IQ Spoofing

ELK, ELK 설치

잉여토끼 — Wed, 11 Dec 2024 19:02:13 +0900

ELK 등장 배경

모니터링

ssh : 접속시 시스템정보를 제공.

snmp : snmp work를 실행하여 OID값을 취합하여 정보를 확인. 단, 갱신 시간 텀이 5분이라는 단점이 존재. 트래픽이 많기 떄문.

현제는 네트워크의 속도, 서버의 퍼포먼스, 저장소 용량이 모두 증가 --> 클라우드의 등장.

클라우드로 인해 과거와 달리 다른 네트워크가 하나의 도매인으로 묶여 서버팜을 형성 시킬 수 있음. 따라서 네트워크가 대규모로 이루어짐.

보안솔루션은 대부분 국지적 특성을 가짐.

해당 네트워크와 도메인은 같은 지역적 위치를 가짐.

--> 통합 관리가 필요하다.

snmp의 Cacti나 mrtg같은 경우 부하가 심함. 이를 그나마 분산구축을 통해 부하를 줄일 수 있음.

ESM(Enterprise Security Menagement)의 경우 통합 로그 분석이 이루어지므로 분산구축을 통해서도 못함. 로그양이 너무 많음. --> 보안과 관련된 정보만을 필터링하여 저장. 이를 SIEM(Security Information and Event Management)이라 함.

SIEM은 시스템이 보내주는 정보 + 서비스 이용 정보를 취합하여 원하는 정보만을 뽑아냄.

이에 대표적인 시스템이 Elastic이다.

ESM

ESM : Enterprise Security Management, 통합 보안 관리

종류

IDS : Security Onion
IPS : pfSence
VPN : ASAv / Router
인증 암호화
백신
WAF : mod_security
백업 --> 이기종 솔루션 : 통합

UTM

보안장비의 각자 로그 정보의 경우 밴더사마다 다름.

--> 통합이 어려움.

초기의 보안개념은 침입 차단 시스템(Firewall)이였으나 최근의 보안은 침입 탐지(IDS), 가상 사설망(VPN), 시스템 보안, 인증, 바이러스, 데이터 백업에 이르기까지 전문화 되는 양상을 띄고 있음.

각각의 보안 기술들이 가진 기밀성, 무결성, 가용성, 접근통제 등의 기능은 상호간의연동을 필요로 하며 연동 될 경우 더 큰 효과를 가질 수 있음.

UTM(Unified Threat Management)

: 통합 보안장비

하나의 장비에서 여러 보안기능을 통합적으로 제공하여 다양하고 복잡한 보안 위협에 대응하고 편의성과 비용절감의 강점이 부각되며 네트워크 보안 시장에 거스를 수 없는 흐름.

기능

방화벽 (Firewall)
VPN
IPS/IDS
안티 바이러스/안티 스파이웨어
안티 스팸
웹 필터링(Web Filtering)
Appliation Control
L2/L3 Routing
Data Loss Prevention
Wan Optiomization
Wireless LAN Security

한계점

사용자의 정책 관리 위주 제품 --> 실제 보안 효용성이 상대적으로 떨어짐.
취약점과 위험요소 분석 및 모니터링

구조(Node)

Node 개념을 이용한 cluster 구축이 가능]

계층 구조를 가지며 cloud 환경에 적합.

SIEM (Security Information and Event Management)

기준점 : 시간(Time) --> NTP 동기화가 필요함. 지역적 특색을 가짐. (GMT +9:00(UTC))

정보를 수집(Logsash) --> 분석(Elastic Search) --> 결과값 도출 --> 문서화 --> 웹(Kibana)

Elastic Search

: DBMS(Timestamp/시간정보 기준을 부여 --> 하나의 시계열 상에서 모든 정보를 볼 수 있음.)

Elastic Search는 DBMS와 같다.

DBMS에서 DB 생성시 해당 DB가 검색 대상임

인덱스(Indise) --> 검색의 대상.

DBMS와의 차이점은 하나의 DB처럼 되어있으나 흘러가고있는 DB임. 실시간으로 데이터가 수정되고 있음.

--> 파이프라고 볼 수 있음

제어 Port : 9200/tcp

DATA Port : 9300/tcp

Logstash(로그수집기)

: Elastic Search가 수집까지 하면 부하가 큼 --> 해당 기능을 수행해줌. 호스트의 정보를 수집하여 Elastic에게 전달하는 역할. 수집시 필터링 및 포멧 통일화.

Kibana(GUI)

: Elastic Search 에게서 정보를 가져와서 그래프 형식의 GUI 형식으로 보여줌.

Port : 5601/tcp

Beats

: 서버에서 자신 서버의 정보를 수집하여 Logstah나 Elastic Search에게 전달. 어디에 전달할지는 설정이 가능.

1. 로그를 발생 할 수 있는 모든 디바이스 (서버 / 보안장비 / 솔루션 / 가상서버 (AWS_GCP_NHN))

2. 정보수집기(특정 Log) --> Elastic Search에 직접 전달 가능. LogStach에 전달 가능.

