CCNA Discovery 4.1 - CCNA Discovery Answers
http://ccna-discovery-4.blogspot.com/
CCNA 1 Chapter 4 V4.0
Labels: CCNA 1 Chapter 4 V4.0
1) Which definition describes the term Internet?
a group of PCs connected together on a LAN
a group of PCs connected together by an ISP
* a network of networks that connects countries around the world
a worldwide collection of networks controlled by a single organization
2) What type of connection point is a point of presence (POP)?
between a client and a host
between two local networks
between a computer and a switch
* between an ISP and a home-based LAN
3) What is the term for the group of high-speed data links that interconnect ISPs?
Internet LAN
ISP backbone
Internet gateways
Internet providers
* Internet backbone
4) Which device can act as a router, switch, and wireless access point in one package?
hub
bridge
modem
repeater
* ISR
5) What are three characteristics of business class ISP service? (Choose three.)
* fast connections
* extra web space
free Windows upgrade
cheapest cost available to all users
* additional e-mail accounts
replacement hardware at no cost
6) What is a major characteristic of asymmetric Internet service?
Download speeds and upload speeds are equal.
Download speeds are slower than upload speeds.
* Upload speeds and download speeds are different.
Upload speeds and download speeds are irrelevant.
7) Which three elements are required to successfully connect to the Internet? (Choose
three.)
* an IP address
file sharing enabled
* a network connection
CCNA Discovery 4.1 - CCNA Discovery Answers
http://ccna-discovery-4.blogspot.com/
server services enabled
* access to an Internet service provider
an address obtained directly from the RIR
8) What term describes each router through which a packet travels when moving
between source and destination networks?
NOC
ISP
* hop
segment
9) What does the tracert command test?
NIC functionality
the ISP bandwidth
* the network path to a destination
the destination application functionality
10) What type of end-user connectivity requires that an ISP have a DSLAM device in
their network?
analog technology
cable modem technology
* digital subscriber line technology
wireless technology
11) Why would an ISP require a CMTS device on their network?
* to connect end users using cable technology
to connect end users using analog technology
to connect end users using wireless technology
to connect end users using digital subscriber line technology
12
Refer to the graphic. What type of cabling is shown?
CCNA Discovery 4.1 - CCNA Discovery Answers
http://ccna-discovery-4.blogspot.com/
STP
UTP
coax
*Fiber
13.Refer to the graphic. What type of cabling is shown?
STP
* UTP
coax
fiber
14) Which two places are most appropriate to use UTP cabling? (Choose two.)
between buildings
* in a home office network
where EMI is an issue
in a cable TV network
* inside a school building
in a manufacturing environment with hundreds of electrical devices
15) What does adherence to cabling standards ensure?
data security
no loss of signal
no electromagnetic interference
* reliable data communications
16. Refer to the graphic. What type of cable is shown?
* crossover
eight coax channels
multimode fiber
single-mode fiber
straight-through
17) What connector is used to terminate Ethernet unshielded twisted pair (UTP)
cabling?
ST
BNC
RJ-11
* RJ-45
18) Which two characteristics describe copper patch panels? (Choose two.)
uses RJ-11 jacks
* uses RJ-45 jacks
supports only data transmissions
* allows quick rearrangements of network connections
forwards transmissions based on MAC addresses
19) What are two advantages of cable management? (Choose two.)
requires no preplanning
* aids in isolation of cabling problems
* protects cables from physical damage
provides compliance with future standards
provides a short-term solution for cable installation
20) What are two common causes of signal degradation when using UTP cabling?
(Choose two.)
installing cables in conduit
CCNA Discovery 4.1 - CCNA Discovery Answers
http://ccna-discovery-4.blogspot.com/
* having improper termination
losing light over long distances
installing low quality cable shielding
* using low quality cables or connectors
21) What are three commonly followed standards for constructing and installing
cabling? (Choose three.)
* pinouts
* cable lengths
connector color
* connector types
cost per meter (foot)
tensile strength of plastic insulator
Saturday, February 6, 2010
Thursday, February 4, 2010
How to Configure Windows Server 2003 DNS Service
To configure the Windows Server 2003 DNS service by using the Configure DNS Server Wizard, follow these steps:
- Click Start, point to Administrative Tools, and then click DNS to open the DNS MMC snap-in.
- In the navigation pane, click the DNS Server object for your server, right-click the server object, and then click Configure a DNS server to start the Configure DNS server Wizard.
- Click Next, click one of the following options, and then click Next:
- Create a forward lookup zone (recommended for small networks)
This server is authoritative for the DNS names for local resources but forwards all other queries to an ISP or other DNS servers. The Wizard will configure the root hints but not create a reverse lookup zone. - Create forward and reverse lookup zones (recommended for large networks)
This server can be authoritative for forward and reverse lookup zones. It can be configured to perform recursive resolution, forward queries to other DNS servers, or both. The wizard configures the root hints. - Configure root hints only (recommended for advanced users only)
The wizard configures the root hints only. You can configure forward and reverse lookup zones and forwarders later.
- Create a forward lookup zone (recommended for small networks)
- If you clicked Create a forward lookup zone or Create forward and reverse lookup zone in step 3, use one of the following procedures to complete the steps.
Create a Forward Lookup Zone
If you create a forward lookup zone, you can either use your server to maintain the zone, or use the Internet service provider’s (ISP) DNS to maintain the zone, in which case the local server maintains a copy of the zone downloaded from the ISP. The following procedure creates a forward lookup zone which is maintained by your server:- Click This server maintains the zone, and then click Next.
- In the Zone name box, type the name of the zone. Make sure that the name is the same as the fully qualified domain name (FQDN) DNS domain name for which the zone is authoritative. Click Next.
- Click one of the following three options:
- Click Allow only secure dynamic updates if the zone is integrated into Active Directory.
- Click Allow any dynamic updates for all other zones (that is, zones that are not necessarily integrated into Active Directory).
- Click Do not allow dynamic updates if all updates to this zone are to be made manually. Click Next.
- Click Yes, it should forward queries to DNS servers with the following IP address to forward queries for names external to your network to another DNS server located elsewhere on the Internet. Typically, you use this option if you use your ISP’s DNS server for external name resolution queries. Type the forwarding DNS server’s IP address.If you do not want to resolve names outside your network by forwarding queries to an external server, click No, it should not forward queries. Click Next, and then click Finish.
Create Forward and Reverse Lookup Zones
To configure forward and reverse lookup zones, follow these steps:- Click Create forward and reverse lookup zones (recommended for large networks), and then click Next.
- Click Yes, create a forward lookup zone now (recommended), and then click Next.
- Click Primary zone, click to select the Store the zone in Active Directory (available only if DNS server is a domain controller) check box, and then click Next.
- Click the appropriate replication scope option, and then click Next.
- In the Zone name box, type the name of the zone. Make sure that the name is the same as the fully qualified domain name (FQDN) DNS domain name for which the zone is authoritative. Click Next.
- Click one of the following three options:
- Click Allow only secure dynamic updates if the zone is integrated into Active Directory.
- Click Allow any dynamic updates for all other zones (that is, zones that may not be integrated into Active Directory).
- Click Do not allow dynamic updates if all updates to this zone are to be made manually.
- Click Next.
- Click Yes, create a reverse lookup zone now, and then click Next.
- Click Primary zone, click to select the Store the zone in Active Directory (available only if DNS server is a domain controller) check box, and then click Next.
- Click the appropriate zone replication method, and then click Next.
- Click Network ID, and then type the Network ID portion of your IP address that is exposed to the internet. For example, if your IP address is 10.10.10.10, and the subnet mask is 255.255.255.0, the network address portion of the IP address is 10.10.10. Click Next
- Click the appropriate zone dynamic update method, and then click Next.
- Click Yes, it should forward queries to DNS servers with the following IP address to forward queries for names external to your network to another DNS server located elsewhere on the Internet. Typically you would use this option if you use your ISP’s DNS server for external name resolution queries. Type the forwarding DNS server’s IP address in the space below.If you prefer not to resolve names outside your network by forwarding queries to an external server, click No, it should not forward queries. Click Next, and then click Finish.
