I bought 2 EX4200 from eBay and wanted to do virtual-chassis. Here are some things I learned:
1. The 2 switches came with different Software version 10 and 12.
2. Had to buy the vcp cable for virtual chassis.
3. Had to connect the cable in the back vcp-0 to vcp-0 and vcp-1 to vcp-1 to make a ring, else wouldn't work. You'll see a status of "NotPrsnt."
4. Both switches need to be on the same software, so this is what I did:
I had to downgrade the new switch to 10.4R5.5 – the simplest and safest way to do this is with the switch in standalone and put the image on a USB Key and plug in back of EX4200.
Here are the steps:
a. Download your image from Juniper.net and put in the root of a FAT32 formatted USB Key in your laptop/
b. Insert the USB key into the back of the EX4200 and boot the switch if Needed.
Then mount the usb key
root@:RE:0% mount_msdosfs /dev/da1s1 /mnt
Once the USB has been mounted you can run the request system software add command. This command installs any software version you specified...upgrade or downgrade.
root> request system software add /mnt/jinstall-ex-4200-10.4R5.5-domestic-signed.tgz
You now have to be patient as this process takes a few minutes, once the image has been loaded you will be asked to reboot.
Checking pending install on fpc0
Validating on fpc0
Done with validate on all virtual chassis members
fpc0:
WARNING: A reboot is required to install the software
WARNING: Use the ‘request system reboot’ command immediately
root@:RE:0% cli
{master:0}
root> request system reboot
Reboot the system ? [yes,no] (no) yes
*** FINAL System shutdown message from root@ ***
System going down IMMEDIATELY
Once the switch has rebooted a show version will show the switch is now running the 10 or any Image you had installed.
root> show version
3/16/2015
BGP LAB 1: BGP Access List Filtering and Answer
2 routers connected with eBGP. Want to filter some routes (10.x.x.x) from the neighbor router using Extended Access List.
Goal:
Config like diagram.
Configure EBGP between router Tristram and Sanctuary.
Advertise the loopback interfaces on both routers in BGP.
Configure a summary that advertises 10.0.0.0/8 towards router Sanctuary.
Configure an extended access-list on router Sanctuary that will block the 10.0.0.0/8 prefix but allows all other prefixes.
Configure an extended access-list on router Tristram that blocks network 10.2.2.0/24.
Answer:
Tristram Router:
router bgp 1
no synchronization
bgp log-neighbor-changes
network 1.1.1.1 mask 255.255.255.255
network 10.0.0.0 === Advertise the 10.x network, then need the summary-only next statement.
aggregate-address 10.0.0.0 255.0.0.0 summary-only === This is to summarize the 10.x.
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 distribute-list 100 in ===Deny the ACL 100 from coming in.
access-list 100 deny ip 10.0.0.0 0.255.255.255 any === Deny the 10.x network.
access-list 100 permit ip any any
Sanctuary Router:
router bgp 2
no synchronization
bgp log-neighbor-changes
network 2.2.2.2 mask 255.255.255.255
network 10.2.2.0 mask 255.255.255.0
aggregate-address 10.0.0.0 255.0.0.0 summary-only
neighbor 192.168.12.1 remote-as 1
neighbor 192.168.12.1 soft-reconfiguration inbound
neighbor 192.168.12.1 distribute-list 100 in
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
sh ip bgp nei 192.168.12.1 received-routes
sh ip route
====================================
Note: I got this from gns3vault.com, but I posted my answer for my own reference.
Goal:
Config like diagram.
Configure EBGP between router Tristram and Sanctuary.
Advertise the loopback interfaces on both routers in BGP.
Configure a summary that advertises 10.0.0.0/8 towards router Sanctuary.
Configure an extended access-list on router Sanctuary that will block the 10.0.0.0/8 prefix but allows all other prefixes.
Configure an extended access-list on router Tristram that blocks network 10.2.2.0/24.
Answer:
Tristram Router:
router bgp 1
no synchronization
bgp log-neighbor-changes
network 1.1.1.1 mask 255.255.255.255
network 10.0.0.0 === Advertise the 10.x network, then need the summary-only next statement.
aggregate-address 10.0.0.0 255.0.0.0 summary-only === This is to summarize the 10.x.
