El poder de 01100011 Unix-FreeBSD: rutas

Mostrando entradas con la etiqueta rutas. Mostrar todas las entradas

jueves, 3 de julio de 2025

VLAN Mikrotik Basado en Puertos

VLANs Mikrotik - Basada en Puertos. Tenemos dos routers Mikrotik (RouterOS).

Internet

El router Mikrotik esta conectado desde el puerto ehter1 (WAN_ether1) a uno de los puertos ethernet del router ISP, usando DHCP Client.

[admin@R1] /ip dhcp-client> print
Flags: X - disabled, I - invalid, D - dynamic 
 #   INTERFACE    USE-PEER-DNS ADD-DEFAULT-ROUTE STATUS      ADDRESS           
 0   ether1        yes          yes               bound       192.168.88.12/24

Todos los puertos de un switch por defecto pertenecen a la la vlan 1. El switch necesita de un router para mover (forwarding) el tráfico entre las vlan. Eso permite la comunicacion entre diferentes VLAN.

Las VLAN ID solo aparecen en Switch administrables y funcionan en capa 2. La segmentación se produce en el Switch.

El Switch tiene una base de datos llamada tabla CAM donde realiza un seguimiento de cada computadora conectada:

- MAC Address
- Numero de Puerto
- VLAN ID - Solo en Switches Administrables

Las VLANs se utilizan se utilizan para segmentar una red, lo que permite mejorar la seguridad, el rendimiento y la gestion de la red. Los dispositivos de una VLAN pueden ser configurados y administrados de forma separada.

Los dispositivos CRS (tienen capacidad de capa 3) se pueden utilizar como enrutador y conmutador al mismo tiempo, útil para redes que se centran en el rendimiento de la red interna.

VLAN - Laboratorio de pruebas

Ambos routers estan en blanco - System - Reset Configuration - No Default Configuration - Reset Configuration.

Tenemos un router 1 (R1) donde se crean las VLAN, vlan10 con vlan-id=10 y vlan20 con vlan-id=20 en la interfaz Ether3, cada una con su direccionamineto IP y un DHCP Server. Esas VLAN se envían Tagged (Trunk en Cisco) a través de Ether3 y se reciben Tagged en el router 2 (R2) en el puerto Ether1. Luego se entregan como Untagged (Access Port) en los puertos Ether3 y Ether4.

Configuración vía comandos del Router 1.

Nota: La dirección IP del dns-server correspnde al servidor DNS de mi red interna. Puede utilizar DNS públicos si no tiene un servidor DNS local, por ejemplo, 1.1.1.1 o los del propio router Mikrotik, por defecto 192.168.88.1.

/interface
add interface=ether2 name=vlan10 vlan-id=10
add interface=ether2 name=vlan20 vlan-id=20
/ip pool
add name=dhcp_pool0 ranges=10.10.10.200-10.10.10.254
add name=dhcp_pool1 ranges=172.24.1.200-172.24.1.254
/ip dhcp-server
add address-pool=dhcp_pool0 disable=no interface=vlan10 name=dhcp1
add address-pool=dhcp_pool1 disable=no interface=vlan20 name=dhcp2
/ip address
add address=10.10.10.1/24 interface=vlan10 network=10.10.10.0
add address=172.24.1.1/24 interface=vlan20 network=172.24.1.0
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=192.168.88.200 gateway=10.10.10.1
add address=172.24.1.0/24 dns-server=192.168.88.200 gateway=172.24.1.1

En el Router R2 se crean las VLAN en el puerto Ether1 que es donde recibimos las VLAN con el nombre y vlan-id correspondiente, vlan10 vlan-id=10 y vlan20 vlan-id=20. Teniendo en cuenta que para que las VLAN se comuniquen entre dispositivos el id debe ser el mismo. Tambien hay que crear un bridge por cada VLAN Bridge_VLAN10 y Bridge_VLAN20. En la pestaña Bridge - Bridge - Ports, agregar dos interfaces: la propia VLAN y el puerto físico donde quiero entregarla como acceso (Access Port). En el caso de la VLAN vlan10 los puertos son: la propia VLAN vlan10 y el puerto Ether3. En la VLAN vlan20 los puertos son: la propia VLAN vlan20 y el puerto Ether4. Evidentemente, si quiero entregar la misma VLAN en más puertos este último paso se repite para todos los puertos involucrados.

Configuracion vía comandos Router 2 (R2)

/interface vlan
add interface=ether1 name=vlan10 vlan-id=10
add interface=ether1 name=vlan20 vlan-id=20
/interface bridge
add name=Bridge_VLAN10
add name=Bridge_VLAN20
/interface Bridge port
add bridge=Bridge_VLAN10 interface=vlan10
add bridge=Bridge_VLAN10 interface=ether3
add bridge=Bridge_VLAN20 interface=vlan20
add bridge=Bridge_VLAN20 interface=ether4

IP Route R1

[admin@R1] /ip route> print
Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 #      DST-ADDRESS        PREF-SRC        GATEWAY         DISTANCE
 0 ADS  0.0.0.0/0                          192.168.88.1           1
 2 ADC  10.10.10.0/24      10.10.10.1      vlan10                 0
 3 ADC  172.24.1.0/24      172.24.1.1      vlan20                 0
 4 ADC  192.168.88.0/24    192.168.88.12   ether1                 0

Conecto un PC a Ether3 del router R2 y recibe una IP del DHCP-Server configurado en R1

[admin@R1] /ip dhcp-server lease print
Flags: X - disabled, R - radius, D - dynamic, B - blocked 
 #   ADDRESS              MAC-ADDRESS       H SE.. R STATUS  LAST-SEEN            
 0 D 10.10.10.251         E4:B9:7A:6B:96:CD s dh..   bound   4m6s

(Opcional) -¿Cómo Permitir tráfico de VLANs?

/ip firewall filter
add chain=forward src-address=10.10.10.0/24 dst-address=172.24.1.0/24 \
connection-state=new,established action=accept comment="Permitir VLAN10 \
a VLAN20"

/ip firewall filter
add chain=forward src-address=172.24.1.0/24 dst-address=10.10.10.0/24 \
connection-state=new,established action=accept comment="Permitir VLAN20 \
a VLAN10"

Ubicación de las reglas:

Antes de cualquier regla que bloquee tráfico (ej. action=drop).
Usa el menú Drag & Drop en Winbox para ordenarlas.

Explicacion:

Las opciones connection-state=new,established permiten:
new: Conexiones iniciadas desde el origen.
established: Respuestas al tráfico iniciado.

Permitir acceso administrativo sólo desde la red 10.10.10.1/24

add chain=input src-address=10.10.10.1/24 protocol=tcp dst-port=22,8291,8728,8729 \
action=accept comment="Acceso administrativo (Winbox/SSH/API)"

Reglas de cortafuegos R1

admin@R1VLAN] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0    ;;; Permitir conexiones establecidas
      chain=input action=accept connection-state=established,related log=no log-prefix="" 

 1    ;;; Permitir ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 2    ;;; Permitir conexiones establecidas
      chain=forward action=accept connection-state=established,related log=no log-prefix="" 

 3    ;;; Bloquear conexiones inva/ip lidas
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

 4    ;;; Permitir trafico forward in wlan1 y out vlan10
      chain=forward action=accept in-interface=wlan1 out-interface=vlan10 log=no log-prefix="" 

 5    ;;; Permitir forward in vlan10 y out wlan1
      chain=forward action=accept in-interface=vlan10 out-interface=wlan1 log=no log-prefix="" 

 6    ;;; Permitir trafico forward in wlan1 y out vlan20
      chain=forward action=accept in-interface=wlan1 out-interface=vlan20 log=no log-prefix="" 

 7    ;;; Perimtir trafico forward in vlan20 out wlan1
      chain=forward action=accept in-interface=vlan20 out-interface=wlan1 log=no log-prefix="" 

 8    ;;; Bloquear trafico no permitido
      chain=forward action=drop log=no log-prefix=""

FreeBSD es genial!.

jueves, 12 de junio de 2025

Firewall Mikrotik Protege LAN y Permite Acceso a Internet

Configuración de firewall para MikroTik (RouterOS)

Protege la red LAN (10.10.10.0/24) y permite acceso a Internet. Las reglas incluyen protección anti-spoofing, bloqueo de tráfico no autorizado, y permiten tráfico legítimo.

El router Mikrotik esta conectado al puerto ehter1 (WAN_ether1) y uno de los puertos ethernet del router ISP usando DHCP Client

Configuración básica de interfaces

/interface bridge
add name=LAN_bridge
/interface bridge port
add bridge=LAN_bridge interface=ether2
add bridge=LAN_bridge interface=ether3
add bridge=LAN_bridge interface=ether4
add bridge=LAN_bridge interface=ether5
add bridge=LAN_bridge interface=wlan1
add bridge=LAN_bridge interface=wlan2
/ip address
add address=10.10.10.1/24 interface=LAN_bridge

DHCP Client en WAN (WAN_ether1)

/ip dhcp-client
add interface=WAN_ether1

NAT para acceso a Internet

/ip firewall nat
add chain=srcnat out-interface=WAN_ether1 action=masquerade

POLÍTICAS POR DEFECTO (FILTER)

/ip firewall filter

CONEXIONES ESTABLECIDAS

add chain=input action=accept connection-state=established,related \
comment="Permitir conexiones Establecidas/Realacionadas (Input)"
add chain=forward action=accept connection-state=established,related \
comment="Permitir conexiones Establecidas/Relacionadas (Forward)"
add chain=output action=accept connection-state=established,related \
comment="Permitir conexiones Establecidas/Relacionadas (Output)"

ANTI-SPOOFING Y SEGURIDAD BÁSICA Bloqueo de IPs falsas en WAN

add chain=input action=drop in-interface=WAN_ether1 src-address=10.10.10.0/24 \
comment="Bloquear LAN IP Spoofing (Input)"
add chain=forward action=drop in-interface=WAN_ether1 src-address=10.10.10.0/24 \
comment="Bloquear LAN IP Spoofing (Forward)"

Protección contra escaneos y ataques comunes

add chain=input action=drop in-interface=WAN_ether1 protocol=tcp psd=21,3s,3,1 \
comment="Bloquear TCP SYN Scans"
add chain=input action=drop in-interface=WAN_ether1 protocol=udp

REGLAS INPUT (TRÁFICO AL ROUTER) Permitir administración solo desde LAN

add chain=input action=accept in-interface=LAN_bridge protocol=tcp dst-port=22,8291,443 \
comment="Acceso Administracion (LAN)"

Permitir ICMP (ping)

add chain=input action=accept protocol=icmp comment="Allow ICMP"

Permitir DHCP desde ISP

add chain=input action=accept in-interface=WAN_ether1 protocol=udp src-port=67-68 dst-port=67-68 \
comment="DHCP Cliente"

Bloquear todo lo demás en WAN

add chain=input action=drop in-interface=WAN_ether1 \
comment="Bloquear Todo WAN Input"

REGLAS FORWARD (TRÁFICO A TRAVÉS DEL ROUTER)

