Terms
Virtual Teletype Terminal (VTY)
電腦網路連接到 switch 的管理界面
Switched Virtual Interface (SVI)
- Switch does not have a physical interface to which an IP address can be assigned.
- IP is configured on a virtual interface called switched virtual interface (SVI).
- Switched Virtual Interface (SVI)
- A single SVI can only be mapped to a VLAN.
- A SVI cannot be activated unless that VLAN associated with an active physical port.
Basic Cisco IOS CLI Commands
存檔
改 hostname
設定 Console Access 密碼 (not encrypted)
設定 Privileged EXEC Access 密碼 (not encrypted)
加密 running-config 裡的密碼 (沒啥用)
設定 Console Access 密碼 (MD5 encrypted)
設定 Privileged EXEC Access 密碼 (MD5 encrypted)
set banner message
Set executive timeout
Set default gateway (for L2 devices)
Cisco Discovery Protocol (CDP)
A Cisco proprietary protocol
Show all neighbors
Show details of one neighbor
disable CDP globally
disable CDP for an interface
LLDP
- IEEE standard protocol
- Similar to CDP
- Not enabled by default
enable LLDP globally
enable LLDP for an interface
show all neighbors
Virtual LAN (VLAN)
建立 vlan
在 interface 上 access vlan
VLANs |
Range |
Usage |
0, 4095 |
Reserved |
For system use |
1 |
Normal |
Cisco default |
2-1001 |
Normal |
For ethernet VLANs; can be modified. |
1002-1005 |
Normal |
Cannot delete (Cisco default for FDDI and Token Ring) |
1006-4094 |
Extended |
For ethernet VLAN only |
vlan num 表格
建立 trunk
修改 trunk
設定 VLAN interface 的 IP
在 L3 switch 上啟用 routing
設定 Native Vlan , Cisco 預設為 1
dynamic trunking ,預設為 desirable
會主動轉成 trunking mode
Spanning Tree Protocol (STP)
- set hostname other than default hostname is needed
disable STP on the specified vlan
- Check the connectivity between hosts
- Restore the settings
Protocol |
Standard |
Resources needed |
Convergence |
Tree Calculation |
STP |
802.1D |
Low |
Slow |
All VLANs |
PVST+ |
Cisco |
High |
Slow |
Per VLAN |
RSTP |
802.1w |
Medium |
Fast |
All VLANs |
Rapid PVST+ |
Cisco |
Very high |
Fast |
Per VLAN |
MSTP |
802.1s |
Medium or high |
Fast |
Per Instance |
STP mode
Set bridge priority
- Bridge priority only allows to be in multiple of 4096
Set interface cost
Show tree cost
Bridge priority v.s. Cost
- If you want to affect how to the local switch elects the root port change the cost on the links. Cost is cumulative throughout the STP domain. The higher cost is the less preferred.
- If you want to affect how downstream switch elects its root port change the priority. This is only local significant between the two directly connected switches. Highest priority is less preferred.
- Going away from the root of the tree use priority whereas, when going towards the root of the tree use cost.


Portfast
- Allow a port to enter from blocking to forwarding state immediately, bypassing the listening and learning states.
Portfast on an interface.
Portfast on all non-trunking interfaces.
turn on BPDU guard
Enable BPDU filtering globally (deprecated on Packet Tracer)
Enable BPDU filtering on a specific switch port (deprecated on Packet Tracer)
Enable root guard
- If there is a superior BPDU received on the port, root guard does not take the BPDU into account and so puts the port into root inconsistent state
Routing
- Routers learn next hops from
- Static routing
- Manually configured into the routing table.
- Must be reconfigured whenever the network topology changed.
- Dynamic routing
- automatically learned through dynamic routing protocols.
Administrative Distance
- The feature used by routers to select the best path.
Route Source |
Administrative Distance |
Connected |
0 |
Static |
1 |
EIGRP summary route |
5 |
External BGP |
20 |
Internal EIGRP |
90 |
IGRP |
100 |
OSPF |
110 |
RIP |
120 |
External EIGRP |
170 |
Internal BGP |
200 |
Static route configuration
Show routing table
Set default gateway (for L3 devices)
Example setting
Propagate a default route
Disable auto summarization
Passive interface for RIP
OSPF

Settings
gateway
general
priority cost
Verify
multi-area OSPF advertise
multi-area OSPF adjacency
multi-area OSPF route
Router Types
internal router
- A router has all of its interfaces in the same areas
- All internal routers in the same area have identical LSDBs
backbone router
- A backbone router is a router that runs OSPF and has at least one interface connected to the OSPF backbone area.
