Category Archives for "Leander’s blogsphere"


Lately, I've been playing around with DHCPv6 and SLAAC on my home network.

When configuring IPv6 addresses on the network interfaces there are three ways of doing this. We can use Stateless address autoconfiguration (SLAAC), DHCPv6 (statefull) or we can configure the address manually. SLAAC is by far the easiest way to configure IPv6 addresses, simply because you don't have to configure any IPv6 address. The way it works is that the router on your network will advertise the IPv6 prefix (/64) using multicast (remember that with IPv6 there is no such thing as broadcast). The host will receive/request this prefix advertisement and will auto generate the last 64 bits to make a fully working IPv6 address. When auto generating the address the host will use it's mac address (which is 48 bits) and insert "ff:fe" in the middle of it. This is also known as EUI-64. One drawback of EUI-64 is that you're trackable on the Internet because the mac address will normally not change when using the same host (e.g. laptop, smartphone, tablet, etc..). To overcome this issue SLAAC has been extended with  something called Privacy Extensions. When this is enabled the host part (last 64 Continue reading

GRE Tunneling and Recursive Routing


When using a routing protocol over GRE tunnels you might end up learning the tunnel endpoint via the routing protocol. When the tunnel endpoint is preferred using the route learned from the routing protocol you end up with a flapping tunnel.

The router will detect this and generates a message:

%TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing


The easiest way to solve this is by using a static route to the tunnel endpoint.

If this is not allowed you can also use a prefix filter. This filter should block the advertisement of the tunnel endpoint prefix via the GRE tunnel. For example:

ip prefix-list FILTER_TUNNEL_ENDPOINT seq 5 deny

ip prefix-list FILTER_TUNNEL_ENDPOINT seq 10 permit le 32


This will match the tunnel endpoint address (, but allow the other prefixes.

Use this prefix-list to filter the outgoing advertisements on the tunnel interface.

router rip

 distribute-list prefix FILTER_TUNNEL_ENDPOINT out Tunnel1

Reliable Policy Routing

Reliable Policy Routing can be configured by using the "set ip next-hop verify-availability" statement in a route-map. There are two ways to verify the availability of the next-hop. One way is to use CDP. The other way is to use a tracked object (e.g. IP SLA).
Verify availability of next-hop using CDP:
route-map PBR_FROM_R3 permit 10
 match ip address FROM_R3_TO_R4
 set ip next-hop
 set ip next-hop verify-availability
 set ip default next-hop
Verify availability using a tracked object:
route-map PBR_FROM_R3 permit 20
 match ip address FROM_R3_TO_R5
 set ip next-hop verify-availability 1 track 1
 set ip default next-hop

Policy Routing


Create one or more access-lists that specify what traffic should use policy routing.

ip access-list extended FROM_R4
 permit ip host any

ip access-list extended FROM_R6
 permit ip host any

Then create a route-map that will match the defined access-lists and specify an action.

route-map PBR permit 10
 match ip address FROM_R4
 set ip next-hop

route-map PBR permit 20
 match ip address FROM_R6
 set ip next-hop

route-map PBR permit 30
 # will match any other traffic

Tie the route-map to an interface to enable policy routing.

interface FastEthernet0/0
 ip policy route-map PBR

Usefull debug commands:

#debug ip policy

IP SLA & Enhanced object tracking


Create a SLA object to schedule a ping test

ip sla 1
 icmp-echo <ip address>
 frequency <in seconds>
ip sla schedule 1 life forever start-time now

Enable Enhanced Object tracking on the SLA

track 1 ip sla 1 reachability

Tie the tracked object to a static route

ip route track 1


As soon as the ping test fails the static route will be removed from the routing table.

When there is another static route with a higher Administrative Distance this route will be injected into the routing table.

Once the ping test is successfull again the original static route will be injected again.

Usefull show commands:

#sh track 1
Track 1
  IP SLA 1 reachability
  Reachability is Up
    3 changes, last change 00:21:42
  Latest operation return code: OK
  Latest RTT (millisecs) 1
  Tracked by:

#sh ip sla statistics 1
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
Type of operation: icmp-echo
        Latest RTT: 1 milliseconds
Latest operation start time: *20:39:26.283 UTC Wed Jul 13 2011
Latest operation return code: OK
Number of successes: 417
Number of failures: 13
Operation time to live: Forever

Usefull debug commands:

#debug track

#debug ip routing

CCIE Home Lab inventory

For reference here is the complete list of Cisco devices, including RAM, Flash, installed modules and IOS versions that I’ve used to build my home lab.

Device Platform RAM Flash Modules IOS
SW1 WS-C3560-24TS 128MB 32MB n/a c3560-advipservicesk9-mz.122-44.SE.bin
SW2 WS-C3550-24 64MB 16MB n/a c3550-ipservicesk9-mz.122-25.sec2.bin
SW3 WS-C3550-24 64MB 16MB n/a c3550-ipservicesk9-mz.122-25.sec2.bin
SW4 WS-C3550-48 64MB 16MB n/a c3550-ipservicesk9-mz.122-25.sec2.bin
R1 2610XM 128MB 32MB WIC-2T= c2600-adventerprisek9-mz.124-25d.bin
R2 2610XM 128MB 32MB WIC-2T= c2600-adventerprisek9-mz.124-25d.bin
R3 2651XM 160MB 32MB 2x WIC-2T= c2600-adventerprisek9-mz.124-25d.bin
R4 2801 256MB 64MB WIC-2T= c2801-adventerprisek9-mz.124-24.T4.bin
R5 1841 384MB 128MB WIC-2T= c1841-adventerprisek9-mz.124-24.T4.bin
R6 2691 256MB 64MB WIC-2T= c2691-adventerprisek9-mz.124-15.T14.bin
R7 3725 256MB 128MB 2x WIC-1T=, NM-2FE2W-V2= c3725-adventerprisek9-mz.124-15.T14.bin
BB1 2522 16MB 16MB n/a c2500-is-l.122-15.T17.bin
BB2 2520 16MB 16MB n/a c2500-is-l.122-15.T17.bin
BB3 2520 16MB 16MB n/a c2500-is-l.122-15.T17.bin
CON 2610 64MB 16MB NM-16A=, WIC-1T= c2600-ik9o3s3-mz.123-26.bin

Building the lab – part 2

With all the equipment in the rack it is time to connect everything together. I’ve used a total of 11 back-to-back serial, 12 router-to-switch ethernet and 18 switch-to-switch ethernet connections. All together that makes almost a spaghetti of cabling :)

CCIE Home Lab cabling

CCIE Home Lab cabling

But with some Rip-Tie strap cable I could organize the cabling  in a pretty decent way. Below is the end result, without the console connections.

CCIE Lab Rack

CCIE Lab Rack

Building the lab – part 1

I finally have all the equipment I need to build the lab. I also managed to get a Skeletek C24U rack, and it looks really nice. The fun already starts with assembling the rack as it comes in a relatively small box, including 6 pieces and a whole bunch of nuts and bolts.

Skeletek C24U

Skeletek C24U

After 45 minutes or so the rack is fully assembled and ready to rack the first pieces of Cisco gear.

Skeletek CCIE Home Lab Rack

Assembled Skeletek Rack

After about two hours later I also racked all the Cisco equipment I have into the rack, including two PDU’s for some power juice.

Skeletek CCIE Home Lab Rack

Skeletek CCIE Home Lab Rack

Next step will be to put all the cabling in place. And hopefully the two octal cables (cab-octal-async) I ordered will arrive shortly, so I can also connect all the console outputs to the terminal server/router.