MPLS Deployment reasons

1) Faster convergence, in the old days that was a valid reason due to the relatively complex forwarding task that required more resources then Label forwarding. Today non relevant

2) RFC 1483 the newer 2684 AAL5 ATM Adaptation Layer 5 the implementation of IP over ATM

3) BGP Core Free on the SP network, as with MPLS lookup is done based on Labels and not destination address there is no need to have the BGP table in the Core for external prefixes lookup's. this is a massive change from the requirement that Every router in the core must have BGP enabled (cpu and memory intensive load) to only the edge router have BGP enabled mean higher performance and capability.

Note: edge routers still need to have the BGP routing tables, edge routers are translating between ip routing decision to label based decisions.

4) Deployment scalability, when we face with large scale client to deploy (client that connect with 50 - 300 sites and more) we need to have under the consideration the deployment scalability and management, with that in mind 2 models of deployment are optional:

a) VPN Overlay - creating a point to point connection over the SP network, can be achieved in layer 1, 2 or 3.

Layer 1 TDM E1 T1... Layer 2 ATM FR... Layer 3 GRE, IPIP...

b) Peer to Peer - creating a connection between sites trough the ISP and with him, what I mean is that the SP need to join the client network and to achieve client privacy the SP need to manage acl's and routing updates, not very scalable and a lot of overhead. notice that in addition to the disadvantage for the SP on the additional management overhead and complexity there is the client control (doesn't have any) of his layer 3 network trough the SP.

With MPLS the VPN allow the Peer to Peer bad model to have advantage over the Overlay model where in the MPLS we use VRF Virtual Routing Forwarding separators between each network and the configuration is done only on each new site. meaning that if I am an SP and I have 3 client (Cisco, Microsoft, Verizon) each vrf will have a unique color vrf Cisco, vrf Microsoft and vrf Verizon, and to join a new branch is only to color this branch traffic accordingly, so the main work is done in the initial design and implementation and any new addition is actually very simple to add.

5) TE - traffic engineering is a small phrase for a very big spectrum of options, normally traffic routing is decided at each point separately and usually the best route is chosen according to the shortest path to destination, using TE we can make the routing decision based on multiple criteria options. allowing the traffic to fully utilize network capability.

FRR - Fast ReRouting is a very good feature that allow you to detect and reroute based on router availability in less than 50ms Very important in high sensitive traffic like VoIP.

JUNIPER JNCIA-ER SCORE 90

Well I know this is not Cisco but I have just passed 30 min ago my JNCIA-ER exam with score of 90, to be honest that was one of the shortest test's I have ever had, usually I stay no meter what to the last minute but because I was pretty sure on my answers I have left after ~20 min. The resources provided from the www.juniper.net/fasttrack/ site are excellent and answer 100% to the test questions. almost to good to be true. I must say that the last 3 weeks I have been playing with the junos (under my vmware setup) it seem to be realy nice and powerful OS. So for you professionals and experts I think it should be very nice knowledge edition, I am still thinking if I want to proceed with the JNCIS-ER exam or stop here with juniper, I will update you later. All of you have a nice weekend :-)

Spanning Tree Basics

Spanning Tree is one of the topics that most people a really scared as it is almost fully automatic feature People don’t bother to dig into it; my idea here is to give you a simple way to understand the protocol basics And also get a glance on its complex. First thing when I learn a new protocol I would like to look how it is working on the low level, so here I have drown you the BPDU structure, you can see that all implementations have a common ground and thus there is full backward support: Filed Description: PID = Protocol ID Always 0x0000 VID = Version ID 1) STP 0x00 2) R-PVST 0x02 BT = BPDU Type 1) STP 0x00 2) R-PVST / MST 0x02

TCN / TCN Ack is used only with IEEE 802.1D or with interoperation with RSTP. Proposal and agreement handshake are bits used to prevent loops, proposal sent from a designated port And agreement is sent from the root port. Unlike IEEE 802.1D in which any transition between the blocking and the forwarding state causes a topology change, Only transitions from the blocking to the forwarding state cause a topology change with RSTP. Root ID Show the Root Bridge Priority and the MAC address Root Cost Show your distance from the Root Bridge BID = Bridge ID Here the switch advertise his own Bridge MAC and Priority Port ID A 2 byte number, the first octet build from a configurable priority, the second octet is a number set by the Bridge for the port BPDU was sent from usually in newer Bridge model the port id is the Port number but in Older models it was a random number assigned to the port. Newer models: Show spanning-tree vlan 1 detail Older models: Show spanning-tree MAge = Message Age Indicate an estimated time required for a BPDU to be sent and received by any other bridge, although specified in time it is actually increasing The value by hop count. MA = Max Age This filed is given from the root bridge and by default set to 20 sec indicate the max age of a BPDU. Hello Indicate the time between each BPDU sent from the root bridge. Default 2 sec FWDD = Forward Delay Indicate the amount of time the bridge should stay in each state when transiting from blocking to forwarding. V1_L = Version 1 Length V3_L = Version 3 Length MST EXTENTION MST Config ID MST Config Name = configuration name MST Config Revision Number = configuration revision number MST Config digest = configuration digest CIST Bridge Identifier = CIST Internal Root Path Cost = cost to the root bridge CIST Remaining hops = default (20) state the max number of hops from the root bridge if packet received a packet with remaining hops set to 0 then he will Ignore the spanning tree BPDU and will be able to declare himself as Root Understand the debug as it is one of the tools you have to troubleshoot in real time, but with that said you need to make sure you do not activate spanning tree debug on production with logging console enable as you will probably end up locked out from your switch. ! Do before debug under global config No logging console logging buffered 200000 end clear logging debug spanning-tree bpdu ! output will be displayed under the “show logging” ! to disable debug un all Example output from the debug: *Apr 14 01:19:56: STP: enc 01 00 0C CC CC CD 00 14 F2 E9 44 16 00 32 AA AA 03 00 00 0C 01 0B ! you can see destination MAC 01 00 0C CC CC CD the Cisco multicast address for PVST+ also LCP show AA AA indicate to look into the next 5 byte of information in the LCP, the last 2 byte indicate the ethertype 010b is for PVST+ *Apr 14 01:19:56: STP: Data 000002023C60670014F2E944000000000060670014F2E9440080160000140002000F00 *Apr 14 01:19:56: STP: VLAN0103 Fa0/22:0000 02 02 3C 60670014F2E94400 00000000 60670014F2E94400 8016 0000 1400 0200 0F00 ! BPDU represented in hex *Apr 14 01:19:56: RSTP(103): Fa0/22 repeated msg *Apr 14 01:19:56: RSTP(103): Fa0/22 rcvd info remaining 6 *Apr 14 01:19:56: STP: VLAN0104 rx BPDU: config protocol = rstp, packet from FastEthernet0/22 , linktype SSTP , enctype 3, encsize 22 Short story on the LCP LLC (Logical Link Control) also called 802.2 header and is between 3 to 8 byte long containing protocol type information of the packet. The 3 first bytes are mandatory: DSAP Destination Service Access Point SSAP Source Service Access Point And one more byte that is important only when using SNA in any other cases it is ignored Now you will probably ask what the additional 5 byte is. Now this is where it gets little complex, when using standard STP IEEE or ISL trunks (Cisco Run ISL with PVST that is much similar to the standard accept for the vlan ID addition) then DSAP and SSAP will be set to 0x42 but when configuring DOT1Q trunks on Cisco then they use PVST+ and they are setting the SSAP and DSAP to 0xAA where it point to the additional 5 byte where we get the SNAP (SubNetwork Access Protocol) that is giving us a description of what protocol we are using in layer 3 (AppleTalk, IP, XNS….) Ok this until now are the basics for STP, once you have the structure in place it will be much easier (warning: it is not easy) to understand how it works. Recommended reading: http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080094954.shtml