Permitir LAN -> Internet

add chain=forward action=accept in-interface=LAN_bridge out-interface=WAN_ether1 \
connection-state=new comment="LAN a Internet"

Bloquear Internet -> LAN (excepto respuestas)

add chain=forward action=drop in-interface=WAN_ether1 out-interface=LAN_bridge \
connection-state=new comment="Bloquear Internet a LAN"

Permitir tráfico entre interfaces LAN (opcional)

add chain=forward action=accept in-interface=LAN_bridge out-interface=LAN_bridge \
comment="Inter-LAN Tráfico"

REGLAS OUTPUT (TRÁFICO DESDE EL ROUTER)

add chain=output action=accept comment="Permitir Router Output" disabled=no

REGLAS ADICIONALES DE SEGURIDAD Bloqueo de redes reservadas/rfc1918 desde WAN

add chain=input action=drop in-interface=WAN_ether1 src-address-list=private_ranges \
comment="Bloquear IPs Privada (Input)"
add chain=forward action=drop in-interface=WAN_ether1 src-address-list=private_ranges \
comment="Bloquear IPs Privada (Forward)"

Lista de redes reservadas

/ip firewall address-list
add address=172.16.0.0/12 list=private_ranges
add address=10.0.0.0/8 list=private_ranges
add address=192.168.0.0/16 list=private_ranges
add address=169.254.0.0/16 list=private_ranges

LOGGING (OPCIONAL)

add chain=input action=log log-prefix="[BLOQUEO DE CORTAFUEGOS] " \
comment="Log Bloqueado Input"
add chain=forward action=log log-prefix="[BLOQUEO DE CORTAFUEGOS] " 
comment="Log Bloqueado Forward"

Configurar servicios:

/ip service
set ssh address=10.10.10.0/24,192.168.88.0/24
set winbox address=10.10.10.0/24,192.168.88.0/24
set ftp disable=yes
set telnet disable=yes
set api disable=yes
set api-ssl disable=yes
set www disable=yes
set www-ssl disable=yes

Protección bridge:

/interfaces bridge settings
set use-ip-firewall=yes

Protección extra:

/ip firewall filter
add chain=forward protocol=tcp tcp-flags=syn,!ack action=drop comment="Bloquear SYN-flood"
add chain=forward protocol=udp limit=10/1m action=drop comment="Limite UDP floods"

Explicación:

1. Conexiones Establecidas: - Acepta tráfico de respuestas en todas las cadenas (input, forward, output).

2. Protección Anti-Spoofing: - Bloquea tráfico WAN con IPs de la LAN (10.10.10.0/24). - Bloquea redes reservadas (RFC 1918) desde WAN.

3. Reglas INPUT: - Solo permite administración (SSH, Winbox, WebFig) desde la LAN. - Permite ICMP (ping) y DHCP del ISP. - Bloquea todo el tráfico entrante no autorizado en WAN.

4. Reglas FORWARD: - Permite nuevas conexiones desde LAN hacia Internet. - Bloquea nuevas conexiones desde Internet hacia LAN. - Permite comunicación entre dispositivos LAN (opcional).

5. Reglas OUTPUT: - Permite todo el tráfico generado por el router (se puede ajustar si es necesario).

6. Protección Adicional: - Bloqueo de escaneos TCP/UDP desde Internet. - Logging de tráfico bloqueado para diagnóstico.

Notas: - Políticas por Defecto: - Input: drop (implícito por reglas). - Forward: drop (regla final bloquea tráfico no autorizado). - Output: accept.

- NAT: La regla masquerade en srcnat permite a la LAN acceder a Internet usando la IP WAN (asignada por DHCP).

- Personalización: - Para permitir acceso desde Internet (ej: servidor web), agregar reglas `forward` específicas. - Ajustar puertos de administración en reglas `input` según necesidades.

Esta configuración equilibra seguridad y funcionalidad, protegiendo la LAN de amenazas externas mientras permite acceso a Internet.

FreeBSD es genial!.

miércoles, 14 de abril de 2021

Configuración de ACL numeradas extendidas En GNS3

Configuración y aplicación de ACL numeradas extendidas En GNS3

Filtro extendido de ACL basado en la dirección de origen y destino, así como los protocolos de capa 4 TCP y UDP.

1.- Configurar los nombres de host en R1 y R2

2.- Configurar en R1 s1/0 como DCE para proveer un clock rate de

80640kbps a R2 más sus correspondientes direcciones IP.

3.- Configurar una ruta predeterminada estática en el R1 señalando a R2 (sobre la conexión serial entre los dos Routers). Configure también una ruta predeterminada estática en el R3 señalando al R1 vía la conexión serial entre los dos Routers y las interfaces de loopback especificadas en el diagrama.

R1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1(config)#inter s1/0

R1(config-if)#ip add 172.16.1.1 255.255.255.192

R1(config-if)#no shu

R1(config-if)#

*Mar 1 00:09:59.939: %LINK-3-UPDOWN: Interface Serial1/0, changed state to up

R1(config-if)#

*Mar 1 00:10:00.943: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up

R1(config-if)#clock rate 80640

R2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#inter s1/0

R2(config-if)#ip add 172.16.1.2 255.255.255.192

R2(config-if)#no shu

R2(config-if)#

*Mar 1 00:10:57.499: %LINK-3-UPDOWN: Interface Serial1/0, changed state to up

R2(config-if)#

*Mar 1 00:10:58.503: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up

R2(config-if)#do ping 172.16.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/14/24 ms

R2(config-if)#end

R2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#ip route 0.0.0.0 0.0.0.0 s1/0 172.16.1.1

R2(config)#

R2(config)#inter loop10

R2(config-if)#ip a

*Mar 1 00:18:45.775: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback10, changed state to up

R2(config-if)#ip add 10.10.10.2 255.255.255.128

R2(config-if)#inter loop20

R2(config-if)#ip

*Mar 1 00:20:55.915: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback20, changed state to up

R2(config-if)#ip add 10.20.20.2 255.255.255.240

R2(config-if)#inter loop30

R2(config-if)#ip ad

*Mar 1 00:21:32.163: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback30, changed state to up

R2(config-if)#ip add 10.30.30.2 255.255.255.248

R2(config-if)#end

R2#sh ip inter b

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 unassigned YES unset administratively down down

FastEthernet0/1 unassigned YES unset administratively down down

Serial1/0 172.16.1.2 YES manual up up

Serial1/1 unassigned YES unset administratively down down

Serial1/2 unassigned YES unset administratively down down

Serial1/3 unassigned YES unset administratively down down

Loopback10 10.10.10.2 YES manual up up

Loopback20 10.20.20.2 YES manual up up

Loopback30 10.30.30.2 YES manual up up

R2#

R1#

R1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1(config)#ip route 0.0.0.0 0.0.0.0 s1/0 172.16.1.2

R1(config)#inter loop10

*Mar 1 00:27:12.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback10, changed state to up

R1(config-if)#ip add 172.16.4.1 255.255.255.192

R1(config-if)#exit

R1(config)#inter loop20

*Mar 1 00:27:57.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback20, changed state to up

R1(config-if)#ip add 172.17.5.1 255.255.255.248

R1(config-if)#end

R1#

R1#sh ip inter b

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 unassigned YES unset administratively down down

FastEthernet0/1 unassigned YES unset administratively down down

Serial1/0 172.16.1.1 YES manual up up

Serial1/1 unassigned YES unset administratively down down

Serial1/2 unassigned YES unset administratively down down

Serial1/3 unassigned YES unset administratively down down

Loopback10 172.16.4.1 YES manual up up

Loopback20 172.17.5.1 YES manual up up

R1#

R2#ping 172.16.4.1 source loop10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.4.1, timeout is 2 seconds:

Packet sent with a source address of 10.10.10.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 76/79/84 ms

R2#

R2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#enable secret CISCO

R2(config)#line vty 0 903

R2(config-line)#password CISCO

R2(config-line)#login

R2(config-line)#end

R2#

*Mar 1 00:35:48.115: %SYS-5-CONFIG_I: Configured from console by console

R2#

R1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1(config)#enable secret CISCO

R1(config)#line vty 0 903

R1(config-line)#end

*Mar 1 00:40:22.755: %SYS-5-CONFIG_I: Configured from console by console

R1#

R2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2(config)#access 170 permit tcp 172.16.4.0 0.0.0.63 10.20.20.0 0.0.0.15 eq telnet

R2(config)#access-l 170 perm tcp 172.16.4.0 0.0.0.63 10.30.30.0 0.0.0.7 eq telnet

R2(config)#access- 170 perm icmp 172.17.5.0 0.0.0.7 10.10.10.0 0.0.0.127 echo

R2(config)#access 170 perm icmp 172.17.5.0 0.0.0.7 10.10.10.0 0.0.0.127 echo-reply

R2(config)#inter s1/0

R2(config-if)#ip access-group 170 in

R2(config-if)#end

R2#sh ip access-lists 170

Extended IP access list 170

10 permit tcp 172.16.4.0 0.0.0.63 10.20.20.0 0.0.0.15 eq telnet

20 permit tcp 172.16.4.0 0.0.0.63 10.30.30.0 0.0.0.7 eq telnet

30 permit icmp 172.17.5.0 0.0.0.7 10.10.10.0 0.0.0.127 echo

40 permit icmp 172.17.5.0 0.0.0.7 10.10.10.0 0.0.0.127 echo-reply

R1#

R1#telnet 10.30.30.2 /source-interface loopback10

Trying 10.30.30.2 ... Open

User Access Verification

Password:

R2>en

Password:

R2#exit

R1#telnet 10.20.20.2 /source-interface loopback10

Trying 10.20.20.2 ... Open

User Access Verification

Password:

R2>en

Password:

R2#exit

R1#ping 10.10.10.2 source loopback20

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:

Packet sent with a source address of 172.17.5.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 76/80/88 ms

R1#

R2#sh ip access-lists 170

Extended IP access list 170

10 permit tcp 172.16.4.0 0.0.0.63 10.20.20.0 0.0.0.15 eq telnet (234 matches)

20 permit tcp 172.16.4.0 0.0.0.63 10.30.30.0 0.0.0.7 eq telnet (129 matches)

30 permit icmp 172.17.5.0 0.0.0.7 10.10.10.0 0.0.0.127 echo (45 matches)

40 permit icmp 172.17.5.0 0.0.0.7 10.10.10.0 0.0.0.127 echo-reply

R2#exit

R1#

IOS es genial!.

domingo, 11 de abril de 2021

ACLs Inbound Cisco GNS3

Configurar y aplicar Extended Numbered ACLs Inbound en GNS3:

Configurar R1 y R2 para permitir acceso vía telnet.

R2(config)#enable secret CISCO

R2(config)#line vt

R2(config)#line vty 0 903

R2(config-line)#password CISCO

R2(config-line)#login

R2(config-line)#end

R1(config)#enable secret CISCO

R1(config)#line vt

R1(config)#line vty 0 903

R1(config-line)#password CISCO

R1(config-line)#login

R1(config-line)#end

Implementar las direcciones IP correspondientes a las interfaces seriales 1/0, en R1 y R2.

