休伯利安

Keeping Topology Drawings Clean
By stretch | Wednesday, April 13, 2011 at 1:00 a.m. UTC


People often try to cram too much information onto a network topology drawing, which results in cluttered diagrams that are difficult to follow. While it is commendable to want to convey every detail of a network's architecture, these details can be arranged in two categories: things that go on a topology drawing, and things that go on a spreadsheet. The difference between the two can be determined by keeping in mind the purpose of a topology drawing, which is simply to convey how packets flow across a network. Details which aren't needed to support this function belong on a spreadsheet or in some similar database.
Below are my personal recommendations regarding what goes where. Your own approach might differ somewhat but these rules have worked well for me.
Topology Drawing

Device ID. This is usually a hostname. Leave off any domain suffixes. Avoid generic labels like "gateway router" or "firewall."
Link prefixes. Routed links are typically labeled with their respective IP subnets. Depending on the scope of the drawing, it may also be desirable to label device interface addresses.
VLANs. Layer two trunks might be labeled with the VLANs they carry, if appropriate.
Interface IDs. Label physical and logical interfaces with their abbreviated forms, e.g. F0/0 instead of FastEthernet0/0 (or Fa0/0 if it is necessary to distinguish between FastEthernet and FDDI interfaces).
Circuit IDs. When depicting a link through a service provider, always include its circuit ID.
Link bandwidth. Bandwidths are typically conveyed by color-coding links with contrasting colors (for example, don't use orange and yellow where they might be confused). Avoid explicitly labeling the bandwidth of links except where particularly of interest (for example, WAN circuits).
Device Spreadsheet

Device ID. This should exactly match what's on the drawing. May include domain suffix (preferably in a separate column for easier readability).
Management IP address. This should be a loopback or other virtual interface that will remain reachable so long as there is at least one functional path to the device. (If you haven't designated management addresses for all of your devices, fix that first, then come back to the drawing.)
Serial number. Necessary for accounting and inventory purposes.
Make and model. Manufacturer and model number, e.g. Cisco 1841.
Software version. E.g. Cisco IOS 12.4(25)T.
Miscellaneous. Installed modules, deployment date, notes, etc.
You might also opt to include a spreadsheet containing per-link details. This should be a sheet or table separate from your device spreadsheet. It should include all the relevant details from the topology drawing (IP prefixes, device and interface IDs, bandwidth) plus whatever additional information you care to add.
原帖地址：http://packetlife.net/blog/2011/apr/13/keeping-topology-drawings-clean/

[/img]..

 
Understanding OSPF External Route Path Selection
 

by Brian McGahan, CCIE #8593




Hi Brian,
What is the major difference in using an E1 route over an E2 route in OSPF?
From what I’ve observed, if you redistribute a route into OSPF either E1 or E2, the upstream router will still use the shortest path to get to the ASBR regardless of what is shown in the routing table.
The more I read about this, the more confused I get. Am I missing something?
Matt

Hi Matt,
This is actually a very common area of confusion and misunderstanding in OSPF. Part of the problem is that the vast majority of CCNA and CCNP texts teach the theory that for OSPF path selection of E1 vs E2 routes, E1 routes use the redistributed cost plus the cost to the ASBR, while with E2 routes only use the redistributed cost. When I just checked the most recent CCNP ROUTE text from Cisco Press, it specifically says that “[w]hen flooded, OSPF has little work to do to calculate th..

                                 先学习理解一下帧的封装格式：



需要注意的是，区别两种帧封装格式：802标准帧和以太网帧
1，在802标准定义的帧格式中，长度字段是指它后续数据的字节长度，但不包括C R C检验码。RFC 1042（IEEE 802）
2，RFC 894（以太网）
所以，以太网帧报头为目的地址6+源地址6+类型2+CRC 4=18bytes
而802帧没有CRC，所以为14bytes。Sniffer采用的是802帧为14bytes
 
转载文章：
MTU: Maxitum Transmission Unit 最大传输单元



MSS: Maxitum Segment Size 最大分段大小
 
由于以太网EthernetII最大的数据帧是1518Bytes这样，刨去以太网帧的帧头（DMAC目的地址MAC48bit=6Bytes+SMAC源MAC地址48bit=6Bytes+Type域2bytes）14Bytes和帧尾CRC校验部分4Bytes（这个部门有时候大家也把它叫做FCS），那么剩下承载上层协议的地方也就是Data域最大就只能有1500Bytes. 这个值我们就把它称之为MTU。
 
以太网的MTU是1500，再减去PPP的包头包尾的开销（8Bytes），就变成1492。
 
MSS就是TCP数据包每次能够传输的最大数据分段。为了达到最佳的传输效能
TCP协议在建立连接的时候通常要协商双方的MSS值，这个值TCP协议在实现的
时候往往用MTU值代替（需要减去IP数据包包头的大小20Bytes和TCP数据段的
包头20Bytes）所以往往MSS为1460。通讯双方会根据双方提供的MSS值得最小
值确定为这次连接的最大MSS值。
 
先说说这MTU最大传输单元，这个最大传输单元实际上和链路层协议有着密切的关系，让我们先仔细回忆一下EthernetII帧的结构DMAC+SMAC+Type+Data+CRC。由于以太网传输电气方面的限制，每个以太网帧都有最小的大小64bytes，最大不能超过1518bytes，对于小于或者大于这个限制的以太网帧我们都可以视之为错误的数据帧，一般的以太网转发设备会丢弃这些数据帧。（注：小于64Bytes的数据帧一般是由于以太网冲突产生的“碎片”或者线路干扰或者坏的以太网接口产生的，对于大于1518Bytes的数据帧我们一般把它叫做Giant帧，这种一般是由于线路干扰或者坏的以太网口产生）
 
由于以太网EthernetII最大的数据帧是1518Bytes这样，刨去以太网帧的帧头（DMAC目的MAC地址48bit=6Bytes+SMAC源MAC地址48bit=6Bytes+Type域2bytes）14Bytes和帧尾CRC校验部分4Bytes（这个部门有时候大家也把它叫做FCS），那么剩下承载上层协议的地方也就是Data域最大就只能有1500Bytes这个值我们就把它称之为MTU。这个就是网络层协议非常关心的地方，因为网络层协议比如IP协议会根据这个值来决定是否把上层传下来的数据进行分片。就好比一个盒子没法装下一大块面包，我们需要把面包切成片，装在多个盒子里面一样的道理。
 
当两台远程PC互联的时候，它们的数据需要穿过很多的路由器和各种各样的网络媒介才能到达对端，网络中不同媒介的MTU各不相同，就好比一长段的水管，由不同粗细的水管组成（MTU不同 :)）通过这段水管最大水量就要由中间最细的水管决定。
 
