CCNA Pocket Reference

A Product of




BY

WAQAS ALI ZARAR

CORVIT SYSTEMS
14-C-III, Gulberg III
Lahore, Punjab, Pakistan.
Tel: 92-42-35762401, 35762402, 35762405
Fax: 92-42-35712414
www.corvit.com








Acknowledgment
I acknowledge my parents Ior giving me education and letting me opt Ior taking
Computer as a hobby (and buying me my ever Iirst computer in 1996), which later on
became my proIession.
I would specially like to thank my ustaads (Teachers) Sir, Haroon Ahmed Malik CCIE Routing &
Switching, Securitv, Service Provider. Sir, Adeel Rizvi CCIE Routing & Switching and
Sir Qasim CCNP, who provided me a chance to prove my skills in Cisco. The major portion oI this book
was structured and tested in this institute.

I would like to thank the Corvit Systems team members: Sir, Naeem, Sir, Shuja-ur-Rehman, Mr.Raja
Waqar Ahmed and Mr. Khurram Ior joining hands, and Ior providing the environment in which this
manual was possible.

At last I would also like to thank all the people out there on the Internet who have contributed to the
Cisco community in what ever possible way.






Waqas Ali Zarar



















Preface
Why this manual is written? Has a simple and straight answer: There was a dire
need Ior it. People, which includes proIessional network administrators and
Cisco trainers, had certainly spend some tough time while recalling
those commands and procedures which just sometimes go away Irom the mind.
Similarly, in case oI a network trouble shoot or a problem hunt, there lacked a proper
sequence to Iollow, which could identiIy the problems.
This manual is NOT a detailed theory based encyclopedia. For that kind oI explanation,
please reIer to Cisco Documentation (www.cisco.com) or the books Irom Cisco press,
etc. So in short you should not expect explanation oI things
in this text. This manual is Ior newbies. This is a reIerence manual and should be
treated as reIerence only. There might be things which might not work because oI
your machine or my incorrect explanation. As Iar as this manual is concerned, all
material is related to CCNA.

Please Ieel Iree to inIorm me about any errors, suggestions at:
waqas.alimobex.com.pk





















Terms and conditions

For private and personal use you are allowed to reproduce this manual in any Iorm as Iar
as the name oI the original author (that is myselI ) is maintained in the new
production. You are not liable to give me any money nor you are allowed to charge
any money Irom anyone except the cost oI the media used. I would appreciate an
email once you print this book in any number Ior any one.

For commercial use, the permission must be taken Irom me personally via email.
This permission will only be granted by settling on a contract or agreement between me
(the author) and you (the commercial printer).
Latest version oI this book can always be Iound at:
www.geocities.com/waqas-ali

It is also your moral and ethical duty to print all pages oI this manual, Irom page one till
the last page and keep them in one binding. Printing it without the starting pages is
strongly discouraged and is just like someone without a Iace. I would not like my
hardwork to be censored by your opinions and views about liIe and all that. Permission to
translate this book in any language is granted to everyone, provided the name oI original
author (me in this case, Waqas Ali Zarar) is maintained and is clearly visible / readable
on the title oI the new (translated) book.



Waqas Ali Zarar
























Disclaimer


The computer technology (rather all technologies) are man made and thus are NOT
PerIect. So the author is not responsible Ior any damage to any machine, soItware,
Living (or dead) soul, caused by the contents oI this manual in any possible way.






























Table of Contents

Part 1: Introduction to Cisco Devices........................................................................................................1
Connecting a RolloverCable to Router or Switch:................................................................................................1
Terminal Settings:.................................................................................................................................................1
Serial Cable Types:....................................2
Part 2: Configuring a Router:...............................5
Getting Help:........................................5
Shortcuts Ior Entering Commands:..............................8
Basic Router ConIiguration:...................................9
Part 3: Routing:.....................................18
Static Routing:.......................................18
Routing Protocols:.......................................22
Part 4: Cisco Discovery Protocol:.............................38
Part 5: Switching:....................................44
ConIguring a Switch:.....................................44
VLAN Trunking Protocol:................................. 45
Creating VLANs:.....................................48
Port Security:........................................57
Spanning Tree Protocol:...................................58
Part 6: Back Up and Restoring Cisco IOS:.........................66
Backing Up IOS to a TFTP Server:.............................. 66
Restoring IOS Irom a TFTP Server:................................ 68
Boot Up Sequence:......................................69
Part 7: Password Recovery Procedure:.........................70
Part 8: Network Security:..................................72
Standard Access List:................................................72
Extended Access List:...............................................74
Part 9: Netwrok Address Translation Protocol:.....................77
Static NAT:.................................................................77
Dynamic NAT:............................................................79
Overload NAT/PAT:.........................................................81
Part 11: Voice Over IP:................................... 83
Part 12: Frame Relay:.................................. 84











1his page intentionally left blank









Waqas Ali Zarar
www.geocities.com/waqas.ali


1
Part 1

Connecting a RolloverCable to Router or Switch:
Figure shows how to connect a rollover cable Irom PC to Router or Switch.

Terminal Settings:
The Figure shows the settings that you should conIigure to have your PC connect to a router or switch.











Waqas Ali Zarar
www.geocities.com/waqas.ali


2
Serial Cable Types:
Figure shows the DB-60 end oI a serial cable that connects to a 2500 series router.


Figure shows the newer smart serial cable that connects to a smart serial port on your router. Smart
serial ports are Iound on modular routers




















Waqas Ali Zarar
www.geocities.com/waqas.ali


3
Fig. shows examples oI the male DTE and the Iemale DCE ends that are on
the other side oI a serial or smart serial cable.




Figure shows USB-to-serial connector to connect with Laptop














Waqas Ali Zarar
www.geocities.com/waqas.ali


4

Which Cable to Use?
The table shows which cable should be used while wiring your devices together.
If Device A is: And Device B is: Cable Type:
Computer COM port Console oI router/switch Rollover
Computer NIC Switch Straight-through
Computer NIC Computer NIC Crossover
Switch port Router`s Ethernet port Straight-through
Switch port Switch port Crossover
Router`s Ethernet port Router`s Ethernet port Crossover
Computer NIC Router`s Ethernet port Crossover
Router`s serial port Router`s serial port Cisco serial DCE/DTE cables

UTP Wiring Standards:

Odd pin numbers are always the stripped wires.
A straight-through cable is one with both ends using the same standards (A or B).
A crossover cable is one that has 568A on one end and 568B on the other end.







Waqas Ali Zarar
www.geocities.com/waqas.ali


S
Part 2

How to get help
Router # ? List all commands available in the current command
mode
Router # c ?
calendar call clear clock conIigure connect
crypto
Lists all the possible choices that start with the letter
Router # cl ?
clear clock
Lists all the possible choices that start with the letters
Router # clock
Incomplete Command
Tells you that more parameters need to be entered
Router # clock ?
Set
Shows all subcommands Ior this command (in this case,
Set, which sets the time and date)
Router # clock set 19:50:00 14 1uly 2007 ? Pressing the key conIirms the time and date
conIigured
Router # No error message/Incomplete command message
means the command was entered successIully.

