was the anticipation for a hard question that will fail me.

DCOF – Data Center of the Future

2009-07-16T18:17:00.006+03:00

yesterday we had a virtual event provided by some of the leaders in Data Center Computing (Cisco, VMware, EMC, Oracle, NetApp, APC, EMERSON) the web virtual Event entail some of the challenges and current design's as well as future design and solutions we may encounter in Data Centers.

From my prospective the main event where the 2 first presenters Cisco and VMware, both have joind forces to show you how the Data Center of the Future should look like, VMware as the Application infrastructure and Cisco as the Networking complimentary.

We will expect to see them more and more in Data Centers providing High Availability Fault tolerance and network resilience between Data Centers.

Some of the hot discussed topics where the:

VN-link – amazing Cisco Nexus 1000V basically that is a replacement for vSwitch (VMware layer 2 switch on ESX/ESXi) and I will add to it an amazing with huge amount of capabilities in compare to the vSwitch under the ESX/ESXi.
FCOE – Fiber Channel Over Ethernet std although not new, in the context of Data Center resiliency, management, scalability and cost reduction FCOE can is defiantly an option.
vSphere – VMware Cloud solution version 4, was announced several weeks ago officially by VMware, yesterday was interesting to see the vision for the data center and there honesty about some of their weakness in the networking area (where Cisco compliment them to some level).

I work today a lot with VMware solutions and see their adaptation as their products advanced, the DCOF will be very interesting…

CCIE Re-certification

2009-07-13T21:51:00.007+03:00

I have had in the past months much considerations to take before I am starting the process again of studying for my certification, some of the considerations I will share with you (some I will leave to my self). 1) Time - that is the main point as in the last 1.5 years since the CCIE my work had become so hectic and demanding that I barely have time for my family let alone my self. 2) Money - yes you would think becoming a CCIE would win you the jackpot but I would share with you a secret it will not (may be for some lucky ones) the financial crises had got to all. 3) Family - I have 1 wife 1 son and 1 in the oven (we say tphoo tphoo tphoo like touch wood). so I need again to split my self into several pieces hopefully I would be able to reassemble all back (transformers...). 4) Work - Yes work this is the place my pay check come from, again split my self. 5) Should I consider a different track - I gone back and forward on that question over and over. 6) What material to take - again read the same books, rfc's... and if it is a new track where to start. I will not bore you with all the details and I will tell you that the final result was 1) Time = night 2) Money = dont have a choice, my job dose not pay for that but is also fair and not taking my title under her "wings" like I hear about many others. 3) Family = I would just say that I love my wife son and soon to be ... 4) Work = the only once that do not have any considerations. 5) I Decided to re cert in my current track R&S, much less time! 6) Yes no choice but to go back to txt books.

Advice unless you have a spare time or your job help you (time, money, and they need it) do not consider a different track, specialize in your own track be the best you can be where you at.

So Wish me Luck (I will keep my date to my self for now) :-)