对于网络层的上层协议而言（我们以TCP/IP协议族为例）它们对水管粗细不在意它们认为这个是网络层的事情。网络层IP协议会检查每个从上层协议下来的数据包的大小，并根据本机MTU的大小决定是否作“分片”处理。分片最大的坏处就是降低了传输性能，本来一次可以搞定的事情，分成多次搞定，所以在网络层更高一层（就是传输层）的实现中往往会对此加以注意！有些高层因为某些原因就会要求我这个面包不能切片，我要完整地面包，所以会在IP数据包包头里面加上一个标签：DF（Donot Fragment）。这样当这个IP数据包在一大段网络（水管里面）传输的时候，如果遇到MTU小于IP数据包的情况，转发设备就会根据要求丢弃这个数据包。然后返回一个错误信息给发送者。这样往往会造成某些通讯上的问题，不过幸运的是大部分网络链路都是MTU1500或者大于1500。
 
对于UDP协议而言，这个协议本身是无连接的协议，对数据包的到达顺序以及是否正确到达不甚关心，所以一般UDP应用对分片没有特殊要求。
 
对于TCP协议而言就不一样了，这个协议是面向连接的协议，对于TCP协议而言它非常在意数据包的到达顺序以及是否传输中有错误发生。所以有些TCP应用对分片有要求---不能分片（DF）。
 
花开两朵，各表一枝，说完MTU的故事我们该讲讲今天的第二个猪脚---PPPoE所谓PPPoE就是在以太网上面跑PPP协议，有人奇怪了，PPP协议和Ethernet不都是链路层协议吗？怎么一个链路层跑到另外一个链路层上面去了，难道升级成网络层协议了不成。其实这是个误区：就是某层协议只能承载更上一层协议。
为什么会产生这种奇怪的需求呢？这是因为随着宽带接入（这种宽带接入一般为Cable Modem或者xDSL或者以太网的接入）由于以太网缺乏认证计费机制而传统运营商是通过PPP协议来对拨号等接入服务进行认证计费的，所以就出了这么一个怪胎：PPPoE。（有关PPPoE的详细介绍参见V大以及本站其他成
员的一些介绍文章，我就不啰里啰唆的了）
 
PPPoE带来了好处，也带来了一些坏处，比如：二次封装耗费资源，降低了传输效能等等，这些坏处俺也不多说了，最大的坏处就是PPPoE导致MTU变小了以太网的MTU是1500，再减去PPP的包头包尾的开销（8Bytes），就变成1492。
 
如果两台主机之间的某段网络使用了PPPoE那么就会导致某些不能分片的应用无法通讯。
 
这个时候就需要我们调整一下主机的MTU，通过降低主机的MTU，这样我们就能够顺利地进行通讯了。
 
当然对于TCP应用而言还有另外的解决方案。马上请出今天第三位猪脚：MSS。
MSS最大传输大小的缩写，是TCP协议里面的一个概念。MSS就是TCP数据包每次能够传输的最大数据分段。为了达到最佳的传输效能TCP协议在建立连接的时候通常要协商双方的MSS值，这个值TCP协议在实现的时候往往用MTU值代替（需要减去IP数据包包头的大小20Bytes和TCP数据段的包头20Bytes）所以往往MSS为1460。通讯双方会根据双方提供的MSS值得最小值确定为这次连接的最大MSS值。
 
 
我们回过头来看前言里面的那个问题，我们试想一下，如果我们在中间路由器上把每次TCP连接的最大MSS进行调整这样使得通过PPPoE链路的最大MSS值加上数据包头包尾不会超过PPPoE的MTU大小1492这样就不会造成无法通讯的问题。
 
所以上面的问题可以通过ip tcp adjust-mss 1452来解决。
 
当然问题也可以通过修改PC机的MTU来解决。
 
[后记]
Cisco在IOS 12.2(4)T及以后的版本支持修改MSS大小的特性
 
Cisco的TCP Adjust MSS Feature：
 
The TCP MSS Adjustment feature enables the configuration of the
maximum segment size (MSS) for transient packets that traverse a router,
specifically TCP segments in the SYN bit set, when Point to Point Protocol
over Ethernet (PPPoE) is being used in the network. PPPoE truncates the
Ethernet maximum transmission unit (MTU) 1492, and if the effective MTU
on the hosts (PCs) is not changed, the router in between the host and the
server can terminate the TCP sessions. The ip tcp adjust-mss command
specifies the MSS value . the intermediate router of the SYN packets to
avoid truncation. 
附：MS文章---路径最大传输单元 (PMTU) 黑洞路由器
当路由器必须将 IP 包分段但又因 DF 标记设置为 1 而不能分段时，路由器可采用以下任一种方式：




•


发送符合 RFC 792 中最初定义的“ICMP Destination Unreachable-Fragmentation Needed and DF Set”消息，然后丢弃该包。
原始消息格式中不包含有关转发失败的链路的 IP MTU 的信息。




•


发送符合 RFC 1191 中重新定义的“ICMP Destination Unreachable-Fragmentation Needed and DF Set”消息，然后丢弃该包。此新消息格式包含一个 MTU 字段，可指出转发失败的链路的 IP MTU。
RFC 1191 定义了路径 MTU (PMTU) 发现，它使得成对的 TCP 对等方能够动态地发现二者之间路径的IP MTU，从而发现该路径的 TCP MSS。一旦收到符合 RFC 1191 定义的“Destination Unreachable-Fragmentation Needed and DF Set”消息，TCP 就会将该连接的 MSS 调整为指定 IP MTU 减去 TCP 和 IP 报头的大小。这样，在该 TCP 连接上发送的后续包就不会超过最大大小，无需分段即可在该路径上传输。




•


直接丢弃包。
直接丢弃需分段但 DF 标记设置为 1 的包的路由器称为 PMTU 黑洞路由器。




 
PMTU 黑洞路由器会给 TCP 连接带来问题。例如，Microsoft® Windows® XP 和 Windows Server™2003 中的 TCP/IP 协议默认情况下会使用 PMTU 发现。TCP 会发送 DF 标记设置为 1 的数据段，并且在需要时，会根据符合 RFC 1191 定义的“ICMP Destination Unreachable-Fragmentation Needed and DF Set（ICMP Type 3 Code 4）”消息的回执（其中包含 IP MTU），更改 TCP MSS值。
 
