Friday, August 3, 2018

Configuring RIPng and IPv6 Default Route

I did CCNP ROUTE Version 1 a few years ago in order to complete my CCDP and built a lab using real Cisco 2811 routers and Cisco 3560 Catalyst switches. I needed to renew my CCNP this year and studied for the CCNP ROUTE Version 2 and performed labs using the CCNP ROUTE Lab Manual Version 7. I used a virtual lab this time on my Intel NUC and EVE since the new ROUTE exam (300-101) uses IOS 15 and covers a lot of IPv6 topics.


Configuring RIPng

RIPng uses a new command style for the basic configuration, but most of the optional features and verification commands look much like the commands used for RIP for IPv4. This section first takes a look at the basic RIPng configuration, accepting as many defaults as possible.

The big difference between RIPv2 and RIPng configuration is that RIPng discards the age-old RIP network command in deference to the ipv6 rip name enable interface subcommand, which enables RIPng on an interface. Another difference relates to the routing of IPv4 and IPv6: Cisco IOS routes IPv4 by default (because of a default global configuration command of ip routing ), but Cisco IOS does not route IPv6 by default (a default of no ipv6 unicast-routing ). Finally, RIPng allows multiple RIPng processes on a single router, so Cisco IOS requires that each RIPng process is given a text name that identifies each RIPng process for that one router—another difference compared to RIPv2.

The following list shows the basic configuration steps for RIPng, including steps to enable IPv6 routing and enabling IPv6 on the interfaces:

Step 1. Enable IPv6 routing with the ipv6 unicast-routing global command.

Step 2. Enable RIPng using the ipv6 router rip name global configuration command. The name must be unique on a router but does not need to match on neighboring routers.

Step 3. Enable IPv6 on the interface, typically with one of these two methods:
  • Configure an IPv6 unicast address on each interface using the ipv6 address address/prefix-length [eui-64] interface command.
  • Configure the ipv6 enable command, which enables IPv6 and causes the router to derive its link-local address.
Step 4. Enable RIP on the interface with the ipv6 rip name enable interface subcommand (where the name matches the ipv6 router rip name global configuration command).

Below is the RIPng lab that I performed.


r1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r1(config)#ipv6 unicast-routing     // ENABLE IPv6 ROUTING
r1(config)#
r1(config)#interface loop 0
r1(config-if)#
*Jun 16 22:00:54.419: %LINK-3-UPDOWN: Interface Loopback0, changed state to up
*Jun 16 22:00:55.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
r1(config-if)#ipv6 address 2001:db8:cafe:1::1/64
r1(config-if)#
r1(config-if)#interface serial 2/0
r1(config-if)#ipv6 address 2001:db8:cafe:2::1/64
r1(config-if)#no shut
r1(config-if)#
*Jun 16 22:02:07.615: %LINK-3-UPDOWN: Interface Serial2/0, changed state to up
r1(config-if)#
*Jun 16 22:02:08.627: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up
r1(config-if)#end
r1#