R1#conf t

R1(config)#inter se1/0

R1(config-if)#ip addr 172.16.1.1 255.255.255.192

R1(config-if)#no shut

R2#conf t

R2(config)#inter

R2(config)#interface se1/0

R2(config-if)#ip addr 172.16.1.2 255.255.255.192

R2(config-if)#no shut

Configurar las interfaces loopback 10,20 y 30 y sus correspondientes IPs:

R2(config)#interface loopback 10

R2(config-if)#ip add 10.10.10.3 255.255.255.128

R2(config-if)#exit

R2(config)#interface loopback 20

R2(config-if)#ip add 10.20.20.3 255.255.255.240

R2(config-if)#exit

R2(config)#interface loopback 30

R2(config-if)#ip add 10.30.30.3 255.255.255.248

Este comando establece una ruta predeterminada para subredes de destino que no están en la tabla de enrutamiento, "gateway del último recurso" configurado en su tabla de rutas IP.

R1(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.2

R2(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.1

Access-lists (R1).

R1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1(config)#access-list 150 deny tcp 10.20.20.0 0.0.0.15 any eq telnet

R1(config)#access-list 150 permit tcp 10.30.30.0 0.0.0.7 any eq telnet

R1(config)#access-list 150 permit icmp 10.20.20.0 0.0.0.15 any echo

R1(config)#inter s1/0

R1(config-if)#ip access-group 150 in

R1(config-if)#^Z

R1#sh ip access-lists

Extended IP access list 150

10 deny tcp 10.20.20.0 0.0.0.15 any eq telnet

20 permit tcp 10.30.30.0 0.0.0.7 any eq telnet

30 permit icmp 10.20.20.0 0.0.0.15 any echo

40 permit tcp 10.10.10.0 0.0.0.127 any eq telnet

R2#ping 172.16.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:

UUUUU

Success rate is 0 percent (0/5)

R2#telnet 172.16.1.1 /source-

R2#telnet 172.16.1.1 /source-interface loopback

R2#telnet 172.16.1.1 /source-interface loopback 20

Trying 172.16.1.1 ...

% Destination unreachable; gateway or host down

R2#telnet 172.16.1.1 /source-interface loopback 30

Trying 172.16.1.1 ... Open

User Access Verification

Password:

R1>en

Password:

R1#exit

[Connection to 172.16.1.1 closed by foreign host]

R2#ping 172.16.1.1 source 10.20.20.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:

Packet sent with a source address of 10.20.20.3

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/21/24 ms

R2#telnet 172.16.1.1 /source-interface loopback 10

Trying 172.16.1.1 ... Open

User Access Verification

Password:

R1>en

Password:

R1#exit

Permitir ping a la interface serial 1/0 de R1

R1(config)#access-list 150 permit icmp 172.16.1.0 0.0.0.127 any echo

R1#sh ip access-lists

Extended IP access list 150

10 deny tcp 10.20.20.0 0.0.0.15 any eq telnet (3 matches)

20 permit tcp 10.30.30.0 0.0.0.7 any eq telnet (174 matches)

30 permit icmp 10.20.20.0 0.0.0.15 any echo (30 matches)

40 permit tcp 10.10.10.0 0.0.0.127 any eq telnet (111 matches)

50 permit icmp 172.16.1.0 0.0.0.63 any echo (15 matches)

R1#

R2#ping 172.16.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 76/77/80 ms

R2#

GNS3 es genial!.

lunes, 29 de marzo de 2021

Configurar y permitir el enrutamiento inter-VLAN Cisco EVE-NG

En computación, un Router on A Stick (ROAS), es un router que tiene una sola conexión física o lógica a una red. Es un método de ruteo inter-VLAN (redes de área local virtual) donde un router está conectado a un Switch vía un solo cable. El router tiene conexiones físicas a los dominios de broadcast donde uno o más VLAN requieren de enrutamiento entre ellos.

Configurar Sw1 y Sw2 como switches VTP transparentes:

Sw1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Sw1(config)#vtp mode Transparent

Setting device to VTP TRANSPARENT mode.

Sw1(config)#vtp domain CISCO

Changing VTP domain name from NULL to CISCO

Sw1(config)#vtp password cisco-vtp

Setting device VLAN database password to cisco-vtp

Sw1(config)#do sh vtp status

VTP Version : 2

Configuration Revision : 0

Maximum VLANs supported locally : 36

Number of existing VLANs : 5

VTP Operating Mode : Transparent

VTP Domain Name : CISCO

VTP Pruning Mode : Disabled

VTP V2 Mode : Disabled

VTP Traps Generation : Disabled

MD5 digest : 0xC3 0xD3 0x78 0x64 0x81 0xE5 0xE4 0x17

Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00

Sw1(config)#

Sw2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Sw2(config)#vtp mode Transparent

Setting device to VTP TRANSPARENT mode.

Sw2(config)#vtp domain CISCO

Changing VTP domain name from NULL to CISCO

Sw2(config)#vtp password cisco-vtp

Setting device VLAN database password to cisco-vtp

Sw2(config)#do sh vtp status

VTP Version : 2

Configuration Revision : 0

Maximum VLANs supported locally : 36

Number of existing VLANs : 5

VTP Operating Mode : Transparent

VTP Domain Name : CISCO

VTP Pruning Mode : Disabled

VTP V2 Mode : Disabled

VTP Traps Generation : Disabled

MD5 digest : 0xC3 0xD3 0x78 0x64 0x81 0xE5 0xE4 0x17

Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00

Sw2(config)#

Vlans 10,20,30,40 y su nombre correspondiente. Interface e0/0 y e0/1 modo trunk, permitir vlan 1,10,20,30,40. Interface e0/2 access vlan 20.

Sw1#config t

Enter configuration commands, one per line. End with CNTL/Z.

Sw1(config)#interface e0/0

Sw1(config-if)#switchport mode trunk

Sw1(config-if)#exit

Sw1(config)#vlan 10

Sw1(config-vlan)#name SALES

Sw1(config-vlan)#exit

Sw1(config)#vlan 20

Sw1(config-vlan)#name STATIC

Sw1(config-vlan)#exit

Sw1(config)#vlan 30

Sw1(config-vlan)#name ADMIN

Sw1(config-vlan)#exit

Sw1(config)#interface e0/0

Sw1(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Sw1(config)#vlan 40

Sw1(config-vlan)#name VoIP

Sw1(config-vlan)#exit

Sw1(config)#interface e0/1

Sw1(config-if)#switchport mode trunk

Sw1(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Sw1(config-if)#exit

Sw1(config)#interface e0/2

Sw1(config-if)#switchport mode access

Sw1(config-if)#switchport access vlan 20

Sw1(config-if)#end

Sw1#

Verificar interfaces trunk en sw1:

Sw1#sh interfaces trunk

Port Mode Encapsulation Status Native vlan

Et0/0 on 802.1q trunking 1

Et0/1 on 802.1q trunking 1

Port Vlans allowed on trunk

Et0/0 1,10,20,30,40

Et0/1 1,10,20,30,40

Port Vlans allowed and active in management domain

Et0/0 1,10,20,30,40

Et0/1 1,10,20,30,40

Port Vlans in spanning tree forwarding state and not pruned

Et0/0 1,10,20,30,40

Et0/1 1,10,20,30,40

Sw1#

Vlans Switch 1:

Sw1#sh vlan b

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Et0/3

10 SALES active

20 STATIC active Et0/2

30 ADMIN active

40 VoIP active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

Sw1#

Vlans 10,20,30,40 y su nombre correspondiente. Interface e0/0 modo trunk, permitir vlan 1,10,20,30,40. Interface e0/1 access vlan 30, interface e0/2 access vlan 40.

Sw2#config t

Enter configuration commands, one per line. End with CNTL/Z.

Sw2(config)#interface e0/0

Sw2(config-if)#switchport mode trunk

Sw2(config-if)#exit

Sw2(config)#vlan 10

Sw2(config-vlan)#name SALES

Sw2(config-vlan)#exit

Sw2(config)#vlan 20

Sw2(config-vlan)#name STATIC

Sw2(config-vlan)#exit

Sw2(config)#vlan 30

Sw2(config-vlan)#name ADMIN

Sw2(config-vlan)#exit

Sw2(config)#vlan 40

Sw2(config-vlan)#name VoIP

Sw2(config-vlan)#exit

Sw2(config)#interface e0/0

Sw1(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Sw2(config)#interface e0/1

Sw2(config-if)#switchport mode access

Sw2(config-if)#switchport access vlan 30

Sw2(config-if)#exit

Sw2(config)#interface e0/2

Sw2(config-if)#switchport mode access

Sw2(config-if)#switchport access vlan 40

Sw2(config-if)#^Z

Sw2#

Verificar interfaces trunk en sw2:

Sw2#show interfaces trunk

Port Mode Encapsulation Status Native vlan

Et0/0 on 802.1q trunking 1

Port Vlans allowed on trunk

Et0/0 1,10,20,30,40

Port Vlans allowed and active in management domain

Et0/0 1,10,20,30,40

Port Vlans in spanning tree forwarding state and not pruned

Et0/0 1,10,20,30,40

Sw2#

Vlans en switch2:

Sw2#sh vlan b

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Et0/3

10 SALES active

20 STATIC active

30 ADMIN active Et0/1

40 VoIP active Et0/2

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

Sw2#

Router On A Stick (ROAS) en R1:

R1#config t

Enter configuration commands, one per line. End with CNTL/Z.