10 CCIE LAB TIPS

1. Read the entire exam – now I know everyone is saying that and even Cisco it advising that in there site, but this is one of the important things you need to do before you start configuring as when you start configuring, your mind is set to different mode and you will miss important details.
2. Take Notes - In addition to step 1 you must know to take notes, what I mean you ask yourself?! Well when you read the exam you will probably be thinking "am I wasting my time reading when other are typing and almost finishing their exam" I say NO you are not but because you all stress and your brain is speeding in almost 200mph you will not remember if you will not take notes.
3. Work Your Way UP – After first two steps are done you are probably 30 min – 40 min into your exam do not panic, work in a step by step layer 2 to layer 3…
4. Ask The Proctor – there was in my lab a real nice person that I am sorry I didn't ask for his name but for me his name was Mr. Proctor and whenever I had a question about something that I didn't understand or I thought that it is not well asked then I got up from my seat and went to his desk and ASKED, no shame, If you do not understand ASK that is one of his jobs, Accept for escorting you to the dining room J
5. Don't ASK Dumb Questions – The Proctor will not give you an answer to your lab question, he will only answer "yes" or "no" format and only if he understand from your question that you know what you are talking about, so do not go and ask "question 1.1 what do you want me to do here" (In CCIE Routing and Switching Practice Labs, Cisco Press book you can see a lot of questions / Answers like that).
6. Be Polite – the proctor doesn't work for you so be nice, that is the end of proctor candidate relation advice.
7. You Can Jump Back and FWD – the exam is open to your judgment you can say I will do first security then multicast or I will do IPv6 last
8. Keep Track – the exam have a lot of questions and sections, you need to write down questions and/or sections you finished, I myself written every question and its points, when done I have marked with "ok" when skipped marked with "later" when I have finished I looked on my paper and made sure I didn't left any question without "ok"
9. Know How to check – after every question I did a check to make sure that what they want to work dose work, it is not always sufficient to put the commands as some time one section is relaying on another and putting the command relating to that question will not work until you add or remove other commands, I hope that is not to confusing, but most of the exam time went in my exam to verification. Also once you go to sections like security that may brake other sections, I would go back and verify the sections all over again and if they don't work I know where is the problem, if I didn't check every step it would be hard and more stressful when something would not work at the end.
10. Do not panic – that is important and for some it is more for other it is less, when you see the exam for the first time do not panic take it and brake it to small pieces, and do it one step at a time, if you face a problem skip ahead do not try to solve it for 2hr you can come back to it later

GOOD LUCK

CCIE LAB Learn Process

I will separate the LAB study process from the Written Exam as they are 2 different process from my point of view, so my study to the lab started at the end of 2006 after I passed my Written Exam, first my plan was to study for 4 months using Rack Rental but as I progressed I saw that this target was not realistic and I had a lot more to practice and to study before I will attempt to go to the lab so I scheduled my lab for mid August 2007, I rented almost 600 hours of rack time and scheduled almost every day a lab session, very important detail I forgot to mention is that I purchased the IEWB from Internetworkexpert. At first stage of my study the version that was available of the Work Book was 3 that was according to the old LAB format with 2 Catalysts only later they released version 4 and 4.1 according to the updated format of 4 Catalysts, but never mind that, at first few months I had a lot of mess in my brain as I didn't had any structured plan on how to approach the lab, then I saw that that mess is getting me no where I stoped and done a study plan divided to subjects that need to be covered and to the importance level meaning that OSPF BGP EIGRP... FR, VLAN, VTP, STP... all these are core subjects and needed to get the highest focus then I taken the Security QoS Multicast IPv6 and other miscellaneous subjects and given them a lower priority and each subject like that I divided to sub category and gave them also priority, finely I had a structured plan of approach and I started working according to it but yet again I saw that I have short time to my LAB so I postponed my first lab attempt to Jan 16 2008, I have rented additional ~500 hours, also I didn't mention but I done also a lot of reading both books like TCP/IP vol 1 and 2 CCIE R&S Practice Labs CCIE Practical Studies vol 1 and 2 RFC's of OSPF BGP RIP IGMP and more It is needless to say that the books are sufficient but it is nice to know the source of the books and some time I found the RFC information clearer then the books. The final stages before the first attempt was almost 3 weeks of each day 8hr doing full lab from the IEWB. I managed to solve most of the labs within 6hr max. as I mentioned my first attempt was in Jan 16th in San Jose California and it was unsuccessful, although I did 100% on the core subjects I had failed the other miscellaneous subjects and there is no excuse for that as most likely I was not ready for all areas, I got my answer on the morning before my flight back and that was a depressing moment (or should I say a week), but after a week I decided that I should not let this effect me and taken my conclusion from the test result on what I need to give my attention and prepared another plan for making my knowledge in these areas stronger for my next attempt that I scheduled for April 18th 2008 (this was passover evening in Israel) I have scheduled this time only ~80hr of rack time and focused on reading. the second attempt I have had in my first 20 min a blackout I said to my self what the hell do I do now?! but then I taken a step back and started all over again reading and taking notes only after ~40min I have started my configuration and from that moment I went trough it like a tornado it was like the cartoons where you get the spot light above your head and then you start doing every thing fast, I got my spot light and went trough one section after another by lunch I had finished almost 80% of the test then when I returned from lunch I finished all the config by 2PM after all checks and 2 full lab reboots. I must say the proctor was very nice and answered all my questions, my suggestion is in your question do not ask for an answer ask for clarification meaning make the proctor know that you know what you are talking about and do not shoot in the dark for answers. Although I finished at 2PM I stayed and tested my configuration until the test timed out just to make sure, I probably went trough the lab 20times, and very important thing SAVE CONFIG. After the lab I was so nerves starting to question my self although deep down I felt that I passed, I had a very long weekend waiting for the report but then it came at 5AM San Jose time Sunday I saw my number and what a wonderful feeling. Now I will take a time off before my next quest

