IPV6, Things have changed...

Hey Guys,

Hope new years eve is finding you well. While waiting for someone to come and pick me up for a party I have been doing some IPv6 study (I sure do know how to paint the town red don't I ;).)

So, IPv6: It's coming guys. No avoiding it, I recommend if you haven't started reading up on it you better start now.

Bit of a gotcha with that though, ya see a lot of the information out on the Internet at the moment regarding IPv6 is a little outdated. With the IETF feverishly working on the RFC it's getting very hard to get a "Current state" of IPv6

Super Duper Quick Primer on IPv6:

• All Addresses are 128 Bits Long
• The 128 bits are made up of groupings of hexadecimal characters
• You can compress the format of the IPv6 address to make it more readable
• More than one address on an interface is now quite normal
• Broadcast has been done away with
• what bits an address start with now control what "Scope" that address is used for. The Scope defines the "Role" of that address (think loop back, or RFC 1918 addresses)

For me personally, when I did my CCIE in 2007 IPv6 was in quite a diffirent state to what it is now. Here are things that have changed since I started studying it. I hope that you find them useful.


1. Site Local Addressing = Gone

Site Local addressing has been replaced, in its place we now get "Unique Local Addressing" which is essentially the same thing, the major diffirence being what the prefix starts with (FF0C/7)


2. Before they wanted to make it so you could NOT get any address allocations directly for an enterprise, you had to go through an ISP. They have changed that now. you can get Provider indepedent addresses allocated to you should you be able to prove the need. The reason they did not want this at first was because they where worried about how big the routing tables could get if we had tons of ipv6 prefixes floating around instead of being nicely aggregated as they should be.

Thats the two major things I can see so far, I can also see they have dropped most of the IPv6 to IPv4 translation mechanisms, that I will cover later on in my next IPv6 related blog post

Untill next time!

CEF - The Final Frontier

Hi Guys,

Wow been a long time since I have done an update: Sorry about that guys I have been concentrating pretty heavily on two things:

1. Ironport Exam (passed it, got my CICSP woo!)2. Working on something called AXL which is basically a SOAP object for CCM that lets you talk directly to the database: Stay tuned for more info in another blog

3. Weighing up if i should finish my final CCSP Exam so i can get my damn CCSP (Its the NAC exam which is annoying because it is quite difficult to get real-world NAC experience)

Anyway, I think it's important I talk about something pretty low-level in Cisco routers called CEF.

CEF stands for Cisco Express forwarding and is a special algorithm that utilizes the Cisco Hardware ASICS for routing, saving CPU cycles.
(I think the algorithm is called a B-Tree algorithm, if you know the name please post in the comments!)

Has my bland description of CEF bored you yet? It shouldnt: CEF is exceptionally important in how a router makes routing decisions. The Common belief is that a show ip route will tell you exactly where a packet is to be routed, this is not strictly true, although the Cisco router does use the routing table, it only copies this information to the CEF table, which you can see for yourself with show ip cef:

PeterCCIE18371#show ip cef
Prefix Next Hop Interface
0.0.0.0/0 attached Virtual-Access2
attached Dialer1
0.0.0.0/32 receive
10.0.0.0/24 attached FastEthernet0/1
10.0.0.0/32 receive
10.0.0.1/32 10.0.0.1 FastEthernet0/1
10.0.0.2/32 10.0.0.2 FastEthernet0/1
10.0.0.3/32 receive

99.999 percent of the time the routing-table and CEF table will match (except in the instance of policy-maps, which is why the CEF table can be extra useful: you can see what routing decisions where made AFTER your policy-map was applied which you can't always do in the routing table)

However, the CEF table is also extremely useful for debugging hard to troubleshoot problems, For example, a customer of mine had a 837 router that could not be pinged or reached by users on an SSLVPN sitting on an ASA in another part of the customers network.

A policy-map was being used for a nonat statement and had not been updated with the addresses of the ASA SSL VPN Users, so I modified that access-list Everything appeared totally OK according to packet-tracer on the ASA and other debugging tools. After going through things a few times I double checked the cef output

Sure enough, CEF had not updated to reflect the changes in the policy-map and still had a cached entry for that particular IP address, turning CEF off and back on again resolved the issue.

So Top Tip readers: when you look at a problem and your POSITIVE everything is configured the way it should be, don't trust the routing table to tell you what decision the router will be making, check the cef table with show ip cef or show ip cef

Now quickly to talk about another interesting issue: Load Balancing.

As you are probably aware, a Cisco Router can load balance outgoing routes to two different hops. This works as long as your two routes have the same administrative distance and same cost or metric in your routing protocol (except in the case of the EIGRP Variance command)

So, assuming your using static routes for some odd reason and have the administrative distance for both of those routes set to the same value your routing table might look a little something like this:

PeterCCIE18371#show ip route 10.10.10.10
Routing entry for 10.10.10.10/32
Known via "static", distance 1, metric 0
Routing Descriptor Blocks:
10.0.0.71
Route metric is 0, traffic share count is 1
* 10.0.0.70
Route metric is 0, traffic share count is 1

Why has 10.0.0.70 got a little * next to it you might ask? I am glad you ask: This is your indication to let you know what hop the router last took for traffic to that destination, if you see this little asterisk moving between your two next-hops your probably load-balancing reasonably effectively.

The question is, what algorithm is the Cisco router using for this load balancing? How can we determine this? Remember the routing table only tells us about potential routing decisions, it is not the definitive authority on how we will route our packets.. Do you remember what is?

Thats Right CEF

So, if we ask CEF how it is load balancing this route?