R1(config)#interface e0/0

R1(config-if)#description "Connected a Sw1 Trunk e0/1"

R1(config-if)#no shutdown

R1(config-if)#exit

R1(config)#interface e0/0.10

R1(config-subif)#description Subinterface Para VLAN 10

R1(config-subif)#encapsulation dot1Q 10

R1(config-subif)#ip address 10.0.10.1 255.255.255.240 R1(config-subif)#exit

R1(config)#interface e0/0.20

R1(config-subif)#description Subinterface Para VLAN 20

R1(config-subif)#encapsulation dot1Q 20

R1(config-subif)#ip address 10.0.20.1 255.255.255.128

R1(config-subif)#exit

R1(config)#interface e0/0.30

R1(config-subif)#description Subinterface Para VLAN 30

R1(config-subif)#ip address 10.0.30.1 255.255.255.248

R1(config-subif)#exit

R1(config)#interface e0/0.40

R1(config-subif)#description Subinterface Para VLAN 40

R1(config-subif)#encapsulation dot1Q 40

R1(config-subif)#ip address 10.0.40.1 255.255.255.224

R1(config-subif)#end

R1#

Verificar configuración:

R1#show ip interface brief

R1#sh ip interface b

Interface IP-Address OK? Method Status Protocol

Ethernet0/0 unassigned YES NVRAM up up

Ethernet0/0.10 10.0.10.1 YES NVRAM up up

Ethernet0/0.20 10.0.20.1 YES NVRAM up up

Ethernet0/0.30 10.0.30.1 YES NVRAM up up

Ethernet0/0.40 10.0.40.1 YES NVRAM up up

Ethernet0/1 unassigned YES NVRAM administratively down down

Ethernet0/2 unassigned YES NVRAM administratively down down

Ethernet0/3 unassigned YES NVRAM administratively down down

R1#

Dirección IP 10.0.10.2/28 (Vlan 10):

Sw2#conf t

Sw2(config)#interface vlan10

Sw2(config-if)#ip address 10.0.10.2 255.255.255.240

Sw2(config-if)#no shutdown

Sw2(config)#^Z

Sw2#

Comprobar:

Sw2#sh ip interface b

Interface IP-Address OK? Method Status Protocol

Ethernet0/0 unassigned YES unset up up

Ethernet0/1 unassigned YES unset up up

Ethernet0/2 unassigned YES unset up up

Ethernet0/3 unassigned YES unset administratively down down

Vlan1 unassigned YES unset administratively down down

Vlan10 10.0.10.2 YES manual up up

Vlan20 unassigned YES unset administratively down down

Vlan30 unassigned YES unset administratively down down

Vlan40 unassigned YES unset administratively down down

Sw2#

Ping, comprobar conectividad:

R1#ping 10.0.10.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.10.2, timeout is 2 seconds: .!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/4 ms

R1#ping 10.0.20.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.20.2, timeout is 2 seconds: .!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/4 ms

R1#ping 10.0.30.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.30.3, timeout is 2 seconds: .!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/4 ms

R1#ping 10.0.40.4

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.40.4, timeout is 2 seconds: .!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/4 ms

Archivos de configuración de todos los dispositivos:

Sw1#sh run

Building configuration...

Current configuration : 1150 bytes

version 15.1

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

service compress-config

hostname Sw1

boot-start-marker

boot-end-marker

no aaa new-model

clock timezone CET 1 0

no ipv6 cef

ipv6 multicast rpf use-bgp

no ip domain-lookup

ip cef

spanning-tree mode pvst

spanning-tree extend system-id

vlan internal allocation policy ascending

interface Ethernet0/0

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 1,10,20,30,40

switchport mode trunk

duplex auto

interface Ethernet0/1

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 1,10,20,30,40

switchport mode trunk

duplex auto

interface Ethernet0/2

switchport access vlan 20

switchport mode access

duplex auto

interface Ethernet0/3

duplex auto

interface Vlan10

no ip address

shutdown

interface Vlan20

no ip address

shutdown

interface Vlan30

no ip address

shutdown

interface Vlan40

no ip address

shutdown

no ip http server

control-plane

line con 0

logging synchronous

line aux 0

line vty 0 4

end

Sw2#sh run

Building configuration...

Current configuration : 1278 bytes

! Last configuration change at 20:05:49 CET Mon Mar 29 2021

version 15.1

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

service compress-config

hostname Sw2

boot-start-marker

boot-end-marker

no aaa new-model

clock timezone CET 1 0

no ipv6 cef

ipv6 multicast rpf use-bgp

no ip domain-lookup

ip cef

spanning-tree mode pvst

spanning-tree extend system-id

vlan internal allocation policy ascending

interface Ethernet0/0

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 1,10,20,30,40

switchport mode trunk

duplex auto

interface Ethernet0/1

switchport access vlan 30

switchport trunk encapsulation dot1q

switchport mode access

duplex auto

interface Ethernet0/2

switchport access vlan 40

switchport mode access

duplex auto

interface Ethernet0/3

switchport mode access

shutdown

duplex auto

interface Vlan1

no ip address

shutdown

interface Vlan10

ip address 10.0.10.2 255.255.255.240

interface Vlan20

no ip address

shutdown

interface Vlan30

no ip address

shutdown

interface Vlan40

no ip address

shutdown

no ip http server

control-plane

line con 0

logging synchronous

line aux 0

line vty 0 4

end

Sw2#

R1#sh run

Building configuration...

Current configuration : 1561 bytes

! Last configuration change at 20:13:31 CET Mon Mar 29 2021

version 15.7

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R1

boot-start-marker

boot-end-marker

no aaa new-model

clock timezone CET 1 0

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

no ip domain lookup

ip cef

no ipv6 cef

multilink bundle-name authenticated

redundancy

interface Ethernet0/0

description "Connected a Sw1 Trunk e0/1"

no ip address

duplex auto

interface Ethernet0/0.10

description -Subinterface For VLAN 10"

encapsulation dot1Q 10

ip address 10.0.10.1 255.255.255.240

interface Ethernet0/0.20

description -Subinterface For VLAN 20"

encapsulation dot1Q 20

ip address 10.0.20.1 255.255.255.128

interface Ethernet0/0.30

description -Subinterface For VLAN 30"

encapsulation dot1Q 30

ip address 10.0.30.1 255.255.255.248

interface Ethernet0/0.40

description -Subinterface For VLAN 40"

encapsulation dot1Q 40

ip address 10.0.40.1 255.255.255.224

interface Ethernet0/1

no ip address

shutdown

duplex auto

interface Ethernet0/2

no ip address

shutdown

duplex auto

interface Ethernet0/3

no ip address

shutdown

duplex auto

ip forward-protocol nd

no ip http server

no ip http secure-server

ipv6 ioam timestamp

control-plane

line con 0

logging synchronous

line aux 0

line vty 0 4

transport input none

end

R1#

R2#sh run

Building configuration...

Current configuration : 1006 bytes

! Last configuration change at 15:16:01 CET Mon Mar 29 2021

version 15.7

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R2

boot-start-marker

boot-end-marker

no aaa new-model

clock timezone CET 1 0

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

ip cef

no ipv6 cef

multilink bundle-name authenticated

redundancy

interface Ethernet0/0

ip address 10.0.20.2 255.255.255.128

duplex auto

interface Ethernet0/1

no ip address

shutdown

duplex auto

interface Ethernet0/2

no ip address

shutdown

duplex auto

interface Ethernet0/3

no ip address

shutdown

duplex auto

ip forward-protocol nd

no ip http server

no ip http secure-server

ipv6 ioam timestamp

control-plane

line con 0

logging synchronous

line aux 0

line vty 0 4

transport input none

end

R2#

R3#sh run

Building configuration...

Current configuration : 1013 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R3

boot-start-marker

boot-end-marker

no aaa new-model

clock timezone CET 1

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

ip source-route

ip cef

multilink bundle-name authenticated

interface Ethernet0/0

ip address 10.0.30.3 255.255.255.224

interface Ethernet0/1

no ip address

shutdown

interface Ethernet0/2

no ip address

shutdown

interface Ethernet0/3

no ip address

shutdown

interface Serial1/0

no ip address

serial restart-delay 0

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

ip forward-protocol nd

no ip http server

line con 0

logging synchronous

line aux 0

line vty 0 4

exception data-corruption buffer truncate

end

R3#

R4#sh run

Building configuration...

Current configuration : 1013 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R4

boot-start-marker

boot-end-marker

no aaa new-model

clock timezone CET 1

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

ip source-route

ip cef

multilink bundle-name authenticated

interface Ethernet0/0

ip address 10.0.40.4 255.255.255.224

interface Ethernet0/1

no ip address

shutdown

interface Ethernet0/2

no ip address

shutdown

interface Ethernet0/3

no ip address

shutdown

interface Serial1/0

no ip address

serial restart-delay 0

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

ip forward-protocol nd

no ip http server

line con 0

logging synchronous

line aux 0

line vty 0 4

exception data-corruption buffer truncate

end

R4#

Cisco es genial!.

sábado, 13 de marzo de 2021

IPv4 Subnetting Cisco

Red 67.83.0.0/21 y la tabla

Crear subredes en el orden programado

Optimizar el espacio de direcciones

No desperdiciar IPs

Comprobar ping y tracert entre PC-10,

MA-PC1 y ZA-PC1

Desde Hasta VLAN

67.83.0.1 - 67.83.0.254 10

67.83.1.1 - 67.83.1.254 20

67.83.2.1 - 67.83.2.254 30

67.83.3.1 - 67.83.3.126 40

67.83.3.129 - 67.83.3.190 --

67.83.3.193 - 67.83.3.254 --

67.83.4.1 - 67.83.4.6 --

Core1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Core1(config)#vlan 10

Core1(config-vlan)#exit

Core1(config)#interface vlan 10

Core1(config-if)#

%LINK-5-CHANGED: Interface Vlan10, changed state to up

Core1(config-if)#ip address 67.83.0.1 255.255.255.0

Core1(config-if)#exit

Core1(config)#vlan 20

Core1(config-vlan)#

Core1(config-vlan)#exit

Core1(config)#int

Core1(config)#interface vlan 20

Core1(config-if)#

%LINK-5-CHANGED: Interface Vlan20, changed state to up

Core1(config-if)#ip address 67.83.1.1 255.255.255.0

Core1(config-if)#exit

Core1(config)#vlan 30

Core1(config-vlan)#

Core1(config-vlan)#exit

Core1(config)#inter

Core1(config)#interface vlan 30

Core1(config-if)#

%LINK-5-CHANGED: Interface Vlan30, changed state to up

Core1(config-if)#ip address 67.83.2.1 255.255.255.0

Core1(config-if)#exit

Core1(config)#vlan 40

Core1(config-vlan)#exit

Core1(config)#inter

Core1(config)#interface vlan 40

Core1(config-if)#

%LINK-5-CHANGED: Interface Vlan40, changed state to up

Core1(config-if)#ip address 67.83.3.1 255.255.255.128

Core1(config-if)#exit

Core1(config)#

Core1(config)#^Z

Core1#

%SYS-5-CONFIG_I: Configured from console by console

Core1#sh ip interface b

Interface IP-Address OK? Method Status Protocol

GigabitEthernet1/0/1 unassigned YES unset up up

GigabitEthernet1/0/2 unassigned YES unset up up

GigabitEthernet1/0/3 unassigned YES unset down down

GigabitEthernet1/0/4 unassigned YES unset down down

GigabitEthernet1/0/5 unassigned YES unset down down

GigabitEthernet1/0/6 unassigned YES unset down down

GigabitEthernet1/0/7 unassigned YES unset down down

GigabitEthernet1/0/8 unassigned YES unset down down

GigabitEthernet1/0/9 unassigned YES unset down down

GigabitEthernet1/0/10 unassigned YES unset down down

GigabitEthernet1/0/11 unassigned YES unset down down

GigabitEthernet1/0/12 unassigned YES unset down down

GigabitEthernet1/0/13 unassigned YES unset down down

GigabitEthernet1/0/14 unassigned YES unset up up

GigabitEthernet1/0/15 unassigned YES unset up up

GigabitEthernet1/0/16 unassigned YES unset down down

GigabitEthernet1/0/17 unassigned YES unset down down

GigabitEthernet1/0/18 unassigned YES unset down down

GigabitEthernet1/0/19 unassigned YES unset down down

GigabitEthernet1/0/20 unassigned YES unset down down

GigabitEthernet1/0/21 unassigned YES unset down down

GigabitEthernet1/0/22 unassigned YES unset down down

GigabitEthernet1/0/23 unassigned YES unset down down

GigabitEthernet1/0/24 unassigned YES unset down down

GigabitEthernet1/1/1 unassigned YES unset down down

GigabitEthernet1/1/2 unassigned YES unset down down

GigabitEthernet1/1/3 unassigned YES unset down down

GigabitEthernet1/1/4 unassigned YES unset down down

Loopback0 11.11.11.11 YES manual up up

Vlan1 unassigned YES unset administratively down down

Vlan10 67.83.0.1 YES manual up up

Vlan20 67.83.1.1 YES manual up up

Vlan30 67.83.2.1 YES manual up up

Vlan40 67.83.3.1 YES manual up up

Core1#

Core1#sh cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

R1-NV Gig 1/0/1 157 R C2900 Gig 0/0

Core2 Gig 1/0/15 157 3650 Gig 1/0/15

Access Gig 1/0/2 120 S 2960 Fas 0/1

Core2 Gig 1/0/14 157 3650 Gig 1/0/14

Core1#

Core1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Core1(config)#interface g

Core1(config)#interface gigabitEthernet 1/0/1

Core1(config-if)#sw

Core1(config-if)#switchport mode

Core1(config-if)#switchport mode access

Core1(config-if)#switchport access

Core1(config-if)#switchport access vlan 40

Core1(config-if)#

Core1(config-if)#exit

Core1(config)#interface gigabitEthernet 1/0/2

Core1(config-if)#switchport trunk encapsulation dot1q

Core1(config-if)#switchport mode trunk

Core1(config-if)#switchport trunk allowed vlan 1,10,30,40

Core1(config-if)#exit

Core1(config)#interface gigabitEthernet 1/0/14

Core1(config-if)#switchport trunk encapsulation dot1q

Core1(config-if)#switchport mode trunk

Core1(config-if)#switchport trunk allowed vlan 1,10,30,40

Core1(config-if)#exit

Core1(config)#interface gigabitEthernet 1/0/15

Core1(config-if)#switchport trunk encapsulation dot1q

Core1(config-if)#switchport mode trunk

Core1(config-if)#switchport trunk allowed vlan 1,10,30,40

Core1(config-if)#

Core1#sh interfaces trunk

Port Mode Encapsulation Status Native vlan

Gig1/0/2 on 802.1q trunking 1

Gig1/0/14 on 802.1q trunking 1

Gig1/0/15 on 802.1q trunking 1

Port Vlans allowed on trunk

Gig1/0/2 1,10,20,30,40

Gig1/0/14 1,10,20,30,40

Gig1/0/15 1,10,20,30,40

Port Vlans allowed and active in management domain

Gig1/0/2 1,10,20,30,40

Gig1/0/14 1,10,20,30,40

Gig1/0/15 1,10,20,30,40

Port Vlans in spanning tree forwarding state and not pruned

Gig1/0/2 1,10,20,30,40

Gig1/0/14 1,10,20,30,40

Gig1/0/15 none

Core1#wri

Building configuration...

Compressed configuration from 7383 bytes to 3601 bytes[OK]

[OK]

Core1#sh vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Gig1/0/3, Gig1/0/4, Gig1/0/5, Gig1/0/6

Gig1/0/7, Gig1/0/8, Gig1/0/9, Gig1/0/10

Gig1/0/11, Gig1/0/12, Gig1/0/13, Gig1/0/16

Gig1/0/17, Gig1/0/18, Gig1/0/19, Gig1/0/20

Gig1/0/21, Gig1/0/22, Gig1/0/23, Gig1/0/24

Gig1/1/1, Gig1/1/2, Gig1/1/3, Gig1/1/4

10 VLAN10 active

20 VLAN20 active

30 VLAN30 active

40 VLAN40 active Gig1/0/1

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

10 enet 100010 1500 - - - - - 0 0

20 enet 100020 1500 - - - - - 0 0

30 enet 100030 1500 - - - - - 0 0

40 enet 100040 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

Core1#

Core2#sh cdp ne

Core2#sh cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

Core1 Gig 1/0/15 174 3650 Gig 1/0/15

Core1 Gig 1/0/14 174 3650 Gig 1/0/14

Access Gig 1/0/1 174 S 2960 Fas 0/4

Core2#

Core2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Core2(config)#inter

Core2(config)#interface g

Core2(config)#interface gigabitEthernet 1/0/1

Core2(config-if)#switchport trunk encapsulation do

Core2(config-if)#switchport trunk encapsulation dot1q

Core2(config-if)#switchport mode trunk

Core2(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Core2(config-if)#exit

Core2(config)#interface gigabitEthernet 1/0/14

Core2(config-if)#switchport trunk encapsulation dot1q

Core2(config-if)#switchport mode trunk

Core2(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Core2(config-if)#exit

Core2(config)#interface gigabitEthernet 1/0/15

Core2(config-if)#switchport trunk encapsulation dot1q

Core2(config-if)#switchport mode trunk

Core2(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Core2(config-if)#exit

Core2(config)#

Core2#sh interfaces trunk

Port Mode Encapsulation Status Native vlan

Gig1/0/1 on 802.1q trunking 1

Gig1/0/14 on 802.1q trunking 1

Gig1/0/15 on 802.1q trunking 1

Port Vlans allowed on trunk

Gig1/0/1 1,10,20,30,40

Gig1/0/14 1,10,20,30,40

Gig1/0/15 1,10,20,30,40

Port Vlans allowed and active in management domain

Gig1/0/1 1,10,20,30,40

Gig1/0/14 1,10,20,30,40

Gig1/0/15 1,10,20,30,40

Port Vlans in spanning tree forwarding state and not pruned

Gig1/0/1 1,10,20,30,40

Gig1/0/14 1,10,20,30,40

Gig1/0/15 10,20,30

Core2#

Core2#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Core2(config)#vlan 10

Core2(config-vlan)#exit

Core2(config)#inter

Core2(config)#interface vlan 10

Core2(config-if)#

%LINK-5-CHANGED: Interface Vlan10, changed state to up

Core2(config-if)#ip address 67.83.0.2 255.255.255.0

Core2(config-if)#exit

Core2(config)#vlan 20

Core2(config-vlan)#

Core2(config-vlan)#exit

Core2(config)#int

Core2(config)#interface vlan 20

Core2(config-if)#

%LINK-5-CHANGED: Interface Vlan20, changed state to up

Core2(config-if)#exit

Core2(config)#interface vlan 20

Core2(config-if)#ip address 67.83.1.2 255.255.255.0

Core2(config-if)#exit

Core2(config)#vlan 30

Core2(config-vlan)#

Core2(config-vlan)#exit

Core2(config)#inter

Core2(config)#interface vlan 30

Core2(config-if)#

%LINK-5-CHANGED: Interface Vlan30, changed state to up

Core2(config-if)#ip address 67.83.2.2 255.255.255.0

Core2(config-if)#exit

Core2(config)#vlan 40

Core2(config-vlan)#exit

Core2(config)#inter

Core2(config)#interface vlan 40

Core2(config-if)#

%LINK-5-CHANGED: Interface Vlan40, changed state to up

Core2(config-if)#ip address 67.83.3.2 255.255.255.128

Core2(config-if)#exit

Enter configuration commands, one per line. End with CNTL/Z.

Core2(config)#interface loo

Core2(config)#interface loopback 0

Core2(config-if)#ip add

Core2(config-if)#ip address 22.22.22.22 255.255.255.255

Core2(config)#^Z

Core2#

%SYS-5-CONFIG_I: Configured from console by console

Core2#wri

Building configuration...

Compressed configuration from 7383 bytes to 3601 bytes[OK]

[OK]

Core2#sh ip interface b

Interface IP-Address OK? Method Status Protocol

GigabitEthernet1/0/1 unassigned YES unset up up

GigabitEthernet1/0/2 unassigned YES unset down down

GigabitEthernet1/0/3 unassigned YES unset down down

GigabitEthernet1/0/4 unassigned YES unset down down

GigabitEthernet1/0/5 unassigned YES unset down down

GigabitEthernet1/0/6 unassigned YES unset down down

GigabitEthernet1/0/7 unassigned YES unset down down

GigabitEthernet1/0/8 unassigned YES unset down down

GigabitEthernet1/0/9 unassigned YES unset down down

GigabitEthernet1/0/10 unassigned YES unset down down

GigabitEthernet1/0/11 unassigned YES unset down down

GigabitEthernet1/0/12 unassigned YES unset down down

GigabitEthernet1/0/13 unassigned YES unset down down

GigabitEthernet1/0/14 unassigned YES unset up up

GigabitEthernet1/0/15 unassigned YES unset up up

GigabitEthernet1/0/16 unassigned YES unset down down

GigabitEthernet1/0/17 unassigned YES unset down down

GigabitEthernet1/0/18 unassigned YES unset down down

GigabitEthernet1/0/19 unassigned YES unset down down

GigabitEthernet1/0/20 unassigned YES unset down down

GigabitEthernet1/0/21 unassigned YES unset down down

GigabitEthernet1/0/22 unassigned YES unset down down

GigabitEthernet1/0/23 unassigned YES unset down down

GigabitEthernet1/0/24 unassigned YES unset down down

GigabitEthernet1/1/1 unassigned YES unset down down

GigabitEthernet1/1/2 unassigned YES unset down down

GigabitEthernet1/1/3 unassigned YES unset down down

GigabitEthernet1/1/4 unassigned YES unset down down

Loopback0 22.22.22.22 YES manual up up

Vlan1 unassigned YES unset administratively down down

Vlan10 67.83.0.2 YES manual up up

Vlan20 67.83.1.2 YES manual up up

Vlan30 67.83.2.2 YES manual up up

Vlan40 67.83.3.2 YES manual up up

Core2#

Core2#sh vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Gig1/0/2, Gig1/0/3, Gig1/0/4, Gig1/0/5

Gig1/0/6, Gig1/0/7, Gig1/0/8, Gig1/0/9

Gig1/0/10, Gig1/0/11, Gig1/0/12, Gig1/0/13

Gig1/0/16, Gig1/0/17, Gig1/0/18, Gig1/0/19

Gig1/0/20, Gig1/0/21, Gig1/0/22, Gig1/0/23

Gig1/0/24, Gig1/1/1, Gig1/1/2, Gig1/1/3

Gig1/1/4

10 VLAN0010 active

20 VLAN0020 active

30 VLAN0030 active

40 VLAN0040 active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

10 enet 100010 1500 - - - - - 0 0

20 enet 100020 1500 - - - - - 0 0

30 enet 100030 1500 - - - - - 0 0

40 enet 100040 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

Core2#

R1-NV#sh cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

MAN Gig 0/1 152 S 2960 Fas 0/1

Core1 Fas 0/0/0 152 3650 Gig 1/0/1

R1-NV#

R1-NV(config-if)#

R1-NV#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1-NV(config)#interface gigabitEthernet 0/1

R1-NV(config-if)#ip address 67.83.4.1 255.255.255.248

R1-NV(config-if)#no shut

R1-NV(config-if)#

%LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

R1-NV#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1-NV(config)#interface g

R1-NV(config)#interface gigabitEthernet 0/0

R1-NV(config-if)#ip add

R1-NV(config-if)#ip address 67.83.3.3 255.255.255.128

R1-NV(config-if)#no shut

R1-NV(config-if)#

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up

R1-NV#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1-NV(config)#inte

R1-NV(config)#interface loo

R1-NV(config)#interface loopback 0

R1-NV(config-if)#ip addr

R1-NV(config-if)#ip address 1.1.1.1 255.255.255.255

R1-NV(config-if)#do wri

Building configuration...

