FAILOVER: DIGINET -> DSL/WIRELESS using PBR/HSRP/EEM/IPSLA

December 3, 2010

 

This will do the trick for you in a smart fashionable way and its less messy :)

With the right IOS images ur good to go :)

################################
#    Primary Router Configuration        #        
################################
!
!!!!!! KEY
!!!!!! = Comment
!
track 123 rtr 1 reachability !! Tracking Object ties back to the IPSLA 1 configuraton below.
!
interface FastEthernet0/1 !! Customize HSRP/IP configurations as you deem necessary.
 ip address 172.16.12.1 255.255.255.0
 ip policy route-map WWW-HTTPS-DNS
 standby 3 ip 172.16.12.254
 standby 3 priority 120
 standby 3 preempt
 standby 3 track Serial0/0/0 50 !! Tracks Serial interface and fails HSRP over to Standby CE if primary link goes down.
!
ip route 172.16.34.0 255.255.255.0 172.16.12.3 !! Route to monitored IP via the backup router, backup CE LAN IP as the next hop for echos.
!
ip access-list extended WWW-HTTPS-DNS !! Customize the ACL configurations as you deem necessary.
remark -> Catch Web Traffic && Dns <-
 permit icmp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 !! Customize
 permit tcp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 eq www !! Customize
 permit icmp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 echo !! Customize
 permit icmp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 echo-reply !! Customize
 permit icmp 172.16.12.0 0.0.0.255 5.5.5.0...

[More]
Posted at: 11:00 AM | 0 Comments | Add Comment | Permalink

QUICK IPSEC

November 30, 2010

!
crypto isakmp policy 1
 authentication pre-share
crypto isakmp key p03sfu3ky0u2b1t3t4h@ address 116.26.70.33
crypto isakmp keepalive 120 5 periodic
!
crypto ipsec transform-set VPN ah-sha-hmac esp-des
!
crypto map example 5 ipsec-isakmp
 set peer 116.26.70.33
 set transform-set VPN
 match address 130
!
interface <Blah Blah>
  crypto map example
 crypto ipsec df-bit clear
!
access-list 130 permit ip 192.168.0.0 0.0.0.255 any
!
end
Posted at: 04:24 PM | 0 Comments | Add Comment | Permalink

LINESPEED POLICY - SUB-INTERFACE

November 9, 2010

!
ip access-list extended CE-INPUT-GOLD
 remark *** CUSTOMER Gold Traffic ***
 permit ip any 192.168.30.0 0.0.0.255
 permit ip 192.168.30.0 0.0.0.255 any
ip access-list extended CE-INPUT-SILVER
 remark *** CUSTOMER Silver Traffic ***
 permit ip any any
!
class-map match-any CE-OUTPUT-SILVER
  match ip dscp default
  match ip dscp 4
  class-map match-any CE-OUTPUT-GOLD
   match ip dscp af11
   match ip dscp af13
  class-map match-any ALL-OUTPUT-LINESPEED
  match any
  class-map match-any CE-INPUT-GOLD
   match access-group name CE-INPUT-GOLD
  class-map match-any CE-INPUT-SILVER
  match any
!
policy-map CE-OUTPUT
class CE-OUTPUT-GOLD
  bandwidth 1024
  random-detect dscp-based
 class CE-OUTPUT-SILVER
  bandwidth 128
  random-detect dscp-based
policy-map CE-OUTPUT-LINESPEED
  class ALL-OUTPUT-LINESPEED
    shape average 1152000
    service-policy CE-OUTPUT
policy-map CE-INPUT
class CE-INPUT-GOLD
   police cir 1024000 bc 192000 be 384000
     conform-action set-dscp-transmit af11
     exceed-action set-dscp-transmit af13
 class CE-INPUT-SILVER
   police cir 128000 bc 24000 be 48000
     conform-action set-dscp-transmit 0
     exceed-action set-dscp-transmit 4
!
interface FastEthernet0/1
  max-reserved-bandwidth 100
  service-policy input CE-INPUT
  !
  int FastEthernet0/0.280
  service-policy output CE-OUTPUT-LINESPEED
!
end
Posted at: 04:25 PM | 0 Comments | Add Comment | Permalink

TLC ping TEST: its a quickie :)

September 27, 2010

 

CLI programming :)

 

Cisco-Freak#tclsh  !!! step 1
Cisco-Freak(tcl)#foreach ping_test {  !! step 2
+>1.1.1.1
+>2.2.2.2
+>3.3.3.3
+>4.4.4.4
+>5.5.5.5
+>} { puts [exec "ping v ABG $ping_test"] }

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 360/365/372 ms

Cisco-Freak(tcl)#tclquit !! step 3

[NB -> Follow steps above to execute- copy paste your shit into CLI]

So the script will look like this:

Cisco-Freak(tcl)#foreach ping_test {
+>1.1.1.1
+>2.2.2.2
+>3.3.3.3
+>4.4.4.4...

[More]
Posted at: 05:33 PM | 0 Comments | Add Comment | Permalink

Cisco router ALIASES template

August 24, 2010

alias exec sib show ip interface brie
alias exec r show ip route
alias exec sr show run
alias exec c conf t
alias exec sec show run | sec
alias exec s show run | sec router
alias exec nei show cdp nei det | i ID: |Port |IP
alias exec o sh ip ospf
alias exec e sh ip eigrp
alias exec b sh ip bgp
alias exec r6 sh ipv6 route
alias exec co clear ip ospf process
alias exec cb clear ip bgp *
alias exec a show ip access-lists
alias exec rb configure router bgp
alias exec re configure router eigrp
alias exec ro configure router ospf

alias exec hs show history 

 


Posted at: 01:37 PM | 0 Comments | Add Comment | Permalink

Formulas for working out FRAME CIR,TC,BC,BE.....

