I've been starting to catch up on some parts of my life that were put on hold while the CCIE studies were in full swing, so postings here will continue just rather sporadically.
A few weeks before I attempted my lab exam, Greg Chisholm (CCIE #29271) gave me a complimentary copy of his Pro2Expert CCIE study and strategy guide to review. The main audience for this document is someone that has completed or near completion of their CCNP (the Pro) and is considering heading towards the CCIE (the Expert). It is also tentatively pitched at those that have attempted the CCIE lab exam but have not come up trumps and are wanting to find an alternate focus.
While this document does have a reasonable amount of technical content, it's probably more focused on CCNPs that are wanting to look at an intermediate step before going all in for the depth of knowledge that will be required for face off for the lab exam, I guess the thinking here is that if this is either stuff you know like the back of your hand or at least doesn't overwhelm you, then maybe you're in a position to start developing your studies.
While the technical content was reasonable, to me personally and most likely those that have faced the expensive lunch already, what's there is rather shallow. In each of the technical chapers, Greg includes a "--More--" section which provides more references to go into to grasp a more detailed understanding.
My favourite part of the document though was the writing style, it felt very conversational in style and personal because Greg was able to leverage his own experiences in sitting the lab exam multiple times, dealing with blueprint changes and finally getting over the line. It was good to be able to read his story, draw some inspiration but more importantly gain some extra thoughts and clarification on workflow optimisations where if you start on these early on into your studies, you can more easily avoid fat-fingered mistakes when you are feeling pressure, some of these things may seem straightforward and obvious but in my own case I definitely picked up a few tips that I should have been aware of much earlier.
Early on in the document there is a section describing how to select components to build your own lab environment and do things such as connecting servers to test things like netflow, snmp, http etc which is adequate for self directed study, however I personally would have thought that there could be some value in including a selection on why you may select a CCIE workbook training vendor and what kind of features (e.g. community, reputation, topology size, errata on material etc.) may be used to help select the vendor and then help select what you may do for lab practice (build a lab, rent time on a lab, do simulation or some combination of the lot) personally I think that this is something worth dwelling upon particularly if you coming from a CCNP looking at going for the CCIE because part of your study plan will be putting together a timetable of equipment/services and working out when and where you have to spend your money, whether this is sponsored by your employer or yourself you need to budget time and money. Please note has Greg has told me this is an area he plans to address in a future iteration of the document. I will endeavour to update this review once this occurs but if this topic is of interest - I suggest you get in contact with Greg directly
For those that have not faced the CCIE R&S Written Exam yet, you will not currently see anything specific about this exam, however to be fair the CCIE R&S Version 4 Certification Guide is probably a better resource on facing this exam. Greg did mention that he plans to provide a write up on the written exam once he recertifies his CCIE as he prefers to be more specific than give generalised tips on something he faced quite some time back.
Pro2Expert arrives on a a watermarked PDF that is just over 560 pages in length. I didn't attempt to print it out, however it did work fine on my Amazon Kindle. The document does not touch every aspect on the CCIE R&S Blueprint.
The introductory price for Greg's Pro2Expert document is $US90 and may
increase at a later date. I received my copy for free in exchange for
providing this review, Greg was more than happy for me to review the
document in any way that I wanted and in areas I thought may need
further development he took those thoughts into serious consideration.
Final thoughts: In comparison to most of CCIE related study material which tends to
focus directly on the technical side of things which of course is extremely
important - this guide's greatest strengths to me at least is the human side and the workflow aspects. If you are considering going for the CCIE, this guide may be a worthwhile investment before on embarking on a long, tentatively expensive but educational journey. If you have faced the lab on multiple occasions and are at your wits end on where to go further and don't think the problems you are facing are technical in nature, perhaps you can draw inspiration from Greg's words but at this point in time I'm unsure that this will be what's needed to give you that extra push.
Sunday, 22 July 2012
Thursday, 12 July 2012
My CCIE Journey
It's taken a bit
longer to get to this point than I had originally planned when I started on this journey but I'm glad to be here.
Tuesday, July 10 2012 was my fifth attempt at the CCIE R&S Lab. The day started well enough, the Sydney lab is pretty good and the proctor is a friendly enough guy (having been there quite a few times, he recognised me but thankfully I hadn't been there enough that he recalled my name!)
When the troubleshooting section commenced I was able to address the easier tickets in relatively short order, however the three pointers took considerably longer but were not impossible (it actually ended up being one of those issues where it was staring me in the face but it took a bit of time to realise it) and ended up closing them out with about 10 minutes left on the clock giving ample time to go to the front and validate that they were still resolved and within the confines of the restrictions.
Each of my lab attempts displayed improvement in my troubleshooting skills (my first attempt resulted in me getting steamrolled in TS, the second attempt I was much better but with plenty of room for improvement, and the third I missed passing by what seemed one ticket, finally passing TS in the fourth attempt) this time round it felt like I had solidly addressed all faults, so I was able to proceed into configuration with a fair amount of confidence.
The Configuration component was traditionally an area I did well in - except for attempt number 4 where I just couldn't quite get my groove on and fell apart - this was quite unfortunate since this happened to be the first time I got through TS. Fortunately this time around I was able to enter "the zone" relatively quickly and get my layer 2 sorted out and get most of the IGP config complete before lunch. The coke I drank at lunch much have given me enough of a jolt to blast through the BGP, services and other config pieces to result in a reasonable amount of verification time to spare, which was fortunate, my tcl and ping macros helped pick up a few simple but potentially costly mistakes and extra validation of various config components highlighted a number of minor corrections that I needed to make.
I left the lab location feeling quietly confident and after flying home, waiting in my inbox was that email with the subject "CCIE Lab Score Report". I rushed to the website was very pleased to the see the "PASS" and an allocation of a number on that very 90's style webpage, resulting in a happy conclusion to this journey.
I made use of material from IPExpert (Video on Demand, Workbook Volume 1 and 3) , Internet Expert (Audio Bootcamp and Mocklabs) and Micronics training (Narbik's famous bootcamp and troubleshooting workbook) each has a slightly different way of building your expertise and understanding which can be helpful if you are having problems in grasping a specific concept. All are high quality products from top class vendors with good support from the people within the organisations.
