Prefix List explanation

A quick touch on prefix lists.

They are for matching, similar to an access list or whatnot, but can match exact subnet mask lengths.

First you just have an IP with slash notation, and you are matching that EXACT prefix. For instance:

#ip prefix-list ListName permit 10.1.0.0/16

would match the first sixteen bits. This will not match 10.1.0.0/18. It must match the subnet length EXACTLY.



But say we are looking to match a bit more than that.

#ip prefix-list ListName permit 10.1.0.0/16 ge 24 le 24

So we need to match the prefix 10.1.0.0 exactly, but we only want to match /24 masks (remember, this is for matching routes, not hosts) So any /24 route that starts with 10.1. will be matched.



So you want a real life example. Say all my loopback addresses start with 10.99.x.x and I want to match them with a filter. Well I know all my loopbacks are a /32 mask, so I can put

#ip prefix-list LoopBackMatch permit 10.99.0.0/16 ge 32 le 32

I matched the 10.99 prefix, then look through those and only match /32 bit masks.

Last example

ge meaning greater than or equal to, le meaning less than or equal to, we can match a range of masks.

Say all my client routes are 10.x.x.x with /22 masks, and all my switch management, wireless APs, security, and other networks are /24 and /25 masks, and my router links are /30.

#ip prefix-list ClientMatchList permit 10.0.0.0/8 ge 22 le 22
#ip prefix-list ManageNetworksList permit 10.0.0.0/8 ge 24 le 25
#ip prefix-list RouterLinksList permit 10.0.0.0/8 ge 30 le 30

Here I matched the /22 in the first line for client networks.

Then I matched greater or equal to /24 and less than or equal to /25 to match the other networks

Lastly I matched /30 subnets for the router links.

As always, let me know if I got something wrong, I am learning!

Try a few examples!

Simple BGP prepending

So, Having a baby seems to suck up a lot of time... Anyway,

Getting back to my CCNP studies, lets look at some simple BGP path selection: prepending.

First lets glance at BGP route selection process.
1. Highest weight (local/cisco proprietary)
2. Highest Local Preference (propagated in IBGP, stripped from EBGP)
3. Originated by Local Router
4. Prefer shortest AS path
5. Lowest Origin Code
6. Prefer lowest MED
7. EBGP over IBGP
8. Closest IGP neighbor
9. Oldest EBGP
10. Lowest BGP neighbor ID
11. Lowest Neighbor IP address


So, down at step four we are looking at how to manipulate traffic coming into our AS.

Patch selection is by AS hops, so if we have two paths into our AS we are going to make it appear to use extra AS hops through one of the paths.

We can use a trusty route map to prepend these extra AS'.

We'll use BGP AS 65000 as us, 65010 (10.1.1.1) as the desired path, and 65020 (10.2.2.2) as the less desirable path.

#router bgp 65000
#neighbor 10.2.2.2 route-map PrependASMapSample out
#
#route-map PrependASMapSample permit 10
#set as-path prepend 65000 65000 65000

Now, lets first notice, you need to prepend your own AS number, don't use someone else's. I have used the neighbor command on the LESS DESIRABLE AS and attached a route-map that adds three extra AS hops. Now when this adjacent AS 65020 wants to send you traffic, you appear as 4 hops instead of just 1. If the path through 65010 is only three hops away, you just directed traffic through the more desirable ISP.

Cisco 5508 WLC 5 min timeout bug

Ok, don't you love it when you've been struggling to troubleshoot something that just doesn't make any sense, then you start grasping at a straw and it starts coming together. So, we have 4 devices. Three existing 4404 cisco wireless lan controllers. I come along with a new and pretty 5508 to add to the bunch. Configure it so it has all the same vlans/ssids/settings/mobility groups/etc. as the others, bring up some access points on it, everything looks great.

So, i go log into the old controller, take a building worth of APs and add the new 5508 to the top of their "High Availability" list, let them swing over on their own. Walk over to the building, log in for a minute, everything looks great, project successful right?

Hour later I start hearing reports about people in that building on the 5508 getting kicked off every 5 minutes. I hurriedly swing all the APs back to the old 4404s and problem goes away.

Ok, not sure why the testing didn't bring this up but lets bring up a test AP at my desk. I stream video on my laptop beside me for 4 hours before deciding there isn't a timeout issue. I swing a single AP over to that problem building and walk over to test with my laptop, make sure there actually is a problem. Sure enough, every 5 minutes I have issues. Still says I'm connected on laptop and controller, but cannot ping gateway, cannot get anywhere. Reconnect/click repair on my wireless icon and I'm good to go (for another 5 minutes). It doesn't even ask me to authenticate again so I know the web authentication isn't getting timed out, BUT, I go ahead and change the idle timeout to several hours (since it is 300 seconds, I tried to avoid seeing 300 anywhere), and changed the user timeout to 8 hours. I peer through looking for any other 300 second timer that might be giving me issues. Go ahead and test, still nothing wrong at my desk with the test APs but still timing out in the problem building...

verify there are no ACLs that might be blocking or different for the problem building versus my test lab building.

Finally I start grasping at something, the APs that I am testing with are booting straight to the 5508. The APs swung over using high availability do not reboot but simply authenticate to the new controller.

The next time I swung the APs over in the production building I chose to reset AP after changing the primary high availability. To my delight i am now typing this on a non-timing out connection. I also verified there are identical software versions on all controllers, so there shouldn't be problems moving between them... I should probably let TAC know about this little bug.


*Before any tells me not to test on a production network, #1, I did test in the lab first and didn't find anything #2, it's spring break so there are only a handful of students on campus anyway, far from the thousands of wireless clients I would have on a typical school day*


PROBLEM CAME BACK TODAY- think I found the real problem now (and this time it makes sense). Two of my controllers were using the same AP multicast address!!! #facepalm APs aren't going to like getting updates from two different WLCs at the same time, periodic updates must come at a 5 minute interval. I think this will actually be the solution, will update if for some reason it is not.

ASA prompts

SO USEFUL!!! If you manage redundant ASA's, read @aconaway 's post on changing your prompt to include the active/standby and primary/secondary state of your firewall to the prompt. Click Here

You might be a network guy if:

You might be an Network Guy If

you know more ip addresses than phone numbers

You regularly mock TV shows for using technology that isn't part of the feature set available on the devices they have

You correct people who mix up Megabytes and Megabits

You waited eagerly for wireless N to be approved officially.

You can explain everything in your life using 7 layers

You tell people not to use TKIP because of it's security flaw

You think people should be able to do without DNS for a day, just use IP addresses...

You follow your wife around shopping retail stores and spend your time skimming the ceilings for their APs and mapping out a heat map of the store in your head

you know what TCP/IP stands for, not to mention DNS, HTTP, SNMP, BGP, OSPF, WPA, and DHCP - Sometimes you wonder if you know more acronyms than words

You've known what IPv6 was for years

cmd, telnet, and ssh are useful everyday tools, not just black boxes

Linus Torvalds comes up in everyday conversation

You know jokes about DHCP and LSAs

You cringe when you have to use a Gui to configure a switch or router

Your Amazon wish list consists of routers and ASA firewalls

Dealing with Tier 1 tech support makes you pull your hair out.

You have read the NSA's security best practices

The routing protocol in your house changes daily depending on what you have been reading

You know what a nibble is

You know what 1000 Terabytes is called

You can intelligently discuss how Egypt shut off their Internet to the country