Configuring SSH

Always use SSH, telnet is gone.

Configuring SSH includes configuring a domain name (ip domain-name WORD), generate rsa key (crypto key generate rsa), specify only ssh for vty connection (transport input ssh), specify where to find username and password list (login WORD. This could be local, if you use local, you will want to create username and password in the router)

First you have to configure a domain name for your router with the command (enter this command at the global configuration level)

ip domain-name WORD

WORD: the domain name string.

Then you generate rsa key by the command

crypto key generate rsa [general-keys | usage-keys]

In the picture above, when you try to create an rsa key, there will be two parameters

1. General-keys. By default Cisco routers use the same key for all encryption (SSH, HTTPS, …)


2. Usage-keys. Usage-keys create a unique key.

Bit range of an rsa key is 360bits – 2048bits. A minimum of 1024 is usually used. For old series router (2500, 2600 series), generating an rsa key could take a long time (10 – 15 minutes).

You can configure some ssh options through the command (from the global configuration level)

ip ssh time-out NUMBER

NUMBER: in sec, 1-120 secs.

ip ssh authentication retries NUMBER

NUMBER: 0-5 retries

Configuring SNMP

Simple Network Management protocol is good to gather information per interface basis. SNMP version 1 and 2 doesn’t support authentication. SNMP version 1 is an old protocol, it doesn’t support to monitor Gigs link. SNMP version 2 was out primarily to support that problem so that you can monitor high bandwidth link even there are some other enhancements to the SNMP version 1. SNMP version 3 added security. It adds authentication and encryption.

The following command configure SNMP version 1 or 2c.

snmp-server community WORD [ACL] [ro | rw]

WORD: the community string for the snmp community (server).

ro: allow other device (server) from this community to only read information from this router. Usually you will want to use this mode.

rw: allow other device to read and write information to this device.

ACL: you can use ACL to specify which devices can access the community string with ro | rw mode. So you can specify, devices coming from this address has the rw mode or something like that. Here you either specify the number of the ACL or the name of the ACL.

SNMP works like this, the community string is the only identifier that you need to access SNMP information from the router and it is sent in clear text. So if anybody else send an SNMP request message to the router with the right community string, then the router agrees to give SNMP information to that person.

Management Information Basis (MIB). This is the string that identify what information that you want to access or change if it is in Read-Write mode from the device. It could be in number or string representation. Let’s say that the SNMP server requested information from your router identified with MIB as 1.2.3.6.9.12, that series of number is an identifier for a specific information in your router. Maybe that’s the identifier to get the hostname, bandwidth utilization or the enable secret information. Cisco has its own MIB.

You can configure what MIB people can access in your router by the following configuration (if you don’t specify this, every information could be collected from your router)

snmp-server view STRING

to configure SNMP v3, first you have to configure the local ID for the router by the command

snmp-server engineID local HEX

HEX: hexadecimal (0-9, A-F) value with a minimum of 10 chars. Actually the HEX value is a fixed length string. It’s 16 chars fixed, if you only type 10 chars, Cisco will automatically fill the rest with 0.

Then you want to configure the SNMP group

snmp-server group WORD v3 [auth | noauth | piv]

Here, you name the group (SNMP_CROWS), specify the version that it use and specify if you want users to be authenticated to access this SNMP group (auth) and if you want to use encryption to send SNMP packets in this group (priv).

After that, you configure the users for the SNMP groups

snmp-server user WORD1 WORD2 v3 {auth [md5 | sha] WORD3} {priv [3des | des | aes] WORD4}

WORD1: the name of the user.

WORD2: the name of the group that the user belongs to.

WORD3: the password for the authentication.

WORD4: the privacy password for the user.

In this command you kinda map the user to the SNMP group, you specify that this SNMP will use v3. Note that this command still has other parameters.

If you choose to use authentication, you will want to choose the hashing method. It is either md5 or sha. Then enter what password is required by the users to access this SNMP GROUP

If you choose to use encryption (priv) you specify the encryption method and the encryption key. The available encryption methods are 3des, des, aes. which is not strong enough for an encryption but is better than not using any encryption at all.

You can also specify if you want to use ACL to limit what addresses that this USER GROUP will come from.

Inside a Router

a router is a computer. like a PC, a router also includes CPU, RAM and ROM. the components in a router are:

• Central Processing Unit (CPU). the CPU executes operating system instructions, such as system initialization, routing fuinctions and switching functions.


• Random-Access Memory (RAM). RAM is volatile memory and it loses its content when the router is powered down or restarted. RAM stores the instructions and data needed to be executed by the CPU. RAM is used to store these components:
  
  
  
  • Operating System: the Cisco IOS is copied into RAM during bootup.
  
  
  • Running Configuration File: this is the file that stores the configuration commands that the router is currently using. with few exceptions, configuration commands are directly stored to the running configuration, known as running-config.
  
  
  • IP Routing Table: this file stores information about directly connected and remote networks. it is used to determine the best path to forward the packet.
  
  
  • ARP Cache: this is similar to the ARP cache on a PC, this contains the IPv4 address to MAC address mappings. this is used on routers that have LAN interfaces such as Ethernet.
  
  
  • Packet Buffer: packets are temporarily stored in a buffer when received on an interface or before they exit an interface.
  
  
  
  
• Read-Only Memory (ROM). ROM does not lose its content when the router is powered down or restarted. cisco devices use ROM to store the bootstrap instructions, basic diagnostic software and scaled-down version of IOS. ROM uses firmware (firmware includes software that does not normally need to be modified or upgraded, such as the bootup instructions), which is software that is embedded inside the integrated circuit.


• Flash Memory. Flash is a nonvolatile computer memory that can be electrically stored or erased. flash is used to store the router operating system, Cisco IOS. the IOS is copied to the RAM during bootup process, where it can be executed by the CPU (some old routers run the IOS directly from flash). flash consists of SIMMs and PCMCIAs cards, which can be upgraded to increase the amount of flash memory.


• Nonvolatile RAM (NVRAM). unlike most kind of RAMs, NVRAM does not lose its content when power is turned off. Cisco IOS use this permanent storage to store the startup configuration file (startup-config). to save the changes implemented to the router in case the router is powered down or restarted, the running-config must be copied to NVRAM as the startup-config.

Router boot-up process
there are four major phases to the bootup process:

• performing the Power-On Self Test (POST). POST is a common process done by almost every computer during bootup. when the router is powered on, the software on the ROM chip perform POST to test the router hardware. during this process, the router executes diagnostics from ROM on several hardware components including the CPU, RAM and NVRAM. after the process is done, the router executes the bootstrap program.


• loading the bootstrap program. after the POST process, the router copies the bootstrap program from ROM into RAM. once in RAM, the CPU executes the instructions in the bootstrap program. the main purpose of the bootstrap program is to locate the Cisco IOS and load it into RAM. (at this point, if you have a console connection to the router, you will begin to see output).


• locating and loading Cisco IOS. usually, the IOS is located in the flash memory, but can also be stored remotely, such as a TFTP server (a TFTP server can be used as a central storage for IOS images or as a backup server for IOS). if a full IOS image can not be located, a scaled-down version of the IOS is copied from ROM into RAM. this version of IOS is used to help diagnose any problems and can be used to load a complete version of the IOS into RAM. once the IOS begins to load, you may see a string of pounds signs (#), while the image decompresses.


• locating and loading the configuration file. after the IOS is loaded, the bootstrap program searches for the startup configuration file (startup-config) in the NVRAM. if the file exists, it is copied into RAM as the running configuration file (running-config). if the file does not exists, the router may serach for a TFTP server. if the router detects that it has an active link to another configured router, it sends a broadcast searching for a configuration file across the active link. this condition will cause the router to pause. if the startup configuration file can not be located, the router prompts the user to enter setup mode. setup mode is a series of questions prompting the user for basic configurations information (setup mode is not to be used to enter complex configuration and is not commonly used by network administrators). you can terminate the setup process by pressing the Ctrl-C at any time. if the setup mode is not used, the IOS creates a default running-config. this file is a basic configuration file (this file does not contain any interface addresses, routing information, passwords or other specific configuration information).

VTP

advantages of VTP:

• dynamic trunk configuration when vlans are added to the network


• vlan configuration consistency


• dynamic reporting of added vlans across a network

VTP only learns about normal-range VLANs (VLAN IDs 1 to 1005). Extended-range VLANs (IDs greater than 1005) are not supported by VTP.

