Configuring a Basic MPLS PE Router
Problem
You want to configure a Provider Edge (PE) router to connect your MPLS core to a customer network.
Solution
To configure a PE router, you must set up connections to the MPLS core as well as to one or more customer networks. Further, to distribute customer VRF routing information to other PE routers, you must configure MP-BGP:
Router-PE1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router-PE1(config)#ip cef Router-PE1(config)#mpls ip Router-PE1(config)#interface Serial0/0 Router-PE1(config-if)#description Connection to Router-P1 Router-PE1(config-if)#ip address 10.1.1.13 255.255.255.252 Router-PE1(config-if)#mpls ip Router-PE1(config-if)#exit Router-PE1(config)#interface Loopback0 Router-PE1(config-if)#ip address 10.0.0.2 255.255.255.255 Router-PE1(config-if)#exit Router-PE1(config)#router ospf 99 Router-PE1(config-router)#router-id 10.0.0.2 Router-PE1(config-router)#network 10.0.0.0 0.255.255.255 area 0 Router-PE1(config-router)#exit Router-PE1(config)#ip vrf NetworkA Router-PE1(config-vrf)#rd 100:1 Router-PE1(config-vrf)#route-target export 100:1 Router-PE1(config-vrf)#route-target import 100:1 Router-PE1(config-vrf)#exit Router-PE1(config)#ip vrf NetworkB Router-PE1(config-vrf)#rd 100:2 Router-PE1(config-vrf)#route-target export 100:2 Router-PE1(config-vrf)#route-target import 100:2 Router-PE1(config-vrf)#exit Router-PE1(config)#interface Ethernet0/0 Router-PE1(config-if)#description connection to customer A, site 1 Router-PE1(config-if)#ip vrf forwarding NetworkA Router-PE1(config-if)#ip address 192.168.1.1 255.255.255.0 Router-PE1(config-if)#exit Router-PE1(config)#interface Ethernet0/1 Router-PE1(config-if)#description connection to customer B, site 1 Router-PE1(config-if)#ip vrf forwarding NetworkB Router-PE1(config-if)#ip address 192.168.11.1 255.255.255.0 Router-PE1(config-if)#exit Router-PE1(config)#router bgp 100 Router-PE1(config-router)#bgp log-neighbor-changes Router-PE1(config-router)#neighbor 10.0.0.3 remote-as 100 Router-PE1(config-router)#neighbor 10.0.0.3 update-source Loopback0 Router-PE1(config-router)#neighbor 10.0.0.4 remote-as 100 Router-PE1(config-router)#neighbor 10.0.0.4 update-source Loopback0 Router-PE1(config-router)#address-family ipv4 vrf NetworkA Router-PE1(config-router-af)#no auto-summary Router-PE1(config-router-af)#no synchronization Router-PE1(config-router-af)#redistribute connected Router-PE1(config-router-af)#exit-address-family Router-PE1(config-router)#adress-family ipv4 vrf NetworkB Router-PE1(config-router-af)#no auto-summary Router-PE1(config-router-af)#no synchronization Router-PE1(config-router-af)#redistribute connected Router-PE1(config-router-af)#exit-address-family Router-PE1(config-router)#address-family vpnv4 Router-PE1(config-router-af)#neighbor 10.0.0.3 activate Router-PE1(config-router-af)#neighbor 10.0.0.3 send-community extended Router-PE1(config-router-af)#neighbor 10.0.0.4 activate Router-PE1(config-router-af)#neighbor 10.0.0.4 send-community extended Router-PE1(config-router-af)#exit-address-family Router-PE1(config-router)#exit Router-PE1(config)#end Router-PE1#
We will also show the configuration for the other two PE routers for reference:
Router-PE2#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router-PE2(config)#ip cef Router-PE2(config)#mpls ip Router-PE2(config)#interface FastEthernet0/0 Router-PE2(config-if)#no ip address Router-PE2(config-if)#exit Router-PE2(config)#interface FastEthernet0/0.1 Router-PE2(config-if)#description Connection to Router-P1 Router-PE2(config-if)#encapsulation dot1Q 10 Router-PE2(config-if)#ip address 10.1.2.4 255.255.255.0 Router-PE2(config-if)#mpls ip Router-PE2(config-if)#exit Router-PE2(config)#interface Loopback0 Router-PE2(config-if)#ip address 10.0.0.3 255.255.255.255 Router-PE2(config-if)#exit Router-PE2(config)#router ospf 99 Router-PE2(config-router)#router-id 10.0.0.3 Router-PE2(config-router)#network 10.0.0.0 0.255.255.255 area 0 Router-PE2(config-router)#exit Router-PE2(config)#ip vrf NetworkA Router-PE2(config-vrf)#rd 100:1 Router-PE2(config-vrf)#route-target export 100:1 Router-PE2(config-vrf)#route-target import 100:1 Router-PE2(config-vrf)#exit Router-PE2(config)#ip vrf NetworkB Router-PE2(config-vrf)#rd 100:2 Router-PE2(config-vrf)#route-target