Cisco Secure ACS 를 사용하여 인증 하는 사용자나 그룹에 대해 특정 명령어에 권한을 주거나 뺄 수 있는 설정을 할 수 있네요.


acs_shell_auth.pdf

ACS Shell Command Authorization Sets on IOS and ASA/PIX Configuration






세팅 방법은
1.ReadWrite Access - For Administrators etc full access
2.ReadOnly Access - Users are allowed to run only show commands
ex)show 명령어에 대해서만 권한을 줄수 있어요..
3.Restrict_access
특정 명령어에 대한 세부적인 설정을 할 수 있어요.


IOS를 사용하는 장비에는 아래와 같은 설정이 꼭 들어 있어야 해요.
aaa new-model
aaa authorization config-commands
aaa authorization commands 0 default  group tacacs+ local
aaa authorization commands 1 default  group tacacs+ local
aaa authorization commands 15 default group tacacs+ local


PDF 문서를 보면 영문 문서지만 그림을 보며 쉽게 세팅 할 수 있어요.

Using the PIX Firewall DHCP Client

아래와 같은 구성일때 Pix Outside 쪽 interface가 Dhcp로 동작 하기 때문에 pix interface 에 직접 ip를 설정 할 수가 없어요.
그래서 cisco.com site를 뒤적 거리다 찾아낸 PIX Firewall을 DHCP Client로 사용하기 예요.

Outside 쪽에 dhcp 를 연결 하고 pix 방화벽을 두고 Inside 쪽에서는 방화벽으로 보호된 internet을 사용한다 뭐 이런 개념이죠.

 

사용자 삽입 이미지


설정은 생각보다 너무 간단했어요. >ㅁ<

Configuring the DHCP Client
To enable the DHCP client feature on a given PIX Firewall interface and set the default route via the DHCP server, enter the following command:

아래와 같이 config mode에서 outside쪽에 dhcp 명령어를 넣어 주면 된답니다.

ip address outside dhcp [setroute] [retry retry_cnt]

setroute 옵션은 default route 가 없을때 default route를 생성해 준답니다.

아래 명령어들은 DHCP client debugging 을 위해 제공 된답니다.
•debug dhcpc packet
•debug dhcpc detail
•debug dhcpc error

Outside interface 쪽에 케이블을 연결 할때와 분리할때 debug dhcp packet 결과를 한 번 캡쳐해 봤어요.

Cable을 연결 했을 때
pixfirewall# debug dhcpc packet
DHCP: allocate request
DHCP: new entry. add to queue
DHCP: SDiscover attempt # 1 for entry:
DHCP: SDiscover: sending 278 byte length DHCP packet
DHCP: SDiscover 278 bytes
DHCP Broadcast to 255.255.255.255 from 0.0.0.0dhcpc_discover_pkt: proto = 0x1, lp = 0x2b66
dhcpc_discover_pkt: proto = 0x1, lp = 0x2b66
dhcpc_discover_pkt: proto = 0x11, lp = 0x44

DHCP client msg received, fip=10.10.10.4, fport=67
DHCP: Received a BOOTREP pkt
DHCP: offer received from 10.10.11.101
DHCP: SRequest attempt # 1 for entry:
DHCP: SRequest- Server ID option: 10.10.11.101
DHCP: SRequest- Requested IP addr option: 10.10.10.95
DHCP: SRequest placed lease len option: 43200
DHCP: SRequest: 296 bytes
DHCP Broadcast to 255.255.255.255 from 0.0.0.0dhcpc_discover_pkt: proto = 0x11, lp = 0x44
dhcpc_discover_pkt: proto = 0x11, lp = 0x44
dhcpc_discover_pkt: proto = 0x11, lp = 0x44

DHCP client msg received, fip=10.10.10.3, fport=67
DHCP: Received a BOOTREP pkt
DHCP: offer received from 10.10.11.101
DHCP: offer received in bad state: Requesting  punt
DHCP client msg received, fip=10.10.10.4, fport=67
DHCP: Received a BOOTREP pkt
DHCP Proxy Client Pooling: ***Allocated IP address: 10.10.10.95
DHCP client msg received, fip=10.10.10.3, fport=67
DHCP: Received a BOOTREP pkt
DHCP: rcv ack in Bound state: punt
DHCP: allocate request
Allocated IP address = 10.10.10.95,  netmask = 255.255.255.0, gateway = 10.10.10.1

