How to configure EIGRP and Standard Access List (ACL) on Cisco Router

Junpier block traffic
The first term is set to match icmp-echo-request traffic destine for the IP address of 192.168.10.1/24.
The second term is to pass (or accept) all other traffic.
Without the second term all traffic not matching the first term would be dropped.
Lastly the filter is applied to an interface on the inbound direction.

R1#set firewall filter LAN-inbound term BLOCK from destination-address 192.168.10.1/24
R1#set firewall filter LAN-inbound term BLOCK from icmp-type echo-request
R1#set firewall filter LAN-inbound term BLOCK then log
R1#set firewall filter LAN-inbound term BLOCK then discard
R1#set firewall filter LAN-inbound term accept-all-else then accept
R1#set interfaces em1 family inet filter input LAN-inbound

How to configure OSPFv2 on Cisco Router

R1 connect to R2 via ethernet

R1#set interface em1 unit 0 family inet address 1.1.1.1/24
R1#set interface lo1 unit 0 family inet address 11.11.11.11/24
R1#set protocol ospf area 0.0.0.0 interface em1
R1#set protocol ospf area 0.0.0.0 interface lo1

R2#set interface em1 unit 0 family inet address 2.2.2.2/24
R2#set interface lo2 unit 0 family inet address 22.22.22.22/24

R2#set protocol ospf area 0.0.0.0 interface em1
R2#set protocol ospf area 0.0.0.0 interface lo2

show configuration
show ospf neighbor
show protocols ospf

How to configure inter-VLAN static route and RIPv2

Juniper inter-vlan

set interfaces em1 vlan-tagging

set interfaces em1 unit 10 vlan-id 10 family inet address 192.168.10.1/24

set interfaces em1 unit 20 vlan-id 20 family inet address 192.168.20.1/24

Ipv6 general -prefix

ipv6 general-prefix command is a great help when its come to configuration of IPv6 address. As we all know that when IPv6 address are 128 bits which is lengthy. When it comes to configuration of interfaces, we need to key in a long strings of hexadecimal digits. The command will make the configuration less tedious.


Take for example, ISP assigned you an IPv6 address 2003:abcd:1234::/48. Most of your interfaces on the router will most probabaly be configured within this prefix.


ipv6 general-prefix ISPIssued 2003:345:ABCD::/48


So if we want to assigned 2003:345:ABCD::1/64 to interface fa0/1


We just simply need to


int fa0/1
ipv6 address ISPIssued ::1/64


That's it. We don't have to worry that we will mistype the wrong prefix for the IPv6 addresses for all our interfaces. Noted that an interface can have more than one IPv6 addresses, so any mistype will need to be manually removed by the negate command.

DHCP configuration

Given a scenario of auto-assigning the range of address 192.168.30.0/24 to your host and to reserve the first 10 ip of the range to your static devices such as servers, printers, routers' interfaces etc ... ...


ip dhcp excluded-address 192.168.30.1 192.168.30.10  => tell dhcp server no to assign 1st 10 address


ip dhcp pool TEST  => create a TEST pool to start assigning address
network 192.168.30.0 255.255.255.0  
=> range of address to assign, will check with excluded-address to start the ip assignment
default-router 192.168.30.1  => define the default gateway to be used by PC
dns-server 192.168.30.10  => define the dns server to be used for resolving URL to IP address




For Voice configuration support
option 150 ip 192.168.30.1  => assuming CME installed on the router


Why option 150?
Cisco phones require access to a TFTP server that contains device configuration name files (.cnf file format), which enables the device to communicate with Cisco Call Manager. 

Cisco IP Phones download their configuration from a TFTP server. When a Cisco IP Phone starts, if it does not have both the IP address and TFTP server IP address pre configured, it sends a request with option 150 to the DHCP server to obtain this information.


DHCP Option 150 is Cisco proprietary. The IEEE standard that matches with this requirement is Option 66. Like option 150, option 66 is used to specify the Name of the TFTP server.


Option 66 is an open standard juniper supports it. RFC 2132 defines option 66.

Difference between option 150 and option 66

• DHCP option 150 supports a list of TFTP servers (Multiple Server IPs)
• DHCP option 66 only supports the IP address or the hostname of a single TFTP server.

