IGMPv2 – RFC 2236

While PIM controls the communication between multicast routers, IGMP is the control protocol between routers and hosts. IGMP is similar with ICMP and it has IP protocol number 2. Because the intention is the communcation between hosts and routers, it is only sent as a link-local packet that has TTL of 1 in the IP packet header.

Continue reading

PIM Sparse-Mode (SM) Notes – RFC 4601

Uses both Shared-Tree (*,G) and Source-Tree (S,G).

PIM Sparse-Mode (SM) steps:

  1. Discover PIM neighbor and elect DR.
    PIM is the infrastructure to deliver the multicast packet. It builds the multicast network hop-by-hop. It takes the advantage of the routing table to perform RPF but it does not really matter what routing protocol derives it from. Hence this is why it is called Protocol Independent Multicast (PIM).
  2. Continue reading

Cisco IOS IPS

If you’re tasked to configure an Internet router, what features/services you would usually put in? You most definitely require NAT for LAN to Internet IP address translation, ACL for blocking unnecessary traffics from Internet to LAN, and might be a bit of router hardening by locking down some unnecessary services and management/control plane.
Continue reading

How to Fail CCIE Exam and Learn From It.

A note to myself.

Time flies!

It’s been a little more than a year since I wrote a post to my blog. Quite a few things happened in my life and priorities change.

I decided to postpone my CCIE RS lab for sometime after several failed attempts. No, I’m not giving up yet, It’s just better for myself and my family that I take a pause for it until we’re sure I can dedicate myself into it.
Continue reading

Router ACL on SVI; Inbound or Outbound?

Just a little note for SVI Access-List (or Cisco calls it Router ACL on SVI).
Three routers configured as below.

! R1

int f0/0
 ip addr 12.12.12.1 255.255.255.0
 no shut

router ospf 1
 net 0.0.0.0 0.0.0.0 a 0
 
! R2
int vlan 100
 ip addr 12.12.12.2 255.255.255.0
 
int f1/0
 switchport mode access
 switchport access vlan 100
int f0/0
 ip addr 23.23.23.2 255.255.255.0

router ospf 1
 net 0.0.0.0 0.0.0.0 a 0

! R3

int f0/0
 ip addr 23.23.23.3 255.255.255.0
 no shut

router ospf 1
 net 0.0.0.0 0.0.0.0 a 0
 
ip http server

I’m testing the Access-list on SVI and testing it by ICMP and HTTP from R1 (12.12.12.1) to R3 (23.23.23.3) and check the matches on the ACL. I’m expecting that the HTTP access will be denied and ICMP will be allowed.

The direction of the access-list and the SVI (inbound or outbound) tested as below.

! R2
Extended IP access list ACL
    10 deny tcp host 12.12.12.1 host 23.23.23.3 eq www
    20 permit ip any any (1 match)

int vlan 100
 ip access-group ACL out
 
! RESULT. ICMP and HTTP access are both OK

! R2
Extended IP access list ACL
    10 deny tcp host 23.23.23.3 eq www host 12.12.12.1 
    20 permit ip any any (5 matches)

int vlan 100
 ip access-group ACL in

! RESULT. ICMP and HTTP access are both OK

! R2
Extended IP access list ACL
    10 deny tcp host 23.23.23.3 eq www host 12.12.12.1 (6 matches)
    20 permit ip any any 

interface Vlan100
 ip access-group ACL out

! RESULT. ICMP OK, HTTP access is opened then timed-out.
! R2
Extended IP access list ACL
    10 deny tcp host 12.12.12.1 host 23.23.23.3 eq www (3 matches)
    20 permit ip any any 

interface Vlan100
 ip access-group ACL in

! RESULT. ICMP OK, HTTP access is UNREACHABLE 

Summary. The rule of thumb for the direction of the ACL on SVI above are:

ACL always have the form of , while the direction of the ACL int SVI works as below:

  • If it’s INBOUND (“ip access-group ACL out”), then it means “It’s going OUT TO the VLAN100 access ports.”
  • If it’s OUTBOUND (“ip access-group ACL in”), then it means “It’s going AWAY from the VLAN100″

As much as it’s confusing as it can be, I prefer to use VLAN ACCESS-MAP.

Router Output Queue

Output Queue
For the egress queue, router interface uses two queues. The first queue is, like Input queue, Output queue is a software queue. The default queuing mechanism is FIFO and it can be change to WFQ or CBWFQ. The default value for this queue is 40 packets.

Rack1R1#sh int e0/0 | i queue
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Output queue: 0/40 (size/max)
  
Rack1R1#    sh int e0/0 | i Queueing
  Queueing strategy: fifo

Continue reading