Passed the SP written.

Took and passed the written.

Now back to doing the labs.

IPX Vol 1 - Lab 12 - Security

Lab 12 deals with Security in a very broad manner. Securing BGP, IGPs, Interfaces, logging, SNMP, NTP, anti-spoofing, Management security, and disabling unnecessary services.

Let's break it down...

12.1 - Accepting a limited amount of BGP prefixes from a neighbor

#neighbor 1.2.3.4 max-prefix 125000

12.2 - Securing BGP, on the destination router, create an ACL to allow the neighbor/source to create a TCP connection on port 179 to the destination router. Allow both sourcing from tcp 179 and destined to 179 on the destination router, then deny any to port 179 and finally permit tcp any and ip any.

12.3 - (a) Advertise a default route to neighbor #nieghbor 1.2.3.4 default-information originate.

Then configure the neighbor to only receive a default route via a prefix-list (0.0.0.0/0).

(b) RFC 1918 prefix-list should look like:

#ip prefix-list RFC1918 permit 10.0.0.0/8 le 32

#ip prefix-list RFC1918 permit 192.168.0.0/16 le 32

#ip prefix-list RFC1918 permit 172.16.0.0/12 le 32

Don't forget the le 32 since subnets of each of these ranges are still RFC1918.

(c) ORF - BGP outbound route filter is used to send a prefix-list upstream so that the filter happens there instead of after getting all the BGP prefixs and then having to filter locally. Saves resources.

#neighbor 1.2.3.4 capability orf prefix-list send

12.4 and 12.5 are OSPF and EIGRP authentication, EIGRP everything is done on the interface while OSPF area authentication is done in the area and then on the interfaces in that area.

12.6 - Anti-Spoofing

(a) to prevent spoofing configure uRPF under an interface.

#ip verify unicast source reachable-via rx allow-default

(b) uRPF in loose mode the router will drop the packet if the route for the source is via a null interface. Configured the same was as (a) plus the routes pointing to null0

(c) using an ACL to block spoofing. Create a standard ACL denying the subnets/hosts in your internal network, then apply inbound on the ingress interface.

(d) redundant

(e) configure ip accounting.

#interface s0/1.26

#ip accounting access-violations

12.7 - Logging - straight forward with the exception of Core dumps. Remember the key work "exception" to configure core dump file name, protocol, and IP addy of the dump server.

12.8 - Interactive Access

(d) SSH server - don't forget to configure a domain-name, crypto key generate rsa, and AAA if necessary.

This section was long and there are definitely some things I knew at one point but have forgotten. Good to review and to deep dive via Narbik's books.

IPX Vol 1 - Lab 11- Traffic Engineering (TE)

This is a straight forward one. TE tunnels are unidirectional, therefore, if you want bidirectional traffic between 2 end points to flow through a certain path, that means 2 tunnels. This task asks the student to prep the topology for MPLS TE, create the TE tunnels (one dynamic path and one explicit path), and verify.

Points to remember:

*prerequisiste: mpls and cef are enabled globally and on the interfaces

1. Must enable TE globally on a router

R1(config)#mpls traffic-eng tunnel

#mpls ldp router-id l0 - This is important as it will be used when creating a TE tunnel as a tunnel destination

2. Must configure TE for the routing protocol (OSPF or ISIS)

R1(config)#router os 1

#mpls traffic-eng router-id l0

#mpls traffic-eng area 0

3. Configure RSVP on the interfaces

R1(config)#interface f1/0

#ip rsvp bandwidth 75000 100 - By default the router will reserve 75% of max-reserveable bandwidth, if not defined

4. Interfaces must support traffice engineering

R1(config)#interface f1/0

#mpls traffic-eng tun

5. If using explicit path

R1(config)#ip explicit-path name ABC

#next-address 1.2.3.4 - the ip is the inbound interface of the next-hop router

#next-address .... - list all the inbound interfaces in order including the destination router

6. Create a tunnel interface

R1(config)#int tun0

#ip unnumber l0

#tun destination 200.0.0.6

#tunn mode mpls traffic-eng

#tun mpls traffic-eng path-option 1 explict name ABC

#tun mpls traffic-eng path-option 2 dynamic

#tun mpls traffic-eng autoroute announce

#tun mpls traffic band 100

There are a few things to remember here, ip addy, tunnel destination, tunnel mode, path options. The autoroute announce is used so that traffic can be forwarded on to the tunnel, it specifies that the IGP (in this case ospf) should use the tunnel when calculating SPF.

7. Specify tunnel priorities for setup and hold (lower is better)

R1(config)#int tun 0

#tunn mpls traffic prio 7 7

IPX Vol 1 - Lab 10 - Multicast

This one was a little jacked up. It started out fine but then towards the end, it went to pieces.

A few things to remember:

- multicast groups 224.0.1.39 and 224.0.1.40 are used for RP announce and discovery respectively.

- ip pim autorp listener used for sparse mode interfaces/routers so that they can receive the rp announce info in dense mode.

- I need to brush up on 10.5 - For BSR, using ip pim bsr-border will ensure dynamic RP announcements from one AS aren't propagated to the neighboring AS. For AutoRP, set up a filter to block traffic e for 224.0.1.39 and .40 and apply the filter with a multicast boundry, ie,

#int s1/0.26

#ip pim sparse-mode

#ip multicast boundary 24

#access-list 24 deny 224.0.1.39

#access-list 24 deny 224.0.1.40

#access-list 24 permit 224.0.0.0 0.15.255.255

IPX Vol 1 - Lab 9 - MPLS

Pretty straight forward for me now, nothing that I stumbled on. Just a few things that can escape you if you don't keep them in the back of your mind.

1. CEF - required to be on the routers to support MPLS
2. #no bgp default ipv4-unicast - used to disable the default behavior of putting "unspecified" commands into the AFI ipv4 unicast. This means, you have to manually go into the AFI and make your configurations.

3. If you don't advertise the WAN link then you have to source your pings from the loopback because there's no route back, since it's not being advertised.

4. BGP Next Hop Self - know when and why you need it.

Most of this is stuff I know but can forget if rushed :)

IPX Vol 1 - Lab 8 - MBGP

Task 8.3 - BGP Dampening.

- Remember that BGP dampening is under the address-family as "bgp dampening route-map ABC" and not a applied to a neighbor.

- To verify, show ip bgp dampening parameters

Restarting... again.

It's been awhile since I've hit the workbooks and it's never good to stop in the middle of something, progress becomes hindered.

I'm back to studying for the CCIE SP lab and this time I'm taking it more seriously.

New Plan!

IPX Vol1 workbook
INE Vol1 workbook

And then assess and make more plans.