DHCP client msg received, fip=10.10.10.3, fport=67
DHCP: Received a BOOTREP pkt Not for us..:  xid: 0xE6A9F1C3
DHCP client msg received, fip=10.10.10.4, fport=67
DHCP: Received a BOOTREP pkt Not for us..:  xid: 0xE6A9F1C3


 

Cable을 제거 했을때
DHCP: deleting entry 10194f4 10.10.10.95 from list
Temp IP addr: 10.10.10.95  for peer on Interface: outside
Temp  sub net mask: 255.255.255.0
   DHCP Lease server: 10.10.11.101, state: 3 Bound
   DHCP transaction id: 0x65453
   Lease: 43200 secs,  Renewal: 21600 secs,  Rebind: 37800 secs
   Temp default-gateway addr: 10.10.10.1
   Next timer fires after: 21550 seconds
   Retry count: 0   Client-ID: cisco-0000.0000.0000-outside

+
참고 page
Using PIX Firewall in SOHO Networks


Direct 를 나타내는 MDI(Medium Dependent Interface) 와 Cross를 나타내는 MDIX(MDI Cross) 가 있습니다.
보통 3Com switch나 hub 에서는 MDI/MDIX, MDI/X 로 표시 되어 있는데 예를 들면 switch <-> switch 사이의 연결 일때 cross cable로 연결을 해야 하는데 Direct cable 밖에 없다면 이 기능을 이용 하면 됩니다.

Cisco 의 switch 에도 mdix 라는 기능이 있는데 interface 에서 mdix auto 로 지정해 놓으면 switch 는 연결된 cable type 을 확인하고 적절히 처리하게 되어 cross 나 direct cable 에 상관없이 사용 할 수 있습니다.

Switch(config-if)#mdix ?
  auto  Enable automatic MDI crossover detection on this interface

You can use the mdix auto interface configuration command in the CLI(Command Line Interface) to enable the automatic medium-dependent interface crossover (auto-MDIX) feature. When the auto-MDIX feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100, 10/100/1000, or 1000BASE-T SFP module port on the switch, regardless of the type of device on the other end of the connection.

The auto-MDIX feature is enabled by default on switches running Cisco IOS Release 12.2(18)SE or later. For releases between Cisco IOS Release 12.1(14)EA1 and 12.2(18)SE, the auto-MDIX feature is disabled by default. For configuration information for this feature, see the switch software configuration guide or the switch command reference.


새로 들어온 Network Device 의 IOS Upgrade를 하던 중 이미지도 정상적으로 Upload 되고 boot system 도 정상적으로 지정이 되었는데 Reload 를 하면 이전 이미지로 booting 이 되는 난감한 상황 속에서 원인을 찾았네요. 정상적으로 사용되는 config-register 의 값은 0x2102 인데 0x2 로 지정되어 있더군요.

config-register 값은 보통 show version 시 마지막 줄에서 확인 할 수 있어요.

ex )

R1>sh ver
Cisco Internetwork Operating System Software
IOS (tm) 2600 Software (C2691-IS-M), Version 12.3(22), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by cisco Systems, Inc.
Compiled Wed 24-Jan-07 17:17 by ccai
Image text-base: 0x60008AF4, data-base: 0x61C6A000

ROM: ROMMON Emulation Microcode
ROM: 2600 Software (C2691-IS-M), Version 12.3(22), RELEASE SOFTWARE (fc2)

R1 uptime is 1 minute
System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19
System image file is "tftp://255.255.255.255/unknown"

cisco 2691 (R7000) processor (revision 0.1) with 120832K/10240K bytes of memory.
Processor board ID XXXXXXXXXXX
R7000 CPU at 80MHz, Implementation 39, Rev 2.1, 256KB L2, 512KB L3 Cache
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
2 FastEthernet/IEEE 802.3 interface(s)
4 Serial network interface(s)
DRAM configuration is 64 bits wide with parity enabled.
55K bytes of non-volatile configuration memory.
65536K bytes of ATA System CompactFlash (Read/Write)

Configuration register is 0x2102


Configuration register 값에 대한 정리.

사용자 삽입 이미지

Software Configuration Bit Meanings
Bit No. Hex Meaning
00-03 0x0000-0x000F Boot Field
06 0x0040 Ignore NVM contents
07 0x0080 OEM bit enabled
08 0x0100 Break disabled
10 0x0400 IP broadcast with all zeros
11-12 0x0800-0x1000 Console line speed
13 0x2000 Boot default ROM software if network boot fails
14 0x4000 IP broadcasts do not have net numbers
15 0x8000 Enable diagnostic messages and ignore NVM contents

Explanation of Boot Field (Configuration Register Bits 00-03)
Boot Field Meaning
00 Stays at the system bootstrap prompt
01 Boots system image on EPROM
02-F Specifies a default netboot filename

Enables boot system commands that override default netboot filename


Default Boot Filenames
Action/Filename Bit 3 Bit 2 Bit 1 Bit 0
Bootstrap monitor 0 0 0 0
ROM software 0 0 0 1
cisco2-igs 0 0 1 0
cisco3-igs 0 0 1 1
cisco4-igs 0 1 0 0
cisco5-igs 0 1 0 1
cisco6-igs 0 1 1 0
cisco7-igs 0 1 1 1
cisco10-igs 1 0 0 0
cisco11-igs 1 0 0 1
cisco12-igs 1 0 1 0
cisco13-igs 1 0 1 1
cisco14-igs 1 1 0 0
cisco15-igs 1 1 0 1
cisco16-igs 1 1 1 0
cisco17-igs 1 1 1 1

Configuration Register Settings for Broadcast Address Destination
Bit 14 Bit 10 Address (<net> <host>)
off off <ones> <ones>
off on <zeros> <zeros>
on on <net> <zeros>
on off <net> <ones>

System Console Terminal Baud Rate Settings
Baud Bit 12 Bit 11
9600 0 0
4800 0 1
1200 1 0
2400 1 1

원문링크


pix ios 7.x 에서 6.x 로 downgrade 하는 방법이 따로 있어요.
일반적인 ios upload 명령어로 7.x 버전 ios 가 올라가 있는 상태에서 6.x ios를upload 하면 정상 동작 하지 않습니다.
제경우 moniter mode로 빠졌었던 것 같네요.

Downgrade from PIX 7.x to 6.x -

pixfirewall(config-if)# downgrade tftp://192.168.0.2/pix635.bin
This command will reformat the flash and automatically reboot the system.
Do you wish to continue? [confirm]
Buffering image
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Buffering startup config

All items have been buffered successfully.
If the flash reformat is interrupted or fails, data in flash will be lost
and the system might drop to monitor mode.
Do you wish to continue? [confirm]
Acquiring exclusive access to flash
Installing the correct file system for the image and saving the buffered data
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Flash downgrade succeeded

Rebooting....


ios image 가 잘 못 올라가 pix 부팅시 아래와 같은 메세지가 나오면

No bootable image in flash. Please download
an image from a network server in the monitor mode

Failed to find an image to boot

moniter mode 에서 ios 를 tftp 를 이용해 새로 upload 해 주면 됩니다.
이미지가 올라가다 멈춰도 몇 번 하다 보면 정상적으로 올라 갑니다.

monitor> interface 0
0: i8255X @ PCI(bus:0 dev:14 irq:10)
1: i8255X @ PCI(bus:0 dev:13 irq:11)

Using 0: i82557 @ PCI(bus:0 dev:14 irq:10), MAC: 0011.2063.5565
monitor> addr 192.168.0.1
address 192.168.0.1
monitor> server 192.168.0.2
server 192.168.0.2
monitor> file pix711.bin
file pix711.bin
monitor> tftp
tftp pix711.bin@192.168.0.2.............................................................
.................................................................................................
..................................................................................................
...................................................................................................
..................................................................................................
..................................................................................................
........................................................

참고 page :
http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_tech_note09186a00804708d8.shtml#t4

cspix-adsm-swupgrade.pdf


거의 석달만에 PDF 파일이지만 자격증을 받았습니다.

어제 오전에 cisco 측에서 메일이 왔네요.

1. Login to the Cisco Career Certifications Tracking System at www.cisco.com/go/certification/login.
2.  Click Test History.
3.  Click the Check Fulfillment Status link.
4.  Click the PDF link under the Certificate column for the appropriate certificate. Select File from the menu options and save the file to your local machine.

Cisco site 에 로긴 해서 pdf 파일을 다운 받을 수 있게 되어 있더군요.

자격증중 일부 캡쳐!


자격증이 꼭 필요한 건 아니지만 없는 것 보다는 좋고 웬지 뿌듯 하답니다.

  1. BlueCol 2006.09.01 11:31 신고

    쳇쳇쳇...

  2. Favicon of http://cyworld.com/jeichee BlogIcon J.HEe 2006.09.04 11:40 신고

    진짜가아니야..아닌거야
    PDF잖어..진짜가아니야

    진짜를 보여주세요.

    • Favicon of http://www.banggae.com/tt BlogIcon bang 2006.09.04 14:05 신고

      진짜는 배타고 오다가 사라졌어.
      배타고 오다가 사라졌어.
      배타고 오다가 사라졌어.

자격증 취득한지 어언 두달.

아직도 자격증을 수령 하지 못 했습니다.

미국에서 배를 이용한 메일로 발송 되었다고 하는데 벌써 두달이 넘도록 수령하지 못해 몇번 메일로 문의를 해서 아래와 같은 답변을 받았습니다.

However, as a courtesy, we would like to offer you an electronic copy of your certificate at no charge.

electronic copy란 종이로 인쇄 되어진 자격증(printed copy)을 받는 것이 아니라 메일로 PDF 형식으로 자격증을 보내 주는 것으로 바로 받아서 인쇄 할 수 있는 것이죠.

printed copy로 발송되면 나중에 Electronic copy로 다시 신청하려면 15$를 추가로 내고 발급 받을 수 있습니다.

처음부터 Electronic copy로 신청 할 수도 있고요.

printed copy를 받지 못했는데 급하게 자격증이 필요하니 Electronic copy로 받을 수 있겠냐고 물어보니 다행히 no charge 로 Electronic copy를 제공해 준다고 하네요.

5~7일 정도 기다리라고 하는데 어서 받았으면 좋겠네요.

cisco 자격증을 취득 하였는데 수령하지 못한 분들은 아래 site에서 발송 되었는지 확인 후

http://www.cisco.com/go/certifications/login

발송 되었는데도 수령이 안되신 분들은 아래 site에서

http://ciscocert.custhelp.com

create case를 만들어 문의를 하시면 됩니다.

일단 printed copy로 발송된 자격증은 8주 동안은 기다려 보라는 답변을 준답니다.


뭐 printed copy로 자격증을 받더라도 못받았다고 우기면 Electronic copy도 주는 건가 라는 생각이 드네요.




시원한 가을 바람이 불고 있습니다.
8월 24일 좋은 날 좋은 하루들 보내시길.
  1. Favicon of http://puriae.tistory.com BlogIcon 푸리아에 2006.08.24 17:45 신고

    음. 못받은 거로군 .. -_-;

    • Favicon of http://www.banggae.com/tt BlogIcon bang 2006.08.24 19:49 신고

      응 아직도 못 받았어.
      보냈다는데 지난 번 자격증도 못 받았는데 그건 오래 된 거라 포기.

642-831 CIT

Internet Troubleshooting Support Exam

  Exam Number:  642-831
Associated Certifications:CCNP
Duration:75-90 minutes (60-70 questions)
Available Languages:English, Japanese in Japan only
Click Here to Register:Pearson VUE or Prometric
Exam Policies:Read current policies and requirements
Exam Tutorial:Review type of exam questions

Exam Description

CIT is a qualifying exam for the Cisco Certified Network Professional CCNP® certification. The 642-831 CIT exam will test materials covered under the Cisco Internetwork Troubleshooting (CIT) course. The exam will certify that the successful candidate has important knowledge and skills necessary to troubleshoot sub-optimal performance in a converged network environment. The exam includes topics on describing and implementing effective troubleshooting strategies, troubleshooting IP unicast and multicast routing, troubleshooting multi-layer switched networks, and troubleshooting WANs and remote access connections.

