Configure GRE over IPsec VPN

I've visited many countries mostly in Asia trying to set up client VPN connections and for our Point-of-Presence (POP) connection back to our HQ in Singapore. I started doing network security (with CCNA Security) back in 2012 and I'm now enjoying the traveling perks because of my network security skills. This is me at Petronas Towers in Kuala Lumpur Malaysia where I setup a client site with MetroE as primary link and a DSL Internet as backup.

 

I've observed that many companies today are buying cheaper but secure WAN solution, especially those on a remote location. Companies also try to use VPN as a backup WAN solution.

It's fun educating my colleagues, mainly those who have routing and switching skills, about security terms, ASA firewall CLI (mostly on NAT) and recipes for creating IPsec VPNs. It also helps me reinforce my network security and ASA firewall knowledge. I always tell that the "official" security term is GRE over IPsec and the mnemonic I use is "GRE is covered by IPsec."

Branch(config)#interface loopback1
Branch(config-if)#
*Jan  3 23:37:17.179: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
Branch(config-if)#description Branch LAN
Branch(config-if)#ip address 192.168.1.1 255.255.255.0
Branch(config-if)#interface s0/0/1
Branch(config-if)#description Connection to ISP
Branch(config-if)#ip address 209.165.200.242 255.255.255.248
Branch(config-if)#bandwidth 64
Branch(config-if)#no shutdown
*Jan  3 23:38:07.179: %LINK-3-UPDOWN: Interface Serial0/0/1, changed state to down


HQ(config)#interface loopback1
HQ(config-if)#
*Jan  3 22:20:47.579: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
HQ(config-if)#description Headquarters LAN
HQ(config-if)#ip address 10.10.10.1 255.255.255.0
HQ(config-if)#interface s0/0/1
HQ(config-if)#description Connection to ISP
HQ(config-if)#ip address 209.165.200.226 255.255.255.248
HQ(config-if)#clock rate 64000
HQ(config-if)#bandwidth 64
HQ(config-if)#no shutdown
HQ(config-if)#
*Jan  3 22:21:55.527: %LINK-3-UPDOWN: Interface Serial0/0/1, changed state to up
*Jan  3 22:21:56.527: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to up


ISP(config)#interface loopback1
ISP(config-if)#
*Jan  3 22:59:50.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
ISP(config-if)#description Simulating the Internet
ISP(config-if)#ip address 209.165.202.129 255.255.255.240
ISP(config-if)#interface s0/0/0
ISP(config-if)#description Connection to Branch
ISP(config-if)#ip address 209.165.200.241 255.255.255.248
ISP(config-if)#clock rate 64000
ISP(config-if)#bandwidth 64
ISP(config-if)#no shutdown
ISP(config-if)#
*Jan  3 23:00:53.167: %LINK-3-UPDOWN: Interface Serial0/0/0, changed state to up
*Jan  3 23:00:54.167: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to up
ISP(config-if)#do ping 209.165.200.242

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.242, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/28 ms
ISP(config-if)#interface s0/0/1
ISP(config-if)#description Connection to HQ
ISP(config-if)#ip address 209.165.200.225 255.255.255.248
ISP(config-if)#bandwidth 64
ISP(config-if)#no shutdown
ISP(config-if)#do ping 209.165.200.226

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.226, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/28 ms
ISP(config-if)#exit
ISP(config)#ip route 209.165.200.232 255.255.255.248 serial0/0/1
ISP(config)#ip route 209.165.200.248 255.255.255.248 serial0/0/0


Branch#show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES NVRAM  administratively down down
FastEthernet0/1            unassigned      YES NVRAM  administratively down down
Serial0/0/0                unassigned      YES NVRAM  administratively down down
Serial0/0/1                209.165.200.242 YES manual up                    up 
Loopback1                  192.168.1.1     YES manual up                    up

Branch#tclsh
Branch(tcl)#foreach address {
+>209.165.200.241
+>209.165.202.129
+>209.165.200.226
+>} { ping $address }

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.241, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.202.129, timeout is 2 seconds:   // NO LEARNED ROUTE
.....
Success rate is 0 percent (0/5) 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.226, timeout is 2 seconds:   // NO LEARNED ROUTE
.....
Success rate is 0 percent (0/5)


Branch#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set   // NO DEFAULT ROUTE TO ISP

     209.165.200.0/29 is subnetted, 1 subnets
C       209.165.200.240 is directly connected, Serial0/0/1
C    192.168.1.0/24 is directly connected, Loopback1


Branch(config)#ip route 0.0.0.0 0.0.0.0 209.165.200.241

HQ(config)#ip route 0.0.0.0 0.0.0.0 209.165.200.225


Branch#tclsh
Branch(tcl)#foreach address {
+>209.165.200.241
+>209.165.202.129
+>209.165.200.226
+>} { ping $address }

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.241, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.202.129, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.226, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/56/56 ms


Branch#tclsh
Branch(tcl)#foreach address {
+>209.165.200.241
+>209.165.202.129
+>209.165.200.226
+>} { ping $address source 192.168.1.1 }

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.241, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1   // ISP BLOCKS PRIVATE IP; NO NAT CONFIGURED
.....
Success rate is 0 percent (0/5)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.202.129, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
.....
Success rate is 0 percent (0/5)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.200.226, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
.....
Success rate is 0 percent (0/5)


Branch(config)#ip access-list extended BRANCH_NAT_ACL    // SKIP NAT DUE TO ROUTER MEMORY ISSUE
Branch(config-ext-nacl)#remark ?
  LINE  Comment up to 100 characters
  <cr>

Branch(config-ext-nacl)#remark Do not translate Branch LAN to HQ LAN addresses
Branch(config-ext-nacl)#deny ip 192.168.1.0 0.0.0.255 10.10.0.0 0.0.255.255    // FOR S2S IPSEC VPN
Branch(config-ext-nacl)#remark Translate LAN to all Internet destinations
Branch(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 any   // NAT ACL
Branch(config-ext-nacl)#exit
Branch(config)#ip nat ?
  Stateful           Stateful NAT configuration commands
  create             Create flow entries
  inside             Inside address translation
  log                NAT Logging
  outside            Outside address translation
  piggyback-support  NAT Piggybacking Support
  pool               Define pool of addresses
  portmap            Define portmap of portranges
  service            Special translation for application using non-standard
                     port
  sip-sbc            SIP Session Border Controller commands
  source             Source address translation
  translation        NAT translation entry configuration

Branch(config)#ip nat pool ?
  WORD  Pool name

Branch(config)#ip nat pool BRANCH_NAT_POOL ?
  A.B.C.D        Start IP address
  netmask        Specify the network mask
  prefix-length  Specify the prefix length

Branch(config)#ip nat pool BRANCH_NAT_POOL 209.165.200.249 ?
  A.B.C.D  End IP address

Branch(config)#ip nat pool BRANCH_NAT_POOL 209.165.200.249 209.165.200.254 ?
  netmask        Specify the network mask
  prefix-length  Specify the prefix length

Branch(config)#ip nat pool BRANCH_NAT_POOL 209.165.200.249 209.165.200.254 prefix-length ?
  <1-32>  Prefix length

Branch(config)#ip nat pool BRANCH_NAT_POOL 209.165.200.249 209.165.200.254 prefix-length 29
Branch(config)#
*Jan  3 23:56:03.863: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up
Branch(config)#ip nat inside ?
  destination  Destination address translation
  source       Source address translation

Branch(config)#ip nat inside source ?
  list       Specify access list describing local addresses
  route-map  Specify route-map
  static     Specify static local->global mapping

Branch(config)#ip nat inside source list ?
  <1-2699>  Access list number for local addresses
  WORD      Access list name for local addresses

Branch(config)#ip nat inside source list BRANCH_NAT_ACL ?
  interface  Specify interface for global address
  pool       Name pool of global addresses

Branch(config)#ip nat inside source list BRANCH_NAT_ACL pool ?
  WORD  Pool name for global addresses

Branch(config)#ip nat inside source list BRANCH_NAT_ACL pool BRANCH_NAT_POOL

Branch(config)#interface loopback1
Branch(config-if)#ip nat inside
Branch(config-if)#interface s0/0/1
Branch(config-if)#ip nat outside
Branch(config-if)#end
Branch#ping 10.10.10.1 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1   // ISP CAN'T ROUTE PINGS TO PRIVATE IP ON HQ; IPsecVPN IS NEEDED TO PROTECT TRAFFIC TRAVERSING THE PUBLIC INTERNET
.....
Success rate is 0 percent (0/5)


Branch(config)#crypto ?
  ca            Certification authority
  call          Configure Crypto Call Admission Control
  ctcp          Configure cTCP encapsulation
  dynamic-map   Specify a dynamic crypto map template
  engine        Enter a crypto engine configurable menu
  gdoi          Configure GDOI policy
  identity      Enter a crypto identity list
  ipsec         Configure IPSEC policy
  isakmp        Configure ISAKMP policy
  key           Long term key operations
  keyring       Key ring commands
  logging       logging messages
  map           Enter a crypto map
  mib           Configure Crypto-related MIB Parameters
  pki           Public Key components
  provisioning  Secure Device Provisioning
  wui           Crypto HTTP configuration interfaces
  xauth         X-Auth parameters

