Chainring Circus

IPV6 Addressing
• 128 bit addresses.
• Simplified header with fewer fields; IPv4 has 12 fields, IPv6 has 5 fields;
• No checksum in the header. This results in more efficient process because in IPv4 the TTL is decremented at each hop, the checksum had to be recalculated at each hop, that is not the case with IPv6.
• No packet fragmentation done by the router, instead an ICMP “packet too big” message is sent to the client. Fragmentation information has been moved to an extension header.

Types of IPv6 Addresses
• Unicast — Send to one interface.
• Multicast — Send to many hosts in a group in the FF00::/8 address range.
• Anycast — Send to the nearest host in a group.

Abbreviate IPv6 Addresses
• Leading zeros in a field can be omitted.
• Contiguous fields containing zeros can be abbreviated with “::”.
• eui-64 addresses use the MAC address for the lower 64 bits of an IPv6 address. The MAC address is split in half and FFFE is placed between the two halves to make the 48 bit MAC into 64 bits, universal/local (U/L) flag (bit 7) in the OUI portion of the address is flipped as well.

Troubleshoot IPv6
sh ipv6 int — Validates the IPv6 and status of interfaces.
sh ipv6 routers — Displays IPv6 router advertisements.
sh ipv6 route — Shows the routing table. DUH.
sh ipv6 protocols — Shows parameters and state of the active IPv6 protocols.
debug ipv6 nd — Debug IPv6 neighbor discovery.
debug ipv6 routing — Display debugging messages for IPv6 routing table and route cache updates.
debug ipv6 packet — Displays the debugging messages for IPv6 packets.

IPv6 Configuration
ipv6 cef
ipv6 unicast-routing
ipv6 address xxxx::xxxx/xxx

OSPFv3
Configure OSPFv3
ipv6 router ospf 6
router-id 10.1.1.10
log-adjacency-changes

interface Tunnel0
no ip address
ipv6 address 2026::34:2/122
ipv6 ospf 6 area 34

Troubleshoot OSPFv3
sh ipv ospf neigh
sh ipv ospf
sh ipv ospf int

sh ipv ospf neigh

sh ipv ospf

sh ipv ospf int

RIPng
• IPv6 multicast address FF02::9 is the destination address for RIPng update messages.
• Link-local addresses used for next-hop addresses
• Metric is hop count and 15 is still the maximum, 16 is unreachable.
• Distance-vector

Configure RIPng
To set up a 3560 switch for IPv6 you must first configure the switch database management (SDM) template to one that supprts IPV6. The rest of the configuration is the same on a router and a layer 3 switch.

Troubleshoot RIPng
sh ipv6 protocols — What protocols are running on what interfaces.
sh ipv6 rip RIP_ZONE — Show general RIPng information concerning the specific RIP_ZONE.
sh ipv6 rip database — Shows the routes in the RIB.
sh ipv6 rip next-hops — Next hops out of this router as seen by RIPng.

sh ipv6 protocols

sh ipv6 rip RIP_ZONE

sh ipv6 rip database

I have had a hard time figuring out how they are going to test us for voice troubleshooting when the only real command they cover is auto qos and and the MQC. As a result I’m going to concentrate on the definitions.

Voice Definitions
Gatekeeper — provides bandwidth management through call admission control (CAC).
Gateway — ensures interoperability between VOIP and the public switched telephone network (PSTN).
Jitter (delay variation) — When consecutive packets experience different amounts of delay. Data applications tend to be much more forgiving of jitter than voice and video.
Delay — There are multiple types of delay in a network. Some are standard or fixed and some are variable in their affects, the TSHOOT book describes delay as propagation delay, the time it takes to get a bit from one end of a link to the other.
Drops — Congested packets overflow a buffer.

Cisco Phone Boot Process
1. Power, PoE
2. Load firmware from flash.
3. Catalyst switch informs the phone it’s voice VLAN.
4. DHCP for ip address and TFTP server.
5. Downloads configuration using TFTP.
6. Registers with call agent or Call Manager.

QoS Metrics for Video

Sources:
1 — ONT Certification Guide p.62
2 — Cisco DocWiki
3 — Enabling VOIP
4 — TSHOOT Book

Multicasting
Class D IP address in the range 224.0.0.0 through 239.255.255.255. Source sends one packet stream to the multicast address and all hosts that have joined that group receive that packet.

