TSHOOT: Troubleshooting & Maintaining Cisco (Part1 of Part2)

Plan maintenance for complex networks by outlining strategies and steps covered in this chapter for effective reliability and uptime.

Explain itil as a best-practices framework for it service management and fcaps—fault, configuration, accounting, performance, security management—and Cisco’s ppdio lifecycle.

Explore configuration management element of the CPS, detailing schedule configuration backups, manual backups, automatic configuration checking, and mirrored offsite backups for disaster recovery with enmasse schedulers and fpp/fgp servers.

Explore network maintenance processes and procedures, including installation and configuration of new devices, backups, and troubleshooting. Monitor performance, capacity planning, apply software upgrades, and maintain documentation to support reliable services.

Explore network maintenance planning, including scheduling maintenance windows, change control procedures, and disaster recovery. Learn to formalize documentation, templates, communication, and conventions to reduce downtime and clarify responsibilities.

Explore Cisco IOS CLI management, including show and debug commands and embedded event manager, accessible via serial console or Telnet/SSH, with GUI tools for backups and logging.

Shows configuring a Cisco device to use NTP with time server at 10.1.23, sets Pacific Standard Time with DST, and enables timestamps with time zone and millisecond precision for logs.

Explore Cisco logging levels from emergencies to debugging, how to filter messages, and how RAM buffers and circular buffers store logs for display with show logging.

Learn to use capacity planning and network monitoring tools to establish a baseline, monitor trends, and verify SLA compliance while diagnosing performance problems.

Explore implementing backup and restore services using FCP, with examples of copying using FGP with a specified user name and password, and storing those credentials in a configuration.

Learn to implement backup and restore services using the configure replace command, navigate privilege exec and global configuration modes, and roll back changes.

Create a physical and logical topology in a simulator using three routers, two multilayer switches, a layer-2 switch, PCs, and a server; implement redundant links with spanning tree.

Highlight how IT acronyms shape understanding, detailing ITIL (IT infrastructure library) by UK OGC, FCAPS (fault, configuration, accounting, performance, security), TMN, and Cisco's PPDIOO (prepare plan design implement operate optimize).

Learn troubleshooting processes for complex enterprise networks within Cisco environments, focusing on systematic approaches to identify, diagnose, and resolve network issues.

Identify troubleshooting principles, evaluate pathologies from chapter 1, and plan and implement structured troubleshooting procedures, along with network maintenance steps, to effectively support each other.

Compare shoot-from-the-hip troubleshooting with structured methods used in Cisco maintenance, emphasizing analyze and eliminate, gathering information, and forming and testing hypotheses to avoid unverified solutions.

Explore troubleshooting approaches based on the OSI model, including top-down and bottom-up methods, divide-and-conquer strategies, and difference spotting, with practical use of ping and tracer tools.

Use show ip route to inspect the routing table. The spot the difference example shows how missing a static default route, a gateway of last resort, blocks packets.

Implement a network troubleshooting procedure built on elementary subprocesses, with action plan, assigning responsibilities and resources, information gathering (logs, tickets, Wireshark), hypothesis testing, and communication to find and solve problems.

Verify and define the problem after a report, use a troubleshooting ticket system, gather information, assign the issue, and decide to solve or escalate to tier 2 or 3.

Define the problem, establish a plan, identify targets across one machine or the entire network, assemble toolkits and access, then analyze information and escalate if needed.

Analyze assumptions, identify potential causes, and eliminate them to refine the hypothesis in the troubleshooting process.

Test hypotheses to find a solution, and assess its impact and urgency. Apply a rollback plan if the fix creates further problems; if unresolved, return to gather more information.

Explore how a test hypothesis guides troubleshooting by incorporating the solution, report the solution, and confirm that the problem is solved.

Document accurately to underpin effective troubleshooting by collecting per-link and device performance statistics via snmp and netflow, wireshark measurements, and ip sla latency and jitter.

Communicate clearly across all phases of structure troubleshooting to verify and clarify the reported problem, gather and analyze information, validate, escalate if needed, and test a hypothesis to solve it.

Apply change control to implement network changes, verify outcomes, and rollback if needed; document, back up configurations, and communicate changes to reduce outages and meet business requirements.

Explore disaster recovery tools and establish an up-to-date configuration backup plan, ensuring software and hardware inventories, documentation, and provisioning tools are in place.

Explore troubleshooting processes for complex enterprise networks in chapter 02 of the tshoot course, focusing on systematic diagnostics and problem resolution.

Explore troubleshooting fundamentals: gather information, analyze symptoms, form and test hypotheses, and apply top-down, bottom-up, or divide-and-conquer methods using the OSI model and tracer tools.

Create a network baseline and measure basic performance using show commands and NetFlow statistics, while IP SLA features monitor operations and guide troubleshooting and escalation across tiers.

Chapter three objectives guide you to use Cisco IOS commands to gather information for diagnostic processes. Identify tools for specific maintenance and troubleshooting tasks.

Learn to collect and filter information with IOS show commands by specifying both the network address and mask to avoid unintuitive show ip route behavior and longest prefix matching.

Utilize the show IAP route command with a prefix and the longer prefixes keyword to limit output. Display addresses for a branch office or data center using the summary address.

Filter Cisco IOS show outputs using the pipe operator with include, exclude, or begin. Apply case-sensitive regular expressions to IP input, switch interfaces, and running-config lines.

Learn to collect and filter Cisco IOS information using show commands with pipe options, displaying specific configuration sections and lines that match regular expressions.

Redirect ios show command output to a tftp server and to a file named show tech.txt. Repeated redirects overwrite the file; the t option displays on the console.

Use the append option to collect multiple show command outputs into a text file; TFT servers do not support append operations, and file content is displayed with the more command.

Explore IOS ping options to collect and filter information, adjusting repeat count, packet size, timeout, and source address to test MTU and diagnose packet loss with the don't fragment bit.

Test network connectivity with Cisco IOS commands by performing source-address pings and interpreting ICMP echo replies to determine if routers along the path can return replies.

Use Cisco IOS ping tests to diagnose MTU issues, noting that 1476-byte packets trigger ICMP fragmentation needed messages and may imply a GRE tunnel reducing usable MTU.

Demonstrates using extended ping to set a sweep range and packet sizes, highlighting the need to be in the correct mode to use extended ping and ping options.

