نگاهي كوتاه به ISL , vtp در سيسكو

VLAN 1, 1002,1003,1004,1005 ARE FACTORY DEFAULT VLANS
so u can number your VLAN from 2-1001

ISL is Cisco proprietry.
DOT1Q is IEEEE Standad 802.1Q.
802.1Q SUPPORT 4096 VLAN.
802.1Q DONT tag on the NATIVE VLAN.
Make sure that Same Native VALN is configured on both Switch
MONO SPAN TREE!!

ISL and DOT1Q(802.1q) are frame tagging methods for Inter switch VLan Course.
ISL and DOT1Q are not compatible.
ISL + DOT1Q trunks enable VLAN across a switched network back bone.

They operates on Layer 2.
DOT1Q adds a field in the FRAME where as ISL adds HEADER and FCS means ISL really encapsultes the frame.


Inter Switched Link

1. It’s a CISCO proprietery Protocol.
2. performed with ASIC (Application Specific Integrated Circuits).
3. its only for SWITCHes and Routers and servers wit ISL Nic. Not for clients or hosts.
4. operates in P2P environment.
5. supported on 2600+ routers (is it ture that ISL dont support 1600,1700,2500 routers)?
6. Allow multiple vlan traffice on a single path (called TRUNK)
7. Each Switch/Router/ISL server should be ISL configureable/Capable
8. ISL is protocol independent. means it works fine with most of Layer 3 protocols.
9. ISL header 26 Bytes and 4 Bytes FCS
10. ISL provides VLAN trunking capablilties on FULL \ HALF duplex & support 1000 VLAN
11. USE PSVT (PER VLAN SPAN TREE)

Catalys 1900 switch can support 1005 VLANS with Seprate VLAN across a Trunk but it dont support more then 64 VTPS and REMEMBER v have only 27 ports (24+1+2) in 1900 switch.so the maths is
MAXimum 24porst :: 24 Vlans :: 24VTP

VLAN Trunking Protocol (VTP)

1. Vtp is used to distrubute and synchronize info (identifying) abt VLN configured throughtout a switched network.
2. VTP is also a Layer 2 protocol.
3. it works on MulitCasting
4. VTP Domian can exist on 1 or more SERVER Switches sharing same VTP environment. (is this statment true REFERENCE TK 83 TOPIC 2 SECTION 6-7-8 CHECK FOR VLAN SUBSECTION)
5. A Single Switch can be configured in ONE VTP DOMAIN ONLY .
6. VTP Server is a SWITCH not Router (true or False tell me )
7. A Switch in Transparent Mode can be in 2 Domains (1 is its own, and second domain is the one its just receving and forwarding information)
8. VTP advertisment are Multicast every 5 minutes or on change of configuration. Advertisements are forwarded on VLAN 1


VTP MODES

1. Server
2. Client
3. Transparent

Default mode of a switch is SERVER mode but VLAN are not propagated untill a [U]MANAGEMENT DOMAIN

[U] is specified or learned
VTP messages are tranmitted on all trunks using ISL DOT1Q
VLAN are saved in NVRAM in SEVERS

SERVER MODE
Send \Forward VTP Advertisement
VLAN are saved in NVRAM in SEVERS
Cataylst switches can CREATE,MODIFY,DELETE, VLANS in Server modes
Synchronize VLAN config info with other Switches in Domian.

CLIENT MODE
Send \Forward VTP Advertisement
VLAN are NOT saved in NVRAM in CLIENT
Cataylst switches CANN'T CREATE,MODIFY,DELETE, VLANS in CLIENT modes
Synchronize VLAN config info with other Switches in Domian.

TRANSPARENT MODE
Forward VTP Advertisement
VLAN are NOT saved in NVRAM in CLIENT
Cataylst switches CANN'T CREATE,MODIFY,DELETE, VLANS in CLIENT modes
Synchronize VLAN config info with other Switches in Domian.

If there is no VLAN created by a user then BY DEFAULT Switch is in VTP Server mode and there is a VLAN named VLAN1. All ports of this Switch belong to that VLAN.

In Multiple VLAN environment, VLAN1 is used of management of other VLANs,
CDP & VTP info are send on VLAN1.
Switch 1900 IP address is in the VLAN Broadcast Domain.

switch(config)# vtp {[server|transparent|client] [domain DomainName] [trap (enable|Disable)] [password password] [prunning {enable|Disable}]}

switch(config)# DELETE vtp -- Set SWX with VTP Parameter Default to FACTORY.