How to Secure the ISA Server Computer with Security Configuration Wizard
The Microsoft Windows Server 2003 operating system with Service Pack 1 (SP1) includes an attack surface reduction tool called the Security Configuration Wizard (SCW). Depending on the server role you select, the SCW determines the minimum functionality required, and disables functionality that is not required.
When you install Windows Server 2003 SP1 on the ISA Server computer, you can install the SCW and use the wizard to harden the computer.
The SCW guides you through the process of creating, editing, applying, or rolling back a security policy based on the selected roles of the server. The security policies that are created with the SCW are .xml files that, when applied, configure services, network security, specific registry values, audit policy, and if applicable, Internet Information Services (IIS). The SCW includes a role for ISA Server computers.
To apply the appropriate ISA Server roles, perform the following steps
When you install Windows Server 2003 SP1 on the ISA Server computer, you can install the SCW and use the wizard to harden the computer.
The SCW guides you through the process of creating, editing, applying, or rolling back a security policy based on the selected roles of the server. The security policies that are created with the SCW are .xml files that, when applied, configure services, network security, specific registry values, audit policy, and if applicable, Internet Information Services (IIS). The SCW includes a role for ISA Server computers.
To apply the appropriate ISA Server roles, perform the following steps
- On the ISA Server computer, click Start, point to Administrative Tools, and then click Security Configuration Wizard.
- In the Security Configuration Wizard, on the Welcome page, click Next.
- On the Configuration Action page, select Create a new security policy.
- On the Select Server page, in Server, type the name or IP address of the ISA Server computer.
- On the Processing Security Configuration Database page, click Next.
- On the Welcome page of the Role-based Service Configuration page, click Next.
- On the Select Server Roles page, select the following, and then click Next:
- Select Microsoft Internet Security and Acceleration Server 2004, if you are hardening a computer running the ISA Server services (for ISA Server Enterprise Edition, an array member).
- Select Remote Access/VPN Server, if you will be using the ISA Server computer for virtual private network (VPN) functionality.
On the Select Client Features page, select the default client roles, as appropriate. No special client roles are specifically required for hardening ISA Server. Then, click Next.
- On the Select Administration and Other Options page, select the following options:
- Select Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition: Configuration Storage, if the Configuration Storage server is installed on this computer (for ISA Server Enterprise Edition only).
- Select Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition: Client installation share, if the Firewall Client share is installed on this computer.
- Select Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition: MSDE Logging, if ISA Server advanced logging options are installed on this computer.
- Select Remote Access Quarantine Agent, if you will enable quarantine for ISA Server. (You must have selected the Remote Access/VPN Server server role in step 7.)
- On the Select Additional Services page, select the appropriate services and click Next.
- Click Next until you finish the wizard.
How to configure a remote access policy in Windows Server 2003
How to configure a remote access policy
By default, two remote access policies are available in Windows Server 2003:- Connections to Microsoft Routing and Remote Access server
This policy matches every remote access connection that is made to the Routing and Remote Access service. - Connections to other access servers
This policy matches every incoming connection, regardless of the network access server type.
- The Connections to Microsoft Routing and Remote Access server policy is unavailable.
- The order of the policies has been changed.
- Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access.
- Expand Server_Name, and then click Remote Access Policies. Note If you have not configured remote access, click Configure and Enable Routing and Remote Access on the Action menu, and then follow the steps in the Routing and Remote Access Server Setup Wizard.
- Create a new remote access policy. The following example steps illustrate how to create a new remote access policy that explicitly grants remote access permissions to a specific user on certain days. This policy implicitly blocks access on other days.
- Right-click Remote Access Policies, and then click New Remote Access Policy.
- In the New Remote Access Policy Wizard, click Next.
- In the Policy name box, type Test Policy, and then click Next.
- On the Access Method page, click Dial-up, and then click Next.
- On the User or Group Access page, click User or Group, and then click Next. Note If you want to configure the remote access policy for a group, click Add, type the name of the group in the Enter Object Names To Select box, and then click OK.
- On the Authentication Methods page, make sure that only the Microsoft Encrypted Authentication version 2 (MS-CHAPv2) check box is selected, and then click Next.
- On the Policy Encryption Level page, click Next.
- Click Finish. A new policy named Test Policy appears in the Remote Access Policies node.
- In the right pane, right-click Test Policy, and then click Properties.
- In the Test Policy Properties dialog box, make sure that Grant remote access permission is selected.
- Click Edit Profile, click to select the Allow access only on these days and at these times check box, and then click Edit.
- Click Denied, click Monday through Friday from 8:00 A.M. to 4:00 P.M., clickPermitted, and then click OK.
- Click OK to close the Edit Dial-in Profile dialog box.
- Click OK to close the Test Policy Properties dialog box. The Test Policy policy is in effect.
- Repeat steps a through h to create another remote access policy named Test Block Policy.
- In the right pane, right-click Test Block Policy, and then click Properties.
- In the Test Block Policy Properties dialog box, click Deny remote access permission. The Test Block Policy policy is in effect.
- Quit Routing and Remote Access.
How To Create a Roaming User Profile in Windows Server 2003
Creating a roaming user profile is a two-step process. First you create a test user profile, and then you copy the test user profile to a network server.
Create a Test Profile
To create a test profile for the roaming user, follow these steps:- Log on as Administrator.
- Click Start, point to Administrative Tools, and then click Computer Management.
- In the console tree, expand Local Users and Groups, and then click Users.
- Right-click Users, and then click New User.
- Type a name and password for the user.
- Click to clear User must change password at next logon.
- Click Create, and then click Close.
- Quit the Computer Management snap-in.
- Log off the computer.
- Log on as the test user account that you created in step 7. A user profile is automatically created on the local computer in the drive:\Documents and Settings\username folder (where drive is the drive on which Windows is installed).
- Configure the desktop environment, including appearance, shortcuts, and Start menu options.
- Log off, and then log on as Administrator.
Copy the Test Profile
To copy the test profile to a network server, follow these steps:- Create a folder on a network drive in which you can store network profiles. For example: \\server_name\Profiles\user_name
- Click Start, point to Control Panel, and then click System.
- Click the Advanced tab, and then click Settings in the User Profiles section of theSystem Properties dialog box.
- Under Profiles Stored On This Computer, click the profile for the user that you created in the “Create a Test Profile” section of this article, and then click Copy To.
- In the Copy Profile To dialog box, type the network path to the folder.
- Under Permitted to Use, click Change.
- Type the name of the user account that you created in the “Create a Test Profile” section, and then click OK.
- Click OK three times.
- Click Start, point to Administrative Tools, and then click Computer Management.
- In the console tree, expand Local Users and Groups, and then double-click Users.
- Double-click the user account that you created in the “Create a Test Profile” section.
- Click the Profile tab. In the Profile path box, type the path to the network profile folder. For example, type \\server_name\Profiles\user_name.
- Click OK.
- Quit the Computer Management snap-in.
NAT Configuration
NAT can be configured in various ways. In the example below, the NAT router is configured to translate unregistered (inside, local) IP addresses, that reside on the private (inside) network, to registered IP addresses. This happens whenever a device on the inside with an unregistered address needs to communicate with the public (outside) network.
IP addresses have different designations based on whether they are on the private network (stub domain) or on the public network (Internet), and whether the traffic is incoming or outgoing.
As you can see, the NAT router stores the IP address and port number of each computer in the address translation table. It then replaces the IP address with its own registered IP address and the port number corresponding to the location, in the table, of the entry for that packet's source computer. So any external network sees the NAT router's IP address and the port number assigned by the router as the source-computer information on each packet.
You can still have some computers on the stub domain that use dedicated IP addresses. You can create an access list of IP addresses that tells the router which computers on the network require NAT. All other IP addresses will pass through untranslated.