Test network connectivity with Cisco IOS commands using telnet to port 23 and test other ports; open, refused, or timed out results guide banners from protocols like SMTP, FTP, HTTP.

Explore how Cisco IOS debug commands collect real-time packet details, including source, destination, and next-hop forwarding, while noting that some packets fast-switched or CTF-switched may not display.

Observe real-time rip debug data on Cisco IOS to see rip version 2 updates, one-hop routes, and how destinations beyond 15 hops become unreachable, with multicast 224.0.0.9 versus broadcast 255.255.255.255.

Filter Cisco IOS debug output using the debug condition command to target rip activity on an interface, and view or unset conditions with show debug condition or no debug condition.

Use Cisco IOS show process cpu to analyze five-second cpu usage, identify the system process and packet switching contributions, and note interrupt-driven tasks not tied to a single process.

Diagnose hardware issues with Cisco IOS commands, exploring show controllers, show platform, show inventory, and show dialog, plus diagnostics and the time domain Reflektor meter for upcoming labs.

Use traffic capturing tools with the Wireshark protocol analyzer to observe a four-way DHCP exchange leasing an IP from server to client, then ARP packets from an IP device.

Learn to configure switch port analyzers using span and monitor sessions to copy all traffic from Fa0/7 to Fa0/8, verify with show monitor, and understand frame types and ingress restrictions.

Configure a remote span (rspan) session across the path between source and destination switches, using rspan vlan 100 as destination on the source and as source on the destination.

This SNMP configuration example demonstrates setting read-only and read-write community strings, specifying location and contact, and enabling persistent configuration.

Use the router’s net flow cache to view active flows by issuing show IP cache flow; filtering options let you limit output to specific source or destination IPs for troubleshooting.

Enable network event notification to support proactive network management, using SNMP and syslog to trigger alerts, and leverage Cisco IOS Embedded Event Manager to define actions in response to events.

Enable embedded event manager policies to trigger actions on syslog events, IOS calendar changes, or MIB object changes, and execute commands, timers, or emails, including command language scripts.

Enable a network event notification using an EEM applet that triggers on the configure terminal pattern and logs 'configuration mode was entered' and 'change control policies apply authorized access only'.

Explore how to collect and filter routing information with the show ip route command, view the routing table, and understand administrative distance and directly connected versus dynamic routes.

Review chapter 3 highlights how to use troubleshooting tools and applications effectively, detailing practical methods for diagnosing and resolving problems.

Illustrates how a lan switch determines if host b is on subnet using ip and subnet mask, checks the arp cache for host b’s mac, and transmits the ethernet frame.

Broadcasts an ARP request to learn host B's MAC address when host A lacks the IP-to-MAC mapping for Hauspie.

A switch learns the source MAC address from incoming frames, updates its MAC address table, and floods broadcast frames to all ports except the source, updating entries as frames arrive.

Process a broadcast ARP request; host B recognizes it is for itself, sends a unicast ARP reply to host A, and updates its ARP table with the MAC mapping.

Switches forward the reply only to host A using their MAC address table, and learn host B's MAC address and interface in the LAN MAC address table.

Review how LAN switches consult MAC address tables to forward frames directly to the destination host, avoiding flooding.

Demonstrate how the host receives the packet, concluding the simple packet change in LAN switch operation.

Diagnose and resolve switched-network failures by tracing layer 1 and layer 2 issues, from faulty cables and unseated NICs to VLAN/trunk mismatches and misconfigurations.

Verify layer 2 forwarding by understanding that a switch learns its MAC address table from the source address of incoming frames; without upstream frames, it cannot learn.

Run diagnostic commands to validate layer 2 forwarding, such as show mac address table and show mac address learning, verify frames reach the interface, and inspect VLAN and trunk configurations.

Learn how spanning tree operation prevents switching loops caused by redundant paths. Enable this operation on all switches to maintain a loop free network.

Spanning tree operation elects a root bridge based on the lowest bridge ID, formed from switch priority and the lowest MAC address among participating switches.

Understand spanning tree operation: root bridge selection by least path cost, and root port selection with the lowest upstream bridge ID or port ID using the sender's ID for ties.

Identify how non-root, non-designated ports enter blocking, while designated ports move to listening and learning, and finally forward in normal operation, enabling information frames to be forwarded from the switches.

View a sample output from the show spanning-tree command to check the spanning tree protocol status for all VLANs on a switch, or limit the view to a specific VLAN.

Analyze spanning tree on port 88, a 10 gigabit ethernet link, identify root port and designated port, confirm root bridge, and note bpdu activity with 0 path cost during convergence.

Explore spanning tree failures and how type 1 and type 2 faults affect forwarding and blocking, despite STP reliability, causing partial connectivity loss or bridging loops and broadcast forms.

Identify type 2 spanning-tree failures and their symptoms: high link utilization, frequent MAC changes, and control plane issues in layer 3 devices, and learn diagnostic steps like removing a faulty cable.

Demonstrates how a mismatch between VLANs allowed on the port channel and on the physical interfaces can cause spanning-tree failures.

Identify EtherChannel problems caused by port inconsistencies, where mismatched speed or status suspends a link. Learn how a link aggregation control protocol ensures agreement and how hashing can skew load.

Identify a spanning-tree configuration issue and inconsistency across switches in etherchannel diagnostics from the command output, noting one device is running MSDE.

Explore inter-vlan routing and multilayer switching, comparing routers and multilayer switches as they use OSPF or EIGRP routing protocols or static routes and maintain routing tables.

compare multilayer switches and routers, noting that switches connect homogeneous networks with wire-speed ethernet packet switching, while routers link diverse networks using multi-purpose hardware and upgradeable features.

Examine sample data plane and control plane commands for routers and multilayer switches, noting that control plane troubleshooting is similar across devices while data plane troubleshooting differs.

Cisco express forwarding builds the FIB and adjacency table from control plane data, like routing and ARP cache, to ensure accurate packet forwarding; verify alignment when problems occur.

Demonstrate how a multi-layer switch uses switched virtual interfaces as the default gateway for VLAN 10 and VLAN 20. Show how the router port handles IP routing between the VLANs.

Explore layer 2 switching within VLANs and trunked traffic, including MAC address tables, then configure multilayer switching with SVIs and the IP routing command to enable inter-VLAN routing.