DTPP - Domain Trap Password Prunning

TRUNK LINE CONFIG
In 1900 Cat Swx v have only 2 Fast Eth porst (fa0/26 port is called A and fa0/27 port is called
Only these ports can be used for a TRUNK. (A trunk is used to connect 2 SWX or Router)

Switch(config)# trunk [ON|OFF|Desireable|Auto|Nonnegotiate]
[b]Switch(config)# show trunk [a / b]


PORT ASSIGNMENT TO VLAN

A port can belong to only 1 VLAN at a time

Switch(config)#Vlan-membership {static (vlan#)|dynamic}
Switch(config)#Show Vlan-membership


IF ROUTER USED FOR ISL TAGGING [/B]

int e 0.1
ip address 10.1.1.1 255.255.255.0
encapsulation isl 11 -------------(11 is the name of VLAN)

int e 0.2
ip address 10.1.2.1 255.255.255.0
encapsulation isl 22 -------------(22 is the name of VLAN)

int e 0.3
ip address 10.1.3.1 255.255.255.0
encapsulation isl 33 -------------(33 is the name of VLAN)


IF ROUTER USED FOR DOT1Q TAGGING [/B]

int e 0.1
ip address 10.1.1.1 255.255.255.0
encapsulation DOT1Q 11 -------------(11 is the name of VLAN)


int e 0.2
ip address 10.1.2.1 255.255.255.0
encapsulation DOT1Q 22 -------------(22 is the name of VLAN)

int e 0.3
ip address 10.1.3.1 255.255.255.0
encapsulation DOT1Q 33 -------------(33 is the name of VLAN)

ISL

VLAN CREATION ON 1900 WHICH SUPPORTS ISL ONLY
CONFIG)# VLAN 2 SALES
CONFIG)# VLAN 3 MARKETING
CONFIG)# VLAN 4 MIS
CONFIG)# EXIT
-----MEMBERSHIP ADDITION
CONFIG)# int e0/2
CONFIG)#vlan-membership static 2 --- make me member of VLAN 2
CONFIG)# int e0/3
CONFIG)#vlan-membership static 3 --- make me member of VLAN 3
CONFIG)# int e0/4
CONFIG)#vlan-membership static 3 --- make me member of VLAN 3
CONFIG)# int e0/5
CONFIG)#vlan-membership static 4 --- make me member of VLAN 4
CONFIG)# int e0/6
CONFIG)#vlan-membership static 4 --- make me member of VLAN 4
CONFIG)# int e0/7
CONFIG)#vlan-membership static 4 --- make me member of VLAN 4

Inter VLAN Communication

config terminal
config)#interface f0/26
if)#trunk on

ON----------------- trunk is on
OFF-----------------trunk is off
AUTO---------------trunk is on if the other side is ON \ Desirable
DESIRABLE--------trunk is on if the other side is ON \ Desirable \ Auto
NOnEGOTIATE-----trunk is on and it wont initiate the negotiation


DOT1Q

VLAN CREATION ON 2900 WHICH SUPPORTS dot1q ONLY
CONFIG)# VLAN 2
CONFIG)# name SALES

CONFIG)# VLAN 3
CONFIG)# name MARKETING

CONFIG)# VLAN 4
CONFIG)# name MIS
CONFIG)# EXIT

-----MEMBERSHIP ADDITION
CONFIG)# interface f0/2
CONFIG-if)#switchprot access vlan 2

CONFIG)# interface f0/3
CONFIG-if)#switchprot access vlan 3

CONFIG)# interface f0/4
CONFIG-if)#switchprot access vlan 3

CONFIG)# interface f0/5
CONFIG-if)#switchprot access vlan 4

CONFIG)# interface f0/6
CONFIG-if)#switchprot access vlan 4

CONFIG)# interface f0/7
CONFIG-if)#switchprot access vlan 4


---------------
CONFIG)# switchport mode trunk (on|off)
CONFIG)# switchport mode trunk dot1q

)# show vlan
)#show vlan brief


Switch 19000(ISL) and 2950 (Dot1q)
We will use 1 fast ehternet port of Router and Devide it into 2 or more SUBINTERFACES FOR MULTIPLE VLANS

STEPS TO CREATE AN INTERCONNECTED VLAN

1.create a VLANs on Switch
2.Assign ports to VLAN
2.1 Dynamic Assignment
2.2 Static Assignment
3. Creat VTP Domain. and Set its MODE (SERVER,CLIENT,TRANSPARENT)
4. Create Trunks for INTERNETWORK SWICTH communication
5. Involve Router for intervlan packet switching.
5.1 Subinterface Creation
5.2 Encapsulation settings

نگاهي كوتاه ISDN

ISDN
Integrated Services Digital Network is a set of comminucation protocol, developed by Telco to digitalized their services to carry VOICE,VIDEO and DATA. Analog services are called PLAIN OLD TELEPHONE SERVICES POTS
ISDN is a set of protocols which cover 3 OSI layes NETWORK,DATA LINK AND PHYSICAL. It’s a low cost reliable and high speed link, run on both COPPER and FIBER media. It’s a circuit switched network.