在 TCP 三次握手期间交换的 TCP 数据段不会太大，因而不会被 PMTU 黑洞路由器丢弃。但是，一旦开始在连接上传输数据—假定基于协商的 MSS 确定的 PMTU 比实际 PMTU 大—TCP 数据段的大于实际 PMTU的 IP 包就会被直接丢弃。
例如，您可以用 FTP 命令行工具成功地与 FTP 服务器建立连接并登录。但是，当您试图下载或者上载文件时，中间的 PMTU 黑洞路由器就会丢弃达到最大大小的 TCP 数据段，从而导致错误和文件传输失败。
您可以按照下面的语法使用 Ping 工具来检测 PMTU 黑洞路由器：
Pingdestination –f –l ICMPEchoPayloadSize




•


此处的 destination 可以是一个 IP 地址，也可以是一个可解析为 IP 地址的名称。




•


-f 选项可将 DF 标记设置为 1。




•


-l 选项指定 ICMP Echo 消息的有效负载的大小。




•


ICMPEchoPayloadSize 是 ICMP Echo 消息的有效负载的字节数。




要计算 ICMPEchoPayloadSize，可用您想发送的 IP 包的大小减去 28。这是因为，IP 报头的大小为 20字节，而 ICMP Echo 消息的 ICMP 报头的大小为 8 字节。下图显示了二者的关系。

例如，要发送长度为 1500 字节的 ICMP Echo 消息，您应使用以下命令：
ping destination –f –l 1472
如果有 IP MTU 更小的中间链路，且路由器发送了“ICMP Destination Unreachable-Fragmentation Needed and DF Set”消息，则 Ping 工具会显示“Packet needs to be fragmented but DF set”消息。如果有 IP MTU 更小的中间链路，且 PMTU 黑洞路由器直接丢弃了包，则 Ping 工具会显示“Request timed out”消息。
要找出包含 PMTU 黑洞路由器的路径的有效 IP MTU，请使用 Ping 工具，同时不断增大 Echo 消息的有效负载的大小。因为典型子网的最小 IP MTU 是 576 字节，因此开始时可将 ICMP Echo 消息的有效负载设置为 548字节，然后每次递增 100 字节，直到找到有效 PMTU。
例如，如果 ping 10.0.0.10 -f -l 972 命令显示“Reply from 10.0.0.10”，而命令 ping 10.0.0.10 -f -l 973 显示“Request timed out”，则 IP 地址为 10.0.0.10 的节点的有效 PMTU 为 1000 字节(972+28)。
 
PMTU 黑洞路由器的解决方案和工作方法
1. 配置中间路由器以支持路由器端 PMTU 发现
解决专用 Intranet 中的 PMTU 黑洞路由器问题的最简单的方法，是将您的所有路由器配置为支持路由器端RFC 1191，并支持发送 ICMP Destination Unreachable-Fragmentation Needed and DF Set 消息（其中带有转发失败的链路的 IP MTU）。这与将路由器配置为支持主机端 RFC 1191 是有区别的，后者的路由器会对自己的 TCP 连接使用 PMTU 发现。
在 Internet 上进行通信时，通常不太可能将 Internet 路由器配置为支持路由器端 PMTU 发现。在这种情况下，您可以使用以下各节介绍的工作方法。
3. 确定最佳 IP MTU 并通过 MTU 注册表设置来设置该值
启用 PMTU 黑洞路由器检测的替代方法，是根据本文前面部分的介绍使用 Ping 工具确定所有相关路径的PMTU 值，然后使用注册表设置手动配置发送接口的 IP MTU。
该方法通过不停发送 DF 标记设置为 1，大小又不会导致 PMTU 黑洞路由器将其直接丢弃的 IP 包来避开PMTU 黑洞路由器。手动指定 IP MTU 意味着所有通信量（包括本地子网通信量和不包含 PMTU 黑洞路由器的路径上的通信量）都将使用较小的 IP MTU。
确定有效的 PMTU 后，您可以通过以下步骤手动指定 TCP/IP 接口的 IP MTU：




1.


打开 Network Connections 文件夹，记下 LAN 连接的名称，如“Local Area Connection”。




2.


单击开始，单击“运行”，键入“regedit.exe”，然后单击“确定”。




3.


使用注册表编辑器工具的树图（左边窗格）打开如下键：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control \Network\{4D36E972-E325-11CE-BFC1-08002BE10318}




4.


此键下面是与已安装的 LAN 连接相关联的全局唯一标识符 (GUID) 的一个或多个键。这些 GUID 键中的每一个都有一个 Connection 子键。打开每个 GUID\Connection 键，寻找值与第一步中记下的 LAN 连接的名称匹配的 Name 设置。




5.


如果找到包含与 LAN 连接匹配的 Name 设置的 GUID\Connection 键，请写下或记下该 GUID 值。




6.


使用注册表编辑器的树视图打开如下键：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip \Parameters\Interfaces\GUID




7.


右键单击树视图中的“GUID”键，指向“新建”，然后单击“双字节值”。




8.


在注册表编辑器工具的内容窗格（右窗格）中，为新注册表设置的值键入 MTU，然后按 ENTER。




9.


在内容窗格中，双击新的 MTU 设置，并在“编辑双字节值”对话框中选择“十进制”，然后在“数值数据”中键入有效 MTU 值。




10.


单击“确定”。关闭注册表编辑器工具。




11.


重新启动计算机使 MTU 设置生效。




 网络故障举例：[转自华为3COM全球服务论坛]
 
现象描述：

组网：

    PC－AR2831－AR2880－CISCO设备组成的核心网－SERVER

网络运行MPLS VPN;AR2880为PE;AR2831为CE，PE、CE间运行OSPF,多CE配置；路由器各接口MTU、TCP MSS值采用默认设置

AR2880：Version 3.30, Release 0008

AR2831：Version 3.30, Release 0008

现象1：

       AR2880路由器的以太口MTU使用缺省设置时,使用的OA系统(BS架构)部分流程无法运行,上网发邮件时附件无法粘贴；但是在cisco设备上，同样的组网没有发现问题；

现象2：

       将AR2880路由器的以太口MTU改为512测试,邮件附件可以粘贴,但OA主页打开后无内容,刷新不了；将AR2880路由器的以太口MTU改为1200测试,邮件附件可以粘贴,OA主页可以正常显示,但是点击OA系统的"起草公文"无页面弹出,正常状况下应弹出新建公文页面；



