PPP Authentication

• Is it a mutual authentication or only one side is authenticating?
• Clear text or scrambled password in running config:
• username R1 password 0 test
• no service password-encryption
• VTY and Console line authentication
• aaa authentication login default line none
• none required if no password is set on console
• AAA settings
• aaa authentication ppp default group radius local-case

IPv6 Multicast Routing with BSR

R1(config)#ipv6 routing
R1(config)#ipv6 pim bsr candidate rp <IPv6 Address>
R1(config)#ipv6 pim bsr candidate bsr <IPv6 Address> priority X


BSR and RP can't be on a single router.

IP Addressing in Mars!

Got this few days ago in a test lab:

*Mar  1 00:10:50.423: %BGP-6-NEXTHOP: Invalid next hop (254.192.2.52) received from FEC0:234::4: martian next hop

it seems Class E was reserved to be used on Mars, always knew we are not alone!

Debug Condition

debug condition interface fastEthernet 0/1
debug ip ospf hello

Full Packet Dump

R1#debug ip packet detail <ACL#> dump

dump is a hidden option.

OSPF Downward Option

PE1 router advertises intra area routes int MP-BGP. other PE2 redistributes the MP-BGP routes into OSPF as LSA type 3 (Summary address) as MPLS backbone acts as an OSPF superbackbone.

PE2 sets the Down bit on those routes to avoid routing loops in scenarios which a site is dual homed to the service provider network.

If a router receives a Type 3 LSA with its Down bit set on an interface that belongs to a VRF, it drops the LSA. In cases which the site is not dual home this loop prevention mechanism is undesirable.

To disable this behaviour the following command can be used under router ospf, which no longer perform PE specific checks:

R1(config-router)# capability vrf-lite

If the router doesn't support that command, different OSPF domain-ids should be set on the PE routers, which in turn changes the route types to External(LSA Type 5) instead of Summary (LSA Type3).

max-reserved-bandwidth

To change the percent of interface bandwidth allocated for Resource Reservation Protocol (RSVP), class-based weighted fair queueing (CBWFQ), low latency queueing (LLQ), IP RTP Priority, Frame Relay IP RTP Priority, Frame Relay PVC Interface Priority Queueing (PIPQ), or hierarchical queueing framework (HQF), use the max-reserved bandwidth command in interface configuration mode.


http://www.cisco.com/en/US/docs/ios/qos/command/reference/qos_m1.html#wp1054626

Frame Relay RTP Priority

map-class frame-relay <NAME>
frame-relay ip rtp priority <LOW PORT NUMBER> <PORT RANGE> <BANDWIDTH>

Don't forget to configure frame-relay fragmentation (FRF.12) as RTP Priority doesn't work without frame-relay fragmentation.
map-class frame-relay <NAME>
frame-relay fragmentation <SIZE>

Frame Relay Traffic Shape

R1(config)# map-class <CLASS-NAME>
R1(config-map-class)#frame-relay cir <CIR>
R1(config-map-class)#frame-relay bc <CIR>
R1(config-map-class)#frame-relay be <CIR>
R1(config-if)# frame-relay traffic-shaping

Apply to PVC:
R1(config-if)# frame-relay interface-dlc <PVC>
R1(config-fr-dlci)#class <CLASS-NAME>

Apply to interface:
R1(config-if)# frame-relay class <CLASS-NAME>


CIR=Bc/Tc

Be=(AR-CIR)*Tc

AR= Available Rate, the actual physical interface speed.


Don't forget to enable traffic shaping on interface first

R1(config-if)# frame-relay traffic-shaping





http://www.ine.com/resources/01700368.htm

Serial Link Compression

PPP Predictor:
Less CPU, more memory, less efficient.
R1(config-if)# compress predictor

HDLC Stacker (LZ):
More CPU, less memory, more efficient.
R1(config-if)# compress stacker

Frame Relay FRF.9 Compression
R1(config-if)# frame-relay map ip <IP-ADDRESS> <PVC> broadcast IETF payload-compression FRF9 stac one-way-negotiation

Selective Packet Discard

It applies a form of random packet drop to interface FIFO input queue.
It's a hidden command from IOS parser.

ip spd enable

ip spd mode aggressive --> bad packets are dropped as soon as the minimum threshold for hold-queue
is reached

spd headroom <x> --> BGP, IGP, L2 Keepalives

spd extended-headroom <x> --> IGP, L2 Keepalives

ip spd queue max-threshold <x>

ip spd queue min-threshold <x>

show ip spd

http://www.cisco.com/en/US/products/hw/routers/ps167/products_tech_note09186a008012fb87.shtml

Don't Miss the Permit Sequence in route-map

While modifying BGP route attributes with route-map, always remember to add permit line at the end of the list, or you'll end up filtering those routes which haven't been matched by previous route-map entries.

