Thursday, 30 July 2026

How to configure ASA Dynamic routing?

 

Configuring EIGRP on Cisco ASA: A Quick Lab Guide

Setting up EIGRP on a Cisco Adaptive Security Appliance (ASA) is a bit different from doing it on a standard Cisco IOS router. Because security appliances handle traffic with strict firewall rules and security contexts, you need to pay close attention to interfaces, security levels, and passive interfaces.

Here is a straightforward, step-by-step guide to get your ASA EIGRP lab up and running smoothly.

Let's see the configuration:- 


Goal:-

  • Configure the topology as per the diagram
  • Configure the IP addresses as per the topology
  • Configure ZONES on the ASA firewall
  • Configure EIGRP routing on routers and ASA
  • Verify with show commands


R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface loopback 0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface loopback 0
R2(config-if)#ip address 20.1.1.1 255.0.0.0
R2(config-if)#exit

R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface loopback 0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#exit

R1(config)#router eigrp 100
R1(config-router)#network 192.168.1.0
R1(config-router)#network 10.0.0.0
R1(config-router)#exit

%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.1.2 (FastEthernet0/0) is up: new adjacency

R2(config)#router eigrp 100
R2(config-router)#network 192.168.2.0
R2(config-router)#network 20.0.0.0
R2(config-router)#exit

%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.2.2 (FastEthernet0/0) is up: new adjacency


R3(config)#router eigrp 100
R3(config-router)#network 192.168.3.0
R3(config-router)#network 30.0.0.0
R3(config-router)#exit

DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.3.2 (FastEthernet0/0) is up: new adjacency

ciscoasa(config)# interface gig 1
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 192.168.1.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# interface gig 2
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address 192.168.2.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# interface gig 3
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# ip address 192.168.3.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

ciscoasa(config)# show ip
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
GigabitEthernet1         inside                 192.168.1.2     255.255.255.0   manual
GigabitEthernet2         outside                192.168.2.2     255.255.255.0   manual
GigabitEthernet3         dmz                    192.168.3.2     255.255.255.0   manual

Current IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
GigabitEthernet1         inside                 192.168.1.2     255.255.255.0   manual
GigabitEthernet2         outside                192.168.2.2     255.255.255.0   manual
GigabitEthernet3         dmz                    192.168.3.2     255.255.255.0   manual

ciscoasa(config)# router eigrp 100
ciscoasa(config-router)# network 192.168.1.0
ciscoasa(config-router)# network 192.168.2.0
ciscoasa(config-router)# network 192.168.3.0
ciscoasa(config-router)# exit

ciscoasa(config)# show eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
2   192.168.3.1             Gi3              11  00:18:43 19   200   0   4
1   192.168.2.1             Gi2              12  00:18:44 1019 5000  0   4
0   192.168.1.1             Gi1              11  00:18:45 641  3846  0   5



ciscoasa(config)# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is not set

D    20.0.0.0 255.0.0.0 [90/156160] via 192.168.2.1, 0:18:05, outside
D    10.0.0.0 255.0.0.0 [90/156160] via 192.168.1.1, 0:18:06, inside
C    192.168.1.0 255.255.255.0 is directly connected, inside
C    192.168.2.0 255.255.255.0 is directly connected, outside
C    192.168.3.0 255.255.255.0 is directly connected, dmz
D    30.0.0.0 255.0.0.0 [90/156160] via 192.168.3.1, 0:18:04, dmz


By at No comments:
Labels:

Thursday, 14 May 2026

IPv6 eBGP and iBGP

IPv6 iBGP: The Internal Fabric

In an iBGP setup, the goal is to ensure all routers within your organization know how to reach external destinations.

  • The Full Mesh Requirement: Since iBGP routers do not re-advertise prefixes learned from one iBGP peer to another (to pr+event loops), you typically need a "Full Mesh" or Route Reflectors.
  • Next-Hop-Self: Because iBGP doesn't change the next-hop attribute, internal routers often don't know how to reach the original eBGP exit point. Using the next-hop-self command is a standard practice to ensure internal reachability.





IPv6 eBGP: Crossing the Border

eBGP is the handshake between different entities (like your network and an ISP).

  • Prefix Filtering: Unlike iBGP, you never trust an eBGP peer blindly. Strict prefix-lists and route-maps are essential to ensure you aren't leaking private routes or accepting "bogon" space.
  • The Link-Local Trap: In IPv6, eBGP can technically peer using Link-Local addresses (fe80::/10), but for stability and clarity, most engineers stick to Global Unicast Addresses (GUA) for peering.


In this blog, we configure the basics of IPv6 eBGP and iBGP. 

Topology:


  • Configure the topology as per the diagram.
  • Configure the IPv6 addresses as per the topology.
  • Configure IBGP on router 1 and router 2.
  • Advertise directly connected.
  • Configure EBGP on router 3
  • Configure next-hop-self on router 2 for router 1
  • Verify the configuration with ping, traceroute and show commands.


