A few words about CCNP ROUTE 642-902 exam. This is the first one of three qualifying exams for CCNP, CCIP and CCDP. If you plan to become one of those certifications you must take 642-902 (the possibility to take the composite CCNP exam is also opened). Cisco ROUTE exam contains detailed information regarding implementing of EIGRP, BGP, OSPF dynamic routing protocols, redistribution between different protocols, filtering, summarization/aggregation and a lot of related stuff. You can read more at Cisco Learning Center.

Main Preparation Materials

• Implementing Cisco IP Routing (ROUTE) Foundation Learning Guide [ref]
• CCNP ROUTE 642-902 Official Certification Guide [ref]
• CCNP ROUTE 642-902 Quick Reference Guide
• CCNP ROUTE Portable Command Guide [ref]

Lab Simulations

I’ve been using the only available emulation software of this kind: dynamips. There are a lot of information available about it around the web. Meantime it is worth to say that Packet Tracer’s functionality is far not enough to complete labs coming with CCNP ROUTE so using of dynamips is mandatory. It is clear that every lab include more than three routers in it so you should be able to interconnect devices between each other using different kinds of connection e.g. Serial or FastEthernet. I used GNS3 for this purpose and it did its job perfectly.

Cisco CCNP ROUTE Cheet Sheets

Before actually to take an exam it makes sense to sum everything up in your mind so you should us cheat sheets for this purpose. I’ve been using Cisco cheat sheets which were prepared by Jeremy from www.packetlife.com, here are the direct links to them:

• Interior Routing Protocols
• BGP
• EIGRP
• IPv6
• OSPF
• RIP
• IPv4 ACLs
• NAT

Good luck!

No dynamic routing protocols are used by ISPs but only static routing. The primary task is to ensure quick failover between two Internet connections so LAN users are automatically switched to ISP_2 if ISP_1 fails and vice versa. When both ISP_1 and ISP_2 are online the traffic of LAN users should be shared between two links to double available bandwidth on uplink (Tx) and downlink (Rx), in other words the router should be configured for load balancing between the links. You can see a network diagram below:

Load balancing setup description

There are two basic options available: per-destination or per-packet load balancing. Since ISP_1 and ISP_2 connections have almost the same link characteristics including delay, jitter and bandwidth, it is reasonable idea to pick per-packet option. In comparison to per-destination load balancing approach per-packet uses more router’s hardware resources but makes it possible to share traffic between connections more evenly. For better forwarding performance the router will be configured for Cisco Express Forwarding or simply CEF per-packet load balancing.

Failover description

Every 30 seconds the router will ping two IP addresses through ISP_1 and two other IP addresses via ISP_2. If both IPs via ISP_1 becomes unreachable (we assume that ISP_1 connection fails in this case) the router will delete ISP_1’s route from its routing table so ISP_2 becomes the only Internet connection for LAN users. Meantime the router still continues pinging two ISP_1’s IP addresses and once they become reachable back ISP_1 is added to ISP_2 as an active Internet connection link. Such failover scenario works in absolutely the same way for ISP_2. Usually this is reasonable idea to ping IP addresses of each provider’s DNS servers when monitoring availability of each ISP.

Miscellaneous details

Notice that CEF per-packet load balancing requires IOS version of 12.0+ while failover setup described above needs 12.4+ IOS version so you have to make sure your Cisco router runs at least 12.4 version of operating system. E.g. c7200-ik9o3s-mz.124-12c.bin would be ok.