area border router(ABR)
- A router that has interfaces attached to multiple areas
- Maintain separate LSDB for each area it is connected to
- Exit points of the area, which means that routing information destined for another area can get there via ABR of the local area
- Can be configured to summarize the routing information from the LSDB of their areas
- Distribute routing information into backbone
- Backbone router forwards information to the other ABRs
- In multiarea network, an area can have one or more ABRs
autonomous system boundary router(ASBR)
- A router that has at least one interface attached to an external internetwork
- An external network is a network that is not part of this OSPF routing domain
- An ASBR can import external network information to the OSPF network
Link State Advertisement (LSA)
A Link State Database(LSDB) contains LSAs
- In combination, LSAs describe the entire topology of an OSPF network/area
OSPF LSA Types
LSA Type |
Description |
Send |
Receive |
Information |
1 |
Router Link |
Any OSPF Router |
All other routers in the same area |
Link/Network information |
2 |
Network Link |
DR |
BDR/DRother |
List of routers that DR connects with |
3 |
Summary Network Link |
ABR |
All other routers in the same area |
Network information of other areas |
4 |
Summary AS Border Link |
ABR |
All other routers in the same area |
Information of ASBR |
5 |
AS External Link |
ASBR |
All routers in OSPF routing domain |
External network |
7 |
Router Link |
ASBR |
All the routers in the NSSA |
External network |
verify
Stub Area
- No Type 5 LSA
- ABR will send a default route (0.0.0.0) as type 3 LSA
config
Totally Stub Area
- No Type 3,4,5 LSA
- The only type 3 is 0.0.0.0
config
Not So Stubby Area (NSSA)
- Extension of OSPF stub areas
- Must be placed at the edge of an OSPF routing domain
- More flexible than stub area
- Can import external routes into OSPF routing domain
- Provide transit service to small routing domains that are not part of OSPF routing domain
config
Totally NSSA
config
Comparison
Area |
Restriction |
Normal |
- None |
Stub |
- No Type 5 AS-external LSA allowed |
Totally Stub |
- No Type 3,4,5 LSA allowed - except the default summary route |
NSSA |
- No Type 5 As-external LSA allowed> - Type 7 LSAs that convert to Type 5 at the NSSA ABR can traverse |
Totally NSSA |
- No Type 3,4,5 LSA allowed - except the default summary route - Type 7 LSAs that convert to Type 5 at the NSSA ABR can traverse |
PAgP & LACP
PAgP
- Cisco-proprietary protocol for negotiating and managing EtherChannel links.
- Sends PAgP packets every 30 seconds.
- Checks config consistency.
- Manages link additions and failures.
- Combine a maximum of 8 physical links into a single virtual link.
LACP
- Industrial standard, IEEE 802.1AX (previously 802.3ad)
- Performs similar to Cisco PAgP
- Cisco device support both protocols
- Can be used to facilitate EtherChannels in multi-vendor environments.
- LAP allows for 8 active links and 8 standby links.
- A standby link will become active when one of the current active links fails.
Deciding which links to be active or standby
- System priority
- Default priority = 32768
- Switch with the lower value will become the leader.
- Port priority
- The master chooses which ports to be active or standby.
- Port with the lower value will be chosen to be active.
- desirable Enable PAgP unconditionally
- auto Enable PAgP only if a PAgP device is detected
- active Enable LACP unconditionally
- passive Enable LACP only if an LACP device is detected
- on Enable Etherchannel only
Load Balance
- Traffic in an EtherChannel is distributed across the physical links.
- But not necessarily balanced equally across all the links.
- Packets are forwarded on a specific link as a result of a deterministic method.
- Use 3 bits of (src and/or dst) (MAC addr, IP addr, port) to calculate the physical link to use.
- The same 5-tuple between two devices is always sent through the same physical link.
- Choose the load-balancing method that provides the greatest distribution.
Config Steps
- Specify the interfaces that compose the EtherChannel group.
- Setting LACP system priority & port priority. (Optional, Not support in Packet Tracer.)
- Config the port-channel interface.
e.g.
Change EtherChannel setting after creation.
Avoiding misconfiguration with EtherChannel. (Enabled by default)
- If you want to change those configs, set them in the port-channel interface.
First-Hop Router Protocol (FHRP)
- The default gateway for end devices is called first-hop.
- FHRP allows 2+ routers to provide backup for gateway address.
- When master is dead, backup routers will take over within seconds.
- FHRP is a category, there are several FHRP protocols.
- Virtual Router Redundancy Protocol (VRRP)
- Hot Standby Router Protocol (HSRP)
- Gateway Load Balancing Protocol (GLBP)
Virtual Router Redundancy Protocol (VRRP)
- Defined in RFC 2338
- Designed to be transparently failover for an IP address.
- Provides virtual router IP address for a group of routers as a gateway.
- A router with the highest priority becomes the master. If same VRRP priority, choose the router with numerically highest IPv4 address.
- VRRP advertisements are sent at 1 second intervals.
- When not hearing advertisements over 3*intervals from the master router. A backup router would take over.
- By default, VRRP routers are configured to preempt if priorities are greater.
- Priority should be 1-254.
- 0 and 255 have special meaning.
- Maximum Advertisement Interval
- Indicates the time interval in centiseconds.
- Default is 100 cs (1 sec). Max is 40.95 sec.
config example
Makes the interface a member of the vrrp group and assign the virtual IP address.
(The virtual IP address can be the same as the interface IP address of one member in the group.)
Set the VRRP router priority from 1 to 254 (Default is 100).