Branch(config)#crypto isakmp ?
  aggressive-mode       Disable ISAKMP aggressive mode
  client                Set client configuration policy
  default               ISAKMP default policy
  enable                Enable ISAKMP
  fragmentation         IKE Fragmentation enabled if required
  identity              Set the identity which ISAKMP will use
  invalid-spi-recovery  Initiate IKE and send Invalid SPI Notify
  keepalive             Set a keepalive interval for use with IOS peers
  key                   Set pre-shared key for remote peer
  nat                   Set a nat  keepalive interval for use with IOS peers
  peer                  Set Peer Policy
  policy                Set policy for an ISAKMP protection suite
  profile               Define ISAKMP Profiles
  xauth                 Set Extended Authentication values

Branch(config)#crypto isakmp policy ?
  <1-10000>  Priority of protection suite

Branch(config)#crypto isakmp policy 1   // ISAKMP POLICY FOR PHASE 1
Branch(config-isakmp)#?
ISAKMP commands:
  authentication  Set authentication method for protection suite
  default         Set a command to its defaults
  encryption      Set encryption algorithm for protection suite
  exit            Exit from ISAKMP protection suite configuration mode
  group           Set the Diffie-Hellman group
  hash            Set hash algorithm for protection suite
  lifetime        Set lifetime for ISAKMP security association
  no              Negate a command or set its defaults

Branch(config-isakmp)#encryption ?
  3des  Three key triple DES
  aes   AES - Advanced Encryption Standard.
  des   DES - Data Encryption Standard (56 bit keys).

Branch(config-isakmp)#encryption aes
Branch(config-isakmp)#authentication ?
  pre-share  Pre-Shared Key
  rsa-encr   Rivest-Shamir-Adleman Encryption
  rsa-sig    Rivest-Shamir-Adleman Signature

Branch(config-isakmp)#authentication pre-share
Branch(config-isakmp)#group ?
  1   Diffie-Hellman group 1 (768 bit)
  14  Diffie-Hellman group 14 (2048 bit)
  15  Diffie-Hellman group 15 (3072 bit)
  16  Diffie-Hellman group 16 (4096 bit)
  2   Diffie-Hellman group 2 (1024 bit)
  5   Diffie-Hellman group 5 (1536 bit)

Branch(config-isakmp)#group 2
Branch(config-isakmp)#exit
Branch(config)#crypto isakmp ?
  aggressive-mode       Disable ISAKMP aggressive mode
  client                Set client configuration policy
  default               ISAKMP default policy
  enable                Enable ISAKMP
  fragmentation         IKE Fragmentation enabled if required
  identity              Set the identity which ISAKMP will use
  invalid-spi-recovery  Initiate IKE and send Invalid SPI Notify
  keepalive             Set a keepalive interval for use with IOS peers
  key                   Set pre-shared key for remote peer
  nat                   Set a nat  keepalive interval for use with IOS peers
  peer                  Set Peer Policy
  policy                Set policy for an ISAKMP protection suite
  profile               Define ISAKMP Profiles
  xauth                 Set Extended Authentication values

Branch(config)#crypto isakmp key ?
  0     Specifies an UNENCRYPTED password will follow
  6     Specifies an ENCRYPTED password will follow
  WORD  The UNENCRYPTED (cleartext) user password

Branch(config)#crypto isakmp key cisco123 ?
  address   define shared key with IP address
  hostname  define shared key with hostname

Branch(config)#crypto isakmp key cisco123 address 209.165.200.226
Branch(config)#crypto ipsec ?
  client                Configure a client
  default               Default transform-set
  df-bit                Handling of encapsulated DF bit.
  fragmentation         Handling of fragmentation of near-MTU sized packets
  nat-transparency      IPsec NAT transparency model
  optional              Enable optional encryption for IPSec
  profile               Configure an ipsec policy profile
  security-association  Security association parameters
  transform-set         Define transform and settings

Branch(config)#crypto ipsec transform-set ?
  WORD  Transform set tag

Branch(config)#crypto ipsec transform-set HQ-VPN ?
  ah-md5-hmac   AH-HMAC-MD5 transform
  ah-sha-hmac   AH-HMAC-SHA transform
  comp-lzs      IP Compression using the LZS compression algorithm
  esp-3des      ESP transform using 3DES(EDE) cipher (168 bits)
  esp-aes       ESP transform using AES cipher
  esp-des       ESP transform using DES cipher (56 bits)
  esp-md5-hmac  ESP transform using HMAC-MD5 auth
  esp-null      ESP transform w/o cipher
  esp-seal      ESP transform using SEAL cipher (160 bits)
  esp-sha-hmac  ESP transform using HMAC-SHA auth

Branch(config)#crypto ipsec transform-set HQ-VPN esp-3des ?
  ah-md5-hmac   AH-HMAC-MD5 transform
  ah-sha-hmac   AH-HMAC-SHA transform
  comp-lzs      IP Compression using the LZS compression algorithm
  esp-md5-hmac  ESP transform using HMAC-MD5 auth
  esp-sha-hmac  ESP transform using HMAC-SHA auth
  <cr>

Branch(config)#crypto ipsec transform-set HQ-VPN esp-3des esp-sha-hmac   // IPSEC POLICY FOR PHASE 2
Branch(cfg-crypto-trans)#exit
Branch(config)#crypto map ?
  WORD  Crypto map tag

Branch(config)#crypto map HQ-MAP ?
  <1-65535>       Sequence to insert into crypto map entry
  client          Specify client configuration settings
  gdoi            Configure crypto map gdoi features
  isakmp          Specify isakmp configuration settings
  isakmp-profile  Specify isakmp profile to use
  local-address   Interface to use for local address for this crypto map
  redundancy      High availability options for this map

Branch(config)#crypto map HQ-MAP 10 ?
  gdoi          GDOI
  ipsec-isakmp  IPSEC w/ISAKMP
  ipsec-manual  IPSEC w/manual keying
  <cr>

Branch(config)#crypto map HQ-MAP 10 ipsec-isakmp   // VPN TUNNEL INFO
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
Branch(config-crypto-map)#?
Crypto Map configuration commands:
  default        Set a command to its defaults
  description    Description of the crypto map statement policy
  dialer         Dialer related commands
  exit           Exit from crypto map configuration mode
  match          Match values.
  no             Negate a command or set its defaults
  qos            Quality of Service related commands
  reverse-route  Reverse Route Injection.
  set            Set values for encryption/decryption

Branch(config-crypto-map)#set ?
  identity              Identity restriction.
  ip                    Interface Internet Protocol config commands
  isakmp-profile        Specify isakmp Profile
  nat                   Set NAT translation
  peer                  Allowed Encryption/Decryption peer.
  pfs                   Specify pfs settings
  reverse-route         Reverse Route Injection.
  security-association  Security association parameters
  transform-set         Specify list of transform sets in priority order

Branch(config-crypto-map)#set peer ?
  A.B.C.D  IP address of peer
  WORD     Host name of the peer

Branch(config-crypto-map)#set peer 209.165.200.226
Branch(config-crypto-map)#set transform-set ?
  WORD  Proposal tag

Branch(config-crypto-map)#set transform-set HQ-VPN
Branch(config-crypto-map)#match ?
  address  Match address of packets to encrypt.

Branch(config-crypto-map)#match address ?
  <100-199>    IP access-list number
  <2000-2699>  IP access-list number (expanded range)
  WORD         Access-list name

Branch(config-crypto-map)#match address HQ-VPN-ACL
Branch(config-crypto-map)#exit
Branch(config)#ip access-list extended HQ-VPN-ACL
Branch(config-ext-nacl)#remark Branch to HQ traffic to trigger VPN
Branch(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 10.10.0.0 0.0.255.255   // CRYPTO ACL
Branch(config-ext-nacl)#exit
Branch(config)#interface s0/0/1
Branch(config-if)#crypto ?
  ipsec  Set IPSec parameters
  map    Assign a Crypto Map

Branch(config-if)#crypto map ?
  WORD  Crypto Map tag
  <cr>

Branch(config-if)#crypto map HQ-MAP   // APPLY CRYPTO MAP
*Jan  4 00:15:42.747: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON


HQ(config)#crypto isakmp policy 1
HQ(config-isakmp)#encryption aes
HQ(config-isakmp)#authentication pre-share
HQ(config-isakmp)#group 2
HQ(config-isakmp)#exit
HQ(config)#crypto isakmp key cisco123 address 209.165.200.242
HQ(config)#crypto ipsec transform-set BRANCH-VPN esp-3des esp-sha-hmac
HQ(cfg-crypto-trans)#exit
HQ(config)#crypto map BRANCH-MAP 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
        and a valid access list have been configured.
HQ(config-crypto-map)#set peer 209.165.200.242
HQ(config-crypto-map)#set transform-set BRANCH-VPN
HQ(config-crypto-map)#match address BRANCH-VPN-ACL
HQ(config-crypto-map)#exit
HQ(config)#ip access-list extended BRANCH-VPN-ACL
HQ(config-ext-nacl)#remark HQ to Branch traffic to trigger VPN
HQ(config-ext-nacl)#permit ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255   // CRYPTO ACL; MIRRORED

BRANCH ACL
HQ(config-ext-nacl)#exit
HQ(config)#interface s0/0/1
HQ(config-if)#crypto map BRANCH-MAP
HQ(config-if)#
*Jan  3 23:02:38.631: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON


Branch#show crypto ?
  call             Show crypto call admission info
  ctcp             cTCP connections
  datapath         Data Path
  debug-condition  Debug Condition filters
  dynamic-map      Crypto map templates
  eli              Encryption Layer Interface
  engine           Show crypto engine info
  gdoi             Show crypto gdoi
  ha               Crypto High Availability information
  identity         Show crypto identity list
  ipsec            Show IPSEC policy
  isakmp           Show ISAKMP
  key              Show long term public keys
  map              Crypto maps
  mib              Show Crypto-related MIB Parameters
  optional         Optional Encryption Status
  pki              Show PKI
  route            Show crypto VPN routes
  ruleset          Show crypto rules on outgoing packets
  session          Show crypto sessions (tunnels)
  sockets          Secure Socket Information
  tech-support     Displays relevant crypto information

Branch#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: Serial0/0/1
Session status: DOWN  
Peer: 209.165.200.226 port 500 fvrf: (none) ivrf: (none)  
      Desc: (none)
      Phase1_id: (none)
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 10.10.0.0/255.255.0.0  
        Active SAs: 0, origin: crypto map
        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0

Branch#ping 10.10.10.1 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
.!!!!  
Success rate is 80 percent (4/5), round-trip min/avg/max = 84/84/84 ms    // PING DROPPED DUE TO VPN HANDSHAKE

TUNNEL NEGOTIATION

Branch#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: Serial0/0/1
Uptime: 00:00:09
Session status: UP-ACTIVE  
Peer: 209.165.200.226 port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 209.165.200.226
      Desc: (none)
  IKE SA: local 209.165.200.242/500 remote 209.165.200.226/500 Active
          Capabilities:(none) connid:1001 lifetime:23:59:49
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 10.10.0.0/255.255.0.0
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 4 drop 0 life (KB/Sec) 4501643/3590  
        Outbound: #pkts enc'ed 4 drop 1 life (KB/Sec) 4501643/3590  

Branch#clear crypto isakmp
Branch#clear crypto sa  


Branch(config)#interface tunnel0   // IPSEC VPN DOES NOT ALLOW DYNAMIC ROUTING PROTOCOLS, MULTICAST

AND BROADCAST; WILL NEED GRE OVER IPSEC
Branch(config-if)#
*Jan  4 00:27:11.739: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
Branch(config-if)#ip address 172.16.100.2 255.255.255.252
Branch(config-if)#tunnel ?
  bandwidth           Set tunnel bandwidth informational parameter
  checksum            enable end to end checksumming of packets
  destination         destination of tunnel
  flow                flow options
  key                 security or selector key
  mode                tunnel encapsulation method
  mpls                MPLS tunnel commands
  path-mtu-discovery  Enable Path MTU Discovery on tunnel
  protection          Enable tunnel protection
  rbscp               Set tunnel RBSCP parameters
  route-via           Select subset of routes for tunnel transport
  sequence-datagrams  drop datagrams arriving out of order
  source              source of tunnel packets
  tos                 set type of service byte
  ttl                 set time to live
  udlr                associate tunnel with unidirectional interface
  vrf                 set tunnel vrf membership

Branch(config-if)#tunnel source ?
  A.B.C.D             ip address
  Async               Async interface
  Auto-Template       Auto-Template interface
  BVI                 Bridge-Group Virtual Interface
  CDMA-Ix             CDMA Ix interface
  CTunnel             CTunnel interface
  Dialer              Dialer interface
  FastEthernet        FastEthernet IEEE 802.3
  Lex                 Lex interface
  Loopback            Loopback interface
  MFR                 Multilink Frame Relay bundle interface
  Multilink           Multilink-group interface
  Null                Null interface
  SSLVPN-VIF          SSLVPN Virtual Interface
  Serial              Serial
  Tunnel              Tunnel interface
  Vif                 PGM Multicast Host interface
  Virtual-Dot11Radio  Virtual dot11 interface
  Virtual-PPP         Virtual PPP interface
  Virtual-Template    Virtual Template interface
  Virtual-TokenRing   Virtual TokenRing
  X:X:X:X::X          IPv6 address
  vmi                 Virtual Multipoint Interface

Branch(config-if)#tunnel source 209.165.200.242
Branch(config-if)#tunnel destination 209.165.200.226
Branch(config-if)#
*Jan  4 00:27:43.055: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up


HQ(config)#interface tunnel0
HQ(config-if)#
*Jan  3 23:10:26.883: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
HQ(config-if)#ip address 172.16.100.1 255.255.255.252
HQ(config-if)#tunnel source 209.165.200.226
HQ(config-if)#tunnel destination 209.165.200.242
HQ(config-if)#
*Jan  3 23:10:53.603: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up


Branch#show interfaces tunnel0
Tunnel0 is up, line protocol is up  
  Hardware is Tunnel
  Internet address is 172.16.100.2/30  
  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation TUNNEL, loopback not set  
  Keepalive not set
  Tunnel source 209.165.200.242, destination 209.165.200.226
  Tunnel protocol/transport GRE/IP   
    Key disabled, sequencing disabled
    Checksumming of packets disabled
  Tunnel TTL 255
  Fast tunneling enabled
  Tunnel transport MTU 1476 bytes
  Tunnel transmit bandwidth 8000 (kbps)
  Tunnel receive bandwidth 8000 (kbps)
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

Branch#ping 172.16.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 68/69/72 ms


Branch#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: Serial0/0/1
Session status: DOWN    // TRAFFIC IS NOT ENCRYPTED
Peer: 209.165.200.226 port 500 fvrf: (none) ivrf: (none)
      Desc: (none)
      Phase1_id: (none)
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 10.10.0.0/255.255.0.0
        Active SAs: 0, origin: crypto map
        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0


Branch(config)#no ip access-list extended HQ-VPN-ACL
Branch(config)#ip access-list extended HQ-VPN-ACL
Branch(config-ext-nacl)#remark HQ to Branch GRE traffic to trigger VPN
Branch(config-ext-nacl)#permit gre host 209.165.200.242 host 209.165.200.226   // MAKE GRE TRAFFIC INTERESTING


HQ(config)#no ip access-list extended BRANCH-VPN-ACL
HQ(config)#ip access-list extended BRANCH-VPN-ACL
HQ(config-ext-nacl)#remark Branch to HQ GRE traffic to trigger VPN
HQ(config-ext-nacl)#permit gre host 209.165.200.226 host 209.165.200.242


Branch#ping 172.16.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.100.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 96/97/100 ms

Branch#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: Serial0/0/1
Uptime: 00:00:19
Session status: UP-ACTIVE  
Peer: 209.165.200.226 port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 209.165.200.226
      Desc: (none)
  IKE SA: local 209.165.200.242/500 remote 209.165.200.226/500 Active  
          Capabilities:(none) connid:1002 lifetime:23:59:40
  IPSEC FLOW: permit 47 host 209.165.200.242 host 209.165.200.226   // GRE PROTOCOL 47
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 4 drop 0 life (KB/Sec) 4426451/3580   
        Outbound: #pkts enc'ed 4 drop 1 life (KB/Sec) 4426451/3580    


Branch#ping 10.10.10.1 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1   // PING DROPS DUE TO NO ROUTE TO HQ
.....
Success rate is 0 percent (0/5)

Branch#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 209.165.200.241 to network 0.0.0.0

     172.16.0.0/30 is subnetted, 1 subnets
C       172.16.100.0 is directly connected, Tunnel0
     209.165.200.0/29 is subnetted, 1 subnets
C       209.165.200.240 is directly connected, Serial0/0/1
C    192.168.1.0/24 is directly connected, Loopback1
S*   0.0.0.0/0 [1/0] via 209.165.200.241


Branch(config)#router eigrp 1
Branch(config-router)#network 192.168.1.0 0.0.0.255
Branch(config-router)#network 172.16.100.0 0.0.0.3


HQ(config)#router eigrp 1
HQ(config-router)#network 10.10.0.0 0.0.255.255
HQ(config-router)#network 172.16.100.0 0.0.0.3
HQ(config-router)#
*Jan  3 23:26:09.743: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.100.2 (Tunnel0) is up: new

adjacency


Branch#show ip eigrp neighbor
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   172.16.100.1            Tu0               12 00:00:21   88  2151  0  3

Branch#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 209.165.200.241 to network 0.0.0.0

     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
D       172.16.0.0/16 is a summary, 00:01:08, Null0
C       172.16.100.0/30 is directly connected, Tunnel0
     209.165.200.0/29 is subnetted, 1 subnets
C       209.165.200.240 is directly connected, Serial0/0/1
D    10.0.0.0/8 [90/27008000] via 172.16.100.1, 00:00:23, Tunnel0
C    192.168.1.0/24 is directly connected, Loopback1
S*   0.0.0.0/0 [1/0] via 209.165.200.241

Branch#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: Serial0/0/1
Uptime: 00:08:38
Session status: UP-ACTIVE  
Peer: 209.165.200.226 port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 209.165.200.226
      Desc: (none)
  IKE SA: local 209.165.200.242/500 remote 209.165.200.226/500 Active
          Capabilities:(none) connid:1002 lifetime:23:51:21
  IPSEC FLOW: permit 47 host 209.165.200.242 host 209.165.200.226
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 19 drop 0 life (KB/Sec) 4426449/3081   
        Outbound: #pkts enc'ed 29 drop 1 life (KB/Sec) 4426448/3081   

