FAILOVER: DIGINET -> DSL/WIRELESS using PBR/HSRP/EEM/IPSLA
December 3, 2010
This will do the trick for you in a smart fashionable way and its less messy :)
With the right IOS images ur good to go :)
################################
# Primary Router Configuration #
################################
!
!!!!!! KEY
!!!!!! = Comment
!
track 123 rtr 1 reachability !! Tracking Object ties back to the IPSLA 1 configuraton below.
!
interface FastEthernet0/1 !! Customize HSRP/IP configurations as you deem necessary.
ip address 172.16.12.1 255.255.255.0
ip policy route-map WWW-HTTPS-DNS
standby 3 ip 172.16.12.254
standby 3 priority 120
standby 3 preempt
standby 3 track Serial0/0/0 50 !! Tracks Serial interface and fails HSRP over to Standby CE if primary link goes down.
!
ip route 172.16.34.0 255.255.255.0 172.16.12.3 !! Route to monitored IP via the backup router, backup CE LAN IP as the next hop for echos.
!
ip access-list extended WWW-HTTPS-DNS !! Customize the ACL configurations as you deem necessary.
remark -> Catch Web Traffic && Dns <-
permit icmp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 !! Customize
permit tcp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 eq www !! Customize
permit icmp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 echo !! Customize
permit icmp 172.16.12.0 0.0.0.255 5.5.5.0 0.0.0.255 echo-reply !! Customize
permit icmp 172.16.12.0 0.0.0.255 5.5.5.0...
[More]
Posted at: 11:00 AM | 0 Comments | Add Comment | Permalink
QUICK IPSEC
November 30, 2010
!
crypto isakmp policy 1
authentication pre-share
crypto isakmp key p03sfu3ky0u2b1t3t4h@ address 116.26.70.33
crypto isakmp keepalive 120 5 periodic
!
crypto ipsec transform-set VPN ah-sha-hmac esp-des
!
crypto map example 5 ipsec-isakmp
set peer 116.26.70.33
set transform-set VPN
match address 130
!
interface <Blah Blah>
crypto map example
crypto ipsec df-bit clear
!
access-list 130 permit ip 192.168.0.0 0.0.0.255 any
!
end
Posted at: 04:24 PM | 0 Comments | Add Comment | Permalink
LINESPEED POLICY - SUB-INTERFACE
November 9, 2010
!
ip access-list extended CE-INPUT-GOLD
remark *** CUSTOMER Gold Traffic ***
permit ip any 192.168.30.0 0.0.0.255
permit ip 192.168.30.0 0.0.0.255 any
ip access-list extended CE-INPUT-SILVER
remark *** CUSTOMER Silver Traffic ***
permit ip any any
!
class-map match-any CE-OUTPUT-SILVER
match ip dscp default
match ip dscp 4
class-map match-any CE-OUTPUT-GOLD
match ip dscp af11
match ip dscp af13
class-map match-any ALL-OUTPUT-LINESPEED
match any
class-map match-any CE-INPUT-GOLD
match access-group name CE-INPUT-GOLD
class-map match-any CE-INPUT-SILVER
match any
!
policy-map CE-OUTPUT
class CE-OUTPUT-GOLD
bandwidth 1024
random-detect dscp-based
class CE-OUTPUT-SILVER
bandwidth 128
random-detect dscp-based
policy-map CE-OUTPUT-LINESPEED
class ALL-OUTPUT-LINESPEED
shape average 1152000
service-policy CE-OUTPUT
policy-map CE-INPUT
class CE-INPUT-GOLD
police cir 1024000 bc 192000 be 384000
conform-action set-dscp-transmit af11
exceed-action set-dscp-transmit af13
class CE-INPUT-SILVER
police cir 128000 bc 24000 be 48000
conform-action set-dscp-transmit 0
exceed-action set-dscp-transmit 4
!
interface FastEthernet0/1
max-reserved-bandwidth 100
service-policy input CE-INPUT
!
int FastEthernet0/0.280
service-policy output CE-OUTPUT-LINESPEED
!
end
Posted at: 04:25 PM | 0 Comments | Add Comment | Permalink
TLC ping TEST: its a quickie :)
September 27, 2010
CLI programming :)
Cisco-Freak#tclsh !!! step 1
Cisco-Freak(tcl)#foreach ping_test { !! step 2
+>1.1.1.1
+>2.2.2.2
+>3.3.3.3
+>4.4.4.4
+>5.5.5.5
+>} { puts [exec "ping v ABG $ping_test"] }
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 360/365/372 ms
Cisco-Freak(tcl)#tclquit !! step 3
[NB -> Follow steps above to execute- copy paste your shit into CLI]
So the script will look like this:
Cisco-Freak(tcl)#foreach ping_test {
+>1.1.1.1
+>2.2.2.2
+>3.3.3.3
+>4.4.4.4...
[More]
Posted at: 05:33 PM | 0 Comments | Add Comment | Permalink
Cisco router ALIASES template
August 24, 2010
alias exec sib show ip interface brie
alias exec r show ip route
alias exec sr show run
alias exec c conf t
alias exec sec show run | sec
alias exec s show run | sec router
alias exec nei show cdp nei det | i ID: |Port |IP
alias exec o sh ip ospf
alias exec e sh ip eigrp
alias exec b sh ip bgp
alias exec r6 sh ipv6 route
alias exec co clear ip ospf process
alias exec cb clear ip bgp *
alias exec a show ip access-lists
alias exec rb configure router bgp
alias exec re configure router eigrp
alias exec ro configure router ospf
alias exec hs show history
Posted at: 01:37 PM | 0 Comments | Add Comment | Permalink
Formulas for working out FRAME CIR,TC,BC,BE.....
