Here is another tutorial running Cisco ASAv on GNS3 using Qemu.

For Configure GNS3

In My case I have used ASAv952-204.qcow2

Go to the GNS3>Edit>Preferences>QEMU>Qemu VMs>New
Follow on screen procedure. 

Don't forget to enable kvm and memory allocation. 



Now you can see I can run ASAv 9.5.2

Blank Password.

This time lets have tutorial on Cisco XR 9k series router image running on the GNS3. Please don't ask for the XR image. Your are smart enough to get it.

My system configuration:

Ubuntu 16.04
GNS3 1.4
RAM 8Gig
i7 processor

Used XR Image
iosxrv-k9-demo-6.0.1.qcow2

This image is VIRL extracted image.

You need to convert this image into QEMU image, follow this link

I strongly recommend you to run it on the Linux system.

Now you have converted image, then go to the GNS3>Edit>Preferences>QEMU>Qemu VMs>New
then follow the onscreen procedure.

Setting for QEMU XR Image.

RAM:- 4Gig
CPU:- 1

Somebody ask me to run Cisco EPIC VPN lab test provide by the Cisco. I just try it done but Anyconnect client doesn't seems to work on ubuntu system. The error message was

sudo apt-get install lib32z1 lib32ncurses5

sudo apt-get install network-manager-openconnect

sudo systemctl daemon-reload

EoMPLS is point to point L2 VPN services which is used to transport all Ethernet frame received on particular Ethernet or VLAN,  its also called Any Transport over MPLS(ATOM) means this technology can connect like Frame-Relay, PPP, Ethernet,ATM etc.

IOS used
c7200-adventerprisek9-mz.151-4.M

Logical Topology

It's been a long time I'm away from blogging due to some R&D on the network with Juniper boxes. On this tutorial I'm going to configure very basic MPLS VPN configuration in GNS3. After that we go for EoMPLS configuration.

This is the logical topology for this tutorial.

Command:
interface fa0/2
switchchport mode access
switchport access vlan 30
switchport protected

Sometime I need to analyze network traffic from remote switch. Thus RSPAN is life saver. Go to the site and capturing the packets and analyze the packets is very time consuming. So here a small tutorial which explain how to configure packets with RSPAN.

SW1(This is the remote switch, Which is the source for our packets.)

sw1(config)#vlan 444
sw1(config-vlan)#remote-span
sw1(config)#monitor session 1 source interface Fa1/0/1 - 16
sw1(config)#monitor session 1 destination remote vlan 444



SW2(The destination switch where you going sniff the packets send my remote switch on case sw1.)
sw2(config)#vlan 444
sw2(config-vlan)#name RSPAN_VLAN
sw2(config-vlan)#remote-span

sw2(config)#monitor session 1 destination interface Gi0/17
sw2(config)#monitor session 1 source remote vlan 444

Now you can capture remote packets in port 17.

All these tutorial tested on cisco 3750 switch.

Step1:
Fist of all create tftp server in one of the updated IOS switch.
sw2(config)#tftp-server c2950-i6k2l2q4-mz.121-22.EA14.bin

Step2:
Then go to the remote switch where you want to upgrade IOS with new version.

sw1#copy tftp: flash:
Address or name of remote host [100.100.255.47]?
Source filename [100.100.255.47]? c2950-i6k2l2q4-mz.121-22.EA14.bin
Destination filename [c2950-i6k2l2q4-mz.121-22.EA14.bin]?
Accessing tftp://100.100.255.47/c2950-i6k2l2q4-mz.121-22.EA14.bin...
Loading c2950-i6k2l2q4-mz.121-22.EA14.bin from 100.100.255.47 (via Vlan2): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 3722814 bytes]

3722814 bytes copied in 143.124 secs (26011 bytes/sec)

Step3.
Check your copied IOS in the switch.

sw1(config)#do dir flash:
Directory of flash:/

    2  -rwx         864  Mar 01 1993 05:45:31 +05:45  vlan.dat
    3  -rwx       13499  Sep 23 2014 22:17:39 +05:45  config.text
    4  -rwx        1952  Sep 23 2014 22:17:39 +05:45  private-config.text
    5  -rwx     3722112  Mar 01 1993 07:33:24 +05:45  c2950-i6k2l2q4-mz.121-22.EA12
    6  -rwx        5871  Mar 01 1993 06:18:00 +05:45  sw1-config
    7  -rwx          43  Mar 01 1993 07:37:36 +05:45  env_vars
    8  -rwx     3722814  Sep 24 2014 12:30:41 +05:45  c2950-i6k2l2q4-mz.121-22.EA14.bin
  305  -rwx        5168  Mar 01 1993 08:37:25 +05:45  running-config1
  306  -rwx        1048  Sep 23 2014 22:17:39 +05:45  multiple-fs

