IPSEC - VPN Notes

IPSEC is a framework for security that operates at the Network Layer by extending the IP packet header (using additional protocol numbers, not options). This gives it the ability to encrypt any higher layer protocol, including arbitrary TCP and UDP sessions, so it offers the greatest flexibility of all the existing TCP/IP cryptosystems. Flexibility, however, often comes at the price of complexity, and IPSEC is not an exception. Configuring which addresses and ports to encrypt using which IPSEC options often begins to look like configuring packet filtering, then add in the additional complexities of key management. While conceptually simple, setting up IPSEC is much more complex that installing SSH, for example.

What IPsec Does

IPsec provides security services at the IP layer by enabling a system to select required security protocols, determine the algorithm(s) to use for the service(s), and put in place any cryptographic keys required to provide the requested services. IPsec can be used to protect one or more "paths" between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.  (The term "security gateway" is used throughout the IPsec documents to refer to an intermediate system that implements IPsec protocols.  For example, a router or a firewall implementing IPsec is a security gateway.)

The set of security services that IPsec can provide includes access control, connectionless integrity, data origin authentication, rejection of replayed packets (a form of partial sequence integrity), confidentiality (encryption), and limited traffic flow confidentiality.  Because these services are provided at the IP layer, they can be used by any higher layer protocol, e.g., TCP, UDP, ICMP, BGP, etc.

How IPsec Works

IPsec uses two protocols to provide traffic security -- Authentication Header (AH) and Encapsulating Security Payload (ESP).

The IP Authentication Header (AH) [KA98a] provides connectionless integrity, data origin authentication, and an optional anti-replay service.

The Encapsulating Security Payload (ESP) protocol [KA98b] may provide confidentiality (encryption), and limited traffic flow confidentiality.  It also may provide connectionless

Domain of Interpretation (DOI), a term in the IPSec ISAKMP/IKE, defines payload formats, exchange types, and conventions for naming security-relevant information such as security policies or cryptographic algorithms and modes.

 

Great Sites for Study Material

http://blog.ine.com/

http://packetlife.net/

http://tekcert.com/

http://www.youtube.com/user/Keith6783?feature=watch

WS-X6716-10G Performance Mode

Depending on what kind of traffic you plan to push onto a 6716 module, you might need to run one of the port groups in performance mode. You loose 3 out of the four ports in that port group when you do this but you gain a bigger buffer. This is great for bursty traffic like multicast or when you are spanning multiple ports into one.

Implementation:

6509E(config)#no hw-module slot 8 oversubscription port-group 3

Verification:

6509E#show hw-module slot 8 oversubscription

port-group      oversubscription-mode

1               enabled

2               enabled

3               disabled

4               enabled

 Verification:

6509E#show int te 8/10

TenGigabitEthernet8/10 is administratively down, line protocol is down (disabled for performance)

  Hardware is C6k 10000Mb 802.3, address is 001c.f9d7.e400 (bia 001c.f9d7.e400)

Further Reference:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/qa_cisco_catalyst_6500_series_16port_10gigabit_ethernet_module.html

BGP NOTES

:

1.            For EBGP, the next hop is always the IP address of the neighbor specified in the neighbor command. For IBGP, the protocol states that the next hop advertised by EBGP should be carried into IBGP“You would need to be running internal IGP in order for the default behavior to work. To change the default behavior, you would use neighbor X.X.X.X next-hop-self

2.            Networks originated via an “aggregate” command will have a next hop of 0.0.0.0.

3.            A rule of aggregation is “Aggregation applies only to routes that exist in the BGP routing table. An aggregated route is forwarded if at least one more specific route of the aggregation exists in the BGP routing table”. 

4.            If you see (s>) under show ip bgp, it specifies the route is suppressed (Not Being Advertised by design).

What are the well known communities of the BGP community attribute?

A. The community attribute is a transitive, optional attribute designed to group destinations in a certain community and apply certain policies (such as accept, prefer, or redistribute). This table shows the well known BGP communities.