The number of simultaneous translations that a router will support are determined mainly by the amount of DRAM (Dynamic Random Access Memory) it has. But since a typical entry in the address-translation table only takes about 160 bytes, a router with 4 MB of DRAM could theoretically process 26,214 simultaneous translations, which is more than enough for most applications.
IANA has set aside specific ranges of IP addresses for use as non-routable, internal network addresses. These addresses are considered unregistered (for more information check out RFC 1918: Address Allocation for Private Internets, which defines these address ranges). No company or agency can claim ownership of unregistered addresses or use them on public computers. Routers are designed to discard (instead of forward) unregistered addresses. What this means is that a packet from a computer with an unregistered address could reach a registered destination computer, but the reply would be discarded by the first router it came to.
There is a range for each of the three classes of IP addresses used for networking:
In specific circumstances, Static NAT, also called inbound mapping, allows external devices to initiate connections to computers on the stub domain. For instance, if you wish to go from an inside global address to a specific inside local address that is assigned to your Web server, Static NAT would enable the connection.
NAT is sometimes confused with proxy servers, but there are definite differences between them. NAT is transparent to the source and to destination computers. Neither one realizes that it is dealing with a third device. But a proxy server is not transparent. The source computer knows that it is making a request to the proxy server and must be configured to do so. The destination computer thinks that the proxy server IS the source computer, and deals with it directly. Also, proxy servers usually work at layer 4 (transport) of the OSI Reference Model or higher, while NAT is a layer 3 (network) protocol. Working at a higher layer makes proxy servers slower than NAT devices in most cases.
NAT and DHCP (dynamic host configuration protocol ) are a natural fit. You can choose a range of unregistered IP addresses for your stub domain and have the DHCP server dole them out as necessary. It also makes it much easier to scale up your network as your needs grow. You don't have to request more IP addresses from IANA. Instead, you can just increase the range of available IP addresses configured in DHCP to immediately have room for additional computers on your network.
In addition to maintaining a reliable connection, multi-homing allows a company to perform load-balancing by lowering the number of computers connecting to the Internet through any single connection. Distributing the load through multiple connections optimizes the performance and can significantly decrease wait times.
Multi-homed networks are often connected to several different ISPs (Internet Service Providers). Each ISP assigns an IP address (or range of IP addresses) to the company. Routers use BGP (Border Gateway Protocol), a part of the TCP/IP protocol suite, to route between networks using different protocols. In a multi-homed network, the router utilizes IBGP (Internal Border Gateway Protocol) on the stub domain side, and EBGP (External Border Gateway Protocol) to communicate with other routers.
Multi-homing really makes a difference if one of the connections to an ISP fails. As soon as the router assigned to connect to that ISP determines that the connection is down, it will reroute all data through one of the other routers.
NAT can be used to facilitate scalable routing for multi-homed, multi-provider connectivity. For more on multi-homing, see Cisco: Enabling Enterprise Multihoming.
- An ISP assigns a range of IP addresses to your company. The assigned block of addresses are registered, unique IP addresses and are called inside global addresses. Unregistered, private IP addresses are split into two groups. One is a small group (outside local addresses) that will be used by the NAT routers. The other, much larger group, known as inside local addresses, will be used on the stub domain. The outside local addresses are used to translate the unique IP addresses, known as outside global addresses, of devices on the public network.
- Most computers on the stub domain communicate with each other using the inside local addresses.
- Some computers on the stub domain communicate a lot outside the network. These computers have inside global addresses, which means that they do not require translation.
- When a computer on the stub domain that has an inside local address wants to communicate outside the network, the packet goes to one of the NAT routers.
- The NAT router checks the routing table to see if it has an entry for the destination address. If it does, the NAT router then translates the packet and creates an entry for it in the address translation table. If the destination address is not in the routing table, the packet is dropped.
- Using an inside global address, the router sends the packet on to its destination.
- A computer on the public network sends a packet to the private network. The source address on the packet is an outside global address. The destination address is an inside global address.
- The NAT router looks at the address translation table and determines that the destination address is in there, mapped to a computer on the stub domain.
- The NAT router translates the inside global address of the packet to the inside local address, and sends it to the destination computer.
- Source Address - The IP address of the originating computer, such as 201.3.83.132
- Source Port - The TCP or UDP port number assigned by the originating computer for this packet, such as Port 1080
- Destination Address - The IP address of the receiving computer, such as 145.51.18.223
- Destination Port - The TCP or UDP port number that the originating computer is asking the receiving computer to open, such as Port 3021
Dynamic NAT and Overloading
Here's how dynamic NAT works:- An internal network (stub domain) has been set up with IP addresses that were not specifically allocated to that company by IANA (Internet Assigned Numbers Authority), the global authority that hands out IP addresses. These addresses should be considered non-routable since they are not unique.
- The company sets up a NAT-enabled router. The router has a range of unique IP addresses given to the company by IANA.
- A computer on the stub domain attempts to connect to a computer outside the network, such as a Web server.
- The router receives the packet from the computer on the stub domain.
- The router saves the computer's non-routable IP address to an address translation table. The router replaces the sending computer's non-routable IP address with the first available IP address out of the range of unique IP addresses. The translation table now has a mapping of the computer's non-routable IP address matched with the one of the unique IP addresses.
- When a packet comes back from the destination computer, the router checks the destination address on the packet. It then looks in the address translation table to see which computer on the stub domain the packet belongs to. It changes the destination address to the one saved in the address translation table and sends it to that computer. If it doesn't find a match in the table, it drops the packet.
- The computer receives the packet from the router. The process repeats as long as the computer is communicating with the external system.
- An internal network (stub domain) has been set up with non-routable IP addresses that were not specifically allocated to that company by IANA.
- The company sets up a NAT-enabled router. The router has a unique IP address given to the company by IANA.
- A computer on the stub domain attempts to connect to a computer outside the network, such as a Web server.
- The router receives the packet from the computer on the stub domain.
- The router saves the computer's non-routable IP address and port number to an address translation table. The router replaces the sending computer's non-routable IP address with the router's IP address. The router replaces the sending computer's source port with the port number that matches where the router saved the sending computer's address information in the address translation table. The translation table now has a mapping of the computer's non-routable IP address and port number along with the router's IP address.
- When a packet comes back from the destination computer, the router checks the destination port on the packet. It then looks in the address translation table to see which computer on the stub domain the packet belongs to. It changes the destination address and destination port to the ones saved in the address translation table and sends it to that computer.
- The computer receives the packet from the router. The process repeats as long as the computer is communicating with the external system.
- Since the NAT router now has the computer's source address and source port saved to the address translation table, it will continue to use that same port number for the duration of the connection. A timer is reset each time the router accesses an entry in the table. If the entry is not accessed again before the timer expires, the entry is removed from the table.
Stub Domains
Look at this table to see how the computers on a stub domain might appear to external networks.Computer | Computer's IP Address | Computer's Port | IP Address | Assigned Port Number |
As you can see, the NAT router stores the IP address and port number of each computer in the address translation table. It then replaces the IP address with its own registered IP address and the port number corresponding to the location, in the table, of the entry for that packet's source computer. So any external network sees the NAT router's IP address and the port number assigned by the router as the source-computer information on each packet.
You can still have some computers on the stub domain that use dedicated IP addresses. You can create an access list of IP addresses that tells the router which computers on the network require NAT. All other IP addresses will pass through untranslated.
The number of simultaneous translations that a router will support are determined mainly by the amount of DRAM (Dynamic Random Access Memory) it has. But since a typical entry in the address-translation table only takes about 160 bytes, a router with 4 MB of DRAM could theoretically process 26,214 simultaneous translations, which is more than enough for most applications.
IANA has set aside specific ranges of IP addresses for use as non-routable, internal network addresses. These addresses are considered unregistered (for more information check out RFC 1918: Address Allocation for Private Internets, which defines these address ranges). No company or agency can claim ownership of unregistered addresses or use them on public computers. Routers are designed to discard (instead of forward) unregistered addresses. What this means is that a packet from a computer with an unregistered address could reach a registered destination computer, but the reply would be discarded by the first router it came to.