B Chanels Circuit switch and D Chanels Packet Switch. ... ?? it is true

ADVANTAGES
1- 5+ times faster then 28.8kpbs analog modem.
2- use multiple devices on the same fone line like Video, Voice, Fax,Video Confrence etc
3-Drops from 2 B Chanels to 1 when incomig call detected.
4-Dynamic allocation

DISADVANTAGES
1-Central office OR Service Provider should be in 5 mile radius.
2-Difficult Setup

ITU-T define standerd which are important for Exam (difficult for candidate to digest)

SERIES--OSI--EXAMPLE------DESCRIPTION
E...........E-163........Packet Switch Telephone Network its a International Telephone Numbering System
E...........E-164........ISDN numbering Standerd
I...........I-100........Concepts, Stractures, Termonology
I...........I-200........Services Aspects
I...........I-300........Network Aspects
I...........I-400........User Network Interface (Uni)
I......1....I-430........Define Connectors, Encoding Frames, Reference Points
I......1....I-431........Define Connectors, Encoding Frames, Reference Points
I...........I-411........ISDN REFERENCES POINT (IMPORTANT Detail is following)
Q......2....I-921........Signaling, Switching at Data link Layer LAPD(Link Access Procedure Dedicated)
Q......3....I-931........its works on Network Layer in ISDN

Tool To remember
Focus on 2nd Digit in Q Series. It matches to the layer e.g. Q921 = Layer 2 Standerd and Q931 = Layer3 Standerd

SERVICES - 2 Services r supported on ISDN:
BRI (BASIC RATE INTERFACE)
PRI (PRIMARY RATE INTERFACE)

BRI + B & D Channels - 2B+D

B Channels are aslo called CLEAR CHANNELS because they are clear to send data. Data is transfered in B Channel and Singnals (Call setup etc) are resposiblity of D CHANNELS.
D makes it posssible to connect relativly much faster. D is called OUT OF BAND Channel because it only takes Signalling (Rest of every thing OUT).
B Chanel 64 Kbps Each
D Chanel 16 Kbps

B........128Kbps (64*2)
D.........16Kbps
------------
.........144Kbps
------------
Plus Frame OverHead= 144 + 48Kbps (Frame Overhead)
so total bandwidth supported by this chanel is 192Kbps is Total Bandwidth of BRI channel

ANY ROUTER WITH A SERIAL INTERFACE CAN BE CANNECTED TO A BRI WITH A TERMINAL ADAPTER (TA).

????????question is the following statment true ??????????????????????????????

D CHANNEL operated on LAPD and LapD depends on HDLC

PRI
It’s also known as (23B+D for T1 ) and (30B+D for E1 ). B Channels are aslo called CLEAR CHANNELS because they r clear to send data.

B Chanel 64 Kbps Each
D Chanel 64 Kbps--------Different then BRI(16Kbps)

Transfer RATE
T1.... 1.544Mpbs.....23 B Channels.....USA and Japan
E1.... 2.048Mpbs.....30 B Channels.....Rest of world

in E1 Sequence of Channels
1--15 channels....B
16th .Channel.....D
1--15 channels....B

PRI uses DSU\CSU for T1\E1 Connection.
Terminals \ Functional Groups
These are PHYSICAL DEVICES involved in ISDN connectivity.

TERMINAL EQUIPMENT 2 (Functional Group)
TE2 is old technology (like ordinary fone sets working on analog) that dont support ISDN series so it need a Conversion Device named TERMINAL ADAPTOR. (THINK LIKE SOMETHING MODEM)

TERMINAL EQUIPMENT 1 (Functional Group)
TE1 is ISDN Ready Devices that dont need any converion device like Terminal Adaptors.

TERMINAL ADAPTOR. (Functional Group)
Takes the analog data from TERMINAL EQUIPMENT 1 and make it ISDN READY. Converts EIA\TIA-232, V35 & into BRI SIGNAL..

Network Termination 2 (Functional Group)
NT2 is the point (Device) at which all ISDN lines at Customer Premises are agregated and Switched using cusmtomer Switch Device Private Branch Exchange(PBX). they are very rare in usage. So even most documents dont Discuss them.

Network Termination 1 (Functional Group)
NT1 is a LOCAL LOOP TERMINAER. it converst BRI singnals intor formused by ISDN DIGITAL LINE. It can be in Customer premises or in TELCO (diffent in Europe and USA)

REFERENCE POINTS (I-411 STANDERD)
RP are used to characterised the interfaces between ISDN Devices. (RF are logical)
RF--Location (Function Group)-------
R---Between TE2 and TA--------------between NON ISDN DEVICE AND TERMINAL ADAPTOR
S---Between TE1\TA and NT2----------ISDN READY to Network Terminator
T---Between NT2 and NT1
U---Between NT1 and ISDN Network

Note: Electronically S and T are same so some devices are labeled as ST. They are identical so in most cases we dont see the S R Point and our networks work properly.


TOOL TO REMEMBER
R---- not isdn ready old device-->R=REGULAR
S---- isdn ready devices--------->S=SPECIAL
T-------------------------------->T=TERMINATION POINT
U----if its in Cus. Premises then customer will provide power to the NT1

so->U=UNPOWER

Functional Groups + References Points altogather
-------R-----------S--------------T--------------U
TE2-------->TA----------->NT2------------>NT1------------>TELCO
.
--------------S-------------------T--------------U
TE1---------------------->NT2------------>NT1------------>TELCO

ALSO TRY TO DRAW FUNCTION GROUPS AND REFERENCE POINT ON PAPER SO THAT U CAN VISUALISE THEM PROPERLY.