Router Modes:
Router ~ User mode
Router # Privileged mode (also known as EXEC-level mode)
Router (conIig) # Global conIiguration mode
Router (conIig-iI) # InterIace mode
Router (conIig-line) # Line mode
Router (conIig-router) # Router conIiguration mode




Enter
Enter







Waqas Ali Zarar
www.geocities.com/waqas.ali


6

enable Command
Router ~enable
Router #

Moves the user Irom user mode to privileged
mode

exit Command
Router # exit
Or
Router ~ exit

Logs a user oII
Router (conIig-iI) # exit
Router(conIig)#

Moves you back one level
Router (conIig) # exit
Router #

Moves you back one level

disable Command
Router # disable
Router ~

Moves you Irom privileged mode back to user mode

logout Command
Router # logout

PerIorms the same Iunction as exit

Setup Mode

Setup mode start automatically iI there is no startup conIiguration present.
Router # setup

Enters startup mode Irom the command line








Waqas Ali Zarar
www.geocities.com/waqas.ali


7

Keyboard Help

Shows you where you made a mistake in entering a command
Router # confg t
^
Invalid input detected
at ^` marker.
Router # config t
Router (conIig) #


Moves cursor to beginning oI line

Moves cursor back one word

Moves cursor back one character

Moves cursor to end oI line

Moves cursor Iorward one character

Moves cursor Iorward one word

Moves you Irom any prompt back down to
privileged mode
$
Indicates that the line has been scrolled to the leIt

History Commands

Recalls commands in the history buIIer in a backward sequence,
beginning with the most recent command

Returns to more recent commands in the history buIIer aIter
recalling commands with the C-P key sequence
Router # terminal history size 25 Causes the router to now remember the last 25 commands in the
buIIer. (Maximum 256, Default 10)

show Commands
Router # show version

Displays inIormation about the current Cisco IOS SoItware









Waqas Ali Zarar
www.geocities.com/waqas.ali


8

Shortcuts for Entering Commands
To enhance eIIiciency and to reduce time, Cisco IOS SoItware has some shortcuts Ior entering
commands.
Router ~ enable
Router ~ enab
Router ~ en
Entering a shortened Iorm oI a command is suIIicient as long as there is
no conIusion about which command you are attempting to enter.
Router # configure terminal
is the same as
Router # config t


Using the Key to Complete Commands
When you are entering a command, you can use the key to complete the command. Enter the Iirst
Iew characters oI a command and press the key. II the characters are unique to the command, the
rest oI the command is entered in Ior you. This is helpIul iI you are unsure about the spelling oI a
command.

Router # sh Router # show

By pressing the word will be auto completed

























Waqas Ali Zarar
www.geocities.com/waqas.ali


9




Configuring a Single Router

Entering Global Configuration Mode

Router ~

Limited viewing oI conIiguration. You cannot make changes in this mode.
Router #

You can see the conIiguration and move to make changes

Configuring a Router Name

This command works on both routers and switches.

Router (conIig) # hostname Cisco

The name can be any word you choose.
Cisco (conIig) #

Configuring Passwords




Router (conIig) # enable password cisco

Sets enable password
Router (conIig) # enable secret corvit

Sets enable secret password
Router (conIig) # line console 0

Router (conIig-line) # password cisco

Router (conIig-line) # login

Enters console line mode
Sets console line mode password to cisco

Enables password checking at login







Waqas Ali Zarar
www.geocities.com/waqas.ali


10

Router (conIig) # line vty 0 4

Router (conIig-line) # password cisco

Router (conIig-line) # login
Enters vty line mode Ior all Iive vty lines

Sets vty password to cisco

Enables password checking at login


Note: The enable secret password is encrypted by deIault.
The enable password is not. Recommended practice is that you Use only
the enable secret password command in a router or switch conIiguration
rather than enable password command.


Moving Between Interface

Router (conIig) # interface fastethernet 0/0 Moves to Fast Ethernet interIace conIiguration mode
Router (conIig-iI) #

In Fast Ethernet 0/0 conIiguration mode now
Router (conIig-iI) # exit

Moves to global conIiguration mode
Router (conIig) # interface serial 0/0
or
Router (conIig-iI) # interface serial 0/0

Moves to Serial interIace conIiguration mode

Moves directly to Serial 0/0 conIiguration mode

Configuring a Serial Interface

Router (conIig) # interface s0/0

Moves to serial interIace 0/0 conIiguration mode
Router (conIig-iI) # ip address 1.1.1.1
255.0.0.0
Assigns address and subnet mask to interIace
Router (conIig-iI) # clock rate 56000

Assigns a clock rate Ior the InterIace
Router (conIig-iI) # encapsulation PPP Assign encapsulation to InterIace
(defaultHDLC)
Router (conIig-iI) # no shutdown

Turns interIace on

Note: The clock rate command is used only on a serial interIace
that has a DCE cable plugged into it. There must be a clock rate set
on every serial link between routers.







Waqas Ali Zarar
www.geocities.com/waqas.ali


11


Configuring a Fast Ethernet Interface

Router (conIig) # interface fastethernet 0/0 Moves to Fast Ethernet 0/0 interIace conIiguration
mode
Router (conIig-iI) # ip address 200.100.50.100
255.255.255.0
Assigns address and subnet mask to interIace
Router (conIig-iI) # no shutdown

Turns interIace on

Creating a Message-of-the-Day Banner

Router (conIig) # banner motd # Authorized
Personnel Only! Please enter your username
and password. #
Router (conIig) #
# is known as a delimiting character. The
delimiting character must surround the banner
message and can be any character so long as it is not a
character used within the body oI the message.

Saving Configurations

Router # copy running-config startup-config Saves the running conIiguration to local
NVRAM
Router # copy running-config tftp Saves the running conIiguration remotely to a
TFTP server

Erasing Configurations

Router # erase startup-config
Or
Router # write erase
Deletes the startup conIiguration Iile Irom
NVRAM

Note: The running conIiguration is still in dynamic memory.
Reload the router to clear the running conIiguration.

show Commands

Router # show ?

Lists all show commands available in privilege mode
Router # show interfaces

Displays statistics Ior all interIaces
Router # show interface serial 0/0 Displays statistics Ior a speciIic interIace








Waqas Ali Zarar
www.geocities.com/waqas.ali


12
Router # show ip interface brief Displays a summary oI all interIaces, including status
and IP address assigned
Router # show controllers serial 0/0 Displays statistics Ior interIace hardware. Statistics
display iI the clock rate is set and iI the cable is
DCE, DTE,or not attached
Router # show users

Displays all users connected to Router.
Router # show version

Displays inIo about loaded IOS version.
Router # show ip protocols

Displays status oI conIigured Layer 3 protocols
Router # show startup-config

Displays the conIiguration saved in NVRAM.

The do Command

Router (conIig) # do show running-config Executes the privileged-level show running-config
command while in global conIiguration mode.
Router (conIig) # The router remains in global conIiguration mode
aIter the command has been executed.






