告警信息：

无  

原因分析：

原因分析：

可能是应用软件问题；可能是MTU 、TCP MSS值协商配置问题；

具体分析：

1、接口MTU、TCP MSS采用缺省值1500时，无法贴附件；

这是因为应用了三层MPLS VPN技术，增加了8bit的标签，MTU值协商出现问题。

AR28XX路由器默认在接口上自动分片，所以在普通的应用中采用默认值不会影响业务。但路由器接口上收到一个报文长度大于本接口MTU值的报文，如果该报文被强制打上不分片的标记，将丢弃报文，并返回一个ICMP差错报文（type 3,code 4），通知报文发起者丢弃原因。报文发起者将发送比较小的报文。通过多次上述报文协商，将得到对于某一个固定路径上的最小Mtu值，这个过程叫做Mtu Discovery ，通过MTU Discovery来确定报文路径上最小可通过的MTU；如果两个设备相连，没有MTU Discovery功能并且MTU值不一致，将可能导致丢弃报文。只有把双方设备的Mtu为对端设备MRU的最小值，才能正常通信。由于某些组网考虑到网络安全问题和性能，往往会把ICMP报文过滤掉，引起Mtu Discovery不能正常运行；应用软件由于程序算法问题或根本没有相应协商功能，也会导致了部分应用异常。

2、更改接口MTU值以后，仍然有部分业务不正常；

这是因为TCP MSS值协商的问题。

 MSS值的计算方法是：MSS=MTU-IP-TCP（如果有其他pppoe、加密报文头的话也同样减去），也就是说MSS值其实就是TCP所承载的净载荷的长度。由于AR28XX接口缺省的MTU是1500字节，故一般要求加密报文头+链路层开销+IP头（20-60字节）+TCP报文（20字节）小于1500字节，即TCP分片配置1200左右比较适合。缺省情况下，TCP报文不分片。因此TCP MSS不匹配也会引起部分应用异常。



处理过程：

      本例中通过修改路由器接口MTU、TCP MSS值，解决问题。

     具体报文mtu 、tcp mss大小要根据具体应用，按经验值进行尝试，选择最佳值；其中MTU值的选择可以通过ping命令设置不分片来进行测试；TCP MSS值的选择则可以通过MTU减去相应其它加密、链路层开销、IP头、TCP头等字节计算。

     具体过程如下：

     1、本例中使用cisco路由器时相关应用正常。初步估计是mtu值问题，但是对普通应用AR28系列路由器会自动分片，不会影响业务。测试发现在client上ping大包的时候，如果不设置不允许分片，业务正常。看来客户应用中做了不允许分片的设置或其它原因mtu协商错误。更改路由器接口mtu为1500-8＝1492以后，业务正常。

     2、更改接口mtu以后，其它部分业务还不正常。分析原因是tcp mss值的问题。减小tcp mss值8字节1460-8＝1452，但是还有部分业务不正常。询问软件集成商，得到答复部分软件中使用了加密技术。而且不同的应用加密强度不同。

     3、逐步调整路由器接口的tcp mss值，减到到1200以后，所有业务测试通过。



命令说明：

     1、mtu命令用来设置以太网接口的MTU（最大传输单元），undo mtu命令用来恢复MTU的缺省值。缺省的MTU为1500。使用mtu命令改变接口最大传输单元MTU后，需要先对接口执行shutdown命令，再执行undo shutdown命令将接口重启，以保证设置的MTU生效。

     2、tcp mss命令用来配置TCP报文分片，undo tcp mss命令用来取消TCP报文分片。 
个人总结：
 
MTU=MSS+IP header+TCP header+链路层开销+加密报文头（某些程序加密强度不一样）
 
MTU，对UDP和TCP报文都检测，当超过时，如果报文DF=0 ，就进行分段，如果DF=1，就丢弃，同时返回RFC 792定义的ICMP Type3 Code 4（ICMP Destination Unreachable-Fragmentation Needed and DF Set）或 RFC 1191定义的ICMP包（包含转发失败链路的MTU），主机收到后会调节MSS以适应，后续包不会分片就可进行传输。如果两端之间某Router配置了ACL ，deny掉所有的ICMP，那就无法收到咯。
 
MSS其实就是TCP报文payload大小。一般的应用软件，当客户端和服务器端在建立TCP连接的时候需要根据实际传输的报文大小来协商TCP的窗口大小MSS。Tcp连接成功后会进行两次滑动窗口的协商,一次是pc与server，一次是与网关，然后在两次协商里选择一个较小的值作为窗口来发送报文。
 
当协商出来的MSS比较大时，加上IP header+TCP header+链路层开销+加密报文头后，就有可能大于MTU，当DF=1时，就会丢弃掉。
 
正如     所说：“对于UDP协议而言，这个协议本身是无连接的协议，对数据包的到达顺序以及是否正确到达不甚关心，所以一般UDP应用对分片没有特殊要求。”所以在路由器上进行ip tcp mss命令只对tcp packet检测就够了。
 
再提供一个案例：MSN是使用https方式登陆的，有时会有突发大报文，而且DF位是设置为1的。虽然目前大部分出现的故障现象都是：不能发送附件；不能打开网页等。都是在PPPoE中发生的。但就算源和目的网络的MTU都是1500，但是由于中间经过的节点链路可能存在不同，可能少于1500。或者在传输过程中的某个路由器设置了较小的MTU。而往往配置路由器或交换机时，习惯禁止了所有的ICMP信息，这样的话那路由器就无法返回ICMP 3/4的包给源主机了。 RFC 2923 （TCP Problems with Path MTU Discovery）。
 
所以，有时候出现的故障，不止要调试MTU值，还要调试MSS值，才能使所有应用正常
其实碰到此问题时，最好是借助Sniffer抓包分析（不过奇怪，锐捷NBR1000无法抓到ICMP Type 3 Code 4的包，所以无法抓包提供分析图，好可惜！是路由器不支持还是其他原因，以后有机会考证）
 
附：Sniffer抓包协助理解分片过程以及DF
 
 

上图是：Ping –l 2000 [url]www.163.com[/url]
首先看IP header，More fragments位为1，向对方通告此数据包为多帧发送（分段），total lengt=1300bytes（1280bytes+IP报头20bytes）。再看ICMP处，可以看到分了两个包，大小分别为1280bytes和728bytes，2008 bytes of reassembled data指明重组后的数据为2008bytes（icmp包头8bytes，数据2000bytes）。然后看DLC部分，指明了以太类型0800（IP），帧大小为1314bytes（ICMP的1280bytes+IP报头20bytes+帧14bytes）
 

原帖地址：http://www.networking-forum.com/viewtopic.php?f=24&t=3203
 I originally posted this over in the IP Communications forum. However, I think it has value here as well, so I'm going to repost it here (and rework is a bit) for those who may not have seen it. The was originally written to provide QoS for Vonage, but the concepts here apply to any type of traffic.

