Começar. É Gratuito
ou inscrever-se com seu endereço de e-mail
Rocket clouds
CCIE por Mind Map: CCIE

1. Layer 2

1.1. LAN

1.1.1. Trunk Interfaces

1.1.1.1. Trunk Mode

1.1.1.1.1. Dynamic ?

1.1.1.1.2. Don't work:

1.1.1.2. Trunk Encapsulation

1.1.1.2.1. Dynamic?

1.1.2. Etherchannel

1.1.2.1. Modes

1.1.2.1.1. Dynamic ?

1.1.2.2. Configuration

1.1.2.2.1. interface range <first-if> <last-if>

1.1.2.2.2. shutdown

1.1.2.2.3. [switchport | no switchport]

1.1.2.2.4. channel-group <channel-number> mode [on | desirable | auto | active | passive]

1.1.2.2.5. interface port-channel <channel-number>

1.1.2.2.6. switchport mode [access | trunk]

1.1.2.2.7. ... other configurations ...

1.1.2.2.8. no shutdown

1.1.2.2.9. interface range <first-if> <last-if>

1.1.2.2.10. no shutdown

1.1.3. FlexLinks

1.1.3.1. Link level redundancy

1.1.3.2. Alternative to STP

1.1.3.3. Automatically disables STP

1.1.3.4. Configuration

1.1.3.4.1. interface <active-interface-L2>

1.1.3.4.2. switchport backup interface <backup-interface-L2>

1.1.3.4.3. switchport backup interface <backup-interface-L2> preemption mode [forced | bandwidth | off]

1.1.3.4.4. switchport backup interface <backup-interface-L2> preemption delay <msec>

