CCIE笔记
ccie知识点总结大全
ccie知识点总结大全一、网络基础知识1. OSI七层模型2. TCP/IP协议族3. IP地址和子网划分4. VLAN和Trunk技术5. STP及其变种RSTP/MSTP6. VTP及VLAN pruning7. EtherChannel和PortChannel二、路由和交换1. 静态路由及其配置2. 动态路由协议：RIP、EIGRP、OSPF、BGP3. QoS基本概念及配置4. 交换技术：ARP、MAC地址表、交换机帧转发5. SpanningTree Protocol（STP）相关知识6. 综合交换技术解决方案7. WAN连接方式和配置：HDLC、PPP、FrameRelay、ATM、MPLS8. HSRP/VRRP/GLBP三、网络设计1. 企业网络设计：三层设计、核心层/汇聚层/接入层2. 数据中心网络设计：数据中心网络架构、SAN、NAS3. WAN设计：各种WAN连接技术的选择4. IP地址规划5. 网络设备的冗余和负载均衡设计6. 网络安全设计四、网络安全1. 防火墙技术：ACL、NAT、PAT、Zone-Based Firewall、ASA Firewall2. VPN技术：IPSec VPN、SSL VPN3. IDS/IPS4. AAA认证：RADIUS、TACACS+5. 网络安全策略设计及实施五、网络管理1. 网络设备的远程管理：Telnet、SSH2. SNMP协议及其相关概念3. 网络设备的配置备份和恢复4. 网络监控和故障排除六、IP电话及视频1. VoIP基本概念：H.323、SIP、MGCP2. VoIP协议与传输3. QoS在VoIP中的应用4. IP电话网关的配置七、IPv61. IPv6基本概念2. IPv6地址分配和路由3. IPv6网络基础设施的部署4. IPv6过渡技术八、思科设备配置1. 路由器和交换机基本配置2. IOS路由器和交换机高级特性配置3. Catalyst交换机常见配置4. ISR路由器配置5. ASA防火墙配置6. Nexus交换机配置7. Catalyst 6500交换机配置8. 无线控制器配置以上就是CCIE知识点总结大全，涵盖了网络基础知识、路由和交换、网络设计、网络安全、网络管理、IP电话及视频、IPv6、思科设备配置等方面的内容。
CCIE实验笔记之-WAN协议帧中继
CCIE实验笔记之-第3章WAN协议（帧中继）之一3.1 帧中继概述3.1.1 帧中继相关术语l PVC（永久虚电路）传输帧的逻辑端到端电路，PVC是用DLCI来寻址。
l DLCI（数据链路连接标识符）16-1007的逻辑数字，标识CPE和帧中继交换机之间的PVC，只在本地有效。
l LMI（本地管理接口）router and frame switch 之间使用的信令标准，交换机使用LMI确定已定义的DLCI及其状态。
支持10s间隔的keepalive机制。
Cisco支持三种LMI：※CISCO：Cisco、Digital和Northern Telecom定义，自动协商失败后默认的LMI类型，状态信息通过DLCI 0传送。
※ANSI：ANSI标准T1.617定义，最常用的LMI类型，通过DLCI1023传送。
※Q933A：定义为ITU-T Q.933的LMI类型，状态信息通过DLCI 0传送。
l NNI（网络到网络接口）2台交换机间通信标准，帧中继和ATM均使用NNI，ATM称为网络节点接口（Network Node Interface）。
l 本地访问速率与帧中继服务提供者相连链路的时钟速率或称接口速率。
可以工作在T1、T3或者HSSI下。
图3-1为常用的帧中继网络示意图下面术语称为数据速率度量值。
服务商使用这些来规定服务级别，这些术语还用于帧中继流量整形：l Bc（承诺突发量）以CIR为基础的允许接收和发送的bit numberl CIR(承诺信息速率)PVC允许的最大的数据速率，超过时置为可丢弃位（DE）。
单位bit/s。
l Bc(过量突发)达到了承诺突发值之后可发送的超出bit number。
l MaxR(最大速率)单位bit/s，计算公式：MaxR=CIR×((Bc+Be)/Bc)。
图3-2显示各种速率间的关系。
3.1.2 技术概览帧中继特点：l 通过统计多路复用技术全多个逻辑电路功能在一个物理电路上实现。
CCIE学习笔记-交换
CCIE学习笔记—交换—SPAN/RSPAN Editor：EdisonE-mail:shilianwang@QQ：21478604如有疏漏之处请不吝赐教如有转载请注明作者及出处SPAN（Switched Port Analyzer，交换端口分析器）——用于交换环境的性能管理和排错。
SPAN能够将某个VLAN或一组端口（源）的网络流量复制到某个端口中（目的），而那个目的端口通常连接到网络分析器（比如，SwitchProbe设备）。
SPAN不会对源端口或VLAN的网络流量交换产生影响。
SPAN分为两类：1．本地SPAN2．远程SPAN本地SPAN（简称SPAN）：SPAN通常只在一台交换机上进行配置，包括配置源端口、源VLAN和目的端口。
SPAN将任何VLAN 中的单个或多个端口中的网络流量复制到用于分析的目标端口。
SPAN会话支持对如下三种类型的网络流量进行监控——流入的网络流量；流出的网络流量；双向网络流量。
通过将需要分析的源端口和VLAN所接受（rx）的网络流量复制到目标端口，流入SPAN能够监控流入的网络流量；通过将需要分析的源端口和VLAN所发送（tx）的网络流量复制到目标端口，流出SPAN 能够监控流出的网络流量。
当使用双向（both）关键字的时候，通过将需要分析的源端口和VLAN所收发网络流量复制到目标端口，SPAN能够监控双向的网络流量。
SPAN支持将交换端口和路由端口配置为SPAN源端口。
SPAN能能够在单个SPAN会话中监控单个或多个源端口。
任何VLAN中都可以配置源端口。
干道端口能够与非干道端口混合形成有效的源端口。
在目标端口没有配置trunk的时候，在它对流入的帧传输之前，首先会将帧中的ISL或Dot1q清除掉。
顺带介绍一下IPS，全称为Intrusion Prevention System，入侵防御系统，使用目标端口的流入特性来阻挠网络攻击，起方法是向攻击者的TCP会话发送TCP复位或者是向网络管理站发送警报。
CCIE学习 笔记-CBWFQ的配置及和WFQ的区别
CBWFQ 基于类别的加权公平排队,通常使用ACL定义数据流类别，并将注入宽带和队列限制等参数应用于这些类别.CBWFQ特点:1)能够给不同的类保障一定的带宽2)对传统的WFQ作了扩展支持用户自己定义流量的分类:3)队列的个数和类别是一一对应,给每个class 保留带宽CBWFQ与WFQ的区别：WFQ: 用户无法控制分类，由HASH算法自己决定CBWFQ:让用户对流量自己来分类WFQ 对正常流量处理没问题，但是对语音流量显得"太公平"(语音要求低延迟)CBWFQ:考虑到公平特性，并没有考虑到语音的应用CBWFQ Configuration:CBWFQ(config)#CBWFQ(config)#class-map match-any CBWFQ1CBWFQ(config-cmap)#match dscp 6CBWFQ(config-cmap)#match protocol http //两个条件，满足其中一个就可以匹配CBWFQ1//CBWFQ(config)#CBWFQ(config)#class-map match-all CBWFQ2CBWFQ(config-cmap)#match precedence 3CBWFQ(config-cmap)#match protocol telnet //两个条件必须全部满足才能匹配CBWFQ2//CBWFQ(config)#CBWFQ(config)#policy-map CBWFQCBWFQ(config-pmap)#class CBWFQ1 //调用class-map CBWFQ1// CBWFQ(config-pmap-c)#bandwidth 60CBWFQ(config-pmap)#CBWFQ(config-pmap)#class CBWFQ2CBWFQ(config-pmap-c)#bandwidth 30CBWFQ(config)#CBWFQ(config)#int s0/0CBWFQ(config-if)#service-policy output CBWFQ //CBWFQ只能在出方向上调用//CBWFQ#查看：CBWFQ#CBWFQ#show class-mapClass Map match-any class-default (id 0)Match anyClass Map match-any CBWFQ1 (id 1)Match dscp 6Match protocol httpClass Map match-all CBWFQ2 (id 2)Match precedence 3CBWFQ#CBWFQ#CBWFQ#show policy-mapPolicy Map CBWFQClass CBWFQ1Bandwidth 60 (kbps) Max Threshold 64 (packets)Class CBWFQ2Bandwidth 30 (kbps) Max Threshold 64 (packets)CBWFQ(config)#CBWFQ(config)#policy-map CBWFQCBWFQ(config-pmap)#class CBWFQ1CBWFQ(config-pmap-c)#queue-limit 30 // 定义每个队能存放的报文数量，超过后丢包方式：Tail drop//CBWFQ#CBWFQ#show policy-mapPolicy Map CBWFQClass CBWFQ1Bandwidth 60 (kbps) Max Threshold 30 (packets)Class CBWFQ2Bandwidth 30 (kbps) Max Threshold 64 (packets)CBWFQ#配置实例：一家公司需求；HTTP流量保障256Kbps带宽，FTP流量保证512Kbps带宽，禁止BT流量.CBWFQ(config)#class-map HTTP //定义一个匹配HTTP的类// CBWFQ(config-cmap)#match protocol httpCBWFQ(config)#class-map FTPCBWFQ(config-cmap)#match protocol ftpCBWFQ(config)#class-map BTCBWFQ(config-cmap)#match protocol bittorrentCBWFQ(config)#CBWFQ(config)#policy-map CBWFQ //定义策略，调用类class// CBWFQ(config-pmap)#class HTTPCBWFQ(config-pmap-c)#bandwidth 256CBWFQ(config-pmap)#class FTPCBWFQ(config-pmap-c)#bandwidth 512CBWFQ(config-pmap)#class BTCBWFQ(config-pmap-c)#dropCBWFQ(config-pmap)#class class-defaultCBWFQ(config-pmap-c)#fair-queue //网络中剩下的流量除了HTTP,FTP之外都使用WFQ，放到fair-queue中了//CBWFQ(config)#CBWFQ(config)#int s0/0CBWFQ(config-if)#service-policy output CBWFQCBWFQ(config)#Weighted Fair Queue，加权公平队列。
CCIE学习笔记——RMON
CCIE学习笔记——RMONCCIE学习笔记——RMON(2008-12-19 20:25:05)转载▼标签：ccie分类：CiscormonRMON是在Cisco设备上与SNMP配合使⽤的⼀个IETF标准监控协议。
在RMON中，⽹络监控数据包含了⼀组统计数据以及性能指标，能够在不同的监视器和控制台系统之间交换。
RMON是为了解决SNMP协议在应⽤的时候的局限性⽽开发出来的。
在Cisco交换机上，RMON⽀持⼀下RMON组：l Statistics ——收集⼀个接⼝的状态信息。
l History ——在指定时间间隔内保存⼀个接⼝状态信息的历史记录。
l Alarm ——定期查看制定MIB信息并在达到或回落到⼀个指定值时触发警报，通常与Event结合使⽤，警报触发事件，事件产⽣SNMP Trap消息。
l Event ——在被警报出发后执⾏指定动作，通常是产⽣SNMP Trap消息。
配置RMON Alarm以及Events（全局）：Alarm：rmon alarm number variable interval {absolute | delta} rising-threshold value [event-number] falling-threshold value [event-number] [owner string]命令中，number为管理员指定的编号，variable为要监控的MIB对象，interval为监控时间间隔，当指定absolute 时，为直接检查MIB的值，⽽delta为检查MIB采样的变化。
之后的第⼀个event-number为制定的Event编号，意思是当监控值的曾长达到指定的value⼤⼩时触发event-number指定的Event。
第⼆个event-number为当监控值减少到指定的value⼤⼩时，触发event-number指定的Event。
Event：rmon event number [description string] [log] [owner string] [trap community]命令中，number为管理员指定的编号，description string为对此事件的描述，当使⽤log参数时，在事件发⽣后产⽣⼀个RMON⽇志。
CCNP_BCMSN_Notes_CCNPCCIE专业笔记