To configure the QoS for Vonage you don't have to do a whole lot. Here's the configuration you need:


Code:
!
class-map match-any voice-traffic
match  dscp ef 
class-map match-any voice-signal
match  dscp af31 
!
policy-map voice-policy
class voice-traffic
  priority 200
class voice-signal
  bandwidth 8
class class-default
  fair-queue
!
policy-map shaper
class class-default
  shape average 350000 3500 0
  service-policy voice-policy
!
interface FastEthernet4
service-policy output shaper
!


The above configuration was taken directly ..

 这里提供两种安装方法，原理相同。
    第一种：
    
    1.将硬盘分为四个（或四个以下）主分区，分区工具为PartitionMagic (分区魔法师)v8.0，或者在安装过程中使用Linux 的分区工具；
    2.第一个设为swap分区，用来做多个linux 公用的交换分区（共用交换分区可以节约空间）；
    3.依次安装第一个、第二个等linux ，且每个linux选一个主分区作为其“/”目录（根目录）；将grub都设为默认（安装在MBR）即可；当然，这时只有最后安装的linux 是可以启动的；
    4.启动系统（最后安装的那个linux ），将其他linux 系统所在的分区挂载（mount）好，将这些挂载分区的/boot/grub/grub.conf 打开，分别将文件中title 字段之后的内容copy 到当前系统的/boot/grub/grub.conf 文件末尾，保存重起；
    5.ok，一个多linux 系统的启动菜单便展现在你的屏幕上。
    第二种：
    第一种方法最多只能安装3个linux ，要想装的更多，你可以：
    1.建一个主分区作swap 用,..

 
Symmetric Encryption, Asymmetric Encryption, and Hashing
By stretch | Tuesday, November 23, 2010 at 4:16 p.m. UTC


A fundamental topic of IT security that often gives people difficulty is understanding the difference between symmetric, asymmetric encryption, and hashing. While each has specific uses, a robust communications encryption solution will typically implement all three.
Symmetric Encryption
Symmetric encryption may also be referred to as shared key or shared secret encryption. In symmetric encryption, a single key is used both to encrypt and decrypt traffic.

Common symmetric encryption algorithms include DES, 3DES, AES, and RC4. 3DES and AES are commonly used in IPsec and other types of VPNs. RC4 has seen wide deployment on wireless networks as the base encryption used by WEP and WPA version 1.
Symmetric encryption algorithms can be extremely fast, and their relatively low complexity allows for easy implementation in hardware. However, they require that all hosts participating in the encryption have already been configured with the secret key through some external means.
Asymmetric Encryption
Asymmetric encryption is also known as public-key cryptography. Asymmetric encryption differs from symmetric encryption primarily in that two keys are used: one for encryption and one for decryption. The most common asymmetric encryption algorithm is RSA.
Compared to symmetric encryption, asymmetric encryption imposes a high computational burden, and tends to be much slower. Thus, it isn't typically employed to protect payload data. Instead, its major strength is its ability to establish a secure channel over a nonsecure medium (for example, the Internet). This is accomplished by the exchange of public keys, which can only be used to encrypt data. The complementary private key, which is never shared, is used to decrypt.

Robust encryption solutions such as IPsec implement the strengths of both symmetric and asymmetric encryption. First, two endpoints exchange public keys, which allows for the setup of a slow but secure channel. Then the two hosts decide on and exchange shared symmetric encryption keys to construct much faster symmetric encryption channels for data.
Hashing
Finally, hashing is a form of cryptographic security which differs from encryption. Whereas encryption is a two step process used to first encrypt and then decrypt a message, hashing condenses a message into an irreversible fixed-length value, or hash. Two of the most common hashing algorithms seen in networking are MD5 and SHA-1.

Hashing is used only to verify data; the original message cannot be retrieved from a hash. When used to authenticate secure communications, a hash is typically the result of the original message plus a secret key. Hashing algorithms are also commonly used without a secret key simply for error checking. You can use the md5sum and sha1sum utilities on a Linux or Unix machine to experiment with hashing.

$ echo -n This is a secret message. | md5sum
39de572a4d05b1ad6552dcfee90f4d20 -
$ echo -n This is a secret message. | sha1sum
e35c5046b5fe69488ce0ab14c5761d785995ee79 -

Another example of MD5 hashing can be seen in IOS' secret passwords, which implement a random salt to avoid duplicate hashes should two users by chance select the same password.
 
原帖地址：http://packetlife.net/blog/2010/nov/23/symmetric-asymmetric-encryption-hashing/


[/img]..

 
Inter-VRF Routing with VRF Lite
By stretch | Monday, March 29, 2010 at 4:29 a.m. UTC


In Intro to VRF lite, we looked at how virtual routing and forwarding (VRF) instances can be employed to logically separate the layer three topologies of unrelated entities sharing a single physical infrastructure. VRFs work at layer three much like VLANs work at layer two, by assigning interfaces to a virtual domain isolated from other virtual domains at the same layer. This is a simple concept to grasp so long as each of the VRFs are maintained in isolation. However, things get a bit more complex when you need to route traffic from one VRF to another.
Consider the following topology, which might be found at a small business park or college campus.

The network pictured serves three customers: we'll call them customers Red, Green, and Blue. Each customer has its own Internet connection, housed in building one. Customer Green has employees in building two, customer Blue has employees in building three, and customer Red has employees in both buildings two and three. Additionally, VOIP service and connection to the PSTN (represented for now by a loopback interface) will be provided in the future by the network operator to customers Red and Green, but not Blue.Buildings two and three are connected to building one via 802.1Q trunk links. All three customers rely on the same physical network infrastructure for connectivity, but the traffic from each customer must be isolated from the others for security reasons. The IP prefixes in use are as follows:

Red: 172.16.0.0/16
Green: 172.17.0.0/16
Blue: 172.18.0.0/16
VOIP Services: 192.168.99.0/24

The design question posed by this scenario is as follows: how can we provide local VOIP connectivity to some customers while keeping all of the customers isolated from one another?
Modifying the Multilayer Switches' SDM Template
Before we can implement VRFs on our multilayer switches (Catalyst 3550s, in this case), we have to modify how the internal ternary content-addressable memory (TCAM) is partitioned to store IP routes. Observe what happens if we attempt to enable VRF with the default SDM template:

S1(config)# ip routing
S1(config)# ip vrf Red
S1(config-vrf)#
%L3TCAM-3-SIZE_CONFLICT: VRF requires enabling extended routing

VRF routes require that an additional unique identifier, a route distinguisher, is prepended to each VRF route in the routing table (we'll cover this in more detail shortly). To accommodate for this, the TCAM must be repartitioned. (This step is only necessary when configuring VRFs on certain multilayer switches.)