Community	Description
Local-AS	Use in confederation scenarios to prevent sending packets outside the local autonomous system (AS).
no-export	Do not advertise to external BGP (eBGP) peers. Keep this route within an AS.
no-advertise	Do not advertise this route to any peer, internal or external.
none	Apply no community attribute when you want to clear the communities associated with a route.
internet	Advertise this route to the internet community, and any router that belongs to it.

Cisco Interface Counters

 If you ever wondered if an interface has ever been over-run but the interface counters were cleared, well you can view this information.


This will show you the counters of the interface since the device was last rebooted. For this interface, if you look at line number 10 under "32 bit counters", you can see the interface has one been over-run.  The same information is shown on line number 32 under "All Port Counters"

6509E#show counters interface gigabitEthernet 1/15
64 bit counters:
 0.                      rxHCTotalPkts = 13773719463
 1.                      txHCTotalPkts = 117546981006
 2.                    rxHCUnicastPkts = 13770411834
 3.                    txHCUnicastPkts = 27169023634
 4.                  rxHCMulticastPkts = 3235868
 5.                  txHCMulticastPkts = 90377957594
 6.                  rxHCBroadcastPkts = 71761
 7.                  txHCBroadcastPkts = 1
 8.                         rxHCOctets = 964690246478
 9.                         txHCOctets = 17121008138826
10.                 rxTxHCPkts64Octets = 122237854
11.            rxTxHCPkts65to127Octets = 91633004621
12.           rxTxHCPkts128to255Octets = 31194865790
13.           rxTxHCPkts256to511Octets = 5836699039
14.          rxTxHCpkts512to1023Octets = 1625307189
15.         rxTxHCpkts1024to1518Octets = 908585976
16.                    txHCTrunkFrames = 0
17.                    rxHCTrunkFrames = 0
18.                     rxHCDropEvents = 0

