Corporation Ore Deposit

THCore64733ad78

pondělí 6. srpna 2007

CCNA - Final Exam v3.1

CCNA2 Final Exam v3.1

Which of the following could describe the devices labeled "?" in the graphic? (Choose three.)

**DCE
**CSU/DSU
LAN switch
**modem
hub

-------------------------------------------------
Router A and Router B have been correctly configured to use RIP as a dynamic routing protocol and all intefaces on Router A and Router B are reporting "interface is up, line protocol is up" status. RIP is then configured on Router C using the following commands:

RouterC(config)# router rip
RouterC(config-router)# network 192.168.4.0
RouterC(config-router)# network 172.16.0.0

If no additional routing is configured on Router A, Router B, and Router C, what will be the result?

**Networks 192.168.12.0/24, 192.168.4.0/24, and 172.16.0.0/16 will be unreachable from Router A.

Router A will have no knowledge of network 192.168.12.0/24, but will have routes to networks 192.168.4.0/24 and 172.16.0.0/16.

All networks shown in the graphic will be reachable by Router A, Router B, and Router C.

Networks 192.168.4.0/24 and 172.16.0.0/16 will be unreachable from Router A and Router B.

--------------------------------------------------------
The following access list has been correctly applied to a router interface:

access-list 52 deny 172.30.65.52
access-list 52 permit any

Which of the following statements are true about this ACL? (Choose three.)

This is an invalid ACL because the wildcard mask is missing from the command.

**A wildcard mask of 0.0.0.0 is assumed for 172.30.65.52.

This is an extended IP access list.

**All traffic from 172.30.65.51 will be permitted.

**This is a standard IP access list.
---------------------------------------------------------
Refer to the graphic. Assuming default metrics are used and the network is fully converged, which path will the IGRP routing protocol use to send a packet from Router A to Router F?

A, D, E, F
**A, B, D, E, F
A, C, D, E, G, F
A, B, D, E, G, F
---------------------------------------------------------
Neither router in the graphic has a host table or DNS available. The interfaces and passwords have been correctly configured. Which of the following commands will initiate a Telnet session? (Choose two.)

ATL> connect CHI
ATL> telnet CHI
**ATL# 192.168.4.2
ATL# connect ATL
**CHI# telnet 192.168.4.1
CHI# telnet ATL
--------------------------------------------------------
What will occur if the command service password-encryption is entered on a router? (Choose two).

It will allow only the user EXEC mode password to be encrypted.
It will set an MD5 hashing algorithm on all unencrypted passwords.
**It will apply a weak encryption to all unencrypted passwords.
It will set the enable secret password to be encrypted.
It will apply an MD5 hashing algorithm to encrypt the console and telnet passwords.
**It will configure the user EXEC mode, telnet, and enable passwords as encrypted.
---------------------------------------------------------
A network administrator must configure a serial interface with an IP address. The configuration must also identify the remote site to which the interface is connected. Which set of commands will meet these requirements?

Chicago(config)# description San Jose T1
Chicago(config)# interface serial0/0
Chicago(config-if)# ip address 192.168.204.9 255.255.255.252

**Chicago(config)# interface serial0/0
**Chicago(config-if)# ip address 192.168.204.9 255.255.255.252
**Chicago(config-if)# description San Jose T1

Chicago(config)# interface serial0/0
Chicago(config-if)# ip address 192.168.204.9 netmask 255.255.255.252
Chicago(config-if)# description San Jose T1

Chicago(config)# interface serial0/0
Chicago(config-if)# ip address 192.168.204.9 255.255.255.252
Chicago(config-if)# remote site San Jose T1

Chicago(config)# interface serial0/0
Chicago(config-if)# ip address 192.168.204.9 255.255.255.252
Chicago(config-if)# interface description San Jose T1

-----------------------------------------------------
A network administrator has enabled RIP on routers B and C in the network diagram. Which of the following commands will prevent RIP updates from being sent to Router A?