CCNP BCMSN Notes31 Mar 2008Chapter 3: Switch OperationLayer 2 SwitchingSw itching DecisionFactors in a switching decision:Layer 2 forwarding table - Content Addressable Memory (CAM) tableSecurity A CLs - Access lists are stored in compiled form in the Ternary CAM (TCAM)QoS A CLs - Used to police traffic flow, also stored in the TCAMMultilayer SwitchingRoute C achingRoute caching is the first generation multilayer switching.Requires a route processor (RP) and switching engine (SE).The RP routes the first packet in a flow, and creates a record for the destination in the MLS cache.The SE forwards all subsequent packets for that destination based on the MLS cache entry.Route caching is used by NetFlow to generate traffic statistics.Topology-basedSecond generation multilayer switching, known as Cisco Express Forwarding (CEF).Layer 3 routing information builds a database containing the entire network topology, contained in hardware Forwarding Information Base (FIB).The hardware database can be updated dynamically with no performance penalty.Sw itching DecisionLayer 2 forwarding table - The destination MAC is checked against the CAM table todetermine if the frame contains a layer 3 packet (if the MAC address belongs to a layer 3interface on the switch)Layer 3 forwarding table - The destination IP is checked against the FIB; the next-hop IP,next-hop MAC, and egress port (and VLAN) are returnedSecurity A CLs - Same as in L2QoS A CLs - Same as in L2Multilayer Sw itching ExceptionsPackets which require processing cannot be forwarded by CEF:ARPIP packets requiring a response from the routerIP broadcasts relayed as unicasts (via IP helpers)Routing protocol updatesCDPIPX routing protocol and service advertisementsPackets needing encryptionPackets requiring Network Address Translation (NAT)Other non-IP and non-IPX packetsSwitching TablesC ontent Addressable Memory (C AM)The CAM table stores MAC-to-port/VLAN bindings on all Catalyst switches.CAM is updated with each frame received.The CAM table can be inspected with show mac address-table.Ternary C ontent Addressable Memory (TC AM)TCAMs facilitate the processing of inbound and outbound security and QoS ACLs in hardware. Physically separate memory allows ACLs checks to be done in parallel with forwarding decisions. The Feature Manager (FM) compiles ACLs into machine code and inserts them into the TCAM. The Switching Database Manager (SDM) allows for configuration and repartitioning of the TCAM. TCAMs operate with values, masks, and results:V alue - 134-bit value composed of source and destination addresses and other protocol information; format is dependent on ACL typeMask - 134-bit mask in the same format as its complement value; used to mark bits which must be matched in the valueResult - A numerical value which represents which action should be taken nextLayer 4 port ranges are stored in Logical Operation Unit (LOU) registers.Chapter 4: Switch Port ConfigurationIEEE standards:802.3 - Ethernet802.3u - Fast Ethernet802.3z - Gigabit Ethernet802.3ab - Gigabit Ethernet over copper (1000Base-T)802.3ae - 10 Gigabit EthernetGigabit Ethernet was the result of merging IEEE 802.3 Ethernet and ANSI X3T11 FibreChannel. GBIC/SFP types:1000Base-SX1000Base-LX/LH1000Base-ZX1000Base-TGigaStack (Cisco Proprietary)Fiber modules take the Rx fiber on the left and Tx on the right (when facing the module).Interface error disabling can be tuned in global config:Chapter 5: VLANs and TrunksThe normal range allows for VLANs 1 - 1005; IEEE 802.1Q expands this to 1 - 4095.VTP version 1 and 2 only support VLANs 1 - 1005. VTPv3 will support extended VLANs but isn't available yet.Dynamic VLANs can be configured by a VLAN Membership Policy Server (VMPS).Trunk types:Inter-Switch Link (ISL) - Cisco proprietary; 26-byte headerIEEE 802.1Q - Open standard; 4-byte headerIEEE 802.3ac extends the Ethernet MTU to 1522 to account for the 4-byte 802.1Q header.Trunk configuration:Chapter 6: VLAN Trunking ProtocolVTP modes:Client - Rely on VLAN information advertised by a server; no local configuration possibleServer - Have full control over VLAN creation and modification for the VTP domainTransparent - Does not participate in VTP but will forward advertisementsVTP advertisements:Summary - Sent every 300 seconds or whenever a change occursSubset - Sent after a summary advertisement when a change occurs; these provide moredetail to reflect the change that was madeA dvertisement Request - Issued by clients to request VLAN informationPruning Request - Sent from clients to servers to announce active VLANs; inactive VLANsmay be pruned from the trunkVTP configuration:Switch(config)# vtp mode {server | client | transparent}Switch(config)# vtp version {1 | 2}Switch(config)# vtp domain <domain>Switch(config)# vtp password <password>VTP pruning can be enabled with vtp pruning.Verification:show vtp statusshow vtp countersChapter 7: Aggregating Switch LinksEtherChannel Load BalancingEtherChannel distributes load across multiple physical links by examining between one and three low order bits of an arbitrary address. XOR is used when multiple addresses are examined.Address types eligible for examination:Source and destination MA C-src-mac(default for L2channels),dst-mac,orsrc-dst-macSource and destination IP - src-ip, dst-ip, or src-dst-ip (default for L3 channels)Source and destination L4 port-src-port,dst-port,or src-dst-port(Catalyst6500/4500 only)Port channel load balancing is configured globally:EtherChannel NegotiationPort Aggregation Protocol (PAgP)PAgP is Cisco proprietary.Port channels are configured as desirable (active) or auto (passive).Addition of the non-silent parameter will ensure the etherchannel will not be formed without receiving PAgP packets from the neighbor.Configuring PAgP:Link Aggregation C ontrol Protocol (LAC P)LACP is defined in IEEE 802.3ad.The switch with the lowest priority designates which interfaces participate in the etherchannel.Interfaces are configured as active or passive.lacp port-priority <priority> is used to assign an LACP priority to individual ports.Lower-priority interfaces beyond the eight-port limit for a single channel will be designated as standby interfaces should one of the higher-priority links fail.Configuring LACP:StaticEtherChannel interfaces can be set to on, forming a permanent etherchannel with no autonegotiation protocol (neither PAgP or LACP is used).Troubleshootingshow etherchannel summaryshow etherchannel portshow etherchannel load-balanceshow {pagp | lacp} neighborChapter 8: Traditional Spanning Tree ProtocolSTP is defined in IEEE 802.1D.BPDUsSTP messages are carried by Bridge Protocol Data Unit (BPDU) frames; BPDUs are multicast to 01:80:c2:00:00:00.BPDU types:Configuration - Used for spanning-tree computationTopology Change Notification (TCN) - Used to announce changes in the network Configuration BPDUs are sent out every port every two seconds by default.Root Bridge ElectionA root bridge is elected to serve as a common reference point for the topology.A switch's bridge ID is composed of two parts:Bridge priority (2 bytes) - Administratively set; defaults to 32,768 (0x8000)MA C address (6 bytes) - One of the switch's MAC addressesAll switches assume they are the root bridge at boot. The actual root bridge is the switch with the lowest bridge ID.Configuration BPDUs are only generated by the root bridge; all other bridges insert their own sender ID and relay them.Root Port ElectionAll non-root switches must designate a single interface as the root port (the port with the best path to the root bridge).All interfaces are assigned an 8-bit cost derived from their speed.Port costs:Bandwidth Cost4 Mbps25010 Mbps10016 Mbps6245 Mbps39100 Mbps19155 Mbps14622 Mbps61 Gbps410 Gbps2The port with the lowest path cost to the root bridge is designated as the root port.The root path cost noted in a BPDU is incremented by the cost assigned to the port on which it was received.Designated Port SelectionIf multiple switches reside on a segment, the one with the lowest root path cost has the designated port; the other ports will be set to blocking.Designated port selection process:1.Lowest root bridge ID2.Lowest root path cost3.Lowest sender bridge ID4.Lowest sender port IDSTP StatesDisabled - ShutdownBlocking - The first state when an interface comes up; only receives BPDUs; indefinitedurationListening - Can send and receive BPDUs; able to participate in STP; duration specified byforward delay timerLearning - Can send and receive BPDUs and learn MAC addresses; duration specified byforward delay timerForwarding - Normal operation; indefinite durationSTP TimersHello Time - The rate at which configuration BPDUs are advertised by the root bridge(default is 2 seconds)Forward Delay - Length of time a port spends in both the listening and learning states(default is 15 seconds)Max A ge - Life of the most recent BPDU advertised from the root bridge (default is 20seconds)Timers can be individually adjusted manually on the root bridge, or automatically adjusted by modifying the network diameter (number of switch hops which extend from the root).STP TypesCommon Spanning Tree (CST) - Defined in 802.1Q; one tree for all VLANsPer-V LA N Spanning Tree (PV ST) - Cisco proprietary; one tree per VLANPer-V LA N Spanning Tree Plus (PV ST+) - PVST featuring compatibility with CST BPDUsChapter 9: Spanning Tree ConfigurationRoot Bridge ConfigurationThe root bridge should be positioned centrally in the network to ensure the spanning tree forms in a predictable manner.Two bridge ID formats are available:802.1D Standard - 16-bit priority + unique MAC address for the VLAN802.1t Extended - 4-bit priority multiplier + 12-bit VLAN ID + non-unique MAC addressThe extended ID format is enabled by default, or with spanning-tree extend system-id.An extended system ID priority must be a multiple of 4096.There are two ways to designate the root bridge.Setting a static priority:Allowing the switch to decide its own priority relative to other switches on the network:Port Cost and ID TuningTo manually configure the cost for a port (and override the default cost associated with its speed):The port ID consists of an 4-bit port priority (default value is 128) and a 12-bit port number.To manually configure the priority of a port:Tuning Spanning-Tree ConvergenceManually configuring STP timers:Timers can also be automatically adjusted when designating an automatically determined bridge priority (via the diameter parameter):Redundant Link ConvergencePortFast - Applied to access ports to allow fast establishment of connectivityUplinkFast - Enables fast failover to an alternate uplink toward rootBackboneFast - Enables fast convergence in the core after a topology changePortFastCan be enabled globally:Or, per-interface:UplinkFastCan only be enabled on switches which do not act as transit to root (and are not root).Enabled globally, for all ports and VLANs:The optional max-update-rate (default 150) specifies how fast to flood out spoofed multicast frames from sources in the CAM so that upstream switches see them on the new link.BackboneFastBackboneFast allows a switch to respond to inferior BPDUs (BPDUs from a new switch claiming to be root) immediately, instead of waiting for the Max Age timer to expire.Root Link Query (RLQ) protocol requests are sent out to see if upstream switches have a path to root.BackboneFast is enabled globally:If enabled, BackboneFast should be enabled on all switches in the domain, due to its reliance on RLQ. Troubleshooting Spanning-Treeshow spanning-tree [detail | summary | ...]Chapter 10: Protecting the Spanning Tree Protocol Topology Root GuardIf a switch with a lower bridge ID enters the network, it can preempt the current STP root.Root guard can be enabled on an interface to prevent it from becoming a root port:Root guard will affect all VLANs on the port.Ports disabled by root guard can be viewed with show spanning-tree inconsistentports.BPDU GuardBPDU guard automatically places an interface in the error-disabled state upon receipt of a BPDU.BPDU guard can be enabled globally or per interface:Loop GuardLoop guard prevents a blocked port from transitioning to the forwarding state if it stops receiving BPDUs. Instead, the port is placed in the loop-inconsistent state and continues to block traffic.Loop guard operates per VLAN, and can be enabled globally or per interface:Unidirectional Link Detection (UDLD)UDLD can detect link failures which do no explicitly shutdown the interface (such as a unidirectional fiber link or failed intermediate media converter).UDLD transmits frames across a link at regular intervals, expecting the distant end to transmit them back.The default UDLD message timer is 7 or 15 seconds (depending on the platform), allowing it to detect a unidirectional link before STP has time to transition the interface to forwarding mode.UDLD has two modes of operation:Normal mode - UDLD will notice and log a unidirectional link condition, but the interface isallowed to continue operating.A ggressive mode - UDLD will transmit 8 additional messages (1 per second); if none ofthese are echoed back the interface is placed in the error-disabled state.UDLD can be enabled globally for all fiber interfaces, or per-interface:The UDLD message time can be from 7 to 90 seconds.UDLD will not consider a link eligible for disabling until it has seen a neighbor on the interface already. This prevents it from disabling an interface when only one end of the link has been