dKD33z7T

1Search | Glossary
2Course Index:
3 
4CCNA Discovery - Introducing Routing and Switching in the Enterprise
59 Troubleshooting an Enterprise Network
69.0 Chapter Introduction
79.0.1 Introduction
8
9Page 1:
10
11
12
13
149.1 Understanding the Impact of Network Failure
159.1.1 Enterprise Network Requirements
16
17Page 1:
18Most enterprises rely on their networks to provide consistent and reliable access to shared resources. Network uptime is the time that the network is available and functioning as expected. Network downtime is any time that the network is not performing as required. A reduction in the performance level of the network may have a negative impact on the business.
19
20Without a reliable network, many organizations lose access to customer databases and accounting records that employees need to perform their daily activities. Network outages also prevent customers from placing orders or obtaining the information they require. Downtime results in lost productivity, customer frustration, and often the loss of customers to competitors.
21
22
23
24
25Page 2:
26Many different metrics are used to determine the cost of downtime to an enterprise. The actual cost to a company varies depending on the day, date, and time.
27
28Large enterprises generally span many different time zones and have employees, customers, and suppliers accessing their network around the clock. For these organizations, any downtime is extremely costly. Many factors cause network downtime. These include:
29
30Weather and natural disasters
31Security breaches
32Man-made disasters
33Power surges
34Virus attacks
35Equipment failure
36Misconfiguration of devices
37Lack of resources
38
39
40
41
42Page 3:
43A well-planned network design and implementation are crucial for meeting uptime requirements.
44
45To ensure the proper and efficient flow of traffic, a good design includes redundancy of all critical components and data paths. This redundancy eliminates single points of failure.
46
47The three-layer hierarchical network design model separates the functionality of the various networking devices and links. This separation ensures efficient network performance. In addition, the use of enterprise class equipment provides a high degree of reliability.
48
49Even with proper network design, some downtime is inevitable. To keep downtime to a minimum and ensure rapid recovery requires additional considerations.
50
51To guarantee service levels, an enterprise should have service level agreements (SLAs) with key suppliers. An SLA clearly documents network expectations in terms of level of service. These expectations include the acceptable level of downtime as well as the recovery period. SLAs often specify the penalty associated with any loss of service.
52
53
54
55
56Page 4:
57Outages are not only associated with loss of service from ISPs. Quite often, the problem stems from the failure of a key piece of equipment that is part of the local network. To minimize this type of downtime requires warrantees on all critical pieces of equipment. Warrantees provide for rapid replacement of mission-critical components.
58
59Business continuity plans provide a detailed plan of action in case of unexpected man-made or natural disasters such as power failures or earthquakes. Business continuity plans provide the details on how the business continues or resumes operations, with minimal disruption to its clients, after the disaster. They clearly specify how the network re-establishes functionality in the event of a catastrophic failure. One way to ensure functionality is to have a redundant backup site at another location, in case of failure at the primary site.
60
61
62
63
649.1.2 Monitoring and Proactive Maintenance
65
66Page 1:
67One way of ensuring uptime is to monitor current network functionality and perform proactive maintenance.
68
69The purpose of network monitoring is to watch network performance in comparison to a predetermined baseline. Any observed deviations from this baseline indicate potential problems with the network and require investigation. As soon as the network administrator determines the cause of degraded performance, corrective actions can be taken to prevent a serious network outage.
70
71Several groups of tools are available for monitoring network performance levels and gathering data. These tools include:
72
73Network utilities
74Packet sniffing tools
75SNMP monitoring tools
76
77Each of these groups of tools has different capabilities and provides different types of information. Using these tools in combination provides comprehensive information on current network performance.
78
79A network administrator performs proactive maintenance on a regular basis to verify and service equipment. By doing this, the administrator can detect weaknesses prior to a critical error that could bring down the network. Like regular servicing on a car, proactive maintenance extends the life of a network device.
80
81
82
83
84Page 2:
85Network monitoring tools, techniques, and programs rely on the availability of a complete set of accurate and current network documentation. This documentation includes:
86
87Physical and logical topology diagrams
88Configuration files of all network devices
89A baseline performance level
90
91It is best practice to determine baseline network performance levels when the network is first installed and then again after any major changes or upgrades occur. Network administrators perform baseline testing of the network under normal load levels, using the protocols and applications that are normally encountered on the network.
92
93Many complex tools and procedures exist to determine performance baselines. Some programs perform many different tests with different types of traffic. The tests determine the network performance under very accurately defined loads and conditions. Others, such as a simple ping, are less accurate but often provide sufficient information to alert the administrator to a problem.
94
95
96
97
98Page 3:
99Simple network utilities, like ping and tracert, provide information on the performance of the network or network link. Performing these commands at multiple times shows the difference in time required for a packet to travel between two locations. Using these commands, however, does not provide a reason for the difference in times.
100
101Packet sniffing tools monitor the types of traffic on various parts of the network. These tools indicate if there is an excessive amount of a particular traffic type. They examine the contents of the packets, which provides a quick way of locating the source of this traffic.
102
103These tools may also be able to remedy the situation before network congestion becomes critical. For example, traffic sniffing can detect whether a type of traffic or a particular transaction occurring on the network is unexpected. This detection might stop a potential denial of service attack before it impacts network performance.
104
105
106
107
108Page 4:
109Simple Network Management Protocol (SNMP) allows monitoring of individual devices on the network. SNMP-compliant devices use agents to monitor a number of predefined parameters for specific conditions. These agents collect information and store it in a database known as the management information base (MIB).
110
111SNMP polls devices at regular intervals to collect information about managed parameters. SNMP also traps certain events that exceed a predefined threshold or condition.
112
113For example, SNMP monitors a router interface for errors. The network administrator defines a specific level of acceptable errors for that interface. If the errors exceed the threshold level, SNMP traps the condition and sends it to a network management station (NMS). The NMS alerts the network administrator. Some SNMP systems trigger events, such as the automatic reconfiguration of a device, to eliminate the problem. Most enterprise class network management systems use SNMP.
114
115A number of freeware and commercial proactive network monitoring tools exist. These tools monitor traffic type, traffic load, server configurations, traffic patterns, and a multitude of other conditions. A proper Network Monitoring Plan and the use of proper tools help a network administrator evaluate the health of the network and detect any problem situations.
116
117
118
119
120Page 5:
121Packet Tracer Activity
122
123Design a network and create a baseline.
124
125Click the Packet Tracer icon to begin.
126
127
128
129
1309.1.3 Troubleshooting and the Failure Domain
131
132Page 1:
133The objective of any troubleshooting effort is to return functionality quickly and with little disruption to the end users. Achieving this objective often means postponing an extensive or prolonged process for determining the cause of a problem in favor of quickly re-establishing functionality.
134
135In some situations, putting a temporary solution into place allows investigation and correction of the problem under a less critical time constraint.
136
137Redundancy is a key design element for enterprise networks. In a redundant environment, if one link goes down, traffic diversion to the redundant link occurs immediately. This temporary solution allows the network to maintain functionality and gives the administrator time to diagnose and correct the problem with the failed link. If problems occur with a specific device or configuration, having backup copies of the configuration files or spare devices allows quick restoration of connectivity.
138
139
140
141
142Page 2:
143Quick solutions are not always possible or appropriate. The security of the network and the resources that it houses must always be the highest priority. If a quick fix compromises this security, take the time to investigate an alternative solution that is more appropriate.
144
145Detail security concerns in the business continuity plan. The plan includes:
146
147Documentation of potential problems
148Description of the appropriate course of action in the event of problems
149Details of the security policy of the company
150Details of the security risks of the actions
151
152When designing an enterprise network limit the size of a failure domain. The failure domain is the area of the network that is impacted by the failure or misconfiguration of a network device. The actual size of the domain depends on the device and the type of failure or misconfiguration. When troubleshooting a network, determine the scope of the issue and isolate the issue to a specific failure domain.
153
154
155
156
157Page 3:
158If both a Layer 2 switch and a border router fail at the same time, they affect different failure domains.
159
160The failure of a Layer 2 switch on a LAN segment only affects user in the broadcast domain. It has no affect on other regions of the network. Failure of a border router, however, prevents all users in the company from connecting to network resources outside of their local network.
161
162The router has a larger impact on the network, it has a larger failure domain. Under normal circumstances, troubleshoot resources with the larger failure domains first.
163
164In some circumstances, the size of the failure domain is not the deciding factor in troubleshooting. If a business critical server is connected to a failed switch, correction of this issue may take precedence over the border router.
165
166
167
168
169Page 4:
170
171
172
173
1749.1.4 Troubleshooting Process
175
176Page 1:
177When a problem occurs on an enterprise network, troubleshooting that problem quickly and efficiently is very important to avoid extended periods of downtime. Many different structured and unstructured problem-solving techniques are available to the network technician. These include:
178
179Top-down
180Bottom-up
181Divide-and-conquer
182Trial-and-error
183Substitution
184
185Most experienced network technicians rely on the knowledge gained from past experience and start the troubleshooting process using a trial-and-error approach. Correcting the problem in this manner saves a great deal of time.