32 bit counters:
 0.                   rxCRCAlignErrors = 0
 1.                   rxUndersizedPkts = 0
 2.                    rxOversizedPkts = 0
 3.                     rxFragmentPkts = 0
 4.                          rxJabbers = 0
 5.                       txCollisions = 0
 6.                         ifInErrors = 0
 7.                        ifOutErrors = 0
 8.                       ifInDiscards = 0
 9.                  ifInUnknownProtos = 0
10.                      ifOutDiscards = 164487
11.            txDelayExceededDiscards = 0
12.                              txCRC = 0
13.                         linkChange = 5
14.                   wrongEncapFrames = 0
All Port Counters
 1.                          InPackets = 13773719462
 2.                           InOctets = 964690246414
 3.                        InUcastPkts = 13770411833
 4.                        InMcastPkts = 3235868
 5.                        InBcastPkts = 71761
 6.                         OutPackets = 117546981005
 7.                          OutOctets = 17121008138749
 8.                       OutUcastPkts = 27169023633
 9.                       OutMcastPkts = 90377957594
10.                       OutBcastPkts = 1
11.                           AlignErr = 0
12.                             FCSErr = 0
13.                            XmitErr = 0
14.                             RcvErr = 0
15.                          UnderSize = 0
16.                          SingleCol = 0
17.                           MultiCol = 0
18.                            LateCol = 0
19.                       ExcessiveCol = 0
20.                       CarrierSense = 0
21.                              Runts = 0
22.                             Giants = 0
23.                         InDiscards = 0
24.                        OutDiscards = 164487
25.                           InErrors = 0
26.                          OutErrors = 0
27.                    InUnknownProtos = 0
28.                              txCRC = 0
29.                      TrunkFramesTx = 0
30.                      TrunkFramesRx = 0
31.                         WrongEncap = 0
32.     Broadcast_suppression_discards = 0
33.     Multicast_suppression_discards = 0
34.       Unicast_suppression_discards = 0
35.                 rxTxHCPkts64Octets = 122237853
36.            rxTxHCPkts65to127Octets = 91633004620
37.           rxTxHCPkts128to255Octets = 31194865790
38.           rxTxHCPkts256to511Octets = 5836699039
39.          rxTxHCpkts512to1023Octets = 1625307189
40.         rxTxHCpkts1024to1518Octets = 908585976
41.                         DropEvents = 0
42.                     CRCAlignErrors = 0
43.                     UndersizedPkts = 0
44.                      OversizedPkts = 0
45.                       FragmentPkts = 0
46.                            Jabbers = 0
47.                         Collisions = 0
48.              DelayExceededDiscards = 0
49.                        bpduOutlost = 0
50.                        qos0Outlost = 164487
51.                        qos1Outlost = 0
52.                        qos2Outlost = 0
53.                        qos3Outlost = 0
54.                        qos4Outlost = 0
55.                        qos5Outlost = 0
56.                        qos6Outlost = 0
57.                        qos7Outlost = 0
58.                        qos8Outlost = 0
59.                        qos9Outlost = 0
60.                       qos10Outlost = 0
61.                       qos11Outlost = 0
62.                       qos12Outlost = 0
63.                       qos13Outlost = 0
64.                       qos14Outlost = 0
65.                       qos15Outlost = 0
66.                       qos16Outlost = 0
67.                       qos17Outlost = 0
68.                       qos18Outlost = 0
69.                       qos19Outlost = 0
70.                       qos20Outlost = 0
71.                       qos21Outlost = 0
72.                       qos22Outlost = 0
73.                       qos23Outlost = 0
74.                       qos24Outlost = 0
75.                       qos25Outlost = 0
76.                       qos26Outlost = 0
77.                       qos27Outlost = 0
78.                       qos28Outlost = 0
79.                       qos29Outlost = 0
80.                       qos30Outlost = 0
81.                       qos31Outlost = 0
82.                    bpduCbicOutlost = 0
83.                    qos0CbicOutlost = 0
84.                    qos1CbicOutlost = 0
85.                    qos2CbicOutlost = 0
86.                    qos3CbicOutlost = 0
87.                         bpduInlost = 0
88.                         qos0Inlost = 0
89.                         qos1Inlost = 0
90.                         qos2Inlost = 0
91.                         qos3Inlost = 0
92.                         qos4Inlost = 0
93.                         qos5Inlost = 0
94.                         qos6Inlost = 0
95.                         qos7Inlost = 0
96.                         qos8Inlost = 0
97.                         qos9Inlost = 0
98.                        qos10Inlost = 0
99.                        qos11Inlost = 0
100.                        qos12Inlost = 0
101.                        qos13Inlost = 0
102.                        qos14Inlost = 0
103.                        qos15Inlost = 0
104.                        qos16Inlost = 0
105.                        qos17Inlost = 0
106.                        qos18Inlost = 0
107.                        qos19Inlost = 0
108.                        qos20Inlost = 0
109.                        qos21Inlost = 0
110.                        qos22Inlost = 0
111.                        qos23Inlost = 0
112.                        qos24Inlost = 0
113.                        qos25Inlost = 0
114.                        qos26Inlost = 0
115.                        qos27Inlost = 0
116.                        qos28Inlost = 0
117.                        qos29Inlost = 0
118.                        qos30Inlost = 0
119.                        qos31Inlost = 0
120.                         pqueInlost = 0
121.                           Overruns = 0
122.                           maxIndex = 0

This command will show you interface counters since they were last cleared. It even shows you when they were last cleared. To confirm this, I'm also including a show interface gigabitEthernet 1/15 which also has the last time the interface was cleared.