configured to support UDLD.udld reset can be issued in user exec to re-enable interfaces which UDLD has disabled.BPDU FilteringBPDU filter can be enabled globally or per-interface to effectively disable STP:Chapter 11: Advanced Spanning Tree ProtocolRapid STP (RSTP)RSTP was developed to provide a faster converging alternative to STP, and is defined in IEEE 802.1w.Like STP, RSTP can be applied as a single instance or per VLAN.A root is elected by lowest bridge ID, as in 802.1D STP.RSTP provides its own set of port roles:Root port - Same as in 802.1DDesignated port - Same as in 802.1DA lternate port - A port with an alternate, less desirable path to rootBackup port - A port which provides an alternate, less desirable path to a segment whichalready has a designated portRSTP defines port states based on what action is taken on incoming frames:Discarding - Frames are dropped, no addresses are learned (replaces 802.1D disabled,blocking and listening states)Learning - Frames are dropped, but addresses are learnedForwarding - Frames are forwardedRSTP defines a new version of BPDU (v2) which is backward-compatible with 802.1D.BPDUs are sent out from every switch at hello time intervals; a neighbor is assumed down if three intervals are missed.If an RSTP switch detects a traditional (version 0) BPDU on a port, that port changes to operate in 802.1D mode.Port types:Edge port - A port to which a single host connects; identified by enabling PortFast; loses itsedge status upon receipt of a BPDURoot port - The port with the best path to root; alternates can be identified as wellPoint-to-point port-A designated port connected directly to another switch;onlyfull-duplex ports are eligible by defaultRSTP SynchronizationAll non-edge ports begin in the discarding state.Proposal messages are used to determine the root port of a segment based on bridge priorities.When a switch receives a proposal message on a port, it moves all other non-edge ports to the discarding state until it sends an agreement to the sender of the proposal.When an agreement is reached, the ports on both ends of the link begin forwarding.This method of proposal/agreement handshakes allows the synchronization process to complete much faster than traditional STP, as no timers are needed.Topology change BPDUs are sent only when a non-edge port transitions to forwarding.RSTP C onfigurationRSTP is enabled by configuring Rapid PVST:Half-duplex links to other switches can be administratively designated as point-to-point links:Multiple Spanning Tree (MST)MST was developed to offer a middle ground between CST (one instance for all VLANs) and PVST (one instance for each VLAN).An MST region is defined by several attributes:Configuration name (32 characters)Configuration revision number (16-bit)Instance-to-VLAN mapping table (up to 4096 entries)All attributes must match for two switches to belong to the same region.An MST region is seen as a single virtual bridge by an outside CST, and runs an Internal Spanning Tree (IST) inside.Up to 16 MST Instances (MSTIs) numbered 0 through 15 run inside an MST region; MSTI 0 is the IST.Additional MSTIs can be created and have VLANs assigned to them.MST C onfigurationEnabling MST:Creating an MST region:View pending changes before they are applied:Chapter 12: Multilayer SwitchingInterfaces on multilayer switch are designated as switch ports (layer 2) with switchport or routed ports (layer 3) with no switchport.Switched Virtual Interfaces (SVIs) can be defined to provide a routed interface to a VLAN.Cisco Express Forwarding (CEF)Traditional multilayer switching ("route once, switch many", also known as NetFlow switching or route cache switching) was done through the combination of a route processor and a switching engine.CEF is the second generation of multilayer switching, and is enabled by default in hardware which supports it.CEF operation relies on two components working in tandem: the layer 3 engine (routing) and the layer 3 forwarding engine (switching).The layer 3 forwarding engine contains the Forwarding Information Base (FIB) and its Adjacency Table.Forw arding Information Base (FIB)The FIB is an optimized copy of the routing table, with more-specific routes listed first.Each entry in the FIB has layer 2 and 3 next-hop addressing information associated with it.FIB entries can be examined with show ip cef.Packets meeting certain conditions cannot be CEF-switched and will be punted to the layer 3 engine for traditional software routing:Expired TTLMTU exceededICMP redirect requiredUnsupported encapsulation typeCompression and/or encryption is necessaryAn ACL log entry must be generatedAccelerated CEF (aCEF) can be implemented in some hardware to cache portions of the FIB on each line card.Distributed CEF (dCEF) stores the entire FIB on all capable line cards.Adjacency TableThe adjacency table is the portion of the FIB which contains layer 2 next-hop information (MAC addresses which correspond to the layer 3 next-hop addresses).Similar to how the FIB is built from the routing table, the adjacency table is built from the ARP table.Adjacency information can be examined with show adjacency.Adjacency table entries with missing or expired layer 2 addresses are placed in the CEF glean state; packets must be punted to the L3 engine so an ARP request/reply can be generated.When a route is placed in the glean state, incoming packets will be dropped for up to two seconds as the switch awaits an ARP reply.Other adjacency states include:Null - Represents a null interface (black hole)Drop - Indicates packets cannot be forwarded to the destination and should be droppedDiscard - An ACL or other policy mandates that packets be droppedPunt - Further processing is required by the layer 3 enginePacket Rew riteThe packet rewrite engine reconstructs the incoming packet with the appropriate next hop address information.Fields rewritten include:Layer 2 destinationLayer 2 sourceIP TTLIP ChecksumLayer 2 frame checksumFallback BridgingNon-IP protocols are not supported by CEF.Each SVI carrying nonroutable traffic can be assigned to a bridge group and bridged transparently, separate from normal L2 switching.A special type of STP known as VLAN-bridge is run on these bridge groups.Fallback bridging must be manually configured:Verifying Multilayer Switchingshow interface switchport ("Disabled" verifies layer 3 operation)show ip cef [detail]show bridge groupChapter 13: Router, Supervisor, and Power RedundancyHot Standby Router Protocol (HSRP)HSRP is Cisco