SG

SG

Rabu, 21 Desember 2011

Configuration VRRP




VRRP adalah open standar protocol, alternative untuk Cisco HSRP

VRRP Sample Configuration on C1
**************************************
!
track 1 interface Serial1/0 line-protocol
!
interface FastEthernet0/0
ip address 192.168.10.2 255.255.255.0
duplex auto
speed auto
vrrp 1 ip 192.168.10.1
vrrp 1 priority 110
vrrp 1 authentication agus123
vrrp 1 track 1 decrement 20
!
**************************************
VRRP Sample Configuration on C2
**************************************
!
interface FastEthernet0/0
ip address 192.168.10.3 255.255.255.0
duplex auto
speed auto
vrrp 1 ip 192.168.10.1
vrrp 1 authentication agus123
!
**************************************
How to check 1 (show vrrp all/brief)
**************************************
C1#sh vrrp all
FastEthernet0/0 - Group 1
State is Master
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 110
Track object 1 state Up decrement 20
Authentication text "agus123"
Master Router is 192.168.10.2 (local), priority is 110
Master Advertisement interval is 1.000 sec
Master Down interval is 3.570 sec

C1#
**************************************
C2#sh vrrp all
FastEthernet0/0 - Group 1
State is Backup
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 100
Authentication text "agus123"
Master Router is 192.168.10.2, priority is 110
Master Advertisement interval is 1.000 sec
Master Down interval is 3.609 sec (expires in 3.425 sec)

C2#
**************************************
How to check 2 (ping and tracert)
**************************************
C:\>ping 192.168.40.5 -n 5

Pinging 192.168.40.5 with 32 bytes of data:

Reply from 192.168.40.5: bytes=32 time=341ms TTL=126
Reply from 192.168.40.5: bytes=32 time=262ms TTL=126
Reply from 192.168.40.5: bytes=32 time=280ms TTL=126
Reply from 192.168.40.5: bytes=32 time=528ms TTL=126
Reply from 192.168.40.5: bytes=32 time=444ms TTL=126

Ping statistics for 192.168.40.5:
Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 262ms, Maximum = 528ms, Average = 371ms
**************************************
C:\>tracert 192.168.40.5

Tracing route to 192.168.40.5 over a maximum of 30 hops

1    92 ms    87 ms   144 ms  192.168.10.2
2   277 ms   191 ms   348 ms  192.168.20.2
3   206 ms   291 ms   387 ms  192.168.40.5

Trace complete.

C:\>
**************************************
How to check 3 (shutdown int f0/0 on C1)
**************************************
C1(config)#int f0/0
C1(config-if)#shut
C1(config-if)#
*Dec 11 10:13:34.667: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Master -> Init
*Dec 11 10:13:34.687: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached
*Dec 11 10:13:36.667: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Dec 11 10:13:36.667: %ENTITY_ALARM-6-INFO: ASSERT INFO Fa0/0 Physical Port Administrative State Down
*Dec 11 10:13:37.667: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down
**************************************
C2#
*Dec 11 10:07:28.327: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Backup -> Master
**************************************
C1#sh vrrp all
FastEthernet0/0 - Group 1
State is Init
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 110
Track object 1 state Up decrement 20
Authentication text "agus123"
Master Router is unknown, priority is unknown
Master Advertisement interval is unknown
Master Down interval is unknown

C1#
**************************************
C2#sh vrrp all
FastEthernet0/0 - Group 1
State is Master
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 100
Authentication text "agus123"
Master Router is 192.168.10.3 (local), priority is 100
Master Advertisement interval is 1.000 sec
Master Down interval is 3.609 sec

C2#
**************************************

C:\>ping 192.168.40.5 -n 5

Pinging 192.168.40.5 with 32 bytes of data:

Reply from 192.168.40.5: bytes=32 time=332ms TTL=126
Reply from 192.168.40.5: bytes=32 time=351ms TTL=126
Reply from 192.168.40.5: bytes=32 time=322ms TTL=126
Reply from 192.168.40.5: bytes=32 time=449ms TTL=126
Reply from 192.168.40.5: bytes=32 time=615ms TTL=126

Ping statistics for 192.168.40.5:
Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 322ms, Maximum = 615ms, Average = 413ms
**************************************
C:\>tracert 192.168.40.5

Tracing route to 192.168.40.5 over a maximum of 30 hops

1   267 ms   167 ms    53 ms  192.168.10.3
2   388 ms   246 ms   168 ms  192.168.30.2
3   407 ms   368 ms   310 ms  192.168.40.5

Trace complete.

