my CCDE cheat sheetsPhilippe Jounin 2013

L2L3Tunnelingand overlaysSecurityOperationLayer 2

Layer 2 DesignBPDU GuardPort FastHSRP active& STP RootRoot GuardLoop Guard or Bridge AssuranceForce access-mode (disable DTP)Choose VLAN1Apply Port SecurityModify VTP domain(or turn VTP off)Clear native VLANApply ACL filter on admin VLANPerformance and stabilitySecurity

802.1D EhancementsSpanning Tree ProtectionPortFastEnables immediate transition into forwarding state on edge portsUplinkFast Enables access switches to maintain backup paths to rootBackboneFastEnables immediate expiration of the Max Age timerRoot Guard Prevents a port from becoming the root portBPDU Guard Disables a port if a BPDU is receivedLoop Guard Prevents a blocked port from transitioning to listening (unidirectional) after Max Age timerBPDU Filtering Disables STP on a portBridge Assurance Blocks port if it receives no BPDU

Layer 2 DesignSpanning normalisation DEC STP pre-IEEE 802.1wRapid STP (RSTP) 802.1DClassic STP 802.1sMultiple STP (MST) 802.1t802.1d maintenanceThe following enhancements to 802.1(d,s,w) comprise the Cisco Spanning-Tree toolkit: PortFastLets the access port bypass the listening and learning phases UplinkFastProvides 3-to-5 second convergence after link failure BackboneFastCuts convergence time by MaxAge for indirect failure Loop GuardPrevents the alternate or root port from being elected unless (BPDUs) are present Root GuardPrevents external switches from becoming the root BPDU GuardDisables a PortFast-enabled port if a BPDU is received BPDU FilterPrevents sending or receiving BPDUs on PortFast-enabled ports

Cisco has incorporated a number of these features into the following versions of STP: Per-VLAN Spanning Tree Plus (PVST+)Provides a separate 802.1D spanning tree instance for each VLAN configured in the network.This includes PortFast, UplinkFast, BackboneFast, BPDU Guard, BPDU Filter, Root Guard, and Loop Guard. Rapid PVST+Provides an instance of RSTP (802.1w) per VLAN. This includes PortFast, BPDU Guard, BPDU Filter, Root Guard, and Loop Guard. MSTProvides up to 16 instances of RSTP (802.1w) and combines many VLANS with the same physical and logical topology into a common RSTP instance. This includes, PortFast, BPDU Guard, BPDU Filter, Root Guard, and Loop Guard.Spanning toolkit

Access design STP or not STP

L2 topologies

Layer 3L2L3Tunnelingand overlaysSecurityOperation

Layer 3 DesignThe network must be reliable and resilient

The network must be manageable

The network must be scalable

Layer 3 DesignTriangle vs SquareTriangles: Link/Box Failure does NOTrequire routing protocol convergenceSquares: Link/Box Failure requiresrouting protocol convergence

OSPF in a Campus EIGRP in a Campus ospf stub no-summaryCoreThe router goes up and may advertise default route immediately, (if a loopack is in area 0)eigrp stubQueriesImmediate repliesQueries not forwarded Queries not forwardedArea 0Area 10Summaries

OSPF as PE-CE protocolEIGRP as PE-CE protocolIa routes preferredSham-link use route with lower Cost Set down bit (LSA 3) or domain ID (LSA 5)Ignore routes with down bitAS should be the same

Metric/AS/SOO transported as communities

Pre best path point of insertion

SOO transported into EIGRP

SOO on PE : same SOO per siteSOO on CEs : one SOO per CE

OSPF

LSADescriptionType 1Type 2Router Link LSA Routers, links and costs Network Link LSA Initiated by DR on multipoint networks - Pseudonode. Type 3Type 4Type 5Type 7Network Summary Link LSA Initiated by ABRs. AS External ASBR Summary Link LSA Advertised by ASBRs to be reachable. External Link LSA Initiated from ASBR OSPF external routes advertisment. NSSA External LSA - Initiated from ASBR in a NSSA area OSPF external routes advertisment. .

AireDescriptionBackbone StandardStubTotally StubNSSA(Area 0) All other areas have to be linked with. Accepts LSA 4 from other areas.Receives LSA 3 & 5, initiates LSA 3,4 & 5 toward backbone area. Receives type 3 LSA and a default route (advertised as a LSA 3). initiates LSA 3. Receives a default route as a type 3 LSA, initiates LSA 3Initiates type 7 LSA, Receives LSA 3. Implicit default route for Totally NSSA.