1.1.4. Spanning Tree

1.1.4.1. STP (802.1d)

1.1.4.1.1. Cisco PVSTP+

1.1.4.1.2. Port states

1.1.4.1.3. Rules

1.1.4.1.4. Port Roles

1.1.4.1.5. BDPU Types

1.1.4.1.6. Elections

1.1.4.2. Rapid STP (802.1w)

1.1.4.2.1. Cisco RPVSTP

1.1.4.2.2. spanning-tree mode rapid-pvst

1.1.4.2.3. Standardize BackboneFast, UplinkFast, PortFast

1.1.4.2.4. Port states

1.1.4.2.5. Port Roles

1.1.4.3. MST (802.1s)

1.1.4.3.1. Automatically enables RSTP

1.1.4.3.2. Enable MST

1.1.4.3.3. Create MST instances and map VLAN to instance

1.1.4.3.4. Define root, cost, priority

1.1.4.4. Features

1.1.4.4.1. Can be enabled on PVST+, rapid PVST_ and MST

1.1.4.4.2. Can be enabled on PVST+

1.1.5. udld

1.1.5.1. modes

1.1.5.1.1. normal

1.1.5.1.2. aggressive

1.2. WAN

1.2.1. PPP over Frame-relay

1.2.1.1. interface Virtual-Template <if>

1.2.1.2. ip unnumbered <interface>

1.2.1.3. encapsulation ppp

1.2.1.4. CHAP

1.2.1.4.1. ppp authentication chap

1.2.1.4.2. ppp chap username <usernameB>

1.2.1.4.3. ppp chap password <passwordB>

1.2.1.5. PAP

1.2.1.5.1. ppp authentication pap

1.2.1.5.2. ppp pap sent-username <usernameB> password <passwordB>

1.2.1.6. username <usernameA> password <passwordA>

1.2.1.7. interface <Serial>

1.2.1.8. encapsulation frame-relay

1.2.1.9. frame-relay interface-dlci <dlci> ppp Virtual-Template <if>

1.2.1.10. Multilink

1.2.1.10.1. interface Multilink

1.2.1.10.2. ppp multilink

1.2.1.10.3. ppp multilink group <num>

1.2.1.10.4. interface Virtual-Template

1.2.1.10.5. ppp multilink group <num>

2. IGP and PBR

2.1. EIGRP

2.1.1. Administrative Distance

2.1.1.1. router egirp <as>

2.1.1.2. distance <ad> <source-IP> <source-wildcard> <acl>

2.1.1.2.1. Don't match external prefixes, only internal

2.1.1.2.2. Set the neighbor, don't let any (0.0.0.0 255.255.255.255)

2.1.1.3. distance eigrp <internal-ad> <external-ad>

2.1.1.3.1. Change all routes, can't be selective

2.1.2. Metric

2.1.2.1. BW-Metric = 10.000.000/interface-BW(kbps)

2.1.2.2. Delay-Metric = sum [delays (tens of us)] * 256

2.1.2.3. Metric = BW-Metric + Delay-Metric

2.1.3. Load Balance

2.1.3.1. Proportional to metrics

2.1.3.2. Range = Variance multiplier

2.1.3.3. router eigrp <eigrp-as>

2.1.3.4. variance <multiplier>

2.1.4. Neighbors

2.1.4.1. passive-interface <interface>

2.1.4.1.1. Disable send and receive hellos on interface

2.1.4.1.2. Neighbors don't establish

2.1.4.2. neighbor <ip-addr> <interface>

2.1.4.2.1. Suppress multicast hellos on the interface

2.1.4.2.2. Send unicast hellos

2.2. RIP

2.2.1. Basic config

2.2.1.1. router rip

2.2.1.2. version 2

2.2.1.3. no auto-summary

2.2.1.4. passive default

2.2.1.5. network <classful-network>

2.2.2. Destination Format

2.2.2.1. Multicast

2.2.2.1.1. Default

2.2.2.1.2. 224.0.0.9

2.2.2.2. Unicast

2.2.2.2.1. neighbor <neighbor-ip>

2.2.2.2.2. passive-interface <interface>

2.2.2.3. Broadcast

2.2.2.3.1. ip rip v2-broadcast

2.2.3. Filtering

2.2.3.1. Distribute List

2.2.3.1.1. distribute-list <acl> [in | out] <interface>

2.2.3.1.2. acl

2.2.3.2. Offset List

2.2.3.2.1. offset-list <acl> [in | out] <additive-metric>

2.2.3.2.2. Metric 16 means invalid route

2.2.3.2.3. acl

2.2.3.3. Administrative Distance

2.2.3.3.1. distance <adm-distance> <source-ip> <source-wildcard> <acl>

2.2.3.3.2. Administrative Distance 255 means invalid route

2.2.3.3.3. source-ip = RIP Neighbor IP

2.2.3.3.4. acl

2.2.4. Authentication

2.2.4.1. interface <if>

2.2.4.2. ip rip authentication key-chain <key-chain>

2.2.4.3. ip rip authentication mode [text | md5]

2.2.5. Default route

2.2.5.1. router rip

2.2.5.2. default-information originate

2.2.5.3. Conditional

2.2.5.3.1. Only send default route if there is a specific prefix in route table

2.2.5.3.2. router rip

2.2.5.3.3. default information originate route-map <condition-route-map>

2.2.6. Summarization

2.2.6.1. interface <if>

2.2.6.2. ip summary-address rip <summary-ip> <mask>

2.3. OSPF

2.3.1. Basic config

2.3.1.1. Router process

2.3.1.1.1. router ospf <process-id>

2.3.1.1.2. network <ip-address> <wildcard-mask> area <area-id>

2.3.1.2. Interface

2.3.1.2.1. interface <if>

2.3.1.2.2. ip ospf <process-id> area <area-id>

2.3.2. Network types

2.3.2.1. Elects DR/BDR ?

2.3.2.1.1. Y

2.3.2.1.2. N

2.3.2.2. Configuration

2.3.2.2.1. ip ospf network-type <type>

2.3.2.2.2. ip ospf priority <priority-value>

2.3.2.3. Default Types by interface

2.3.2.3.1. Frame-Relay

2.3.2.3.2. Ethernet

2.3.2.3.3. Loopback

2.3.2.3.4. Tunnel

2.3.3. Area types

2.3.3.1. LSAs

2.3.3.1.1. Type 1

2.3.3.1.2. Type 2

2.3.3.1.3. Type 3

2.3.3.1.4. Type 4

2.3.3.1.5. Type 5

2.3.3.1.6. Type 7

2.3.3.1.7. Totally Stub or Totally NSSA (5 -> 7)

2.3.3.1.8. Stub or NSSA (5 -> 7)

2.3.3.2. Stub

2.3.3.2.1. Stub

2.3.3.2.2. Totally Stub

2.3.3.2.3. Not-so-stubby (NSSA)

2.3.3.2.4. Not-so-stubby Totally Stub

2.3.3.2.5. NSSA no-redistribution

2.3.3.2.6. NSSA Suppress-FA

2.3.4. Route types

2.3.4.1. In order of preference

2.3.4.2. O

2.3.4.2.1. Intra-area

2.3.4.3. O IA

2.3.4.3.1. Inter-area

2.3.4.4. O E1

2.3.4.4.1. Metric = External Cost + Internal Cost

2.3.4.5. O E2

2.3.4.5.1. Default when redistributing

2.3.4.5.2. Metric = External cost only; don't change through area

2.3.4.6. External routes

2.3.5. Summarization

2.3.5.1. Inter-area (ABR)

2.3.5.1.1. area <area-id> range <summary-ip> <mask>

2.3.5.2. External (ASBR)

2.3.5.2.1. summary-address <summary-ip> <mask>

2.3.6. Virtual-link

2.3.6.1. Required for areas not connected to area 0

2.3.6.2. area <not-area-0-id> virtual-link <dest-ospf-router-id>

2.3.6.3. Not allowed through stub areas

2.3.7. Filtering

2.3.7.1. Type-3 LSA filter

2.3.7.1.1. Only can be done on the ABR

2.3.7.1.2. router ospf <process-id>

2.3.7.1.3. area <area-id> filter-list <prefix-list> [in | out]

2.3.7.2. Prevent LSA from being installed on routing table

2.3.7.2.1. ip prefix-list <pl-filter> permit <net-to-be-filtered>

2.3.7.2.2. route-map <route-map-filter> deny 10

2.3.7.2.3. match ip address prefix <pl-filter>

2.3.7.2.4. route-map flter <route-map-filter> permit 20

2.3.7.2.5. router ospf <process>

2.3.7.2.6. distribute-list route-map <route-map-filter> in

2.3.8. Authentication

2.3.8.1. Enable and set type

2.3.8.1.1. Interface

2.3.8.1.2. Area

2.3.8.1.3. Virtual-Link

2.3.8.2. Password

2.3.8.2.1. Text

2.3.8.2.2. MD5

2.3.8.2.3. Virtual-link

2.3.9. MPLS

2.3.9.1. Sham-Link

2.3.9.1.1. Avoid routing outside MPLS Core

2.3.9.1.2. Created in PE routers, when backdoor link exists between two sites.

2.3.9.1.3. area <area-id> sham-link <src-add> <dst-addr> cost <cost>

2.3.9.1.4. Use loopback interface for source/destination

2.3.9.1.5. show ip ospf sham-link

2.3.9.2. Domain-id

2.3.9.2.1. 8-byte value of BGP update that identify OSPF domain

2.3.9.2.2. Routes received from far-end CPE are classified as:

2.3.9.2.3. router ospf <process-id>

2.3.9.2.4. domain-id <ip-address-format-id>

2.3.9.3. VRF-Lite

2.3.9.3.1. OSPF routes received by CPEs have the down-bit set

2.3.9.3.2. Down-bit don't let OSPF routes be re-learned bt BGP; Avoid loops

2.3.9.3.3. Don't let routes be installed on VRF either

2.3.9.3.4. To enable VRF use on CE:

2.3.9.3.5. router ospf <process-id>

2.3.9.3.6. capability vrf-lite

2.3.10. Administrative Distance

2.3.10.1. distance <ad> <source-IP> <source-wildcard> <acl>

2.3.10.1.1. It's not possible to change AD from only one neighbor, it must change for all neighbors for that process

2.3.10.2. distance ospf external <O-EX-distance> inter-area <O-IA-distance> intra-area <O-distance>

