NetworkJutsu

Network Security Consulting | San Francisco Bay Area

Blog

Manipulating Shaping Values

By Leave a Comment

Cisco’s recommendation is to leave the shaping values (Bc – committed burst and Tc – committed rate interval time) alone if you’re not servicing delay sensitive application, like voice. By default Class Based Shaping use 8000 bits for Bc and 125 ms for Tc if it is below 320 Kbps shaping rate. For 320 Kbps and above, the Tc changes to 25 ms and the Bc will be calculated based on the formula below. For example, the shaping rate is 640 Kbps, if you look at the formula, Bc = Tc * CIR. The CIR (Committed Information Rate) can be replaced by the shaping rate value. In this scenario, the shaping rate is 640,000 bits/sec. Going back to the example, since the shaping rate is over 320Kbps, we know that Tc is 25ms (0.025 secs) and if we multiply it to the shaping rate of 640 Kbps then we get 16 Kb for the Bc.

Let’s say for example that your shaping rate is 128 Kbps and you need to traverse a single G.711 phone call. As mentioned above, the Tc is 125 ms for shaping rate lower than 320 Kbps, this value is not an acceptable value for VoIP calls. The recommended one way delay is 150 ms. Allowing the default values of the shaping rate will make all voice calls unacceptable and you’ll start hearing complaints from users. Since we have the formula, we can manipulate the value to send packets every 10 ms to lessen the one way delay. If you look at the command below, you will see that Tc is not configurable. IOS calculates the Tc from the values of Bc and CIR/Shaping rate. Going back to the formula above, we know that we want to send packets every 10 ms and we know our CIR/shaping rate is 64 Kbps, let’s plug in the values to the formula to find out the Bc, which is needed to complete our command. Bc = 0.010 (Tc) * (CIR/Shaping rate) 128000 = 1280 bits. To check our math, please check the show policy-map output below.

R1(config-pmap-c)#shape average ?
    Target Bit Rate (bits per second), the value needs
                    to be multiple of 8000
  percent           % of interface bandwidth for Committed information
                    rate
R1(config-pmap-c)#shape average 128000 ?
    bits per interval, sustained. Needs to be multiple of
                   128. Recommend not to configure it, the algorithm
                   will find out the best value

For an overview of traffic shaping, please visit this site.

References

Cisco QoS Exam Certification Guide (IP Telephony Self-Study) (2nd Edition)
End-to-End QoS Network Design: Quality of Service in LANs, WANs, and VPNs

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

Switch Port Template

By Leave a Comment

This post will cover a switch port template that I consistently use for user switch ports. These commands also help in speeding up switch port initialization. Anything that speeds up the process is normally a good thing.

Without further ado, here are the commands that I use for user access switch ports, excluding QoS settings which will be covered in the future article:

Switch (config)# int range g0/1 - 48
 switchport host
 spanning-tree bpduguard enable
 switchport access vlan 10
 switchport voice vlan 20

The switchport host macro command was designed to facilitate the configuration of switch ports that connect to end stations. Entering this command sets the switch port mode to access, enables spanning tree PortFast, and disables channel grouping, all at the same time. You will also see a notification of what it did once the command took effect, as shown below. Additionally, you can also hard code the speed and duplex to prevent auto negotiation process to initiate. Other Network Engineers will tell you to disable anything auto, but I personally leave the auto negotiation for speed and duplex alone. I only mess with speed and duplex if the node does not negotiate properly and there’s no way to change the settings to auto.

Switch (config-if)#sw host
switchport mode will be set to access
spanning-tree portfast will be enabled
channel group will be disabled

For more information about the switch port initialization, please read this post.

I hope this has been helpful and I thank you for reading!

Reference

Switching Infrastructure

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

Cisco IP Phone Boot Process

By Leave a Comment

Knowing how something works is always beneficial. Having said that, I believe network engineers should know the boot process of the Cisco IP phones so they can assist with troubleshooting.

  • The Cisco IP phone connects to an Ethernet switchport. If the IP phone and switch support PoE, the IP phone receives power through either Cisco-proprietary PoE or 802.3af PoE.
  • As the Cisco IP phone powers on, the Cisco switch delivers voice VLAN information to the IP phone using CDP as a delivery mechanism. The Cisco IP phone now knows what VLAN it should use.
  • The Cisco IP phone sends a DHCP request asking for an IP address on its voice VLAN. The router connecting to the voice VLAN receives this DHCP request and, through the ip helper-address command, forwards the request directly to the DHCP server.
  • The DHCP server responds with an IP address offer. When the Cisco IP phone accepts the offer, it receives all the DHCP options that go along with the DHCP request. DHCP options include items such as default gateway, DNS server information, domain name information, and so on. In the case of Cisco IP phones, a unique DHCP option is included, known as Option 150. This option directs the IP phone to a TFTP server (you learn more about this in the upcoming section, “Configuring a Router-Based DHCP Server”).
  • Once the Cisco IP phone has the IP address of the TFTP server, it contacts the TFTP server and downloads its configuration file. Included in the configuration file is a list of valid call processing agents (such as Cisco Unified Communications Manager or CME agents).
  • The Cisco IP phone attempts to contact the first call processing server (the primary server) listed in its configuration file to register. If this fails, the IP phone moves to the next server in the configuration file. This process continues until the IP phone registers successfully or the list of call processing agents is exhausted.

I hope this has been helpful and I thank you for reading!

Reference

CCNA Voice Official Exam Certification Guide

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

Disabling HTTP and HTTPS

By Leave a Comment

As promised, I will keep adding to the list of what Network Engineers should do to harden their Cisco network devices. This article, as what it says on the title, talks about how to disable HTTP and HTTPS service running on your Cisco network devices by default. Brand new out of the box, the Cisco routers and switches contain HTML files that allow you to manage them using Graphical User Interface (GUI). Cisco Network Academy Program and most Cisco Press books teach students to use CLI and not GUI so most Network Engineers won’t be using this GUI. Having said that, if you don’t use it then disable it. That’s what IT-Security guys would say because this mitigate attacks by limiting what services that are running on your devices.

The screenshot below shows you a port scan of a newly configured switch with Telnet disabled and SSH enabled.

To disable this default behavior, issue the following commands:

Router (config)#no ip http server no ip http secure-server

Upon disabling HTTP and HTTPS services, here’s what it would look like after doing a port scan.

I hope this has been helpful and I thank you for reading!

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

Configuring Terminal/Access Server

By Leave a Comment

This post shows you how to configure a Cisco router to act as a terminal or access server. Terminal/Access server makes it easy for you to be able to have console access to important devices on your network or if you have a bunch of routers and switches for your CCIE home lab.

Without further delay, here’s the configuration on how to configure your terminal/access server.

TERMSRV (config)# interface loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface Ethernet0
 ip add 192.168.0.254 255.255.255.0
!
ip host BB1 2001 1.1.1.1
ip host BB2 2002 1.1.1.1
ip host BB3 2003 1.1.1.1
ip host R1 2004 1.1.1.1
ip host R2 2005 1.1.1.1
ip host R3 2006 1.1.1.1
ip host R5 2008 1.1.1.1
ip host R6 2009 1.1.1.1
ip host S4 2010 1.1.1.1
ip host S3 2011 1.1.1.1
ip host S2 2012 1.1.1.1
ip host S1 2013 1.1.1.1
ip host R4 2014 1.1.1.1
!
end

The commands below are optional. I had problems with my Cisco 2511 and this is the configuration that seemed to fix the issue. Unfortunately, I don’t exactly remember what it was since that was few years ago.

TERMSRV (config)# line 1 16
 flush-at-activation
 transport input telnet
 autohangup
!
end

I hope this has been helpful and I thank you for reading.

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.