186
187Unfortunately, less experienced technicians cannot rely solely on previous experience. Additionally, many times the trial-and-error approach does not provide a solution. Both of these cases require a more structured approach to troubleshooting.
188
189
190
191
192Page 2:
193When a situation requires a more structured approach, most network personnel use a layered process based on the OSI or TCP/IP models. The technician uses previous experience to determine if the issue is associated with the lower layers of the OSI model or the upper layers. The layer dictates whether a top-down or bottom-up approach is appropriate.
194
195When approaching a problem situation, follow the generic problem-solving model, regardless of the type of troubleshooting technique used.
196
197Define the problem
198Gather facts
199Deduce possibilities and alternatives
200Design plan of action
201Implement solution
202Analyze results
203
204If the first pass through this procedure does not determine and correct the problem, repeat the process as necessary.
205
206Document the initial symptoms and all attempts at finding and correcting the cause. This documentation serves as a valuable resource should the same or similar problem occur again. It is important to document even failed attempts, to save time during future troubleshooting activities.
207
208
209
210
211Page 3:
212
213
214
215
2169.2 Troubleshooting Switching and Connectivity Issues
2179.2.1 Troubleshooting Basic Switching
218
219Page 1:
220Switches are currently the most commonly used Access Layer networking device. Workstations, printers, and servers connect into the network through switches. Faults with the switch hardware or configuration prevent connection between these local and remote devices.
221
222The most common problems with switches occur at the Physical Layer. If a switch is installed in an unprotected environment, it can suffer damage such as dislodged or damaged data or power cables. Ensure that switches are placed in a physically secure area.
223
224If an end device cannot connect to the network and the link LED is not illuminated, the link or the switch port is defective or shutdown, perform the following steps:
225
226Ensure that the power LED is illuminated.
227Ensure that the correct type of cable connects the end device to the switch.
228Reseat the cables at both the workstation and the switch end.
229Check the configuration to ensure that the port is in a no shutdown state.
230
231If a connectivity problem exists, and if the link LED is illuminated, the switch configuration is the most likely problem.
232
233
234
235
236Page 2:
237If a switch port fails or malfunctions, the easiest way to test it is to move the physical connection to another port and see if this corrects the problem.
238
239Ensure that switch port security has not disabled the port. Confirm this using the following commands:
240
241show running-config
242
243show port-security interface interface_id
244
245If the switch security settings are disabling the port, review the security policy to see if altering the security is acceptable.
246
247Switches function at Layer 2 and keep a record of the MAC address of all connected devices. If the MAC address in this table is not correct, the switch forwards information to the wrong port and communication does not occur.
248
249To display the MAC address of the device connected to each switch port, use:
250
251show mac-address-table
252
253To clear the dynamic entries in the table, issue the command:
254
255clear mac-address-table dynamic
256
257The switch then repopulates the MAC address table with updated information.
258
259
260
261
262Page 3:
263Although automatically detected on many devices, mismatched speed or duplex settings can prevent the link between the switch and end device from functioning. Some switches do not properly detect the speed and duplex of the connected device. If this is the suspected problem, lock down the values on the switch port to match the host device using the interface speed and duplex commands.
264
265To display both the speed and duplex settings of the port, use the command:
266
267show interface interface_id
268
269Switching loops are another potential source of connectivity issues. STP prevents bridging loops and broadcast storms by shutting down redundant paths in a switched network. If STP bases its decisions on inaccurate information, loops may occur.
270
271Indicators that a loop is present in a network include:
272
273Loss of connectivity to, from, and through affected network regions
274High CPU utilization on routers connected to affected segments
275High link utilization up to 100%
276High switch backplane utilization as compared to the baseline utilization
277Syslog messages indicating packet looping, constant address relearning, or MAC address flapping messages
278Increasing number of output drops on many interfaces
279
280
281
282
283Page 4:
284A loop develops when the switch does not receive BPDUs or is unable to process them. This problem could be due to:
285
286Misconfigurations
287Defective transceivers
288Hardware and cabling issues
289Overloaded processors
290
291Overloaded processors disrupt STP and prevent the switch from processing the BPDUs. A port that is flapping causes multiple transitions to occur. These multiple transitions can overload the processors. This should be a rare occurrence in a properly configured network. To remedy this type of problem, remove as many of the redundant links as possible.
292
293Another troubleshooting issue is suboptimal switching. Left to default values, STP does not always identify the best root bridge or root ports. Changing the priority value on a switch can force the selection of the root bridge. The root bridge should normally be at the center of the network to provide for optimum switching.
294
295When troubleshooting STP, use the following commands:
296
297To provide information about the STP configuration:
298
299show spanning-tree
300
301To provide information about the STP state of an individual port:
302
303show spanning-tree interface interface_id
304
305
306
307
308Page 5:
309Packet Tracer Activity
310
311Troubleshoot host connectivity on a switch.
312
313Click the Packet Tracer icon to begin.
314
315
316
317
3189.2.2 Troubleshooting VLAN Configuration Issues
319
320Page 1:
321If the Physical Layer is functioning correctly and communication is still not occurring between end devices, check the VLAN configuration.
322
323If the non-functioning ports are in the same VLAN, the hosts must have IP addresses on the same network or subnet in order to communicate. If the non-functioning ports are in different VLANs, communication is only possible with the aid of a Layer 3 device, such as a router. If information is required on a specific VLAN, use the following command show vlan id vlan_number to display the ports assigned to each VLAN.
324
325If inter-VLAN routing is required, verify the following configurations:
326
327One port from each VLAN connects into a router interface or subinterface.
328Both the switch port and the router interface are configured with trunking.
329Both the switch and router interface are configured with the same encapsulation.
330
331Newer switches default to 802.1Q, but some Cisco switches support both 802.1Q and Cisco proprietary Inter-Switch Link (ISL) format. IEEE 802.1Q should be used whenever possible, because it is the de facto standard and 802.1Q and ISL are not compatible.
332
333
334
335
336Page 2:
337When troubleshooting inter-VLAN issues, ensure that there is no IP address on the physical interface of the router. The interface must be active.
338
339To verify the interface configuration, use:
340
341show ip interface brief
342
343The network associated with each VLAN should be visible in the routing table. If not, recheck all physical connections and trunk configuration on both ends of the link. If it is not directly connected to the VLAN subnets, check the configuration of the routing protocol to verify that there is a route to each of the VLANs. Use the command:
344
345show ip route
346
347
348
349
350Page 3:
351Access or Trunk Port
352
353Each switch port is either an access port or a trunk port. On some switch models, other switch port modes are available and the switch automatically configures the port to the appropriate status. It is sometimes advisable to lock the port into either access or trunk status to avoid potential problems with this detection process.
354
355Native and Management VLANs
356
357The native VLAN and management VLAN are VLAN1 by default. Untagged frames sent across a trunk are assigned to the native VLAN of the trunk line. If the native VLAN assignment is changed on a device, each end of the 802.1Q trunk should be configured with the same native VLAN number. If one end of the trunk is configured for native VLAN10 and the other end is configured for native VLAN14, a frame sent from VLAN10 on one side is received on VLAN14 on the other. VLAN10 "leaks" into VLAN14. This can create unexpected connectivity issues and increase latency.
358
359For smoother, quicker transitions, verify that the native VLAN assignment is the same on all devices throughout the network.
360
361
362
363
364Page 4:
365Packet Tracer Activity
366
367Troubleshoot inter-VLAN routing issues.
368
369Click the Packet Tracer icon to begin.
370
371
372
373
3749.2.3 Troubleshooting VTP
375
376Page 1:
377VTP simplifies the distribution of VLAN information to multiple switches in a domain. Switches that participate in VTP operate in one of three modes: server, client, or transparent. Only the server adds, deletes, and modifies VLAN information.
378
379When troubleshooting VTP on a network, ensure that:
380
381All participating devices have the same VTP domain name.
382Two VTP servers exist in every domain, in case one fails.
383All servers have the same information.
384The revision numbers are the same on all devices.
385All devices use the same VTP version.
386
387To display the VTP version in use on a device, the VTP domain name, the VTP mode, and the VTP revision number, issue the command:
388
389show vtp status
390
391To modify the VTP version number, use:
392
393vtp version <1 | 2>
394
395
396
397
398Page 2:
399VTP clients and servers use the VTP revision number to decide if they should update their VLAN information. If the revision number of the update is higher than the revision number currently in use, the client and server use the information to update the configuration.
400
401Always check the VTP revision information and mode on any switch before allowing it to join the network. The revision number is stored in NVRAM and erasing the start-up configuration on the switch does not reset this value. To reset the revision number, either set the switch mode to transparent or change the VTP domain name.
