IP Network Fundamental

======================
Data Traffic Components:
a) Sender
b) Receiver
c) Protocol
d) Medium
e) Message

Network Topologies:
a) Bus (most unreliable)
b) Star
c) Ring
d) Mesh/Grid (most reliable in redundancy)
e) Tree

Formula to calculate the number of sites in
a) Mesh (full mesh topology)
[n x (n-1)]/2, n - no of routers/sites

b) Star
n - 1

Local Area Network Charisteristics
===================================
a) Short distance (Campus wide scope)
b) High bandwidth/speed
c) Low delay/latency
d) More reliable/resilient

Equipment used in LAN:
i) Hubs/switches/bridges
ii) Routers
iii) ATM switch
iv) WiFi access point

Wide Area Network Charisteristics
=================================
a) Long distance (cross states, counties even countries)
b) Low bandwidth/speed relative to LAN
c) Higher latency relative to LAN
d) Less resilient

Equipment used on WAN
i) WAN Routers
ii) WAN switches - FR switches,etc
iii) Modems
iv) DCE/DTE terminals
v) Access server

Standardisation of Products, Services, protocols etc divided into two
sets
a) de factor - industry preference
b) de jure - industry regulation and rules

Orgisation Standardisation:
a) Institute of Electronic, Electrical Engineers (IEEE)
- provides standardisation for IT, Telecommunication and electrical
products
- IEEE 802 projects (Ethernet, WiFi, Vlan trunk, etc)
802.3, 802.11, 802.1q, 802.16.....

b) Internet Engineering Task Force (IETF)
- provides standardisation for routing protocols
- RIP, OSPF, BGP, TCP/IP Subneting/VLSM, VRRP
- provides technical documentation for a process/technologies over the
RFC and RFC Draft.

c) International Standardisation Organisation (ISO)
- provides standard datacom reference model : OSI 7 Layers
OSI 7 Layers of Data Communication Reference Model
Layer 1 : Physical
Layer 2 : Data Link
Layer 3 : Network
Layer 4 : Transport
Layer 5 : Session
Layer 6 : Presentation
Layer 7 : Application

IP Core/Backbone Network Characteristics:
----------------------------------------
a) High reliability
b) High speed/convergence
c) Scalable/Flexible for growth
d) QoS requirements for differentiated services required by customers
e) Manageable and Operational by EMS/NMS
f) Flat network architecture

OSI 7 Layer Reference Model : Benefits
--------------------------------------
i) Engineering support can be scoped and escalated by means of layers
ii) Facilitate the learning and teaching of data communication by
means layers
iii) Silicon providers/vendors can modulate the process of creating
and marketing the datacom products based on the modular functionality.
Eg, routers perform Layer 3 jobs, all vendor-based routers will have
the same functions based on the Layer 3 specs. (Vendor
interoperability support guaranteed)

OSI 7 Layers
------------
1) Physical or Layer 1
- dealing with interfaces, ports, cabling, medium in connectivity
- examples: cables (coaxial, copper/twisted pair, fiber), wired and
microwave frequency, V.35/RS232, hubs/repeaters, transceivers, etc
- data named as bit flows

2) Data Link or Layer 2
- dealing with data encapsulation/de-encapsulation, link management
- examples: data encapsulation/de-encapsulation with PPP/HDLC,
,Ethernet,ATM,FR, MAC, LLC (compression, authentication), etc
- hardware used in Layer 2: switches, bridges, WiFi Access
points/Controllers
- MAC address (aka physical address) is a 48-bit hexadecimal values;
eg. f04b.7b3a.9056 OR f0-4b-7b-3a-90-56 OR f0:4b:7b:3a:90:56
- first 24-bit of the MAC address represents unique vendor ID while
the balance 24-bit represents the unique object ID (adapter ID)
- data named as frames

3) Network or Layer 3
- dealing with IP addressing and IP path forwarding (routing)
- examples: IP routing with RIP,OSPF,IS-IS,BGP (routing protocols); IP
addressing with VLSM/FLSM, routed protocols as TCP/IP, IPX/SPX,
Appletalk;
- hardware used in Layer 3: routers, multilayer/L3 switches
- data named as packets
- A typical ip address contains two parts: Network ID and Host ID
- IP address is a 32-bit decimal values
- Network layer protocols include: ARP, Proxy ARP, Reverse ARP, DHCP

i) Address Resolution Protocol (ARP)
- used to resolve MAC address based on IP address map
- uses broadcast communication
- ARP works only in the same broadcast domain (network/vlan)
ii) Proxy ARP
- used to resolve MAC address based on IP address map but it needs the
gateway/router to forward the ARP request to different broadcast
domain
- ARP can work in different subnets as long as gateway is enabled for
proxy ARP
iii) Gratuitous ARP
- happens when conflict of IP addresses in the network detected by
both owners of the address
- generating network error messages to inform about the conflict
iv) Reverse ARP (RARP)
- used to resolve IP address based on mapped MAC address
- uses unicast communication
- used commonly in the network with BOOTP server (RARP server)
providing ip addresses for diskless workstations upon power-up

Dynamic Host Configuration Protocol (DHCP)
- used to provide dynamic ip address allocation to clients/hosts
- DHCP server uses a scope of address range to assign addresses

Routing
- routers work on Layer 3
- functions of a router:
i) provide ip forwarding path to the network
ii) isolate networks with subnets; reducing the broadcast size
iii) provide security isolation with access control list (a kind of
simple firewalling service)
iv) interconnect heterogenous networks (networks with different
platforms)

4) Transport or Layer 4
- dealing with data transportation and delivery
- two transport protocols : a) TCP, b) UDP
- data named as segment

a) Transport Control Protocol (TCP)
- characteristics:
i) Connection-oriented transport protocol
ii) Reliable transmission with acknowledgement
iii) support both fixed and sliding windowing (flow control)
iv) retransmission for error correction
v) High overhead
vi) Used for bulky data streams

b) User Datagram Protocol (UDP)
- characteristics:
i) Connectionless transport protocol
ii) Unreliable transmission without acknowledgement
iii) No retransmission nor error correction (best effort)
iv) Low overhead (smaller data streams) with faster transmission
(transmission efficiency)
v) Used for smaller data streams like voice and video traffic (based
on RTP)

Examples of TCP and UDP
-----------------------
Application Transport Protocol
----------- ------------------
HttP TCP 80
HTTPs TCP 443
SNMP UDP 161/162
Telnet TCP 23
SSH TCP 22
FTP TCP 20/21
TFTP UDP 69
DNS TCP/UDP 53
SMTP TCP 25
RIP UDP 520
...

5) Session or Layer 5
- dealing session establishment, maintenance and management
- examples: RPC, Remote RPC, SQL, etc
- data named as Session PDU (protocol data unit)

6) Presentation or Layer 6
- dealing with data formatting
- examples: encryption/de-encription with MD5, SHA-1, ASCII,
JPEG/MPEG, etc
- - data named as Presentation PDU (protocol data unit)

7) Application or Layer 7
- dealing with final end user applications
- examples: HTTP,HTTPs, FTP/TFTP,SNMP, DNS, Telnet, SSH, SNMP, SMTP
etc
- hardware used including firewall, proxy firewall, etc
- data named as Application PDU (protocol data unit)

ICMP (Internet Control Message Protocol)
- includes application like ping, tracert
a) Ping
- used to test and verify network connectivity (end-to-end)
example:
C:\>ping google.com

Pinging google.com [61.6.41.209] with 32 bytes of data:
Reply from 61.6.41.209: bytes=32 time=8ms TTL=54
Reply from 61.6.41.209: bytes=32 time=7ms TTL=54
Reply from 61.6.41.209: bytes=32 time=7ms TTL=54
Reply from 61.6.41.209: bytes=32 time=10ms TTL=54

b) tracert
- used to test and verify each junction of the network connection
point (hop to hop connectivity)
example:
C:\>tracert google.com

Tracing route to googl.com [173.194.117.48]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 160.0.59.254
2 1 ms 1 ms 1 ms 172.16.255.41
3 1 ms <1 ms <1 ms 172.16.254.14
4 1 ms <1 ms <1 ms 172.16.254.4
5 1 ms 1 ms 1 ms 160.0.234.51
6 1 ms 2 ms 1 ms 202.185.21.1
7 2 ms 2 ms 2 ms 161.142.32.153
8 6 ms 5 ms 3 ms ge0-3-1-0.iph95.jaring.my
[61.6.54.129]
9 9 ms 9 ms 8 ms pos0-3-0-0.bkj95.jaring.my
[61.6.13.129]
10 11 ms 9 ms 9 ms te0-0-0-0.bkj96.jaring.my [61.6.10.2]
11 12 ms 12 ms 9 ms te-0-2-0-0.drc95.jaring.my
[61.6.51.14]
12 9 ms 8 ms 8 ms 61.6.3.150
13 33 ms 96 ms 49 ms 209.85.242.246
14 17 ms 22 ms 15 ms 209.85.242.242
15 15 ms 17 ms 15 ms 209.85.244.115
16 16 ms 16 ms 16 ms sin01s15-in-f16.1e100.net
[173.194.117.48]