Waqas Ali Zarar
www.geocities.com/waqas.ali


13






(Note: Lab results are produced using Packet Tracer Simulator)
Task to complete in this Lab:
1. Set host names oI both Routers as shown in Iigure.
2. Assign IP address to Serial 0/1 oI LHR router 1.1.1.1/8
3. Assign IP address to Serial 0/1 oI KHI router 1.1.1.2/8
4. Assign IP address to Fast Ethernet 1/0 oI LHR Router 200.100.50.100/24
5. Assign IP address to Fast Ethernet 1/0 oI KHI Router 200.100.100.100/24
6. Set encapsulation oI Serial 1/0 on both Routers to PPP
7. Set clock rate on DCE interIace.
8. Both Routers must ping each other
9. ConIigure line console password to cisco
10. ConIigure Secret password to corvit
11. ConIigure line vty password oI both Routers to cisco
12. Save the conIigurations
13. Telnet Router LHR Irom your PC















Waqas Ali Zarar
www.geocities.com/waqas.ali


14


Configuration of Router-LHR
Router ~ enable
Router # conIigure terminal
Router (conIig) # hostname LHR

LHR (conIig) # interIace s 0/1
LHR (conIig-iI) # ip address 1.1.1.1 255.0.0.0
LHR (conIig-iI) # no shutdown
LHR (conIig-iI) # encapsulation ppp
LHR (conIig-iI) # clock rate 64000
LHR (conIig-iI) # exit

LHR (conIig) # interIace Ia 0/0
LHR (conIig-iI) # ip address 200.100.50.100 255.255.255.0
LHR (conIig-iI) # no shutdown

LHR (conIig) # line console 0
LHR (conIig-line) # password cisco
LHR (conIig-line) # login
LHR (conIig-line) # exit
LHR (conIig) # enable secret corvit
LHR (conIig) # line vty 0 4
LHR (conIig-line) # password cisco
LHR (conIig-line) # login
LHR # copy run start









Note: You can check which Router has DCE interIace
by Show controllers serial 1/ command. In this case
Router LHR has DCE interIace.







Waqas Ali Zarar
www.geocities.com/waqas.ali


1S
To view running configurations of Router-LHR:
LHR# show running-conIig

















Waqas Ali Zarar
www.geocities.com/waqas.ali


16

Configuration of Router-KHI
Router ~ enable
Router # conIigure terminal
Router (conIig) # hostname KHI

KHI (conIig) # interIace s 0/1
KHI (conIig-iI) # ip address 1.1.1.2 255.0.0.0
KHI (conIig-iI) # no shutdown
KHI (conIig-iI) # encapsulation ppp
KHI (conIig-iI) # exit

KHI (conIig) # interIace Ia 0/0
KHI (conIig-iI) # ip address 200.100.100.100 255.255.255.0
KHI (conIig-iI) # no shutdown

KHI (conIig) # line console 0
KHI (conIig-line) # password cisco
KHI (conIig-line) # login

KHI (conIig) # enable secret corvit
KHI (conIig) # line vty 0 4
KHI (conIig-line) # password cisco
KHI (conIig-line) # login

KHI # copy run start
Ping Router KHI from Router LHR
LHR# ping 1.1.1.1

The 5 success sign shows that your connectivity is 100











Waqas Ali Zarar
www.geocities.com/waqas.ali


17

Telnet Router LHR from PC
PC~ telnet 200.100.50.100

Enter Line vty password i.e.; cisco to login Router LHR
To view running configurations of Router-KHI:
KHI # show run












Waqas Ali Zarar
www.geocities.com/waqas.ali


18
Part 3


Static Routing



(Note: Lab results are produced using Packet Tracer Simulator)

II you try to ping 200.100.100.100 Irom Router LHR or 200.100.50.100 Irom Router KHI. There will
be 5 unsuccessIul signs because there is no entry Ior these routes in routing table oI both routers. As
shown in Iigure.
For this purpose we will perIorm routing so that both routers exchange their missing routes. Once
routing table is complete you can ping these routes.
When conIiguring a static route, you can identiIy where packets should be routed in two ways:

The next-hop address
The exit interface
Both ways are shown in the 'ConIiguration Example













Waqas Ali Zarar
www.geocities.com/waqas.ali


19

Routing table of Router LHR before static routing.
LHR# show ip route

The 3
rd
route i.e. 200.100.100.0 is missing in Router LHR routing table.

LHR# ping 200.100.100.100

Now create a static route Ior this missing route on Router LHR

Configuration of Router-LHR
LHR(conIig)# ip route 200.100.100.0 255.255.255.0 1.1.1.2


Routing table oI Router LHR aIter creating static route is shown below.



Missing Address
Next Hop Address







Waqas Ali Zarar
www.geocities.com/waqas.ali


20

LHR# show ip route


Now try to ping again that route and this time ping will be successIul.
LHR# ping 200.100.100.100


Routing table oI Router KHI beIore static routing.
KHI# show ip route

The 3
rd
route i.e. 200.100.50.0 is missing in Router KHI routing table.
KHI# ping 200.100.50.100









Waqas Ali Zarar
www.geocities.com/waqas.ali


21

Now create a static route Ior this missing route on Router KHI
Configuration of Router-KHI
LHR (conIig)# ip route 200.100.50.0 255.255.255.0 serial 0/1


Routing table oI Router LHR aIter creating static route is shown below.
LHR # Show ip route

Now try to ping again that route and this time ping will be successIul.
KHI# ping 200.100.50.100









Exit Interface
Missing Address







Waqas Ali Zarar
www.geocities.com/waqas.ali


22









RIP
(Note: Lab results are produced using Packet Tracer Simulator)
Basic Configuration of Router-A
A (conIig) # interIace serial 1/0
A (conIig-iI) # ip address 1.1.1.1 255.0.0.0
A (conIig-iI) # no shutdown
A (conIig-iI) # clock rate 64000

A (conIig) # interIace serial 1/1
A (conIig-iI) # ip address 3.1.1.2 255.0.0.0
A (conIig-iI) # no shutdown










Waqas Ali Zarar
www.geocities.com/waqas.ali


23

A (conIig) # interIace Iastethernet 0/0
A (conIig-iI) # ip address 200.100.50.100 255.255.255.0
A (conIig-iI) # no shutdown

Basic Configuration of Router-B
B (conIig) # interIace serial 1/0
B (conIig-iI) # ip address 1.1.1.2 255.0.0.0
B (conIig-iI) # no shutdown

B (conIig) # interIace serial 1/1
B (conIig-iI) # ip address 2.1.1.1 255.0.0.0
B (conIig-iI) # no shutdown
B (conIig-iI) # clock rate 64000

B (conIig) # interIace Iastethernet 0/0
B (conIig-iI) # ip address 200.100.100.100 255.255.255.0
B (conIig-iI) # no shutdown

Basic Configuration of Router-C
C (conIig) # interIace serial 1/0
C (conIig-iI) # ip address 3.1.1.1. 255.0.0.0
C (conIig-iI) # no shutdown
C (conIig-iI) # clock rate 64000

C (conIig) # interIace serial 1/1
C (conIig-iI) # ip address 2.1.1.2. 255.0.0.0
C (conIig-iI) # no shutdown

C (conIig) # interIace Iastethernet 0/0
C (conIig-iI) # ip address 200.100.150.100 255.255.255.0
C (conIig-iI) # no shutdown

Running RIP on Router-A, B & C
A (conIig) # router rip
A (conIig-router) # network 1.0.0.0
A (conIig-router) # network 3.0.0.0
A (conIig-router) # network 200.100.50.0

B (conIig) # router rip
B (conIig-router) # network 1.0.0.0
B (conIig-router) # network 2.0.0.0
B (conIig-router) # network 200.100.100.0










Waqas Ali Zarar
www.geocities.com/waqas.ali


24

C (conIig) # router rip
C (conIig-router) # network 2.0.0.0
C (conIig-router) # network 3.0.0.0
C (conIig-router) # network 200.100.150.0

Routing Table of Router-A

A # show ip route


Note: Routing table oI Router-A has been completely converged and network
2.0.0.0 has been reached on Router-A using two diIIerent paths


Shutting Down Interface Serial 1/0 of Router-B
B (conIig) # interIace serial 1/0
B (conIig-iI) # shutdown

A # show ip route



Note: Network 2.0.0.0 has been reached on Router-A using
only one path.