r2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r2(config)#ipv6 unicast-routing
r2(config)#
r2(config)#interface loop 0
r2(config-if)#
*Jun 16 22:01:47.903: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
r2(config-if)#ipv6 address 2001:db8:cafe:3::1/64
r2(config-if)#
r2(config)#interface serial 2/0
r2(config-if)#ipv6 address 2001:db8:cafe:2::2/64
r2(config-if)#no shut
r2(config-if)#
*Jun 16 22:03:27.335: %LINK-3-UPDOWN: Interface Serial2/0, changed state to up
r2(config-if)#
*Jun 16 22:03:28.347: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up
r2(config-if)#
r2(config-if)#do ping 2001:db8:cafe:2::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:2::1, timeout is 2 seconds:
..!!!
Success rate is 60 percent (3/5), round-trip min/avg/max = 32/50/64 ms
r2(config-if)#
r2(config-if)#do ping 2001:db8:cafe:2::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:2::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/36/44 ms
r2(config-if)#
r2(config-if)#interface serial 2/1
r2(config-if)#ipv6 address 2001:db8:feed:1::2/64
r2(config-if)#no shut
r2(config-if)#
*Jun 16 22:04:51.299: %LINK-3-UPDOWN: Interface Serial2/1, changed state to up
r2(config-if)#
*Jun 16 22:04:52.311: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/1, changed state to up
r2(config-if)#
r2(config-if)#interface loop 10
r2(config-if)#
*Jun 16 22:05:10.083: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback10, changed state to up
r2(config-if)#
*Jun 16 22:05:12.467: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/1, changed state to down
r2(config-if)#
r2(config-if)#ipv6 address 2001:db8:cafe:10::1/64
r2(config-if)#
r2(config-if)#interface loop 11                 
r2(config-if)#
*Jun 16 22:05:44.107: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback11, changed state to up
r2(config-if)#
r2(config-if)#ipv6 address 2001:db8:cafe:11::1/64
r2(config-if)#
r2(config-if)#interface loop 12                 
r2(config-if)#
*Jun 16 22:05:54.491: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback12, changed state to up
r2(config-if)#
r2(config-if)#ipv6 address 2001:db8:cafe:12::1/64
r2(config-if)#end
r2#


r3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r3(config)#ipv6 unicast-routing
r3(config)#
r3(config)#interface serial 2/1
r3(config-if)#ipv6 address 2001:db8:feed:1::1/64
r3(config-if)#no shut
r3(config-if)#
*Jun 16 22:05:00.915: %LINK-3-UPDOWN: Interface Serial2/1, changed state to up
r3(config-if)#
*Jun 16 22:05:01.927: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/1, changed state to up
r3(config-if)#
r3(config-if)#do ping 2001:db8:feed:1::2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:FEED:1::2, timeout is 2 seconds:
HHH.!
Success rate is 20 percent (1/5), round-trip min/avg/max = 36/36/36 ms
r3(config-if)#
r3(config-if)#do ping 2001:db8:feed:1::2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:FEED:1::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/34/40 ms
r3(config-if)#end
r3#


r1#sh ipv6 interface brief
FastEthernet0/0        [administratively down/down]
    unassigned
FastEthernet1/0        [administratively down/down]
    unassigned
FastEthernet1/1        [administratively down/down]
    unassigned
Serial2/0              [up/up]
    FE80::C803:14FF:FEC4:0
    2001:DB8:CAFE:2::1
Serial2/1              [administratively down/down]
    unassigned
Serial2/2              [administratively down/down]
    unassigned
Serial2/3              [administratively down/down]
    unassigned
Loopback0              [up/up]
    FE80::C803:14FF:FEC4:0
    2001:DB8:CAFE:1::1


r2#sh ipv6 int brief
FastEthernet0/0        [administratively down/down]
    unassigned
FastEthernet1/0        [administratively down/down]
    unassigned
FastEthernet1/1        [administratively down/down]
    unassigned
Serial2/0              [up/up]
    FE80::C80C:28FF:FE64:0
    2001:DB8:CAFE:2::2
Serial2/1              [up/up]
    FE80::C80C:28FF:FE64:0
    2001:DB8:FEED:1::2
Serial2/2              [administratively down/down]
    unassigned
Serial2/3              [administratively down/down]
    unassigned
Loopback0              [up/up]
    FE80::C80C:28FF:FE64:0
    2001:DB8:CAFE:3::1
Loopback10             [up/up]
    FE80::C80C:28FF:FE64:0
    2001:DB8:CAFE:10::1
Loopback11             [up/up]
    FE80::C80C:28FF:FE64:0
    2001:DB8:CAFE:11::1
Loopback12             [up/up]
    FE80::C80C:28FF:FE64:0
    2001:DB8:CAFE:12::1
r2#