Terminology
vtp domain : switches in the same vtp domain share the same vlan configuration details using vtp advertisements. a router or layer 3 switch defines the boundary of a domain.

vtp modes : a switch can be configured in one of the three modes:

• Server : vtp servers advertise vlan configuration to other vtp-enabled switches in the same domain. VTP SERVERS STORE THE VLAN CONFIGURATION IN NVRAM. at the server is where the vlan can be created, deleted or renamed.


• Client : function the same way as servers, but clients could not create, delete or rename vlans. clients also only store the vlan configuration while the switch on.


• Transparent : transparent switches don't participate in vtp. transparent switches don't store vlans advertised by servers. however, they do advertise/forward vtp advertisement that they receive. vlans can be created, renamed or deleted and local only to that switch. In transparent mode, VLAN configurations are saved in NVRAM (but not advertised to other switches), so the configuration is available after a switch reload. This means that when a VTP transparent mode switch reboots, it does not revert to a default VTP server mode, but remains in VTP transparent mode.
  

VTP pruning : VTP-pruning restricts packets from passing to an interfce to a switch that doesn't have the same vlan as the packets come from. this can save some bandwidth
VTP revision number : each switch running VTP keep track of a revision number. the revision number is a 32-bit and starts from 0. the revision number will determine wether the information received is more recent than the current one or not. everytime a change (a VLAN is added or removed) occur, the revision number is incremented. (a domain name change doesn't increment the revision number but reset it to 0)
VTP Advertisements : VTP uses a hierarchy of advertisements to distribute and synchronize VLAN configurations across the network.


VTP Default Settings

version = 1 (vtp has 3 version 1, 2, 3. only one version allowed in a domain)
domain name = null (means no domain)
mode = server
config revision = 0
vlans = 1

when a VTP first starts, by default there are 5 vlans created in a switch (1, 1002-1005).

when a VTP server switch is given a domain name, it will propagate the domain name to all switches for us.

you can reset the revision number of a switch by changing its domain name.

the command "show vtp status" will give you information about the running vtp in the switch. such as the domain name, version number, vtp mode, revision number, vlans information, etc.

the command "show vtp counters" will show you information about how many each information is sent or received.

VTP ONLY COMMUNICATES ON TRUNK PORT

VTP ONLY LEARNS ABOUT NORMAL-RANGE VLANs (vlan ids of 1 to 1005)

VTP DOMAIN NAMES ARE CASE SENSITIVE

VLAN CREATED BEFOTE ENABLING VTP WILL BE REMOVED

A SWITCH CAN BE A MEMBER OF ONLY ONE VTP DOMAIN AT A TIME



************
VTP messages
************
VTP messages are encapsulated within an ethernet frame which then encapsulated in trunking protocol (either 802.1Q or ISL). the vtp message (header and message) is at the data portion of the frame. VTP ADVERTISEMENTS ARE SENT PERIODICALLY. VTP sends advertisement to a reserved multicast address which is 01-00-0C-CC-CC-CC.

VTP header - fields and size varies but always contains domain name, domain name length, version, message type, revision number.

VTP message - VTP domain name, md5 digest, updater identity and timestamp message was sent.
for each vlan, the message contains:

• VLAN ID


• VLAN name


• VLAN type


• VLAN state


• additional VLAN configuration information

Type of advertisements
Inside each message there's a field that tells which type the message is.

Summary advertisments :

• are sent every 5 minutes by VTP server or client to inform other switches in the domain of the current revision number, the domain name and other VTP configuration details.


• sent immediately after a change occur.

there is a followers field that indicates that this summary is followed by subset advertisement. code for this type is 0x01.

Subset advertisements :
contain vlan information. triggered by:

• creating / deleting a vlan


• suspending / activating a vlan


• changing the name of a vlan


• changing the MTU of the vlan

it may take some subset advertisements to fully update the vlan configuration. there is a seq-number field that tells the sequence of packets, starts with 1. the code for this type is 0x02.

Request advertisements :
a request is sent to a VTP server if:

• domain name has been changed.


• the switch received a summary with revision number higher than its own.


• a subset advertisement is missed for some reasons.


• the switch has been reset.

when a VTP server received a request, it reponds by sending a summary advertisement and then a subset advertisement. the type for this message is 0x03.



***********
VTP pruning
***********
when vtp pruning is enabled on a switch, it reconfigures the trunk link based on which ports are configured with which vlans.

essentialy, if you want to enable pruning in your network, configuring the vtp pruning at the vtp servers is enough.

vtp pruning only prunes vlan pruning-eligle. vlans 2 - 1001 are pruning-eligible by default. vlan pruning-eligibles can be changed.

pruning cannot be done to vlans which pruning-ineligible. those vlans are 1 and 1002-1005


*****************
VTP configuration
*****************
to be noticed when configuriing VTP servers:

• confirm that default settings are present.


• always reset the configuration revision number.


• configure at least 2 vtp servers in the network. because only on servers we can configure vlans, if one down we still have the other one.


• if you set a password for vtp information, ensure that all switches is configured with the same password. switches without password or wrong password reject VTP advertisements.
  BY DEFAULT A CISCO SWITCH DOESN'T IMPLEMENT ANY PASSWORD.


• create vlan after you've enabled VTP on the vtp server, because vlan created before vtp enabled, are removed.


• ensure all switches run the same vtp protocol version.

to be noticed when configuring vtp clients:

• 
  
• confirm that default settings are present.


• verify vtp status. confirm that vlans has been updated and revision number is changed.


• configure access port, you still need to assign ports to existing VLANs.

(at global configuration)
Configure VTP Domain

vtp domain word

Configure VTP mode

vtp mode word

Configure password

vtp password password

Configure version

vtp version number

*********
Common error in configuring VTP
-protocol version mismatch. vtp version is incompatbile with different version.
-password mismatch / not set on every switch.
-different domain name. to solve this only configure domain name on VTP servers, because VTP servers will propagate the domain name to all other switches.


REMEMBER, BECAUSE BOTH VTP SERVERS AND CLIENTS SEND SUMMARY ADVERTISEMENT, BOTH CAN HAVE ITS VLAN CONFIGURATION RUINED WHEN A SERVER / CLIENT RECEIVED A SUMMARY ADVERTISEMENT WITH HIGHER REVISION NUMBER, IT WILL REQUEST FOR VLAN INFORMATION (SUBSET ADVERTISEMENTS) AND CONFIGURE ITS OWN VLAN CONFIGURATION (NO MATTER IF THE SENDING SWITCHES IS A CLEINT AND THE REQUESTING IS A SERVER). ALWAYS RESET THE REVISION NUMBER OF A SWITCH BEFORE ADDING IT TO THE NETWORK.

IPv6

IPv4 provides appoximately 3.7 billion assignable addresses of all 4,296,967,296 available addresses. this is because IPv4 divides addresses into classes and some of these classes are used for multicasting, research and testing and other reserved uses. in 2007 there are about 2.4 billion of IPv4 addresses that has been used. newer technology requires more addresses, including mobile users (PDA, new mobile phone), transportation (allow remote monitoring and maintenance), electronics (home appliances).


Europe, Japan and Asia-Pacific region has started to begin the transition from IPv4 to IPv6. Japan officially started to move in 2000 and set a deadline in 2005 to upgrade existing systems in every sector. this is followed by Korea, China and Malaysia. DOD mandated at early 2003, that all new equipment must be ip-enabled and compatible to IPv6.

IPv5 was used to define an experimental real-time streaming protocol.

not only IPv6 provides more addresses than IPv4, but also IPv6 is easier to use, has a simplified header and more secure. devices has been evolving from stationary devices into moving devices. in IPv6, mobile devices can roam into network reqions without breaking the network connection. the simplified header offers several advantages:

• Better routing efficiency
  
• no broadcasts, avoid potential threat of broadcast storm.
  
• no checksum processing
  
• flow labels field, no need to open the inner packet to identifiy various traffic flow.
  

IPv6 Representation
IPv6 is 128-bit length. it's represented as a series of eight 16-bit fields, each seperated by a colon. example, 1031:40BF:A03C:0000:5031:04DE:0000:0000. the representation can be shortened by using the following rules:

• leading zeros are optional to be written. the field 04DE can be written as 4DE. field 0000 can be written as 0
  
• successive zeros can be represented as two colons "::". the field 0000:0000 can be written as :: .
  

from the example above, it can be shortened as 1031:40BF:A03C:0:5031:4DE:: .


