Networking-Blog

My WordPress Blog

Cisco 877w WPA Key Wireless Configuration

dot11 ssid CommsWireless
authentication open
authentication key-management wpa
guest-mode
wpa-psk ascii 0 12345678910
!
interface Dot11Radio0
no ip address
!
encryption mode ciphers tkip
!
ssid CommsWireless
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
world-mode dot11d country GB outdoor
!
interface Dot11Radio0.1
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
bridge-group 1
bridge-group 1 spanning-disabled
!
!
interface BVI1
description $ES_LAN$
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
!
bridge 1 protocol ieee
bridge 1 route ip

!

Route-Map NaTing

ip nat inside source route-map nonat interface GigabitEthernet0/1 overload
!
route-map nonat permit 12
match ip address NONAT
!
!
ip access-list extended NONAT
deny   ip 10.10.10.0 0.0.0.255 10.10.11.0 0.0.0.255 (deny NaTing across the link via ipsec vpn)
permit ip 10.10.10.0 0.0.0.255 any

Cisco GRE over IPSEC

GRE is a tunneling protocol used to transport packets from one network through another network.

If this sounds like a virtual private network (VPN) to you, that’s because it theoretically is: Technically, a GRE tunnel is a type of a VPN—but it isn’t a secure tunneling method. However, you can encrypt GRE with an encryption protocol such as IPSec to form a secure VPN.

In fact, the point-to-point tunneling protocol (PPTP) actually uses GRE to create VPN tunnels.

For example, if you configure Microsoft VPN tunnels, by default, you use PPTP, which uses GRE

Local Network Configuration :

crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key test address 2.2.2.2 no-xauth
crypto isakmp keepalive 15 5
!
!
crypto ipsec transform-set COMMTRANSIT esp-aes esp-sha-hmac
!
crypto ipsec profile COMMS 
set transform-set COMMTRANSIT
!
!
interface Tunnel0
 ip unnumbered GigabitEthernet0/0
 keepalive 10 3
 tunnel source 1.1.1.1
 tunnel destination 2.2.2.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile COMMS
!
!
interface GigabitEthernet0/0
 description COMMS-PRIMARY
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip inspect myfw in
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
interface GigabitEthernet0/1
 ip address 1.1.1.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
router rip
 version 2
 network 10.0.0.0
!
ip route 10.10.11.0 255.255.255.0 Tunnel0
!

Remote Network Configuration :

crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key test address 1.1.1.1 no-xauth
crypto isakmp keepalive 15 5
!
!
crypto ipsec transform-set COMMTRANSIT esp-aes esp-sha-hmac
!
crypto ipsec profile COMMS 
set transform-set COMMTRANSIT
!
!
interface Tunnel0
 ip unnumbered GigabitEthernet0/0
 keepalive 10 3
 tunnel source 2.2.2.2
 tunnel destination 1.1.1.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile COMMS
!
!
interface GigabitEthernet0/0
 description COMMS-SECONDARY
 ip address 10.10.11.1 255.255.255.0
 ip nat inside
 ip inspect myfw in
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
interface GigabitEthernet0/1
 ip address 2.2.2.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
router rip
 version 2
 network 10.0.0.0
!
ip route 10.10.10.0 255.255.255.0 Tunnel0

Cisco HRSP Load Balancing Protocol

Hot Standby Router Protocol (HSRP) is a Cisco proprietary redundancy protocol for establishing a fault-tolerant default gateway.

Primary-Router-Config :

interface GigabitEthernet0/0
 description Comms-Primary-Router
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip inspect myfw in
 ip virtual-reassembly
 duplex auto
 speed auto
 standby 1 ip 10.10.10.3
 standby 1 timers msec 500 2
 standby 1 priority 110
 standby 1 preempt delay minimum 1
 standby 1 authentication LocalLan
 standby 1 name Group1
 standby 1 track 4 decrement 100
 standby 1 track 5 decrement 15
 !
!
interface GigabitEthernet0/1
 description WAN_Interface
 ip address 1.1.1.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
track 4 interface GigabitEthernet0/0 line-protocol
!
track 5 interface GigabitEthernet0/1 line-protocol
!

