Jessica, getting excited thinking about using PCs as routers.

JK: So—you’re saying you’re free to date again? JS: Well, I would start dating, because I’m free and all….but I’ve discovered open-source routers. They’re so hot!!! I’ve been spending all my new-found free time with them! I can hardly tear myself away! I really find I don’t have any time now for anything that’s not connected to open-source networking in general. JK: Really? Wow. That’s interesting. Did I tell you I worked for a networking company myself? It’s called Vyatta. We do open-source routers.

JS: That’s amazing! I just started working with that software like a week ago! I just think it’s so cool that you can take normal PC hardware and turn it into a fabulous router. I mean, it’s just so great—like, I was upgrading the servers at, you know, my web site? And it’s like, suddenly I had a big pile of left-over hardware! Well, what am I supposed to do with that?? Suddenly they’re, like, all spilling out of my walk-in shoe closet, cause the space in my other closets was full.

JK: Wow. That sounds like a problem, all right. So what did you do?

JS: Well, originally, I was going to start learning, like, AJAX and Web 2.0, you know? But doing websites was just so dull. You know, I’m really a network girl at heart. So you can imagine how excited I got when I started thinking about using all that hardware as routers!

JK: Yes, I can see how exciting, that would be, all right. So, Jessica, why did you need a router?

JS: Well, with the divorce, you know, Nick gets all the furniture. Okay, I mean, that was the deal. But I didn’t know he was going to walk off with our Cisco 2610! I mean, who would expect that?? What a jerk. Especially since I’m the one with my CCNA. Nick was always a Juniper guy. I guess it just goes to show how you don’t know a person. Of course, I went ahead and got a T1 connection at my new place—I mean, it’s not like I’m helpless or something—but without my old Cisco, I’m sort of, well, stuck.

JK: Wow. Very upsetting.

JK: And these are just normal PC servers?

JS: Yep, that’s it! With open source you can take normal commodity Intel or AMD servers and turn them into basic routers very easily.

JS: Even so, it took me a little while to get the hang of it. At first I was plugging in my T1 line and it wasn’t working at all. Like I just couldn’t connect to the WAN, you know? But it turns out that I was plugging it into an Ethernet port, can you believe how silly?? –It’s just like the whole Chicken of the Sea thing: it’s not really chicken, it’s tuna. And a T1 isn’t really Ethernet, it’s a T1. See. It’s like totally different? Once I got a T1 card, it was all okay. I mean, I couldn’t get a pink T1 card, and I was bummed about that at first. But then I realized that the T1 card goes inside, so you can’t see it anyway. But still—there’s so much choice in hardware, who knew you couldn’t get a pink T1 card?

JK: That is surprising, all right. But in the end, you managed to get it going?

JS: Oh yeah, of course. And it was way cheaper than replacing the Cisco that stinky old Nick took. And it handles my traffic really well.

JK: Is that so?

JS: Well, most of the time I’m just downloading videos of me — Have you seen my newest one? — but yeah, it works great!

JK: How about software? Is there lots of choice there?

JS: Oh, lots. I started out using NetBSD, because I liked the little red BSD Daemon guy—so cute!! But then I saw that little penguin in that adorable tux!! I was a goner. I do think that penguins are cuter than daemons, don’t you?

JK: Er…

JS: Plus, they don’t have horns, so it’s easier to put darling little hats on them.

JK: Er… what about routing protocols? Did you find the routing protocols you needed?

JS: Well, duh. I like playing with BGP, OSPF and RIP as much as the next person. There are lots of open-source routing protocol suites to choose from, silly. I started using Zebra — I just love all those stripes — but I found they weren’t keeping up with a newer suite called Quagga. Then a couple of the girls suggested that I try XORP.

JK: XORP? That’s what we use at Vyatta.

JS: You know, it took me a while to learn to pronounce “XORP.” But some nice man spent a lot of time helping me with it, and now it just feels natural. Was that how it was with you?

Jessica counts a CCNA among her many endowments.

JK: Er… JS: Anyway, XORP and Quagga are just routing stacks running on top of UNIX, so I still get to use my UNIX skills. A lot. I’m glad about that. I feel that if I let my UNIX skills get stale I’d just be, well—letting myself go. Don’t you think? JK: And how do you find these routing stacks? JS: Oh, they’re very usable, and quite mature. Not at all like Nick, you know? JK: I suppose so. But I’m curious, how deeply do you get into these software packages? JS: Well, isn’t that the best thing about open source? If you don’t like something, you can just open up the source code and start hacking. You know, like hacking in the good sense, not like hacking in the bad sense.

JK: Have you been doing much—er—hacking?

JS: Well, you know, I’ve always hated the look of most “show ip bgp” commands. Don’t you? It’s just so—blah. I wanted to liven it up a little—you know, add a little color and spice. So, I made my BGP peers show red when they’re down. It’s so much more exciting now—like real-life drama! Plus, it goes great with my NOC décor. I have different color sets for each of my BGP peers, it’s very colorful.

JK: You sound busy. Do you ever get lonely with all your hacking?

JS: Oh no! For example, when I was hacking up BGP I spent a lot of time on Internet relay chat with the some protocol developers.

JK: Were they a big help?

JS: Were they ever! There was this nice guy who taught me how to say “XORP.” Also, after I made my BGP hack, they said they’d consider putting my change back into the main source tree. It’s like I’m part of the whole community!!

JK: That does sound good.

JS: Well, of course, not everyone can be a hacker like me. But still, when you can look right into the code, it’s like—it’s like—well like having the ultimate manual! I mean, I thought I had a handle on BGP after reading Courtney Love’s Router God article (<giggle>Hi, Court!) But whoa. Looking directly into the XORP code it, like, blew me away! I mean, the BGP decision process: how complicated is THAT? But now I understand it so much better. And I think that’s the main thing, don’t you?

JK: It sounds like you really like having the source.

JS: Well, what about security? People are always trying to break in to my machines. I don’t know what they think they’ll find—maybe they think they’ll find sexy photos like Paris Hilton had on her cell phone.
I wouldn’t put those online, duh! But now I can see the root cause of a security hole immediately. I can even fix it myself. And you know, you want to fix those things right away. You don’t want, say, a buffer overflow. That could lead to the router version of a wardrobe malfunction. If you know what I mean.

JK: Sure fixing all sorts of bugs is much easier when you have the source.

JS: And another thing I like is that open source is that it stays available. Remember Pluris? Hey, Pluris sort of rhymes with Paris! I bet she never thought of that before. Anyway, Pluris had very cool software a few years ago, but they went out of business. Now their code is probably locked up in a vault somewhere, and we’ll never see it again. And, you know, well, after Nick, I—well, I guess I feel a bit vulnerable. I want to know that my source will always be available. I want to know that it will always be there for me. I just need that in my life right now.