Routed interfaces depend on the connected subnet, so down interfaces remove routes; SVIs are nonphysical and stay up while at least one VLAN port remains in spanning tree forwarding state.

Verify status of VLAN 128 on SW1; if the interface is down, check VLAN existence and spanning tree forwarding state using show spanning tree and show vlan id 128.

Provide a redundant default gateway with a virtual IP and MAC for hosts through first hop redundancy protocols, enabling transparent failover controlled by an active router in a router group.

Learn how two routers configure hsrp on fast ethernet interfaces, with group 1 virtual IP 10.1.1.254, preemption enabled, and active router selection based on priority (110 vs 100).

Observe a sample output from the show standby brief command for hsrp group one, detailing active and standby IPs, virtual IP, configured priority, and preemption per interface.

Examine the command output for interface Fa0/0 and the workstation ARP cache, revealing the virtual IP and MAC addresses of the HSRP group provided by both routers.

Verify HSRP operation through practical troubleshooting steps, focusing on standby behavior, failover readiness, and network maintenance in the Cisco troubleshooting and maintaining course.

Compare HSRP with VRRP and GLBP to understand alternatives for gateway redundancy. The lecture highlights virtual IP usage, preemption behavior, and hello timer values across protocols.

Demonstrates connectivity testing with ping between T1, T2, and T3, confirming 100 percent replies, then uses show spanning tree commands on a switch to diagnose vlan and interface issues.

Review essential layer 2 troubleshooting commands, including show mac address-table, show vlan, show interfaces trunk, show interfaces switchport, trace route, and spanning-tree commands for vlan and interface.

Identify three common etherchannel problems, focusing on port inconsistency within the channel and across opposite-side ports, and address uneven traffic distribution among channel bundle members.

Examine how multi-layer switches and routers share routing responsibilities, using OSPF or static routes to populate routing tables and determine reachability, while performing packet switching from layer 2 headers.

Compare multi-layer switches and routers: routers connect diverse networks and media with broader features but lower throughput; multi-layer switches link homogeneous ethernet networks with wire-speed data plane hardware.

Differentiate SVI from a router port: a router port isn't tied to a VLAN and may not run spanning-tree or dynamic routing, and its status affects the connected subnet's route.

Explore redundancy protocols, noting the standards-based preempt option and a virtual IP that can be a real address on a participating router; highlight glbp load balancing and timer differences.

Develop the ability to maintain and troubleshoot routing solutions within Cisco networks, as outlined in this chapter.

Diagnose and troubleshoot network layer connectivity using the iOS command line interface, and resolve routing information exchanges across EIGRP, OSPF, and BGP, including route redistribution.

Explore routing concepts and data structures by tracing a packet from host A to host B through IP and MAC addresses, encapsulation, and protocol interactions like ARP, DHCP, and ICMP.

Verify forwarding by inspecting routing table entries, cef, ib short table, using show ip route ip address and show ip route network mask longer prefix to diagnose route summarization.

Verify routing functions with IOS commands by inspecting the arp cache using show ip arp, refreshing entries with clear ip arp, and mapping frame-relay PVC/DLCI with show frame-relay map.

Verify routing with iOS commands by clearing the IPv4 CEF and FIB tables and rebuilding them with APOC generation increments, noting APOC availability in iOS 12.4 revision 20.

Explore interior gateway protocol concepts, including neighbor relationships, learning paths, routing updates and redistribution, directly connected routes, best-path selection by metric, equal-cost load balancing, and administrative distance.

Review eigrp concepts by examining the interface and neighbor tables, the topology table, and how best path selection via the diffusing update algorithm enables equal-cost load balancing.

Learn to monitor EIGRP and IGMP using show commands: list interfaces participating in EIGRP processing, display IGMP neighbors, and inspect the EIGRP topology table to select specific prefixes.

Explain why only one topology table entry exists and determine if a neighbor relationship was never established or if the route was not exchanged, using hello packets to discover neighbors.

Diagnose why a serial interface isn't added to the EIGRP topology by ensuring the interface is up, its IP matches the configured network statement, and it is not passive.

Explains an EIGRP troubleshooting scenario by analyzing packet flow and verifying that loopback traffic uses the direct link and follows the correct path.

Learn how OSPF uses shortest path first to select intra area, inter area, and external routes, with routing information flooded by area border routers.

Explore OSPF data structures, including the interface table for OSPF-enabled interfaces, passive interfaces, the neighbor table tracking active neighbors via hello messages, dead-time, and adjacency state.

Explore how the link state database stores OSPF topology, including areas and autonomous systems, and how SPF updates the routing information base and routing table with bandwidth-based path costs.

Review OSPF areas by counting Type 1, Type 2, and Type 3 LSAs in each area database, across area 0, area 1, and area 2.

Analyze area databases by counting type 1, type 2, and type 3 entries for areas 0, 1, and 2 across routers A to E.

Verify OSPF neighbor relationships on the link by ensuring interfaces are activated on both sides. Detect parameter mismatches via debug ip ospf output to understand information flow within an area.

Explore how router B uses the area 1 database to run SPF and generate type 3 LSAs, injecting them into area 0 to advertise costs to area 1 prefixes.

Monitor OSPF effectively by using show commands to view router ID, areas, and spf run counts; inspect interfaces, neighbors, database, and spf statistics for routing stability.

Monitor OSPF in real time using debugging commands to observe routing changes and OSPF packet headers; verify hello exchanges and neighbor establishment, and diagnose mismatches in timers or area numbers.

Explore an OSPF troubleshooting example in a multi-area network, showing how the routing table may display a single entry despite two equal-cost paths.

Demonstrates using show ip OSPF neighbor command to verify neighbor relationships, interpret router ID and IP, and diagnose missing neighbors due to hello mismatches, missing hellos, or inactive interfaces.

Identify a misconfigured ospf network statement that matches the correct ip address, then replace it or use interface config mode to set ip ospf process-number area.

Apply the correct ospf configuration in this troubleshooting example to resolve the issues highlighted in the previous slides.

Observe how updating the ospf network statement activates ospf on the fast ethernet 0/1 interface, enabling ospf packet processing and listing the router ID and interface IP in neighbor table.

OSPF troubleshooting demonstrates how type 3 LSA entries define routes by listing router IDs CSW2 and CSW1 as the sources in the routing table.