R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 address 2001:12::1/64
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface loopback 1
R1(config-if)#ipv6 address fc00:11::1/64
R1(config-if)#no shutdown
R1(config-if)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 address 2001:12::2/64
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface loopback 1
R2(config-if)#ipv6 address fc00:22::1/64
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface serial 2/0
R2(config-if)#ipv6 address 2001:23::1/64
R2(config-if)#no shutdown
R2(config-if)#exit

R3(config)#interface loopback 1
R3(config-if)#ipv6 address fc00:33::1/64
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface serial 2/0
R3(config-if)#ipv6 address 2001:23::2/64
R3(config-if)#no shutdown
R3(config-if)#exit

R1(config)#ipv6 unicast-routing
R1(config)#router bgp 6500
R1(config-router)#bgp router-id 1.1.1.1
R1(config-router)#no bgp default ipv4-unicast
R1(config-router)#neighbor 2001:12::2 remote-as 6500
R1(config-router)#address-family ipv6 unicast
R1(config-router-af)#neighbor 2001:12::2 activate
R1(config-router-af)#network fc00:11::/64
R1(config-router-af)#network 2001:12::/64
R1(config-router-af)#exit


R2(config)#ipv6 unicast-routing
R2(config)#router bgp 6500
R2(config-router)#bgp router-id 2.2.2.2
R2(config-router)#no bgp default ipv4-unicast
R2(config-router)#neighbor 2001:12::1 remote-as 6500
R2(config-router)#neighbor 2001:23::2 remote-as 6700
R2(config-router)#address-family ipv6 unicast
R2(config-router-af)#neighbor 2001:12::1 activate
R2(config-router-af)#neighbor 2001:23::2 activate
R2(config-router-af)#network fc00:22::/64
R2(config-router-af)#network 2001:12::/64
R2(config-router-af)#network 2001:23::/64
R2(config-router-af)#exit

%BGP-5-ADJCHANGE: neighbor 2001:12::1 Up

R2(config)#router bgp 6500
R2(config-router)#address-family ipv6 unicast
R2(config-router-af)#neighbor 2001:12::1 next-hop-self
R2(config-router-af)#exit

R3(config)#ipv6 unicast-routing
R3(config)#router bgp 6700
R3(config-router)#bgp router-id 3.3.3.3
R3(config-router)#no bgp default ipv4-unicast
R3(config-router)#neighbor 2001:23::1 remote-as 6500
R3(config-router)#address-family ipv6 unicast
R3(config-router-af)#neighbor 2001:23::1 activate
R3(config-router-af)#network fc00:33::/64
R3(config-router-af)#network 2001:23::/64
R3(config-router-af)#exit

%BGP-5-ADJCHANGE: neighbor 2001:23::1 Up

R1#show ip bgp ipv6 unicast summary
BGP router identifier 1.1.1.1, local AS number 6500
BGP table version is 7, main routing table version 7
5 network entries using 860 bytes of memory
6 path entries using 528 bytes of memory
3/3 BGP path/bestpath attribute entries using 408 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1820 total bytes of memory
BGP activity 7/2 prefixes, 8/2 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
2001:12::2      4         6500      24      21        7    0    0 00:16:06        4


R1#show ipv6 route bgp
IPv6 Routing Table - default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
       IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
       ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
B   2001:23::/64 [200/0]
     via 2001:12::2
B   FC00:22::/64 [200/0]
     via 2001:12::2
B   FC00:33::/64 [200/0]
     via 2001:12::2



R2#ping fc00:11::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FC00:11::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/30/40 ms

R2#ping fc00:33::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FC00:33::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/36 ms

R1#traceroute fc00:33::1
Type escape sequence to abort.
Tracing the route to FC00:33::1

  1 2001:12::2 20 msec 28 msec 20 msec
  2 2001:23::2 44 msec 64 msec 40 msec

(If you like this blog, please visit our YouTube channel.https://www.youtube.com/@internetworkss



By at No comments:
Labels: ,

Monday, 20 April 2026

All the methods of Default route Injection in EIGRP

Default route injection is a critical technique for directing traffic to a gateway of last resort, commonly used in hub-and-spoke topologies, internet breakouts, and redundant network designs. The specific method you use will depend on the routing protocol.

The default route is used to forward any packet with a destination not found in the routing table, which is why it is also called a gateway of last resort. Also can be used at the end location where there is only one exit path for any destination (internet).

Default routes help in reducing the size of your routing table. It’s the last preferred route in the routing table 

 

There are many ways to inject a default route in EIGRP. In this lab, we test four ways of injecting a default route.

The first method to inject a default route into EIGRP is to configure a static default route pointing to Null0, and then redistribute the default route into EIGRP when redistributing a static, connected, or EIGRP route for another autonomous system; the metric does not need to be assigned. The default route will be an external EIGRP route.

The second method for injecting a default route into EIGRP is to configure a network command with 0.0.0.0. You must have the static default route configured; otherwise, with the network 0.0.0.0, all the existing and future directly connected interfaces will be advertised in the AS. The default route will be an internal EIGRP route. 

The third method for injecting a default route into EIGRP  is to configure the IP summary-address EIGRP interface configuration command. With this command, you are summarizing all the class A, B, and C networks. This means that you are suppressing every route in your routing table, but if you must advertise a specific network, you must leak it. The default route will be an internal EIGRP route.

The fourth method of injecting a default route is to use IP default-network command. 




The goal is to perform all the route injection methods in our topology.

