Browsing articles in "Tutorial"
Oct
9
2018
Troubleshoot a DMVPN phase 3 architecture
DMVPN-Phase3-in-depth

In the last article, I explained how to configure DMVPN phase3, but what are the most useful commands to troubleshoot this type of network architecture? Five are the main group of commands used to troubleshoot a DMVPN topology: show dmvpn […] show ip nhrp […] show ip eigrp […] show crypto […] The “show dmvpn” and “show ip nhrp” commands permit to obtain the state of the tunnels. On hub router, all tunnels are dynamic (D attribute) because it waits the registration from spokes routers (“ip nhrp map multicast dynamic”).

Jul
16
2018
DMVPN Phase 3: a complete guide
DMVPN-Phase3-in-depth

In a previous article, I explained what is and how it works DMVPN technology. In this article you see how to configure DMVPN phase3. This phase allows spokes to build a spoke-to-spoke tunnel and to overcomes the phase2 restriction using NHRP traffic indication messages from the hub to signal to the spokes that a better path exists to reach the target network. The phase3 configuration is based by 4 steps: Define Tunnel interface (mandatory) Define NHRP (mandatory) Define EIGRP Process (mandatory) Define IPSEC Profile (optional) In this example, there are 3 routers: one hub (Ciscozine) and two spokes.

Jun
26
2018
Understanding Cisco DMVPN
Understanding-DMVPN-Phase-2

In an old post, dated 2011, I explained various types of VPN technologies. In seven years several things have changed: SHA1 is deprecated, des and 3des are no more used for security issues, but some VPN technologies are still used with protocols more secure (SHA256, AES, …). In this article, I explain how DMVPN works and what are the key components of it. Cisco DMVPN uses a centralized architecture to provide easier implementation and management for deployments that require granular access controls for diverse user communities, including mobile workers, telecommuters, and extranet users.

Jan
10
2018
Cisco EIGRP named, a better approach
Cisco-EIGRP-named-a-better-approach

The Enhanced Interior Gateway Routing Protocol can be configured using either the classic mode or the named mode. The classic mode is the old way of configuring EIGRP. In classic mode, EIGRP configurations are scattered across the router mode and the interface mode. The named mode is the new way of configuring EIGRP; this mode allows EIGRP configurations to be entered in a hierarchical manner under the router mode. Each named mode configuration can have multiple address families and autonomous system number combinations. In the named mode, you can have similar configurations across IPv4 and IPv6.

Sep
25
2017
The power of prefix lists
The-power-of-prefix-lists

Prefix lists are used in route maps and route filtering operations and can be used as an alternative to access lists in many route filtering commands. The most notable and important difference is that a prefix-list allows you to filter networks based on their subnet mask. ACLs used in distribute list filter networks only by network addresses but they do not perform matching on subnet mask; in other words, for an ACL used in distribute list, the networks 192.168.100.0/24 and 192.168.100.0/28 are indistinguishable. Moreover, the prefix-list also allows you to specify networks in much more natural format that ACLs.

Apr
27
2017
How to install Cisco ISE using USB or CIMC interface
Cisco-ISE-CIMC

In one of my last job activities, the customer has requested to reinstall the Cisco ISE appliance (SNS-3495). The first option, a DVD reader, is not feasible due the large ISO image file; in fact, the Cisco ISE Software Version 2.2.0 full installation iso file requires more or less 8Gb. So, how can we install the software? There are two options: Using an USB pendrive(al least 16Gb) Using the Cisco Integrated Management Interface (CIMC)

Jan
16
2017
How to access network devices via Radius server
How-to-access-network-devices-via-radius-server

Suppose you manage hundreds of Cisco devices; how can you connect and secure it against unauthorized access? You can use local username, but it isn’t scalable and granular, or use an AAA Server. In fact, the benefits of AAA are: Increased flexibility and control of access configuration. Scalability. Standardized authentication methods. Multiple backup system. Additionally, AAA provides a modular way of performing the following services:

Nov
23
2016
DDNS: How to manage a device with a dynamic public IP

The DDNS aka Dynamic DNS is an old feature that several routers (non only Cisco devices) have implemented and, in some circumstances, it is very useful. DDNS is a method of automatically updating a name server in the Domain Name System (DNS), often in real time, with the active DDNS configuration of its configured hostnames, addresses or other information. It provides two mechanisms to generate or perform DDNS: the IETF standard as defined by RFC 2136 and a generic HTTP using various DNS services. In a nutshell, when this feature can simplify our lifes? When we haven’t a static IP public […]

May
31
2016
Nexus HSRP/VRRP active/active with vPC
Nexus-HSRP-active-active

In the article vPC aka Virtual PortChannel, I explained how vPC works and the benefits that it gives. However, there is another important feature using HSRP/VRRP protocols in the context of vPC: the Layer2 dual–active peer devices. What does it mean? HSRP and VRRP operate in active-active mode from data plane standpoint, as opposed to classical active/standby implementation with STP based network. From a control plane standpoint, active-standby mode still applies for HSRP/VRRP in context of vPC. A characteristic of the active HSRP/VRRP peer device is that it is the only one to respond to ARP requests for HSRP/VRRP VIP […]

Apr
20
2016
vPC aka Virtual PortChannel

The vPC aka virtual Port Channel is a Cisco technology that presents both Nexus paired devices as a unique Layer 2 logical node to a third device. The third device can be a switch, server, or any other networking device that supports link aggregation technology. From a spanning tree standpoint, vPC eliminates STP blocked ports and uses all available uplink bandwidth. Spanning-Tree is used as a fail safe mechanism and does not dictate L2 path for vPC attached devices.  

Pages:123456789»