IF you have BRI interface in your Router, it’s NT1 so U Labled on interfce
No Bri Interface but Serial interface(TE2) Use External T.A
If u must supply NT1 (in US) make sure Router have U interface otherwise purchase NT1.

SPID
Many books gave it many names like SERVICE PROFILE ID, SERVICE PROVIDER ID, PSEUDO PASSWORD ID Etc. It is a numerical string of 14 characters assigned by TELCO to EACH B CHANNEL on an ISDN link.

GENERIC FORMAT OF SPID
NUMBER OF DIGITS---NAME-------------------RANGE
10-----------------Digit form-------------
02-----------------Sharing Terminal ID----01-32
02-----------------Terminal ID------------01-08

SWITCH TYPE
There are different switch types around the globe (No Standard). And unfortunatly Cisco supports then so do CCNA. Switch type and SPID is informed by the telco to customer. And it can be configurable in Global or Interface Mode.

Router(config)#isdn switch-type
example
Router(config)#isdn basic-ni1

Switch type value---Description
basic-5ess----------AT&T in USA
basic-dms100--------NorTel USA
basic-ni1-----------National ISDN1 North America
basic-ts013---------Australia
basic-net3----------net3 & net5 are used in UK and Europe
basic-nit-----------Japan

note
missed topic are
DDR
ISDN SBus

نگاهي كوتاه Frame relay

In 1984 FRAME RELAY started to develop.
Frame Relay deliver variable size data frames to multiple WAN site. Multi Access is the most obvious difference between Frame Relay and Leased lines. Leased lines ae used as acccess link of Frame Relay.

In 1990 FRAME RELAY CONSOTIUM was created by following four copmanies: Cisco, Startdacom, Nortel and Dec. (AKA: GANG OF FOURs) to standardise the Frame Relay this consortium start working Later ANSI & ITU-T aslo like the idea.

DTE -- Data Terminating Equipment
DCE-- Data Circuit Terminating Equipment
Access- Line
Trunk- Line in Frame Realy From Router 1 to Router 2 a VIRTUAL CIRCUIT is created.
NOTE: Router opperate on Layer 3 and Switch operates on Layer 2. when Frame RelayNetwork a Router is working as a Frame relay switch then its operating on Layer 2.

L.M.I - Some LMI type is required between DTE and DCE (Switch). LMI autosense enabled in IOS 11.2 & greater. 1 LMI exists per serial Interface.

DLC - Data Link Connection Identifier
In header there is a single DLCI field. No Source or Desitnation field like LAN addresses.
LOCAL DLCI
Global DLCI
A Practical Way to identifiy between Global and Local DLCI is:
if two Virtual Circuit terminate at a DTC and a single DLCI is shown. its most probably is GLOCBAL DLCI. if one DLCI is shown per VC then it is depicting Local DLCI.

FRAME RELAY PACKET
consist of 2 Bytes. .
6 Bits of First Bytes are called High Order Bits
4 Bits of Second Bytes are called Low Order Bits

DLCI number consist of 6+4 Bits of high and low order bits

7th Bits is CR (Commited RATE) -- First Byte
8th Bit is EA-------------------------------

5th Bit is FORWARD EXPLICIT CONGESTION NOTIFICATION (FECN) -- Second Byte
6th Bit is BACKWARD EXPLICIT CONGESTION NOTIFICATION (BECN) -- Second Byte
7th Bit is Discard Eligibility------------------------------------------------------------------ Second Byte
8th Bit is EA--------------------------------------------------------------------------------------Second Bytes

Note that FECN-BECN is always set by (DCE) Frame Relay Switch and Discard Eligibility is set by Sending Router.

Broadcast are not supported over a framerelay network so this is done in 2 steps:

1. IOS sends copies of Broadcast accross each VC u instruct.
2.Router Places these Broadcast in Different Ques then the ordinary user traffic.
TYPE OF CONFIGURATION----------SPLIT HORIZON IS
No Subinterfaces---P2P------------------Enable
No Subinterfaces Multi Point----------Disabled
Subinterfaces-------P2P------------------Enable
Subinterfaces Multi Point--------------Disable
if)#ip split horizon
if)#no ip split horizon
Address Mapping
1 Static Config Mapping
2 Dynamically Mapping

Dynamic Mapping use a process called INVERSE ARP. each router announces its layer 3 addresss + DLCI to its adjacent Routers. INVERSE ARP is enabled by default at 11.2 and greater versions unless point to point subinterfaces are used.

configuration register

With "configuration register", we can configure what the router will do at the next reboot.

To see what is the actual setting of your routers configuration register, use router#show version

To change the configuration register, use the following command in global config mode:
Router(config)#config-register 0x2142

For CCNA exam, you need to know two configuration register settings. These are:

0x2102 is the factory-default configuration register value.
0x2142 boots from flash without using NVRAM contents good for password recovery.

When the config. register is set to 2142, the router will start in setup-mode,
where you can interactive select some options.
The "normal" config. register is 2102.