C:\>
**************************************
How to check 4 (no shutdown int f0/0 on C1)
**************************************
C1(config)#int f0/0
C1(config-if)#no shut
C1(config-if)#
*Dec 11 10:16:27.267: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Init -> Backup
*Dec 11 10:16:29.251: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Dec 11 10:16:29.251: %ENTITY_ALARM-6-INFO: CLEAR INFO Fa0/0 Physical Port Administrative State Down
*Dec 11 10:16:30.251: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
*Dec 11 10:16:30.839: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Backup -> Master
*Dec 11 10:16:33.503: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on FastEthernet0/0 from LOADING to FULL, Loading Done
**************************************
C2#
*Dec 11 10:10:39.731: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Master -> Backup
*Dec 11 10:10:41.523: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading Done
**************************************
FastEthernet0/0 - Group 1
State is Master
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 110
Track object 1 state Up decrement 20
Authentication text "agus123"
Master Router is 192.168.10.2 (local), priority is 110
Master Advertisement interval is 1.000 sec
Master Down interval is 3.570 sec

C1#
**************************************
C2#sh vrrp all
FastEthernet0/0 - Group 1
State is Backup
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 100
Authentication text "agus123"
Master Router is 192.168.10.2, priority is 110
Master Advertisement interval is 1.000 sec
Master Down interval is 3.609 sec (expires in 2.045 sec)

C2#
**************************************

C:\>ping 192.168.40.5 -n 5

Pinging 192.168.40.5 with 32 bytes of data:

Reply from 192.168.40.5: bytes=32 time=379ms TTL=126
Reply from 192.168.40.5: bytes=32 time=335ms TTL=126
Reply from 192.168.40.5: bytes=32 time=371ms TTL=126
Reply from 192.168.40.5: bytes=32 time=346ms TTL=126
Reply from 192.168.40.5: bytes=32 time=428ms TTL=126

Ping statistics for 192.168.40.5:
Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 335ms, Maximum = 428ms, Average = 371ms

C:\>tracert 192.168.40.5
**************************************
Tracing route to 192.168.40.5 over a maximum of 30 hops

1   607 ms   395 ms   516 ms  192.168.10.2
2   628 ms   201 ms   382 ms  192.168.20.2
3   607 ms   521 ms   339 ms  192.168.40.5

Trace complete.

C:\>
**************************************
How to check 5 (shutdown int s1/0 on C1)
**************************************
C1(config)#int s1/0
C1(config-if)#shutdown
C1(config-if)#
*Dec 11 10:19:19.015: %TRACKING-5-STATE: 1 interface Se1/0 line-protocol Up->Down
*Dec 11 10:19:19.023: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0 from FULL to DOWN, Neighbor Down: Interface down or detached
*Dec 11 10:19:20.995: %LINK-5-CHANGED: Interface Serial1/0, changed state to administratively down
*Dec 11 10:19:20.995: %ENTITY_ALARM-6-INFO: ASSERT INFO Se1/0 Physical Port Administrative State Down
*Dec 11 10:19:21.995: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to down
*Dec 11 10:19:22.023: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Master -> Backup
**************************************
C2#
*Dec 11 10:13:28.343: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Backup -> Master
**************************************
C1(config-if)#do sh vrrp all
FastEthernet0/0 - Group 1
State is Backup
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 90  (cfgd 110)
Track object 1 state Down decrement 20
Authentication text "agus123"
Master Router is 192.168.10.3, priority is 100
Master Advertisement interval is 1.000 sec
Master Down interval is 3.570 sec (expires in 3.198 sec)

C1(config-if)#
**************************************
C2#sh vrrp all
FastEthernet0/0 - Group 1
State is Master
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 100
Authentication text "agus123"
Master Router is 192.168.10.3 (local), priority is 100
Master Advertisement interval is 1.000 sec
Master Down interval is 3.609 sec

C2#
**************************************
C:\>ping 192.168.40.5 -n 5

Pinging 192.168.40.5 with 32 bytes of data:

Reply from 192.168.40.5: bytes=32 time=231ms TTL=126
Reply from 192.168.40.5: bytes=32 time=413ms TTL=126
Reply from 192.168.40.5: bytes=32 time=316ms TTL=126
Reply from 192.168.40.5: bytes=32 time=480ms TTL=126
Reply from 192.168.40.5: bytes=32 time=367ms TTL=126

Ping statistics for 192.168.40.5:
Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 231ms, Maximum = 480ms, Average = 361ms
**************************************
C:\>tracert 192.168.40.5

Tracing route to 192.168.40.5 over a maximum of 30 hops

1   326 ms   121 ms    48 ms  192.168.10.3
2   392 ms   202 ms   207 ms  192.168.30.2
3   544 ms   603 ms   515 ms  192.168.30.2
4   423 ms   256 ms   276 ms  192.168.40.5

Trace complete.

C:\>
**************************************
How to check 6 (no shutdown int s1/0 on C1)
**************************************
C1(config-if)#int s1/0
C1(config-if)#no shut
C1(config-if)#
*Dec 11 10:22:31.627: %LINK-3-UPDOWN: Interface Serial1/0, changed state to up
*Dec 11 10:22:31.627: %ENTITY_ALARM-6-INFO: CLEAR INFO Se1/0 Physical Port Administrative State Down
*Dec 11 10:22:31.635: %TRACKING-5-STATE: 1 interface Se1/0 line-protocol Down->Up
*Dec 11 10:22:32.635: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up
*Dec 11 10:22:33.487: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Backup -> Master
*Dec 11 10:22:43.575: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Serial1/0 from LOADING to FULL, Loading Done
**************************************
C2#
*Dec 11 10:16:47.391: %VRRP-6-STATECHANGE: Fa0/0 Grp 1 state Master -> Backup
**************************************
C1(config-if)#do sh vrrp all
FastEthernet0/0 - Group 1
State is Master
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 110
Track object 1 state Up decrement 20
Authentication text "agus123"
Master Router is 192.168.10.2 (local), priority is 110
Master Advertisement interval is 1.000 sec
Master Down interval is 3.570 sec

C1(config-if)#
**************************************
C2#sh vrrp all
FastEthernet0/0 - Group 1
State is Backup
Virtual IP address is 192.168.10.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption enabled
Priority is 100
Authentication text "agus123"
Master Router is 192.168.10.2, priority is 110
Master Advertisement interval is 1.000 sec
Master Down interval is 3.609 sec (expires in 3.185 sec)

C2#
**************************************
C:\>ping 192.168.40.5 -n 5

Pinging 192.168.40.5 with 32 bytes of data:

Reply from 192.168.40.5: bytes=32 time=441ms TTL=126
Reply from 192.168.40.5: bytes=32 time=427ms TTL=126
Reply from 192.168.40.5: bytes=32 time=594ms TTL=126
Reply from 192.168.40.5: bytes=32 time=863ms TTL=126
Reply from 192.168.40.5: bytes=32 time=324ms TTL=126

Ping statistics for 192.168.40.5:
Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 324ms, Maximum = 863ms, Average = 529ms
**************************************
C:\>tracert 192.168.40.5

Tracing route to 192.168.40.5 over a maximum of 30 hops

1   184 ms   105 ms    82 ms  192.168.10.2
2   332 ms   261 ms   214 ms  192.168.20.2
3   323 ms   344 ms   467 ms  192.168.40.5

Trace complete.

C:\>

kita bisa lihat kalo interface C1 atau C2 down, melalui VRRP ini traffic tetap bisa lewat, asalkan salah satu router C1 atau C2 masih tetap up sebagai master...

referensi dari packetlife.net dan CCIE Bootcamp Indonesia


Diposting oleh di Tidak ada komentar:

Video Zone-Based Firewall Configuration



di video ini, akan menampilkan zone inside dan outside,
INSIDE zone, link antara R2 dan R1dimana fa0/0-R2 (vlan 2, 10.0.0.2/24) dan fa0/0-R1 10.0.0.1/24
OUTSIDE zone, link antara R3 dan R2 dimana fa0/1-R2 23.0.0.2/24 dan fa0/1-R3 23.0.0.3/24....
 pertama membuat class-map CMAP-1...
match protocol tcp, icmp dan udp...
kita buat policy-map PMAP-1, didalamnya kita assign class-map CMAP-1
kita inspect dan kita rate-limit 8000bits...
lalu ditambahkan zone-pair sec inside-to-outside source inside destination outside
masukkan service-policy type inspect PMAP-1...
kita tes ping...
lalu untuk melihat policy-map ini, kita gunakan show policy-map type inspect zone-pair sessions
akan terlihat class-map CMAP-1, match protocol ICMP, akan ada traffic packet yang lewat...

Diposting oleh di Tidak ada komentar:

Selasa, 20 Desember 2011

Contoh Soal QOS





pertanyaan untuk soal ini:
Pada 1.1.3.0/24 di R3 Fa0/0, ada juga subnet 1.1.33.0/24, yang berisi beberapa high bandwidth user. Ada user ....Beberapa user mendapatkan packet yang sangat besar untuk http download via serial1/3....batasi http ke arah 1.1.33.0/24 menjdai 512 kbps...semua configurasi dilakukan di R3

Solution:
R3:
ip access-list extended HTTP_TO_1.1.33
 permit tcp any eq www 1.1.33.0 0.0.0.255
!
class-map match-all HTTP_TO_1.1.33
 match access-group name HTTP_TO_1.1.33
!
policy-map QOS1
 class HTTP_TO_1.1.33
    police 512000
 class class-default
!
interface Serial1/3
 service-policy input QOS1


Konfirmasi untuk jawabannya melalui:
Rack1R3(config-if)#do sh policy-map int            
 Serial1/3

