In this video and hands-on lab, what we get to do is we are
going to implement some control plane policing and then verify
that it's working against remote access protocols like telnet
and SSH and--
well, I thought we do, also, as part of troubleshooting
is why is Intel networking our why is it SSH working?
So we're going to bundle that into this as well
and give you a chance to setup the remote access
as well as the control plane policing in the lab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as well as the control plane policing in the lab
to get a little more troubleshooting experience
with both.
So without further ado, let's take a look at the topology
and then we'll go right into the lab.
So here is our topology, and we really
could use almost any router.
But to stay in sync with each other, let's go ahead
and I reset the lab.
Let's go ahead and do control plane policing on R1,
and let's go ahead and set it up to make sure that we're
getting telnet, which I know.
I know.
In a production environment, we're not going [INAUDIBLE]----
don't have to worry too much about doing controlled plane
policing regarding telnet because we're not using it that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
policing regarding telnet because we're not using it that
much.
However, you can replace this with SSH.
In fact, we'll do both.
So let's go ahead and set up control plane policing
and access for telnet and SSH.
We'll do it on R1, then we can test from R2
or R3 or R4 going into R1.
And then we can verify that the remote access is set up,
and we can also verify the control plane
policing is working.
All right, let's take a look at R1.
All right, so here we go.
Now, before we start doing control plane policing
for telnet or SSH, let's make sure that it works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for telnet or SSH, let's make sure that it works.
As far as SSH or telenet to begin with.
We'll do a-- let's do a show IP interface brief on this router.
All right, and we just get wo-- on locally on R1,
so let's just go ahead and do a telnet to ourselves.
You're teleneting to yourself?
Or trying to.
Pass required but none set.
All right, we can deal with that.
So config t enable secret.
And let's use a password, a capital C, i, f, c, o,
exclamation mark, 2, 3.
Fantastic.
Now, we'll try telent to ourselves. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, we'll try telent to ourselves.
Up arrow key a couple times and pass requi--
oh, OK.
So I thought it was just the enable secret.
Let's do a show run and take a look at the VTY lines,
see what's there.
Now, if it's AAA related, we might
have to troubleshoot what method list is
assigned to the VTY lines.
I'm not using AAA numeral yet on this device.
OK, there's a log in.
Gotcha.
So the log in on the VTY lines is saying, hey,
log in required, but there's no password set.
So we'll go fix that with a-- fix
it anyway you like in the lab.
There's several options. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's several options.
It's going to go into line VTY--
had to think about for a moment.
Zero, three, four-- oh, VT line--
I said it, didn't take it.
VTY zero through four, and let's do a login local
and it will create a username.
Username, let's go make Bob.
And I'll give Bob--
I'll give him privilege level 15,
and we'll give him a password of Cisco, exclamation mark, 2, 3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we'll give him a password of Cisco, exclamation mark, 2, 3.
Fantastic.
All right, let's try to tell him that again, shall we?
Let's do a up arrow key a few times.
Telnet to 1.1.1.1, username Bob, and the password is capital
C-I-S-C-O, [INAUDIBLE], 3.
All right, telenet works.
Yay.
All right, so we are in Bob.
All right, so that works.
Let's also do a SSH.
SSH dash L login as Bob, do 1.1.1.1.
It's not accepting. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's not accepting.
Let's take a look, show run.
Well, the troubleshooting is getting the basic functionality
working.
Login local.
So the transport should be allowing SSH and also telnet.
Hmm.
Let's go force it.
Config t find VTY zero space four
and transport input and let's take a look at our options.
Oh, I might need MOP, I might need LAT, I might need PAD, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Oh, I might need MOP, I might need LAT, I might need PAD,
I might--
no, you won't.
Anyway, but this will get us SSH as well.
Though that's no longer being limited to an SSH
at dash l, Bob, to 1.1.1.1.
Connection refused.
All right, maybe we're not set up for SSH.
show IP SSH.
Oh, SSH is disabled.
That would explain quite a bit.
Let's set it up.
Config t, IP domain name because you
have to have that to set it up and we'll
call this CBT.com for short. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
call this CBT.com for short.