proprietary, but defined in RFC 2281.HSRP routers multicast to the all-routers address 224.0.0.2 on UDP port 1985.HSRP group numbers (0 - 255) are only significant to an interface.HSRP group configuration:HSRP virtual interfaces are assigned a MAC in the range0000.0c07.acXX where the last8 bits represent the standby group.Router ElectionHSRP priority ranges from 0 to 255; default is 100.The highest priority wins; highest IP wins a tie.HSRP interface states:DisabledInitListenSpeakStandbyActiveThe default hello timer is 3 seconds; holddown timer is 10 seconds.Timers can be adjusted:By default a router with higher priority cannot preempt the current active router; this can be allowed:minimum defines the time the router must wait after it becomes HSRP-capable for the interface. reload defines the time it must wait after reloading.AuthenticationCisco devices by default use the plaintext string "cisco" for authentication.Plaintext or MD5 authentication can be usedC onceding the ElectionA router can be configured to withdraw from active status if one or more of its other interfaces fail:The router's priority will be decremented by the associated value (default 10) if the tracked interface fails.If another router now has a higher priority and has been configured to preempt, it will take over as theactive router for the group.Verificationshow standby [brief] [interface]Virtual Router Redundancy Protocol (VRRP)Standards-based alternative to HSRP, defined in RFC 2338.VRRP refers to the active router as the master router; all others are in the backup state.VRRP virtual interfaces take their MAC from the range 0000.5e00.01XX where the last eight bits represent the group number.VRRP advertisements are multicast to 224.0.0.18, using IP protocol 112.VRRP advertisements are sent in 1-second intervals by default; backup routers can optionally learn the interval from the master router.VRRP routers will preempt the master by default if they have a higher priority.VRRP is unable to track interfaces and concede an election.VRRP C onfigurationVRRP configuration is very similar to HSRP configuration:Verificationshow vrrp [brief]Gateway Load Balancing Protocol (GLBP)GLBP is Cisco proprietary, and acts like HSRP/VRRP with true load-balancing capability: all routers in a group forward traffic simultaneously.GLBP group numbers range from 0 to 1023. Priorities range from 0 to 255 (default is 100).IP address(es), router preemption, and hello/hold timers (default 3/10 seconds) can be configured like for HSRP:Timers only need to be configured on the AVG; other routers will learn from it.Active Virtual Gatew ay (AVG)The AVG has the highest priority in the GLBP group (or the highest IP address in the event of a tie); it answers all ARP requests for the group's virtual IP address.Active Virtual Forw arder (AVF)All routers sharing load in GLBP are AVFs.If an AVF fails, the AVG reassigns its virtual MAC to another router.Two timers are used to age out the virtual MAC of a failed AVF:Redirect timer (default 600 seconds) - Determines when the AVG will stop responding toARP requests with the MAC of the failed AVFTimeout timer (default 4 hours) - Determines when the failed AVF is no longer expected toreturn, and its virtual MAC will be flushed from the GLBP groupConfiguring the timers:AVFs are assigned a maximum weight (1-254; default is 100).Interfaces can be tracked and the AVF's weight adjusted when interfaces go down:When the upper or lower threshold is reached, the AVF enters or leaves the group, respectively.Load BalancingUp to four virtual MACs can be assigned by the AVG.Traffic can be distributed among AVFs using one of the following methods:Round robin (default) - Each new ARP request is answered with the next MAC address available; traffic is distributed evenly among AVFsWeighted - AVFs are assigned load in proportion to their weightHost-dependent - Statically maps a requesting client to a single AVF MACConfiguring load balancing:Verificationshow glbp [brief]Switch Chassis RedundancyRedundant supervisor modes:Route Processor Redundancy (RPR) (> 2 minutes) - The standby supervisor is only partially initialized; when the active sup fails, the standby must reload all modules and finish initializing itself.Route Processor Redundancy Plus (RPR+) (>30 seconds) - The standby supervisor boots but does not operate; when the active sup fails, the standby can take over without reloading the modules.Stateful Switchover (SSO) (>1 second) - Configuration and layer 2 information are stored on both supervisors; the standby sup takes over immediately.Configuring supervisor redundancy:If configuring redundancy for the first time, it must be configured manually on both supervisors. Redundant operation can be verified with show redundancy states.Non-Stop Forw arding (NSF)When a standby supervisor takes over, it must populate its RIB; this can be achieved quickly with Cisco's proprietary NSF. NSF-aware neighbors provide routing information to quickly populate the new RIB.BGP, EIGRP, OSPF, and IS-IS support NSF, but it must be enabled through manual configuration under the relevant protocol:Redundant Power SuppliesSwitches with multiple power supplies can operate in one of two power modes:Combined mode - The load for a single power supply may be exceeded; does not provideredundancy.Redundant mode (default) - Load is shared but may not exceed the output of a singlepower supply.Configuring power mode:Power may be administratively removed from or applied to individual modules:Verification:show power [redundancy-mode | status | available | used | total]show power inline - Displays power drawn from PoE interfacesChapter 14: IP TelephonyPower Over Ethernet (PoE)Two solutions exist to supply PoE:Cisco Inline Power (ILP) - Cisco proprietary solution developed before IEEE 802.3afIEEE 802.3af - StandardIEEE 802.3afAn 802.3af PoE switch applies a small voltage across the wire and checks for 25K Ohm resistance to determine if a PoE device is connected.Depending on the resistance presented at differing test voltages, the switch can determine which power class a device belongs to:Class 0 - 15.4W (default)Class 1 - 4.0WClass 2 - 7.0WClass 3 - 15.4WClass 4 - Reserved for future useThe power class determines how much of the switch's power budget is allocated to the interface.Power is supplied over pairs 1,2 and 3,6 or pairs 4,5 and 7,8.C isco ILPA Cisco ILP switch transmits a 340kHz test tone on the Tx pair to detect a PoE device; if a Cisco ILP-capable device is present, the tone will be echoed back.Power is supplied over pairs 1,2 and 3,6.Cisco ILP detects a device's power requirement via CDP.C onfiguring PoEAll capable switch ports will attempt PoE by default (auto).PoE can be verified with show power inline.Voice VLANsTrunks to IP phones are automatically negotiated by Dynamic Trunking Protocol (DTP) and CDP.Configuring a voice VLAN:。