Inter-area routes are summarized on the ABRExternal routes are summarized on the ASBRNSSA-External routes can be summarized on the ASBR or ABR

OSPF AreasArea 0Std AreaExternaltype 1 & 2type 1 & 2type 3type 4type 5Area 0Stub AreaExternaltype 1 & 2type 1 & 2type 3default route

Area 0Totally Stub AreaExternaltype 1 & 2type 1 & 2default route

OSPF AreasArea 0NSSAExternaltype 1 & 2type 1 & 2type 3Area 0Tottaly NSSAExternaltype 1 & 2type 1 & 2type 5Default routetype 7type 5Default routetype 7

OSPF NBMA and partial mesh networksSet the DR priority to 0 on all partial meshed nodesConfigure the peers manually in unicast modeSet the DR priority to 0 on all partial meshed nodesSet broadcast mode on all links

troubleshooting adjacencies EIGRP Same AS Same primary IP subnet Same metrics OSPF Same area Same area type Same IP subnet and mask (not on point to point) Same hello and dead interval Same MTU IS-IS Same area for L1 adjacencies Different system ID Same MTU Same IP subnet Same network/interface type (multipoint or point-to-point)

IS-IS inter area L1/2 routers set attached bit if they are adjacent to extra area L2 routers. L1 routers receiving attached bit generate default routes toward advertising router and propagate it (transitive).

Intra area routes are preferred oved Inter Area even if metric is greater

L1 routes advertised by L1/2 routers to other L2 routers

L1/2 routers may be configured to leak L2 routes into the L1 domain

System ID best practice :

Add implicit zeros into the main IP loopback :192.168.1.24 192.168.001.024 Transfer it to XXXX.XXXX.XXXX format192.168.001.024 1921.6800.1024 Add 49. and 00 as NSEL1921.6800.1024 49.area.1921.6800.1024.00

VPN backdoorsPartial mesh of sham links backbone preferredBGP backdoor IGP (internal links) preferred over eBGP

Outgoing traffic engineering with BGP AS path prepending MED communities selective advertisments (no backup) specific advertismentsRoute ReflectorsFollowing physical topology Session between an RR and a nonclient should not traverse a client Session between an RR and its client should not traverse a nonclient

BGP confederations

FEATURESEEN IN THE CONFEDERATIONPeeringpartial-mesh peering between sub-autonomous systems.full-mesh peering within sub-AS (or route-reflectors)Communicationsbetween peersiBGP is used within each sub-AScBGP is used between sub-autonomous systems, similar to eBGP but with the following differences:Enhancement of the AS_Path attribute Change in the next-hop handling Additions to the BGP attributesEnhancements to the AS_Path attribute, adding the sub-AS IDs.This enhancement is not advertised to the external Autonomous Systems.Preserved attributesnext-hoplocal preferenceMEDReadvertising a learned prefixreadvertised to other sub-autonomous systems if they are selected as best.Communications with non member BGP peersIf a member of the confederation is peering with a BGP peer located in another AS, the sub-AS numbers located in the AS_Path attribute are supressed and only the confederation number is passed within the AS_Path attribute.User of multi-hop parameterBy default cBGP needs directly connected interface

remotely triggered black hole source triggered black holeCE192.0.2.1/32 Null010.1.1.0/2410.1.1.0/24 192.0.2.1NOCCE192.0.2.1/32 Null0+ loose uRPF192.168.1.0/24 192.0.2.1NOC192.168.1.0/24

IPv6

TypeAbrvICMPDescriptionRouter SolicitationRS133Sent by hosts to request an RA Router AdvertisementRA134Originated by routers to announce their existence Neighbor SolicitationNS135Facilitates link-layer address resolution and duplicate address detection Neighbor AdvertisementNA136Response to an NS Redirect137Used by a router to inform a host of a better path out of the link

IPv6 deployment scenariosDual StackHybridService BlockISATAP and Manually Configured TunnelsEnd to EndNativeMarking at tunnel egressQoSmCastIGPSingle ISATAP with AnycastNo load balancingHASingle ISATAP with Anycastload balancing after TunnelsIPv6 hardware required, no per-user/per-appli controlCore Layer becomes access for IPv6 TunnelsNew IPv6 hardware

