Thursday, October 27, 2011

CCNP TSHOOT - Ticket 4



Just a short note to remind, in exam, you can't use "sh run | include bgp" command. If you doubt which one you can use, check in CCNP Tshoot Demo from Cisco website.

Below are the processes to troubleshoot.

Client1#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.2.1.3        YES DHCP   up                    up
FastEthernet0/1            unassigned      YES NVRAM  administratively down down
Client1#ping 10.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/80/128 ms
Client1#ping 209.65.200.225

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.225, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 80/89/108 ms
Client1#ping 209.65.200.226

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.226, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
------------------------------
Pinging stop in 209.65.200.226. Check BGP neighbour status first in R1.


R1#sh ip bgp summary
BGP router identifier 1.1.1.1, local AS number 65001
BGP table version is 2, main routing table version 2
1 network entries using 117 bytes of memory
1 path entries using 52 bytes of memory
2/1 BGP path/bestpath attribute entries using 248 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 417 total bytes of memory
BGP activity 1/0 prefixes, 2/1 paths, scan interval 60 secs

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
209.65.200.226  4 65002       0       0        0    0    0 never    Active

-----------------------------------------------
R1 has broken BGP neighbour status with another router. As you see that, it's in Active state and no messages and prefix has received.

Let's check R1's bgp configuration.


router bgp 65001
 no synchronization
 bgp log-neighbor-changes
 network 209.65.200.224 mask 255.255.255.252
 neighbor 209.65.200.226 remote-as 65002
 no auto-summary
------------------
It seems like BGP configuration is correct and something wrong in IP access-list. Check access-list in R1.

ip nat inside source list 10 interface Serial1/1 overload
!
access-list 10 permit 10.2.2.0 0.0.0.255
access-list 10 permit 10.2.4.0 0.0.0.255
access-list 10 permit 10.1.4.0 0.0.0.255
access-list 10 permit 10.10.4.0 0.0.0.255
access-list 10 permit 10.1.1.0 0.0.0.255
access-list 10 permit 10.2.1.0 0.0.0.255
access-list 40 permit 209.65.200.241
access-list 40 deny   10.1.0.0 0.0.255.255
access-list 40 deny   10.2.0.0 0.0.255.255
ipv6 router ospf 6
 log-adjacency-changes
-----------------
Here is the problem. IP access-list 40 is not allowing 209.65.200.224/30 network and applied to Serial 1/1 interface. So, let's fix and solve the problem.

As soon as after doing following changes in R1, all are solved.

R1(config)#ip access-list standard 40
R1(config-std-nacl)#per
R1(config-std-nacl)#permit 209.65.200.224 0.0.0.3
R1(config-std-nacl)#^Z
R1#
*Mar  1 00:21:19.411: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:21:25.291: %BGP-5-ADJCHANGE: neighbor 209.65.200.226 Up
R1#
------------------------------
The problem device is R1, and it's related with ip access-list and can fixed by adding new access-list in access-list 40.

CCNP TSHOOT - Ticket 3



Here are the steps for troubleshooting.

Client1#ping 10.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 76/101/116 ms
Client1#ping 209.65.200.225

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.225, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 52/91/140 ms
Client1#ping 209.65.200.226

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.226, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
-----------------------------------------------------------------
Ping stop responding in 209.65.200.226. By seeing this, it's clear that it might be IP access list is blocking.
Let's check in R1.
If you suspect that it can be because of BGP error, check BGP neighbours.

R1#sh ip bgp summary
BGP router identifier 1.1.1.1, local AS number 65001
BGP table version is 3, main routing table version 3
2 network entries using 234 bytes of memory
3 path entries using 156 bytes of memory
4/2 BGP path/bestpath attribute entries using 496 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 910 total bytes of memory
BGP activity 2/0 prefixes, 3/0 paths, scan interval 60 secs

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
209.65.200.226  4 65002      11      10        3    0    0 00:06:22        2


Updated BGP messages and 2 prefix are receiving. It means that BGP is working properly.
Here is IP access-list from R1.
--------------------------
ip nat inside source list 10 interface Serial1/1 overload
!
access-list 10 permit 10.1.0.0 0.0.255.255
access-list 30 permit 209.65.200.241
access-list 30 deny   10.2.1.0 0.0.0.255
access-list 30 deny   10.1.4.0 0.0.0.255
access-list 30 deny   10.1.1.0 0.0.0.255
access-list 30 permit 209.65.200.224 0.0.0.3
access-list 40 permit 209.65.200.241
access-list 40 deny   10.1.0.0 0.0.255.255
access-list 40 deny   10.2.0.0 0.0.255.255
access-list 40 permit 209.65.200.224 0.0.0.3
ipv6 router ospf 6
 log-adjacency-changes
-----------------------


There is no ip access list for 10.2.0.0 network in access-list 10 for NATing.

So, the error is in R1, topology in access-list and you can fix by adding 10.2.0.0 0.0.255.255 in access-list 10.

CCNP TSHOOT - Ticket 2

Lab topology will be the same as in Ticket 1.

