Isn’t it always the way? You get a new job, a new wife and family and important things like blogging go out the window.

I have been extremely busy with all the above, but will spare you the boring details and get onto the good stuff.

Recently I have been doing a fairly large scale migration from Autonomous Wireless Access points to Light Weight Access points. This means implementing a Cisco Wireless Lan Controller and installing a “light weight” IOS so the Wireless Access points can be managed by the controller. No more dispersed SSIDs or inconsistent security.

The environment, most interestingly, consists of 1200 series, 1250 series and two 1310 outdoor controllers.

From Cisco;

A Cisco Aironet 1300 Series device operating autonomously is an intelligent access point or bridge, capable of functioning as a standalone device. As an LWAPP access point, the Cisco Aironet 1300 Series works along with the Cisco wireless LAN controller to enable centralized configuration and management, application of security policies, and seamless mobility. When operating with wireless LAN controllers, Cisco Aironet 1300 Series Outdoor Access Points/Bridges function only as access points and are not capable of bridging.
The integrated antenna versions feature a radio and high-gain patch antenna for user installations of either point-to-point links or non-root nodes of point-to-multipoint networks. The connectorized versions provide professional installers with RP-TNC type connectors that allow the deployment of nodes with omnidirectional, sector, or high-gain dish antennas for longer links. In all cases, the mounting kit must be ordered separately.
All parts, along with accessories such as the Roof Mount Kit, Wall Mount Kit, cable, antennas, and power supplies, are available on the Cisco Systems® global and wholesale price lists.

So it’s designed for outdoors, which is great! However, at the remote end, it keeps getting screwed up by the upgrade process and I have to nuke both sides to reconfigure them to be autonomous. I’m serious, delete /force /recursive flash:!

That scares the SHIT out of me and I’ve been forced to do it two or three times! The first time we transferred the IOS back onto both ends via console ie. 9600 bps. This was not any fun at all. Logically, there has to be a better way.

After nuking the device back to the stone age, issue the following commands:
set IP_ADDR A.B.C.D
set DEFAULT_ROUTER W.X.Y.Z
set NETMASK XXX.XXX.XXX.XXX
tftp_init
tar -xtract tftp://IPADDR_OF_TFTP_SERVER/ios.tar flash:
set BOOT flash:/c1310-k9w7-mx.124-21a.JA1/c1310-k9w7-mx.124-21a.JA1

The only thing to look out for is make sure the TFTP server is reachable by the access point. And make sure you set the BOOT option to boot to the correct directory and file in flash. As you can see above, I am booting from the flash directory c1310-k9w7-mx.124-21a.JA1 and a file called c1310-k9w7-mx.124-21a.JA1. A simple dir flash: will start to get you on the right track.

1. After the completion of the link establishment phase, the authenticator sends a “challenge” message to the peer.
2. The peer responds with a value calculated using a one-way hash function, such as an MD5 checksum hash.
3. The authenticator checks the response against its own calculation of the expected hash value. If the values match, the authenticator acknowledges the authentication; otherwise it should terminate the connection.
4. At random intervals the authenticator sends a new challenge to the peer and repeats steps 1 through 3.

An example of CHAP authentication can be seen between two Cisco 3640 routers. The network is a fairly simple on and looks like this:

After enabling the serial interfaces between the two routers, I enable and configure PPP encapsulation. On the second router (R2) , I enable CHAP authentication and view debugging information on the first router (R1)


*Mar 1 00:25:39.971: Se1/0 PPP: Using default call direction
*Mar 1 00:25:39.975: Se1/0 PPP: Treating connection as a dedicated line
*Mar 1 00:25:39.975: Se1/0 PPP: Session handle[26000001] Session id[0]
*Mar 1 00:25:39.975: Se1/0 PPP: Authorization required
*Mar 1 00:25:40.255: Se1/0 PPP: No authorization without authentication
*Mar 1 00:25:40.259: Se1/0 CHAP: I CHALLENGE id 1 len 23 from "r2"
*Mar 1 00:25:40.299: Se1/0 CHAP: Unable to authenticate for peer
R2 is waiting for authentication from R1 and is unable to get authentication information. Now I configure CHAP authentication on r1 and observe the following:

*Mar 1 00:26:26.867: Se1/0 LCP: Received AAA AUTHOR Response PASS
*Mar 1 00:26:26.867: Se1/0 IPCP: Received AAA AUTHOR Response PASS
*Mar 1 00:26:26.871: Se1/0 CHAP: O SUCCESS id 12 len 4
*Mar 1 00:26:27.055: Se1/0 CHAP: I SUCCESS id 15 len 4
*Mar 1 00:26:27.059: Se1/0 PPP: Sent CDPCP AUTHOR Request
*Mar 1 00:26:27.063: Se1/0 PPP: Sent IPCP AUTHOR Request
*Mar 1 00:26:27.071: Se1/0 CDPCP: Received AAA AUTHOR Response PASS
*Mar 1 00:26:28.055: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up
The shared secret is exchanged between the two and the Serial interface is changed to an up state.

You have been given the network range 192.168.128.0/24. Your task is to break it down into six networks. The questions you have to answer are, how many hosts on each network, and what are the network IDs and broadcast IDs for each of the networks.

I will post the answer on Friday 12th December, 2008 at 3:30pm EDST.

Sorry for the lateness of the solution. I have been as sick as a dog for the last few days, hence no update.

Last time we talked breaking networks up based on host requirements. This time we’re working with the network portion of the IP address.

When we were working with hosts, we worked from the thirty-second bit. Or, from right to left. This time we’re working from left to right to break up an IP range.

Let’s look at the IP address in binary first. Because it’s a twenty-four bit subnet mask, this tells us that it’s a Class C network and that the first three octets are locked and can’t be changed. Therefore, we will be breaking up the fourth octet.
192.168.128.00000000
255.255.255.00000000

Similarly to subnetting for hosts, subnetting for networks is achieved by modifying the subnet mask. So rather than working from the last bit leftwards, let’s start with the first bit I am allowed to modify and work to the right. In our example, the twenty-fifth bit (the first bit of the fourth octet).

For each bit I change, I get 2^bits networks. Unlike hosts, I don’t lose the first IP address to the network ID or the last IP address to the broadcast. Therefore, if I use one bit I get two usable networks. If we extend this to cover our example, two bits gives me four networks (still not enough!). Can I get exactly six networks? Because I’m working with binary values (powers of two), it’s not possible to get exactly six networks. If I use three bits, I get eight networks. More than the required six.

First thing’s first: the subnet mask. The original Class C has been subnetted. Now I am using the first three bits of the fourth octet as the network portion. It did look like this: 255.255.255.00000000. Now, after subnetting, it looks like this: 255.255.255.11100000 or, (after converting back to decimal) 255.255.255.224.

My networks look something like this (the spaces represent the division between my new network ID and new host ID):
192.168.128.000 00000
192.168.128.001 00000
192.168.128.010 00000
192.168.128.011 00000
192.168.128.100 00000
192.168.128.101 00000
192.168.128.110 00000
192.168.128.111 00000

How many hosts on each network? Seeing that we are using three bits for the network, the remaining five bits are the host portion ie. (2^5)-2 hosts or 32-2 hosts. A total of 30 hosts per network. Going back to the last tutorial, the host portion can’t be all zeroes, nor can it be all ones.

Therefore, my network ranges look like this:
192.168.128.000 00000 192.168.128.000 11111
192.168.128.001 00000 192.168.128.001 11111
192.168.128.010 00000 192.168.128.010 11111
192.168.128.011 00000 192.168.128.011 11111
192.168.128.100 00000 192.168.128.100 11111
192.168.128.101 00000 192.168.128.101 11111
192.168.128.110 00000 192.168.128.110 11111
192.168.128.111 00000 192.168.128.111 11111

Any questions or problems, please email me contactme@invurted.com or my work email address.

So, fixed length subnet masking example #1 is this:

You have been given the network range 192.168.128.0/22. Your first task is to break this network up into blocks of one hundred IP addresses. How many blocks of IP addresses will you get (how many networks will you have)? What are the network IDs and what are the broadcast IP addresses for each of the network ranges?

I will post the answer on Tuesday 9th December, 2008 at 10:30am EDST.

Okay. The question specifically asks for hosts. Therefore, we are working from the thirty second bit back to the start to get hosts.

The original subnet mask is a /22 (255.255.252.0). This tells me that the first twenty two bits are “locked away” leaving me the last ten bits to play with. Straight away we can discern at least one piece of information about my network: there are 2^10 total hosts in the network ie. 2^#bits that aren’t locked away, or one thousand and twenty four total hosts.

On to the good stuff. If we look at the IP address in it’s binary format we have to do a decimal to binary conversion on the third and fourth octets. By looking at the subnet mask this tells me it’s not a full block of eight bits in the third octet and the fourth is all zeroes.

Which looks something like this:
192.168.10000000.00000000
255.255.11111100.00000000
Notice twenty two contiguous ones and ten contiguous zeroes.

As previously mentioned, I want hosts. So, I am working from the last bit leftwards. Each zero represents two hosts (1 and 0). Every time I go up a column, I am adding a power of two to the total number of hosts. If I use one column (the thirty-second bit), I have 2^1 hosts, two columns gives me 2^2 hosts etc. Can I get exactly 100 hosts for the network? The answer is no. If I use the last six bits I have sixty-four hosts (2^6), well below the required one hundred hosts! Let’s use the last seven bits. This gives me 2^7 hosts. One hundred and twenty eight is well above the one hundred required, but is the nearest value over one hundred I get given I have to count in powers of two.

My new subnet mask now looks something like this:
192.168.100000 00.0 0000000
255.255.111111 11.1 0000000
The spaces show the modifications that I have made to the network range given the requirements of the scenario.

The three bits between the spaces are telling me what networks I am now defining. Three bits, straight away, tells me I have 2^3 or eight networks in total. The network part of the IP address has to be unique. The eight unique combinations of the network ID are:
192.168.100000 00.0 0000000 (192.168.128.0)
192.168.100000 00.1 0000000 (192.168.128.128)
192.168.100000 01.0 0000000 (192.168.129.0)
192.168.100000 01.1 0000000 (192.168.129.128)
192.168.100000 10.0 0000000 (192.168.130.0)
192.168.100000 10.1 0000000 (192.168.130.128)
192.168.100000 11.0 0000000 (192.168.131.0)
192.168.100000 11.1 0000000 (192.168.131.128)


The rules of TCP/IP state that the host ID can’t be all zeroes and it can’t be all ones. The all zeroes address is the network ID and the all ones address is the broadcast IP address for that network.

In our example, the last six bits are the host ID. Therefore, the network IDs are up above and the broadcast IP addresses are:
192.168.100000 00.0 1111111 (192.168.128.127)
192.168.100000 00.1 1111111 (192.168.128.255)
192.168.100000 01.0 1111111 (192.168.129.127)
192.168.100000 01.1 1111111 (192.168.129.255)
192.168.100000 10.0 1111111 (192.168.130.127)
192.168.100000 10.1 1111111 (192.168.130.255)
192.168.100000 11.0 1111111 (192.168.131.127)
192.168.100000 11.1 1111111 (192.168.131.255)


Any questions or problems, please email me contactme@invurted.com or my work email address.

Stay tuned because I’ll post another example later this week.

Speaking at the Networkers conference Dylan Morrison, Cisco’s data centre general manager for Australia and New Zealand, confirmed the jointly developed products will be sold through joint partners. “Both our traditional partners will already have skills in both VMware and Cisco.”

To learn more and to read the entire article at its source, please refer to the following page, Reseller News – Cisco, VMware make worlds collide

(Like my life isn’t hard enough!)