Inter-VLAN routing

Traditional Inter-VLAN
- Separate links are needed for individual VLANs. In the example above, VLAN 10 and VLAN 20 are created. Thus 2 separate fastethernet links are needed to connected to the router.

Configuration on Router2
interface fa0/0
ip address 192.168.10.1 255.255.255.128
no shut
interface fa0/1
ip address 192.168.10.129 255.255.255.128
no shut

Configuration on Switch
=> connection to PC4
interface fa0/10
switchport access vlan 10

=> connection to PC5
interface fa0/20
switchport access vlan 20

=> connection to router2 interface fa0/0
interface fa0/23
switchport access vlan 10

=> connection to router2 interface fa0/1
interface fa0/24
switchport access vlan 20

Router-on-a-stick
- No separate links are needed for individual VLANs. Sub-interfaces are created to connect the Vlans, but ports on switch will need to be set to trunk mode in order for multiple vlans to pass through.

Configuration on Router0
interface fa0/0
no shut
=>good practice to set the sub-interface number to be same as the VLAN id for ease of identification
interface fa0/0.10
encapsulation dot1q 10
ip address 192.168.20.1 255.255.255.128
no shut
interface fa0/1.20
encapsulation dot1q 10
ip address 192.168.20.129 255.255.255.128
no shut

Configuration on Switch
Set the interface connecting to the end device such as client PC to be on the respective VLAN
switchport access vlan 10

Set the interface connecting to another intermediary device such as Router or Switch  to be on Trunk mode to enable multiple VLANs to pass through.
switchport mode trunk

**Make sure all the VLAN are created on all the switch if VLAN Trunking Protocol are not configured

Switch-based Inter-VLAN (L3 switch)
- Layer 3 switch allowed one to use the switch as a Layer 3 device to route traffic between different VLANs

Configuration on Multilayer Switch
ip routing  => to enable L3 function routing on switch
interface VLAN 10   => gateway for VLAN 10
ip address 192.168.30.1 255.255.255.128
no shut
interface VLAN 20   => gateway for VLAN 20
ip address 192.168.30.129 255.255.255.128
no shut
interface fa0/1   => connected to switch for VLAN 10
switchport access vlan 10

interface fa0/2   => connected to switch for VLAN 20
switchport access vlan 20

Configuration on Switch
Set the interface connecting to the device to be on the respective VLAN
switchport access vlan 10

RIP configuration

router rip
network
=>enable routing protocol RIP version 1 (classful, same subnet used throughout whole network)
=> routing table send out thru broadcast address 255.255.255.255


router rip
version 2
network

=>enable routing protocol RIP version 2 (classless, able to used different subnet VLSM)
=> routing table send out thru multicast address 224.0.0.9, UDP Port number 520
no auto-summary => no auto summarization

default-information originate => generate a default route into RIP

passive-interface fa0/0 => prevent routing update out thru interface fa0/0

Load Balancing

maximum-paths

=> default 4, maximum 6

=> IOS version 12.3 onwards up to 16

By default, RIP uses broadcast or multicast to push out routing table. If there's a need, we can push update using unicast neighbor 

Juniper

R2#set protocol rip group RIPGROUP2 neighbor em2.0

R3#set protocol rip group RIPGROUP3 neighbor em2.0

Group name is local significant

Be default Junos dont advertise route, need to create a policy

R2#set policy-options policy-statement RPOLICY term 1 from protocol rip

R2#set policy-options policy-statement RPOLICY term 1 from protocol direct

R2#set policy-options policy-statement RPOLICY term 1 then accept

R2#set protocol rip group RIPGROUP2 export RPOLICY

R3#set policy-options policy-statement RPOLICY term 1 from protocol rip

R3#set policy-options policy-statement RPOLICY term 1 from protocol direct

R3#set policy-options policy-statement RPOLICY term 1 then accept

R3#set protocol rip group RIPGROUP3 export RPOLICY

show route

Default route

R1(config)#ip route 0.0.0.0 0.0.0.0 s0/0/1 or
R1(config)#ip route 0.0.0.0 0.0.0.0 200.0.0.2