I also did a number of the Cisco360 Mocklabs and found their TS scenarios were commensurate with the lab environment with a roughly equivalent topology and level of faults though sometimes I found the configuration labs sometimes easier or of similar difficulty to the actual lab. Regardless of the vendor, any mock lab is good to ensure you've got the stamina and can work against the clock.
Mailing lists like Groupstudy, IPExpert's OSL and INE's IEOC Forum were very valuable in helping hone my knowledge and also reminding me that I'm not alone on what is pretty much a solo voyage. These resources are worth their weight in gold for inspiration and support.
Also, it must be said that while I was the one that passed the exam, it was only made possible thanks to the understanding and support of my wonderful wife which is something I am truly lucky and grateful for her being there and believing I can get there even though there were several faulty attempts.
Tuesday, July 10 2012 was my fifth attempt at the CCIE R&S Lab. The day started well enough, the Sydney lab is pretty good and the proctor is a friendly enough guy (having been there quite a few times, he recognised me but thankfully I hadn't been there enough that he recalled my name!)
When the troubleshooting section commenced I was able to address the easier tickets in relatively short order, however the three pointers took considerably longer but were not impossible (it actually ended up being one of those issues where it was staring me in the face but it took a bit of time to realise it) and ended up closing them out with about 10 minutes left on the clock giving ample time to go to the front and validate that they were still resolved and within the confines of the restrictions.
Each of my lab attempts displayed improvement in my troubleshooting skills (my first attempt resulted in me getting steamrolled in TS, the second attempt I was much better but with plenty of room for improvement, and the third I missed passing by what seemed one ticket, finally passing TS in the fourth attempt) this time round it felt like I had solidly addressed all faults, so I was able to proceed into configuration with a fair amount of confidence.
The Configuration component was traditionally an area I did well in - except for attempt number 4 where I just couldn't quite get my groove on and fell apart - this was quite unfortunate since this happened to be the first time I got through TS. Fortunately this time around I was able to enter "the zone" relatively quickly and get my layer 2 sorted out and get most of the IGP config complete before lunch. The coke I drank at lunch much have given me enough of a jolt to blast through the BGP, services and other config pieces to result in a reasonable amount of verification time to spare, which was fortunate, my tcl and ping macros helped pick up a few simple but potentially costly mistakes and extra validation of various config components highlighted a number of minor corrections that I needed to make.
I left the lab location feeling quietly confident and after flying home, waiting in my inbox was that email with the subject "CCIE Lab Score Report". I rushed to the website was very pleased to the see the "PASS" and an allocation of a number on that very 90's style webpage, resulting in a happy conclusion to this journey.
I made use of material from IPExpert (Video on Demand, Workbook Volume 1 and 3) , Internet Expert (Audio Bootcamp and Mocklabs) and Micronics training (Narbik's famous bootcamp and troubleshooting workbook) each has a slightly different way of building your expertise and understanding which can be helpful if you are having problems in grasping a specific concept. All are high quality products from top class vendors with good support from the people within the organisations.
I also did a number of the Cisco360 Mocklabs and found their TS scenarios were commensurate with the lab environment with a roughly equivalent topology and level of faults though sometimes I found the configuration labs sometimes easier or of similar difficulty to the actual lab. Regardless of the vendor, any mock lab is good to ensure you've got the stamina and can work against the clock.
Mailing lists like Groupstudy, IPExpert's OSL and INE's IEOC Forum were very valuable in helping hone my knowledge and also reminding me that I'm not alone on what is pretty much a solo voyage. These resources are worth their weight in gold for inspiration and support.
Also, it must be said that while I was the one that passed the exam, it was only made possible thanks to the understanding and support of my wonderful wife which is something I am truly lucky and grateful for her being there and believing I can get there even though there were several faulty attempts.
Monday, 25 June 2012
Private VLANs
One of the features the Catalyst 3560 has that the 3550 doesn't have is the capacity to support Private-Vlans. Private-VLANs are a method to partition one broadcast domain into several by combining multiple VLANs into one.
There are three types of Private-VLAN VLAN constructs
1) The Primary VLAN of which the other two are associated with, the primary VLAN would typically be associated with the Gateway router for the Private-VLAN
2) Community VLANs - hosts associated with the same community VLAN are able to talk with each other but with no one else except for hosts on the Primary VLAN
3) Isolated VLANs - hosts even on the same isolated VLAN are unable to talk with anyone except hosts on the Primary VLAN
Actually there is a form of the Isolated VLAN feature which is supported on platforms such as the 3550 which is enabled using "switchport protected" however this is local to one switch - this means in a multi-switch environment, your switchport protected ports can communicate with hosts that are on the same VLAN on other switches
This post will cover a multi-switch private VLAN configuration as shown in the topology diagram
Private-VLANs can only work when the Switch is set to VTP transparent mode.
This exercise will be using 4 VLANs
Before we get to the PVLAN config section, lets quickly list the configs on our routers
R1
hostname R1
interface FastEthernet0/0
ip address 10.1.100.1 255.255.255.0
no shutdown
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
R2
hostname R2
no ip routing
interface FastEthernet0/0
ip address 10.1.100.2 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R3
hostname R3
no ip routing
interface FastEthernet0/0
ip address 10.1.100.3 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R4
hostname R4
no ip routing
interface FastEthernet0/1
ip address 10.1.100.4 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R5
hostname R5
no ip routing
interface FastEthernet0/1
ip address 10.1.100.5 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R6
hostname R6
no ip routing
interface FastEthernet0/1
ip address 10.1.100.6 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
Our Switches are in their vanilla configurations (wr erase and del vlan.dat before reloading) so we we need to configure them from scratch.