S1(config)# sdm prefer extended-match
Changes to the running SDM preferences have been stored, but cannot take effect
until the next reload.
Use 'show sdm prefer' to see what SDM preference is currently active.
S1(config)# ^Z
S1# show sdm prefer
The current template is the default template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1K VLANs.

number of unicast mac addresses: 5K
number of igmp groups: 1K
number of qos aces: 1K
number of security aces: 1K
number of unicast routes: 8K
number of multicast routes: 1K

The template stored for use after the next reload
is the default extended-match template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1K VLANs.

number of unicast mac addresses: 5K
number of igmp groups: 1K
number of qos aces: 1K
number of security aces: 1K
number of unicast routes: 4K
number of multicast routes: 1K

Note that the supported number of unicast routes has been halved from 8K to 4K.
We need to apply this change to and reload all three switches before proceeding.
Creating VRFs
We need to create four VRFs on S1: one for each of the three customers, and one for the shared VOIP network. Each VRF must be assigned a unique route distinguisher. A route distinguisher is simply a unique number stored beside each route in the routing table to associate it with its VRF and maintain uniqueness should two or more VRFs have overlapping address space (for example, if all three of our customers were addressed out of the 10.0.0.0/8 network).
There are two formats in which we can define a route distinguisher: <ASN>:<number> or <IP address>:<number>, where number is an arbitrary decimal number. Which method we choose is arbitrary. While the format of route distinguishers is an important design consideration in "real" VPNs, in VRF lite (i.e. VRFs without MPLS) it is only a locally-significant value. We'll use the <ASN>:<number> format with the private ASN 65000 (which will also be used for our BGP configuration later in the article) and number customers sequentially beginning from 1.
S1

ip routing
!
ip vrf Red
rd 65000:1
!
ip vrf Green
rd 65000:2
!
ip vrf Blue
rd 65000:3
!
ip vrf Shared
rd 65000:99

Next, we assign the physical and logical interfaces to VRFs and address them appropriately. We're using a loopback interface in place of a physical interface on S1 to emulate the shared VOIP network, however there is no effective difference with regard to VRF configuration. Note that interfaces must be assigned to a VRF before being addressed; assigning an interface to a VRF wipes any IP addresses already configured on that interface.
S1

vlan 16
vlan 17
vlan 18
!
interface Loopback99
description VOIP Services
ip vrf forwarding Shared
ip address 192.168.99.1 255.255.255.0
!
interface FastEthernet0/1
no switchport
ip vrf forwarding Red
ip address 172.16.1.2 255.255.255.252
!
interface FastEthernet0/3
no switchport
ip vrf forwarding Green
ip address 172.17.1.2 255.255.255.252
!
interface FastEthernet0/5
no switchport
ip vrf forwarding Blue
ip address 172.18.1.2 255.255.255.252
!
interface FastEthernet0/13
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface FastEthernet0/16
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Vlan16
ip vrf forwarding Red
ip address 172.16.0.1 255.255.255.0
!
interface Vlan17
ip vrf forwarding Green
ip address 172.17.0.1 255.255.255.0
!
interface Vlan18
ip vrf forwarding Blue
ip address 172.18.0.1 255.255.255.0

The physical trunk interfaces F0/13 and F0/16 are not assigned to a VRF, because they are not routed interfaces. VRF configuration is only relevant at layer three.
We can use show ip vrf to examine the VRFs and their assigned interfaces:

S1# show ip vrf
Name Default RD Interfaces
Blue 65000:3 Fa0/5
Vl18
Green 65000:2 Fa0/3
Vl17
Red 65000:1 Fa0/1
Vl16
Shared 65000:99 Lo99
S1# show ip vrf interfaces
Interface IP-Address VRF Protocol
Fa0/5 172.18.1.2 Blue up
Vl18 172.18.0.1 Blue up
Fa0/3 172.17.1.2 Green up
Vl17 172.17.0.1 Green up
Fa0/1 172.16.1.2 Red up
Vl16 172.16.0.1 Red up
Lo99 192.168.99.1 Shared up

We only need to create two VRFs on each of the two other switches, as each connects only two customers, and assign the appropriate interfaces.
S2

ip routing
!
ip vrf Red
rd 65000:1
!
ip vrf Green
rd 65000:2
!
vlan 16
vlan 17
vlan 216
vlan 217
!
interface FastEthernet0/13
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Vlan16
ip vrf forwarding Red
ip address 172.16.0.2 255.255.255.0
!
interface Vlan17
ip vrf forwarding Green
ip address 172.17.0.2 255.255.255.0
!
interface Vlan216
ip vrf forwarding Red
ip address 172.16.2.1 255.255.255.0
!
interface Vlan217
ip vrf forwarding Green
ip address 172.17.2.1 255.255.255.0

S3

ip routing
!
ip vrf Red
rd 65000:1
!
ip vrf Blue
rd 65000:3
!
vlan 16
vlan 18
vlan 316
vlan 318
!
interface FastEthernet0/13
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Vlan16
ip vrf forwarding Red
ip address 172.16.0.3 255.255.255.0
!
interface Vlan18
ip vrf forwarding Blue
ip address 172.18.0.3 255.255.255.0
!
interface Vlan316
ip vrf forwarding Red
ip address 172.16.3.1 255.255.255.0
!
interface Vlan318
ip vrf forwarding Blue
ip address 172.18.3.1 255.255.255.0

Configuring OSPF
Next we'll configure OSPF to exchange routes among the three buildings. Three independent OSPF processes are to be run, one per customer VRF. OSPF configuration here is pretty straight forward, as we can simply place all interfaces in area 0 within each VRF.
S1

router ospf 1 vrf Red
network 0.0.0.0 255.255.255.255 area 0
!
router ospf 2 vrf Green
network 0.0.0.0 255.255.255.255 area 0
!
router ospf 3 vrf Blue
network 0.0.0.0 255.255.255.255 area 0

S2

router ospf 1 vrf Red
network 0.0.0.0 255.255.255.255 area 0
passive-interface Vlan216
!
router ospf 2 vrf Green
network 0.0.0.0 255.255.255.255 area 0
passive-interface Vlan217
!

S3

router ospf 1 vrf Red
network 0.0.0.0 255.255.255.255 area 0
passive-interface Vlan316
!
router ospf 3 vrf Blue
network 0.0.0.0 255.255.255.255 area 0
passive-interface Vlan318


We can verify that OSPF adjacencies have been appropriately established with show ip ospf neighbor. Note that this command is not VRF-specific.