Send all packets destined for networks not in my routing table to 200.0.0.2 or out interface s0/0/1
**Normally used for connection to ISP

Juniper


set routing-options static route 0.0.0.0/0 next-hop 200.0.0.2

Static route & floating Static route

Cisco


ip route next-hop address => admin distance of 1

ip route local exit interface => admin distance of 0 like connected interface

e.g. on R1 router

ip route 10.10.30.0 255.255.255.0 10.10.20.2 or

ip route 10.10.30.0 255.255.255.0 s0

** Adding the permanent keyword to a static route statement will keep the static routes in the routing table even if the interface goes down 

floating static route (Backup route)

ip route 10.10.30.0 255.255.255.0 s0

ip route 10.10.30.0 255.255.255.0 s0 91

when running eigrp which has a default AD of 90, eigrp route will appear in routing table and only when that route goes down will the floating static route appear. Serves as a backup route.


Juniper


set routing-options static route 10.10.30.0/24 next-hop 10.10.20.2


IPv6
Cisco - ipv6 route 2001:db8::/32 s0 fe80::1/64
Juniper - set routing-options rib inet6.0 static route 2001:200:20:1::1/128 next-hop 2001:200:30:2::2

Show Version

Router# show version
Cisco Internetwork Operating System Software IOS (tm) 3600 Software (C3640-J-M), Version 11.2(6)P, SHARED PLATFORM, RELEASE SOFTWARE (fc1) Copyright (c) 1986-1997 by cisco Systems, Inc. Compiled Mon 12-May-97 15:07 by tej Image text-base: 0x600088A0, data-base: 0x6075C000 ROM: System Bootstrap, Version 11.1(7)AX [kuong (7)AX], EARLY DEPLOYMENT RELEASE SOFTWARE (fc2) Router uptime is 1 week, 1 day, 38 minutes System restarted by power-on System image file is "flash:c3640-j-mz_112-6_P.bin", booted via flash Host configuration file is "3600_4-confg", booted via tftp from 171.69.83.194 cisco 3640 (R4700) processor (revision 0x00) with 107520K/23552K bytes of memory. Processor board ID 03084730 R4700 processor, Implementation 33, Revision 1.0 Bridging software. SuperLAT software copyright 1990 by Meridian Technology Corp). X.25 software, Version 2.0, NET2, BFE and GOSIP compliant. TN3270 Emulation software. Primary Rate ISDN software, Version 1.0. 2 Ethernet/IEEE 802.3 interface(s) 97 Serial network interface(s) 4 Channelized T1/PRI port(s) DRAM configuration is 64 bits wide with parity disabled. 125K bytes of non-volatile configuration memory. 16384K bytes of processor board System flash (Read/Write) Configuration register is 0x2102


IOS image version and features => c3640-j-mz_112-6_P.bin
Dynamic(Volatile) RAM => 107520K/23552K bytes total = 107520k + 23552k = 131072k
NVRAM => 125K
Flash memory => 16384K

Show command with pipe

show ip interface brief | exclude unassigned
=> show interface with IP address

show running-config | begin router
=> show routing protocol configuration

show ip protocols
=> show the various routing protocols configured, its participating network and its various running timer

show interface trunk
=> show the interface which are configured as trunk and using 802.1q or ISL encapsulation

show ip route
=>show the routing table
R => RIP
O => OSPF
D => EIGRP
B => BGP
C => connected
S => static
* => default route

Stop those translating time

If you do not have DNS enable. You can stop those annoying translating time when you accidentally hit enter when typing anything