Internet Group Management Protocol (IGMP)
Hosts join a multicast group by sending an IGMP join message to router, which then knows to send multicast messages out that interface. IGMP snooping allows a switch to learn which interfaces desire multicast traffic by listening for IGMP traffic between routers and hosts. This stops the switch from flooding multicast traffic out all ports.

IGMP Version 1 — Hosts join a multicast group by sending a membership report to its local router. Every 60 seconds the querier router sends a messages to all-hosts 224.0.0.1 to ensure that there is a host on that network segment that is still in the group. IGMPv1 does not have a mechanism for hosts to leave a group, and it takes three query intervals (3 minutes) to stop sending multicast traffic to a segment.

IGMP Version 2 — Adds the ability for routers to query a specific multicast group, elect a querier for a segment and allows a host to send a leave group message to the all routers address 224.0.0.2. All routers start as queriers, however, if a router hears a query from another router, the router with the highest IP address on the segment becomes the querier for that segment.

Reverse Path Forwarding (RPF) — Verifies that multicast traffic flows away from the source or root and is flowing toward the branch or host.

Protocol Independent Multicast (PIM) — Allows multicast to build distribution trees regardless of the unicast routing protocol which is running such as EIGRP or OSPF.

PIM Dense Mode (PIM-DM) — Uses a source distribution tree. At first all routers receive traffic for the group, but if no host joins using IGMP the router sends a prune message so that unnecessary traffic does not continue. Most often used when recipients are on every subnet, densely populated.

PIM Sparse Mode (PIM-SM) — Uses a shared tree with a root router or rendezvous point (RP) that is not necessarily the multicast source but is usually centrally located on the network. All multicast streams go through this router, hence the name share tree or shared distribution tree. A router only joins the tree when a host has joined the multicast group. It is built opposite of dense mode, the tree is built from the leaves to the root, it is only when a host joins a multicast group that the router forwards the membership report to the RP.

PIM Sparse-Dense Mode — Allows a router to use sparse or dense-mode or both at the same time. Dense mode is used to flood RP discovery and announcement messages so that the client can find the RP and use the RP to find the multicast server.

Multicast Configuration

switch(config)# ip igmp snooping
switch(config)# ip igmp snooping vlan x

router(config)# ip multicast-routing
router(config)# ip pim {dense-mode | sparse-mode | sparse-dense-mode}
router(config)# ip pim version {1 | 2}

Multicast Troubleshooting
ip igmp join-group — Let’s a router join a group in order to test.
sh ip igmp group — Shows the groups a router has joined.
sh ip igmp interface — Shows IGMP information for each interface.

sh ip mroute
ping multicast address
sh ip pim rp
sh ip rpf

sh ip igmp group

sh ip igmp interface

sh ip mroute

ping multicast address

I added some more flashcards in the files directory. These all have a file name of tshoot-topic.csv and are for the Flashcards Deluxe iPhone app.

If you notice any errors in the cards please shoot an email or make a comment. At this point I have not downloaded all of them so there may be serious errors or formatting changes. I made them from my notes so any errors are mine.

I am not going to get into a long discussion of DHCP. I run the DNS/DHCP servers at work and have a pretty good idea of how it all works. Even though the basics are the same, BIND is a different animal than IOS.

The DCHP process from debug messages
–> DHCPD: DHCPDISCOVER received from client
<-- DHCPD: Sending DHCPOFFER to client
–> DHCPD: DHCPREQUEST received from client
<-- DHCPD: Sending DHCPACK to client

And the actual debug output.

DHCP Message Table

IOS DHCP Server Configuration
The lease command is in days. Also, the excluded-address field can be a range low to high, for instance the snippet below will exclude the range of .1 to .50 on the 10.2.1.x subnet.

DHCP Server configuration:

DHCP Helper Address
DHCP uses broadcast address because the client does not have an IP address with which to communicate. Routers do not forward broadcasts, therefore routers need to set up to forward DHCP traffic, the IP helper-address command also forwards the following protocols:
TFTP
Domain Name System (DNS)
Internet Time Service (ITS)
NetBIOS name server
NetBIOS datagram server
BootP
TACACS

An IOS router as a DHCP client:

DHCP Troubleshooting
show ip dhcp conflict
show ip dhcp binding

clear ip dhcp binding *
This is not necessarily the best command to run on a production router because you clear the addresses the router knows it has given out.
clear ip dhcp conflict *
debug ip dhcp server packet
See the listing above.
debug ip dhcp server events

sh ip dhcp pool

Additional Source:
Document ID: 27470

Definitions
NAT Types
Static NAT — A one-to-one mapping of private to public IP addresses, best used for a device that needs access from outside the AS.
Dynamic NAT — A dynamic one-to-one mapping between private and public IP addresses, however, the mapping can vary and depends upon the addresses left in the pool.
NAT Overloading — PAT, allows multiple private addresses to masquerade as one public IP address by using layer 4 port numbers to differentiate sessions.
Overlapping NAT — Used when the same subnets are in use in two locations and addresses overlap.