There is a range for each of the three classes of IP addresses used for networking:
- Range 1: Class A - 10.0.0.0 through 10.255.255.255
- Range 2: Class B - 172.16.0.0 through 172.31.255.255
- Range 3: Class C - 192.168.0.0 through 192.168.255.255
Security and Administration
Implementing dynamic NAT automatically creates a firewall between your internal network and outside networks, or between your internal network and the Internet. NAT only allows connections that originate inside the stub domain. Essentially, this means that a computer on an external network cannot connect to your computer unless your computer has initiated the contact. You can browse the Internet and connect to a site, and even download a file; but somebody else cannot latch onto your IP address and use it to connect to a port on your computer.In specific circumstances, Static NAT, also called inbound mapping, allows external devices to initiate connections to computers on the stub domain. For instance, if you wish to go from an inside global address to a specific inside local address that is assigned to your Web server, Static NAT would enable the connection.
Static NAT (inbound mapping) allows a computer on the stub domain to maintain a specific address when communicating with devices outside the network.
Some NAT routers provide for extensive filtering and traffic logging. Filtering allows your company to control what type of sites employees visit on the Web, preventing them from viewing questionable material. You can use traffic logging to create a log file of what sites are visited and generate various reports from it. NAT is sometimes confused with proxy servers, but there are definite differences between them. NAT is transparent to the source and to destination computers. Neither one realizes that it is dealing with a third device. But a proxy server is not transparent. The source computer knows that it is making a request to the proxy server and must be configured to do so. The destination computer thinks that the proxy server IS the source computer, and deals with it directly. Also, proxy servers usually work at layer 4 (transport) of the OSI Reference Model or higher, while NAT is a layer 3 (network) protocol. Working at a higher layer makes proxy servers slower than NAT devices in most cases.
NAT operates at the Network layer (layer 3) of the OSI Reference Model -- this is the layer that routers work at.
A real benefit of NAT is apparent in network administration. For example, you can move your Web server or FTP server to another host computer without having to worry about broken links. Simply change the inbound mapping at the router to reflect the new host. You can also make changes to your internal network easily, because the only external IP address either belongs to the router or comes from a pool of global addresses. NAT and DHCP (dynamic host configuration protocol ) are a natural fit. You can choose a range of unregistered IP addresses for your stub domain and have the DHCP server dole them out as necessary. It also makes it much easier to scale up your network as your needs grow. You don't have to request more IP addresses from IANA. Instead, you can just increase the range of available IP addresses configured in DHCP to immediately have room for additional computers on your network.
Multi-homing
As businesses rely more and more on the Internet, having multiple points of connection to the Internet is fast becoming an integral part of their network strategy. Multiple connections, known as multi-homing, reduces the chance of a potentially catastrophic shutdown if one of the connections should fail.In addition to maintaining a reliable connection, multi-homing allows a company to perform load-balancing by lowering the number of computers connecting to the Internet through any single connection. Distributing the load through multiple connections optimizes the performance and can significantly decrease wait times.
Multi-homed networks are often connected to several different ISPs (Internet Service Providers). Each ISP assigns an IP address (or range of IP addresses) to the company. Routers use BGP (Border Gateway Protocol), a part of the TCP/IP protocol suite, to route between networks using different protocols. In a multi-homed network, the router utilizes IBGP (Internal Border Gateway Protocol) on the stub domain side, and EBGP (External Border Gateway Protocol) to communicate with other routers.
Multi-homing really makes a difference if one of the connections to an ISP fails. As soon as the router assigned to connect to that ISP determines that the connection is down, it will reroute all data through one of the other routers.
NAT can be used to facilitate scalable routing for multi-homed, multi-provider connectivity. For more on multi-homing, see Cisco: Enabling Enterprise Multihoming.
Wednesday, February 3, 2010
How to Configure DCHP in Windows 2003 Server
DHCP stands for Dynamic Host Configuration Protocol and it is designed for minimizing the Administration of the IP addresses in a big network. DHCP server can be setup with the appropriate and required settings in a computer network. A DHCP server can assign the IP address, gateway, DNS, DHCP, subnet mask, Router, Proxy server’s IP address from its predefined pool of the addresses. Once DHCP server has been configured, it automatically assigns the IP addresses to the client computers.
DHCP server holds a database of the IP addresses for a leased duration. Manual settings and changes in an enterprise network can be a nightmare. DHCP provides centralized control and management of your computer network.
Before your implement DHCP server in your network you need to review security issues, identify the range of the IP addresses, which you want to assign, determine the correct subnet mask, decide the duration of the leased addresses, identify the IP address of the router, gateway computer, DNS and WINS. This article will help you to setup and configure DHCP server in Windows 2003 Server.
In this Administrative tools of the Windows 2003 Sever perform the following actions.
Setup
* Click DHCP in the Administrative Tools or in the “Manager Your Servers” Window.
* In the Scope window, enter the scope name and description and click next.
* In the next window, you will be asked to define the range of the IP addresses that the scope will distribute to the network computers.
* Enter the start IP address, end IP address, length and subnet mask and click next.
* In the next Window, you will need to add exclusions i.e. you can add any IP addresses that you don’t want to be distributed to the network computers. After adding the range of the exclusive IP addresses click next. (You can assign the exclusive IP address manually to the company’s router, gateway or any other device. These IP addresses will not be distributed to the network computers.)
* In the next window, you need to enter the lease duration. It is recommended that you add longer lease duration for the fixed computer networks and the shorter leased time for the remote connections and Laptops.
* On the next screen, you will be given the choice to configure these options for the DHCP scope now or later. Check “Yes I want to configure these options now” and click next.
* On the next screen, you need to enter the Router’s IP address from the exclusive list, which we defined on the above steps. After you add the router’s address click next.
* In the next window, DNS settings can be entered i.e. IP address, domain name and server name.
* On the screen next to DNS, WINS server settings can be entered.
* On the next window, you need to activate the scope. Click “Yes I want to activate the scope now”.
* That’s all. You have successfully setup the DHCP in your Windows 2003 Server.
Configurations
After you have successfully setup the DHCP server, you may need to configure the multiple options based up the requirements of your network. For configuring the Exclusions after setting up the DHCP server, please follow the below steps.
In the DCHP main windows right click the Address Pool on the left side and click “Add Exclusions”. Here you can define the range of the IP addresses which you don’t want to distribute among the network computers.
If you want to reserve an IP address for a client computer, you can configure it by the following steps. For reserving the IP addresses for client computer, you need to know the MAC address of that client.
In the DHCP main window, right click Reservations in the left side. Provide the required parameters for fixing the IP addresses for the client computers.
You need to explore the various features of the DHCP server as you can configure multiple other options.
DHCP server holds a database of the IP addresses for a leased duration. Manual settings and changes in an enterprise network can be a nightmare. DHCP provides centralized control and management of your computer network.
Before your implement DHCP server in your network you need to review security issues, identify the range of the IP addresses, which you want to assign, determine the correct subnet mask, decide the duration of the leased addresses, identify the IP address of the router, gateway computer, DNS and WINS. This article will help you to setup and configure DHCP server in Windows 2003 Server.
In this Administrative tools of the Windows 2003 Sever perform the following actions.
Setup
* Click DHCP in the Administrative Tools or in the “Manager Your Servers” Window.
* In the Scope window, enter the scope name and description and click next.
* In the next window, you will be asked to define the range of the IP addresses that the scope will distribute to the network computers.
* Enter the start IP address, end IP address, length and subnet mask and click next.
* In the next Window, you will need to add exclusions i.e. you can add any IP addresses that you don’t want to be distributed to the network computers. After adding the range of the exclusive IP addresses click next. (You can assign the exclusive IP address manually to the company’s router, gateway or any other device. These IP addresses will not be distributed to the network computers.)
* In the next window, you need to enter the lease duration. It is recommended that you add longer lease duration for the fixed computer networks and the shorter leased time for the remote connections and Laptops.
* On the next screen, you will be given the choice to configure these options for the DHCP scope now or later. Check “Yes I want to configure these options now” and click next.
* On the next screen, you need to enter the Router’s IP address from the exclusive list, which we defined on the above steps. After you add the router’s address click next.
* In the next window, DNS settings can be entered i.e. IP address, domain name and server name.
* On the screen next to DNS, WINS server settings can be entered.
* On the next window, you need to activate the scope. Click “Yes I want to activate the scope now”.
* That’s all. You have successfully setup the DHCP in your Windows 2003 Server.
Configurations
After you have successfully setup the DHCP server, you may need to configure the multiple options based up the requirements of your network. For configuring the Exclusions after setting up the DHCP server, please follow the below steps.
In the DCHP main windows right click the Address Pool on the left side and click “Add Exclusions”. Here you can define the range of the IP addresses which you don’t want to distribute among the network computers.
If you want to reserve an IP address for a client computer, you can configure it by the following steps. For reserving the IP addresses for client computer, you need to know the MAC address of that client.
In the DHCP main window, right click Reservations in the left side. Provide the required parameters for fixing the IP addresses for the client computers.
You need to explore the various features of the DHCP server as you can configure multiple other options.
For Sale Slight Use Computer Hardware
200 Gigabyte hardisk for only 1500 php
80 gigabyte Hardisk for only 1000php
40 gigabyte hardisk for only 800php
1gig ddr1 for only 1300php
1gig ddr2 for only 1000php
80 gigabyte Hardisk for only 1000php
40 gigabyte hardisk for only 800php
1gig ddr1 for only 1300php
1gig ddr2 for only 1000php
Restore Deleted IE7 With This Tips
For IE 7 (maybe others)
Search file: regedit.exe
go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
double click the one starting with: 871C5380
Change value to: 0
Exit then press F5 once on desktop.
If you're using "Classic Menu"
Go to ClassicStartMenu instead of NewStartPanel
Search file: regedit.exe
go to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
double click the one starting with: 871C5380
Change value to: 0
Exit then press F5 once on desktop.
If you're using "Classic Menu"
Go to ClassicStartMenu instead of NewStartPanel
Classful IP Subnet Calculations
Classful IP Subnet Calculations
1. IP Addressing
At this point you should know that IP, the Internet Protocol, is a network layer (OSI layer 3) protocol, used to route packets between hosts on different networks. To suit this purpose, IP must define an addressing scheme, so that a packet's intended destination can be indicated.An IP address is composed of 32 bits. These 32 bits are divided into 4 octets of 8 bits each. You may have seen an IP address represented like this: 172.68.15.24. We must remember, however, that the computer understands this number only in binary, so we must often deal with them in binary. Many people are intimidated by this initially, but soon find that it is not difficult. If you do not allow yourself to be flustered, you can master this topic.
IP addresses are assigned to orginazations in blocks. Each block belongs to one of three classes: class A, class B, or class C. You can tell what class an IP address is by the value in its first octet.
Class A | 1-126 |
Class B | 128-191 |
Class C | 192 --> |
When a class A IP license is granted, you are assigned something like this: 99.0.0.0. Only the value of the bits in the first octet are assigned. This means you are free to assign any values you wish in the second, third and fourth octets.
The defualt subnet mask for a class A network is 255.0.0.0. High bits, ones, indicate the bits that are part of the network field of the IP address. The default subnet mask does not create subnets. Therefor, a class A network with the default subnet mask is one network. The three octets that are unassigned and unmasked are part of the host field of the address. There is a total of 24 bits in those three octets. Each bit can be in one of two states. Therefor, 2^24 is the number of host addresses that can be assigned on that network, almost. Two addresses are reserved on every network, x.x.x.0 and x.x.x.255. So the total number of hosts possible on this network is 2^24. 2^24-2=16,777,214 hosts for a class A IP network.
When a class B license is granted, the first two octets are assigned. For example, 172.198.x.x. The default subnet mask for a class B is 255.255.0.0. One network, two octets free, 16 bits for the host address field. 2^16-2=65,534 possible host addresses on a class B IP network.
When a class C license is granted, the first three octets are assigned, for example: 193.52.16.0. The default subnet mask for a class C is 255.255.255.0. Once octet makes up the host address field. 2^8-2=254 host addresses possible on a class C network.
2. Reason for Subnetting
We said that the default subnet mask for a class A IP network is 255.0.0.0. Once octet only of a class A network address identifies the network, with this subnet mask. This leaves three octets of 8 bits each, or 24 bits, to identify the host on that one network. 2^24=16,777,216 addresses. Two addresses are reserved, x.x.x.0 and x.x.x.255. 16,777,214 nodes can be assigned an IP address on this network.It is highly unlikely that any organization would want one network of 16,777,214 nodes. They might want that many devices connected in a wide area network (WAN), thus capablee of communicating when neccessary, but they will want to subdivide this huge network into mostly self-contained subnetworks of nodes that communicate with each other often. This is called subnetting.
To understand why, consider what would happen in either a broadcast or a token passing network that consisted of over 16,000,000 nodes. Nothing would happen. It simply would not work. Though the problem is not as drastic, class B and class C IP networks are often subnetted, also.
The subnet mask is used to subdivide an IP network into subnets. This is a division that takes place in OSI layer 3, so it is a logical division that is created by the addressing scheme. This logical division is usually combined with a physical division. Many subnets are physically isolated from the rest of the network by a device such as a router or a switch. This aspect of subnetting is discussed in Unit 3--Data Link Layer.
3. How Subnetting Works
The bits of an address that are masked by the subnet mask are the bits that make up the network field of the address. To subnet, the default subnet mask for a network is extended to cover bits of the address that would otherwise be part of the host field. Once these bits are masked, they become part of the network field, and are used to identify subnets of the larger network.Here is where we begin dealing with both addresses and subnetmasks in binary. Get yourself a cold beverage, stretch, take a deep breath and don't worry. Once you get your brain around the concepts, it is not difficult. You just have to keep trying until the light goes on.
3.1 Translating Binary to Decimal
Both IP addresses and subnet masks are composed of 32 bits divided into 4 octets of 8 bits each. Here is how a single octet translates from binary to decimal. Consider an octet of all ones: 11111111.128 64 32 16 8 4 2 1 --- -- -- -- - - - - 1 1 1 1 1 1 1 1 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255Here's another: 10111001
128 64 32 16 8 4 2 1 --- -- -- -- - - - - 1 0 1 1 1 0 0 1 128 + 0 + 32 +16 + 8 + 0 + 0 + 1 = 185and 00000000
128 64 32 16 8 4 2 1 --- -- -- -- - - - - 0 0 0 0 0 0 0 0 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 = 0
3.2 Converting Decimal to Binary
Converting decimal to binary is similar. Consider 175:128 64 32 16 8 4 2 1 --- -- -- -- - - - - 1 0 1 0 1 1 1 1 128 + 0 + 32 + 0 + 8 + 4 + 2 + 1 = 175175=10101111
3.3 Simple Subnetting
The simpliest way to subnet is to take the octet in the subnet mask that covers the first unassigned octet in the IP address block, and make all its bits high. Remember, a high bit, a 1, in the subnet mask indicates that that corresponding bit in the IP address is part of the network field. So, if you have a class B network 172.160.0.0, with the subnet mask 255.255.0.0, you have one network with 65, 534 possible addresses. If you take that subnet mask and make all the bits in the third octet high128 64 32 16 8 4 2 1 --- -- -- -- - - - - 1 1 1 1 1 1 1 1 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255you get the subnet mask 255.255.255.0.
172.60. 0. 0 255.255.255.0Now the third octet of all the addresses on this network are part of the network field instead of the host field. That is one octet, or eight bits, that can be manipulated to create subnets. 2^8=256 possible subnets now on this class B network.