Exam Topics

The following information provides general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes the guidelines below may change at any time without notice.

Describe and implement effective troubleshooting strategies

  • Describe and apply layered-model troubleshooting methodologies
  • Isolate sub-optimal internetwork operation at the correctly defined OSI Model layer
  • Identify tools and resources for network troubleshooting

Troubleshoot IP unicast and multicast routing

  • Troubleshoot IGPs
  • Troubleshoot BGP
  • Troubleshoot multicast routing
  • Troubleshoot protocol redistribution
  • Troubleshoot policy based routing

Troubleshoot multi-layer switched networks

  • Troubleshoot spanning tree
  • Troubleshoot VLANs
  • Troubleshoot multi-layer switch operations
  • Troubleshoot gateway redundancy protocols

Troubleshoot WAN and Remote Access

  • Troubleshoot and verify AAA
  • Troubleshoot Frame Relay
  • Troubleshoot PPP
  • Troubleshoot ISDN and DDR
  • Troubleshoot and verify VPN remote access operations with IPSec
  • Troubleshoot queuing and compression solutions
Recommended Training

Cisco Internetworking Troubleshooting (CIT) is the recommended training for this exam.

Courses listed are offered by Cisco Learning Partners—the only authorized source for Cisco IT training delivered exclusively by Certified Cisco Instructors. Check the List of Learning Partners for a Cisco Learning Partner nearest you.

Additional Resources

A variety of Cisco Press Self-Study titles are available for this exam. These titles can be purchased at the Cisco Marketplace, directly from Cisco Press, or wherever you purchase technical books.

Understanding EIGRP Features and Advantages

■ DUAL
-DUAL is one of the main features of EIGRP. It diffuses the routing computation over multiple routers. A more detailed discussion of DUAL is provided in the section “Components of EIGRP.”
■ Loop-free networks
-The DUAL algorithm is used to ensure a loop-free network. The calculation of an FS means that the backup route is downstream from the router. The FS is chosen only because it has a lower metric to
the destination route than that reported by the router. This prevents any routes that lead back to the router from being chosen, thus eliminating loops.
■ Incremental updates
-EIGRP sends nonperiodic, partially bounded updates. That is, they are sent whenever there is a change to be reported and not at regular intervals. When a network change is made, the updates
include only those changes that are needed to update the affected routers.
■ Multicast addressing for updates
-EIGRP uses an RTP that guarantees delivery. This is essential when the routing updates are not sent periodically; otherwise, if the receiving router is not expecting an update, it cannot realize that an
update was missed, indicating a network problem. Updates are therefore sent using a reliable multicast. The address is the reserved class D address, 224.0.0.10. When the neighbor receives a
multicast, it acknowledges receipt of the packet with an unreliable unicast.
■ Advanced distance vector protocol
-EIGRP has solved many of the problems inherent in distance vector protocols, which prevent them from effectively supporting large networks. The features of distance vector technology that prohibit
network growth include the use of broadcasts and hop count, neither of which is used by EIGRP.
Other characteristics that advance EIGRP beyond an ordinary distance vector protocol come from its status as a classless routing protocol. Without the use of areas, EIGRP allows summarization
anywhere in the network. Summarization reduces the need for network resources. Because the classless protocols send the subnet mask with the update, this also means that classless protocols
support discontiguous networks and, of course, variable-length subnet mask (VLSM).
■ Loop-Free Routing Tables
The criteria for selecting the primary and backup routes in the topology table and the routing table ensure that the routes offered are loop-free. The primary route that is placed in the routing table is
chosen for the lowest metric, which means it cannot be looped. The backup route (feasible successor) is dependent on the downstream router (next hop advertising the alternative route)
advertising a lower cost for the route than the one stored in the routing table. This ensures that the backup route does not loop back through the router.
■ Support for different topologies
-EIGRP, as a new protocol, has been able to anticipate recent topologies, such as NBMA clouds.
There is no complex configuration required for these topologies, though additional configuration is available for tuning the update operation of EIGRP.
■ Rapid convergence
-The use of the DUAL algorithm stores not only the best path to the destination, but also the close contenders. If a network fails, the router can immediately switch to the alternate route. If there are
no alternative routes, then the router will query neighbors to see whether they have a path to the destination.
■ Reduced bandwidth use
-Using multicast and unicast addressing to send and acknowledge updates restricts the potential use of both bandwidth and the other system’s CPU to the essential requirements. EIGRP also uses only
incremental updates, as opposed to periodic updates.
■ Protocol independence at Layer 3
-EIGRP functions as the routing protocol for IP, AppleTalk, and IPX. A different routing table is maintained for each Layer 3 protocol. EIGRP will automatically redistribute IPX RIP, AppleTalk
RTMP, and IP IGRP within the same autonomous system.
■ Compatibility with IGRP
-Because it grew out of IGRP, EIGRP is backward-compatible with IGRP. This allows for seamless transitions to EIGRP and support for older, smaller networks that have neither the need nor the
capability to upgrade. EIGRP automatically redistributes IP routes learned into the IGRP process as long as the autonomous system number used to configure the processes is the same.
■ Easy configuration
-Because EIGRP was designed for the hardware on which it runs, the protocol not only is tuned for efficiency, but also is simple and straightforward to configure. Another benefit is that EIGRP has
fewer design constraints than OSPF; for example, EIGRP supports point-to-point, in addition to NBMA point-to-point and multipoint. EIGRP requires no additional configuration other than tuning
the bandwidth utilization, if desired.
■ Use of a composite metric
-EIGRP uses the same metric as IGRP (bandwidth and delay as the default), though EIGRP has expanded the metric to 32-bit, allowing for greater scaling and granularity. An intelligent metric will
select the shortest path.
■ Unequal-cost load balancing
-Unequal-cost load balancing allows all links to a destination to be used to carry data without saturating the slower links.