JK: Well, of course. That’s what Vyatta does.

JS: Exactly! I’ve been using their stuff for a while now. I always remember their name, because it rhymes with “Miata”, such cute little cars. And “Vyatta” is less confusing to pronounce than “XORP”!

JK: So, you like Vyatta?

JS: Oh yes. It’s not just that they put together a full system. They also have support. I love the idea that when I’m struggling with a bad BGP config, I can just call and get help. I mean, I know Courtney would help me if she could, but she’s got problems of her own, right? It’s nice to know that you can just make a call.

JK: That’s right. You can get commercial support for open-source software and you can run it on any hardware you want. Even on pink servers.

JS: And maybe one day they’ll have pink T1 cards, too.

JK: So, um, did you say that you were thinking you would starting to date again? We could maybe.. hack router code together?? The source is open, and all.

JS: Well, maybe… a good hacker that knows networks and UNIX is hard to find.

JK: What’s your uptime?

JS: You show me yours first…

JK:
Welcome to Vyatta on vyatta-sanmateo-1
root@vyatta-sanmateo-1> show version
Revision: 0.7 (2505M)
Image built: Tue May 30 14:34:50 PDT 2006
System booted: Fri Jun 2 06:42:12 PDT 2006
Uptime: 14:28:39 up 75 days, 22:46, load average: 0.16, 0.03, 0.01
root@vyatta-sanmateo-1>

Courtney Love wants the world to know she’s still hot stuff. Either that, or, she’s pointing to where she wants the next tab.

BC: Hello Courtney, thanks for taking the time out of your busy schedule to meet with me today. CL: Zzzzzzzz… BC: Courtney? CL: Wha ..? Oh, hi. Was jus’ restin’ my eyes. Who’re you again? BC: I’m here from RouterGod, to interview you about BGP. CL: Oh yeah! BPG! OK, so here’s the thing. BPG, I mean BGP, lets your router talk to other routers outside your network. BC: Outside? What do you mean? CL: Well, you know, you have that AS thingy, um…Autonomous System, yeah! And maybe you want to have two ways to get out of it, you know? Like, in case one of them goes down, then you have another way to get out.

So you can’t just use a default route. And you can’t use RIP or EIGRP to learn routes outside it, you know? Cuz they’re just for inside your network. So you have to have an outside gateway protocol. I mean, exterior gateway protocol. Like BPG! Um, BGP.

BC: OK, so you’re saying since I already have OSPF running inside my AS, and I need to be multihomed to two transit providers, then I need to use BGP?

CL: Uh, yeah. And here’s the kicker—you have to have BGP running inside your AS, too, on top of OSPF. That’s called interior BGP—iBGP for short.

BC: I’m confused.

CL: Me too. All the drugs, you know? But don’t worry—you’ll get used to it . . .Where was I?

BC: iBGP.

CL: Oh! Right—you have to have all those outside routes in iBGP so that when you need to get to one of ‘em, you know which of your inside routers to use to get to it. That’s called the next hop. Cuz, maybe you have two border routers (you know, on the border of your AS), and they are the ones that get all the outside routes—that’s called eBGP, the “e” is for “external”. But if you’re on an access router—you know, way inside your AS, where your customers connect to you—you can see from the iBGP table that your destination is outside the AS, and part of the BGP information for each route is the next hop address. That tells you which of the border routers is the one you need to send the traffic to. And to know how to get to the border router from the access router, you have to have a route to it in OSPF.

BC: No, sorry. I’m fresh out. So, how does BGP work anyway? Is it a link-state protocol?

CL: Easy, chick, with the questions! You and all these big words are giving me a headache. You sure you don’t have any painkillers in there? Anyway, it’s more like a distance vector protocol. I mean, the number of hops in the AS path is the distance vector—the best routes have the shortest AS path.

Courtney shows what can happen when you don’t have a full mesh.

BC: OK, well, I know this is a stretch, but could you possibly tell me how to configure BGP? CL: Sure thing, sister! I’m not as drug-addled as I look. I was in escalation at the WorldCom NOC back in the late 90’s, after Hole fell apart. Anyone could get a networking job in those days! So here’s what you do. First, enable BGP and turn off synchronization, and then start settin’ up those neighbors, baby! Don’t forget to set them up on all your inside routers too, so you have a mesh. Let’s pretend your AS number is 65535, and your routers’ loopback addresses are in the 10.1.1.0/24 network. Now just go into configure terminal mode–you know, “conf t”–and start typing BGP commands:

router bgp 65535
  no synchronization
  neighbor 10.1.1.2 remote-as 65535
  neighbor 10.1.1.2 update-source Loopback0

See, if you wanna use those loopbacks as your BGP neighbor addresses, you gotta make sure the updates come from the loopback. Then, on your border router, say your transit provider’s AS is 65001, and the far end of your link to them is 172.16.19.111:

router bgp 65535
  no synchronization
  neighbor 10.1.1.2 remote-as 65535
  neighbor 10.1.1.2 update-source Loopback0
  neighbor 172.16.19.111 remote-as 65001

Now, do a “show ip bgp summary” and make sure they’re up and getting routes (you can just skip down to the part where the neighbors show up):

Neighbor      V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down State/PfxRcd
10.1.1.2      4 65535 4775841  206453 20341277    0    0   2w2d             4
10.1.1.3      4 65535 6993647 6138407 20341277    0    0   2w6d            32
10.1.1.4      4 65535  208510 6416731 20341277    0    0  10w2d           198
172.16.19.111 4 65001  206914 6153319 20341277    0    0  18w0d        184475

BC: All right, here’s your precious Percodan. Thanks for the interview.

CL: Thanks for nothin’! You . . . uh . . . ahhhh . . . zzzzzzzzzzzzzzzzzz…

Jennifer
Cisco recently announced that effective January 1st, 2005 there would no longer be IP Telephony in the RS lab, why the change?

Sanjay
Oh my, yes, where to start? Oh, so many problems.  We had many unexpected problems, so we, ahhh, make change.

Jennifer
Problems?  Can you elaborate?

Sanjay
The test candidates were misusing the phones.

Jennifer
Misusing the phones?  I don’t understand.

Sanjay
Oh, where to start, OK, the candidates would
often connect their phones to our IP phone system
at Cisco and use the phones to make unauthorized calls.

Jennifer
Very interesting, what type of calls?