Data Encapsulation and De-encapsulation
a) Traffic sent by sender
- data will be encapsulated by ADDING a layer of header information
b) Traffic received by receiver
- data traffic will be de-encapsulated by REMOVING/POPPING a layer of
header information

IP Addressing
=============
IP Address consists of two portions: Network ID and Host ID
Format: dotted decimal value (32-bits)
Classes of IP Address
1) Class A
2) Class B
3) Class C
4) Class D
5) Class E

Classes of Address depends on the value of the first octet of an IP
address
Format of IP Address: x1.X2.X3.X4
Class A => x1 = 1 - 126 (127 - reserved for loopback)
Class B => x1 = 128 - 191
Class C => x1 = 192 - 223
Class D => x1 = 224 - 239
Class E => x1 = 240 - 255

Examples:
10.1.0.0 255.255.0.0 is a Class A network address
10.1.1.0 255.255.255.0 is a Class A network address
172.16.10.0 255.255.255.0 is a Class B network address

Subnet Mask or Net Mask value defines the SIZE of the networks.

The size of the Class of Network depends on the subnet mask value.
Example:
By default, Class A has the largest size network compared to Class B
and C.

Private Addresses
- IP addresses used in the local internal networks (which cannot be
accessing Internet or outside networks without NAT).
Examples of Private IP Addresses:
Class A: 10.0.0.0 - 10.255.255.255
Class B: 172.16.0.0 - 172.31.255.255
Class C: 192.168.0.0 - 192.168.255.255
Reserved loopback address: 127.0.0.0 - 127.255.255.255

Public Addresses
- IP addresses used in Internet or public networks which are
accessible in Internet and recognised by all providers' networks.

Formulas for Subnetting:
a) n + h = 32; n - network bit, h - host bit
b) 2^h - 2 = total number of hosts (valid hosts - usable IP Addresses)
c) 2^h = size of the subnetwork
d) 2^n = the total number of subnetworks after being subnetted

Example of Subnet Calculation
1) Given 10.0.0.0/8 full Class A, requires 6 subnets with 62 hosts
each. Find all the 6 subnetworks.
Answer:

2^h - 2 = 62
2^h = 62 + 2
2^h = 64
Hence, h= 6

n + h = 32
n + 6 = 32
n = 26 (255.255.255.192)

Size of the network = 2^h
= 2^6
= 64

Jadi, 6 subnets will be as follows:
10.0.0.0/26
10.0.0.64/26
10.0.0.128/26
10.0.0.192/26
10.0.1.0/26
10.0.1.64/26

Exercises:
-----------
1) Find out the broadcast ID for the network 172.16.30.48/29.

2) Find out the network ID for the host 192.168.10.98/26.

3) Find out the subnet mask for the network 172.30.17.0 with 510 valid
hosts.

4) Find out the valid host address range for the network 10.0.10.0
with subnet mask 255.255.254.0

5) Based on the Class B address, how many subnets and hosts for each
they can be created given the subnet mask 255.255.255.224?


Questions:
1) Give me some examples of Application layer?
Answer: Http,Https, FTP,SNMP,NNTP,SMTP,TFTP,Telnet,SSH,DNS, etc

2) Give me some examples of Transport layer?
Answer: TCP and UDP

3) Give me some examples of Network layer?
Answer: ICMP (ping/tracert), IP addressing, RIP,OSPF,IS-IS,BGP, DHCP
[Software]
routers, multilayer switches [hardware]

4) Give me some examples of Data Link layer?
Answer: VLAN,STP,PPP,HDLC,Frame-relay,ATM,MAC addressing [software]
switches, bridges, access points [hardware]

5) Give me some examples of Physical layer?
Answer: cables (UTP/STP/coaxial/fiber optical), hubs, repeaters, V.35
serial port, etc

6) Give me some examples of Presentation layer?
Answer: JPEG,MPEG,GIF,ASCII,MIDI,MD5,SHA-1,AES,etc
Versatile Routing Platform (VRP)
================================
- Huawei network device operating system
- a building block for all kinds of services and subsystems used in a
network device like routers, switches, firewall, Access controller,
etc

Basic configuration for Huawei Network Device supported by the
following methods:
a) Console
b) Telnet/SSH
c) Auxiliary (Dial-in port)
Note: As for the writing of this course, WEB access is not supported.
Console access is the first and initial method to config a Huawei
equipment

Default console port parameter settings as follows:
Bits per second : 9600
Data bits : 8
Parity : None
Stop bits : 1
Flow Control : None

VRP devices can be configured as:
a) FTP server
b) FTP client
c) TFTP client
at a time but no exception for TFTP server
Note: VRP routers/switches cannot be a TFTP server

VRP software and configuration files can be transferred via any one of
the methods:
i) FTP (via ethernet link)
ii) TFTP (via ethernet link)
iii) XModem (via serial console(9600bps))

Basic VRP Commands
==================

Telnet Configuration:
---------------------
int me0/0
ip address 10.1.1.1 24
undo shutdown
- enable and assign address for an interface

user-interface vty 0 4
authentication-mode password
set authentication password simple @5kY0urMgr
user privilege level 15
- Telnet configuration

user-interface console 0
authentication-mode password
set authentication password simple @5kY0urMgr
user privilege level 15
screen-length 0
- console password enabled with no split screen display

save
- save the current configuration into flash

reset saved-configuration
- delete the saved configuration and require reboot to take effect

reboot
- manual reboot the system take changes effect (after delete the saved
configuration)

Two main operational modes on VRP device:
a) User view
b) System view

<Huawei> - user view
[huawei] - system view

<Huawei>system-view
[Huawei]quit
<Huawei>system-view
[huawei]ospf
[huawei-ospf-1]area 0
[huawei-ospf-1-area-0.0.0.0]return
<huawei>

display current-configuration
- view the current config (not saved)
display saved-configuration
- view the saved config
display version
- view the VRP platform and its version
display ip int brief
- view the interfaces' address and status
display ip routing-table
- view the ip routing table contents
display clock
- view the system date, time and timezone of the device
display this
- view the current configuration settings on the configured items
compare configuration
- view the changes between the saved and current configuration
settings

sysname xxxxxxx
- set a hostname for the device
clock timezone
- set time zone for the device
clock datetime hh:mm:ss yyyy-mm-dd
- set date and time for the system

Routing
=======
- a network layer process to determine and decide the best forwarding
path for a destination network
- routing table or known as ip forwarding table is used to look up for
the best route to the destination networks
- routing table is generated and updated via static configuration
and/or through dynamic routing configuration (routing protocols)
- contents of a routing table consist of:
a) destination address/network mask
b) Outgoing interface
c) Nexthop
d) cost of a route
e) preference of a routing source (static/dynamic/direct connect)

Static Routing
===============
- What is static routing?
- a route is manually added and updated by administrator on the
router's routing table
- a change in the network topology does not reflect in the routing
table automatically
- static routing is suitable for small and steady network topology
- static routing can support equal cost load balancing routes and
primary/backup routes strategy
- preference is used to create primary/backup route strategy

Commands for static routing
---------------------------
ip route-static 10.1.1.0 24 192.168.1.1
OR
ip route-static 10.1.1.0 255.255.255.0 192.168.1.1
OR
ip route-static 10.1.1.0 24 gi0/0/0
- create a single static route to the destination

ip route-static 0.0.0.0 0 192.168.1.1
OR
ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
OR
ip route-static 0.0.0.0 0 gi0/0/1
- create a default route to all unknown networks

display ip routing-table
- view all routes in the routing table
display ip routing-table protocol static
- view only static routes in the routing table
- both active (primary) and inactive (backup) routes can be viewed
with the command

Equal Cost Multipath (ECMP)
---------------------------
- multiple routes available to the same destination network with each
of them having the SAME route cost/metric
- ip routing table shows all the active multiple paths/routes

Active/Standby Routes (Backup Routing)
--------------------------------------
- multiple routes available to the same destination network with each
of them having DIFFERENT route cost/metric
- only active route (best route) is used for forwarding while standby
(backup) route is used to replace the failed active route
- ip routing table does not show backup routes

Preference
----------
- preference is a metric used by routers to determine the best choice
of routing (similar to Cisco Administrative Distance (AD))
- the lower the preference value, the higher the priority for the
selection of routing choice

Preference for Routing Algorithm:
---------------------------------
Routing Algorithm Preference (default)
------------------ --------------------
Static 60
Direct (local connected) 0
RIP 100
OSPF 10
IS-IS 15
OSPF ASE 150
BGP 255
Note:
OSPF ASE is the External OSPF routes (like OSPF OE1/OE2 routes)
All default preference value can be changed using the command
PREFERENCE

Example:
--------
i) Create a primary/active and backup static and default route:

ip route-static 10.1.1.0 24 192.168.0.2 preference 70
ip route-static 10.1.1.0 24 192.168.1.2
and
ip route-static 0.0.0.0 0 192.168.0.2 preference 70
ip route-static 0.0.0.0 0 192.168.1.2
Note: The first route is the backup due to its higher value.


ii) Create a equal cost multipath (load balance) route:

ip route-static 10.1.1.0 24 192.168.0.2
ip route-static 10.1.1.0 24 192.168.1.2
AND
ip route-static 0.0.0.0 0 192.168.0.2
ip route-static 0.0.0.0 0 192.168.1.2
Note: Both routes are in the routing table as they have the same
preference value (60) shown as active routes.