export 100:2 Router-PE2(config-vrf)#route-target import 100:2 Router-PE2(config-vrf)#exit Router-PE2(config)#interface FastEthernet0/0.2 Router-PE2(config-if)#description Connection to customer A, site 2 Router-PE2(config-if)#encapsulation dot1Q 102 Router-PE2(config-if)#ip address 192.168.3.1 255.255.255.0 Router-PE2(config-if)#mpls ip Router-PE2(config-if)#exit Router-PE2(config)#router bgp 100 Router-PE2(config-router)#bgp log-neighbor-changes Router-PE2(config-router)#neighbor 10.0.0.2 remote-as 100 Router-PE2(config-router)#neighbor 10.0.0.2 update-source Loopback0 Router-PE2(config-router)#neighbor 10.0.0.3 remote-as 100 Router-PE2(config-router)#neighbor 10.0.0.3 update-source Loopback0 Router-PE2(config-router)#address-family ipv4 vrf NetworkA Router-PE2(config-router-af)#no auto-summary Router-PE2(config-router-af)#no synchronization Router-PE2(config-router-af)#redistribute connected Router-PE2(config-router-af)#exit-address-family Router-PE2(config-router)#address-family vpnv4 Router-PE2(config-router-af)#neighbor 10.0.0.2 activate Router-PE2(config-router-af)#neighbor 10.0.0.2 send-community extended Router-PE2(config-router-af)#neighbor 10.0.0.4 activate Router-PE2(config-router-af)#neighbor 10.0.0.4 send-community extended Router-PE2(config-router-af)#exit-address-family Router-PE2(config-router)#exit Router-PE2(config)#end Router-PE2#
The third PE router looks like this:
Router-PE3#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router-PE3(config)#ip cef Router-PE3(config)#mpls ip Router-PE3(config)#interface Serial0/0 Router-PE3(config-if)#description Connection to Router-P1 Router-PE3(config-if)#ip address 10.1.1.9 255.255.255.252 Router-PE3(config-if)#mpls ip Router-PE3(config-if)#exit Router-PE3(config)#interface Loopback0 Router-PE3(config-if)#ip address 10.0.0.3 255.255.255.255 Router-PE3(config-if)#exit Router-PE3(config)#router ospf 99 Router-PE3(config-router)#router-id 10.0.0.3 Router-PE3(config-router)#network 10.0.0.0 0.255.255.255 area 0 Router-PE3(config-router)#exit Router-PE3(config)#ip vrf NetworkA Router-PE3(config-vrf)#rd 100:1 Router-PE3(config-vrf)#route-target export 100:1 Router-PE3(config-vrf)#route-target import 100:1 Router-PE3(config-vrf)#exit Router-PE3(config)#ip vrf NetworkB Router-PE3(config-vrf)#rd 100:2 Router-PE3(config-vrf)#route-target export 100:2 Router-PE3(config-vrf)#route-target import 100:2 Router-PE3(config-vrf)#exit Router-PE3(config)#interface Ethernet0/0 Router-PE3(config-if)#description connection to customer A, site 3 Router-PE3(config-if)#ip vrf forwarding NetworkA Router-PE3(config-if)#ip address 192.168.2.1 255.255.255.0 Router-PE3(config-if)#exit Router-PE3(config)#interface Ethernet0/1 Router-PE3(config-if)#description connection to customer B, site 2 Router-PE3(config-if)#ip vrf forwarding NetworkB Router-PE3(config-if)#ip address 192.168.10.1 255.255.255.0 Router-PE3(config-if)#exit Router-PE3(config)#router bgp 100 Router-PE3(config-router)#bgp log-neighbor-changes Router-PE3(config-router)#neighbor 10.0.0.2 remote-as 100 Router-PE3(config-router)#neighbor 10.0.0.2 update-source Loopback0 Router-PE3(config-router)#neighbor 10.0.0.4 remote-as 100 Router-PE3(config-router)#neighbor 10.0.0.4 update-source Loopback0 Router-PE3(config-router)#address-family ipv4 vrf NetworkA Router-PE3(config-router-af)#no auto-summary Router-PE3(config-router-af)#no synchronization Router-PE3(config-router-af)#redistribute connected Router-PE3(config-router-af)#exit-address-family Router-PE3(config-router)#adress-family ipv4 vrf NetworkB Router-PE3(config-router-af)#no auto-summary Router-PE3(config-router-af)#no synchronization Router-PE3(config-router-af)#redistribute connected Router-PE3(config-router-af)#exit-address-family Router-PE3(config-router)#address-family vpnv4 Router-PE3(config-router-af)#neighbor 10.0.0.2 activate Router-PE3(config-router-af)#neighbor 10.0.0.2 send-community extended Router-PE3(config-router-af)#neighbor 10.0.0.4 activate Router-PE3(config-router-af)#neighbor 10.0.0.4 send-community extended Router-PE3(config-router-af)#exit-address-family Router-PE3(config-router)#exit Router-PE3(config)#end Router-PE3#
Discussion
This is a rather long configuration, but it divides up rather naturally into a few basic components.
