|
0:00:12
|
So, on our next section, we're gonna
|
|
0:00:16
|
packets that EIGRP can use for transport,
|
|
0:00:19
|
which is similar to RIP Version 2,
|
|
0:00:22
|
where by default, the protocol is going
|
|
0:00:29
|
and again, EIGRP does use its own transport
|
|
0:00:35
|
However, some of these messages, like the
|
|
0:00:40
|
acknowledgements to the updates,
|
|
0:00:43
|
replies to the query messages, those are
|
|
0:00:47
|
So, this implies that we need to have
|
|
0:00:51
|
between the devices, but also
|
|
0:00:55
|
Now, where this could
|
|
0:00:58
|
is if there's any type of troubleshooting
|
|
0:01:02
|
maybe there's access lists that are
|
|
0:01:05
|
going to protocol 88, thats gonna stop us
|
|
0:01:11
|
which includes the synchronization
|
|
0:01:15
|
Now, just like in RIP Version 2,
|
|
0:01:21
|
transport by using the
|
|
0:01:23
|
One minor difference
|
|
0:01:26
|
is that in RIP, when we issue
|
|
0:01:28
|
it sends unicasts in addition
|
|
0:01:33
|
where with EIGRP, the neighbor
|
|
0:01:37
|
and the listening for and
|
|
0:01:41
|
So, this essentialy means that
|
|
0:01:45
|
we're gonna have to use it on
|
|
0:01:48
|
Now, the passive interface in EIGRP
|
|
0:01:53
|
Since we are establishing
|
|
0:01:57
|
that we need both the inbound
|
|
0:02:00
|
establish the routing table and the topology.
|
|
0:02:04
|
It means that any link
|
|
0:02:07
|
would not have adjacencies
|
|
0:02:11
|
So, passive interface typically in EIGRP
|
|
0:02:16
|
Where we want to advertise an interface
|
|
0:02:22
|
But we don't want to establish
|
|
0:02:25
|
So, we'll see, it's different than
|
|
0:02:30
|
So, let's take a look at this
|
|
0:02:34
|
between router 5 and switch 2,
|
|
0:02:39
|
we have simply two neighbors on this link.
|
|
0:02:42
|
So, if we were to look at the Debug IP
|
|
0:02:48
|
we should see that router 5 in switch 2
|
|
0:02:56
|
for their exchange of the database.
|
|
0:02:58
|
Then, if there's any type of Layer 2
|
|
0:03:03
|
we'll see what the result of that is from the show-up
|
|
0:03:09
|
So, let's take a look at the
|
|
0:03:13
|
And let's see, at this point, do we actually
|
|
0:03:17
|
So, again, if we look at the
|
|
0:03:22
|
this tells me that I
|
|
0:03:26
|
on that link that connects to switch 2,
|
|
0:03:30
|
So, it says, "There's one PR on the link."
|
|
0:03:33
|
If we look at the Show IP EIGRP Neighbors,
|
|
0:03:36
|
I can see that I do have adjacency
|
|
0:03:40
|
and the queue count is 0.
|
|
0:03:44
|
So, the queue count being
|
|
0:03:50
|
that all of those neighbors are fully adjacent
|
|
0:04:00
|
So, next, let's look at the
|
|
0:04:04
|
between router 5 and switch 2,
|
|
0:04:08
|
and then we will add new
|
|
0:04:13
|
we'll also clear the neighbors and see
|
|
0:04:17
|
Now, the cutdown on a
|
|
0:04:20
|
what I'm gonna do first is simply
|
|
0:04:23
|
that were running EIGRP on.
|
|
0:04:26
|
Which would be router 5's connection
|
|
0:04:30
|
And then also that point-to-point link
|
|
0:04:35
|
So, now, we could look at
|
|
0:04:39
|
and also the Debug EIGRP Packets.
|
|
0:04:54
|
And we see between these
|
|
0:04:57
|
from the interface address of swtich 2,
|
|
0:05:01
|
we have packets going to 224.0.0.10.
|
|
0:05:03
|
It says, "The protocol number is 88."
|
|
0:05:06
|
So, we can tell in fact that this is EIGRP
|
|
0:05:10
|
Now, if I were to clear the neighbors,
|
|
0:05:14
|
once we're looking at the same debug
|
|
0:05:18
|
and Debug EIGRP Packets.
|
|
0:05:21
|
Then say Clear IP EIGRP Neighbors.
|
|
0:05:27
|
And we could see, this is quite a lot debug output
|
|
0:05:34
|
So, normally, within the scope of the exam,
|
|
0:05:38
|
you would not want to send this type
|
|
0:05:43
|
You ideally would wanna
|
|
0:05:46
|
or maybe a syslog server where you
|
|
0:05:51
|
But here, we could see between
|
|
0:05:56
|
router 5 says that it is sending an update
|
|
0:06:00
|
on Fast Ethernet 0/0.