Important:
Before a router drops an unmatchable specific network destination in
the routing table, it sends the traffic to the default route path if
the default route is available.
If the default route is not found or specified in the routing table,
then the packet will be dropped when it does not match any specific
routes.

Default routes can be configured statically or obtained via dynamic
routing (route import).
Routing
=======
- a Layer 3 process where ip packets will be guided and forwarded by a
router based on the route path in the routing table
- routes in the routing table can be obtained via:
a) Data Link discovery (applicable for locally connected networks)
b) Manual routing by administrator (static routing)
c) Automatic routing updates by routing protocols (Dynamic Routing)

Functions of a router or Layer 3 switch:
i) Discover all potential routes
ii) Maintain and validate route sources
iii)Forwarding ip packets to destionation based on best route
iv) Select the best route based on the factors as closest match,
preference, cost of a route,etc

What are inside a routing table?
a) Destination/mask (a route entry)
b) Next Hop
c) Preference
d) Cost (metric of a route)
e) Outbound interface
f) Protocol (dynamic protocols, static, direct interface)

Comparisons between Static and Dynamic Routing
----------------------------------------------
i) Static routing: administrator manually injects routes into the
router; no automatic update on topology change
Dynamic routing: routing protocols can learn the changes in the
network topology; no administrative work involved for updating

ii) Use of static routing: suitable for small and steady network
topology
Use of dynamic routing: suitable for medium and large networks with
frequency topology change

iii) Static route uses less system resources (low overhead); dynamic
routing uses relatively more system resources (higher overhead)

Network Communication Protocols can be classified into:
i) Routed protocols
- protocols used by computing hosts as TCP/IP, IPX/SPX, AppleTalk
ii) Routing protocols
- protocols used by routers as OSPF, BGP, RIP, IS-IS, EIGRP

Dynamic routing works based on the peer routers must communicate with
the same routing protocols

Routing protocols can be further classified into:
i) Routing domain (Working area)
- a) Interior Gateway Protocol(IGP) and b) Exterior Gateway
Protocol(EGP)
Examples:
- IGP -> RIP, OSPF, IS-IS, EIGRP
- EGP -> BGP

ii) Routing algorithm
- a) Distance Vector, b) Link State, c) Path Vector
Examples:
- Distance Vector -> RIPv1, RIPv2
- Link State -> OSPF, IS-IS
- Path Vector -> BGP

iii) Application service
- a) Unicast routing b) Multicast routing
Examples:
- Unicast routing -> RIP, OSPF, BGP, IS-IS, EIGRP
- Multicast routing -> DVMRP, PIM-SM, PIM-DM

Autonomous System (AS)
- a routing domain boundary whereby the sets of routers working in the
same administrative control of an organisation

Routing within Autonomous System (AS) -> IGP protocols

Routing between/among different Autonomous Systems (AS) -> BGP

i) Cost or metric of a route is the total cost to reach a destination
network; the lower is the preferred path (best path)
Note:
Metric is a general measurement of route cost. Different routing
protocols use different algorithm to calculate the metric/cost value.
eg. RIP uses hop counts as a metric while OSPF/IS-IS uses interface
bandwidth/delay as calculation for cost.

ii) Preference of a routing protocol or static route is the priority
criteria used by the router to determine the use of routing algorithm
to route

Ultimate routing to the destination network based on the order of
precedence:
1st. closest match for the destination path
2nd. preference of a routing algorithm
3rd. cost/metric of a route


Routing Information Protocol (RIP)
==================================
Characteristics of RIP Routing:
- Distance Vector protocol
- IETF open standard dynamic routing supported by all vendors
- RIP uses UDP 520
- two versions of RIP: RIPv1 and RIPv2
- uses hop count as a metric for route cost
- maximum hop count for RIP is 15
- uses split horizon to prevent routing loops
- support both automatic and manual route aggregation
- by default, route aggregation is enabled
- routing update interval is 30 sec, age/expiry interval is 180 sec
and after 300 sec, the expiry routes will be removed from the router

RIPv1:
- classful routing protocol, no support for VLSM/CIDR addressing
- uses broadcast communication with peers
- only support automatic route aggregation
- no support for peer authentication

RIPv2:
- classless routing protocol, support for VLSM/CIDR addressing
- uses multicast communication with peers (reserved multicast address
for RIP is 224.0.0.9)
- support both automatic and manual route aggregation (default is
automatic route aggregation)
- support peer authentication with either cleartext or MD5-encrypted
password

RTA <-> RTB
-----------
RTA:
----
rip
version 2
- use version 2
undo summary
- disable automatic route aggregation
network 10.0.0.0
network 192.168.1.0
- advertise the local networks
preference 50
- set preference for RIP to 50 overwriting the priority of static
route (example)

int gi0/0/0
rip summary-address 10.1.0.0 255.255.248.0
- create a manual route aggregation for a peer
rip authentication-mode md5 nonstandard cipher huawei 1
- enable MD5-protected password with keyID 1 for peer authentication

RTB:
----
rip
version 2
- use version 2
undo summary
- disable automatic route aggregation
network 20.0.0.0
network 192.168.1.0
- advertise the local networks
preference 50
- set preference for RIP to 50 overwriting the priority of static
route (example)
max load-balancing 1
- disable equal-cost load balancing
import-route static cost 5
import-route ospf 1 cost 3

int gi0/0/1
rip authentication-mode md5 nonstandard cipher huawei 1


Note: RIP process/instance ID. is not mandate to be the same for all
neighbors.

Verify:
-------
display rip
- view all RIP routing instances

display rip 1
- view RIP process 1
Example:
[AR3]display rip 1
Public VPN-instance
RIP process : 1
RIP version : 2
Preference : 100
Checkzero : Enabled
Default-cost : 0
Summary : Enabled
Host-route : Enabled
Maximum number of balanced paths : 8
Update time : 30 sec Age time : 180 sec
Garbage-collect time : 120 sec
Graceful restart : Disabled
BFD : Disabled
Silent-interfaces : None
Default-route : Disabled
Verify-source : Enabled
Networks :
192.168.2.0 192.168.22.0
10.0.0.0
Number of routes in database : 12
Number of interfaces enabled : 3
Triggered updates sent : 4
Number of route changes : 10
Number of replies to queries : 0
Number of routes in ADV DB : 11

display rip 1 neighbor
- view RIP peer routers
Example:
[AR3]display rip 1 neighbor
---------------------------------------------------------------------
IP Address Interface Type Last-Heard-Time
---------------------------------------------------------------------
192.168.2.1 Serial1/0/1 RIP 0:0:16
Number of RIP routes : 4
192.168.22.1 Serial1/0/0 RIP 0:0:16
Number of RIP routes : 4

display ip routing-table protocol rip
- view RIP routes in the routing table inclusive of active and backup
RIP routes
Example:
[AR3]display ip routing-table protocol rip
Route Flags: R - relay, D - download to fib
----------------------------------------------------------------------
--------
Public routing table : RIP
Destinations : 4 Routes : 8

RIP routing table status : <Active>
Destinations : 4 Routes : 8

Destination/Mask Proto Pre Cost Flags NextHop
Interface

10.1.1.0/24 RIP 100 2 D 192.168.22.1
Serial1/0/0
RIP 100 2 D 192.168.2.1
Serial1/0/1
10.2.2.0/24 RIP 100 1 D 192.168.22.1
Serial1/0/0
RIP 100 1 D 192.168.2.1
Serial1/0/1
192.168.1.0/30 RIP 100 1 D 192.168.22.1
Serial1/0/0
RIP 100 1 D 192.168.2.1
Serial1/0/1
192.168.11.0/30 RIP 100 1 D 192.168.22.1
Serial1/0/0
RIP 100 1 D 192.168.2.1
Serial1/0/1

