Skip to main content

Posts

NTP access control

Important trick I found on INE forum that should be remembered about NTP when you are using NTP access-control. One of the important things that are not mentioned in the INE post is that by default no one will be rejected from the NTP master if it's not trying to authenticate that's why you will restrict those stations with ACL.  "If your router is configured as NTP master, and you set up any access-control group, you must allow “peer” access type to a source with IP address “127.127.7.1”. This is because “127.127.7.1” is the internal server created by ntp master command, which the local router synchronizes to. If you forget to enable it peer access, your server will always be out of sync. Here are some examples. First one: configure R1 as NTP master and allow the server to be polled for NTP updates just by one client. Client should receive updates just from one source:" reating an Access Group and Assign a Basic IP Access List to It To control access to NT...
Read more >>
Ethernet over SDH. It's interesting topic though, I got such question on job interview few days ago and I think I was too stressed to give the answer straight away but after I left the interview I came out with few answers about that and I used such solution few years ago in Iceland. So, you want to carry native Ethernet over SDH but for some historical reasons you have a huge SDH/PDH network which carry mainly IP - so what you can do about it? I was thinking of Ethernet-over-IP-over SDH? why not? I tried something like that couple of years back and it works. The Telco way is to convert the SDH to ethernet with pseudo-wire (tunnelling) and Axerra networks and Tellabs have such solutions or using the so well advertised rfc4448 (ethernet-over-mpls)
Read more >>

dynamic access-list - the small trick

short note about the dynamic ACLs: if you are going to use dynamic ACL to allow some kind of access to service/server with absolute timer it's very important to remember that you need to enable the "absolute timer" extensive of the ACL's R1(config)#access-list dynamic-extended and the rest that you have to remember is to put autocommand sub option but if you cannot remember what should be options after that they are available in exec mode R1(config)#username ENABLE autocommand ? LINE Command to be automatically issued after the user logs in R1#access-enable ? host Enable a specific host only timeout Maximum idle time to expire this entry example acl with dynamic statement ip access-list extended DYN permit tcp any any eq telnet permit tcp any any eq 7001 permit udp any any eq rip dynamic ACCESS timeout 15 permit tcp any any eq www deny ip any any deny ip any any log vty configuration R1(config-line)#autocommand access-enable timeout 5 One very ...
Read more >>

Private VLANs

Introduction To begin with, recall that VLAN is essentially a broadcast domain. Private VLANs (PVANs) allow splitting the domain into multiple isolated broadcast “subdomains”, introducing sub-VLANs inside a VLAN. As we know, Ethernet VLANs can not communicate directly with each other – they require a L3 device to forward packets between separate broadcast domains. The same restriction applies to PVLANS – since the subdomains are isolated at Level 2, they need to communicate using an upper level (L3/packet forwarding) device – such as router. In reality, different VLANs normally map to different IP subnets. When we split a VLAN using PVLANs, hosts in different PVLANs still belong to the same IP subnet, yet now they need to use a router (L3 device) to talk to each other (for example, by using Local Proxy ARP). In turn, the router may either permit or forbid communications between sub-VLANs using access-lists. Commonly, these configurations arise in “shared” environments, say ISP co-locat...
Read more >>