A(config)# router rip
A(config-router)# passive-interface S0/0

B(config)# router rip
B(config-router)# network 192.168.25.48
B(config-router)# network 192.168.25.64

A(config)# router rip
A(config-router)# no network 192.168.25.32

**B(config)# router rip
**B(config-router)# passive-interface S0/0

A(config)# no router rip
-----------------------------------------------------
Which of the following describe Telnet on a router? (Choose two.)

**Simultaneous incoming Telnet sessions can be hosted by a router.
Telnet is the most basic testing mechanism available.
A Telnet session can only be initiated in privileged EXEC mode.
**Five separate Telnet lines are specified by the configuration line vty 0 4.
Telnet is classified as a network layer protocol.

--------------------------------------------------
Which commands will show the status and IP address of all interfaces on a router? (Choose two.)

**show protocols
show ip protocols
show version
**show interfaces
show ip ports

---------------------------------------------------
Which router command will generate the router output shown in the graphic?

show arp
show protocols
show interface FastEthernet0/0
show interfaces
**show hardware

---------------------------------------------------
Which of the following are valid boot system commands? (Choose two.)

Router(config)# boot system ram
**Router(config)# boot system rom
Router(config)# boot system IOS flash
Router(config)# boot system flash c2600-d-mz.121-3 192.168.10.5
**Router(config)# boot system tftp c1700-l-mz.131-2 172.16.24.7

---------------------------------------------------
During initial router bootup the following line appears:

"NVRAM invalid, possibly due to write erase."

What are two possible reasons for this result? (Choose two.)

The startup-config file was not saved to RAM before reboot.
The IOS has been erased.
**The router has not been configured.
**The startup-config file cannot be located.
The router will not enter initial configuration dialog.

--------------------------------------------------
While planning an IOS upgrade, the administrator issues the show version command. Based on the output in the graphic, what is the current IOS boot location?

RAM
**NVRAM
Flash
ROM

--------------------------------------------------
Which statements are true regarding setup mode? (Choose three.)

Press Ctrl-z to terminate setup mode.
**Enter a question mark (?) for help at any point.
Press Spacebar to accept the default settings.
Use setup mode to enter complex protocol features.
**Press Enter to accept the default settings.
**Press Ctrl-c to abort configuration dialog.

--------------------------------------------------
Which router components and operations are correctly described? (Choose two.)

ROM - stores the backup configuration file
RAM - loads the operating system
**NVRAM - stores the configuration file
Flash - executes diagnostics at bootup
**POST - runs diagnostics on hardware modules
DRAM - loads the bootstrap

--------------------------------------------------
access-list 199 deny tcp 178.15.0.0 0.0.255.255 any eq 23
access-list 199 permit ip any any

Assuming this ACL is correctly applied to a router interface, which statements describe traffic on the network? (Choose two.)

All FTP traffic from network 178.15.0.0 will be permitted.
**All Telnet traffic destined for network 178.15.0.0 will be denied.
Telnet and FTP will be permitted from all hosts on network 178.15.0.0 to any destination.
**Telnet will not be permitted from any hosts on network 178.15.0.0 to any destination.
Telnet will not be permitted to any host on network 178.15.0.0 from any destination.

------------------------------------------------------
Refer to the graphic. Communication is needed between the LAN connected to the fa0/0 interface of the Kansas router and the fa0/0 interface of the Maine router. All hosts on those LANs also need connectivity to the Internet. Which commands will allow this communication? (Choose three).

**Kansas(config)# ip route 192.168.6.0 255.255.255.0 172.18.64.2
Kansas(config)# ip route 192.168.6.0 255.255.255.0 s0/1
**Kansas(config)# ip route 0.0.0.0 0.0.0.0 s0/1
Maine(config)# ip route 192.168.6.0 255.255.255.0 172.18.64.1
**Maine(config)# ip route 0.0.0.0 0.0.0.0 s0/1
Maine(config)# ip route 172.16.32.0 255.255.255.0 172.18.64.2

-------------------------------------------------------
Due to a security violation, the router passwords must be changed. What information can be learned from the following configuration entries? (Choose two.)