Global Unicast Address
IPv6 has a block of global unicast address. that is, addresses that are globally unique and are able to be routed. this address typically consists of a 48-bit global routing prefix and followed by a 16-bit subnet ID. an Organization can divide a given global unicast address into subnets with a maximum number of 65,535 subnets for each address. currently, IANA uses the range of addresses that starts with binray value 001 (2000::/3), which is 1/8 of the total IPv6 addresses. IANA is allocating the addresses in the ranges 2001::/16 to the five RIR (ARIN, RIPE, APNICm LACNIC, AfriNIC).

Reserved Address
IETF has reserved 1/256 of the total IPv6 addresses for various uses, both present and future.

Private Address
IPv6 has private addresses (just as in IPv4) for use in local needs only and not to be routed outside a particular private network. these addresses start with the first octet value of "FE" in hexadecimal notation and the next hexadecimal digit being a value between 8 and F.
these addresses are further divided into two types:

• Site-Local addresses. the same as private addresses stated in RFC 1918 for IPv4. the scope of these addresses is an entire site. however, the use of site-local addresses is problematic and is being deprecated as stated by RFC 3879 in 2003. site-local addresses begin with the first two hexadecimal value of "FE" and the third being a value from "C" - "F".
  
• Link-local addresses. link-local addresses are new concept to IP networking. these addresses have a smaller scope than site-local addresses. they refer only to a physical network (physical link). routers won't forward packets containing these addresses. they are used for link communications such as automatic address configuration, neighbor discovery and router discovery. Many IPv6 routing protocols also use link-local addresses. these addresses begin with the first two hexadecimal value of "FE" and the third being a value from "8" - "B".
  

Loopback Address
the concept is the same as a loopback address in IPv4. however in IPv6, there is just on address instead of a whole block for this function. the loopback address in IPv6 is 0:0:0:0:0:0:0:1 or also expressed as ::1.

Unspecified Address
in IPv4, a device that doesn't know its IP address will set the source address as all zeroes value. this is formalized in IPv6. the all-zeroes address is named "unspecified" and typically used in the source field of a datagram that is sent by a device that seeks to have its IP address configured. also expressed as ::.


IPv6 addresses have a portion that serves the same functionality of the host portion of IPv4 addesse, which is called the interface identifier. this portion is always 64 bits length and can be dynamically derived from a layer 2 address (MAC). this portion can be defined statically or dynamically. two ways to statically define IPv6 addresses ID are:

• manual interface ID assignment. one way to statically define the IPv6 address for a device is to manually configure both the network (prefix) and the interface ID to the device. to assign an IPv6 address to an interface in Cisco router, enter the following command in the interface configuration level
  

ipv6 address ipv6-address/prefix-length

ipv6-address: the address of the interface in IPv6 notation, example 2001:A58E:9CD:2947::49
prefix-length: the length of the prefix (network) portion. example /64

• EUI-64 interface ID assignment. EUI-64 standard define the way to stretch the MAC address, which is 48 bits, of the interface to a 64 bits interface ID used for IPv6. the convertion is done by inserting the 4 hexadecimal values of "FFFE" at the 24th bit of the MAC address. example, a MAC address of 00:0c:4F:90:27:FC is converted to 00:0c:4F:FF:FE:90:27:FC. to assign an IPv6 with the EUI-64 scheme to an interface in Cisco router. enter the following command at the interface configuration level.
  

ipv6 address ipv6-prefix/prefix-length eui-64

ipv6-prefix: the network (prefix) portion of the address
prefix-length: the length of the prefix (network) portion

example,

 

ipv6 address 2001:A58E:9CD:2947::/64 eui-64

two ways to dynamically define IPv6 addresses ID are:

• Stateless autoconfiguration. this is the plug-and-play feature of IPv6. this enables devices to connect to the network without the needs of any configuration and any servers.
  
• DHCPv6 (statefull). this uses a DHCP server to pass address parameter configuration to IPv6 devices. it provides automatic address allocation of reusable addresses and additional configuration flexibility. this feature can be used concurrently with stateless autoconfiguration feature in IPv6.
  

IPv6 Transition
there are many transition mechanisms that enable smooth integration of IPv4 and IPv6. different situations require different strategis. the commonc techniques are (recall the advice "Dual stack where you can, tunnel where you must". these two are the most common techniques used.):

• Dual stacking. routers and switches are configured to implement and provide connectivity for both IPv4 and IPv6 with IPv6 being the preferred protocol. this is the recommended option.
  
• Tunneling. serveral tunneling techniques available are"
  
• manual IPv6-over-IPv4 tunneling. encapsulates IPv6 packets within IPv4 protocol. this requires dual-stack routers.
  
• Dynamic 6to4 tunneling. automatically establish conneciton between IPv6 networks over a IPv4 network (usually the internet). this dynamically applies a valid IPv6 prefix for each IPv6 network which enables fast deployment of IPv6 in a corporate network without the need of address retrieval from ISPs or registries.
  
• Intra-Size Automatil Tunnel Addressing Protocol (ISATAP) tunneling. this uses the underlying IPv4 network as a link layer for IPv6. this allows IPv4 or IPv6 dual-stack hosts within a site to communicate with other such hosts on a virtual link, creating IPv6 network using the IPv4 infrastructure.
  
• Teredo tunneling. this is an automatic host-to-host tunneling instead of gateway tunneling. this passes unicast IPv6 traffic when dual-stacked hosts are located behind one or multiple IPv4 NATs.
  
• NAT-Protocol Translation (NAT-PT). this allows direct communication between hosts that use different IP protocol version. this translation is more complex than IPv4 NAT. at this time, this approach is the least favorable and should be used as a last resort(included in Cisco IOS releas 12.3.(2)T and later releas with the appropriate feature set).
  

Cisco IOS Dual Stack
dual stack is an integration method allowing a node to provides connectivity for both IPv4 and IPv6. each node has two protocol stacks with the configuration on the same interface or multiple interfaces. a dual-stack node should prefer IPv6 when it is available. old IPv4 applications continue to work as before. Cisco IOS Release 12.2(2)T and later (with appropriate feature set) are IPv6-ready. in order for Cisco routers to be able to forward IPv6 datagramse, use the global command "ipv6 unicast-routing". then configure every interface that forward IPv6 traffic with an IPv6 address.

example, configure interface FastEthernet0/1 to support both IPv4 and IPv6.

ipv6 unicast-routing
interface FastEthernet0/1
ip address 192.168.10.1 255.255.255.0
ipv6 address 2001:A58E:9CD:2947::49/64

when both protocols are configured on the interface, the interface is considered dual-stacked


IPv6 Tunneling
tunneling is an integration method by encapsulating IPv6 packets within another protocol, such as IPv4 protocol (when encapsulated into IPv4 protocol, a protocol type of 41 is specified at the IPv4 header). this enables connecting IPv6 networks without converting any intermediary networks to IPv6. tunneling requires the end routers to be dual-stacked (both border routers must support IPv4 and IPv6 and have their interfaces configured for IPv4 and IPv6 addresses). tunneling has two issues, it decreases the MTU by 20 octets because of the IPv4 header, tunneled networks are often difficult to troubleshoot. tunneling should not be considered as a final solution. a native IPv6 architecture should be the end goal.


Routing Consideration in IPv6
review of router's functionality in a network:

• the control plane. handles the interaction of a the router with other network elements, providing needed information and control the overall router operation. this playe runs routing protocols and network management processes.
  
• the data plane. this forward packets from a source interface to another interface. this involves switching mechanisms such as Cisco Express Forwarding (CEF) and process switching.
  
• Enhanced services. advanced features such as ACL, QoS, encryption, etc.
  

Challenges in IPv6 routing
IPv6 Control Plane

• IPv6 address size. address size affects the routing performance. in the same CPU environment, IPv6 takes more time to process source and destination address information. if routers relying only on software processing, they are likely to perform slower in IPv6 environment.
  
• IPv6 routing protocols. more address size means, messages between routing procotols will be larger than messages in IPv4 environment.
  
• Multiple IPv6 node addresses. IPv6 nodes may have multiple IPv6 unicast addresses, memory consumption on Neighbor Discovery cache may be affected.
  
• Routing table size. increased IPv6 total address leads to larger routing table. this may require more memory to support it.
  

IPv6 Data Plane
the data plane forwards IP packet based on the decisions made by the control plane.

• Parsing IPv6 extension headers. IPv6 packets may have some additional headers. these headers sometimes used by application in IPv6 environment. this additional fields require additional processing. if the length of the extension header exceeds the hardware register limits, the packet may be given to software switching or dropped. this somehow affect forwarding performance.
  
