Cisco Access Servers

[LoneWolf]

Pretty sure they cover RIP, RIPv2, IGRP & EIGRP in CCNA (don't think they do OSPF, IS-IS & BGP) but I can't really remember.

yes, OSPF is also covered in CCNA. we didn't touch on IS-IS though

 

[ponder]

yes, OSPF is also covered in CCNA. we didn't touch on IS-IS though

My two favourite routing protocols

 

[MidnightWizard]

Still at it

Sorry to bore you all some more

There is still something I do not get ( Oh NO ! :erm: )

( I tend to do things back to front -- which is tedious -- but leads one onto roads less explored )



I have a 2511RJ and a 2522 hooked up both on the same segment ( lets say 192.168.10.x /24 ) -- through an unmanaged switch.

Both have private IP addresses ( as above ) on the LAN segment they can both be pinged and telnetted into via the PC as well as each other.

I have set an IP host entry for the 2522 on the 2511

The loopback is set to 192.168.1.1 /32

The Eth 0 is set to 192.168.10.3 /24 ( want to see it on the LAN )

I can Telnet to the 2522 from the 2511 CLI using 192.168.1.1 : 2001
( or just using the host name )

However from an XP command prompt ( machine IP set at 192.168.10.30 /24 I cannot telnet to the 2522 via 192.168.1.1 2001
I CAN however telnet to the 2511 eth IP using 2001 ( First Line of 2511 ) and this takes me straight to a session with the 2522.

One one level this makes compete sense to me as the IP addresses / networks are competely different in the case of the loopback.

On the other I am not understanding how the Loopback works ?
In all the examples I have seen they just say telnet to the loopback ? Which is weird as correctly mentioned by ponder a loopback has NO physical interface ?

I thought that the IP host entry linking the remote host to the loopback IP would act as some sort of internal default route ????

This does not appear to be happening ?

What am I missing / doing wrong / not understanding

 

[ponder]

Post the configs of both routers please, just easier to read.

 

[MidnightWizard]

Puzzle

OK
Here are the important bits
Disclaimer -- work in progress


2511

version 11.3
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname AS-2511RJ
!
enable secret XXXXXXXX 
!
partition flash 2 8 8
!
ip subnet-zero
ip host FR-2522 2001 192.168.1.1
!
clock timezone SAST 2
!
!
interface Loopback0
 ip address 192.168.1.1 255.255.255.252
 no ip directed-broadcast
!
interface Ethernet0
 ip address 192.168.10.3 255.255.255.0
 no ip directed-broadcast
 no ip mroute-cache
!
interface Serial0
 no ip address
 no ip mroute-cache
 shutdown
 no fair-queue
!
ip classless
!
line con 0
 exec-timeout 30 0
 logging synchronous
 notify
 history size 64
 stopbits 1
 flowcontrol hardware
line 1 16
 session-timeout 30  output
 no exec
 exec-timeout 0 0
 transport input all
line aux 0
line vty 0 4
 session-timeout 60 
 exec-timeout 30 0
 password XXXXXXXX
 logging synchronous
 login
 notify
 history size 48
 transport preferred telnet
 transport input SSH telnet
 transport output SSH telnet
!
end

AS-2511RJ#

2522

version 11.3
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname FR-2522
!
enable secret XXXXXXX
!
clock timezone SAST 2
!
!
interface Ethernet0
 ip address 192.168.10.7 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip directed-broadcast
 no ip proxy-arp
 no ip route-cache
 no ip mroute-cache
 no cdp enable
!
interface Serial0
 no ip address
 no ip route-cache
 no ip mroute-cache
 shutdown
!
interface Serial1
 no ip address
 no ip route-cache
 no ip mroute-cache
 shutdown
!
interface Serial2
 no ip address
 shutdown
!
interface Serial3
 no ip address
 shutdown
!
interface Serial4
 no ip address
 shutdown
!
interface Serial5
 no ip address
 shutdown
!
interface Serial6
 no ip address
 shutdown
!
interface Serial7
 no ip address
 shutdown
!
interface Serial8
 no ip address
 shutdown
!
interface Serial9
 no ip address
 shutdown
!
interface BRI0
 no ip address
 no ip route-cache
 no ip mroute-cache
 shutdown
!
ip classless
!
!
line con 0
 session-timeout 60 
 no exec-banner
 exec-timeout 30 0
 password XXXXXXXX
 logging synchronous
 login
 terminal-type Access-Server
 notify
 history size 48
 transport preferred telnet
 stopbits 1
 flowcontrol hardware
line aux 0
 transport input all
line vty 0 4
 session-timeout 60 
 no motd-banner
 no exec-banner
 exec-timeout 30 0
 password XXXXXXXX
 logging synchronous
 login
 notify
 history size 48
 transport preferred telnet
 transport input telnet
 transport output telnet
!
end

FR-2522#

 

[ponder]

The XP machine does not know about "ip host FR-2522 2001 192.168.1.1" only the 2511 does. It's not on a directly connected network. Try adding it to the host file on XP as well. If that still does not work you will have to add a route to it.

 

[MidnightWizard]

More Confusion

The XP machine does not know about "ip host FR-2522 2001 192.168.1.1" only the 2511 does.
It's not on a directly connected network.
Try adding it to the host file on XP as well.
If that still does not work you will have to add a route to it.

Sure -- this much I know and understand.

SO then WHY have a loopback interface and on a different network segment ?
( this is the way it is setup in all the examples I have seen-- and most of them are PRIVATE IP addresses. )

What I am not picking up , is what I see in a lot of the examples I find on the net

ie -- just telnet to the loopback interface ( I am pretty sure that by this they mean using a PC ) --
NOWHERE do I see mention of hosts files or adding routes. ( Perhaps they take this for granted -- or perhaps it is working in some other mysterious way ? )

If one cannot reach the loopback interface without a lot of PT , then WHAT is the point of setting it all up ?
Do I need an entry in EVERY PC's hosts file ?

To be able to telnet to the terminal server / access server, you can either stick with the IP address of that device or you can create a loopback adaptor.

To create a dedicated loopback adaptor for this purpose, do this:

Router(config)# interface loopback0

Router(config-if)# ip address 192.168.1.1 255.255.255.255

Now, add the devices, as IP aliases, that are connected to each of the async cables (your routers & switches), with their respective cable/line number:
Router(config)# ip host host1 2001 192.168.1.1
Router(config)# ip host host2 2002 192.168.1.1

Where it says "2001", for example, the "1" is the cable/line number that that device is connected to.

This means that you could either telnet to the console of the connected "host1" by just telnetting to 192.168.1.1 2001
OR
You could first telnet to the access server, then just twohost1 to telnet to that host.

[ This stuff below is all fine and straight forward ]

Once connected to the device, you can switch between active sessions by using ctrl-shift-6-x to bring you back to terminal server.

You can use show sessions to display the active sessions, and to go back to your session just press enter for the last session or the session number of that session.

To disconnect a session use the disconnect command.

After all this hassle one might as well just telnet to the damn hosts themselves.

 

[ponder]

1. If one cannot reach the loopback interface without a lot of PT , then WHAT is the point of setting it all up ?
2. Do I need an entry in EVERY PC's hosts file ?

1. See post#14. Many people don't even use loopback interfaces but it does have it's uses.
2. Yes. How else would they know about it?

Just a suggestion. Take the CCNA course material and start with chapter one working yourself towards the last chapter in sequence. Things will make a lot more sense this way.

 

[MidnightWizard]

Course

1. See post#14.
Many people don't even use loopback interfaces but it does have it's uses.

2. Yes. How else would they know about it?

Sure -- I just want to know how it works in an AS

Sure I know that -- I was being facetious :twisted:

Just a suggestion.
Take the CCNA course material and start with chapter one working yourself towards the last chapter in sequence.
Things will make a lot more sense this way.

I had a look at the index of a VERY well known book -- I only found Access-Server in the glossary

I am past "sense"

( I have the devices -- I can test // for-real// )

Have a look here

How To Configure An Access Server For A CCNA And CCNP Lab

and here

Cabling Your CCNA / CCNP Home Lab Access Server

Quite obviously connecting to the AS via a console cable -- does not tell you much or go into detail


To shorten and summarise .....

1.) Can you telnet to the AS loopback interface from "outside" ?

2.) If so HOW do you do this ?


Here are some more pointers

Configure a Loopback Interface

One use of such an interface is to simply assign an IP address to the router as a whole rather than to a specific hardware interface.

This allows the assigned IP address to be used to access the router, for example, Telnet, regardless of which real interfaces are up or down

This intimates to me that there must be some form of internal mapping taking place between the loopback interface and some PHYSICAL interface / s

Again NOT explained properly


From the official Cisco pages

Configuring a Terminal/Comm Server

TROUBLESHOOTING PROCEDURE

4.)
Establish a Telnet connection to the IP address port to test direct connectivity.
You must telnet from both an external device and the terminal server. For example, telnet 172.21.1.1 2003.

172.21.1.1 2003 in their example is the loopback interface.

Also seems to intimate "outside" telnet to the loopback.



You want explanation ?

Ping Loopback OSI layers

 

[Roman4604]

NOWHERE do I see mention of hosts files or adding routes. ( Perhaps they take this for granted

Yes

If one cannot reach the loopback interface without a lot of PT , then WHAT is the point of setting it all up ?
Do I need an entry in EVERY PC's hosts file ?

You could, but in practice PCs generally would be using the default route.

After all this hassle one might as well just telnet to the damn hosts themselves.

The hassle is worth it, if you understand why. Maybe a practical example ...

- Imagine 4 routers each with 2 Ethernet interfaces directly connected to each other with crossover cables, in a square
- One router, A would be your AS with the loopback, connected to B and C
- Router D is also connected to B and C, but would also have a 3rd interface to which your PC is connected
- The routers all run a routing protocol (e.g. EIGRP) on all their interfaces, so they are aware of the all networks connected to all routers
- The PC has a default route to the IP of the connected router's interface facing it.