August 24, 2010
FRAME
======
CIR = Bc X 1000/Tc
Bc = CIR X Tc/1000
Tc = Bc/CIR X 1000
Be = (AR – CIR) X Tc/1000
EIR = Be/Tc
Posted at: 01:35 PM | 0 Comments | Add Comment | Permalink
XOR and AND values: Helps when working with ACLs
August 24, 2010
ACLs
====
A AND B
_________
| A | B | out |
| 0 | 0 | 0 |
| 0 | 1 | 0 |
| 1 | 0 | 0 |
| 1 | 1 | 1 |
--------------
A XOR B
_____________
| A | B | out |
| 0 | 0 | 0 |
| 0 | 1 | 1 |
| 1 | 0 | 1 |
| 1 | 1 | 0 |
--------------
Posted at: 01:34 PM | 0 Comments | Add Comment | Permalink
CCIE Networking Jokes
August 24, 2010
Signs You have sat the lab too many times :))
Number 10 - Visitor parking at Cisco features a spot with your name on it.
Number 9 - Visa calls you to inquire if someone at Cisco may have stolen your Credit Card.
Number 8 - You have earned 65,000 flight miles in the last year.
Number 7 - Your wife asks “Who the hell are you?” when you return home from your latest attempt.
Number 6 - You can now type 90 words per minute.
Number 5 - Your boss indicates that he has a task for you and you respond “How many points is it worth?”
Number 4 - You have recurring nightmares about redistribution.
Number 3 - Your new nickname on the InternetworkExpert forum is “That poor bastard!”
Number 2 - During sex, all you can think about is full IGP reachability.
Number 1 Indication You Have Sat the Lab Too Many Times: The proctor hands you your badge and says “You are on Rack 5 - AGAIN!”
=============================
10. Your wives friends come to visit and they see your rack in the basement and they think you are building SKYNET
9. The beer fridge in the...
[More]
Posted at: 01:32 PM | 0 Comments | Add Comment | Permalink
SED - find and replace :)
August 24, 2010
I use this mostly when I have to do repeated serch and replaces on multiple router configuration files - just copy paste this into a file then run it from your shell
######Created by spin######
##############################
##### Convert switch interfaces #############
sed -i -e 's/FastEthernet 0\/0 /FastEthernet 1\/0/g' sw*
sed -i -e 's/FastEthernet 0\/1/FastEthernet 1\/1' sw*
sed -i -e 's/FastEthernet 0\/2\/FastEthernet 1\/2' sw*
sed -i -e 's/FastEthernet 0\/3/FastEthernet 1\/3' sw*
sed -i -e 's/FastEthernet 0\/4/FastEthernet 1\/4' sw*
sed -i -e 's/FastEthernet 0\/4/FastEthernet 1\/5' sw*
sed -i -e 's/FastEthernet 0\/6/FastEthernet 1\/6' sw*
sed -i -e 's/FastEthernet 0\/7/FastEthernet 1\/7' sw*
sed -i -e 's/FastEthernet 0\/8/FastEthernet 1\/8' sw*
sed -i -e 's/FastEthernet 0\/9/FastEthernet 1\/9' sw*
sed -i -e 's/FastEthernet 0\/10\/FastEthernet 1\/10' sw*
sed -i -e 's/FastEthernet 0\/11/FastEthernet 1\/11' sw*
sed -i -e 's/FastEthernet 0\/12\/FastEthernet 1\/12' sw*
sed -i -e 's/FastEthernet 0\/13/FastEthernet 1\/13v
sed -i -e 's/FastEthernet 0\/14/FastEthernet 1\/14' sw*
sed -i -e 's/FastEthernet 0\/15/FastEthernet 1\/15' sw*
sed -i -e 's/FastEthernet 0\/16/FastEthernet 2\/0' sw*
sed -i -e 's/FastEthernet 0\/17/FastEthernet 2\/1' sw*
sed -i -e 's/FastEthernet 0\/18/FastEthernet 2\/3' sw*
sed -i -e 's/FastEthernet...
[More]
Posted at: 01:29 PM | 0 Comments | Add Comment | Permalink
NESTED POLICY MAP - ETHERNET PHYSICAL INTERFACE
August 24, 2010
This template always..always makes life a bit easier if you have got a copy in hand :)
!
ip access-list extended CE-INPUT-VVCC
remark ***Signaling Traffic ***
ip access-list extended CE-INPUT-VVCC
permit tcp any any range 1718 1720
permit tcp any range 1718 1720 any
permit tcp any any eq 1731
permit tcp any eq 1731 any
permit tcp any any range 5060 5061
permit tcp any range 5060 5061 any
permit udp any any eq 5060
permit udp any eq 5060 any
permit udp any any eq 2727
permit udp any eq 2727 any
permit udp any any eq 2427
permit udp any eq 2427 any
permit udp any any range 1718 1720
permit udp any range 1718 1720 any
permit tcp any any eq 1720
permit tcp any any range 11000 11999
permit tcp any any eq 2428
permit tcp any any range 2000 2002
permit udp any any eq 1719
permit tcp any any range 1024 4999
!
ip access-list extended CE-INPUT-VOICE
remark ***Voice Traffic ***
permit udp any any range 16348 32767
permit udp any range 16348 32767 any
!
ip access-list extended CE-INPUT-PLATINUM
remark ***Platinum Traffic ***
permit tcp any any eq xx
permit tcp...
[More]
Posted at: 01:19 PM | 0 Comments | Add Comment | Permalink