You can also download complete topology file from Cisco website in PDF file. Check here https://learningnetwork.cisco.com/servlet/JiveServlet/download/52366-8599/TSHOOT%20Exam%20Topology.pdf

For demo exam, check out in http://www.cisco.com/web/learning/le3/le2/le37/le10/tshoot_demo.html


After wait for 2 minutes, check whether client1 get IP address or not.


Client1#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.2.1.3        YES DHCP   up                    up
FastEthernet0/1            unassigned      YES NVRAM  administratively down down

Client 1 is getting IP address from DHCP server R4. So, let's ping to 10.1.1.1 as usual.


Client1#ping 10.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!

Success. Client1 can ping to 10.1.1.1 all the way up to R1.
Let's ping one interface after another steps by steps as follow.

Client1#ping 209.65.200.225

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.225, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/92/112 ms
Client1#ping 209.65.200.226

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.226, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 208/228/248 ms
Client1#ping 209.65.200.241

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.65.200.241, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)

Ping success up to 209.65.200.224 network and failed only in 209.65.200.240 network.
So, it's clear that two possible case;

- BGP neighbour relationship (or)
- IP access list

Let's check in R1's BGP and IP access-list
Check R1's BGP neighbour as follow.

R1#sh ip bgp summary
BGP router identifier 1.1.1.1, local AS number 65001
BGP table version is 2, main routing table version 2
1 network entries using 117 bytes of memory
1 path entries using 52 bytes of memory
2/1 BGP path/bestpath attribute entries using 248 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 417 total bytes of memory
BGP activity 1/0 prefixes, 1/0 paths, scan interval 60 secs

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
209.56.200.226  4 65002       0       0        0    0    0 never    Idle

Neighbour is idle and haven't received any message to and from.

Let's check neighbour configuration as follow in R1.

R1#sh run | include neighbor
 bgp log-neighbor-changes
 neighbor 209.56.200.226 remote-as 65002

Here is the problem. Actual neighbour IP address of next BGP router should be 209.65.200.226.
Let's fix it and it will worked. 
So, the problem lies in R1, topology error is in BGP and fixed by changing the IP address of neighbour to 209.65.200.226.

CCNP TSHOOT - Ticket 1

I have a chance to download CCNP Tshoot GNS3 files from Internet to practice. I will not create new GNS3 files this time and I'll use the files which I found from Internet.

Use this link http://dl.dropbox.com/u/2749921/GNS_Tshoot.tar.gz to download all tickets. Thanks to the one who create all GNS3 files.

The lab topology is the same as you will see in exam.



All of the questions will ask you "client1 can't reach to WebSrv.

First of all, you need to check whether client1 has IP address or not. Check in console as follow.


Client1#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.2.1.3        YES DHCP   up                    up  
FastEthernet0/1            unassigned      YES NVRAM  administratively down down


Client1 has IP address 10.2.1.3. Let's ping to 10.1.1.1 which is Router 1.

Client1#ping 10.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Ping is failed. So, let's check whether client1 can reach to router 2 (10.1.1.2)


Client1#ping 10.1.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 96/124/160 ms

Then, you know where is the problem. It's between R1 and R2. Let's check more the configuration of R1 and R2.


As the topology is OSPF, check whether R1 is neighbour with R2 or not.


R1#sh ip ospf neighbor


R1#

No neighbour fond in R1. So, let's move to R2.

R2#sh ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
3.3.3.3           0   FULL/  -        00:00:33    10.1.1.6        Serial1/0.23


R2 has neighbour with R3 (3.3.3.3). So, the problem is R1's OSPF configuration.

Check R1's OSPF configuration as follow.


R1#sh run | in
R1#sh run | include ospf
 ipv6 ospf 6 area 12
 ip ospf message-digest-key 1 md5 TSHOOT
 ipv6 ospf 6 area 12
router ospf 1
ipv6 router ospf 6

Let's check again in R2.


R2#sh run | include ospf
 ipv6 ospf 6 area 0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 TSHOOT
 ipv6 ospf 6 area 12
 ipv6 ospf 6 area 0
router ospf 1
ipv6 router ospf 6
--------------------------
What is the difference? In R1, ip ospf authentication message-digest is missing.
That's it. So, the problem is in R1, it's OSPF configuration and you already know how to fix it.

As soon as you fixed, neighbour will established between R1 and R2 and you can reach to WebSrv.

Tuesday, October 18, 2011

HSRP with VLAN interfaces

I'm looking for GNS3 file to simulate HSRP with two VLAN interfaces but failed to get the information. Finally, I managed to get through and I'll share soon.

Below is the topology diagram that I have simulated with GNS3.

Download completed GNS3 file from https://docs.google.com/leaf?id=0B889ogd4ltI2NDBiMzg5YjItNTcwYi00ODhmLWJiYzItYWIyZjk5ZDM3YjU3&hl





Here is brief description of lab topology.
  • R1 and R2 are HSRP active and standby routers for VLAN 100 and VLAN 200.
  • R3 is the layer 2 switch and enabled trunk in fa1/1 and fa1/2 to allow traffic from R4 (VLAN-100 PC) and R6 (VLAN-200 PC)
  • R1, R2 and R5 are in EIGRP 1 network and ip routing is enabling all routes including loopback of R5 (5.5.5.5). 
  • Simple testing can be done by ping from VLAN 100 PC (R4) to R5's loopback ip 5.5.5.5
  • To simulate HSRP, try to track loopback of R1's interface status. When it's down, R1 will release it's active role to R2 for VLAN 100.
  • With same method, for VLAN 200, configure R2 as active role in VLAN 200. Track loopback 0 of R2's interface status. When it down, R2 will release it's active state for VLAN 200 to R1.
  • By doing so, both VLAN 100 and VLAN 200 will be online all the time even though any of either R1 or R2 down for redundancy.
Detail of configuration steps are as follows;

R1(config)#int fa1/1
R1(config-if)#int vlan 100
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#int fa1/1
R1(config-if)#switchport trunk encapsulation dot1q
R1(config-if)#switchport mode trunk
R1(config-if)#
*Mar  1 00:02:05.887: %DTP-5-TRUNKPORTON: Port Fa1/1 has become dot1q trunk
R1(config-if)#exit
R1(config)#exit
R1#vlan
*Mar  1 00:02:17.683: %SYS-5-CONFIG_I: Configured from console by console
R1#vlan database
% Warning: It is recommended to configure VLAN from config mode,
  as VLAN database mode is being deprecated. Please consult user
  documentation for configuring VTP/VLAN in config mode.

R1(vlan)#vlan 100
VLAN 100 added:
    Name: VLAN0100
R1(vlan)#exit
APPLY completed.
Exiting....
-----------------------------------------
R1#sh int status

Port    Name               Status       Vlan       Duplex Speed Type
Fa1/0                      notconnect   1            auto    auto 10/100BaseTX
Fa1/1                      connected    trunk      a-full   a-100 10/100BaseTX
Fa1/2                      notconnect   1            auto    auto 10/100BaseTX
Fa1/3                      notconnect   1            auto    auto 10/100BaseTX
Fa1/4                      notconnect   1            auto    auto 10/100BaseTX
Fa1/5                      notconnect   1            auto    auto 10/100BaseTX
Fa1/6                      notconnect   1            auto    auto 10/100BaseTX
Fa1/7                      notconnect   1            auto    auto 10/100BaseTX
Fa1/8                      notconnect   1            auto    auto 10/100BaseTX
Fa1/9                      notconnect   1            auto    auto 10/100BaseTX
Fa1/10                     notconnect   1            auto    auto 10/100BaseTX
Fa1/11                     notconnect   1            auto    auto 10/100BaseTX
Fa1/12                     notconnect   1            auto    auto 10/100BaseTX
Fa1/13                     notconnect   1            auto    auto 10/100BaseTX
Fa1/14                     notconnect   1            auto    auto 10/100BaseTX
Fa1/15                     notconnect   1            auto    auto 10/100BaseTX
-------------------------------------------------
R1#sh int vlan 100
Vlan100 is up, line protocol is up
  Hardware is EtherSVI, address is c200.067c.0000 (bia c200.067c.0000)
  Internet address is 192.168.1.1/24
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     1 packets output, 60 bytes, 0 underruns
     0 output errors, 1 interface resets
     0 output buffer failures, 0 output buffers swapped out
-------------------------------------
R1#sh int trunk

Port      Mode         Encapsulation  Status        Native vlan
Fa1/1     on           802.1q         trunking      1

Port      Vlans allowed on trunk
Fa1/1     1-4094

Port      Vlans allowed and active in management domain
Fa1/1     1,100

Port      Vlans in spanning tree forwarding state and not pruned
Fa1/1     1,100
++++++++++++++++++++++++++++++++++++++++++++++++++++

switch(config)#int fa1/3
switch(config-if)#switchport mode access
switch(config-if)#switchport access vlan 100
----------------------------------------
Ping test as follow to R1 and R2 from R4 (VLAN100-PC)

PC#ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/236/1044 ms
PC#ping 192.168.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/40/84 ms
--------------------------------------------

R2#sh int trunk

Port      Mode         Encapsulation  Status        Native vlan
Fa1/2     on           802.1q         trunking      1

Port      Vlans allowed on trunk
Fa1/2     1-4094

Port      Vlans allowed and active in management domain
Fa1/2     1,100,200

Port      Vlans in spanning tree forwarding state and not pruned
Fa1/2     1,100,200
---------------------------------------------
Activate HSRP for VLAN 100 in R1 as follow.

R1(config)#int vlan 100
R1(config-if)#stan
R1(config-if)#standby 1 ip ?
  A.B.C.D  Virtual IP address
  <cr>

R1(config-if)#standby 1 ip 192.168.1.10
R1(config-if)#standby 1 preempt
R1(config-if)#standby 1 priority 110
R1(config-if)#^Z
R1#
*Mar  1 00:21:29.123: %SYS-5-CONFIG_I: Configured from console by console
R1#
*Mar  1 00:21:41.831: %HSRP-5-STATECHANGE: Vlan100 Grp 1 state Standby -> Active
--------------------------------------
R2 HSRP for VLAN 100 as follow;

R2#config t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#int vlan 100
R2(config-if)#stan
R2(config-if)#standby 1 ip 192.168.1.10
R2(config-if)#standby 1 preempt
R2(config-if)#^Z
--------------------------------------
Check HSRP status as below.

R1#sh standby
Vlan100 - Group 1
  State is Active
    2 state changes, last state change 00:01:57
  Virtual IP address is 192.168.1.10
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.048 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.1.2, priority 100 (expires in 8.496 sec)
  Priority 110 (configured 110)
  Group name is "hsrp-Vl100-1" (default)
-----------------------------------------------------------------
Activate for VLAN 200 as follow.

R1(config)#int vlan 200
R1(config-if)#standby 2 ip 192.168.2.10
R1(config-if)#standby 2 preempt
R1(config-if)#standby 2 priority 120
R1(config-if)#^Z
R1#
*Mar  1 00:24:35.923: %SYS-5-CONFIG_I: Configured from console by console
R1#
*Mar  1 00:24:46.487: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Standby -> Active
R1#
*Mar  1 00:25:13.551: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Active -> Speak
R1#
*Mar  1 00:25:23.551: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Speak -> Standby
------------------------------------------
VLAN 200 for R2 is as follow.

R2(config)#int vlan 200
R2(config-if)#standby 2 ip 192.168.2.10
R2(config-if)#standby 2 priority 250
R2(config-if)#standby 2 preempt
R2(config-if)#^Z
R2#
*Mar  1 00:25:13.143: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Speak -> Active
*Mar  1 00:25:13.699: %SYS-5-CONFIG_I: Configured from console by console
---------------------------------------------------
Final HSRP status for VLAN 100 and 200 are as follow in R1.

R1#sh standby
Vlan100 - Group 1
  State is Active
    2 state changes, last state change 00:04:50
  Virtual IP address is 192.168.1.10
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.892 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.1.2, priority 100 (expires in 7.316 sec)
  Priority 110 (configured 110)
  Group name is "hsrp-Vl100-1" (default)
Vlan200 - Group 2
  State is Standby
    4 state changes, last state change 00:01:08
  Virtual IP address is 192.168.2.10
  Active virtual MAC address is 0000.0c07.ac02
    Local virtual MAC address is 0000.0c07.ac02 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.600 secs
  Preemption enabled
  Active router is 192.168.2.2, priority 250 (expires in 9.548 sec)
  Standby router is local
  Priority 120 (configured 120)
  Group name is "hsrp-Vl200-2" (default)
+++++++++++++++++++++++++++++++++++++++++++++++++++++
In R2,

R2#sh standby
Vlan100 - Group 1
  State is Standby
    1 state change, last state change 00:31:57
  Virtual IP address is 192.168.1.10
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.672 secs
  Preemption enabled
  Active router is 192.168.1.1, priority 110 (expires in 9.040 sec)
  Standby router is local
  Priority 100 (default 100)
  Group name is "hsrp-Vl100-1" (default)
Vlan200 - Group 2
  State is Active
    1 state change, last state change 00:29:27
  Virtual IP address is 192.168.2.10
  Active virtual MAC address is 0000.0c07.ac02
    Local virtual MAC address is 0000.0c07.ac02 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.660 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.2.1, priority 120 (expires in 9.452 sec)
  Priority 250 (configured 250)
    Track object 20 state Up decrement 140
  Group name is "hsrp-Vl200-2" (default)
++++++++++++++++++++++++++++++++++++++++++++++++++++
Shutdown loopback interface of R2' as below and monitor HSRP changes 

R2(config)#int lo0
R2(config-if)#shut
R2(config-if)#
*Mar  1 00:54:51.655: %TRACKING-5-STATE: 20 interface Lo0 line-protocol Up->Down
R2(config-if)#
*Mar  1 00:54:53.651: %LINK-5-CHANGED: Interface Loopback0, changed state to administratively down
*Mar  1 00:54:53.735: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Active -> Speak
*Mar  1 00:54:54.651: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to down
R2(config-if)#
*Mar  1 00:55:03.735: %HSRP-5-STATECHANGE: Vlan200 Grp 2 state Speak -> Standby
R2(config-if)#
---------------------------------------------------------------------------

R2#sh standby
Vlan100 - Group 1
  State is Standby
    1 state change, last state change 00:33:43
  Virtual IP address is 192.168.1.10
  Active virtual MAC address is 0000.0c07.ac01
    Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.104 secs
  Preemption enabled
  Active router is 192.168.1.1, priority 110 (expires in 7.564 sec)
  Standby router is local
  Priority 100 (default 100)
  Group name is "hsrp-Vl100-1" (default)
Vlan200 - Group 2
  State is Standby
    3 state changes, last state change 00:01:23
  Virtual IP address is 192.168.2.10
  Active virtual MAC address is 0000.0c07.ac02
    Local virtual MAC address is 0000.0c07.ac02 (v1 default)
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.220 secs
  Preemption enabled
  Active router is 192.168.2.1, priority 120 (expires in 9.316 sec)
  Standby router is local
  Priority 110 (configured 250)
    Track object 20 state Down decrement 140
  Group name is "hsrp-Vl200-2" (default)
-------------------------------------------------
Initial HSRP active, standby state, normal traffic flow path is as shown below.

PC-VLAN100#traceroute 5.5.5.5

Type escape sequence to abort.
Tracing the route to 5.5.5.5

  1 192.168.1.1 72 msec 28 msec 24 msec
  2 172.16.1.5 76 msec *  88 msec
---------------------

PC-VLAN200#traceroute 5.5.5.5

Type escape sequence to abort.
Tracing the route to 5.5.5.5

  1 192.168.2.2 36 msec 48 msec 28 msec
  2 172.16.2.5 32 msec *  40 msec
+++++++++++++++++++++++++++++++++++++++++++++++

After shutdow lo0 from R2, check router path as below.

PC-VLAN200#traceroute 5.5.5.5

Type escape sequence to abort.
Tracing the route to 5.5.5.5

  1 192.168.2.1 28 msec 60 msec 32 msec
  2 172.16.1.5 28 msec *  32 msec
=============================

PC-VLAN100#traceroute 5.5.5.5

Type escape sequence to abort.
Tracing the route to 5.5.5.5

  1 192.168.1.1 48 msec 28 msec 32 msec
  2 172.16.1.5 64 msec *  88 msec
===================

Check the HSRP status of routers as follow;

R2#sh standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl100       1    100 P Standby 192.168.1.1     local           192.168.1.10
Vl200       2    250 P Active  local           192.168.2.1     192.168.2.10
---------------------------------

R1#sh standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl100       1    110 P Active  local           192.168.1.2     192.168.1.10
Vl200       2    120 P Standby 192.168.2.2     local           192.168.2.10

Saturday, August 27, 2011

GLBP with GNS3

It's time to start GLBP using the same topology that I uploaded in my previous posts.

Here is the lab topology diagram.

Download the completed GNS3 file from https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B889ogd4ltI2ZjdkYTg4YjMtMDU1My00MjI1LWFiYmUtOTYyMWVmYzAxNmM3&hl=en





Let's see the how it works.

- R1 and R2 will be running GLBP in interface fa0/0
- R3 will be PC as usual with gateway to virtual IP of 192.168.1.10
- R4 is the destination PC enabled with loopback IP 4.4.4.4. 
- Goal is to reach the loopback 4.4.4.4 from Router3 (PC).
- Network is running EIGRP routing to reach to other networks, 192.168.1.0, 172.16.1.0 and 172.16.2.0.
- To test, I have created two loopback interfaces; lo0, lo1 in R1 to track two interfaces with different weighting values.
- Shutting down lo0 in R1 will not release AVF role because of upper and lower value "glbp 1 weighting 110 lower 95 upper 103"
- To have authentication, use MD5 with string name "test123"

Configure in R1 as follow;

 glbp 1 ip 192.168.1.10
 glbp 1 priority 200
 glbp 1 preempt
---------------
 glbp 1 weighting 110 lower 95 upper 103
 glbp 1 authentication md5 key-string test123
 glbp 1 weighting track 1 decrement 10
 glbp 1 weighting track 2 decrement 10
 glbp 1 forwarder preempt delay minimum 2

The first three lines configure the AVG status whether it will be AVG or not. It depends upon the priority. As like HSRP and VVRP, it will release AVG to other routers.

The second part of the lines are weighting and tracking interfaces for AVF status. Changes in these lines effect the status of AVF.

In R2, configure as follow;


 glbp 1 ip 192.168.1.10
 glbp 1 preempt
 glbp 1 authentication md5 key-string test123
---------------
 glbp 1 forwarder preempt delay minimum 2

As nothing mention about priority and weighting value, R2 will get the default value of priority 100 and weighting "lower 1, upper 100" automatically.
---------------------------------------------------
Let's check GLBP status in both routers.
In R1,

FastEthernet0/0 - Group 1
  State is Active
    8 state changes, last state change 00:04:10
  Virtual IP address is 192.168.1.10
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 1.192 secs
  Redirect time 600 sec, forwarder timeout 14400 sec
  Authentication MD5, key-string "test123"
  Preemption enabled, min delay 0 sec
  Active is local
  Standby is 192.168.1.2, priority 100 (expires in 8.448 sec)
  Priority 200 (configured)
  Weighting 110 (configured 110), thresholds: lower 95, upper 103
    Track object 1 state Up decrement 10
    Track object 2 state Up decrement 10
  Load balancing: round-robin
  Group members:
    c201.07e8.0000 (192.168.1.1) local
    c202.07e8.0000 (192.168.1.2) authenticated
  There are 2 forwarders (1 active)
  Forwarder 1
    State is Active
      9 state changes, last state change 00:17:12
    MAC address is 0007.b400.0101 (default)
    Owner ID is c201.07e8.0000
    Redirection enabled
    Preemption enabled, min delay 2 sec
    Active is local, weighting 110
    Client selection count: 3
  Forwarder 2
    State is Listen
    MAC address is 0007.b400.0102 (learnt)
    Owner ID is c202.07e8.0000
    Redirection enabled, 597.368 sec remaining (maximum 600 sec)
    Time to live: 14397.364 sec (maximum 14400 sec)
    Preemption enabled, min delay 2 sec
    Active is 192.168.1.2 (primary), weighting 100 (expires in 7.360 sec)
    Client selection count: 2

As you seen, Local router is active for Group1 and it's also "Forwarder1" .
One thing to note is default forwarder min delay is 30 sec and I have change to 2 sec" using "glbp 1 forwarder preempt delay minimum 2" to change the forwarder status as soon as there is status change in forwarder states.

What are the two MAC addresses in Forwarder 1 and 2. Noticed that R1 is local, it's MAC address is marked as "(default)" and Forwarder 2 MAC address is noted as "(learnt)", because it's learnt from R2.

Let's check in R2

R2#sh glbp
FastEthernet0/0 - Group 1
  State is Standby
    7 state changes, last state change 00:11:48
  Virtual IP address is 192.168.1.10
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.164 secs
  Redirect time 600 sec, forwarder timeout 14400 sec
  Authentication MD5, key-string "test123"
  Preemption enabled, min delay 0 sec
  Active is 192.168.1.1, priority 200 (expires in 8.840 sec)
  Standby is local
  Priority 100 (default)
  Weighting 100 (default 100), thresholds: lower 1, upper 100
  Load balancing: round-robin
  Group members:
    c201.07e8.0000 (192.168.1.1) authenticated
    c202.07e8.0000 (192.168.1.2) local
  There are 2 forwarders (1 active)
  Forwarder 1
    State is Listen
      8 state changes, last state change 00:25:00
    MAC address is 0007.b400.0101 (learnt)
    Owner ID is c201.07e8.0000
    Time to live: 14398.160 sec (maximum 14400 sec)
    Preemption enabled, min delay 2 sec
    Active is 192.168.1.1 (primary), weighting 110 (expires in 8.152 sec)
  Forwarder 2
    State is Active
      1 state change, last state change 02:45:20
    MAC address is 0007.b400.0102 (default)
    Owner ID is c202.07e8.0000
    Preemption enabled, min delay 2 sec
    Active is local, weighting 100
    Client selection count: 1

Notice that it's in "Standby" and Forwarder 1 is in "listen" state but Forwarder2 of R2 is active and it's itself.
-------------------------------------------------------------------------------
Let's start change the loopback0 of the R1 down. Even though you shutdown loopback 0, nothing changed but interface track status console message appear as follow.
R1(config-if)#
*Mar  1 02:50:24.463: %TRACKING-5-STATE: 2 interface Lo0 line-protocol Up->Down

Check GLBP status in R1.

  Priority 200 (configured)
  Weighting 100 (configured 110), thresholds: lower 95, upper 103
    Track object 1 state Up decrement 10
    Track object 2 state Down decrement 10
----------
Noted that weighting change from 110 to 100 because of the decrements value of "Track object 1" is 10.
But, AVF status of the router won't be changed because of the lower value is "95".

Let's shutdown loopback 1 again. Look the console message.

R1(config-if)#
*Mar  1 02:56:31.787: %TRACKING-5-STATE: 1 interface Lo1 line-protocol Up->Down
R1(config-if)#
*Mar  1 02:56:33.787: %LINK-5-CHANGED: Interface Loopback1, changed state to administratively down
*Mar  1 02:56:34.787: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to down
R1(config-if)#
*Mar  1 02:56:37.543: %GLBP-6-FWDSTATECHANGE: FastEthernet0/0 Grp 1 Fwd 1 state Active -> Listen

AVF 1 will release it's active state to LISTEN because of the weighting value will now be 90. As the lower value is configured as "95", 90 is less than 95 and it' release AVF and R2 will be the active AVF. Check in both routers.
In R2's console, you will see as follow.
R2#
*Mar  1 02:56:25.455: %GLBP-6-FWDSTATECHANGE: FastEthernet0/0 Grp 1 Fwd 1 state Listen -> Active

Here is latest status of GLBP in R1,

FastEthernet0/0 - Group 1
  State is Active
    8 state changes, last state change 00:25:21
  Virtual IP address is 192.168.1.10
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 2.420 secs
  Redirect time 600 sec, forwarder timeout 14400 sec
  Authentication MD5, key-string "test123"
  Preemption enabled, min delay 0 sec
  Active is local
  Standby is 192.168.1.2, priority 100 (expires in 9.848 sec)
  Priority 200 (configured)
  Weighting 90, low (configured 110), thresholds: lower 95, upper 103
    Track object 1 state Down decrement 10
    Track object 2 state Down decrement 10
  Load balancing: round-robin
  Group members:
    c201.07e8.0000 (192.168.1.1) local
    c202.07e8.0000 (192.168.1.2) authenticated
  There are 2 forwarders (0 active)
  Forwarder 1
    State is Listen
      10 state changes, last state change 00:03:00
    MAC address is 0007.b400.0101 (default)
    Owner ID is c201.07e8.0000
    Redirection enabled
    Preemption enabled, min delay 2 sec
    Active is 192.168.1.2 (secondary), weighting 100 (expires in 8.912 sec)
    Client selection count: 3
  Forwarder 2
    State is Listen
    MAC address is 0007.b400.0102 (learnt)
    Owner ID is c202.07e8.0000
    Redirection enabled, 598.912 sec remaining (maximum 600 sec)
    Time to live: 14398.908 sec (maximum 14400 sec)
    Preemption enabled, min delay 2 sec
    Active is 192.168.1.2 (primary), weighting 100 (expires in 8.908 sec)
    Client selection count: 2
---------------
Here is R2's GLBP status.

R2#sh glbp
FastEthernet0/0 - Group 1
  State is Standby
    7 state changes, last state change 00:26:46
  Virtual IP address is 192.168.1.10
  Hello time 3 sec, hold time 10 sec
    Next hello sent in 0.552 secs
  Redirect time 600 sec, forwarder timeout 14400 sec
  Authentication MD5, key-string "test123"
  Preemption enabled, min delay 0 sec
  Active is 192.168.1.1, priority 200 (expires in 7.128 sec)
  Standby is local
  Priority 100 (default)
  Weighting 100 (default 100), thresholds: lower 1, upper 100
  Load balancing: round-robin
  Group members:
    c201.07e8.0000 (192.168.1.1) authenticated
    c202.07e8.0000 (192.168.1.2) local
  There are 2 forwarders (2 active)
  Forwarder 1
    State is Active
      9 state changes, last state change 00:04:35
    MAC address is 0007.b400.0101 (learnt)
    Owner ID is c201.07e8.0000
    Time to live: 14122.908 sec (maximum 14400 sec)
    Preemption enabled, min delay 2 sec
    Active is local, weighting 100
  Forwarder 2
    State is Active
      1 state change, last state change 03:00:19
    MAC address is 0007.b400.0102 (default)
    Owner ID is c202.07e8.0000
    Preemption enabled, min delay 2 sec
    Active is local, weighting 100
    Client selection count: 1

Group status is still "Active" but, when you tracerroute from PC1 to 4.4.4.4, it will select 192.168.1.2 path.
Check in PC as follow.

First, clear APR cache in PC 
PC#clear arp-cache
Ping to 4.4.4.4 to update the latest gateway
PC#ping 4.4.4.4

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/237/1092 ms
PC#
--------
Then, traceroute to 4.4.4.4 and check APR table.

PC#traceroute 4.4.4.4

Type escape sequence to abort.
Tracing the route to 4.4.4.4

  1 192.168.1.2 68 msec 28 msec 8 msec
  2 172.16.2.4 36 msec *  100 msec

PC is using 192.168.1.2 (R2) is next hop instead of going from 192.168.1.1. Confirm the APR table whether it's using AVF of R2's MAC address as follow.

PC#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.3             -   c203.07e8.0000  ARPA   FastEthernet0/0
Internet  192.168.1.10            1   0007.b400.0102  ARPA   FastEthernet0/0

As you seen, MAC address of 192.168.1.10 is changed from 0007.b400.0101 to 0007.b400.0102

Let's check the status of each router's GLBP status in brief.
You can see all router's glbp status, forwarding and MAC addresses as well.

R1#sh glbp brief
Interface   Grp  Fwd Pri State    Address         Active router   Standby router
Fa0/0       1    -   200 Active   192.168.1.10    local           192.168.1.2
Fa0/0       1    1   -   Listen   0007.b400.0101  192.168.1.2     -
Fa0/0       1    2   -   Listen   0007.b400.0102  192.168.1.2     -

R2#sh glbp brief
Interface   Grp  Fwd Pri State    Address         Active router   Standby router
Fa0/0       1    -   100 Standby  192.168.1.10    192.168.1.1     local
Fa0/0       1    1   -   Active   0007.b400.0101  local           -
Fa0/0       1    2   -   Active   0007.b400.0102  local           -

In above test, noted that group's state "Active/Standby" will not be change as R1's priority is 200 higher than the R2's default priority 100.

You can test by changing the priority to 230 or R2 and see what happened.
----------------
Finally, change loopback0 and 1 from R1 up again. Monitor the console message in R1


R1(config)#int lo0
R1(config-if)#no shut
R1(config-if)#int lo1
*Mar  1 03:14:57.199: %TRACKING-5-STATE: 2 interface Lo0 line-protocol Down->Up
R1(config-if)#int lo1
R1(config-if)#no shut
R1(config-if)#
*Mar  1 03:14:59.199: %LINK-3-UPDOWN: Interface Loopback0, changed state to up
*Mar  1 03:15:00.199: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
R1(config-if)#
*Mar  1 03:15:00.371: %TRACKING-5-STATE: 1 interface Lo1 line-protocol Down->Up
R1(config-if)#
*Mar  1 03:15:02.367: %LINK-3-UPDOWN: Interface Loopback1, changed state to up
*Mar  1 03:15:03.367: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
R1(config-if)#
*Mar  1 03:15:05.167: %GLBP-6-FWDSTATECHANGE: FastEthernet0/0 Grp 1 Fwd 1 state Listen -> Active

Let's traceroute again from PC to 4.4.4.4. Make sure to clean apr-cache and ping 4.4.4.4 first.

PC#traceroute 4.4.4.4

Type escape sequence to abort.
Tracing the route to 4.4.4.4

  1 192.168.1.1 68 msec 20 msec 12 msec
  2 172.16.1.4 44 msec *  72 msec

PC will be use the original path using R1 as above to reach to 4.4.4.4.