Cisco router’s configuration with comments

! This line enables Cisco Express Forwarding (CEF)
ip cef
!
ip sla monitor 1
 type echo protocol ipIcmpEcho 10.0.0.100 source-interface FastEthernet0/0
 ! IP address 10.0.0.100 is primary DNS of ISP_1
 timeout 1000
 threshold 250
 frequency 30
ip sla monitor schedule 1 life forever start-time now
ip sla monitor 2
 type echo protocol ipIcmpEcho 10.0.0.101 source-interface FastEthernet0/0
 ! IP address 10.0.0.101 is secondary DNS of ISP_1
 timeout 1000
 threshold 250
 frequency 30
ip sla monitor schedule 2 life forever start-time now
!
!
ip sla monitor 3
 type echo protocol ipIcmpEcho 20.0.0.100 source-interface FastEthernet0/1
 ! IP address 20.0.0.100 is primary DNS of ISP_2
 timeout 1000
 threshold 250
 frequency 30
ip sla monitor schedule 3 life forever start-time now
ip sla monitor 4
 type echo protocol ipIcmpEcho 20.0.0.101 source-interface FastEthernet0/1
 ! IP address 20.0.0.101 is primary DNS of ISP_2
 timeout 1000
 threshold 250
 frequency 30
ip sla monitor schedule 4 life forever start-time now
!
!
track 1 rtr 1 reachability
track 2 rtr 2 reachability
track 3 rtr 3 reachability
track 4 rtr 4 reachability
!
! Tracker for ISP_1
track 10 list boolean or
 object 1
 object 2
!
! Tracker for ISP_2
track 20 list boolean or
 object 3
 object 4
!
! Interface connected to ISP_1
interface FastEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 ip load-sharing per-packet
 duplex auto
 speed auto
!
! Interface connected to ISP_2
interface FastEthernet0/1
 ip address 20.0.0.2 255.255.255.0
 ip load-sharing per-packet
 duplex auto
 speed auto
!
! Interface connected to LAN
interface FastEthernet1/0
 ip address 192.168.100.2 255.255.255.0
 ip load-sharing per-packet
 duplex auto
 speed auto
!
! Two equal cost static routes to ISP_1 and ISP_2
ip route 0.0.0.0 0.0.0.0 10.0.0.1 track 10
ip route 0.0.0.0 0.0.0.0 20.0.0.1 track 20
!

Netflow is the protocol developed by Cisco to manage data about IP traffic. In a few words using Netflow you can collect data about all IP data send/received on multiple Cisco/Linux/BSD/Juniper hosts and send it to central Netflow collector that will show you the nice graphs and also will allow to have a complete picture of what data was sent/received on those hosts (including destination and source IP, port, bytes transfered, int/out interfaces etc). Nfdump is netflow collector. Nfsen is graphical tools for generating graphs and querying Nfdump for historical traffic reports. In this article you will see how to deploy all this staff in Linux.

Netflow probe is required to collect IP traffic data on Linux host. In general this piece of sofware will sit in background, store every network activity on certain network interface and then send collected data to Netflow collector nfdump. As Netflow probe I prefer fprobe that is totally simple application that just does its job. If you feel that fprobe is not what you need or there are some problems with installing it you can try softflowd that can do the same job.

Install fprobe from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/fprobe/files/fprobe/1.1/fprobe-1.1.tar.bz2/download
tar -xvjf fprobe-1.1.tar.bz2
cd fprobe-1.1
./configure --prefix=/
make
make install

Point fprobe to one of network interfaces of Linux host and make it to send data to Netflow collector:

fprobe -i eth0 11.22.33.44:23456

In above example fprobe stores all data trasnfers on eth0 network interface and sends collected data to 11.22.33.44 host via 23456 UDP port (you may want to change firewall rules to make Netflow working over 23456 UDP port).

Install nfdump Netflow collector from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.2/nfdump-1.6.2.tar.gz/download
tar -xvzf nfdump-1.6.2.tar.gz
cd nfdump-1.6.2
./configure --prefix=/ --enable-nfprofile
make make
install

When finished Netflow collector becomes ready so you can start capturing traffic from Netflow probe. If you don’t need any graphical tools like nfsen described below you can just start collector and save Netflow data in /var/neflow/ directory (THIS STEP IS OPTIONAL):

/bin/nfcapd -w -D -p 23456 -B 200000 -S 1 -z -I Linux-Host-1-eth0 -l /var/netflow/

In order to install nfsen from sources you have to get all its prerequisites, run one of below lines depending on what Linux distro you’re using (1st line is for Fedora, Centos, Redhat while 2nd line is for Ubuntu, Debian, Mint and similar):

yum install rrdtool rrdtool-devel rrdutils perl-rrdtool -y

or

aptitude install rrdtool librrd2-dev librrd-dev librrd4 librrds-perl librrdp-perl

Compile nfsen from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.5/nfsen-1.3.5.tar.gz/download
tar -xvzf nfsen-1.3.5.tar.gz
cd nfsen-1.3.5
cp etc/nfsen-dist.conf etc/nfsen.conf

In order to continue the installation you should edit file etc/nfsen.conf to specify where to install nfsen, web server’s username (yes, you have to install apache, lighttpd, nginx or any other web server first), its document root directory etc. The major section of that config file is ‘Netflow sources’ that must list all hosts you’ve started Netflow probes at. Here is an example section for monitoring above Linux host:

%sources = (
    'Linux-Host-eth0'    => { 'port' => '23456', 'col' => '#ff0000', 'type' => 'netflow' },
);

When finished it’s time to actually install nfsen using installation script:

./install.pl etc/nfsen.conf

In case of successful installation you will be notified with corresponding congratulations message so it would be proper time to start nfsen daemon:

/path/to/nfsen/bin/nfsen start

Now you can open http://localhost/nfsen/nfsen.php at Linux host where nfsen was installed to start using this Netflow tool and see some graphs. Notice that it takes about 5-10 minutes to see first bars at the graphs, if the graphs are still empty you will have to check at least the following:

1. If fprobe is able to communicate to Netwflow collector and can send Netflow data to it (use ‘ps ax | grep fprobe’ and Linux host being monitored and tcpdump tool at Netflow collector).
2. If Netflow collector is started and can receive data from Netflow probe. Use ‘ps ax | grep nfcapd’ and tcpdump at Netflow collector Linux host.