402
403It is also a problem if a rogue switch joins the domain and modifies VLAN information. To prevent this situation, it is important to configure a password on the VTP domain. To set a VTP password for the domain, use the global configuration command:
404
405vtp password password
406
407When configured, the authentication password must be the same on all devices in the VTP domain. If updates are not propagating to a new switch in the VTP domain, suspect the password. To verify the password, use the command:
408
409show vtp password
410
411
412
413
414Page 3:
415Packet Tracer Activity
416
417Troubleshoot and correct VTP Issues.
418
419Click the Packet Tracer icon to begin.
420
421
422
423
4249.3 Troubleshooting Routing Issues
4259.3.1 RIP Issues
426
427Page 1:
428Many tools exist for troubleshooting routing issues. These include IOS show commands, debug commands and TCP/IP utilities such as ping, traceroute and telnet.
429
430The show commands display a snapshot of a configuration or of a particular component. The debug commands are dynamic and provide real-time information on traffic movement and the interaction of protocols. Use TCP/IP utilities such as ping for verifying connectivity.
431
432The show commands are important tools for understanding the status of a router, detecting neighboring routers, isolating problems in the network, and monitoring the network in general. Use a combination of show commands and debug commands to troubleshoot RIP routing protocol issues.
433
434Before using the debug command, narrow the problems to a likely subset of causes. Use debug commands to isolate problems, not to monitor normal network operation.
435
436
437
438
439Page 2:
440RIP is a fairly basic and simple protocol to configure. However, some common issues can arise when configuring RIP routers.
441
442Compatibility issues exist between RIPv1 and RIPv2. If the RIP routes are not being advertised, check for the following problems:
443
444Layer 1 or Layer 2 connectivity issues
445Requirements for VLSM subnetting but using RIPv1
446RIPv1 and RIPv2 routing configurations mismatched
447Network statements missing or incorrect
448Interface IP addressing incorrect
449Outgoing interface is down
450Advertised network interface is down
451Passive interface misconfigurations
452
453When testing with the show ip route command, it is a good idea to clear the routing tables using the clear ip route * command.
454
455In addition to the issues identified here, it is always important is remember that RIP has a hop count limit of 15 hops. This limitation alone can be a problem in a large enterprise network.
456
457
458
459
460Page 3:
461Packet Tracer Activity
462
463Troubleshoot RIP using show and debug commands.
464
465Click the Packet Tracer icon to begin.
466
467
468
469
470Page 4:
471Lab Activity
472
473Troubleshoot RIPv2 routing issues.
474
475Click the lab icon to begin.
476
477
478
479
4809.3.2 EIGRP Issues
481
482Page 1:
483A number of IOS show commands and debug commands are the same for troubleshooting EIGRP routing issues as they are for RIP. Commands specific to troubleshooting EIGRP include:
484
485show ip eigrp neighbors
486
487Displays neighbor IP addresses and the interface on which they were learned.
488
489show ip eigrp topology
490
491Displays the topology table of known networks with successor routes, status codes, feasible distance, and interface.
492
493show ip eigrp traffic
494
495Displays EIGRP traffic statistics for the AS configured, including hello packets sent/received, updates, and so on.
496
497debug eigrp packets
498
499Displays real-time EIGRP packet exchanges between neighbors.
500
501debug ip eigrp
502
503Displays real-time EIGRP events, such as link status changes and routing table updates.
504
505
506
507
508Page 2:
509Certain issues commonly occur when configuring the EIGRP protocol. Possible reasons why EIGRP may not be working are:
510
511Layer 1 or Layer 2 connectivity issues exist.
512An interface has incorrect addressing or subnet mask.
513AS numbers on EIGRP routers are mismatched.
514The wrong network or incorrect wildcard mask is specified in the routing process.
515The link may be congested or down.
516The outgoing interface is down.
517The interface for an advertised network is down.
518
519If auto-summarization is enabled on routers with discontiguous subnets, routes may not be advertised correctly.
520
521
522
523
524Page 3:
525Packet Tracer Activity
526Troubleshoot common EIGRP issues using show and debug commands.
527
528Click the Packet Tracer icon to begin.
529
530
531
532
5339.3.3 OSPF Issues
534
535Page 1:
536The majority of problems encountered with OSPF relate to the formation of adjacencies and the synchronization of the link-state databases.
537
538OSPF Troubleshooting Issues
539
540Neighbors must be part of the same OSPF area.
541Interfaces for neighbors must have compatible IP addresses and subnet masks.
542Routers in an area should have the same OSPF hello interval and dead interval.
543The routers must advertise the correct networks for interfaces to participate in the OSPF process.
544The appropriate wildcard masks must be used to advertise the correct IP address ranges.
545Authentication must be correctly configured on routers for communication to occur.
546
547In addition to the standard show and debug commands, the following commands assist troubleshooting OSPF issues:
548
549show ip ospf
550show ip ospf neighbor
551show ip ospf interface
552debug ip ospf events
553debug ip ospf packet
554
555
556
557
558Page 2:
559
560
561
562
563Page 3:
564Lab Activity
565
566Troubleshoot OSPF routing issues.
567
568Click the lab icon to begin.
569
570
571
572
5739.3.4 Route Redistribution Issues
574
575Page 1:
576Configuring a static default route on an edge router provides a gateway of last resort for packets destined for IP addresses outside the network.
577
578Although this configuration provides a solution for the edge router, it does not provide a way out of the internal network for other internal routers. One solution is to configure a default route on each internal router that points to the next hop or edge router. However, this method does not scale well with large networks. A better solution uses the routing protocol to propagate the default route on the edge router to other internal routers. All routing protocols, including RIP, EIGRP and OSPF, provide mechanisms to accomplish this.
579
580With each routing protocol, configure a default quad 0 static route on the edge router.
581
582ip route 0.0.0.0 0.0.0.0 S0/0/0
583
584Next, configure the edge router to send or propagate its default route to the other routers. With RIP and OSPF, enter router configuration mode and use the command default-information originate. EIGRP redistributes default routes directly; the redistribute static command can also be used.
585
586Failure to properly implement default route redistribution prevents users that are connected to internal routers from accessing external networks.
587
588
589
590
591Page 2:
592Lab Activity
593Troubleshoot default route redistribution with EIGRP.
594
595Click the lab icon to begin.
596
597
598
599
600Page 3:
601Lab Activity
602Troubleshoot OSPF router configurations to determine why a default route is not being redistributed.
603
604Click the lab icon to begin.
605
606
607No transcript is available for this item.
608
609
6109.4 Troubleshooting WAN Configurations
6119.4.1 Troubleshooting WAN Connectivity
612
613Page 1:
614When configuring WAN interfaces, a number of potential problem areas can surface. Some of these problems are unavoidable if the network administrator only has control over one end of the link and the ISP controls the other end. In this case, the network administrator uses the configuration information provided by the ISP to ensure connectivity.
615
616At the Physical Layer, the most common problems involve clocking, cable types, and loose or faulty connectors. Serial line connections link a DCE device to a DTE device. Two different types of cables exist for connecting devices: DTE and DCE. Usually the DCE device at the service provider provides that clocking signal.
617
618Visually check each cable for loose connections or faulty connectors. If a cable cannot be correctly connected, swap the current cable with one known to work.
619
620To display the type of cable and the detection and status of DTE, DCE, and clocking, use the following command:
621
622show controllers <serial_port>
623
624
6259.4.1 - Troubleshooting WAN Connectivity
626The diagram depicts the DCE router, R1, connected to the D T E router, R2. The show controllers command is issued on R1. The following line is highlighted in the show command output: 
627
628R1# show controllers s0/0/1 
629DCE V.35, clock rate 56000 
630
631The show controllers command is issued on R2. The following line is highlighted in the show command output: 
632
633R2# show controllers s0/0/1 
634D T E V.35 TX and RX clocks detected 
635
636
637Page 2:
638For a serial link to come up, the encapsulation format on both ends of the link must match. The default serial line encapsulation used on Cisco routers is HDLC. Since Cisco HDLC and open standard HDLC are not compatible, do not use the Cisco default encapsulation when connecting to a non-Cisco device.
639
640Some Layer 2 encapsulations have more than one form. For example, Cisco routers support both the proprietary Cisco Frame Relay format as well as the industry-standard IETF format. These formats are not compatible. The default format on Cisco devices is Cisco Frame Relay format.
641
642To see the encapsulation in use on a serial line, use the command:
643
644show interfaces <serial_port>
645
646Layer 3 configurations can also prevent data from moving across a serial link. Although it is not necessary to use an IP address on a serial link, if one is used, both ends of the link must be on the same network or subnet.
647
648
6499.4.1 - Troubleshooting WAN Connectivity
650The diagram depicts the DCE router, R1, connected to the DTE router, R2. The show interfaces command is issued on R1 The following line is highlighted in the show interfaces output. 
651
652R1# show interfaces s0/0/1 
653Encapsulation PPP 
654
655The show interfaces command is issued on R2. The following line is highlighted in the show interfaces output. 
656
657R2# show interfaces s0/0/1 
658Encapsulation PPP 
659
660
661Page 3:
662A process known as serial line address resolution protocol (SLARP) assigns an address to the end point of a serial link if the other end is already configured. SLARP assumes that each serial line is a separate IP subnet, and that one end of the line is host number 1 and the other end is host number 2. As long as one end of the serial link is configured, SLARP automatically configures an IP address for the other end.
663
664The IP address configured on an interface and the status of the port and line protocol is viewable with the command:
665
666show ip interface brief
667
668Before Layer 3 information moves across the link, both the interface and the protocol must be up. If the interface is down, there is a problem with the interface itself.
669
670If the interface is up but the line protocol is down, check that the proper cable is connected and is firmly attached to the port. If this step still does not correct the problem, replace the cable.
671
672If the status of an interface is administratively down, the most probable cause is that the no shutdown command was not entered on the interface. Interfaces are shutdown by default.
673
674
6759.4.1 - Troubleshooting WAN Connectivity
676The diagram depicts the output when troubleshooting a WAN topology. 
677
678Network Topology 
679Switch, S1, is connected to switch, S2. S2 is connected to the F A 0 /0 of router, R1. R1 connects to the WAN cloud via its S0/0/1 port. The following is the output the show IP interface brief command. 
680
681R1 # show IP interface brief 
682InterfaceIP-AddressOK?MethodStatusProtocol 
683FastEthernet0/0unassignedYesmanualupup 
684FastEthernet0/0.10010.2 0.100.1Yesmanualupup 
685FastEthernet0/0.10110.20.101.1Yesmanualupup 
686FastEthernet0/0.10210.20.102.1Yesmanualupup 
687FastEthernet0/0.10310.20.103.1Yesmanualupup 
688Serial0/0/0unassignedYESmanualupup 
689FastEthernet0/1unassignedYESunset administrativelydowndown 
690Serial0/0/110.20.30.1YESmanualupup 
691
692
693Page 4:
694The PPP process involves both the LCP and NCP phases. LCP establishes the link and verifies that it is of sufficient quality to bring up the Layer 3 protocols. NCP allows Layer 3 traffic to move across the link. There is an optional authentication field between the LCP and NCP phases.
695
696Each phase has to complete successfully before the other begins.
697
698When troubleshooting PPP connectivity, verify that:
699
700LCP phase is complete
701Authentication has passed, if configured
702NCP phase is complete
703
704Commands are available that assist in troubleshooting PPP. To show the status of the LCP and NCP phase, use:
705
706show interface
707
708To display PPP packets transmitted during the startup phase where PPP options are negotiated, use:
709
710debug ppp negotiation
711
712To display real-time PPP packet flow, use:
713
714debug ppp packet
715
716
7179.4.1 - Troubleshooting WAN Connectivity
718The diagram depicts the output for router, R1, when R1 is connected to router, R2, via a serial connection, and the following commands are used: show interfaces s/0/0/1, debug ppp negotiation, and debug ppp packet. 
719
720The following is the show interfaces s0/0/1 command output: 
721R1 # show interfaces s0/0/1 
722Encapsulation PPP 
723LCP Open 
724Open: IPCP, CDPCP 
725
726The following is the debug ppp negotiation command output: 
727R1 # debug ppp negotiation 
7281d05h: S e0/0/1 LCP: AuthProto CHAP (0x0305c22305) 
7291d05h: S e0/0/1 LCP: Lower layer not up, Fast Starting 
7301d05h: S e0/0/1 PPP: Treating connection as dedicated line 
7311d05h: S e0/0/1 PPP: Phase is ESTABLISHING, Active Open 
7321d05h: S e0/0/1 LCP: AuthProto CHAP (0x0305c22305) 
7331d05h: S e0/0/1 LCP: State is Open 
7341d05h: S e0/0/1 PPP: Phase is AUTHENTICATING, by both 
7351d05h: S e0/0/1 CHAP: O CHALLENGE id 146 len 28 from "R1" 
7361d05h: S e0/0/1 CHAP: I CHALLENGE id 148 len 27 from "R2" 
7371d05h: S e0/0/1 CHAP: Using hostname from configured hostname 
7381d05h: S e0/0/1 CHAP: O CHALLENGE id 146 len 28 from "R1" 
7391d05h: S e0/0/1 CHAP: Using password from AAA 
7401d05h: S e0/0/1 CHAP: O RESPONSE id 146 len 28 from "R1" 
7411d05h: S e0/0/1 CHAP: I RESPONSE id 148 len 27 from "R2" 
7421d05h: S e0/0/1 PPP: Phase is AUTHENTICATING, Unauthenticated User 
7431d05h: S e0/0/1 CHAP: I SUCCESS id 148 len 4 
7441d05h: S e0/0/1 PPP: Phase is AUTHENTICATING, Authenticated User 
7451d05h: S e0/0/1 CHAP: O SUCCESS id 146 4 
7461d05h: S e0/0/1 PPP: Phase is UP 
7471d05h: S e0/0/1 IPCP: State is Open 
7481d05h: S e0/0/1 CDCP: State is Open 
7491d05h: %LINEPRONTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to up 
750
751The following is the debug ppp packet command output: 
752R1 #debug ppp packet 
753PPP packet diplay debugging is on 
754R1 # 
7551d05h: S e0/0/1 LCP: O ECHO-REQ [Open] i d 1 l e n 12 magic 0x136F1E39 
7561d05h: S e0/0/1 PPP: I pkt type 0xC021, datagramsize 16 
7571d05h: S e0/0/1 LCP: I ECHO-REQ [Open] i d 1 l e n 12 magic 0x13663C01 
7581d05h: S e0/0/1 LCP: Received is 1, sent id 1, line up 
7591d05h: S e0/0/1 PPP: I pkt type 0xC021, datagramsize 16 
7601d05h: S e0/0/1 LCP: I ECHO-REQ [Open] i d 1 l e n 12 magic 0x13663C01 
7611d05h: S e0/0/1 LCP: O ECHO-REQ [Open] i d 1 l e n 12 magic 0x136F1E39 
7621d05h: S e0/0/1 PPP: 0 pkt type 0x0021, datagramsize 116 
7631d05h: S e0/0/1 LCP: O ECHO-REQ [Open] i d 2 l e n 12 magic 0x136F1E39 
7641d05h: S e0/0/1 PPP: I pkt type 0xC021, datagramsize 16 
7651d05h: S e0/0/1 LCP: I ECHO-REQ [Open] i d 2 l e n 12 magic 0x13663C01 
7661d05h: S e0/0/1 LCP: Received id 2, sent id 2, line up 
7671d05h: S e0/0/1 PPP: I pkt type 0xC021, datagramsize 16 
7681d05h: S e0/0/1 LCP: I ECHO-REQ [Open] i d 2 l e n 12 magic 0x13663C01 
7691d05h: S e0/0/1 LCP: O ECHO-REQ [Open] i d 2 l e n 12 magic 0x136F1E39 
7701d05h: S e0/0/1 LCP: O ECHO-REQ [Open] i d 3 l e n 12 magic 0x136F1E39 
7711d05h: S e0/0/1 PPP: I pkt type 0xC021, datagramsize 16 
7721d05h: S e0/0/1 LCP: I ECHO-REQ [Open] i d 3 l e n 12 magic 0x13663C01 
7731d05h: S e0/0/1 LCP: Received I d 3, sent I d 3, line up 
7741d05h: S e0/0/1 PPP: I pkt type 0xC021, datagramsize 16 
7751d05h: S e0/0/1 LCP: I ECHO-REQ [Open] i d 3 l e n 12 magic 0x13663C01 
7761d05h: S e0/0/1 LCP: O ECHO-REQ [Open] i d 3 l e n 12 magic 0x136F1E39 
777
778
779Page 5:
780Packet Tracer Activity
781
782Troubleshoot WAN connectivity issues.
783
784Click the Packet Tracer icon to begin.
785
786
7879.4.1 - Troubleshooting WAN Connectivity
788Link to Packet Tracer Exploration: Troubleshooting WAN Connectivity 
789
790Troubleshoot WAN connectivity issues. 
791
792
7939.4.2 Troubleshooting WAN Authentication
794
795Page 1:
796PPP offers many advantages over the default HDLC serial line encapsulation. Among these features is the ability to use either PAP or CHAP to authenticate end devices. Authentication occurs as an optional phase after the establishment of the link with LCP but before the NCPs allow the movement of Layer 3 traffic.
797
798If the LCP is not able to connect, negotiation of the optional parameters, including authentication, cannot occur. The absence of active NCPs indicates a failed authentication.
799
800When troubleshooting PPP authentication, determine if authentication is the problem by examining the status of the LCP and NCPs using the show interface command.
801
802If both the LCP and NCPs are open, authentication has been successful and the problem is elsewhere.
803
804If the LCP is not open, the problem exists with the physical link between the source and destination.
