InterVLAN Routing - Layer3 Switch

I try to do inter VLAN Routing without using Router.  Usually if layer 2 switches are used, we have to use a router to do inter VLAN Routing.  I use a standalone layer 3 switch to create VLAN and route packets between them.

Topology

There are 3 PCs in 3 different networks, and a layer3 switch.

Task Breakdown

1. Configure IP Addresses in PCs
2. Create VLANs in switch
3. Configure Layer3 parameters in switch
4. Validate configuration

1. Configure IP Addresses in PCs

PC Name	IP Address	Subnet Mask	Default Gateway
PC-NET-1	172.1.0.100	255.255.0.0	172.1.0.1
PC-NET-2	172.2.0.100	255.255.0.0	172.2.0.1
PC-NET-3	172.3.0.100	255.255.0.0	172.3.0.1

Click on PC-> Desktop -> IP Configuration

Static IP Configuration in PC

2. Create VLANs in switch

Creating 3 VLANs 101, 102, 103 for PC-NET-1, PC-NET-2, PC-NET-3 respectively.

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#vlan 101
Switch(config-vlan)#exit
Switch(config)#vlan 102
Switch(config-vlan)#exit
Switch(config)#vlan 103
Switch(config-vlan)#exit
Switch(config)#

Assign the switch ports fa0/1(connected to PC-NET-1), fa0/2(connected to PC-NET-2) and fa0/3(connected to PC-NET-3) to VLAN 101, 102 and 103 respectively.

PC Name	IP Address	Subnet Mask	Default Gateway	Switchport interface	VLAN ID
PC-NET-1	172.1.0.100	255.255.0.0	172.1.0.1	fa0/1	VLAN 101
PC-NET-2	172.2.0.100	255.255.0.0	172.2.0.1	fa0/2	VLAN 102
PC-NET-3	172.3.0.100	255.255.0.0	172.3.0.1	fa0/3	VLAN 103

Switch(config)#int fa0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 101
Switch(config-if)#exit
Switch(config)#int fa0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 102
Switch(config-if)#exit
Switch(config)#int fa0/3
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 103
Switch(config-if)#exit

3. Configure Layer3 parameters in switch

Configure IP addresses to VLANs like the following.  IP addresses has to match the default gateway configured in the respective PCs

Switch(config)#int vlan 101
Switch(config-if)#ip address 172.1.0.1 255.255.0.0
Switch(config-if)#exit
Switch(config)#int vlan 102
Switch(config-if)#ip address 172.2.0.1 255.255.0.0
Switch(config-if)#exit
Switch(config)#int vlan 103
Switch(config-if)#ip address 172.3.0.1 255.255.0.0
Switch(config-if)#exit
Switch(config)#

To enable layer3 switch's capability to route packets, the following command has to be given

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#ip routing
Switch(config)#exit
Switch#

To view the routing table of the switch

Switch#show ip route 
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is not set

C    172.1.0.0/16 is directly connected, Vlan101
C    172.2.0.0/16 is directly connected, Vlan102
C    172.3.0.0/16 is directly connected, Vlan103

4. Validation 

Ping test has to be done from any PC to the other two PCs

Click on PC-NET-2 -> Desktop -> Command Prompt

Successful Ping from PC-NET-2

Basic VLAN Operation

I am performing a basic operation of VLAN using Packet Tracer.

Topology

It resembles a use case scenario, where 2 PC's from Marketing and Finance are placed in two different buildings.  Each building will have a 3560 multi-layer switch.  A connection is laid between switches.  We need connectivity between MKT-1 and MKT-2.  Also between FIN-1 and FIN-2.