2.4. PBR

2.4.1. ip local policy route-map <map-name>

2.4.1.1. Local packets are not subject to PBR. Local policy fix this.

2.4.2. interface <if>

2.4.2.1. interface where the packet would pass by

2.4.3. ip policy route-map <map-name>

2.4.4. route-map <map-name>

2.4.5. match ip address <acl>

2.4.6. set ip next-hop <ip>

2.5. PFR/OER

2.5.1. Configuration guide

2.5.1.1. Master

2.5.1.1.1. Key chain

2.5.1.1.2. Border

2.5.1.1.3. Measure

2.5.1.1.4. Learn

2.5.1.1.5. Route

2.5.1.1.6. Prefixes

2.5.1.2. Border

2.5.1.2.1. Key chain

2.5.1.2.2. Master

2.5.1.2.3. NAT

2.6. 1st hop redundancy

2.6.1. Cisco Proprietary?

2.6.1.1. Y

2.6.1.1.1. Load balance

2.6.1.2. N

2.6.1.2.1. VRRP

2.6.2. Configuration

2.6.2.1. HSRP = standby

2.6.2.2. VRRP = vrrp

2.6.2.3. GLBP = glbp

2.6.2.4. standby <group> IP <ip-address>

2.6.2.5. standby <group> priority <priority-number>

2.6.2.5.1. Higher wins

2.6.2.6. standby <group> preempt

2.6.2.7. standby <group> track <track> decrement <priority-decrement>

3. BGP

3.1. Path attributes {Order of choice}

3.1.1. Must be know?

3.1.1.1. Y

3.1.1.1.1. Present in all updates?

3.1.1.2. N

3.1.1.2.1. Must forward?

3.1.2. Local Info

3.1.2.1. {1} Weight

3.1.2.1.1. Local information to the router, never send in updates

3.1.2.1.2. Higher wins

3.2. Configuration

3.2.1. Basic

3.2.1.1. router bgp <as-number>

3.2.1.2. neighbor <ip-address> remote-as

3.2.1.3. no auto-summary

3.2.1.4. Synchronization?

3.2.1.4.1. Y

3.2.1.4.2. N

3.2.1.5. Peer-group

3.2.1.5.1. neighbor <pgNAME> peer-group

3.2.1.5.2. neighbor <pgNAME> ...

3.2.1.5.3. neighbor <ip-address> peer-group <pgNAME>

3.2.1.6. Direct connection?

3.2.1.6.1. N

3.2.1.7. iBGP

3.2.1.7.1. Not fully-meshed?

3.2.1.8. Community

3.2.1.8.1. ip bgp-community new-format

3.2.1.8.2. neighbor <ip-address> send-community [standard | extended | both]

3.2.1.9. iBGP to IGP redistribution

3.2.1.9.1. Disabled by default

3.2.1.9.2. To enable:

3.2.1.9.3. router bgp <as-number>

3.2.1.9.4. bgp redistribute internal

3.2.2. Inject routes

3.2.2.1. network

3.2.2.1.1. network <ip-address> mask y.y.y.y

3.2.2.1.2. network <ip-address> mask y.y.y.y backdoor

3.2.2.2. default

3.2.2.2.1. neighbor <ip-address> default-originate

3.2.2.2.2. Don't need to have the default-route

3.2.2.2.3. Don't supress more specific

3.2.2.3. Summarization

3.2.2.3.1. aggregate-address

3.2.2.4. Conditional

3.2.2.4.1. Injection

3.2.2.4.2. Advertising

3.2.3. Control advertisement

3.2.3.1. neighbor <ip-address> distribute-list <acl-number> [out | in]

3.2.3.2. neighbor <ip-address> filter-list <ip-as-path-acl-number> [out | in]

3.2.3.3. neighbor <ip-address> route-map <rmBGP> [out | in]

3.2.3.4. route-map <rmBGP>

3.2.3.5. match ip address <acl-number>

3.2.3.6. match as-path <ip-as-path-acl-number>

3.2.3.7. match community <community-list-number>

3.2.3.8. set local-preference

3.2.3.9. set metric

3.2.3.10. set as-path prepend

3.2.3.11. set community

3.2.3.12. Manipulate prefixes

3.2.3.12.1. Filter private ASs

3.2.3.12.2. Change local AS

3.2.3.12.3. Change next-hop for all?

3.2.3.13. Propagate prefix-list

3.2.3.13.1. Sender

3.2.3.13.2. Receiver

3.2.3.14. SET

3.2.3.15. Match

3.2.4. Syncronization

3.2.4.1. Disable syncronization

3.2.4.1.1. no synchronization

4. IPv6

4.1. Addressing

4.1.1. Loopback

4.1.1.1. ::1

4.1.2. empty

4.1.2.1. ::