Secondary-Router-Config :

interface GigabitEthernet0/0
 description Comms-Seondary-Router
 ip address 10.10.10.2 255.255.255.0
 ip nat inside
 ip inspect myfw in
 ip virtual-reassembly
 duplex auto
 speed auto
 standby 1 ip 10.10.10.3
 standby 1 timers msec 500 2
 standby 1 preempt delay minimum 1
 standby 1 authentication LocalLan
 standby 1 name Group1
 standby 1 track 4 decrement 100
 standby 1 track 5 decrement 15
!
!
interface GigabitEthernet0/1
 description WAN_Interface
 ip address 1.1.1.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
!
track 4 interface GigabitEthernet0/0 line-protocol
!
track 5 interface GigabitEthernet0/1 line-protocol

Cisco GLBP Load Balancing Protocol

Gateway Load Balancing Protocol (GLBP) protects data traffic from a failed router or circuit, like Hot Standby Router Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP), while allowing packet load sharing between a group of redundant routers.

Primary Router Config :

interface GigabitEthernet0/0
 description Comms-Primary-Router
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip inspect myfw in
 ip virtual-reassembly
 duplex auto
 speed auto
 glbp 1 ip 10.10.10.254
 glbp 1 timers msec 500 2
 glbp 1 priority 150
 glbp 1 preempt delay minimum 5
 glbp 1 weighting 110 lower 90
 glbp 1 authentication md5 key-string 0 group1
 glbp 1 name BSSGROUP
 glbp 1 weighting track 1 decrement 30
 glbp 1 forwarder preempt delay minimum 5
!
!
track 1 interface GigabitEthernet0/1 line-protocol
!
interface GigabitEthernet0/1
description WAN_Interface
 ip address 2.2.2.2 255.255.255.0
  ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto

Secondary Router Config :

interface GigabitEthernet0/0
 description Comms-Secondary-Router
 ip address 10.10.10.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 glbp 1 ip 10.10.10.254
 glbp 1 timers msec 500 2
 glbp 1 priority 150
 glbp 1 preempt delay minimum 5
 glbp 1 weighting 110 lower 90
 glbp 1 authentication md5 key-string 0 group1
 glbp 1 name BSSGROUP
 glbp 1 weighting track 1 decrement 30
 glbp 1 forwarder preempt delay minimum 5
!
!
track 1 interface GigabitEthernet0/1 line-protocol
!
interface GigabitEthernet0/1
description WAN_Interface
 ip address 1.1.1.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto

Troubleshooting Commands for Cisco Routers

Typical Troubleshooting Commands for Router / Switch

Show controllers Ethernet [interface number] To display statistics like missing datagrams, memory errors, buffer errors, and overflow errors for an Ethernet interface on a Cisco router (Please note this command will not give you information on internal hardware errors)
Show flash To display the router images stored in NVRAM
Show buffers To display statistics for the buffer pools in router (Please note that the router has one pool of queuing elements and five pools of packet buffers of different sizes. Network server keeps counts of the number of buffers outstanding, the number of buffers in the free list, and the maximum number of buffers allowed in the free list for each pool)
Show processes To display information about the active processes in a router
Show tech-support To show tech support router conditions
Show version To show current status of router
Debug ip rip To check if RIP routing is operating properly
Show ip route To display the entries in the routing table
Show version To obtain a router’s firmware version
Show running-config To obtain a router’s current configuration
Show interface fddi 3/0 To display an upstream neighbor value of 0000 0000 0000 for FDDI (Keep in mind that 0000 0000 0000 means the upstream neighbor is unknown, indicating that a physical problem is likely to have occurred)
Debug isdn q921 / debug isdn q931 To troubleshoot ISDN BRI layer 2 and 3
Show controller bri To view information specifically about the D channel of a BRI line
Logging console level To send debugging output to the consol
Show frame-relay To obtain statistics about a PVC (Permanent Virtual Circuit) on all Frame Relay interfaces

Cisco DSL Mode Tweaks

1. dsl operating-mode auto

To configure the (DSL) operating mode, use the :

Interface Atm0
dsl operating-mode itu-dmt

dsl operating-mode {adsl2 [annex a | annex m] | adsl2+ [annex a | annex m] |
ansi-dmt | auto | itu-dmt}

The router continues switching between modes, in sequence, until the router reaches the state
showtime (which signifies that the connection attempt was successful) and connects using one of the modes.