CCIE #20572

That is one happy weekend for me, I posting this from my room Residence Inn in Milpitas City an hour after I recived one of the best news after a very long year and half of studying and one failiur, I passed my CCIE of R&S in San Jose Apr 18 2008. Wonderful feeling, please forgive me for the short story. Thank you all for the support especialy to my wife, son and parents that suffered my moods and my busy schedual.

IPSec Basics

IPSec is an suit of protocols designed to provide interopable and high secure data transfer service. to understand IPSec we need to go to the basics and see some defenitions and protocols used by IPSec and start from there to build our understanding on IPSec, after we know what is IPSec and what he need to provide us we can go over to the practical usage and some configuration samples. so as I have said we have some basics to cover and we will start with: Authentication - is how the units verify they are who they say they are Data Integrity - making sure that the data that was sent it what was recived in the other side with no change Confidentiality - it the Encription of the data Anti-Replay - preventing play back attack, if this mechanizem was not enable then a potential attacker could capture a stream of data and replay it to the box this stream was sent and potentialy could log into the network even if the data is hashed it dosent metter as the other side need to know to unpack that data. this 4 definitios are the very basic to understand, and each one is playing a very important role in the vpn. AH Authentication Header - as it is mentioned in his name it is a header authentication method and can provide integrity authentication and anti-relplay, it is the older form of creating IPSec VPN, and today less used. ESP encapsulation security protocol - this is the new form of creatign IPSec VPN and it add the very important element of Confidentiality or encription of the data as I mentioned. the methods we have to encrypt the data are very wide spread but here are the most common ones DES data encription standart 64bit key 3DES it is 192bit what is even funy The procedure for encryption is exactly the same as regular DES, but it is repeated three times. AES Advanced Encryption Standard has a minimum key size of 128bit and maximum of 256bit, a AES 128 is considered more secure then 3DES. RSA (Ron Rivest, Adi Shamir, and Leonard Adleman) is used for Asymetric Public Private Keys Authentication there are 2 main methods to authenticate pre-shared key is a staticly defigned by the Admin on the units the less secure way but the more common method Certificate Authority this is the high security methode and the less common due to the complex of configuration and usually also you need to buy Certificate from one of the vendors like verisign, commodo... Integrity is using hashing for making sure that that the data is not changed: MD5 Message-Digest algorithm 5 the most commonly hash used today the hash size is 128bit. SHA-1 Secure Hash Algorithm 1 the hash size is 160bit DH Diffie-Hellman "A public-key cryptography protocol which allows two parties to establish a shared secret over an insecure communications channel. Diffie-Hellman is used within IKE to establish session keys and is a component of Oakley." (this line was taken from Cisco Site:http://www.cisco.com/en/US/docs/ios/12_1t/12_1t3/feature/guide/dtgroup5.html#wp1015327 ) Let Me try to expalin the proccess; each unit have a private key (used for decryption) a key that is never passed, and a Diffie-Helman Key (Public Key used for encryption) when a unit want to do a key exchange they each send there Public Key to the other side so lets drill down to Unit_A, Unit_A get the Public Key of Unit_B then using the RSA create a shared key that shared key can only be opened on Unit_B with Unit_B Private Key so even if you intercept the shared key you cant reverse engineer it to see as only the private key of Unit_B will be able to understand it. ok untill here I have summerized for you all the key concepts and provided an example of the proccess used in Asymetric Process of the IPSec next I will take the concept and show you in practice what need to be done to form an IPSec connection. General Guide lines to configure an IPSec connection: 1) Create IKE Policy 2) Create IPsec Transform Set 3) Defign ACL for the encription 4) Configure a Crypto Map 5) Assign the Crypto Map to an Interface Note: when you want to create an IPsec between 2 units you must make sure there configuration match so this is a tip copy the configuration you did to a notepad and on the other side unit only flip the ACL IP address to match the other side and paset it, if you did correct on the first side you will have a working connection, if you did bad then you will need to troubleshoot only one side and again copy paste to the other side, save time and pain!

New Job

Hi Guys, Sorry I don’t have much time as I started a week ago new job in Expand Networks as one of the 3rd level Support Team, our product is the answer to Cisco WAAS, currently I am only learning trying to catch up some huge amount of information on a product that I was never familiar before and in between still studying and preparing for My CCIE. so wish me luck I hope soon I will be able to catch a breath and give you some nice articles :-)

Juniper start here

Ok although I am a fan of Cisco you cant go around and not see that Juniper is there and slow but safely moving up and up, I remembered that I heard the name Juniper in 2001 I said yes yes... and thought to my self another one of thus companies... Today I cant ignore them anymore, and why I saw today the first (I think, as I never saw before) online rack rental and workbook for Juniper http://www.routertricks.com/ this I think is the first but many will follow after, as the demand and the deployments of Juniper in the world today are growing and I do not think there is an ISP or any SP (Wireless / Mobile / Others) in the Industry today that do not have Juniper some where in his network, now I do not think it is bad for Cisco (other then sales), I think that good competitors bring the best in you, when I was in school if some one tried had better grades then me then I always tried to do harder and if I was the better one I always made sure that it would stay that way (I was very competitive with subjects I liked). so competition is good for Cisco from my point of view.