4.1.3. Default route

4.1.3.1. ::/0

4.1.4. Link-Local

4.1.4.1. FE80::/64

4.1.5. Unique-local

4.1.5.1. FC00::/7

4.1.6. Global

4.1.6.1. 2000::/3

4.2. ICMPv6

4.2.1. Combines several IPv4 funtions: ICMPv4, IGMP and ARP

4.3. Configuration

4.3.1. ipv6 unicast-routing

4.3.2. Interface

4.3.2.1. ipv6 enable

4.3.2.1.1. Auto-generate link-local, even if the interface don't have IPv6 unique/global address

4.3.2.2. ipv6 address <ipv6-address>

4.3.2.3. ipv6 address <link-local-add> link-local

4.3.2.4. ipv6 address <prefix-only> eui-64

4.3.3. Routing

4.3.3.1. Static

4.3.3.1.1. ipv6 route <ipv6-network/length> <next-hop-address>

4.3.3.1.2. ipv6 route <ipv6-network/length> <next-hop-link-local-add> <exit-interface>

4.3.3.2. The routing process is automatically created when assigned to interface

4.3.3.3. RIP

4.3.3.3.1. interface <if>

4.3.3.3.2. ipv6 rip <process-name> enable

4.3.3.3.3. ipv6 rip <process-name> default-information originate

4.3.3.3.4. ipv6 router rip <process-name>

4.3.3.4. EIGRP

4.3.3.4.1. Uses FF02::A (all EIGRP routers)

4.3.3.4.2. interface <if>

4.3.3.4.3. ipv6 eigrp <as-number>

4.3.3.4.4. ipv6 router eigrp <as-number>

4.3.3.5. OSPF

4.3.3.5.1. interface <if>

4.3.3.5.2. ipv6 ospf <process> area <area-number>

4.3.3.5.3. ipv6 router ospf <process>

4.4. Tunnels

4.4.1. Tunnels source and destination are always IPv4

4.4.2. Manual

4.4.2.1. Manual Tunnel

4.4.2.1.1. IPv6 -> IPv4::IPv6 -> IPv6

4.4.2.1.2. interface tunnel <if>

4.4.2.1.3. ipv6 address <ipv6>

4.4.2.1.4. tunnel source <ipv4>

4.4.2.1.5. tunnel destination <ipv4>

4.4.2.1.6. tunnel mode ipv6ip

4.4.2.2. IPv6 over GRE

4.4.2.2.1. IPv6 -> IPv4::GRE::IPv6 -> IPv6

4.4.2.2.2. Can carry non-IP packets, like IS-IS

4.4.2.2.3. interface tunnel <if>

4.4.2.2.4. ipv6 address <ipv6>

4.4.2.2.5. tunnel source <ipv4>

4.4.2.2.6. tunnel destination <ipv4>

4.4.2.2.7. tunnel mode gre ip

4.4.3. Automatic

4.4.3.1. 6to4

4.4.3.1.1. IPv6 -> IPv4::IPv6 -> IPv6

4.4.3.1.2. 2002:[IPv4-in-hex]::/48

4.4.3.1.3. interface tunnel <if>

4.4.3.1.4. ipv6 address 2002::[IPv4]::

4.4.3.1.5. tunnel source <ipv4>

4.4.3.1.6. tunnel mode ipv6ip 6to4

4.4.3.1.7. ipv6 route 2002::/16 tunnel<if>

4.4.3.1.8. Destination is extracted from the IPv6 data packet destination IP

4.4.3.1.9. No Multicast Support

4.4.3.2. ISATAP

4.4.3.2.1. IPv6 -> IPv4::IPv6 -> IPv6

4.4.3.2.2. [64-bit-prefix]:0000:5ef3:[IPv4-in-hex]/64

4.4.3.2.3. interface tunnel <if>

4.4.3.2.4. ipv6 address [64-bit-prefix]::/64 eui-64

4.4.3.2.5. tunnel source <ipv4>

4.4.3.2.6. no ipv6 nd suppress-ra

4.4.3.2.7. tunnel mode ipv6ip isatap

4.4.3.2.8. Destination is extracted from the IPv6 data packet destination IP

4.4.3.3. 6rd

4.4.3.3.1. 6rd utilises an SP's own IPv6 address prefix - avoids well-known prefix (2002::/16)