r3#sh ipv6 int br
FastEthernet0/0        [administratively down/down]
    unassigned
FastEthernet1/0        [administratively down/down]
    unassigned
FastEthernet1/1        [administratively down/down]
    unassigned
Serial2/0              [administratively down/down]
    unassigned
Serial2/1              [up/up]
    FE80::C808:29FF:FE44:0
    2001:DB8:FEED:1::1
Serial2/2              [administratively down/down]
    unassigned
Serial2/3              [administratively down/down]
    unassigned


r1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r1(config)#ipv6 router ? 
  eigrp  Enhanced Interior Gateway Routing Protocol (EIGRP)
  ospf   Open Shortest Path First (OSPF)
  rip    IPv6 Routing Information Protocol (RIPv6)

r1(config)#ipv6 router rip ?
  WORD  User selected string identifying this process

r1(config)#ipv6 router rip RIPNG       // NEED TO ENABLE ipv6 unicast-routing BEFORE ENABLING RIPng
r1(config-rtr)#exit
r1(config)#interface loop 0
r1(config-if)#ipv6 rip ?
  WORD  User selected string identifying this RIP process

r1(config-if)#ipv6 rip RIPNG ?
  default-information  Configure handling of default route
  enable               Enable/disable RIP routing
  metric-offset        Adjust default metric increment
  summary-address      Configure address summarization

r1(config-if)#ipv6 rip RIPNG enable     // RIPng PROCESS WILL BE AUTOMATICALLY CREATED IF RIPng IS ENABLED FIRST ON AN INTERFACE
r1(config-if)#
r1(config-if)#interface serial 2/0
r1(config-if)#ipv6 rip RIPNG enable


r2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r2(config)#ipv6 router rip RIPNG
r2(config-rtr)#exit
r2(config)#interface loop 0
r2(config-if)#ipv6 rip RIPNG enable
r2(config-if)#
r2(config-if)#interface loop 10   
r2(config-if)#ipv6 rip RIPNG enable
r2(config-if)#
r2(config-if)#interface loop 11   
r2(config-if)#ipv6 rip RIPNG enable
r2(config-if)#
r2(config-if)#interface loop 12   
r2(config-if)#ipv6 rip RIPNG enable
r2(config-if)#
r2(config-if)#interface serial 2/0
r2(config-if)#ipv6 rip RIPNG enable
r2(config-if)#
r2(config-if)#interface serial 2/1
r2(config-if)#ipv6 rip RIPNG enable


r2#show ipv6 ?      
  access-list         Summary of access lists
  cef                 Cisco Express Forwarding for IPv6
  dhcp                IPv6 DHCP
  eigrp               Show IPv6 EIGRP
  features            IPV6 features
  general-prefix      IPv6 general prefixes
  inspect             CBAC (Context Based Access Control) information
  interface           IPv6 interface status and configuration
  lisp                Locator/ID Separation Protocol
  local               IPv6 local options
  mfib                IP multicast forwarding information base
  mld                 Multicast group membership information
  mobile              Mobile IPv6
  mobile              mobile IPv6
  mrib                Multicast Routing Information Base
  mroute              IPv6 multicast routing table
  mtu                 MTU per destination cache
  nat                 IPv6 NAT-PT information
  neighbors           Show IPv6 neighbor cache entries
  nhrp                NHRP information
  ospf                OSPF information
  pim                 PIM information
  policy              Policy routing
  port-map            Port to Application Mapping (PAM) information
  prefix-list         List IPv6 prefix lists
  protocols           IPv6 Routing Protocols
  rip                 RIP routing protocol status
  route               Show IPv6 route table entries
  routers             Show local IPv6 routers
  rpf                 Multicast RPF information
  rsvp                RSVP show commands
  spd                 IPv6 Selective Packet Discard
  static              IPv6 static routes
  traffic             IPv6 traffic statistics
  virtual-reassembly  IPV6 Virtual Fragment Reassembly (VFR) information
  wccp                WCCP IPv6 information

r2#show ipv6 protocols
IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "ND"
IPv6 Routing Protocol is "rip RIPNG"
  Interfaces:
    Serial2/1
    Serial2/0
    Loopback12
    Loopback11
    Loopback10
    Loopback0
  Redistribution:
    None