• IPv6 address lookup. most routers today perform lookups using an Application Specific Integrated Circuit (ASIC) which is originally designed to work in IPv4 environment. when this is used to process IPv6 packets which have larger address size, this could result in punting the packets into software processing or dropping the packets.
  

Cisco IOS IPv6 Name Resolution
two ways to perform name resolution in Cisco IOS

• Statically define a name for an IPv6 address. use the following command at global configuration level
  

ipv6 host name [port] ipv6addr [{ipv6addr}..]

name : name of the ipv6addr
port : telnet port to be used for the associated host
ipv6addr: the address of the hostname. there can be up to four addresses for a given hostname

example,

ipv6 host router1 2001:A58E:9CD:2947::1

Network Address Translation

RFC 1918 defines private IP addresses. private IP addresses are a reserverd block of numbers that can be used by onyone. these addresses can be used only in private networks and are not to routed in the internet. this way, onyone can use private IP addresses for his internal needs, without worrying the same address will be used by someone else. since packets containing private ip addresses are not to be routed in public networks (internet). blocks of reserved number used for private ip addresses are:

• Class A. 10.0.0.0 - 10.255.255.255. prefix length /8
  
• Class B. 172.16.0.0 - 172.31.255.255. prefix length /12
  
• Class C. 192.168.0.0 - 192.168.255.255. prefix length /16
  

unlike private ip addresses, public ip address must be registered with a Regional Internet Registry (RIR). Organizations can lease public addresses from an ISP. those RIRs are:

• ARIN, America
  
• RIPE, Europe
  
• APNIC, Asia
  
• LACNIC, South America
  
• AfricNIC, Africa
  

in the old days, a device that needs to access the internet must be assigned with a public IP address. since there are not enough public addresses, there's no way an organization will assign each of its devices a public address. Network Address Translation provides a mechanism to enable private ip address devices to access the internet with only using one public address.

a NAT-enabled router has a pool of public IP addresses. these addresses can be used by the inside hosts when they want to communicate with a host outside the network (at the internet). the router will maintain a translation table. this table contains the inside local address, inside global address, outside global address. the router will act as a forwarder for the inside host, it will alter the source address of the packet sent to the outside network to one of the public address that it has. when the router receives a packet destined for a particular public address, it looks up at the table and find the corresponding inside local address. this allow the router to forward the packet to the correct host at the inside network.

some NAT terminologies:

• inside local address. actual address of inside host, most likely a private address.
  
• inside global address. public address given to an inside host when it wants to communicate with outside network.
  
• outside global address. public address assigned to a host in the internet.
  
• outside local addess. private address assigned to a host on the outside network. in most cases this is the same as outside global address.
  

the "inside" of a NAT is not synonymous with private addresses as defined by RFC 1918. "non-routable" means that it's not routable on the internet.


Types of NAT
Static NAT. one-to-one mapping, a particular inside host will always be given the same public address. this mapping remain constant. this is usually usefull for hosts that need a consistent public address (might be enterprise servers or networking devices).

Dynamic NAT. first-come, first-served basis mapping. when an inside host wants to communicate with outside network, it will be assigned with one of the public address from the pool that is available (not used by any other host yet).

NAT overload, also called Port Address Translation (PAT). maps multiple private addresses to a single public address or a few addresses. a PAT-enabled assigns a source port number to TCP/IP sessions opened by inside hosts. the router also ensures that every hosts use a different source port number. when reply messages come from the internet, the router will check the destination port of the messages and do a look up at the table to forward the message to the correct host at the inside network.

NAT overload assigns a next-available port if the port chosen by an inside host is already used by another host. if an inside host opens a session with outside network and choose port 1221 as it source port, NAT router will try not to alter the source port of inside local address, however if 1221 is already used by another host, NAT router will use the next available port (in this case 1222, if not used yet) for the inside global address of this session. it will choose a port number starting from appropriate port group 0-511, 512-1023, 1024-65535. if every ports has been used and there's more than one public ip addess, NAT router will use the next public address.


Configuring Static NAT
static NAT allows connections initiated by external devices to inside hosts. for example you may want to map an inside global address to your web server inside local address. the steps for configuring static NAT are:

• step 1. establish a static translation between an inside local address and an inside global address.
  

ip nat inside source static local-ip global-ip

local-ip: inside local address of a specific device
global-ip: public address available for the local device

• step 2. specify the inside interface.
  

interface type number

ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 3. specify the outside interface
  

interface type number

ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

Configuring Dynamic NAT
dynamic NAT translates private addresses to public addresses from a pool. the steps are:

• step 1. Define a pool of global addresses to be allocated as needed.
  

ip nat pool name start-ip end-ip {netmask netmask-number|prefix-length pref-length}

name: word. name of the pool
start-ip: lowest public address to be available in the pool
end-ip: highest public addess to be available in the pool
netmask-number: subnet mask of the public addresses
pref-length: prefix length of the public addresses

• step 2. create a standard access-list permitting the addresses to be translated.
  

access-list acl-number permit source [ source-wildcard ]

acl-number: a number that identifies the the standard acl
source: private address/network to be permitted
source-wildcard: wildcard of the source permitted (see ACL)

• step 3. establish dynamic translation between private addresses and public addresses
  

ip nat inside source list acl-number pool name

acl-number: the number of ACL which permits private addresses to be translated
name: name of the pool that contains public addresses

• step 4. specify the inside interface.
  

interface type number

ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 5. specify the outside interface
  

interface type number

ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

Configuring NAT overload
there are two ways to configure overloaded NAT. it depends on how many public address is given by the ISP. if only one address is given, the steps are:

• step 1. create a standard access-list permitting the addresses to be translated.
  

access-list acl-number permit source [ source-wildcard ]

acl-number: a number that identifies the the standard acl
source: private address/network to be permitted
source-wildcard: wildcard of the source permitted (see ACL)

• -step 2. establish overload translation.
  

ip nat inside source list acl-number interface interface-type/number overload

acl-number: the number of ACL which permits private addresses to be translated
interface-type/number: specify the interface that is assigned the public address (typically, address given by the ISP)

the "overload" keywords enables the addition of the source port number to the translation.

• step 3. specify the inside interface.
  

interface type number
ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 4. specify the outside interface
  

interface type number
ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

to configure overloaded NAT with more than one public ip address:

• step 1. create a standard access-list permitting the addresses to be translated.
  

access-list acl-number permit source [ source-wildcard ]

acl-number: a number that identifies the standard acl
source: private address/network to be permitted
source-wildcard: wildcard of the source permitted (see ACL)

• step 2. Specify the global addresses as a pool.
  

ip nat pool name start-ip end-ip {netmask netmask-number|prefix-length pref-length}

name: word. name of the pool
start-ip: lowest public address to be available in the pool
end-ip: highest public addess to be available in the pool
netmask-number: subnet mask of the public addresses
pref-length: prefix length of the public addresses

• step 3. establish overload translation
  

ip nat inside source list acl-number pool name overload

acl-number: the number of ACL which permits private addresses to be translated
name: name of the pool that contains public addresses

• step 4. specify the inside interface.
  

interface type number
ip nat inside

type: the type of the interface [FastEthernet | Serial]
number: interface number

• step 5. specify the outside interface
  

interface type number
ip nat outside

type: the type of the interface [FastEthernet | Serial]
number: interface number

by default translation will time out after 24 hours, you can change the timers with the command "ip nat translation timeout timeout-seconds".

you can see the NAT you've configured using the command "show run". to verify NAT operations use the command "show ip nat translations [verbose]". the command "show ip nat statistics" displays information about total number of active translations, NAT configuration parameters, total addresses in the pool, and allocated addresses from the pool.

you can debug NAT operations using the command "debug ip nat".


Port Forwarding
port forwarding enables external users (from outside network) to initiate a connection to inside hosts. Port Forwarding does this by translating received messages destined to a specified port, to a particular host and destination port number at inside network.

for example, you have a web server in you inside network of which ip address is 192.168.1.252, if you want to enable external users to access your web server you can configure port forwarding HTTP traffic from your border router to the web server. you can specify traffic received at the WAN interface destined to port 80 (HTTP works at port 80), to be forwarded to inside interface with destination address 192.168.1.252 and destination port is 80. in this case, the external port and the internal port are the same. you can change the external port and the internal port to something else. if you change the external port, the external users must know the specific port number you use.

Configure DHCP

Configuring DHCP Server
a Cisco router running IOS can be configured as a DHCP server. the steps to configure a Cisco router to be a DHCP server are:

• step 1. Define a range of addresses that should not be used for address allocation. this could be some static ip addresses assigned to servers or printers, switch management IP address and gateway/router address. the command to specify the excluded addresses are
  

ip dhcp excluded-address low-addess [high-address]

low-address: the (lowest) address of the reserved address that should not be used for DHCP address allocation.
highest-address: optional, if you want to specify a range of reserved address, this should be the highest address of the range.

a best practice is to configure these reserved addresses first at the global configuration level to prevent DHCP assigns these reserved addresses accidentally.

• step 2. create a DHCP pool. using the command
  

ip dhcp pool pool-name

pool-name : the name of the pool te be created.

after entering the command, you'll be at the DHCP configuration level. at this configuration level you can configure specifics of the pool

• step 3. configure the specifics of the pool. here you need to configure the network address the pool is assigned to, and the gateway address of the network. to define the network of the pool use the command
  

network network-number {mask | /prefix-length}

network-number : the network address
mask : subnet mask of the address

to define a default gateway for the network enter the following command

default-router address {address2 .. address8}

typically the gateway address is the address of the router's LAN interface connected to the network. at least one address is required but you can list up to eight addresses.

there are some optional configurations for the DHCP pool. some of those optional commands are

•  define DNS server

dns-server address {address2 .. address8}

• define the domain name

domain-name domain

• define the duration of the lease

lease { days [hours] [minutes] | infinite }

• define the NetBIOS WINS server

netbios-name-server address {address2 .. address8}

here is an example to configure DHCP for network 192.168.10.0/24. with 192.168.10.1 - 192.168.10.10 and 192.168.10.100 addresses should not be used in DHCP address allocation. here we create a DHCP pool named "pool1"

ip dhcp excluded-address 192.168.10.1 192.168.10.10

ip dhcp excluded-address 192.168.10.100

ip dhcp pool pool1

network 192.168.10.0 255.255.255.0

default-router 192.168.10.1

end

to verify the DHCP configuration you can use the command "show ip dhcp binding" at privileged EXEC mode. it will show information of current bindings of the addresses in the pool to clients. use the command "show ip dhcp server" to see DHCP statistic and message received/sent by the server. to see information of the pools that have been created use the command "show ip dhcp pool".

administrators can also specify which MAC addresses to service and assign them the same address everytime they boot.

DHCP services can be disabled with the command "no service dhcp". reenable it with the command "service dhcp".

you can also configure a router to be a DHCP server using SDM. click the configure tab, in the task list. click the DHCP folder > DHCP pool and click the add button. a dialog box will appear with some text-fields that you can fill in to specify the pool parameters such as the pool's name, pool network, starting and ending address of the pool, lease time, etc.. when you've finished specifying the parameters, klik the ok button. SDM automatically exclude IP address used by the interface connected to the LAN of the pool.

Configure DHCP Client
sometimes, Cisco routers on a SOHO network needs to get its IP address automatically assigned by the ISP. this could be done, by using the command "ip address dhcp" at the interface that should get its address from a DHCP server.
example, a cisco router is connected to an ISP through the interface Serial0/0/0. ISP will automatically assign this interface an address, so this interface address should not be configured manually. the commands are

interface serial0/0/0

ip address dhcp

no shutdown

DHCP Relay
in most enterprise environments, servers are located in a seperate network (the server farm) including the DHCP server. a problem arise as when a client need an address from a DHCP server on a seperate network. DHCPDISCOVER message is a broadcast message and a router won't forward the message to any other network. (this problem is not specific only to DHCP service, some other services use broadcasts. Cisco routers and other devices use broadcast to locate a TFTP server or an authentication server, eg TACACS server).
the problem can be solve by configuring intervening routers and switches to act as a DHCP relay agent with the Cisco IOS helper address feature. this enable routers to forward DHCP messages to the DHCP servers. to configure a router as a relay agent, use the following command at the interface receiving the broadcast (nearest/directly connected to the client)

ip helper-address forward-address

forward-address : an ip address to which broadcasts will be forwarded.

using that command, broadcasts received at the interface will be forwarded to the specified address as a unicast.

example, host1 on subnet 192.168.10.0 needs to renew its address from a DHCP server on subnet 192.168.20.0. both devices are seperated by a router. host1 (subnet 192.168.10.0) is connected to the router by the FastEthernet0/0 interface. the DHCP server address is 192.168.20.254. assume that you're at the global configuration level of the router. enter the following commands at the router.

interface FastEthernet0/0

ip helper-address 192.168.20.254

as default, ip helper-address forward the follwoing eight UDP services:

• Port 37: time
  
• Port 49: TACACS
  
• Port 53: DNS
  
• Port 67: DHCP/BOOTP client
  
• Port 68: DHCP/BOOTP server
  
• Port 69: TFTP
  
• Port 137: NetBIOS name service
  
• Port 138: NetBIOS datagram service
  

to add additional services to be forwarded use the command "ip forward-protocol".

VPN

Tunneling enable users to access private networks from public networks. tunneling encapsulates an entire packet within another packet and sends the new composite packet over a network. three classes of tunneling protocol:

• Carrier protocol. the protocol over which the information is travelling (Frame-relay, ATM, MPLS)
  
• Encapsulating protocol. the protocol that wraps around the original data (GRE, L2F, L2TP)
  
• Passenger protocol. the protocol over which the original data was sent over (IPv4, AppleTalk, IPv6, IPX)
  

Tunneling works as the original data is wrapped by the encapsulating protocol, then as leaving the VPN gateway ("tunnel interfaces"), the data will be encapsulated by the carrier protocol with the source and destination adress are the "tunnel interface"s address, when the data arrived at the other end of the VPN gateway, the original data will be extracted and sent over the destination.

for the message to be private, it must be encrypted. VPN encryption rules include an algorithm and a key. the message will be encrypted using the combination of the algorithm and the key. the result is a cipher text, that's very difficult if not impossible to be decrypted without the correct key. there are two kinds of encryption algorithm, symmetric algorithm which uses the same key for the encryption and decryption process, and asymmetric algorithm that uses different keys for the encryption and decryption process. some common used encryption algorithm are:

• Data Encryption Standard (DES). a symmetric key encryption. developed by IBM, uses 56-bit key giving high-performance encryption.
  
• Triple DES (3DES). developed from DES. a symmetric key cryptosystem. it encrypts a message with one key, decrypts it with another key and finally encrypts it with another different key. this provides more strength than DES.
  
• Advanced Encryption Standard (AES). developed by the National Institute of Standards and Technology. replacing DES. it offers more strength than DES and more efficient than 3DES. it offers using three different key-lengths: 128, 192 and 256 bit keys.
  
• Rivest, Shamir, and Adleman (RSA). named as its founders. this is an asymmetric cryptosystem. it uses a key bit length of 512, 768, 1024 or larger.
  

a Hash is a string generated from a text. it's generated using algorithms that there will be no two different texts that will produce the same hash value. the hash is smaller than the text. it can be used to guarantee that a message hasn't been modified. the sender can generate a hash of the message and send it along with the message to the receiver. the receiver then receive the message and will generate a hash value from the message again. the result then will be matched with the hash value sent by the sender. if both hashes are the same, then the message hasn't been changed/modified.

a keyed hashed message authentication code (HMAC) is a data integrity algorithm that guarantees the integrity of the message. a HMAC has two parameters: a message input and a secret key known only to the sender and the receiver of the message. two commons HMAC algorithm are:

• Message Digest 5 (MD5), uses 128-bit shared key. the 128-bit key is combined through the message and produces a 128-bit hash. the hash is appended with the message and sent to the destination.
  
• Secure Hash Algorithm 1 (SHA-1), uses 160-bit shared key. the 160-bit key is combined through the message and produces a 160-bit hash. the hash is appended with the message and sent to the destination.
  

both ends on VPNs connectin must be authenticated. so that a secure connection and communication can be made. two peer authentication in VPNs are:

• Pre-Shared Key (PSK), a secret key shared between the two parties. a PSK is entered manually at each party and is used to authenticate the peer. it uses symmetric key cryptosystem. the key shared is combined with other information to form the authentication key.
  
• RSA signature, exchange digital certificates to authenticate the peers. local device (local end) derives a hash and encrypts it with its private key. the encrypted hash (digital signature) is sent along with the message. the remote end will decrypt the hash using the public key of the local end. if the decrypted hash matched the recomputed hash, the signature is genuine.
  