NAT Address Types
Inside Local — A private address referencing an inside device.
Inside Global — A public address referencing an inside device.
Outside Local — A private address referencing an outside device.
Outside Global — A public address referencing an outside device.
The TSHOOT book had a good mnemonic that helps everything else fall in place, global starts with g, it means good, good being a routable address on the internet.

Order of operation for an interface, inside to outside network.
1. Decryption of IPsec traffic
2. Input ACL applied
3. Input policing applied
4. Input accounting applied
5. Policy-based routing (PBR)
6. Redirecting traffic to a web cache
7. NAT translating local to global addresses
8. Crypto map application
9. Output ACL applied
10. Cisco IOS Firewall inspection performed
11. TCP intercept feature applied
12. Encryption performed

Order of operation for an interface, outside to inside network.
1. Decryption of IPsec traffic
2. Input ACL applied
3. Input policing applied
4. Input accounting applied
5. NAT translating global to local addresses
6. Policy Based Routing (PBR)
7. Redirecting traffic to a web cache
8. Crypto map application
9. Output ACL applied
10. Cisco IOS Firewall inspection performed
11. TCP intercept feature applied
12. Encryption performed

Troubleshoot NAT
show ip nat statistics
Displays general NAT information of the router.

sh ip nat translations
Shows the current translations on the router. These can be reset with the command clear ip nat translation *.

debug ip nat
Shows real time source and destination of NAT sessions on the router.

There are three planes of a router that need to be secured, the management plane, control plane and data plane.

Management Plane
Used to access and configure a switch or router. It is secured through SNMPv3, TACACS+, VTY ACLs and SSH. It is also a best practice to have role based CLI views.

TACACS+ and RADIUS are used in part to secure user access to the management plane, the major differences between them:

Sources:
Cisco Document ID 13838
TSHOOT Book p.287

Control plane
Includes routing protocols and spanning tree used between routers and switches, it is the ability of a router to route. The control plane can be secured by the command auto secure, routing protocol authentication, and CPU/memory thresholding.

See each routing protocol discussion for troubleshooting steps.

Securing STP
Root Guard — Is enabled on a per-port basis. When a port receives a superior BPDU, with a lower bridge ID, the local switch will not allow the new switch to become the root. Instead the port is changed to root-inconsistent state, no data can be sent or received until the BPDUs stop.

BPDU Guard — PortFast moves an end-user port to forwarding state without going through all of the STP checks and can induce loops in the network. If any BPDU is received on a port where BPDU guard is enabled that port is put into errdisable state. It can then be recovered manually or through the errdisable timeout function.

Data plane
Forwards data through a router or switch. The data plane can be secured through ACLs, 802.1x, Unicast Reverse Path Forwarding (uRPF), IPsec VPN tunnels.

Securing DHCP and ARP:
DHCP snooping — With DHCP snooping enabled a switch port is either trusted or untrusted. Any DHCP replies coming from an untrusted port are discarded because they must have come from a rogue DHCP server. Additionally that switch port is shut in the errdisable state.

Dynamic ARP Inspection (DAI) — Helps to prevent ARP spoofing attacks. DHCP snooping keeps track of completed DHCP bindings including MAC address, IP address offered and lease time. This database is used by DAI to stop man-in-the-middle style attacks.

802.1X
Port-based authentication is a combination of AAA authentication and port security. An 802.1x port begins in an unauthorized state and requires the client to authenticate before it is allowed to communicate. The three components of an 802.1x network are:
Supplicant — Device trying to gain access.
Authenticator — Acts as an intermediary (proxy) between the host and the authentication server, requesting identity information from the host, verifying that information with the authentication server, and relaying a response to the host.
Authentication Server — Performs the actual authentication of the supplicant. The authentication server validates the identity of the supplicant and notifies the switch if it is authorized to communicate on the network.
Source:
TSHOOT Book
6500 802.1X Configuration Guide

There are three general causes of router performance issues:
1. High CPU load
2. Router packet switching mode
3. Excessive memory use

Processes that can be a cause of high CPU load:
• ARP Input process — Heavy traffic load can cause a the ARP Input process to spike.
• Net Background process — If an interface has full buffers but still needs to use a globally available buffer, the Net Background process handles it. There might also be a corresponding rise in throttles, ignored and overrun parameters of the sh int command.
• IP Background process — When an interface changes state this process does the work.