One octet is left for the host field. 2^8-2=254 possible host addressed on each subnet.
3.4 Advanced Subnetting
That is the simplist way to subnet, but it may not be the most desirable. You might not want 254 subnets on your class B network. Instead, you might use a subnet mask like 255.255.224.0. How many subnets would this give you? The first step is to see how many bits are allocated to the network by this mask.128 64 32 16 8 4 2 1 --- -- -- -- - - - - 1 1 1 0 0 0 0 0 128 + 64 + 32 + 0 + 0 + 0 + 0 + 0 = 2243 bits are allocated. 2^3=8 subnets.
How many hosts on each subnet? Well, 5 bits from this octet are left for the host field, and 8 bits in the fourth octet, for a total of 13 bits in the host field. 2^13-2=8190 possible hosts on each subnet.
The subnet mask is always extended by masking off the next bit in the address, from left to right. Thus, the last octet in the subnet mask will always be one of these: 128, 192, 224, 240, 248, 252, 254 or 255.
Given the IP address of a host and the subnet address for the network, you need to be able to calculate which subnet that host is on. To do this we compare the binary representation of the pertinent octet of the subnet mask witht he binary representation of the corresponding octet in the IP address. Example:
IP address=172.60.50.2 subnet mask=255.255.224.0 50= 00110010 224=11100000We perform a logical
00110010 11100000 -------- 00100000=32This host is on subnet 172.60.32.0.
We also need to be able to find the range of assignable IP addresses on this subnet. To do this, we take the binary that tells us the subnet address, in this case 00100000, and compare it with the subnet mask.
00100000 11100000The bits convered by the mask we will leave as they are. The rest of the bits we make high. So
00100000 11100000 -------- 0011111=63The range of assignable IP addresses on the subnet 172.60.32.0 is 172.60.32.1-172.60.63.254.
On every network and subnet, two addresses are reserved. At the low end of the range of addresses for the network or subnet, in this case 172.60.64.0, is the address for the network or subnet itself. The address at the high end of the range of addresses, in this case 172.60.95.255, is the broadcast address. Any message sent to the broadcast address will be received by every host on the network.
4. Sample Problem
Here is a sample problem for you to calculate. When you are done, you can check your answers using an online subnet calcualtor at Tactix Engineering.IP address: 154.16.52.16 subnet mask: 255.255.240.0 Find: Number of subnets possible on this network: Number of hosts possible on each subnet: Which subnet this address is on: Range of addresses on that subnet:
Cisco T1 Load Balancing HOWTO
This document is for those facing the common problem of using Cisco routers to load balance 2 or more parallel T1's.
Acknowledgments- Thanks to Mark Costlow who showed me how this works.
- References to pertinent Cisco documentation can be found at the end of this document.
This document carries no explicit or implied warranty. Nor is there any guarantee that the information contained in this document is accurate. It is offered in the hopes of helping others, but you use it at your own risk. The author will not be liable for any damages that occur as a result of using this document.
Conventions
Important terms and concepts, when they are introduced, may be displayed in bold. Commands included in the body of the text will be displayed in
this font.
Annoying Facts will be displayed in red, and will indicate pitfalls the reader should be aware of before taking any action based on this document. 1. What This Document covers
This document is for those facing the common problem of using Cisco routers to load balance IP traffic across 2 or more parallel T1's. Although the problem is common, acquiring the knowledge to address the issue can be frustratingly difficult. Hopefully this will help.2. Per-Packet Load Balancing
What you want if you can get it, and if it will not break any of your applications, is per-packet load balancing. Load balancing on a router happens at layer 3, meaning it is a function of IP routing. Per-packet load balancing means the Cisco will route outbound IP packets in round-robin fashion, simply taking turns which interface it routes each IP packet out. Per-packet load balancing gives the most even distribution across outbound connections.3. Annoying Fact #1 Outbound Only
A router can load balance outbound traffic only. In order to get load balancing in both directions, the T1's on Router A must both terminate on the same Router B. Load balancing must be configured on both Router A and Router B. Easy enough if Router A and Router B are both in your control. If they are not, you will have to coordinate with the authority that controls the other router. Another unfortunate result is that per-packet load balancing on T1's to multiple ISP's is not feasible.4. Annoying Fact #2 Out of Order Packets
This method of per-packet load balancing can mean that packets in a particular connection or flow arrive at their destination out of sequence. This doesn't cause a problem for most applications, but it can cause problems for the increasingly popular streaming media, both video and audio. This includes voice over IP.If out of order packets will cause you a problem, Cisco recommends using Multilink PPP to do your load balancing. I do not personally have experience with MLPPP between Cisco routers.
5. Cisco Express Forwarding
Cisco Express Forwarding (CEF) is one method that IOS can use to switch packets through the router. It is the method Cisco recommends, and seems to be the right thing most of the time. It is required for the per-packet load balancing this document discusses. You can tell if CEF is enabled by issuing the command:show ip cef
If it is enabled you get some interesting output. If it is not enabled, IOS will tell you that it is not running. To enable CEF, in global configuration mode:
ip cef
6. Equal Cost Routes
To get load balancing to happen, you need equal cost routes pointing to the interfaces involved in the load balancing. For example, on Router A load balancing 2 T1's, the
show ip route
output might include something like this:S* 0.0.0.0/0 is directly connected, Serial0/1 is directly connected, Serial0/0And on Router B the
show ip route
output might include something like this: ip route 192.168.8.0 255.255.255.0 Serial1/3 10 ip route 192.168.8.0 255.255.255.0 Serial1/0 10
7. ip load-sharing per-packet
The magic IOS command you have been looking for but couldn't find on Cisco's website is:ip load-sharing per-packet
You apply this to each interface you want to participate in per-packet load balancing. Remember, you want to do this on the routers at both ends of the T1's.
My experience is that this works like a charm. Graphs I look at everyday of traffic on T1's configured this way are indistinguishable from each other. The balancing is near perfect.
8. References
Per-Packet Load BalancingAlternatives for High Bandwidth Connections Using Parallel T1/E1 Links
9. More Information
<!-- Cisco Router Configuration TutorialMy tutorial on IP subnet calculations
And More ...
Cisco Router Configuration Tutorial Using CLI
This document covers basic Cisco router IP configuration using the command-line interface
The following sources where extremely useful:
- Leinwand, Pinsky, and Culpepper. Cisco Router Configuration. Indianapolis, Indiana: Cisco Press, 1998.
- Cisco Systems, Inc., http://www.cisco.com
This document carries no explicit or implied warranty. Nor is there any guarantee that the information contained in this document is accurate. It is offered in the hopes of helping others, but you use it at your own risk. The author will not be liable for any damages that occur as a result of using this document.
Conventions
Important terms and concepts, when they are introduced, may be displayed in bold. Commands included in the body of the text will be displayed in
this font
. All names and addresses used in examples are just that, examples, and should not be used on your network. Do not type them in verbatim when configuring your system. Finally, in some examples where the command rquires an IP address as an argument, the IP address may be represented in this way, xx.xx.xx.xx, or aa.bb.cc.dd. You will never actually use these strings when configuring your system. They are mearly a convention of this document to specify that you should substitute the appropriate IP address at that point.1. What this document covers
There are several methods available for configuring Cisco routers. It can be done over the network from a TFTP server. It can be done through the menu interface provided at bootup, and it can be done from the menu interface provided by using the commandsetup
. This tutorial does not cover these methods. It covers configuration from the IOS command-line interface only. Useful for anyone new to Cisco routers, and those studying for CCNA.Note that this tutorial does not cover physically connecting the router to the networks it will be routing for. It covers operating system configuration only.