Sanjay
At first they would do harmless things like order pizzas and call in to radio shows, then they would progress to other things like calling Cisco support and opening help desk tickets to assist with their labs and sometimes they would page the proctors and get them to leave the room so they could compare notes.

Jennifer
Very clever, when did you first notice this?

Sanjay
We discovered early on that the candidates would actually place calls to each other and we would see them whispering into the phones. We also discovered many calls placed to India which indicates they were seeking tech support.  Some candidates would even operate long distance pre-paid phone card businesses right from the lab.  We soon decided to remove the phones.

Jennifer
I see, how do you keep the same thing from happening in the Voice Lab?

Sanjay
We replaced the phones with older phones that go
through a live operator, this was the only way
we could stop the monkey business.

Agent Smith
Explains Syslog

Agent Smith receives a message from Cisco CEO John Chambers…

Here at RouterGod Online Magazine we recognize that Cisco routers have evolved well past the point of being simple routing appliances.  Cisco routers have recently been classified as life forms by the National Institute of Science.  As Cisco Engineers, we’ve long known that our little forest green friends were sentient beings.  Cisco is busy making revolutionary strides developing a new method of configuring routers that involves plugging a console cable into a special port in the back of an engineer’s head, and then the engineer can configure the router by interacting with a virtual character that represents the IOS.  All CCIEs with numbers higher than 9918 have this special port in the back of their head.  We sent RouterGod Technical Editor Jenny Vo to San Jose to have the port installed in her head and try out the new interface.  She chose the popular Agent Smith interface (only available in T trains) and decided to test it out by configuring Syslog.  Let’s Join Jenny as she interacts with Cisco’s new interface!

The Iraqi Information Minister

It’s well known that when Muhammed Saeed al-Saaf (MSS) speaks, people listen.  What is not so well known is that the Information Minister is in charge of the single Cisco 3620 that connects Iraq to the Internet.  We dispatched RouterGod Middle East Correspondent Johna Barson to Baghdad to interview MSS.  She caught up to him as he was looting an abandoned 7-11 convenience store and askedhim about policy based routing, let’s join Johna as she learns about PBR from MSS!

Johna Barson (smiles at her escort, Sgt. Ahmet Candan, USMC)

Right…. Anyway, about Policy Based Routing?

MSS

OK, It’s like this, routers move packets from one interface to another, they determine which interface to send the packet out of by looking at their routing table.  This is the natural manner in which a Cisco router works.  If you want the router to handle a packet in a different manner, to send it out an interface it might not normally or perhaps you want to change the precedence value of the packet, that is PBR.  You do it with Route Maps

Johna Barson

Why would you change the precedence of a packet?

MSS

Infidel!  So that other routers downstream can provide different service levels, or prioritize the packets based on what the precedence field is set to.  The route map uses and access list to identify the traffic, it alters the precedence, routers downstream use access-lists to recognize these packets and Priority or Custom Queuing to put the packets in special queues.  This is but one way to do Policy Based Routing, there are many!

Johna Barson

What would the config look like on the ingress, or classifying router?  Say you wanted to prioritize traffic going to a webserver at 172.16.1.1!

MSS

!
access-list 100 permit tcp any host 172.16.1.1 eq 80
!
route-map iraq 10
 match ip address 100
 set ip precedence 7
!
interface serial 0
 ip policy route-map iraq
!

Johna Barson

Oh, I see!  Any traffic that enters the serial interface that matches the access-list will have the precedence set to 7.  Awesome!  What happens to traffic that is not permitted by the access-list, is it denied?

MSS

No!  It is routed normally

Johna Barson

OK, what would the config look like on the routers between the classifying router and the web server?  We want to guarantee 50% of the bandwidth to this traffic.

MSS
!
access-list 100 permit ip any any precedence 7
!
queue-list 1 protocol ip 1 list 100
queue-list 1 default 2
queue-list 1 queue 1 byte-count 2000
queue-list 1 queue 2 byte-count 2000
!
interface serial 0
 custom-queue-list 1
!

Johna Barson

I have to admit, that’s pretty cool.  So you can tag certain traffic as it enters your routing domain, and then elsewhere in your domain, identify and handle that traffic differently, so that’s PBR?

MSS

That’s just one example, there are as many as there are grains of sand in the desert!  Death to the Infidels! 

Johna Barson

Yeah, whatever.  Where are you going to now?

MSS

I am the new spokesman for Isuzu, I am replacing an infidel named Joe.
Praise Allah!

Back to main page

Many of our readers are now pursuing the Cisco Security Specialist 1 certificate, and still others are simply wondering how to configure the mighty PIX Firewall. The PIX Firewall is without a doubt the way to secure enterprise networks. Used in conjunction with the IOS Firewall Feature Set (now known as Cisco Secure Integrated Software) running on a Cisco router, Cisco’s security solution is far superior to weak software applications that run on Unix or NT. RouterGod Online Magazine reporter John Riehl sought out beautiful Denise Richards to help us learn how to configure the PIX Firewall. John is a Cisco instructor and holds the CCSP and CISSP certificates. When not teaching Cisco, John likes to tell wild stories about his days in the circus where he was known as the Polish Invisible Man. When not being beautiful, Denise practices kickboxing and enjoys watching American Chopper on TV. Let’s join JR as he interviews Denise about the PIX Firewall. RFC 1918 Addresses are used to protect the innocent.

JR

Oh My God!  This sounds too complicated!  Let’s forget about it, maybe you should tell us how a console cable works or maybe which end of a power cord plugs into the wall…

Denise

Ha Ha!  Don’t be such a baby!  The PIX is easy!  It uses a Command Line Interface, not one of those complicated GUI’s like Checkpoint!  The PIX has 3 command modes: User Mode, Privileged Mode and “Global” Config Mode.  There is no concept of Interface Config Mode and the cool thing is that SHOW commands can be used at Global Config!  By default the PIX interfaces are shutdown.  To do a “no shut” on the outside interface you would use the following command: interface ethernet0 auto.  To give it an IP address you would use a command like this: ip address outside 192.168.1.1 255.255.255.0

PIX Facts

PIX 535 - 500,000 Connections
PIX 525 - 280,000 Connections
PIX 515 - 125,000 Connections

  Back to RouterGod Online Magazine

Meet Sexy Singles

Priscilla Oppenheimer

Yes, we say “Routing by Rumor”.

Fabio

Yes!  I can see you are a woman of the world!  A Distance Vector protocol simply gives a copy of it’s routing table to it’s neighbors, and they alter the metric to reflect the added cost and merge it with their own routing table.

Priscilla Oppenheimer

What sort of metric does IGRP use?