RIP routing table status : <Inactive>
Destinations : 0 Routes : 0


display rip 1 route
- view RIP route information by peer
Example:
<AR1>display rip 1 route
Route Flags : R - RIP
A - Aging, G - Garbage-collect
---------------------------------------------------------------------
-------
Peer 192.168.1.2 on Serial1/0/0
Destination/Mask Nexthop Cost Tag Flags Sec
10.2.2.0/24 192.168.1.2 1 0 RA 22
192.168.2.0/30 192.168.1.2 1 0 RA 22
192.168.22.0/30 192.168.1.2 1 0 RA 22
10.3.3.0/24 192.168.1.2 2 0 RA 22
Peer 192.168.11.2 on Serial1/0/1
Destination/Mask Nexthop Cost Tag Flags Sec
192.168.2.0/30 192.168.11.2 1 0 RA 14
10.2.2.0/24 192.168.11.2 1 0 RA 14
192.168.22.0/30 192.168.11.2 1 0 RA 14
10.3.3.0/24 192.168.11.2 2 0 RA 14


undo rip 1
- remove RIP process

Example:

<R1>display rip 1 neighbor
----------------------------------------------------------
IP Address Interface Type Last-Heard-Time
----------------------------------------------------------
10.0.14.4 Serial2/0/0 RIP 0:0:8
Number of RIP routes : 1
10.0.123.2 GigabitEthernet0/0/0 RIP 0:0:3
Number of RIP routes : 1
10.0.123.3 GigabitEthernet0/0/0 RIP 0:0:26
Number of RIP routes : 1

Conclusion: You can discover 3 neighbors running RIPv2.

Troubleshooting RIP routing : Procedures
----------------------------------------
a) Check and ensure the RIP version deployed
b) Check the RIP communication set on the peering interface using the
same type of communication (broadcast vs multicast)
c) Check and ensure the "Network" statement to propagate locally
connected networks are done correctly
d) If manual route summary is implemented, ensure the automatic route
summary disabled (command -> undo summary)
e) Check the peer authentication protocol used and password syntax
Dynamic Routing
===============
Dynamic routing can be categorised into:
1) Routing domain
- IGP vs EGP
- IGP - routing within the same autonomous system (AS)
- EGP - routing between different autonomous systems (AS)
Examples of IGP: RIP, OSPF, IS-IS, EIGRP (not supported by Huawei)
Examples of EGP: BGP

2) Protocol Algorithm
- Distance Vector vs Path Vector vs Link State
- Distance Vector: RIPv1/RIPv2
- Link State: OSPF, IS-IS
- Path Vector: BGP

3) Application service
- Unicast routing vs Multicast routing
- Unicast routing protocols: RIP,OSPF,IS-IS,BGP
- Multicast routing protocols: DVMRP,PIM-DM,PIM-SM

Routing Protocols Performance Index:
------------------------------------
a) Accuracy of route learning
- Link state in general performs better than Distance Vector routing
due to its algorithm
- Link State uses Shortest Path First (SPF) algorithm to apply
bandwidth, delay to calculate the cost of a route
- Distance Vector uses Bellman Ford algorithm to estimate the distance
and direction of a route through neighbors

b) Convergence
definition:
Convergence is a process of synchronizing all routing tables for all
the routers in the network. It is the process for a router to reach
the stable and consistent state after the network topology changes.

- different routing protocols have different convergence performance
when a change in topology occurs
- Link State can do the job better (faster) than Distance Vector

c) Routing Overhead
- Distance Vector has lower overhead compared to Link State in
utilising router system resources (CPU, Memory and network bandwidth)
- however, on steady network topologies, Link State is more efficient
as routing updates are not done regularly, instead it performs update
when there are changes made

d) Security of the protocols
- Link State protocols are generally more secure than Distance Vector
due to the authentication and encryption options

e) Scalability and Interoperability
- Link State is more scalable for all kinds of sizes of networks
deployed (not subject to max 15 hop counts)
- Distance Vector is not scalable but suitable for small networks with
less than 16 routers in the hierarchy design
- Link State and Distance Vector protocols are also compatible with
all vendor deployment unlike Hybrid routing as EIGRP
- Link state can support partitioning of the routing domain into areas
to reduce the load of a router when networks grow in sizes (Distance
Vector got no support for area partitioning)

How Distance Vector routing works?
- Routers discover peers using broadcast or multicast depend on
version of RIP
- RIPv1 uses broadcast while RIPv2 uses multicast to communicate with
peers with multicast address 224.0.0.9
- Routing updates sent every 30 seconds (regular periodical updates)
- RIP also expires obsolete routes in 180 seconds (aging period) and
flushes/deletes the expired routes after 300 seconds.

Comparisons between Distance Vector and Link State routing:
-----------------------------------------------------------
a) Protocol algorithm
RIP uses Bellman-Ford; OSPF/IS-IS uses SPF (Shortest Path First)

b) Metric of route
RIP uses hop count; OSPF/IS-IS uses cost

c) Peer communication
RIPv1 uses broadcast, RIPv2 and OSPF uses multicast
Multicast addresses used by RIPv2 and OSPF:
RIPv2 -> 224.0.0.9
OSPF -> 224.0.0.5 and 224.0.0.6

d) Peer authentication
RIP1 does not support authentication
RIPv2 support plaintext and cipher-based (encrypted) password
OSPF support plaintext and cipher-based (encrypted)password

e) Route aggregation (route summarisation)
RIPv1 supports on automatic route aggregation only (Classful)
RIPv2 supports both automatic and manual route aggregation
(default is automatic aggregation)
OSPF support manual route aggregation only

f) Scalability
RIPv1 and RIPv2 do not support area partitioning
OSPF and IS-IS support area partitioning

g) Routing Convergence
RIP is slow in convergence; OSPF and IS-IS is fast in convergence

h) Routing Update
RIP uses 30-sec interval routing table updates (periodical)
OSPF uses triggered update on network interface status (triggered by
changes)

RIP Routing mechanism for Routing Loop Prevention:
a) Split Horizon
b) Route Poisoning
c) Reverse route poisoning
d) Hold down timer
e) Triggered Update
f) Count to infinity

Open Shortest Path First (OSPF)
===============================
- Protocol ID 89
- classless routing protocol (support CIDR/VLSM)
- Link state routing with CIDR and VLSM support
- fast convergent routing (no periodic updates required)
- Hello protocol (hello packet) is used to discover connected
neighbors in the SAME area
- OSPF uses 3 sets of databases for route calculation
a) Neighborship/Adjacency table
- contain a list of connected neighbors in the same area
b) Link State Database (LSDB)
- contain a list of all potential routes to destination networks in
the same area
- LSDB is shared among all the OSPF peers in the same AREA
(meaning each peer in the same OSPF area has the same content in
their LSDB)
- best routes are sourced from the LSDB after SPF calculation
- LSDB is maintained and updated from the updated adjacency table
c) Routing table
- contain a list of best routes to the destionation networks
- routes in this table are sourced from the valid and updated LSDB

- OSPF uses multicast communication for neighbor updates for effective
communication; hence reducing broadcast impact on the network.

In any neighborship table, for multiaccess broadcast network
(ethernet, metro-E, Token Ring) in OSPF deployment, two routers are
selected to be DR (designated router) and BDR (backup designated
router); all other routers served as DROthers
- selection of DR and BDR depends on the OSPF peer priority value;
highest the priority value, then the router will be selected as DR and
BDR.
Note:
By default, routers with interface connected to the broadcast network
to establish neighborship that has the HIGHEST and second highest
address will be selected as DR and BDR respectively.
You can overwrite this setting by changing the router priority value.
Default priority value is 1.
command:
--------
[AR1-GigabitEthernet0/0/0]ospf dr-priority <1-255>
Priority 0 means never become a DR/BDR

In OSPF routing, router id serves as a unique router entity.
In a single area, a router id must be unique among all the members but
OSPF process ID may or may not be unique in the same area.