r1#sh ipv6 protocols
IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "ND"
IPv6 Routing Protocol is "rip RIPNG"
  Interfaces:
    Serial2/0
    Loopback0
  Redistribution:
    None


r1#show ipv6 route
IPv6 Routing Table - default - 10 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
       IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
       NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
       OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
       ON2 - OSPF NSSA ext 2, l - LISP
C   2001:DB8:CAFE:1::/64 [0/0]
     via Loopback0, directly connected
L   2001:DB8:CAFE:1::1/128 [0/0]
     via Loopback0, receive
C   2001:DB8:CAFE:2::/64 [0/0]
     via Serial2/0, directly connected
L   2001:DB8:CAFE:2::1/128 [0/0]
     via Serial2/0, receive
R   2001:DB8:CAFE:3::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0      // NEXT HOP IP IS R2 LINK-LOCAL ADDRESS
R   2001:DB8:CAFE:10::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:11::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:12::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:FEED:1::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
L   FF00::/8 [0/0]
     via Null0, receive
r1#


r1#ping 2001:db8:cafe:3::1    
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:3::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/10/16 ms
r1#
r1#ping 2001:db8:cafe:10::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:CAFE:10::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
r1#
r1#ping 2001:db8:feed:1::1      // PING TO R3 SERIAL 2/1 FAILED DUE TO UNKNOWN ROUTE
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:FEED:1::1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)


r3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r3(config)#ipv6 route 2001:db8:cafe::/48 2001:db8:feed:1::2       // STATIC ROUTE TO RIPng DOMAIN


r2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
r2(config)#ipv6 route ::/0 2001:db8:feed:1::1        // STATIC DEFAULT ROUTE TO R3 (ISP)
r2(config)#
r2(config)#interface serial 2/0
r2(config-if)#ipv6 rip RIPNG ?
  default-information  Configure handling of default route
  enable               Enable/disable RIP routing
  metric-offset        Adjust default metric increment
  summary-address      Configure address summarization

r2(config-if)#ipv6 rip RIPNG default-information ?
  only       Advertise only the default route
  originate  Originate the default route

r2(config-if)#ipv6 rip RIPNG default-information originate       // PROPAGATE DEFAULT ROUTE TO ROUTERS IN  RIPng DOMAIN


r1#show ipv6 route        
IPv6 Routing Table - default - 11 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
       IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
       NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
       OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
       ON2 - OSPF NSSA ext 2, l - LISP
R   ::/0 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
C   2001:DB8:CAFE:1::/64 [0/0]
     via Loopback0, directly connected
L   2001:DB8:CAFE:1::1/128 [0/0]
     via Loopback0, receive
C   2001:DB8:CAFE:2::/64 [0/0]
     via Serial2/0, directly connected
L   2001:DB8:CAFE:2::1/128 [0/0]
     via Serial2/0, receive
R   2001:DB8:CAFE:3::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:10::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:11::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:12::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:FEED:1::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
L   FF00::/8 [0/0]
     via Null0, receive


r1#ping 2001:db8:feed:1::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:FEED:1::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/18/28 ms


r2(config-if)#no ipv6 rip RIPNG default-information originate
r2(config-if)#ipv6 rip RIPNG default-information ?          
  only       Advertise only the default route
  originate  Originate the default route

r2(config-if)#ipv6 rip RIPNG default-information only    // PROPAGATES DEFAULT ROUTE BUT SUPRESSES OTHER ROUTES
r2(config-if)#