Fabio

Oh my Dear Priscilla, I will tell you.  IGRP uses a composite metric based on the lowest bandwidth along a route and the sum of the delay along the same route.  As you know, this is a much superior metric than RIPs metric, which is simply, hhmmmmmm, how do you say? a quantity of leaps…

Priscilla Oppenheimer

We would call RIPs metric a hop count.  What else makes IGRP better than RIP?

Fabio

Well, my inquisitive and sweet bundle of joy, RIP only allows a network diameter of 15 hops, where IGRP can support a network diameter of up to 255 hops although 100 is the default.

Fabio

Cisco is a lot like Fabio, beautiful and one of a kind.  Cisco invented the router.  Soon thereafter many imitators began selling routers but Cisco was the first, just like Fabio was the first.  Cisco is the only company that actually created their own routing protocols like IGRP and EIGRP.  No other company can say that.  Not HP, not 3 Com, not Juniper, no one.  Cisco is head and shoulders above the competition, just like Fabio.

Priscilla Oppenheimer

How do you configure IGRP on a Cisco router?

Fabio

It is very easy my dear, Fabio will show you.  Put your hands on the keyboard and Fabio will place his hands on top of yours.  Then I will teach you.  I will be gentle, I will show you the ways of the Command Line Interface, you have nothing to fear, Fabio will protect you.

Priscilla Oppenheimer

You don’t know the commands!  Ha!  I caught you!  You are vamping for time, hoping I will forget the question!  Isn’t that right, Fabio?!?!  You don’t have a clue, do you?  Every CCNA on the planet knows the commands, but you don’t, do you?

Fabio (eyes cast downward)

Do not be cross.  Do not be disappointed in Fabio.  Fabio is only a man, he cannot bear to think that he has let a woman down.  My heart is heavy and filled with remorse.  Fabio remembers when love filled our happy hearts.  All that is left for Fabio is to end it all, perhaps I will jump into a river, perhaps I will overdose on sleeping pills and dream of our time together.  Yes my Priscilla, remember me when I am gone…

   Back To RouterGod Online Magazine

Trinity

I doubt that you would ever want to forward an ARP broadcast.  But there are many types of broadcasts besides ARP.

Mitch

There are?  Like what?

Trinity

Well a good example would be when a workstation that is a DHCP client boots up, it sends out a broadcast looking for a DHCP server.  I’m pretty sure you want the DHCP server to respond and give the client an IP address.

Mitch

Well, sure, but why not just put your DHCP server in the same subnet as the client?  Problem solved!

Trinity

Do you have a Microsoft MCSE certificate?

Mitch

Yes!

Trinity

I thought so.  Bill Gates has convinced you that you need a Windows DHCP server in every subnet, hasn’t he?  The truth is, you only need one DHCP server and one as a backup.  You can configure a Cisco router to forward BOOTP broadcasts to the centralized DHCP server and save your company thousands of dollars.

Mitch

Holy smokes!  How do you do that?

Mitch

Can I use one command to forward to a directed broadcast address and another command to specify unicast IP addresses of machines on other networks?

Trinity

You bet!  You can mix and match

Mitch

If the ip helper-address command can take a broadcast and turn it into a unicast, must the target machine be directly on the other side of the router?

Trinity

No, you can use an address to any destination on your network.

Mitch

How do the routers know how to get the packet to the target machine?

Trinity

These are routers, right?  That’s what they do…

Mitch

Oh yeah!  I forgot for a second.  One more thing, is there any way to customize what ports get forwarded?  Can I delete some of the 8 default UDP ports or add new ports I want forwarded?

Trinity

Well, put you ip helper-address command on the interface that receives the broadcasts, then in global config mode enter the command: ip forward-protocol udp 2000 and that should do the trick.

Mitch

Here’s another one, say I only want to forward TFTP broadcasts, how do I do that with the ip forward-protocol command?

Trinity

Easy, here’s how, you just have to specify the ports you don’t want forwarded:

no ip forward-protocol udp 37
no ip forward-protocol udp 49
no ip forward-protocol udp 53
no ip forward-protocol udp 67
no ip forward-protocol udp 68
no ip forward-protocol udp 137
no ip forward-protocol udp 138

Mitch

OK, now I get it, out of the box, Cisco routers do not forward broadcasts, but like everything else, Cisco has given us a way to tweak and customize things for our own individual networks.  Very Cool!  Why don’t they teach this in CCNA class?

Trinity

They did for CCNA version 1, but now it is taught in CCNP, it’s definitely on the BCSN test so remember the commands!

Mitch

Hey thanks, Trinity.  How did you know that I needed to learn these commands?

Trinity

The Oracle prophesized it.

Mitch

Huh?

   Back To RouterGod Online Magazine

Max Throughput, CCIE

There I was, minding my own sweet business, drinking a shot of rot gut whiskey and having a smoke when suddenly the phone rang.  With a sense of weary anticipation I picked up the phone, “Talk to me” I barked.  On the other end there was a moment of silence and then a woman spoke “Is this Max Throughput, the famous CCIE?”.  “The one and only, Babycakes.  What can I do for ya” I growled.  “It’s…it’s my router, something’s wrong…look, can we meet somewhere?” she replied nervously.  “Sure doll” I said, “I haven’t had breakfast yet, how ’bout we meet at the House of Pancakes in an hour”.  Her reply was short and sweet: “I’ll be there” and she hung up.

Being a CCIE in a big city like Los Angeles is not all fun and games if ya know what I mean.  You never know what’s going to happen next.  And trust me, there’s lots of people who would like you to fail.  I have survived because I can think quick on my feet and I’m not afraid to pull out my roscoe and start shooting up a NOC when things get ugly.

But enough tough talk, I pounded down the last of my whiskey, stubbed out my Camel in the ashtray, put on my hat and coat and headed out the door for another adventure.  I walked down the street to the House of Pancakes.  As I neared I was greeted by the inviting smell of eggs and waffles.  But I also sniffed something else: trouble.  I opened the door and surveyed the joint.  Standing alone near the counter was a classy looking dame.  She was a brunette, wearing a low cut blouse, short skirt and had a pair a gams that went all the way to the floor.  I walked up behind her, pinched her ass and said “Hey sugar lips, you called?”.  She swung around and with a look of horror exclaimed “I beg your pardon!”.  “So you wanna play hard to get” I smirked, “I can play that way too” I said.  She rolled her eyes in mock disbelief and stormed out of the joint.