Branch#ping 10.10.10.1 source 192.168.1.1   // LAN-TO-LAN (SITE-TO-SITE VPN) HAS REACHABILITY

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 96/98/100 ms

Branch#show crypto session detail
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: Serial0/0/1
Uptime: 00:09:45
Session status: UP-ACTIVE  
Peer: 209.165.200.226 port 500 fvrf: (none) ivrf: (none)
      Phase1_id: 209.165.200.226
      Desc: (none)
  IKE SA: local 209.165.200.242/500 remote 209.165.200.226/500 Active
          Capabilities:(none) connid:1002 lifetime:23:50:13
  IPSEC FLOW: permit 47 host 209.165.200.242 host 209.165.200.226
        Active SAs: 2, origin: crypto map
        Inbound:  #pkts dec'ed 39 drop 0 life (KB/Sec) 4426446/3014  
        Outbound: #pkts enc'ed 49 drop 1 life (KB/Sec) 4426445/3014  

Branch#traceroute 10.10.20.238 source 192.168.1.1

Type escape sequence to abort.
Tracing the route to 10.10.20.238

  1 172.16.100.1 68 msec *  68 msec   // HOPS TO HQ GRE TUNNEL (ENCRYPTED); BRANCH UNAWARE IT TRAVERSED PUBLIC INTERNET

Converting Lightweight AP to Autonomous AP

Our warehouse mistakenly bought the Cisco AIR-CAP1602E-E-K9, which is the Lightweight or Controller-based access point. We should be getting the AIR-SAP1602E-E-K9 Standalone access point in the first place. I had no choice but to convert them from Lightweight to Autonomous type AP since it would be difficult to replace them with the vendor because of the price difference. Last time I did this was way back in 2009 on a Cisco Aironet 1100 series during my first job as a Network Administrator for a pharmaceutical company in Singapore.

In Cisco.com's website, it showed several ways to convert an access point from Lightweight to Autonomous and vice-versa using archive download-sw (just like when upgrading a Catalyst switch) and by also using (or holding) the MODE button. I tried them all but this one worked for me. We must first need to know the basics of the AP's IOS. There are three type of IOS being used:

* k9w7: Autonomous IOS (which I'm going to use for conversion)

* k9w8: Lightweight IOS (currently used by my LWAP)

* rcvk9w8: Lightweight recovery image (like a bootstrap IOS in a router)

This is the initial boot sequence from a Cisco AIR-CAP1602E-E-K9. For my setup, I just used an 8-port Cisco switch using default config (ports on VLAN 1) and static IP address 10.1.1.1/8 on my PC running TFTP server.


Boot from flash

IOS Bootloader - Starting system.

 FLASH CHIP: Micronix MX25L256_35F

Xmodem file system is available.

flashfs[0]: 5 files, 2 directories

flashfs[0]: 0 orphaned files, 0 orphaned directories

flashfs[0]: Total bytes: 31936000

flashfs[0]: Bytes used: 6554112

flashfs[0]: Bytes available: 25381888

flashfs[0]: flashfs fsck took 9 seconds.

Reading cookie from SEEPROM

Base Ethernet MAC address: c0:8c:60:1f:24:ab

 ************* loopback_mode = 0

Loading "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx"...####################

File "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx" uncompressed and installed, entry point: 0x100000

executing...


              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco IOS Software, C1600 Software (AP1G2-RCVK9W8-M), Version 15.2(2)JB2, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Mon 29-Jul-13 12:40 by prod_rel_team

Initializing flashfs...
 FLASH CHIP: Micronix MX25L256_35F

flashfs[2]: 5 files, 2 directories
flashfs[2]: 0 orphaned files, 0 orphaned directories
flashfs[2]: Total bytes: 31808000
flashfs[2]: Bytes used: 6554112
flashfs[2]: Bytes available: 25253888
flashfs[2]: flashfs fsck took 9 seconds.
flashfs[2]: Initialization complete.
flashfs[3]: 0 files, 1 directories
flashfs[3]: 0 orphaned files, 0 orphaned directories
flashfs[3]: Total bytes: 11999232
flashfs[3]: Bytes used: 1024
flashfs[3]: Bytes available: 11998208
flashfs[3]: flashfs fsck took 1 seconds.
flashfs[3]: Initialization complete....done Initializing flashfs.

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
memory validate-checksum 30
 ^
% Invalid input detected at '^' marker.

no ip http server
       ^
% Invalid input detected at '^' marker.
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for

login authentication default
  ^
% Invalid input detected at '^' marker.

compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.


Warning:  the compile-time code checksum does not appear to be present.
cisco AIR-CAP1602E-E-K9    (PowerPC) processor (revision B0) with 98294K/32768K bytes of memory.
Processor board ID FGL1735Wabc
PowerPC CPU at 533Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 7.4.1.37
1 Gigabit Ethernet interface

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: C0:8C:60:1F:24:ab
Part Number                          : 73-14508-04
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  :
PCB Serial Number                    : FOC17292abc
Top Assembly Part Number             : 800-38553-01
Top Assembly Serial Number           : FGL1735Wabc
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP1602E-E-K9  
% Please define a domain-name first.
logging facility kern
        ^
% Invalid input detected at '^' marker.

logging trap emergencies
        ^
% Invalid input detected at '^' marker.



Press RETURN to get started!


*Mar  1 00:00:12.363: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Mar  1 00:00:13.595: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar  1 00:00:14.599: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Mar  1 00:00:15.039: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C1600 Software (AP1G2-RCVK9W8-M), Version 15.2(2)JB2, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Mon 29-Jul-13 12:40 by prod_rel_team
*Mar  1 00:00:15.067: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Mar  1 00:00:15.067: %CAPWAP-3-ERRORLOG: Failed to load configuration from flash. Resetting to default config
*Mar  1 00:00:16.111: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to uplwapp_crypto_init: MIC Present and Parsed Successfully

no bridge-group 1 source-learning
                   ^
% Invalid input detected at '^' marker.
%Default route without gateway, if not a point-to-point interface, may impact performance

User Access Verification

Username: Cisco
Password: <Cisco>

APc08c.601f.2460>enable
Password: capwap process not yet started.Please execute enable command again

APc08c.601f.2460>
*Mar  1 00:00:44.327: %CDP_PD-4-POWER_OK: All radios disabled - NEGOTIATED inline power source
APc08c.601f.2460>enable
Password: <Cisco>
APc08c.601f.2460#conf t
                  ^
% Invalid input detected at '^' marker.

APc08c.601f.24ab#debug
*Mar  1 00:00:53.847: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!  ca
APc08c.601f.24ab#debug capwap console cli   // NEED TO ISSUE THIS COMMAND IN ORDER TO GO TO GLOBAL CONFIG MODE
This command is meant only for debugging/troubleshooting
Any configuration change may result in different
behavior from centralized configuration.

CAPWAP console CLI allow/disallow debugging is on
APc08c.601f.24ab#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
APc08c.601f.24ab(config)#
*Mar  1 00:01:03.847: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
APc08c.601f.24ab(config)#do show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
BVI1                       unassigned      YES DHCP   up                    up     
GigabitEthernet0           unassigned      NO  unset  up                    up     
GigabitEthernet0.1         unassigned      YES unset  up                    up     
APc08c.601f.24ab(config)#interface bvi1
APc08c.601f.24ab(config-if)#ip add 10.1.1.1
*Mar  1 00:01:13.847: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !! 
APc08c.601f.24ab(config-if)#ip address 10.1.1.1 2 255.0.0.0
APc08c.601f.24ab(config-if)#end
APc08c.601f.24ab#
*Mar  1 00:01:20.343: %SYS-5-CONFIG_I: Configured from console by Cisco on console
APc08c.601f.2460#archive download-sw /force-reload /overwrite tftp://10.1.1.1/ap1g2k9w7-tar.153-3.JAB.tar      // I HAD SUCCESS WITH TWO APs USING THIS COMMAND; IT'S NOT 100% GUARANTEE IT WILL ALWAYS WORK
examining image...
Loading ap1g2-k9w7-tar.153-3.JAB.tar from 10.1.1.1 (via BVI1): !
extracting info (288 bytes)
Image info:
    Version Suffix: k9w7-.153-3.JAB
    Image Name: ap1g2-k9w7-mx.153-3.JAB
    Version Directory: ap1g2-k9w7-mx.153-3.JAB
    Ios Image Size: 1290752
    Total Image Size: 11387392
    Image Feature: WIRELESS LAN|LWAPP
    Image Family: AP1G2
    Wireless Switch Management Version: 8.0.72.236
Extracting files...
ap1g2-k9w7-mx.153-3.JAB/ (directory) 0 (bytes)
extracting ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-mx.153-3.JAB (123464 bytes)
ap1g2-k9w7-mx.153-3.JAB/html/ (directory) 0 (bytes)
ap1g2-k9w7-mx.153-3.JAB/html/level/ (directory) 0 (bytes)
ap1g2-k9w7-mx.153-3.JAB/html/level/1/ (directory) 0 (bytes)
extracting ap1g2-k9w7-mx.153-3.JAB/html/level/1/appsui.js (563 bytes)
extracting ap1g2-k9w7-mx.153-3.JAB/html/level/1/back.shtml (512 bytes)
extracting ap1g2-k9w7-mx.153-3.JAB/html/level/1/cookies.js (5032 bytes)