CCNP-BSCI课堂笔记
NP BSCI 课程 (3)1.1.EIGRP 增强型内部网关路由协议 (3)1.1.1.EIGRP的特性： (3)1.1.2.EIGRP的关键技术 (3)1.1.3.EIGRP的术语 (3)1.1.4.EIGRP的包的类型 (3)1.1.5.EIGRP metric值的计算 (4)1.1.6.EIGRP的配置 (4)1.1.7.路由汇总 (6)1.1.8.非等价负载均衡 (6)1.1.9.基于MD5的认证加密 (7)1.2.OSPF 开放式最短路径优先协议 (8)1.2.1.工作的过程 (8)1.2.2.OSPF的区域划分 (8)1.2.3.关于OSPF的邻居关系与邻接关系 (9)1.2.4.OSPF包的类型 (9)1.2.5.DR和BDR的选举 (9)1.2.6.OSPF的实验配置 (10)1.2.7.Router-id 的选举 (11)1.2.8.OSPF网络类型 (11)1.2.9.Virtual-Link 虚链路 (12)1.2.10.LSA(链路状态通知) 的类型 (14)1.2.11.路由的类型 (16)1.2.12.修改OSPF接口COST值和路由器的带宽值 (16)1.2.13.OSPF的特殊区域 (17)1.2.14.OSPF的邻居认证 (19)1.2.15.OSPF的路由汇总 (20)1.3.IS-IS(中间系统) 路由协议 (21)1.3.1.基本概念 (21)1.3.2.相关术语 (21)1.3.3.相关特性 (21)1.3.4.Level-1 和Level-2 以及Level-1-2 (21)1.3.5.NSAP地址 (21)1.3.6.IS-IS的邻居建立条件 (22)1.3.7.纯IS-IS的实验配置 (22)1.3.8.集成IS-IS的实验配置 (24)1.4.BGP 边界网关协议 (26)1.4.1.何时使用BGP (26)1.4.2.满足以下条件之一时，不要使用BGP (26)1.4.3.BGP的特性 (27)1.4.4.BGP的数据库 (27)1.4.5.BGP的消息类型 (27)1.4.6.关于IBGP与EBGP之间的关系 (27)1.4.7.基本BGP邻居建立的实验 (29)1.4.8.高级的BGP(属性)实验 (30)1.4.9.BGP的路径属性 (33)1.4.10.BGP路由选择决策过程 (33)1.4.11.使用Route-map操纵BGP路径实验(Local_prefence As-path) (33)1.5.过滤路由的更新 (36)1.6.路由重分发(Redistribution) (37)1.6.1.将RIPv2路由重分发进OSPF 中 (37)1.6.2.将OSPF路由重分发进RIPv2中 (38)1.6.3.将EIGRP 100 重分发进OSPF 中 (38)1.6.4.将OSPF重分发进EIGRP 100中 (39)1.6.5.将RIP v2重分发进EIGRP 100 中 (39)1.6.6.将EIGRP 100 重分发进RIPv2中 (39)1.6.7.将EIGRP 100 重分发进EIGRP 10 (40)1.6.8.将EIGRP 100重分发进集成ISIS中 (40)1.6.9.将ISIS 重分发进EIGRP 100 (41)1.6.10.将ISIS重发分进OSPF中 (41)1.6.11.将OSPF 重分发进ISIS中 (42)1.7.各种路由协议的管理距离值 (42)1.8.(MultiCast)组播 (43)1.8.1.单播数据流 (43)1.8.2.广播数据流 (43)1.8.3.组播数据流 (44)1.8.4.组播的缺点： (44)1.8.5.IP的组播地址(3层地址) (45)1.8.6.数据链路层的2层组播地址 (45)1.8.7.IGMP互联网组管理协议 (46)1.8.8.第2层组播帧交换 (47)1.8.9.组播路由协议 (47)1.8.10.带有RP的稀疏密集的实验配置 (48)1.9.IPV6 (48)1.9.1.IPV6的特性 (48)1.9.2.地址空间 (49)1.9.3.IPv6的地址格式 (49)1.9.4.IPv6地址类型 (49)1.9.5.组播地址Multicast (50)1.9.6.任意播地址Anycast (51)1.9.7.EUI(扩展全局标识)地址格式 (51)1.9.8.IPv6与OSPFv3的实验配置 (52)NP BSCI 课程1.1.EIGRP 增强型内部网关路由协议1.1.1.EIGRP的特性：属CISCO私有协议高级的距离矢量路由协议实现网络的快速收敛支持变长子网掩码和不连续的子网路由更新时发送变化部分的更新内容路由更新采用触发更新机制，只当网络发生变化的时候，才会发送路由更新支持多个网络层的协议(IP、IPX、Novell协议)使用组播和单播技术代替了广播(组播地址：224.0.0.10)在网络的任意点可方便的创建手动路由汇总实现100%无环路(基于DUAL(弥散更新算法))支持等价的和非等价的负载均衡1.1.2.EIGRP的关键技术邻居的发现和恢复使用Hello包来建立，高速链路5秒发送Hello包，低速链路是60秒发送Hello包是一个RTP(可靠的传输协议)协议，能够保证所有的更新数据包能被邻居路由器接受到使用DUAL算法机制，选择一个低代价、无环路的路径到达每一个目标段1.1.3.EIGRP的术语1、Successor 后继路由\\ 主路由2、Feasible Successor (FS)可行后继路由\\备用路由3、Feasible Distance (FD)可行距离\\指从源到达目标段的路径距离值4、Advertised Distance (AD)通告距离\\是指通告路由器到达目标段的距离值1.1.4.EIGRP的包的类型HelloUpdate 更新包Query 查询包Reply 应答包ACK 确认包Router# debug eigrp packet //关闭debug使用undebug all1.1.5.EIGRP metric值的计算K1= 带宽1 BWK2= 负载0 txload(发送) 1/255 rxload(接收) 1/255 255代表固定参考值 K3= 延迟1 DLY 100M=100 10M=1000 1.544M=20000K4= 可靠性0 Reliability 255/255 (最可靠)K5= 最大传输单元0 MTU 1500注：1代表使用, 0代表未被使用Router# show interface E0/0计算公式Metric= [ 107/最小带宽(k) + (延迟)/10]×256说明：最小带宽：指从源到达目的网段链路中的最小带宽延迟：指每段链路的延迟总和1.1.6.EIGRP的配置R1(config)# router eigrp 100R1(config-router)# no auto-summaryR1(config-router)# network 12.0.0.0 0.0.0.3R1(config-router)# network 13.0.0.0 0.0.0.3R1(config-router)# endR2(config)# router eigrp 100R2(config-router)# no auto-summaryR2(config-router)# network 12.0.0.0 0.0.0.3R2(config-router)# network 23.0.0.0 0.0.0.3R2(config-router)# endR3(config)# router eigrp 100R3(config-router)# no auto-summaryR3(config-router)# network 13.0.0.0 0.0.0.3R3(config-router)# network 23.0.0.0 0.0.0.3R3(config-router)# endR1#show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static routeGateway of last resort is not set23.0.0.0/30 is subnetted, 1 subnetsD 23.0.0.0 [90/2681856] via 13.0.0.2, 00:00:12, Serial0/1[90/2681856] via 12.0.0.2, 00:00:12, Serial0/012.0.0.0/30 is subnetted, 1 subnetsC 12.0.0.0 is directly connected, Serial0/013.0.0.0/30 is subnetted, 1 subnetsC 13.0.0.0 is directly connected, Serial0/1说明：[90/2681856] [协议管理距离/Metric度量值]R1#show interfaces s0/0Serial0/0 is up, line protocol is upHardware is M4TInternet address is 12.0.0.1/30MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,reliability 255/255, txload 1/255, rxload 1/255Metric= [ 107/最小带宽(k) + (延迟+延迟)/10]×256Metric= [ 107/1544 + 4000] ×256Metric= [ 6476 + 4000] ×256Metric= 2681856说明：当107/1544 时候，会出现小数点，立即取整数位，舍弃小数点。
CCIE-经典的OSPF笔记(第一天课程)
<OSPF(Open Shortest Path First开放最短路径优先协议为什么它要起这个名字 呢?它的算法本身就是SPF-支持多厂商,目前它只支持在TCP/IP环境中)1987年 IETF OSPF工作小组成立,OSPFv1只是当做实验特殊用途--1991年IPv4-OSPFv2在 RFC1247中发布--1998年OSPFv2在(RFC2328)中正式规范--1999年基于IPv6的OSPF 在RFC2470中发布!这个协议也是我们以后工程和考试中遇到最多的IGP主流路由协 议,个人认为它是路由协议的灵魂领袖,也就相当电脑的心脏-CPU一样,建议大家 一定要学好这个链路状态路由协议!也为大家后面学习部署在通信运营商的 IS-IS/BGP打下坚实的基础,推荐CCIE备考书籍:CCIE#1919 Jeff doyle TCP/IP路 由技术 卷一(第二版),当然我们这个课程主要也是对卷一这本书进行更深入的拓 展! 比如:1-OSPF流量优化工程!2-OSPF与NAT搭建的大型网络工程案例!3-某网游公 司OSPF网络排错工程案例故事-1!4-OSPF网络排错工程案例故事-2!5-对某国企压 入OSPF恶意路由安全测试案例,让大家掌握到基本CCIE水平的OSPF知识> OSPF属于IGP,是Link-State协议,基于IP 协议号 89. 采用SPF算法(Dijkstra算法)计算最佳路径.(1.最短 2.无环) 快速响应网络变化. 以较低频率(每隔30分钟)发送定期更新,被称为链路状态刷新. 网络变化时是触发更新. 支持等价的负载均衡,我们所学的协议中,只有EIGRP支持不等价负载.(默认4, 最大16)
CCNA读书笔记
ccna读书笔记第一篇：红头发na读书笔记第二章第二篇：红头发na读书笔记第三章第三篇：na培训读书笔记第四篇：读书笔记第五篇：读书笔记更多相关范文na中文笔记第2章:(更多内容：)inter protocols 作者：红头发chapter2 inter protocolstcp/ip and the dod modeldod模型被认为是osi参考模型的浓缩品,分为4层,从上到下是:1.process/application layer2.host-to-host layer3.inter layer4.work aess layer其中,如果在功能上和osi参考模型互相对应的话,那么:1.dod模型的process/application层对应osi参考模型的最高3层2.dod模型的host-to-host层对应osi参考模型的transport层3.dod模型的inter层对应osi参考模型的work层4.dod模型的work aess层对应osi参考模型的最底2层the process/application layer protocolsprocess/application层包含的协议和应用程序有：tel,ftp,x windows,tftp,smtp,snmp,nfs和lpd等等dynamic host configuration protocol(dhcp)/bootp(bootstrap protocol)动态主机配置协议(dhcp)服务器可以提供的信息有:1.ip地址2.子网掩码(sub mask)3.域名(domain name)4.默认网关(default gateway)5.dns6.wins信息the host-to-host layer protocolshost-to-host层描述了2种协议:1.传输控制协议(transmission control protocol,tcp)2.用户数据报协议(user datagram protocol,udp)transmission control protocol(tcp)当1个主机开始发送数据段(segment)的时候,发送方的tcp协议要与接受方的tcp协议进行协商并连接,连接后即所谓的虚电路(virtual circuit),这样的通信方式就叫做面向连接(connection-oriented).面向连接的最大优点是可靠,但是它却增加了额外的网络负担(overhead)user datagram protocol(udp)udp协议的最他特点是无连接(connectionless),即不可靠,因为它不与对方进行协商并连接,它也不会给数据段标号,也不关心数据段是否到达接受方key concepts of host-to-host protocols现在把tcp协议和udp协议的一些特性做个比较:1.tcp.