4.4.3.3.2. CE

4.4.3.3.3. BR

4.4.3.4. Dual Stack Lite

4.4.3.4.1. Dual stack endpoints

4.4.3.4.2. IPv6 Backbone

4.4.3.4.3. Based on Carrier Grade NAT

4.5. IPV6 NAT

4.5.1. NAT-PT

4.5.1.1. Interfaces

4.5.1.1.1. IPV6 side

4.5.1.1.2. IPv4 side

4.5.1.2. Static NAT

4.5.1.2.1. ipv6 nat v4v6 source <ipv4-address> <ipv6-address>

4.5.1.2.2. ipv6 nat v6v4 source <ipv6-address> <ipv4-address>

4.5.1.3. Dynamic NAT

4.5.1.3.1. ipv6 nat v4v6 source list <acl-ipv4> pool <pool-ipv6>

4.5.1.3.2. ipv6 nat v6v4 source list <acl-ipv6> pool <pool-ipv4>

4.5.1.4. ipv6 nat prefix

4.5.1.4.1. Installs the connected prefix in the IPv6 routing table

4.5.1.4.2. ipv6 nat prefix <prefix-ipv6>

5. Multicast

5.1. PIM Mode

5.1.1. Dense Mode

5.1.1.1. Flood & Prune

5.1.1.2. ip pim dense-mode

5.1.2. Sparse Mode

5.1.2.1. Any Source Multicast (ASM)

5.1.2.1.1. Uses RP

5.1.2.1.2. Shared -> Source Specific (*,G -> S.G)

5.1.2.1.3. ip multicast-routing

5.1.2.1.4. Static RP?

5.1.2.2. Use (S,G) ?

5.1.2.2.1. Y

5.1.2.2.2. N

5.1.3. MSDP (Multicast source discovery protocol)

5.1.3.1. Allow RPs to excahnge information about groups sources

5.1.3.2. ip msdp peer <ip-address>

5.1.3.3. ip msdp originator-id <loopback-if>

5.1.3.4. ip msdp mesh-group <group-name <neighbors-IP-address>

5.1.3.4.1. Used if there are more than two RP fully-meshed, to avoid loops

5.1.4. NBMA networks

5.1.4.1. RPF rules prevent traffic from spoke to hub to be replicated to other spokes

5.1.4.1.1. Use NBMA mode

5.1.4.1.2. Create tunnel between spokes and routers

5.2. IGMP

5.2.1. v1

5.2.1.1. Old

5.2.1.2. Slow leave

5.2.2. v2

5.2.2.1. Join to mcast group address

5.2.2.2. Fast leave

5.2.2.3. Querier

5.2.3. v3

5.2.3.1. Join to 224.0.0.22

5.2.3.1.1. Easy to Layer2 snooping

5.2.3.2. Source filter

5.2.3.2.1. Enable SSM

5.2.4. IGMP Snooping

5.2.4.1. ip igmp snooping <vlan> <interface connected to mcast router>

6. QoS

6.1. RSVP

6.1.1. Messages

6.1.1.1. PATH = ask for resources

6.1.1.2. RESV = Confirm resource reservation

6.1.1.3. RESV-CONF = Last confirmation

6.1.1.4. Order

6.1.1.4.1. Source send PATH

6.1.1.4.2. Destination send RESV

6.1.1.4.3. Destination send PATH

6.1.1.4.4. Source send RESV

6.1.1.4.5. Destination send RESV-CONF

6.1.2. Configuration

6.1.2.1. Interface

6.1.2.1.1. ip rsvp bandwidth <total> <flow>

6.1.2.2. LLQ

6.1.2.2.1. ip rsvp pq-profile <max-rate> <max-burst> <peak-to-avg-ratio-%>

6.1.2.3. fair-queue must be enabled.

6.1.2.3.1. Frame-Relay

6.1.2.3.2. fair-queue

6.1.2.4. Source

6.1.2.4.1. ip rsvp sender-host <ip-dest> <ip-src> [tcp | udp] <dst-port> <src-port> <bw> <peak>

6.1.2.4.2. The "-host" generates PATH msg; without it the router waits for traffic to send it.

6.1.2.4.3. show ip rsvp sender

6.1.2.5. Destination

6.1.2.5.1. ip rsvp reservation-host <ip-dest> <ip-src> [tcp | udp] <dst-port> [ff | sw | wf] rate <bw> <peak>

6.1.2.5.2. The "-host" generates RESV msg; without it the router waits for traffic to send it.

6.1.2.5.3. ff (fixed filter)= Only one source can use the reservation

6.1.2.5.4. se (shared explicit) = shared with some specified sources

6.1.2.5.5. wf (wildcast filter) = shared with any source

6.1.2.5.6. show ip rsvp reservation

6.1.2.5.7. show ip rsvp installed [detailed]

6.2. FRTS

6.2.1. Generic Traffic Shape

6.2.1.1. traffic-shape rate <bit-rate> <burst-size> <excess-burst-size>

6.2.2. Frame Relay Traffic Shapping

6.2.2.1. Config

6.2.2.1.1. Interface <if>

6.2.2.1.2. frame-relay trafic-shapping

6.2.2.1.3. DLCI only (optional)

6.2.2.1.4. frame-relay class <class-name>

6.2.3. Class-Based Traffic Shapping

6.2.3.1. Can be combined with MQC

6.2.3.2. Traffic classes

6.2.3.3. Configuration

6.2.3.3.1. interface <if-fr>

6.2.3.3.2. frame-relay interface-dlci <dlci>

6.2.3.3.3. service-policy <policy-map-name>

6.2.3.3.4. policy-map <policy-map-name>

6.2.3.3.5. class <class-name>

6.2.3.3.6. shape

6.2.3.3.7. class-map <class-name>

6.2.3.3.8. match

6.3. MQC

6.3.1. interface <if>

6.3.2. service-policy [input | output] <policy-name>

6.3.3. policy-map <policy-name>

6.3.4. class <class-name>

6.3.5. set

6.3.5.1. ip precedence

6.3.5.2. ip dscp

6.3.5.3. cos

6.3.6. class-map <class-name>

6.3.7. match (qos, acl, mac)

6.3.8. match protocol

6.3.8.1. nbar

6.3.9. match any

6.4. Switch QoS (MLS)

6.4.1. mls qos behavior

6.4.1.1. no mls qos

6.4.1.1.1. QoS disabled

6.4.1.1.2. COS = 0

6.4.1.1.3. COS = 5

6.4.1.1.4. Untagged

6.4.1.2. mls qos

6.4.1.2.1. QoS enabled

6.4.1.2.2. COS = 0

6.4.1.2.3. COS = 5

6.4.1.2.4. Untagged

6.4.1.3. mls qos (if) mls qos trust cos

6.4.1.3.1. COS = 0

6.4.1.3.2. COS = 5

6.4.1.3.3. Untagged

6.4.1.4. mls qos (if) mls qos cos X override

6.4.1.4.1. COS = 0

6.4.1.4.2. COS = 5

6.4.1.4.3. Untagged

6.4.2. Layer 2 to Layer 3 mapping

6.4.2.1. Inbound

6.4.2.1.1. cos-dscp map

6.4.2.2. Outbound

6.4.2.2.1. cos-dscp map

6.4.2.3. show mls qos map [dscp]

