cisco - The Network Stack (Page 2)

IP SLA, Track Lists and Route Tracking

IP SLA is a powerful tool, which I will only scratch the surface of in this post in regards to route tracking. I had a scenario where the primary default route should be removed if the internet was no longer accessible through the primary interface. This can be achieved with

cisco

Cisco 3560-X Password Reset

1. Unplug Cisco 3560-X power 2. Hold down "Mode" button on front, and plug in power 3. Continue to hold "Mode" for about 15 seconds, until the SYST LED turns solid green, then release 4. Log into the switch via console, you should see the "switch:" prompt 5. Enter the

cisco

Cisco Show Command for ACL Interfaces

While browsing networkengineering.stackexchange.com, I came across an interesting post regarding easily finding interfaces in a config that have an ACL applied. The thread is found here, and the command is as follows (credit goes to @Santino from the thread): show ip interface | include line protocol|access list

cisco

QoS DSCP/ToS Values

DSCP Class DSCP (bin) DSCP (dec) ToS (dec) ToS (bin) ToS Prec. (bin) ToS Prec. (dec) none 000000 0 0 00000000 000 0 cs1 001000 8 32 00100000 001 1 af11 001010 10 40 00101000 001 1 af12 001100 12 48 00110000 001 1 af13 001110 14 56 00111000 001

cisco

Cisco CBAC Firewall - FW-4-ALERT_ON: getting aggressive

Had an issue recently were the CBAC firewall on a Cisco 1811 was slowing down/blocking internet traffic. My inspect policy was doing basic inspection (tcp, icmp - not http,https). The log showed: %FW-4-ALERT_ON: getting aggressive, cound (501/500) current 1-min rate: 216 Cisco explains this as the

cisco

DMVPN Firewall (Access-List) Ports

If you have a dedicated DMVPN router and want to apply a simple access list to the public interface to block all other traffic, this is what you need opened up: permit esp any any permit udp any eq isakmp any eq isakmp and if you have NAT-T, then you

cisco

DMVPN - Phase 1 with EIGRP

Here is a quick and clean DMVPN Phase 1 Configuration: Hub Router IPsec: HUB01(config)# crypto isakmp policy 10 HUB01(config-isakmp)# encr 3des HUB01(config-isakmp)# hash md5 HUB01(config-isakmp)# authentication pre-share HUB01(config)# crypto isakmp key CISCO address 0.0.0.0 0.0.0.0 HUB01(config)#crypto ipsec

cisco

ASA Implicit Rule "Permit all traffic to less secure networks" ACL

When adding a new network interface to the ASA, you must specific a security level. Based off this security level, the default ACL allows you to access "less secure" networks, and denies access to "more secure" networks. This default rule works great until you need to implement a security zone

cisco

Cisco Switch Security Best Practices

This is a summary and command reference for Cisco Switch Security Best Practices from the Cisco CCNP material. 1. Configure secure passwords * Use the enable secret command to set the enable password * Use external AAA servers for administrative access * Use the service password-encryption command to prevent casual observers from seeing

cisco

Cisco SPAN (Port-Mirror) Configuration

Example: On my Cisco switch I want to mirror port 10 to port 20 so I can plug in my laptop (into port 20) with wireshark and do packet captures (config) #monitor session 1 source interface fastethernet0/10 (config) #monitor session 1 destination interface fastethernet0/20 and then verify the

cisco

OSPF Neighbor Relationships

5 Requirements for OSPF to form a relationship with a neighbor: 1. Hello and Dead timers must match 2. Network mask must match 3. Area ID must match 4. Authentication password must match (if you are using OSPF authentication) 5. Stub Area Flag must match Also found a great wiki

cisco

IPv6 OSPF on a Cisco router

The big difference between IPv4 and IPv6 OSPF configuration on a Cisco router is that the initial configuration has moved to the interface level, instead of using the "network" statements to determine which interfaces will be part of the OSPF process. To get IPv6 OSPF up-and-running, here are the 4

cisco

Advertise Default Route with BGP

If you are used to using the "Default-Information Originate" command with OSPF or EIGRP to easily advertise a default route, you might be surprised to find that solely applying that command within BGP does not advertise a default route. You must also use Redistribute Static in conjunction with Default-Information Originate.

cisco

Understanding VLAN Membership

The topic of how VLANs work and untagging/tagging ports has come up, so I am attempting to write a simplified post based off some of the questions I have received: VLANs are typically assigned to a single subnet. This is done to limit the broadcast domain and to implement

cisco

Cisco Troubleshooting Commands for Input/Output Drops

Some common commands that can help troubleshoot packet discards or drops: show interface x/x/x show interface x/x/x stats show interface x/x/x switching show cef not-cef-switched show ip cef switching statistics show ip cef switching statistics features show ip traffic show buffers and if you

cisco

Cisco Router Reset Password

Link for instructions on how to reset the password on your 2600 or 2800 series router: cisco.com

cisco

New Network Subnet Provisioning

Found the Cisco Design Zone online, which has tons of great resources: cisco.com Read an article on IPv4 addressing schemes, and best practices for setting up a new network. Besides separate subnets for the standard data and voice networks, it is recommended to: 1. "Reserve a subnet for physical