“Well, there goes another satisfied customer” I thought.  No use letting the morning go to waste though, so I sat down at the counter and ordered a Rootie-Tootie breakfast.  Soon my breakfast arrived and as I was trying to decide which of the 25 different syrups to pour on my pancakes a beautiful blonde sat down next to me.  She glance nervously at me and said “Are you Max?”.  “All depends who’s asking” I smugly intoned.  “I called you, thanks for meeting me” she said with a voice that was so husky it could pull a dogsled.  “I hope you can help, my router has quit working and if I don’t get it fixed today, my boss will fire me” she said breathlessly.  “Sure cream puff, I can help you but there’s the small matter of my fee” I said.  She leaned into me and in a conspiratorial tone said “What ever the cost, I will pay it.  Please Mr. Throughput, you’re my only hope” she pleaded.

I looked her over with a studied eye.  I took note of the Cartier wristwatch, the Gucci handbag, the unmistakable swell of her breast implants.  No doubt about it, this broad was loaded.  “Five hundred dollars and you pay for breakfast” I said.  “Oh thank you, Max!” she gushed.  After I finished my third breakfast, she paid the check and I followed her out to her car.  As we got into her Mercedes 560 I silently admonished myself for not charging her more.  She drove us through the mean streets of Los Angeles and into the sexually ambiguous area of West L.A.  Soon we arrived at a nondescript building off Wilshire.  I followed her to the entrance, admiring the womanly sway of her hips, this dame was definitely a looker.

She opened the door and led me to the computer room.  It was the usual computer room: raised floor, racks and racks of servers and assorted networking gear.  Then my eyes settled on it, a Cisco 2620 with a console cable leading to a notebook PC.  “Is that the little bugger?” I asked, already knowing the answer.  “Yes, please see what you can do” she said.  “No problem dumpling, just relax while I work my magic” I responded coolly.

I sat down at the computer, flicked my cigarette butt into a nearby box full of DLT tapes and entered the command show run.  The Cisco router obediently coughed up it’s config.  Perusing its contents I noticed that this router was configured for inter VLAN routing or “Router on a stick” as we say in my line of work.  That means that the FastEthernet port was divided into sub interfaces and was trunked to a switch somewhere.  I noticed that the encapsulation was ISL, Cisco’s proprietary trunking encapsulation.  Using ISL encapsulation shows breeding and good taste, who ever configured this router was no slouch.  Well the config looked fine, no problems other than the type 7 encryption on the password.  Next I entered the command show ip route and what I saw even shocked a grizzled CCIE like myself: no routes!  Nada, zilch, zero, goose egg, you get the picture.

Let me explain something to you, directly connected interfaces that are active should always show up in the routing table.  No ifs, ands or buts.  I reached into my pocket and pulled out my whisky flask and swilled down a gulp of liquid confidence for I knew this was going to be a tough one.

Next command I entered was show ip interface brief.  It was there I noticed that the FastEthernet interface was UP and DOWN!  This command shows the interface status and the protocol state.  You want to see UP and UP for status and protocol respectively.  For the status to be up, the interface must be administratively up as in NO SHUT and there must be a cable plugged into it.  For the protocol to be UP there must be a keepalive signal that has been detected by the interface.  It’s possible to see UP and UP, UP and DOWN, DOWN and DOWN but you would never see DOWN and UP because how would you be getting keepalives if the cable is unplugged?  Are you getting my drift?

Everything looked hunky dory on the router so I next went to go check out the switch to see what was wrong.  My gorgeous new client followed to the end of the row of racks where the Catalyst 5000 was.  I started checking the cables when one of them fell right out!  “This looks like yer problem right here” I said as I examined the RJ45 connector on the cable.  “That’s funny” I muttered as I noticed that someone had placed transparent scotch tape over the pins of the connector…

It was then I felt her right behind me, I smelled her expensive perfume and sensed the heat radiating from her bosom.  I spun around quickly and confronted her: “Alright sister!  The jig is up, My mother didn’t raise any mentally defective offspring and this is a frame up!” I shouted.  “But…But what do you mean?” she stammered.  “Oh you’re a clever one, I’ll grant you that, but save your little miss innocent act for someone else, I’m a Cisco CCIE and you’re not gonna pull the wool over my eyes” I shot back.

“Ok! I confess!” she cried “I admit it, I taped the connector, it was just a ruse to get you up here”.  “You better start talking girlie before I lose my patience”  I ordered.  “I’ve always wondered what it would be like to be with a CCIE” she said in a hushed tone.  “Surely you can’t blame me?” she asked playfully.  She then grabbed me by my lapels, pulled me towards her forcefully and planted a big wet kiss on my lips.  “Well ok” I said. “But this will cost you double…..”.

Stay tuned for more upcoming adventures of America’s favorite CCIE, Max Throughput!

Back to RouterGod Online Magazine

Internet Dating Service, Meet Sexy Singles Near You

A poor swimmer, Liz often washes up on shore wearing only panties.

Erwin

The model numbers are kinda confusing, how do you know what the numbers mean?

Liz

First off, they all start with the number 26, so we can set that aside. If the last 2 digits are in the 50s that means a high performance CPU.  If the last number is a 1, that means it has 2 Ethernet Ports.

The 2610 is the basic model with one Ethernet port, the 2611 has 2 Ethernet Ports.

Erwin

Can you show us a product matrix?

Liz

Sure, here goes:

Erwin

Wow!  You really seem to know your stuff, have you ever thought of quitting modeling and getting into Cisco routers?

Liz

Funny you should ask!  I plan on getting my CCNA when I’m too old to model, maybe next year.

Erwin

No Way!

Liz

Way!

She’s just skin and bones. The poor dear…

What we’ve learned

1. The 2600 is for branch office applications.

2. The 2600s have 2 WAN slots.

3. The 2600s have 1 Network Module slot.

4. All 2600s use a RISC processor.

5. There are 3 CPU speeds to choose from.

6. Modules are compatible with the 1600, 1700 & 3600 series.

  Back to RouterGod Online Magazine

Anna

I wouldn’t know.  I just collect them.  The Cisco reseller comes by every Thursday.  He leaves six or seven “5 packs” of switches on my doorstep.  I now have over 400 Catalyst switches in my collection.

Tom

Wow!  400 switches, that’s a lot!  Are they all 1900s?

Anna

Yeah, 1912s and 1924s.  Some are Enterprise version.  Hey, are you hungry?  Can we order appetizers?  I want a drink too.  (Anna motions to the queer-gay waiter and we order Escargot and martinis.)  Oh yeah, where were we…my switches.  Yepper, I got lots of switches!

Tom

Can you explain the differences between the different 1900 series switches?