نگاهي كوتاه به دستورات IP ROUTING

IP ROUTING
#sh ip route - To view IP routing tables created on a Cisco router.

-Static Routing- Routers are manually configured for networks that are not directly connected, to be able to route to all networks via the next-hop interface.

Example- Let 192.168.30.0/24 be the IP of a network not directly connected
Let 192.168.20.2 be the next hop interface

(config)#ip route 192.168.30.0 255.255.255.0 192.168.20.2

-to remove static route
(config)#no ip route 192.168.30.0 255.255.255.0 192.168.20.2

-Default Routing- Used on stub networks only to send packets with remote destination network not in the routing table to the next hop router.

(Assume IP 192.168.40.1 is not in routing table)

-first remove static route
(config)#no ip route 192.168.30.0 255.255.255.0 192.168.40.1
(config)#ip route 0.0.0.0 0.0.0.0 192.168.40.1

-RIP- A distance vector routing protocol that passes complete routing table contents to neighbouring routers

Example- Let 192.168.10.0 & 192.168.20.0 be directly connected networks of a router interfaces and 192.168.30.0 be non-directly connected

-first delete all static routes
(config)#no ip route 192.168.30.0 255.255.255.0 192.168.20.2
(config)#router rip
(config-router)#network 192.168.10.0
(config-router)#network 192.168.20.0
(config-router)#^z
#

-Verifying RIP
1.Sh ip route
2.debug ip

-Holding Down RIP Propagation- To stop RIP update sending but allow its receipt
-say for s0/0 with ip 192.168.10.0

(config)#router rip
(config-router)#network 192.168.10.0
(config-router)#passive-interface serial 0/0

-IGRP- Also a distance routing protocol
Example- Let 192.168.10.0 & 192.168.20.0 be directly connected networks of a router interfaces with autonomous system number of 10 and 192.168.30.0 be non-directly connected

#router igrp 10
(config-router)#network 192.168.10.0
(config-router)#network 192.168.20.0
(config-router)#^z
#

-Verifying IGRP
1.sh ip route
2.sh protocols- Displays routed protocols and their interfaces
3.sh ip protocols- Displays routing protocols configured
4.debug igrp events- Displays summary of IGRP routing information running on the network
5.debug igrp transactions- Displays messages request from neighbour routers

-Turning off all possible debugging
#un all

-EIGRP- Uses classless routing which is subnet mask information sent with routing protocol updates.

Example- Let 192.168.10.0 & 192.168.20.0 be directly connected networks of a router interfaces with autonomous system number of 20 and 192.168.30.0 be non-directly connected

#router eigrp 20
(config-router)#network 192.168.10.0
(config-router)#network 192.168.20.0
(config-router)#^z

-To stop EIGRP from working on an interface- no sending no receipt
(config)#router eigrp 20
(config-router)#passive-interface serial 0/0

-To enable EIGRP on discontiguos networks- (two different subnetworks of classfull network connected by another different classful subnetwork)

Example- Let 172.16.0.0 & 10.0.0.0 be directly connected to a router to another remote subnetwork of 192.168.10.0, then to enable EIGRP, we use

(config)#router eigrp 100
(config-router)#network 172.16.0.0
(config-router)#network 10.0.0.0
(config-router)#no auto-summary
N.B-The no auto-summary command sholuld be enabled in routers that encloses such networks.

-Verifying EIGRP
1. sh ip route- Shows entire routing table
2. sh ip route eigrp- Shows only EIGRP entries in the routing table
3. ip eigrp neighbours- Shows all EIGRP neighbours
4. ip eigrp topology- Shows entries in the EIGRP topology table

-OSPF- A link-state routing protocol

Example- Let 10.0.0.0 be the network directly connected to the router upon which OSPF is to be enabled; with ospf ID of 1 and area o

(config)#router ospf 1
(config-router)#network 10.0.0.0 0.255.255.255 area0

-Loopback Interface- They are configured to be used as the routers RID to advertise the routes and elect DR and BDR.

Example- Let the loopback iinterface be configured on interface with ip 172.16.10.1

(config)#int loopback 0
(config-if)#ip address 172.16.10.1 255.255.255.0
(config-if)#no shut
(config-if)#^z

-Verifying OSPF Configuration
1. sho ip ospf- Used to display all OSPF information
2. sho ip ospf database- indicates the number of links and neighboring router ID
3. sho ip ospf interface- Displays all OSPF interface related info
4. sho ip ospf neighbour- Summarizes OSPF info about neighbours
5. sho ip protocols- Overview of all present running protocols

- Verifying Loopback and RID
1. sho running-config- To verify loopback address
2. sho ip ospf database- Verifies the new RID of each router
3. sho ip ospf interface- Verifies the new RID of each router

-Initial configuration of a 1900 Switch with ip 172.16.10.16
>en
#config t
(config)#enable password level 1 kennifeh
(config)#enable password level 15kennifeh 1
(config)#enable secret kennifeh 2(when enabled no need 4 enable password)
(config)#hostname kenn 1900
(config)#ip address 172.16.10.16 255.255.255.0
(config)#ip default-gateway 172.16.10.1
(config)#int f0/1
(config-if)#description Finance_vlan (No space for 1900)
(config-if)#int f0/26
(config-if)#description Trunk_to_Biulding
(config-if)#exit
(config)#

