SSH works without AAA
Related posts in IOS hints blog
Identifying TACACS+ failure
I've got an interesting question from Colin a while ago:
I would like to generate a different prompt during the login to the router if the TACACS+ server has failed, indicating to the network operators that they have to log-in with the special (local) username, not with the TACACS+ authenticated username/password.
Fortunately he was running TACACS+ which supplies its own prompts during the authentication phase (the solution would not work with RADIUS). If you change the local authentication prompts, you'll get the prompts from TACACS+ server if it's reachable from the router (the AAA authentication is performed via TACACS+ server) and the local prompts if the TACACS+ server has failed (the AAA authentication is performed via any other mechanism). Here's a sample configuration:
OSPF in a VRF Requires a Box-Unique Router ID
It’s obvious why two routers in the same OSPF domain cannot have the same router ID. However, requiring unique router IDs on OSPF processes running in different VRFs is probably too harsh, even though it does prevent confusion if two VRFs ever get connected through a customer site. Anyhow, if you have overlapping IP addresses on loopback interfaces in different VRFs, OSPF process might not start.
Interesting links | 2008-07-27
- Petr Lapukhov continues to write interesting stuff: recently he's covered WRR queuing parameters on Catalyst 3550, wrote an introduction to SNMPv3 and provided sample private VLAN configurations.
- Joe Harris discovered an interesting feature in IOS release 12.4(20)T: you can increase the Fast Ethernet interface MTU way beyond the 1500 bytes, making it easier to implement various MPLS solutions in switched LAN environments.
- Brian McGahan describes the IP Multicast helper-map feature.
- Arden Packeer writes about 6to4 tunnels.
Router configuration partitioning
IOS release 12.2(33)SRB has introduced a fantastic feature: router configuration partitioning. The early seeds of this idea are already present in mainstream IOS releases. For example, you can display the configuration of a single interface, all class-maps or all policy-maps. The configuration partitioning gives you the ability to display access-lists, route-maps, static routes, router configurations ...
… updated on Monday, December 28, 2020 12:44 UTC
Unequal-Bandwidth EBGP Load Balancing
EIGRP was always described as the only routing protocol that can do unequal-cost load sharing. As it turns out, BGP is another one (although it's way more limited than EIGRP). For example, if you have two links into a neighbor AS, you can load-share across them proportionally to their bandwidth.
EBGP load balancing was introduced with the BGP 4 Multipath Support feature in IOS release 11.2. Initially, EBGP supported up to six maximum paths; IOS release 12.0(S) increased that value to 8, IOS release 12.3T to 16 and 12.2S (including 12.2SRC) to 16.
Goodbye fast switching & cell-mode MPLS
After leaving us in the dark for almost a year, Cisco finally released new functionality in IOS release 12.4(20)T. Support for a number of hardware platforms has been removed (dynamips fans are left with the 7200’s, everything else is gone). They also removed two switching features: fast switching and label-controlled ATM (cell-mode MPLS-over-ATM) together with Label Switch Controller (LSC).
Interesting links | 2008-07-13
- Petr Lapukhov described the differences between shaping and policing, the Unidirectional Link Detection (UDLD) technology and the PPP IPCP subnet mask negotiation. Obviously he had a highly productive week :) ... or maybe the shakeups in the CCIE training market result in more high-quality content? Hat tip to Ethan; you've made me look up a word in the English dictionary; a rare, but interesting and pleasurable event.
- Jeremy Stretch documents how you can turn a Catalyst into a totally transparent switch. Fantastic solution for lab environments. He also found a way to generate IOS type 5 passwords (enable/username secrets) on a Linux workstation.
How obscure can it get?: BGP IPv6 printouts
If you want to display any IPV6-related BGP objects (neighbors, routes …) you can use the familiar BGP commands, but have to prefix them with show ip bgp ipv6 unicast. For example, to display the BGP neighbors active in the IPv6 address family, you would use show ip bgp ipv6 unicast summary command. I doubt you like so much typing (I don't, just entering the IPv6 addresses is enough for me); luckily Cisco IOS has aliases - just configure alias exec bgpv6 show ip bgp ipv6 unicast and (for consistency) alias exec bgpv4 show ip bgp ipv4 unicast.
Update 2010-03-12: Cisco IOS also supports show bgp ipv6 unicast command, which (at least) makes BGP ipv4-agnostic.