Task Breakdown

1. Setting Devices
2. Creating VLANs in Switch
3. Access Mode Configuration in Switch
4. Trunk Mode Configuration in Switch
5. Validating

1. Setting Devices

• Configure IP Address in PC: Click on PC. Config -> FastEthernet0 -> Static -> 172.1.0.1
• Set hostname in Switch

IP Configuration on PC

Switch#configure t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname BLD-1
BLD-1(config)#

Similarly configure IP Addresses and hostnames for all PCs and Switches as mentioned in Topology diagram above.

2. Creating VLANs in Switch

On both BLD-1 and BLD-2 switches create VLANs 2 and 3 for Marketing and Finance respectively.

BLD-1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
BLD-1(config)#vlan 2
BLD-1(config-vlan)#name MKT
BLD-1(config-vlan)#exit
BLD-1(config)#vlan 3
BLD-1(config-vlan)#name FIN
BLD-1(config-vlan)#exit
BLD-1(config)#exit

Observe that 2 VLANs are created waiting for the ports to be assigned.

BLD-1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24
                                                Gig0/1, Gig0/2
2    MKT                              active    
3    FIN                              active    
1002 fddi-default                     active    
1003 token-ring-default               active    
1004 fddinet-default                  active    
1005 trnet-default                    active   

3. Access Mode Configuration in Switch

• Fa0/1 of BLD-1 to VLAN 2(MKT)
• Fa0/2 of BLD-1 to VLAN 3(FIN)
• Fa0/1 of BLD-2 to VLAN 2(MKT)
• Fa0/2 of BLD-2 to VLAN 3(FIN)

Now we have to assign ports of switches to VLANs 2 or 3 according to the PCs connected.  Here in our case:

BLD-1(config)#int fa0/1
BLD-1(config-if)#switchport access vlan 2
BLD-1(config-if)#switchport mode access
BLD-1(config-if)#exit
BLD-1(config)#int fa0/2
BLD-1(config-if)#switchport access vlan 3
BLD-1(config-if)#exit
BLD-1(config)#exit


Observe the Port assignments to VLAN

BLD-1# show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10
                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22
                                                Fa0/23, Fa0/24, Gig0/1, Gig0/2
2    MKT                              active    Fa0/1
3    FIN                              active    Fa0/2
1002 fddi-default                     active    
1003 token-ring-default               active    
1004 fddinet-default                  active    
1005 trnet-default                    active    

4. Trunk Mode Configuration in Switch

Interconnection of two Switches is through Gig0/1.  They have to pass traffic of VLANs 1 and 2 in it.  So, we make it Trunk mode with encapsulation IEEE Dot11q.

The configuration to be performed on both BLD-1 and BLD-2

BLD-1(config)#int gig0/1
BLD-1(config-if)#switchport trunk encapsulation dot1q
BLD-1(config-if)#switchport mode trunk
BLD-1(config-if)#exit
BLD-1(config)#exit

As Default VLAN 1 is already present in switch and we added VLAN 2 and 3, the resultant trunk port will pass all 3 VLANs traffic.

BLD-2#show int trunk
Port        Mode         Encapsulation  Status        Native vlan
Gig0/1      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gig0/1      1-1005

Port        Vlans allowed and active in management domain
Gig0/1      1,2,3

Port        Vlans in spanning tree forwarding state and not pruned
Gig0/1      1,2,3

5. Validating

To make sure our configuration works (without negative test cases involved), Following ping test should pass

• MKT-1 (172.1.0.1) to MKT-2 (172.1.0.2)
• FIN-1 (172.2.0.1) to FIN-2 (172.2.0.2)

Click FIN-1. Desktop -> Command Prompt

wireshark: Viewing encrypted PSK2AES packet

In case, we capture packets encrypted with WPA/WPA2-PSK security in wireshark.  Now, to see that we can do the following procedure.

• Go to Edit -> Preferences to open the Preferences dialog box.
• Expand Protocols and select IEEE 802.11.
• Select: Enable decryption
• Edit: Decryption Keys
• Go to WEP and WPA Decryption window
• Key type: wpa-pwd
• Key: <passphrase>:<ssid>
• Example: 12345678:4366ap
• Click 'Apply' and 'Ok' on all corresponding nested windows.