6509E#show counters interface gigabitEthernet 1/15 delta
Time since last clear
---------------------
11:50:29

64 bit counters:
 0.                      rxHCTotalPkts = 15163
 1.                      txHCTotalPkts = 10498
 2.                    rxHCUnicastPkts = 8429
 3.                    txHCUnicastPkts = 8346
 4.                  rxHCMulticastPkts = 6734
 5.                  txHCMulticastPkts = 2152
 6.                  rxHCBroadcastPkts = 0
 7.                  txHCBroadcastPkts = 0
 8.                         rxHCOctets = 1037219
 9.                         txHCOctets = 743295
10.                 rxTxHCPkts64Octets = 14372
11.            rxTxHCPkts65to127Octets = 11289
12.           rxTxHCPkts128to255Octets = 0
13.           rxTxHCPkts256to511Octets = 0
14.          rxTxHCpkts512to1023Octets = 0
15.         rxTxHCpkts1024to1518Octets = 0
16.                    txHCTrunkFrames = 0
17.                    rxHCTrunkFrames = 0
18.                     rxHCDropEvents = 0

32 bit counters:
 0.                   rxCRCAlignErrors = 0
 1.                   rxUndersizedPkts = 0
 2.                    rxOversizedPkts = 0
 3.                     rxFragmentPkts = 0
 4.                          rxJabbers = 0
 5.                       txCollisions = 0
 6.                         ifInErrors = 0
 7.                        ifOutErrors = 0
 8.                       ifInDiscards = 0
 9.                  ifInUnknownProtos = 0
10.                      ifOutDiscards = 0
11.            txDelayExceededDiscards = 0
12.                              txCRC = 0
13.                         linkChange = 0
14.                   wrongEncapFrames = 0
All Port Counters
 1.                          InPackets = 15159
 2.                           InOctets = 1036963
 3.                        InUcastPkts = 8428
 4.                        InMcastPkts = 6731
 5.                        InBcastPkts = 0
 6.                         OutPackets = 10497
 7.                          OutOctets = 743218
 8.                       OutUcastPkts = 8345
 9.                       OutMcastPkts = 2152
10.                       OutBcastPkts = 0
11.                           AlignErr = 0
12.                             FCSErr = 0
13.                            XmitErr = 0
14.                             RcvErr = 0
15.                          UnderSize = 0
16.                          SingleCol = 0
17.                           MultiCol = 0
18.                            LateCol = 0
19.                       ExcessiveCol = 0
20.                       CarrierSense = 0
21.                              Runts = 0
22.                             Giants = 0
23.                         InDiscards = 0
24.                        OutDiscards = 0
25.                           InErrors = 0
26.                          OutErrors = 0
27.                    InUnknownProtos = 0
28.                              txCRC = 0
29.                      TrunkFramesTx = 0
30.                      TrunkFramesRx = 0
31.                         WrongEncap = 0
32.     Broadcast_suppression_discards = 0
33.     Multicast_suppression_discards = 0
34.       Unicast_suppression_discards = 0
35.                 rxTxHCPkts64Octets = 14368
36.            rxTxHCPkts65to127Octets = 11288
37.           rxTxHCPkts128to255Octets = 0
38.           rxTxHCPkts256to511Octets = 0
39.          rxTxHCpkts512to1023Octets = 0
40.         rxTxHCpkts1024to1518Octets = 0
41.                         DropEvents = 0
42.                     CRCAlignErrors = 0
43.                     UndersizedPkts = 0
44.                      OversizedPkts = 0
45.                       FragmentPkts = 0
46.                            Jabbers = 0
47.                         Collisions = 0
48.              DelayExceededDiscards = 0
49.                        bpduOutlost = 0
50.                        qos0Outlost = 0
51.                        qos1Outlost = 0
52.                        qos2Outlost = 0
53.                        qos3Outlost = 0
54.                        qos4Outlost = 0
55.                        qos5Outlost = 0
56.                        qos6Outlost = 0
57.                        qos7Outlost = 0
58.                        qos8Outlost = 0
59.                        qos9Outlost = 0
60.                       qos10Outlost = 0
61.                       qos11Outlost = 0
62.                       qos12Outlost = 0
63.                       qos13Outlost = 0
64.                       qos14Outlost = 0
65.                       qos15Outlost = 0
66.                       qos16Outlost = 0
67.                       qos17Outlost = 0
68.                       qos18Outlost = 0
69.                       qos19Outlost = 0
70.                       qos20Outlost = 0
71.                       qos21Outlost = 0
72.                       qos22Outlost = 0
73.                       qos23Outlost = 0
74.                       qos24Outlost = 0
75.                       qos25Outlost = 0
76.                       qos26Outlost = 0
77.                       qos27Outlost = 0
78.                       qos28Outlost = 0
79.                       qos29Outlost = 0
80.                       qos30Outlost = 0
81.                       qos31Outlost = 0
82.                    bpduCbicOutlost = 0
83.                    qos0CbicOutlost = 0
84.                    qos1CbicOutlost = 0
85.                    qos2CbicOutlost = 0
86.                    qos3CbicOutlost = 0
87.                         bpduInlost = 0
88.                         qos0Inlost = 0
89.                         qos1Inlost = 0
90.                         qos2Inlost = 0
91.                         qos3Inlost = 0
92.                         qos4Inlost = 0
93.                         qos5Inlost = 0
94.                         qos6Inlost = 0
95.                         qos7Inlost = 0
96.                         qos8Inlost = 0
97.                         qos9Inlost = 0
98.                        qos10Inlost = 0
99.                        qos11Inlost = 0
100.                        qos12Inlost = 0
101.                        qos13Inlost = 0
102.                        qos14Inlost = 0
103.                        qos15Inlost = 0
104.                        qos16Inlost = 0
105.                        qos17Inlost = 0
106.                        qos18Inlost = 0
107.                        qos19Inlost = 0
108.                        qos20Inlost = 0
109.                        qos21Inlost = 0
110.                        qos22Inlost = 0
111.                        qos23Inlost = 0
112.                        qos24Inlost = 0
113.                        qos25Inlost = 0
114.                        qos26Inlost = 0
115.                        qos27Inlost = 0
116.                        qos28Inlost = 0
117.                        qos29Inlost = 0
118.                        qos30Inlost = 0
119.                        qos31Inlost = 0
120.                         pqueInlost = 0
121.                           Overruns = 0
122.                           maxIndex = 0