Commands to troubleshoot the different processes:
sh process cpu | inc [process name] — Is there an inordinate amount of CPU usage?
sh arp — Are there too many entries in the ARP table that would cause the ARP Input process to spike?
sh int fa0/0 — Are the throttles, ignored and overrun parameters climbing?
sh ctp stat — A high connection load can result in the TCP Timer process spiking.

sh arp

sh int fa0/0 | inc thrott|ignor|over

sh tcp stat

Packet Switching Modes
• Process switching — The CPU is used to make packet switching decisions, the entire data flow is processed in the control plane. To turn on process switching issue the command no ip route-cache.
• Fast Switching — The CPU processes the first packet of a data flow, the rest are handled by the fast cache, reducing processor load. Turn on fast switching with the command ip route-cache.
• Cisco Express Forwarding (CEF) — CEF maintains the Forwarding Information Base (FIB) for layer 3 forwarding and the Adjacency Table for layer 2 next hops. The entire flow is processed in the data plane.

Packet Switching commands that look interesting to me:
sh ip int fa0/0 — Displays the packet switching mode.
sh ip cache — If fast switching is enabled it displays the fast cache.
sh ip cef — Displays the FIB contents.
sh adjacency det — Displays the adjacency table of a router if CEF is enabled.

sh ip int fa0/0 | inc IP

sh ip cache

sh ip cef

sh adj det

Troubleshoot Memory Usage
• Memory leak — When not all memory used by a process is returned to the memory pool.
• Memory allocation failure — Shows up as a MALLOCFAIL error message.
• Bufffer leak — Similar to a memory leak, a process does not return a buffer after use.
• Runaway process — A process is consuming an inordinate amount of memory.

Commands to troubleshoot memory problems
sh buffers — Check the number of free in the list.
sh processes memory sorted — What are the largest memory users?

sh buffers

sh processes memory sorted

You need to purchase Troubleshooting IP Routing Protocols.

For all of the other CCNP tests I have read two books. I enjoy the different perspective from two books and the extra reading has reinforced my understanding of the topics. Unfortunately for this exam I only had the TSHOOT Official Certification Guide and had been keeping my eyes open for another book.

I came across a recent CCIE blog post that mentioned Troubleshooting IP Routing Protocols by Aziz, Liu, Martey and Shamim. I wish I could give that guy credit because this is the best routing book I have found. I sat down to glance at the chapters and began to read a section on BGP, I was stunned by the clarity. It’s not the newest book, but it is written by four low digit CCIEs and is a great book, I have not been disappointed in a section I have read yet. Unfortunately it does not cover all of the topics of the TSHOOT exam but I am glad to have this book.

BGP is a path-vector routing protocol. Routes are tracked in terms of the AS they pass through,
and routers avoid loops by rejecting routes that have already passed through their AS.

Definitions
Synchronization — Before iBGP can propagate a route, the route must be learned from an IGP.
Split Horizon — BGP will not advertise a route out the interface from which it was learned.
Path Selection — Routers avoid loops by rejecting routes that already include their AS. BGP attributes are used to determine the best route to a destination.

BGP Attributes

Sources: BSCI p. 443 and TSHOOT P.229

BGP Updates three tables

BGP States
BGP cycles through five states as it runs:
■ Idle—Searching for neighbors
■ Connect—TCP three-way handshake complete with neighbor
■ Open Sent—BGP Open message has been sent
■ Open Confirm—Response received
■ Established—BGP neighborship is established
Remember: Established is good, anything else is bad.

Troubleshoot BGP States
■ If a neighbor does not progress from “idle,” look for a next-hop address that cannot be reached.
■ If the neighbor stays “active,” the neighbor is not responding as expected, so look for things that
affect this reply. For instance,the peering IP address or AS number may be incorrect, the neighbor may be misconfigured, or authentication may be misconfigured.
BSCI p.406, TSHOOT p.229

TSHOOT BGP
sh ip bgp summary
Helps to debug the neighbor table.

sh ip bgp neighbor
More neighbor table debugging.

sh ip bgp neigh x.x.x.x advertised-routes
This command should be in the troubleshooting list in the book but is not. It shows what advertisements you are sending to a neighbor.

sh ip bgp neigh x.x.x.x routes
Similarly this command is not discussed in the book. This command shows which routes are being received. Helps to debug the RIB.

sh ip bgp
Help to debug the RIB.

sh ip route bgp
What routes are making it from the RIB to routing table.