EIGRP 용어
■ Neighbor table - 각각의 EIGRP 라우터에는 네이버 테이블이 있으며 인접 라우터의 목록이 저장되어 있다.
link state 라우팅 프로토콜에서 사용되는 인접 관계 데이터베이스와 네이버 테이블을 비교할 수 있으며, 네이버 테이블은 인접 데이터베이스와 동일한 용도로 사용된다.
지원되는 각 네트워크 프로토콜의 네이버 테이블을 유지한다.
■ Topology table - 설정되어 있는 각 네트워크 프로토콜에 대한 topology table을 관리한다.
■ Routing table - 수신지로 가는 최상의 경로를 토폴로지 테이블에서 선택하며 이경로를 라우팅 테이블에 저장한다.
■ Successor - 수신지에 도착하기 이ㅜ해 사용되는 주 경로를 제공하는 네이버.
■ FS(Feasible Successor) - FS는 수신지에서 아래쪽으로 있는 네이버다. 최소 코스트 경로는 아니므로 데이터 전달에 사용되지는 않는다.
수신지에 대한 백업 경로를 제공하는 네이버. FS 경로는 Success와 동시에 선택되지만 토폴로지 테이블에서 관리된다. 1개의 수신지에 대해 여러 개의 FS가 있을 수 있고 여러개의 FS를 토폴로지 테이블에서 관리 할 수 있다.


EIGRP Router에서 IP topology와 routing table을 모으는 순수
1. 각 router는 EIGRP neighbor table에 명시된 대로 IP routing table의 복사본을 인접한 모든 EIGRP neighbor로 전달.
2. 각 router는 인접한 neighbor의 routing table을 EIGRP topology table(database)에 저장한다.
3. 각 router는 EIGRP topology database를 조사하여 모든 수신지 네트워크에 대한 최상의 경로와 다른 적합한 경로를 파악한다.
4. Topology table에서 각 수신지에 대한 최상의 경로(successor 경로)가 선택되고, 이것이 라우팅 테이블에 저장 된다.