Router(config)# line vty 0 3
Router(config-line)# password c13c0
Router(config-line)# login

The entries specify three Telnet lines for remote access.
**The entries specify four Telnet lines for remote access.
The entries set the console and Telnet password to "c13c0".
Telnet access will be denied because the Telnet configuration is incomplete.
**Access will be permitted for Telnet using "c13c0" as the password.

-------------------------------------------------------
What are some reasons to change the configuration register setting? (Choose two.)

**to force the system to ignore the configuration file stored in NVRAM
to monitor password changes
to change the POST sequence
to force the router to boot the IOS from NVRAM
**to force the system into ROM monitor mode

-------------------------------------------------------
A network administrator issues the erase startup-config command on a configured router with the configuration register set to 0x2102 and observes the following output:

Erasing the nvram filesystem will remove all files! Continue? [Confirm]
[OK]
Erase of nvram: complete

If the router unexpectedly loses power after this sequence, what will occur when power is restored?

The router will enter ROM monitor mode upon completion of the power-on self test (POST).
The router will load the last known valid configuration file.
The router will enter Rx-boot mode.
**The router will prompt the user to enter setup mode or to continue without entering setup mode.

-------------------------------------------------------
Which of the following are true regarding the use of login banners? (Choose two.)

The message is only displayed in privileged EXEC mode.
**The message can be seen by everyone who accesses the router.
Good morning is an appropriate message to display.
**The banners should display warning messages.
The banners should identify circuits and other devices connected to the router.

-------------------------------------------------------
Which router component stores the information that is displayed by the show ip route command?

CPU
Flash
NVRAM
**RAM

---------------------------------------------------------
What information can be learned during the initial router bootup? (Choose two.)

the configuration register value
**the number and types of interfaces installed
**the router model and the amount of memory that is available
the amount of memory required to load the IOS and configuration
the number of interfaces with connected cables

-------------------------------------------------------
Which of the following describes CDP? (Choose three.)

**provides information on directly connected Cisco routers that have CDP enabled
**can only be configured between Cisco devices
used for debugging Layer 4 connectivity issues
**should be disabled on non-locally managed ports
presents a potential security risk

------------------------------------------------------
What can a network administrator do to recover from a lost router password?

perform a reload or reset
telnet from another router and issue the show running-config command to view the password
**boot the router to ROM monitor mode and configure the router to ignore NVRAM when it initializes
boot the router to bootROM mode and enter the b command to load the IOS manually

------------------------------------------------------
A network administrator wishes to load a configuration file from a TFTP server into NVRAM on a router. Which of the following methods will create a startup-config file in NVRAM that matches the contents of the configuration file on the TFTP server?

**Copy the configuration file from a TFTP server using the command copy tftp startup-config.
Copy the configuration file from a TFTP server using the command copy < startup-config.
Copy the file to RAM from a console connection using the copy tftp running-config command. Then reload the router to use the new configuration.
Paste the configuration file to the command line of the router while in global configuration mode. Then issue the copy startup-config running-config command.

------------------------------------------------------
Which of the following are primary functions of a router? (Choose two.)

**packet switching
microsegmentation
domain name resolution
**path selection
flow control

------------------------------------------------------
Which of the following are true regarding an interface description? (Choose three.)

It is a message that is displayed at login.
**It does not affect the operation of the router.
It contains the circuit identifiers of the interface by default.
**It could allow support personnel to better understand the scope of an interface problem.
**It could identify the purpose and location of the interface.
It wastes bandwidth and slows down interface problem resolution.