协议在传送数据段的时候要给段标号;udp协议不2.tcp协议可靠;udp协议不可靠3.tcp协议是面向连接;udp协议采用无连接4.tcp协议负载较高;udp协议低负载5.tcp协议的发送方要确认接受方是否收到数据段;udp反之6.tcp协议采用窗口技术和流控制;udp协议反之port numberstcp和udp协议必须使用端口号(port number)来与上层进行通信,因为不同的端口号代表了不同的服务或应用程序.1到1023号端口叫做知名端口号(well-known port numbers).源端口一般是1024号以上随机分配the inter layer protocols在dod模型中,inter层负责：路由,以及给上层提供单独的网络接口inter protocol(ip)ip协议查找每个数据包(packets)的地址,然后,根据路由表决定该数据包下1段路径该如何走,寻找最佳路径inter control message protocol(icmp)icmp协议一样是工作在dod模型的inter层,ip协议使用icmp协议来提供某些不同的服务,icmp协议是一种管理协议1.目标不可达(destination unreachable):假如1个routers不能把ip协议数据报发送到更远的地方去,于是router将发送icmp协议信息给数据报的发送方,告诉它说目标网络不可达2.缓冲区已满(buffer full):假如router的缓冲区已经存满发送方发来的ip协议数据报了,它将发送icmp协议信息给发送方并告诉它缓冲区已满,如果再继续接受的话将导致缓冲区溢出,造成数据丢失3.跳(hops):ip协议数据报经过1个router,称为经过1跳4.ping(packet inter groper):采用icmp协议信息来检查网络的物理连接和逻辑连接是否完好5.traceroute:根据icmp协议信息来跟踪数据在网络上的路径,经过哪些跳address resolution protocol(arp)地址解析协议(arp)用于根据1个已知的ip地址查找硬件地址.它把ip地址翻译成硬件地址reverse address resolution protocol(rarp)rarp协议用于把mac地址翻译成ip地址ip addressingip地址是软件地址,mac地址是硬件地址,mac地址是烧录在nic里的,mac地址用于在本地网络查找主机地址.ip地址是唯一的,也叫做网络地址(work address);硬件地址也叫节点地址(node address) work address网络地址分为5类:1.a类地址:4个8位位组(octets).第一个octet代表网络号,剩下的3个代表主机位.范围是0xxxxxxx,即0到1272.b类地址: 前2个octets代表网络号,剩下的2个代表主机位. 范围是10xxxxxx,即128到1913.c类地址: 前3个octets代表网络号,剩下的1个代表主机位. 范围是110xxxxx,即192到2234.d类地址:多播地址,范围是224到2395.e类地址:保留,实验用,范围是240到255work address:special purpose一些特殊的ip地址:1.ip地址127.0.0.1:本地回环(loopback)测试地址2.广播地址:255.255.255.2553.ip地址0.0.0.0:代表任何网络4.网络号全为0:代表本网络或本网段5.网络号全为1:代表所有的网络6.节点号全为0:代表某个网段的任何主机地址7.节点号全为1:代表该网段的所有主机广播地址tcp/ip协议规定,主机号部分各位全为1的ip地址用于广播.所谓广播地址指同时向网上所有的主机发送报文,也就是说,不管物理网络特性如何,inter网支持广播传输.如136.78.255.255就是b类地址中的一个广播地址,你将信息送到此地址,就是将信息送给网络号为136.78的所有主机.有时需要在本网内广播,但又不知道本网的网络号时,tcp/ip协议规定32比特全为1的ip地址用于本网广播,即255.255.255.255private ip address私有ip地址(private ip address):节约了ip地址是空间,增加了安全性.处于私有ip地址的网络称为内网,与外部进行通信就必须靠网络地址翻(work address translation,nat)一些私有地址的范围:1.a类地址中:10.0.0.0到10.255.255.255.2552.b类地址中:172.16.0.0到172.31.255.2553.c类地址中:192.168.0.0到192.168.255.255broadcast address广播地址:1.层2广播:ff.ff.ff.ff.ff.ff,发送给lan内所有节点2.层3广播:发送给网络上所有节点3.单播(unicast):发送给单独某个目标主机4.多播:由1台主机发出,发送给不同网络的许多节点introduction to work address translation(nat)nat一般都操作在cisco router上,用于连接2个网络,同时把私有地址翻译公有地址一些nat的种类以及特点:1.静态nat(static nat):本地地址和全局地址一一对应.这样的方式需要你拥有真正的inter上的ip地址2.动态nat(dynamic nat):把未注册的ip地址对应到已注册ip地址池中的某个ip地址上.你不必需要静态配置你的router使内外地址对应3.超载(overloading):采用的最广泛的nat配置类型.类似动态nat,但是它是把1组未注册的ip地址根据不同的端口(ports)对应到1个已注册的ip地址上.因此,它又叫做端口地址翻译(port address translation,pat)。
ccie笔记
OSPF LSA的作用（一共有11种）
LSA-1：ROUTER路由器LSA
每一台OSPF的路由器都会产生LSA-1
作用;列出了所有的链路或接口，并且指明了沿每条链路出站的COST值，以及这条链路上已知的OSPF邻居
只能在同一区域AREA中扩散
OSPF路由器在完全邻接之前,所经历过的几个状态
1.DOWN:初始化状态
2.Attempt:只适用于NBMA网络
3.Init:表明在DeadInterval里收到HELLOW包，但是2-WAY通讯仍然没有建立起来（从对方发来的HELLOW里没有自己的Router id）
4.two-way:双向会话建立
OSPF(开放式最短路径优先)
1.公有
2. 完全链路状态路由协议
3.OSPF通过多区域的概念减少对路由器资源的占用
只有OSPF能做到无大小限制的度量值
OSPF的工作的基本原理
先通过HELLOW包 在2个OSPF之间建立邻居
在2个OSPF之间建立邻接关系(交换了链路状态信息)
OSPF会同步LSA（链路状态通告）
LSA-2：NETWORK网络LSA
是由DR路由器产生LSA-2
作用是总结DROTHER的LSA-1，再向上扩散
必须是DR才能看到LSA-2
只能在同一区域AREA中扩散
LSA-3：网络汇总LSA summary NETWORK
由ABR（区域边界路由器）产生的 LSA-3 是由ABR发出的 用来通告区域外路由
DR 指定路由器 BDR 备用指定路由器
作用是减少重复的LSA在网络中的传送
房智勇CCIE SP 笔记
由于NAT对IP和TCP信头的综合处理，使得一些服务在使用上会出现异常 1． 信头的checksum需要重新计算 2． IPSec等加密服务由于不能让NAT修改Ip报头，所以会工作异常 3． ICMP报文被修改 4． DNS解析时需要静态的NAT 5． FTP需要服务器打开被动模式，并采用PASV传送文件
11．1 NAT简介
NAT的优点和缺点： 优点：节省IP地址，能够处理地址重复的情况，增加了灵活性，消除了地址重新编号， 隐藏了内部的IP地址。 缺点：增加了延迟，丢失了端到端IP的跟踪过程，不能够支持一些特定的应用程序（如 MSN5.0以下版本） 需要更多的内存来储存一个NAT表， ， 需要更多的CPU来进行处理NAT的过程。 NAT的概念： INSTDE（内部看）和OUTSIDE（外部看）。本地和全局。
本文由yiran109贡献
pdf文档可能在WAP端浏览体验不佳。建议您优先选择TXT，或下载源文件到本机查看。
CCIE R/S & Service Provider Exam Certification Guide
Chapter 11
NAT网络地址转换
Outside local
Outside global
P a g e | 178
CCIE R/S & Service Provider Exam Certification Guide ip nat outside source static 201.114.37.5 10.1.3.1 将主机 D 配置外部 NAT， 使其看上去像内部网的一部分 Mazatlan#show ip nat translations Pro Inside global Inside local 204.15.87.2 10.1.2.2 204.15.87.1 10.1.1.3 此后内部地址将自动映射到外部地址 Mazatlan#show ip nat translations Pro Inside global Inside local 204.15.87.2 10.1.2.2 204.15.87.1 10.1.1.3 204.15.87.1 10.1.1.3 204.15.87.2 10.1.2.2 Outside local 10.1.3.1 Outside global 201.114.37.5
CCIE_笔试笔记
PASS4SURE 2.97 350-0011、最短的答案 关键字 ： higer cost to reach 172.30.1.02、管理组播范围：239.0.0.0 239.255.255.2553、不回应RSTP proposals（提议，建议）（选2）(1) 远端桥的状态是“discarding“(2) 远端前不理解RSTP BPDU4、网络中运用ipv6和EIGRP v3 （选3）5、IPV6 EIGRP 直接在接口上配置6、当用户使用PASSIVE-INTERFACE的时候，IPV6 EIGRP7、没有network statement 配置在 IPV6 EIGRP中8、什么信息被承载在 OSPF V3 的 intar-area-prefix ？9、OSPF V3 就是 针对IPV6开发的 题目中也提到 PREFIX 答案：IPV6 PREFIXES（没有拓扑信息）10、LINK-STATE 状态 路由协议的优点（选3）11、答案中 “send all or portion of 路由表给他的邻居“是错误的12、Penultimate hop poping 倒数第二跳 （选3）13、只用于直连的直连的子网和聚合的路由14、Implicit-null value15、Upstream neighbor16、PRSR1为DR 正确的操作 这是DR的功能17、DHCP 工作：1、定义一个地址池 2、排除掉哪些地址不被分配18、图中有提示 LOOPGUARD19、图中的两个IP地址 EIGRP只在两个主类网络的边界进行自动汇总20、不接收任何类型的LSA21、R7 重发布 EIGRP进OSPF22、R12 在完全末节区域 需要R4引出一条默认路由出去23、BGP 选择最优路径失败 （选3）24、内存错误25、更好的管理值26、VRF中的路由数量超过限制27、ISL和802.1Q的区别（要求选错的）：都支持NATIVE VLAN （ISL不支持NATIVEVLAN ）28、PORFAST BPDU GUARD 最适合(appropriate)那种类型的端口：主机 （不需要学习VLAN）29、NAT的配置：配置 IP Classless30、RP问题：RP失效。
CCIE学习笔记
CCIE学习笔记CCIE学习笔记之一：Rip技术概览Rip工作在UDP的端口520上-也就是说，所有的RIP数据包的源端口和目的端口都是520。
1 初始化——/CMS/Pub/network/network_protocal/04937.htm"target="_blank">RIP 初始化时，会从每个参与工作的接口上发送请求数据包。
该请求数据包会向所有的RIP路由器请求一份完整的路由表。
该请求通过LAN上的广播形式发送LAN或者在点到点链路发送到下一跳地址来完成。
这是一个特殊的请求，向相邻设备请求完整的路由更新。
2 接收请求——RIP有两种类型的消息，响应和接收消息。
请求数据包中的每个路由条目都会被处理，从而为路由建立度量以及路径。
RIP采用跳数度量，值为1的意为着一个直连的网络，16，为网络不可达。
路由器会把整个路由表作为接收消息的应答返回。
3 接收到响应——路由器接收并处理响应，它会通过对路由表项进行添加，删除或者修改作出更新。
4 常规路由更新和定时——路由器以30秒一次地将整个路由表以应答消息地形式发送到邻居路由器。
路由器收到新路由或者现有路由地更新信息时，会设置一个180秒地超时时间。
如果180秒没有任何更新信息，路由的跳数设为16。
路由器以度量值16宣告该路由，直到刷新计时器从路由表中删除该路由。
刷新计时器的时间设为240秒，或者比过期计时器时间多60秒。
Cisco还用了第三个计时器，称为抑制计时器。
接收到一个度量更高的路由之后的180秒时间就是抑制计时器的时间，在此期间，路由器不会用它接收到的新信息对路由表进行更新，这样能够为网路的收敛提供一段额外的时间。
5 触发路由更新——当某个路由度量发生改变时，路由器只发送与改变有关的路由，并不发送完整的路由表。
注意：RIP-1是一个有类的路由选择协议，因此路由宣告中不携带子网掩码。
RIP-1采用接收路由的接口的子网掩码来确定目的网络的子网掩码。
新版CCNP 642-811学习中文笔记(下)
新版CCNP 642-811学习中文笔记（下）Chapter $5 HSRP一. HSRP使CISCO IOS路由器可以相互监视对方的运行状态，并在HSRP组当前转发失效或是因进行维护而关机时，能非常迅速地接管起来数据报的转发责任。
通过多个热备份组，路由器可以同时提供冗余备份或是在不同地IP子网上执行负载分担。
VRRP(与HSRP比较): The Virtual Router Redundancy Protocol (VRRP) feature can solve the static configuration problem. VRRP enables a group of routers to form a single virtual router. The LAN clients can then be configured with the virtual router as their default gateway. The virtual router, representing a group of routers, is also known as a VRRP group.In a topology where multiple virtual routers are configured on a router interface, the interface can act as a master for one virtual router and as a backup for one or more virtual routers.HSRP:RFC 2281IRDP:RFC 1256使用icmp作为冗余的路由技术------irdp二. 冗余性网络中的路由问题1. 缺省网关：当设置默认的网关失效后，数据就不能到别的网段；即使存在作为网关使用的冗余路由器，也不能动态的方法将这些设备切换到新的网关地址。