Review route redistribution, troubleshooting techniques and commands to diagnose why redistribution may fail, and understand interactions between routing protocols like OSPF and IGMP.

Compare how different routing protocols handle external routes during redistribution, noting that RIP cannot mark external routes while OSPF can, and explain how preferring internal routes helps prevent routing loops.

Verify the redistribution configuration and fix metrics, route filtering, or protocol-number issues; troubleshoot the destination protocol's routing exchange to ensure all routers receive external and internal routes, including OSPF's stub-area.

Review the show iap route profile output to gauge routing table stability via 5-second sampling intervals and prefix add and forwarding path changes.

Identify two equal-cost OSPF paths to 10.1.0/24 via S-W1 and S-W2, both installed in the routing table, with the redistribution entry showing the configured metric.

Analyze why the OSPF to EIGRP redistribution process advertises only one route when two equal-cost paths lead to the same destination, and how this affects routing.

explore troubleshooting OSPF to EIGRP redistribution in routing updates, focusing on how external routes appear, how redistributed routes propagate, and how the originated router and routing protocols remain visible.

On router B, IGMP selects a route learned from s.r.o 1 and installs it as an external route with administrative distance 170 in the IP routing table.

Review the basics of BGP as an external inter-AS routing protocol that exchanges prefix reachability with external networks and supplies the best paths to the routing table.

Learn how BGP processes and advertises routes from internal neighbors, using the network statement and redistribution from static or other IGPs, with prefixes in the IP routing table.

Explore how BGP selects the best path from neighbors, advertises routes with administrative distances (eBGP 20, iBGP 200), and applies split-horizon, access lists, prefix lists, and route maps for filtering.

Explore the BGP neighbor table on a router, listing configured peers with their autonomous system numbers, internal or external status, session state, capabilities, uptime, and prefixes exchanged.

Explore how the BGP routing information base stores routes with next hop, AS path, local preference, MED, and community, and how best path selection installs the chosen route.

Configure BGP neighbors manually by IP and host number, initiate a TCAP session to exchange open messages for AS numbers and address families, and reset peering if AS numbers mismatch.

Identify causes for BGP peering failure, including lack of IP connectivity and non-direct paths, mismatched source and neighbor IPs, and AS number mismatches in open messages.

Use real-time debug ip bgp commands to monitor BGP peering events and updates, and limit output to specific neighbors and prefixes with access-list options for precise troubleshooting.

Learn how BGP routes traffic by ensuring the destination network is advertised by the correct ISP and reached directly, rather than routed via another ISP.

Verify layer 3 connectivity with a ping to ISP and access router; if ISP1 is up but traffic uses other router, diagnose routing problem from prefix learning or route preference.

Examine a BGP troubleshooting example where the 192.168.224.0/19 prefix learned via BGP is installed in the routing table as the best internal path.

Troubleshoot BGP neighbor configuration with an ISP, identify why the BGP neighbor address fails, and verify correct IP addressing to ensure successful peering.

Diagnose a bgp troubleshooting scenario for the 192.168.2.0/24 network advertised by isp one to route to isp one, not through isp two, and configure a neighbor relationship with isp one.

Demonstrates a bgp troubleshooting example where isp 1's path is installed in the routing table and confirmed by trace route to 192.168.224.1; aligns with Cisco's free flowchart.

Explore troubleshooting various dynamic routing protocols such as eigrp, ospf, and bgp, using trace route, ping, and show commands to verify connectivity, adjacencies, and routing table paths.

Master the fundamentals of maintaining and troubleshooting routing solutions in Cisco networks through chapter 05 review.

Review chapter 5 troubleshooting commands: use show ip route, show ip route [network/mask], and show ip cef to verify routing and forwarding, arp, and frame relay mappings.

Identify how routing protocols handle reception of routing information from neighbors, manage route data structures, perform route injection or redistribution, and select and install routes while transmitting information to neighbors.

Learn how EIGRP uses three data structures—the interface, neighbor, and topology tables—and view them with show ip eigrp interfaces, show ip eigrp neighbors, and show ip eigrp topology.

Identify how OSPF uses four main data structures: the interface table, the neighbor table, the link state database, and the routing information base to determine reachable networks and path costs.

Explore real-time troubleshooting of OSPF in Cisco networks by using debug commands that display OSPF packets, adjacency building events, and the SPF algorithm's execution and results.

Enable ip route profile in global config to monitor route stability; it tracks routing table changes over five seconds and shows results with show ip route profile.

Explore common BGP session failures, including IP connectivity issues, non-direct peering, and AS number or source IP mismatches that prevent neighbor establishment.

Learn to gather bgp data with show ip bgp summary and show ip bgp neighbors, then observe exchanges using debug ip bgp and debug ip bgp updates with targeted filters.

Explore troubleshooting addressing services in Cisco networks, and learn practical techniques to identify and resolve addressing issues.

Describe common NAT and PAT issues, explain dynamic host control protocol basics, and identify IPv6 routing internal issues.

Explore NAT/PAT operation at the network border, translating the source IP addresses of existing packets and the destination IP addresses of incoming packets.

Assess how NAT/PAT conserves addresses, hides internal hosts, and avoids address renumbering as networks change. Note the drawbacks: processing delay, loss of end-to-end reachability, and VPN considerations.

Review how nat and pat affect nat sensitive protocols such as ipsec, icmp, and sip, and examine nat traversal methods, vpn considerations, and application-aware handling for voice, video, and dns.

Examine how NAT/PAT interacts with ACLs, QoS, rate limiting, and VPN features, emphasizing the critical enforced order on router interfaces and its impact on troubleshooting inbound and outbound traffic.

Emphasizes using diagrams for NAT/PAT configuration, showing how IP NAT inside/outside interfaces, NAT pools, and routing reachability interact and require advertising translated addresses.

Use debug ip and debug ip packet commands to monitor NAT/PAT translations, analyze per-packet details, and diagnose end-to-end issues by narrowing output with access-list filters.

Apply conditional debug to isolate NAT/PAT issues by defining a debug condition for an interface. Keep outputs focused by using show debug condition and removing the condition when finished.

Navigate a NAT/PAT troubleshooting example showing a routing issue where router 1 cannot ping R3, with no routing protocols running, and the gateway of last resort to restore end-to-end connectivity.