August 24, 2010

 

FRAME
======

CIR = Bc X 1000/Tc
Bc = CIR X Tc/1000
Tc = Bc/CIR X 1000
Be = (AR – CIR) X Tc/1000
EIR = Be/Tc


Posted at: 01:35 PM | 0 Comments | Add Comment | Permalink

XOR and AND values: Helps when working with ACLs

August 24, 2010

 

ACLs
====

A AND B
_________
| A | B | out |
| 0 | 0 |  0  |
| 0 | 1 |  0  |
| 1 | 0 |  0  |
| 1 | 1 |  1  |
--------------

A XOR B
_____________
| A | B | out |
| 0 | 0 |  0  |
| 0 | 1 |  1  |
| 1 | 0 |  1  |
| 1 | 1 |  0  |
--------------


Posted at: 01:34 PM | 0 Comments | Add Comment | Permalink

CCIE Networking Jokes

August 24, 2010

Signs You have sat the lab too many times :))

Number 10 - Visitor parking at Cisco features a spot with your name on it.

Number 9 - Visa calls you to inquire if someone at Cisco may have stolen your Credit Card.

Number 8 - You have earned 65,000 flight miles in the last year.

 Number 7 - Your wife asks “Who the hell are you?” when you return home from your latest attempt.

Number 6 - You can now type 90 words per minute.

Number 5 - Your boss indicates that he has a task for you and you respond “How many points is it worth?”

Number 4 - You have recurring nightmares about redistribution.

Number 3 - Your new nickname on the InternetworkExpert forum is “That poor bastard!”

Number 2 - During sex, all you can think about is full IGP reachability.

Number 1 Indication You Have Sat the Lab Too Many Times: The proctor hands you your badge and says “You are on Rack 5 - AGAIN!”

 =============================

 10. Your wives friends come to visit and they see your rack in the basement and they think you are building SKYNET

 9. The beer fridge in the... [More]
Posted at: 01:32 PM | 0 Comments | Add Comment | Permalink

SED - find and replace :)

August 24, 2010

I use this mostly when I have to do repeated serch and replaces on multiple router configuration files - just copy paste this into a file then run it from your shell

                ######Created by spin######
       ##############################
##### Convert switch interfaces #############
  sed -i -e 's/FastEthernet 0\/0 /FastEthernet 1\/0/g' sw*
  sed -i -e 's/FastEthernet 0\/1/FastEthernet 1\/1' sw*
  sed -i -e 's/FastEthernet 0\/2\/FastEthernet 1\/2' sw*
  sed -i -e 's/FastEthernet 0\/3/FastEthernet 1\/3' sw*
  sed -i -e 's/FastEthernet 0\/4/FastEthernet 1\/4' sw*
  sed -i -e 's/FastEthernet 0\/4/FastEthernet 1\/5' sw*
  sed -i -e 's/FastEthernet 0\/6/FastEthernet 1\/6' sw*
  sed -i -e 's/FastEthernet 0\/7/FastEthernet 1\/7' sw*
  sed -i -e 's/FastEthernet 0\/8/FastEthernet 1\/8' sw*
  sed -i -e 's/FastEthernet 0\/9/FastEthernet 1\/9' sw*
  sed -i -e 's/FastEthernet 0\/10\/FastEthernet 1\/10' sw*
  sed -i -e 's/FastEthernet 0\/11/FastEthernet 1\/11' sw*
  sed -i -e 's/FastEthernet 0\/12\/FastEthernet 1\/12' sw*
  sed -i -e 's/FastEthernet 0\/13/FastEthernet 1\/13v
  sed -i -e 's/FastEthernet 0\/14/FastEthernet 1\/14' sw*
  sed -i -e 's/FastEthernet 0\/15/FastEthernet 1\/15' sw*
  sed -i -e 's/FastEthernet 0\/16/FastEthernet 2\/0' sw*
  sed -i -e 's/FastEthernet 0\/17/FastEthernet 2\/1' sw*
  sed -i -e 's/FastEthernet 0\/18/FastEthernet 2\/3' sw*
  sed -i -e 's/FastEthernet...

[More]
Posted at: 01:29 PM | 0 Comments | Add Comment | Permalink

NESTED POLICY MAP - ETHERNET PHYSICAL INTERFACE

August 24, 2010

 

This template always..always makes life a bit easier if you have got a copy in hand :)

!
ip access-list extended CE-INPUT-VVCC
 remark ***Signaling Traffic ***
 ip access-list extended CE-INPUT-VVCC
 permit tcp any any range 1718 1720
 permit tcp any range 1718 1720 any
 permit tcp any any eq 1731
 permit tcp any eq 1731 any
 permit tcp any any range 5060 5061
 permit tcp any range 5060 5061 any
 permit udp any any eq 5060
 permit udp any eq 5060 any
 permit udp any any eq 2727
 permit udp any eq 2727 any
 permit udp any any eq 2427
 permit udp any eq 2427 any
 permit udp any any range 1718 1720
 permit udp any range 1718 1720 any
 permit tcp any any eq 1720
 permit tcp any any range 11000 11999
 permit tcp any any eq 2428
 permit tcp any any range 2000 2002
 permit udp any any eq 1719
 permit tcp any any range 1024 4999
!
ip access-list extended CE-INPUT-VOICE
 remark ***Voice Traffic ***
 permit udp any any range 16348 32767
 permit udp any range 16348 32767 any
!
ip access-list extended CE-INPUT-PLATINUM
 remark ***Platinum Traffic ***
 permit tcp any any eq xx
 permit tcp...

[More]
Posted at: 01:19 PM | 0 Comments | Add Comment | Permalink

Posts by Date

Recent Posts

Archives