6509E#show int gi 1/15
GigabitEthernet1/15 is up, line protocol is up (connected)
  Hardware is C6k 1000Mb 802.3, address is 001c.f9d7.e400 (bia 001c.f9d7.e400)
  Description: XXXXXXXXXXXXX
  Internet address is X,X,X,X/30
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 1000Mb/s, media type is SX
  input flow-control is off, output flow-control is on
  Clock mode is auto
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:04, output 00:00:04, output hang never
  Last clearing of "show interface" counters 11:51:15
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
  L2 Switched: ucast: 8437 pkt, 595439 bytes - mcast: 0 pkt, 0 bytes
  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast
  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes
     15176 packets input, 1038132 bytes, 0 no buffer
     Received 6738 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     10508 packets output, 743999 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out

Viewing ASIC Mappings - 6509E & 3750E

48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX

6509E#show int gi 2/1 capabilities | include ASIC
  Ports-in-ASIC (Sub-port ASIC) : 1-24 (1-12)6509E#show int gi 2/13 capabilities | include ASIC
  Ports-in-ASIC (Sub-port ASIC) : 1-24 (13-24)6509E#show int gi 2/25 capabilities | include ASIC
  Ports-in-ASIC (Sub-port ASIC) : 25-48 (25-36)6509E#show int gi 2/37 capabilities | include ASIC
  Ports-in-ASIC (Sub-port ASIC) : 25-48 (37-48)




So ports 1-12 are on one ASIC, 13-24 on another and so one. Now what does the 1-24 and 25-48 mean? It means Janus 1 and Janus 2, those are Fabric Interface/Replication Engines. 