Explore a nat/pat troubleshooting example showing fast ethernet 0/0 as the inside interface and s0/1 0/8 0/1 as outside, with dynamic and static nat, using show ip nat translation to view translations.

Examine a NAT static translation entry in the NAT translation table and diagnose routing issues caused by no route back or overlap with a dynamic address pool.

Analyze nat/pat troubleshooting by using debug ip icmp and ping tests to determine whether icmp reachability issues point to nat or routing problems between r1 and r3.

Using NBAR to discover protocols, analyze packet count and rate statistics for input and output traffic, and apply insights to capacity planning, security, and quality of service design.

Troubleshoot NAT/PAT with an incorrect access list that blocks SSH from the 10.0/24 network, and restore end-to-end connectivity by aligning router and firewall policies with single-area ospf.

Explore NAT/PAT troubleshooting and an incorrect access-list blocking under upgraded security policies, and verify connectivity with pings before attempting SSH between routers.

Apply NAT/PAT troubleshooting by using a special iOS debugging tool to reveal filters, trace path from intermediate routers, and diagnose a failed TCAP session caused by a remote reset.

Troubleshoot nat/pat issues by verifying inbound access lists on serial interfaces and using show access list to confirm firewall HIF allows TCAP to 172.16.11.3 port 22.

Explore NAT/PAT troubleshooting with an incorrect inbound access-list scenario, showing how a port translation mismatch and packet denial arise on a serial interface.

Troubleshoot nat/pat by examining show ip nat translations to reveal port 22 mapped to 2222 due to an outdated access list; update the access list and inbound firewall on R3.

Correct NAT/PAT troubleshooting by fixing the firewall and synchronizing configuration teams, ensuring access-list and port-mapping account for the custom port.

DHP overview explains how a client obtains IP configuration and DNS details from a server via broadcast discovery across subnets, with routers forwarding using IP helper-address.

Demystifies the DHCP client–server exchange, showing how a client broadcasts a discover from 0.0.0.0, receives offers, selects one with a request, and receives an ack with configuration parameters.

Review the DHCP packets and message types that govern client-server communication, as the lecture presents a table of packet types and their roles in DHCP transactions.

Explore common DHCP troubleshooting issues across three router roles: DHCP server, DHCP client, and DHCP relay—and see how branch offices and providers affect IP phones and video devices.

Troubleshoot DHCP configuration and relay issues that prevent clients from obtaining IP information or options, and address scope exhaustion, rogue servers, and client renewal during renumbering.

Configure a DHCP relay agent with the ip helper-address command on Cisco IOS. Forward DHCP/bootp requests and other UDP broadcasts to the DHCP server.

Troubleshoot dhcp snooping to secure address allocation and avoid blocked transactions. Address improper trust boundary configuration, missing dhcp snooping on lans, and misconfigured rate limits that degrade performance.

Diagnose DHCP issues by locating servers and clients, verifying relay agents and pool sizes, and checking ACLs, firewalls, and DHCP snooping on correct interfaces.

Use show ip dhcp conflict to identify address conflicts; the Cisco IOS DHCP server detects conflicts with ping and clients use ARP, removing conflicted addresses from the pool until resolved.

Explore dhcp debugging commands for troubleshooting the dhcp server, including udp packet monitoring, server events, and actions on address assignments and database updates.

Determine if the DHCP issue affects all clients or only specific ones; verify show ip interface brief that interfaces are DHCP clients with unassigned IPs, then check DHCP server configuration.

Investigate the client and server DHCP interaction by verifying DHCP discovery messages with the debug command, noting no offers, three attempts time out, and no allocation.

Check the DHCP server statistics and verify the address pool with show ip pool; confirm 254 addresses are available and none allocated, indicating correct server and client configurations.

Port 67 is now active, illustrating a DHCP troubleshooting step, and Cisco IOS replaces show IP socket with show UDP and show socket commands in release 12.4(11)T.

Explore a DHCP troubleshooting example that covers a duplicate client IP address scenario in Cisco networks.

Explore how a router acting as a dhcp server can cause ip address duplication, and learn to verify dhcp pool settings and timers using running-config and dhcp pool commands.

Identify and verify excluded IPs from the DHCP dynamic pool using a shell command to prevent static addresses from devices like servers and printers from causing IP conflicts.

Reintegrate the 10.1.100 address into the DHCP pool and exclude the static range 10.1.0.1 to 10.1.1.20 to ensure unique IP assignments; then renew leases to resolve past address conflicts.

Identify and diagnose a DHCP relay agent issue by evaluating client misconfigurations, relay agent or server faults, and network filtering or security barriers.

Verify dhcp agent operations by using the debug ip udp command to observe dhcp client and server traffic, noting packets with source 0.0.0.0 to 255.255.255.255 and ports 68 and 67.

Troubleshoot DHP forwarding, verify that DHP requests reach the server, and confirm devices acquire IP addresses and other parameters from the DHP server, signaling normal operation.

Compare IPv6 and IPv4 to reveal similarities in command syntax and differences that affect troubleshooting; IPv6 uses no broadcasts, ICMPv6 multicast neighbors, and longer subnets like /96 or /128.

Understand how IPv6 interfaces can hold multiple addresses with different protocol layer identifiers, and how this can trigger troubleshooting scenarios like OSPF adjacencies across subnets and IPv6 stateless auto configuration.

Learn how IPv6 debug commands support troubleshooting to identify symptoms and isolate problems, including neighbor discovery, duplicate addresses, and auto configuration issues, and understand ICMPv6's role in IPv6 failure conditions.

Determine the interface status using the show ipv6 interface commands, confirm the interface is up at both layers, and verify a global unicast and link-local address.

Verify the fast ethernet interface configuration to ensure it uses stateless autoconfig to automatically obtain the IPv6 prefix and other information.

Analyze why the IPv6 routing table shows only local networks and why a default route is missing despite stateless auto configuration on the fast ethernet 00 interface.

Explore how ICMPv6 neighbor discovery governs auto configuration, observe router solicitations and lack of replies, and diagnose a misconfigured or unreachable router in a Cisco network.

Examine IPv6 auto configuration address and its valid and preferred lifetimes, based on ICMPv6 router information, and confirm connectivity with remote pings.

analyze a redistribution issue in ipv6 troubleshooting example 2, tracing rip processes across a six-to-four tunnel and a frame relay link, and diagnose why router three’s loopback becomes unreachable.