1.1 Reasons for using the command-line
The main reason for using the command-line interface instead of a menu driven interface is speed. Once you have invested the time to learn the command-line commands, you can perform many operations much more quickly than by using a menu. This is basically true of all command-line vs. menu interfaces. What makes it especially efficient to learn the command-line interface of the Cisco IOS is that it is standard across all Cisco routers. Also, some questions on the CCNA exam require you to know command-line commands.2. Getting started with Cisco
Initially you will probably configure your router from a terminal. If the router is already configured and at least one port is configured with an IP address, and it has a physical connection to the network, you might be able totelnet
to the router and configure it across the network. If it is not already configured, then you will have to directly connect to it with a terminal and a serial cable. With any Windows box you can use Hyperterminal to easily connect to the router. Plug a serial cable into a serial (COM) port on the PC and the other end into the console port on the Cisco router. Start Hyperterminal, tell it which COM port to use and click OK
. Set the speed of the connection to 9600 baud
and click OK
. If the router is not on, turn it on.If you wish to configure the router from a Linux box, either Seyon or Minicom should work. At least one of them, and maybe both, will come with your Linux distribution.
Often you will need to hit the
Enter
key to see the prompt from the router. If it is unconfigured it will look like this: Router>
If it has been previously configured with a hostname, it will look like this: hostname of router>
If you have just turned on the router, after it boots it will ask you if you wish to begin initial configuration. Say no. If you say yes
, it will put you in the menu interface. Say no
.2.1 Modes
The Cisco IOS command-line interface is organized around the idea of modes. You move in and out of several different modes while configuring a router, and which mode you are in determines what commands you can use. Each mode has a set of commands available in that mode, and some of these commands are only available in that mode. In any mode, typing a question mark will display a list of the commands available in that mode. Router>?
2.2 Unprivileged and privileged modes
When you first connect to the router and provide the password (if necessary), you enter EXEC mode, the first mode in which you can issue commands from the command-line. From here you can use such unprivileged commands asping, telnet, and rlogin.
You can also use some of the show
commands to obtain information about the system. In unprivileged mode you use commands like, show version
to display the version of the IOS the router is running. Typing show ?
will diplay all the show
commands available in the mode you are presently in. Router>show ?
You must enter privileged mode to configure the router. You do this by using the command enable
. Privileged mode will usually be password protected unless the router is unconfigured. You have the option of not password protecting privileged mode, but it is HIGHLY recommended that you do. When you issue the command enable
and provide the password, you will enter privileged mode.To help the user keep track of what mode they are in, the command-line prompt changes each time you enter a different mode. When you switch from unprivileged mode to privileged mode, the prompt changes from:
Router>
to Router#
This would probably not be a big deal if there were just two modes. There are, in fact, numerous modes, and this feature is probably indispensable. Pay close attention to the prompt at all times.Within privileged mode there are many sub-modes. In this document I do not closely follow Cisco terminology for this hierarchy of modes. I think that my explanation is clearer, frankly. Cisco describes two modes, unprivileged and privileged, and then a hierarchy of commands used in privileged mode. I reason that it is much clearer to understand if you just consider there to be many sub-modes of privileged mode, which I will also call parent mode. Once you enter privileged mode (parent mode) the prompt ends with a pound sign (#). There are numerous modes you can enter only after entering privileged mode. Each of these modes has a prompt of the form:
Router(arguments)#
They still all end with the pound sign. They are subsumed within privileged mode. Many of these modes have sub-modes of their own. Once you enter priliged mode, you have access to all the configuration information and options the IOS provides, either directly from the parent mode, or from one of its submodes. 3. Configuring your Cisco Router
If you have just turned on the router, it will be completely unconfigured. If it is already configured, you may want to view its current configuration. Even if it has not been previously configured, you should familiarize yourself with theshow
commands before beginning to configure the router. Enter privileged mode by issuing the command enable
, then issue several show
commands to see what they display. Remember, the command show ?
will display all the show
commands aavailable in the current mode. Definately try out the following commands: Router#show interfaces
Router#show ip protocols
Router#show ip route
Router#show ip arp
When you enter privileged mode by using the command enable
, you are in the top-level mode of privileged mode, also known in this document as "parent mode." It is in this top-level or parent mode that you can display most of the information about the router. As you now know, you do this with the show
commands. Here you can learn the configuration of interfaces and whether they are up or down. You can display what IP protocols are in use, such as dynamic routing protocols. You can view the route and ARP tables, and these are just a few of the more important options.As you configure the router, you will enter various sub-modes to set options, then return to the parent mode to display the results of your commands. You also return to the parent mode to enter other sub-modes. To return to the parent mode, you hit
ctrl-z
. This puts any commands you have just issued into affect, and returns you to parent mode.3.1 Global configuration (config)
To configure any feature of the router, you must enter configuration mode. This is the first sub-mode of the parent mode. In the parent mode, you issue the commandconfig
. Router#config
Router(config)#
As demonstrated above, the prompt changes to indicate the mode that you are now in.In connfiguration mode you can set options that apply system-wide, also refered to as "global configurations." For instance, it is a good idea to name your router so that you can easily identify it. You do this in configuration mode with the
hostname
command. Router(config)#hostname ExampleName
ExampleName(config)#
As demonstrated above, when you set the name of the host with the hostname
command, the prompt immediately changes by replacing Router
with ExampleName
. (Note: It is a good idea to name your routers with an organized naming scheme.)Another useful command issued from config mode is the command to designate the DNS server to be used by the router:
ExampleName(config)#ip name-server aa.bb.cc.dd
ExampleName(config)#ctrl-Z
ExampleName#
This is also where you set the password for privileged mode. ExampleName(config)#enable secret examplepassword
ExampleName(config)#ctrl-Z
ExampleName#
Until you hit ctrl-Z
(or type exit
until you reach parent mode) your command has not been put into affect. You can enter config mode, issue several different commands, then hit ctrl-Z
to activate them all. Each time you hit ctrl-Z
you return to parent mode and the prompt: ExampleName#
Here you use show
commands to verify the results of the commands you issued in config mode. To verify the results of the ip name-server
command, issue the command show host
.3.2 Configuring Cisco router interfaces
Cisco interface naming is straightforward. Individual interfaces are referred to by this convention: media type slot#/port#
"Media type" refers to the type of media that the port is an interface for, such as Ethernet, Token Ring, FDDI, serial, etc. Slot numbers are only applicable for routers that provide slots into which you can install modules. These modules contain several ports for a given media. The 7200 series is an example. These modules are even hot-swapable. You can remove a module from a slot and replace it with a different module, without interrupting service provided by the other modules installed in the router. These slots are numbered on the router.Port number refers to the port in reference to the other ports in that module. Numbering is left-to-right, and all numbering starts at 0, not at one.
For example, a Cisco 7206 is a 7200 series router with six slots. To refer to an interface that is the third port of an Ethernet module installed in the sixth slot, it would be interface ethernet 6/2. Therefor, to display the configuration of that interface you use the command:
ExampleName#show interface ethernet 6/2
If your router does not have slots, like a 1600, then the interface name consists only of: media type port#
For example: ExampleName#show interface serial 0
Here is an example of configuring a serial port with an IP address: ExampleName#config
ExampleName(config)#interface serial 1/1
ExampleName(config-if)#ip address 192.168.155.2 255.255.255.0
ExampleName(config-if)#no shutdown
ExampleName(config-if)#ctrl-Z
ExampleName#
Then to verify configuration: ExampleName#show interface serial 1/1
Note the no shutdown
command. An interface may be correctly configured and physically connected, yet be "administratively down." In this state it will not function. The command for causing an interface to be administratively down is shutdown
. ExampleName(config)#interface serial 1/1
ExampleName(config-if)#shutdown
ExampleName(config-if)#ctrl-Z
ExampleName#show interface serial 1/1
In the Cisco IOS, the way to reverse or delete the results of any command is to simply put no
infront of it. For instance, if we wanted to unassign the IP address we had assigned to interface serial 1/1: ExampleName(config)#interface serail 1/1
ExampleName(config-if)#no ip address 192.168.155.2 255.255.255.0
ExampleName(config-if)ctrl-Z
ExampleName#show interface serial 1/1
Configuring most interfaces for LAN connections might consist only of assigning a network layer address and making sure the interface is not administratively shutdown. It is usually not necessary to stipulate data-link layer encapsulation. Note that it is often necessary to stipulate the appropriate data-link layer encapsulation for WAN connections, such as frame-relay and ATM. Serial interfaces default to using HDLC. A discussion of data-link protocols is outside the scope of this document. You will need to look up the IOS command encapsulation
for more details.3.3 Configuring Cisco Routing
IP routing is automatically enabled on Cisco routers. If it has been previously disabled on your router, you turn it back on in config mode with the commandip routing.