First, we have configured the basic MPLS functionality:
Router-PE1(config)#ip cef Router-PE1(config)#mpls ip Router-PE1(config)#interface Serial0/0 Router-PE1(config-if)#description Connection to Router-P1 Router-PE1(config-if)#ip address 10.1.1.13 255.255.255.252 Router-PE1(config-if)#mpls ip Router-PE1(config-if)#exit Router-PE1(config)#interface Loopback0 Router-PE1(config-if)#ip address 10.0.0.2 255.255.255.255 Router-PE1(config-if)#exit Router-PE1(config)#router ospf 99 Router-PE1(config-router)#router-id 10.0.0.2 Router-PE1(config-router)#network 10.0.0.0 0.255.255.255 area 0 Router-PE1(config-router)#exit
Notice that this section of configuration is extremely similar to how we configured the P router in Recipe 26.1.
The next chunk of the router's configuration defines the VPNs. We have created two customer networks called NetworkA and NetworkB. Let's look at the first of these in more detail:
Router-PE1(config)#ip vrf NetworkA Router-PE1(config-vrf)#rd 100:1 Router-PE1(config-vrf)#route-target export 100:1 Router-PE1(config-vrf)#route-target import 100:1 Router-PE1(config-vrf)#exit
The first line defines the name of the VRF, in this case NetworkA. Then the rd command defines a " route descriptor" for this VRF. This is really just a numerical tag that MP-BGP will use when propagating the routes associated with this VPN.
The route-target commands then tell MP-BGP which route descriptors to share its routes with. There can only be one route descriptor in a VRF definition, but you can freely share routes among several different route targets. In most cases, however, you will actually want to keep the routes confined to a particular VRF, as we have done in the example.
The route descriptor value is a 48-bit number that is conventionally written in two different ways. We have written the value as 100:1, which is a 16-bit BGP Autonomous System Number (ASN), followed by an arbitrary 32-bit number identifying the client network. The other way to write this value is as a 32-bit dotted decimal value (like an IP address) followed by an arbitrary 16 bit valuefor example, 192.168.1.1:100.
MP-BGP then uses these values as a tag that it adds to the client routing prefixes. It's important to note that although it is a good idea to make these RD values meaningful, to MP-BGP they are just a sequence of bits. As long as they are consistent throughout your network, you can use whatever values are meaningful to you. It is not necessary, for example, to make the ASN identical with the BGP ASN, as we have done in this recipe. However, this is often a good practice, particularly if your MPLS network includes multiple ASNs that must be kept straight.
We note also that you can deliberately "leak" routes between VRFs as follows:
Router-PE1(config)#ip vrf NetworkA Router-PE1(config-vrf)#rd 100:1 Router-PE1(config-vrf)#route-target export 100:1 Router-PE1(config-vrf)#route-target import 100:1 Router-PE1(config-vrf)#route-target export 100:2 Router-PE1(config-vrf)#route-target import 100:2 Router-PE1(config-vrf)#exit
This is sometimes used by service providers to ensure that their network management VLAN can access customer networks. However, most of the time you want to keep the VRFs separated.
Next we associate the VRF instances with physical interfaces:
Router-PE1(config)#interface Ethernet0/0 Router-PE1(config-if)#description connection to customer A, site 1 Router-PE1(config-if)#ip vrf forwarding NetworkA Router-PE1(config-if)#ip address 192.168.1.1 255.255.255.0 Router-PE1(config-if)#exit
|
The IP address in this case is part of the VRF for this customer network. Consequently, devices inside the customer network will be able to PING and route to this address. If this were a real customer and service provider, it would be critical to secure this interface to prevent users from using TELNET or other protocols to gain access to the provider network.