CCIE R&S CBAC FireWall

One of my major weakness until recently was security, security is the one topic that can kill you if you do not know what you are doing or if you are not careful enough to lookinto the small details. in the past when I came to a task I would attack it straight ahead and not thinking what it can do to other things I did before or what I need to do in the next task, I worked in a task by task strategy, today as I grown :-) I learned that nothing especially in real life is not presented to you in a step by step manner, you always need to gather all the information and sort it your self like a puzzle, some time the puzzle is small and easy some time you cant find the middle piece to complete your puzzle. so my advice to you is take the exam as a puzzle put all the parts in front of you (mean read all and draw basic topology accordingly) and build your puzzle from bottom up (piece by piece) if you cant find a piece then skip you will find it later. Now with that analogy the Security is one of those last pieces in your puzzle that can brake your entire puzzle so you can decide either to leave one piece out or to start rearrange everything (not recommended). With that in mind I would like to talk here on CBAC or the IOS Firewall, the basic Idea is very similar to reflexive ACL but with enhanced support of features and application. What Do we need for the firewall to work: 1) We Must have an ACL - the ACL will be in most of the cases (for the R&S CCIE) on the outside interface and it will have a Deny all statement, now that was a hard issue for me to grasp at first I said to my self what the hell do I need the Firewall to use a ACL?! isn’t that already build into the firewall, well no! the Firewall is "inspecting" traffic as it go out or come in but the ACL define what to be denied from coming into the Router, so that mean only traffic that is coming from inside the network to outside is allowed back in and traffic that is trying to come from outside need to stay out unless there is a permit statement. 2) We need to define and inspect rules and that is another thing that you need to be careful, as if you only set a rule to inspect icmp that mean that only icmp traffic from your network to the outside and back will be allowed, if you will try to browse the internet without setting an inspect rule your traffic will not be inspected and therefore not been allowed back in!!! Now here is my home router example: I start by defign the traffic that I am using from in --> out ip inspect name HOME-FW sip <- My Voip service need to be up ip inspect name HOME-FW snmp <- I have Snmp Server to monitor the networks I maintain ip inspect name HOME-FW http <- a man need to surf :-) ip inspect name HOME-FW https <- some time need to use a secure web browsing ip inspect name HOME-FW dns <- well I do not want to use IP for all my surfing so I need name resolve server access ip inspect name HOME-FW smtp <- need to sent out mail ip inspect name HOME-FW pop3 <- mail in ip inspect name HOME-FW ssh <- all my servers using SSH (linux RHES) ip inspect name HOME-FW icmp <- Pings ip inspect name HOME-FW telnet <- Some of the router I manage are old or do not have SSH ip inspect name HOME-FW udp <- miscellaneous traffic ip inspect name HOME-FW tcp <- miscellaneous traffic ! ip access-list extended ACCESS-CONTROL permit icmp any any echo-reply <- that I am using as the traffic from the router it self is not inspected so if I will not permit it then I will not babble to ping from the router, the same go for the traceroute permit icmp any any time-exceeded permit icmp any any port-unreachable permit udp x.x.x.80 0.0.0.15 any eq snmptrap <- I have in my home a Snmp Server and to allow traps from outside to come in I need a permit permit udp x.x.x.80 0.0.0.15 any eq 5060 <- although I enabled SIP in the inspection rule calls that are originated from outside in need to be permitted as only traffic inspected from inside to outside is permited permit udp host x.x.x.83 any range 10000 20000 <- that is for the RTP, it is not really needed but for the "obscure" bugs that can happen I rather permit it then loose a call. deny ip any any log-input <- the log-input is for tracing attackers always good to have. ! interface Dialer0 <-- that is my outside interface .. ip access-group ACCESS-CONTROL in .. ! interface Vlan16 <-- that is my inside interface .. ip inspect HOME-FW in .. !

This is In response to the comment posted: The ACL has no direct relation to the CBAC firewall, it is there to prevent traffic coming into your network from the outside, the inspection rule is there to inspect traffic going out from your network. if the ACL was not there the traffic would have been inspected but still people would able to go into your network. so if you want to block traffic you must have ACL but if you inspect traffic then even if there is a deny statement on the outside interface traffic is allowed to return. so the short answer CBAC is not inspecting the ACL, CBAC is inspecting what you tell him on the inspection rule.

CCIE Lab San Jose 16 Jan 2008

Ok, I wished to tell you my number after that date but unfurtunetly for me I will need to hold on with that post. so for now I will tell you my expireance, I traveled from Israel to San Francisco California on Jan 12 2008 arrived after painful 18hr flight with a connection in London. Days before the exam I have taken the liberty to relax and sleep as much as I can. The lab Day I have arrived as early as I could at 7am to Tasman Drive 150 bldg C waiting for them to open the doors (yes I am that freek). at about 7:30 they have opened the doors and I waited for the other candidates to arrive, at about 8:15 we where guided to the Lab...(now I cant tell you what happen there as I am obligated to the NDA). What I can tell you is that it was hard but not impossiable I have actually had no problem with the core topics and but I did found the security and qos to be confusing enough to fail me. I certenly learned from this expireance (it was expensive lesson) and hope to not fail on that again, but with no pain there is no gain.