This switching process is designed specifically for expediting DSL performance.

2. dsl sync mode

To set a preference for Digital Subscriber Line (DSL) synchronization mode, use the :

interface atm0
dsl sync mode itu-dmt

3. dsl sync interval

To set the interval of time between ANSI synchronization and ITU synchronization, use the: interface atm0
dsl sync interval secondsBy default, the DSL synchronization interval is 2 seconds.

Number of seconds between ITU and ANSI synchronization.
This number must be within the range from 2 to 360 seconds.

4. dsl lom

(lom = Loss Of Margin)

 dsl lom number  (1-250)

Enables LoM monitoring and checks for the specified number of consecutive LoM messages.
When message count exceeds configured size it will cause the router  adsl line to resync with the dslam.

5. dsl noise-margin

Amount by which a signal exceeds the minimum amount for proper operation. If dsl noise margin
reaches this peak it will cause the adsl line to resync.

interface atm0
dsl noise-margin -3

6dB or below is bad and will experience no sync or intermittent sync problems
7dB-10dB is fair but does not leave much room for variances in conditions
11dB-20dB is good with no sync problems
20dB-28dB is excellent
29dB or above is outstanding

6. dsl max-tone-bits

Sets the maximum bits per tone limit.
Integer ranges from 2 dB to 14 dB with a granularity of 1 dB.

interface atm0
dsl max-tone-bits 10

7. dsl power-cutback

maximum noise margin that can occur on a digital subscriber line (DSL) before a power cutback happens.
default value of 31
Maximum noise margin in decibels. Range is 1 to 30.

interface atm0
dsl power-cutback 1

8. dsl bitswap both

is for G.DMT – it’s good for the connection in terms of stability. Should be left on, and if I’m not
mistaken I think it’s for adapting to changes on a line (swapping bit allocations).

Bitswapping: adapts to errors on the line:

As line conditions change, bit swapping allows the modem to swap bits around different channels,
without retraining, as each channel becomes more or less capable. If bit swapping is disabled then this
does not happen and the modem needs to retrain in order to adapt to changing line conditions.

Complete Configuration :

Eg :
interface atm0
dsl operating-mode itu-dmt
dsl sync mode itu-dmt
dsl sync interval 30
dsl lom 200
dsl noise-margin -3
dsl max-tone-bits 10
dsl power-cutback 1
dsl bitswap bot
h

On routers that don’t have the below firmware:

Init FW:         init_AMR-4.0.015.bin
Operation FW:    AMR-4.0.015.bin
FW Source:       external
FW Version:      4.0.15

Issue the command :
service internal

A Tip

Remember previously how you had to issue the command “service internal” to configure noise margin
settings…well that is no longer the case with this new firmware! Now it is by default in the atm0 interface
mode, and theres a few other settings you can adjust as well..

cisco877(config-if)#dsl ?
bitswap              Bitswap Feature
enable-training-log  enable the fw training log for Showtime and failure  cases
gain-setting         ADSL programmable gain setting
lom                          Loss Of Margin watch counter for line retrain
max-tone-bits      set maximum bits per tone limit
noise-margin       set noise margin offset
operating-mode   auto or specific ADSL mode
power-cutback     Noise Threshold for Power CutBack
sync                        ADSL sync preferences

Cisco FTP Download of DSL Firmware: adsl_alc_firmware.4-10-9.bin

ftp://ftp.cisco.com/pub/access/800/adsl_alc_20190.bin

rename firmware to :

adsl_alc_20190.bin

Upload to flash via tftp
Reboot router
run command: show dsl int atm0

Should see:

Init FW:         init_AMR-4.0.015.bin
Operation FW:    AMR-4.0.015.bin
FW Source:       external
FW Version:      4.0.15