Note also that because two customers could well be using the same IP addresses, the ip vrf forwarding command allows you to configure overlapping or even duplicate IP addresses on the PE router, provided the interfaces with conflicting addresses belong to different VRFs.
Notice that we have created the same VRFs on all three PE routers, even though NetworkB only appears on two of them. This VRF is not assigned to any physical interface. You can see which interfaces are associated with each VRF:
Router-PE1#show ip vrf Name Default RD Interfaces NetworkA 100:1 Ethernet0/0 NetworkB 100:2 Ethernet0/1 Router-PE1#
If a particular VRF is not assigned to any interface, this command will list it in the output but leave the interface column blank:
Router-PE2#show ip vrf Name Default RD Interfaces NetworkA 100:1 FastEthernet0/0.2 NetworkB 100:2 Router-PE2#
The next section of the PE configuration shows the MP-BGP configuration:
Router-PE1(config)#router bgp 100 Router-PE1(config-router)#bgp log-neighbor-changes Router-PE1(config-router)#neighbor 10.0.0.3 remote-as 100 Router-PE1(config-router)#neighbor 10.0.0.3 update-source Loopback0 Router-PE1(config-router)#neighbor 10.0.0.4 remote-as 100 Router-PE1(config-router)#neighbor 10.0.0.4 update-source Loopback0 Router-PE1(config-router)#address-family ipv4 vrf NetworkA Router-PE1(config-router-af)#no auto-summary Router-PE1(config-router-af)#no synchronization Router-PE1(config-router-af)#redistribute connected Router-PE1(config-router-af)#exit-address-family Router-PE1(config-router)#adress-family ipv4 vrf NetworkB Router-PE1(config-router-af)#no auto-summary Router-PE1(config-router-af)#no synchronization Router-PE1(config-router-af)#redistribute connected Router-PE1(config-router-af)#exit-address-family Router-PE1(config-router)#address-family vpnv4 Router-PE1(config-router-af)#neighbor 10.0.0.3 activate Router-PE1(config-router-af)#neighbor 10.0.0.3 send-community extended Router-PE1(config-router-af)#neighbor 10.0.0.4 activate Router-PE1(config-router-af)#neighbor 10.0.0.4 send-community extended Router-PE1(config-router-af)#exit-address-family Router-PE1(config-router)#exit
First we define all of the BGP peer relationships in the usual way:
Router-PE1(config)#router bgp 100 Router-PE1(config-router)#neighbor 10.0.0.3 remote-as 100 Router-PE1(config-router)#neighbor 10.0.0.3 update-source Loopback0
The peer devices indicated are the other PE routers in this network. Since the Remote-AS indicated for each of the peers is the same as this router's BGP AS, they are all internal or iBGP peer relationships. IBGP peer relationships are required because MP-BGP distributes VRF information using extended BGP communities. If you need to break up your BGP network into more than one AS, you can do so, but you must take care to redistribute the VRF tables between the ASBR devices.
The other common way of handling the inherent scaling problems of large numbers of BGP peers in MPLS networks is to use Route Reflectors. We discuss Route Reflectors in Chapter 9.
For improved network stability, we prefer to identify all of our peer IP address with Loopback interfaces rather than physical interfaces. This way, if your PE router has multiple connection points into your MPLS core, a physical failure on one interface won't bring down the network.
Next we must tell MP-BGP about the VRF information that we want it to carry between the PE routers:
Router-PE1(config-router)#address-family ipv4 vrf NetworkA Router-PE1(config-router-af)#no auto-summary Router-PE1(config-router-af)#no synchronization Router-PE1(config-router-af)#redistribute connected Router-PE1(config-router-af)#exit-address-family
In this case, the only interface on this router is a member of the VRF that we have called NetworkA is Ethernet0/0, which has an IP address of 192.168.1.1/24. We chose to include this interface using the redistribute connected command. Usually in BGP networks we prefer to use a network command rather than redistributing connected routes because it will result in a better Origin code. However, MP-BGP doesn't treat redistributed routes in the same way, as we will see later in this chapter. Consequently, the redistribute connected command is actually the most convenient way of making sure that every interface associated with this VRF is automatically included in the routing table.
We note in passing that you exit from the address-family configuration block using the command exit-address-family rather than the simple exit command that Cisco usually uses for this purpose. The short form works, but the router will replace it with the long form in the configuration file. We don't know why this is.
Finally, the last section of the configuration example is necessary to allow MP-BGP to carry the VRF routing prefixes:
Router-PE1(config-router)#address-family vpnv4 Router-PE1(config-router-af)#neighbor 10.0.0.3 activate Router-PE1(config-router-af)#neighbor 10.0.0.3 send-community extended Router-PE1(config-router-af)#neighbor 10.0.0.4 activate Router-PE1(config-router-af)#neighbor 10.0.0.4 send-community extended Router-PE1(config-router-af)#exit-address-family
The critical command here is send-community extended, which tells MP-BGP to use extended communities.
You can verify basic MPLS connectivity for the connection between the PE and P routers by using the show mpls interfaces command, as we did in Recipe 26.1:
Router-PE1#show mpls interfaces Interface IP Tunnel Operational Serial0/0 Yes No Yes Router-PE1#
And you can see the contents of your VRF tables as follows:
Router-PE1#show ip route vrf NetworkA Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 10.0.0.0/32 is subnetted, 1 subnets B 10.8.8.8 [200/4] via 10.0.0.4, 02:15:54 C 192.168.1.0/24 is directly connected, Ethernet0/0 B 192.168.2.0/24 [200/0] via 10.0.0.3, 02:16:08 B 192.168.3.0/24 [200/0] via 10.0.0.4, 02:15:54 Router-PE1#
It is sometimes useful to be able to do PING tests through a customer VLAN. You can do this from your PE routers, although you must take care to specify a source address that is also part of this VRF:
Router-PE1#ping vrf NetworkA 192.168.2.9 source 192.168.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.2.9, timeout is 2 seconds: Packet sent with a source address of 192.168.1.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms Router-PE1#
In this case, the destination address is a CE router at a different site.
See Also
Recipe 26.1; Chapter 8; Chapter 9
Router Configuration and File Management
- Configuring the Router via TFTP
- Saving Router Configuration to Server
- Booting the Router Using a Remote Configuration File
- Storing Configuration Files Larger Than NVRAM
- Clearing the Startup Configuration
- Loading a New IOS Image
- Booting a Different IOS Image
- Booting over the Network
- Copying an IOS Image to a Server
- Copying an IOS Image Through the Console
- Deleting Files from Flash
- Partitioning Flash
- Using the Router as a TFTP Server
- Using FTP from the Router
- Generating Large Numbers of Router Configurations
- Changing the Configurations of Many Routers at Once
- Extracting Hardware Inventory Information
- Backing Up Router Configurations
- Warm Reload
- Warm Upgrade
- Configuration Archiving
- Locking Configuration Access
Router Management
- Creating Command Aliases
- Managing the Routers ARP Cache
- Tuning Router Buffers
- Auto Tuning Buffers
- Using the Cisco Discovery Protocol
- Disabling the Cisco Discovery Protocol
- Using the Small Servers
- Enabling HTTP Access to a Router
- Enabling Secure HTTP (HTTPS) Access to a Router
- Using Static Hostname Tables
- Enabling Domain Name Services
- Disabling Domain Name Lookups
- Specifying a Router Reload Time
- Scheduling of Router Commands
- Displaying Historical CPU Values
- Creating Exception Dump Files
- Generating a Report of Interface Information
- Generating a Report of Routing Table Information
- Generating a Report of ARP Table Information
- Generating a Server Host Table File
User Access and Privilege Levels
- Setting Up User IDs
- Encrypting Passwords
- Using Better Password-Encryption Techniques
- Removing Passwords from a Router Configuration File
- Deciphering Ciscos Weak Password Encryption
- Displaying Active Users
- Sending Messages to Other Users
- Changing the Number of VTYs
- Changing VTY Timeouts
- Restricting VTY Access by Protocol
- Enabling Absolute Timeouts on VTY Lines
- Implementing Banners
- Disabling Banners on a Port
- Disabling Router Lines
- Reserving a VTY Port for Administrative Access
- Restricting Inbound Telnet Access
- Logging Telnet Access
- Setting the Source Address for Telnet
- Automating the Login Sequence
- Using SSH for Secure Access
- Changing Privilege Level of IOS Commands
- Defining Per User Privileges
- Defining Per Port Privileges
TACACS+
- Authenticating Login IDs from a Central System
- Restricting Command Access
- Losing Access to the TACACS+ Server
- Disabling TACACS+ Authentication on a Particular Line
- Capturing User Keystrokes
- Logging System Events
- Setting the IP Source Address for TACACS+ Messages
- Sample Server Configuration Files
IP Routing
- Finding an IP Route
- Finding Types of IP Routes
- Converting Different Mask Formats
- Using Static Routing
- Floating Static Routes
- Using Policy-Based Routing to Route Based on Source Address
- Using Policy-Based Routing to Route Based on Application Type
- Examining Policy-Based Routing
- Changing Administrative Distances
- Routing Over Multiple Paths with Equal Costs
- Static Routes That Track Interfaces or Other Routes
- Keeping Statistics on Routing Table Changes
RIP
- Configuring RIP Version 1
- Filtering Routes with RIP
- Redistributing Static Routes into RIP
- Redistributing Routes Using Route Maps
- Creating a Default Route in RIP
- Disabling RIP on an Interface
- Default Passive Interface
- Unicast Updates for RIP
- Applying Offsets to Routes
- Adjusting Timers
- Configuring Interpacket Delay
- Enabling Nonperiodic Updates
- Increasing the RIP Input Queue
- Configuring RIP Version 2
- Enabling RIP Authentication
- RIP Route Summarization
- Route Tagging
EIGRP
- Configuring EIGRP
- Filtering Routes with EIGRP
- Redistributing Routes into EIGRP
- Redistributing Routes into EIGRP Using Route Maps
- Disabling EIGRP on an Interface
- Adjusting EIGRP Metrics
- Adjusting Timers
- Enabling EIGRP Authentication
- EIGRP Route Summarization
- Logging EIGRP Neighbor State Changes
- Limiting EIGRPs Bandwidth Utilization
- EIGRP Stub Routing
- Route Tagging
- Viewing EIGRP Status
OSPF
- Configuring OSPF
- Filtering Routes in OSPF
- Adjusting OSPF Costs
- Creating a Default Route in OSPF
- Redistributing Static Routes into OSPF
- Redistributing External Routes into OSPF
- Manipulating DR Selection
- Setting the OSPF RID
- Enabling OSPF Authentication
- Selecting the Appropriate Area Types
- Using OSPF on Dial Interfaces
- Summarizing Routes in OSPF
- Disabling OSPF on Certain Interfaces
- Changing the Network Type on an Interface
- OSPF Route Tagging
- Logging OSPF Adjacency Changes
- Adjusting OSPF Timers
- Reducing OSPF Traffic in Stable Networks
- OSPF Virtual Links
- Viewing OSPF Status with Domain Names
- Debugging OSPF
BGP
- Configuring BGP
- Using eBGP Multihop
- Adjusting the Next-Hop Attribute
- Connecting to Two ISPs
- Connecting to Two ISPs with Redundant Routers
- Restricting Networks Advertised to a BGP Peer
- Adjusting Local Preference Values
- Load-Balancing
- Removing Private ASNs from the AS Path
- Filtering BGP Routes Based on AS Paths
- Reducing the Size of the Received Routing Table
- Summarizing Outbound Routing Information
- Prepending ASNs to the AS Path
- Redistributing Routes with BGP
- Using Peer Groups
- Authenticating BGP Peers
- Using BGP Communities
- Using BGP Route Reflectors
- Putting It All Together
Frame Relay
- Setting Up Frame Relay with Point-to-Point Subinterfaces
- Adjusting LMI Options
- Setting Up Frame Relay with Map Statements
- Using Multipoint Subinterfaces
- Configuring Frame Relay SVCs
- Simulating a Frame Relay Cloud
- Compressing Frame Relay Data on a Subinterface
- Compressing Frame Relay Data with Maps
- PPP over Frame Relay
- Viewing Frame Relay Status Information
Handling Queuing and Congestion
- Fast Switching and CEF
- Setting the DSCP or TOS Field
- Using Priority Queuing
- Using Custom Queuing
- Using Custom Queues with Priority Queues
- Using Weighted Fair Queuing
- Using Class-Based Weighted Fair Queuing
- Using NBAR Classification
- Controlling Congestion with WRED
- Using RSVP
- Manual RSVP Reservations
- Aggregating RSVP Reservations
- Using Generic Traffic Shaping
- Using Frame-Relay Traffic Shaping
- Using Committed Access Rate
- Implementing Standards-Based Per-Hop Behavior
- AutoQoS
- Viewing Queue Parameters
Tunnels and VPNs
- Creating a Tunnel
- Tunneling Foreign Protocols in IP
- Tunneling with Dynamic Routing Protocols
- Viewing Tunnel Status
- Creating an Encrypted Router-to-Router VPN in a GRE Tunnel
- Creating an Encrypted VPN Between the LAN Interfaces of Two Routers
- Generating RSA Keys
- Creating a Router-to-Router VPN with RSA Keys
- Creating a VPN Between a Workstation and a Router
- Creating an SSL VPN
- Checking IPSec Protocol Status
Dial Backup
- Automating Dial Backup
- Using Dialer Interfaces
- Using an Async Modem on the AUX Port
- Using Backup Interfaces
- Using Dialer Watch
- Using Virtual Templates
- Ensuring Proper Disconnection
- View Dial Backup Status
- Debugging Dial Backup
NTP and Time
- Time-Stamping Router Logs
- Setting the Time
- Setting the Time Zone
- Adjusting for Daylight Saving Time
- Synchronizing the Time on All Routers (NTP)
- Configuring NTP Redundancy
- Setting the Router As the NTP Master for the Network
- Changing NTP Synchronization Periods
- Using NTP to Send Periodic Broadcast Time Updates
- Using NTP to Send Periodic Multicast Time Updates
- Enabling and Disabling NTP Per Interface
- NTP Authentication
- Limiting the Number of Peers
- Restricting Peers
- Setting the Clock Period
- Checking the NTP Status
- Debugging NTP
- NTP Logging
- Extended Daylight Saving Time
- NTP Server Configuration
DLSw
- Simple Bridging
- Configuring DLSw
- Using DLSw to Bridge Between Ethernet and Token Ring
- Converting Ethernet and Token Ring MAC Addresses
- Configuring SDLC
- Configuring SDLC for Multidrop Connections
- Using STUN
- Using BSTUN
- Controlling DLSw Packet Fragmentation
- Tagging DLSw Packets for QoS
- Supporting SNA Priorities
- DLSw+ Redundancy and Fault Tolerance
- Viewing DLSw Status Information
- Viewing SDLC Status Information
- Debugging DSLw
Router Interfaces and Media
- Viewing Interface Status
- Configuring Serial Interfaces
- Using an Internal T1 CSU/DSU
- Using an Internal ISDN PRI Module
- Using an Internal 56 Kbps CSU/DSU
- Configuring an Async Serial Interface
- Configuring ATM Subinterfaces
- Setting Payload Scrambling on an ATM Circuit
- Classical IP Over ATM
- Configuring Ethernet Interface Features
- Configuring Token Ring Interface Features
- Connecting VLAN Trunks with ISL
- Connecting VLAN Trunks with 802.1Q
- LPD Printer Support
Simple Network Management Protocol
- Configuring SNMP
- Extracting Router Information via SNMP Tools
- Recording Important Router Information for SNMP Access
- Using SNMP to Extract Inventory Information from a List of Routers
- Using Access Lists to Protect SNMP Access
- Logging Unauthorized SNMP Attempts
- Limiting MIB Access
- Using SNMP to Modify a Routers Running Configuration
- Using SNMP to Copy a New IOS Image
- Using SNMP to Perform Mass Configuration Changes
- Preventing Unauthorized Configuration Modifications
- Making Interface Table Numbers Permanent
- Enabling SNMP Traps and Informs
- Sending Syslog Messages As SNMP Traps and Informs
- Setting SNMP Packet Size
- Setting SNMP Queue Size
- Setting SNMP Timeout Values
- Disabling Link Up/Down Traps per Interface
- Setting the IP Source Address for SNMP Traps
- Using RMON to Send Traps
- Enabling SNMPv3
- Strong SNMPv3 Encryption
- Using SAA
Logging
- Enabling Local Router Logging
- Setting the Log Size
- Clearing the Routers Log
- Sending Log Messages to Your Screen
- Using a Remote Log Server
- Enabling Syslog on a Unix Server
- Changing the Default Log Facility
- Restricting What Log Messages Are Sent to the Server
- Setting the IP Source Address for Syslog Messages
- Logging Router Syslog Messages in Different Files
- Maintaining Syslog Files on the Server
- Testing the Syslog Sever Configuration
- Preventing the Most Common Messages from Being Logged
- Rate-Limiting Syslog Traffic
- Enabling Error Log Counting
- XML-Formatted Log Messages
- Modifying Log Messages
Access-Lists
- Filtering by Source or Destination IP Address
- Adding a Comment to an ACL
- Filtering by Application
- Filtering Based on TCP Header Flags
- Restricting TCP Session Direction
- Filtering Multiport Applications
- Filtering Based on DSCP and TOS