r1#show ipv6 route       
IPv6 Routing Table - default - 11 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
       IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
       NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
       OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
       ON2 - OSPF NSSA ext 2, l - LISP
R   ::/0 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
C   2001:DB8:CAFE:1::/64 [0/0]
     via Loopback0, directly connected
L   2001:DB8:CAFE:1::1/128 [0/0]
     via Loopback0, receive
C   2001:DB8:CAFE:2::/64 [0/0]
     via Serial2/0, directly connected
L   2001:DB8:CAFE:2::1/128 [0/0]
     via Serial2/0, receive
R   2001:DB8:CAFE:3::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:10::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:11::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:CAFE:12::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
R   2001:DB8:FEED:1::/64 [120/2]
     via FE80::C80C:28FF:FE64:0, Serial2/0
L   FF00::/8 [0/0]
     via Null0, receive
r1#
r1#show ipv6 rip 
RIP process "RIPNG", port 521, multicast-group FF02::9, pid 302
     Administrative distance is 120. Maximum paths is 16
     Updates every 30 seconds, expire after 180
     Holddown lasts 0 seconds, garbage collect after 120
     Split horizon is on; poison reverse is off
     Default routes are not generated
     Periodic updates 37, trigger updates 4
     Full Advertisement 0, Delayed Events 0
  Interfaces:
    Serial2/0
    Loopback0
  Redistribution:
    None
r1#
r1#clear ipv6 rip RIPNG      // FORCE R1 TO REFRESH THE RIPNG ROUTING TABLE
r1#
r1#show ipv6 route      // RIPnG ROUTES WERE REMOVED IN THE ROUTING TABLE
IPv6 Routing Table - default - 5 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
       IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
       NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
       OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
       ON2 - OSPF NSSA ext 2, l - LISP
C   2001:DB8:CAFE:1::/64 [0/0]
     via Loopback0, directly connected
L   2001:DB8:CAFE:1::1/128 [0/0]
     via Loopback0, receive
C   2001:DB8:CAFE:2::/64 [0/0]
     via Serial2/0, directly connected
L   2001:DB8:CAFE:2::1/128 [0/0]
     via Serial2/0, receive
L   FF00::/8 [0/0]
     via Null0, receive


r2#sh ipv6 rip
RIP process "RIPNG", port 521, multicast-group FF02::9, pid 302     // RIPng USES UDP PORT 521, IPv6 MULTICAST GROUP FF02::9
     Administrative distance is 120. Maximum paths is 16
     Updates every 30 seconds, expire after 180
     Holddown lasts 0 seconds, garbage collect after 120
     Split horizon is on; poison reverse is off
     Default routes are generated
     Periodic updates 37, trigger updates 5
     Full Advertisement 0, Delayed Events 0
  Interfaces:
    Serial2/1
    Serial2/0
    Loopback12
    Loopback11
    Loopback10
    Loopback0
  Redistribution:
    None

r2#sh ipv6 rip database
RIP process "RIPNG", local RIB
 2001:DB8:CAFE:1::/64, metric 2, installed
     Serial2/0/FE80::C803:14FF:FEC4:0, expires in 156 secs
 2001:DB8:CAFE:2::/64, metric 2
     Serial2/0/FE80::C803:14FF:FEC4:0, expires in 156 secs

r2#sh ipv6 rip RIPNG next-hops
 RIP process "RIPNG", Next Hops
  FE80::C803:14FF:FEC4:0/Serial2/0 [2 paths]

Saturday, July 14, 2018

MikroTik Router Basic Configuration

I was able to do basic configuration on a MikroTik router and allowed the LAN to go the Internet using NAT (Source NAT).  Below is the network topology and actual photos of the MikroTik Cloud Core Router used for this lab scenario.









To initially configure the MikroTik router, manually set your PC IP to 192.168.88.2/24 > connect an RJ45 cable between PC LAN port and MikroTik router's ETH (leftmost port).



Open a web browser > HTTP to 192.168.88.1 > type admin under login > leave Password blank > click Login.
 


Create a new user account under WebFig > Users > Add New.



Type the Name > choose a Group (full by default) > type and confirm Password > click Apply > OK.
 

You can delete the default admin account by clicking the dash or minus icon ( - ) which is beside D (disable).



I’m using a cable modem at home which provides a public IP address via its Ethernet port. To configure the MikroTik router's ISP/WAN interface, go to IP > DHCP Client > Add New.
 


Under Interface > choose ether1 > Apply > OK. Notice the ISP public IP address appeared.
 