6.4.3. Port trust

6.4.3.1. (if) # mls qos trust [dscp | cos | ip-prec]

6.4.3.1.1. if trust COS, DSCP is modified, based on COS-to-DSCP map

6.4.3.1.2. To avoid, use DSCP transparency

6.4.3.2. Maps

6.4.3.2.1. COS = 0 to 7

6.4.3.2.2. IP Precendence = 0 to 7

6.4.3.2.3. DSCP = 0 to 63

6.4.3.2.4. COS-to-DSCP map

6.4.3.2.5. IP Prec-to-DSCP map

6.4.3.2.6. DSCP-to-COS map

6.4.3.2.7. DSCP to DSCP mapping (aka DSCP Mutation)

6.4.4. 3560

6.4.4.1. SRR

6.4.4.1.1. sharing

6.4.4.1.2. shaping

6.4.4.2. Two ingress queues

6.4.4.2.1. Only support SRR sharing

6.4.4.2.2. Normal

6.4.4.2.3. Expedite

6.4.4.3. Four egress gueues

6.4.4.3.1. Uses queue-set

6.4.4.3.2. Assign queue-set to interface

6.4.4.3.3. Set queue-set threshold and buffers

6.4.4.3.4. Map DSCP/CoS to queue

6.4.4.3.5. Set SRR shape or share to queue.

6.4.4.3.6. Expedite (queue 1)

6.4.4.3.7. Limit bandwitch for interface

6.4.5. Use MQC to apply QoS to interface

6.4.5.1. inbound only

6.4.5.2. interface X/Y

6.4.5.3. service-policy input <pmQOS>

6.4.5.4. policy-map <pmQOS>

6.4.5.5. class <cmA>

6.4.5.6. trust [cos | dscp | ip-prec]

6.4.5.7. set [dscp | ip-prec]

6.4.5.8. police [rate-bps] [burst-byte] exceed-action [drop | policied-dscp-transmit]

6.4.5.9. class-map cmA

6.4.5.10. match [acl | ip dscp | ip prec | input-interface]

6.4.5.11. OR

7. Security

7.1. Switch security

7.1.1. Control DHCP packets

7.1.1.1. DHCP Snooping

7.1.1.1.1. Only allow DCHP responses from a trusted port

7.1.1.1.2. ip dhcp snooping [vlan [vlans]]

7.1.1.1.3. DHCP server must be connected to a trusted port

7.1.2. Control frames based on source

7.1.2.1. Filter frames

7.1.2.1.1. IP Source Guard

7.1.2.2. Filter ARP packets

7.1.2.2.1. ARP inspection

7.1.3. Filter specific frames

7.1.3.1. vlan filter <amVLAN> vlan-list <vlan-range>

7.1.3.1.1. vlan access-map <amVLAN>

7.1.3.1.2. Match

7.1.3.1.3. Action

7.1.4. Control VLAN/interface traffic

7.1.4.1. Port Blocking

7.1.4.1.1. Unknow destination MACs packets are forwarded to all ports. To prevent:

7.1.4.1.2. interface <blocked-if>

7.1.4.1.3. switchport block unicast

7.1.4.1.4. switchport block multicast

7.1.4.2. Port Security

7.1.4.2.1. Restric how many and which ones mac-address have access to an interface

7.1.4.2.2. interface <secured-if>

7.1.4.2.3. Enable Port Security

7.1.4.2.4. Maximum mac-address learned

7.1.4.2.5. How to react

7.1.4.2.6. Static MAC assignment

7.1.4.2.7. Learn MACs and don't forget on reload

7.1.4.2.8. Static MACS and don't forget on reload

7.1.4.3. Port protected

7.1.4.3.1. One protected port don't talk with another protected port

7.1.4.3.2. interface <protected-if>

7.1.4.3.3. switchport protected

7.1.4.4. Private VLANs

7.1.4.4.1. Port modes

7.1.4.4.2. VLAN modes

7.1.4.4.3. Configuration

7.2. IP Options

7.2.1. Drop all packets with options marked

7.2.1.1. ip options drop

7.2.2. Ignore the option parameters

7.2.2.1. ip options ignore

8. IP Services

8.1. SPAN

8.1.1. Up to two source sessions

8.1.2. Up to 64 destination ports

8.1.3. Source port = Physical, Trunk, Routed, Voice

8.1.4. monitor session X source [interface | vlan] [rx | tx | both]

8.1.5. monitor session X filter vlan [range]

8.1.6. monitor session X destination [interface | remote vlan]

8.1.7. RSPAN

8.1.7.1. vlan Y

8.1.7.2. remote-span

8.1.7.3. monitor session X source [remote vlan] Z

8.1.7.4. monitor session X destination [interface]

8.1.7.5. Destination switch

8.1.7.6. Intermediate switches

8.1.8. Source switches

8.2. Reflexive ACL

8.2.1. Config

8.2.1.1. interface <if-inside>

8.2.1.2. ip access-group <acl-in> in

8.2.1.2.1. ip access-list extended <acl-in>

8.2.1.2.2. evaluate <tcp-temp-name>

8.2.1.3. ip access-group <acl-out> out

8.2.1.3.1. ip access-list extended <acl-out>

8.2.1.3.2. permit tcp any any reflect <tcp-temp-name>

8.2.1.4. Can be done one in each interface (in/out)

8.3. EEM

8.3.1. Event Detector

8.3.1.1. Monitors:

8.3.1.1.1. CLI Command

8.3.1.1.2. Events

8.3.1.1.3. Object track

8.3.1.1.4. SNMP Events

8.3.1.1.5. Syslog messages

8.3.1.1.6. Interface counters

8.3.1.1.7. Timers

8.3.2. Event Manager

8.3.3. Policy Director

8.3.3.1. Applet Policy

8.3.3.1.1. event manager applet <appNAME>

8.3.3.1.2. event <monitor>

8.3.3.1.3. action x.x <action>

8.3.3.1.4. action 1.0 cli command "cli command"