Analyze IPv6 troubleshooting through bi-directional redistribution between RIP IPv6 routers, configured with show ipv6 protocols, to advertise Ethernet and loopback networks; note the use of a 15 metric to influence route selection.

Troubleshoot IPv6 redistribution by fixing R2's redistribution metric and adjusting the redistribute command to a value like 10, then verify the IPv6 routing table and routes from the serial network.

Verify IPv6 RIP configuration on the router using the IPv6 RIP command to obtain a snapshot of enabled interfaces and check for no interfaces enabled on the frame relay link.

Troubleshoot IPv6 routing by enabling the routing process on the serial interface and using debug IPv6 routing to observe missing routes added to the routing table.

Use the show ipv6 route command to verify routes. Frame relay routes are preferred because of the lower metric.

Apply show ip version 6 route and debug ip version 6 packet with an access-list filter to confirm R3 receives IPv6 traffic from R4, and identify the missing return route.

Examine IPv6 route redistribution into rip to verify that a specific IPv6 address is advertised from R1 to R3, and use the show ipv6 protocols command to confirm redistributions.

Troubleshoot IPv6 routing by redistributing RIP and verifying connectivity; ensure the IPv6 interface is active and redistribution includes connected routes, confirming 100% ping success.

Explore IPv6 troubleshooting example 3, diagnosing OSPFv3 configuration errors in a backbone area 0 with stub areas 1 and 2, amid a power outage.

Apply good troubleshooting by pinging multiple addresses or interfaces to verify reachability; the fast Ethernet 00 interface on router 1 succeeds while the same test from R2 fails.

Apply bottom-up troubleshooting approach on router one, using show ipv6 ospf interface and show ipv6 ospf neighbor to verify layers one to three, non-broadcast frame relay interfaces, and area configuration.

Use the IPv6 OSPF hello command to reveal area mismatches. Debug output shows a stub/transit area option bit mismatch between the routers.

Apply IPv6 troubleshooting techniques to fix SPF issues across three areas, normalize area one, and resolve configuration problems demonstrated in this Cisco tshoot example.

Enable a stub area under the IPv6 OSPF routing process with the IPv6 router OSPF 1 command, then adjacency forms quickly and pings to loopback addresses succeed.

Troubleshoot IPv6 hello delivery over a frame relay backbone by examining IPv6 to DLCI mappings with show Frame Relay map, understanding why OSPFv3 link-local hellos fail without DLCI mapping.

Verify IPv6 OSPF configuration on the interfaces using the show ipv6 ospf interface command, ensuring OSPFv3 is enabled in area 0 on both interfaces.

Troubleshoot edge and border routers and tunnel endpoints, and review a tunnel command output that shows IPv6 ping success and encapsulation/decapsulation messages.

Identify edge border routers as the tunnel endpoints and begin troubleshooting, then review the debug tunnel output as the routers ping each other, showing encapsulation and cancellation messages.

Identify that IPv6 OSPFv3 is active on the tunnel interface and no neighbors appear, while Hello messages are sent but not received.

ipv6 tunnel is configured and operational, but ospf fails across it; static routes restore connectivity, while bgp is not used in this scenario for dynamic routing across the tunnel.

Troubleshoot DHCP and NAT on a Cisco T-1 by using show commands to verify DHCP server statistics, IP address bindings, and the running configuration.

Master troubleshooting techniques and address services as outlined in chapter 06 review of the tshoot: troubleshooting and maintaining Cisco course.

Analyze NAT sensitive protocols and exclusions like IPsec and ICMP, and master essential troubleshooting commands: show ip nat translations, show ip nat statistics, and debug ip nat.

Explore how enabling router interfaces supports udp broadcast for six protocols, including dns (53), time service (37), netbios name service (137), netbios data service (138), tacacs (49), and dhcp/bootp (67–68).

Master Cisco IOS commands for DHCP troubleshooting, including show ip dhcp binding, show ip dhcp conflict, show ip dhcp database, and debug ip dhcp with packet or event.

Explore essential Cisco IOS IP version 6 troubleshooting commands, including debugs and show IP version 6 interface, routers, route, and protocols.

Learn to troubleshoot ipv6 with Cisco IOS using essential show commands and debug ipv6 routing, debug ipv6 packet, and show ipv6 interface, routers, route, and protocols.

Describe and troubleshoot network application services, and identify performance issues on Catalyst switches and routers.

Explore the four-step ANS optimization cycle: baseline traffic profiling, network optimization with QoS and traffic prioritization, measure and verify outcomes, and deploy new applications with refreshed baselines.

Understand how net flow, IP service level agreements, and packet inspection establish a network performance baseline by classifying traffic and measuring optimization technologies, including Elby and CULE in Cisco IOS.

Cisco designed NetFlow, now in its ninth version on the standards track to become industry-wide standard, creating a net flow cache for active flows to enable traffic accounting and security.

Netflow overview defines a flow as a unidirectional packet stream between a source and destination, matching seven fields such as source IP, destination IP, and input interface, including tos/dscp.

Configure NetFlow on interfaces with IP flow ingress. Enable accounting on fast ethernet 0/0 and export cache data to an external collector by setting version, destination IP, and UDP port.

Analyze the show IP cashflow output to understand packet distribution, flow counts, and rates. Aggregate and graph flow data with a collector to establish a network baseline.

Identify IP SLA results and trigger actions, such as updating routing table when a destination port test succeeds, and monitor performance by generating traffic between devices without deploying a probe.

practice IP SLA overview by simulating a source device sending a generated packet to a responder destination, which replies with timestamp information to compute performance metrics using UDP.

Learn how the Cisco IOS IP SLA responder, embedded in a destination's Cisco routing device, responds to IP SLA requests, configures the IP SLA responder, and monitors recent control messages.

nbar overview explains recognizing applications, including web-based and other protocols with dynamic udp port assignments, using match protocol in a route map to mark packets and apply rate limits.

Examine NBAR PDLMs in the context of Citrix ICBA and how independent computing architecture supports peer-to-peer file sharing apps such as Kazaa, Gnutella, BitTorrent, and edonkey 2000.

Discover how slb uses a virtual server and vip to balance client connections across a server farm, improving scalability and maintaining transparency during maintenance.