Router ID
- a unique ID for OSPF router
- serve as a unique source for a particular route in the same area of
routing
- How an OSPF router chooses and uses a router?
Preference as this sequence:
1st router id command
2nd highest IP address set on any of the loopback interfaces
3rd highest IP address set on any of the physical active interfaces

Single Area OSPF Configuration:
-------------------------------
router id x.x.x.x , where x is a number in range of 1 - 255
ospf
area 0
network 10.0.1.0 0.0.0.255
network 10.0.123.0 0.0.0.255

eg.
router id 1.1.1.1
ospf 1
area 0
network 10.0.1.0 0.0.0.255
network 10.0.123.0 0.0.0.255
network 192.168.1.0 0.0.0.255

display ospf peer
- view OSPF neighbors
<R2>display ospf peer

OSPF Process 1 with Router ID 1.1.1.2
Neighbors

Area 0.0.0.0 interface 10.0.123.2(GigabitEthernet0/0/0)'s neighbors
Router ID: 1.1.1.1 Address: 10.0.123.1
State: Full Mode:Nbr is Slave Priority: 200
DR: 10.0.123.1 BDR: 10.0.123.3 MTU: 0
Dead timer due in 36 sec
Retrans timer interval: 0
Neighbor is up for 00:03:50
Authentication Sequence: [ 0 ]

Router ID: 1.1.1.3 Address: 10.0.123.3
State: Full Mode:Nbr is Master Priority: 250
DR: 10.0.123.1 BDR: 10.0.123.3 MTU: 0
Dead timer due in 30 sec
Retrans timer interval: 5
Neighbor is up for 00:03:53
Authentication Sequence: [ 0 ]

<R2>display ospf lsdb

OSPF Process 1 with Router ID 1.1.1.2
Link State Database

Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence
Metric
Router 1.1.1.3 1.1.1.3 368 48 80000017
1
Router 1.1.1.2 1.1.1.2 331 48 8000001B
1
Router 1.1.1.1 1.1.1.1 365 48 80000021
1
Network 10.0.123.1 1.1.1.1 365 36 8000000E
0



display ospf routing
- view all OSPF routes
<R2>display ospf routing

OSPF Process 1 with Router ID 1.1.1.2
Routing Tables

Routing for Network
Destination Cost Type NextHop AdvRouter
Area
10.0.2.0/24 0 Stub 10.0.2.2 1.1.1.2
0.0.0.0
10.0.123.0/24 1 Transit 10.0.123.2 1.1.1.2
0.0.0.0
10.0.1.1/32 1 Stub 10.0.123.1 1.1.1.1
0.0.0.0
10.0.3.3/32 1 Stub 10.0.123.3 1.1.1.3
0.0.0.0

Total Nets: 4
Intra Area: 4 Inter Area: 0 ASE: 0 NSSA: 0

Verify
======
reset ospf process
- reboot OSPF routing process when you changed router id or priority
value to take effect. It will not reboot the whole router system.
Ethernet Technologies
=====================
- Ethernet technology standard defined by IEEE (802.3)
- cabling standard: coaxial, copper and fiber optic
- Ethernet is a Data Link technology commonly used in campus LAN
- Ethernet transmission medium and maximum distance support
Cabling Standard Maximum distance
---------------- ----------------
Coaxial
10Base2 (thin Net) 200m
10Base5 (thick Net) 500m
- based on BUS network topology

Copper ethernet (xBaseT) 100m
- twisted pair cables
(STP/UTP)
- based on STAR network topology

Fiber optical
Single mode (long range) more than 2km
Multimode (short range) up to 2km

Types and Usage of Twisted pair cable:
a) Straight Through (Normal line)
- used to connect different types of devices
eg.
Router - Switch, PC - Switch, Router - Hub, AP - switch, PC - Hub
b) Crossover (Cross line)
- used to connect same type of devices
eg.
PC - PC, PC - Router, switch - switch, hub - switch, hub - bridge

PC/router ethernet interfaces are based on MDI (media dependent
interface)
Hubs are based on MDI_X (media dependent interface crossover)
Switches are based on both MDI and MDI_X
Interfaces from MDI to MDI use crossover
Interfaces from MDI_X to MDI_X use crossover
Interfaces from MDI to MDI_X use straigh-thru

Standard Ethernet
------------------
- still commonly used in Access layer network connecting hosts
(PC/server/laptop/AP/VOIP phone)
- the speed of the standard is 10Mbps, half and full duplex support
- standard: 802.3

Fast Ethernet
--------------
- commonly used in Access and Distribution layer connecting hosts and
network devices
- the speed of the fast ethernet is 100Mbps, hald and full duplex
support
- standard: 802.3u

Gigabit Ethernet
----------------
- commonly used in network to network extension (trunking in switched
networks)
- the speed of the gigabit ethernet is 1000Mbps or 1GBps, full duplex
support
- standard: 802.3z and 802.3ab

10GB Ethernet
-------------
- commonly used in the fast speed backbone networks
- the speed of the 10GB ethernet is 10000Mbps or 10GBps, full duplex
- standard: 802.3ae, 802.3ak, 802.3an

Note: All Ethernet technologies based on copper twisted pair cables
are limited to 100m in maximum transmission distance.

Shared Ethernet Network
-----------------------
- refers to hub-based network without partitioning into multiple
logical networks called VLAN
- half-duplex communication (only a sender/receiver at a time, no
simultaneous transmission)
- subject to data collision
- prevention of data collision by means of CSMA/CD
(Carrier Sense Multi Access/Collision Detection)
- hubs and repeaters work in Physical layer (Layer 1) of OSI 7 Layers
- How Hubs work?
When a traffic received on a port in the hub, it forwards the
traffic to all other ports (except the incoming port) without the
intelligence of learning and filtering

Drawbacks in Layer 1 Hub networks:
i) Potential heavy collision
ii) Heavy broadcast traffic in a single large network (No VLans)
iii) No guarantee about performance, security, privacy for users

- How Switch works?
When a switch is powered on with the hosts connected, the switch
starts learning the SOURCE Mac address of the hosts.
After a short moment, the switch has fully populated all the MAC
addresses from all the connected hosts.
- MAC address table is served as a forwarding database reference when
a frame destinated to the switch ports
- A switch can learn, filter and forward traffic based on MAC table
(unicast communication)

Note: Switch forwarding based on Destination MAC address; switch
learning based on Source MAC address.

When a destination MAC address found, the switch will forward the data
to its associated connected port (unicast).
If the destination MAC address not found in the current MAC table, the
switch will forward to all the ports (flooding) except the incoming
port (similar to HUB, broadcast communication)

Two types of frames supported by switches:
a) tagged frames
- frames carry vlan ID/label
- frames come from switches
b) untagged frames
- frames carry no vlan ID/label
- frames come from hosts (pc and routers)

Three types of Switching Mode:
a) Cut-through
- forward data after receiving destination mac address without error
checking; fastest processing but no reliability

b) Fragment Free
- receive first 64-bit of data containing addresses, found working
fine the forward out

c) Store-and-Forward
- receive the entire frame with error checking, error-free frame will
be forwarded out; slowest processing but most reliable method

Drawbacks/limitations of the Layer 2 Switches:
a) Isolated networks (Vlans) cannot communicate with each other
b) No security guarantee since switches do not have security filtering
like Access Control list found in routers

Benefits of Layer 3 Switches/switching:
a) Provide inter-networks (interVlan) communication after isolating
b) security control via access control list to filter unwanted traffic
from one network to another
c) Layer 2 switching and routing can be performed on the same physical
hardware hence reducing the latency of packet/frame
processing/forwarding.

Media Control Access (MAC) Address
----------------------------------
- Data Link (Layer 2) layer addresses; 48-bit hexadecimal values
- MAC address is automatically assigned during the manufacturing
process; not changeable and globally unique
- valid format of MAC addresses:
i) xx:xx:xx:xx:xx:xx (eg. 54:b4:98:fc:03:62)
ii) xxxx.xxxx.xxxx (eg. 54b4.98fc.0362)
iii) xx-xx-xx-xx-xx-xx (eg. 54-b4-98-fc-03-62)
where x can be 0-9 and a-f
- MAC database is a table of mapping of MAC addresses with associated
ports

Each Ethernet port and interface have their own MAC addresses.
a) Switch
- System MAC address or Base MAC address
- Port Mac address
b) Host
- Ethernet adapter MAC address

Virtual Local Area Network (VLAN)
---------------------------------
- objectives: to reduce broadcast domain size by creating multiple
smaller size networks (vlans) and isolate networks
- by default vlan 1 is created and enabled on all switches
- Vlan 1 cannot be deleted, modified or disabled
- by default, all switch ports belong to Vlan 1 membership
- every switch ports can be assigned to other vlans
- all hosts (untagged frame) connected to the switch port with a PVID,
all the hosts belong to that vlan as members (inheritance by PVID)
- a tagged host (tagged frame) connected to the switch port with a
PVID, the host will resume its own original vlan ID (no inherittance)
- for a vlan to pass the link, the switch must have the vlan and its
ports must be allowed to pass that vlan traffic
- vlan interfaces can only be created after the specific vlan been
created (vlan must exist first before vlan interface can be created)

Create Vlan and Assigning Ports to Vlans:
-----------------------------------------
1) Create the vlan
- cannot remove VLan 1 as it is a default system vlan
- any vlan ID can be created except Vlan 1
- vlan can be created as a single unit or in a batch
eg.
vlan 2
- create a vlan ID 2
vlan batch 2 to 10
- create a series of vlans starting with Vlan 2 to 10
vlan batch 2 4 6 10 to 20
- create vlan 2,4,6, 10 to 20
vlan batch 10 20 30 40 50
- create 5 vlans not in sequence

Use "UNDO vlan batch" to remove a series of vlans in sequence and not
in sequence.