805
806If the LCP is open and the NCPs are not, authentication is suspect.
807
808
8099.4.2 - Troubleshooting WAN Authentication
810The diagram depicts the four steps used when debugging PPP. A man is on a host computer, that is connected to a simple two router network. The host is connected to R1. R1 is connected to R2 via a serial link. 
811
812The man thinks, "I cannot connect to R2." 
813
814Step 1. 
815Identify the problem. 
816Step 2. 
817Use the debug ppp negotiation command. 
818Step 3. 
819Use the debug ppp negotiation command. 
820Step 4. 
821Once the problem has been identified implement a solution. 
822
823The man thinks, "I see the error, I will change the R2 to CHAP and try again." 
824
825
826Page 2:
827Authentication can be either one-way or two-way. For enhanced security, use two-way or mutual authentication. Two-way authentication requires that each end device authenticate to the other.
828
829On both ends of the link, verify that a user account exists for the remote device and that the password is correct. If uncertain, remove the old user account statement and recreate it. The configuration on both ends of the link must specify the same type of authentication.
830
831The most common problem with authentication is either forgetting to configure an account for the remote router or misconfiguring the username and password. By default, the username is the name of the remote router. Both the username and the password are case-sensitive.
832
833If using PAP authentication on a current version of the IOS, activate it with the command:
834
835ppp pap sent-username username password password
836
837Debugging the authentication process provides a quick method of determining what is wrong. To display packets involved in the authentication process as they are exchanged between end devices, use the command:
838
839debug ppp authentication
840
841
8429.4.2 - Troubleshooting WAN Authentication
843The diagram depicts the output of the debug ppp authentication command when the following conditions occur: proper configuration, no user account, and wrong password. Router, R1, is connected via a serial connection to router, R2. 
844
845Proper Configuration 
84603:03:35: S e0/0/1 PPP: Received LOGIN Response from AAA = PASS 
84703:03:36: %LINEPRONTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changes state to up 
848
849No User Account 
85003:21:43: S E0/0/1 CHAP: Unable to authenticate for peer 
851
852Wrong Password 
85303:17:47: S E0/0/1 PPP: Received LOGIN Response from AAA = FAIL 
854
855
856Page 3:
857Packet Tracer Activity
858
859Troubleshoot PPP authentication using CHAP.
860
861Click the Packet Tracer icon to begin.
862
863
8649.4.2 - Troubleshooting WAN Authentication
865Link to Packet Tracer Exploration: Troubleshooting PPP Authentication Using CHAP 
866
867Troubleshoot PPP authentication using CHAP. 
868
869
870Page 4:
871Lab Activity
872
873Troubleshoot WAN and PPP connectivity.
874
875Click the lab icon to begin.
876
877
8789.4.2 - Troubleshooting WAN Authentication
879Link to Hands-on Lab: Troubleshooting WAN and PPP Connectivity 
880
881Troubleshoot WAN and PPP connectivity. 
882
883
8849.5 Troubleshooting ACL Issues
8859.5.1 Determining if an ACL is the Issue
886
887Page 1:
888ACLs add a level of complexity to troubleshooting network issues. Therefore, it is important to verify basic network connectivity before applying an ACL.
889
890When networks or hosts become unreachable and ACLs are in use, it is critical to determine if the ACL is the problem. Ask the following questions to help to isolate the problem:
891
892Is an ACL applied to the problem router or interface?
893Has it been applied recently?
894Did the issue exist before the ACL was applied?
895Is the ACL performing as expected?
896Is the problem with all hosts connected to the interface or only specific hosts?
897Is the problem with all protocols being forwarded or only specific protocols?
898Are the networks appearing in the routing table as expected?
899
900One way to determine the answer to several of these questions is to enable logging. Logging shows the effect that ACLs are having on various packets. By default, the number of matches display with the show access-list command.
901
902To display details about packets permitted or denied, add the log keyword to the end of ACL statements.
903
904
9059.5.1 - Determining if an ACL is the Issue
906The diagram depicts the output when examining an ACL on a network. 
907
908Network Topology 
909Two hosts with the following IP addresses, 192.168.1.2 and 192.168.1.3 are on the 192.168.1.0 /24 network. A switch is connected to the R1 F A 0 /0. This interface has an ACL applied (ACL 123 inbound). Router, R1, S0/0/0 is connected to the S0/0/0 of router, R2, with a of network address 172.20.0.1 /30. The R2 F A 0 /0 is connected to another switch with a network address of 192.168.2.0 /24. A server is connected to the switch with an IP address of 192.168.2.2. The configuration commands for placing the ACL are listed below. 
910
911Output 
912R1 (config)# access-list 123 deny tcp host 192.168.1.2 host 192.168.2.2 eq 23 log 
913R1 (config)# access-list 123 permit IP 192.168.1.0 0.0.0.255 any log 
914R1 (config)# access-list 123 deny IP any any log 
915R1 (config)# int FA0/0 
916R1 (config-if)# IP access-group 123 In 
917
918ACL Console Logging 
919*Sep 12:34:35:54.067: *SEC - 6 -IPACCESSLOGP: list 123 denied tcp 192.168.1.2(1141) 192.168.2.2(23), 1 packet 
920R1# 
921*Sep 12:34:35:54.067: *SEC - 6 -IPACCESSLOGP: list 123 permitted icmp 192.168.1.3 192.168.2.2 (8 /0), 1 packet 
922
923
924Page 2:
925A number of commands help to determine if ACLs are configured and applied correctly.
926
927To display all ACLs configured on the router, whether applied to an interface or not, use the following command:
928
929show access-lists
930
931To clear the number of matches for each ACL statement, use:
932
933clear access-list counters
934
935To display the source and destination IP address for each packet received or sent by any interface on the router, use:
936
937debug ip packet
938
939The debug ip packet command shows packets whose source or destination is a router interface. This command includes packets that are denied by an ACL at the interface. Examples of traffic that create a debug message include:
940
941RIP updates to or from a router interface
942Telnet from an external source to an external destination blocked by an ACL on the interface
943
944If the packets are simply passing through and the ACL does not block a packet from this IP address, no debug message is generated.
945
946
9479.5.1 - Determining if an ACL is the Issue
948The diagram depicts the output when examining an ACL on a network. The following commands are used: R1# show running-config, R1# debug IP packet, R1# show IP interface, and R1# show access-lists. 
949
950Network Topology 
951Two hosts are connected to a switch. The two hosts have the IP addresses 192.168.1.2 and 192.168.1.3, and are part of the 192.168.1.0 /24 network. A switch is connected to the router, R1 F A 0 /0. This interface has an ACL applied (ACL 123 inbound). R1 S0/0/0 is connected to the S0/0/0 of router, R2, with a network address of 172.20.0.1 /30. R2 F A 0 /0 is connected to another switch on the 192.168.2.0 /24 network. A server is connected to the switch with an IP address of 192.168.2.2. 
952
953Output 
954R1 # show running-config 
955IP address 192.168.1.1 255.255.255.0 
956IP access-group 123 in 
957[output omitted] 
958access-list 123 deny tcp host 192.168.1.2. host 192.168.2.2 eq telnet 
959access-list 123 permit IP 192.168.1.0 0.0.0.255 any 
960
961R1 # debug IP packet 
962*Sep 19 ...omitted... IP: s=192.168.1.2(fastethernet0/0), d=192.168.2.2, len 48, access denied 
963
964R1 # show IP interface 
965Outgoing access list is not set 
966Inbound access list is 123 
967
968R1 # show access-lists 
969Extended IP access list 123 
97010 deny host 192.168.1.2 host 192.168.2.2 eq telnet (9 matches) 
97120 permit IP 192.168.1.0 0.0.0.255 any (24 matches) 
97230 deny IP any any (3 matches) 
973
974
975Page 3:
976
977
9789.5.1 - Determining if an ACL is the Issue
979The diagram depicts an activity in which you must analyze the network topology and router command output. Indicate whether the statements regarding ACL's and their effects are True or False. 
980
981Network Topology 
982The diagram depicts two hosts connected to a switch. The two hosts have the IP addresses 192.168.1.2 and 192.168.1.3, and are part of the 192.168.1.0 /24 network. The switch is connected to the router, R1, via F A 0 /0. This interface has an ACL applied (ACL 123 inbound). R1 S0/0/0 is connected to router, R2, with a network address of 172.20.0.1 /30. R2 F A 0 /0 is connected to another switch on the 192.168.2.0 /24 network. A server is connected to the switch with an IP address of 192.168.2.2. 
983
984Scenario 1 
985The following is the router output for the command show running-config. 
986
987R1# show running-config 
988Building Configuration... 