8.3.3.1.5. action 1.1 mail server <server> from <from> to <to>

8.3.3.1.6. action 1.2 syslog message "message"

8.3.3.2. TCL Policy

8.3.3.2.1. event manager enviroment <variable>

8.3.3.2.2. event manager directoy user policy <path>

8.3.3.2.3. event manager policy <filename>

8.4. WCCP

8.4.1. UDP Port 2048

8.4.2. Basic config

8.4.2.1. ip wccp version [1 | 2]

8.4.2.1.1. Version 1 = 1 router, Cluster HTTP only

8.4.2.1.2. Version 2 = Multiple routers; Clusters

8.4.2.2. ip wccp web-cache

8.4.2.3. TCP Promiscuous mode

8.4.2.3.1. ip wccp 61

8.4.2.3.2. ip wccp 62

8.4.2.4. From which interfaces?

8.4.2.4.1. interface X/Y

8.4.2.4.2. Standard web service

8.4.2.4.3. TCP Promiscuous mode

8.4.2.4.4. Except:

8.4.3. Who will be redirected?

8.4.3.1. ip wccp web-cache redirect-list <acl>

8.4.4. To which web caches?

8.4.4.1. ip wccp web-cache group-list <acl>

8.4.5. Group web caches

8.4.5.1. ip wccp web-cache group-add <mcast-address> password <pw>

8.4.6. And if web cache is not available?

8.4.6.1. block

8.4.6.1.1. ip wccp mode closed

8.4.6.2. passthrough

8.4.6.2.1. ip wccp mode open

8.4.7. 3560

8.4.7.1. sdm prefer extended

8.4.7.2. reload

8.5. IP SLA

8.5.1. Configuration

8.5.1.1. Probe

8.5.1.1.1. ip sla <oper-number>

8.5.1.1.2. [probe-type]<dest-IP> <dest-port> interval <interval>

8.5.1.1.3. frequency <seconds>

8.5.1.1.4. ip sla schedule <oper-number> life [forever | <seconds>] [start-time <time> | pending | now]

8.5.1.1.5. show ip sla configuration <oper-number>

8.5.1.1.6. show ip sla statistics

8.5.1.2. Responder

8.5.1.2.1. ip sla

8.5.1.2.2. ip sla responder udp-echo ipaddress <ip-address> port <port>

8.5.1.3. Authentication

8.5.1.3.1. ip sla key-chain <key>

8.6. IP Traffic Export

8.6.1. Similar to SPAN on switches

8.6.2. Profile

8.6.2.1. ip traffic-export profile <profile-name> mode [capture | export]

8.6.2.1.1. Capture = store in router flash

8.6.2.1.2. Export = Send

8.6.2.2. interface <export-interface>

8.6.2.3. mac-address <export-host>

8.6.2.4. incoming [access-list <acl> | sample on-in-every <number>]

8.6.2.5. outgoing [access-list <acl> | sample on-in-every <number>]

8.6.2.6. bidirectional

8.6.3. Apply

8.6.3.1. interface <monitored-interface>

8.6.3.2. ip traffic-export apply <profile-name> size <capture-buffer>

8.7. SNMP

8.7.1. Security Models

8.7.1.1. noAuth noPriv

8.7.1.2. Auth Priv

8.7.1.3. Auth noPriv

8.7.2. Config

8.7.2.1. v3

8.7.2.1.1. What?

8.7.2.1.2. Which?

8.7.2.1.3. Who?

8.7.2.1.4. Traps

8.7.2.1.5. Engine

8.7.2.2. v1/v2

8.7.2.2.1. What?

8.7.2.2.2. Community

8.8. NetFlow

8.8.1. Flow =

8.8.1.1. Source IP

8.8.1.2. Dest IP

8.8.1.3. Source Port

8.8.1.4. Dest Port

8.8.1.5. Layer 3

8.8.1.6. ToS

8.8.1.7. Input Interface

8.8.2. Flows can be on

8.8.2.1. Collector

8.8.2.2. Local cache

8.8.3. Config

8.8.3.1. Basic

8.8.3.1.1. ip flow-export destination <collector-ip> <udp-port>

8.8.3.1.2. ip flow-export version 9

8.8.3.1.3. interface <if>

8.8.3.2. Aggregation cache

8.8.3.2.1. ip flow aggregation-cache [prefix | protocol | etc]

8.8.3.3. Filter and sampling

8.8.3.3.1. Filter AND Sampling

8.8.3.3.2. Sampling only

8.9. NAT

8.9.1. Interfaces

8.9.1.1. interface <if-inside>

8.9.1.2. ip nat inside

8.9.1.3. interface <if-outside>

8.9.1.4. ip nat outside

8.9.2. Static or Dynamic?

8.9.3. Source or Destination?

8.9.4. ip nat [inside | outside] [source | destination] static <from> <to>

8.9.4.1. When the packet hit the [inside | outside] interface

8.9.4.2. Change the [source | destination]

8.9.4.3. From <from>

8.9.4.4. To <to>

8.9.4.5. nat outside source = nat inside destination

8.9.5. ip nat pool <pool-name> <start-IP> <end-IP> [netmask | prefix-length]

8.9.6. access-list <acl-number> permit <source-address> <source-wildcard>

8.9.7. ip nat inside source list <acl-number> pool <pool-name> [overload]