2) Set the port to be an access port
- default port type is Hybrid
command to verify:
display port vlan [port-name]
command to configure:
port link-type access
eg. display port vlan gi0/0/1
port link-type access

3) Assign the port to the vlan
- default for all ports is set to Vlan 1 membership
command:
vlan 2
port gi0/0/1
verify:
display vlan 2

Example:
display port vlan gi0/0/1
Port Link Type PVID Trunk Vlan List
---- --------- ---- ----------------
Gi0/0/1 Trunk 1 1-5

Note: When a custom vlan deleted, all ports belong to that vlan will
be automatically assigned back to vlan 1.

Each VLan is represented by each ip subnet
eg.
Vlan 10 maps to subnet 10.1.1.0/24
Vlan 20 maps to subnet 10.2.2.0/24
Note:
Vlan is a logical network separation by Data Link layer
IP Subnet is a logical network separation by Network layer

Port Settings:
--------------
Ethernet ports can be configured for the following functions:
a) Duplex
- can set to auto, full or half (default auto)
command: duplex full | half; undo duplex
b) Speed
- can set to 10Mbps, 100Mbps, 1000Mbps and be auto
command: speed 10 | 100 | 1000, speed auto; undo speed
c) Flow Control
- used to delay or prevent network congestion but it cannot replace
QoS function in combating network congestion
command: flow-control; undo flow-control

Switch Port Types
------------------
Huawei switches support 3 types of ports:
a) Access
b) Trunk
c) Hybrid

a) Access
- a single vlan membership port
- used to connect to host belongs to a single vlan

b) Trunk
- multi-vlan membership port
- used to connect to switches as a uplink for multiple or all vlans to
pass through

C) Hybrid
- a flexible trunk port (more than 1 vlans involved)
- commonly used in carrier providers' networks to isolate subscribers'
networks into a single managed vlan
- Hybrid port support one or more vlans with some vlans require no tag
(untagged frames)

Configuration Examples:
-----------------------
vlan batch 2 3 4 100 to 110
- create vlan 2,3,4,100 to 110
int gi0/0/1
port link-type trunk
- set port to trunk
port trunk allow-pass vlan all
- trunk port allows all vlans to pass
*1 port trunk allow-pass vlan 2 3 4 100 to 105
- trunk port vlan filtering
port trunk pvid vlan 3
OR
port default pvid vlan 3
- set PVID vlan 3 for trunk port
- vlan 3 tagged frames pass thru this trunk port as untagged

int gi0/0/10
port link-type access
- set port to access
*2 port default vlan 100
- set the port to Vlan 100 membership
port access pvid vlan 100
- set the port PVID vlan 100

Note*:
If this command not available, use this:
*1 port trunk permit vlan 2 3 4 100 to 105

*2 vlan 100
port gi0/0/10

Port Aggregation
----------------
- Port aggregation is also known as Link Aggregation Group (LAG)
- LAG serves to provide Layer 2 link redundancy while providing load
balancing across multiple physical ports/links over a single logical
port
- In a logical port group, STP instance treats LAG as a single link
(logical link) hence no redundant ports/links exist.
- Therefore, in LAG, all physical links are active at the same time in
the presence of STP
- minimum 2 physical ports required to build a LAG group
- up to maximum 8 physical ports to establish load-balanced logical
port group

Benefits of LAG:
i) Improve link bandwidth (throughput)
ii) Improve link reliability (redundancy)
iii) Provide load balancing across multiple links

Requirements for LAG:
a) hardward requirements
- two interconnected switches must have ports with same number of
ports, speed and duplex of the ports
b) software requirements
- the configurations on the ports from both peers must be set to the
same: vlan membership, QoS, STP, etc

Note:
Huawei switches recognise the pyhsical port type, meaning that
Ethernet and Gigabit Ethernet ports cannot be combined to form a LAG.

Example: configuration
----------------------
Sw1
---
int eth-trunk 1
port link-type trunk
port trunk allow-pass vlan all

int gi0/0/1
eth-trunk 1

int gi0/0/2
eth-trunk 1

Sw2
---
int eth-trunk 1
port link-type trunk
port trunk allow-pass vlan all

int gi0/0/21
eth-trunk 1

int gi0/0/22
eth-trunk 1

Verify:
display int eth-trunk x (x is the LAG ID (0-63))
- view the status of the Ether-trunk (LAG)

GARP Vlan Registration Protocol (GVRP)
--------------------------------------
- GVRP is used to dynamically update vlan database across all GVRP-
enabled switches in the network
- trunk ports are needed for GVRP to work on switches
Configuration:
--------------
[Sw1]gvrp
[Sw1-gi0/0/1]gvrp
[Sw1]vlan batch 10 to 20

Result: All switches will get the 11 vlans (vlan 10-20) from Sw1.
Note: Only Vlans are schronized across switches. Membership on ports
and vlan interfaces are not affected.
Vlan Routing
============
- vlans are used to separate a large broadcast domain into multiple
broadcast domains
- however, the broadcast domains cannot communicate with each other
without routing
- hence, vlan routing is required

Two types of vlan routing solutions:
a) Router on a stick solution
- a dedicated Layer 3 router and layer 2 switch are used to connect
each other over a trunk link
- the router uses a single port to connect to a switch trunk port
- it is not scalable because the router's port can be at bottleneck

b) Layer 3 switching
- only a Layer 3 switch required with vlan interfaces serve as routed
ports
- scalable due to no bottleneck on a port performance

Configuration command:
---------------------
a) Router
------
int gi0/0/0
ip address 10.1.1.1 24
undo shutdown

int gi0/0/0.11
dot1q termination vid 11
ip address 10.1.11.1 24

int gi0/0/0.12
dot1q termination vid 12
ip address 10.1.12.1 24

Switch
-------
vlan 11
vlan 12

int gi0/0/1
port link-type trunk
port trunk allow-pass vlan all

b) L3 Switch
---------
vlan 11
vlan 12

int vlan 11
ip address 10.1.11.1 24

int vlan 12
ip address 10.1.12.1 24

Reminder: No router is required for this solution for the Vlan
routing.

Virtual Router Redundancy Protocol (VRRP)
=========================================
- VRRP provides gateway redudancy for routing clients; preventing
single point of failure for gateway solution
- VRRP can be configured to provide load balance for gateway load
sharing when network size grows
- clients need to point to the ip address of the virtual router to use
the redundant service
- master router of the VRRP group serves the client traffic
- backup/slave router listens and monitors the heartbeat of the master
router in VRRP

VRRP characteristics:
----------------------
- VRRP group is created for the router members
- one master is selected the rest are backup or slaves
- VRRP ip address can be set to unique address from the physical
routers or used any one of the physical routers' address

Example:
VRRP 1
Router A Router B
ip address: 10.1.1.1/24 10.1.1.2/24

VRRP Address
Option (i) 10.1.1.3/24
Option (ii) 10.1.1.1 or 10.1.1.2

Implications when VRRP address set to
Option (i), master router is selected based on the HIGHEST VRRP
priority of the group
- configurable VRRP priority is in the range of 1 - 254
- VRRP priority 0 and 255 are reserved

Option (ii), master router is selected based on the owner of VRRP
group. VRRP owner is the router in which his ip address is the same as
the VRRP ip address and it reserves its priority to 255.
Note: Owner of the VRRP group assumes VRRP priority 255 (fixed)

Assumption:
RouterA is configured with VRRP priority 254 and its address 10.1.1.1
while RouterB is configured with address 10.1.1.2. VRRP group address
is set 10.1.1.2.
Which router becomes master?
- RouterB
Why?
- RouterB is assumed priority 255 automatically when powered up.
RouterB is the owner.
Note: Default VRRP priority for all routers is 100.