<OUTPUT TRUNCATED>

extracting ap1g2-k9w7-mx.153-3.JAB/html/level/15/ap_contextmgr_scm-groups.shtml.gz (7586 bytes)
extracting ap1g2-k9w7-mx.153-3.JAB/html/level/15/ap_contextmgr_scm_summary.shtml.gz (5194 bytes)
extracting ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-xx.153-3.JAB (8810727 bytes)!!!!!!!!!!!!!!!!!!!!
*Mar  1 00:03:19.305: %CAPWAP-3-STATIC_TO_DHCP_IP: Could not discover WLC using static IP. Forcing AP to use DHCP...     // WILL REVERT BVI PORT TO DHCP, IOS UPDATE WILL GET DISRUPTED
*Mar  1 00:03:29.309: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !! .
*Mar  1 00:03:39.309: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!  [timed out]

Premature end of tar file      // I KEEP GETTING THIS ERROR EACH TIME I REPEAT THE CONVERSION PROCESS
ERROR: Problem extracting files from archive.
Download image failed, notify controller!!! From:7.4.1.37 to 8.0.72.236, FailureCode:3
archive download: takes 137 seconds

APc08c.601f.24ab#
APc08c.601f.24ab#
Not in Bound state.
*Mar  1 00:03:49.309: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
*Mar  1 00:03:49.309: %CAPWAP-3-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP.


This is a sure way of getting the right IOS on the AP by first deleting the recovery image file and boot it up afterwards (just like a ROMmon in IOS router).

APc08c.601f.24ab#show flash

Directory of flash:/

    2  -rwx        1048   Mar 1 1993 00:00:20 +00:00  private-multiple-fs
    3  -rwx           0   Mar 1 1993 00:00:34 +00:00  config.txt
   12  drwx         128   Mar 1 1993 00:03:03 +00:00  ap1g2-rcvk9w8-mx    // DIRECTORY
    4  -rwx         155   Jan 1 1970 00:01:46 +00:00  env_vars

31808000 bytes total (25253888 bytes free)
APc08c.601f.2460#
*Mar  1 00:03:59.309: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !! dir
APc08c.601f.24ab#dir ap1g2-rcvk9w8-mx
Directory of flash:/ap1g2-rcvk9w8-mx/

   13  -rwx     6550041   Mar 1 1993 00:03:03 +00:00  ap1g2-rcvk9w8-mx   // ACTUAL RECOVERY IMAGE FILE
   14  -rwx         273   Mar 1 1993 00:03:03 +00:00  info

31808000 bytes total (25253888 bytes free)
APc08c.601f.24ab#
*Mar  1 00:04:09.309: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
APc08c.601f.24ab#delete flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx   // DELETE THE RECOVERY IMAGE/IOS
Delete filename [/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx]?
Delete flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx? [confirm]

*Mar  1 00:04:19.489: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
APc08c.601f.24ab#
*Mar  1 00:04:29.489: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
APc08c.601f.24ab#dir
Directory of flash:/

    2  -rwx        1048   Mar 1 1993 00:00:20 +00:00  private-multiple-fs
    3  -rwx           0   Mar 1 1993 00:00:34 +00:00  config.txt
   12  drwx          64   Mar 1 1993 00:04:23 +00:00  ap1g2-rcvk9w8-mx
    4  -rwx         155   Jan 1 1970 00:01:46 +00:00  env_vars

31808000 bytes total (31804416 bytes free)

APc08c.601f.24ab#dir ap1g2-rcvk9w8-mx
Directory of flash:/ap1g2-rcvk9w8-mx/

   14  -rwx         273   Mar 1 1993 00:03:03 +00:00  info

31808000 bytes total (31804416 bytes free)
APc08c.601f.2460#reload

System configuration has been modified. Save? [yes/no]: y
Proceed with reload? [confirm]

Writing out the event log to flash:/event.log ...

Write of event.log done


*Mar  1 00:04:49.489: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
*Mar  1 00:04:50.657: %SYS-5-RELOAD: Reload requested by Cisco on console. Reload Reason: Reload Command.
*Mar  1 00:04:50.657: %LWAPP-5-CHANGED: CAPWAP changed state to DOWN
Boot from flash


IOS Bootloader - Starting system.

 FLASH CHIP: Micronix MX25L256_35F

Xmodem file system is available.

flashfs[0]: 5 files, 2 directories

flashfs[0]: 0 orphaned files, 0 orphaned directories

flashfs[0]: Total bytes: 31936000

flashfs[0]: Bytes used: 6656

flashfs[0]: Bytes available: 31929344

flashfs[0]: flashfs fsck took 9 seconds.

Reading cookie from SEEPROM

Base Ethernet MAC address: c0:8c:60:1f:24:60

 ************* loopback_mode = 0

Loading "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx"...flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx: no such file or directory


Error loading "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx"


Interrupt within 5 seconds to abort boot process.

Boot process failed...


The system is unable to boot automatically.  The BOOT

environment variable needs to be set to a bootable

image.


C1600 Boot Loader (AP1G2-BOOT-M) LoaderVersion 15.2(2)JAX, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Compiled Fri 30-Nov-12 15:48 by aselvara

ap: set IP_ADDR 10.1.1.2   

ap: set NETMASK 255.0.0.0

ap: set DEFAULT_ROUTER 10.1.1.1

ap: tftp_init    // I'VE USED AN ADDITIONAL COMMAND ether_init WHEN CONVERTING 2600 AP TO AUTONOUS

ap: tar -xtract tftp://10.1.1.1/ap1g2-k9w7-tar.153-3.JAB.tar flash:    // SIMILAR TO tftpdnld COMMAND IN IOS ROUTER


extracting info (288 bytes)

ap1g2-k9w7-mx.153-3.JAB/ (directory) 0 (bytes)

extracting ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-mx.153-3.JAB (123464 bytes)..........................

ap1g2-k9w7-mx.153-3.JAB/html/ (directory) 0 (bytes)

ap1g2-k9w7-mx.153-3.JAB/html/level/ (directory) 0 (bytes)

ap1g2-k9w7-mx.153-3.JAB/html/level/1/ (directory) 0 (bytes)


<OUTPUT TRUNCATED>

extracting ap1g2-k9w7-mx.153-3.JAB/img_sign_rel.cert (1375 bytes)

extracting ap1g2-k9w7-mx.153-3.JAB/img_sign_rel_sha2.cert (1371 bytes)

extracting info.ver (288 bytes)ap: set BOOT flash:ap1g2-k9w7-tar.153-3.JAB.tar

ap: set    // TO CHECK AP INITIAL SETTINGS

BOOT=flash:ap1g2-k9w7-tar.153-3.JAB.tar

DEFAULT_ROUTER=10.1.1.1

ENABLE_BREAK=yes

IP_ADDR=10.1.1.2

MANUAL_BOOT=no

NETMASK=255.0.0.0

RELOAD_REASON=41

TERMLINES=0

ap: boot

Loading "flash:ap1g2-k9w7-tar.153-3.JAB.tar"...flash:ap1g2-k9w7-tar.153-3.JAB.tar: no such file or directory


Error loading "flash:ap1g2-k9w7-tar.153-3.JAB.tar"


Interrupt within 5 seconds to abort boot process.

Loading "flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-mx.153-3.JAB"...##############


File "flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-mx.153-3.JAB" uncompressed and installed, entry point: 0x2004000

executing...


Secondary Bootloader - Starting system.

 FLASH CHIP: Micronix MX25L256_35F

Xmodem file system is available.

flashfs[0]: 210 files, 8 directories

flashfs[0]: 0 orphaned files, 0 orphaned directories

flashfs[0]: Total bytes: 31936000

flashfs[0]: Bytes used: 11331584

flashfs[0]: Bytes available: 20604416

flashfs[0]: flashfs fsck took 10 seconds.

Reading cookie from SEEPROM

Base Ethernet MAC address: c0:8c:60:1f:24:60

Secondary bootloader Ethernet not enabled, skip ether_init


Unable to locate IOS image with name **xx**.

Boot CMD: 'boot  flash:ap1g2-k9w7-tar.153-3.JAB.tar;flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-xx.153-3.JAB'

Loading "flash:ap1g2-k9w7-tar.153-3.JAB.tar"...flash:ap1g2-k9w7-tar.153-3.JAB.tar: no such file or directory


Error loading "flash:ap1g2-k9w7-tar.153-3.JAB.tar"


Interrupt within 5 seconds to abort boot process.

Unable to locate IOS image with name **xx**.

Boot CMD: 'flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-xx.153-3.JAB'

Loading "flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-xx.153-3.JAB"...####################################

File "flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-xx.153-3.JAB" uncompressed and installed, entry point: 0x100000

executing...