EIGRP Packet
■ hello - neighbor를 발견 할 때는 hello packet이 사용된다. multicast로 전송되며 확인 응답 번호 0을 보낸다.
EIGRP multicast address는 224.0.0.10 이다. 동일한 AS에 속한 router로부터 hello packet을 수신할 때 router는 neighbor 관계를 수립한다.
T1이나 이보다 느린 다중점 interpace에서 60초마다 hello packet 전송,LAN과 Serial interpace에서는 5초마다 전송.
■ update - convergence를 위하여 특적 router에서 사용한 경로가 무엇인지 알리기 위해 update packet이 전송된다.(영향을 받는 router에게만)
EIGRP startup이 진행되는 동안 topology table을 동기화 하기 위해 update packet은 neighbor에게 unicast로서 전송된다.
■ query - 경로 계산을 수행하고 FS를 발견하지 못할 경우 router는 질의 packet을 neighbor로 보내서 수신지에 대한 FS가 있는지를 물어본다. 질의는 항상 multicast.
■ reply - reply packet는 query packet에 반응하여 전송된다. reply는 처음 query를 보낸 곳에 대해서는 unicast.
■ acknowledge - update,query,reply의 확인 응답에 ACK가 사용된다. ACK는 unicast로서 전송되는 hello packet다. 여기에는 0이 아닌 확인 응답 번호가 포함된다.

hello interval 변경 - ip eigrp hello-interval as-number seconds
hold time 변경 - ip eigrp hold-time as-number seconds

hello interval 과 hold time 값이 일치 하지 않더라도 두 대의 router는 EIGRP neighbor가 될 수 있다.

show ip eigrp neighbors 명령어로 IP neighbor 테이블을 볼 수 있다.
show ip eigrp topology all-links 명령어로 이웃하고 있는 모든 router가 광고한 모든 수신지가 포함된 topology table을 볼 수 있다.
show ip eigrp topology 명렁어는 ip 경로에 대한 success와 FS만을 표시한다.

Route selection
EIGRP는 Success경로의 FS 경로를 선택하고 이를 Topology table에 삽입한다.
수신지별로 최대 6개까지 가능하다. 이후에 success 경로는 routing table로 옮겨진다.

EIGRP Metric 계산
EIGRP의 Metric 계산에는 5개의 변수를 사용 할 수 있지만 기본적으로 2개(bandwidth,delay)의 변수만을 사용한다.

■ bandwidth - 송신지와 수신지 사이에서 가장 작은 대역폭
■ delay - 경로에 따라 누적되는 interpace의 지연

■ reliability - 송신지와 수신지 사이의 가장 나쁜 신뢰성, keepalive를 기반
■ loading - 송신지와 수신지 사이의 link에서 가장 나쁜 load,packet speed와 interpace의 설정된 bandwidth를 기반으로 한다.
■ MTU(Maximum Transmission Unit) - 경로에서 가장 작은 MTU.

- Catalyst 3550 Multilayer Switch -

Troubleshooting
Recovery Procedures

Recovering from Corrupted Software
Recovering from a Lost or Forgotten Password
Recovering from a Command Switch Failure
Recovering from Lost Member Connectivity

Autonegotiation Mismatches

Connectivity Problems

Understanding Ping
Executing Ping
Understanding IP Traceroute
Executing IP Traceroute

Debug Commands

Enabling Debugging on a Specific Feature
Enabling All-System Diagnostics
Redirecting Debug and Error Message Output



1.Recovering from Corrupted Software

Step 1 Connect a PC with terminal-emulation software supporting the XMODEM Protocol to the switch console port.

Step 2 Set the line speed on the emulation software to 9600 baud.

Step 3 Unplug the switch power cord.

Step 4 Press the Mode button, and at the same time, reconnect the power cord to the switch.

You can release the Mode button a second or two after the LED above port 1X goes off. Several lines of information about the software appear along with instructions:

The system has been interrupted prior to initializing the flash file system. The following
commands will initialize the flash file system, and finish loading the operating system
software:


flash_init

load_helper

boot


Step 5 Initialize the Flash file system:

switch: flash_init

Step 6 If you had set the console port speed to anything other than 9600, it has been reset to that particular speed. Change the emulation software line speed to match that of the switch console port.

Step 7 Load any helper files:

switch: load_helper

Step 8 Start the file transfer by using the XMODEM protocol.

switch: copy xmodem: flash:image_filename.bin

Step 9 When the XMODEM request appears, use the appropriate command on the terminal-emulation software to start the transfer and to copy the software image into Flash memory.



xmodem으로 image upload시 엄청난 시간을 필요로 합니다


xmodem upload

.

해당 link로 가시면 c3550의 Troubleshooting을 모두 확인해 볼 수 있습니다.

+ Recent posts