CCDE Interview with Russ White

CCIE BGP ORF

This days I am a little slow on article writing as I am in the final lap before my lab exam (wish to pass..) ok that was on a personal note. Now on a hopefully helping note, i had a little bit difficulty understanding first the logic behind ORF but when the coin dropped then I started hearing a voice in my head saying tada... So here it how it goes, the real BGP full table is currently almost 250K path entries, now you have connection to 3 ISP's and you want for example to get from your Backbone ISP the full table and from your other ISP's only partial table, you then face with a dilemma should I develop my human bagging skills to ask nicely from each ISP's to filter on his side specifically for you and what you will probably get as answer is "NO" or if he is nice then "NO". So now you face with a problem you can get from each of the ISP's the full table and filter on your side but it will not solve the performance and resource intensive problem you wanted to avoid. or you can call the nice person in the ISP side and ask him just to put neighbor capability orf prefix-list recive and on your side: neighbor capability orf prefix-list send note: that this will reset your BGP peer relationship, after that you will create your Prefix Filter now lets say you want to only recive the 2 class B subnets all you need to do is: ip prefix-list FILTER-FULL-TABLE seq 5 permit 187.0.0.0/16 ip prefix-list FILTER-FULL-TABLE seq 10 permit 198.0.0.0/16 ip prefix-list FILTER-FULL-TABLE seq 15 deny 0.0.0.0/0 le 32 ! ! under the BGP process ! router bgp neighbor prefix-list FILTER-FULL-TABLE in ! This will result in filtering the BGP table on your ISP side so you will not even get the table to filter it, it is cool not?! as it is allowing you to create filters on the ISP side without him to do any thing. Here is a small example from my home lab: R3 is peering with R1 and R1 is advertising some prefixes now R3 want to filter them but not on his side: !R3 before ORF ! router bgp 100 no synchronization bgp log-neighbor-changes neighbor 150.1.1.1 remote-as 200 neighbor 150.1.1.1 password CISCO neighbor 150.1.1.1 update-source Loopback0 ! R3#sh ip bg BGP table version is 193, local router ID is 150.1.3.3Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 150.1.1.1 0 0 200 i *> 150.1.1.0/24 150.1.1.1 0 0 200 i *> 167.13.0.0 150.1.1.1 0 0 200 i *> 167.13.135.0/24 150.1.1.1 0 0 200 i *> 205.90.31.0 150.1.1.1 0 200 254 ? *> 220.20.3.0 150.1.1.1 0 200 254 ? *> 222.22.2.0 150.1.1.1 0 200 254 ? ! Here is R1 before: R1#sh ip bg nei 150.1.3.3 ad BGP table version is 16, local router ID is 150.1.1.1Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 0.0.0.0 32768 i *> 150.1.1.0/24 0.0.0.0 0 32768 i *> 167.13.0.0 0.0.0.0 32768 i *> 167.13.135.0/24 0.0.0.0 0 32768 i *> 205.90.31.0 192.10.1.254 0 0 254 ? *> 220.20.3.0 192.10.1.254 0 0 254 ? *> 222.22.2.0 192.10.1.254 0 0 254 ? ! router bgp 200 no synchronization bgp log-neighbor-changes network 150.1.1.0 mask 255.255.255.0 network 167.13.135.0 mask 255.255.255.0 aggregate-address 150.1.0.0 255.255.248.0 aggregate-address 167.13.0.0 255.255.0.0 neighbor 150.1.3.3 remote-as 100 neighbor 150.1.3.3 password CISCO neighbor 150.1.3.3 next-hop-self ! NOW: I would like to filter on R1 the following so I will not even get prefixes" 167.13.135.0/24 150.1.1.0/24 222.22.2.0/24 So I am setting on ! R1 (the ISP side for that example) router bgp 200 neighbor 150.1.3.3 capability orf prefix-list receive ! ! R3 (the client side) router bgp 100 neighbor 150.1.1.1 capability orf prefix-list send neighbor 150.1.1.1 prefix-list FILTER-DUP in ! and the following prefix list ip prefix-list FILTER-DUP seq 5 deny 167.13.135.0/24 ip prefix-list FILTER-DUP seq 10 deny 150.1.1.0/24 ip prefix-list FILTER-DUP seq 11 deny 222.22.2.0/24 ip prefix-list FILTER-DUP seq 15 permit 0.0.0.0/0 le 32 ! now be prepared for the TADA.. R3#sh ip bg BGP table version is 194, local router ID is 150.1.3.3Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 150.1.1.1 0 0 200 i *> 167.13.0.0 150.1.1.1 0 0 200 i *> 205.90.31.0 150.1.1.1 0 200 254 ? *> 220.20.3.0 150.1.1.1 0 200 254 ? So Up to now it looks normal that the filter was done on our side and when applied it was filtering incoming prefixes, but no! See R1 Advertisements: R1#sh ip bg nei 150.1.3.3 ad BGP table version is 16, local router ID is 150.1.1.1Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 150.1.0.0/21 0.0.0.0 32768 i *> 167.13.0.0 0.0.0.0 32768 i *> 205.90.31.0 192.10.1.254 0 0 254 ? *> 220.20.3.0 192.10.1.254 0 0 254 ? and no there is no prefix list on R1, belive me: R1#sh ip bg nei 150.1.3.3 ... Outbound Route Filter (ORF): received (4 entries) Sent Rcvd Prefix activity: ---- ---- Prefixes Current: 4 0 Prefixes Total: 4 0 Implicit Withdraw: 0 0 Explicit Withdraw: 0 0 Used as bestpath: n/a 0 Used as multipath: n/a 0 ... ORF prefix-list: 3 I hope that was a little eye open on this issue :-)

Mary Christmas and Happy New Year

To all of you that study during the holidays and thinking they are the only one, well you are not alone. Our dedication to the goal is what Differentiate us, an expert is not the one that know all, it is the one that is most dedicated to find the best solution and do what ever it takes. So Mary Christmas and Happy New Year to all of you out there :-) Now let ABBA Continue from here....

CCIE EIGRP METRIC

One of the annoying fileds in my opinion is calculation, I hate them! in my mind it is just in the way of the cool stuff. but unfurtunetly to get to the cool stuf you need to calculate.

so I would like to start by giving you a little review and may be more indepth look over EIGRP Metric, as we all should know EIGRP is a Hybrid Routing Protocol that use a Composite Metric in his DUAL Diffusing Update Algorithm. the Composite metric is composed (good word selection :-)!?) from K Values.

K1 K2 K3 K4 K5

K1 = Bandwidth = 1 meaning it is used in the calculation by default.

K2 = load = 0 you gust it, meaning that is not participating in the calculation by default.

K3 = Delay = 1 you can take it from here

K4 = Reliability = 0

K5 = MTU = 0

the K values tells us if the value is participating in the calculation or not and what is the weight of the value, meaning that if you set K1 to 3 then it means that the weight of K1 will be 3 times more "important" or in other words it will take the BW * 3.

So now we know what are the "K" Values we need to know how to calculate:

well I will not endolge you with long version of the formula as it is hardly ever use (by hardly I mean I never seen it fully used).

Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]

in the attached picture I draw a small network to demonstrate what I mean to get from R1 to R3 netwrok 3.3.3.0/24

you have the following options:
R1 -> R2 -> R3
The lowes bandwith in that path is 64Kbps
The Delay is 20000 for the 64Kbps link 100 for the 100 Mbps linke and another 100 for the 3.3.3.0/24 network link also 100Mbps = 20200 microseconds delay.

so now lets put all into the formula:

Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 100 + 100)]
Metric = [256 * (156250) + 256 * (20200)]
Metric = [40000000 + 5171200]
Metric = 45171200 = FD Feasable Distance (I will Talk about this in a bit)

R1 -> R4 -> R3

Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 1000 + 100)]
! note that now you have 1000 in the path as it is a regular 10 Mbps Ethernet
Metric = [256 * (156250) + 256 * (21100)]
Metric = [40000000 + 5401600]
Metric = 45401600 = FD

R1 -> R2 -> R4 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 20000 + 20000 + 100)]
Metric = [256 * (156250) + 256 * (60100)]
Metric = [40000000 + 15385600]
Metric = 55385600 = FD

R1 -> R4 -> R2 -> R3 I think you should do it now, you should get the point of the calculation

Now that have an idea how to calculate we need to see what route is preferd, in that senarion it is easy but in complex networks this basics can help us understand the proccess (leave the calc to the router).

FD as I was mentioning this Feasable Distance is the Metric that our router see from his outgoing interface to the point he wish to go, also caled end-to-end metric.

AD Advertised Distance that is the Distance we recive from our directly connected neighbor for the path we wish to go.

so for FD of R1 ->R2 ->R3 we get an AD of R2->R3.

FS Feasible Successor is the Router that is chosen by us to be the next hop to the Destination Prefix.

FC Feasible Condition is a rule that tells us in a very logical way to select a FS he must send to us an AD that is lower then the FD.

if we received from R4 for example a AD higher then the FD that we had already in our topology table to get to R3 then we would not consider him to be a Feasible Successor.

so final step lets take the Paths and FD and Calculate the AD and see what path sould we go as I am already exited where to go from now:

Now our AD for the Paths sent to R1:

R2 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/100000) + 256 * (100 + 100)]
Metric = [256 * (100) + 256 * (200)]
Metric = [25600 + 51200]
Metric = 76800 = AD
Metric = 45171200 =FD

R4 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 100)]
Metric = [256 * (156250) + 256 * (20100)]
Metric = [40000000 + 5145600]
Metric = 45145600 = AD
Metric = 45401600 = FD

R1 -> R2 -> R4 -> R3
Metric = [256 * (10^7/BW) + 256 * (Accumulated Delay)]
Metric = [256 * (10^7/64) + 256 * (20000 + 20000 + 20000 + 100)]
Metric = [256 * (156250) + 256 * (60100)]
Metric = [40000000 + 15385600]

Metric = 55385600 Here we can clearly see that there is not way that this route can meet the FC.
So we have a winner:
Metric = 76800 = AD
Metric = 45171200 =FD

to get to R3 3.3.3.0/24 R1 will take the path R1 ->R2 -> R3.
if it will fail then the path R1 ->R4->R3 will be taken as he still qualified to meet then FC for FS

FS Feasible Successor the second path in the topology that is set only of FC are met.

I hope this was an intersting article :-)

IPV6 Tricks

Have you ever faced with a situation where you where stuck out of your server due to a IP Address Change, well if you didn't you might one day, let me tell you how IPv6 Saved me. I have several Linux Servers in My Company and Due to some maintenance I needed to change the IP Address on on of them, simple task although it went bad due to a miss spelling on the ifcfg-eth0 file. and like I love to go fast with configuration I did a stupid mistake and restarted the network service well needless to say that as soon as I did that I was left outside, started yelling and spelling out some wired brrrrrrr hmmmm grrrrrrr and all sort of mad words. but then I said to my self hey i am an almost Expert I know Networking, how do I solve this, well the port is still listening on the Ethernet Network so If I had some way of login via ARP or MAC or Other Protocol then I was good to go, and then it pupped out to me IPv6 use in link local address based on MAC address and I have the MAC address of my Linux also I remembered that Linux from Kernel 2.6 is using IPv6 Nativity mean that if i will take the MAC address and convert it to IPv6 link local address FE80:: and do not forget to inverse the 7th bit of the MAC address if you have MAC 1234:5678:1111 0001 0010 now it is 0001 0000 1034:5678:1111 and you add to it FE80:: FE80::1034:5678:1111 --> TADA then I will be able to ping it and log in from one of my other servers so that is what I did and there you go a rescue backdoor to your network when your IPv4 network is down. also you could login from remote if you set on your Cisco a 6to4 tunnel, but that is for next article, leave the good stuff for later :-)

CCIE IP Precedence Vs DSCP Values

The Table bellow Represent the TOS filed in the IP Header

IPP

IPP

IPP

DropP

DropP

0

ECN

ECN

Drop P = Drop Precedence IPP = IP Precedence The Drop Precedence means the probability that the packet will be dropped, the higher the value it is more likely to be dropped. IP Precedence is the importance value of a packet, the higher the value the packet is more valuable. In IP Precedence we have 0 – 7 values and you can see that by looking into the amount of fields that we have Routing (Best Effort) - 000 Priority - 001 Immediate - 010 Flash – 011 => mainly used for Voice Signaling or for Video Flash-Override - 100 Critical – 101 => mainly used for Voice RTP Internet - 110 Network - 111 You do not need to remember the name value of each one, you can simply see it with: TermServ(config)#access-list 100 permit ip any any precedence ? (0-7) Precedence value critical Match packets with critical precedence (5) flash Match packets with flash precedence (3) flash-override Match packets with flash override precedence (4) immediate Match packets with immediate precedence (2) internet Match packets with internetwork control precedence (6) network Match packets with network control precedence (7) priority Match packets with priority precedence (1) routine Match packets with routine precedence (0) with that said now we have added 2 more bits for the or more accurate 3 bits but only 2 bits we are playing with for allowing us to determine with in the scope of class witch is more preferable and for that we divided to 6 main classes Class 0 – Called also Best Effort all bits are 0 = 000000 Now we have 4 classes that are with in them divided each to 3 separate

Class1	AF11 001010	AF12 001100	AF13 001110
Class2	AF21 010010	AF22 010100	AF23 010110
Class3	AF31 011010	AF32 011100	AF33 011110
Class4	AF41 100010	AF42 100100	AF43 100110