Cisco 1841 Netflow

Cisco 1841 Netflow Configuration :

flow exporter NETFLOW1
destination 192.168.1.254
source FastEthernet0/1
transport udp 9996
!
flow monitor NETFLOW
record netflow-original
exporter NETFLOW1
cache timeout active 1
!
interface FastEthernet0/1
description LAN-Interface
ip flow monitor NETFLOW input
!
interface FastEthernet0/0
description WAN-Interface
ip flow monitor NETFLOW input
end

Cisco Netflow

Interface mode :

ip route-cache flow
!
config mode :

ip flow-cache timeout inactive 30
ip flow-cache timeout active 60
ip flow-cache entries 10240
ip flow-egress input-interface
ip flow-capture vlan-id
ip flow-capture ip-id
ip flow-export source vlan 2
ip flow-export version 5
ip flow-export destination 192.168.2.4 9996
ip flow-top-talkers
top 10
sort-by bytes
cache-timeout 3600000
match protocol tcp
!
ip flow-capture packet-length
ip flow-capture ttl
ip flow-capture mac-addresses
!
ip route 192.168.2.4 255.255.255.255 (Wan Interface ip address)
“If going over ipsec vpn. To force packets to traverse the vpn link”.
!

show ip cache flow

Cisco Ipsec Site-Site VPN

Cisco Ipsec Site-Site VPN Configuration :

Local Site :

crypto isakmp policy 1
 encr aes
 hash sha
 authentication pre-share
 group 2
crypto isakmp key test address 1.1.1.1
!
crypto ipsec transform-set comms esp-aes esp-sha-hmac
!
crypto map comms 1 ipsec-isakmp
 set peer 2.2.2.2
 set transform-set comms
 match address 102
!
access-list 102 permit ip 10.10.10.0 0.0.0.255 172.0.0.0 0.31.255.255
                              (Lan Ip)             (Remote Subnet)
!
!
access-list 101 deny ip 10.10.10.0 0.0.0.255 172.0.0.0 0.31.255.255
       (Deny Traffic to be NaTed over the VPN Link)
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
       (Permit Local Traffic to be NaTed)
!
!
ip nat inside source list 101 interface Dialer0 overload
!
interface FA0/0
 description Connectioon_to_WAN
 ip address 1.1.1.1 255.255.255.0
 ip access-group INTERNET in
 ip nat outside
 crypto map comms
!
interface FA0/1
 description Connection_to_LAN
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
!
ip access-list extended INTERNET
permit esp host 2.2.2.2 any
permit udp host 2.2.2.2 any eq isakmp
!
end

Remote Site :
crypto isakmp policy 1
 encr aes
 hash sha
 authentication pre-share
 group 2
crypto isakmp key test address 2.2.2.2
!
crypto ipsec transform-set comms esp-aes esp-sha-hmac
!
crypto map comms 1 ipsec-isakmp
 set peer 1.1.1.1
 set transform-set comms
 match address 102
!
access-list 102 permit ip 172.0.0.0 0.31.255.255 10.10.10.0 0.0.0.255
                               (Lan Ip)             (Remote Subnet)
!
!
access-list 101 deny ip 172.0.0.0 0.31.255.255 10.10.10.0 0.0.0.255
      (Deny Traffic to be NaTed over the VPN Link)
access-list 101 permit ip 172.0.0.0 0.31.255.255 any
      (Permit Local Traffic to be NaTed)
!
!
ip nat inside source list 101 interface Dialer0 overload
!
interface FA0/0
description Connectioon_to_WAN
ip address 2.2.2.2 255.255.255.0
ip access-group INTERNET in
ip nat outside
crypto map comms
!
interface FA0/1
description Connection_to_LAN
ip address 172.16.1.1 255.255.255.0
ip nat inside
!
ip access-list extended INTERNET
permit esp host 1.1.1.1 any
permit udp host 1.1.1.1 any eq isakmp
!
end

VPN Tweaks :

config terminal

crypto isakmp keepalive 15 10
!
crypto map comms securewan 1 ipsec-isakmp
set security-association lifetime kilobytes 18432000
set security-association lifetime seconds 86400
set security-association idle-time 7200

2 Types of VPN Encryption :

crypto ipsec transform-set esp-aes esp-md5-hmac
crypto ipsec transform-set esp-aes esp-sha-hmac
!
crypto isakmp policy 1
 hash md5
 hash sha