-Initail Configuration of 2950 Switch with ip 172.16.10.17 255.255.255.0
>en
#config t
(config)#hostame kenn2950
(config)#enable password kenn
(config)#enable password kenn1(enable and enable secret password must be different)
(config)#line vty 0 15
(config-line)#login
(config-line)#password telnet
(config-line)#line con 0
(config-line)#login
(config-line)#password console
(config-line)#exit
(config)#int vlan 1
(config-if)#ip address 172.16.10.17 255.255.255.0
(config-if)#no shut
(config-if)#int f0/1
(config-if)#description sales printer(with space)
(config-if)#int f0/12
(config-if)description connection to backbone
config-if)#exit
(config)#ip default-gateway 172.16.10.1
(config)#

-Erasing Switching Configuration 1900
#delete nvram
yes

-Erasing Switching Configuration 2950
#erase startup-config
Enter

-Configuring VLANS 1900
>en
#config t
(config)#vlan 2 name Cisco
(config)#vlan 3 name Microsoft
(config)#vlan 4 name Comptia
(config)#exit

verify with command sh run

-Configuring for 2950
>en
#vlan database
(vlan)#vlan 2 name Cisco
(vlan)#vlan 3 name Microsoft
(vlan)#vlan 4 name Comptia
(vlan)#apply
(vlan)#^c

verify with command sh vlan brief

-Assigning Switch Ports To Vlan- 1900
(config)#int e0/2
(config-if)#vlan-membership static 2
(config-if)#int e0/3
(config-if)#vlan-membership static 3
(config-if)#exit

verify with sh vlan

-Assigning Switch Ports To Vlan- 2950
(config)#int f0/2
(config-if)#switchport access vlan 2
(config-if)#int f0/3
(config-t)#switchport access vlan 3
(config-if)#int f0/4
(config-if)#switchport access vlan 4
(config-if)#

verify with sh vlan brief

-Configuring Trunks ports
(config)#int f0/26
(config-if)#trunk on

-Configuring Trunk Ports for 2950
(config)#int f0/12
(config-if)#switchport mode trunk
(config-if)#^z
#

-To disable Trunk- use switchport mode access

-To verify Trunking- use sh running config

-Configuring Inter-vlan Routing for 1900 connecting to 2600
(config)#int f0/0.1
(config-if)#encapsulation isl vlan (d number)

-Configuring Inter-vlan Routing for 2950 connecting to 2600
(config)#int f0/0.1
(config-if)#encapsulation dot1q vlan (d number)

-Configuring VTP for 1900
(config)#vtp server
(config)vtp domain kenn
(config)#vtp password kenn

-Configuring VTP for 2950
(config)#vtp mode server
(config)#vtp domain routersim
(config)#^z

-verify with sh vtp status

-Checking the Current Configuration Register Values
show version or show ver

-Changing Configuration Register
(config)#config-register 0x101 (d default is 0x2102)
(config)#^z
-Recovering Passwords
1. Interrupt the Router Boot Sequene
ctrl+Break key (windows wont perform break key, only 95/98)
2. Changing the configuration register
-for 2600 series router
rammon>confreg 0x2142

-for 2500
type 0 after a break and enter the command o/r 0x2142

3. Reloading the Router and Entering Privilged mode
-for 2600-type reset
-for 2500-type I
4. Viewing and changing the configuration
-copy run start
5. Resetting the configuration Register and Reloading the Router
-config t
-config-register 0x2102
-copy run start-to save

-Backing up and restoring the Cisco ios
1. verifying flash memory-Ensuring flash memory has enough room
router#sh flash
2. Backing-up the ciso ios
first verify server connectivity by- Router#ping 192.168.0.120
then; router#copy flash tftp
3. Restoring or upgrading the cisco router ios
router#copy tftp flash
[confirm][ENTER]
?[ENTER]
-Backing up and Restoring the Cisco configuration
1.Backing up the cisco router configuration
-copy runing config tftp
2. verifying the current configuration
-sh run
3. copying the current cofiguration to NVRAM
-copy run start
4. copying the current configuration to a TFTP server
-copy run TFTP
5. Restoring the Cisco Router Configuration
-copy TFTP run
6. Erasing the configuration
-erase startup-config

-Getting CDP timers and Holdtime information
Router#config t
Router(config)#cdp timer 90
Router(config)#cdp holdtime 240
Router(config)#^z

-Turn-off CDP Completely- no cdp run

-Gathering Neighbour information
kenn2509#sh cdp nei- delivers information about directly connected devices
OR kenn2509#sh cdp neighbour detail Also sh cdp entry

-Gathering Interface Traffic Information
kenn2509#sh cdp traffic

-Gathering port and Interface information
kenn2509#sh cdp interface

-Turn off cdp on a router- no cdp enable then ^z

-Using Telnet
kenn2509#telnet 172.16.10.2

-Telnetting into multiple devices simultaneously
kenn2509#telnet 172.16.10.2
then, 2501B>{cntl+shift+6, then x}