Redistribute iBGP Routes into IGP

Issuing redistribute bgp command under IGP routers only redistribute EBGP routes into the IGP. In order to redistribute iBGP learnt routes into IGP redistribute bgp internal command should be used.

To avoid routing loops and IGP routes to preempt iBGP routes, it's recommended to increase the IGP AD to a value higher than iBGP AD (200).

BGP RIB-failure and bgp suppress-inactive

RIB-failure means although the BGP route is valid (reachable next-hop) it's not being installed in the routing table. One of the main reasons for that behaviour is to have an exact match for that route already installed in the routing table with a better administrative distance, which in case of iBGP learnt routes any IGP has better AD.

Such routes with RIB-failure are advertised to BGP peers by default as the hidden command, no bgp suppress-inactive exists under router bgp. If bgp suppress-inactive command those routes will no longer be advertised to BGP peers.

BGP Decision Process and AS_CONFED_SET

Entire AS_CONFED_SET counts as single entry when comparing AS_PATH length.

EBGP Session from Loopback without Increasing TTL

Instead of using neighbor ebgp-multihop, the neighbor disable-connected-check command is used to disable the connection verification process for eBGP peering sessions that are reachable by a single hop but are configured on a loopback interface or otherwise configured with a non-directly connected IP address.

http://www.cisco.com/en/US/docs/ios/12_3t/ip_route/command/reference/ip2_n1gt.html#wp1109875

Enforce Specific Router to Establish BGP Session

Normally the router which has the lowest IP address is responsible to establish the BGP session to remote TCP port 179. However as defined in RFC 4271 (A Border Gateway Protocol 4) - BGP Connection Collision Detection Mechanism - the session originated from the device with higher BGP rouer-id is maintained and the other session is dropped.

To enforce a router to always become the BGP Client (establish TCP session from a high number TCP port to TCP 179), configure loopback addresses in neighbour command and set update-source on the router that you wish to always become client.

Resource Limitation in OSPF

Limit maximum number of LSAs in the database:
R1(config-router)#max-lsa <1-4294967294>

Limit maximum number of redistributed routes:
R1(config-router)#redistribute maximum-prefix <1-4294967294>

To specify the minimum percentage of CPU process time OSPF takes before the CPU should yield to a process with a higher priority:
R1(config-router)#process-min-time percent <1-100>

http://www.cisco.com/en/US/docs/ios/iproute_ospf/command/reference/iro_osp2.html

Sub-second Hello Interval in OSPF

R1(config-if)#ip ospf dead-interval minimal hello-multiplier <3-20>

OSPF Summary and Discard Route

R1(config-router)#area 0 range 100.0.0.0 255.255.192.0
R1(config-router)#no discard-route internal

Same as BGP and EIGRP, when summarising networks in OSPF, it automatically adds a route to Null0 interface. discard-route command stops OSPF from generating that route.

Conditional Default Route with IP SLA in OSPF

R1(config)#ip sla 1

R1(config-ip-sla)#icmp-echo x.x.x.x

R1(config-ip-sla)#frequency y

R1(config-ip-sla)#ip sla schedule 1 life forever start-time now

R1(config)#exit

R1(config)#track 1 ip sla 1

R1(config)# ip prefix-list TRACK_DUMMY permit 1.0.0.1/32

R1(config)#route-map TRACK IPSLA

R1(config-route-map)#match ip add prefix-list TRACK_DUMMY

R1(config)#router ospf 1

R1(config-router)#default-information originate always route-map TRACK_IPSLA

OSPF Type 7 to 5 Translation

• ABR with the highest router-id does the translation (avoid unnecessary and redundant LSA generation)
• Preserves forward address
• There is no type 4 ASBR summary (as forwarding address is preserved)
• Yet the calculation of the final forwarding path stays independent

Cisco Guide to Harden Cisco IOS Devices

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml