Working with IPv6 address Part 1(Exam topic 3-E)

IPv6 may seem bit and scary. I know  that I wasn't too thrilled about IPv6 at first, in fact i hated it. That was until I understood its simplicity.
I will try to simplify and explain IPv6 as best as I can. I will try to brake down structure, and rules with close comparison to IPv4. Understanding IPv6 will require a understanding of submitting, binary and hexadecimal.

First lest start with the basics. 

• IPv6 is written out in  hexadecimal format 
• An IPv6 address is 128 bits long 
• An IPv6 address is broken into 8 16 bit groups (IPv4 uses 4 8 bit groups, a group in IPv4 world is called an octet
• IPv6 uses only CIDR for the network bits 

Now Lets review the foundation Base 2, base 10 and base 16 numeral system 

Base 10 (decimal)

The very first numeral system we learn as a child. which is based on the powers of 10. In the below screenshot you see 255 written out in base 10.

As you can see 10 to the power of 0 equals 1, and 10^1 = 10, and so forth. 

Now we need to add up to 255, to we need 2 100, 5 10, and 5 1. I know this seems too fundamental but we need to take a steep back and take a look back so its easier to understand binary and hex.

Base 2 (Binary) 

Base 2 is introduced when you learn binary. Base 2 is based on the powers.....of you guessed it 2. Based 2 only use a 1 or an 0 to represent which bit is on or off to equal a decimal number. The max for in 8 digit binary (which is all we are concerned with) is 255. In the screenshot below we will write out 158 in binary. 

We see that in binary 158 is written out as 10011110. If you do the math we simply subtract 128 from 158 and turned that bit on we did did not need 64 so we left that bit off. You continue down until you get you reach 0. The best way to learn binary numeral system is to practice, practice converting decimal numbers to binary, you can convert 201, 75, and 103, and post your answers. 

Base 16 (Hexadecimal)

Base 16 is what MAC addresses and IPv6 uses, IPv6 relays heavily on your MAC address you will see why I made that statement when you dive deeper into IPv6. Base 16 is based on the power of 16, and is written out as 0123456789ABCDF where A=10, B=11, C=12, and so fort. Since were using this numeral system for IPv6 we will only go up to 4 places. Each place contains 8 bits. in this example we will write out 179 in hexadecimal. 

We see that we need (11x16)+(3x1) to get 179 which is written out in hex as 0xB3 (B=11)

Seems simple enough, we applied the same concept used from decimal and binary. 

Conversion (Hex to Binary)

Finally we will convert hexadecimal to binary. We will jump straight to the shortcut on how to convert. Each hexadecimal character is represented by 4 bits which is also called a nibble. In the example I will be converting 0xB3 to binary. 

Since we know each hex is 4 bit long we can split our 8 bit binary conversion chart to 4 bits, or we can solve for the entire binary number. does not matter in the end it is the same amount of bits. This trick however will save you tons of time without the need to convert hex to decimal first. I the example above we know that B=11 so we turn on the necessary bits for 11 and then the second hex character we are converting would be 3 so we turn on the bits necessary for 3.

So in binary B=1011 and 3=0011 so 0xB3 = 179 in dec and 10110011 in binary. 

Below is a chart that you an draw up to help you convert quickly 

Now that we have the foundation down lets take a look at some of the rules.   

What do we know so far

So far we know that IPv6 is 128 bits long separated into 8 groups 4 hex characters each with each character equaling 4 bits each 

Rules of IPv6

There are a few rules that will make your live a lot easier when handling IPv6, because lets face there is no way we can remember all IPv6 address the same way we did with IPv4. We are talking about 24 characters below is the IPv6 address we will apply some of the basic rules to 

2014:00B0:0000:0000:0000:B4A0:F63C:00AB

First rule - consecutive 0s can be represented by "::" keep in mind this can only be done once IOS is smart enough to know your writing a shorthand version of an IPv6 address. See example below.

2014:00B0::B4A0:F63C:00AB 

Now that's a lot easier to read and its the same exact address as previously mentioned. Again this can only be done once per address. 

Second rule- All leading 0s can be omitted. As you ca see below I've omitted all leading 0s from our example IPv6 address

2014:B0::B4A0:F63C:AB

Now that we've brought our IPv6 address down to size it doesn't look so scary 

Link Local

Link local is enabled by default when IPv6 is enabled. Link local is similar to Microsoft's automatic addressing. In which network communication is enabled without any administrative interference. You can ping local devices within your link local network. You can not set a gateway to a link local address, so you can not reach outside of your link local network (which means no internet) The prefix for a link local address will always be an FE80 prefix 

Working with network bits

Rather than using the familiar 255.x.x.x format IPv6 uses CIDR notation which counts the bits used for a network. The most common network you will come across is /64 

Here is a link to an article that covers IPv6 subnetting

Types of traffic  

In the chart below we see the types of traffic available in IPv6

Broadcast no longer exist instead we use multicast 

Multicast is used by services such as DHCP to receive a multicast you must be in listening mode 

Unicast is commonly used for 1 to 1 communication 

Anycast is useful in a globally dispersed environment where you will have multiple servers configured with the same IP and the client will connect to the serve with the lowest cost. 

Types of addresses 

Global

Gloabal addresses are provided by ISP to each subscriber. Usually this address will begin with 2000: 

each provider as their global prefix which is 16 bits then they would add the additional 48 bits when given to the customer 

Site local 

Site local is similar to the common unique address or an internal address for example 192.168.10.0/24 

Link local 

Automatic address or loopback address 

Working with and Configuring IPV6 address Part 2(OSPF)(Exam topic 3-E)

Setting up your IPV6 on a router that is compatible can be fairly easy. In this example I will be setting up a few router with IPV6 and OSPF for IPV6 then I will verify connectivity. On a few of these interfaces I will use the eui-64 command to generate the unique local address.
eui-64 generates the host id  simple formula using your interface MAC address, it flips the 7th bit and insets FEEE in the middle of your MAC address.

Below is the network that I will be setting up.

Lets start with router 1, we will configure fa0/0 and s1/0 as shown.
First we will enable IPV6 

Next we will assign IPV6 address to each interface using eui-64

We can verify that an host ID was generated based on the routers MAC address.
You can also see i forgot to do a no shut on the interfaces.

 Now lets configure OSPF using the command ipv6 router ospf 1 (where 1 is the process id of your choosing)
Note:Immediately after using this command it shoots out an error of no router-id. This was not an issue with OSPF for IPV4 since it generated a router id based on the IPV4 address.

Next we will assign a random router ID, this must be unique on each router using the x.x.x.x format

In OSPF for IPV4 you would use the network command to identify networks that it would use for OSPF hello packets and which networks to advertise. In OSPF for IPV6 you simply enable OSPF on each interface you would like to make routable using the following command ipv6 ospf 1 area 0 

That's all it takes to apply IPV6 to your router an make it routable, now we will all the same configs to the other router and do a test ping

Note: Don't forget to save your config!!!

First on R1 I'll do a sh ipv6 route to show learned routs via OSPF

Now from R1 I'll ping R3 an R4 and we see both are successful

 Thats it, we've enabled IPv6 and configured routing with OSPF , IPv6 is not as scarry as it sounds.
I'll do a few sh cdp neighbor just for fun .

IPv6-01 Making sense out of an IPv6 Address

How to convert hexadecimal to binary to decimal?

MicroNugget: GNS3 and Windows 8 connecting your virtual lab to the internet

Overview and Configuring DTP (Exam Topic 3-H)

DTP Dynamic Trunking Protocol. Basically trunking your ports on the fly based on port combinations.
Even though you may have configured VLAN on your switch by default only one VLAN may pass through an interface at a time. This is the entire idea behind VLANs, creating new broadcast domain, and providing a layer of security.

DTP is not secured since a device can send a false DTP packet pretending to be a switch and sniff traffic going across all VLANs. It is best practice to disable this feature.

There are two modes for DTP Dynamic Auto and Dynamic Desirable. depending on the combination of these two will determine mode for ports connected.

• Dynamic auto + Dynamic auto = access
• Dynamic desirable + Dynamic auto = trunk
• Dynamic desirable + Dynamic desirable = trunk
• Dynamic desirable or Dynamic auto + trunk = trunk
• Dynamic desirable or Dynamic auto + access= access

Configuring DTP

DTP can be configured with one command 

Switchport mode dynamic auto or switchport mode dynamic desirable 

In the example below I will set both auto and desirable

  

Working with and Configuring VTP (Exam topic 3-G)

VTP can be good and bad depending on what environment your in. VTP can be a powerful administrative tool that can allow you to manage your VLAN centrally. Once you've made changes on the VTP server it automatically configure new VLANs or remove VLANs from all of your client mode switches.

This can be potentially dangerous if you reuse a switch where the VTP domain name remains default or the VTP domain name is the same. If the revision number on this switch is higher than the server then it will overwrite all your VLAN settings and potentially bring down your network.
Even if you wipe a switch with a that was a prior VTP server it still retains its revision number.
Note: VTP operate on revision numbers, a server with a higher revision number always win.

This has personally happened to me luckily there were only two switches affected.
A switch from a different site was wiped with intentions of using it for my imaging station, the revision number on this switch was higher than the VTP server on site, so it overwrote the VLAN database on all switches belonging to the VTP domain. Which in turn brought down the network.

Steps that should be taken when deploying a VTP implementation.

• Always name you VTP domains different at each location 
• Always set a VTP password (this can be something as simple as 123)
• Whenever you config a new switch always set it to transparent or client depending on your plan for deployment. 

VTP mode 

There are there modes VTP can operate in 

• Server - there can be multiple servers each server will push out changes to all clients (default mode for all switches)
• Client - you can not create a VLAN on a switch in client mode, VLAN will be pushed out by a switch in server mode
• Transparent - gives a switch the ability to operate independently of a VTP server.  

Configuring VTP 

VTP can be configured in a few simple steps, since VTP is in server mode by default in this example we will configure the domain and password, and set a switch to client mode. 

First lets configure the domain and password
We will be setting the domain to VTP.com and the password to 1234
Note: the VTP domain can be any domain you like does not have to be an existing domain, this domain is used only for your VTP servers and client

Next we will set our second switch up as a VTP client  and join it to the VTP domain

That's it we've set up VTP, just ensure the ports between the switch are set up as trunk ports. Now lets see VTP in action
First we will see which VLANs are on sw2 (the VTP client)

Now we will create a VLAN on sw1 and let it push out to sw2.
Note: correction name VTP-example there can not be any spacing between a VLAN name. 

Now we can see that it has replicated, the process happens instantaneously before you get a chance to save your config the changes have already replicated to the client.

Configure DHCP on a Cisco router (Exam topic 5-A)

Configuring a Cisco router as a DHCP server can be accomplished in a few steps.

The only downside to using a Cisco Router as a DHCP server is manageability. With a Windows, or Linux DHCP server you have much more options as far as administrating and reporting of usage.

The first step in setting up a DHCP server is setting your exclusion range. This is usually a good idea since you would want a range of static IPs for your router, and switches.

Next we will name our DHCP pool. In this example I have named my pool LAN.

Next we will set the network that this pool will assign addresses to. This command is one of the few commands that allows you to use CIDR

Finally we will set the DNS server and default route for the pool

There are a few useful debugging commands, also a command to clear all leases
show ip dhcp binding and show dhcp server statistics shows useful information on your DHCP server.  clear ip dhcp binding <address> removes a single address, while clear ip dhcp binding * will remove all assigned addresses.

Applying Basic config to a Router (Exam Topic 4-A)

Applying a config to a router is similar to that of a switch.

First lets config a host-name, and disable time out on console (my personal preference for console) We will also set logging synchronous
Note: syntax for exec timeout exec-timeout <minutes> [seconds]

Next we will configure VTY (telnet)
We will set the password to cisco and require login

Next we will set the enable secret, encrypt all plain word passwords
First we see the passwords are plain text

Now we will set the enable password and encryption 

Once we've made that changes we can see the password is encrypted. Secret will always be encrypted regardless if the service password was used. 

 
Now we will config fas 0/0. We will be bringing the interface up and applying an IP. This IP will be used to manage the router, it will also be used as the default gateway for your network.

Now lets have some fun with banners. There are three types of banners that can be set MOD, login, and exec. All self explanatory MOD you will see first prior to logging on to the router, Login you will see at first login, exec you will see when entering exec
We will just set the exec login in this example steps are the same for each option
Note: you can use any delimiter you like I will be using a $ in my example

Now lets take a look at how our banner will display while entering exec mode

Now lets save all of our changes there are two options you can do a copy or a write. Doing a write memory requires less key strokes so I usually do a wr mem 

Working With ACL (Exam Topic 6-F/G)

In the following example we will create an Named extended ACL that will permit the 192.168.2.0/24 telnet and FTP access only to R2 Serial 0/0 interface. S 0/0 on R2 has an IP of 10.3.1.2, we still want traffic to pass through this interface to any other adjacent network.
 

First step is to enter "Global Config Mode" once in global config we will create the ACL named telnet and add our first rule.
       Create named ACL: IP access-list extended telnet
       Create rule to allow telnet and FTP to S 0/0 interface: 6 permit tcp 192.168.2.0 0.0.0.255 host 10.3.1.2 range 21 23
Note: you can leave rule number out and let the IOS automatically assign this number, in this example I chose 6.
Note:  Direction - All direction originates from the routers point of view IN/OUT


Next we will deny all other traffic from the 192.168.2.0/24 network
Note: by default the last rule will be a explicit deny all, but we set an allow all as last rule so we need to deny all for the 192.168.2.0/24 network

Finally we will add the last rule that will allow all other traffic

 Now we are ready to apply our newly created ACL to an interface    
Note: we want to place this ACL as close to the source as possible network 192.168.2.0/24 is attached to interface fas 0/0 with traffic flowing into this interface

Now lets test 

First lets see if we can send ICMP traffic to 10.3.1.2 from 192.168.2.2

We can not because only FTP and telnet traffic are allowed to S 0/0 from 192.168.2.0/24

Now Lets try to telnet to 10.3.1.2
We are successful but I did not set a VTY password

Lets try to send traffic through that interface
We are successful because the ICMP traffic matches rule 100 allow all

We can take a look at the amount of hits each rule received 

Access Control List (Exam topic 6-F/G)

What is an Access Control List? 

In the simplest way that I can put it, ACL is used for traffic filtering. You can use ACL to filter traffic based on network, protocols, host. 

All of this filtering is based on permit deny statements.  

Permit 192.168.2.50

Deny 192.168.1.0/24

permit TCP port 80 for 200.1.1.1

Permit ALL TCP traffic for 210.0.1.0/24

What are they used for

• Access control
• NAT
• Quality of Service
• Demand Dial Routing
• Policy routing
• Route Filtering

     Types of ACL        

   ·         Standard

o   Matches based on source address

o   Lower processor utilization

o   Affect depends on application

o   Closer to destination

o   Uses wild card mask

   ·         Extended

o   Close to source as possible

o   Matches based on protocol

o   Matches from source

o   Matches destination 

o   Port|source|destination

o   Can be used for debugging

   ·         Reflexive

o   Not applied to an interface

o   Creates dynamic ACL

o   Can be used as a firewall defense

Access List Number Range 
Depending on what number you user for your ACL will determine its type. I have not included the complete list just that which is regularly used

• 1-99 IP Standard 
• 100-199 IP extended 

    

Rules

      ·         ACL are created in global config mode

o   Is not active until applied to an interface

      ·         List is read from top to bottom, stops at first match

o   Invisible implicit deny at bottom

      ·         ACL is applied to an interface inbound or outbound

      ·         Other possibilities: ACL used for NAT, QOS, VPN
       Note: ACL must be applied to an interface before it is active

   

      Syntax - Standard Access-List 
      Legacy - access-list <number> {permit | deny} <source> [log]
      Modern - ip access-list standard {<number> | <name>}
      Modern Line 2 - [<sequence>] {permit | deny} <source> [log]

      Syntax - Extended Access-List 
    Legacy - access-list <number> {permit | deny} <protocol> <source> [<ports>] <destination> [<ports>] [<options>] 
          Modern - ip access-list extended {<number> | <name>}
     Modern Line 2 - [<sequence>] {permit | deny} <protocol> <source> [<ports>] <destination> [<ports>] [<options>]

      Question: You may be asking yourself whats the mane difference between legacy and modern? 
      Answer: The ability to have a named ACL everything else is the same  

      Here is a link to a quick reference sheet for ACL  Packetlife ACL