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#host SW1
Ensure that we're in vtp transparent mode
SW1(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
Now we create the VLANs that will be used in our private-vlan and specify the type
SW1(config)#vlan 100
SW1(config-vlan)#private-vlan primary
SW1(config-vlan)#vlan 200
SW1(config-vlan)#private-vlan isolated
SW1(config-vlan)#vlan 300
SW1(config-vlan)#private-vlan community
SW1(config-vlan)#vlan 400
SW1(config-vlan)#private-vlan community
Let's check the configuration
SW1(config-vlan)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 primary
200 isolated
300 community
VLAN 400 is not shown - whenever vlan configuration is used, the current vlan configuration is not applied until you exit it (either by configuring another VLAN or exiting VLAN config mode)
SW1(config-vlan)#exit
SW1(config)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 primary
200 isolated
300 community
400 community
Now that the Private VLANs have been created, an association is required - we do this by selecting the primary vlan and then attaching the isolated/community VLANs to it
SW1(config)#vlan 100
SW1(config-vlan)#private-vlan association 200,300,400
SW1(config-vlan)#exit
SW1(config)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated
100 300 community
100 400 community
Let's set up the trunk between SW1 and SW2 and then apply the same PVLAN config to SW2
SW1(config)#int fa1/0/19
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#host SW2
SW2(config)#int fa1/0/19
SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunk
SW2(config-vlan)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
SW2(config)#vlan 100
SW2(config-vlan)#private-vlan primary
SW2(config-vlan)#vlan 200
SW2(config-vlan)#private-vlan isolated
SW2(config-vlan)#vlan 300
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#vlan 400
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#vlan 100
SW2(config-vlan)#private-vlan association 200,300,400
SW2(config-vlan)#exit
SW2(config)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated
100 300 community
100 400 community
Before we associate switch interfaces with private-vlan configurations, by default all router facing ports will be in vlan 1, let's validate we have full connectivity.
R1
R1#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/261/1012 ms
R1#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/268/1056 ms
R1#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/260/1004 ms
R1#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/262/1016 ms
R1#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/264/1044 ms
R2
R2#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R2#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/10/24 ms
R2#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/406/1996 ms
R2#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/5/12 ms
R2#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/403/1988 ms
R2#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3
R3#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/405/2000 ms
R3#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/8/20 ms
R3#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/5/8 ms
R3#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4
R4#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms
R4#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/403/1996 ms
R4#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/7/16 ms
R4#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/12 ms
R5
R5#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R5#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
R5#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R5#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/12 ms
R5#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/406/1992 ms
R5#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R6
R6#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/12 ms
R6#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R6#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R6#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/16 ms
Okay, so our baseline of full connectivity between hosts has been established, we can start applying the pvlan configurations to switchports.
SW1 Fa1/0/1 (R1) - Primary VLAN (100)
SW1 Fa1/0/2 (R2) - Isolated VLAN (200)
SW1 Fa1/0/3 (R3) - Community VLAN (300)
SW2 Fa1/0/4 (R4) - Isolated VLAN (200)
SW2 Fa1/0/5 (R5) - Community VLAN (300)
SW2 Fa1/0/6 (R6) - Community VLAN (400)
SW1(config)#int fa1/0/1
This is the promiscuous port for the private-vlan (all isolated/community VLANs of the private vlan can talk with this port)
Attach the secondary vlans (200,300,400) to the primary vlan (100)
SW1(config-if)#switchport private-vlan association mapping 100 200,300,400
Now we configure the secondary vlan interfaces
SW1(config-if)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated Fa1/0/1, Fa1/0/2
100 300 community Fa1/0/1, Fa1/0/3
100 400 community Fa1/0/1
On SW2 we only have secondary vlan interfaces
SW2(config)#int fa1/0/4
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan association host 100 200
SW2(config-if)#int fa1/0/5
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan association host 100 300
SW2(config-if)#int fa1/0/6
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan association host 100 400
SW2(config-if)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated Fa1/0/4
100 300 community Fa1/0/5
100 400 community Fa1/0/6
Now to test
R1 should be able to ping R2/R3/R4/R5/R6 because it's the promiscuous port (SW1 Fa1/0/1)
R1>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R1>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R1>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/8 ms
R1>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R1>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R2 (SW1 Fa1/0/2) should only be able to ping R1 even though R4 (SW2 Fa1/0/4) is on the same secondary VLAN as this pvlan type is isolated neither will be able to communicate with each other
R2>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R2>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R2>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3 (SW1 Fa1/0/3) should be able to ping R1 and R5 (as they are in the same community pvlan)
R3>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
R3>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4 (SW2 Fa1/0/4) like R2 should only be able to ping R1
R4>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R4>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5 (SW2 Fa1/0/5) should be able to ping R1 and R3 (as they are in the same community pvlan)
R5>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R5>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/12 ms
R5>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R5>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6 (SW2 Fa1/0/6) will only be able to ping R1 currently it is the only community pvlan (400) member
R6>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
So we have seen how you can use Private VLANs to partition a broadcast domain / IP subnet into multiple domains for service/security separation.
While the promiscuous port has been shown to occur on a layer 2 interface, it is also able to happen on a switched virtual interface.
to demonstrate we'll first make a slight change to R1's configuration
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int fa0/0
R1(config-if)#ip add 10.100.100.1 255.255.255.0
R1(config-if)#ip route 0.0.0.0 0.0.0.0 10.100.100.100
R1(config)#end
Now we'll return SW1 Fa1/0/1 to act as a regular access port in vlan 10
We'll create our SVI for vlan 10
SW1(config-if)#int vlan 10
SW1(config-if)#ip add 10.100.100.100 255.255.255.0
SW1(config-if)#exit
now we'll enable routing and add the static route to 1.1.1.1
SW1(config)#do ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/9 ms
Now we need to create the SVI for vlan 100 and create the private-vlan mapping
SW1(config-if)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated Fa1/0/2
100 300 community Fa1/0/3
100 400 community
We cant see any reference to VLAN 100 here but there is an alternate way to see the mapping
SW1(config-if)#do sh int vlan 100 private-vlan mapping
Interface Secondary VLANs
--------- --------------------------------------------------------------------
vlan100 200, 300, 400
We'll do a verification using R3 (Only hosts on VLAN 10, 100 and 300) should be reachable
R3>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/8/20 ms
R3>ping 10.100.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
R3>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Using the Private VLAN on the SVI enables you to to use your switch as a routing gateway for your private vlans.