Internet is a public network and it reaches almost everwhere in the world. the fact that internet is a worldwide network, makes internet an option for oranizations and corporations to connect their teleworkers with the organization's private network. but the fact that it is a public network, makes it fragile to security risks. with VPN technology, organizations can create a private network from the internet and can safely transfer their private data over the internet from branches and remote teleworkers. instead of using a dedicated layer 2 connection, such as a leased line, a VPN uses virtual connections that are routed over the internet.

the benefits of using VPN are:

• cost saving. unlike a leased line which requires an expensive cost to establish a connection between sites. VPN uses the public network Internet, which is cheaper.
  
• security. VPN encrypts and authenticates its data. protecting the data from unauthorized access.
  
• scalability. anyone, anywhere within an ISP area can connect to the VPN. organizations can add new users, big or small organizations without adding significant infrastructure.
  

Types of VPN:

• site-to-site VPN. a site-to-site VPN is used to connect between company intranets or a company intranet with a business partner extranet. for example it can connect a branch with the headquarter office. a site-to-site VPN uses a VPN gateway at each site to send and receive TCP/IP traffic. a VPN gateway in a site-to-site VPN could be a router, PIX firewall appliance or an Adaptive Security Appliance (ASA). the VPN gateway is responsible for encrypting outgoing traffic and decrypting incoming traffic.
  
• remote access VPN. remote access VPNs are used to connect mobile users and teleworkers as well as extranet consumer-to-business. since most teleworkers have access to the internet, they can establish a remot VPN connection to the company. each host typically has a VPN client software. this software will encrypts/decrypts incoming/outgoing traffic. at the company site, a VPN gateway which could be a PIX firewall, a router, an ASA or a VPN concentrator will do the encrypts and decrypts tasks.
  

a VPN creates a virtually private network which must maintain confidentiality and security. it must protect data against sniffing activity, sender authentication and message integrity.
typically a VPN would require the following components:

• a network with servers and workstations.
  
• an access to the internet.
  
• VPN gateway capable devices, such as routers, firewalls, VPN concentrators and ASAs. at the endpoints that establish and manage VPN connections.
  
• appropriate software to create and manage VPN tunnels.
  

Most VPN can do both

• Encapsulation. also called as tunneling, this enables data to be transferred between private networks over a shared public network.
  
• Encryption. codes data to another format using a secret key. decryption decodes the encrypted data to its original format.
  

Keypoints of security in VPNs are:

• data confidentiality. guarantees that data are not stolen as they travel across a shared networks. VPNs achieve this using encapsulation and encryption.
  
• data integrity. guarantees that the data received by the receiver are the same as the data sent by the sender. this means that data are not modified. VPNs usually use hashes to ensure data integrity. a hash is like a seal that guarantees that no one has read the content of the message.
  
• authentication. this guarantees that only authorized users may participate in the private network. unauthorized users must not be given access to the private network. VPNs achieve this by using passwords, digital certificates or other authenticate mechanisms.
  

IPsec is a protocol suite for securing communications in IP networks. there are two frameworks for IPsec:

• Authentication Header (AH), provides authentication and integrity. use this when confidentiality (ecnryption) is not needed or permitted. this makes AH weaker, that's why AH is often used along with ESP.
  
• Encapsulation Security Payload (ESP), provides authentication, integrity and confidentiality (encryption). although encryption and and authentication are optional, at a minimum, one of them must be selected.
  

we can choose and implement standards for encrytion, authentication and key exchange

IPsec Framework Choices

IPsec Protocol - ESP, AH, ESP + AH
Encryption - DES, 3DES, AES
Authentication - MD5, SHA
DH - DH1, DH2, DH5

DH allows two parties to establish a shared secret key used for the encryption and hash algorithm.

Password Recovery

enable password and enable secret are used to control access to the privileged EXEC mode. lost password can be recovered while lost secret should be replaced by a new one because it's encrypted. for security reason, you recover lost password or secret by connectring your PC to the device through a console cable. the configuration register, is something similar to the BIOS configuration in a PC. for example, BIOS determine from which hard disk should the PC boot. for a router, the configuration register, which is represented by a single hexadecimal value, tells the router what steps to take when booting. configuration register has many uses, password recovery might be the most used one.

the steps are:

• step 1. connect your PC to the router.
  
• step 2. record the configuration register by entering the command "show version" (the configuration register information usually will be at the last line). if you don't have access to the user EXEC mode anymore. you can safely assume that the configuration register value is 0x2102 (the configuration register is usually set to 0x2102 or 0x102).
  
• step 3. turn off the router and then turn it back on.
  
• step 4. press Break on the keyboard, within 60 seconds of power up to put router into ROMmon.
  
• step 5. change the configuration register value to 0x2142 in ROMmon by entering the command "confreg 0x2142". this will cause the boot process to bypass the startup-configuration where the forgotten password is stored.
  
• step 6. reboot the router by entering the command "reset" in ROMmon. the router will then reboot and ignores the saved configuration.
  
• step 7. ignore the initial setup procedure by typing "no" at boot process.
  
• step 8. go to the privileged EXEC mode with the command "enable".
  
• step 9. copy your startup-configuration to running-configuration with the command "copy startup-config running-config".
  
• step 10. now you use "show running-config" to see the password. if your password is encrypted, then you have to set a new password. (you will also see that all interfaces are on shutdown state).
  
• step 11. to set a new password go into the global configuration level with the command "configure terminal".
  
• step 12. set a new secret with the command "enable secret password". for example if you want to set the password to cisco then type "enable secret cisco".
  
• step 13. because all interfaces are in shutdown state, issue "no shutdown" on every interface that should be up. issue "show interface brief" to confirm it.
  
• step 14. reset the configuration register to the its value (that you've recorded) with the command "config-register confreg-value". enter the command "config-register 0x2102", if you want to set it to 0x2102.
  
• step 15. all is set, then you might want to copy the running-configuration to the startup-configuration so that your new password is stored in startup-configuration.
  

Recovering IOS Image

IOS Image is crucial for a router to run. However if the IOS Image is accidentally deleted from the flash, the router can still operate as long as it's not rebooted, because it's running IOS from RAM. If somehow it's rebooted or you have to reboot it for some reason, then the router won't be able to run IOS anymore, it will boot into ROMmon. You can recover from this state by copying IOS Image that has been backup previously to an TFTP server. But the steps/commands are different because we are dealing with ROMmon (you still can type "?" to see available commands in ROMmon). the steps are:

• step 1. Connect the router directly to the TFTP server. first you have to connect the router to the TFTP server from the first ethernet port of the router (this depends on the router, some router is FastEthernet0/0). And give the TFTP server a static IP address, for example 192.168.20.1.
  
• step 2. Set ROMmon variables. turn on the router then you'll see ROMmon prompt. some notes about variables in ROMmon:
  

Variable names are case sensitive


Don't include any spaces before and after the = symbol


Navigational key are not operatable

enter the following variables to the ROMmon, the value for each variable is just an example, you can change it like you need.

IP_ADDRESS=192.168.20.2
IP_SUBNET_MASK=255.255.255.0
DEFAULT_GATEWAY=192.168.20.1
TFTP_SERVER=192.168.20.1
TFTP_FILE=c1841-ipbase-mz.123-14.T7.bin

• step 3. enter the "tftpdnld" command. this will download the specified file from the TFTP server. before the transfer begin you'll be warned that all existing data in flash will be deleted. type "y" to continue. then you will see some exclamation marks "!", one exclamation mark shows you that a UDP packet has been successfully transferred. after it finished, use the "reset" command to reboot the router with the IOS Image in the flash.
  

Recovering Using Xmodem
there's also another way for recovering a IOS Image to a router. another way is using xmodem (ROMmon supports Xmodem), but the transfer progress is slower than using the "tftpddnld" command because the transfer is accomplished using the console cable. that is, copy of the IOS Image is not taken from a TFTP server but might be from an Administrator PC. the steps are:

• step 1. connect a PC that has the IOS Image to the router. Open connection with the router to enter the ROMmon command prompt.
  
• step 2. use the "xmodem" command at the ROMmon command prompt. the syntax is
  

xmodem [-cyr] [filename]

c : specifies CRC-16
y : specifies the Ymodem protocol
r : copies the image to RAM

example,

xmodem -c c1841-ipbase-mx.123-14.T7.bin

by entering this command at the router, will make the router ready to receive the specified file.

• step 3. from the software that you use to make a connection to the router through the console cable, choose to send a file. Depends on the software that you use, there should be a menu to send a file. if you use HyperTerminal the menu is Transfer > Send File.
  
• step 4. browse for the file that you want to transfer, specify the protocol to be used to xmodem, then send the file. after the transfer has been done the router will reload automatically with the new IOS Image.
  