Waqas Ali Zarar
www.geocities.com/waqas.ali


2S




(Note: Lab results are produced using Packet Tracer Simulator)
Coca Cola recently installed new routers in their oIIice. Complete the network installation by
conIiguring RIPV2 routing on LHR & KHI Router.
Configure the router per the following requirements:
IPv4 addresses must be conIigured on Router-LHR as Iollows:
Ethernet network 200.100.50.64/27 - router has fourth assignable host address in subnet.
Serial network192.168.1.0/28 router has last assignable host address in subnet
Routing Protocol is RIPv2.
IPv4 addresses must be conIigured on Router-KHI as Iollows:
Ethernet network 200.100.50.32/27 - router has first assignable host address in subnet.
Serial network192.168.1.0/28 router has first assignable host address in subnet
Routing Protocol is RIPv2.











Waqas Ali Zarar
www.geocities.com/waqas.ali


26

Configuration of Router-KHI
KHI (conIig) # interIace Iastethernet 0/0
KHI (conIig-iI) # ip address 200.100.100.100.33 255.255.255.224
KHI (conIig-iI) # no shutdown

KHI (conIig) # interIace serial 0/1
KHI (conIig-iI) # ip address 192.168.1.1 255.255.255.240
KHI (conIig-iI) # no shutdown
KHI (conIig-iI) # exit

Configuration of Router-LHR

LHR (conIig) # interIace Iastethernet 0/0
LHR (conIig-iI) # ip address 200.100.50.68 255.255.225.224
LHR (conIig-iI) # no shutdown

LHR (conIig) # interIace serial 0/1
LHR (conIig-iI) # ip address 192.168.1.14 255.255.255.240
LHR (conIig-iI) # no shutdown

Configuring RIP version 2 on Router-KHI

KHI (conIig) # router rip
KHI (conIig-router) # version 2
KHI (conIig-router) # network 200.100.100.32
KHI (conIig-router) # network 192.168.1.0

Configuring RIP version 2 on Router-LHR

LHR (conIig) # router rip
LHR (conIig-router) # version 2
LHR (conIig-router) # network 192.168.1.0
LHR (conIig-router) # network 200.100.50.64














Waqas Ali Zarar
www.geocities.com/waqas.ali


27

Routing Table of Router-KHI
KHI # show ip route

Note: Network 200.100.50.0 has been reached on Router KHI
with subnetted network 200.100.50.64

Routing Table of Router-LHR
LHR # show ip route

Note: Network 200.100.100.0 has been reached on Router LHR
with subnetted network 200.100.100.32















Waqas Ali Zarar
www.geocities.com/waqas.ali


28







(Note: Lab results are produced using Packet Tracer Simulator)

Basic Configuration of Router-A
A (conIig) # interIace serial 1/0
A (conIig-iI) # ip address 1.1.1.1 255.0.0.0
A (conIig-iI) # no shutdown
A (conIig-iI) # clock rate 64000

A (conIig) # interIace Iastethernet 0/0
A (conIig-iI) # ip address 200.100.50.100 255.255.255.0
A (conIig-iI) # no shutdown

Basic Configuration of Router-B

B (conIig) # interIace serial 1/0
B (conIig-iI) # ip address 1.1.1.2 255.0.0.0
B (conIig-iI) # no shutdown

B (conIig) # interIace Iastethernet 0/0
B (conIig-iI) # ip address 200.100.100.100 255.255.255.0
B (conIig-iI) # no shutdown










Waqas Ali Zarar
www.geocities.com/waqas.ali


29

Running EIGRP on Router-A & B

A (conIig) # router eigrp 10
A (conIig-router) # network 1.0.0.0
A (conIig-router) # network 200.100.50.0

B (conIig) # router eigrp 10
B (conIig-router) # network 1.0.0.0
B (conIig-router) # network 200.100.100.0

Routing Table of Router-A
A # show ip route

Note: Network 200.100.100.0 has been reached on Router A
Routing Table of Router-B
B # show ip route

Note: Network 200.100.50.0 has been reached on Router B
















Waqas Ali Zarar
www.geocities.com/waqas.ali


30

Now ping PC 200.100.100.10 Irom PC 200.100.50.10
C:\~ ping 200.100.10.10
























Waqas Ali Zarar
www.geocities.com/waqas.ali


31



EICRP
Using Wildcard Masks with OSPF Areas

When compared to an IP address, a wildcard mask identiIies which addresses get matched
Ior placement into an area:
A 0 (zero) in a wildcard mask means to check the corresponding bit in the address Ior an exact
match.
A 1 (one) in a wildcard mask means to ignore the corresponding bit in the address can be either 1
or 0.

Example 1: 1.0.0.0 0.255.255.255
Example 2: 172.16.0.0 0.0.255.255
Example 3: 200.100.50.0 0.0.0.255

Note: Wild Card Mask is inverse of subnet mask only in case of Network D.



















Waqas Ali Zarar
www.geocities.com/waqas.ali


32







(Note: Lab results are produced using Packet Tracer Simulator)
Basic Configuration of Router-A

A (conIig) # interIace serial 1/0
A (conIig-iI) # ip address 1.1.1.1 255.0.0.0
A (conIig-iI) # no shutdown
A (conIig-iI) # clock rate 64000

A (conIig) # interIace Iastethernet 0/0
A (conIig-iI) # ip address 200.100.50.100 255.255.255.0
A (conIig-iI) # no shutdown

Basic Configuration of Router-B

B (conIig) # interIace serial 1/0
B (conIig-iI) # ip address 1.1.1.2 255.0.0.0
B (conIig-iI) # no shutdown











Waqas Ali Zarar
www.geocities.com/waqas.ali


33
B (conIig) # interIace serial 1/1
B (conIig-iI) # ip address 2.1.1.1 255.0.0.0
B (conIig-iI) # no shutdown
B (conIig-iI) # clock rate 64000

B (conIig) # interIace Iastethernet 0/0
B (conIig-iI) # ip address 200.100.100.100 255.255.255.0
B (conIig-iI) # no shutdown

Running OSPF on Router-A & B

A (conIig) # router ospI 1
A (conIig-router) # network 1.0.0.0 0.255.255.255 area 0
A (conIig-router) # network 200.100.50.0 0.0.0.255 area 0

B (conIig) # router ospI 1
B (conIig-router) # network 1.0.0.0 0.255.255.255 area 0
B (conIig-router) # network 200.100.100.0 0.0.0.255 area 0

Routing Table of Router-A
A # show ip route

Note: Network 200.100.100.0 has been reached on Router A
Routing Table of Router-B
B # show ip route

Note: Network 200.100.50.0 has been reached on Router B











Waqas Ali Zarar
www.geocities.com/waqas.ali


34


Now ping PC 200.100.100.10 Irom PC 200.100.50.10
C:\~ ping 200.100.10.10






















Waqas Ali Zarar
www.geocities.com/waqas.ali


3S







(Note: Lab results are produced using Packet Tracer Simulator)
Basic Configuration of Router-A

A (conIig) # interIace serial 1/0
A (conIig-iI) # ip address 1.1.1.1 255.0.0.0
A (conIig-iI) # no shutdown
A (conIig-iI) # clock rate 64000

A (conIig) # interIace Iastethernet 0/0
A (conIig-iI) # ip address 200.100.50.100 255.255.255.0
A (conIig-iI) # no shutdown

Basic Configuration of Router-B

B (conIig) # interIace serial 1/0
B (conIig-iI) # ip address 1.1.1.2 255.0.0.0
B (conIig-iI) # no shutdown
B (conIig-iI) # clock rate 64000