There are three types of Private-VLAN VLAN constructs
1) The Primary VLAN of which the other two are associated with, the primary VLAN would typically be associated with the Gateway router for the Private-VLAN
2) Community VLANs - hosts associated with the same community VLAN are able to talk with each other but with no one else except for hosts on the Primary VLAN
3) Isolated VLANs - hosts even on the same isolated VLAN are unable to talk with anyone except hosts on the Primary VLAN
Actually there is a form of the Isolated VLAN feature which is supported on platforms such as the 3550 which is enabled using "switchport protected" however this is local to one switch - this means in a multi-switch environment, your switchport protected ports can communicate with hosts that are on the same VLAN on other switches
This post will cover a multi-switch private VLAN configuration as shown in the topology diagram
This exercise will be using 4 VLANs
- VLAN 100 - Primary
- VLAN 200 - Isolated
- VLAN 300 - Community
- VLAN 400 - Community
Before we get to the PVLAN config section, lets quickly list the configs on our routers
R1
hostname R1
interface FastEthernet0/0
ip address 10.1.100.1 255.255.255.0
no shutdown
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
R2
hostname R2
no ip routing
interface FastEthernet0/0
ip address 10.1.100.2 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R3
hostname R3
no ip routing
interface FastEthernet0/0
ip address 10.1.100.3 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R4
hostname R4
no ip routing
interface FastEthernet0/1
ip address 10.1.100.4 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R5
hostname R5
no ip routing
interface FastEthernet0/1
ip address 10.1.100.5 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
R6
hostname R6
no ip routing
interface FastEthernet0/1
ip address 10.1.100.6 255.255.255.0
no shutdown
!
ip default-gateway 10.1.100.1
Our Switches are in their vanilla configurations (wr erase and del vlan.dat before reloading) so we we need to configure them from scratch.
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#host SW1
Ensure that we're in vtp transparent mode
SW1(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
Now we create the VLANs that will be used in our private-vlan and specify the type
SW1(config)#vlan 100
SW1(config-vlan)#private-vlan primary
SW1(config-vlan)#vlan 200
SW1(config-vlan)#private-vlan isolated
SW1(config-vlan)#vlan 300
SW1(config-vlan)#private-vlan community
SW1(config-vlan)#vlan 400
SW1(config-vlan)#private-vlan community
Let's check the configuration
SW1(config-vlan)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 primary
200 isolated
300 community
VLAN 400 is not shown - whenever vlan configuration is used, the current vlan configuration is not applied until you exit it (either by configuring another VLAN or exiting VLAN config mode)
SW1(config-vlan)#exit
SW1(config)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 primary
200 isolated
300 community
400 community
Now that the Private VLANs have been created, an association is required - we do this by selecting the primary vlan and then attaching the isolated/community VLANs to it
SW1(config-vlan)#private-vlan association 200,300,400
SW1(config-vlan)#exit
SW1(config)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated
100 300 community
100 400 community
Let's set up the trunk between SW1 and SW2 and then apply the same PVLAN config to SW2
SW1(config)#int fa1/0/19
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#host SW2
SW2(config)#int fa1/0/19
SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunk
SW2(config-vlan)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
SW2(config)#vlan 100
SW2(config-vlan)#private-vlan primary
SW2(config-vlan)#vlan 200
SW2(config-vlan)#private-vlan isolated
SW2(config-vlan)#vlan 300
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#vlan 400
SW2(config-vlan)#private-vlan community
SW2(config-vlan)#vlan 100
SW2(config-vlan)#private-vlan association 200,300,400
SW2(config-vlan)#exit
SW2(config)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated
100 300 community
100 400 community
Before we associate switch interfaces with private-vlan configurations, by default all router facing ports will be in vlan 1, let's validate we have full connectivity.
R1
R1#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/261/1012 ms
R1#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/268/1056 ms
R1#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/260/1004 ms
R1#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/262/1016 ms
R1#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/264/1044 ms
R2
R2#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R2#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/10/24 ms
R2#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/406/1996 ms
R2#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/5/12 ms
R2#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/403/1988 ms
R2#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3
R3#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/405/2000 ms
R3#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/8/20 ms
R3#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/5/8 ms
R3#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4
R4#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms
R4#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/403/1996 ms
R4#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/7/16 ms
R4#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/12 ms
R5
R5#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R5#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
R5#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R5#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/12 ms
R5#ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/406/1992 ms
R5#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R6
R6#ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6#ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/12 ms
R6#ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R6#ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R6#ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/16 ms
Okay, so our baseline of full connectivity between hosts has been established, we can start applying the pvlan configurations to switchports.
SW1 Fa1/0/1 (R1) - Primary VLAN (100)
SW1 Fa1/0/2 (R2) - Isolated VLAN (200)
SW1 Fa1/0/3 (R3) - Community VLAN (300)
SW2 Fa1/0/4 (R4) - Isolated VLAN (200)
SW2 Fa1/0/5 (R5) - Community VLAN (300)
SW2 Fa1/0/6 (R6) - Community VLAN (400)
SW1(config)#int fa1/0/1
This is the promiscuous port for the private-vlan (all isolated/community VLANs of the private vlan can talk with this port)
SW1(config-if)#switchport mode private-vlan promiscuous
Attach the secondary vlans (200,300,400) to the primary vlan (100)
SW1(config-if)#switchport private-vlan association mapping 100 200,300,400
Now we configure the secondary vlan interfaces
SW1(config-if)#int fa1/0/2
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan association host 100 200
SW1(config-if)#int fa1/0/3
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan association host 100 300SW1(config-if)#switchport mode private-vlan host
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated Fa1/0/1, Fa1/0/2
100 300 community Fa1/0/1, Fa1/0/3
100 400 community Fa1/0/1
On SW2 we only have secondary vlan interfaces
SW2(config)#int fa1/0/4
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan association host 100 200
SW2(config-if)#int fa1/0/5
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan association host 100 300
SW2(config-if)#int fa1/0/6
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#switchport private-vlan association host 100 400
SW2(config-if)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated Fa1/0/4
100 300 community Fa1/0/5
100 400 community Fa1/0/6
Now to test
R1 should be able to ping R2/R3/R4/R5/R6 because it's the promiscuous port (SW1 Fa1/0/1)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R1>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R1>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/8 ms
R1>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R1>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R2 (SW1 Fa1/0/2) should only be able to ping R1 even though R4 (SW2 Fa1/0/4) is on the same secondary VLAN as this pvlan type is isolated neither will be able to communicate with each other
R2>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R2>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R2>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R2>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3 (SW1 Fa1/0/3) should be able to ping R1 and R5 (as they are in the same community pvlan)
R3>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
R3>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4 (SW2 Fa1/0/4) like R2 should only be able to ping R1
R4>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R4>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R4>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5 (SW2 Fa1/0/5) should be able to ping R1 and R3 (as they are in the same community pvlan)
R5>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R5>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/12 ms
R5>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R5>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6 (SW2 Fa1/0/6) will only be able to ping R1 currently it is the only community pvlan (400) member
R6>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R6>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6>ping 10.1.100.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R6>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
So we have seen how you can use Private VLANs to partition a broadcast domain / IP subnet into multiple domains for service/security separation.