Take note of the default Add Default Route of yes.




To configure the LAN IP address, go to IP > Addresses > Add New.
 


Type the LAN Address 192.168.1.1/24 (default gateway) > type 192.168.1.0 under Network > choose ether2 under Interface > click Apply > OK.
 



To configure a DHCP Server for the LAN, go to IP > DHCP Server > Add New.
 


Type a Name > choose the LAN Interface > set a Lease Time (HH:MM:SS) > click Apply > OK.


Choose dynamic under Bootp Support.
 


Click DHCP Setup > choose ether2 under DHCP Server Interface > Next.
 



Leave the default DHCP Address Space (192.168.1.0/24) > click Next.
 


Leave the default (192.168.1.1) for Gateway for DHCP Network.
 


Leave the default for Address to Give Out (192.168.1.2-192.168.1.254).
 



Type a Primary (optional Secondary) DNS Servers. It auto filled the ISP DNS Servers if WAN is a DHCP Client.
 


Optionally change the default lease time (10 mins) to 8 hours.
 




Click Leases tab to see DHCP clients (I had a PC connected on ether2)
 


You can do an IP Scan on selected Interface (ether2) under Tools > IP Scan. Notice the MikroTik router was able to fingerprint the host NetBIOS (MACBOOKPRO).




You can also view DHCP leased addresses under IP > Pool > Used Addresses.


To configure a default route, go to under IP > Routes. Notice the ISP DHCP Client automatically configured a default route 0.0.0.0/0 since we selected yes under Add Default Route.


Click on the 0.0.0.0/0 route entry to view more details.



You need to configure NAT in order to allow the private IP address (192.168.1.0/24) to reach the public Internet. To configure NAT (Source NAT), go to IP > Firewall > NAT > Add New.
 


Leave the default srcnat under Chain > select Out.Interface ether1 (ISP)
 


You can view interface status and statistics under Interfaces.


Click a specific interface (ether1) to view more details.




You can perform troubleshooting or diagnostics, go to Tools > Ping > type an IP address (8.8.8.8) under Ping To > click Start.
 

You can also do a Traceroute which perform like an MTR.



You can view NAT translations under IP > Firewall > Connections.


Click on a specific output (line 2) in order to view more details.


To view chassis information, go to System > Health.


You can also view more chassis environment info under System > Resources.


To view Syslogs to to Log.


You can also do Packet Sniffer or capture under Tools > Packet Sniffer > Start.


Click Stop > then click Packets.



Click on a specific output or line (line 2) to view more details.


You can do real-time traffic monitoring on a specific interface under Torch > select an Interface (ether2) > type Src Address (Source Address) > type Dst Address (Destination Address) > click Start (then click Stop).



You can do a factory reset under System > Reset Configuration.


You can do a remote reboot  under System >Reboot.


You can do a quick network setup under Quick Set found on the upper right hand corner of the web GUI.


You can launch the CLI terminal (inband) under Terminal.


You can connect (out-of-band) a console (rollover) cable to the MikroTik CONSOLE port. Set the baud rate to 115200 (8-N-1-N).



Below are some useful CLI show commands.


[admin@MikroTik] > system resource print
             uptime: 2h36s
            version: 6.39.2 (stable)
         build-time: Jun/06/2017 08:01:04
   factory-software: 6.36.4
        free-memory: 1742.1MiB
       total-memory: 1956.2MiB
                cpu: tilegx
          cpu-count: 9
      cpu-frequency: 1200MHz
           cpu-load: 0%
     free-hdd-space: 82.1MiB
    total-hdd-space: 128.0MiB
  architecture-name: tile
         board-name: CCR1009-7G-1C-1S+
           platform: MikroTik