  Service-policy input: QOS1

    Class-map: HTTP_TO_1.1.33 (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: access-group name HTTP_TO_1.1.33
      police:
          cir 512000 bps, bc 16000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

    Class-map: class-default (match-any)
      11 packets, 1088 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any


Diposting oleh di Tidak ada komentar:

Zone Based Firewall Configuration


Pertama kita pisahkan 2 zone, inside dan outside..untuk memastikan zone based ini berjalan
Buat Inside zone dan Outside zone
Router(config)#zone security INSIDE
Router(config)#zone security OUTSIDE
Assign IP addresses dan apply zones to interfaces
Router(config)#interface fa0/0
Router(config-if)#ip address 10.0.1.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#zone-member security INSIDE
Router(config)#interface fa0/1
Router(config-if)#ip address 10.0.2.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#zone-member security INSIDE
Router(config)#interface fa1/0
Router(config-if)#ip address 12.12.12.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#zone-member security OUTSIDE
Define “interesting” traffic with class-map
Router(config)#class-map type inspect match-any CLASS_MAP_IN_TO_OUT
Router(config-cmap)#match protocol icmp
Router(config)#policy-map type inspect POLICY_MAP_IN_TO_OUT
Router(config-pmap)#class type inspect CLASS_MAP_IN_TO_OUT
Router(config-pmap-c)#inspect
class class-default
drop
Router(config)#zone-pair security ZONE_PAIR_IN_TO_OUT source INSIDE destination OUTSIDE
Router(config-sec-zone-pair)#service-policy type inspect POLICY_MAP_IN_TO_OUT
untuk configurasi Zone Based Policy Firewall, kita butuh step berikut :
+ Tentukan zonenya.
+ Tentukan tipe protocol yang ingin kita monitor dengan class-map
+ Tentukan action yang ingin kita lakukan  (drop, permit atau inspect) dengan policy-map.
+ Tentukan arah yang ingin kita aply dengan filterin zone-pair
Contoh ini, kita configurasi:
+ Zones: INSIDE dan OUTSIDE
+ Tipe traffic: icmp (ping)
+ Action: inspect (karena kita tidak ingin allow or deny semua traffic, jadi kita gunakan inspect action
+ Direction: INSIDE to OUTSIDE
Dari sisi Firewall, hanya mengizinkan traffic icmp dari inside ke outside, drop semua traffic yang lain
Sekarang jika kita ping dari PC (inside) ke 12.12.12.2 (Outside), maka policy ini akan bekerja
(INSIDE)#ping 12.12.12.2
!!!!!
tapi jika kita ping dari 12.12.12.2 (outside) ke PC inside, maka akan didrop
(OUTSIDE)#ping 10.0.1.1
…..

info dari link ini --> http://www.securitytut.com/ccna-security-knowledge/cisco-ios-zone-based-firewall-tutorial
Diposting oleh di Tidak ada komentar:

Jumat, 16 Desember 2011

Jadwal CCIE mobile lab 2012

bagi para peserta CCIE Bootcamp Indonesia...
berikut adalah jadwal CCIE mobile Lab

Lab Locations2012 DatesStatusLab
Mexico City, MexicoJan 9 - 13
R
Routing & Switching, Security and Voice
Johannesburg, South AfricaJan 23 - 27
R
Routing & Switching, Security
Bangkok, ThailandJan 30 -Feb  3
R
Routing & Switching, Security
Riyadh, Saudi ArabiaFeb 4 - 8
R
Routing & Switching, Security
Sao Paulo, BrazilFeb 13 - 17
R
Routing & Switching, Security
Cairo, EgyptFeb 19 - 23
R
Routing & Switching, Security
Buenos Aires, ArgentinaMar 5 - 9
R
Routing & Switching, Security and Voice
Moscow, RussiaMar 19 - 23
R
Routing & Switching, Security
Seoul, South KoreaMar 19 - 23
R
Routing & Switching, Security and Voice
Mexico City, MexicoApr 2 - 6
R
Routing & Switching, Security and Voice
Istanbul, TurkeyApr 16 - 20
R
Routing & Switching, Security
Lagos, NigeriaApr 30 - May 4
R
Routing & Switching, Security
Moscow, RussiaMay 14 - 18
R
Routing & Switching, Security
Johannesburg, South AfricaMay 28 - Jun 1
R
Routing & Switching, Security
Singapore, SingaporeJun 4 - 8
R
Routing & Switching, Security and Voice
Rio de Janeiro, BrazilJun 11 - 15
R
Routing & Switching, Security
Toronto, CanadaJun 18-22
R
Routing & Switching, Security and Voice
Warsaw, PolandJun 25 - 29
R
Routing & Switching, Security
Shanghai, PR ChinaJul 23 - 27
R
Routing & Switching, Security


prepare yourself for the LAB....


Diposting oleh di 1 komentar:
Langganan: Postingan (Atom)