configure terminal

no ip domain-lookup

Reset password

Press break or Control-C when powered-up

in ROMMON

confreg 0x2142

reset

no to System Configuration Dialog

enable

configure memory

copy startup-config running-config

exit

configure terminal

configure-register 0x2102

write memory

Restore back to default

configure terminal

configure-register 0x2142

reload

=>no need to save system config

no to System Configuration Dialog

configure terminal

configure-register 0x2102

write memory

reload

Download the IOS to the rommon

rommon 1 > set 

PS1=rommon ! >  

BSI=0 

RET_2_RUTC=0 

RET_2_RTS= 

?=1  

rommon 2 > IP_ADDRESS=192.168.0.2 

rommon 3 > IP_SUBNET_MASK=255.255.255.0 

rommon 4 > TFTP_SERVER=192.168.0.3 

rommon 5 > TFTP_FILE=c1841-xxxxxx-xx.xxx-xx.xx.bin 

rommon 6 > DEFAULT_GATEWAY=192.168.0.1  

rommon 7 > tftpdnld            

IP_ADDRESS: 192.168.0.2       

IP_SUBNET_MASK: 255.255.255.0      

DEFAULT_GATEWAY: 192.168.0.1          

TFTP_SERVER: 192.168.0.3            

TFTP_FILE: c1841-xxxxxxx-xx.xxx-xx.xx.bin  

Invoke this command for disaster recovery only. 

WARNING: all existing data in all partitions on flash will be lost! 

Do you wish to continue? y/n:  [n]:  y  

Receiving c1841-xxxxxxx-xx.xxx-xx.xx.bin from 192.168.0.3 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

File reception completed. 

Copying file c1841-xxxxxxx-xx.xxx-xx.xx.bin to flash. 

Erasing flash at 0x60fc0000 

program flash location 0x60e70000 

rommon 8 > 

simple OSPF config

configure terminal

Router ospf (process id) e.g. 1

Network (interface ip starting address) (wildcard) area 0

wildcard hint:

0.0.0.0 host address

0.0.0.3 subnet mask : /30 255.255.255.252

0.0.0.7 subnet mask: /29 255.255.255.248

0.0.0.15 subnet mask: /28 255.255.255.240

0.0.0.31 subnet mask: /27 255.255.255.224

0.0.0.63 subnet mask: /26 255.255.255.192

0.0.0.127 subnet mask: /25 255.255.255.128

0.0.0.255 subnet mask: /24 255.255.255.0

Copy the IOS from router to the PC

copy c1841-12-4.xxxx.bin tftp://192.168.0.2

IP address of PC 192.168.0.2

IP address of ethernet interface of router 192.168.0.1

encrypt all password in show run

Service password-encryption

Password encryption is applied to all passwords, including 
1)username passwords
2)authentication key passwords
3)privileged command password
4)console
5)virtual terminal line access passwords
6)Border Gateway Protocol neighbor passwords. 


Keeping unauthorized individuals from viewing your password in your configuration file.

Interface configuration

Cisco


Interface (fa0/0 or s0/0/0 etc… …>)

Description (describe link) =>useful for troubleshooting as it can tell you where is it connected to

Ip address (ip address) (subnet mask)

No shut

hint: subnet mask

/32 255.255.255.255 no useful IP address

/31 255.255.255.254 no useful IP address

/30 255.255.255.252 useful for WAN link, 4 IPs (1 network, 1 broadcast, 2 user IPs)

/29 255.255.255.248 8 IPs (1 network, 1 broadcast, 6 user IPs)

/28 255.255.255.240 16 IPs (1 network, 1 broadcast, 14 user IPs)

/27 255.255.255.224 32 IPs (1 network, 1 broadcast, 30 user IPs)

/26 255.255.255.192 64 IPs (1 network, 1 broadcast, 62 user IPs)

/25 255.255.255.128 128 IPs (1 network, 1 broadcast, 126 user IPs)

/24 255.255.255.0

/23 255.255.254.0

/22 255.255.252.0

/21 255.255.248.0

/20 255.255.240.0


Juniper
Interface (fxp0,lo0,em0,fe-x/0/y,se-x/0/y)
x = PIM slot
y = Port Number


inet => IPv4


root@router#set interfaces em0 unit 0 family inet address (ip address)/(prefix)
root@router#commit


IPv6
Cisco - ipv6 address 2001:db8::1/64
Juniper - set interfaces em0 unit 0 family inet6 address 2001:200:30:2::1/64

Enable Privileged Password Login

Enable secret 5 (Level 2 password)

Cisco's Type 7 scheme is a weak protection scheme.


Type 5 uses a strong, one-way encryption hash (MD5), which will ensure greater security. 


Whenever possible, the Type 5 password protection scheme should be used.