DropP IPP Class 5 – EF Expedited Forwarding last class used for Voice Traffic Mainly 101110, and also all the DSCP values you can see with a simple ACL, but I think it is better to understand the principle and once you understand it you will not have to remember you will simply know. As it is relatively simple but the quantity makes people confused. TermServ(config)#access-list 100 permit ip any any dscp ? (0-63) Differentiated services codepoint value af11 Match packets with AF11 dscp (001010) af12 Match packets with AF12 dscp (001100) af13 Match packets with AF13 dscp (001110) af21 Match packets with AF21 dscp (010010) af22 Match packets with AF22 dscp (010100) af23 Match packets with AF23 dscp (010110) af31 Match packets with AF31 dscp (011010) af32 Match packets with AF32 dscp (011100) af33 Match packets with AF33 dscp (011110) af41 Match packets with AF41 dscp (100010) af42 Match packets with AF42 dscp (100100) af43 Match packets with AF43 dscp (100110) cs1 Match packets with CS1(precedence 1) dscp (001000) cs2 Match packets with CS2(precedence 2) dscp (010000) cs3 Match packets with CS3(precedence 3) dscp (011000) cs4 Match packets with CS4(precedence 4) dscp (100000) cs5 Match packets with CS5(precedence 5) dscp (101000) cs6 Match packets with CS6(precedence 6) dscp (110000) cs7 Match packets with CS7(precedence 7) dscp (111000) default Match packets with default dscp (000000) ef Match packets with EF dscp (101110)

CCIE INTERNETWROKEXPERT

I would like to express my grate appreciation to the contribution that Internetworkexpert brings to the Technical Community, although they are a commercial company they do give away free seminars and do help people that are in need to learn and do not have a lot of financial resources to do that. So Thank you InternetworkExpert Here is a recent v-sminar that was added on IPv6 http://classroom.internetworkexpert.com/p23982603/ Soon they will release a v-seminar that was transferred yesterday for free on Catalyst QoS. Also grate thanks to there top notch instructors: Brian Dennis, CCIE #2210 (R&S/ISP Dial/Security/Service Provider) Brian McGahan, CCIE #8593 (R&S/Service Provider/Security) THANK YOU!

CCIE SecureCRT Tip

As you all know the mostly used terminal in the CCIE lab exam is the old SecureCRT from http://www.vandyke.com/ without the tabs addition. but what you do have is the key mapping. you can set for example: F6 to be the CTRL SHIFT 6+x by simply setting the send sting in the key map to \036x F7 to be CTRL SHIFT 66 sequence of braking in the middle of a trace or a ping when you connected with the Access Server by mapping \0366 I my self practicing without the shortcuts but each person with its own methods and tactics. I believe the quest is like a preparation for the Olympics so practice practice practice.