High Avalability from http://www.sanog.org/resources/sanog14/sanog14-paresh-highavailability.pdf

HAReliable HardwareHigh MTBFRedundant ComponentsNon Stop RoutingRapid Failure detectionNetworkdesignQuickconvergenceR o u t e r r e s i l i e n c yN et w o r k r e s i l i e n c y

ISISArea 1CE 25.5.5.5/322.2.2.2/32router isis net 49.0100.0000.0000.0002.00 area-password IS-IS metric-style wide (for tag TLV) log-adjacency-changes

router isis net 49.0100.0000.0000.0003.00 area-password IS-IS metric-style wide log-adjacency-changes redistribute isis ip level-2 into level-1 route-map MatchTag5router isis net 49.0200.0000.0000.0004.00 metric-style wide log-adjacency-changes summary-add 5.5.0.0 255.255.0.0 tag 5

Area 2CE5#sh ip route | in ^ii L14.4.4.4 [115/20] via 10.1.45.4, Fast1i L110.1.34.0/24 [115/20] via 10.1.45.4, Fast1i*L10.0.0.0/0 [115/10] via 10.1.45.4, Fast1

3.3.3.3/324.4.4.4/32router isis net 49.0200.0000.0000.0005.00 metric-style wide log-adjacency-changes

interface Loopback2 ip address 2.2.2.2/32 ip router isisinterface FastEthernet1 ip address 10.1.23.2/24 ip router isis isis circuit-type level-1

interface Loopback3 ip address 3.3.3.3/32 ip router isisinterface FastEthernet01 ip address 10.1.23.3/24 ip router isis isis circuit-type level-1interface FastEthernet2 ip address 10.1.34.3/24 ip router isisinterface Loopback4 ip address 4.4.4.4/32 ip router isis isis tag 5interface FastEthernet1 ip address 10.1.45.4/24 ip router isis (level-1 not configured)interface FastEthernet2 ip address 10.1.34.4/24 ip router isisinterface Loopback5 ip address 5.5.5.5/32 ip router isisinterface FastEthernet1 ip address 10.1.45.5/24 ip router isis isis circuit-type level-1

CE4#sh ip route | in ^ii L22.2.2.2 [115/30] via 10.1.34.3, 01:51:07, Fast2i L23.3.3.3 [115/20] via 10.1.34.3, 03:23:20, Fast2i su5.5.0.0/16 [115/20] via 0.0.0.0, 00:08:19, Null0i L15.5.5.5/32 [115/20] via 10.1.45.5, 00:08:19, Fast1i L210.1.23.0/24 [115/20] via 10.1.34.3, 03:23:20, Fast1CE3#sh ip route | in ^ii L12.2.2.2 [115/20] via 10.1.23.2, 01:55:41, Fast0i L24.4.4.4 [115/20] via 10.1.34.4, 00:11:55, Fast1i L25.5.0.0 [115/30] via 10.1.34.4, 00:12:49, Fast1i L210.1.45.0/24 [115/20] via 10.1.34.4, 01:55:41, Fast1CE2#sh ip route | i ^ii L13.3.3.3 [115/20] via 10.1.23.3, Fast0i ia4.4.4.4 [115/30] via 10.1.23.3, Fast0i ia5.5.0.0 [115/40] via 10.1.23.3, Fast0i L110.1.34.0/24 [115/20] via 10.1.23.3, Fast0i*L10.0.0.0/0 [115/10] via 10.1.23.3, Fast0Fast 110.1.23.0/24Fast 110.1.45.0/24Fast 210.1.34.0/24CE 3CE 4CE 5Straightforward configurationSummarization + leaking

OSPFArea 202 NSSACE11.1.1.1/242.2.2.2/243.3.3.3/24Area 0lyo-maq-2811-03#sh ip route | i ^OOE1 1.0.0.0/8 [110/124] via 10.1.34.3,Fast3O E1 2.2.0.0 [110/125] via 10.1.34.3, Fast3

interface Loopback1111 ip address 1.1.1.1 255.255.255.0interface Loopback2222 ip address 2.2.2.2 255.255.255.0interface Loopback3333 ip address 3.3.3.3 255.255.255.0router rip version 2 redistribute connected route-map Loopbacks passive-interface default no passive-interface FastEthernet1 network 10.0.0.0 no auto-summary

router rip version 2 timers basic 15 45 15 60 passive-interface default network 10.0.0.0 no auto-summaryrouter ospf 1 log-adjacency-changes area 202 nssa summary-address 3.0.0.0 255.0.0.0 not-advertise summary-address 2.2.0.0 255.255.0.0 redistribute rip metric 123 metric-type 1 subnets network 10.1.23.0 0.0.0.255 area 202router ospf 1 log-adjacency-changes area 202 nssa summary-address 10.0.0.0 255.0.0.0 not-advertise summary-address 1.0.0.0 255.0.0.0 network 10.1.23.0 0.0.0.255 area 202 network 10.1.34.0 0.0.0.255 area 0