|
|
0:06:02
|
But if we look at the
|
|
0:06:04
|
it is a unicast between the two of them.
|
|
0:06:07
|
So, it's coming from router 5's
|
|
0:06:11
|
going to switch 2, which is 155.10.58.8.
|
|
0:06:18
|
Now, between these neighbors,
|
|
0:06:20
|
physically, in the transit path, router 5
|
|
0:06:27
|
So, rotuer 5's link here physically
|
|
0:06:33
|
There's Fast Ethernet 0/0.
|
|
0:06:35
|
Then there are some trunk links
|
|
0:06:38
|
that are gonna connect between
|
|
0:06:41
|
And ultimately, get us transport
|
|
0:06:45
|
So, let's say now that on switch 1
|
|
0:06:50
|
that we have some sort of filter that is breaking the
|
|
0:06:56
|
So, let's go to switch 1.
|
|
0:07:00
|
And on switch 1, if we look at our Show CDP neighbors,
|
|
0:07:04
|
we can see on port Fast Ethernet 0/5,
|
|
0:07:09
|
that this is the connection that goes to router 5.
|
|
0:07:13
|
So, what we're gonna say here is
|
|
0:07:17
|
on that VLAN 58, that the unicast
|
|
0:07:24
|
So, I'll allow them all to just to go through
|
|
0:07:30
|
Now, there's essentially two different
|
|
0:07:34
|
I could just create a normal access list and
|
|
0:07:40
|
So, to the interface that's
|
|
0:07:43
|
Or I could configure it as a VLAN access list
|
|
0:07:48
|
and then apply it to the VLAN as a whole.
|
|
0:07:53
|
So, both of these will essentially
|
|
0:07:57
|
It just depends on whether we want to apply it
|
|
0:08:04
|
So, first, let's create the access list.
|
|
0:08:07
|
On switch 1, we'll say, "Access List 100 is going
|
|
0:08:16
|
That is coming from...
|
|
0:08:21
|
switch 2 going anywhere.
|
|
0:08:24
|
And that is coming from
|
|
0:08:28
|
Then we will permit...
|
|
0:08:31
|
Permit anything else. Permit IP any any.
|
|
0:08:34
|
Now, when we look at the result to this of
|
|
0:08:39
|
we could see that it doesn't use
|
|
0:08:43
|
Instead it says, "Deny EIGRP from that host."
|
|
0:08:47
|
And likewise for the second line.
|
|
0:08:49
|
Because for some of these IP Protocol numbers,
|
|
0:08:52
|
the IOS does have shortcut keywords in there.
|
|
0:08:54
|
So, we don't have to memorize
|
|
0:08:58
|
So, when we say Permit TCP
|
|
0:09:02
|
we're simply referring to
|
|
0:09:05
|
Now, if there is a particular
|
|
0:09:09
|
we could use the command line and the access list
|
|
0:09:15
|
So, if were to say Access List 101
|
|
0:09:17
|
Permit 1 any any
|
|
0:09:20
|
Permit 2, 3, 4, 5 and go down the list and
|
|
0:09:27
|
Then we look at the Do Show Access List,
|
|
0:09:31
|
we could see protocol number 1 is ICMP
|
|
0:09:38
|
Protocol number 2 is IGMP,
|
|
0:09:43
|
Protocol 3 is defined but it's not
|
|
0:09:48
|
So, some of these, you will
|
|
0:09:50
|
Where number 4 is an IP in IP tunnel.
|
|
0:09:54
|
Now, the reason that you may wann do this
|
|
0:09:58
|
and do a question mark.
|
|
0:10:00
|
It shows you what the keywords are but it
|
|
0:10:07
|
And where this would be useful is if
|
|
0:10:10
|
and you're trying to figure out what is the
|
|
0:10:16
|
based on this protocol number.
|
|
0:10:19
|
So, here, the debug IP packet detail output,
|
|
0:10:24
|
but we know that simply based on the
|
|
0:10:29
|
And also that this is the well-known multicast
|
|
0:10:36
|
So, we'll see as we get into
|
|
0:10:40
|
I'll go over some of these shortcuts that
|
|
0:10:44
|
to get more information about basically things
|
|
0:10:50
|
because in the real world, for a lot of these things,
|
|
0:10:55
|
or specific ICMP type code, you don't need to memorize
|
|
0:11:01
|
But within the scope of the lab exam,
|
|
0:11:02
|
a lot of this type of stuff is not gonna be easily
|
|
0:11:11
|
So again, on switch 1, if we
|
|
0:11:16
|
I have access list 100 that is gonna deny
|
|
0:11:22
|
So now, I just apply this directly on to the link.
|
|
0:11:24
|
We'll say IP Access Group 100 in.