B (conIig) # interIace Iastethernet 0/0
B (conIig-iI) # ip address 200.100.100.100 255.255.255.0
B (conIig-iI) # no shutdown







Waqas Ali Zarar
www.geocities.com/waqas.ali


36

Running OSPF on Router-A & B

A (conIig) # router ospI 1
A (conIig-router) # network 1.0.0.0 0.255.255.255 area 0
A (conIig-router) # network 200.100.50.0 0.0.0.255 area 0

B (conIig) # router ospI 1
B (conIig-router) # network 1.0.0.0 0.255.255.255 area 0
B (conIig-router) # network 200.100.100.0 0.0.0.255 area 1

Routing Table of Router-A
A # show ip route

Note: The Routes which comes across another area in OSPF are
shown by OIA and are called OSPF Inter Area Routes


Routing Table of Router-B
B # show ip route

Note: Network 200.100.50.0 has been reached on Router B














Waqas Ali Zarar
www.geocities.com/waqas.ali


37

Neighbor Table of Router-A
A # show ip ospI neighbor

Note: Router A has one neighbor with Neighbor ID 200.100.100.100
Neighbor Table of Router-B
B # show ip ospI neighbor

Note: Router B has one neighbor with Neighbor ID 200.100.50.100

Now ping PC 200.100.100.10 Irom PC 200.100.50.10
C:\~ ping 200.100.10.10












Waqas Ali Zarar
www.geocities.com/waqas.ali


38

Part 4








Draw Network Diagram using CDP:
A # show cdp neighbors

Note: cdp neighbors table shows that there are 2 neighbors oI Router A
i.e.; Router B & Router C. Local Interface shows interIaces oI
Router A, whereas Port ID shows interIaces oI neighbor Routers.










Waqas Ali Zarar
www.geocities.com/waqas.ali


39

Neighbors Detail Information:

A # show cdp neighbors
detail
Note: cdp neighbors detail shows complete inIormation oI neighbor
Including IP Address and outgoing interIace oI neighbor.









Waqas Ali Zarar
www.geocities.com/waqas.ali


40

A # telnet 1.1.1.2

B # show cdp neighbors


Note: cdp neighbors table shows that there are 2 neighbors oI Router B
i.e.; Router B & Router C. Local Interface shows interIaces oI Router B
whereas Port ID shows interIaces oI neighbor Routers.


















Waqas Ali Zarar
www.geocities.com/waqas.ali


41

Neighbors Detail Information:
B # show cdp neighbors detail

Note: cdp neighbors detail shows complete inIormation oI neighbor
Including IP Address and outgoing interIace oI neighbor.















Waqas Ali Zarar
www.geocities.com/waqas.ali


42

B # telnet 2.1.1.2



C # show cdp neighbors



Note: cdp neighbors table shows that there are 2 neighbors oI Router C
i.e.; Router A & Router B. Local Interface shows interIaces oI Router B
whereas Port ID shows interIaces oI neighbor Routers.
























Waqas Ali Zarar
www.geocities.com/waqas.ali


43

Neighbors Detail Information:
C # show cdp neighbors detail


Note: cdp neighbors detail shows complete inIormation oI neighbor
Including IP Address and outgoing interIace oI neighbor.









Waqas Ali Zarar
www.geocities.com/waqas.ali


44

Part 5








Catalyst 3560
Switch # show vtp status























Waqas Ali Zarar
www.geocities.com/waqas.ali


4S



Switch (conIig) # vtp domain CISCO
Changing VTP domain Irom NULL to CISCO

Switch # show vtp status

Note: VTP domain CISCO has been conIigured



VTP is a Cisco proprietary protocol that allows Ior VLAN conIiguration (addition, deletion,
or renaming oI VLANs) to be consistently maintained across a common administrative
domain.

VTP reduces administration in a switched network. When you conIigure a new VLAN on one
VTP server, the VLAN is distributed through all switches on the domain. This reduces the need
to conIigure the same VLAN everywhere. VTP is a Cisco proprietary protocol that is available
on most oI the Cisco Catalyst series products.
II you intend to make a switch part oI a VTP management domain, each switch must be
conIigured in one oI these three possible VTP modes.

Server Mode
Client Mode
Transparent Mode

We will discuss Iirst 2 modes in CCNA. The VTP mode assigned to a switch will determine how
the switch interacts with other VTP switches in the management domain.








Waqas Ali Zarar
www.geocities.com/waqas.ali


46

Server Mode:

Once VTP is conIigured on a Cisco switch the deIault mode used is Server Mode. In any given
VTP management domain, at least one switch must be in Server Mode. When in Server Mode, a
switch can be used to add, delete and modiIy VLANs, and this inIormation will be passed to all
other switches in the VTP management domain.

Client Mode:

When a switch is conIigured to use VTP Client Mode, it is simply the recipient oI any VLANs
added, deleted, or modiIied by a switch in Server Mode within the same management domain . a
switch in VTP Client Mode cannot make any changes to VLAN inIormation.



Server Mode:

Switch (conIig) # vtp mode server
Device mode already VTP SERVER.

Client Mode:

Switch (conIig) # vtp mode client
Setting device to VTP CLIENT mode.

Switch # show vtp status
















Waqas Ali Zarar
www.geocities.com/waqas.ali


47


VLAN:
A VLAN is a logical local area network (or LAN) that extends beyond a single traditional LAN
to a group oI LAN segments. Because a VLAN is a logical entity, its creation and conIiguration
is done completely in soItware. In other words VLAN is a logical grouping oI network users and
resources connected administratively to deIined ports on a switch.
(ReIerence: http://www.topbits.com/vlan.html)

Why use VLAN?

VLAN is like placing a router to stop broadcasts between each individual VLAN. Routers are
like bug poison-they kill broadcasts. Broadcast can't escape through routers and they can't escape
a VLAN. Each VLAN becomes its own individual broadcast domain. When a network node or
workstation sends out an advertisement or broadcast to the other nodes on a segment, only the
nodes assigned to that VLAN to which the node sending the broadcast will receive that
broadcast.
Default VLANS

Switch # show vlan


Note: VLAN 1, 1002, 1003, 1004 & 1005 are deIault VLANs.









Waqas Ali Zarar
www.geocities.com/waqas.ali


48



How to Create VLAN

Switch (conIig) # vlan 2
VTP VLAN conIiguration is not allowed when device is in client mode.

Switch (conIig-vlan) # end

Switch # show vlan



Switch # show vtp status

Note: DeIault VLANs are 5 but aIter creating VLAN 2 total no oI
VLANs are 6







Waqas Ali Zarar
www.geocities.com/waqas.ali


49

Switch (conIig) # vlan 4-6
Switch (conIig-vlan) # exit

Switch (conIig) # vlan 7-9,10
Switch (conIig-vlan) # exit

Switch # show vlan






















Waqas Ali Zarar
www.geocities.com/waqas.ali


S0

Switch # show vtp status


Note: DeIault VLANs are 5 but aIter creating 8 VLANs total no oI
VLANs are 13




The option Ior the switchport mode command are as Iollows:

TRUNK

ConIigures the port to permanent trunk mode and negotiates with the connected device on the
other side to convert the link to trunk mode. II multiple trunk encapsulations are available, the
encapsulation must be chosen beIore this command will work.

Access

Disables port trunk mode and negotiates with the connected device to convert the link to non
trunk. This port will belong to only the conIigured access VLAN.

