989(**output omitted**) 
990
991hostname R1 
992
993interface Fast Ethernet 0 /0 
994description LAN gateway for 192.168.1.0 net 
995IP address 192.168.1.1 255.255.255.0 
996IP access-group 123 in 
997duplex auto 
998speed auto 
999
1000interface FastEthernet 0 /1 
1001no IP address 
1002shutdown 
1003duplex auto 
1004speed auto 
1005
1006interface Serial0/0/0 
1007description WAN link to R2 
1008IP address 172.20.1.1 255.255.255.252 
1009no fair-queue 
1010
1011interface Serial0/0/1 
1012no IP address 
1013shutdown 
1014
1015router rip 
1016version 2 
1017passive-interface FastEthernet 0/0 
1018network 172.20.0.0 
1019network 192.168.1.0 
1020no auto-summary 
1021
1022access-list 123 permit tcp host 192.168.1.2 any eq telnet 
1023access-list 123 permit tcp host 192.168.1.2 any range ftp-data ftp 
1024access-list 123 deny tcp any any eq telnet 
1025access-list 123 tcp any any range ftp-data ftp 
1026access-list 123 permit IP 192.168.1.0 0.0.0.255 any 
1027access-list 123 deny IP any any 
1028
1029Determine if the statements below are True or False. 
1030One.This router is configured with a standard ACL. 
1031Two.If a telnet packet from 192.168.1.5 enters F A 0 /0 it will be permitted. 
1032Three.Host 192.168.1.2 is permitted to transfer files to and from any FTP server. 
1033Four.This ACL is applied to F A 0 /0 inbound. 
1034Five.If an HTTP packet from a host on network 192.168.1.0 is received on F A 0 /0 inbound it will permitted. 
1035
1036Scenario 2 
1037
1038The following is the router output for the command show access-list. 
1039R1 # show access-list 
1040Extended IP access-list 123 
1041permit tcp host 192.168.1.2 any eq telnet (24 matches) 
1042permit tcp host 192.168.1.2 any range ftp-data ftp 
1043deny tcp any any eq telnet (8 matches) 
1044deny tcp any any range ftp-data ftp (12 matches) 
1045permit IP 192.168.1.0 0.0.0.255 any (250 matches) 
1046deny IP any any (22 matches) 
1047
1048Determine if the statements below are True or False. 
1049One.This router ACL allows an administrator PC (192.168.1.2) to Telnet and FTP to any location. 
1050Two.The administrator has been using FTP extensively. 
1051Three.PC's other than 192.168.1.2 on the 192.168.1.0 network have attempted to telnet to other networks. 
1052Four.This ACL prevents transferring a file using using FTP from PC 192.168.1.3 to PC 192.168.1.5 
1053Five.Most hosts have used IP protocols other than FTP and Telnet (e.g. HTTP) to connect to other networks. 
1054
1055Scenario 3 
1056The following is the router output for the command debug IP packet. 
1057
1058R1# debug IP packet 
1059IP packet debugging is on 
1060R1# 
1061*Sep 19 17:09:25.555: IP: s=192.168.1.3 (FastEthernet 0 /0),d=192.168.2.2, len 48, access denied 
1062*Sep 19 17:09:26.555: IP: tableid=0, s=192.168.1.1 (local),d=192.168.1.3 (FastEthernet 0 /0) routed via FIB 
1063*Sep 19 17:11:34:555: IP: s=172.20.1.2 (Serial 0/0/0), 
1064d= 224.0.0.9, len 52, recvd 2 
1065*Sep 19 17:11:45.119: IP: s=172.20.1.1 (local), d=224.0.0.9 
1066(Serial0/0/0), len 52, sending broadcast/multicast 
1067R1# 
1068*Sep 19 17:09:25.555: IP: s=192.168.1.5 (FastEthernet 0/0),d=192.168.2.2, len 48, access denied 
1069*Sep 19 17:09:26.555: IP: tableid=0, s=192.168.1.1 (local, d=192.168.1.5 (FastEthernet 0 /0) routed via FIB 
1070
1071Determine if the statements below are True or False. 
1072One.All packets from host 192.168.1.5 have been permitted by this router and ACL. 
1073Two.This router is running only the EIGRP routing protocol. 
1074Three.Packets from host 192.168.1.3 may be permitted by this router and ACL depending on the protocol they are using. 
1075Four.Routing updates to multicast addresses 224.0.0.9 are being blocked by the ACL on this router. 
1076Five.The IP address of the S0/0/0 interface on this router is 172.20.1.2 
1077
1078
1079Page 4:
1080Packet Tracer Activity
1081
1082Troubleshoot ACL issues using show and debug commands.
1083
1084Click the Packet Tracer icon to begin.
1085
1086
10879.5.1 - Determining if an ACL is the Issue
1088Link to Packet Tracer Exploration: Troubleshooting ACL Issues 
1089
1090Troubleshoot ACL issues using show and debug commands. 
1091
1092
10939.5.2 ACL Configuration and Placement Issues
1094
1095Page 1:
1096Issues such as slow performance and unreachable network resources result from an incorrectly configured ACL. In some cases, the ACL may permit or deny the intended traffic but can also have unintended effects on other traffic. If it appears that the ACL is the problem, there are several issues to check.
1097
1098If the ACL statements are not in the most efficient order to permit the highest volume traffic early in the ACL, check the logging results to determine a more efficient order.
1099
1100The implicit deny may be having unintended effects on other traffic. If so, use an explicit deny ip any any log command so that packets that do not match any of the previous ACL statements can be monitored.
1101
1102Use logging to determine if the ACL is optimized or working as expected.
1103
1104
11059.5.2 - ACL Configuration and Placement
1106The diagram depicts output when using the following commands: R1# show IP route, R1# debug IP rip, R2# show IP route, R2# (console logging on), R2# debug IP rip, R2# show access-lists, and R2# show IP interface s0/0/0. 
1107
1108Network Topology 
1109Two hosts are directly connected to a switch. The two hosts have the IP addresses 192.168.1.2 and 192.168.1.3, and are part of the 192.168.1.0 /24 network. The switch is connected to the router, R1. R1 S0/0/0 is connected to router, R2, S0/0/0, and are part of the 172.20.1.0 /30 network. An ACL (123) has been placed on the serial interface S0/0/0 inbound on R2. R2 F A 0 /0 is connected to another switch, 192.168.2.0 /24. A server is connected to the switch with an IP address of 192.168.2.2. 
1110
1111Only sections of each command are shown below. All other output from the commands is omitted. Complete outputs may be seen in the Hands-on Labs or Packet Tracer Activities. 
1112
1113R1 # show IP route 
1114R 192.168.2.0 /24 [120 /1] via 172.20.1.2, 00:00:06, Serial 0/0/0 
1115
1116R1 # debug IP rip 
1117*Sep 19 21:12:59622: RIP: received v2 update from 172.20.1.2 on Serial0/0/0 
1118*Sep 19 21:12:59622: 192.168.2.0 /24 via 0.0.0.0. in 1 hops 
1119*Sep 19 21:12:59622: RIP: sending v2 update to 224.0.0.9 via Serial0/0/0 (172.20.1.1) 
1120
1121R2 # show IP route 
1122(No output is highlighted here for this command.) 
1123
1124R2 # (console logging on) 
1125*Sep 19 20:21:28.139: %SEC-6 IP ACCESS LOG N P: list 1 denied 0 172.20.1.1 -> 224.0.0.9 
1126
1127R2 # debug IP rip 
1128(No output is highlighted here for this command.) 
1129
1130R2 # show access-lists 
113120 deny any (matches) 
1132
1133R2 # show IP interface s0/0/0 
1134Outgoing access list is not set 
1135Inbound access list is 1 
1136
1137
1138Page 2:
1139In addition to determining whether the ACL is correctly configured, it is also important to apply the ACL to the right router or interface, and in the appropriate direction. A correctly configured ACL that is incorrectly applied is one of the most common errors when creating ACLs.
1140
1141Standard ACLs filter only on the source IP address; therefore, place them as close to the destination as possible.
1142
1143Placing a Standard ACL close to the source may unintentionally block traffic to networks that should be allowed.
1144
1145Placing the ACL close to the destination unfortunately allows traffic to flow across one or more network segments prior to being denied. This is a waste of valuable bandwidth.
1146
1147Using an Extended ACL resolves both of these issues.
1148
1149Packets destined for networks other than the one being blocked are unaffected. The routers along the potential path never see the denied packets, which helps to conserve bandwidth.
1150
1151
11529.5.2 - ACL Configuration and Placement
1153This diagram compares the use of a standard ACL with an extended ACL to prevent network 192.168.1.0 traffic from entering the 192.168.4.0 network. Traffic should be allowed to reach all other networks. 
1154
1155Network Topology 
1156The diagram depicts four routers, R1, R2, R3, and R4, connected by serial links to each other. On R1 there is an extended ACL placed on F A 0 /0 which connects network 192.168.1.0 /24 to R1.