              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco IOS Software, C1600 Software (AP1G2-K9W7-M), Version 15.3(3)JAB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Tue 02-Sep-14 20:36 by prod_rel_team

Initializing flashfs...
 FLASH CHIP: Micronix MX25L256_35F

flashfs[2]: erasing block[0]...
flashfs[2]: erasing block[1]...
flashfs[2]: 210 files, 8 directories
flashfs[2]: 0 orphaned files, 0 orphaned directories
flashfs[2]: Total bytes: 31808000
flashfs[2]: Bytes used: 11331584
flashfs[2]: Bytes available: 20476416
flashfs[2]: flashfs fsck took 11 seconds.
flashfs[2]: Initialization complete.
flashfs[4]: 0 files, 1 directories
flashfs[4]: 0 orphaned files, 0 orphaned directories
flashfs[4]: Total bytes: 11999232
flashfs[4]: Bytes used: 1024
flashfs[4]: Bytes available: 11998208
flashfs[4]: flashfs fsck took 0 seconds.
flashfs[4]: Initialization complete....done Initializing flashfs.

Radio0  present 8764B 8000 0 A8000000 A8010000 0
Rate table has 586 entries (20 legacy/160 11n/406 11ac)

POWER TABLE FILENAME = flash:/ap1g2-k9w7-mx.153-3.JAB/S2.bin

Radio1  present 8764B 8000 0 88000000 88010000 4
POWER TABLE FILENAME = flash:/ap1g2-k9w7-mx.153-3.JAB/S5.bin

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco AIR-SAP1602E-E-K9 (PowerPC) processor (revision B0) with 187382K/74672K bytes of memory.
Processor board ID FGL1735W7LF
PowerPC CPU at 533Mhz, revision number 0x2151
Last reset from power-on
1 Gigabit Ethernet interface
2 802.11 Radios

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: C0:8C:60:1F:24:ab
Part Number                          : 73-14508-04
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  :
PCB Serial Number                    : FOC17292abc
Top Assembly Part Number             : 800-38553-01
Top Assembly Serial Number           : FGL1735Wab
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP1602E-E-K9  



Press RETURN to get started!


*Mar  1 00:00:13.891: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed (15)
*Mar  1 00:00:14.719: APAVC:  WlanPAKs 9355 RadioPaks  8747

*Mar  1 00:00:20.827: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0 (4)
*Mar  1 00:00:27.207: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 1 (4)
*Mar  1 00:00:29.931: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar  1 00:00:31.059: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Mar  1 00:00:31.243: Starting Ethernet promiscuous mode
*Mar  1 00:00:31.299: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to administratively down
*Mar  1 00:00:31.303: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down
*Mar  1 00:00:31.319: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C1600 Software (AP1G2-K9W7-M), Version 15.3(3)JAB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Tue 02-Sep-14 20:36 by prod_rel_team
*Mar  1 00:00:31.319: %SNMP-5-COLDSTART: SNMP agent on host ap is undergoing a cold start
*Mar  1 00:00:32.295: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Mar  1 00:00:32.299: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Mar  1 00:00:32.303: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Mar  1 00:00:43.547: %CDP_PD-4-POWER_OK: Full power - NEGOTIATED inline power source
ap>show version
Cisco IOS Software, C1600 Software (AP1G2-K9W7-M), Version 15.3(3)JAB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Tue 02-Sep-14 20:36 by prod_rel_team

ROM: Bootstrap program is C1600 boot loader
BOOTLDR: C1600 Boot Loader (AP1G2-BOOT-M) LoaderVersion 15.2(2)JAX, RELEASE SOFTWARE (fc1)

ap uptime is 1 minute
System returned to ROM by power-on
System image file is "flash:/ap1g2-k9w7-mx.153-3.JAB/ap1g2-k9w7-xx.153-3.JAB"
Last reload reason:



This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
 --More--         agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco AIR-SAP1602E-E-K9 (PowerPC) processor (revision B0) with 187382K/74672K bytes of memory.
Processor board ID FGL1735W7LF
PowerPC CPU at 533Mhz, revision number 0x2151
Last reset from power-on
1 Gigabit Ethernet interface
2 802.11 Radios

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: C0:8C:60:1F:24:ab
Part Number                          : 73-14508-04
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  :
PCB Serial Number                    : FOC17292abc
 --More--         Top Assembly Part Number             : 800-38553-01
Top Assembly Serial Number           : FGL1735Wabc
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP1602E-E-K9    // MUST BE COSMETIC BUG

Configuration register is 0xF

ap>

BGP Route Reflectors and Route Filters

We've deployed BGP route reflectors globally in our enterprise. For each region (ours is APAC), we installed two Cisco ASR-1002X as BGP route reflectors (the other one for redundancy). These beefy routers can easily hold thousands of megabytes of public Internet routes. This also makes our IBGP config smaller and more scalable since it doesn't need a full mesh on all IBGP peers.

I did a route reflector lab for CCNP ROUTE. I got a bit intimated doing this lab since BGP isn't my strong point but while I was already doing the configuration, it's not so bad after all. It's just a matter of having a good solid BGP foundation (from my ISP job background) that I was able to pull this off.

 

SanJose1(config)#interface s0/0/0
SanJose1(config-if)#ip address 192.168.1.5 255.255.255.252
SanJose1(config-if)#clock rate 128000
SanJose1(config-if)#no shutdown
SanJose1(config-if)#
*Jan  3 15:34:53.515: %LINK-3-UPDOWN: Interface Serial0/0/0, changed state to down


SanJose2(config)#interface loopback0
SanJose2(config-if)#
*Jan  3 14:17:39.863: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
SanJose2(config-if)#ip address 10.2.2.1 255.255.255.0
SanJose2(config-if)#interface s0/0/0
SanJose2(config-if)#ip address 192.168.1.6 255.255.255.252
SanJose2(config-if)#no shutdown
SanJose2(config-if)#
*Jan  3 14:18:14.847: %LINK-3-UPDOWN: Interface Serial0/0/0, changed state to up
*Jan  3 14:18:15.847: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to up
SanJose2(config-if)#do ping 192.168.1.5

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/16 ms
SanJose2(config-if)#interface s0/0/1
SanJose2(config-if)#ip address 172.24.1.17 255.255.255.0
SanJose2(config-if)#clock rate 128000
SanJose2(config-if)#no shutdown
SanJose2(config-if)#
*Jan  3 14:18:44.299: %LINK-3-UPDOWN: Interface Serial0/0/1, changed state to up
*Jan  3 14:18:45.299: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to up


SanJose3(config)#interface s0/0/1
SanJose3(config-if)#ip address 172.24.1.18 255.255.255.0
SanJose3(config-if)#no shutdown
SanJose3(config-if)#do ping 172.24.1.17

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.1.17, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms


SanJose1(config)#router rip
SanJose1(config-router)#version 2
SanJose1(config-router)#no auto-summary
SanJose1(config-router)#network 192.168.1.0


SanJose2(config)#router rip
SanJose2(config-router)#version 2
SanJose2(config-router)#no auto-summary
SanJose2(config-router)#network 172.24.0.0
SanJose2(config-router)#network 192.168.1.0
SanJose2(config-router)#network 10.0.0.0


SanJose3(config)#router rip
SanJose3(config-router)#version 2
SanJose3(config-router)#no auto-summary
SanJose3(config-router)#network 172.24.0.0


SanJose1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
R       172.24.1.0 [120/1] via 192.168.1.6, 00:00:06, Serial0/0/0
     10.0.0.0/24 is subnetted, 1 subnets
R       10.2.2.0 [120/1] via 192.168.1.6, 00:00:06, Serial0/0/0
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0


SanJose1#tclsh
SanJose1(tcl)#foreach address {
+>10.2.2.1
+>192.168.1.5
+>192.168.1.6
+>172.24.1.17
+>172.24.1.18
+>} {
+>ping $address }

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.1.17, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.1.18, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms


SanJose2(config)#router bgp 100
SanJose2(config-router)#neighbor 192.168.1.5 remote-as 100
SanJose2(config-router)#neighbor 172.24.1.18 remote-as 100


SanJose1(config)#router bgp 100
SanJose1(config-router)#neighbor 192.168.1.6 remote-as 100
SanJose1(config-router)#
*Jan  3 15:44:53.379: %BGP-5-ADJCHANGE: neighbor 192.168.1.6 Up


SanJose3(config)#router bgp 100
SanJose3(config-router)#neighbor 172.24.1.17 remote-as 100
SanJose3(config-router)#
*Jan  3 15:04:45.779: %BGP-5-ADJCHANGE: neighbor 172.24.1.17 Up


SanJose2#show ip bgp neighbors
BGP neighbor is 172.24.1.18,  remote AS 100, internal link  
  BGP version 4, remote router ID 172.24.1.18
  BGP state = Established, up for 00:00:52  
  Last read 00:00:52, last write 00:00:52, hold time is 180, keepalive interval is 60 seconds
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    New ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
  Message statistics:
    InQ depth is 0
    OutQ depth is 0

                         Sent       Rcvd
    Opens:                  1          1
    Notifications:          0          0
    Updates:                0          0
    Keepalives:             1          1
    Route Refresh:          0          0
    Total:                  2          2
  Default minimum time between advertisement runs is 0 seconds

 For address family: IPv4 Unicast
  BGP table version 1, neighbor version 0/0
  Output queue size : 0
  Index 2, Offset 0, Mask 0x4
  2 update-group member
                                 Sent       Rcvd
  Prefix activity:               ----       ----
    Prefixes Current:               0          0
    Prefixes Total:                 0          0
    Implicit Withdraw:              0          0
    Explicit Withdraw:              0          0
    Used as bestpath:             n/a          0
    Used as multipath:            n/a          0

                                   Outbound    Inbound
  Local Policy Denied Prefixes:    --------    -------
    Total:                                0          0
  Number of NLRIs in the update sent: max 0, min 0

  Address tracking is enabled, the RIB does have a route to 172.24.1.18
  Connections established 1; dropped 0
  Last reset never
  Transport(tcp) path-mtu-discovery is enabled
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 255
Local host: 172.24.1.17, Local port: 179
Foreign host: 172.24.1.18, Foreign port: 14628
Connection tableid (VRF): 0

Enqueued packets for retransmit: 0, input: 0  mis-ordered: 0 (0 bytes)

Event Timers (current time is 0x12422C):
Timer          Starts    Wakeups            Next
Retrans             4          0             0x0
TimeWait            0          0             0x0
AckHold             3          2             0x0
SendWnd             0          0             0x0
KeepAlive           0          0             0x0
GiveUp              0          0             0x0
PmtuAger            0          0             0x0
DeadWait            0          0             0x0
Linger              0          0             0x0
ProcessQ            0          0             0x0

iss: 1760080277  snduna: 1760080369  sndnxt: 1760080369     sndwnd:  16293
irs:  615136447  rcvnxt:  615136539  rcvwnd:      16293  delrcvwnd:     91

SRTT: 124 ms, RTTO: 1405 ms, RTV: 1281 ms, KRTT: 0 ms
minRTT: 8 ms, maxRTT: 300 ms, ACK hold: 200 ms
Status Flags: passive open, gen tcbs
Option Flags: nagle, path mtu capable
IP Precedence value : 6

Datagrams (max data segment is 1460 bytes):
Rcvd: 7 (out of order: 0), with data: 3, total data bytes: 91
Sent: 6 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 3, total

data bytes: 91
 Packets received in fast path: 0, fast processed: 0, slow path: 0
 fast lock acquisition failures: 0, slow path: 0

BGP neighbor is 192.168.1.5,  remote AS 100, internal link  
  BGP version 4, remote router ID 192.168.1.5
  BGP state = Established, up for 00:01:29   
  Last read 00:00:39, last write 00:00:31, hold time is 180, keepalive interval is 60 seconds
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    New ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
  Message statistics:
    InQ depth is 0
    OutQ depth is 0

                         Sent       Rcvd
    Opens:                  1          1
    Notifications:          0          0
    Updates:                0          0
    Keepalives:             2          2
    Route Refresh:          0          0
    Total:                  3          3
  Default minimum time between advertisement runs is 0 seconds

 For address family: IPv4 Unicast
  BGP table version 1, neighbor version 1/0
  Output queue size : 0
  Index 2, Offset 0, Mask 0x4
  2 update-group member
                                 Sent       Rcvd
  Prefix activity:               ----       ----
    Prefixes Current:               0          0
    Prefixes Total:                 0          0
    Implicit Withdraw:              0          0
    Explicit Withdraw:              0          0
    Used as bestpath:             n/a          0
    Used as multipath:            n/a          0

                                   Outbound    Inbound
  Local Policy Denied Prefixes:    --------    -------
    Total:                                0          0
  Number of NLRIs in the update sent: max 0, min 0

  Address tracking is enabled, the RIB does have a route to 192.168.1.5
  Connections established 1; dropped 0
  Last reset never
  Transport(tcp) path-mtu-discovery is enabled
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 255
Local host: 192.168.1.6, Local port: 51613
Foreign host: 192.168.1.5, Foreign port: 179
Connection tableid (VRF): 0

Enqueued packets for retransmit: 0, input: 0  mis-ordered: 0 (0 bytes)

Event Timers (current time is 0x1259B8):
Timer          Starts    Wakeups            Next
Retrans             4          0             0x0
TimeWait            0          0             0x0
AckHold             3          2             0x0
SendWnd             0          0             0x0
KeepAlive           0          0             0x0
GiveUp              0          0             0x0
PmtuAger            1          0        0x1A18C8
DeadWait            0          0             0x0
Linger              0          0             0x0
ProcessQ            0          0             0x0

iss:  235163843  snduna:  235163935  sndnxt:  235163935     sndwnd:  16293
irs:   61301986  rcvnxt:   61302078  rcvwnd:      16293  delrcvwnd:     91

SRTT: 124 ms, RTTO: 1405 ms, RTV: 1281 ms, KRTT: 0 ms
minRTT: 8 ms, maxRTT: 300 ms, ACK hold: 200 ms
Status Flags: active open
Option Flags: nagle, path mtu capable
IP Precedence value : 6

Datagrams (max data segment is 1460 bytes):
Rcvd: 6 (out of order: 0), with data: 3, total data bytes: 91
Sent: 7 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 3, total

data bytes: 91
 Packets received in fast path: 0, fast processed: 0, slow path: 0
 fast lock acquisition failures: 0, slow path: 0


SanJose3(config)#interface loopback0
SanJose3(config-if)#
*Jan  3 15:07:07.631: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
SanJose3(config-if)#ip address 198.133.219.1 255.255.255.0
SanJose3(config-if)#exit
SanJose3(config)#router bgp 100
SanJose3(config-router)#network 198.133.219.0    // ADVERTISE LOOPBACK INTO BGP


SanJose2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
C       172.24.1.0 is directly connected, Serial0/0/1
     10.0.0.0/24 is subnetted, 1 subnets
C       10.2.2.0 is directly connected, Loopback0
B    198.133.219.0/24 [200/0] via 172.24.1.18, 00:00:33  
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0

SanJose2#ping 198.133.219.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.133.219.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms


SanJose1#show ip route   // SanJose1 ISN'T CONFIGURE FOR IBGP PEERING WITH SanJose3
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
R       172.24.1.0 [120/1] via 192.168.1.6, 00:00:11, Serial0/0/0
     10.0.0.0/24 is subnetted, 1 subnets
R       10.2.2.0 [120/1] via 192.168.1.6, 00:00:11, Serial0/0/0
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0


SanJose2(config)#router bgp 100
SanJose2(config-router)#neighbor 192.168.1.5 ?
  activate                 Enable the Address Family for this Neighbor
  advertise-map            specify route-map for conditional advertisement
  advertisement-interval   Minimum interval between sending BGP routing updates
  allowas-in               Accept as-path with my AS present in it
  capability               Advertise capability to the peer
  default-originate        Originate default route to this neighbor
  description              Neighbor specific description
  disable-connected-check  one-hop away EBGP peer using loopback address
  distribute-list          Filter updates to/from this neighbor
  dmzlink-bw               Propagate the DMZ link bandwidth
  ebgp-multihop            Allow EBGP neighbors not on directly connected
                           networks
  fall-over                session fall on peer route lost
  filter-list              Establish BGP filters
  inherit                  Inherit a template
  local-as                 Specify a local-as number
  maximum-prefix           Maximum number of prefixes accepted from this peer
  next-hop-self            Disable the next hop calculation for this neighbor
  next-hop-unchanged       Propagate next hop unchanged for iBGP paths to this
                           neighbor
  password                 Set a password
  peer-group               Member of the peer-group
  prefix-list              Filter updates to/from this neighbor
  remote-as                Specify a BGP neighbor
  remove-private-as        Remove private AS number from outbound updates
  route-map                Apply route map to neighbor
  route-reflector-client   Configure a neighbor as Route Reflector client
  send-community           Send Community attribute to this neighbor
  send-label               Send NLRI + MPLS Label to this peer
  shutdown                 Administratively shut down this neighbor
  soft-reconfiguration     Per neighbor soft reconfiguration
  timers                   BGP per neighbor timers
  translate-update         Translate Update to MBGP format
  transport                Transport options
  ttl-security             BGP ttl security check
  unsuppress-map           Route-map to selectively unsuppress suppressed
                           routes
  update-source            Source of routing updates
  version                  Set the BGP version to match a neighbor
  weight                   Set default weight for routes from this neighbor

SanJose2(config-router)#neighbor 192.168.1.5 route-reflector-client   // CONFIGURE SanJose2 AS ROUTE

REFLECTOR TO ELIMINATE IBGP FULL MESH
SanJose2(config-router)#neighbor 192.168.1.5 route-reflector-client
*Jan  3 14:32:54.191: %BGP-5-ADJCHANGE: neighbor 192.168.1.5 Down RR client config change
*Jan  3 14:32:57.659: %BGP-5-ADJCHANGE: neighbor 192.168.1.5 Up
SanJose2(config-router)#neighbor 172.24.1.18 route-reflector-client
SanJose2(config-router)#
*Jan  3 14:33:12.391: %BGP-5-ADJCHANGE: neighbor 172.24.1.18 Down RR client config change
*Jan  3 14:33:15.067: %BGP-5-ADJCHANGE: neighbor 172.24.1.18 Up


SanJose2#show ip protocols
Routing Protocol is "rip"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Sending updates every 30 seconds, next due in 18 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Redistributing: rip
  Default version control: send version 2, receive version 2
    Interface             Send  Recv  Triggered RIP  Key-chain
    Serial0/0/0           2     2
    Serial0/0/1           2     2
    Loopback0             2     2
  Automatic network summarization is not in effect
  Maximum path: 4
  Routing for Networks:
    10.0.0.0
    172.24.0.0
    192.168.1.0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 120)

Routing Protocol is "bgp 100"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Route Reflector for address family IPv4 Unicast, 2 clients  
  Route Reflector for address family IPv6 Unicast, 2 clients
  Route Reflector for address family IPv4 MDT, 2 clients
  Route Reflector for address family VPNv4 Unicast, 2 clients
  Route Reflector for address family VPNv6 Unicast, 2 clients
  Route Reflector for address family IPv4 Multicast, 2 clients
  Route Reflector for address family IPv6 Multicast, 2 clients
  Route Reflector for address family NSAP Unicast, 2 clients
  IGP synchronization is disabled
  Automatic route summarization is disabled
  Neighbor(s):
    Address          FiltIn FiltOut DistIn DistOut Weight RouteMap
    172.24.1.18
    192.168.1.5
  Maximum path: 1
  Routing Information Sources:
    Gateway         Distance      Last Update
    172.24.1.18          200      00:02:06
  Distance: external 20 internal 200 local 200


SanJose1#show ip protocols
Routing Protocol is "rip"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Sending updates every 30 seconds, next due in 17 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Redistributing: rip
  Default version control: send version 2, receive version 2
    Interface             Send  Recv  Triggered RIP  Key-chain
    Serial0/0/0           2     2
  Automatic network summarization is not in effect
  Maximum path: 4
  Routing for Networks:
    192.168.1.0
  Routing Information Sources:
    Gateway         Distance      Last Update
    192.168.1.6          120      00:00:00
  Distance: (default is 120)

Routing Protocol is "bgp 100"    // ROUTE REFLECTOR CLIENT IS UNAWARE OF BGP ROUTE REFLECTION
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  IGP synchronization is disabled
  Automatic route summarization is disabled
  Neighbor(s):
    Address          FiltIn FiltOut DistIn DistOut Weight RouteMap
    192.168.1.6
  Maximum path: 1
  Routing Information Sources:
    Gateway         Distance      Last Update
    192.168.1.6          200      00:02:43
  Distance: external 20 internal 200 local 200


SanJose1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
R       172.24.1.0 [120/1] via 192.168.1.6, 00:00:05, Serial0/0/0
     10.0.0.0/24 is subnetted, 1 subnets
R       10.2.2.0 [120/1] via 192.168.1.6, 00:00:05, Serial0/0/0
B    198.133.219.0/24 [200/0] via 172.24.1.18, 00:03:45   // RECEIVED SanJose3 LOPPBACK0 SUBNET EVEN IF NOT AN IBGP PEER; RECEIVED FROM ROUTE REFLECTOR SanJose2
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0

SanJose1#ping 198.133.219.1   // CAN PING IP ADDRESS EVEN IF NEXT-HOP IP 172.24.1.18 ISN'T DIRECTLY CONNECTED

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.133.219.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/28 ms


SanJose3(config)#router bgp 100
SanJose3(config-router)#?
Router configuration commands:
  address-family       Enter Address Family command mode
  aggregate-address    Configure BGP aggregate entries
  auto-summary         Enable automatic network number summarization
  bgp                  BGP specific commands
  default              Set a command to its defaults
  default-information  Control distribution of default information
  default-metric       Set metric of redistributed routes
  distance             Define an administrative distance
  distribute-list      Filter networks in routing updates
  exit                 Exit from routing protocol configuration mode
  help                 Description of the interactive help system
  maximum-paths        Forward packets over multiple paths
  neighbor             Specify a neighbor router
  network              Specify a network to announce via BGP
  no                   Negate a command or set its defaults
  redistribute         Redistribute information from another routing protocol
  synchronization      Perform IGP synchronization
  table-map            Map external entry attributes into routing table
  template             Enter template command mode
  timers               Adjust routing timers

SanJose3(config-router)#aggregate-address ?
  A.B.C.D  Aggregate address

SanJose3(config-router)#aggregate-address 198.0.0.0 ?
  A.B.C.D  Aggregate mask

SanJose3(config-router)#aggregate-address 198.0.0.0 255.0.0.0


SanJose2#show ip bgp 198.0.0.0
BGP routing table entry for 198.0.0.0/8, version 5
Paths: (1 available, best #1, table Default-IP-Routing-Table)
Flag: 0x820
  Advertised to update-groups:
        1
  Local, (aggregated by 100 172.24.1.18), (Received from a RR-client)  
    172.24.1.18 from 172.24.1.18 (172.24.1.18)
      Origin IGP, metric 0, localpref 100, valid, internal, atomic-aggregate, best  


SanJose1#show ip route   // SanJose2 REFLECTED SUPERNET ROUTE TO SanJose1
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
R       172.24.1.0 [120/1] via 192.168.1.6, 00:00:11, Serial0/0/0
     10.0.0.0/24 is subnetted, 1 subnets
R       10.2.2.0 [120/1] via 192.168.1.6, 00:00:11, Serial0/0/0
B    198.133.219.0/24 [200/0] via 172.24.1.18, 00:13:19  
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0
B    198.0.0.0/8 [200/0] via 172.24.1.18, 00:02:01   


SanJose2(config)#ip prefix-list ?
  WORD             Name of a prefix list
  sequence-number  Include/exclude sequence numbers in NVGEN

SanJose2(config)#ip prefix-list SUPERNET_ONLY ?
  deny         Specify packets to reject
  description  Prefix-list specific description
  permit       Specify packets to forward
  seq          sequence number of an entry

SanJose2(config)#ip prefix-list SUPERNET_ONLY permit ?
  A.B.C.D/nn  IP prefix <network>/<length>, e.g., 35.0.0.0/8

SanJose2(config)#ip prefix-list SUPERNET_ONLY permit 198.0.0.0/8
SanJose2(config)#router bgp 100
SanJose2(config-router)#neighbor 192.168.1.5 ?
  activate                 Enable the Address Family for this Neighbor
  advertise-map            specify route-map for conditional advertisement
  advertisement-interval   Minimum interval between sending BGP routing updates
  allowas-in               Accept as-path with my AS present in it
  capability               Advertise capability to the peer
  default-originate        Originate default route to this neighbor
  description              Neighbor specific description
  disable-connected-check  one-hop away EBGP peer using loopback address
  distribute-list          Filter updates to/from this neighbor
  dmzlink-bw               Propagate the DMZ link bandwidth
  ebgp-multihop            Allow EBGP neighbors not on directly connected
                           networks
  fall-over                session fall on peer route lost
  filter-list              Establish BGP filters
  inherit                  Inherit a template
  local-as                 Specify a local-as number
  maximum-prefix           Maximum number of prefixes accepted from this peer
  next-hop-self            Disable the next hop calculation for this neighbor
  next-hop-unchanged       Propagate next hop unchanged for iBGP paths to this
                           neighbor
  password                 Set a password
  peer-group               Member of the peer-group
  prefix-list              Filter updates to/from this neighbor
  remote-as                Specify a BGP neighbor
  remove-private-as        Remove private AS number from outbound updates
  route-map                Apply route map to neighbor
  route-reflector-client   Configure a neighbor as Route Reflector client
  send-community           Send Community attribute to this neighbor
  send-label               Send NLRI + MPLS Label to this peer
  shutdown                 Administratively shut down this neighbor
  soft-reconfiguration     Per neighbor soft reconfiguration
  timers                   BGP per neighbor timers
  translate-update         Translate Update to MBGP format
  transport                Transport options
  ttl-security             BGP ttl security check
  unsuppress-map           Route-map to selectively unsuppress suppressed
                           routes
  update-source            Source of routing updates
  version                  Set the BGP version to match a neighbor
  weight                   Set default weight for routes from this neighbor

SanJose2(config-router)#neighbor 192.168.1.5 prefix-list ?
  WORD  Name of a prefix list

SanJose2(config-router)#neighbor 192.168.1.5 prefix-list SUPERNET_ONLY ?
  in   Filter incoming updates
  out  Filter outgoing updates

SanJose2(config-router)#neighbor 192.168.1.5 prefix-list SUPERNET_ONLY out   // PREVENT
198.133.219.0/24 ROUTE TO REFLECT ON SanJose1


SanJose1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
R       172.24.1.0 [120/1] via 192.168.1.6, 00:00:09, Serial0/0/0
     10.0.0.0/24 is subnetted, 1 subnets
R       10.2.2.0 [120/1] via 192.168.1.6, 00:00:09, Serial0/0/0
B    198.133.219.0/24 [200/0] via 172.24.1.18, 00:15:58
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0
B    198.0.0.0/8 [200/0] via 172.24.1.18, 00:04:40
SanJose1#clear ip bgp * soft
SanJose1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.24.0.0/24 is subnetted, 1 subnets
R       172.24.1.0 [120/1] via 192.168.1.6, 00:00:07, Serial0/0/0
     10.0.0.0/24 is subnetted, 1 subnets
R       10.2.2.0 [120/1] via 192.168.1.6, 00:00:07, Serial0/0/0
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.4 is directly connected, Serial0/0/0
B    198.0.0.0/8 [200/0] via 172.24.1.18, 00:05:05  

SanJose1#tclsh
SanJose1(tcl)#foreach address {
+>10.2.2.1
+>198.133.219.1
+>192.168.1.5
+>192.168.1.6
+>172.24.1.17
+>172.24.1.18
+>} {
+>ping $address }

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.133.219.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/28 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.1.17, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.1.18, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/44 ms