S1# show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
172.18.3.1 1 FULL/DR 00:00:31 172.18.0.3 Vlan18
172.17.2.1 1 FULL/DR 00:00:32 172.17.0.2 Vlan17
172.16.2.1 1 FULL/BDR 00:00:32 172.16.0.2 Vlan16
172.16.3.1 1 FULL/DR 00:00:31 172.16.0.3 Vlan16

At this point, all customers in all buildings should have full connectivity within their respective VRFs.

S2# show ip route vrf Red

Routing Table: Red
...

172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C 172.16.0.0/24 is directly connected, Vlan16
O 172.16.1.0/30 [110/2] via 172.16.0.1, 00:00:31, Vlan16
C 172.16.2.0/24 is directly connected, Vlan216
O 172.16.3.0/24 [110/2] via 172.16.0.3, 00:00:31, Vlan16
S2# show ip route vrf Green

Routing Table: Green
...

172.17.0.0/16 is variably subnetted, 3 subnets, 2 masks
O 172.17.1.0/30 [110/2] via 172.17.0.1, 00:00:37, Vlan17
C 172.17.0.0/24 is directly connected, Vlan17
C 172.17.2.0/24 is directly connected, Vlan217


S3# show ip route vrf Red

Routing Table: Red
...

172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C 172.16.0.0/24 is directly connected, Vlan16
O 172.16.1.0/30 [110/2] via 172.16.0.1, 00:01:04, Vlan16
O 172.16.2.0/24 [110/2] via 172.16.0.2, 00:01:04, Vlan16
C 172.16.3.0/24 is directly connected, Vlan316
S3# show ip route vrf Blue

Routing Table: Blue
...

172.18.0.0/16 is variably subnetted, 3 subnets, 2 masks
C 172.18.3.0/24 is directly connected, Vlan318
C 172.18.0.0/24 is directly connected, Vlan18
O 172.18.1.0/30 [110/2] via 172.18.0.1, 00:01:05, Vlan18

Configuring Multiprotocol BGP
Multiprotocol BGP (MP-BGP or BGP-MP) will be used only to exchange routes between VRFs, and therefore needs to be configured only on S1. We'll use the private AS number 65000 for the BGP process.
Because all of our routed interfaces on S1 have been assigned to VRFs, we'll create a loopback interface not in a VRF to keep BGP from complaining about not being able to find a router ID. (In the real world, one might consider using the IP of a management interface as the BGP router ID.) A router ID can also be configured per BGP address family.

S1(config)# interface loopback0
S1(config-if)# ip address 192.0.2.1 255.255.255.255

To configure MP-BGP, we configure a separate address family within BGP for each VRF and simply redistribute all connected and OSPF-learned routes within that VRF.
S1

router bgp 65000
no synchronization
bgp log-neighbor-changes
no auto-summary
!
address-family ipv4 vrf Red
redistribute connected
redistribute ospf 1 vrf Red
no synchronization
exit-address-family
!
address-family ipv4 vrf Green
redistribute connected
redistribute ospf 2 vrf Green
no synchronization
exit-address-family
!
address-family ipv4 vrf Blue
redistribute connected
redistribute ospf 3 vrf Blue
no synchronization
exit-address-family
!
address-family ipv4 vrf Shared
redistribute connected
no synchronization
exit-address-family

We can verify that each BGP address family now maintains routes for its respective VRF. (To view the BGP routes for only a specific VRF, use the command show ip bgp vpnv4 vrf.)

S1# show ip bgp vpnv4 all
BGP table version is 47, local router ID is 192.0.2.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:1 (default for vrf Red)
*> 172.16.0.0/24 0.0.0.0 0 32768 ?
*> 172.16.1.0/30 0.0.0.0 0 32768 ?
*> 172.16.2.0/24 172.16.0.2 2 32768 ?
*> 172.16.3.0/24 172.16.0.3 2 32768 ?
Route Distinguisher: 65000:2 (default for vrf Green)
*> 172.17.0.0/24 0.0.0.0 0 32768 ?
*> 172.17.1.0/30 0.0.0.0 0 32768 ?
*> 172.17.2.0/24 172.17.0.2 2 32768 ?
Route Distinguisher: 65000:3 (default for vrf Blue)
*> 172.18.0.0/24 0.0.0.0 0 32768 ?
*> 172.18.1.0/30 0.0.0.0 0 32768 ?
*> 172.18.3.0/24 172.18.0.3 2 32768 ?
Route Distinguisher: 65000:99 (default for vrf Shared)
*> 192.168.99.0 0.0.0.0 0 32768 ?

Enabling VRF Route Import and Export
Our final task is to configure route import and export among the Red, Green, and Shared VRFs. VRF route import and export are configured as two explicit, independent functions. Under VRFs Red and Green, we need to:

Export local routes
Import routes from VRF Shared

Under VRF Shared:

Export local routes
Import routes from VRFs Red and Green

To do this, we configure each VRF with import and export route targets. A route target is similar in format to a route distinguisher, but serves a different purpose. Whereas any given VRF route in our scenario has exactly one route distinguisher to uniquely identify it, a route can have zero or more route targets as arbitrary identifiers for reference by import and export policies. This allows for much greater flexibility than if only the route distinguisher was used. Although used only locally in our example, route targets are communicated with MP-BGP neighbors as extended communities.
Route targets can be defined in the same formats as route distinguishers. Here each route target will reuse the same format and value of its VRF's route distinguisher, just to keep things simple. However, remember that there is no direct relation between the two. Additionally, although each VRF is exporting only one route-target in our example, multiple route-targets can be exported simultaneously (resulting in multiple communities attached to an MP-BGP route).

ip vrf Blue
rd 65000:3
!
ip vrf Green
rd 65000:2
route-target export 65000:2
route-target import 65000:99
!
ip vrf Red
rd 65000:1
route-target export 65000:1
route-target import 65000:99
!
ip vrf Shared
rd 65000:99
route-target export 65000:99
route-target import 65000:1
route-target import 65000:2

Now VRF Shared has routes from VRFs Red and Green, and VRFs Red and Green each have the route from VRF Shared (it may take a minute for the routes to appear in the table):

S1# show ip route vrf Shared

Routing Table: Shared
...

172.17.0.0/16 is variably subnetted, 2 subnets, 2 masks
B 172.17.1.0/30 is directly connected, 00:00:24, FastEthernet0/3
B 172.17.0.0/24 is directly connected, 00:00:24, Vlan17
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
B 172.16.0.0/24 is directly connected, 00:00:24, Vlan16
B 172.16.1.0/30 is directly connected, 00:00:24, FastEthernet0/1
C 192.168.99.0/24 is directly connected, Loopback99
S1# show ip route vrf Red

Routing Table: Red
...

172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C 172.16.0.0/24 is directly connected, Vlan16
C 172.16.1.0/30 is directly connected, FastEthernet0/1
O 172.16.2.0/24 [110/2] via 172.16.0.2, 00:05:38, Vlan16
O 172.16.3.0/24 [110/2] via 172.16.0.3, 00:05:38, Vlan16
B 192.168.99.0/24 is directly connected, 00:00:44, Loopback99
S1# show ip route vrf Green

Routing Table: Green
...

172.17.0.0/16 is variably subnetted, 3 subnets, 2 masks
C 172.17.1.0/30 is directly connected, FastEthernet0/3
C 172.17.0.0/24 is directly connected, Vlan17
O 172.17.2.0/24 [110/2] via 172.17.0.2, 00:05:43, Vlan17
B 192.168.99.0/24 is directly connected, 00:00:49, Loopback99

VRF Blue, however, still contains only its own routes, as we did not configure import or export for this VRF:

S1# show ip route vrf Blue Routing Table: Blue ... 172.18.0.0/16 is variably subnetted, 3 subnets, 2 masks O 172.18.3.0/24 [110/2] via 172.18.0.3, 00:06:02, Vlan18 C 172.18.0.0/24 is directly connected, Vlan18 C 172.18.1.0/30 is directly connected, FastEthernet0/5

Lastly, we need to configure the VRF OSPF processes to redistribute BGP-learned routes to OSPF peers on S1:

S1(config)# router ospf 1 vrf Red
S1(config-router)# redistribute bgp 65000 subnets
S1(config-router)# router ospf 2 vrf Green
S1(config-router)# redistribute bgp 65000 subnets

These routes are now propagated via OSPF to S2 and S3 within their respective VRFs. On S3, we can verify that VLAN 316 (VRF Red) has access to the VOIP network, but VLAN 318 (VRF Blue) does not:

S3# show ip route vrf Red

Routing Table: Red
...

172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C 172.16.0.0/24 is directly connected, Vlan16
O 172.16.1.0/30 [110/2] via 172.16.0.1, 00:10:15, Vlan16
O 172.16.2.0/24 [110/2] via 172.16.0.2, 00:10:15, Vlan16
C 172.16.3.0/24 is directly connected, Vlan316
O E2 192.168.99.0/24 [110/1] via 172.16.0.1, 00:10:15, Vlan16
S3# show ip route vrf Blue

Routing Table: Blue
...

172.18.0.0/16 is variably subnetted, 3 subnets, 2 masks
C 172.18.3.0/24 is directly connected, Vlan318
C 172.18.0.0/24 is directly connected, Vlan18
O 172.18.1.0/30 [110/2] via 172.18.0.1, 00:25:17, Vlan18
S3# ping vrf Red 192.168.99.1 source vlan316

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.99.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.3.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
S3# ping vrf Blue 192.168.99.1 source vlan318

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.99.1, timeout is 2 seconds:
Packet sent with a source address of 172.18.3.1
.....
Success rate is 0 percent (0/5)

The final configurations of all three switches are made available here:

S1.txt
S2.txt
S3.txt

原帖地址：http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/


[/img]..

 
Recovering a Router with the Password Recovery Service Disabled
By stretch | Monday, October 11, 2010 at 1:43 a.m. UTC


Password recovery is a process used to restore to working order a Cisco router which is no longer administratively accessible (e.g. the correct credentials to log in have been forgotten). The process enables anyone with access to the physical console to interrupt the boot sequence of the router, forcing it into ROM monitor mode (rommon). From rommon, the router can then be instructed to boot without referencing its startup-configuration, so the user can access privileged exec (enable) mode at the console and retrieve or modify the saved configuration.
Obviously, this means anyone with physical access to the device can view the potentially sensitive router configuration. Cisco provides the ability to disable the password recovery service to mitigate such physical attacks.
Disabling Password Recovery
Disabling the password recovery serv..

 
Routed or Switched Access Layer: Why not Both?
By stretch | Friday, September 24, 2010 at 3:32 a.m. UTC


A major consideration when designing an enterprise network is whether traffic at the access layer will be switched or routed toward the distribution layer. Placing multilayer switches in the access layer yields significant advantages; chief among them is the ability to fully utilize all uplinks to the distribution layer (as loops are no longer broken by STP). However, many organizations opt to stick with simple switched (layer two) access schemes to support one or two legacy applications which require a direct layer two path to a server or management station, or to maintain a common subnet for similar devices scattered about multiple access blocks (for example, security systems or environmental monitors).

In such a situation, it's quite feasible to extend both routed and switched connectivity to the access layer, provided you have multilayer access switches (such as the Catalyst 3550, 3560, or 3750). Within the IEEE 802.1Q trunks between distribution devices and access switches, one VLAN can be designated as a routed point-to-point link, and one or more additional VLANs can be added for traditional layer two connectivity.

In this hybrid L2/L3 access design, VLANs carrying normal routable traffic are terminated directly on the access switches as in the L3 design shown earlier. Traffic from end hosts is routed out of these access VLANs and onto one of the point-to-point VLANs shared with the distribution switches. In our example above, traffic from VLANs 100 and 101 is routed from the access switch to the distribution switch via VLAN 2 (a point-to-point /30 link). A separate point-to-point VLAN must be created for each physical link between an access switch and a distribution switch.
This design allows us to still extend some VLANs for legacy nonroutable applications up to the distribution layer. In the example above, VLAN 99 extends to the distribution layer, sharing the same 802.1Q trunks as the point-to-point VLANs.
We can see how this hybrid access design allows us to have our cake and eat it too. It's worth noting, however, that this design reinforces the need for independent layer two and layer three documentation and topology drawings.
 
原帖地址：http://packetlife.net/blog/2010/sep/24/routed-or-switched-access-layer-why-not-both/


[/img]..

 
Route Preference
By stretch | Monday, August 16, 2010 at 3:04 a.m. UTC


Suppose a router receives a packet destined for the IP address 192.0.2.73. The router has in its routing table the following three routes:



Protocol
AD
Metric
Prefix
Next Hop


OSPF
110
240
192.0.2.0/25
172.16.1.1


EIGRP
90
33789
192.0.2.0/24
172.16.2.1


RIP
120
6
192.0.2.64/26
172.16.3.1



To which next hop address will the packet be routed?
If you picked 172.16.3.1, you're correct. Why? A router evaluates routes in the following order.

Prefix Length - The longest-matching route is preferred first. Prefix length trumps all other rou..