Sunday, December 30, 2012

HSRP vs VRRP vs GLBP



Here, we show the main difference between HSRP, VRRP and GLBP in the following table, which may helpful for CCIE learners.
HSRP
VRRP
- 1 active router.- 1 standby router.- 1   or more listening routers.
- 1 master router.- 1 or more backup routers.
- 1 AVG (Active Virtual Gateway).- up to 4 AVF routers on   the group (Active Virtual Forwarder) passing traffic.- up to 1024 virtual   routers (GLBP groups) per physical interface.
- Use virtual ip address.
- Can use real router ip address, if not,   the one with highest priority become master.
- Use virtual ip address.
Cisco   proprietary
IEEE standard
Cisco proprietary
Active   Router:
Master Router: (*)
Active Virtual Gateway:
1-Highest Priority
1-Highest   Priority
1-Highest   Priority
2-Highest IP (tiebreaker)
2-Highest   IP (tiebreaker)
2-Highest   IP (tiebreaker)
yes
yes
yes
yes
yes
yes
yes
yes
yes
224.0.0.2   – udp 1985 (version1)
224.0.0.18 – IP 112
224.0.0.102 udp 3222
224.0.0.102-udp 1985 (version2)
Hello   – 3 seconds
Advertisement – 1 second
Hello – 3 seconds
(Hold) 10 seconds
(Master Down Interval)3 * Advertisement +   skew time
(Hold) 10 seconds
(Skew time)(256-priority) / 256
-   Multiple HSRP group per interface/SVI/routed int.
- Multiple VRRP group per   interface/SVI/routed int.
Load-balancing oriented- Weighted   algorithm.- Host-dependent algorithm.

- Round-Robin algorithm (default).
Requires appropriate distribution of Virtual GW IP per   Clients for optimal load-balancing.(generally through DHCP)
Requires appropriate distribution of   Virtual GW IP per Clients for optimal load-balancing.(generally through DHCP)
Clients are transparently updated with   virtual MAC according to load-balancing algorithm through ARP requesting a   unique virtual gateway.

More Related Readings:

Monday, December 24, 2012

Private VLANs: VLAN & Switchport Configuration to Layer-3 Connectivity



In this article we will take a look at what is required to configure private VLANs on Cisco equipment. But firstly we need to be clear about what VLAN and private VLAN are.
A Virtual Local Area Network, or VLAN, provides the ability to logically separate a LAN the same way that would be possible with multiple physical switches. For example, if an engineer had four different physical switches, each of the switches could be connected to separate departments within a company. Without an interconnection or a routing device, the devices within each department would not be able to send traffic to each other and would typically be put into different subnets. A VLAN takes this ability to separate devices, but does it logically instead of physically; a separate VLAN can be created for each department and the physical ports that connect these devices can be configured into the correct VLAN. It is important to keep in mind however that the same rules apply to VLANs as physical LANs; that is in order to communicate between them a routing device is required and separate subnets should be assigned to the devices in each VLAN.

The private VLAN feature provides the ability to extend the capabilities of a “standard” VLAN. It does this by introducing some additional concepts: Primary VLAN, Community VLAN and Isolated VLAN. The Primary VLAN should be considered the Master in the master/slave relationship with the other two sub-types. Switch ports assigned within the primary VLAN are able to see traffic from all devices within the primary VLAN and all sub-types (also referred to as secondary VLANs).

Both Community and Isolated VLANs should be considered slaves in the master/slave relationship with the primary VLAN. Switchports assigned to a Community VLAN can see traffic from all other devices in the same Community VLAN and can send traffic back and forth with devices in the primary VLAN. Switchports assigned to an Isolated VLAN can send traffic back and forth with devices in the primary VLAN, but CANNOT see traffic from other devices in the same Isolated VLAN.

It is important to understand that regardless of the VLAN assignment of the switchport, all of the devices will share the same IP subnet; the private VLAN feature just sets up rules as to which devices are able to speak to each other.

Configuration Basics
The first thing that needs to be reviewed is how the concepts of primary, community and isolated VLANs translate to a physical implementation of private VLANs. Switchports that are going to be used by the private VLAN feature are separated into three different categories: Promiscuous, Community, and Isolated. A promiscuous switchport is able to see the traffic from all other promiscuous switchports as well as all secondary switchport types (community and isolated). If the reader has just come from the private VLANs concepts article, the switchports assigned as promiscuous exist within the primary VLAN and map to the secondary VLANs.

VLAN Configuration
The first phase in private VLAN configuration is to set up the VLANs that will be used and assign them to a specific type. It is important to note that one caveat to using the private VLAN feature is it is not compatible with the Virtual Trunking Protocol (VTP); due to this the first thing that must be done is to configure the switch into VTP transparent mode.
Enter privileged mode.
router>enable
Enter global configuration mode
router#configure terminal
Configure VTP Transparent Mode.
router(config)#vtp mode transparent

The next step is to configure the VLANs as specific private VLAN types.
Enter VLAN configuration mode for the secondary VLAN.
router(config)#vlan vlan-id
Configure the VLAN as a private secondary VLAN.
router(config-vlan)#private-vlan [isolated |community]
Enter VLAN configuration mode for the primary VLAN.
router(config-vlan)#vlan vlan-id
Configure the VLAN as a primary VLAN.
router(config-vlan)#private-vlan primary

Once all of the VLANs have been configured, the primary and secondary VLANs must be associated together.
Associate the primary VLAN with secondary VLANs.
The secondary-vlan-list parameter is typically a range (using ‘-‘) or a comma separated list. No spaces are allowed.
router(config-vlan)#private-vlan association [add |removesecondary-vlan-list

Switchport Configuration
The second phase involves the configuration of the physical switchports, what type of privateVLAN they are and how they are associated with the VLANs. This article will show the configuration of the switchports assigned to the secondary private VLANs first.

The first thing to do is to configure the switchport as a host (this includes community and isolated switchports).
Enter interface configuration mode.
router(config-vlan)#interface interface-id
Configure the interface as a host interface.
router(config-if)#switchport mode private-vlan host

The next thing to do is associate the switchport with the primary and secondary VLANs that were configured in the previous section.
Associate the interface with a primary and secondary VLAN
router(config-if)#switchport private-vlan host-association primary-vlan secondary-vlan

The configuration of the switchports in the primary VLAN now has to be completed.
Enter interface configuration mode.
router(config-if)#interface interface-id
Configure the interface as a promiscuous interface
router(config-if)#switchport mode private-vlan promiscuous

This switchport then has to be mapped to all of the associated primary and secondary VLANs.
Associate the interface with a primary VLAN and all secondary VLANs
The secondary-vlan-list parameter is typically a range (using ‘-‘) or a comma separated list. No spaces are allowed.
router(config-if)#switchport private-mode mappingprimary-vlan {add removesecondary-vlan-list

This completes the layer-2 configuration of private VLANs; if only layer-2 connectivity is required then the next section is not required.

Layer-3 Connectivity
As with a normal VLAN, private VLANs will only allow communications within the configured VLANs (according to the private VLAN rules), but to speak to devices outside this VLAN structure a layer-3 device is required. In many situations, this layer-3 functionality is also provided by the switch (assuming this is a layer-3 capable switch). This section shows the additional configuration that is required to have the switch provide layer-3 functionality to the switchports configured with theprivate VLAN feature.

This additional configuration is simple and just adds a single configuration command to the primary VLAN interface.
Enter VLAN (SVI) interface configuration mode.
router(config)#interface vlan primary-vlan-id
Associate the secondary VLANs with the SVI.
The secondary-vlan-list parameter is typically a range (using ‘-‘) or a comma separated list. No spaces are allowed.
router(config-if)#private-vlan mapping {add remove}secondary-vlan-list

Once an engineer has a firm understanding of private VLAN concepts it is rather simple to translate this understanding to the configuration portion of private VLANs. There are a number of different applications for the private VLAN feature that an engineer can take advantage of, and hopefully these two articles will make it easier to understand how they can be put to use.

More Network and Cisco Tips:

Friday, December 21, 2012

Router OSPF Overview-Section 2



This is Part 2 of the Router OSPF Serieswhich will cover topics about OSPF Areasand OSPF LSA’s. Before continuing on I recommend reading Part 1 of the Router OSPF Series which gives an introduction on the topic.

For the ICND2 and CCNA exam you will only need to configure a single area OSPF implementation, but you will still be required to know many different things about a full multi-area OSPF network.
OSPF is a link-state routing protocol that stores a complete topology map of the network it is in. In order for OSPF to know where the shortest routes are to each network it has to calculate it off of the topology map using the Dijkstra algorithm every time there is a change in the network. This process can take up a lot of CPU cycles and slow down the routing process if there are many routers. In order for OSPF to be able to scale well in larger network situations with a lot of routers it uses Areas to logically break up the network.

OSPF Router Types
Backbone Router – Every OSPF implementation must have a backbone area. The backbone area will always be area 0. A Backbone router is any router that has an interface connected to area 0.
Area Border Router (ABR) – Are routers that have on interface in area 0 and another interface in a different area. ABR’s sit between the two areas. All ABR’s are backbone routers because they have an interface connected to area 0.
Autonomous System Boundary Router (ASBR) – Share information with other routers that are not running OSPF.
Internal Router – Are routers that are not area border routers. They simply are routers running OSPF, but are not passing information between areas.

Here is an example of a network with multiple OSPF areas so that you can visually see the different OSPF router roles amongst the areas.
Types of OSPF Areas
Backbone Area – This area is also known as the standard area. Every OSPF implementation has to have one. Backbone areas accept all types of LSA’s.
Stub Area – Will only receive summary LSA’s. Routing LSA’s are NOT allowed.
Totally Stubby Area – Absolutely no LSA’s are allowed.
Not So Stubby Area (NSSA) – This is a stub area that has a ASBR router that receives information from another routing protocol other than OSPF and passes it into the OSPF network.

OSPF LSA Types
There are seven different types of Link-State advertisements that OSPF routers pass around to check up on each other. When you type “show ip route” on a Cisco router to see the routing table, ospf entries will show up with the letter “o” in front. There are also many different variations that will show up in the routing table depending on the LSA type.
LSA Type 1: “O” — Intra-Area — Passed around inside an area
LSA Type 2: “O 1A — Inter-area — Pass through an area
LSA Type 3: Summary LSA by an ABR
LSA Type 4: Summary LSA to an ASBR
LSA Type 5: “O E1″ or “O E2″ — From an ASBR about external links
LSA Type 6: This is a Groupe Membership Link LSA that is sent out by multicast OSPF Routers
LSA Type 7: “O N1″ or “O N2″ — These are NSSA external routes from an ASBR

Well, I Think that is quite a bit of OSPF information for today. Tomorrow I’m actually going to show you how to configure OSPF since we still haven’t gone over that yet.

More OSPF Reviews: