Sunday, December 5, 2010

Misc Stuff

debug inter fa 0/0 ==> This enters into just debugging this interface

debug eigrp packet ==> This is the debug you want to see on the command above!

** undebug all
** undebug inter fa 0/0

debug ip error ==> This will tell you all the error's you are getting on anything.

Example: BGP peering, if the neighbors wont peer it will tell you its a hop count issue!

show ip traffic

*Feb 26 15:10:42.235: %OSPF-4-FLOOD_WAR: Process 1 re-originates LSA ID 141.34.25.0 type-3 adv-rtr 141.34.200.1 in area 0

This happens if there are 2 routers with the same router ID!!
______________________

UDLD, like Loop Guard, is used to prevent loops due to unidirectional links. The difference between the features is that Loop Guard uses STP BPDUs to detect these failures, while UDLD uses its own keepalive. UDLD is a Cisco proprietary feature in which peers discover each other by exchanging frames sent to the well-known MAC address 01:00:0C:CC:CC:CC
In "Normal" mode if the physical state of port (as reported by Layer 1) is still up UDLD marks this port as "Undetermined", but does NOT shut down or disable the port, and it continues to operate under its current STP status. This mode of operation is informational and potentially less disruptive (though it does not prevent STP loops).

If UDLD is set to "Aggressive" mode, once the switch loses its neighbor it actively tries to re-establish the relationship by sending a UDLD frames 8 times every 1 second. If the neighbor does not respond after that the port is considered to be unidirectional and sent to err-disable state.
______________________

access-list 1 permit 1.1.1.0 0.0.254.255

R 1.1.1.0 [120/1] via 10.1.1.1, 00:00:03, FastEthernet0/0
R 1.1.3.0 [120/1] via 10.1.1.1, 00:00:03, FastEthernet0/0
R 1.1.5.0 [120/1] via 10.1.1.1, 00:00:03, FastEthernet0/0

access-list 1 permit 1.1.0.0 0.0.254.255

R 1.1.2.0 [120/1] via 10.1.1.1, 00:00:00, FastEthernet0/0
R 1.1.4.0 [120/1] via 10.1.1.1, 00:00:00, FastEthernet0/0
R 1.1.6.0 [120/1] via 10.1.1.1, 00:00:00, FastEthernet0/0
______________________

You must nave AAA new-model turned on for this option to be available.

R1(config)#radius-server local
R1(config-radsrv)#?
Local RADIUS server configuration commands:
authentication   supported authentication
eapfast             EAP-FAST configurations
exit                  Exit from local radius server sub mode
group               Configure client groups
nas                  Configure allowed Network Access Servers
no                    Negate a command or set its defaults
user                 Configure client usernames and passwords

R1(config-radsrv)#

You can configure a router as a "RADIUS-SERVER" and not just point it to one! It seems like a great way to test if your radius configuration is working without having a real radius server to point to!
______________________

- BPDU Guard > Used to enforce access layer security, when an erroneous BPDU is received on an access interface, by transitioning the interface to shutdown and err-disable state. > Err-disable recovery can be configured to bring the interface out of err-disable state automatically after configured interval. > The err-disable state can be seen with "sh interface status" > Configured globally with "spanning-tree portfast bpduguard default" > Interface configuration "spanning-tree bpduguard enable"

- BPDU Filter > Drops all inbound BDPU's and does not send BDPU's out of the interface. > Unlike BPDU guard, the interface does not go into err-disable state when violation occurs. > Other user traffic will still be forwarded. > If BPDU filter default is enabled with portfast, all interface will run in portfast mode except those which are receiving BPDU's. > Configured globally with "spanning-tree portfast bpdufilter default" > Interface configuration "spanning-tree bpdufilter enable"

- ROOT Guard > Similar to BDPU guard, but the difference is a root guard interface is only disabled if a superior BPDU is received,
placing the interface into ROOT_INCONSISTANT_STATE. > It should be enabled on a downstream interface, which should never become a root-port. > A superior BPDU indicates a better cost to the root bridge, than what is currently installed. > Interface configuration "spanning-tree guard root"

- LOOP Guard > Is used to prevent STP loops from occurring due to a unidirectional link. > Similar to UDLD but instead uses BDPU keepalive to determine unidirectional traffic. > If a blocked port transitions to forwarding state erroneously, a loop can occur. > Blocked ports will be transitioned into LOOP_INCONSISTANT_STATE to avoid loops. > Interface configuration "spanning-tree guard loop"

No comments:

Post a Comment