! Remark : ! area 10 filter-list prefix FILTER out! area 10 range 10.0.0.0 255.0.0.0 not-advertise! Only for standard Areas

router ospf 1 network 10.1.34.0 0.0.0.255 area 0

lyo-maq-2611-02#sh ip route | i ^R|^OR 1.1.1.0 [120/1] via 10.1.12.1, Fast1O 2.2.0.0/16 is a summary, Null0R 2.2.2.0/24 [120/1] via 10.1.12.1, Fast1R 3.3.3.0 [120/1] via 10.1.12.1, Fast1O IA 10.1.34.0/24 [110/2] via 10.1.23.3, Fast2

lyo-maq-2811-03#sh ip route | i ^OO N1 1.1.1.0/24 [110/124] via 10.1.23.2, Fast2O 1.0.0.0/8 is a summary, Null0O N1 2.2.0.0 [110/124] via 10.1.23.2, Fast2O N1 10.1.12.0/24 [110/124] via 10.1.23.2,Fast2

lyo-maq-2611-01#sh ip route | i ^CC 1.1.1.0 is connected, Loopback1111C 2.2.2.0 is connected, Loopback2222C 3.3.3.0 is connected, Loopback3333C 10.1.12.0/24 is connected, Fast1Fast 110.1.12.0/24Fast 310.1.34.0/24Fast 210.1.23.0/24CE 2CE 3CE 4

L2L3Tunnelingand overlaysSecurityOperationTunneling& MPLS

MPLS TEHow to route a flow into a tunnel

static routing PBR Autoroute tunnel included into SPF calculation, not into the IGP other routers are unaware of the Tunneldefault metric is the tail end IGP metricRelative/asolute metrics OSPF similar to E1/E2 externalsLSP tail end is always routed through the tunnelIGP+LSP load sharing available behind tail endtail end load sharing needs 2 LSP Forwarding Adjacencytunnel propagated into the IGP

Inter Area MPLS TEMulti domain LSP : each domain core topology should be hidden

per-domain static ERO (next-hop loose ) CSPF stitching (CSPF calculation on each ASBR) then ERO extended to hide core topology backward recursive path computation A tree is created by destination PE (=cost X) and topology increased by each domain StitchingUse targeting signaling StackingInner domain uses its own LSP to tunnel border domains LSP, targeted signaling required

Backbone

ProviderInter domain VPN with CSC - IGPIGP + LDP (int e0/0 mpls ip)vpnv4 multiphop e/i-bgp peering, next-hop-unchangedInner VPN definition and routing in vpnv4IGP ipv4 BGP redistribution into ipv4 add-family vrf innerIGP + local loopbackOuter VPN definitionCEPE route distributionCE1PE1CSC-CE1CSC-PE1CSC-PE2CSC-CE2PE2CE2MP-iBGP sessionMP-iBGP sessionIPv4+ labelsIPv4+ labels

Backbone

ProviderCE1PE1CSC-CE1CSC-PE1CSC-PE2CSC-CE2PE2CE2MP-iBGP sessionMP-iBGP sessionIPv4+ labelsIPv4+ labelsInter domain VPN with CSC - eBGPmpls ip not necessaryInner VPN definition and routing in vpnv4bgp neighbor as-overridebgp send-labelIGP + local loopback BGPneighbor bgp send-labelOuter VPN definitionCEPE route distributionvpnv4 multiphop e/i-bgp peering, next-hop-unchanged

Inter domain VPN option Binterface Ethernet 1/0 mpls bgp forwarding

router bgp 1 neighbor remote-as 2 neighbor remote-as 1 no bgp default route-target filter

address-family vpnv4 neighbor activate neighbor next-hop-self neighbor activate neighbor send-community extendedOne tag allocated by ASBROption B1Next-hop-self methodOption B2Redistribute connected methodeBGP : no route-target filteringiBGP : next-hop-self