  • Configure the topology as per the diagram
  • Configure IP addresses as per the topology
  • Configure IGP EIGRP AS 65100.
  • Advertise directly connected routes
  • Configure the first method of route injection (redistribute default route static Null0)
  • Configure the Second method of route injection (static and network 0.0.0.0)
  • Configure the third method of route injection (only summary address)
  • Configure the fourth method of route injection ( IP default-network)

Read more »
By at No comments:
Labels:

Friday, 20 March 2026

DMVPN Phase 2 Dynamic Mapping

 DMVPN (Dynamic Multipoint VPN), introduced by Cisco in late 2000, is a routing technology you can use to build a VPN network with multiple sites (spokes) without having to statically configure all devices. It’s a “hub and spoke” network, where the spokes can communicate with each other directly without having to go through the hub. Encryption is supported through IPsec, which makes DMVPN a popular choice for connecting different sites using regular Internet connections. It’s a great backup or alternative to private networks like MPLS VPN.

  • In DMVPN Phase 2, hub and spokes are configured as multipoint GRE and spoke-to-spoke tunnels are created. NHRP is required for spokes to register to the hub, and NHRP is also required for spoke-to-spoke resolution.
  • Phase 2: Spoke-to-Spoke tunnels allowed. Branches can talk directly, offloading the Hub. However, routing can become asymmetrical (traffic takes one path there and a different path back), which can cause issues with firewalls.

NHRP (Next Hop Resolution Protocol)

  • Think of NHRP as the "DNS for DMVPN."
  • When a Spoke boots up, it registers its real public IP address with the Hub using NHRP.
  • When Spoke A wants to talk to Spoke B, it asks the Hub, "Who is Spoke B?"
  • The Hub responds with Spoke B’s real public IP.
  • Spoke A then builds a direct IPsec tunnel to Spoke B

 The Next Hop Server is a router (typically the Hub) that maintains the authoritative NHRP database for the entire DMVPN cloud. Every spoke registers its real (public) IP address and its tunnel (private) IP address with the NHS.

 Topology:-


R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.8
R1(config)#end
 
R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#ip route 0.0.0.0 0.0.0.0 192.168.2.8
R2(config)#exit
 
 
R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#ip route 0.0.0.0 0.0.0.0 192.168.3.8
R3(config)#end
 
 
 
R4(config)#interface fastethernet 0/0
R4(config-if)#ip address 192.168.4.1 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#ip route 0.0.0.0 0.0.0.0 192.168.4.8
 
switch-1(config)#interface range ethernet0/0-3
switch-1(config-if-range)#no switchport
switch-1(config-if-range)#shutdown
switch-1(config-if-range)#exit

switch-1(config)#interface Ethernet0/0
switch-1(config-if)#no shutdown
switch-1(config-if)# ip address 192.168.1.8 255.255.255.0
switch-1(config-if)#exit
switch-1(config)#interface Ethernet0/1
switch-1(config-if)#no shutdown
switch-1(config-if)# ip address 192.168.2.8 255.255.255.0
switch-1(config-if)#exit
switch-1(config)#interface Ethernet0/2
switch-1(config-if)# no switchport
switch-1(config-if)# ip address 192.168.3.8 255.255.255.0
switch-1(config-if)#exit
switch-1(config)#interface Ethernet0/3
switch-1(config-if)# no switchport
switch-1(config-if)# ip address 192.168.4.8 255.255.255.0
switch-1(config-if)#exit

switch-1(config)#interface range ethernet0/0-3
switch-1(config-if-range)#no switchport
switch-1(config-if-range)#no shutdown
switch-1(config-if-range)#exit
 
switch-1(config)#ip routing
 
 
 
 
R1(config)#interface tunnel 1
R1(config-if)#ip address 10.1.1.1 255.255.255.0
R1(config-if)#tunnel source 192.168.1.1
R1(config-if)#tunnel mode gre multipoint
R1(config-if)#ip nhrp network-id 111
R1(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
 %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R1#show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
        N - NATed, L - Local, X - No Socket
        # Ent --> Number of NHRP entries with same NBMA peer
        NHS Status: E --> Expecting Replies, R --> Responding
        UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface: Tunnel1, IPv4 NHRP Details
Type:Hub, NHRP Peers:3,

 # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1     192.168.2.1        10.1.1.2    UP 00:00:27     D
     1     192.168.3.1        10.1.1.3    UP 00:00:27     D
     1     192.168.4.1        10.1.1.4    UP 00:00:28     D

 
R2(config)#interface tunnel 1
R2(config-if)#ip address 10.1.1.2 255.255.255.0
R2(config-if)#tunnel source 192.168.2.1
R2(config-if)#tunnel mode gre multipoint
R2(config-if)#ip nhrp network-id 222
R2(config-if)#ip nhrp nhs 10.1.1.1
R2(config-if)#ip nhrp map 10.1.1.1 192.168.1.1
R2(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R2#show dmvpn detail
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
        N - NATed, L - Local, X - No Socket
        # Ent --> Number of NHRP entries with same NBMA peer
        NHS Status: E --> Expecting Replies, R --> Responding
        UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Intferface Tunnel1 is up/up, Addr. is 10.1.1.2, VRF ""
   Tunnel Src./Dest. addr: 192.168.2.1/MGRE, Tunnel VRF ""
   Protocol/Transport: "multi-GRE/IP", Protect ""

IPv4 NHS: 10.1.1.1 RE
Type:Spoke, Total NBMA Peers (v4/v6): 1

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb    Target Network
----- --------------- --------------- ----- -------- ----- -----------------
    1    192.168.1.1        10.1.1.1    UP 00:01:06    S        10.1.1.1/32