Waqas Ali Zarar
www.geocities.com/waqas.ali


S1





Task to complete in this simulation:

1. ConIigure host names oI switches as A and B
2. Set VTP domain as CISCO on both switches
3. Set VTP mode oI switch A as server
4. Set VTP mode oI switch B as client
5. Create vlan 2 and vlan 3 on Switch A
6. Create trunk link b/w Switch A and Switch B on Fa 0/1
7. Assign port Fa 0/4 oI both switches to vlan 2.
8. Conclude result by ping Irom Switch A to Switch B
Configuration of Switch-A

Switch (conIig) # hostname A
A (conIig) # vtp domain CISCO
Changing VTP domain Irom NULL to CISCO

A (conIig) # vtp mode server
Device mode already VTP SERVER.











Waqas Ali Zarar
www.geocities.com/waqas.ali


S2

Creating Trunk on Switch-A

A (conIig) # interIace Iastethernet 0/1
A (conIig-iI) # switchport trunk encapsulation dot1q
A (conIig-iI) # switchport mode trunk

Configuration of Switch-B

Switch (conIig) # hostname B
B (conIig) # vtp domain CISCO
Changing VTP domain Irom NULL to CISCO

B (conIig) # vtp mode client
Setting device to VTP CLIENT mode.

Creating Trunk on Switch-A

B(conIig) # interIace Iastethernet 0/1
B (conIig-iI) # switchport trunk encapsulation dot1q
B (conIig-iI) # switchport mode trunk

Verify Trunk Link

Switch # show interIaces trunk















Waqas Ali Zarar
www.geocities.com/waqas.ali


S3

Creating VLANs on Switch-A

A(conIig)# vlan 2
A (conIig-vlan) # exit

A(conIig)# vlan 3

Verification of VLANs on Switch-A

A # show vlan



Note: VLAN 2 & VLAN 3 has been created on Switch-A




















Waqas Ali Zarar
www.geocities.com/waqas.ali


S4


A # show vtp status

Note: DeIault VLANs are 5 but aIter creating 2 VLANs total no oI
VLANs are 7

Verification of VLANs on Switch-B

B # show vlan



Note: VLAN 2 & VLAN 3 has been propagated on Switch-B








Waqas Ali Zarar
www.geocities.com/waqas.ali


SS

B # show vtp status


Note: No oI VLANs on Switch-B are same as on Switch-A.
As Switch-B is in client mode which shows that Switch-A
has propagated its VLAN database on Sitch-B


Assigning Membership to Interface on Switch-A

A (conIig) # interIace Iastethernet 0/4
A (conIig-iI) # switchport mode access
A (conIig-iI) # switchport access vlan 2

A # show vlan



Note: InterIace FastEthernet 0/1 has been assigned to VLAN 2










Waqas Ali Zarar
www.geocities.com/waqas.ali


S6

Assigning Membership to Interface on Switch-B
B (conIig) # interIace Iastethernet 0/4
B (conIig-iI) # switchport mode access
B (conIig-iI) # switchport access vlan 2

B # show vlan


Note: InterIace FastEthernet 0/1 has been assigned to VLAN 2

Verification by ping 1.1.1.1 & 1.1.1.2




Note: ping will be successIul as 1.1.1.1 & 1.1.1.2 are in same vlan















Waqas Ali Zarar
www.geocities.com/waqas.ali


S7



Configure Port Security on Fa0/4 of Switch

A (conIig) # interIace Iastethernet 0/1
A (conIig-iI) # switchport port-security
Enables port security on the interIace.

A (conIig-iI) # switchport port-security maximum 4
A (conIig-iI) # switchport port-security mac-address 1234.5678.90ab
Sets a speciIic secure MAC address 1234.5678.90ab.

A (conIig-iI) # switchport port-security violation shutdown
ConIigures port security to shut down the interIace iI a security violation occurs.

Verifying Switch Port Security

A # show port-security interIace Iastethernet 0/4



















Waqas Ali Zarar
www.geocities.com/waqas.ali


S8



Spanning-Tree Protocol is a link management protocol that provides path redundancy while
preventing undesirable loops in the network. For an Ethernet network to Iunction properly, only
one active path can exist between two stations.

BPDU

Bridges must communicate with one another to execute the STP, and they accomplish this by
sending conIiguration messages in the Iorm oI Bridge Protocol Data Unit (BPDUs). AIter every
2 seconds STP sends BPDUs out every port oI the bridge.

Here is some oI the inIormation provided in BPDU:

Root ID The lowest Bridge ID (BID) in the topology.
Cost of Path Cost oI all links Irom the transmitting switch to the root bridge.
BID Bid oI the transmitting switch.
Port ID Transmitting switch Port ID.
STP Timer Values Max age, hello time, Iorward delay

Root Bridge

ReIerence point
One root per VLAN
Maintains topology
Propagates timers

STP uses the concept oI root bridge, root ports and designated ports to establish a loop-Iree path
through the network. The Iirst step in creating the loop-Iree path through the network. The root
bridge is the reIerence point that all switches use to establish Iorwarding paths that will avoid
loops in the layer 2 network.




















Waqas Ali Zarar
www.geocities.com/waqas.ali


S9

Selection of Root Bridge





BPDUs are exchanged b/w switches and the analysis oI the BID and root ID inIormation Irom
those BPDUs determines which bridge is selected as the root bridge.

In the example shown, both switches have the same priority Ior the same VLAN. The switch
with the lowest MAC address will, thereIore be elected as root bridge. In the example, Switch-A
is the root bridge Ior VLAN1, with a BID oI 0x8001:0c0011111111.

Port Roles

One root bridge per network/Vlan
One root port per non-root bridge
One designated port per segment


Spanning Tree Mechanism







Waqas Ali Zarar
www.geocities.com/waqas.ali


60


There are Iour port roles in spanning tree:

Root Port
This port exists on nonroot bridges and is the switch port with the best path to the root bridge.
Root ports Iorward traIIic toward the root bridge. Only one root port is allowed per bridge.

Designated Port
This port exists on root and non root bridges. For root bridges, all switch ports are designated
ports. For nonroot bridges, a designated port is the switch port that will receive and Iorward
Irames toward the root bridges as needed. Only one designated port is allowed per segment. II
multiple switches exist on the same segment, an election process determines the designated
switch, and the corresponding switch port begins Iorwarding Irames Ior segment.

Non Designated Port
The non designated port is a switch port that is not Iorwarding (blocking) data Irames and not
populating the MAC address table with the source addresses oI Irames seen on that segment.

Disable Port
The disabled port is a switch port that is shut down.



Blocking
A port in the blocking state does not participate in Irame Iorwarding. AIter initialization, a
BPDU is sent to each port in the switch. A switch initially assumes it is the root until it
exchanges BPDUs with other switches. This exchange establishes which switch in the network is
really the root. II only one switch resides in the network, no exchange occurs, the Iorward delay
timer expires, and the ports move to the listening state.

Learning
The listening state is the Iirst transitional state a port enters aIter the blocking state, when
Spanning-Tree Protocol determines that the port should participate in Irame Iorwarding.
Learning is disabled in the listening state.

Learning State
A port in the learning state is preparing to participate in Irame Iorwarding. This is the second
transitional state through which a port moves in anticipation oI Irame Iorwarding. The port enters
the learning state Irom the listening state through the operation oI Spanning-Tree Protocol.
Forwarding State
A port in the Iorwarding state Iorwards Irames and also sends and receives BPDUs. The port
enters the Iorwarding state Irom the learning state through the operation oI Spanning-Tree
Protocol.







Waqas Ali Zarar
www.geocities.com/waqas.ali


61

Disabled State
A port in the disabled state does not participate in Irame Iorwarding or the operation oI
Spanning-Tree Protocol. A port in the disabled state is virtually nonoperational.