That'll work.
And then crypto key generate RSA modulus.
And let's go for 1,024.
That'll be enough to at least get us in.
Thank you very much.
Now, SSH 1.99 simply says supports version 1 and 2.
Let's go and try it now.
Up arrow key a few times.
SSH dash L Bob to ourselves.
Password for Bob is the one we created. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Password for Bob is the one we created.
Troubleshooting.
And if we were using AAA new model,
we might have to look at the method list
and what the defaults were and assign the right method
list into the actual VTY lines.
But we're good.
So the basics of this work.
We can do a show users and now it
says that we are on the console with no authentication
and we are also on the VTY line zero for our current session
that we just connected with Bob on the SSH.
And show SSH, yeah. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And show SSH, yeah.
Great, awesome.
So I'm going to type in exit.
[VOOT] [INAUDIBLE] the show users.
All right, we're back to the console with no users
currently attached besides us on the console.
Fantastic.
All right, let's set up control plane policing for both SSH
and also for telnet.
Help us with that so it's less of a typing exercise.
I've got this document right here on the desktop.
It's called COPP practice.
It's the one we looked at earlier.
And I will change the format to make it a little bit easier WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I will change the format to make it a little bit easier
to view for the demo.
And also, it's the hands-on lab.
So if you want to click on the link for the virtual lab,
you can do this right alongside.
And the font is now 16, great.
And first we are creating some access list.
So the ICMP I don't care too much about.
What we're focused on is management protocols
including SSH right there, TCP port 22 and also telnet.
Though this is also covering port 80 and port 443 for TCP
and also UDP 161 which is SNMP and that's great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and also UDP 161 which is SNMP and that's great.
And then what we're doing is we're in--
there's also some routing protocols here.
We'll deal with that later.
And then there's also the policy map,
which is calling on the class maps
and then specifying their rights.
So here's the key.
If we are going to have a certain quantity of traffic
that's matching and being policed,
we'd want to make sure that we're not starving it.
The way we find out is we do a show for the policy
map when this is applied.
And we can see, OK, how much traffic conformed
and how much traffic dropped.
And if we have routing protocols or SSH traffic,
it's being dropped because of excess traffic over the limits. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's being dropped because of excess traffic over the limits.
Then we'd want to tweak, so that's
part of the troubleshooting.
And also to show the policy map for the control plane,
we'll also indicate what was hit and what was dropped
as a result of the policing.
So I'm going to go ahead and--
I'm going to take all this.
And there's the application to the control plane.
That's going to highlight all this, all the way
from config t, all the way to the very bottom.
In fact, I'll also go ahead and include the show command out
here.
Show policy map control plane input.
Right click, copy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Right click, copy.
And we'll go to R1 and here on R1 we'll just do a paste.
All right, so here's this command
shell policy map control plane input,
and then here we have the RCMP class
and we should have very little matches here
because all that traffic, there's
nothing going on with it.
There's no pings happening, there's no SSH,
there's no telnet.
So let's go to on our topology.
Let's take a peek at our topology.
Let's go to R2, and from R2 let's
go ahead and generate a remote session to R1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go ahead and generate a remote session to R1.
We know that we can get there-- or we know that the SSH intel
network, we've done that.
So let's go to R2 and we'll SSH or telnet enter both
and we'll generate some traffic and then
we can look at the counters as far
as the control plane policing and verify that everything's
in compliance.
And again, it'd be in the case where
it wasn't being policed at all, which would be
a problem with our access list.
They're probably off a little bit.
Or a problem with the actual traffic being dropped,
which means our policing is being done too much WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which means our policing is being done too much
of an extent.
We need to increase the amount of traffic that's going
to be conformed and forwarded.
All right, so let's go to R2 and here we go.
So on R2, other shows CDP neighbor.
I just want to see who--
so I'm connected directly over to R1
because we gave the domain CBT.com, it's there.
And we're one hop away.
So let's just do a show IP route.
Let's take a look at the gig two slash zero interface.
So it's the 10.0.12 network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's the 10.0.12 network.
So R1 is 10.0.12.1.