------------------------------------------------------
Which ACL can be applied in the outbound direction of Serial 0/0 on router B in the graphic to allow all IP traffic from LAN A to the Internet, allow Web traffic from LAN B to the Internet, and deny all other traffic to the Internet?

access-list 98 permit 192.168.2.0 0.0.0.255 any
access-list 98 permit tcp 10.90.3.0 0.0.0.255 any eq www

access-list 125 permit ip 192.168.2.0 0.0.0.255 any
access-list 125 permit tcp 10.90.3.0 0.0.0.255 any eq www

access-list 132 permit ip 192.168.2.0 0.0.0.255 any
access-list 132 permit tcp 10.90.3.0 0.0.0.255 any eq www
access-list 132 permit ip any any

**access-list 156 permit ip 192.168.2.0 0.0.0.255 any
**access-list 156 permit ip 10.90.3.0 0.0.0.255 any eq www

-------------------------------------------------------
The following access list has been created to prevent traffic from host 172.23.40.36 from accessing the 192.168.34.0 network.

access-list 44 deny host 172.23.40.36
access-list 44 permit any

Refer to the graphic. Which group of commands will properly place the access list so that the host is denied access only to network 192.168.34.0?

Rome(config)# interface fa0/0
Rome(config-if)# ip access-group 44 in

Rome(config)# interface s0/1
Rome(config-if)# ip access-group 44 out

Tokyo(config)# interface s0/0
Tokyo(config-if)# ip access-group 44 in

**Tokyo(config)# interface fa0/0
**Tokyo(config-if)# ip access-group 44 out

--------------------------------------------------------
Which of the following are true statements regarding IGRP and RIP? (Choose two.)

**IGRP uses a combination of different metrics for path selection.
RIP is a proprietary protocol developed by Cisco.
RIP has the ability to scale to large networks.
**IGRP has the ability to scale to large networks.

--------------------------------------------------
In what order will the initial startup routine of a router locate and load the IOS if the config-register setting is 0x2102 and there are no boot system commands present in the startup-config file?

Flash, ROM, TFTP server
RAM, Flash, NVRAM
Flash, TFTP server, ROM
ROM, TFTP server, Flash
Flash, NVRAM, RAM
**ROM, Flash, TFTP server

--------------------------------------------------
What will occur when the following ACL is applied inbound to both FastEthernet interfaces of Router A in the graphic?

access-list 125 permit tcp 192.168.2.0 0.0.0.255 10.90.3.0 0.0.0.255 eq 23
access-list 125 permit tcp 10.90.3.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 23
access-list 125 permit tcp 192.168.2.0 0.0.0.255 any eq www

**Workstations A and B will be able to Telnet to each other. Workstation A will be allowed to access Web servers on the Internet, while Workstation B will be denied Internet Web access.
Workstations A and B will be able to Telnet to each other. All other traffic will be denied.
The ACL will have no effect because it should be applied in the outbound direction on the FastEthernet interfaces.
The ACL will deny all traffic because of the implied deny ip any any statement at the end of the ACL.

---------------------------------------------------
Which of the following commands will correctly configure an extended ACL? (Choose two).

Router(config)# access-list 18 permit tcp host 192.168.73.3 eq 25
**Router(config)# access-list 102 permit tcp 10.43.0.0 0.0.255.255 any eq 80
**Router(config)# access-list 187 permit tcp host 192.168.42.34 172.29.0.0 0.0.255.255 eq 23
Router(config)# access-list 99 permit host 10.217.32.3
Router(config)# access-list 128 permit tcp host 192.168.100.31 eq 23

----------------------------------------------------
Refer to the graphic. Which command will create a standard ACL that will apply to outbound traffic on interface Fa0/0 of router A and will deny IP traffic from any host on network 172.16.34.0/24 that is destined for network 192.168.5.0/24 while allowing all other IP traffic?

access-list 2 deny 172.16.34.0 0.0.0.0
access-list 2 permit any

**access-list 33 deny 172.16.34.0 0.0.0.255
**access-list 33 permit any

access-list 42 deny 172.16.34.0
access-list 42 permit any

access-list 56 deny tcp 172.16.34.0
access-list 56 permit ip any

------------------------------------------------------
Refer to the network and routing table entries shown in the graphic. How much time will elapse before Router A expects to receive another update from Router B?