CCNA笔记：EIGRPandOSPF（一）_Cisco认证_
CCNA笔记：EIGRP and OSPF（一）Enhanced IGRP(EIGRP) and Open Shortest Path First(OSPF) EIGRP Features and OperationEIGRP是1种无分类(classless),增强的距离向量路由协议,和IGRP 类似,EIGRP也使用AS,但是和IGRP不同的是,EIGRP在它的路由更新信息中要包含子网掩码的信息.这样,在我们设计的网络的时候,就允许我们使用VLSM和summarization.EIGRP有时候也算是混合型路由协议,因为它同时具有了距离向量路和链路状态的一些特征:比如它不像OSPF那样发送链路状态包而发送传统的距离向量更新;EIGRP也有链路状态协议的特征比如它在相邻router启动的时候同步路由表,然后只在拓扑结构发生变化的时候发送1些更新.这样就使得EIGRP能够很好的在1个大型网络中工作.EIGRP支持的跳数多达255.EIGRP的主要特点如下:1.通过PDMs(Protocol-Dependent Module)来支持IP,IPX和AppleTalk2.有效的邻router的发现3.通过可靠传输协议(Reliable Transport Protocol,RTP)进行通讯4.通过扩散更新算法(Diffusing Update Algorithm,DUAL)来选择最佳路径Protocol-Dependent ModuleEIGRP的1大特点是它可以支持几种网络层协议:IP,IPX和AppleTalk等.能像EIGRP那样支持数种网络层协议的还有Intermediate System-to-Intermediate System(IS-IS)协议,但是这个协议只支持IP和Connectionless Network Service(CLNS).EIGRP通过PDMs来支持不同的网络层协议.每个EIGRP的PDM保持1个单独的路由信息表来装载某种协议(比如IP)的路由信息.也就是有IP/EIGRP表,IPX/EIGRP的表和AppleTalk/EIGRP表Neighbor Discovery在运行了EIGRP的router彼此进行交换信息之前,它们首先必须成为邻居(neighbor).建立邻居关系必须满足以下3个条件:1.Hello信息或接受收ACK2.AS号匹配3.K值链路状态协议趋向于使用Hello信息来建立邻居关系,它不会像距离向量那样周期性的发送路由更新.为了保持邻居关系,运行了EIGRP的router必须持续从邻居那里收到Hellos如果不在1个AS内,router之间是不会共享路由信息的,也不会建立邻居关系.这样做的优点是在大型网络中可以减少特定某个AS内路由信息的传播当EIGRP发现新邻居的时候,就开始通告整个路由表给别的router,当所有的router都知道新成员的加入,学习到新的路径以后,从那开始,路由表中有变动的部分才会传播给别的router.当router接收到邻居的更新以后,把它们保存在本地数据库表里看下几个术语:1.可行距离(feasible distance):到达一个目的地的最短路由的度2.后继(successor):后继是一个直接连接的邻居router,通过它具有到达目的地的最短路由.通过后继router将包转发到目的地3.通告距离(reported distance):相邻router所通告的相邻router 自己到达某个目的地的最短路由的度4.可行后继(feasible successor):可行后继是一个邻居router,通过它可以到达目的地,不使用这个router是因为通过它到达目的地的路由的度比其他router高,但它的通告距离小于可行距离,因而被保存在拓扑表中,用做备择路由Reliable Transport Protocol(RTP)EIGRP使用一种叫做RTP的私有协议,来管理使用了EIGRP的router之间的通信,如RTP的名字,可靠(reliable)即为这个协议的关键.RTP负责EIGRP数据包到所有邻居的有保证和按顺序的传输.它支持多目组播或单点传送数据包的混合传输/出于对效率的考虑.只有某些E IGRP数据包被保证可靠传输.RTP确保在相邻router间正在进行的通信能够被维持.因此,它为邻居维护了一张重传表.该表指示还没有被邻居确认的数据包.未确认的可靠数据包最多可以被重传1 6次或直到保持时间超时,以它们当中时间更长的那个为限.EIGRP所使用的多目组播地址是224.0.0.10Diffusing Update Algorithm(DUAL)EIGRP使用DUAL来选择和保持到远端的最佳路径.它能使router 判决某邻居通告的一个路径是否处于循环状态,并允许router找到替代路径而无须等待来自其他router的更新.这样做有助于加快网络的汇聚.这个算法顾及以下几点:1.备份的路由线路2.支持VLSM3.动态路由恢复4.没有发现线路的话发送查询寻找新路线Using EIGRP to Support Large NetworksEIGRP在大型网络中能够工作的很好,包含了很多优点比如:1.在1个单独的router上可以支持多个AS2.支持VLSM和summarization3.路由发现和保持Multiple AS只有AS号相同的router才能共享路由信息.把大型网络分成不同的AS,可以有效的加快汇聚.EIGRP的AD为90,而外部EIGRP(external EIGRP)的AD为170VLSM Support and Summarization之前说过EIGRP支持VLSM,也支持不连续子网.什么是不连续子网?,如下图:如图可以看到,2个子网172.16.10.0/24和172.16.20.0/24由10.3.1.0/24来连接,但是routerA和B认为它们只有网络172.16.0.0EIGRP支持在任何运行EIGRP的router上summary的手动创建,这样可以减少路由表的体积.EIGRP自动把网络summarize到等级边界,如下图:Route Discovery and Maintenance类似一些链路状态的协议,EIGRP通过Hello信息来发现邻居;而它又和距离向量类似,使用传闻路由的机制,即不主动去发现,而是听从别人的信息.EIGRP使用一系列的表来存储信息:1.邻居表,记录了邻居的一些信息2.拓扑表,记录了网络中的拓扑状态3.路由表,根据这个来做路由决定EIGRP MetricsEIGRP使用混合度,包含到4个方面:1.带宽2.延迟(delay)3.负载(load)4.可靠性(reliability)5.最大传输单元(maximum transmission unix,MTU)默认情况下EIGRP使用带宽和延迟来决定最佳路径Configuration EIGRP配置EIGRP,首先在全局配置模式下使用router eigrp [AS号]命令.接下来再使用network命令定义直接相连的网络.仍然可以像配置IGRP那样使用passive-interface命令来禁止某个接口接收或发送Hello信息.并且记住EIGRP的AD是90来看1个配置实例,如图:Router Network Address Interface AddressRouterA 192.168.10.0 fa0/0 192.168.10.1192.168.20.0 s0/0 192.168.20.1RouterB 192.168.20.0 s0/0 192.168.20.2192.168.40.0 s0/1 192.168.40.1192.168.30.0 fa0/0 192.168.30.1RouterC 192.168.40.0 s0/0 192.168.40.2192.168.50.0 fa0/0 192.168.50.1配置RouterA:RouterA(config)#router eigrp 10RouterA(config-router)#network 192.168.10.0RouterA(config-router)#network 192.168.20.0RouterA(config-router)#^ZRouterA#记住配置EIGRP和配置IGRP十分类似,唯一不同的是EIGRP是无分类路由(classless routing)配置RouterB:RouterB(config)#router eigrp 10RouterB(config-router)#network 192.168.20.0RouterB(config-router)#network 192.168.30.0RouterB(config-router)#network 192.168.40.0RouterB(config-router)#^ZRouterB#配置RouterC:RouterC(config)#router eigrp 10RouterC(config-router)#network 192.168.40.0RouterC(config-router)#network 192.168.50.0RouterC(config-router)#^ZRouterC#这样配置看上去好象没什么问题,EIGRP的AD比之前配置的RIPv1和IGRP的低,但是有个问题就是:增加了CPU的负担,而且占用了额外的带宽还有1点要注意的是自动summarization,router默认会向分级边界进行summarize.如下图:A的配置如下:A(config)#router eigrp 100A(config-router)#netw 172.16.0.0A(config-router)#netw 10.0.0.0A(config-router)#no auto-summaryB的配置如下:B(config)#router eigrp 100B(config-router)#netw 172.16.0.0B(config-router)#netw 10.0.0.0B(config-router)#no auto-summary使用no auto-summary命令后,运行了EIGRP的router就不会相互进行通告Verifying EIGRP在刚才配置好的情况下使用show ip route命令查看路由信息,如下:RouterA#sh ip route(略)D 192.168.30.0/24 [90/2172416] via 192.168.20.2, 00:04:36, Serial0/0(略)注意字母D代表DUAL,即代表EIGRP,AD为90show ip route eigrp命令只显示路由表中的EIGRP选项show ip eigrp neighbors:显示所有的EIGRP邻居show ip eigrp topology:显示EIGRP拓扑表条目,如下:RouterC#sh ip eigrp topology(略)P 192.168.40.0/24, 1 successors, FD is 21469856Via Connected, Serial0(略)注意前面的P代表passive状态,这样的状态是正常的如果看见的是A即active状态而不是P,说明router失去了到这个网络的路径并且在寻找替代路径Open Shortest Path First(OSPF) Basics在1个大型网络中,假如不是所有的设备都是Cisco的,EIGRP明显就不行,因为它是私有的.所以就可以使用OSPF协议或者路由redistribution(路由协议之间的翻译服务).OSPF使用Dijkstra算法,是1种链路状态协议.OSPF汇聚快速,支持多个耗费相同的路径.和EIGRP 不同的是,OSPF只支持IP路由.OSPF也能够设计网络为层次化的,这样就把1个大的网络分割成几个小的网络,叫做区域(area).这是OSPF最好的设计方法.把OSPF设计成层次化的好处是:1.减少路由成本(overhead)2.加速汇聚3.把大网络分割成小的区域下面是1个典型的OSPF设计图,如下:注意这个图,BR为骨干router(backbone router,BR),连接到这个骨干的为区域0或者骨干区域(backbone area),OSPF必须要有个区域0所有的router应该尽可能的连接到这个区域.连接其他区域到骨干区域的为区域边界router(area border router,ABR),ABR必须至少有1个接口位于区域0中.OSPF运行在1个AS中,而且能够连接多个AS,连接多个AS的router为自治系统边界router(autonomous system boundary router,ASBR)。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
一边的出对应另一边的入RT RD 有一个有全局意义有一个是本地意义
Ip vrf a创建一个虚拟的VRF
rd 1:1创建RD RD的格式
route-target 1:1 创建一个RT
int s0/1
ip vrf forwarding a 将一个接口放到VRF a 中
ip address ****** ********
show ip route vrf a 查看VRF a 的路由表
ping vrf a 192.168.1.1 用VRF a 的表ping
int s0/2
ip vrf forwarding b 在VRF表中配IP地址它会覆盖物理接口配置好的路由ip address ******** ******
一个路由器分别于两个CE设备建邻居
router ospf 1 vrf a PE 设备用VRF表与CE设备建邻居
network ****** ******* area 0
router ospf 2vrf b
CE 设备与PE设备建立邻居在全局下配置OSPF
两边的PE设备为了防止次末跳弹出标签问题
在各自路由器上配置换回口用换回口建立邻居
BGP 建邻居
激活VPNv4邻居
Address-family vpnv4 unicast 启用VPNv4 的功能
Neighbor 3.3.3.3activate
将对端的传来的路由重分发到VRF表中
Router bgp 1
Address-family ipv4 vrf a
Redistribute ospf 1 vrf a
Show ip bgp vpnv4 all
将BGP传过来的路由重分发到ＩＧＰ中
Router ospf 1 vrf a
Redistribute bgp 1 subnets
客户上show ip route
可以看到学到了公网对端的私网路由但PING不通
启用MPLS
在接口下Mpls ip
RT RD 是用来传递路由的标签是用来传递数据包的路由还原
OSPF的down bit 位防环机制。