8.9.8. Load balance

8.9.8.1. ip nat pool <pool-name> <start-IP> <end-IP> [netmask | prefix-length] type rotary

8.9.8.2. ip nat inside destination-list <acl-name> pool <pool-name>

8.9.8.3. Pool = real hosts

8.9.8.4. ACL = Virtual address

8.9.9. Select which IPs get translated.

8.9.9.1. ip nat inside source static <from> <to> route-map <rm-name>

8.9.10. Stateful NAT

8.9.10.1. Use for asymmetrical routing and redundancy

8.9.10.2. With HSRP

8.9.10.2.1. ip nat inside source static <from> <to> redundancy <group-name>

8.9.10.2.2. standby <group> name <group-name>

8.9.10.3. Configuration

8.9.10.3.1. ip nat stateful <id>

8.9.10.3.2. Primary

8.9.10.3.3. Secondary

8.9.10.3.4. peer <other-router-IP>

8.9.10.3.5. mapping-id <map-id>

8.9.10.3.6. ip nat source static route-map <rm-name> pool <pool-name> mapping-id <map-id>

8.10. DHCP

8.10.1. RARP = Layer 2 header

8.10.2. BOOTP = Layer 3 header

8.10.3. DHCP = More options (lease time, extra fields, dynamic range)

8.10.4. DHCP Relay

8.10.4.1. interface <if>

8.10.4.1.1. interface that receives de DHCP request

8.10.4.2. ip helper-address <dhcp-server>

8.10.5. DHCP Server

8.10.5.1. Config

8.10.5.1.1. service dhcp

8.10.5.1.2. ip dhcp excluded-address <start-ip> <end-ip>

8.10.5.1.3. ip dhcp pool <pool-name>

8.10.5.1.4. Network

8.10.5.1.5. Host

8.10.5.1.6. domain <domain-name>

8.10.5.1.7. dns-server <server-IP>

8.10.5.1.8. default-router <gw-ip>

8.10.5.1.9. lease [days [hours] [minutes] | infinite]

8.10.5.2. Troubleshooting

8.10.5.2.1. clear ip dhcp dinding *

8.10.5.2.2. show ip dhcp binding

8.10.5.2.3. show dhcp lease

8.11. Lock and Key Security

8.11.1. Lock the traffic

8.11.1.1. interface <if-traffic>

8.11.1.2. ip access-group <acl> in

8.11.1.3. access-list <acl> permit <always-allowed-traffic>

8.11.1.4. access-list <acl> dynamic <temprary-acl-name> timeout <absolut-seconds> permit <temporary-traffic>

8.11.2. Telnet to enable

8.11.2.1. line vty 0

8.11.2.2. autocommand access-enable <host> timeout <inactivity-seconds>

8.12. NTP

8.12.1. Client/Server

8.12.1.1. Pull method, from client to server

8.12.1.2. Server

8.12.1.2.1. ntp master [stratum]

8.12.1.2.2. Access Control

8.12.1.2.3. Authentication

8.12.1.3. Client

8.12.1.3.1. ntp server <ip-address>

8.12.1.3.2. ntp access-group peer <aclSERVER>

8.12.1.3.3. Authentication

8.12.2. Peer

8.12.2.1. Push/Pull method

8.12.2.2. ntp peer <ip-address>

8.12.2.3. ntp access-group peer <aclPEER>

8.12.3. UDP port 123

8.13. RMON

8.13.1. Configuration

8.13.1.1. Interface

8.13.1.1.1. rmon [native | promiscuous]

8.13.1.2. rmon queuesize <size>

8.13.1.3. rmon alarm <number> <varable> <interval> [delta | absolute] rising-threshold <value> falling-threshold <value>

8.13.1.4. show rmon

8.13.1.5. show rmon alarms

8.13.1.6. show rmon events

9. Misc

9.1. Regular Expression

9.1.1. ( ) Parenthesis

9.1.1.1. Grouping

9.1.2. | (pipe)

9.1.2.1. OR expression

9.1.3. ? (question mark)

9.1.3.1. 0 or 1 occurrence of previous

9.1.4. * (asterisk)

9.1.4.1. 0 or more occurrences of previous

9.1.5. + (Plus sign)

9.1.5.1. 1 or more occurrences of previous

9.1.6. \ (backslash)

9.1.6.1. Escape special characters

9.1.7. [ ] (brackets)

9.1.7.1. Any character from range

9.1.8. ^ (Circumflex )

9.1.8.1. Start of line

9.1.9. $ (dollar sign)

9.1.9.1. End of line

9.1.10. _ (underline)

9.1.10.1. Can be replaced by comma (,), space ( ), start of line (^), end of line ($), rigt or left brace ({})

9.2. SSH

9.2.1. Configuration

9.2.1.1. Generate keys

9.2.1.1.1. crypto key generate rsa

9.2.1.2. Enable SSH server

9.2.1.2.1. ip ssh [version <version-number> | timeout <seconds> | authentication-retries <number>]

9.2.2. show crypto key mypubkey rsa

9.3. Bridge

9.3.1. Ethernet and Frame-Relay example

9.3.1.1. R5

9.3.1.1.1. interface Ethernet0/0.40

9.3.1.1.2. encapsulation dot1Q 40

9.3.1.1.3. ip address 145.11.25.5 255.255.255.0

9.3.1.2. R2

9.3.1.2.1. Global configuration

9.3.1.2.2. Ethernet

9.3.1.2.3. Serial FR

9.3.1.3. R3

9.3.1.3.1. interface Serial1/0

9.3.1.3.2. no ip address

9.3.1.3.3. encapsulation frame-relay

9.3.1.3.4. frame-relay map bridge 302 broadcast

9.3.1.3.5. bridge-group 1