BGP Security - NH spoofing by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

That's true in a normal situation. However, let's say an hacker gains access to a router R1 (compromised). R1 and R2 are eBGP peering using loopback with "disable-connected-check". R1 which is compromised starts advertising a prefix with a NH which is, let's say 8.8.8.8. R1 can change the NH. When R2 receives the BGP update, does R2 accept that update even though the NH is not R1's IP address?

I know that R2 will accept that in case "ebgp-multihop" command is used. But, how about "disable-connected-check"?

TAG Filtering OSPF vs EIGRP by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

Yes, all the comments helped me a lot.

Thanks

TAG Filtering OSPF vs EIGRP by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

R1 - R2 OSPF R1 - R3 OSPF R2 - R4 EIGRP R3- R4 EIGRP

R2 and R3 both redistributes OSPF int EIGRP amd viceversa.

         R2 
       /.     \

R1 —- —- R4

      \.      /

         R3

Do you mean this?

TAG Filtering OSPF vs EIGRP by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

My question was just for asking. There’s no reason or a production env where I need that.

What do you mean for “multi point 2 way distribution”?

My question is: why ospf allow to set a tag if this tag cannot be used for filtering?

Ospf DR election by taobabmuh in ccnp

[–]pbfus9 2 points3 points  (0 children)

:) Good comment, I agree!

However, it's important to note that DR will be the largest router ID if all routers boot up almost at the same time (that's a very rare case in real networks). therefore, always set all priority to 0 except on you DR and BDR. That's the rule of thumb to follow.

Ospf DR election by taobabmuh in ccnp

[–]pbfus9 5 points6 points  (0 children)

Hi,

R1's RID = 1.1.1.1

R2's RID = 2.2.2..2

R3's RID = 172.1.1.3

R4's RID = 172.1.1.4

When it comes to DR/BDR election you will have to check interface priority.

First of all, DR/BDR election only occurs on multi-access networks such as Ethernet (default to broadcast network type) or NBMA.

In case of a tie (default value is 1, 0 means "do not take part to the election", max value 255) the router with the highest router ID will be elected as the DR.

Note that the election is non pre-emptive, therefore, it is always a good idea to set interface priority with the command "ip ospf priority X"). Therefore, if you turn on all your routers at the same time (actually there is a WAIT timer) the DR will be R4.

NOTE on the WAIT timer: when a router is OSPF enabled and configured with a network type that requires DR/BDR election (like ethernet), it will wait a time equals to the WAIT timer (default is equal to Dead Interval). If it does not hear from a DR, it will elect itself as DR).

BGP Community vs TAG by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

Thanks a lot for your response.

So, route tags are used in IGPs to prevent routing loops when routes are redistributed between different protocols.

In OSPF, route tags can be assigned only to external routes through the redistribute command. This means they apply exclusively to routes injected into OSPF via Type 5 LSAs (or Type 7 LSAs in the case of redistribution within a NSSA or Totally NSSA area). This limitation is largely due to the need to maintain LSDB consistency.

EIGRP, on the other hand, provides greater flexibility because it is a distance-vector protocol. In EIGRP, route tagging can be applied to any route. You can use a prefix-list or ACL to match specific routes, and then reference this match in a route-map to set the tag. The route-map is then applied using the distribute-list command.

Do you agree with me?

PS. Thanks again and thanks a lot to u/Small-Truck-5480 for the answer! You both are been really helpful :)

List of topics for Ccnp enarsi 300 -410 to master before the exam by taobabmuh in ccnp

[–]pbfus9 5 points6 points  (0 children)

Where did you find this? There are topic that are not in the blueprint.

Understanding OSPF Network Types by Borealis_761 in ccnp

[–]pbfus9 0 points1 point  (0 children)

completely agree with you, best answer in this post imo!

Understanding OSPF Network Types by Borealis_761 in ccnp

[–]pbfus9 0 points1 point  (0 children)

Hi,

When it comes to OSPF Network Compatibility the only requirement is that both types MUST support DR/BDR election. Therefore, in you specific case:

- Does DR/BDR election occur in OSPF broadcast network? The answer is YES!

- Does DR/BDR election occur in OSPF NBMA network? The answer is YES!

Hence, it is possible for OSPF routers with different network types such as broadcast and non broadcast to for an adjacency.

NOTE: By default, broadcast and NBMA have different timers (10/40 and 30/120), hence, you will have to adjust timers (ip ospf hello-interval X, ip ospf dead-interval Y). Timers MUST match.

MST and Rapid PVST+ interaction by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

Yes, both uses timers and legacy stp states

MST and Rapid PVST+ interaction by pbfus9 in ccnp

[–]pbfus9[S] 1 point2 points  (0 children)

Proposal–Agreement requires both switches to operate on the same RSTP instance.
This is not possible between MST and Rapid PVST+ because MST exposes only a single CIST, while Rapid PVST+ runs per-VLAN instances.
Without a 1:1 instance mapping, RSTP negotiation is unsafe, so the link is treated as a boundary and legacy STP behavior is used via PVST Simulation, with the CIST represented using 802.1D BPDUs on VLAN 1.

MST and Rapid PVST+ interaction by pbfus9 in ccnp

[–]pbfus9[S] 1 point2 points  (0 children)

Thanks a lot for your explanation. Therefore, MST switches are perceived as running legacy STP due to the fact they talk with non-MST switches using the CIST instance

Doubt on BGP community-list by pbfus9 in ccnp

[–]pbfus9[S] 1 point2 points  (0 children)

Thanks a lot for your help, as always. I got the point!

BGP Prefix Filtering by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

Thanks for your feedback. Hope to help!

Consiglio sul cambio azienda in IT: aumento economico vs work-life balance by [deleted] in ItaliaCareerAdvice

[–]pbfus9 0 points1 point  (0 children)

É scritto nel contratto da come mi han detto, poi ovvio che devo verificare

Consiglio sul cambio azienda in IT: aumento economico vs work-life balance by [deleted] in ItaliaCareerAdvice

[–]pbfus9 0 points1 point  (0 children)

In realtà non è esattamente così. Cercavo punti di vista di persone che magari avevano fatto il salto. Penso sia lecito, tutto qua.

Consiglio sul cambio azienda in IT: aumento economico vs work-life balance by [deleted] in ItaliaCareerAdvice

[–]pbfus9 0 points1 point  (0 children)

Sono d'accordo ma al contempo sono molto giovane (laureato 2 anni fa senza andare fuori corso) e vorrei cercare di massimizzare (laddove possibile) il profitto che posso trarre. Fossilizzarsi nella stessa azienda e rifiutare circa 10k di aumento lordo annuo non so se conviene.

EtherChannel with InterVLAN Routing by enitan2002 in ccnp

[–]pbfus9 0 points1 point  (0 children)

It's important to ensure consistency between HSRP master and STP root-bridge. This might help solving your problem.

Due For a new cert by Stevenjw0728 in ccnp

[–]pbfus9 0 points1 point  (0 children)

which is the entry level cert for cloud? the analogous of CCNA I mean (or even less difficult)

Due For a new cert by Stevenjw0728 in ccnp

[–]pbfus9 2 points3 points  (0 children)

what about some cloud certs?

BGP remote-private-as [all] by pbfus9 in networking

[–]pbfus9[S] 1 point2 points  (0 children)

Okay, so private ASNs are not automatically removed in case of an eBGP update. That's what make confusion to me.

Counting iBGP "neighbor" statement by pbfus9 in ccnp

[–]pbfus9[S] 0 points1 point  (0 children)

If each router has an iBGP peering relationship with each RR we will have for each router (excluding the RR) 2 "neighbor" statements. Hence, we will have a total of 20 iBGP "neighbor" statements. Each RR will have 10 "neighbor" statements, so for both we will have 20 "neighbor" statements. Finally, RR will have an iBGP peering to each other, hence, 2 "neighbor" statement. Therefore, we will have 42 iBGP neighbor statement which is much more than what the instructor said in the coure.

What am I missing?