-Checking Telnet connections
kenn2509#sh sessions-connections from your router to remote

-Checking Telnet users
kenn2509#sh user

-Closing Telnet sessions
1900switch>exit OR
kenn2509#disconnect1 (num of active networks)

-Resolving Hostname
kenn2509#config t
kenn2509(config)#ip host 2501B 172.16.10.2
kenn2509(config)#ip host 1900switch 192.168.0.148
kenn2509(config)#^z

-Remove a hostname from a table
RouterA(config)#no ip host routerB

-Using DNS to resolve names
#config t
(config)#ip domain-lookup (usually turned on by default)
(config)#ip name-server 192.168.0.70 (ip of an assumed DNS set)
(config)#ip domain-name kenn.com (Appends the domain name to a host)
(config)#^z

-Check Network Connectivity
use ping command
#ping kenn2509

-Using Traceroute command
#trace 2501B

-Creating a Standard Access Lists (1-99 or 1,300-1,999)
(config)#access-list 10 deny 172.16.30.2 (using the ip as a test)

-Controlling vty(Telnet) sessions
(config)#access-list 50 permit 172.16.30.2
(config)#line vty 0 4

(config-line)#access-class 50 in

-Creating Extended Access-lists (100 to 199) OR (2000 to 2699)
(config)#access-list 110 deny tcp any host 172.16.30.2 eq 23 log
(config)#access-list 110 permit ip any any
(config)#int f0/0
(config-if)#ip access-group 110 in
(config-if)#ip access-group 110 out

نگاهي كوتاه به Booting up the Router

Booting up the Router
Cisco routers can boot Cisco IOS software from

1. Flash memory
2. TFTP server
3. ROM (not full Cisco IOS)

Normally its booted from Flash RAM. But if it fails, it trys to load IOS from tftp server.
If this also fails, it boots a "small" ios which is in ROM.


Default boot sequence for Cisco IOS software:

img89.imageshack.us/my.php?image=routerboot3wi.jpg



1. NVRAM (check config-register)
2. FLASH (load IOS)
3. TFTP (boot IOS from tftp if FLASH fails)
4. ROM (If TFTP fails, load "mini" IOS from ROM

Booting up the router and locating the Cisco IOS

1. POST (power on self test)
2. Bootstrap code executed
3. Check Configuration Register value (NVRAM) which can be modified using the config-register command

0 = ROM Monitor mode
1 = ROM IOS
2 - 15 = startup-config in NVRAM

4. Startup-config file: Check for boot system commands (NVRAM)
If boot system commands in startup-config
a. Run boot system commands in order they appear in startup-config to locate the IOS
b. [If boot system commands fail, use default fallback sequence to locate the IOS (Flash, TFTP, ROM)?]

If no boot system commands in startup-config use the default fallback sequence in locating the IOS:
a. Flash (sequential)
b. TFTP server (netboot)
c. ROM (partial IOS) or keep retrying TFTP depending upon router model

5. If IOS is loaded, but there is no startup-config file, the router will use the default fallback sequence for locating the IOS and then it will enter setup mode or the setup dialogue.
6. If no IOS can be loaded, the router will get the partial IOS version from ROM

Default (normal) Boot Sequence

Power on Router - Router does POST - Bootstrap starts IOS load - Check configuration register
to see what mode the router should boot up in (usually 0x2102 to read startup-config in NVRAM / or 0x2142 to start in "setup-mode") - check the startup-config file in NVRAM for boot-system commands - load IOS from Flash.

Boot System Commands

Router(config)# boot system flash IOS filename - boot from FLASH memory
Router(config)# boot system tftp IOS filename tftp server ip address - boot from a TFTP server
Router(config)# boot system rom - boot from system ROM

This post has been edited by spacyfreak: Apr 2 2006, 03:46 PM

 

Full Edit

Quick Edit

Booting up the Router Cisco routers can boot Cisco IOS software from 1. Flash memory 2. TFTP server 3. ROM (not full Cisco IOS) Normally its booted from Flash RAM. But if it fails, it trys to load IOS from tftp server. If this also fails, it boots a "small" ios which is in ROM.   Default boot sequence for Cisco IOS software: 1. NVRAM (check config-register) 2. FLASH (load IOS) 3. TFTP (boot IOS from tftp if FLASH fails) 4. ROM (If TFTP fails, load "mini" IOS from ROM Booting up the router and locating the Cisco IOS 1. POST (power on self test) 2. Bootstrap code executed 3. Check Configuration Register value (NVRAM) which can be modified using the config-register command 0 = ROM Monitor mode 1 = ROM IOS 2 - 15 = startup-config in NVRAM 4. Startup-config file: Check for boot system commands (NVRAM) If boot system commands in startup-config a. Run boot system commands in order they appear in startup-config to locate the IOS b. [If boot system commands fail, use default fallback sequence to locate the IOS (Flash, TFTP, ROM)?] If no boot system commands in startup-config use the default fallback sequence in locating the IOS: a. Flash (sequential) b. TFTP server (netboot) c. ROM (partial IOS) or keep retrying TFTP depending upon router model 5. If IOS is loaded, but there is no startup-config file, the router will use the default fallback sequence for locating the IOS and then it will enter setup mode or the setup dialogue. 6. If no IOS can be loaded, the router will get the partial IOS version from ROM Default (normal) Boot Sequence Power on Router - Router does POST - Bootstrap starts IOS load - Check configuration register to see what mode the router should boot up in (usually 0x2102 to read startup-config in NVRAM / or 0x2142 to start in "setup-mode") - check the startup-config file in NVRAM for boot-system commands - load IOS from Flash. Boot System Commands Router(config)# boot system flash IOS filename - boot from FLASH memory Router(config)# boot system tftp IOS filename tftp server ip address - boot from a TFTP server Router(config)# boot system rom - boot from system ROM

 

800x600 Normal 0 false false false EN-US X-NONE AR-SA MicrosoftInternetExplorer4 st1\:*{behavior:url(#ieooui) } /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman","serif";}

نگاهي كوتاه به access list نويسي

With Access Lists, you can filter traffic on your Cisco Router.
It filters only traffic coming in or going through your router.
It does not filter traffic which origins from the router. Its kind of "Firewall"-Feature.
You can permit or deny traffic from or to a network or host, and can filter on special ports.
Its useable for "basic" security.
For komplex Firewall settings, better use a "real" Firewall, because
to much filtering can make the device slower, cause each paket has to be checked, and the more rulez are configured, the more the CPU of the router has to work.


There are two kinds of Access Lists on Cisco Routers

1. Standart ACLs

-Numbered from 1-99 (and some higher ranges)
-filter ONLY on SOURCE IP
-needed to permit or deny a single source ip or source network to access another network or host

2. Extended ACLs

-Numbered from 100-199 (and some higher ranges)
-filter on Source IP and protocols and ports/applications
-needed to filter only traffic from a specified host or network and specified protocols and ports

ACLs can be identified by numbers, or by names.

Handling of Access-Lists

1. Configure some statements.

example1: Deny http and telnet access from a Network to an Host

access-list 100 deny tcp 143.43.43.0 0.0.0.255 132.32.32.4 0.0.0.0 eq 80
access-list 100 deny tcp 143.43.43.0 0.0.0.255 132.32.32.4 0.0.0.0 eq 23
access-list 100 permit ip any any

example2: Deny complete ip access from a network

access-list 1 deny 143.43.43.0 0.0.0.255
access-list 1 permit any any

example 3: Deny Ping from a network to a host

access-list 101 deny icmp 132.43.4.0 0.0.0.255 host 145.52.54.9
access-list 101 permit ip any any

You can also use command

access-list 101 deny icmp 132.43.4.0 0.0.0.255 145.52.54.9 0.0.0.0
access-list 101 permit ip any any

2. Select the Interface where the Access List will filter pakets.
ALL the statements build ONE Access List.
Bind the ACL on an interface with command "ip access-group "

interface e0
ip access-group 101 in

Rules

1. "Last" deny statement of every ACL
At the end of EVERY access-list there is a "access-list deny ip any any" statement, which is invisible.
Thats why we have to use the "access-list permit ip any any" statement at the end of OUR ACL.

2. From first to last
In filtering the packets, the router checks the statements of the ACL from the first to the last.
When an statement is found as true, the next statements are not checked anymore.

example
access-list 100 deny tcp 143.43.43.0 0.0.0.255 132.32.32.4 0.0.0.0 eq 80
access-list 100 deny tcp 143.43.43.0 0.0.0.255 132.32.32.4 0.0.0.0 eq 23
access-list 100 permit ip any any

If a host with IP 143.43.43.6/24 would try to access the Webserver 132.32.32.4 he would be denied, because of the first statement. The second and third statement would not be checked in that case.
If the same host would try to access the telnet port of the Webserver, then the first statement would be checked. Because its NOT Port 80 which the host wants to reach, the second statement would be checked.
The second statement denys telnet, and the host would not access the Webserver via Telnet.

3. Placement of ACLs
Put standart ACLs close to the Destination Host or Network which has to be protected
Put extended ACLs close to the Source Hosts or Network, from where the traffic will origin.

4. You can put ONE ACL per Interface, per Protocol, per Direction
You cant bind more than one ACL to an Interface per Direction (incoming or outgoing).

5. Single statements of an ACL can NOT be deleted
If you have to change or delete a single statement, you have to delete the whole ACL and write a new one.
Only in named access-lists it is possible to change or delete single statements of the ACL.

6. Different terms for different useage
There are different terms which can confuse.
access-group
Used to bind an access-list to an interface
access-class
Used to deny or permit telnet access to a router vty line.

7. synthax of extended ACL

access-list eq

 

 

example

access-list 111 deny tcp 200.20.20.0 0.0.0.255 200.20.30.0 0.0.0.255 eq 23

8. synthax of standart ACL

access-list