CCIE VERIFY RPF FAIL

One of the major issues with Multicast is finding the RPF and making sure that there is no Failure in it, as if we do have a fail we can patch it by adding ip mroute (like a static route but only to pass the RPF, not actually changing the path of the packet). So how we can find such fail we have several tools the first one is to find if we have rp mapping. R6#sh ip pim rp ma PIM Group-to-RP Mappings Group(s) 224.0.0.0/4 RP 150.1.5.5 (?), v2v1 Info source: 150.1.3.3 (?), elected via Auto-RP Uptime: 00:14:48, expires: 00:00:02 R6# we see here in that example that we do have RP Mapping so we defiantly passed the RPF. I have made an RPF fail and we now will try to trace it: R6#sh ip mroute count IP Multicast Statistics 3 routes using 1962 bytes of memory 3 groups, 0.00 average sources per group Forwarding Counts: Pkt Count/Pkts(neg(-) = Drops) per second/Avg Pkt Size/Kilobits per second Other counts: Total/RPF failed/Other drops(OIF-null, rate-limit etc) Group: 227.0.0.1, Source count: 0, Packets forwarded: 0, Packets received: 0 Group: 224.0.1.1, Source count: 0, Packets forwarded: 0, Packets received: 0 Group: 224.0.1.40, Source count: 0, Packets forwarded: 0, Packets received: 0 we see that we are not receiving packets from our mapping agent when we listen on group 224.0.1.40 so some where along the path we have an RPF fail. R6#sh ip mrou IP Multicast Routing Table Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement, U - URD, I - Received Source Specific Host Report, Z - Multicast Tunnel, z - MDT-data group sender, Y - Joined MDT-data group, y - Sending to MDT-data group Outgoing interface flags: H - Hardware switched, A - Assert winner Timers: Uptime/Expires Interface state: Interface, Next-Hop or VCD, State/Mode (*, 227.0.0.1), 00:02:19/00:02:47, RP 0.0.0.0, flags: SJCL Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: FastEthernet0/0, Forward/Sparse, 00:02:19/00:02:47 (*, 224.0.1.1), 00:02:19/00:02:53, RP 0.0.0.0, flags: SJCL Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: FastEthernet0/0, Forward/Sparse, 00:02:19/00:02:53 (*, 224.0.1.39), 00:01:12/stopped, RP 0.0.0.0, flags: DP Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: Null (150.1.5.5, 224.0.1.39), 00:01:12/00:01:47, flags: PT Incoming interface: FastEthernet0/0, RPF nbr 166.1.12.1 Outgoing interface list: Null (*, 224.0.1.40), 00:02:20/00:02:54, RP 0.0.0.0, flags: DCL Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: FastEthernet0/0, Forward/Sparse, 00:02:20/00:02:54 R6# we see above that we do get see the RP and we get it from 166.1.12.1 so lets got to R1 (166.1.12.1). R1#sh ip mroute count IP Multicast Statistics 5 routes using 2946 bytes of memory 4 groups, 0.25 average sources per group Forwarding Counts: Pkt Count/Pkts(neg(-) = Drops) per second/Avg Pkt Size/Kilobits per second Other counts: Total/RPF failed/Other drops(OIF-null, rate-limit etc) Group: 227.0.0.1, Source count: 0, Packets forwarded: 0, Packets received: 0 Group: 224.0.1.1, Source count: 0, Packets forwarded: 0, Packets received: 1 RP-tree: Forwarding: 0/0/0/0, Other: 1/0/1 Group: 224.0.1.39, Source count: 1, Packets forwarded: 12, Packets received: 12 Source: 150.1.5.5/32, Forwarding: 12/1/48/0, Other: 12/0/0 Group: 224.0.1.40, Source count: 0, Packets forwarded: 0, Packets received: 0 R1# we see here that we still do not recive any packet on the mapping group. R1#sh ip mrou IP Multicast Routing Table Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement, U - URD, I - Received Source Specific Host Report, Z - Multicast Tunnel, z - MDT-data group sender, Y - Joined MDT-data group, y - Sending to MDT-data group Outgoing interface flags: H - Hardware switched, A - Assert winner Timers: Uptime/Expires Interface state: Interface, Next-Hop or VCD, State/Mode (*, 227.0.0.1), 00:01:24/00:02:10, RP 0.0.0.0, flags: SP Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: Null (*, 224.0.1.1), 00:01:24/stopped, RP 0.0.0.0, flags: SP Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: Null (166.1.12.4, 224.0.1.1), 00:00:20/00:03:09, flags: T Incoming interface: FastEthernet0/0, RPF nbr 0.0.0.0 Outgoing interface list: Serial1/0, Forward/Sparse, 00:00:20/00:03:09 (166.1.12.6, 224.0.1.1), 00:00:20/00:03:09, flags: T Incoming interface: FastEthernet0/0, RPF nbr 0.0.0.0 Outgoing interface list: Serial1/0, Forward/Sparse, 00:00:20/00:03:09 (*, 224.0.1.39), 00:01:26/stopped, RP 0.0.0.0, flags: D Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: FastEthernet0/0, Forward/Sparse, 00:01:26/00:00:00 Serial1/0, Forward/Sparse, 00:01:26/00:00:00 (150.1.5.5, 224.0.1.39), 00:01:26/00:02:56, flags: T Incoming interface: Serial1/0, RPF nbr 166.1.0.5 Outgoing interface list: FastEthernet0/0, Forward/Sparse, 00:01:26/00:00:00 (*, 224.0.1.40), 00:01:27/00:02:04, RP 0.0.0.0, flags: DCL Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: FastEthernet0/0, Forward/Sparse, 00:01:27/00:00:00 Serial1/0, Forward/Sparse, 00:01:27/00:00:00 R1# now lets go again one step forward to R5 to see if R5 is also not receiving packets for group of the mapping agent. R5#sh ip pim rp ma PIM Group-to-RP Mappings This system is an RP (Auto-RP) Group(s) 224.0.0.0/4 RP 150.1.5.5 (?), v2v1 Info source: 150.1.3.3 (?), elected via Auto-RP Uptime: 00:00:45, expires: 00:00:01 R5# and we can see that we do receive the mapping from 150.1.3.3 on R5 so we know that the RPF fail happen on R1 to R3 Now I will tell you that R5 R3 and R1 are connected over FR (Physical Interface only) R5 is the hub and R1 and R3 are the spokes. so first we need to make sure that we enabled R5(config-if)#ip pim nbma-mode that command will make sure that packets received on one VC of the FR can go out that same interface to another VC for Sparse Groups Only here bellow you can see the output of sparse group with the nbma-mode enable you can see it is going out of that same interface but to different IP (VC) (*, 227.0.0.1), 20:05:09/stopped, RP 150.1.5.5, flags: SJCL Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: Serial1/0, 166.1.0.3, Forward/Sparse, 00:15:40/00:01:01 Serial1/0, 166.1.0.5, Forward/Sparse, 04:28:41/00:02:42 And on that same router R5 although I have enabled nbma-mode you can see that for dense mode group it is acting different. (*, 224.0.1.40), 17:24:56/stopped, RP 0.0.0.0, flags: DCL Incoming interface: Null, RPF nbr 0.0.0.0 Outgoing interface list: Loopback0, Forward/Sparse, 17:24:56/00:00:00 Serial1/0, Forward/Sparse, 17:24:56/00:00:00 So now that we see that we traced where the RPF is we need to solve it, on R1 R1#sh ip route 150.1.3.3 Routing entry for 150.1.3.3/32 Known via "ospf 1", distance 110, metric 65, type intra area Redistributing via eigrp 1 Advertised by eigrp 1 metric 1536 1 255 1 1500 Last update from 166.1.0.3 on Serial1/0, 00:17:50 ago Routing Descriptor Blocks: * 166.1.0.3, from 150.1.3.3, 00:17:50 ago, via Serial1/0 Route metric is 65, traffic share count is 1 R1#sh ip route 166.1.0.3 Routing entry for 166.1.0.0/24 Known via "connected", distance 0, metric 0 (connected, via interface) Redistributing via eigrp 1 Advertised by eigrp 1 Routing Descriptor Blocks: * directly connected, via Serial1/0 Route metric is 0, traffic share count is 1 we know that 224.0.1.40 is Dense mode group and it cannot pass the RPF due to that as it will not be able to go out the same interface it came in. so what we can do is create a tunnel interface between R1 to R3. And set the RPF to check the path trough that tunnel. interface Tunnel0 ip unnumbered Loopback0 ip pim sparse-mode tunnel source Loopback0 tunnel destination 150.1.3.3 ! R1#sh run inc ip mrou ip mroute 150.1.3.3 255.255.255.255 Tunnel0 R1# ! interface Tunnel0 ip unnumbered Loopback0 ip pim sparse-mode tunnel source Loopback0 tunnel destination 150.1.1.1 end R3# we must make sure that the source and the destination match exactly on both side like showed here and both on the interface that we are sourcing and destination and the tunnel we enabling PIM. R1#sh ip pim neighbor PIM Neighbor Table Mode: B - Bidir Capable, DR - Designated Router, N - Default DR Priority, S - State Refresh Capable Neighbor Interface Uptime/Expires Ver DR Address Prio/Mode 166.1.0.5 Serial1/0 20:52:24/00:01:20 v2 1 / DR S 166.1.12.4 FastEthernet0/0 17:20:06/00:01:24 v2 1 / S 166.1.12.6 FastEthernet0/0 20:51:54/00:01:21 v2 1 / DR S 150.1.3.3 Tunnel0 00:02:12/00:01:30 v2 1 / S R1# R1#sh ip pim rp ma PIM Group-to-RP Mappings Group(s) 224.0.0.0/4 RP 150.1.5.5 (?), v2v1 Info source: 150.1.3.3 (?), elected via Auto-RP Uptime: 00:00:10, expires: 00:00:02 R1# And now we can go back to R6 and see that we have also mapping on R6 so we solved RPF fail. R6#sh ip pim rp ma PIM Group-to-RP Mappings Group(s) 224.0.0.0/4 RP 150.1.5.5 (?), v2v1 Info source: 150.1.3.3 (?), elected via Auto-RP Uptime: 00:00:33, expires: 00:00:03 R6#