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 distribute-list 100 in ===Deny the ACL 100 from coming in.
access-list 100 deny ip 10.0.0.0 0.255.255.255 any === Deny the 10.x network.
access-list 100 permit ip any any
Sanctuary Router:
router bgp 2
no synchronization
bgp log-neighbor-changes
network 2.2.2.2 mask 255.255.255.255
network 10.2.2.0 mask 255.255.255.0
aggregate-address 10.0.0.0 255.0.0.0 summary-only
neighbor 192.168.12.1 remote-as 1
neighbor 192.168.12.1 soft-reconfiguration inbound
neighbor 192.168.12.1 distribute-list 100 in
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
sh ip bgp nei 192.168.12.1 received-routes
sh ip route
====================================
Note: I got this from gns3vault.com, but I posted my answer for my own reference.
3/04/2015
How to Secure Your Network
This is a precursor to my new post on how to secure your network from the outside.
Securing networks from the outside in is quite easy. All you need is to buy an appliance device, either a hardware device or software device to do the job.
But how does one decide with vendor to get, Cisco ASA, Juniper, or others, like the NextGen Firewall and UTM.
I will tell you that we decided to get rid of our Cisco ASA FW and Content filtering, with Sophos UTM. And it has worked wonderfully. NO SPAM, Virus, Web filtering, stopping outside threat coming in, etc.
On my next post I will tell you why.
Securing networks from the outside in is quite easy. All you need is to buy an appliance device, either a hardware device or software device to do the job.
But how does one decide with vendor to get, Cisco ASA, Juniper, or others, like the NextGen Firewall and UTM.
I will tell you that we decided to get rid of our Cisco ASA FW and Content filtering, with Sophos UTM. And it has worked wonderfully. NO SPAM, Virus, Web filtering, stopping outside threat coming in, etc.
On my next post I will tell you why.
Cisco to Juniper (Junos) Redistributing EIGRP to OSPF
In my previous post,
A problem comes up when you're redistributing from EIGRP to OSPF with external routes, ie. external EIGRP.
This is when you use the redistribute command in EIGRP, which gives AD of 170. To solve this, you'll need to add:
distance ospf external 171
in the router ospf 1 process. Do a "show ip route ospf" in the core router that does the EIGRP/OSPF redistribution to see the difference.
To simulate:
Router 4 / router 6 / other normal router:
router eigrp 2
network 172.17.39.0 0.0.0.3
redistribute connected
redistribute static === The redistribute command will have the AD of 170 (external EIGRP). Internal EIGRP is 90 with the "network" command.
Router 2: == This is the router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.34.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Router 3: == The core router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 3.3.3.3
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.35.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Both R2 and R3# sh ip ro os === WILL SHOW THE SAME OSPF route to the OSPF domain.
Gateway of last resort is 172.17.32.1 to network 0.0.0.0
192.168.60.0/32 is subnetted, 1 subnets
O 192.168.60.1 [110/3] via 172.17.34.1, 2d01h, FastEthernet1/0
R2#
Redistribute EIGRP and OSPF / Route Tagging
I talked about route tagging, but it works only for internal routes redistributing from EIGRP to OSPF.A problem comes up when you're redistributing from EIGRP to OSPF with external routes, ie. external EIGRP.
This is when you use the redistribute command in EIGRP, which gives AD of 170. To solve this, you'll need to add:
distance ospf external 171
in the router ospf 1 process. Do a "show ip route ospf" in the core router that does the EIGRP/OSPF redistribution to see the difference.
To simulate:
Router 4 / router 6 / other normal router:
router eigrp 2
network 172.17.39.0 0.0.0.3
redistribute connected
redistribute static === The redistribute command will have the AD of 170 (external EIGRP). Internal EIGRP is 90 with the "network" command.
Router 2: == This is the router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.34.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Router 3: == The core router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 3.3.3.3
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.35.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Both R2 and R3# sh ip ro os === WILL SHOW THE SAME OSPF route to the OSPF domain.
Gateway of last resort is 172.17.32.1 to network 0.0.0.0
192.168.60.0/32 is subnetted, 1 subnets
O 192.168.60.1 [110/3] via 172.17.34.1, 2d01h, FastEthernet1/0
R2#
2/10/2015
BGP Load Balancing
BGP Load Balancing
In order to do BGP load balancing, the route selection must be the same up to 5.5. I had thought it was at 8.5, but after testing, it's at 5.5.
1 Weight
2 Local pref
3 Self-originated next hop = 0.0.0.0)
4 AS Path
5 Origin i, then, e, then, ?
5.5 --note: When "bgp bestpath as-path multipath-relax" is used, it's actually at this point it will load balance when above 3 are the same. Not anything else below. Any else below don't matter. If above 5 are the same for that route, it will load balance when do a "show ip route" will see 2 routes there.
6 Med (metric)
7 external ebgp over igp
8 IGP cost
8.5 --Max Path Checks -- If all above are the same for a route with multiexit points, will load balance. Put in routing table. Will see 2 routes in "sh ip ro", then you know it's load balanced.
R1(config)#
router bgp 100
maximum-paths 2
bgp bestpath as-path multipath-relax (A hidden Command).
9 Ebgp peering -older routes better
10 rid lower
R1#sh run | s bgp
router bgp 1
no synchronization
bgp log-neighbor-changes
bgp bestpath as-path multipath-relax
network 1.1.1.1 mask 255.255.255.255
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 soft-reconfiguration inbound
neighbor 192.168.12.2 route-map SET-MED-ASPATH in
neighbor 192.168.13.3 remote-as 3
neighbor 192.168.13.3 route-map SET-ORIGIN-IGP in
maximum-paths 2
no auto-summary
=====
R1#sh ip bgp
m multipath,
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.1/32 0.0.0.0 0 32768 i
*m 5.5.5.5/32 192.168.12.2 999 0 2 2 5 i
*> 192.168.13.3 3 0 3 4 5 i
R1#
R1#sh ip route
Gateway of last resort is not set
1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
5.0.0.0/32 is subnetted, 1 subnets
B 5.5.5.5 [20/999] via 192.168.13.3, 03:14:22
[20/999] via 192.168.12.2, 03:14:22
192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.12.0/24 is directly connected, FastEthernet0/1
L 192.168.12.1/32 is directly connected, FastEthernet0/1
192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.13.0/24 is directly connected, FastEthernet0/0
L 192.168.13.1/32 is directly connected, FastEthernet0/0
R1#
From R1, you want to BGP load balance out to R2, R3.
In order to do BGP load balancing, the route selection must be the same up to 5.5. I had thought it was at 8.5, but after testing, it's at 5.5.
1 Weight
2 Local pref
3 Self-originated next hop = 0.0.0.0)
4 AS Path
5 Origin i, then, e, then, ?
5.5 --note: When "bgp bestpath as-path multipath-relax" is used, it's actually at this point it will load balance when above 3 are the same. Not anything else below. Any else below don't matter. If above 5 are the same for that route, it will load balance when do a "show ip route" will see 2 routes there.
6 Med (metric)
7 external ebgp over igp
8 IGP cost
8.5 --Max Path Checks -- If all above are the same for a route with multiexit points, will load balance. Put in routing table. Will see 2 routes in "sh ip ro", then you know it's load balanced.
R1(config)#
router bgp 100
maximum-paths 2
bgp bestpath as-path multipath-relax (A hidden Command).
9 Ebgp peering -older routes better
10 rid lower
R1#sh run | s bgp
router bgp 1
no synchronization
bgp log-neighbor-changes
bgp bestpath as-path multipath-relax
network 1.1.1.1 mask 255.255.255.255
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 soft-reconfiguration inbound
neighbor 192.168.12.2 route-map SET-MED-ASPATH in
neighbor 192.168.13.3 remote-as 3
neighbor 192.168.13.3 route-map SET-ORIGIN-IGP in
maximum-paths 2
no auto-summary
=====
R1#sh ip bgp
m multipath,
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.1/32 0.0.0.0 0 32768 i
*m 5.5.5.5/32 192.168.12.2 999 0 2 2 5 i
*> 192.168.13.3 3 0 3 4 5 i
R1#
R1#sh ip route
Gateway of last resort is not set
1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
5.0.0.0/32 is subnetted, 1 subnets
B 5.5.5.5 [20/999] via 192.168.13.3, 03:14:22
[20/999] via 192.168.12.2, 03:14:22
192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.12.0/24 is directly connected, FastEthernet0/1
L 192.168.12.1/32 is directly connected, FastEthernet0/1
192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.13.0/24 is directly connected, FastEthernet0/0
L 192.168.13.1/32 is directly connected, FastEthernet0/0
R1#
10/15/2014
Redistribute EIGRP and OSPF / Route Tagging
In route redistribution, the router process asks this question first:
Ask this question:
1. Does the route exist in my router process that it will redistribute into?
No, then Redistribute the route.
Yes, then Go TO 2.
2. If so, Does the route have a better AD?
NO, then Don't redistribute the route.
YES, then Redistribute the route.
Example:
So, change the external EIGRP route from default 170 to 171 when redistribute into OSPF.
170 = is AD for External EIGRP routes.
171 = in this example, we use 171 for external OSPF route to stop the routing loops, but when you shutdown the interface with the injected route, the route updated LSAs still goes in circle.
R2(config)#
router eigrp 10
redistribute ospf 1
network x.x.x.x 0.0.0.255
default-metric 100000 0 255 1 1500
no-auto
router ospf 1
redistribute eigrp 10 subnets
distance ospf external 171 ==== only locally significant.
Use route tagging is better.
Route Tagging:
Most situation, you don't need route tags, since the above 2 questions hold. But in situations where you have external routes coming into your domain, then you'll need route tagging.
STEPS:
route-map OSPF-TO-EIGRP deny 10
match tag 170
route-map OSPF-TO-EIGRP PERMIT 20
SET tag 110
route-map EIGRP-TO-OSPF DENY 10
match tag 110
route-map EIGRP-TO-OSPF permit 20
set tag 170
R2:
conf t
router eigrp 10
network 10.1.12.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ===
!
router ospf 1
log-adjacency-changes
redistribute eigrp 10 subnets route-map EIGRP-TO-OSPF ======
network 10.1.22.0 0.0.0.3 area 0.0.0.0
R3:
conf t
router eigrp 10
network 10.1.13.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ====
!
router ospf 1
log-adjacency-changes
redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF ==========
network 10.1.23.0 0.0.0.3 area 0.0.0.0
DONE.
TEST:
R4-EIGRP-ROUTER# sh ip ro 192.168.1.1
Routing entry for 192.168.1.1/32
Known via "eigrp 100", distance 170, metric 28416
Tag 110, type external
Redistributing via eigrp 100
Last update from 10.1.12.2 on FastEthernet1/0, 00:38:36 ago
Routing Descriptor Blocks:
* 10.1.13.2, from 10.1.13.2, 00:38:36 ago, via FastEthernet1/1
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
10.1.12.2, from 10.1.12.2, 00:38:36 ago, via FastEthernet1/0
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
R1-OSPF-ROUTER# sh ip ro 172.16.1.1
Routing entry for 172.16.1.0/24
Known via "ospf 1", distance 110, metric 20
Tag 170, type extern 2, forward metric 1
Last update from 10.1.22.2 on FastEthernet1/0, 00:40:31 ago
Routing Descriptor Blocks:
* 10.1.23.2, from 10.1.23.2, 00:48:47 ago, via FastEthernet1/1
Route metric is 20, traffic share count is 1
Route tag 170
10.1.22.2, from 10.1.22.2, 00:40:31 ago, via FastEthernet1/0
Route metric is 20, traffic share count is 1
Route tag 170
Ask this question:
1. Does the route exist in my router process that it will redistribute into?
No, then Redistribute the route.
Yes, then Go TO 2.
2. If so, Does the route have a better AD?
NO, then Don't redistribute the route.
YES, then Redistribute the route.
Example:
So, change the external EIGRP route from default 170 to 171 when redistribute into OSPF.
170 = is AD for External EIGRP routes.
171 = in this example, we use 171 for external OSPF route to stop the routing loops, but when you shutdown the interface with the injected route, the route updated LSAs still goes in circle.
R2(config)#
router eigrp 10
redistribute ospf 1
network x.x.x.x 0.0.0.255
default-metric 100000 0 255 1 1500
no-auto
router ospf 1
redistribute eigrp 10 subnets
distance ospf external 171 ==== only locally significant.
Use route tagging is better.
Route Tagging:
Most situation, you don't need route tags, since the above 2 questions hold. But in situations where you have external routes coming into your domain, then you'll need route tagging.
STEPS:
route-map OSPF-TO-EIGRP deny 10
match tag 170
route-map OSPF-TO-EIGRP PERMIT 20
SET tag 110
route-map EIGRP-TO-OSPF DENY 10
match tag 110
route-map EIGRP-TO-OSPF permit 20
set tag 170
R2:
conf t
router eigrp 10
network 10.1.12.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ===
!
router ospf 1
log-adjacency-changes
redistribute eigrp 10 subnets route-map EIGRP-TO-OSPF ======
network 10.1.22.0 0.0.0.3 area 0.0.0.0
R3:
conf t
router eigrp 10
network 10.1.13.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ====
!
router ospf 1
log-adjacency-changes
redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF ==========
network 10.1.23.0 0.0.0.3 area 0.0.0.0
DONE.
TEST:
R4-EIGRP-ROUTER# sh ip ro 192.168.1.1
Routing entry for 192.168.1.1/32
Known via "eigrp 100", distance 170, metric 28416
Tag 110, type external
Redistributing via eigrp 100
Last update from 10.1.12.2 on FastEthernet1/0, 00:38:36 ago
Routing Descriptor Blocks:
* 10.1.13.2, from 10.1.13.2, 00:38:36 ago, via FastEthernet1/1
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
10.1.12.2, from 10.1.12.2, 00:38:36 ago, via FastEthernet1/0
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
R1-OSPF-ROUTER# sh ip ro 172.16.1.1
Routing entry for 172.16.1.0/24
Known via "ospf 1", distance 110, metric 20
Tag 170, type extern 2, forward metric 1
Last update from 10.1.22.2 on FastEthernet1/0, 00:40:31 ago
Routing Descriptor Blocks:
* 10.1.23.2, from 10.1.23.2, 00:48:47 ago, via FastEthernet1/1
Route metric is 20, traffic share count is 1
Route tag 170
10.1.22.2, from 10.1.22.2, 00:40:31 ago, via FastEthernet1/0
Route metric is 20, traffic share count is 1
Route tag 170
10/08/2014
Block RFC 1918 and Others Coming In Your Network
If you're an enterprise, chances are your ISP may have already blocked some or all private addresses from the internet.
But you should also block the IP subnets assigned to you by your ISP, if you see that IP coming in, then somone is spoofing your IP.
For security, it's best to block all RFC 1918 and you many want to block others as well.
Below is what I use:
access-list 199 deny ip 10.0.0.0 0.255.255.255 any
access-list 199 deny ip 127.0.0.0 0.255.255.255 any
access-list 199 deny ip 172.16.0.0 0.15.255.255 any
access-list 199 deny ip 169.254.0.0 0.0.255.255 any
access-list 199 deny ip 192.0.2.0 0.0.0.255 any
access-list 199 deny ip 192.168.0.0 0.0.255.255 any
access-list 199 deny ip 224.0.0.0 0.0.0.255 any
access-list 199 deny ip 239.0.0.0 0.255.255.255 any
access-list 199 deny ip host 255.255.255.255 any
access-list 199 deny ip YOUR-SUBNET-HERE 0.0.0.31 any --- This should be the IP Subnet assigned to you by your ISP. You don't want to see the originator's IP is your own IP.
access-list 199 permit ip any any --- This permits everything else.
Now apply this access list to the interface facing or connecting to your ISP.
interface Serial0/1/0
ip address 29.6.11.261 255.255.255.252
ip access-group 199 in
ip nbar protocol-discovery
ip flow ingress
ip flow egress
no cdp enable
You want to apply the access-list 199 to inbound traffic.
Done.
But you should also block the IP subnets assigned to you by your ISP, if you see that IP coming in, then somone is spoofing your IP.
For security, it's best to block all RFC 1918 and you many want to block others as well.
Below is what I use:
access-list 199 deny ip 10.0.0.0 0.255.255.255 any
access-list 199 deny ip 127.0.0.0 0.255.255.255 any
access-list 199 deny ip 172.16.0.0 0.15.255.255 any
access-list 199 deny ip 169.254.0.0 0.0.255.255 any
access-list 199 deny ip 192.0.2.0 0.0.0.255 any
access-list 199 deny ip 192.168.0.0 0.0.255.255 any
access-list 199 deny ip 224.0.0.0 0.0.0.255 any
access-list 199 deny ip 239.0.0.0 0.255.255.255 any
access-list 199 deny ip host 255.255.255.255 any
access-list 199 deny ip YOUR-SUBNET-HERE 0.0.0.31 any --- This should be the IP Subnet assigned to you by your ISP. You don't want to see the originator's IP is your own IP.
access-list 199 permit ip any any --- This permits everything else.
Now apply this access list to the interface facing or connecting to your ISP.
interface Serial0/1/0
ip address 29.6.11.261 255.255.255.252
ip access-group 199 in
ip nbar protocol-discovery
ip flow ingress
ip flow egress
no cdp enable
You want to apply the access-list 199 to inbound traffic.
Done.
Subscribe to:
Posts (Atom)