If you can add anything — feel free to drop a comment below.

Below is beginner’s guide that helps to quickly deploy netflow collector and visualizer under Linux and impress everybody by cute and descriptive graphs like these:

It is highly recommended to look through Netflow basics to get brief understanding of how it works before configuring anything. For example, here is Cisco’s document that gives complete information about Netflow. In a few words to get started you should enable netflow exporting on Cisco router and point it to netflow collector running under Linux. Exported data will contain complete information about all packets the router has received/sent so nfdump and nfsen working under Linux will collect it and visualize to present you the graph like above example.

Cisco Router Setup

1. Enable flow export on ALL Cisco router’s interfaces that send and receive some traffic, here is an example:

Router1# configure terminal
Router1(config)#interface FastEthernet 0/0
Router1(config-if)#ip route-cache flow input
Router1(config-if)#interface FastEthernet 0/1
Router1(config-if)#ip route-cache flow input
...

2. Setup netflow export:

Router1# configure terminal
Router1(config)#ip flow-export source FastEthernet0/0
Router1(config)#ip flow-export source FastEthernet0/1
Router1(config)#ip flow-export version 5
Router1(config)#ip flow-export destination 1.1.1.1 23456

Where 1.1.1.1 is IP address of Linux host where you plan to collect and analyze netflow data. 23456 is port number of netflow collector running on Linux.

Linux Setup

1. Download and install nfdump.

cd /usr/src/
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.2/nfdump-1.6.2.tar.gz/download
tar -xvzf nfdump-1.6.2.tar.gz
cd nfdump-1.6.2
./configure --prefix=/ --enable-nfprofile
make
make install

2. Download and install nfsen.

It requires web server with php module and RRD so make sure you have the corresponding packages installed. I hope you’re running httpd with php already so below are rrd/perl related packages installation hints only.

Fedora/Centos/Redhat users should type this:

yum install rrdtool rrdtool-devel rrdutils perl-rrdtool

Ubuntu/Debian:

aptitude install rrdtool librrd2-dev librrd-dev librrd4 librrds-perl librrdp-perl

If you run some exotic Linux distribution just install everything that is related to rrd + perl.

At last, nfsen installation:

cd /usr/src/
wget http://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.5/nfsen-1.3.5.tar.gz/download
tar -xvzf nfsen-1.3.5.tar.gz
cd nfsen-1.3.5
cp etc/nfsen-dist.conf etc/nfsen.conf

In order to continue you should edit file etc/nfsen.conf to specify where to install nfsen, web server’s username, its document root directory etc. That file is commented so there shouldn’t be serious problems with it.

One of the major sections of nfsen.conf is ‘Netflow sources’, it should contain exactly the same port number(s) you’ve configured Cisco with — recall ‘ip flow-export …’ line where we’ve specified port 23456. E.g.

%sources = (
    'Router1'    => { 'port' => '23456', 'col' => '#0000ff', 'type' => 'netflow' },
);

Now it’s time to finish the installation:

./install.pl etc/nfsen.conf

In case of success you’ll see corresponding notification after which you will have to start nfsen daemon to get the ball rolling:

/path/to/nfsen/bin/nfsen start

From this point nfdump started collecting netflow data exported by Cisco router and nfsen is hardly working to visualize it — just open web browser and go to http://linux_web_server/nfsen/nfsen.php to make sure. If you see empty graphs just wait for a while to let nfsen to collect enough data to visualize it.

That’s it!

Anyways sometimes Packet Tracer as like as dynamips/gns3 are not a panacea when it’s necessary to emulate mid-sized network or test some specific ios features on real Cisco devices. There are several options: the first and the easiest one means to buy Cisco device. But we all know that Cisco’s pricing policy is far away from democratic in application to individual users so even used or refurbished Cisco router/switch will cost enough to think about another option. Second option is to schedule access to Community Lab at packetlife.net. Nice to know the access to it is absolutely free so anyone can get logon to Cisco routers, switches or ASAs once user reached his/her timeslot. Here is the list of hardware you can have access to (there are multiple devices of the same model):

Cisco ASA 5505
Cisco 2811 (2xWIC-2T)
Cisco 1841 (1xWIC-2T)
Cisco Catalyst 3550-24

Not bad for free lab as for me. The lab is broken into two blocks so user can reserve only one block or both blocks simultaneously. This is to make it possible to access the lab by multiple users simultaneously. Devices are connected to each other according to predefined topology — see separate diagrams for Ethernet and Serial connections below (they are split to prevent overhead on the graph I guess). All documentation as well as FAQs can be found here: here and here. Thanks to Jeremy Stretch.

P.S. By the way if you can share any other similar labs allowing people on the web to access Cisco (or some other networking devices) — you are welcome to share this information here. Thanks!

GRE setup example topology

R1’s startup-config (part of it)

!

hostname R1
!
interface Tunnel0
description GRE tunell to R2
ip address 192.168.200.1 255.255.255.0
tunnel source 123.123.0.10
tunnel destination 123.123.1.10
!
interface FastEthernet 1/0
ip address 10.0.0.1 255.255.255.0
!
interface Serial1/0
ip address 123.123.0.10 255.255.255.0
serial restart-delay 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 123.123.0.1
ip route 10.1.1.0 255.255.255.0 192.168.200.2
!

R2’s startup-config (part of it)

!

hostname R2
!
interface Tunnel0
description GRE tunnel to R2
ip address 192.168.200.2 255.255.255.0
tunnel source 123.123.1.10
tunnel destination 123.123.0.10
!
interface FastEthernet 1/0
ip address 10.1.1.1 255.255.255.0
!
interface Serial1/0
ip address 123.123.1.10 255.255.255.0
no fair-queue
serial restart-delay 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 123.123.1.1
ip route 10.0.0.0 255.255.255.0 192.168.200.1
!

Results

R2#ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/17/28 ms

R3#ping 10.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/20/44 ms

1. Cisco IOS Versions what’s this?)
2. Physical Terminations/Connectors (what’s this?)
3. VLANs (what’s this?)
4. Quality of Service (what’s this?)
5. MPLS (what’s this?)
6. IP Access Lists what’s this?)
7. Spanning Tree (what’s this?)
8. OSPF (what’s this?)
9. EIGRP (what’s this?)
10. BGP (what’s this?)

11. General Cisco IOS cheat sheet (router/switch commands etc.)
12. Cisco Commands for Beginners
13. Descriptive list of Cisco Commands (fresh)
14. Cisco IOS Firewall Cheat Sheet (Official Design Guide)
15. Cisco – Ethernet Encapsulation (in pdf)
16. Mini CCNA Cheat Sheet
17. CCNA Cheat Sheet (commands debugging)
18. Connector Pinouts Cheat Sheets

Great thanks to Jeremy Stretch (author of packetlife.net) for the first 10 cheat sheets from above list (to get them all just download this package).

Information improvisation: You can get your 000-152 and 70-293 exam within days using latest 642-974 and other resources of 1z0-515 exam certifications; you can get a wonderful JN0-343 booklet.

Here is a piece of shell code that allows to export ipcad output into sqlite3 database format:

echo "create table traffic (src, dst, pkt, bt);" | sqlite3 /tmp/throttle.db
rsh 127.0.0.1 show ip accounting | grep "^ " | grep -vi source | awk \
'{print"insert into traffic values (\""$1"\",\""$2"\",\""$3"\",\""$4"\");"}' \
| sqlite3 /tmp/throttle.db


To make this working ipcad should be configured not to capture ports and to enable rsh service. In my case ipcad has the following settings set in ipcad.conf:

capture-ports disable;
interface eth0;
rsh enable at 127.0.0.1;
rsh 127.0.0.1 admin;
rsh ttl = 3;
rsh timeout = 30;
pidfile = /var/run/ipcad.pid;
memory_limit = 100m;


and output (rsh 127.0.0.1 show ip accouting) is like:

192.168.0.7      192.168.0.1                 113241           166387462
192.168.0.1      192.168.0.7                  72117             4282846
192.168.0.77     66.235.184.245                2448              821095
66.235.184.245   192.168.0.77                  3995              697371

The main problem is that it sqlite3 is rather slow and it takes eleven (11!!!) seconds to export 1000 entries of ipcad’s output into database. This was got at PC with 1.4Ghz CPU and 512Mb RAM.

If anybody knows how to get it faster, PLEASE LET ME KNOW! Thanks.

Information Improvisation: Traffic Engineering Server is new Solution for Bandwidth Management and QoS. It’s especially suitable for Broadband ISPs and SMEs.