[OK]

R1-NV#sh ip interface b

Interface IP-Address OK? Method Status Protocol

GigabitEthernet0/0 67.83.3.3 YES manual up up

GigabitEthernet0/1 67.83.4.1 YES manual up up

GigabitEthernet0/2 unassigned YES unset administratively down down

FastEthernet0/0/0 unassigned YES unset up down

FastEthernet0/0/1 unassigned YES unset up down

FastEthernet0/0/2 unassigned YES unset up down

FastEthernet0/0/3 unassigned YES unset up down

Loopback0 1.1.1.1 YES manual up up

Vlan1 unassigned YES unset administratively down down

R1-NV#

R2-MA#sh cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

MAN Gig 0/0 169 S 2960 Fas 0/2

SW-MA

R2-MA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2-MA(config)#inter

R2-MA(config)#interface g

R2-MA(config)#interface gigabitEthernet 0/0

R2-MA(config-if)#ip add

R2-MA(config-if)#ip address 67.83.4.2 255.255.255.248

R2-MA(config-if)#no shut

R2-MA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2-MA(config)#inter

R2-MA(config)#interface loo

R2-MA(config)#interface loopback 0

R2-MA(config-if)#ip add

R2-MA(config-if)#ip address 2.2.2.2 255.255.255.255

R2-MA(config-if)#do sh ip inter b

Interface IP-Address OK? Method Status Protocol

GigabitEthernet0/0 67.83.4.2 YES manual up up

GigabitEthernet0/1 67.83.3.129 YES manual up up

GigabitEthernet0/2 unassigned YES unset administratively down down

FastEthernet0/0/0 unassigned YES unset up down

FastEthernet0/0/1 unassigned YES unset up down

FastEthernet0/0/2 unassigned YES unset up down

FastEthernet0/0/3 unassigned YES unset up down

Loopback0 2.2.2.2 YES manual up up

Vlan1 unassigned YES unset administratively down down

R2-MA(config-if)#

R2-MA#ping 67.83.4.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 67.83.4.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/2 ms

R2-MA#ping 67.83.4.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 67.83.4.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/2 ms

R2-MA#

R2-MA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R2-MA(config)#interface gigabitEthernet 0/1

R2-MA(config-if)#ip address 67.83.3.129 255.255.255.192

R2-MA(config-if)#no shut

R2-MA(config-if)#

%LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

R2-MA(config-if)#do wri

Building configuration...

[OK]

R2-MA(config-if)#

R2-MA#sh ip interface b

Interface IP-Address OK? Method Status Protocol

GigabitEthernet0/0 67.83.4.2 YES manual up up

GigabitEthernet0/1 67.83.3.129 YES manual up up

GigabitEthernet0/2 unassigned YES unset administratively down down

FastEthernet0/0/0 unassigned YES unset up down

FastEthernet0/0/1 unassigned YES unset up down

FastEthernet0/0/2 unassigned YES unset up down

FastEthernet0/0/3 unassigned YES unset up down

Loopback0 2.2.2.2 YES manual up up

Vlan1 unassigned YES unset administratively down down

R2-MA#

R3-ZA#sh cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

SW-ZA Gig 0/1 147 S 2960 Fas 0/1

MAN Gig 0/0 120 S 2960 Fas 0/3

R3-ZA#

R3-ZA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R3-ZA(config)#interface gigabitEthernet 0/1

R3-ZA(config-if)#ip address 67.83.3.193 255.255.255.192

R3-ZA(config-if)#no shut

R3-ZA(config-if)#

%LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

R3-ZA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R3-ZA(config)#inter

R3-ZA(config)#interface g

R3-ZA(config)#interface gigabitEthernet 0/0

R3-ZA(config-if)#ip add

R3-ZA(config-if)#ip address 67.83.4.3 255.255.255.248

R3-ZA(config-if)#no shut

R3-ZA(config-if)#

%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up

R3-ZA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R3-ZA(config)#inter

R3-ZA(config)#interface lo

R3-ZA(config)#interface loopback 0

R3-ZA(config-if)#ip add

R3-ZA(config-if)#ip address 3.3.3.3 255.255.255.255

R3-ZA(config-if)#do wri

Building configuration...

[OK]

R3-ZA(config-if)#

R3-ZA#sh ip interface b

Interface IP-Address OK? Method Status Protocol

GigabitEthernet0/0 67.83.4.3 YES manual up up

GigabitEthernet0/1 67.83.3.193 YES manual up up

GigabitEthernet0/2 unassigned YES unset administratively down down

FastEthernet0/0/0 unassigned YES unset up down

FastEthernet0/0/1 unassigned YES unset up down

FastEthernet0/0/2 unassigned YES unset up down

FastEthernet0/0/3 unassigned YES unset up down

Loopback0 3.3.3.3 YES manual up up

Vlan1 unassigned YES unset administratively down down

R3-ZA#

R3-ZA(config-if)#do wri

Building configuration...

[OK]

R3-ZA(config-if)#

Access#sh cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

Core1 Fas 0/1 122 3650 Gig 1/0/2

Core2 Fas 0/4 122 3650 Gig 1/0/1

Access#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Access(config)#inter

Access(config)#interface fa

Access(config)#interface fastEthernet 0/1

Access(config-if)#sw

Access(config-if)#switchport mode

Access(config-if)#switchport mode tr

Access(config-if)#switchport mode trunk

Access(config-if)#sw

Access(config-if)#switchport tr

Access(config-if)#switchport trunk all

Access(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Access(config-if)#exit

Access(config)#interface fastEthernet 0/4

Access(config-if)#switchport mode trunk

Access(config-if)#switchport trunk allowed vlan 1,10,20,30,40

Access(config-if)#sw

Access(config-if)#switchport none

Access(config-if)#switchport nonegotiate

Access(config-if)#exit

Access(config)#interface fastEthernet 0/1

Access(config-if)#sw

Access(config-if)#switchport none

Access(config-if)#switchport nonegotiate

Access(config-if)#exit

Access(config)#inter

Access(config)#interface fa

Access(config)#interface fastEthernet 0/2

Access(config-if)#sw

Access(config-if)#switchport mode acc

Access(config-if)#switchport mode access

Access(config-if)#sw

Access(config-if)#switchport acc

Access(config-if)#switchport access vlan 10

Access(config-if)#exit

Access(config)#interface fastEthernet 0/3

Access(config-if)#switchport mode access

Access(config-if)#switchport access vlan 20

Access(config-if)#

Access#sh interfaces trunk

Port Mode Encapsulation Status Native vlan

Fa0/1 on 802.1q trunking 1

Fa0/4 on 802.1q trunking 1

Port Vlans allowed on trunk

Fa0/1 1,10,20,30,40

Fa0/4 1,10,20,30,40

Port Vlans allowed and active in management domain

Fa0/1 1,10,20,30,40

Fa0/4 1,10,20,30,40

Port Vlans in spanning tree forwarding state and not pruned

Fa0/1 1,40

Fa0/4 10,20,30

Access#

Access#sh interfaces trunk

Port Mode Encapsulation Status Native vlan

Fa0/1 on 802.1q trunking 1

Fa0/4 on 802.1q trunking 1

Port Vlans allowed on trunk

Fa0/1 1,10,20,30,40

Fa0/4 1,10,20,30,40

Port Vlans allowed and active in management domain

Fa0/1 1,10,20,30,40

Fa0/4 1,10,20,30,40

Port Vlans in spanning tree forwarding state and not pruned

Fa0/1 1,40

Fa0/4 10,20,30

Access#sh vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8

Fa0/9, Fa0/10, Fa0/11, Fa0/12

Fa0/13, Fa0/14, Fa0/15, Fa0/16

Fa0/17, Fa0/18, Fa0/19, Fa0/20

Fa0/21, Fa0/22, Fa0/23, Fa0/24

Gig0/1, Gig0/2

10 VLAN10 active Fa0/2

20 VLAN20 active Fa0/3

30 VLAN30 active

40 VLAN40 active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

10 enet 100010 1500 - - - - - 0 0

20 enet 100020 1500 - - - - - 0 0

30 enet 100030 1500 - - - - - 0 0

40 enet 100040 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

Access#

Implementando OSPF

Core1(config)#router ospf 1

Core1(config-router)#net

Core1(config-router)#network 11.11.11.11 0.0.0.0 area 0

Core1(config-router)#net

Core1(config-router)#network 67.83.0.0 0.0.0.255 area 0

Core1(config-router)#network 67.83.1.0 0.0.0.255 area 0

Core1(config-router)#network 67.83.2.0 0.0.0.255 area 0

Core1(config-router)#network 67.83.3.0 0.0.0.127 area 0

Core1(config-router)#do wri

Building configuration...

Compressed configuration from 7383 bytes to 3601 bytes[OK]

Core1#sh ip route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets

O 1.1.1.1 [110/2] via 67.83.3.3, 01:58:21, Vlan40

2.0.0.0/32 is subnetted, 1 subnets

O 2.2.2.2 [110/3] via 67.83.3.3, 01:58:21, Vlan40

11.0.0.0/32 is subnetted, 1 subnets

C 11.11.11.11 is directly connected, Loopback0

22.0.0.0/32 is subnetted, 1 subnets

O 22.22.22.22 [110/2] via 67.83.0.2, 00:45:46, Vlan10

[110/2] via 67.83.2.2, 00:45:46, Vlan30

[110/2] via 67.83.3.2, 00:45:46, Vlan40

67.0.0.0/8 is variably subnetted, 6 subnets, 4 masks

C 67.83.0.0/24 is directly connected, Vlan10

C 67.83.1.0/24 is directly connected, Vlan20

C 67.83.2.0/24 is directly connected, Vlan30

C 67.83.3.0/25 is directly connected, Vlan40

O 67.83.3.128/26 [110/3] via 67.83.3.3, 01:58:21, Vlan40

O 67.83.4.0/29 [110/2] via 67.83.3.3, 00:09:49, Vlan40

Core1#

Core2(config)#route ospf 1

Core2(config-router)#netw

Core2(config-router)#network 22.22.22.22 0.0.0.0 area 0

Core2(config-router)#netw

Core2(config-router)#network 67.83.0.0 0.0.0.255 area 0

Core2(config-router)#network 67.83.1.0 0.0.0.255 area 0

Core2(config-router)#network 67.83.2.0 0.0.0.255 area 0

Core2(config-router)#network 67.83.3.0 0.0.0.127 area 0

08:18:45: %OSPF-5-ADJCHG: Process 1, Nbr 11.11.11.11 on Vlan10 from LOADING to FULL, Loading Done