7741440 bytes total (263680 bytes free)

Step5.
Verify the IOS if corrupted while copying form remote system to the destination system.

sw1#verify /md5 flash:c2950-i6k2l2q4-mz.121-22.EA14.bin
.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Done!
verify /md5 (flash:c2950-i6k2l2q4-mz.121-22.EA14.bin) = 8d3250ee253b81b7fe2762e281773fbc

Step6.
Now boot system

sw1(config)#boot system c2950-i6k2l2q4-mz.121-22.EA14.bin

Step7.
Write into the memory, otherwise your system may not boot from the new IOS or if you removed working IOS you system may not found any IOS.

sw1#wr memory
Building configuration...
[OK]

sw1#reload
System configuration has been modified. Save? [yes/no]: y
Building configuration...
[OK]

Step8.
Now check your system boot from new IOS

sw1#sh ver | inc image
System image file is "flash:/c2950-i6k2l2q4-mz.121-22.EA14"
Proceed with reload? [confirm]

How to recover extra space in 2950 switch.

In case you may have little space in switch, your new IOS have "3722814" size and switch only left "2220544" bytes free, in my case I don't need html file so I delete it form the switch.
sw1#dir flash:
Directory of flash:/

    2  -rwx     3722112  Apr 08 2013 11:13:12 +05:45  c2950-i6k2l2q4-mz.121-22.EA12
    3  -rwx         796  Mar 01 1993 05:45:28 +05:45  vlan.dat
    4  drwx        4224  Mar 14 2008 11:52:14 +05:45  html
   79  -rwx        1048  Sep 23 2014 17:05:12 +05:45  multiple-fs
   81  -rwx       12534  Sep 23 2014 17:05:12 +05:45  config.text
   83  -rwx        1958  Sep 23 2014 17:05:12 +05:45  private-config.text

7741440 bytes total (2220544 bytes free)

sw1#delete /f /r flash:html
Delete filename [html]? 

1. The following instructions appear:
  The system has been interrupted prior to initializing the
   flash filesystem.  The following commands will initialize
   the flash filesystem, and finish loading the operating
   system software:
       flash_init
       load_helper
       boot
   switch:

2. Now follow the following command

switch: flash_init
switch: dir flash
switch: rename flash:config.text flash:config.old
switch: boot

3. Enter "n" at the prompt to start the setup program

--- System Configuration Dialog ---
   At any point you may enter a question mark '?' for help.
   Use ctrl-c to abort configuration dialog at any prompt.
   Default settings are in square brackets '[]'.
   Continue with configuration dialog? [yes/no]: n

    !--- Press Return or Enter.
 
    Switch>
 
    !--- The Switch> prompt is displayed.

      switch>en
      switch#

4. Type rename flash:config.old flash:config.text to rename the configuration file with its original name.

    Switch#rename flash:config.old flash:config.text
                Destination filename [config.text]
    Switch#

5. Copy the configuration file into memory

       Switch#copy flash:config.text system:running-config

6. Change the password


      Switch#configure terminal
      Switch(config)#no enable secret
      Switch(config)#enable secret Cisco
      Switch(config)#end

7. Write the into the memory.

          Switch#write memory
                 Building configuration...
                 [OK]
        Switch#

To reset password of  2970 Switch, power off the switch and press MODE button then power it on, take a look at the SYS led when it glows green leave the mode button. To recover the password click here.

Now your are in switch: prompt mode.
switch: flash_init
switch: dir flash:

switch: delete flash:config.text
switch: delete  flash:vlan.dat

 

Recently I encounter Cisco switch 3750 reload puts it into switch: prompt. I try every possible troubleshoot but wherever switch reload its automatically boot to recovery mode.