Change the advertisement timer (Default is 1 second).
Learn the advertisement interval from the master router.
Change the preempt delay.
Disable preempting. (Default is to preempt)
Track an object and decrease the priority when the object is down.
Hot Standby Router Protocol (HSRP)
- A Cisco-proprietary FHRP protocol.
- Send periodic Hello messages to all-routers multicast address.
- HSRP group consist of 1 active router + 1 standby router.
- Others remain in the speak state.
HSRP States
- Initial: When HSRP is disabled or the interface first coms up.
- Learn: The router has not determined the virtual IP address.
- Listen: Waiting for Hello message from active or standby router.
- Speak: Participating in the HSRP election.
- Standby: The router is a candidate to become the next active router.
- Active: Forwarding packets that are sent to the group's virtual IP / MAC address.
Speak, Standby, Active: Sends Hello messages periodically.
At most one router in: Standby, Active state.
HSRP Timers
In Hello message:
- Hellotime: The frequency of routers to send hello packes. (Default 3 seconds)
- Holdtime: The time that an active or standby router will be expired.
Each router maintains 3 timers:
- Hello Timer: Send Hello message when Hello timer expired.
- Active Timer: Used to monotor the Active router.
- Standby Timer: Used to monotor the Stadby router.
Election
- Determine the role of each router in HSRP group based on the priority value.
- HSRP priority
- Range from 0 to 255 (Default 100)
- Highest priority in the group = Active router
- If the priorities are equal, router with numerically highest IPv4 address is elected.
- By default, the active router won't be replaced by a router with higher priority.
- To force a new HSRP election process, preemption must be enabled.
Config Steps
- Configure the HSRP version 2
- Set the virtual IP address for the group.
- The IP address of interface and the virtual address should be in the same IP subnet.
- Configure the priority for the desired active router.
- Make the active router to be preemptive.
e.g.
Interface Tracking
- HSRP would track the interface of router.
- When the tracked interface goes down, HSRP reduces the router's priority.
interface-priority
: The value is decremented when the interface goes down, and would be added back when the interface comes back.
Gateway Load Balancing Protocol (GLBP)
- Another Cisco-proprietary FHRP protocol.
- Active Virtual Gateway & Active Virtual Forwarder
- Support load balancing and authentication.
- Load balancing modes: round-robin, host-dependent, weighted
Remote Authentication Dial-In User Service (RADIUS)

RADIUS Router Configuration
Enable AAA
Enter radius server config mode
Configure server IP address
Add radius key
Configure authentication method list
Apply the list to connections (e.g. console, vty, …)
RADIUS for router example
RADIUS for 2960 Configuration
Enable AAA
Configure radius server
Configure authentication method list
Apply the list to connections (e.g. console, vty, …)
RADIUS for 2960 example
Access Control List (ACL)
- A sequential list of permit or deny statements, known as access control entries (ACEs).
- Contol whether a switch/router allows or drops packets based on information found in the packet header.
- ACL being applied to an interface
- Router evaluates all network packets passing through the interface based on the ACL.
- Compare in sequential order, stop when matched (first match)
- Either deny or permit
- Source IPv4 address is the main filtering criteria
- The last statement of an ACL is always an implict deny
- Block all traffic if no entries being matched
Wildcard Masking
- 32-bit string
- Wildcard masks use the following rules to match binary 1s and 0s:
- Wildcard mask bit 0 – Match the corresponding bit value in the address
- Wildcard mask bit 1 – Ignore the corresponding bit value in the address
- Wildcard masks are often referred to inverse mask
- Usually considered as opposite of subnet mask
- But actually not the same
- Wildcard mask keywods
- host: 0.0.0.0
- any: 255.255.255.255
Type
- OSI layer
- Standard ACLs – Layer 3
- Only based on source IP address
- Placed close to the destination due to the inability to specify destination address
- Placed at source may prevent the traffic from reaching any other networks
- Extended ACLs – Layer 3&4
- Based on source IP, source port, destination IP, destination port and protocol
- Placed close to the source to filter undesirable traffic
- ACL name
- Flow direction
- Inbound ACLs
- Outbound ACLs
Standard ACLs
- Can only check source IP address
Numbered ACL
- list-number should be 1-99, 1300-1999
Named ACL
Standard ACLs – Example
Extended ACLs
- Having the ability to check source IP, source port, destination IP, destination port and protocol
Numbered ACL
- list-number should be 100-199 or 2000-2699
Named ACL
Extended ACLs – Example
Apply to interface (2960 not support)
Aply to line (e.g. console, vty)
Sequence Numbers
- Every time you add a new entry in ACL, it is added at the end of it.
- According to first match rule, thath entry will be checked at last.
- How to insert an entry between previous ACL entries?
- Sequence numbers help you make the proper order of ACL entries
Generic Routing Encapsulation (GRE)
example on hw4
Others
Windows command
- ipconfig
- route print
- ping
- tracert
- nslookup
- ssh
Linux command
- ip address
- ip route
- ping
- traceroute -I
- nslookup
- dig
- ssh