Radius Server with Linksys WRT 300N - PT

I am trying to demonstrate the working of Radius Server on Packet Tracer 7.1.  Components I have are

• End Devices -> Server - PT (Radius Server)
• Wireless Devices -> WRT300N (Linksys Wireless Router)
• End Devices -> Laptop - PT (Wireless Client

Topology

First, we have to insert Wireless adapter in 'Laptop0'.  See the post Basic Wireless with Linksys WRT 300N

Connect ethernet cable(copper straight-through) from Ethernet1 of WRT300N to FastEthernet0 of Server-PT.

1. Click 'Connections' -> 'Copper Straight-through'
2. Click WRT300N, select Ethernet1 from the dropdown
3. Click on Server-PT , select FastEthernet0 from the dropdown.

IP Address Configuration

• Wireless Router will have default IP address
• On Server configure '192.168.0.10/24' 
• Click 'Server' -> 'Config' tab -> 'FastEthernet0' -> 'Static' from 'IP Configuration' -> IP Address '192.168.0.10' ; Subnet Mask '255.255.255.0'
• In Laptop, set DHCP

Aim

Establish wireless connection from laptop to WRT300N thru WPA2-AES security with the help of Radius Server

AAA Configuration in Server 

Server AAA Configuratioin

1. Click 'Server' -> 'Services' tab -> 'AAA' section
2. Add Linksys WRT300N as a Radius Client
• Service 'On' -> Client Name 'actrouter' ; Client IP '192.168.0.1' (IP Address of Wireless Router) ; Secret 'actkey' ; ServerType 'Radius' ; Click 'Add' 
3. Add a User who will connect from laptop
•  Username 'actuser' ; Password 'actpass' ; Click 'Add'

AAA Configuration in Router

Router AAA Configuration

1. Click 'Router' -> 'Config' tab -> 'Wireless' section
2. SSID 'actwifi' -> Authentication 'WPA2' -> Encryption Type 'AES'
3. Radius Server IP and Credentials
• IP Address '192.168.0.10' ; Shared Secret 'actkey'

AAA Configuration in Laptop

Laptop AAA Configuration

1. Click 'Laptop' -> 'Config' tab -> 'Wireless0' section
2. SSID 'actwifi' -> Authentication 'WPA2' -> Encryption Type 'AES'
3. Radius user credentials configuration
• User ID 'actuser' Password 'actpass'
4. IP Configuration is DHCP

Connection Success

Wireless Connection between Laptop and WRT300N will be visible.

Connection Testing

Open the command prompt of Laptop, and verify ping to WRT300N and Radius Server.

Basic Wireless with Linksys WRT 300N - PT

Using Cisco Packet Tracer 7.1

Setup will comprise 2 components

1. Linksys WRT 300N wireless router (Network Devices -> Wireless Devices ->WRT300N)
2. Laptop ( End Devices -> End Devices -> Laptop)

Laptop by default do not contain wireless card.  We have to physically configure like the following:

1. Click on laptop -> 'physical' tab 
2. Click and drag the ethernet module on the image, to the left panel.  A empty slot will be created
3. Click and drag 'WPC300N' to the empty slot

Aim, is to establish connection from laptop to router thru WPA2-AES wireless encryption.

We configure on wireless router 

1. Click router -> 'Config' tab -> 'Wireless' section
2. SSID 'actwifi' ; Authentication 'WPA2-PSK' ; PSK Pass Phrase '12345678' ; Encryption 'AES'

Router Configuration

Now laptop configuration

1. Click laptop ->'Config' tab -> 'Wireless' section
2. SSID 'actwifi' ; Authentication 'WPA2-PSK' ; PSK Pass Phrase '12345678', Encryption Type 'AES'
3. IP Configuration 'DHCP'

Move the mouse over laptop, information of wireless connection(Data rate, signal strength) and DHCP alloted IP address 192.168.0.101 can be seen.