5 seconds
13 seconds
**17 seconds
25 seconds
65 seconds
90 seconds

-----------------------------------------------------
Refer to the graphic. Which series of commands will create static routes that will allow Router A and Router B to deliver packets destined for LAN A and LAN B, and direct all other traffic to the Internet?

RouterA(config)# ip route 10.90.3.0 255.255.255.0 192.168.3.2
RouterB(config)# ip route 192.168.2.0 255.255.255.0 192.168.3.1
RouterB(config)# ip route 0.0.0.0 0.0.0.0 s0/0

RouterA(config)# ip route 10.90.3.0 255.255.255.0 192.168.3.2
RouterA(config)# ip route 0.0.0.0 0.0.0.0 192.168.3.2
RouterB(config)# ip route 192.168.2.0 255.255.255.0 192.168.3.1

RouterA(config)# ip route 0.0.0.0 0.0.0.0 192.168.3.2
RouterB(config)# ip route 192.168.2.0 255.255.255.0 192.168.3.1
RouterB(config)# ip route 172.20.20.4 255.255.255.252 s0/0

**RouterA(config)# ip route 0.0.0.0 0.0.0.0 192.168.3.2
**RouterB(config)# ip route 192.168.2.0 255.255.255.0 192.168.3.1
**RouterB(config)# ip route 0.0.0.0 0.0.0.0 s0/0

-----------------------------------------------
Which of the following describe Ethernet and serial interfaces of a router? (Choose two.)

They are enabled by default.
**They may be administratively disabled by using the shutdown command.
**They must be configured with an IP address and subnet mask in order to forward packets.
They must be configured with an IP address and a clockrate in order to forward packets.
They may be administratively disabled by using the no shutdown command.

-----------------------------------------------
Which of the following statements are true regarding routed protocols? (Choose two.)

**They provide enough information in the Layer 3 address to allow a packet to be forwarded from one network to another.
**They carry user data between networks.
They allow routers to share information about networks and their proximity to each other.
They are used by routers to maintain routing tables.
RIP and IGRP are routed protocols.

------------------------------------------------
If a PC does not have network connectivity to a router, which router port can be used to establish communication?

console
**Ethernet
serial
VTY

------------------------------------------------
Router A is directly connected to the networks shown in the graphic and has a default route that points to Router B. All interfaces are active and properly addressed. However, when the workstation on network 172.16.4.0/24 sends a packet to destination address 172.16.201.5, it is discarded by Router A. What can be a reason for this result?

**The ip classless command is not enabled on Router A.
Router B is in a different autonomous system than Router A.
Routers A and B are using different routing protocols.
Router A has no route in its routing table that includes the address 172.16.201.5.

------------------------------------------------
Which of the following prevent successful loading of the Cisco IOS from flash memory? (Choose two.)

**a configuration register set at 0x2102
a missing startup-configuration file
a boot system command not present in the startup-config file
an incorrect configuration register setting
**a boot field set to 2

------------------------------------------------
Which two steps describe how to create a functional physical connection between a router console and a terminal? (Choose two.)

Use a crossover cable to connect the terminal serial port to the router console port.
Use a rollover cable to connect the terminal NIC to the router console port.
**Use an RJ-45 to DB-9 adapter on the terminal serial port to connect to the cable going to the router console.
Use a transceiver to connect a straight-through cable to the router console port.
Use a straight-through cable to connect the router console port to the terminal NIC.
**Use a rollover cable to connect from a terminal serial port to the router console port.

-----------------------------------------------
Refer to the graphic. A network administrator has a console connection to Router A. Pings to Router B are successful, but pings to Routers C and D fail. What is the first step in troubleshooting the problem?

Use the show cdp neighbors detail command from router A to gather information about all Cisco routers in the network.
Use the traceroute command to discover exactly which link in the network is down.
Use an extended ping from router A to each router in the network.
**Use the show interfaces command from a Telnet session on router B to check the connection to router C.

-----------------------------------------------
Based on this partial output of the show ip route command, which routing protocol is configured on the router?

I 172.16.3.0/24 [100/80135] via 172.16.2.2, 00:00:27, Serial0/0


RIP v1
RIP v2
**IGRP
EIGRP
OSPF
IGP

------------------------------------------------
Assuming the following ACL is correctly applied to a router interface, what can be concluded about this set of commands? (Choose two.)

Router(config)# access-list 165 deny tcp 192.28.115.0 0.0.0.255 172.20.0.0 0.0.255.255 eq 23
Router(config)# access-list 165 permit ip any any

This is a standard IP access list that denies network 192.28.115.0 Telnet access to the 172.20.0.0 network.
All Telnet traffic destined for 172.20.0.0 from any network will be denied access.
**Network 192.28.115.0 is denied Telnet access to the 172.20.0.0 network.
Network 172.20.0.0 is denied Telnet access to the 192.28.115.0 network.
**All FTP and HTTP traffic destined for 172.20.0.0 will be permitted access.

------------------------------------------------
What could a Cisco support technician learn from the IOS filename c2600-d-mz.121-3? (Choose three.)

**the format of the file
the RAM memory requirements of the file
**the version number of the file
the size of the file
**the device platform of the file

------------------------------------------------
Which of the following are correct statements verified by the router output shown in the graphic? (Choose two.)

Layer 3 connectivity exists between BigCity and the devices in the Device ID column.
**Layer 2 connectivity exists between BigCity and the devices in the Device ID column.
All devices shown in the Device ID column use the TCP/IP protocol suite.
All devices shown in the Device ID column can be pinged from BigCity.
**All devices listed in the Device ID column are directly connected to BigCity.

------------------------------------------------
What are the results of setting the boot field bits in the configuration register to "0000"? (Choose two.)

The startup-config file will be ignored at bootup.
The router will load the IOS from Flash.
**The router will enter ROM monitor mode upon reload.
The router will enter boot ROM mode and have limited capabilities.
**The administrator can enter the b command to manually boot the IOS.

_________________

sobota 4. srpna 2007

Psytrance - Best software

Synths for psytrance sounds:

- Predator 1.0.1b
- Albino 3.0.2
- FireBird 1.2.1
- Vanguard
- SuperWave P8
- Absynth, powerful vst and has really cool atmospheric psy sounds
- Massive, the name says it all, must have, trust me;) (native)
- Nexus, one of the warmest softhsynths around (refx)
- FM8, massive-style monster(native)
- FX, camelphat, camelspace, camelcrusher, glitch, pudding,predatohm(disto)
- Blue (rob Papen)
- Discovery
- D'cota
- Korg legacy cell !!!
- Trilogy (spectraphonics)
- Atmosphere (spectraphonics)
- Crystal (pads)

[quote]Massive and FM8 are amazing synths... don't know for psymuze but they do the trick for me

středa 1. srpna 2007

Routery - BGP

Border Gateway Protocol (BGP) je dynamický směrovací protokol používaný pro směrování mezi autonomními systémy (AS). Je základem propojení sítí různých ISP v peeringových uzlech.

Směrování mezi autonomními systémy má charakteristické požadavky, které se nevyskytují v interním směrování. Směrovací tabulky obsahují stovky tisíc záznamů, nejdůležitějším kritériem nebývá vzdálenost, ale posuzují se nastavitelné parametry zohledňující například cenu a dodatečná pravidla aplikovaná v závislosti na zdroji, cíli, seznamu tranzitních autonomních systémů a dalších atributech.

Vzhledem k velkému počtu záznamu se v případě změn v topologii vyměňují pouze informace o změnách, nikoliv celé směrovací tabulky jako je tomu v případě protokolu RIP.

Routery - OSPF

Open Shortest Path First

Open Shortest Path First (OSPF) je adaptivní hierarchický distribuovaný routovací protokol, provádějící změny v routovacích tabulkách na základě změny stavu v síti. Jedná se o nejpoužívanější routovací protokol uvnitř autonomních systémů.

Routery, používající tento protokol, si v pravidelných krátkých intervalech zvláštními zprávami (ECHO) kontrolují spojení se svými sousedními routery. Při zjištění jakékoliv změny zasílá oznámení všem routerům v síti, ty si pak podle nové informace přepočítají nové cesty v síti a podle toho upraví routovací tabulky.

Výpočet nejkratších cest se provádí Dijkstrovým algoritmem.

Dalším vylepšením tohoto protokolu je rozdělení autonomního systému na několik oblastí (proto hierarchický), ve kterých si routery vzájemně vyměnují sdělení o změnách v síti, ale mimo svou oblast je neposílají. O výměnu souhrnných informací mezi oblastmi se starají hraniční routery. Touto technikou se zamezuje zahlcování rozlehlých sítí informacemi o změnách při velkém počtu routerů v autonomním systému.

(článek z wikipedia.cz)

úterý 24. července 2007

Routery - Wildcard masky

Wildcard masky neboli tzv. reverzní masky jsou vlastně subnetové masky obrácené v hodnotě bitů (1=0). Jsou vyžadovány u nastavování EIGRP, OSPF nebo access-listů.

Takže jednoduše platí:
mask 255.255.255.0 = 0.0.0.255 wildcard

Příklad subnet-wildcard převodu binárně 1:
11111111.11111111.11111111.10000000 = 255.255.255.128 Subnet maska
00000000.00000000.00000000.01111111 = 0.0.0.127 Wildcard maska

Příklad subnet-wildcard převodu binárně 2:
11111111.11111111.11111111.11111100 = 255.255.255.252 Subnet maska
00000000.00000000.00000000.00000011 = 0.0.0.3 Wildcard maska

atd...

OSPF/EIGRP trik s wildcard maskou:
Cisco IOS nám ovšem umožnuje učinit malý trik jednoduchým příkazem, kterým si můžeme vypomoci s převodem. Ukažme si to na názorném příkladu:

Interface konfugurován na IP adresu 137.1.2.0/27 (subnet 255.255.255.224, že jo)

interface GigabitEthernet0/0
description ->VLAN22 137.1.2.0/27
ip address 137.1.2.2 255.255.255.224
duplex auto
speed auto
end

Nyní potřebujete nastavit tuto síť v OSPF nebo EIGRP, takže musíme konvertovat subnet masku na wildcard masku.

Nejjednodušší metoda je samozřejmě použít IP adresu interfacu s wildcard maskou 0.0.0.0, ale pokud chceme konfigurovat wildcard "korektním" způsobem, je zde malý IOS "trik", který můžete využít u konfigurace wildcard masky v EIGRP (IGRP) a OSPF.
Místo aby jste použili wildcard masku, vypíšete normální subnet masku (stejnou jako jste zadávali při konfiguraci interfacu) a IOS za vás dokáže udělat konverzi jednoduchým příkazem:

Použijme subnet masku místo wild card masky:
router(config)#router os 100
router(config-router)#net 137.1.2.2 255.255.255.224 area 0

IOS příkaz pro konverzi:
router(config-router)#do sh run | sec ospf
router ospf 100
log-adjacency-changes
network 137.1.2.0 0.0.0.31 area 0

středa 18. července 2007

Routery - access listy

ACCESS-LISTY (ACLs)
Access-listy slouží k omezení-či zákazu přístupu uživatele na určité služby sítě.

Čísla access listů nám říkají o jaký typ access listu se jedná.
1-99 (IP) Standart Access list
100-199 2000-2699 Extended IP Access list
600-699 AppleTalk
800-899 IPX
900-999 Extended IPX
1000-1099 IPX Service Advertisinfg protocol

Zápis 0.0.0.0 255.255.255.255 = ANY

acces-list 100 deny/permit TCP/IP
172.16.1.53 0.0.0.0 = kdo
1.1.1.1 255 255.255.255 eq 80 = kam
ANY = jakykoli
eq = equal

Standart acces-list:
Umisťují se na interface routeru připojeného k internetu, jinak by zabránil přístupu klienta do podnikové LAN

Extendet acces-list:
Měl se dát na interface routeru mezi klientem a zbytkem LAN, lze totiž nakonfigurovat pouze na povolený port a službu...

Syntaxe:
access-list (číslo acl 100 - 199) (akce - permit/deny) (protokol) (adresa+wilcat) (cílová adresa+wildcat) (eq, gr,...) (port)

Příklad extended access-list:

Zakázat http pro PC 172.16.4.2:
Router(config)#
Router(config)#access-list 101 DENY TCP 172.16.4.2 0.0.0.0 ANY eq 80
Router(config)#int fastethernet 0/0
Router(config-if)#ip access-group 101 IN -zapíná access-list na rozhraní

Zakázat telnet pro PC 172.16.4.2:
Router(config)#
Router(config)#access-list 101 DENY TCP 172.16.4.2 0.0.0.0 172.16.8.2 0.0.0.0 eq 23
Router(config)#access-list 101 DENY TCP 172.16.4.2 0.0.0.0 172.16.16.2 0.0.0.0 eq 23
Router(config)#int serial 0/0
Router(config-if)#ip access-group 101 IN

Pozn:
Třeba u telnetu je třeba zakázat přístup na VŠECHNY porty routeru, jinak by se uživatel mohl přihlásit na jiné rozhraní nezahrnuté v access-listu.

Povolit veškeré služby:
Router(config)#access-list 101 PERMIT IP ANY ANY - povoluje veškerou komunikaci

Pokud bych zadal access-group xxx nedefinovaným číslem (prázdný access-list), zakáže veškerou komunikaci pro toto rozhraní.
Například v tomto případě třeba #ip access-group 102 IN

Příklady access-listů:
#access-list 100 PERMIT TCP 10.1.2.5 0.0.0.0 ANY eq 80
#access-list 100 DENY TCP 10.1.2.5 0.0.0.0 ANY EQ 21
#access-list 100 PERMIT IP ANY ANY

Povolili jsme přístup na web PC 10.1.2.5, zakázali mu FTP a tím jsme odřízli všechny ostatní PC v síti. Proto je tam třetí řádek, který povoluje všechen ostatní přístup, z čehož vyplývá, že první řádek je vlastně zbytečný...

Řádek který není při konfiguraci access listů vidět je access-list 100 DENY ANY ANY, který je defaultní jakmile konfigurujeme access-list. Proto povolujeme ostatní komunikaci manuálně.

Příklady praktického užití ACLs:
Access-list 1 permit 0.0.0.0 255.255.255.255
Je totéž jako:
Access-list 1 permit ANY

Access-list 1 permit 192.168.1.5 0.0.0.0
Je totéž jako:
Access-list 1 permit host 192.168.1.5

Pozn:
Pokud chceme povolit HTTP, nesmíme zapomenout povolit rovněž DNS!!! Jinak bude internet sice funkční, ale bez překladu adres, což jak si dokážeme představit - je dost na hovno...

Access list na povolení internetu:
#acc 101 permit tcp any any eq 80 (htttp)
#acc 101 permit tcp any any eq 443 (https)
#acc 101 permit tcp any any eq 53 (dns)
#acc 101 permit udp any any eq 53 (dns)

Pozn:
Neměli bychom rovněž zapomenout, že FTP používá dva porty pro navázání spojení (21) a přenos souborů (20).

Takže povolení FTP:
#acc 101 permit tcp any any eq 20
#acc 101 permit tcp any any eq 21

"Jakési další zabezpečení je použití příkazu established.
acc 101 permit tcp eq 80 any any established" *teď si nejsem jist, ještě se na to mrknu....

pondělí 16. července 2007

Routery - Priority protokolů

CISCO IOS Administrative distance
PrioritaProtokol
0Connected interface
1 Static route
5EIGRP summary route
20 External BGP
90EIGRP internal route
100IGRP
110OSPF
115IS-IS
120RIP
170EIGRP external route
200Internal BGP
255Unknown

...