Example of Configuration:
-------------------------
RouterA:
- RouterA serves a master router in VRRP group 1
- both routers back up each other in both VRRP groups
------------------------------------------------
int gi0/0/0
description connected to user segment for gateway
ip address 10.1.0.1 23
undo shutdown
vrrp vrid 1 virtual-ip 10.1.0.3
vrrp vrid 1 priority 250
vrrp vrid 1 preempt
vrrp vrid 1 track s0/0/0 reduced 160
vrrp vrid 1 track s0/0/1 reduced 160

vrrp vrid 2 virtual-ip 10.1.1.3
vrrp vrid 2 preempt
vrrp vrid 2 track s0/0/0 reduced 50
vrrp vrid 2 track s0/0/1 reduced 50

int s0/0/0
description connected to Public Internet
link-protocol ppp
ip address 202.190.109.5 30
undo shutdown

int s0/0/1
description connected to Intranet via VPN
link-protocol ppp
ip address 199.190.15.23 24
undo shutdown

RouterB:
- RouterB serves as a master router in VRRP 2
- both routers back up each other in both VRRP groups
---------------------------------------------
int gi0/0/0
description connected to user segment for gateway
ip address 10.1.0.2 23
undo shutdown
vrrp vrid 1 virtual-ip 10.1.0.3
vrrp vrid 1 preempt
vrrp vrid 1 track s0/0/0 reduced 50
vrrp vrid 1 track s0/0/1 reduced 50

vrrp vrid 2 virtual-ip 10.1.1.3
vrrp vrid 2 priority 250
vrrp vrid 2 preempt
vrrp vrid 2 track s0/0/0 reduced 160
vrrp vrid 2 track s0/0/1 reduced 160

int s0/0/0
description connected to Public Internet
link-protocol ppp
ip address 202.190.188.11 30
undo shutdown

int s0/0/1
description connected to Intranet via VPN
link-protocol ppp
ip address 202.188.0.123 24
undo shutdown

Spanning Tree Protocol (STP)
============================
Redundant switched network without STP process will cause the
following problems: Symptons of Switching Loops
a) Instability of the MAC address table
b) Heavy broadcast storm
c) Network congestion

- STP is designed to prevent switching loops in redundant switched
network topology while maintaining physical link redundancy
- STP is defined in IEEE 802.3d, Rapid STP defined in 802.3w

Operational Rules of STP
------------------------
i) One ROOT switch per switched network
- root switch is the master switch that controls the topology of the
redundant switched networks
ii) One ROOT port per non-root switch
- root port is the port with the lowest path cost to the root switch
(best port to forward traffic to the root switch)
iii) One Designated port per switch link
- a designated port is the switch port where data traffic will be
designated to
iv) One alternate port is blocking the user traffic from looping in
the switched networks

Port Roles in STP
-----------------
a) Root port
b) Designated port
c) Alternate port

Port State in STP process
-------------------------
i) Forwarding
- user and BPDU traffic forwarding & processing goes on as normal
(everything works !)
ii) Blocking/Standby/Discarding
- NO user traffic; no learning of MAC address, receive and process
BPDu but not sending BPDU
iii)Listening
- no user data traffic pass, no learning of MAC address but BPDU
process and exchange (send/receive) go on
iv) Learning
- no user data traffic, learning MAC address, process and exchange of
BPDU go on
v) Disabled
- port is in disconnected mode; no user traffic forwarded, no learning
of MAC addresses,NO BPDU exchange traffic (nothing happens)


How root switch is selected?
- Every switch has a unique bridge ID (switch/bridge ID)
- Bridge ID = Bridge Priority + System MAC Address
Note: By default, bridge priority is 32768 (configurable)
System MAC address is not configurable but unique
Switch priority can be modified from the value of Bridge
Priority value which finally and manually determine the role of root
switch selection.
- root switch is selected based LOWEST bridge ID (means lowest
bridge priority)
By default, root switch is selected based on the lowest system MAC
address of the switches (bcoz the bridge priority is the same for all)

IEEE defined path cost for each interface bandwidth/speed as follows:
Interface (speed) path cost
----------------- ---------
10Mbps 100
100Mbps 19
1000Mbps 4
10000Mbps 2

Command:
---------
stp enable
- enable STP process
- by default STP is enabled already on the switches
undo stp enable
- disable STP process
stp mode stp | rstp | mstp
- set and change STP mode (default is MSTP)
stp priority xxxx (xxxx can be 0 - 61440 in multiple of 4096)
- set STP priority to xxxx value
- lower the priority value, the higher is the preference for the
switch to be selected as root switch.
example of output:

[Sw3]display stp vlan 1
ProcessId InstanceId Port Role State
---------------------------------------------------------------------
-
0 0 GigabitEthernet0/0/1 DESI FORWARDING
0 0 GigabitEthernet0/0/2 DESI FORWARDING

[Sw3]display stp
-------[CIST Global Info][Mode MSTP]-------
CIST Bridge :32768.4c1f-cc6e-6aca
Config Times :Hello 2s MaxAge 20s FwDly 15s MaxHop 20
Active Times :Hello 2s MaxAge 20s FwDly 15s MaxHop 20
CIST Root/ERPC :32768.4c1f-cc07-0b17 / 1
CIST RegRoot/IRPC :32768.4c1f-cc6e-6aca / 0
CIST RootPortId :128.1
BPDU-Protection :Disabled
TC or TCN received :6
TC count per hello :0
STP Converge Mode :Normal
Time since last TC :0 days 0h:59m:6s
Number of TC :5
Last TC occurred :GigabitEthernet0/0/1
----[Port1(GigabitEthernet0/0/1)][FORWARDING]----
Port Protocol :Enabled
Port Role :Root Port
Port Priority :128

- from the above info, you can see the root ID, switch ID and port
role
CIST Root :32768.4c1f-cc07-0b17 (root switch)
CIST Bridge :32768.4c1f-cc6e-6aca (current switch ID)
Port1(GigabitEthernet0/0/1)
Port role :Root Port

WAN Encapsulation with High-level Data Link Control Protocol (HDLC)
===================================================================
- WAN encapsulation protocol works in Data Link layer over serial
interfaces (serial links)
- HDLC does not provide authentication, compression nor encryption
- not practically being used nowadays (obsolete)
command:
link-protocol hdlc

IP Address UNNumbered
- loan ip address from loopback interfaces
command:
ip address unnumbered interface loopback 0


WAN Encapsulation with Point-to-Point (PPP) protocol
=====================================================
- PPP is a well-known WAN encapsulation protocol supports many kinds
of networks as leased lines, circuit switching networks as PSTN/ISDN
with serial interfaces
- PPP works in Data Link layer as other encapsulation protocols as
Ethernet, Frame Relay, ATM, and X.25
- All Huawei router serial interfaces use PPP by default
- PPP carries functions in encapsulation, link compression, and peer
authentication with the following components:
a) PPP encapsulation
b) Link Control Protocol (LCP)
- responsible for link establishment, session negotiation and
compression (optional)
- it works with Data Link layer
- LCP supports link authentication with CHAP and PAP
- CHAP (Challenge Handshake Authentication Protocol) supports
encrypted password (three-way handshake) with MD5 encryption algorithm
- PAP (Password Authentication Protocol) supports plaintext password
only; less secure (two-way handshake)
- LCP uses ICMP (echo request/reply) to detect link state of the peer
c) Network Control Protocol (NCP)
- NCP is in charge of encapsulating network-layer protocols as IP and
IPX
- NCP uses IPCP and IPXCP to negotiate for IP/IPX parameters before
establishing the layer 3 connection
- it works on Network layer

Configuration:
---------------
int s0/0/0
link-protocol ppp
- set link encap with PPP
link-protocol hdlc
- set link encap with HDLC

PPP Address Dynamic Negotiation
--------------------------------
R1:
int s1/0/0
link-protocol ppp
ip address 192.168.1.2 30
remote address 192.168.1.1

R2:
int s1/0/0
link-protocol ppp
ip address ppp-negotiate


Verify the serial interface configuration
-----------------------------------------
[Router1]display interface s1/0/0
Serial1/0/0 current state : UP
Line protocol current state : UP
Last line protocol up time : 2014-05-20 10:47:38 UTC-05:13
Description:HUAWEI, AR Series, Serial1/0/0 Interface
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 192.168.1.1/30
Link layer protocol is PPP
LCP opened, IPCP opened

CHAP with MD5-encrypted password Authentication and IPCP Negotiation
-----------------------------------------------
R1: (Authenticator)
---
aaa
local-user admin password cipher Hu@We1
local-user admin service-type ppp

int s1/0/0
link-protocol ppp
ip address 192.168.1.1 24
remote address 192.168.1.2
ppp authentication-mode chap

R2: (Authenticated)
---
int s1/0/0
link-protocol ppp
ip address ppp-negotiate
ppp chap user admin
ppp chap password cipher Hu@We1
WAN Encapsulation with High-level Data Link Control Protocol (HDLC)
===================================================================
- WAN encapsulation protocol works in Data Link layer over serial
interfaces (serial links)
- HDLC does not provide authentication, compression nor encryption
- not practically being used nowadays (obsolete)
command:
link-protocol hdlc

IP Address UNNumbered
- loan ip address from loopback interfaces
command:
ip address unnumbered interface loopback 0