Core1#sh ip route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets

O 1.1.1.1 [110/2] via 67.83.3.3, 00:00:21, Vlan40

2.0.0.0/32 is subnetted, 1 subnets

O 2.2.2.2 [110/3] via 67.83.3.3, 00:00:21, Vlan40

3.0.0.0/32 is subnetted, 1 subnets

O 3.3.3.3 [110/3] via 67.83.3.3, 00:00:21, Vlan40

11.0.0.0/32 is subnetted, 1 subnets

C 11.11.11.11 is directly connected, Loopback0

22.0.0.0/32 is subnetted, 1 subnets

O 22.22.22.22 [110/2] via 67.83.0.2, 01:01:09, Vlan10

[110/2] via 67.83.1.2, 01:01:09, Vlan20

[110/2] via 67.83.2.2, 01:01:09, Vlan30

[110/2] via 67.83.3.2, 01:01:09, Vlan40

67.0.0.0/8 is variably subnetted, 7 subnets, 4 masks

C 67.83.0.0/24 is directly connected, Vlan10

C 67.83.1.0/24 is directly connected, Vlan20

C 67.83.2.0/24 is directly connected, Vlan30

C 67.83.3.0/25 is directly connected, Vlan40

O 67.83.3.128/26 [110/3] via 67.83.3.3, 00:00:21, Vlan40

O 67.83.3.192/26 [110/3] via 67.83.3.3, 00:00:21, Vlan40

O 67.83.4.0/29 [110/2] via 67.83.3.3, 00:00:21, Vlan40

Core1#

Core1#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

22.22.22.22 1 FULL/DR 00:00:31 67.83.0.2 Vlan10

22.22.22.22 1 FULL/DR 00:00:31 67.83.1.2 Vlan20

22.22.22.22 1 FULL/DR 00:00:31 67.83.2.2 Vlan30

22.22.22.22 1 FULL/DR 00:00:31 67.83.3.2 Vlan40

1.1.1.1 1 FULL/DROTHER 00:00:31 67.83.3.3 Vlan40

Core1#

Core2(config-router)#network 67.83.2.0 0.0.0.255 area 0

08:18:52: %OSPF-5-ADJCHG: Process 1, Nbr 11.11.11.11 on Vlan20 from LOADING to FULL, Loading Done

Core2(config-router)#network 67.83.2.0 0.0.0.255 area 0

08:18:55: %OSPF-5-ADJCHG: Process 1, Nbr 11.11.11.11 on Vlan30 from LOADING to FULL, Loading Done

Core2(config-router)#do wri

Building configuration...

Core1#sh ip protocols

Routing Protocol is "ospf 1"

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Router ID 11.11.11.11

Number of areas in this router is 1. 1 normal 0 stub 0 nssa

Maximum path: 4

Routing for Networks:

11.11.11.11 0.0.0.0 area 0

67.83.0.0 0.0.0.255 area 0

67.83.1.0 0.0.0.255 area 0

67.83.2.0 0.0.0.255 area 0

67.83.3.0 0.0.0.127 area 0

Routing Information Sources:

Gateway Distance Last Update

1.1.1.1 110 00:04:38

2.2.2.2 110 00:04:49

3.3.3.3 110 00:04:49

11.11.11.11 110 00:04:48

22.22.22.22 110 00:04:48

Distance: (default is 110)

Core1#

Core2#sh ip route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets

O 1.1.1.1 [110/2] via 67.83.3.3, 00:01:39, Vlan40

2.0.0.0/32 is subnetted, 1 subnets

O 2.2.2.2 [110/3] via 67.83.3.3, 00:01:39, Vlan40

3.0.0.0/32 is subnetted, 1 subnets

O 3.3.3.3 [110/3] via 67.83.3.3, 00:01:39, Vlan40

11.0.0.0/32 is subnetted, 1 subnets

O 11.11.11.11 [110/2] via 67.83.0.1, 01:02:18, Vlan10

[110/2] via 67.83.1.1, 01:02:18, Vlan20

[110/2] via 67.83.2.1, 01:02:18, Vlan30

[110/2] via 67.83.3.1, 01:02:18, Vlan40

22.0.0.0/32 is subnetted, 1 subnets

C 22.22.22.22 is directly connected, Loopback0

67.0.0.0/8 is variably subnetted, 7 subnets, 4 masks

C 67.83.0.0/24 is directly connected, Vlan10

C 67.83.1.0/24 is directly connected, Vlan20

C 67.83.2.0/24 is directly connected, Vlan30

C 67.83.3.0/25 is directly connected, Vlan40

O 67.83.3.128/26 [110/3] via 67.83.3.3, 00:01:39, Vlan40

O 67.83.3.192/26 [110/3] via 67.83.3.3, 00:01:39, Vlan40

O 67.83.4.0/29 [110/2] via 67.83.3.3, 00:01:39, Vlan40

Core2#

Core2#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

11.11.11.11 1 FULL/BDR 00:00:38 67.83.0.1 Vlan10

11.11.11.11 1 FULL/BDR 00:00:39 67.83.2.1 Vlan30

11.11.11.11 1 FULL/BDR 00:00:39 67.83.3.1 Vlan40

1.1.1.1 1 FULL/DROTHER 00:00:39 67.83.3.3 Vlan40

Core2#

Core2#sh ip protocols

Routing Protocol is "ospf 1"

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Router ID 22.22.22.22

Number of areas in this router is 1. 1 normal 0 stub 0 nssa

Maximum path: 4

Routing for Networks:

22.22.22.22 0.0.0.0 area 0

67.83.0.0 0.0.0.255 area 0

67.83.1.0 0.0.0.255 area 0

67.83.2.0 0.0.0.255 area 0

67.83.3.0 0.0.0.127 area 0

Routing Information Sources:

Gateway Distance Last Update

1.1.1.1 110 00:05:25

2.2.2.2 110 00:05:34

3.3.3.3 110 00:05:34

11.11.11.11 110 00:05:35

22.22.22.22 110 00:05:34

Distance: (default is 110)

Core2#

R1-NV(config)#router ospf 1

R1-NV(config-router)#network 67.83.4.0 0.0.0.7 area 0

R1-NV(config-router)#

07:59:00: %OSPF-6-AREACHG: 67.83.4.0/0 changed from area 1 to area 0

R1-NV(config-router)#network 67.83.4.0 0.0.0.7 area 0

R1-NV(config-router)#net

R1-NV(config-router)#network 67.83.0.0 0.0.0.255 area 0

R1-NV(config-router)#

08:00:22: %OSPF-6-AREACHG: 67.83.0.0/0 changed from area 1 to area 0

R1-NV(config-router)#network 67.83.1.0 0.0.0.255 area 0

R1-NV(config-router)#

08:00:30: %OSPF-6-AREACHG: 67.83.1.0/0 changed from area 1 to area 0

R1-NV(config-router)#network 67.83.2.0 0.0.0.255 area 0

R1-NV(config-router)#

08:00:35: %OSPF-6-AREACHG: 67.83.2.0/0 changed from area 1 to area 0

R1-NV(config-router)#network 67.83.3.0 0.0.0.127 area 0

R1-NV(config-router)#

08:01:09: %OSPF-5-ADJCHG: Process 1, Nbr 11.11.11.11 on Vlan40 from LOADING to FULL, Loading Done

R1-NV(config-router)#network 1.1.1.1 0.0.0.0 area 0

R1-NV(config-router)#^Z

R1-NV#

%SYS-5-CONFIG_I: Configured from console by console

R1-NV#w

08:01:14: %OSPF-5-ADJCHG: Process 1, Nbr 22.22.22.22 on Vlan40 from LOADING to FULL, Loading Done

Building configuration...

[OK]

R1-NV#sh ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets

C 1.1.1.1/32 is directly connected, Loopback0

2.0.0.0/32 is subnetted, 1 subnets

O 2.2.2.2/32 [110/2] via 67.83.4.2, 02:01:17, GigabitEthernet0/1

11.0.0.0/32 is subnetted, 1 subnets

O 11.11.11.11/32 [110/2] via 67.83.3.1, 02:01:17, Vlan40

22.0.0.0/32 is subnetted, 1 subnets

O 22.22.22.22/32 [110/2] via 67.83.3.2, 00:18:18, Vlan40

67.0.0.0/8 is variably subnetted, 8 subnets, 5 masks

O 67.83.0.0/24 [110/2] via 67.83.3.1, 00:18:18, Vlan40

[110/2] via 67.83.3.2, 00:18:18, Vlan40

O 67.83.1.0/24 [110/2] via 67.83.3.1, 00:18:18, Vlan40

[110/2] via 67.83.3.2, 00:18:18, Vlan40

O 67.83.2.0/24 [110/2] via 67.83.3.1, 00:18:18, Vlan40

[110/2] via 67.83.3.2, 00:18:18, Vlan40

C 67.83.3.0/25 is directly connected, Vlan40

L 67.83.3.3/32 is directly connected, Vlan40

O 67.83.3.128/26 [110/2] via 67.83.4.2, 02:01:17, GigabitEthernet0/1

C 67.83.4.0/29 is directly connected, GigabitEthernet0/1

L 67.83.4.1/32 is directly connected, GigabitEthernet0/1

R1-NV#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

11.11.11.11 1 FULL/BDR 00:00:38 67.83.3.1 GigabitEthernet0/0

22.22.22.22 1 FULL/DROTHER 00:00:38 67.83.3.2 GigabitEthernet0/0

3.3.3.3 1 FULL/DR 00:00:38 67.83.4.3 GigabitEthernet0/1

2.2.2.2 1 FULL/BDR 00:00:38 67.83.4.2 GigabitEthernet0/1

R1-NV#

R1-NV#sh ip protocols

Routing Protocol is "ospf 1"

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Router ID 1.1.1.1

Number of areas in this router is 1. 1 normal 0 stub 0 nssa

Maximum path: 4

Routing for Networks:

67.83.4.0 0.0.0.7 area 0

1.1.1.1 0.0.0.0 area 0

67.83.3.0 0.0.0.127 area 0

0.0.0.0 255.255.255.255 area 0

Routing Information Sources:

Gateway Distance Last Update

1.1.1.1 110 00:00:27

2.2.2.2 110 00:00:28

3.3.3.3 110 00:00:28

11.11.11.11 110 00:00:27

22.22.22.22 110 00:00:27

Distance: (default is 110)

R1-NV#

R2-MA(config)#router ospf 1

R2-MA(config-router)#net

R2-MA(config-router)#network 67.83.3.128 0.0.0.63 area 0

R2-MA(config-router)#net

R2-MA(config-router)#network 2.2.2.2 0.0.0.0 area 0

R2-MA(config-router)#netw

R2-MA(config-router)#network 67.83.4.0 0.0.0.7 area 0

R2-MA(config-router)#^Z

R2-MA#

%SYS-5-CONFIG_I: Configured from console by console

R2-MA#wri

Building configuration...