Connection Success

To verify ping, click laptop -> 'Desktop' tab -> 'Command Prompt' -> Issue ping command.

TCP open connection with scapy

Today, I am going to try to create TCP 3-way connection with the help of scapy and iperf.  The full wireshark capture is

TCP 3-way Connection

192.168.1.10 (client: port 40508: scapy) ------->> 192.168.1.200 (server: port 5000: iperf)

As we donot have a conventional TCP client program running on the client side.  Whenever server sends SYN-ACK packet to client, the kernel on the client responds with Reset TCP connection.  To avoid this, we should place a rule in IPTables, to drop any Reset's packets initiated from client side.  This can be done using the following command on the client side:

# iptables -A OUTPUT -p tcp --tcp-flags RST RST -s 192.168.1.10 -j DROP

On the server side, we create a server listening on port 5000, using 

# iperf -s -p 5000
------------------------------------------------------------
Server listening on TCP port 5000
TCP window size: 85.3 KByte (default)
------------------------------------------------------------

In another session, observe that the output of netstat command, its in listen state

# netstat -na | grep 5000
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN

On the client side, we open scapy session, send a TCP SYN packet and receive the response.  sr1 implies send (ip/SYN) and wait till ONE response is received.

# scapy
INFO: Can't import python gnuplot wrapper . Won't be able to plot.
INFO: Can't import PyX. Won't be able to use psdump() or pdfdump().
INFO: Can't import python Crypto lib. Won't be able to decrypt WEP.
INFO: Can't import python Crypto lib. Disabled certificate manipulation tools
Welcome to Scapy (2.2.0)
>>>
>>> ip=IP(src="192.168.1.10",dst="192.168.1.200")
>>> SYN=TCP(sport=40508,dport=5000,flags="S",seq=0)
>>> SYNACK=sr1(ip/SYN)
Begin emission:
.......Finished to send 1 packets.
.*
Received 9 packets, got 1 answers, remaining 0 packets

Netstat on the server side, the state would have been

# netstat -na | grep 5000
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN
tcp        0      0 192.168.1.200:5000      192.168.1.10:40508      SYN_RECV

Now, on the client, we create and send the 3rd handshake message ACK to complete the TCP connection. This has to be sent as quick as possible, because there is a chance that the server may have timed out and dropped the TCP connection.

>>> ACK=TCP(sport=40508,dport=5000,flags="A",seq=SYNACK.ack+1,ack=SYNACK.seq+1)
>>> send(ip/ACK)
.
Sent 1 packets.

Netstat shows that the TCP connection is established.

# netstat -na | grep 5000
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN
tcp        0      0 192.168.1.200:5000      192.168.1.10:40508      ESTABLISHED

DHCP Broadcast - Notes

In my last post on DHCP, DHCP Offer and DHCP ACK were unicast frames.

DHCP Unicast Flag

In the Bootp Flags, the broadcast bit is set to 0(means unicast).  It means DHCP Client tells that it is expecting unicast responses from DHCP server.  So, the reply from DHCP server(DHCP Offer and DHCP ACK) will have Unicast MAC and IP Addresses. 

On a linux machine, this can be seen using command 'dhclient eth0'

Broadcast

There are cases when they will be broadcast.  From linux machine, we can use 'dhclient -B eth0' to request Broadcast responses.  Most of the times, DHCP starts from DHCP Offer, instead of Discovery.  So, by googling I found that we had to release the existing IP address for the transaction to happen from Discovery.  Like this

# dhclient -r  eth0
# dhclient -B  eth0

DHCP Broadcast

Observe that the Bootp flag here is '1'(means Broadcast flag set).  Client is asking the server to give broadcast responses.  Therefore, the DHCP Offer and ACK from the server has broadcast MAC and IP addresses.