3750E#show platform pm if-numbers

interface gid  gpn  lpn  port slot unit slun port-type lpn-idb gpn-idb
----------------------------------------------------------------------
Gi1/0/1   1    1    1    1/1  1    1    1    local     Yes     Yes
Gi1/0/2   2    2    2    1/0  1    2    2    local     Yes     Yes
Gi1/0/3   3    3    3    1/3  1    3    3    local     Yes     Yes
Gi1/0/4   4    4    4    1/2  1    4    4    local     Yes     Yes
Gi1/0/5   5    5    5    1/5  1    5    5    local     Yes     Yes
Gi1/0/6   6    6    6    1/4  1    6    6    local     Yes     Yes
Gi1/0/7   7    7    7    1/9  1    7    7    local     Yes     Yes
Gi1/0/8   8    8    8    1/8  1    8    8    local     Yes     Yes
Gi1/0/9   9    9    9    1/11 1    9    9    local     Yes     Yes
Gi1/0/10  10   10   10   1/10 1    10   10   local     Yes     Yes
Gi1/0/11  11   11   11   1/13 1    11   11   local     Yes     Yes
Gi1/0/12  12   12   12   1/12 1    12   12   local     Yes     Yes
Gi1/0/13  13   13   13   1/15 1    13   13   local     Yes     Yes
Gi1/0/14  14   14   14   1/14 1    14   14   local     Yes     Yes
Gi1/0/15  15   15   15   1/17 1    15   15   local     Yes     Yes
Gi1/0/16  16   16   16   1/16 1    16   16   local     Yes     Yes
Gi1/0/17  17   17   17   1/19 1    17   17   local     Yes     Yes
Gi1/0/18  18   18   18   1/18 1    18   18   local     Yes     Yes
Gi1/0/19  19   19   19   1/23 1    19   19   local     Yes     Yes
Gi1/0/20  20   20   20   1/22 1    20   20   local     Yes     Yes
Gi1/0/21  21   21   21   1/25 1    21   21   local     Yes     Yes
Gi1/0/22  22   22   22   1/24 1    22   22   local     Yes     Yes
Gi1/0/23  23   23   23   1/27 1    23   23   local     Yes     Yes
Gi1/0/24  24   24   24   1/26 1    24   24   local     Yes     Yes
Gi1/0/25  25   25   25   2/1  1    25   25   local     Yes     Yes
Gi1/0/26  26   26   26   2/0  1    26   26   local     Yes     Yes
Gi1/0/27  27   27   27   2/3  1    27   27   local     Yes     Yes
Gi1/0/28  28   28   28   2/2  1    28   28   local     Yes     Yes
Gi1/0/29  29   29   29   2/5  1    29   29   local     Yes     Yes
Gi1/0/30  30   30   30   2/4  1    30   30   local     Yes     Yes
Gi1/0/31  31   31   31   2/9  1    31   31   local     Yes     Yes
Gi1/0/32  32   32   32   2/8  1    32   32   local     Yes     Yes
Gi1/0/33  33   33   33   2/11 1    33   33   local     Yes     Yes
Gi1/0/34  34   34   34   2/10 1    34   34   local     Yes     Yes
Gi1/0/35  35   35   35   2/13 1    35   35   local     Yes     Yes
Gi1/0/36  36   36   36   2/12 1    36   36   local     Yes     Yes
Gi1/0/37  37   37   37   2/15 1    37   37   local     Yes     Yes
Gi1/0/38  38   38   38   2/14 1    38   38   local     Yes     Yes
Gi1/0/39  39   39   39   2/17 1    39   39   local     Yes     Yes
Gi1/0/40  40   40   40   2/16 1    40   40   local     Yes     Yes
Gi1/0/41  41   41   41   2/19 1    41   41   local     Yes     Yes
Gi1/0/42  42   42   42   2/18 1    42   42   local     Yes     Yes
Gi1/0/43  43   43   43   2/23 1    43   43   local     Yes     Yes
Gi1/0/44  44   44   44   2/22 1    44   44   local     Yes     Yes
Gi1/0/45  45   45   45   2/25 1    45   45   local     Yes     Yes
Gi1/0/46  46   46   46   2/24 1    46   46   local     Yes     Yes
Gi1/0/47  47   47   47   2/27 1    47   47   local     Yes     Yes
Gi1/0/48  48   48   48   2/26 1    48   48   local     Yes     Yes
Gi1/0/49  49   49   49   0/20 1    49   49   local     Yes     Yes
Gi1/0/50  50   50   50   0/21 1    50   50   local     Yes     Yes
Gi1/0/51  51   51   51   0/6  1    51   51   local     Yes     Yes
Gi1/0/52  52   52   52   0/7  1    52   52   local     Yes     Yes
Te1/0/1   53   53   53   0/14 1    1    53   local     Yes     Yes
Te1/0/2   54   54   54   0/0  1    2    54   local     Yes     Yes
Po10      584  584  0    2/0  10   10   10   local     No      No
Po11      592  592  0    2/0  10   11   11   local     No      No
St1       896  896  0    16/0  1    0    0    internal  Yes     Yes