[OK]

R2-MA#sh ip r

08:03:59: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done

R2-MA#sh ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets

O 1.1.1.1/32 [110/2] via 67.83.4.1, 04:02:59, GigabitEthernet0/0

2.0.0.0/32 is subnetted, 1 subnets

C 2.2.2.2/32 is directly connected, Loopback0

3.0.0.0/32 is subnetted, 1 subnets

O 3.3.3.3/32 [110/2] via 67.83.4.3, 00:13:14, GigabitEthernet0/0

11.0.0.0/32 is subnetted, 1 subnets

O 11.11.11.11/32 [110/3] via 67.83.4.1, 01:54:58, GigabitEthernet0/0

22.0.0.0/32 is subnetted, 1 subnets

O 22.22.22.22/32 [110/3] via 67.83.4.1, 00:18:58, GigabitEthernet0/0

67.0.0.0/8 is variably subnetted, 9 subnets, 5 masks

O 67.83.0.0/24 [110/3] via 67.83.4.1, 01:54:58, GigabitEthernet0/0

O 67.83.1.0/24 [110/3] via 67.83.4.1, 01:32:17, GigabitEthernet0/0

O 67.83.2.0/24 [110/3] via 67.83.4.1, 01:54:58, GigabitEthernet0/0

O 67.83.3.0/25 [110/2] via 67.83.4.1, 01:54:58, GigabitEthernet0/0

C 67.83.3.128/26 is directly connected, GigabitEthernet0/1

L 67.83.3.129/32 is directly connected, GigabitEthernet0/1

O 67.83.3.192/26 [110/2] via 67.83.4.3, 00:13:14, GigabitEthernet0/0

C 67.83.4.0/29 is directly connected, GigabitEthernet0/0

L 67.83.4.2/32 is directly connected, GigabitEthernet0/0

R2-MA#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

1.1.1.1 1 FULL/DROTHER 00:00:32 67.83.4.1 GigabitEthernet0/0

3.3.3.3 1 FULL/DR 00:00:32 67.83.4.3 GigabitEthernet0/0

R2-MA#

R2-MA# sh ip protocols

Routing Protocol is "ospf 1"

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Router ID 2.2.2.2

Number of areas in this router is 2. 2 normal 0 stub 0 nssa

Maximum path: 4

Routing for Networks:

67.83.4.0 0.0.0.7 area 0

67.83.3.128 0.0.0.63 area 0

2.2.2.2 0.0.0.0 area 0

0.0.0.0 255.255.255.255 area 1

Routing Information Sources:

Gateway Distance Last Update

1.1.1.1 110 00:01:53

2.2.2.2 110 00:02:48

3.3.3.3 110 00:02:04

11.11.11.11 110 00:02:03

22.22.22.22 110 00:02:03

Distance: (default is 110)

R2-MA#

R3-ZA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R3-ZA(config)#router ospf 1

R3-ZA(config-router)#net

R3-ZA(config-router)#network 3.3.3.3 0.0.0.0 area 0

R3-ZA(config-router)#network 67.83.3.192 0.0.0.63 area 0

R3-ZA(config-router)#network 67.83.4.0 0.0.0.7 area 0

R3-ZA(config-router)#^Z

R3-ZA#

%SYS-5-CONFIG_I: Configured from console by console

R3-ZA#wri

Building configuration...

[OK]

R3-ZA#

08:06:53: %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done

08:06:53: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on GigabitEthernet0/0 from LOADING to FULL, Loading Done

R3-ZA#sh ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets

O 1.1.1.1/32 [110/2] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

2.0.0.0/32 is subnetted, 1 subnets

O 2.2.2.2/32 [110/2] via 67.83.4.2, 00:04:23, GigabitEthernet0/0

3.0.0.0/32 is subnetted, 1 subnets

C 3.3.3.3/32 is directly connected, Loopback0

11.0.0.0/32 is subnetted, 1 subnets

O 11.11.11.11/32 [110/3] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

22.0.0.0/32 is subnetted, 1 subnets

O 22.22.22.22/32 [110/3] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

67.0.0.0/8 is variably subnetted, 9 subnets, 5 masks

O 67.83.0.0/24 [110/3] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

O 67.83.1.0/24 [110/3] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

O 67.83.2.0/24 [110/3] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

O 67.83.3.0/25 [110/2] via 67.83.4.1, 00:04:23, GigabitEthernet0/0

O 67.83.3.128/26 [110/2] via 67.83.4.2, 00:04:23, GigabitEthernet0/0

C 67.83.3.192/26 is directly connected, GigabitEthernet0/1

L 67.83.3.193/32 is directly connected, GigabitEthernet0/1

C 67.83.4.0/29 is directly connected, GigabitEthernet0/0

L 67.83.4.3/32 is directly connected, GigabitEthernet0/0

R3-ZA#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

1.1.1.1 1 FULL/DROTHER 00:00:34 67.83.4.1 GigabitEthernet0/0

2.2.2.2 1 FULL/BDR 00:00:34 67.83.4.2 GigabitEthernet0/0

R3-ZA#

R3-ZA#sh ip protocols

Routing Protocol is "ospf 1"

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Router ID 3.3.3.3

Number of areas in this router is 1. 1 normal 0 stub 0 nssa

Maximum path: 4

Routing for Networks:

3.3.3.3 0.0.0.0 area 0

67.83.4.0 0.0.0.7 area 0

67.83.3.192 0.0.0.63 area 0

Routing Information Sources:

Gateway Distance Last Update

1.1.1.1 110 00:06:21

2.2.2.2 110 00:06:32

3.3.3.3 110 00:06:32

11.11.11.11 110 00:06:31

22.22.22.22 110 00:06:31

Distance: (default is 110)

R3-ZA#

Comprobando conectividad:

C:\>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::260:3EFF:FE42:38D

IP Address......................: 67.83.0.10

Subnet Mask.....................: 255.255.255.0

Default Gateway.................: 67.83.0.1

C:\>ping 67.83.3.130

Pinging 67.83.3.130 with 32 bytes of data:

Reply from 67.83.3.130: bytes=32 time<1ms TTL=125

Reply from 67.83.3.130: bytes=32 time=1ms TTL=125

Reply from 67.83.3.130: bytes=32 time=12ms TTL=125

Ping statistics for 67.83.3.130:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 12ms, Average = 6ms

C:\>tracert 67.83.3.130

Tracing route to 67.83.3.130 over a maximum of 30 hops:

1 1 ms 0 ms 0 ms 67.83.0.2

2 0 ms 0 ms 1 ms 67.83.3.3

3 1 ms 0 ms 1 ms 67.83.4.2

4 10 ms 12 ms 11 ms 67.83.3.130

Trace complete.

C:\>ping 67.83.3.200

Pinging 67.83.3.200 with 32 bytes of data:

Reply from 67.83.3.200: bytes=32 time=11ms TTL=125

Reply from 67.83.3.200: bytes=32 time=12ms TTL=125

Reply from 67.83.3.200: bytes=32 time<1ms TTL=125

Ping statistics for 67.83.3.200:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 12ms, Average = 5ms

C:\>tracert 67.83.3.200

Tracing route to 67.83.3.200 over a maximum of 30 hops:

1 4 ms 0 ms 1 ms 67.83.0.2

2 0 ms 1 ms 1 ms 67.83.3.3

3 0 ms 1 ms 0 ms 67.83.4.3

4 0 ms 9 ms 1 ms 67.83.3.200

Trace complete.

C:\>

C:\>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::2E0:F7FF:FE0C:B2C9

IP Address......................: 67.83.3.130

Subnet Mask.....................: 255.255.255.192

Default Gateway.................: 67.83.3.129

C:\>ping 67.83.0.10

Pinging 67.83.0.10 with 32 bytes of data:

Reply from 67.83.0.10: bytes=32 time=11ms TTL=125

Reply from 67.83.0.10: bytes=32 time=12ms TTL=125

Reply from 67.83.0.10: bytes=32 time=10ms TTL=125

Reply from 67.83.0.10: bytes=32 time=11ms TTL=125

Ping statistics for 67.83.0.10:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 10ms, Maximum = 12ms, Average = 11ms

C:\>

C:\>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::2D0:BCFF:FE4B:A292

IP Address......................: 67.83.3.200

Subnet Mask.....................: 255.255.255.192

Default Gateway.................: 67.83.3.193

C:\>tracert 67.83.0.10

Tracing route to 67.83.0.10 over a maximum of 30 hops:

1 0 ms 0 ms 0 ms 67.83.3.193

2 0 ms 0 ms 0 ms 67.83.4.1

3 0 ms 1 ms 12 ms 67.83.3.2

4 12 ms 0 ms 11 ms 67.83.0.10

Trace complete.

C:\>

Cisco es genial!.

Páginas

jueves, 3 de julio de 2025

VLAN Mikrotik Basado en Puertos

VLANs Mikrotik - Basada en Puertos. Tenemos dos routers Mikrotik (RouterOS).

Internet

VLAN - Laboratorio de pruebas

Configuración vía comandos del Router 1.

Configuracion vía comandos Router 2 (R2)

IP Route R1

Conecto un PC a Ether3 del router R2 y recibe una IP del DHCP-Server configurado en R1

(Opcional) -¿Cómo Permitir tráfico de VLANs?

Ubicación de las reglas:

Explicacion:

Permitir acceso administrativo sólo desde la red 10.10.10.1/24

Reglas de cortafuegos R1

jueves, 12 de junio de 2025

Firewall Mikrotik Protege LAN y Permite Acceso a Internet

Configuración de firewall para MikroTik (RouterOS)

Configuración básica de interfaces

DHCP Client en WAN (WAN_ether1)

NAT para acceso a Internet

POLÍTICAS POR DEFECTO (FILTER)

CONEXIONES ESTABLECIDAS

ANTI-SPOOFING Y SEGURIDAD BÁSICA Bloqueo de IPs falsas en WAN

Protección contra escaneos y ataques comunes

REGLAS INPUT (TRÁFICO AL ROUTER) Permitir administración solo desde LAN

Permitir ICMP (ping)

Permitir DHCP desde ISP

Bloquear todo lo demás en WAN

REGLAS FORWARD (TRÁFICO A TRAVÉS DEL ROUTER)

Permitir LAN -> Internet

Bloquear Internet -> LAN (excepto respuestas)

Permitir tráfico entre interfaces LAN (opcional)

REGLAS OUTPUT (TRÁFICO DESDE EL ROUTER)

REGLAS ADICIONALES DE SEGURIDAD Bloqueo de redes reservadas/rfc1918 desde WAN

Lista de redes reservadas

LOGGING (OPCIONAL)

Configurar servicios:

Protección bridge:

Protección extra:

Explicación:

miércoles, 14 de abril de 2021

Configuración de ACL numeradas extendidas En GNS3

domingo, 11 de abril de 2021

ACLs Inbound Cisco GNS3

lunes, 29 de marzo de 2021

Configurar y permitir el enrutamiento inter-VLAN Cisco EVE-NG

sábado, 13 de marzo de 2021

IPv4 Subnetting Cisco