All right, so let's go ahead and do our telnet.
10.0.12.1.
Survey says, great.
I was just nervous at more troubleshooting.
So we're going to login as Bob with the password.
And great, we're in.
So if we to a show tech support that's
going to be a lot of output. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to be a lot of output.
And most of it's go through outbound.
It'd going from the telnet session out.
So while I let that just run forever, which is--
it's fun.
Anyway, if I do a-- oh, this guy's so process.
Oh yeah, he's so hurting.
It's all virtualizes, so she'll process CPU.
It's like, what are you doing to me?
So it doesn't say it's to be, so we last five seconds. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it doesn't say it's to be, so we last five seconds.
Alll right, not as high as I thought it would be.
All right.
So getting back to our point, let's go
do a show policy mao and control plane and I'll say--
I'm going to go ahead and press Enter for all of it.
So ICMP, we're not matching too much.
But for our management class--
check this out-- we should have some traffic this matching
because telnet is certainly in that access control list, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because telnet is certainly in that access control list,
and indeed, here we go.
Conformed 154 and exceeded zero, violated zero.
Then we also show access lists and take a look
at the hit count here.
So right here, based on our matches in the access control
list, the traffic we have is matching
is TCP from any to anywhere.
The destination TCP port equals 23,
and that would be the inbound traffic coming from R2 into R1,
All right, and let's see if R2 is done yet.
Yeah, he's done. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yeah, he's done.
Great.
All right, let's take an exit, and we're
sitting at the console of R2.
And let's go ahead and do SSH dash L,
and we'll log in as Bob to 10.0.012.1.
And the password is the same as it was.
And let's do a ping from R1 to R2 just for grins.
So we'll do a ping, so we're SSH into R1.
We're going to do ping from R1 to R2.
So I'll do a ping to-- it's 10.0.12.2, and let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'll do a ping to-- it's 10.0.12.2, and let's go ahead
and let's do a repeat of 100 and let's go ahead
and also do a size of 1,000.
Oh, look at that.
Bop, bop, bop, bop.
And this is because of control plane policing on R1.
So if we go back to R1, the console of R1,
to verify that we do a show users, and so we're now
we're back at the console.
Bob's also logged in from R2 over to the R1 device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Bob's also logged in from R2 over to the R1 device.
Right here, if you do a show policy map for control plane
and press Enter.
So here in our ICMP class, we have some packets
that have conformed and we also have some packets
that have access based on the control plane
policing we set up.
And if we'd hit the up arrow key,
did it again, that number is continuing to grow.
Both the ones that conformed and the ones
that exceeded because that ping is still
going on for a while in the background.
Also, if we go down a little bit to our management class, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also, if we go down a little bit to our management class, which
includes now our SSH traffic, we should have some hits
here as well.
And fortunately for SSH and also with telnet,
they're all lumped here together in that same class.
There is nothing that's being dropped and that's great.
Because if it was being dropped, we'd
have problems with our management protocols.
All right, and let's also do this.
Let's do a show axis lists just to verify
where our hit counts are.
So here we have some for our ICMP traffic, fantastic.
Here we have some for SSH, here we have
some for a lot for our telnet.
And nothing else has been matched. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And nothing else has been matched.
That also implies that, for routing protocols,
show IP protocols, we aren't running any routing protocols.
And that's why none of our routing protocol ACLs
are being matched as part of the class
map for the routing protocols.
Because we're not running, yet, any routing protocols.
So thanks for joining me on this video and lab, as we've
had a chance to both implement remote access with SSH
and telnet, and make sure that our control plane policing is
governing that and protecting your device against too much
incoming traffic and also how to troubleshoot it
by looking at the access list, looking at the hit counts, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
by looking at the access list, looking at the hit counts,
and also looking at the output of the show policy
map we've got in the control point.
And in the next video I'd like to take the same approach
with control plane policing, some hands-on practice,
but this time do it with routing protocols,
so we can actually implement it, see the difference,
and if there's a problem, troubleshoot it.
So I'll see you in that next video
in just a moment meanwhile, I hope this has been informative
for you and I'd like to thank you for viewing.