Maintain Cisco IOS

Over time, a router will need update or updgrade. Either an update or updgrade for the IOS image or the configuration file. an update replaces one release with another without upgrading the feature set. it may fix a bug or replace a release that is no longer supported. an upgrade replaces one release with another with an upgraded feature set. the upgrade might include additional technologies or new features. updates are free while updgrades are not.

NOTE: IT'S NOT ALWAYS GOOD TO REPLACE A ROUTER IOS IMAGE WITH THE NEWEST RELEASE. SOMETIMES THE NEWEST RELEASE IS NOT A STABLE RELEASE.

Cisco provides guidelines on updating/upgrading IOS version. Following the guideline can

reduce operational, planning and management cost. The phases that cisco reccomends are:

• Plan, set goals, resources, hardware and software and create schedule
  
• Design, choose IOS releases to be used and the migrating strategy.
  
• Implement, execute the migration plan.
  
• Operate, monitor the migration progress and backup copies of old images and configuration.
  

Cisco also provides a number of tools on cisco.com. some of the tools are:

• Cisco IOS reference guide, cover basics of cisco IOS software family.
  
• Cisco IOS software technical documents, documentation of each IOS release.
  
• Software Center, place to download IOS images.
  

an attacker who has compromised a router can delete its IOS image or configuration file. to mitigate from this attack, a network administrator must know how to maintain a device file systems.

each Cisco IOS device has a feature called the Cisco IOS IFS (Integrated File System) which can be used to see, navigate and manipulate directories in a Cisco device. you can enter the command "show file systems" at privileged EXEC mode to see available directories in the device. each directory and files in the file system has its own permission mode, read only (ro), write only (wo) and read and write (rw). Then you can see files in each directory ("dir"), change working directory ("cd dir_name") and print current working directory("pwd").

if you want to copy a file in IOS, you can specify the file that you want to copy. File location in IOS devices is specified using the URL convention. in my opinion, as like other OS, IOS has as much the same way to locate a file except that in IOS you first specify the prefix of the file location. the prefix can be tftp, flash, system (RAM) and nvram. for example if you want to specify the "backup-config" file which is located in the "configs" folder in a tftp server of which ip address is 192.168.20.30 you enter "tftp://192.168.20.30/configs/backup-config", file in flash memory you enter "flash:configs/backup-config", in ram "system:running-config", while in nvram "nvram:startup-config".

after specifying the file location, then you can copy the file using the command

copy source-url destination-url

instead of providing the full url, we can also use the simple syntax to copy a file. for example to copy running-configuration in RAM to startup-configuration in NVRAM

copy running-config startup-config

instead of

copy system:running-config nvram:startup-config

to copy running-configuration to a remote location

copy running-config tftp:

to copy a configuration file from a remote location to the ram

copy tftp: running-config

**************************
Cisco IOS Naming Convetion
**************************
knowing the convention of the file can help a network administrator in upgrading and selecting new IOS images. let's see an example of an IOS image name

c1841-ipbase-mz.123-14.T7.bin

the name can be divided into some parts.

• the first part is "c1841", this means that the image runs on 1841 seri platform.
  
• the second part contains the feature set. in this case is "ipbase", this means basic IP internetworking. some other possibilities are:

- "i", ip feature set.
                    - "j", enterprise feature set (all protocols), PLUS feature set (extra queueing, manipulation or translations).
                    - "56i", 56-bit IPSec DES encryption.
                    - "k2", 3DES IPSec encryption (168 bit)                                

• the third part indicates where the image run and wether it's compressed or not. in this case "mz" means that the file runs on RAM and is compressed.
  
• the fourth part is the version number, "123-14.T7".
  
• the last part is the file extention. "bin" indicates that the file is binary executable.
  

you can use TFTP to maintain IOS images and configuration files for routers in a network.  with TFTP you can have a central place to upload and download IOS images and configuration files. The TFTP server can be another router, a workstation or a host.

things to do before changing IOS image on a router:

• Determine memory required for the update, install additional memory if current one is not enough
  
• Set up and test file transfer capability between the router and the file server
  
• Schedule the update/upgrade, because it needs some downtime. usually updates are performed out of peak hour.
  
• 
  

When you are ready to perform the update:

• shutdown all interface not participating in the update process.
  
• backup old IOS image and configuration file.
  
• Load the update and neccessary configuraiton file to the router.
  
• Test the update to confirm that it has been done successfully. if Test failed, check what went wrong and start over again.
  

Backing up IOS Image
it's recommended the you follow the step bellow if you want to back up an IOS image to an TFTP server.

• step 1. ping the TFTP server to determine there's a connectivity between router and the TFTP server, and that the server is alive.
  
• step 2. Check wether the TFTP server has sufficient memory for the IOS image. you must know the available memory in the TFTP server, and you can check the size of the router's IOS image by entering the command "show flash:".
  
• step 3. Copy the current IOS image to the TFTP server using the command "copy flash: tftp:". during the progress there will be some exclamation marks "!", one exclamation mark shows you that a UDP packet has been successfully transferred.
  

Upgrading IOS Image
you can update a router's IOS image by transferring the new one from the TFTP server to the router. this can be done with the command "copy tftp: flash:". after entering this command you'll be prompted for TFTP ip address, and the new IOS file name (you're required to enter the appropriate file name). Once this is done, you'll be prompted wether you want to erase flash memory. erase flash memory when the router doesn't have enough memory fot the new IOS
image. during the progress there will be some exclamation marks "!", one exclamation mark
shows you that a UDP packet has been successfully transferred.


***************************************
TroubleShooting Cisco IOS Configuration
***************************************
after having all devices in a network the right IOS Image and configuration, we can tune configuration for individual devices to improve their performance in the network. There two common commands that most used in daily activity, "show" and "debug". "show" will lists the
parameter onfiguration while "debug" will show you traffic flow through interface, that is allowing you to trace the execution of process.

we use the "debug" command when troubleshooting, finding bugs, etc. when you enter a command to a router, actually there you initiate many more process than just the command you've just entered. therefore just tracing the configuration line by line sometimes won't help finding the error. using the "debug" command will help you to show the flow of packets, and check wether everything is working properly. all "debug" commands are entered at the privileged EXEC mode. some note on using "debug" command:

• plan debugging properly. without proper precautions, debugging can make things worse
  
• debugging can generate too much output. Know what you're looking for before start debugging things.
  
• debugging's output can vary between each protocol. some generate a single output for a single packet, while others may generate multiline output for a packet. a basic understanding of how the protocol works usually needed on debugging the protocol.
  

some other tools that can help to optimize the usage of "debug" are:

• "service timestamps" command will give a timestamp to each debug messages or log messages. this can give you the idea of when an event happened and the duration between events.
  
• "show processes" will show you the CPU used for each process. this information can help you determine wether the CPU has the sufficient process time for debugging or not.
  
• "no debug all" this will turn of every debugging process that has been started.
  
• "terminal monitor", displays debug outputs and system error messages for the current terminal and session. when you telnet to a device, and use the "debug" command, you won't see the debug output unless you've entered this command.
  

NOTE:output from debugging is given high priority by the CPU. it's a good choice to use "debug"during quiet hours so that is doesn't interfere with the production traffic. and always turn off debugging by entering the command "no debug all" when debuggin process has been finished

Multilayer Switch

Multilayer switch is a switch with the ability to do the task of layer 3 routing and some task of the above layer.

Layer 3 switching means routing approximately at the speed of switching. High-end Cisco Layer 3 switches are now able to perform this second function, at the same speed as the Layer 2 switching function

most multilayer switch today doesn't have any visible router module. its ability is contained in its supervisor (CPU). but older chasis based switch can be a multilayer switch with a multi layer switch function card (MSFC) module. in this kind of multilayer switch you go to the router OS with the 'session slot-number' command where the slot-number is the number of the slot where the module is installed you can obtain this number by executing show module command.

with multilayer switch, routing inter vlan can be done by the swithc itself. this is done by creating an Switched Virtual Interface (SVI) for each vlan. with the command

interface vlan vlan-number

different series of cisco multilayer switch give different feature and flexibility. you must choose either a switch with limited routing capabilities, or a router with limited switching capabilities. 6500 switches has become the widley deployed in enterprise environment.

6500 switches come in different sizes from 3 slots up to 13 slots. 6500 has many modules that makes it very expandable Firewall Services Modul (FWSM - firewall and security), Content Switching Module (CSM - load balancing) and Network Analysis Modules (NAM - network monitoring) all in one chassis.

6500 switches is highly redundant. they support dual power supply and dual supervisor.
enhanced chasis type is recognized with the letter e in the end of the series number(6500e).
enhanced chasis use high-speed fans to cool these power-hungry modules.