ExampleName(config)#ip routing
ExampleName(config)#ctrl-Z
There are two main ways a router knows where to send packets. The administrator can assign static routes, or the router can learn routes by employing a dynamic routing protocol.These days static routes are generally used in very simple networks or in particular cases that necessitate their use. To create a static route, the administrator tells the router operating system that any network traffic destined for a specified network layer address should be forwarded to a similiarly specified network layer address. In the Cisco IOS this is done with the
ip route
command. ExampleName#config
ExampleName(config)#ip route 172.16.0.0 255.255.255.0 192.168.150.1
ExampleName(config)#ctrl-Z
ExampleName#show ip route
Two things to be said about this example. First, the packet destination address must include the subnet mask for that destination network. Second, the address it is to be forwarded to is the specified addres of the next router along the path to the destination. This is the most common way of setting up a static route, and the only one this document covers. Be aware, however, that there are other methods.Dynamic routing protocols, running on connected routers, enable those routers to share routing information. This enables routers to learn the routes available to them. The advantage of this method is that routers are able to adjust to changes in network topologies. If a route is physically removed, or a neighbor router goes down, the routing protocol searches for a new route. Routing protocols can even dynamically choose between possible routes based on variables such as network congestion or network reliability.
There are many different routing protocols, and they all use different variables, known as "metrics," to decide upon appropriate routes. Unfortunately, a router needs to be running the same routing protocols as its neighbors. Many routers can, however, run mutliple protocols. Also, many protocols are designed to be able to pass routing information to other routing protocols. This is called "redistribution." The author has no experience with trying to make redistribution work. There is an IOS
redistribute
command you can research if you think this is something you need. This document's compagnion case study describes an alternative method to deal with different routing protocols in some circumstances.Routing protocols are a complex topic and this document contains only this superficial description of them. There is much to learn about them, and there are many sources of information about them available. An excelent source of information on this topic is Cisco's website,
http://www.cisco.com
.This document describes how to configure the Routing Information Protocol (RIP) on Cisco routers. From the command-line, we must explicitly tell the router which protocol to use, and what networks the protocol will route for.
ExampleName#config
ExampleName(config)#router rip
ExampleName(config-router)#network aa.bb.cc.dd
ExampleName(config-router)#network ee.ff.gg.hh
ExampleName(config-router)#ctrl-Z
ExampleName#show ip protocols
Now when you issue the show ip protocols
command, you should see an entry describing RIP configuration.3.4 Saving your Cisco Router configuration
Once you have configured routing on the router, and you have configured individual interfaces, your router should be capable of routing traffic. Give it a few moments to talk to its neighbors, then issue the commandsshow ip route
and show ip arp
. There should now be entries in these tables learned from the routing protocol.If you turned the router off right now, and turned it on again, you would have to start configuration over again. Your running configuration is not saved to any perminent storage media. You can see this configuration with the command
show running-config
. ExampleName#show running-config
You do want to save your successful running configuration. Issue the command copy running-config startup-config
. ExampleName#copy running-config startup-config
Your configuration is now saved to non-volatile RAM (NVRAM). Issue the command show startup-config
. ExampleName#show startup-config
Now any time you need to return your router to that configuration, issue the command copy startup-config running-config
. ExampleName#copy startup-config running-config
3.5 Example Cisco Router configuration
- Router>enable
- Router#config
- Router(config)#hostname N115-7206
- N115-7206(config)#interface serial 1/1
- N115-7206(config-if)ip address 192.168.155.2 255.255.255.0
- N115-7206(config-if)no shutdown
- N115-7206(config-if)ctrl-z
- N115-7206#show interface serial 1/1
- N115-7206#config
- N115-7206(config)#interface ethernet 2/3
- N115-7206(config-if)#ip address 192.168.150.90 255.255.255.0
- N115-7206(config-if)#no shutdown
- N115-7206(config-if)#ctrl-z
- N115-7206#show interface ethernet 2/3
- N115-7206#config
- N115-7206(config)#router rip
- N115-7206(config-router)#network 192.168.155.0
- N115-7206(config-router)#network 192.168.150.0
- N115-7206(config-router)#ctrl-z
- N115-7206#show ip protocols
- N115-7206#ping 192.168.150.1
- N115-7206#config
- N115-7206(config)#ip name-server 172.16.0.10
- N115-7206(config)#ctrl-z
- N115-7206#ping archie.au
- N115-7206#config
- N115-7206(config)#enable secret password
- N115-7206(config)#ctrl-z
- N115-7206#copy running-config startup-config
- N115-7206#exit
4. Troubleshooting your Cisco router
Inevitably, there will be problems. Usually, it will come in the form of a user notifying you that they can not reach a certain destination, or any destinattion at all. You will need to be able to check how the router is attempting to route traffic, and you must be able to track down the point of failure.You are already familiar with the
show
commands, both specific commands and how to learn what other show
commands are available. Some of the most basic, most useful commands you will use for troubleshooting are: ExampleName#show interfaces
ExampleName#show ip protocols
ExampleName#show ip route
ExampleName#show ip arp
4.1 Testing connectivity
It is very possible that the point of failure is not in your router configuration, or at your router at all. If you examine your router's configuration and operation and everything looks good, the problem might be be farther up the line. In fact, it may be the line itself, or it could be another router, which may or may not be under your administration.One extremely useful and simple diagnostic tool is the
ping
command. Ping is an implementation of the IP Message Control Protocol (ICMP). Ping sends an ICMP echo request to a destination IP address. If the destination machine receives the request, it responds with an ICMP echo response. This is a very simple exchange that consists of:Hello, are you alive?
Yes, I am.
ExampleName#ping xx.xx.xx.xx
If the ping test is successful, you know that the destination you are having difficulty reaching is alive and physically reachable.If there are routers between your router and the destination you are having difficulty reaching, the problem might be at one of the other routers. Even if you
ping
a router and it responds, it might have other interfaces that are down, its routing table may be corrupted, or any number of other problems may exist.To see where packets that leave your router for a particular destination go, and how far, use the
trace
command. ExampleName#trace xx.xx.xx.xx
It may take a few minutes for this utility to finish, so give it some time. It will display a list of all the hops it makes on the way to the destination.4.2 debug
commands
There are several debug
commands provided by the IOS. These commands are not covered here. Refer to the Cisco website for more information.4.3 Hardware and physical connections
Do not overlook the possibility that the point of failure is a hardware or physical connection failure. Any number of things can go wrong, from board failures to cut cables to power failures. This document will not describew troubleshooting these problems, except for these simple things.Check to see that the router is turned on. Also make sure that no cables are loose or damaged. Finally, make sure cables are plugged into the correct ports. Beyond this simple advice you will need to check other sources.
4.4 Out of your control
If the point of failure is farther up the line, the prolem might lie with equipment not under your administration. Your only option might be to contact the equipment's administrator, notify them of your problem, and ask them for help. It is in your interest to be courtious and respectful. The other administrator has their own problems, their own workload and their own priorities. Their agenda might even directly conflict with yours, such as their intention to change dynamic routing protocols, etc. You must work with them, even if the situation is frustrating. Alienating someone with the power to block important routes to your network is not a good idea.5. References
- Leinwand, Pinsky and Culpepper Cisco Router Configuration. Indianapolis, Indiana: Cisco Press, 1998.
- Cisco Systems, Inc., http://www.cisco.com
Subscribe to:
Posts (Atom)