Sunday, August 14, 2011

HSRP with GNS3

Actually, I have to post HSRP first. But, before I post, I fond out that I have configured only with one HSRP group. As HSRP is available for load-balancing, I have amended my post with two HSRP groups.

Download GNS3 lab file from https://docs.google.com/leaf?id=0B889ogd4ltI2YmY3YTFmOGQtYmI1OC00ZTVmLTk4YTktMzU3NDBjNzg4MzZh&hl

OK, below is lab topology diagram.



Here are lab objectives;
  • R1 and R2 will be running as HSRP using two VIPs (192.168.1.10 and 192.168.1.20)
  • PC1 will be using R2 (with default gateway 192.168.1.10) to reach 4.4.4.4 (R4's loopback).
  • PC2 will be using R1 (with default gateway 192.168.1.20) to reach 4.4.4.4
  • Both of the links 172.16.1.0/24 and 172.16.2.0/24 will be using by two PCs at the same time without wasting another link's bandwidth.
  • Finally, create one loopback interface in R1 (1.1.1.1) to track interface up /down which will lower the priority of R1 and R2 will take over as standby router. In that case, both R2 will be used by two PCs.


OK, let's create R1 as follow. Set decrements value to 102 to release R1's active status when loopbackup interface down.

interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 duplex auto
 speed auto
 standby 1 ip 192.168.1.10
 standby 1 priority 200
 standby 1 preempt
 standby 1 track Loopback0 102
 standby 2 ip 192.168.1.20
 standby 2 preempt

interface Loopback0
 ip address 1.1.1.1 255.255.255.255

interface FastEthernet0/1
 ip address 172.16.1.1 255.255.255.0
 duplex auto
 speed auto
!
router eigrp 1
 network 0.0.0.0
 no auto-summary
--------------------------------------------------
In R2, configure as follow using default priorities 100 for group 1 and 150 for group 2 as R2 will be active for second group.

interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto
 standby 1 ip 192.168.1.10
 standby 1 preempt
 standby 2 ip 192.168.1.20
 standby 2 priority 150
 standby 2 preempt

interface FastEthernet0/1
 ip address 172.16.2.2 255.255.255.0
 duplex auto
 speed auto
!
router eigrp 1
 network 0.0.0.0
 no auto-summary

---------------------------
Check HSRP status in R1 and R2 as follow.

R1#sh standby brief

Interface   Grp  Pri P State   Active          Standby         Virtual IP
Fa0/0       1    200 P Active  local           192.168.1.1     192.168.1.10
Fa0/0       2    100 P Standby 192.168.1.1     local           192.168.1.20
----------------------
R2#sh standby brief

Interface   Grp  Pri P State   Active          Standby         Virtual IP
Fa0/0       1    100 P Standby 192.168.1.2     local           192.168.1.10
Fa0/0       2    150 P Active  local           192.168.1.2     192.168.1.20

As you can see that, group 1's active router is R1 (due to high priority 200 while R2 is default 100) and group 2's active router is R2 (due to R2's priority is 150 while R1 is setting default 100).

As EIGRP routing is running in R1, R2 and R4, try to run traceroute 4.4.4.4 from PC1 and PC2.

Set PC1's default gateway to 192.168.1.10 (HSRP Group 1's VIP) and PC2 to 192.168.1.20 (HSRP Group 2's VIP)

Here is the traceroute output from PC1 to 4.4.4.4. It's using R2 to reach 4.4.4.4

PC1#traceroute 4.4.4.4

Type escape sequence to abort.
Tracing the route to 4.4.4.4

  1 192.168.1.2 48 msec 88 msec 24 msec
  2 172.16.1.4 16 msec 84 msec *

From PC2, as expected, it's using R1 to reach to 4.4.4.4

PC2#traceroute 4.4.4.4

Type escape sequence to abort.
Tracing the route to 4.4.4.4

  1 192.168.1.1 60 msec 72 msec 8 msec
  2 172.16.2.4 52 msec *  72 msec


Because of this both links are load balanced to reach to another end 4.4.4.4 by setting different gateway IPs in each PC.

Try shutting down loopback 0 interface from R1 manually. Both of the PC will use R2 as default gateway as R2 will be active routers for both HSRP groups.


R1#sh standby brief


Interface   Grp  Pri P State   Active          Standby         Virtual IP
Fa0/0       1    98  P Standby 192.168.1.1     local           192.168.1.10
Fa0/0       2    100 P Standby 192.168.1.1     local           192.168.1.20
-----------------



R2#sh standby brief


Interface   Grp  Pri P State   Active          Standby         Virtual IP
Fa0/0       1    100 P Active  local           192.168.1.2     192.168.1.10
Fa0/0       2    150 P Active  local           192.168.1.2     192.168.1.20

PC1 will be used R2  as shown below as R2 is the active router.

PC1#traceroute 4.4.4.4

Type escape sequence to abort.
Tracing the route to 4.4.4.4

  1 192.168.1.1 44 msec 68 msec 44 msec
  2 172.16.2.4 48 msec 96 msec *