The first number in the ports column is the ASIC that it falls on. When you design your network, always take this into consideration as you don't want to overload an ASIC or a replication engine and among many other things.  Something else to consider is your TCAM size, refer to my TCAM article.


 

Verifying ACL's and Prefix-list

It has been a while since I posted anything, apologies.  I have been very very busy at work with new projects. Some simple commands to verify an ACL/Prefix-list is getting programmed correctly into the TCAM(Hardware)

6509E#show tcam interface gigabitEthernet 7/1 acl in ip detail

* Global Defaults not shared

-------------------------------------------------------------------------------------------------------------------
DPort - Destination Port   SPort - Source Port        TCP-F - U -URG             Pro   - Protocol
I     - Inverted LOU       TOS   - TOS Value                - A -ACK             rtr   - Router
MRFM  - M -MPLS Packet     TN    - T -Tcp Control           - P -PSH             COD   - C -Bank Care Flag
      - R -Recirc. Flag          - N -Non-cachable          - R -RST                   - I -OrdIndep. Flag
      - F -Fragment Flag   CAP   - Capture Flag             - S -SYN                   - D -Dynamic Flag
      - M -More Fragments  F-P   - FlowMask-Prior.          - F -FIN             T     - V(Value)/M(Mask)/R(Result)
X     - XTAG               (*)   - Bank Priority
-------------------------------------------------------------------------------------------------------------------




Interface: 1018   label: 1025   lookup_type: 0
protocol: IP   packet-type: 0

+-+-----+---------------+---------------+---------------+---------------+-------+---+----+-+---+--+---+---+
|T|Index|  Dest Ip Addr | Source Ip Addr|     DPort     |     SPort     | TCP-F |Pro|MRFM|X|TOS|TN|COD|F-P|
+-+-----+---------------+---------------+---------------+---------------+-------+---+----+-+---+--+---+---+

Entries from Bank 0

 V 17139         0.0.0.0     10.202.218.2       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17140         0.0.0.0  10.187.36.133       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17141         0.0.0.0  10.187.36.240       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17142         0.0.0.0  10.187.50.138       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17143         0.0.0.0     10.51.3.35       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17145         0.0.0.0   10.10.83.93       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17153         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

6509E#show ip prefix-list detail to-someone
ip prefix-list to-someone:
   count: 8, range entries: 0, sequences: 25 - 70, refcount: 2
   seq 25 permit 1.1.1.0/23 (hit count: 20, refcount: 1)
   seq 35 permit 10.79.105.0/24 (hit count: 20, refcount: 1)
   seq 40 permit 10.67.251.0/24 (hit count: 20, refcount: 2)
   seq 50 permit 10.55.224.0/23 (hit count: 20, refcount: 1)
   seq 55 permit 10.55.192.0/24 (hit count: 9, refcount: 1)
   seq 60 permit 10.55.193.0/24 (hit count: 1, refcount: 2)
   seq 65 permit 10.55.194.0/24 (hit count: 1, refcount: 1)
   seq 70 permit 10.55.195.0/24 (hit count: 1, refcount: 5)

Good reference Link.

http://www.i-1.nl/blog/?p=134