[admin@MikroTik] > interface print
Flags: D - dynamic, X - disabled, R - running, S - slave
 #     NAME                                TYPE       ACTUAL-MTU L2MTU  MAX-L2MTU MAC-ADDRESS     
 0  R  combo1                              ether            1500  1580      10222 6C:3B:6B:E3:C5:21
 1  R  ether1                              ether            1500  1580      10222 6C:3B:6B:E3:C5:22
 2  R  ether2                              ether            1500  1580      10222 6C:3B:6B:E3:C5:23
 3     ether3                              ether            1500  1580      10222 6C:3B:6B:E3:C5:24
 4     ether4                              ether            1500  1580      10222 6C:3B:6B:E3:C5:25
 5     ether5                              ether            1500  1580      10222 6C:3B:6B:E3:C5:26
 6     ether6                              ether            1500  1580      10222 6C:3B:6B:E3:C5:27
 7     ether7                              ether            1500  1580      10222 6C:3B:6B:E3:C5:28
 8     sfp-sfpplus1                        ether            1500  1580      10222 6C:3B:6B:E3:C5:20


[admin@MikroTik] > interface ethernet cable-test ether1
    name: ether1
  status: link-ok


[admin@MikroTik] > ip route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 ADS  0.0.0.0/0                          222.165.112.1             1
 1 ADC  192.168.1.0/24     192.168.1.1     ether2                    0
 2 ADC  192.168.88.0/24    192.168.88.1    combo1                    0
 3 ADC  222.165.x.0/21   222.165.x.x9 ether1                    0


[admin@MikroTik] > ping 8.8.8.8
  SEQ HOST                                     SIZE TTL TIME  STATUS                                                                                                                                                                     
    0 8.8.8.8                                    56  55 8ms 
    1 8.8.8.8                                    56  55 7ms 
    2 8.8.8.8                                    56  55 7ms 
    3 8.8.8.8                                    56  55 8ms 
    4 8.8.8.8                                    56  55 8ms 
    5 8.8.8.8                                    56  55 7ms 
    6 8.8.8.8                                    56  55 7ms 
    sent=7 received=7 packet-loss=0% min-rtt=7ms avg-rtt=7ms max-rtt=8ms


[admin@MikroTik] > tool traceroute 8.8.8.8
 # ADDRESS                          LOSS SENT    LAST     AVG    BEST   WORST STD-DEV STATUS                                                                                                                                             
 1 10.47.0.1                          0%    7     8ms     7.6     4.6    11.3  2.2                                                                                                                                                    
 2 10.47.0.1                        16..    7   8.1ms     8.2     6.8    10.3     1.2                                                                                                                                                    
 3 172.20.43.65                       0%    6   7.2ms     7.1     6.3     7.6     0.5                                                                                                                                                    
 4 172.20.9.230                       0%    6   9.4ms     9.5     9.4     9.8     0.1                                                                                                                                                    
 5 203.116.188.85                     0%    6  26.5ms    28.3     8.2    41.5    11.3                                                                                                                                                    
 6 203.117.36.21                      0%    6   9.4ms    11.2       6    23.4     6.2                                                                                                                                                    
 7 203.116.189.181                    0%    6   8.1ms    12.9       8    22.5     6.8                                                                                                                                                    
 8 203.117.34.34                      0%    6   7.6ms    18.8     7.6    44.8    13.3                                                                                                                                                    
 9 72.14.196.189                      0%    6   8.5ms     7.5     5.1     8.9     1.4                                                                                                                                                    
10 108.170.242.65                     0%    6   7.7ms     8.4     7.7     8.7     0.3                                                                                                                                                    
11 108.170.237.229                    0%    6   8.1ms    13.2     7.4    27.7       8                                                                                                                                                    
12 8.8.8.8                            0%    6   7.2ms    12.5     7.2    22.5     7.1
                                                                                                                                 