While the promiscuous port has been shown to occur on a layer 2 interface, it is also able to happen on a switched virtual interface.
to demonstrate we'll first make a slight change to R1's configuration
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int fa0/0
R1(config-if)#ip add 10.100.100.1 255.255.255.0
R1(config-if)#ip route 0.0.0.0 0.0.0.0 10.100.100.100
R1(config)#end
Now we'll return SW1 Fa1/0/1 to act as a regular access port in vlan 10
SW1(config)#int fa1/0/1
SW1(config-if)#no switchport private-vlan mapping 100 200,300,400
SW1(config-if)#no switchport mode private-vlan promiscuous
SW1(config-if)#switchport access vlan 10
SW1(config-if)#no switchport private-vlan mapping 100 200,300,400
SW1(config-if)#no switchport mode private-vlan promiscuous
SW1(config-if)#switchport access vlan 10
We'll create our SVI for vlan 10
SW1(config-if)#ip add 10.100.100.100 255.255.255.0
SW1(config-if)#exit
now we'll enable routing and add the static route to 1.1.1.1
SW1(config)#ip routing
SW1(config)#ip route 1.1.1.1 255.255.255.255 10.100.100.1SW1(config)#do ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/9 ms
Now we need to create the SVI for vlan 100 and create the private-vlan mapping
SW1(config)#int vlan 100
SW1(config-if)#ip add 10.1.100.1 255.255.255.0
SW1(config-if)#private-vlan mapping 200,300,400
SW1(config-if)#ip add 10.1.100.1 255.255.255.0
SW1(config-if)#private-vlan mapping 200,300,400
SW1(config-if)#do sh vlan private-vlan
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
100 200 isolated Fa1/0/2
100 300 community Fa1/0/3
100 400 community
We cant see any reference to VLAN 100 here but there is an alternate way to see the mapping
SW1(config-if)#do sh int vlan 100 private-vlan mapping
Interface Secondary VLANs
--------- --------------------------------------------------------------------
vlan100 200, 300, 400
We'll do a verification using R3 (Only hosts on VLAN 10, 100 and 300) should be reachable
R3>ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/8/20 ms
R3>ping 10.100.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3>ping 10.1.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
R3>ping 10.1.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3>ping 10.1.100.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3>ping 10.1.100.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.100.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Using the Private VLAN on the SVI enables you to to use your switch as a routing gateway for your private vlans.
Saturday, 23 June 2012
OSPF and IP Unnumbered over different types of links
This post is about using OSPF to link routers where link endpoints are on completely different IP networks.
Below is the topology used in this post to capture the main link types we'll come up against in the CCIE lab - Frame Relay, PPP and Ethernet.
We shall start with the most straight forward - direct PPP over serial between R1 and R3 Each router is using Loopback0 as the only IP address on the router which is bound to Serial0/1
R1
!
R3
Let's enable R3 S0/1 and verify that OSPF comes up
R3#deb ip ospf adj
OSPF adjacency events debugging is on
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int s0/1
R3(config-if)#no shut
R3(config-if)#
*Mar 1 00:02:19.543: %LINK-3-UPDOWN: Interface Serial0/1, changed state to up
*Mar 1 00:02:20.555: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to up
*Mar 1 00:02:20.559: OSPF: Interface Serial0/1 going Up
*Mar 1 00:02:20.587: OSPF: 2 Way Communication to 1.1.1.1 on Serial0/1, state 2WAY
*Mar 1 00:02:20.587: OSPF: Send DBD to 1.1.1.1 on Serial0/1 seq 0x1DAE opt 0x52 flag 0x7 len 32
*Mar 1 00:02:20.587: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x105C opt 0x52 flag 0x7 len 32 mtu 1500 state EXSTART
*Mar 1 00:02:20.587: OSPF: First DBD and we are not SLAVE
*Mar 1 00:02:20.591: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x1DAE opt 0x52 flag 0x2 len 52 mtu 1500 state EXSTART
*Mar 1 00:02:20.591: OSPF: NBR Negotiation Done. We are the MASTER
*Mar 1 00:02:20.591: OSPF: Send DBD to 1.1.1.1 on Serial0/1 seq 0x1DAF opt 0x52 flag 0x3 len 52
*Mar 1 00:02:20.591: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x1DAF opt 0x52 flag 0x0 len 32 mtu 1500 state EXCHANGE
*Mar 1 00:02:20.595: OSPF: Send DBD to 1.1.1.1 on Serial0/1 seq 0x1DB0 opt 0x52 flag 0x1 len 32
*Mar 1 00:02:20.595: OSPF: Send LS REQ to 1.1.1.1 length 12 LSA count 1
*Mar 1 00:02:20.599: OSPF: Rcv LS REQ from 1.1.1.1 on Serial0/1 length 36 LSA count 1
*Mar 1 00:02:20.599: OSPF: Send UPD to 1.1.1.1 on Serial0/1 length 40 LSA count 1
*Mar 1 00:02:20.599: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x1DB0 opt 0x52 flag 0x0 len 32 mtu 1500 state EXCHANGE
*Mar 1 00:02:20.599: OSPF: Exchange Done with 1.1.1.1 on Serial0/1
*Mar 1 00:02:20.599: OSPF: Rcv LS UPD from 1.1.1.1 on Serial0/1 length 64 LSA count 1
*Mar 1 00:02:20.603: OSPF: Synchronized with 1.1.1.1 on Serial0/1, state FULL
*Mar 1 00:02:20.603: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on Serial0/1 from LOADING to FULL, Loading Done
*Mar 1 00:02:21.059: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x80000002, process 1
*Mar 1 00:02:21.075: OSPF: Rcv LS UPD from 1.1.1.1 on Serial0/1 length 76 LSA count 1
So no problems here, everything came up, let's validate our IP interface and OSPF interface/neighbors
R3(config-if)#do sh ip interface Serial0/1 | i Interface|Peer
Interface is unnumbered. Using address of Loopback0 (3.3.3.3)
Peer address is 1.1.1.1
R3(config-if)#do sh ip ospf int brief
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Se0/1 1 0 0.0.0.0/0 64 P2P 1/1
Lo0 1 0 3.3.3.3/24 1 LOOP 0/0
R3(config-if)#do sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
1.1.1.1 0 FULL/ - 00:00:35 1.1.1.1 Serial0/1
R1#sh ip interface Serial0/1 | i Interface|Peer
Interface is unnumbered. Using address of Loopback0 (1.1.1.1)
Peer address is 3.3.3.3
R1#sh ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
3.3.3.3 0 FULL/ - 00:00:39 3.3.3.3 Serial0/1
R1#sh ip ospf int bri
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Se0/1 1 0 0.0.0.0/0 64 P2P 1/1
Lo0 1 0 1.1.1.1/24 1 LOOP 0/0
Okay, this looks good, lets check the routing table
R1#sh ip route ospf
Hmm, we cant see anything here, we should have R3 Lo0's stub network in our ospf database..