1157
1158The extended ACL information appears as follows: 
1159
1160Extended ACL 
1161Place closest to source 
1162Denies traffic from 192.168.1.0 network from reaching 192.168.4.0 
1163Allows it to reach other networks and saves bandwidth 
1164
1165ACL commands 
1166access-list 101 deny ip 192.168.1.0 
11670.0.0.255 192.168.4.0 0.0.0.255 
1168access-list 101 permit ip any any 
1169
1170Network Topology Continued 
1171R2 is connected to network 192.168.2.0 /24 and is also connected to R4. Router R3 connects to both R1 and R4. R3 is connected to network 192.168.3.0 /24. Router R4 has its FastEthernet F A 0 /0 O U T in use and connected to network 192.168.4.0 /24. There is a Standard ACL placed between the 192.168.4.0 /24 network and the interface. 
1172
1173The Standard ACL information is as follows: 
1174
1175Standard ACL 
1176Place closest to the destination 
1177Denies 192.168.1.0 traffic to 192.168.4.0 
1178Wastes bandwidth 
1179
1180ACL commands 
1181access-list 1 deny 192.168.1.0 0.0.0.255 
1182access-list 1 permit any 
1183
1184
1185Page 3:
1186Packet Tracer Activity
1187
1188Troubleshoot the placement and direction of an ACL.
1189
1190Click the Packet Tracer icon to begin.
1191
1192
11939.5.2 - ACL Configuration and Placement
1194Link to Packet Tracer Exploration: Troubleshooting ACL Placement 
1195
1196Troubleshoot the placement and direction of an ACL. 
1197
1198
1199Page 4:
1200Lab Activity
1201
1202Troubleshoot ACL configuration and placement issues.
1203
1204Click the lab icon to begin.
1205
1206
12079.5.2 - ACL Configuration and Placement
1208Link to Hands-on Lab: Troubleshooting ACL Configuration and Placement 
1209
1210Troubleshoot ACL configuration and placement issues. 
1211
1212
12139.6 Chapter Summary
12149.6.1 Summary
1215
1216Page 1:
1217
1218
12199.6.1 Summary
1220Diagram 1, Image 
1221
1222The diagram depicts a hierarchal network design. 
1223
1224Diagram 1 text 
1225
1226Adherence to the three-layer hierarchical network design model assists in troubleshooting efforts. 
1227Network monitoring tools include: network utilities, packet sniffing tools, and SNMP monitoring tools. 
1228SNMP enables monitoring the performance of individual devices on the network using agents and a MIB. 
1229Backups of the configuration files, spare devices, or backup sites enable quick restoration of connectivity. 
1230The business continuity plan details the security policy and disaster recovery plan. 
1231When troubleshooting a network, determine the scope of the problem, and isolate the issue to a specific failure domain. 
1232
1233Diagram 2, Image 
1234
1235The diagram depicts two rack mounted switches and RJ-45 connections. 
1236
1237Diagram 2 text 
1238
1239The most common problems with switches occur at the Physical Layer. 
1240Visually checking L E D's and cable connections assist in troubleshooting Physical Layer problems. 
1241Change the priority value on a switch to force the selection of the root bridge. The route bridge should be centrally located within the network. 
1242Ensure there are two VTP servers in one domain to provide backup. 
1243Ensure all devices sharing V LAN information have the same VTP domain name. 
1244Check the VTP revision information and mode before enabling a switch to join the network. 
1245
1246Diagram 3, Image 
1247
1248The diagram depicts a simple two router network and various output. 
1249
1250Diagram 3 text 
1251
1252Many tools exist for troubleshooting routing issues include I O S show commands, debug commands and TCP/IP utilities. 
1253Use debug commands to isolate problems, not to monitor normal network operation. 
1254Problems with RIP v1 include lack of VLSM support and intermixing RIP v1 and RIP v2 devices. 
1255Common issues with EIGRP include: mismatched A S numbers, incorrect wildcard mask, and auto-summarization issues with discontiguous subnets. 
1256The majority of OSPF problems relate to the formation of adjacencies and the synchronization of the link-state databases. 
1257
1258Diagram 4, Image 
1259
1260The diagram depicts the show controllers command from a DCE and a DTE end of two connecting routers. 
1261
1262Diagram 4 text 
1263
1264The most common physical layer WAN problems are not specifying a clock rate on the link or using the wrong type of cable. 
1265SLARP assigns an IP address to the end point of a serial link if the other end is already configured. 
1266Ensure that the encapsulation is the same on both sides of the serial link. 
1267If an IP address is used both ends of the link must be on the same network or subnet. 
1268When troubleshooting PPP connectivity verify that the LCP has been opened, authentication, and NCP completed. 
1269For enhanced security, use mutual authentication. On both ends of the link, verify that a user account exists for the remote device and that the password is correct. 
1270By default, the username used during the authentication process, is the name of the remote router. Both the username and the password are case sensitive. 
1271
1272Diagram 5, Image 
1273
1274The diagram depicts a network with an ACL applied. 
1275
1276Diagram 5 text 
1277
1278ACL's can create complications in troubleshooting network issues. 
1279Always verify basic network connectivity before applying an ACL. 
1280Enable logging to determine the effect that ACL's have on traffic. 
1281ACL needs to be applied to the correct router and interface and in the correct direction. 
1282Standard ACL's filter only on one source IP address so they are normally placed as close to the destination as possible. 
1283An Extended ACL filters on source and destination as well as protocols and port numbers. 
1284Placing an extended ACL close to a source can deny traffic before it passes though the router and before it traverses the WAN link. 
1285An ACL placed on the wrong interface or in the wrong direction can block traffic that should not be blocked, or permit traffic that should not be permitted. 
1286
1287
12889.6.2 Critical Thinking
1289
1290Page 1:
1291
1292
12939.6.2 - Critical Thinking
1294Critical Thinking 
1295
1296Answer the following questions based on the exhibit. 
1297
1298Exhibit Network Topology 
1299There are two routers, R2 and R3. 
1300There are two switches, S1 and S2. 
1301R2 is connected to R3 via serial link (network: 192.168.16.0 /30). 
1302R2 has S1 attached (network: 10.1 0.4.0 /24). 
1303R3 has S2 attached (network: 10.1 0.3.0 /24). 
1304S1 has one host attached (Host IP: 10.1 0.4.63 /24). 
1305S2 has one host attached (Host IP: 10.1 0.3.75 /24). 
1306
1307There is a screen capture of the output of R2 which appears, as follows: 
1308
1309hostname R2 
1310[output omitted] 
1311interface F A 0 /0 
1312IP address 10.10.4.1 255.255.255.0 
1313interface s0/0 
1314IP address 192.168.16.1 255.25.255.252 
1315! 
1316router rip 
1317network 192.168.16.0 
1318network 10.0.0.0 
1319[output omitted] 
1320
1321One. Which route advertisements does R3 receive from R2? 
1322a.10.0.0.0 /24. 
1323b.10.10.4.0 /24. 
1324c.10.0.0.0 /8. 
1325d.10.0.0.0 /8 and 10.10.4.0 /24. 
1326e.10.0.0.8, 10.0.0.0 /24 and 10.10.4.0 /24. 
1327
1328Two. If host 10.10.3.75 attempts to ping host 10.1 0.4.63, what will the results be? 
1329a.All packets will be dropped. 
1330b.Some packets will be dropped. 
1331c.All packets will reach the destination and network applications will have connectivity. 
1332d.All packets will reach the destination but network applications will not have connectivity. 
1333
1334Three. What must an administrator do on R3 to ensure that update packets are sent with subnet mask information? 
1335a.Add the command: R2 (config-router) # no version 2. 
1336b.Add the command: R3 (config-router) # version 2, R3 (config-router) # no auto-summary. 
1337c.Change the network statement on Router 3: R3(config)# network 10.1 0.4.0. 
1338d.Add the command: R3 (config ) # IP route 0.0.0.0 0.0.0.0 s0/0. 
1339
1340Four. R1 and R3 is configured with the commands: 
1341
1342version 2 
1343no auto-summary 
1344
1345Which two statements are true? (Choose two.) 
1346a.A ping command will be successful between host 10.1 0.3.75 and host 10.1 0.4.63. 
1347b.R2 is able to send and receive RIP v1 and RIP v2 update packets. 
1348c.R2 is able to receive RIP v1 and RIP v2 update packets. 
1349d.A ping command will fail between host 10.1 0.3.75 and host 10.1 0.4.63. 
1350
1351
13529.7 Chapter Quiz
13539.7.1 Quiz
1354
1355Page 1:
1356Take the chapter quiz to check your knowledge.
1357
1358Click the quiz icon to begin.
1359
1360
13619.7.1 - Quiz
1362Chapter 9 Quiz: Troubleshooting an Enterprise Network 
1363
13641.All IP addresses have been correctly configured and all interfaces are up. Based on the network topology and router output described below, which two statements describe what will occur while testing the network? (Choose two.) 
1365Network Topology 
1366In this topology, router RTA is connected via its S0/0 to router RTB's S0/0 port on the network 192.168.10.0/24. RTA is connected to two switches on the following networks 192.168.30.0/24 and 192.168.80.0/24. RTB is connected to two switches on the following networks 192.168.50.0/24 and 192.168.20.0/24. 