[admin@MikroTik] > /log print
jan/01/1970 00:00:08 system,error,critical router rebooted without proper shutdown, probably power outage
jan/02/1970 00:00:10 script,info Starting_defconf_script_
jan/02/1970 00:00:10 script,info Defconf_script_finished
jan/02/1970 00:00:10 system,info address added
jan/02/1970 00:02:53 interface,info ether2 link up (speed 1G, full duplex)
jan/02/1970 00:07:58 interface,info ether2 link down
jan/02/1970 00:08:02 interface,info ether2 link up (speed 1G, full duplex)
jan/02/1970 00:08:32 interface,info ether2 link down
jan/02/1970 00:08:36 interface,info ether2 link up (speed 1G, full duplex)
jan/02/1970 00:09:06 interface,info ether2 link down
jan/02/1970 00:09:10 interface,info ether1 link up (speed 1G, full duplex)
jan/02/1970 00:10:21 interface,info ether1 link down
jan/02/1970 00:10:27 interface,info combo1 link up (speed 1G, full duplex)
jan/02/1970 00:13:13 system,error,critical login failure for user admin from 192.168.88.2 via ftp
jan/02/1970 00:13:15 system,info,account user admin logged in from 192.168.88.2 via web
jan/02/1970 00:13:16 system,info,account user admin logged in from 192.168.88.2 via ftp
jan/02/1970 00:13:17 system,info,account user admin logged out from 192.168.88.2 via ftp
jan/02/1970 00:14:39 system,info,account user admin logged in via local
jan/02/1970 00:19:15 system,info,account user admin logged out from 192.168.88.2 via web
jan/02/1970 00:19:15 system,info,account user admin logged out via local
jan/02/1970 00:19:27 system,info,account user admin logged in from 192.168.88.2 via web
jan/02/1970 00:19:27 system,info,account user admin logged in via local
jan/02/1970 00:19:51 system,info,account user admin logged in via local
jan/02/1970 00:20:00 system,info,account user admin logged out via local
jan/02/1970 00:20:01 system,info,account user admin logged in via local
jan/02/1970 00:20:04 system,info,account user admin logged out from 192.168.88.2 via web
jan/02/1970 00:20:04 system,info,account user admin logged out via local
jan/02/1970 00:20:04 system,info,account user admin logged out via local
jan/02/1970 00:20:13 system,info,account user admin logged in from 192.168.88.2 via web
jan/02/1970 00:20:14 system,info,account user admin logged in via local
jan/02/1970 00:20:20 system,info,account user admin logged out from 192.168.88.2 via web
jan/02/1970 00:20:20 system,info,account user admin logged out via local
jan/02/1970 00:20:45 system,info,account user admin logged in from 192.168.88.2 via web
jan/02/1970 00:20:47 system,info,account user admin logged in via local
jan/02/1970 00:20:48 system,info,account user admin logged out via local
jan/02/1970 00:25:00 system,info,account user admin logged in via local
jan/02/1970 00:30:00 system,info,account user admin logged out from 192.168.88.2 via web
jan/02/1970 00:31:01 system,info,account user admin logged in from 192.168.88.2 via web
jan/02/1970 00:33:26 system,info,account user admin logged out from 192.168.88.2 via web
jan/02/1970 00:33:28 system,info,account user admin logged in from 192.168.88.2 via web

<OUTPUT TRUNCATED>


[admin@MikroTik] > /system health print
                    fan-mode: auto
                     use-fan: main
                  active-fan: main
          cpu-overtemp-check: yes
      cpu-overtemp-threshold: 100C
  cpu-overtemp-startup-delay: 1m
                     voltage: 24.1V
                     current: 738mA
                 temperature: 34C
             cpu-temperature: 52C
           power-consumption: 17.8W
                  psu1-state: ok
                  psu2-state: fail
                  fan1-speed: 6466RPM


[admin@MikroTik] > /export
# jul/11/2017 22:36:28 by RouterOS 6.39.2
# software id = 1E6H-GITN
#
/ip pool
add name=dhcp_pool0 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=ether2 lease-time=8h name=\
    dhcp1
/ip address
add address=192.168.88.1/24 comment=defconf interface=combo1 network=\
    192.168.88.0
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,4.2.2.2 gateway=192.168.1.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/system clock
set time-zone-name=Asia/Singapore


[admin@MikroTik] > system reset-configuration
Dangerous! Reset anyway? [y/N]: