Note: If you need to revise your Frame Relay knowledge, we recommend you to read our Frame Relay tutorial first.

First we create 4 routers and link them as follows:

IOS used in this lab: c2600-bin-mz.123-6f.bin

Configure IP addresses

First we will assign IP addresses for all relevant interfaces. Notice that R1 will be Frame-Relay switch in this lab so its interfaces don’t need IP addresses.

On R0:

R0#configure terminal
R0(config)#interface s0/0
R0(config-if)#ip address 192.168.1.1 255.255.255.0
R0(config-if)#no shutdown

On R2:

R2#configure terminal
R2(config)#interface s0/0
R2(config-if)#ip address 192.168.1.2 255.255.255.0
R2(config-if)#no shutdown

On R3:

R3#configure terminal
R3(config)#interface s0/0
R3(config-if)#ip address 192.168.1.3 255.255.255.0
R3(config-if)#no shutdown

Configure Frame-Relay (using Inverse ARP)

To configure Frame-Relay on R0, R2 and R3 we need to enable Frame-Relay encapsulation and specify a type of LMI (ansi – in this case). Notice that Inverse ARP is enabled by default on Cisco routers so we don’t need to type anything to activate it.

R0,R2,R3(config)#interface s0/0
R0,R2,R3(config-if)#encapsulation frame-relay
R0,R2,R3(config-if)#frame-relay lmi-type ansi

Configure R1 as a Frame-Relay switch

In this lab R1 will be configured as a Frame-relay switch so no IP address is required.

Turn on Frame-Relay switching feature on R1:
R1(config)#frame-relay switching

On each interface we must specify how the frame will be proceeded. In practical, the Frame-Relay switch (R1) is placed at the ISP side so its interfaces should be set to DCE.

R1(config)# interface s0/0
R1(config-if)#encapsulation frame-relay
R1(config-if)#frame-relay lmi-type ansi
R1(config-if)#frame-relay intf-type dce //This command specifies the interface to handle LMI like a Frame Relay DCE device.
R1(config-if)#clock rate 64000
R1(config-if)#frame-relay route 102 interface Serial0/1 201 (will be explained later)
R1(config-if)#frame-relay route 103 interface Serial0/2 301

The command frame-relay route 102 interface Serial0/1 201 means frame-relay traffic come to R1 which has a DLCI of 102 will be sent to interface Serial0/1 with a DLCI of 201.

Note: Data link connection identifiers (DLCIs) are numbers that refer to paths through the Frame Relay network. They are only locally significant.

Continue configuring s0/1 & s0/2 interfaces (same as s0/0)

R1(config)# interface s0/1
R1(config-if)#encapsulation frame-relay
R1(config-if)#frame-relay lmi-type ansi
R1(config-if)#frame-relay intf-type dce
R1(config-if)#clock rate 64000
R1(config-if)#frame-relay route 201 interface Serial0/0 102

R1(config)# interface s0/2
R1(config-if)#encapsulation frame-relay
R1(config-if)#frame-relay lmi-type ansi
R1(config-if)#frame-relay intf-type dce
R1(config-if)#clock rate 64000
R1(config-if)#frame-relay route 301 interface Serial0/0 103

Use the show frame-relay map command to display the current map entries for static and dynamic routes

R0#show frame-relay map

By default, Cisco uses Inverse ARP to map remote IP address of the PVC with the DLCI of the local interface as we can see here. From the output above we learn that DLCI 102 is set on Serial0/0 of R0 and mapped with 192.168.1.2. The status of this connection is “dynamic” and “active”, which means it is operating correctly.

The outputs of this command on other routers are shown below:

Notice that you will only see the “map” at two ends. If we issue this command on Frame-Relay switch (R1 is this case) it will show nothing.

The show frame-relay pvc command is used to display the status of all configured connections, traffic statistics, BECN and FECN packets received by the router.

Use the show frame-relay lmi to display LMI traffic statistics (including LMI type, status messages sent and invalid LMI messages)

Pings from R0 to R2 & R3 are successful.

However ping from R2 to R3 is unsuccessful. It means that customers cannot see each other. This is because the split horizon rule: “A router never sends information about a route back in same direction which is original information came”. To overcome this problem we can configure subinterfaces on R0.

Note: If you are not sure about NAT, please read my Network Address Translation NAT Tutorial

To configure static NAT we need to complete these tasks:
* Define the router’s interfaces as inside or outside:
R0uter(config-if)#ip nat inside (or ip nat outside)

* Define static mapping between the inside address and the outside address:
R0uter(config)#ip nat inside source static

+ Static NAT:

To make everything clear, we will configure static NAT in GNS3. Open your GNS3 and build a topology like this:

(IOS used: c2600-bin-mz.123-6f.bin but you can use other versions)

We should use 3 routers in this topology but I want to save some RAM and demonstrate how to ping from the loopback interface so I only use two :) Therefore we should configure the loopback interface of R0 as the source IP address and the fa0/0 interface of R0 as the “outgoing static NAT” address.

R0#configure terminal
R0(config)#int loopback0
R0(config-if)#ip address 10.0.0.1 255.0.0.0
R0(config-if)#ip nat inside

R0(config-if)#int f0/0
R0(config-if)#ip address 200.0.0.1 255.255.255.0
R0(config-if)#no shutdown
R0(config-if)#ip nat outside
R0(config-if)#exit

Finally, we have to tell the router to translate my private IP 10.0.0.1 to public IP 200.0.0.2 so that I can go to the Internet!

R0(config)#ip nat inside source static 10.0.0.1 200.0.0.2

In R1 we just assign the IP address and no shut its interface.

R1#config terminal
R1(config)#int f0/0
R1(config-if)#ip address 200.0.0.10 255.255.255.0
R1(config-if)#no shutdown

Check if all things are right or not:

R0#show ip nat translations

In this article we don’t use a host attached to R0 so if we want to test our NAT configuration we have to ping from R0′s loopback interface by using the ping extended command:

We can use the extended ping command by typing only “ping” at the privileged mode, specify the “target IP address” and type “y” at the “Extended commands” and specify the “source address or interface” at shown below:

To approve NAT works well we can disable static NAT with the following command

R0(config)#no ip nat inside source static 10.0.0.1 200.0.0.2

Now if we use the extended ping command (without NAT configured):

-> We can’t ping from the loopback interface.

Download static NAT configuration: http://www.9tut.com/download/NAT_static_CCNA_self_study.zip

+ Dynamic NAT:

To configure dynamic NAT we need to complete these tasks:

* Define a pool of addresses (public IP) to be used for dynamic NAT allocation

Router(config)#ip nat pool pool_name start_ip end_ip { netmask netmask | prefix-length prefix-length }

* Configure a standard access control list to define what internal traffic will be translated

Router(config)#access-list access-list-number permit source [source-wildcard]

Link the access list to the NAT pool

Router(config)#ip nat inside source list access-list-number pool pool_name

Router(config-if)# ip nat inside (on fa0/0, for example)
Router(config-if)#ip nat outside (on fa0/1, for example)

* Dynamic NAT configuration example:

RouterA(config)# access-list 1 permit 192.168.0.0 0.0.0.255
RouterA(config)# ip nat pool PoolforNAT 200.23.123.6 200.23.123.10 netmask 255.255.255.0
RouterA(config)# ip nat inside source list 1 pool PoolforNAT

Note: In the above command, the word “inside” means “I want to NAT from inside to outside”; “list 1″ means “the source IP addresses to NAT are included in Access-list 1″; “pool PoolforNAT” means “NAT to the IP addresses specified in PoolforNAT”.

RouterA(config)# int loopback0
RouterA(config-if)# ip nat inside

RouterA(config-if)# int fa0/0
RouterA(config-if)# ip nat outside

Configure PAT (NAT Overload)

* Configure a standard access list to define what internal traffic will be translated
* Link the access list to the interface to be used for PAT
* Define interfaces as either inside or outside

PAT router commands
RouterA(config)# access-list 1 permit 192.168.0.0 0.0.0.255
RouterA(config)# ip nat inside source list 1 interface fa0/0 overload

(Notice the “interface fa0/0″ means “NAT out of this interface” and the keyword overload for PAT in the above command)

RouterA(config)# interface fa0/0
RouterA(config-if)# ip nat outside

RouterA(config-if)# interface loopback0
RouterA(config-if)# ip nat inside

Static route and Dynamic route

Static route tells the device exactly where to send traffic, no matter what. Static route is often used when your network has only a few routers or there is only one route from a source to a destination. Dynamic routes, on the other hand, use a routing protocol to determine the best path and the routes can be changed depending on specific parameters (like bandwidth, delay, cost…). With dynamic routes, routers can communicate with each other to exchange routing information. In ROUTE 642-902 you will learn about dynamic routing protocols such as OSPF, EIGRP and BGP (RIP is also a dynamic routing protocol but it is not mentioned in ROUTE).

The simple syntax of static route:

ip route destination-network-address subnet-mask {next-hop-IP-address | exit-interface}
+ destination-network-address: destination network address of the remote network
+ subnet mask: subnet mask of the destination network
+ next-hop-IP-address: the IP address of the receiving interface on the next-hop router
+ exit-interface: the local interface of this router where the packets will go out

Now we consider a real-world example of static routing. Suppose that your company has 2 branches located in New York and Chicago. As the administrator of the network, you are tasked to connect them so that employees in the two LANs can communicate with each other. After careful consideration you decided to connect them via static route.

In GNS3, place 2 routers and connect them as the image below, I used IOS c2600-bin-mz.123-6f.bin to save some RAM (only require 64MB/router). We will use two loopback interfaces to simulate two Ethernet LANs.

Configuring interfaces on R0

R0(config)#interface s0/0
R0(config-if)#ip address 12.12.12.1 255.255.255.0
R0(config-if)#no shutdown
R0(config-if)#interface lo0
R0(config-if)#ip address 10.0.0.1 255.0.0.0
R0(config-if)#exit

Configuring interfaces on R1

R0(config)#interface s0/0
R0(config-if)#ip address 12.12.12.2 255.255.255.0
R0(config-if)#no shutdown
R0(config-if)#interface lo0
R0(config-if)#ip address 172.16.0.1 255.255.0.0
R0(config-if)#exit

Now if we check the routing table of R0 & R1 by the command show ip route on both R0 and R1

On R0:
R0# show ip route

The letter “C” means “connected” or “directly connected”. So there are 2 networks that are directly connected to R0: 10.0.0.0/8 and 12.12.12.0

On R1

R1# show ip route

Configuring static route on R0

R0(config)#ip route 172.16.0.0 255.255.0.0 12.12.12.2

Configuring static route on R1

R1(config)#ip route 10.0.0.0 255.0.0.0 12.12.12.1

Notice that static route works one-way. It means we have to add static route to both R0 and R1 so that R0 and R1 can communicate.

Now try to ping each far end network

(Note: In fact, R0 can successfully ping R1 right after adding the static route to R0)

Administrative distance of a static route.

After adding two static routes in R0 & R1 routers, the routing tables of two routers contain these lines:

S 10.0.0.0/8 [1/0] via 12.12.12.1 (on R1)
S 172.16.0.0/16 [1/0] via 12.12.12.2 (on R0)

The “S” letter tells us this is a static route. The networks 10.0.0.0/8 and 172.16.0.0/16 are the destinations of this static route and if the routers want to reach them they must send packets to 12.12.12.1 (on R1) and 12.12.12.2 (on R2). These parameters are straightforward and easy to understand. But what is [1/0]? Well, 1 is the administrative distance (AD) and 0 is the metric of that static route.

The administrative distance is a measure of trustworthiness where lower numbers are considered to be more trustworthy than higher numbers. The route with the lowest administrative distance value is the preferred route that the router selects. Administrative distance is the value from 0 to 255.

Directly connected routes have an administrative distance of 0. Static routes have an administrative distance
of 1 so in the outputs above you will see the administrative distance of both static routes are 1.

The router treats a static route pointing to an interface the same as a connected interface so the its AD is 0. If you configure a static route pointing to an exiting interface (for example: “ip route 172.16.0.0 255.255.0.0 s0/0” on R0) then the AD will not be shown.

(For your information, EIGRP has an administrative distance of 90. IGRP has an administrative distance of 100. OSPF has an administrative distance of 110. And RIP has an administrative distance of 120)

Router>enable
Password: ******* (enter that password here)
Router# (this is the privileged mode)

Now let’s start!

First launch the GNS3, for this tutorial I use the IOS c2600-bin-mz.123-6f.bin but this is a very fundamental lab so you can use any IOS you have.

1. Drag the Router c2600 the place it onto the right-side box,
2. Click the Start button (the green triangle button)
3. Click the Telnet to all IOS button (the black button) to open the Telnet command line interface (CLI).

The CLI window will appear, asking “Would you like to enter the initial configuration dialog? [yes/no]:”. Type n here as we want to configure this router manually.

Wait for a few seconds and now the router will be ready for the configuration.

Router>enable
Router#configure terminal (or type conf t as a shortcut)
Router(config)#enable password digitaltut
Router(config)#exit (or press Ctrl-Z)
Router#exit (to exit privileged mode)

We logged out the router, notice that you will see two lines “Router con0 is now available” and “Press RETURN to get started.” Press Enter to enter the user mode (a line Router> will appear)

Now we can test if the password is working. Log in the privileged mode with the enable command

Router>enable

Now we can see the router is asking for a password. Type “digitaltut” as its password here and we can log in to the privileged mode

Notice that we with the “enable password” command, the router will save our password in plain text. It means if someone types show running-config on our router, they can see our password.

Router#show running-config (or show run)

This is a thing we don’t want as our router is not secured completely. In fact, most of the administrators use the “enable secret” command nowadays. To do it, in the privileged mode type the following commands:

Router#config terminal
Router(config)#enable secret digitaltutSecret (notice the letter “S” is capital)
Router(config)#exit
Router#exit

Now try to log in the privileged mode again (type enable in the user mode). First, try the password digitaltut again; the router will not accept this password anymore. Now type digitaltutSecret and we can login! (make sure you capitalize the letter S).

So notice that if you configure the enable secret command, it takes precedence over the enable password command. The two commands cannot be in effect simultaneously.

The enable secret command will encrypt the password so no one can see the password with the show running-config command. We can check it.

Router#show running-config

We can also set the password for console and vty (telnet) login with these commands:

Set console password:
Router#config terminal
Router(config)#line console 0
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#exit

Set vty (virtual terminal lines) password:
Router#config terminal
Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#exit

By default, a Cisco router supports 5 simultaneous telnet sessions. By using the command line vty 0 4, the configuration below will be applied to all 5 sessions (line 0 to line 4).

Notice these passwords are not encrypted and we can see them with the “show running-config” command. We can encrypt all the passwords with the service password-encryption command in global configuration mode

Router(config)# service password-encryption

Another notice is that we can’t login to a Cisco router via telnet if we don’t set a vty line password for it.

A quick summary of RIPv2:

1) Routing Information Protocol (RIP) is a true distance-vector routing protocol
2) RIP permits a hop count of up to 15, so anything that requires 16 hops is deemed unreachable.
3) RIP sends the complete routing table out to all active interfaces every 30 seconds (RIP updates occur every 30 seconds)
4) RIP version 2 does send subnet mask information with the route updates. This is called classless routing.
5) RIP only uses hop count to determine the best way to a remote network (a hop is a router)
6) Administrative Distance is 120
7) Support VLSM & discontiguous networks

Note: If you are not sure about RIP, please read my RIP tutorial first

Below is the topology of this lab

Configuring interfaces for R0, R1 & R2:

R0(config)#interface s0/0

R0(config-if)#ip address 192.168.1.2 255.255.255.0
R0(config-if)#no shutdown
R0(config-if)#interface lo0
R0(config)#ip address 12.0.0.1 255.0.0.0

R1(config)#interface s0/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#interface f0/0
R1(config-if)#ip address 192.168.2.1 255.255.255.0
R1(config-if)#no shutdown

R2(config)#interface f0/0
R2(config-if)#ip address 192.168.2.2 255.255.255.0
R2(config-if)#interface lo0
R2(config-if)#ip address 200.200.200.1 255.255.255.0

Before enable RIP we should check the routing table on these routers to understand what has been changed in these routers.

R0

R1

R2

Notice that these 3 routers only see the directly connected routers.

Now if you ping from the loopback (or any interface) of R0 to the loopback (or any interface) of R2 then the it will not successful because R0 doesn’t know which interface it should send the packets out to reach network 200.200.200.0.

Now enable RIPv2 on three routers

R0(config)#router rip
R0(config-router)#version 2
R0(config-router)#network 12.0.0.0
R0(config-router)#network 192.168.1.0

R1(config)#router rip
R1(config-router)#version 2
R1(config-router)#network 192.168.1.0
R1(config-router)#network 192.168.2.0

R2(config)#router rip
R2(config-router)#version 2
R2(config-router)#network 200.200.200.0
R2(config-router)#network 192.168.2.0

Notice that with RIP protocol we just need to type the main network without subnet mask or wildcard mask. If you type a subnetwork, it will be auto summary into the main network.

Check the routing tables of these routers we will see the differences

R0

R1

R2

Now we can ping from the R0′s loopback interface to the R2′s loopback interface as the routing table of R0 has a path to R2′s loopback interface and vice versa.

If you want to check what is inside the update packet, use the command debug ip rip.

To turn off the debug ip, use the command undebug ip rip. If you want to disable all the debug processes, use the command undebug all.

This lab consists of 5 routers and we need to configure EIGRP among them. It is done when we can successfully ping among R2, R3, R4 & R5 and the routing tables of these routers show that they are running EIGRP (with letter “D”).

IOS used in this tutorial: c2600-bin-mz.123-6f.bin (with a minimum of 64 MB RAM) but you can use other IOS.

Note: If you are not sure about EIGRP, please read my EIGRP Routing Protocol tutorial first

IP addresses of routers:

+ R1:
s0/0 – 192.168.30.12/28
s0/1 – 192.168.30.18/28
s0/2 – 192.168.30.35/28
f0/0 – 192.168.60.10/28

+ R2:
s0/0 – 192.168.30.13/28

+ R3:
f0/0 – 192.168.60.13/28

+ R4:
s0/0 – 192.168.30.20/28

+ R5:
s0/0 – 192.168.30.40/28

If you are not sure about EIGRP, please read my article about this routing protocol at http://www.9tut.com/eigrp-routing-protocol

Some important notes about EIGRP:

+ All routers must use the same Autonomous System (AS) number to recognize each other. In this case the chosen AS is 100.
+ The major network in this lab is 192.168.30.0 & 192.168.60.0 so there will be discontiguous networks -> need to use the “no auto-summary” command.

Now let’s begin the lab!

Step 1 – Configuring IP addresses on the routers

*On R1:
R1#config t
R1(config)#int s0/0
R1(config-if)#ip address 192.168.30.12 255.255.255.240
R1(config-if)#no shut
R1(config-if)#int s0/1
R1(config-if)#ip address 192.168.30.18 255.255.255.240
R1(config-if)#no shut
R1(config-if)#int s0/2
R1(config-if)#ip address 192.168.30.35 255.255.255.240
R1(config-if)#no shut
R1(config-if)#int f0/0
R1(config-if)#ip address 192.168.60.10 255.255.255.240
R1(config-if)#no shut

*On R2:
R2#config t
R2(config)#int s0/0
R2(config-if)#ip address 192.168.30.13 255.255.255.240
R2(config-if)#no shut

*On R3:
R3#config t
R3(config)#int f0/0
R3(config-if)#ip address 192.168.60.13 255.255.255.240
R3(config-if)#no shut

*On R4:
R4#config t
R4(config)#int s0/0
R4(config-if)#ip address 192.168.30.20 255.255.255.240
R4(config-if)#no shut

*On R5:
R5#config t
R5(config)#int s0/0
R5(config-if)#ip address 192.168.30.40 255.255.255.240
R5(config-if)#no shut

Now all the interfaces are up. We should check the interfaces on R1 to confirm this with the “show ip int brief” command

Notice that all both the “Status” and “Protocol” of the connected interfaces were up.

We can see all the neighbors of R1 with the “show cdp neighbors” command on R1:

At this time we can ping between two directly connected interfaces. For example a ping from s0/0 of R1 to s0/0 of R2 (192.168.30.13) will be successful.

but a ping between two far-away interfaces is not successful. For example a ping from R2 to s0/0 of R4 (192.168.30.20) will be unsuccessful.

If we use the “show ip route” on these routers we will only see directly connected link.

Step 2 – Enable EIGRP on all the routers

*On R1
R1(config)#router eigrp 100
R1(config-router)#network 192.168.30.0
R1(config-router)#network 192.168.60.0
R1(config-router)#no auto-summary

*On R2
R2(config)#router eigrp 100
R2(config-router)#network 192.168.30.0
R2(config-router)#no auto-summary

*On R3
R3(config)#router eigrp 100
R3(config-router)#network 192.168.60.0
R3(config-router)#no auto-summary

*On R4
R4(config)#router eigrp 100
R4(config-router)#network 192.168.30.0
R4(config-router)#no auto-summary

*On R5
R5(config)#router eigrp 100
R5(config-router)#network 192.168.30.0
R5(config-router)#no auto-summary

After typing above commands we will see the neighbors adjacency on these routers are up. For example on R1 we will see

Now the EIGRP process is up and we can ping from anywhere. For example a ping from R2 to s0/0 of R4 (192.168.30.20) will be successful now.

By checking the routing table of R2, R3, R4 & R5 we can confirm EIGRP has been implemented successfully. For example, using the “show ip route” command on R5 we see

Notice that the routes to 192.168.30.16 & 192.168.60.0 are marked with a letter “D”, meaning it is learned via EIGRP. Maybe you are wondering “why is the letter “D” used for EIGRP, not “E”? Well, the answer is the letter “E” has been “stolen” for EGP – an external routing protocol – but it is not popular nowadays :)

We can check the neighbor relationships on these routers with the “show ip eigrp neighbors” command. Below is an example of R1:

To see the topologies of these routers, use the “show ip eigrp topology” command. Below is the output of R4

Download the configured network

TROUBLESHOOTING part

In this part, we created a faulty network and your task is to find out and fix the errors to make the network run perfectly. You can download the files here: Download faulty network