This is happen because manually boot process is enable to yes.

test-sw4#sh boot
BOOT path-list:       flash:/c2950-i6k2l2q4-mz.121-22.EA12
Config file:          flash:/config.text
Private Config file:  flash:/private-config.text
Enable Break:         no
Manual Boot:          yes
*************Output Omitted****************

To set switch to boot automatically, we have to issue no boot command in global configuration mode.

test-sw4(config)#no boot manual ?
  <cr>
test-sw4(config)#no boot manual
test-sw4(config)#end
test-sw4#wr
Building configuration...
[OK]
test-sw4#

Verify the command.

test-sw4#sh boot
BOOT path-list:       flash:/c2950-i6k2l2q4-mz.121-22.EA12
Config file:          flash:/config.text
Private Config file:  flash:/private-config.text
Enable Break:         no
Manual Boot:          no
HELPER path-list:  
*****************Output Omitted****************

Other method
You can set it form the switch:prompt
Initial might be look like this. MANUAL_BOOT=yes

switch:setBOOT=flash:/c2950-i6k2l2q4-mz.121-22.EA12MANNUAL_BOOT=yesswtich:

switch:MANUAL_BOOT=no

In this lab we learn to configure access server. For this lab we are going to use Cisco 2511 router. Before configure the access server make sure you have connect console cable to the router and you can access the router.

Access_Server#sh ver
Cisco Internetwork Operating System Software
IOS (tm) 3000 Software (IGS-J-L), Version 11.0(18), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-1997 by cisco Systems, Inc.
Compiled Mon 01-Dec-97 17:59 by jaturner
Image text-base: 0x03034C58, data-base: 0x00001000

Access_Server uptime is 3 hours, 45 minutes
System restarted by power-on
System image file is "flash:igs-j-l.110-18", booted via flash

cisco 2511 (68030) processor (revision M) with 14336K/2048K bytes of memory.
Processor board ID 10355024, with hardware revision 00000000
Bridging software.
SuperLAT software copyright 1990 by Meridian Technology Corp).
 --More--

Command reference

hostname Access_Server
!
enable secret 5 (deleted)
!
username cisco privilege 15 password 7 (deleted)
!
interface Loopback0
 ip address 172.16.1.1 255.255.255.0
!
interface Ethernet0
 ip address 10.10.10.10 255.255.255.0
 !
interface Serial0
 no ip address
 shutdown
 no fair-queue
!
interface Serial1
 no ip address
 shutdown
!
ip host Sw1 2001 172.16.1.1
ip host Sw2 2002 172.16.1.1
ip host Sw3 2003 172.16.1.1
ip host Sw4 2004 172.16.1.1
ip route 0.0.0.0 0.0.0.0 10.10.10.1

line con 0
line 1 16
 transport input all
line aux 0
 transport preferred telnet
 transport input all
 rxspeed 38400
 txspeed 38400
 flowcontrol hardware
line vty 0 4
 no login

ip host: to mapped name-to-address of the static host
    ip host (name)[tcp-port-number][address]
transport input: define a input protocol on the async lines to Telnet
    transport input all

Verify the command

Access_Server>sh ip interface brief
Interface        IP-Address      OK?  Method    Status                 Protocol
Ethernet0        10.10.10.10  YES  manual    up                     up     
Loopback0        172.16.1.1      YES  manual    up                     up     
Serial0          unassigned      YES  not set   administratively down  down   
Serial1          unassigned      YES  not set   administratively down  down   

Access_Server#sh host
Default domain is not set
Name/address lookup uses domain service
Name servers are 255.255.255.255

Host                     Flags      Age Type   Address(es)
cust215-20.classic.com.np(temp, OK)  0   IP    49.236.215.20
Sw1                      (perm, OK)  0   IP    172.16.1.1
Sw2                      (perm, OK)  3   IP    172.16.1.1
Sw3                      (perm, OK)  3   IP    172.16.1.1
Sw4                      (perm, OK)  3   IP    172.16.1.1
Access_Server#

Troubleshoot:

 Access_Server#sw2
Trying Sw2 (172.16.1.1, 2002)...
% Connection refused by remote host

Access_Server#clear line tty 2
[confirm]
 [OK]
Access_Server#sw2            
Trying Sw2 (172.16.1.1, 2002)... Open

Amnesiac (ttyu0)

login:

Here is the procedure how to run your Cisco Router as DHCP server.
******output omitted ********

!
!
!
!
ip dhcp excluded-address 192.168.10.1
!
ip dhcp pool test
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.10.1 255.255.255.0

 IP>firewall>filter rules
chain=input action=drop protocol=udp in-interface=ether1-WAN dst-port=53
chain=input action=drop protocol=tcp in-interface=ether1-WAN dst-port=53

Same rule can be maintain for other router to block and disable resolver.

Please Note: in-interface should be your WAN port.

How to check your IP is used as open resolver

Linux command

#dig -t A jpudasaini.com.np @8.8.8.8

Note: Replace 8.8.8.8 with your IP address

You may think why we may need RSTP. Go back my previous blog post where I wrote how STP work and its port state. Now we are going to talk about RSTP. Lets learn about it and you may know why we need it.

Recall my previous theory, as we already know STP is created very long time ago and STP have below problem to converge the link.

1. Listening : 15s of listening for BPDUs. Switch sends/receives BPDUs on this state
2. Learning : 15s of Learning MAC Address, populate switch CAM table
3. Forwarding : Port is Forwarding Traffic
4. Blocking : Switch will wait up to 20s before moving a block port into listening phase, because this the time where switch wait if the primary link may came live.

STP port state take minimum 30s to maximum 50s to link up. This is the port process which have to pass every switch when boots up or converge time.

STP downtime is the biggest problem for todays Network.

STP have problems but also we have solution !

Port Fast :

Port fast disable Spanning Tree. When you type this command on an interface it will display warning message. Like this



Because it won't really detect the node mention in Warning message. Just enable the command and unplug the cable then plug back in use show command it’s immediately transition into forwarding state because now we have the port fast enable.

You can enable port fast all end node connected ports, that allow immediate active.

Switch(config)#int range fa0/2-24
swirch(config)#spanning-tree portfast
****output omitted****

On the other hand we have problem with uplink link. We can't enable portfast on the uplink ports, as you can see in warning message. 50s downtime cause big problem to our network. So there has to be other solution for this problem. Yes you already heard about it, RSTP. Rapid Spanning tree is very fast and very good. RSTP give us faster convergence, yes what we need. Think about VoIP, dropping one packet isn't tolerance for it. Other transfer like file transfer can be retransmitted. But voice can't be retransmitted. Real time transmitting must need, we don't have loss in the link.

Some of you still using uplink fast or backbone fast, that wouldn't going to work if you have different switch other than cisco. Those are cisco proprietary. So RSTP standard have availability to participate all vender switches. Which speed things up. RSTP is very good, you can see in your network.

 RSTP with its port state 

Discarding : Its replacement of blocking state of STP, we study before. It’s mean, taking down layer 2 connectivity not sending out any traffic.
Learning: Its mean exactly STP's learning state, it is the process to learn MAC address is on that port, without it switch just act like hub, its forward every packet to every port.
Forwarding: It’s also like STP port state, forwarding means not blocking any traffic.

Port roles

Root port : The way reaching to root bridge.
Designated port : All root bridge port are designated port. Other switch have lower priority or lower mac address elected as designated port. Other switch should be block the traffic.
Alternate port : Instead blocking state in STP, where all port should be re-elected and take 50s to downtime of network. RSTP remember that port with alternate port to reach Root Bridge. If root port failure, its immediately turn it into forwarding state. So it’s doesn't have to wait 50s.
Edge port : Port fast is edge port. Where non switch are connected or host. We can use port past command to tell switch it is edge port.

Why   RSTP is better

a. RSTP doesnt forget its port unlike STP which re-elected when primery link is down.

b. Its dosn't use extra time of STP like listening BPDUs, bonus blockig penalty,

c. If change into trunk port, that will flood to each network with TC packets, where TC is topology changes. Those are part of the BPDU's.

Per-VLAN Spanning Tree Concepts

Make sure that target router are running Cisco IOS Release 12.1(1)T image or later to support SSH.

Before continuing this task don't forget to change the hostname of the router

R1(config)#ip domain-name jpudasaini.com.np
R1(config)# crypto key generate rsa

The name for the keys will be: R1.jpudasaini.com.np
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus[512]: 768
% Generating 768 bit RSA keys, keys will be non-exportable...[ok]

R1(config)#ip ssh time-out 60
R1(config)#ip authentication-retries 3
R1(config)#username jayaram secret cisco
R1(config)#line vty 0 15
R1(config-line)#transport input ssh
R1(config-line)# exit

after this configuration you can login
R1#ssh -l {login with(login name)} -v [ssh version 1 or 2] [remote server name]