WAN Encapsulation with Point-to-Point (PPP) protocol
=====================================================
- PPP is a well-known WAN encapsulation protocol supports many kinds
of networks as leased lines, circuit switching networks as PSTN/ISDN
with serial interfaces
- PPP works in Data Link layer as other encapsulation protocols as
Ethernet, Frame Relay, ATM, and X.25
- All Huawei router serial interfaces use PPP by default
- PPP carries functions in encapsulation, link compression, and peer
authentication with the following components:
a) PPP encapsulation
b) Link Control Protocol (LCP)
- responsible for link establishment, session negotiation and
compression (optional)
- it works with Data Link layer
- LCP supports link authentication with CHAP and PAP
- CHAP (Challenge Handshake Authentication Protocol) supports
encrypted password (three-way handshake) with MD5 encryption algorithm
- PAP (Password Authentication Protocol) supports plaintext password
only; less secure (two-way handshake)
- LCP uses ICMP (echo request/reply) to detect link state of the peer
c) Network Control Protocol (NCP)
- NCP is in charge of encapsulating network-layer protocols as IP and
IPX
- NCP uses IPCP and IPXCP to negotiate for IP/IPX parameters before
establishing the layer 3 connection
- it works on Network layer

Configuration:
---------------
int s0/0/0
link-protocol ppp
- set link encap with PPP
link-protocol hdlc
- set link encap with HDLC

PPP Address Dynamic Negotiation
--------------------------------
R1:
int s1/0/0
link-protocol ppp
ip address 192.168.1.2 30
remote address 192.168.1.1

R2:
int s1/0/0
link-protocol ppp
ip address ppp-negotiate


Verify the serial interface configuration
-----------------------------------------
[Router1]display interface s1/0/0
Serial1/0/0 current state : UP
Line protocol current state : UP
Last line protocol up time : 2014-05-20 10:47:38 UTC-05:13
Description:HUAWEI, AR Series, Serial1/0/0 Interface
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 192.168.1.1/30
Link layer protocol is PPP
LCP opened, IPCP opened

CHAP with MD5-encrypted password Authentication and IPCP Negotiation
-----------------------------------------------
R1: (Authenticator)
---
aaa
local-user admin password cipher Hu@We1
local-user admin service-type ppp

int s1/0/0
link-protocol ppp
ip address 192.168.1.1 24
remote address 192.168.1.2
ppp authentication-mode chap

R2: (Authenticated)
---
int s1/0/0
link-protocol ppp
ip address ppp-negotiate
ppp chap user admin
ppp chap password cipher Hu@We1

Frame Relay
===========
- FR is a Wide Area Network (WAN) service
- offered by carrier providers (COINS in Malaysia,Singtel in
Singapore, Telecom Indonesia)
- classified as packet switching network
- works in Data Link layer
- connection-oriented virtual circuit connection

FR Virtual Circuit connections can be divided into two types:
a) Permanent Virtual Circuit (PVC)
- always-on connection established line (shared network service)
b) Switched Virtual Circuit (SVC)
- on-demand connection (shared network service)

Frame Relay Terminology
-----------------------
DLCI - Data Link Connection Identifier
- used to represent a local significant VC link to remote network
- used to map local DLCI value to remote router ip address
- DLCI provided by FR provider (DCE router)

DTE - Data terminating equipment
- a customer router connecting to FR network

DCE - Data Circuit-terminating Equipment
- a provider edge router connecting to customer DTE providing clocking
speed and bandwidth allocation
- routers, FR switch, CSU/DSU, modem

FECN - Forward Explicit Congestion Notification
- a metric measuring the congestion index for outgoing traffic

BECN - Backward Explicit Congestion Notification
- a metric measuring the congestion index for incoming traffic

DE - Discard Eligibility
- a metric measuring the packet drops due to congestion

Note: FECN, BECN and DE are the parameters used for QoS deployment in
controlling congestion

LMI - Local Management Interface
- a FR signaling and messaging control system used by FR service to
detect the heartbeat of the connected routers
- uses Inverse ARP (Address Resolution protocol) to detect the remote
address associated to local DLCI assigned
Note: Inverse ARP is used to dynamically map remote peer address to
local assigned DLCI (Frame Relay Dynamic Map)
- two common LMI standards: ANSI Annex-D, ITU-T Annex-A
- FR address mapping can be done with static mapping (administrative
command) or dynamic mapping with Inverse ARP using LMI signaling
system

Example: Configuration on DTE router (CE router)
------------------------------------------------
CE_Jakarta:
-----------
int s0/0/1
link-protocol fr ietf
- encapsulate FR on the interface
fr interface-type dte
- set FR DTE interface
fr dlci 888
- set local DLCI
ip address 201.100.190.89 29
undo shutdown
fr inarp
- set FR Inverse ARP for dynamic mapping DLCI-remote_address
OR
fr map ip 201.100.190.90 888


CE_Tokyo:
---------
int s0/0/0
link-protocol fr ietf
- encap FR
fr interface-type dte
- set FR DTE interface
fr dlci 999
- set local DLCI
ip address 201.100.190.90 29
undo shutdown
fr inarp
- set FR Inverse ARP for dynamic mapping DLCI-remote_address
OR
undo fr inarp
- disable FR Inverse ARP
fr map ip 201.100.190.89 999
- set manual mapping for DLCI-remote_address

Verify:
------
display fr map-info
- view and check the VC connectivity status (DLCI,remote address) on
DTE (CE) routers

display fr dlci-switch
- view the FR route map (status) on the DCE (PE and P) routers

Network Security : Firewall Solution
====================================
- Huawei network security products known as Eudemon or Universal
Security Gateway (USG) series
- Definition of Firewall : A combination of services and solutions
that encompass hardware, software and enforcement policies set to
prevent threats into the networks

Two main types of Firewall Policies:
i) Loose control policy
- policies default to permit all traffic implicitly and block traffic
explicitly when required

ii) Strict Control Policy
- policies default to deny all traffic implicitly except for those
traffic explicitly permitted

Evolution of Firewall technologies:
-----------------------------------
i) packet filtering firewall
- ACL-based type of filtering on ip address, port numbers, and
protocol ID.
- it is a stateless firewall
ii) Application Proxy firewall
- pure application filtering firewall; example web and email proxy
- client/server application
- it serves as a client role for application server and serves as a
server role for users/hosts when accessing the network
iii) Stateful Inspection Firewall
- thorough packet inspection for all aspect of traffic inclusive of
addresses, ports, protocol ID, session state, sequence
number,timestamp etc.
- it provides deep packet inspection for network traffic before being
allowed or denied based on the security policies

Limitations of Firewall:
i) cannot detect intrusion originated from internal network source
ii) new intrusion cases yet to be updated
iii) performance and security needs to be stroke a balance for
firewall
iv) firewall cannot decode the encrypted traffic over secured tunnel
v) Firewall bottleneck reach when network size grow unlimited

Security Zones
--------------
Default Firewall security zones include:
a) Trust (security priority 85)
b) Local (security priority 100)
c) Untrust (security priority 5)
d) DMZ (security priority 50)

Command Format for firewall interzone <more secure> <less secure>
eg.
firewall interzone trust untrust
packet-filtering 3000 inbound
- filtering on traffic coming from untrust to trust zone
packet-filtering 3000 outbound
- filtering on traffic coming from trust to untrust zone

Network Address Translation (NAT)
=================================
- Types of NAT
a) Static NAT
- one fixed internal address translated using a predefined single
external or public address
b) Dynamic NAT
- one internal address translated using a random single exernal or
public address
c) NAPT (Network Address Port Translation)
- a batch of internal addresses can be translated using one single
external or public address but using unique port number for each
session of traffic
eg. users using Internet service from LAN private addresses
Users from this network
10.1.1.9 -> 202.188.10.6:2983
10.1.1.10 -> 202.188.10.6:7279
10.1.1.11 -> 202.188.10.6:8729
....

Working Pricinple of NAT/NAPT
------------------------------
- translating internal addresses into external/public address
eg. Internet access from LAN or private networks

- translating servers in the server farm for internal users in public
networks
eg. trainees using remote lab accessing practical servers in
DMZ/server farm from public Internet

Benefits of NAT/NAPT:
a) conserve limited public IPv4 addresses using NAPT
b) provide privacy for internal hidden addresses for servers in DMZ
(security)
c) For company acquisition and merging, combining multiple private
networks into a single larger private networks with a common address
is easy to manage

Examples of Practical Private and Public Addresses
--------------------------------------------------
Class A
Private Address : 10.0.0.0 - 10.255.255.255
Public Address : 1.0.0.0 - 9.255.255.255
11.0.0.0 - 126.255.255.255

Class B
Private Address : 172.16.0.0 - 172.31.255.255
Public Address : 128.0.0.0 - 172.15.255.255
172.32.0.0 - 191.255.255.255

Class C
Private Address : 192.168.0.0 - 192.168.255.255
Public Address : 192.0.0.0 - 192.167.255.255
192.169.0.0 - 223.255.255.255

Note: 127.x.x.x is reserved for loopback (not available)