Debug Commands
debug ip bgp
debug ip bgp updates

My notes for EIGRP felt like I was just regurgitating the Key Points from the book. So with OSPF I read the book and looked at the command output, then decided to copy my notes from the BSCI and edit them down. In this manner I get more detail than the book, it refreshes my mind and I don’t feel like I am bored redoing the commands shown in the book. Please note, these are my notes, you got it off the web from some CCNA who is working toward a CCNP, you get the idea.

Open Shortest Path First (OSPF)
OSPF is a vendor neutral link-state routing protocol designed around the shortest path first or Dijkstra algorithm. OSPF learns all possible routes in the network and never produces routing loops.

OSPF creates three tables
1. Neighbor Table or Adjacency Database – Contains a list of recognized neighbors
2. Topology Table or LSDB – Contains all routers and their attached links the area or network. All routers in an area have Identical LSDB
3. Routing Table or Forwarding Database – Holds the best paths to destinations

Basic OSPF Operation
Exchange Hello messages to build neighbor table.
Elect DR and BDR.
Exchange LSA to build topology table.
Run SPF on topology table to build routing table.

OSPF Area Structure
OSPF uses a two-layer hierarchy.
1. Transit Area – Primary function is fast and efficient packet movement. End users are not usually found here. OSPF area 0 by definition is a transit area.
2. Regular Area – Primary function is to connect users and resources. By default a regular area does not allow transit traffic. It has a number of subtypes; standard area, stub area, totally stubby area and not-so-stubby area.

Neighorship
OSPF sends multicast hello packets to destination address 224.0.0.5. On a broadcast link hello packets are sent every 10 seconds and every 30 seconds on a nonbroadcast link. After initial hello exchange routers become neighbors as soon as they see themselves listed in the neighbor’s hello packet, this guarantees two way communication. Neighbor negotiation applies to the primary address only, secondary addresses have to belong to the same area as the primary address.

Routers must agree on the following to become neighbors:

Adjacency
Routers form an adjacency after they have synchronized their topology databases. After the hello exchange, routers proceed to the database exchange process. In order to minimize the amount of information exchange on a particular segment OSPF elects one router as the designated router (DR) and another as the backup designated router (BDR) on each multi-access segment. Instead of routers having to exchange information with every other router in the segment, they only have to exchange information with the DR and BDR. The DR and BDR relay information to all the other routers.

In mathematical terms this cuts communication from O(n*n) to O(n) where n is the number of routers on a segment. Each router tries to establish adjacency with the DR and BDR.

Building the Adjacency

Adjacency States:
The following are the states of an interface in the process of becoming adjacent to another router.

DR Election
OSPF routers on a LAN segment elects one DR and BDR, all other routers on that segment form full adjacencies with these two routers and pass LSAs only to them. The router with the highest OSPF priority on a segment will become the DR for that segment. Priority can be set from 0 – 255 with the default priority being 1 and a priority of 0 prevents the router from being elected.

OSPF Multicast Addresses:
224.0.0.5 goes to all OSPF routers.
224.0.0.6 goes to the DR and BDR.

Link State Advertisement (LSA)
LSAs are reliable, delivery is acknowledged they also have a sequence number and a set lifetime, so that each router recognizes that it has the most current link state database.

OSPF Network Types
The TSHOOT book did a much better job than my notes summarizing the OSPF network types.

TSHOOT p. 176

sh ip route meanings

Commands to verify OSPF configuration:
sh ip ospf int [br]
From the output you can see that this command give a good overview of “who” is on the other end of an interface. When the brief option is on it gives a summation of the interfaces active in OSPF and their neighbors. This is intended to help debug the interface table.

sh ip ospf neighbor
Intended to help debug the neighbor table of OSPF.

sh ip ospf database
Shows the LSA headers contained in the link state database. Router Link States come from Type 1 LSAs and Net Link States come from Type 2 LSAs.

sh ip ospf statistics
Shows the last time SPF algorithm was run, how often and the reason.

sh ip ospf border-routers
Who is sending what type of LSA?

sh ip route ospf
Shows what routes are being advertised through OSPF.

Commands to debug OSPF:
log-adjacency-changes
debug ip packet
debug ip ospf events
Watch the OSPF process in real time.