Tunnel GRE sobre IPsec

R1#

###### configuracion GRE ######
interface Tunnel0
 ip address 172.16.0.1 255.255.255.0
 tunnel source 10.10.10.1
 tunnel destination 10.10.10.6
end

router ospf 1
 network 172.16.0.0 0.0.0.255 area 0
 network 192.168.10.0 0.0.0.255 area 0

access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

####### config IPsec ############

access-list 101 permit gre any any

crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2

crypto isakmp key 6 cisco address 10.10.10.6
crypto ipsec transform-set TSET ah-sha-hmac esp-aes
crypto map POLITICA 10 ipsec-isakmp
 set peer 10.10.10.6
 set transform-set TSET
 match address 101

 int s0/0 crypto map POLITICA

 

Tunel GRE

R1#sh run int s0/0
interface Serial0/0
 ip address 10.10.10.1 255.255.255.252
 clock rate 2000000
end

interface FastEthernet0/0
 ip address 192.168.10.254 255.255.255.0
 duplex auto
 speed auto
end

interface Tunnel0
 ip address 172.16.0.1 255.255.255.0
 tunnel source 10.10.10.1
 tunnel destination 10.10.10.6
end

router ospf 1
 network 172.16.0.0 0.0.0.255 area 0
 network 192.168.10.0 0.0.0.255 area 0

R3#

interface Serial0/0
 ip address 10.10.10.6 255.255.255.252
 clock rate 2000000
interface FastEthernet0/0
 ip address 192.168.20.254 255.255.255.0
 duplex auto
 speed auto
end

interface Tunnel0
 ip address 172.16.0.3 255.255.255.0
 tunnel source 10.10.10.6
 tunnel destination 10.10.10.1
end

router ospf 1
 log-adjacency-changes
 network 172.16.0.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0

  ping de la Pc1 a la Pc2
  ping 192.168.168.20.10

Tunnel ipv6ip 6to4

  Tunnel 6to4 se levanta de manera automatica
   Podemos configurar tunneles de una fuente a varios destinos
  Tenemeos que usar el direccionamiento 2002:/16
          en el router tenemos la direccion
                                        int s0/0 usa la direccion  10.10.10.1
                                       10.10.10.1      =====> 0a:0a:0a:01
                                       tunnel 6 to 4   =====>  2002:0a0a:0a01


R1(config)#

interface Serial0/0
 ip address 10.10.10.1 255.255.255.0
 clock rate 2000000
end

interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 ipv6 address 2001:1::1/64
end
interface Tunnel1
 no ip address
 no ip redirects
 ipv6 address 2002:A0A:A01::/128
 tunnel source 10.10.10.1
 tunnel mode ipv6ip 6to4
end
ipv6 route  2001:2::/64  2002:A0A:A06::
ipv6 route  2001:3::/64  2002:A0A:A0A::
ipv6 route  2002::/16    Tunnel1

Trafico en la fast ethetnet

Trafico en la interface serial 0/0

Nagios , una breve introduccion

  Nagios , es una herramienta de monitoreo  Open Source , que nos permite sensar Hosts :Linux, Windows , Switchs ,Routers,...

yum install httpd php

 

yum install gcc glibc glibc-common

 

yum install gd gd-devel

 

1) Crear una cuenta

su –l

Creamos una nueva cuenta y asignamos un password

/usr/sbin/useradd -m nagios

passwd nagios

 

Crae un grupo nagcmd

/usr/sbin/groupadd nagcmd

/usr/sbin/usermod -a -G nagcmd nagios

/usr/sbin/usermod -a -G nagcmd apache

 

2) Bajar Nagios y us plugins

Bajar en /tmp/download

mkdir ~/downloads

cd ~/downloads

 

wget http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.2.3.tar.gz

 

wget http://prdownloads.sourceforge.net/sourceforge/nagiosplug/nagios-plugins-1.4.11.tar.gz