Explore the basics of qos and auto qos, how traffic classification drives policies, and the router prerequisites for auto qos, including cef, ip addressing, bandwidth, and clean interfaces.

Cisco auto qos autodiscovery unfolds in two phases: discovery gathers baseline traffic classes and volumes using Embarq, then configuration applies qos policies based on collected templates.

Tune net flow export performance by adjusting aging timers and cache limits to avoid memory and cpu cycle strain, and address export issues like misconfigured destination IP or unreachable collectors.

Nbar classifies traffic by application layer components into traffic classes for control or blocking; nonstandard ports can evade detection, so map ports and upgrade the application definitions on Ambar.

Explore common Cisco auto QoS issues and prerequisites such as IP address, cef enabled, and proper bandwidth on serial interfaces. Understand how mismatched parameters and lingering policies cause problems.

Explore how the monitor keyword was removed from show ip sla commands in Cisco IOS release 12.4, with the deprecated monitors replaced by show ip sla statistics for troubleshooting.

Test connectivity between our router and the net flow collector, verify net flow configuration parameters, and ping to confirm IP reachability; ensure net flow is active on serial 0/0.

Analyze netflow exported flows to identify misconfigurations in the netflow collector IP address and the source interface, correcting deviations from the expected values.

Identify netflow misconfigurations: the flow collector IP and source interface are incorrect, shown as 10 out 1 out $152 1 instead of 10 1 1.10, and loopback0 should replace fastethernet0/0.

Explore an IP SLA troubleshooting example using a sender and responder to measure delay with a probe every 10 minutes, and identify thresholds that affect probe reporting.

Troubleshoot an IP SLA probe timing issue by using show run | section ip to confirm the probe should start at 11:59 p.m., even though the clock shows 20:59.

Check the AP status and ensure it is synchronized with the AP server; diagnose mismatches and fix the issue to restore proper operation.

Review IP SLA monitoring statistics showing a return code of OK, with one success and no failures.

Explore an AutoQoS troubleshooting example where the link between routers 1 and 2 is down, while the backbone server remains fully operational, to diagnose QoS issues.

Investigate an AutoQoS troubleshooting scenario by examining a serial interface up but line protocol down, diagnosing an HDLC vs PPP encapsulation mismatch and data link control settings.

Change the encapsulation on interphase serial 000 to PPE, bring the serial 000 line protocol up, and verify connectivity with a ping from interface one to interface two.

Troubleshoot auto qos by ensuring the interface uses the correct encapsulation, switching from bp to hdlc, and enable auto qos to restore connectivity.

Analyze auto qos multi-link fragmentation on low bandwidth interfaces and configure bandwidth for a serial interface, illustrating why a 200 kbps setting indicates a slow link.

Troubleshoot AutoQoS by fixing the bandwidth on router one and removing all policies from the interface. If policies remain, retrying AutoQoS triggers an error and AutoQoS cannot be applied.

Identify the test policy on serial 00 for inbound and outbound traffic, remove it, reset encapsulation to point-to-point, and reapply auto qos until the interface stays up and pings succeed.

Identify switch performance issues by analyzing physical and data link layer problems, switch ports, TCAM utilization, and root causes of TCAM allocation failures and high usage.

Identify switch performance issues by examining packet loss with the show interface command, which reports input and output packets, error counters, and per-interface statistics (unicast, multicast, broadcast, bytes).

Explore show interface commands and the parameter descriptions they reveal, with guidance on possible causes and issues for each parameter. For deeper details, refer to Cisco's book.

Identify switch performance issues by examining additional show interfaces parameters, and deepen command familiarity by consulting Cisco Press books.

Identify switch port issues by checking cable connections, correct ports, device power, and cable type, using known-good cables and bypassing patch panels or media converters to isolate faults.

Analyze a duplex troubleshooting example of a 1 GB transfer at 100 Mbps, highlighting 80-second expectations and ruling out congestion while considering hardware or software limits on client or server.

Understand how duplex mismatch between full and half duplex ethernet links causes rapid FC errors. Learn how bad cabling or hardware and NIC behavior contribute.

Examine why late collisions occur on the half duplex side and how duplex mismatch causes transmitter frames to transmit without listening for carrier on the full duplex side.

Identify and fix duplex mismatches by enabling auto negotiation on both sides, clearing counters, and testing large file transfers to ensure no collisions, while backing up and documenting changes.

Explore how auto-mdix detects whether a straight-through or crossover cable is needed, enabling connections on switches and routers, depending on speed and duplex auto negotiation, with the mdx auto command.

Analyze switch forwarding hardware on an access switch with 24 fast ports and a 1 gbps uplink, totaling 2.4 gbps, and explain congestion and frame drops when all ports transmit.

Explore why tcam allocation failures are rare due to ample tcm capacity, and how mac attacks filling the cam can cause performance degradation.

spot potential tcam allocation failures by watching show controllers interface for packets forwarded to the cpu; a rising retrieve packet counter in software forwarding indicates software switching, not hardware tcam.

Mitigate tcam exhaustion by reducing control plane information fed into the tcam, using route summarization, route filtering, and prefix or access-list optimization.

Troubleshoot high cpu load in the switch control plane, noting traffic load is not the sole driver; most traffic is switched in hardware, and conclusions vary due to switching implementation.

Investigate high switch cpu load by examining interrupt processing and hardware offload, noting tcom allocation failures or unsupported features, and set a baseline for 50% load and 100% bursts.

Identify causes of high switch cpu load on layer 3 switches from command tasks, routing updates, and snmp polling, including show tech-support, show running-config, and copy running-config startup-config; adjust polling.

Analyze how the ip input process drives most switch cpu load by handling all ip traffic not processed by the tcom, including icmp, arp requests, and igmp packets.

Examine dhcp issues arising from misconfiguration, such as limiting dhcp messages per second on an interface, which can degrade switch performance and stem from poor baselining and dhcp snooping tuning.

Identify DHCP vulnerabilities and abuse methods, including starvation attacks and rogue servers that redirect traffic, and mitigate with DHCP snooping, port security, and rate limits.

Explore spanning-tree issues that slow networks when protocol data units are dropped, triggering reconvergence and topology loops, leading to floods and utilization, with PVST+ creating STP instances per VLAN.