Anna

Sure baby cakes!  OK, here’s the deal, there are 2 types you can order, the Standard version and the Enterprise version.  Then there are 2 basic models the 1912 and the 1924.

Tom

Oh I think I get it!  The 1912 has 12 Ethernet ports, right?

Anna

Nope it has 14!

Tom

14?  That doesn’t seem to make sense. Can you explain that? 

Anna

The Enterprise version gives you the Cisco IOS Command Line Interface and you can use Uplinkfast for increased reliability.

Tom

How about VLANs?  How many VLANs can a single 1900 switch have?

Anna

Each 1900 can have 4 VLANs hosted on it.  That should be plenty considering this is an access level, wiring closet switch.

Tom

What if my wiring closet is really far away?  Too far for Copper based Ethernet, what can I do?

Anna

No problem, Cisco has thought of everything.  Buy a 1924F.  The F suffix means 100BaseFX.  That’s means that by using optical fiber, your little switch can be up to 2 kilometers away!

Tom

Very nice!  What do the 1900s use for CPU’s and how much memory do they have?

Anna

The 1900s use Intel 486 chips.  Each 1900 comes with 1 MB of Flash and 2 MB of RAM memory.  That’s plenty of memory for this type of switch.  While we’re talking hardware, each 1900 can store 1024 MAC addresses and has a 1 Gbps backplane.  And another thing, baby cakes, all the Ethernet ports support full or half duplex connections.

Tom

Hey Anna, I’m impressed!  You really know your stuff.  Thanks a lot!

Anna

My pleasure, pumpkin.  Let’s drink some more martinis.

Doug

How do the routers control all this?

Paul

Well mate, the routers in an HSRP group send and receive keep alives using the multicast address of 224.0.0.2 and UDP port 1985.  By default the hello interval is 3 seconds.  Once 3 hello intervals pass without hearing from the active router, the standby router automatically becomes the active router.  Each router is configured with a priority number, the router with the highest priority number in a standby group is the active router, everyone else just relaxes.

Doug

This must be very hard to configure…

Paul

No way mate, you only need 2 commands to do it, and 2 additional commands to customize it.  What’s more, it’s configured at the interface that you want to participate in the standby group.  It’s so easy, an American could do it!

Doug

No way!  Really?  What are the commands?

Paul

Well, first off, on the router that you want to be the active router, go to the interface you want HSRP to run on, think up a group number, all routers participating in this scheme must use the same group number, also think up what IP address you want the HSRP group to share.  Now watch me type:

dingo(config-if)#standby 1 ip address 10.1.1.254
dingo(config-if)#standby 1 priority 100

So what we have here mate, is a standby group number of 1, an IP address of 10.1.1.254 that the routers are going to share, now let’s configure the standby router:

fosters(config-if)#standby 1 ip address 10.1.1.254
fosters(config-if)#standby 1 priority 90

OK, the only thing different on the standby router is the priority.  The router with the highest priority becomes the active router.

Doug

What if the active router, with the priority of 100 goes down and comes back up, since it has the higher priority, will it become active again?

Paul

Sorry mate, in that situation, if you want it to be the active router again, you have to add the keyword preempt to the priority command:

dingo(config-if)#standby 1 priority 100 preempt

Doug

Hey Paul, what if the routers are connected to a WAN link, and the routers are running fine, but the WAN link goes down, is there any way to track that?

Paul

You said it my clever friend, the command is track.  Say you want to have HSRP failover if the WAN link goes down, well just track the interface that the WAN link is connected to, like so:

dingo(config-if)#standby 1 track s0 priority 11

Noticed that there is the keyword priority followed by a number.  That number is the number to subtract from the router’s own priority number to give it an adjusted priority number if the interface it’s tracking goes down.  If the Serial 0 interface goes down, our router’s priority goes from 100 to 89 which will cause the standby router to become active since it has a priority of 90.  You might need this to happen if the standby router is configured for DDR.

Doug

This has all been very interesting, welcome to America and thanks for explaining HSRP!

Paul

No worries mate!

Visit the HSRP Guide and the HSRP FAQ at Cisco.  Also see Cisco’s exciting page on Configuring HSRP. Remember, never charge less than $1000 to set up HSRP and always get the money up front, before your customer sees that you fully configured HSRP on 2 routers in less than 5 min!

  Back to RouterGod Online Magazine

With the possible exception of Todd Bridges, few celebrities love the jail lifestyle more than Robert Downey Jr. Here in Los Angeles celebrities are treated very well and nowhere is that more true than at the L.A. County Jail. During past incarcerations, Robert Downey Jr. has been chauffeured to movie sets by Sheriffs Deputies and was actually made an honorary Deputy by Sheriff Block himself. Robert Downey or “Robbie D” as he is affectionately known in the slammer agreed to an interview with RouterGod Online Magazine but only if we paid him in cocaine. We told Robbie D that that was out of the question so he then asked for marijuana and a bong and we refused. We said “how about some booze?” to which he told us that the Celebrity Cell at L.A. County already has a fully stocked bar. After hours of negotiations we agreed to bring him his favorite Russian caviar as the caviar provided by room service is not to his liking. We sent RouterGod Field Reported John Lokie to visit Robert Downey Jr. at his beautiful celebrity skybox overlooking the ornate fountains and Japanese gardens at the VIP wing of the L.A. County Jail. Let’s join John as he talks to Robert Downey Jr. about the make up of the IEEE 802.3 Ethernet frame!

RDJ explains that Ethernet is a layer 2 standard.

John Thank you Mr. Downey, our readers are anxious to hear what you have to say about Ethernet. RDJ Sure man, say, do you have any heroin on you?  I’m about out. John Sorry, but I wouldn’t even know what heroin looks like. RDJ Oh well, it was worth a shot.  OK, let’s get on with the show, I’ll explain the Ethernet frame to you.  Do you mind if I get a massage while we do the interview? John No, I don’t mind. Robert Downey Jr. removes his $5,000 Bill Blass smoking jacket exposing his naked upper body.  A beautiful and voluptuous female Sheriff’s Deputy enters carrying a towel and some lotions and follows Robert Downey Jr. to the massage table.  Robert Downey lays face down on the table, folds his arms in front of his face and rests his chin on his hands.  The Deputy proceeds to give RDJ his afternoon massage.

RDJ

Ahh, that’s perfect.  Where do you want to start, John?

John

Why not start at the beginning…

RDJ

Swell, what we are going to talk about is the IEEE 802.3 Ethernet frame.  Ethernet frames are at layer 2 of the OSI model and what they do is encapsulate layer three data and carry it across the physical layer to a destination where it is decapsulated and the layer 3 data is processed. 

John

What is a 802.3 frame composed of?

RDJ Well to begin with there is an 8 byte “preamble”, the preamble is not technically part of the frame as it is added to the front of the frame by the NIC just before the frame is put out on the wire.  The preamble is a series of alternating “one” and “zero” bits.  Actually Manchester encoding is slightly more complicated than this but for our purposes think of the signaling as a simple on and off type of scheme.  These 64 bits in the preamble are for timing, the allow the receiving station to get synchronized with the incoming signal, this usually happens within the first 14 bit times.  The last 2 bits are switched on, so the last byte looks like: 10101011.  This last byte of the preamble is called the Start Of Frame delimiter and signals the start of the actual frame. John I see, since there is no clocking, the preamble allows the receiver to sync up and it signals the start of frame.  What is next?

Robert strikes an introspective pose for benefit of onlookers.  All Deputies in Robert’s employ are also members  of the Screen Actors Guild and receive SAG scale in addition to ordinary wages.

RDJ

The next field is the destination MAC address, of course it is 6 bytes in length.  After that comes the source MAC address and it too is 48 bits in length.  MAC stands for Media Access Control, it is the actual layer 2 hardware address of a device.  Cisco sometimes refers to it as a BIA or Burned In Address.  Notice that the destination address is first, that saves time when you employ cut through switching.

John

Very nice, after the preamble comes the destination and source datalink addresses, what follows?

RDJ

The next field is the Length field, it is 2 bytes in length and indicates the length of the data or payload of the frame.  The length does not include the preamble, MAC addresses, the FCS (we’ll talk about that in a minute) or the length field itself.  An Ethernet frame cannot be any smaller than 64 bytes in length or larger than 1518 bytes in total length, not including the preamble, which we don’t count anyway.

John

So the length field just indicates the payload length, that’s pretty simple.

RDJ

Well not so fast, one very important thing the length field does is communicate the end of the payload.  By knowing how long the payload is, we know exactly when it will end and when the Frame Check Sequence begins, that way we don’t need any kind of “end of data delimiter” or some such thing in our frame.

John

Hey!  You’re pretty good!  Keep going!

RDJ

Of course I’m good, that’s why they pay me the big bucks!    Now we get into 3 cool little fields called the LLC header.  LLC means Logical Link Control.  Each of these is 1 byte in length and these 24 bits are counted in the Length field.

Free gay dating and personals

Robert Downey Jr. arrives at the Cannes Film Festival.

John Well don’t keep us in suspense!  Spill it man, spill it! RDJ OK, ok, the first octet in the LLC header is the DSAP or Destination Service Access Point.  This is a pointer to a location in the receivers memory.  It tells the receiving NIC card where in it’s memory buffer to put this information.  The next 8 bit field is the SSAP or Source Service Access Point, this is the pointer to the buffer address from where this information came.  The DSAP and SSAP allow for multiple protocol stacks to use a single NIC card.  The next and last byte in the LLC header is the Control and it simply indicates the type off LLC that this is.

John

So far you have mentioned the preamble and six different fields, when do we get to the data?

RDJ

Right now my man!  The data field carries the packet that is constructed at layer 3 of the OSI model.  The data can be between 43 and 1497 bytes in length.  The last field is the Frame Check Sequence and that contains a number that the receiving station performs a calculation to determine if the frame is corrupt or not.

John

What if the receiving station does the FCS check and finds the frame to be corrupted, will the NIC card ask the the sender re-send the frame?

RDJ

No way, retransmission is a layer 4 function.  At layer 2 if a frame is bad, it is simply dropped or deleted from the input buffer of the interface.  The FCS field is 4 bytes in length so we have 21 bytes of overhead per frame.  We said that the maximum size of an Ethernet frame was 1518 bytes, so subtract the 21 bytes of overhead and the actual maximum payload is 1497 bytes of data.

John

Well that’s not too bad, we get a maximum 1497 bytes of data for only 21 bytes of overhead, I’d say that’s pretty efficient.

RDJ

Yeah, but don’t forget that this is just the overhead at layer 2, layer 3 has a header as well as layer 4.  Since each of the upper layers of the OSI model gets encapsulated or wrapped in the layer below it, the actual, real data that is hiding in an Ethernet frame is less than the apparent payload of the frame.

John

Dog gone it!  Your right, I forgot all about the other layers.  You know Robert, for a crack smoking, drugged out freak of nature, you sure are pretty smart!  Have you ever given serious thought to quitting drugs?

RDJ

Never!

Editor’s Note
Robert Downey Jr. is a trained, seasoned professional.
Do not attempt to consume illegal narcotics without
first consulting your theatrical agent!

  Back To RouterGod Online Magazine
 

The staff here at RouterGod Online Magazine are always looking for upcoming trends in Cisco networking. After much research we have learned that not every client can afford Cisco’s SmartNet tech support service. In fact, while SmartNet and Cisco’s Technical Assistance Center provide sound solutions to network problems, often they are at a loss to explain how these problems started in the first place. Cisco will solve your problem but they will never tell you how your equipment became cursed or offer to cast a spell to prevent future curses from harming your equipment. Cisco does not employ any witches or Voodoo priests, yet it is no secret that 50% of all Juniper employees are certified in black magic. As much as we love Cisco, they have clearly dropped the ball on this one. So as a public service, the selfless, virtuous and altruistic staff at RouterGod Online Magazine have hired world famous psychic Madame Rommon to answer your technical support questions, all for only $5 per minute!

Caller

Yes!  Yes!  That’s what I told my boss, but he wouldn’t believe me!  Everything has been fine until today, I tried to modify the configuration of this 2620 and suddenly the router will not accept my password.

Madame Rommon

Your router is harboring a secret, a bad secret…

Caller

How did you know!  Yes!  It says “Bad Secrets”!  Oh my God!  I can’t believe you knew that!  My boss said I needed to perform password recovery, but when I saw “Bad Secrets” on the screen, I knew that it was more serious than that.  Please Madame Rommon, tell me what to do!

Madame Rommon

Sweet Child, we must perform an exorcism.  Do not be afraid.  We must type some sacred commands into the router.  These are very special commands, so special that I will need to charge your credit card an additional $750…Do you authorize this charge?

Caller

Oh Yes!  It’s my boss’s personal MasterCard, he told me to fix the router, so I know it’s ok.

Madame Rommon

Marvelous, for an extra $1000 I can say a prayer for your router, do you authorize that charge?

Caller

Yes!  Yes!  Please, I’ll pay anything!  Just help me!

Madame Rommon

Do not fret, plug your console cable into the router and cycle the power switch, when the router reboots, Satan will want to load the startup-config, so you must stop Satan from loading the config.  Do you understand?

Madame Rommon

OK, here is the sacred command, enter: confreg 0×2142

Caller

So far so good, now what?

Madame Rommon

Now you must must cause the router to reboot itself, so enter the following sacred letter: i

Caller

Wow, the router rebooted and now it’s asking if I want to enter the initial configuration dialog, what do I do?

Madame Rommon

Your router has rebooted without loading the the startup-config, the startup-config is where the old password was stored, Your router now has a clear running-config, but your old config remains safe, we just told the router not to load it.  Say “No”.  Now enter Privileged Exec mode by entering the command: enable.  Now you are in enable mode and you didn’t need a password.  The next step is to load the existing startup-config from NVRAM into your running-config, enter the command: copy start run

Back to RouterGod Online Magazine

Free gay dating and personals

Gillian

No, as long as each switch is using the same version of spanning tree, IEEE for example, they all know the rules and can read the BDPUs and determin which ports are blocked and which ports can forward.

Irfan

What other states are there that a port can be in?

Gillian

Well at first when a port comes up it goes int the Listening State.  It listens for BDPUs and by examing the contents of the BDPUs and figures out the topology of the existing network.  After the listening state, the port may decide that it should go into a Blocking State.  In the blocking state, no data can pass through the port but it is still examining BDPUs.  The port remains in the Listening State for however long a duration is specified by the Forward Delay Timer.  The Forward Delay Timer is set to 15 seconds by default.

Irfan

So it could take a port up to 15 seconds to begine forwarding data?

Gillian

Not so fast, Buckaroo!  After the 15 second listening state, if the port does not go into blocking state, it then spends another leisurely 15 seconds in the Learning State.  In the Learning State the port is learning MAC addresses and adding those entries into it’s CAM table.  After the Learning State is complete, then the port goes into Forwarding State and can transmit data.

Irfan

30 seconds before the port will send data?!?!?  That just won’t do!  If I have a single workstation plugged into a port on a switch and it takes 30 seconds, Windows will not wait that long, my workstation will never contact the DHCP server in time!  My workstation will not get an IP address! All is lost!  We are doomed!

Gillian

Relax, Irfan!  There’s a work around!  When you have a single workstation or server plugged into a port, you can selectively disable the spanning tree protocol on that port.  After all, spanning tree’s only job is to prevent loops by shutting off redundant paths in the network.  But your workstation only has one path to the network, through that port!

Irfan

So we can turn off spanning tree?

Gillian

Well, were not going to turn off spanning tree, we’ll just disable it on this one port.  But now that you mention it, it very possible that you are the administrator of a network that by physical design, does not have any loops in the topology.  Nearly all small networks are like that.  If that’s the case, yes, you can disable spanning tree network wide and save the bandwidth and CPU cycles that STP would use to do a job you don’t need.

Irfan

My network has redundant paths, so I’ll use spanning tree, but can you tell me exactly how to shut it off on a single port, so my workstation can access the network immediately?

Gillian

Certainly, Cisco calls it PortFast and you enter the following command:

set spantree portfast <module>/<port> enable

So if you plug your workstation into the 12th port on the 2nd slot in your Catalyst 5505, you would enter the command:

set spantree portfast 2/12 enable

To disable PortFast on this port:

set spantree portfast 2/12 disable

As you can see, those engineers at Cisco made this easy.

Irfan

You call that easy?  Cisco should provide a mouse and a graphical interface like Microsoft does, now that’s what I’d call easy…

Gillian

But if it was that easy, everyone could do it.  Think about it.

Irfan (smiling knowingly)

Ah yes, very good point!

There’s a wonderful page at Cisco that explains how to Configure Spanning Tree .

Watch for part 3 of this
action packed series coming soon!

  Back to RouterGod Online Magazine

Free gay dating and personals

Michael

Excellent.  In your example the switch has tripled the available bandwidth.  What if the switch looks in the CAM table but there is no entry listing the MAC address of the destination machine?  Does the switch just drop the packet?

Gillian

Listen up, cutie!  You just said “packet”!  A packet is a layer 3 data unit.  We use frames thank you very much.  And no, the switch will not drop the frame.  If the switch does not have an entry in it’s CAM table, it will copy the frame and send it out all ports at once.  When it gets a response it will add that machine to the CAM table and all future frames will be switched to that port.

Michael

OK, now I know.  What about broadcasts, what does the switch do with them?  You know, ARP broadcast and stuff like that?

Gillian

Broadcasts are always flooded out all ports that are members of the same vlan.

Michael

There! you said it again, vlan!  What’s a vlan?

Gillian

My goodness!  I love your enthusiasm!  A vlan or “virtual lan” is simply a group of ports that you have put in the same broadcast  domain.  Take a 24 port switch for example, by default all ports can hear broadcasts from all other ports.  The switch is maintaining a CAM table of all 24 ports so that it can switch frames between ports.  This is a single lan, or vlan if you like, now take a hacksaw and saw the switch in half.  Now you have 2 vlans.  Computers in one vlan cannot talk or hear broadcasts from the other vlan.

Michael

So instead of actually sawing a switch into pieces, you can administratively create different vlans and assign ports to these vlans?  Am I getting that right?

Gillian

Exactly, the only switches that come with hacksaws are SMCs and the lower priced Addtrons.  On a Catalyst you create these separate vlans from the command line.  Each port can only be a member of one vlan though, there are exceptions like SPANning a port and trunking but for now, the rule is one vlan per port.

Michael

Ok, here’s a stupid question, how does this really work in the real world?  How do subnets figure in?  This is kind of confusing.

Gillian

You are such a cutie!  You’ve got it figured out and you don’t even know it!  Every vlan is a separate subnet!  You create a vlan called Accounting, all the computers in that vlan have IP addresses that place them in the same subnet.  All machine on the same subnet (vlan) hear broadcasts from the other machines on the same vlan.

Michael

How does the switch route traffic from one vlan to another?

Gillian

They don’t.

Michael

If the switches don’t route the packets from one subnet to another, how do the packets get routed?

Gillian (laughing hysterically)

Hummmm…Let’s see…how do packets get routed?  Humm, that’s a tough one!  They should invent something that routes packets…..they could call it….wait…..a ROUTER!  (more girlish giggling)

Michael

AAHHHhhh!  So the switch always needs a router connected to it if it’s going to route packets between vlans!

Gillian

You got it, Buckaroo!!!!

Check back often as Gillian reveals more
about vlans and switching!

   Back to RouterGod Online Magazine

]]> http://www.routergod.com/?feed=rss2&p=12