 

3) Compilar e instalar Nagios

cd ~/downloads

 

tar xzf nagios-3.2.3.tar.gz

 

cd nagios-3.2.3

compilar:

make all

 

instalar:

make install

make install-init

make install-config

make install-commandmode

4) Personlizar la configuracion

 

vi /usr/local/nagios/etc/objects/contacts.cfg

 

5)Configurar la interface web

make install-webconf

Crear el password nagiosadmin, lepedira la creacion del password

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

 

Reinicializar Apache

service httpd restart

6) Compile  e Instale los plugins de Nagios

cd ~/downloads

 

tar xzf nagios-plugins-1.4.11.tar.gz

 

cd nagios-plugins-1.4.11

 

Compile e instale los  plugins.

 

./configure --with-nagios-user=nagios --with-nagios-group=nagios

 

make

 

make install

 

7) Inicie  Nagios

Ejecutar nagios cada vez que se inicie

 

chkconfig --add nagios

 

chkconfig nagios on

 

service nagios start

 

8) Modifificando la configuracion de  SELinux

Poner SELinux en modo Permissive.

 

setenforce 0

 

 

chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/

 

chcon -R -t httpd_sys_content_t /usr/local/nagios/share/

 

9) Login a la  Web

http://localhost/nagios/

BGP-01

R1
router eigrp 1
network 1.1.1.0 0.0.0.255
network 10.10.0.0 0.0.0.255
no auto-summary
router bgp 65000
no synchronization
bgp log-neighbor-changes
network 1.1.1.0 mask 255.255.255.0
neighbor 10.10.0.4 remote-as 65000
no auto-summary
R4
router eigrp 1
passive-interface FastEthernet0/1
network 4.4.4.0 0.0.0.255
network 10.10.0.0 0.0.0.255
network 172.16.0.0 0.0.0.255
no auto-summary
!
router bgp 65000
no synchronization
bgp log-neighbor-changes
network 4.4.4.0 mask 255.255.255.0
neighbor 10.10.0.1 remote-as 65000
neighbor 10.10.0.1 distribute-list 10 out
neighbor 172.16.0.6 remote-as 65010
no auto-summary
!
R6
router bgp 65010
no synchronization
bgp log-neighbor-changes
network 6.6.6.0 mask 255.255.255.0
neighbor 172.16.0.4 remote-as 65000
no auto-summary

http://youtu.be/a4QnNHgJHy0

QoS - MQC

MQC es un metodo ,configurar la calidad de servicio (cabecera ip y sobre interfaces truncales 802..q) para que estos sean procesados mas rapidamente por el router

1 ) Se configura el trafico , el grupo de direccones ( se puede usar puertos )

2) Se crea la politica ( se puede cambiar la prioridad , el limite de ancho de banda,...)

3) Se aplica en la interface la politica

R1:

enable

config t

access-list 101 permit ip 10.0.10.0 0.0.0.255 20.0.10.10 0.0.0.255

class-map CM

match access-group 101

exit

polic-map PM

class CM

set dscp 5

int s2/0

service-policy out PM

VPN Site to Site

VPN site to site
1.Definir ISAKMP policy
2.Definie Tansform-SET
3.Define ACL , para definir que vamos a encriptar
4.Crear crypto map , aplicar a una interface

R1
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp key CISCO address 2.2.2.1
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
!
crypto map CRYPTO 10 ipsec-isakmp
set peer 2.2.2.1
set transform-set TSET
match address 101
!
interface Serial0/0
ip address 1.1.1.1 255.255.255.252
serial restart-delay 0
crypto map CRYPTO
!
　
R3
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key CISCO address 1.1.1.1
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
!
crypto map CRYPTO 10 ipsec-isakmp
set peer 1.1.1.1
set transform-set TSET
match address 101
!
interface Serial0/0
ip address 2.2.2.1 255.255.255.252
crypto map CRYPTO