R3(config)#interface tunnel 1
R3(config-if)#ip address 10.1.1.3 255.255.255.0
R3(config-if)#tunnel source 192.168.3.1
R3(config-if)#tunnel mode gre multipoint
R3(config-if)#ip nhrp network-id 333
R3(config-if)#ip nhrp nhs 10.1.1.1
R3(config-if)#ip nhrp map 10.1.1.1 192.168.1.1
R3(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R4(config)#interface tunnel 1
R4(config-if)#ip address 10.1.1.4 255.255.255.0
R4(config-if)#tunnel source 192.168.4.1
R4(config-if)#tunnel mode gre multipoint
R4(config-if)#ip nhrp network-id 444
R4(config-if)#ip nhrp nhs 10.1.1.1
R4(config-if)#ip nhrp map 10.1.1.1 192.168.1.1
R4(config-if)#exit
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1,  hanged state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

 R1#show ip nhrp
10.1.1.2/32 via 10.1.1.2
   Tunnel1 created 00:03:23, expire 01:56:36
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.2.1
10.1.1.3/32 via 10.1.1.3
   Tunnel1 created 00:03:23, expire 01:56:36
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.3.1
10.1.1.4/32 via 10.1.1.4
   Tunnel1 created 00:03:24, expire 01:56:35
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.4.1

 R1#ping 10.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/32/44 ms

R1#ping 10.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/36/48 ms

R1#ping 10.1.1.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/36/48 ms

R1#traceroute 10.1.1.2
Type escape sequence to abort.
Tracing the route to 10.1.1.2
  1 10.1.1.2 20 msec 32 msec 28 msec

R1#traceroute 10.1.1.2
Type escape sequence to abort.
Tracing the route to 10.1.1.2
  1 10.1.1.2 40 msec 28 msec 28 msec

R1#traceroute 10.1.1.3
Type escape sequence to abort.
Tracing the route to 10.1.1.3
  1 10.1.1.3 44 msec 32 msec 28 msec

R1#traceroute 10.1.1.4
Type escape sequence to abort.
Tracing the route to 10.1.1.4
  1 10.1.1.4 56 msec 28 msec 28 msec

By at No comments:
Labels:

Saturday, 24 January 2026

Route Map Redistribution and configuration

 

Why use a route map for redistribution?


Without a route-map, you redistribute everything. That's often a bad idea. You might leak routes you shouldn't, cause routing loops, or create security risks. By default, all the routes are redistributed with the metric and metric-type defined when we configure redistribution. When we want to assign different metrics, metric-type or security, we use a route-map. 

 The simple idea of using a route map in redistribution 

  • Filter: only redistribute specific prefixes
  • Modify: change metrics, tag, or route types during the exchange 
  • Control: apply logic with permit or deny statements 


 Let's see the configuration:-

Topology:-


Goal: 

  • Configure the topology as per the diagram
  • Configure the IP addresses as per the topology
  • Configure OSPF as per the topology in area 0
  • Configure RIPv2 on router 3 and advertise loopbacks interfaces
  • Configure ACL permit 192.168.31.0 192.168.32.0 192.168.33.0
  • Configure route map set metric 2000 for 192.168.31.0
  • Configure route map set metric 1000 and metric-type 1
  • Redistribute RIPv2 into OSPF with a route-map 


R1(config)#interface serial 5/0
R1(config-if)#ip address 12.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#no keepalive
R1(config-if)#exit

R1(config)#interface loopback 1
R1(config-if)#ip address 192.168.11.1 255.255.255.0
R1(config-if)#exit
R1(config)#interface loopback 2
R1(config-if)#ip address 192.168.12.1 255.255.255.0
R1(config-if)#exit
R1(config)#interface loopback 3
R1(config-if)#ip address 192.168.13.1 255.255.255.0
R1(config-if)#exit
R1(config)#interface loopback 4
R1(config-if)#ip address 192.168.14.1 255.255.255.0
R1(config-if)#exit
R2(config)#interface serial 5/0
R2(config-if)#ip address 12.1.1.2 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit

R2(config)#interface serial 5/1
R2(config-if)#ip address 23.1.1.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 20.1.1.1 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#no keepalive
R2(config-if)#exit

R2(config)#interface loopback 1
R2(config-if)#ip address 192.168.21.1 255.255.255.0
R2(config-if)#exit
R2(config)#interface loopback 2
R2(config-if)#ip address 192.168.22.1 255.255.255.0
R2(config-if)#exit
R2(config)#interface loopback 3
R2(config-if)#ip address 192.168.23.1 255.255.255.0
R2(config-if)#exit
R2(config)#interface loopback 4
R2(config-if)#ip address 192.168.24.1 255.255.255.0
R2(config-if)#exit


R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#no keepalive
R3(config-if)#exit

R3(config)#interface serial 5/1
R3(config-if)#ip address 23.1.1.2 255.0.0.0
R3(config-if)#no shutdown
R3(config-if)#exit

R3(config)#interface loopback 1
R3(config-if)#ip address 192.168.31.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 2
R3(config-if)#ip address 192.168.32.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 3
R3(config-if)#ip address 192.168.33.1 255.255.255.0
R3(config-if)#exit
R3(config)#interface loopback 4
R3(config-if)#ip address 192.168.34.1 255.255.255.0
R3(config-if)#exit


R1(config)#router ospf 1
R1(config-router)#router-id 10.1.1.1
R1(config-router)#network 0.0.0.0 0.0.0.0 area 0
R1(config-router)#exit

*Jan 24 11:24:24.267: %OSPF-5-ADJCHG: Process 1, Nbr 20.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R2(config)#router ospf 1
R2(config-router)#router-id 20.1.1.1
R2(config-router)#network 12.0.0.0 0.255.255.255 area 0
R2(config-router)#network 23.0.0.0 0.255.255.255 area 0
R2(config-router)#network 20.0.0.0 0.255.255.255 area 0
R2(config-router)#network 192.168.21.0 255.0.0.0 area 0
R2(config-router)#network 192.168.22.0 255.0.0.0 area 0
R2(config-router)#network 192.168.23.0 255.0.0.0 area 0
R2(config-router)#network 192.168.24.0 255.0.0.0 area 0
R2(config-router)#exit

*Jan 24 11:24:24.167: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.1.1 on Serial5/0 from LOADING to FULL, Loading Done

R3(config)#router ospf 1
R3(config-router)#router-id 30.1.1.1
R3(config-router)#network 23.0.0.0 0.255.255.255 area 0
R3(config-router)#network 30.0.0.0 0.255.255.255 area 0
R3(config-router)#exit

*Jan 24 11:35:25.335: %OSPF-5-ADJCHG: Process 1, Nbr 20.1.1.1 on Serial5/1 from LOADING to FULL, Loading Done

R3(config)#router rip
R3(config-router)#version 2
R3(config-router)#network 192.168.31.0
R3(config-router)#network 192.168.32.0
R3(config-router)#network 192.168.33.0
R3(config-router)#network 192.168.34.0
R3(config-router)#exit

R3(config)#access-list 10 permit 192.168.31.0 255.0.0.0
R3(config)#access-list 20 permit 192.168.32.0 255.0.0.0
R3(config)#access-list 30 permit 192.168.33.0 255.0.0.0


R3#show access-lists
Standard IP access list 10
    10 permit 0.168.31.0, wildcard bits 255.0.0.0 (1 match)
Standard IP access list 20
    10 permit 0.168.32.0, wildcard bits 255.0.0.0 (1 match)
Standard IP access list 30
    10 permit 0.168.33.0, wildcard bits 255.0.0.0

R3(config)#route-map OSPF permit 10
R3(config-route-map)#match ip address 10
R3(config-route-map)#set metric 2000
R3(config-route-map)#exit

R3(config)#route-map OSPF permit 20
R3(config-route-map)#match ip address 20
R3(config-route-map)#set metric 1000
R3(config-route-map)#set metric-type type-1
R3(config-route-map)#exit

R3(config)#route-map OSPF permit 30
R3(config-route-map)#exit

R3(config)#router ospf 1
R3(config-router)#redistribute rip subnets route-map OSPF
R3(config-router)#exit
R3(config)#end

R3#show route-map OSPF
route-map OSPF, permit, sequence 10
  Match clauses:
    ip address (access-lists): 10
  Set clauses:
    metric 2000
  Policy routing matches: 0 packets, 0 bytes
route-map OSPF, permit, sequence 20
  Match clauses:
    ip address (access-lists): 20
  Set clauses:
    metric 1000
    metric-type type-1
  Policy routing matches: 0 packets, 0 bytes
route-map OSPF, permit, sequence 30
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes


R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C    192.168.12.0/24 is directly connected, Loopback2
C    192.168.13.0/24 is directly connected, Loopback3
C    192.168.14.0/24 is directly connected, Loopback4
O E2 192.168.31.0/24 [110/2000] via 12.1.1.2, 00:46:06, Serial5/0
     192.168.24.0/32 is subnetted, 1 subnets
O       192.168.24.1 [110/65] via 12.1.1.2, 00:46:06, Serial5/0
O    20.0.0.0/8 [110/65] via 12.1.1.2, 00:46:06, Serial5/0
O    23.0.0.0/8 [110/128] via 12.1.1.2, 00:46:06, Serial5/0
C    192.168.11.0/24 is directly connected, Loopback1
     192.168.21.0/32 is subnetted, 1 subnets
O       192.168.21.1 [110/65] via 12.1.1.2, 00:46:06, Serial5/0
C    10.0.0.0/8 is directly connected, FastEthernet0/0
     192.168.23.0/32 is subnetted, 1 subnets
O       192.168.23.1 [110/65] via 12.1.1.2, 00:46:07, Serial5/0
     192.168.22.0/32 is subnetted, 1 subnets
O       192.168.22.1 [110/65] via 12.1.1.2, 00:46:07, Serial5/0
O E2 192.168.34.0/24 [110/20] via 12.1.1.2, 00:46:07, Serial5/0
C    12.0.0.0/8 is directly connected, Serial5/0
O E1 192.168.32.0/24 [110/1128] via 12.1.1.2, 00:46:07, Serial5/0
O E2 192.168.33.0/24 [110/20] via 12.1.1.2, 00:46:07, Serial5/0
O    30.0.0.0/8 [110/129] via 12.1.1.2, 00:46:07, Serial5/0



IF YOU LIKE THIS BLOG, PLEASE VISIT MY YOUTUBE CHANNEL 

By at No comments:
Labels: , ,

Thursday, 15 January 2026

IPv6 Redistribution between EIGRPv3, OSPFv3 and RIPng

 **IPv6 Route Redistribution** 

Route redistribution in IPv6 allows different routing protocols (e.g., OSPFv3, EIGRP for IPv6, BGP, RIPng, IS-IS) to exchange routing information within the same network. This is useful in multi-vendor or multiprotocol environments where migration or integration is required.

 


**Key Points:**

- Redistribution is typically configured on routers that run multiple routing protocols.

- Careful planning is needed to avoid routing loops, suboptimal paths, or convergence issues.

- Use route filtering, metrics, and administrative distance tuning to control redistribution.

- Default metrics often need manual assignment when redistributing between protocols (e.g., OSPF to EIGRP).

 

**Example Use Case:** 

Connecting an OSPFv3 domain with a BGP IPv6 network, allowing internal routes to be advertised externally and vice versa.

 

**Configuration Note:** 

Always verify routes after redistribution and ensure prefix lengths and next-hop addresses are correctly advertised.


Let's see the configuration:-


Task:

  • Configure the topology as per the diagram
  • Configure the IPv6 addresses as per the topology
  • Configure EIGRPv3 on router 1 and advertise directly 
  • Configure OSPFv3 on router 2 and advertise FastEthernet 2/0 - 3/0
  • Configure EIGRPv3 on router 2 and advertise FastEthernet 0/0
  • Configure OSPFv3 on router 3 and advertise FastEthernet 3/0
  • Configure RIPng on router 3 and advertise FastEthernet 2/0
  • Configure redistribution between EIGRPv3 and OSPFv3 and vice versa 
  • Configure redistribution between RIPng and OSPFv3 and vice versa
  • Make sure all the routes are exchanged 
  • ensure the connectivity and verify with show commands



R1(config)#ipv6 unicast-routing
R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 address 2001:1122:1122:1122::1/64
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 address fc00:1111:1111:1111::1/64
R1(config-if)#no shutdown
R1(config-if)#no keepalive
R1(config-if)#exit
R1(config)#

R2(config)#ipv6 unicast-routing
R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 address 2001:1122:1122:1122::2/64
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 address fc00:2222:2222:2222::1/64
R2(config-if)#no shutdown
R2(config-if)#no keepalive
R2(config-if)#exit
R2(config)#interface fastethernet 3/0
R2(config-if)#ipv6 address 2001:2233:2233:2233::1/64
R2(config-if)#no shutdown
R2(config-if)#exit



R3#show ipv6 interface brief
FastEthernet0/0            [administratively down/down]
    unassigned
ATM1/0                     [administratively down/down]
    unassigned
FastEthernet2/0            [up/up]
    FE80::C803:A5FF:FE68:38
    FC00:3333:3333:3333::1
FastEthernet3/0            [up/up]
    FE80::C803:A5FF:FE68:54
    2001:2233:2233:2233::2


R1(config)#ipv6 router eigrp 65100
R1(config-rtr)#no shutdown
R1(config-rtr)#router-id 11.11.11.11
R1(config-rtr)#exit

R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit

R2(config)#ipv6 router eigrp 65100
R2(config-rtr)#no shutdown
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit

R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 eigrp 65100
R2(config-if)#exit

R2(config)#IPv6 router ospf 100
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit

R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 ospf 100 area 0
R2(config-if)#exit

R2(config)#interface fastethernet 3/0
R2(config-if)#ipv6 ospf 100 area 0
R2(config-if)#exit


R3(config)#IPv6 router ospf 100
R3(config-rtr)#router-id 33.33.33.33
R3(config-rtr)#exit

R3(config)#interface fastethernet 3/0
R3(config-if)#ipv6 ospf 100 area 0
R3(config-if)#exit


R3(config)#ipv6 unicast-routing
R3(config)#interface fastEthernet 2/0
R3(config-if)#ipv6 rip internetworks enable
R3(config-if)#exit


R2(config)#ipv6 router ospf 100
R2(config-rtr)#redistribute eigrp 65100 metric 100 metric-type 1 include-connected
R2(config-rtr)#exit

R2(config)#ipv6 router eigrp 65100
R2(config-rtr)#redistribute ospf 100 include-connected metric 1000 2000 255 1 1500
 metric <bw> <delay> <reliability> <load> <mtu>
R2(config-rtr)#exit

R3(config)#ipv6 router ospf 100
R3(config-rtr)#redistribute rip internetworks include-connected metric 100 metric-type 1
R3(config-rtr)#exit


R1#show ipv6 route
IPv6 Routing Table - Default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001:1122:1122:1122::/64 [0/0]
     via FastEthernet0/0, directly connected
L   2001:1122:1122:1122::1/128 [0/0]
     via FastEthernet0/0, receive
EX  2001:2233:2233:2233::/64 [170/3074560]
     via FE80::C802:59FF:FE98:0, FastEthernet0/0
C   FC00:1111:1111:1111::/64 [0/0]
     via FastEthernet2/0, directly connected
L   FC00:1111:1111:1111::1/128 [0/0]
     via FastEthernet2/0, receive
EX  FC00:2222:2222:2222::/64 [170/3074560]
     via FE80::C802:59FF:FE98:0, FastEthernet0/0
EX  FC00:3333:3333:3333::/64 [170/3074560]
     via FE80::C802:59FF:FE98:0, FastEthernet0/0
L   FF00::/8 [0/0]
     via Null0, receive

R2#show ipv6 protocol
IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 65100"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    FastEthernet0/0
  Redistribution:
    Redistributing protocol ospf 100 with metric 0 include-connected
  Maximum path: 16
  Distance: internal 90 external 170

IPv6 Routing Protocol is "ospf 100"
  Interfaces (Area 0):
    FastEthernet3/0
    FastEthernet2/0
  Redistribution:
    Redistributing protocol eigrp 65100 with metric 100 type 1 include-connected

If you like this blog, please visit our YOUTUBE channel https://www.youtube.com/@internetworkss


By at No comments:
Labels: , , , ,

Monday, 12 January 2026

IPv6 EIGRP: The Next-Generation Routing Protocol

 IPv6 EIGRP: The Next-Generation Routing Protocol

As networks transition to IPv6, routing protocols must evolve too. Enter EIGRP for IPv6 – Cisco’s enhanced interior gateway protocol, now ready for the modern internet.

 

What is IPv6 EIGRP?

IPv6 EIGRP is the IPv6-enabled version of Cisco’s advanced distance-vector protocol. It retains EIGRP’s popular features – rapid convergence, low bandwidth usage, and support for VLSM – while fully embracing IPv6 addressing and communication.




 

Key Advantages

Dual-Stack Ready: Runs alongside IPv4 EIGRP, allowing gradual migration

Separate Process: IPv6 EIGRP operates as an independent protocol instance

Link-local addressing: uses IPv6 link-local addresses for neighbor discovery

Same Dual Algorithm: Maintains the reliable loop-free path selection

 

Configuration Highlights

 

R1(config)#ipv6 unicast-routing
R1(config)#ipv6 router eigrp 65100
R1(config-rtr)#no shutdown
R1(config-rtr)#router-id 11.11.11.11
R1(config-rtr)#exit
R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit  

Let's see the configuration :

Topology:










TASK
  • Configure the topology as per the diagram 
  • Configure IPv6 addresses as per the topology
  • Configure IPv6 EIGRP AS 65100
  • Make sure both routers communicate 
  • Verify with show commands 
R1(config)#ipv6 unicast-routing
R1(config)#
R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 address 2001:1122:1122:1122::1/64
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#
R1(config)#
R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 address fc00:1111:1111:1111::1/64
R1(config-if)#no shutdown
R1(config-if)#no keepalive
R1(config-if)#exit


R2(config)#ipv6 unicast-routing
R2(config)#
R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 address 2001:1122:1122:1122::2/64
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#
R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 address fc00:2222:2222:2222::1/64
R2(config-if)#no shutdown
R2(config-if)#no keepalive
R2(config-if)#exit


R1(config)#ipv6 router eigrp 65100
R1(config-rtr)#no shutdown
R1(config-rtr)#router-id 11.11.11.11
R1(config-rtr)#exit
R1(config)#
R1(config)#interface fastethernet 0/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit
R1(config)#
R1(config)#interface fastethernet 2/0
R1(config-if)#ipv6 eigrp 65100
R1(config-if)#exit


R2(config)#ipv6 router eigrp 65100
R2(config-rtr)#no shutdown
R2(config-rtr)#router-id 22.22.22.22
R2(config-rtr)#exit
R2(config)#
R2(config)#interface fastethernet 0/0
R2(config-if)#ipv6 eigrp 65100
R2(config-if)#exit
R2(config)#
R2(config)#interface fastethernet 2/0
R2(config-if)#ipv6 eigrp 65100
R2(config-if)#exit


R1#show ipv6 route
IPv6 Routing Table - Default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001:1122:1122:1122::/64 [0/0]
     via FastEthernet0/0, directly connected
L   2001:1122:1122:1122::1/128 [0/0]
     via FastEthernet0/0, receive
C   FC00:1111:1111:1111::/64 [0/0]
     via FastEthernet2/0, directly connected
L   FC00:1111:1111:1111::1/128 [0/0]
     via FastEthernet2/0, receive
D   FC00:2222:2222:2222::/64 [90/30720]
     via FE80::C802:59FF:FE98:0, FastEthernet0/0
L   FF00::/8 [0/0]
     via Null0, receive

R1#show ipv6 eigrp neighbor
IPv6-EIGRP neighbors for process 65100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   Link-local address:     Fa0/0             12 00:01:21  906  5000  0  5
    FE80::C802:59FF:FE98:0

R1#show ipv6 interface brief
FastEthernet0/0            [up/up]
    FE80::C801:A5FF:FED4:0
    2001:1122:1122:1122::1
ATM1/0                     [administratively down/down]
    unassigned
FastEthernet2/0            [up/up]
    FE80::C801:A5FF:FED4:38
    FC00:1111:1111:1111::1

R1#ping fc00:2222:2222:2222::1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FC00:2222:2222:2222::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/29/56 ms



















By at No comments:
Labels: ,

Sunday, 4 January 2026

Cisco IP Source Guard (IPSG) and configuration

 **Cisco IP Source Guard (IPSG)**

 

**Purpose:** 

IP Source Guard is a security feature on Cisco switches designed to prevent IP address spoofing attacks. It restricts IP traffic on untrusted switch ports by filtering traffic based on the DHCP snooping binding database or manually configured IP-to-MAC bindings.

 




**How It Works:** 

1. **DHCP Snooping Dependency:** IPSG relies on the DHCP snooping binding table to learn valid IP-MAC-interface bindings. 

2. **Traffic Filtering:** When enabled on an access or untrusted port, the switch drops any IP traffic with a source IP address that does not match a valid binding in the DHCP snooping table (or a static entry). 

3. **Dynamic Enforcement:** Initially, only DHCP packets are allowed. After a client receives a valid IP via DHCP, subsequent traffic from that client is permitted only if the source IP matches the assigned address.