Now if the PC were to connect to the AS using its 1st Ethernet IP, connectivity would be lost if router B goes down. Similarly if the 2nd Ethernet IP is used and router C goes down.

However if one connects to the loopback interface, there would be no loss of connectivity if either B or C went down. Traffic would just re-route around the problem router.

This is basically the benefit of using loopback IPs as your connection target.

Just a suggestion. Take the CCNA course material and start with chapter one working yourself towards the last chapter in sequence. Things will make a lot more sense this way.

I think you should heed Ponder's suggestion, that is to focus on grasping the fundimentals of IP routing before tackling fancy stuff like Access Servers.

 

[MidnightWizard]

Thanks

Thanks for your assistance -- and ponder

However if one connects to the loopback interface, there would be no loss of connectivity if either B or C went down. Traffic would just re-route around the problem router.

OK please stop right there

HOW does "one" connect to the loopback interface

This is basically the benefit of using loopback IPs as your connection target.

Until I can understand this ( how you connect to a virtual interface ) nothing else makes sense

I think you should heed Ponder's suggestion, that is to focus on grasping the fundimentals of IP routing before tackling fancy stuff like Access Servers.

I am kinda stuck here now -- have to get this sorted first. before becoming a "fundi-mental"

In any case connecting to a loopback interface is a hardware issue rather than an IP routing thing.

Over to you boss

 

[Roman4604]

HOW does "one" connect to the loopback interface

By specifying its IP address (rather than a physical interface's), when connecting from the PC (i.e. in Putty or whatever telnet/ssh client you're using).

 

[MidnightWizard]

Aaahhh ( Not )

By specifying its IP address (rather than a physical interface's), when connecting from the PC (i.e. in Putty or whatever telnet/ssh client you're using).

Aahh OK

I am trying to look at this step by step.

I know that if I telnet to an IP that is set on the eth then the transaction is pretty straightforward. ( Not connecting to loopback )


What you describe seems to me to be quite a bit more involved --

Does the PC IP have to be in the same subnet as the loopback ?

IF it is , by which mechanism does it connect with a physical interface that is on a different subnet ? ( Serial or Ethernet )

Say the loopback is on 192.168.1.1

The eth is on 192.168.10.1

If the PC is on 192.168.1.10 ( loopback subnet ) then how does it connect to the eth which is on 192.168.10.1 and thereby the router ?

All I can see is that there must be some sort of translation / mapping ?

I have NO idea where and how is this done ?

Further -- as I understand it each subnet must have a router on it's subnet in order to route (pass on traffic) to another subnet. ( "next hop" -- via that subnets router )

To my understanding what we have here is a complete impasse


I have tried setting the PC to the same subnet as the loopback and doing what you say here. However this did not work -- hence head scratching.

If I set the PC IP to the eth and try to telnet to the loopback IP this does not work either.

One 2511 , One 2522 , One PC , One unmanaged switch

( Can connect to all ( in turn) using console -- but that has NO IP )

 

[Roman4604]

I have tried setting the PC to the same subnet as the loopback and doing what you say here. However this did not work

This cannot work, the loopback is a routed inf. The PC is connected to the router via an Eth, which is a seperate routed inf, therefore the two cannot be on the same subnet (unless Lo & Eth are bridged).

If I set the PC IP to the eth and try to telnet to the loopback IP this does not work either.

The is the correct config, but the PC cannot connect to the loopback because it does not know about the loopback's subnet.

You could add a static route, but the norm is to set the PC's default gateway to the router's Eth IP (one connecting to PC).

 

[MidnightWizard]

Eureka

This cannot work, the loopback is a routed inf.
The PC is connected to the router via an Eth, which is a seperate routed inf, therefore the two cannot be on the same subnet (unless Lo & Eth are bridged).


The is the correct config, but the PC cannot connect to the loopback because it does not know about the loopback's subnet.
You could add a static route, but the norm is to set the PC's default gateway to the router's Eth IP (one connecting to PC).

Thanks for your patience -- sorry for being such a doofus

Works like a charm ( and fixes that piece in the jigsaw )

Couple of little wrinkles to iron out which I am working on ......

If I set the PC gateway to the AS eth I can telnet via PC straight through the AS to the 2522 (FRS) 2001 ( first line )

However there is a problem in terminating the session. I am connected to the con 0 of the 2522 via PC telnet.

How do I disconnect the session ?

ANSWER:

Use Cntrl+] to exit back to MS Telnet then quit to end Telnet session


I am also lookiing at the MS loopback -- bridging , static routes and default gateways on the PC
( So as to be able to have access to the normal internet ( ADSL ) as well as the loopback of the AS ( and the rest )
A dual eth NIC could be the way to go to keep everything seperate ?

To add a static route in XP ( General notation )

route -p add 192.168.1.0 mask 255.255.255.0 192.168.10.3 metric 7


"Happy days are here again" ( for a short time -- testing continues )