1367The following output is displayed from RTA's configuration: 
1368hostname RTA 
1369! 
1370router rip 
1371network 192.168.30.0 
1372network 192.168.80.0 
1373
1374The following output is displayed from RTB's configuration: 
1375hostname RTB 
1376! 
1377router rip 
1378network 192.168.50.0 
1379network 192.168.20.0 
1380
1381A.RTA and RTB are able to ping each others serial interfaces. 
1382B.RTA and RTB do not learn any routes from each other through the RIP process. 
1383C.RTB has all five of the networks listed in the routing table. 
1384D.RTA has all five of the networks listed in the routing table. 
1385E.RTA and RTB will have three entries in the route table found via RIP. 
1386
13872.Which utility is able to detect and monitor different types of traffic on a network and trigger an alarm when an excessive amount of a specified packet type is seen? 
1388A.ping 
1389B.SNMP 
1390C.tracert 
1391D.packet sniffer 
1392
13933.Answer this question based on the network topology and router output below. The network administrator configured the ACL to deny the LAN access to a web server with known viruses. However, the users can still reach this server. What could be the cause of the problem? 
1394
1395Network Topology 
1396A switch on network 192.168.1.0/24 is connected to the Fa0/0 of router RTA. RTA is connected via its Fa0/1 to another switch which connects to a server with the address 172.16.5.5/24. RTA's ACL's are shown as follows: 
1397RTA(config)# access-list 100 deny ip 192.168.1.0 0.0.0.255 host 172.16.5.5 
1398RTA(config)# access-list 100 permit ip any any 
1399RTA(config)# interface fa0/0 
1400RTA(config)# ip access-group 100 out 
1401
1402A.The access list should specifically deny TCP port 80. 
1403B.The access list should be applied inbound on the interface instead of outbound. 
1404C.The access list should be a standard access list instead of and extended. 
1405D.The access list has the source address and destination address reversed. 
1406
14074.Answer this question based on the switch output below. An administrator has been adding new V LAN's to Sw-2 and notices that the new information is not recognized by Sw-3. Given the output of the show vtp status command, what is the reason why information is not shared in this VTP domain? 
1408
1409Sw-1#show vtp status 
1410VTP Version:2 
1411Configuration Revision: 247 
1412Maximum VLANs supported locally: 1005 
1413Number of existing VLANs:40 
1414VTP Operating Mode:Client 
1415VTP Domain Name:Lab_Network 
1416VTP Pruning Mode:Enabled 
1417VTP V2 Mode:Disabled 
1418VTP Traps Generation:Disabled 
1419MD5 digest: 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80 
1420Configuration last modified by 10.10.12.1 at 8-12-08 12:04:42 
1421
1422Sw-2#show vtp status 
1423VTP Version:2 
1424Configuration Revision: 247 
1425Maximum VLANs supported locally: 1005 
1426Number of existing VLANs:40 
1427VTP Operating Mode:Server 
1428VTP Domain Name:Lab_Network 
1429VTP Pruning Mode:Enabled 
1430VTP V2 Mode:Disabled 
1431VTP Traps Generation:Disabled 
1432MD5 digest: 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80 
1433Configuration last modified by 10.10.12.1 at 8-12-08 12:08:52 
1434
1435Sw-3#show vtp status 
1436VTP Version:2 
1437Configuration Revision: 247 
1438Maximum VLANs supported locally: 1005 
1439Number of existing VLANs:25 
1440VTP Operating Mode:Transparent 
1441VTP Domain Name:Lab_Network 
1442VTP Pruning Mode:Enabled 
1443VTP V2 Mode:Disabled 
1444VTP Traps Generation:Disabled 
1445MD5 digest: 0x45 0x52 0xB6 0xFD 0x63 0xC8 0x49 0x80 
1446Configuration last modified by 10.10.12.1 at 8-12-08 13:34:49 
1447
1448A.The VTP domain is not the same between the switches. 
1449B.Sw-3 is configured for transparent mode. 
1450C.VTP version 2 has been disabled. 
1451D.VTP traps have been disabled. 
1452
14535.Answer this question based on the router output below. Two neighboring routers are not able to establish connectivity. Based on the output of the debug ppp authentication command, which statement is true? 
1454
145503:17:47: Se0/1 PPP: Authorization NOT required 
145603:17:47: Se0/1 CHAP: O CHALLENGE id 15 len 28 from "R1" 
145703:17:47: Se0/1 CHAP: I CHALLENGE id 17 len 27 from "R2" 
145803:17:47: Se0/1 CHAP: Using hostname from configured hostname 
145903:17:47: Se0/1 CHAP: Using password from AAA 
146003:17:47: Se0/1 CHAP: O RESPONSE id 17 len 28 from "R1" 
146103:17:47: Se0/1 CHAP: I RESPONSE id 15 len 27 from "R2" 
146203:17:47: Se0/1 PPP: Sent CHAP LOGIN Request to AAA 
146303:17:47: Se0/1 PPP: Received LOGIN Response from AAA=FAIL 
146403:17:47: Se0/1 CHAP: O FAILURE id 15 len 26 msg is "Authentication failure" 
1465
1466E.only one side required authentication 
1467F.an incorrect hash string is received from the remote router 
1468G.the remote location is configured with PAP authentication instead of CHAP 
1469H.the authentication methods are incompatible 
1470
14716.Answer this question based on the network topology and the switch output below. The ACME Company implements V LAN's across its network infrastructure to further control the network traffic. The network administrator issued the show vlan command on SW2 to verify the V LAN configuration. Which statement is true? 
1472Network Topology 
1473Router RTA is connected to switch SW2. SW2 is connected to switches SW1 and SW3. Engineering is V LAN 10. Support is V LAN 20, and Sales is V LAN 30. 
1474
1475SW2# show vlan 
1476VLANNameStatusPorts 
14771defaultactiveFa0/3, Fa0/4, Fa0/21, 
1478Fa0/22, Fa0/23, Fa0/24 
147910EngineeringactiveFa0/5, Fa0/6, Fa0/7, Fa0/8, 
1480Fa0/9 
148120SupportactiveFa0/10, Fa0/11, Fa0/12, 
1482Fa0/13, Fa0/14, Fa0/15 
148330SalesactiveFa0/16, Fa0/17, Fa0/18, 
1484Fa0/19, Fa0/20 
1485
1486A.All ports will be participating in V LAN1. 
1487B.Traffic in each V LAN will not be seen in other V LAN's. 
1488C.The status "active" indicated there are 22 devices currently connected to SW2. 
1489D.Since V LAN 1 is the management V LAN, RTA can connect to any port in V LAN 1 to route between different V LAN's. 
1490
14917.What is one way to limit the size of a failure domain? 
1492A.implement a classless routing protocol 
1493B.create redundant paths wherever possible 
1494C.backup configuration files 
1495D.ensure devices are not-swappable 
1496
14978.Answer this question based on the network topology below. The server was just added to the network and no hosts are able to connect to it. What could be the problem? 
1498
1499Network Topology 
1500Router RTA is connected via Fa0/0 to a switch. The switch is connected to two hosts on the 10.10.10.0/24 network with the following IP addresses, 192.168.102.50/27 and 192.168.102.34/27. RTB is connected via Fa0/0 to a switch. The switch is connected to a host with the IP address 192.168.102.99/27 and a server with the IP address 192.168.102.127/27. RTA has a serial connection port S0/0 to RTB port S0/0. 
1501
1502A.The IP address of the server should be dynamic instead of static. 
1503B.The IP address assigned to the server is the network address for this subnetwork. 
1504C.The IP address assigned to the server is the broadcast address for this subnetwork. 
1505D.The network is not subnetted correctly. 
1506
15079.A technician is troubleshooting a loss of connectivity and suspects that and incorrectly configured ACL is the cause. Which two commands can the technician use to verify that the ACL is incorrectly configured? (Choose two.) 
1508A.show protocols 
1509B.show running-config 
1510C.show ip route 
1511D.show access-lists 
1512E.show ip interface 
1513
151410.To answer this question, refer to the router output below. Why is neighboring 192.168.199.137 not a DROTHER? 
1515
1516Neighbor IDPriStateDead TimeAddressInterface 
1517172.16.40.15Full/DR0:00:31172.16.48.1Ethernet0 
1518172.16.50.11Full/DROTHER0:00:33172.16.48.10Ethernet0 
1519172.16.60.11Full/BDR0:00:33172.16.48.200Ethernet0 
1520192.168.199.1371Full/-0:00:33192.168.1.2Serial0/1 
1521
1522A.It is participating in OSPF over a point interface. 
1523B.The network commence if misconfigured on the local router. 
1524C.The network commence if misconfigured on the neighbouring router. 
1525D.OSPF authentication has been enabled on the local router but not on the neighboring route.