The switch looks at the Iollowing components in the BPDU to determine which switch ports will
Iorward data and which switch ports will block data:

a. Lowest path cost
b. Lowest sender BID
c. Lowest sender port ID

The switch looks at the path cost Iirst to determine which port is receiving the lowest-cost path.
The path is calculated on the basis oI link speed and the number oI links the BPDU traversed. Id
a port has the lowest cost, that port is eligible to be placed in Iorwarding mode. All other ports
that are receiving BPDUs continue in blocking mode.

II the path cost and sender BID are equal, as with parallel links b/w two switches, the switch
goes to the port ID as a 'tiebreaker. The port with the lowest port ID Iorwards data Irames, and
all other ports continue to block data Irames.







A path cost value is given to each port. The cost is typically based on a guideline established as
part oI 802.1d. According to the original speciIication, cost is 1,000 Mbps (1 gigabit per second)
divided by the bandwidth oI the segment connected to the port. ThereIore, a 10 Mbps connection








Waqas Ali Zarar
www.geocities.com/waqas.ali


62

would have a cost oI (1,000/10) 100 as shown in table. The lowest path is considered to be the
best path.






SW-A is the root bridge.
SW-B will elect a root port.

SwitchB receives a BPDU Irom the root bridge (Switch-A) on its switch port Fastethernet
segment and another BPDU on its switch port Ethernet segment. The root path cost in both cases
is zero.
The local path cost on the Fastethernet switch port is 19, whereas the local path cost on the
Ethernet switch port is 100. As a result, the switch port on the Fastethernet segment has the
lowest path cost to the root bridge and is elected the root port Ior switchB.














Waqas Ali Zarar
www.geocities.com/waqas.ali


63
STP selects one designated port per segment to Iorward traIIic. Other switch
ports on the segment become non designated ports and continue blocking. The switch port on the
segment
with the lowest path cost to the root bridge is elected as the designated port. II multiple switch
ports on a switch have the same path cost and are connecting to the same neighbor switch, then
the switch port with the lowest sender port ID becomes the designated port.

Because ports on the root bridge all have a root path cost oI zero so all ports on the root bridge
are designated ports.





A # show spanning-tree



Note: Switch-A has become Root Bridge Ior VLAN 1. InterIace Fa0/1
oI Switch-A is in listening state as is needs 50 sec to go in Iorwarding state
Irom blocking state.







Waqas Ali Zarar
www.geocities.com/waqas.ali


64

A # show spanning-tree



Note: AIter 50 sec InterIace Fa0/1 oI Switch-A is in Iorwarding state.

































Waqas Ali Zarar
www.geocities.com/waqas.ali


6S

B# show spanning-tree



Note: According to the output oI spanning tree on Switch-A & Switch-B we can
conclude that:

Switch-A is the Root Bridge.
InterIaces Fa0/1 & Fa0/2 oI Switch-A are in Designated state.
Port Fa0/1 oI Switch-B is Root port as its port number is smaller
Port Fa0/2 oI Switch-B is in Blocking State.


























Waqas Ali Zarar
www.geocities.com/waqas.ali


66

Part 6




Configuration on Router

Router (conIig) # interIace Iastethernet 0/0
Router (conIig-iI) # ip address 1.1.1.1 255.0.0.0
Router (conIig-iI) # no shutdown

Configuration on TFTP Server

Run TFTP service on your PC it will start providing TFTP services. Now simply assign IP
address to TFTP server as shown in Iig.










Waqas Ali Zarar
www.geocities.com/waqas.ali


67

VeriIying Connectivity b/w Router and TFTP Server!!!

Router # ping 1.1.1.10

Router # show Ilash


Router # copy Ilash tItp



Note: IOS oI Router has been copied to TFTP server.







Waqas Ali Zarar
www.geocities.com/waqas.ali


68




Router # copy tItp Ilash



Router # show Ilash


Note: Router has now two IOS in its Flash. (i.e; Dual Booted)














Waqas Ali Zarar
www.geocities.com/waqas.ali


69



Router (conIig) # boot system Ilash cisco-2600
Router # write
Router # reload

Note: AIter reloading Router will boot Irom cisco-2600

Router # show version






















Waqas Ali Zarar
www.geocities.com/waqas.ali


70

Part 7



Step 1:

Boot the router and interrupt the boot sequence as soon as text appears on the screen.

Step 2:

Change the conIiguration register to ignore contents oI NVRAM.
> o/r 0x2142

Step 3:

Reload the router.
> i

Step 4:

Enter privileged mode. (Do not enter setup mode.)
Router ~ enable

Step 5:

Change the password.
Router # conIigure terminal
Router (conIig) # enable secret new

Step 6:

Reset the conIiguration register back to its deIault value.
Router (conIig) # conIig-register 0x2102

Step 7:

Save the conIiguration.
Router # copy run start


Step 8:
VeriIy the conIiguration register.







Waqas Ali Zarar
www.geocities.com/waqas.ali


71

Router # show version

Step 9:

Reload the Router
Router # reload













































Waqas Ali Zarar
www.geocities.com/waqas.ali


72

Part 8








Define Standard Access List on Router-B

B (conIig) # access-list 1 deny host 1.1.1.1
B (conIig) # access-list 1 permit any

Apply Standard Access List:

B (conIig) # interIace s 1/0
B (conIig-iI) # ip access-group 1 in

Now try to ping Router-B from Router-A
A # ping 1.1.1.2

Note: You are not able to ping Router-B Irom Router-A











Waqas Ali Zarar
www.geocities.com/waqas.ali


73

Now try to Telnet Router-B from Router-A

A # telnet 1.1.1.2



Note: You are not able to telnet Router-B Irom Router-A
Standard Access List blocked every type oI traIIic




Define Standard Access List on Router-B

B (conIig) # access-list 1 deny 1.1.1.1 0.0.0.0 (where 0.0.0.0 is source wildcard mask)
B (conIig) # access-list 1 permit any

Apply Standard Access List:

B (conIig) # interIace s 1/0
B (conIig-iI) # ip access-group 1 in

Now try to ping Router-B from Router-A
A # ping 1.1.1.2

Note: You are not able to ping Router-B Irom Router-A








Wildcard mask







Waqas Ali Zarar
www.geocities.com/waqas.ali


74









Define Standard Access List on Router-B

B (conIig) # access-list 101 deny tcp host 1.1.1.1host 1.1.1.2 eq telnet
B (conIig) # access-list 101permit ip any any

Apply Standard Access List:

B (conIig) # interIace s 1/0
B (conIig-iI) # ip access-group 101 in

Now try to ping Router-B from Router-A
A # ping 1.1.1.2



Note: ping Irom Router-A to Router-B is successIul
As we only deny telnet In Extended Access List.









Waqas Ali Zarar
www.geocities.com/waqas.ali


7S

Now try to Telnet Router-B from Router-A

A # telnet 1.1.1.2



Note: You are not able to telnet Router-B Irom Router-A
Extended Access List can block a speciIic traIIic.



Define Standard Access List on Router-B

B (conIig) # access-list 101 deny icmp 1.1.1.1 0.0.0.0 1.1.1.2 0.0.0.0 echo
B (conIig) # access-list 101 permit ip any any

Apply Standard Access List:

B (conIig) # interIace s 1/0
B (conIig-iI) # ip access-group 101 in


Now try to ping Router-B from Router-A
A # ping 1.1.1.2



Note: You are not able to ping Router-B Irom Router-A
As we deny icmp packets on Router-B






Wildcard mask







Waqas Ali Zarar
www.geocities.com/waqas.ali


76

Now try to Telnet Router-B from PC

Telnet Router-B Irom PC attached with Router-A




Note: Telnet is successIul as we deny only ICMP traIIic
by Extended Access List































Waqas Ali Zarar
www.geocities.com/waqas.ali


77

Part 9







One Private to One Permanent Public Address Translation


Enable the inside NAT on Router-Corvit

Corvit (conIig) # int Fa 0/0
Corvit (conIig-iI) # ip nat inside

Enable the outside NAT on Router-Corvit

Corvit (conIig) # int S 1/0
Corvit (conIig-iI) # ip nat outside

Configure the static Nat on Router-Corvit

Corvit (conIig) # ip nat inside source static 10.0.0.1 11.1.1.1
Corvit (conIig) # ip nat inside source static 10.0.0.2 11.1.1.2













Waqas Ali Zarar
www.geocities.com/waqas.ali


78

Corvit # show ip nat translations



Corvit # debug ip nat

IP NAT debugging is on

Verification:-

Go to PC 10.0.0.1 and Ping 20.0.0.1



Note: Debugging result shows that ip address 10.0.0.1
is translated into 11.1.1.1

Go to PC 10.0.0.2 and Ping 20.0.0.1



Note: Debugging result shows that ip address 10.0.0.2
is translated into 11.1.1.2


















Waqas Ali Zarar
www.geocities.com/waqas.ali


79






One Private to One Public Address Translation


The task oI this Lab is to conIigure a Dynamic Nat

1. Enable Nat on interface
2. Define a Pool of public Addresses
3. Access-list
4. Dynamic Source Translation

Enable the inside NAT on Router-Corvit

Corvit (conIig) # int Fa 0/0
Corvit (conIig-iI) # ip nat inside

Enable the outside NAT on Router-Corvit

Corvit (conIig) # int S 1/0
Corvit (conIig-iI) # ip nat outside

Define Access List on Router-Corvit

Corvit (conIig) # access-list 1 permit 10.0.0.1 0.0.0.0
Corvit (conIig) # access-list 1 permit 10.0.0.2 0.0.0.0

Define Pool of Public IPs on Router-Corvit

Corvit (conIig) # ip nat pool corvit 11.1.1.1 11.1.1.2 preIix-length 8







Waqas Ali Zarar
www.geocities.com/waqas.ali


80

Call Access List into Public IPs Pool on Router-Corvit

Corvit (conIig) # ip nat inside source list 1 pool corvit

Corvit # debug ip nat

IP NAT debugging is on

Verification:-

Go to PC 10.0.0.1 and Ping 20.0.0.1



Note: Debugging result shows that ip address 10.0.0.1
is translated into 11.1.1.1

Go to PC 10.0.0.2 and Ping 20.0.0.1



Note: Debugging result shows that ip address 10.0.0.2
is translated into 11.1.1.2

Corvit # show ip nat translations













Waqas Ali Zarar
www.geocities.com/waqas.ali


81







The task oI this Lab is to conIigure a Dynamic Nat

1. Enable Nat on interface
2. Define a Pool of public Addresses
3. Access-list
4. Dynamic Source Translation using PAT

Enable the inside NAT on Router-Corvit

Corvit (conIig) # int Fa 0/0
Corvit (conIig-iI) # ip nat inside

Enable the outside NAT on Router-Corvit

Corvit (conIig) # int S 1/0
Corvit (conIig-iI) # ip nat outside

Define Access List on Router-Corvit

Corvit (conIig) # access-list 1 permit 10.0.0.1 0.0.0.0
Corvit (conIig) # access-list 1 permit 10.0.0.2 0.0.0.0

Define Pool of Public IPs on Router-Corvit

Corvit (conIig) # ip nat pool corvit 11.1.1.1 11.1.1.2 netmask 8







Waqas Ali Zarar
www.geocities.com/waqas.ali


82

Call Access List into Public IPs Pool on Router-Corvit

Corvit (conIig) # ip nat inside source list 1 pool corvit

Corvit # debug ip nat
IP NAT debugging is on

Verification:-

Go to PC 10.0.0.1 and Ping 20.0.0.1



Note: Debugging result shows that ip address 10.0.0.1
is translated into 11.1.1.1

Go to PC 10.0.0.2 and Ping 20.0.0.1



Note: Debugging result shows that ip address 10.0.0.2
is translated into 11.1.1.1

Corvit # show ip nat translations



Note: NAT table shows that both private address are translated
Into 1 public address with dynamic port numbers







Waqas Ali Zarar
www.geocities.com/waqas.ali


83

Part 10



Configuration of POTS on Router-LHR

LHR (conIig) # dial-peer voice 1 POTS
LHR (conIig-dial-peer) # destination-pattern 101
LHRt (conIig-dial-peer) # port 1/0/0

Configuration of VOIP on Router-LHR

LHR (conIig) # dial-peer voice 1 VOIP
LHR(conIig-dial-peer) # destination-pattern 201
LHR (conIig-dial-peer) # session target ipv4:1.1.1.2

Configuration of POTS on Router-KHI

KHI (conIig) # dial-peer voice 1 POTS
KHI (conIig-dial-peer) # destination-pattern 201
KHI (conIig-dial-peer) # port 1/0/0

Configuration of VOIP on Router-LHR

KHI (conIig) # dial-peer voice 1 VOIP
KHI (conIig-dial-peer) # destination-pattern 101
KHI (conIig-dial-peer) # session target ipv4:1.1.1.1

Note: Now dial 201 Irom Router-LHR to call Router-KHI









Waqas Ali Zarar
www.geocities.com/waqas.ali


84

Part 11






Configuration on Router-LHR

LHR (conIig) # int s 1/0
LHR (conIig-iI) # ip address 1.1.1.1 255.0.0.0
LHR (conIig-iI) # encapsulation Irame-relay
LHR (conIig-iI) # Irame-relay lmi-type ansi
LHR (conIig-iI) # Irame-relay map ip 1.1.1.2 102


Configuration on Router-KHI

KHI (conIig) # int s 1/1
KHI (conIig-iI) # ip address 1.1.1.2 255.0.0.0
KHI (conIig-iI) # encapsulation Irame-relay
KHI (conIig-iI) # Irame-relay lmi-type ansi
KHI (conIig-iI) # Irame-relay map ip 1.1.1.1 201

















Waqas Ali Zarar
www.geocities.com/waqas.ali


8S

Configuration on Frame Relay Switch

FR (conIig) # Irame-relay switching
FR (conIig) # int s 1/0
FR (conIig-iI) # no ip address
FR (conIig-iI) # encapsulation Irame-relay
FR (conIig-iI) # Irame-relay lmi-type ansi
FR (conIig-iI) # Irame-relay intI-type dce
FR (conIig-iI) # clock rate 64000
FR (conIig-iI) # Irame-relay route 102 interIace serial 1/1 201
FR (conIig-iI) # exit

FR (conIig) # int s 1/1
FR (conIig-iI) # no ip address
FR (conIig-iI) # encapsulation Irame-relay
FR (conIig-iI) # Irame-relay lmi-type ansi
FR (conIig-iI) # Irame-relay intI-type dce
FR (conIig-iI) # clock rate 64000
FR (conIig-iI) # Irame-relay route 201 interIace serial 1/0 102

Note: Now ping 1.1.1.2 Irom 1.1.1.1. The ping will be successIul as
both routers are directly connected