 

**Benefits:** 

- Prevents attackers from spoofing another host’s IP address. 

- Limits malicious traffic from unauthorized IP addresses. 

- Works in conjunction with DHCP snooping and Dynamic ARP Inspection (DAI) for layered security.

 

**Typical Use:** 

Deployed on access switch ports in enterprise networks to ensure endpoint integrity and mitigate man-in-the-middle or spoofing-based attacks.

 

**Configuration Note:** 

IPSG is configured at the interface level (`ip verify source`) and is most effective when DHCP snooping is already enabled.

 

Let's see the configuration:-

Topology:-

Goal:

  • Configure the topology as per the diagram
  • Configure the IP addresses on PCs 192.168.1.51/24 - 192.168.1.53/24
  • Configure VLAN 50 and assign ports Ethernet 0/0 - 0/3
  • Configure the IP address to VLAN 50
  • Configure portfast and portsecurity on the range Ethernet 0/0 - 0/3
  • Configure DHCP snooping on VLAN 50
  • Configure static mapping binding IP to MAC
  • Verify with the show commands


PC1> show ip

NAME        : PC1[1]
IP/MASK     : 192.168.1.51/24
GATEWAY     : 192.168.1.50
DNS         :
MAC         : 00:50:79:66:68:00
LPORT       : 10004
RHOST:PORT  : 127.0.0.1:10005
MTU:        : 1500


PC2> show ip

NAME        : PC2[1]
IP/MASK     : 192.168.1.52/24
GATEWAY     : 192.168.1.50
DNS         :
MAC         : 00:50:79:66:68:01
LPORT       : 10006
RHOST:PORT  : 127.0.0.1:10007
MTU:        : 1500


PC3> show ip

NAME        : PC3[1]
IP/MASK     : 192.168.1.53/24
GATEWAY     : 192.168.1.50
DNS         :
MAC         : 00:50:79:66:68:02
LPORT       : 10008
RHOST:PORT  : 127.0.0.1:10009
MTU:        : 1500


PC4> show ip

NAME        : PC4[1]
IP/MASK     : 192.168.1.54/24
GATEWAY     : 192.168.1.50
DNS         :
MAC         : 00:50:79:66:68:03
LPORT       : 10010
RHOST:PORT  : 127.0.0.1:10011
MTU:        : 1500

switch(config)#vlan 50
switch(config-vlan)#name internetworks

switch(config-vlan)#interface range ethernet 0/0 - 3
switch(config-if-range)#switchport
switch(config-if-range)#switchport mode access
switch(config-if-range)#switchport access vlan 50
switch(config-if-range)#exit

switch#show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Et1/0, Et1/1, Et1/2, Et1/3
                                                Et2/0, Et2/1, Et2/2, Et2/3
                                                Et3/0, Et3/1, Et3/2, Et3/3
10   VLAN0010                         active
50   internetworks                    active    Et0/0, Et0/1, Et0/2, Et0/3


switch(config)#interface vlan 50
switch(config-if)#ip address 192.168.1.50 255.255.255.0
switch(config-if)#no shutdown
switch(config-if)#exit


switch#show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.50            -   aabb.cc80.0100  ARPA   Vlan50
Internet  192.168.1.51            0   0050.7966.6800  ARPA   Vlan50
Internet  192.168.1.52            0   0050.7966.6801  ARPA   Vlan50
Internet  192.168.1.53            0   0050.7966.6802  ARPA   Vlan50


switch(config)#interface range ethernet 0/0 - 3
switch(config-if-range)#switchport port-security
switch(config-if-range)#ip verify source port-security
switch(config-if-range)#exit

switch(config)#ip dhcp snooping
switch(config)#ip dhcp snooping vlan 50
switch(config)#end


switch(config)# ip source binding 0050.7966.6800 vlan 50 192.168.1.51 interface ethernet 0/0
switch(config)# ip source binding 0050.7966.6801 vlan 50 192.168.1.52 interface ethernet 0/1
switch(config)# ip source binding  0050.7966.6802 vlan 50 192.168.1.53 interface ethernet 0/2
switch(config)#end

switch#show ip source binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  ----------                                                                                                                                   ----------
00:50:79:66:68:00   192.168.1.51     infinite    static          50    Ethernet0                                                                                                                                   /0
00:50:79:66:68:01   192.168.1.52     infinite    static          50    Ethernet0                                                                                                                                   /1
00:50:79:66:68:02   192.168.1.53     infinite    static          50    Ethernet0                                                                                                                                   /2
Total number of bindings: 3

switch#show ip verify source
Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan
---------  -----------  -----------  ---------------  -----------------  ----
Et0/0      ip-mac       active       192.168.1.51     00:50:79:66:68:00  50
Et0/1      ip-mac       active       192.168.1.52     00:50:79:66:68:01  50
Et0/2      ip-mac       active       192.168.1.53     00:50:79:66:68:02  50
Et0/3      ip-mac       active       deny-all         deny-all           50



If you like this blog, visit our YouTube channel https://www.youtube.com/@internetworkss



By at No comments:
Labels:
Subscribe to: Posts (Atom)

How to configure ASA Dynamic routing?

  Configuring EIGRP on Cisco ASA: A Quick Lab Guide Setting up EIGRP on a Cisco Adaptive Security Appliance (ASA) is a bit different from do...