Explore common HSRP issues that cause instability and performance degradation, including duplicate standby IP addresses, pre-staged changes, timer misconfigurations, lapping links, missing peers, and related switch error messages.

Troubleshoot switch performance by diagnosing speed and duplex settings affecting large file downloads from the file server after weekend maintenance, and restore connectivity to the original performance levels.

Establish a baseline, compare current performance, and locate degradation within a simple switch–pc–file server network: between pc and switch, inside the switch, or between switch and file server.

Assess the switch interface running configuration, which was manually configured after PCs were moved; reconfigure to the correct speed and duplex (half duplex, 10 Mbps) and confirm with the user.

Diagnose switch performance issues caused by excessive broadcasts to resolve connectivity, IP address assignment, and slow download problems using a path troubleshooting technique.

Troubleshoot switch port performance by checking speed, duplex, and utilization; verify the port operates at full duplex 1000 mbps with near-zero utilization and interfaces up.

Identify switch performance issues by analyzing the show process, noting excessive load at 90 percent over five seconds, 94 percent over one minute, and 2 percent over five minutes.

Use the show process command to identify which task or process consumes nearly half the switch's resources and assess its impact on performance.

The accounting command on the interface reveals vlan 10 as the source of excessive traffic, with gigabit ethernet 0 2 9 11 12 13 and 22 in vlan 10.

Observe the positive results in the show processes output and verify with users that they are no longer experiencing problems.

Investigate switch performance issues caused by excessive security after a security update, as clients report unplugged cable messages, poor connectivity, and dhcp failures across the affected switch.

Use bottom-up approach to determine if layer 3 or 4 security policies block traffic, starting at PC, verifying switch interface with show interfaces, and clear counters to address intermittent connectivity.

Run show interfaces to verify counters. Rule out layer 1 with a cable replacement, move to layer 2 in OCI model, check VLAN 10 with show vlan, consider security update.

Verify that an IP access list is applied to the VLAN 10 interface and identify both inbound and outbound access lists using the show ip interface brief command.

Examine the VLAN 10 access list and its large output, similar to VLAN 10 underscore out, to determine if it degrades performance and prevents user connections.

Access lists are managed by s.a.m, not the cpp, and the show platform tcom utilization command should confirm tcom status while noting 964 total slots with 790 in use.

Note the high seip utilization, signaling tcm overload of cpi and cpp; rewrite and simplify access lists at the vlan and interface levels, or invest in a security filtering platform.

Troubleshoot high router cpu load by examining bursts of simple network management protocol packets from intensive monitoring and how competing processes can deprive cpu resources, elevating usage.

Identify common symptoms of high router cpu load, such as slow telnet responses, slow console commands, high ping latency or timeouts, and failures to send routing protocol packets.

Identify how network background tasks, IP background tasks, and TCP timer processes contribute to high router CPU load and how to diagnose them.

Review the show output for detailed TCAP information, noting unassigned ports, 60,000+ control packets, and zero call timeouts, zero connections dropped, and zero keepalive probes.

Analyze router cpu utilization with show processes cpu and show processes cpu history, interpreting last five seconds, one minute, and five minutes and the ascii graphical view.

Explore how CEF status affects switching paths: if CEF is enabled globally, it may not be enabled on an interface.

Review how to troubleshoot switching paths by revisiting techniques discussed in prior slides and chapters, including those from the CCN piece.

Troubleshoot switching paths, including process switching and fast switching, to diagnose and resolve Cisco network issues.

Troubleshoot switching paths by examining the CEF adjacency table and other switch path techniques covered.

Troubleshoot connectivity by inspecting the show ip cache output and the fast switching cache entries for network prefixes and interfaces. The route cache is periodically cleared to remove stale entries.

Troubleshoot cef by examining the IAB and adjacency. Verify cef is enabled globally or per interface using show ip interface to confirm next hop and adjacency.

Enable cef and use the show ip cef command to inspect the fbi table and fcf status, noting next hop and the gateway of last resort as default route.

Use the show ip cef adjacency command to view destinations tied to an interface or next-hop pair. Discover network destinations, including the default route to 10.14.14.19/32.

Identify why some packets are processed even with CEF enabled due to an incomplete adjacency table or main processor handling. Gather information with the show CEF not C-f switched command.

Explore IOS tools to analyze packet forwarding and follow a series of troubleshooting steps to identify problems related to switching paths used by a router.

Use the trace route utility to identify the problematic router along the path, and interpret traceroute output for higher delay or packet loss revealing issues at router R2.

Analyze utilization and load from packet processing using the show processes command and pipe filtering. The example shows no problems related to packet processing, marking step 2.

Analyze packet forwarding in step three by checking the routing table for the corresponding destination prefix. Verify the routing information, such as the loopback interface 0, to validate forwarding decisions.

Analyze packet forwarding by identifying the switching mode used by the router and the interfaces involved, and use the show IPCA command to verify if C-f is enabled.

Continue analyzing step 4 by using the show IAP interface command to verify switching types, noting global CEF is enabled and all interfaces support CEF switching.

We examine the IAB entry for routing information in Step 5, using example 10.11.1.1, and confirm the adjacent entry shows interface FastEthernet 0/1 with the next-hop address.

Analyze how Step 6 uses packet memory to buffer inbound and outbound packets, handles fragmented memory, and determines the next-hop destination with show adjacency, resolving it via ARP.

Verify the ARP cache entry and MAC address information on the router in step 7 to conclude there are no switch-related problems.

Diagnose and resolve router memory issues by understanding how fragmentation prevents finding a usable memory block in Cisco IOS, and how packet memory buffers incoming and outgoing packets.

Troubleshoot router memory issues in Cisco networks, part 2, and learn practical techniques for diagnosing and maintaining memory performance.

Identify security-related causes of router memory issues, such as worms or viruses, especially when there are no recent changes; mitigate by adding an access list to drop malicious traffic.

Diagnose router memory issues from a buffer leak bug that inflates input and output queues beyond the queue depth, causing wedged interfaces and traffic loss on the affected port.

Identify how BGP memory use affects router stability by examining processes: BGP input/output, the BGP router, and the BGP scanner, including memory for the BGP RIB, IP RIB, and prefixes.

Identify and monitor memory availability for routes and line cards on a router, using show dialog outputs to compare memory across card types and detect BGP memory shortages.