|
|
0:11:30
|
And you'll see on the Layer 2 switches, you
|
|
0:11:34
|
So, if we wanted both directions,
|
|
0:11:38
|
Or VLAN access map.
|
|
0:11:40
|
Now, if we look at result to this
|
|
0:11:45
|
and now, Show IP Route EIGRP,
|
|
0:11:48
|
we see that almost immediately, we loose
|
|
0:11:55
|
Because the unicasts are used as the
|
|
0:12:02
|
So, if we look at router 5 and say,
|
|
0:12:07
|
and the same thing on siwtch 2,
|
|
0:12:11
|
We'll see that we are sending the hellos
|
|
0:12:17
|
and we are receiving a hello that's
|
|
0:12:25
|
And let's see, are we
|
|
0:12:30
|
the VLAN interface? It doesn't look like
|
|
0:12:40
|
from the other neighbors.
|
|
0:12:41
|
So, if we look at the Show
|
|
0:12:46
|
this output can be kind of confusing
|
|
0:12:48
|
because we actually learned
|
|
0:12:52
|
based on the multicast hellos
|
|
0:12:56
|
But now, we're stuck at thet point where
|
|
0:13:02
|
Because when we actually go to send
|
|
0:13:06
|
that process is gonna fail because those
|
|
0:13:11
|
they are going to be the unicasts.
|
|
0:13:14
|
So, this would be one possible...
|
|
0:13:19
|
one possible way to identify
|
|
0:13:22
|
If we don't have any complicated
|
|
0:13:28
|
like we don't have any authentication
|
|
0:13:32
|
and if the neighbors are not
|
|
0:13:36
|
then it could be that there's some
|
|
0:13:41
|
Now, where we might also
|
|
0:13:45
|
would be in a non-broadcast segment.
|
|
0:13:48
|
If there's something wrong in
|
|
0:13:52
|
so, let's say for example,
|
|
0:13:56
|
and actually router 2 has a
|
|
0:13:59
|
So, let's try this on router 5.
|
|
0:14:02
|
If we were to go to router 5,
|
|
0:14:08
|
let's say that our frame-relay
|
|
0:14:12
|
where to get to router 2...
|
|
0:14:18
|
maybe I have the wrong address in
|
|
0:14:26
|
maybe I mistyped this as 150.10.2.0.
|
|
0:14:30
|
So, there's an error in the
|
|
0:14:33
|
Now, if we go to this interface
|
|
0:14:38
|
and say No Shutdown.
|
|
0:14:41
|
So, I'm bringing the frame-relay
|
|
0:14:45
|
What we should see here is that
|
|
0:14:50
|
that do include the broadcast keyword,
|
|
0:14:55
|
it means that the EIGRP hellos that I'm
|
|
0:15:00
|
those are gonna be replicated
|
|
0:15:05
|
Because remember what we
|
|
0:15:07
|
the frame-relay mapping for
|
|
0:15:12
|
it doesn't relate to what the actual
|
|
0:15:16
|
So, this could be any arbitrary number
|
|
0:15:19
|
as long as the processes that circuit number 502
|
|
0:15:29
|
But now, on router 5, if we look
|
|
0:15:34
|
we see that for neighbors 1, 3 and 4,
|
|
0:15:39
|
the queue count is 0, which means
|
|
0:15:42
|
But for router 2, the queue
|
|
0:15:46
|
because we're able to exchange
|
|
0:15:51
|
And figure out that those neighbors
|
|
0:15:54
|
But we'll see over and over and over
|
|
0:15:57
|
that we get this log message that
|
|
0:16:03
|
So, typically this means that the neighbors
|
|
0:16:08
|
But then when they actually go
|
|
0:16:11
|
there's some problem in
|
|
0:16:17
|
Now, in the case of the frame-relay,
|
|
0:16:19
|
we could see this if we looked
|
|
0:16:24
|
We'll see that router 5 is trying to send
|
|
0:16:32
|
And we'll see somewhere
|
|
0:16:38
|
that it says, "The encapsulation has failed."
|
|
0:16:41
|
So, we're trying to send a unicast
|
|
0:16:47
|
The routing table says that
|
|
0:16:50
|
But then when we go to the Layer 2 process,
|
|
0:16:53
|
Layer 2 process doesn't know how
|
|
0:16:59
|
So, again, anytime we see this
|
|
0:17:03
|
whether it's in debug frame-relay
|
|
0:17:06
|
it means that the router does not know
|
|
0:17:11
|
And typically, that happens when there's some
|
|
0:17:19
|
So, for our frame-relay interface here, we simply
|
|
0:17:26
|
In problems like this, sometimes they
|
|
0:17:31
|
Especially when you get later
|
|
0:17:34
|
Because when you're looking
|
|
0:17:37
|
it's easy to skip over a problem like this
|
|
0:17:40
|
and not realize that these two
|
|
0:17:44
|
That's why it is so critical to figure out what
|
|
0:17:51
|
besides just looking at the
|
|
0:17:54
|
So, what should the result of the
|
|
0:17:59
|
Or what should the result of the
|
|
0:18:01
|
or Show IP EIGRP Topology look like?
|
|
0:18:04
|
So, then if we see errors in
|
|
0:18:08
|
then we know where we need to investigate
|
|
0:18:15
|
But you'll see like in the
|
|
0:18:18
|
since the topology is fairly large,
|
|
0:18:21
|
a lot of the times, it's not feasible to sit there
|
|
0:18:27
|
to solve the problem within a
|
|
0:18:31
|
Now, if we have 48 hours to solve
|
|
0:18:34
|
then it's not gonna be a problem.
|
|
0:18:35
|
You could do that just based
|
|
0:18:38
|
But most of the time,
|
|
0:18:41
|
to look at the actual results of
|
|
0:18:44
|
and then work backwards from there.
|
|
0:18:48
|
Because we should know ideally
|
|
0:18:54
|
So now, on switch 1,
|
|
0:18:59
|
So, once the packets
|
|
0:19:01
|
we should see that now,
|
|
0:19:05
|
On switch 2, if we look at the
|
|
0:19:16
|
we see no the queue count
|
|
0:19:19
|
If we look at the Show IP Route EIGRP,
|
|
0:19:22
|
we can see that we are installing
|
|
0:19:26
|
So, the keypoint being here again,
|
|
0:19:28
|
that by default, we're gonna use
|
|
0:19:32
|
for the finding of the neighbors
|
|
0:19:35
|
Now, if we do not want to use the multicast
|
|
0:19:39
|
which again, would be advantageous
|
|
0:19:43
|
Where there are other devices
|
|
0:19:46
|
So, maybe there's end hosts here
|
|
0:19:51
|
And we don't want them to
|
|
0:19:55
|
So, we could say on router 5, I wanna send
|
|
0:20:01
|
And likewise, on switch 2, I wanna
|
|
0:20:05
|
So, in this case, we would
|
|
0:20:09
|
underneath us on the segment,
|
|
0:20:14
|
would be sending those unicast
|
|
0:20:18
|
so that they would not be switched to the ports
|
|
0:20:24
|
So, it's more of a security
|
|
0:20:28
|
that if the hosts never received
|
|
0:20:32
|
they don't know that that's the
|
|
0:20:34
|
And then they cannot gain more
|
|
0:20:43
|
So, on switch 2, let's go
|
|
0:20:47
|
And we'll specify that router 5
|
|
0:20:52
|
So, we have router 5's unicast address
|
|
0:20:56
|
So, in this case, it's VLAN 58.
|
|
0:21:04
|
Now, on switch 2, if we look at
|
|
0:21:09
|
we should see that we are still receiving
|
|
0:21:18
|
But on our link, the 58 interface,
|
|
0:21:33
|
So, we see that we are trying to
|
|
0:21:41
|
But router 5 is still sending
|
|
0:21:47
|
The issue with this though is that once
|
|
0:21:51
|
it disables the listening for
|
|
0:21:56
|
So, switch 2 is essentially discarding any of
|
|
0:22:02
|
Because it's looking for the unicast
|
|
0:22:06
|
So, if we look at the
|
|
0:22:10
|
we see that we don't, we do not
|
|
0:22:15
|
Okay, if we look at this on router 5
|
|
0:22:22
|
Likewise, we don't even see
|
|
0:22:25
|
But if we look at the debugs, we would see that
|
|
0:22:31
|
So, essentially, this just means
|
|
0:22:36
|
we need to issue the neighbor statement.
|
|
0:22:39
|
And then, on router 5, this is
|
|
0:22:46
|
If we now look at the result to this
|
|
0:22:50
|
we see that we have the
|
|
0:22:53
|
and that the queue count is 0,
|
|
0:22:59
|
Now, if we were to configure
|
|
0:23:03
|
with adding the passive interface.
|
|
0:23:06
|
This is going to suppress both the
|
|
0:23:12
|
So now, router 5 is not able to
|
|
0:23:18
|
So, passive interface should not be used in
|
|
0:23:21
|
It should be used as a
|
|
0:23:25
|
to stop the router from sending any EIGRP
|
|
0:23:31
|
There's a question here.
|
|
0:23:32
|
"Do we still need to use the network
|
|
0:23:35
|
You do still need the network command because
|
|
0:23:41
|
So, when we look at the
|
|
0:23:45
|
these links, the two Ethernets,
|
|
0:23:50
|
these are the links that I
|
|
0:23:53
|
that are matching the IP
|
|
0:23:57
|
So Fast Ethernet 0/0 did not have
|
|
0:24:01
|
Then we would never get to the point
|
|
0:24:07
|
So, it has to be both of them. Both the
|