R1#sh ip ospf data router 3.3.3.3 | s Stub
Link connected to: a Stub Network
(Link ID) Network/subnet number: 3.3.3.3
(Link Data) Network Mask: 255.255.255.255
Number of TOS metrics: 0
TOS 0 Metrics: 1
We do but it's not being installed in the routing table, is something else already there?
R1#sh ip route 3.3.3.3
Routing entry for 3.3.3.3/32
Known via "connected", distance 0, metric 0 (connected, via interface)
Routing Descriptor Blocks:
* directly connected, via Serial0/1
Route metric is 0, traffic share count is 1
By default, PPP installs a connected route to our peer device, not necessarily a bad thing but we would prefer to see this route originated by ospf, so lets fix that on both sides
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int s0/1
R3(config-if)#no peer neighbor-route
R3(config-if)#end
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int s0/1
R1(config-if)#no peer neighbor-route
Making these changes doesn't cause the static neighbor route to be removed, so we need to bounce the link to make that happen
Interface is unnumbered. Using address of Loopback0 (1.1.1.1)
Peer address is 3.3.3.3
Let's see how if the route comes through from ospf and is installed into the routing table
R1(config-if)#do sh ip route ospf
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/65] via 3.3.3.3, 00:00:00, Serial0/1
R1(config-if)#do ping 3.3.3.3 so 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
OSPF IP Unnumbered over Frame Relay
Between R1 and R2 we have a Frame Relay link, we are going to take advantage of implementing PPP over FR to make this happen
On R1 and R2 create the virtual-template required for PPPoFR to operate, again it's an unnumbered link associated with loopback0
R1
interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip ospf 1 area 0
!
Then we configure the serial interface for frame relay encapsulation and bind the virtual-template to the FR PVC.
encapsulation frame-relay
frame-relay interface-dlci 102 ppp Virtual-Template1
no frame-relay inverse-arp
no shutdown
!
encapsulation frame-relay
frame-relay interface-dlci 201 ppp Virtual-Template1
no frame-relay inverse-arp
no shutdown
!
After a short period of time R1/R2s PVC will come up and the PPP session will go active and then OSPF should start
*Mar 1 00:36:02.407: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
*Mar 1 00:36:51.423: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Mar 1 00:36:53.515: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
*Mar 1 00:36:53.575: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Virtual-Access2 from LOADING to FULL, Loading Done
R1#sh ip ospf int brie
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Vi2 1 0 0.0.0.0/0 1 P2P 1/1
Vt1 1 0 0.0.0.0/0 1 DOWN 0/0
Se0/1 1 0 0.0.0.0/0 64 P2P 1/1
Lo0 1 0 1.1.1.1/24 1 LOOP 0/0
Of potential interest, the PPPoFR link has a lower ospf cost than the native PPP link
R1#sh ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 0 FULL/ - 00:00:37 2.2.2.2 Virtual-Access2
3.3.3.3 0 FULL/ - 00:00:38 3.3.3.3 Serial0/1
R1#sh ip route ospf
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/2] via 2.2.2.2, 00:02:30, Virtual-Access2
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/65] via 3.3.3.3, 00:22:27, Serial0/1
The final link type we're working with is ethernet between R2 and R3
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int range fa1/2 - 3
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport access vlan 23
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#int fa0/0
R2(config-if)#ip unnumbered lo0
Point-to-point (non-multi-access) interfaces only
Okay, that's not so good, I guess we can go back to our friend PPP again and go for PPPoE (R2 will be our PPPoE Client)
R2(config-if)#no peer neighbor-route
R2(config-if)#dialer pool 1
R2(config-if)#dialer persistent
R2(config-if)#ip ospf 1 area 0
R2(config-if)#int fa0/0
R2(config-if)#pppoe-client dial-pool-number 1
R2(config-if)#no shut
Let's set up R3 as the PPPoE Server
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int virtual-template 1
R3(config-if)#ip unnumbered lo0
R3(config-if)#no peer neighbor-route
R3(config-if)#ip ospf 1 area 0
R3(config-if)#int fa0/0
R3(config-if)#pppoe enable
R3(config-if)#bba-group pppoe global
R3(config-bba-group)#virtual-template 1
R3(config-bba-group)#int fa0/0
R3(config-if)#no shut
After a short period of time we can see that the PPPoE link comes up but eventially we see this:
*Mar 1 00:59:06.723: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Virtual-Access2.1 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
A typical cause of this is an MTU mismatch, lets see if this is the case:
R3#sh ip int vi2.1 | i MTU
MTU is 1492 bytes
Remember the PPPoE overhead is 8 bytes....
R2#sh ip int di1 | i MTU
MTU is 1500 bytes
Okay, so that didn't happen here, let's fix this up
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#int di1
R2(config-if)#ip mtu 1492
R2(config-if)#end
We could have also fixed this with ip ospf mtu-ignore... After a few seconds on R2 we see:
*Mar 1 01:00:35.827: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Dialer1 from LOADING to FULL, Loading Done
So there you go, a few different ways of implementing OSPF adjacencies between routers using peers with different IP addresses and subnets, just remember that different link types will have different link cost metrics applied..
Below is the topology used in this post to capture the main link types we'll come up against in the CCIE lab - Frame Relay, PPP and Ethernet.
R1
hostname R1
interface Loopback0
ip address 1.1.1.1 255.255.255.0
ip ospf 1 area 0
!
interface Serial0/1
ip unnumbered Loopback0
encapsulation ppp
ip ospf 1 area 0
clock rate 2000000
no shutdowninterface Loopback0
ip address 1.1.1.1 255.255.255.0
ip ospf 1 area 0
!
interface Serial0/1
ip unnumbered Loopback0
encapsulation ppp
ip ospf 1 area 0
clock rate 2000000
!
R3
hostname R3
interface Loopback0
ip address 3.3.3.3 255.255.255.0
ip ospf 1 area 0
!
interface Serial0/1
ip unnumbered Loopback0
encapsulation ppp
ip ospf 1 area 0
interface Loopback0
ip address 3.3.3.3 255.255.255.0
ip ospf 1 area 0
!
interface Serial0/1
ip unnumbered Loopback0
encapsulation ppp
ip ospf 1 area 0
shutdown
!
!
Let's enable R3 S0/1 and verify that OSPF comes up
R3#deb ip ospf adj
OSPF adjacency events debugging is on
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int s0/1
R3(config-if)#no shut
R3(config-if)#
*Mar 1 00:02:19.543: %LINK-3-UPDOWN: Interface Serial0/1, changed state to up
*Mar 1 00:02:20.555: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to up
*Mar 1 00:02:20.559: OSPF: Interface Serial0/1 going Up
*Mar 1 00:02:20.587: OSPF: 2 Way Communication to 1.1.1.1 on Serial0/1, state 2WAY
*Mar 1 00:02:20.587: OSPF: Send DBD to 1.1.1.1 on Serial0/1 seq 0x1DAE opt 0x52 flag 0x7 len 32
*Mar 1 00:02:20.587: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x105C opt 0x52 flag 0x7 len 32 mtu 1500 state EXSTART
*Mar 1 00:02:20.587: OSPF: First DBD and we are not SLAVE
*Mar 1 00:02:20.591: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x1DAE opt 0x52 flag 0x2 len 52 mtu 1500 state EXSTART
*Mar 1 00:02:20.591: OSPF: NBR Negotiation Done. We are the MASTER
*Mar 1 00:02:20.591: OSPF: Send DBD to 1.1.1.1 on Serial0/1 seq 0x1DAF opt 0x52 flag 0x3 len 52
*Mar 1 00:02:20.591: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x1DAF opt 0x52 flag 0x0 len 32 mtu 1500 state EXCHANGE
*Mar 1 00:02:20.595: OSPF: Send DBD to 1.1.1.1 on Serial0/1 seq 0x1DB0 opt 0x52 flag 0x1 len 32
*Mar 1 00:02:20.595: OSPF: Send LS REQ to 1.1.1.1 length 12 LSA count 1
*Mar 1 00:02:20.599: OSPF: Rcv LS REQ from 1.1.1.1 on Serial0/1 length 36 LSA count 1
*Mar 1 00:02:20.599: OSPF: Send UPD to 1.1.1.1 on Serial0/1 length 40 LSA count 1
*Mar 1 00:02:20.599: OSPF: Rcv DBD from 1.1.1.1 on Serial0/1 seq 0x1DB0 opt 0x52 flag 0x0 len 32 mtu 1500 state EXCHANGE
*Mar 1 00:02:20.599: OSPF: Exchange Done with 1.1.1.1 on Serial0/1
*Mar 1 00:02:20.599: OSPF: Rcv LS UPD from 1.1.1.1 on Serial0/1 length 64 LSA count 1
*Mar 1 00:02:20.603: OSPF: Synchronized with 1.1.1.1 on Serial0/1, state FULL
*Mar 1 00:02:20.603: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on Serial0/1 from LOADING to FULL, Loading Done
*Mar 1 00:02:21.059: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x80000002, process 1
*Mar 1 00:02:21.075: OSPF: Rcv LS UPD from 1.1.1.1 on Serial0/1 length 76 LSA count 1
So no problems here, everything came up, let's validate our IP interface and OSPF interface/neighbors
R3(config-if)#do sh ip interface Serial0/1 | i Interface|Peer
Interface is unnumbered. Using address of Loopback0 (3.3.3.3)
Peer address is 1.1.1.1
R3(config-if)#do sh ip ospf int brief
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Se0/1 1 0 0.0.0.0/0 64 P2P 1/1
Lo0 1 0 3.3.3.3/24 1 LOOP 0/0
R3(config-if)#do sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
1.1.1.1 0 FULL/ - 00:00:35 1.1.1.1 Serial0/1
Interface is unnumbered. Using address of Loopback0 (1.1.1.1)
Peer address is 3.3.3.3
R1#sh ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
3.3.3.3 0 FULL/ - 00:00:39 3.3.3.3 Serial0/1
R1#sh ip ospf int bri
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Se0/1 1 0 0.0.0.0/0 64 P2P 1/1
Lo0 1 0 1.1.1.1/24 1 LOOP 0/0
Okay, this looks good, lets check the routing table
R1#sh ip route ospf
Hmm, we cant see anything here, we should have R3 Lo0's stub network in our ospf database..
R1#sh ip ospf data router 3.3.3.3 | s Stub
Link connected to: a Stub Network
(Link ID) Network/subnet number: 3.3.3.3
(Link Data) Network Mask: 255.255.255.255
Number of TOS metrics: 0
TOS 0 Metrics: 1
We do but it's not being installed in the routing table, is something else already there?
R1#sh ip route 3.3.3.3
Routing entry for 3.3.3.3/32
Known via "connected", distance 0, metric 0 (connected, via interface)
Routing Descriptor Blocks:
* directly connected, via Serial0/1
Route metric is 0, traffic share count is 1
By default, PPP installs a connected route to our peer device, not necessarily a bad thing but we would prefer to see this route originated by ospf, so lets fix that on both sides
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int s0/1
R3(config-if)#no peer neighbor-route
R3(config-if)#end
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int s0/1
R1(config-if)#no peer neighbor-route
Making these changes doesn't cause the static neighbor route to be removed, so we need to bounce the link to make that happen
R1(config-if)#shut
*Mar 1 00:16:45.727: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial0/1 from FULL to DOWN, Neighbor Down: Interface down or detached
*Mar 1 00:16:47.715: %LINK-5-CHANGED: Interface Serial0/1, changed state to administratively down
*Mar 1 00:16:48.715: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to down
R1(config-if)#no shut
*Mar 1 00:16:53.495: %LINK-3-UPDOWN: Interface Serial0/1, changed state to up
*Mar 1 00:16:54.531: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to up
*Mar 1 00:16:54.603: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial0/1 from LOADING to FULL, Loading Done
R1(config-if)#do sh ip int s0/1 | i Interface|Peer*Mar 1 00:16:45.727: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial0/1 from FULL to DOWN, Neighbor Down: Interface down or detached
*Mar 1 00:16:47.715: %LINK-5-CHANGED: Interface Serial0/1, changed state to administratively down
*Mar 1 00:16:48.715: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to down
R1(config-if)#no shut
*Mar 1 00:16:53.495: %LINK-3-UPDOWN: Interface Serial0/1, changed state to up
*Mar 1 00:16:54.531: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to up
*Mar 1 00:16:54.603: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial0/1 from LOADING to FULL, Loading Done
Interface is unnumbered. Using address of Loopback0 (1.1.1.1)
Peer address is 3.3.3.3
Let's see how if the route comes through from ospf and is installed into the routing table
R1(config-if)#do sh ip route ospf
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/65] via 3.3.3.3, 00:00:00, Serial0/1
R1(config-if)#do ping 3.3.3.3 so 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
OSPF IP Unnumbered over Frame Relay
Between R1 and R2 we have a Frame Relay link, we are going to take advantage of implementing PPP over FR to make this happen
On R1 and R2 create the virtual-template required for PPPoFR to operate, again it's an unnumbered link associated with loopback0
R1
interface Virtual-Template1
ip unnumbered Loopback0
ip ospf 1 area 0
no peer neighbor-route
!
ip unnumbered Loopback0
ip ospf 1 area 0
no peer neighbor-route
!
R2
hostname R2interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip ospf 1 area 0
!
interface Virtual-Template1
ip unnumbered Loopback0
ip ospf 1 area 0
no peer neighbor-route
!
ip unnumbered Loopback0
ip ospf 1 area 0
no peer neighbor-route
!
Then we configure the serial interface for frame relay encapsulation and bind the virtual-template to the FR PVC.
R1
interface Serial0/0encapsulation frame-relay
frame-relay interface-dlci 102 ppp Virtual-Template1
no frame-relay inverse-arp
no shutdown
!
R2
interface Serial0/0encapsulation frame-relay
frame-relay interface-dlci 201 ppp Virtual-Template1
no frame-relay inverse-arp
no shutdown
!
After a short period of time R1/R2s PVC will come up and the PPP session will go active and then OSPF should start
R1#
*Mar 1 00:35:51.403: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up*Mar 1 00:36:02.407: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
*Mar 1 00:36:51.423: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Mar 1 00:36:53.515: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
*Mar 1 00:36:53.575: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Virtual-Access2 from LOADING to FULL, Loading Done
R1#sh ip ospf int brie
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Vi2 1 0 0.0.0.0/0 1 P2P 1/1
Vt1 1 0 0.0.0.0/0 1 DOWN 0/0
Se0/1 1 0 0.0.0.0/0 64 P2P 1/1
Lo0 1 0 1.1.1.1/24 1 LOOP 0/0
Of potential interest, the PPPoFR link has a lower ospf cost than the native PPP link
R1#sh ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 0 FULL/ - 00:00:37 2.2.2.2 Virtual-Access2
3.3.3.3 0 FULL/ - 00:00:38 3.3.3.3 Serial0/1
R1#sh ip route ospf
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/2] via 2.2.2.2, 00:02:30, Virtual-Access2
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/65] via 3.3.3.3, 00:22:27, Serial0/1
The final link type we're working with is ethernet between R2 and R3
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int range fa1/2 - 3
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport access vlan 23
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#int fa0/0
R2(config-if)#ip unnumbered lo0
Point-to-point (non-multi-access) interfaces only
Okay, that's not so good, I guess we can go back to our friend PPP again and go for PPPoE (R2 will be our PPPoE Client)
R2(config-if)#int di1
R2(config-if)#ip unnumbered lo0
R2(config-if)#encapsulation pppR2(config-if)#ip unnumbered lo0
R2(config-if)#no peer neighbor-route
R2(config-if)#dialer pool 1
R2(config-if)#dialer persistent
R2(config-if)#ip ospf 1 area 0
R2(config-if)#int fa0/0
R2(config-if)#pppoe-client dial-pool-number 1
R2(config-if)#no shut
Let's set up R3 as the PPPoE Server
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int virtual-template 1
R3(config-if)#ip unnumbered lo0
R3(config-if)#no peer neighbor-route
R3(config-if)#ip ospf 1 area 0
R3(config-if)#int fa0/0
R3(config-if)#pppoe enable
R3(config-if)#bba-group pppoe global
R3(config-bba-group)#virtual-template 1
R3(config-bba-group)#int fa0/0
R3(config-if)#no shut
After a short period of time we can see that the PPPoE link comes up but eventially we see this:
*Mar 1 00:59:06.723: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Virtual-Access2.1 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
A typical cause of this is an MTU mismatch, lets see if this is the case:
R3#sh ip int vi2.1 | i MTU
MTU is 1492 bytes
Remember the PPPoE overhead is 8 bytes....
R2#sh ip int di1 | i MTU
MTU is 1500 bytes
Okay, so that didn't happen here, let's fix this up
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#int di1
R2(config-if)#ip mtu 1492
R2(config-if)#end
We could have also fixed this with ip ospf mtu-ignore... After a few seconds on R2 we see:
*Mar 1 01:00:35.827: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Dialer1 from LOADING to FULL, Loading Done
So there you go, a few different ways of implementing OSPF adjacencies between routers using peers with different IP addresses and subnets, just remember that different link types will have different link cost metrics applied..
Subscribe to:
Posts (Atom)