- Logging When an Access-List Is Used
- Logging TCP Sessions
- Analyzing ACL Log Entries
- Using Named and Reflexive Access-Lists
- Dealing with Passive Mode FTP
- Using Time-Based Access-Lists
- Filtering Based on Noncontiguous Ports
- Advanced Access-List Editing
- Filtering IPv6
DHCP
- Using IP Helper Addresses for DHCP
- Limiting the Impact of IP Helper Addresses
- Using DHCP to Dynamically Configure Router IP Addresses
- Dynamically Allocating Client IP Addresses via DHCP
- Defining DHCP Configuration Options
- Defining DHCP Lease Periods
- Allocating Static IP Addresses with DHCP
- Configuring a DHCP Database Client
- Configuring Multiple DHCP Servers per Subnet
- DHCP Static Mapping
- DHCP-Secured IP Address Assignment
- Showing DHCP Status
- Debugging DHCP
NAT
- Configuring Basic NAT Functionality
- Allocating External Addresses Dynamically
- Allocating External Addresses Statically
- Translating Some Addresses Statically and Others Dynamically
- Using Route Maps to Refine Static Translation Rules
- Translating in Both Directions Simultaneously
- Rewriting the Network Prefix
- Using NAT for Server Load Distribution
- Stateful NAT Failover
- Adjusting NAT Timers
- Changing TCP Ports for FTP
- Checking NAT Status
- Debugging NAT
First Hop Redundancy Protocols
- Configuring Basic HSRP Functionality
- Using HSRP Preempt
- Making HSRP React to Problems on Other Interfaces
- Load-Balancing with HSRP
- Redirecting ICMP with HSRP
- Manipulating HSRP Timers
- Using HSRP on Token Ring
- HSRP SNMP Support
- Increasing HSRP Security
- Showing HSRP State Information
- Debugging HSRP
- HSRP Version 2
- VRRP
- Gateway Load-Balancing Protocol
IP Multicast
- Configuring Basic Multicast Functionality with PIM-DM
- Routing Multicast Traffic with PIM-SM and BSR
- Routing Multicast Traffic with PIM-SM and Auto-RP
- Filtering PIM Neighbors
- Configuring Routing for a Low-Frequency Multicast Application
- Multicast over Frame Relay or ATM WANs
- Configuring CGMP
- Using IGMP Version 3
- Static Multicast Routes and Group Memberships
- Routing Multicast Traffic with MOSPF
- Routing Multicast Traffic with DVMRP
- DVMRP Tunnels
- Configuring Bidirectional PIM
- Controlling Multicast Scope with TTL
- Controlling Multicast Scope with Administratively Scoped Addressing
- Exchanging Multicast Routing Information with MBGP
- Using MSDP to Discover External Sources
- Configuring Anycast RP
- Converting Broadcasts to Multicasts
- Showing Multicast Status
- Debugging Multicast Routing
IP Mobility
- Local Area Mobility
- Home Agent Configuration
- Foreign Agent Configuration
- Making a Router a Mobile Node
- Reverse-Tunnel Forwarding
- Using HSRP for Home Agent Redundancy
IPv6
- Automatically Generating IPv6 Addresses for an Interface
- Manually Configuring IPv6 Addresses on an Interface
- Configuring DHCP for IPv6
- Dynamic Routing with RIP
- Modifying the Default RIP Parameters
- IPv6 Route Filtering and Metric Manipulation in RIP
- Using OSPF for IPv6
- IPv6 Route Filtering and Metric Manipulation in OSPF
- Route Redistribution
- Dynamic Routing with MBGP
- Tunneling IPv6 Through an Existing IPv4 Network
- Translating Between IPv6 and IPv4
MPLS
- Configuring a Basic MPLS P Router
- Configuring a Basic MPLS PE Router
- Configuring Basic MPLS CE Routers
- Configuring MPLS over ATM
- PE-CE Communication via RIP
- PE-CE Communication via OSPF
- PE-CE Communication via EIGRP
- PE-CE Communication via BGP
- QoS over MPLS
- MPLS Traffic Engineering with Autoroute
- Multicast Over MPLS
- Your Service Provider Doesnt Do What You Want
Security
- Using AutoSecure
- Using Context-Based Access-Lists
- Transparent Cisco IOS Firewall
- Stopping Denial of Service Attacks
- Inspecting Applications on Different Port Numbers
- Intrusion Detection and Prevention
- Login Password Retry Lockout
- Authentication Proxy
Appendix 1. External Software Packages
Appendix 2. IP Precedence, TOS, and DSCP Classifications
- IP Precedence, TOS, and DSCP Classifications
- Queueing Algorithms
- Dropping Packets and Congestion Avoidance
Index
EAN: 2147483647
Pages: 505