PeterCCIE18371#show ip cef 10.10.10.10
10.10.10.10/32, version 7386, epoch 0, per-destination sharing
0 packets, 0 bytes
Flow: Origin AS 0, Peer AS 0, mask 32
via 10.0.0.71, 0 dependencies, recursive
traffic share 1
next hop 10.0.0.71, FastEthernet0/1 via 10.0.0.0/24
valid glean adjacency
via 10.0.0.70, 0 dependencies, recursive
traffic share 1
next hop 10.0.0.70, FastEthernet0/1 via 10.0.0.0/24
valid glean adjacency
0 packets, 0 bytes switched through the prefix
tmstats: external 0 packets, 0 bytes
internal 0 packets, 0 bytes



So now we have a bit more information to work with: The router is using per-destination sharing. While fine for most situations it might not work in your particular requirements, for example what if 10.10.10.10 is another router you have a tunnel to? You have two paths to it but because the destination is always going to be 10.10.10.10 the load-balancing algorithm is never going to utilize the second route!

You have two options, you could turn off ip cef and cisco fast switching completely on the interface with the no ip route-cache and no ip cef interface config and global config commands (this may be your only option on certain platforms) OR you could enable per-packet sharing with the following interface commands:

interface FastEthernet0/1
ip address X.X.X.X secondary
ip address 10.0.0.3 255.255.255.0
ip access-group block_others in
ip accounting output-packets
ip load-sharing per-packet
ip nbar protocol-discovery
ip nat inside
duplex auto
speed auto
fair-queue
end

You must enable this command on EVERY interface that is involved in any load sharing, so for example if you had two interfaces you where load-balancing across you must enable load-sharing per-packet on both interfaces. you can confirm with show ip interface

if we return to our CEF entry, we see the following:

PeterCCIE18371#show ip cef 10.10.10.10
10.10.10.10/32, version 7386, epoch 0, per-packet sharing
0 packets, 0 bytes
Flow: Origin AS 0, Peer AS 0, mask 32
via 10.0.0.71, 0 dependencies, recursive
traffic share 1, current path
next hop 10.0.0.71, FastEthernet0/1 via 10.0.0.0/24
valid glean adjacency
via 10.0.0.70, 0 dependencies, recursive
traffic share 1
next hop 10.0.0.70, FastEthernet0/1 via 10.0.0.0/24
valid glean adjacency
0 packets, 0 bytes switched through the prefix
tmstats: external 0 packets, 0 bytes
internal 0 packets, 0 bytes


There you have it folks, CEF and Load-balancing! Until next time.

Pete

Why the ironport?

ASA Botnet FIlter feature

Hi Guys,

Been a while since I have done an update but i came across something pretty cool i wanted to share: ASA Botnet filter.

This feature (available on all ASA's version 8.2 and above) basically does what it says on the label: Tracks and reports back on any suspicious activity leaving your network that looks like one of your boxes may be infected. It of course is constantly updated with new botnet-like patterns so it should be able to detect all the latest bot's as they come out.

It is a licensed feature but a 30 day trial is available, check out:

http://www.cisco.com/en/US/prod/vpndevc/ps6032/ps6094/ps6120/botnet_index.html

for more details

New Cisco ISR G2 Routers: The Facts Part 1

Cisco ISR G2 Routers

Who what when where why

You have probably heard the fuss regarding Cisco’s release of the next generation of ISR Routers, ISR G2. ISR Routers have been the most successful access routers EVER. Now comes the ISR G2 which appears to be able to continue this success.

Enough marketing talk, plenty of that on cisco.com: Let’s get down to the details on what exactly we are looking at, each article will focus on a different area of the G2, Today we will be looking at

Software Licensing

The software is where the vast majority of the changes to the way you think about Cisco are occurring

First of all, No more separate IOS images per platform: IOS version 15 is a “universal” IOS which means that the same IOS is used across all platforms. What is even more interesting is that this “universal” IOS also comes pre-loaded with all the feature sets (i.e. security etc.) ready to go: They just need to be licensed.

It is also important to note that the different feature sets have been broken up into much smaller and more easily understood sections, rather than ADV IP Services, IP Services, IP Plus etc. etc. the model has been significantly simplified:


A default IP base image is enabled by default and you can then enable the feature sets that you require (SEC, DATA or UC). These are referred to as cisco IOS “Technology packages”

Routers that you have pre-purchased for UC etc will obviously come licensed for that technology package. Just so you know: yes you can enable multiple technology packages at the same time.

How do you license them? With a PAK File, you order the license, a PAK file with a special key number is provided to you, you go to www.cisco.com/go/license and enter in this PAK number along with the unique ID of the router (which is made up of the serial number of the router and the PID)

Once you have done that you are then sent a .lic file that you can then apply to the router. Your done!

It is important to note that while this sounds like a pain in the butt it makes ordering IOS a lot simpler and means you don’t have to worry about downloading a new IOS in order to apply the feature set you want. What’s even cooler is that the concept of temporary licenses allowing you to try a feature for 60 days is now supported.

What about features such as SSL you say, or CCME? These are enabled using a “feature license” which is basically an add-on to a particular technology package, so for example, in order to enable CME feature license you obviously must have a voice feature package license already. There are two types of feature licenses

Subscription Licenses

Subscription licenses are time-based licenses that require the subscriber to periodically renew or the license will expire after an agreed-upon time. Some examples of Subscription license are URL Filtering and IPS.

Counted Licenses

Feature licenses can be either uncounted licenses or counted licenses. Uncounted licenses do not have any count and simply enable the unrestricted feature on the router when activated. Counted licenses enable a defined number of uses e.g. CME User Licenses”