Supervisor - over the years, different supervisor models have been introduced to offer greater speed and versatility. increased functionality has also been made available via a add-on daughter cards.

Modules
daughter card is an add-on for a module.
there are fabric-enabled module and nonfabric-enabled module
line cards (offers connectivity, such as copper or fiber ethernet) and service module (offers functionality such as FWSM, CSM)

*Ethernet Module, provide connectivity for ethernet (RJ42, GBIC) available from 4 ports. 48 ports with speed up to 1000 mbps.and even 96 port RJ-21 connector module supporting 10/100 mbps.

*Firewall Services Module (FWSM), provide firewall services just like PIX.

*Content Switch Module (CSM).

*Network Analysis Module, packet capturing, monitoring traffic. controlled through a web-browser which can be tedious when seeing a large scale of traffic.

*Intrusion Detection System Module (IDSM), act like an IDS appliance.

*FlexWAN Module, allow the connection of WAN links such as T1, DS3, OC3.

*Communication Media Module (CMM), provide telephony integration (analog telephone, fax machines, modem)


*************
3750 switches
*************
3750 switches, successor of 3550 switches. have the ability of stacking (the ability to link together some switches, usually of the same type to form a single logical switch with a single management IP address. once you telnet or SSH to the IP address, you can control the stack as if it were a single device).

FlexLink support failover (a pair of link, where one is the primary link and the other is the backup link). flexlink is used on switches where you don't want to run STP.

Port Security. you can specify certain MAC addresses that you allow or deny the right to use the port.

Routing Behaviour

Routing Behaviour - routing behaviour is different from routing protocol. routing protocol (classless/classfull) determines how to populate the routing table, while routing behaviour determines how to search the routing table after it's populated.

what is a match? For there to be a match between the destination IP address of a packet and a route in the routing table, a minimum number of left-most bits must match between the IP address of the packet and the route in the routing table. The subnet mask of the route in the routing table is used to determine the minimum number of left-most bits that must match. (Remember, an IP packet only contains the IP address and not the subnet mask.)

level 1 routes = classfull address, supernet
level 2 routes = subnets

level 1 route that has level 2 routes is called a parent route while those level 2 routes are called child routes.

Routing table lookup step
step1 - look for level 1 routes, if there's a match forward the packet. if this is a parent route continue to step 2.
step2 - match level2 routes. if there's a match forward the packet.
step3 - if there's no match. if this is classful routing behaviour drop the packet (see, why classful routing behaviour never use the default route to forward packets). if classles check level 1 routes again for supernet.
step4 - if no match for supernet but supplied a default route forward the packet through the default route.
step5 - if there's no default route, drop the packet


recursive lookups = if route entry doesn't specify outgoin interface only the next hop ip address (like BGP entry routes), router will check the routing table again to find out what is the outgoing interface to forward the packet.


classfull routing - prefer classfull entry, default route will not be used when there are no match to forward the packet in the routing table.
classless routing - when there are no match after checking the level2 routes (subnetted entry / network). it will check the level1 routes again to check for lesser match (supernet, summary route, etc)

Cisco Security Device Manager

Cisco Security Device Manager (Cisco SDM) is a web-based device-management tool that can be used to configure LAN, WAN and other security features on Ciscio IOS software-based routers.
Cisco SDM has an easy-to-use interface which will help network administrator to perform day-to-day operations. Cisco SDM is preinstalled by default on all new Cisco routers (Cisco SDM is stored in the flash memory). However, if it's not preinstalled, you can install it on the router or a PC. Advantage of installing on a PC is that is saves router's memory and you can manage other routers from the same PC.

if Cisco SDM is preinstalled on a router, Cisco recommend using Cisco SDM to perform the initial confguration.

with Cisco SDM we can manage ACL, create VPN key. Cisco SDM has smart wizards which will guide users step-by-step through router and security configuration workflow. Cisco SDM can intelligently detect incorrect configuration. Cisco SDM also gives background information in addition to the step-by-step procedures.

Installing Cisco SDM
Cisco SDM can be installed on a deployed router without disrupting the network. The steps are:
step 1. Access the router CLI using telnet or console connection.
step 2. Enable HTPP and HTTPS server on the router.
step 3. Create a user account defined with privilege level 15.
step 4. Create SSH and telenet for local login with privilege level 15.

the commands are (assume that a connection to the router has been established):

ip http server
ip http secure-server
ip http authentication local
username joe privilege 15 secret cisco
line vty 0 4
privilege
login local
transport input telnet ssh

then after enabling Cisco SDM on the router, you can launch the Cisco SDM by connecting to the router through HTTP/HTTPS from a web browser. then you will be prompted to enter a username and a password (if you configure http server authentication to local, it will search and match the username and password to local user list).

Cisco SDM overview page, you can see information about the router such as total amount of memory, version of flash, IOS, hardware installed, active VPN connections and also summary of the configuration.

Cisco SDM offers a feature similar to the "auto secure" in command line (see Network Security) which is called one-step lockdown wizard. to access the wizard you have to select configure -> security audit -> one-step lockdown. click yes at the Cisco SDM warning dialog box. Then Cisco SDM will review the current configuration and check for best security practices. Then Cisco SDM will list some recommended configuration. if you click deliver, then the configuration will be sent to the router.

However there are differences of one-step lockdown wizard with "auto secure" command, those are:
- Cisco SDM disables SNMP, "auto secure" configure SNMP version 3.
- Enables and configures SSH on crypto Cisco IOS images.
- Does not enable service control point, disable file transer services (ftp).

Introduction to IOS

IOS is the abbreviation of Internetworking Operating System. IOS is the operating system most used in Cisco's routers and switches. In my opinion IOS is designed to be easy to use. There are helps for the commands, and most of the 
commands are simple enough. Here i'll give a demonstratin of how to configure a Cisco router running 
IOS as it's operating system.

First you may want to understand how IOS is structured. IOS is structured hierarchically. When you first enter the IOS you will be given a command prompt similar to this



you will be given the prompt Router>. "Router" is the name of the router you're logged on. And the ">" tells you that you're in the user mode. In the 
user mode you can only run limited commands, you can't configure the router. You can enter the exec/privileged mode by entering the command "enable". Then you'll be given the prompt Router#. You may notice that the ">" is changed to "#" this tells you that you are in the exec mode. In privileged mode you can enter more commands than in user mode and also you can do some debugging here. But still, no configuration can be made in this mode.

Then you can enter the configuration mode from the exec mode by entering the command "configuration terminal". After you enter the command you may notice the change of the prompt to Router(config)#. Here you are at the global configuration mode (i will explain later why it is called global configuration) and you can enter some configuration to the router. For example you can change the name of the router to something 

meaningfull. You may enter the command "hostname router-name" with router-name is the name of the router that you want. After you changed the name of the router, the changed will be reflected at the prompt



You may see at the picture above, that i've changed the name of the router to "NewYork". Then maybe you want to configure one of the interface of the router. Let's say that you want to configure the fastEthernet 1/0 interface. First thing that you've got to do is to enter the interface fastEthernet 1/0 configuration level. Because you're at the global configuration mode, you can enter the interface configuration mode by entering the command "interface interface-type slot-number" because we want to configure the fastEthernet 1/0 interface then we enter "interface fastEthernet 1/0" command. You may see the change of the mode by seeing the prompt given. Usually some basic things people do is to give an ip address to the interface and activate the interface. To give an ip address to the interface you enter the command "ip address 192.168.1.1" you may want to change the 192.168.1.1 part to any ip address you want. Then enter the "no shutdown" command to activate the interface.



Remember that i said IOS is structured hierarchically. If you remember the modes you've been before reaching the interface configuration mode. Than you might have the idea of the hierarchy. First time you enter a router, you will be at the user mode. So the hierarchy is user mode -> exec mode -> global configuration mode -> interface level configuration mode. You've seen how to enter each mode. Then you might be wondering how to go up one level in the hierarchy, to do this you can enter the command "exit" command.

The configuration that you have made are saved to the running-configuration file. What does it mean? Cisco routers have two configuration files. One is saved in the RAM and the other is in the NVRAM. Running-configuration file is the one that in the RAM. This means that if you restart the router or the router
is turned off accidentally, the changes you've made are gone. To save the configuration to be permanent enter the command "copy running-config startup-config" at the exec mode. After entering the command you will be asked for the destination file name, enter "startup-config" as the name.

There are still so many other comands available in IOS. Hope this can give you some understanding of how IOS works.