Inter domain VPN option C eBGP + send-label router bgp 1 neighbor remote-as 1 neighbor remote-as 2 neighbor ebgp-multihop

address-family vpnv4 neighbor activate neighbor activate neighbor next-hop-unchangedRRinterface Ethernet 1/0 mpls bgp forwarding

router bgp 1 neighbor remote-as 2 neighbor remote-as 1 address-family ipv4 redistribute IGP neighbor activate neighbor send-label address-family vpnv4 neighbor activate router IGP network loopback LDP redistribute BGP 1router bgp 1 neighbor remote-as 1

address-family vpnv4 neighbor activateTag 1 :ebgp + send-label or IGP+LDPTag 2 :VPN label

MPLS TE QoSUniform (mpls exp value set by ISP)Short pipepipe

L2VPN VPWSVirtual Private Pseudowire Services : Point to Point L2 Protocol translation (L2.5 VPN) tLDP session Redundancy by nominal/backup sessions

VPLSVirtual Protocol LAN Service (P2M) Autodiscovery with BGP For Cisco : VPLS = full-mesh Pseudo Wires

H-VPLS Full Mesh between N-PE PW beetwen User PE and Netwok PE redundancy with STP or PW backup between U-PE and N-PE

L2L3Tunnelingand overlaysSecurityOperations MonitoringManagementPerformance

Troubleshooting high CPU Utilization Identify process show proc cpu sorted show log CausesARPBGP ExecSNMPNAT TCAM full (catalyst 3550/..) IP Inputshow interfaces statsshow interfacesshow interfaces switching

QoS operation orderInbound1. QoS Policy Propagation through Border Gateway Protocol (BGP) (QPPB)2. Input common classification3. Input ACLs4. Input marking (class-based marking or Committed Access Rate (CAR))5. Input policing (through a class-based policer or CAR)6. IP Security (IPSec)7. Cisco Express Forwarding (CEF) or Fast Switching

Outbound1. CEF or Fast Switching2. Output common classification3. Output ACLs4. Output marking5. Output policing (through a class-based policer or CAR)6. Queueing (Class-Based Weighted Fair Queueing (CBWFQ) and Low Latency Queueing (LLQ)), and Weighted Random Early Detection (WRED)

Multipoint WAN QoS Remote Ingress Shaping 95% of line rate

WANFR egress shaping : 95% of smallest bandwidth

QoS Models12 Class modelVoiceRealtime InteractiveMultimedia ConferencingBroadcast VideoMultimedia StreamingSignalingNetwork ControlNetwork ManagementTransactional DataBulk DataBest EffortScavanger8 Class modelVoiceInteractive VideoStreaming VideoSignalingNetwork ControlCritical DataBest EffortScavanger4 Class modelRealtimeSignaling / ControlCritical DataBest Effort

L2L3Tunnelingand overlaysOperationSecurity

Internet Edge DMZ : public facing services Private DMZ : internal services (DNS, collaboration, HTTP) not vulnerable to outside attacks infrastructure ACLs

Internet EdgeSecure Operations Monitor Cisco Security Advisories and Responses Leverage Authentication, Authorization, and Accounting Centralize Log Collection and Monitoring Use Secure Protocols When Possible Gain Traffic Visibility with NetFlow Configuration Management

Data Plane General Data Plane Hardening Filtering Transit Traffic with Transit ACLs Anti-Spoofing Protections Limiting CPU Impact of Data Plane Traffic Traffic Identification and Traceback Access Control with VLAN Maps and Port Access Control Lists Using Private VLANs

Internet Edge

Management Plane General Management Plane Hardening password management restrict protocols use secure protocols exec-timeout event detection (memory, cpu threshold) Limiting Access to the Network with Infrastructure ACLs Securing Interactive Management Sessions Using Authentication, Authorization, and Accounting Fortifying the Simple Network Management Protocol Logging Best Practices Cisco IOS Software Configuration Management

Control Plane General Control Plane Hardening filter IPCMP, fragments, source-route, disbale proxy-arp Limiting CPU Impact of Control Plane Traffic filter fragment, non ip traffic, rate ICMP unreachable Securing BGP Securing Interior Gateway Protocols Securing First Hop Redundancy Protocols

Everyone wants to live on top of the mountain, but all the happiness and growth occurs while youre climbing it.