3. 정보수집기 : beats가 보내오는 정보를 취합

4. 정보수집기 : 로그 통합(필터링 / 표준화)

5. Logstash / Beats가 보낸 정보를 적재 및 분석

6. Elastic Search가 보낸 정보를 Visual화

켜기 / 끄기 순서

에러가 발생 할 수 있으므로 해당 순서를 지키는것이 좋음

켜기와 끄기는 역순

1. 켜기

Elastic Search --> Kibana --> Logstash --> Beats

2. 끄기

Beats--> Logstash --> Kibana --> Elastic Search

설치

준비 : Elastic Search 동작서버 --> 메모리 최소 8기가

Elastic 4GB, Java 4GB가 필요.

1. Elastic Search 설치

https://www.elastic.co/kr/downloads/elasticsearch

Download Elasticsearch

Download Elasticsearch or the complete Elastic Stack (formerly ELK stack) for free and start searching and analyzing in minutes with Elastic....

www.elastic.co

elasticsearch.repo

파일을

/etc/yum.repos.d/에 생성

[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

설치

sudo dnf install --enablerepo=elasticsearch elasticsearch

설치시 키값 반드시 저장해두기

[root@localhost ~]# cd /etc/yum.repos.d/
[root@localhost yum.repos.d]# vim elasticsearch.repo
[root@localhost yum.repos.d]# sudo dnf install --enablerepo=elasticsearch elasticsearch
MariaDB                                                        10 kB/s | 3.4 kB     00:00
CentOS Stream 9 - BaseOS                                       11 kB/s | 7.2 kB     00:00
CentOS Stream 9 - BaseOS                                      7.5 MB/s | 8.4 MB     00:01
CentOS Stream 9 - AppStream                                    11 kB/s | 7.3 kB     00:00
CentOS Stream 9 - AppStream                                   9.2 MB/s |  21 MB     00:02
CentOS Stream 9 - Extras packages                              11 kB/s | 8.9 kB     00:00
Elasticsearch repository for 8.x packages                      53 MB/s |  80 MB     00:01
Extra Packages for Enterprise Linux 9 - x86_64                 15 kB/s |  17 kB     00:01
Extra Packages for Enterprise Linux 9 - x86_64                 13 MB/s |  23 MB     00:01
Extra Packages for Enterprise Linux 9 openh264 (From Cisco) - 1.4 kB/s | 993  B     00:00
Extra Packages for Enterprise Linux 9 - Next - x86_64          32 kB/s |  17 kB     00:00
Extra Packages for Enterprise Linux 9 - Next - x86_64         185 kB/s | 228 kB     00:01
Remi's Modular repository for Enterprise Linux 9 - x86_64     2.7 kB/s | 3.5 kB     00:01
Remi's Modular repository for Enterprise Linux 9 - x86_64     232 kB/s | 748 kB     00:03
Safe Remi's RPM repository for Enterprise Linux 9 - x86_64    2.6 kB/s | 3.0 kB     00:01
Safe Remi's RPM repository for Enterprise Linux 9 - x86_64    326 kB/s | 1.1 MB     00:03
종속성이 해결되었습니다.
==============================================================================================
 꾸러미                  구조             버전                  저장소                   크기
==============================================================================================
설치 중:
 elasticsearch           x86_64           8.16.1-1              elasticsearch           606 M

연결 요약
==============================================================================================
설치  1 꾸러미

전체 내려받기 크기: 606 M
설치된 크기 : 1.1 G
진행할까요? [y/N]: y
꾸러미 내려받기 중:
elasticsearch-8.16.1-x86_64.rpm                                45 MB/s | 606 MB     00:13
----------------------------------------------------------------------------------------------
합계                                                           45 MB/s | 606 MB     00:13
Elasticsearch repository for 8.x packages                      26 kB/s | 1.8 kB     00:00
GPG키 0xD88E42B4 가져오는 중:
사용자 ID : "Elasticsearch (Elasticsearch Signing Key) <dev_ops@elasticsearch.org>"
지문: 4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4
출처 : https://artifacts.elastic.co/GPG-KEY-elasticsearch
진행할까요? [y/N]: y
키 가져오기에 성공했습니다
연결 확인 실행 중
연결 확인에 성공했습니다.
연결 시험 실행 중
연결 시험에 성공했습니다.
연결 실행 중
  준비 중     :                                                                           1/1
  구현 중     : elasticsearch-8.16.1-1.x86_64                                             1/1
Creating elasticsearch group... OK
Creating elasticsearch user... OK

  설치 중     : elasticsearch-8.16.1-1.x86_64                                             1/1
  구현 중     : elasticsearch-8.16.1-1.x86_64                                             1/1
--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : z7S3Cwr40Y*CoT+uZujD

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service

/usr/lib/tmpfiles.d/elasticsearch.conf:1: Line references path below legacy directory /var/run/, updating /var/run/elasticsearch → /run/elasticsearch; please update the tmpfiles.d/ drop-in file accordingly.

  확인 중     : elasticsearch-8.16.1-1.x86_64                                             1/1

설치되었습니다:
  elasticsearch-8.16.1-1.x86_64

완료되었습니다!

daemon 및 서비스 재시작

 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
 sudo systemctl start elasticsearch.service

설정파일 수정

Path : /etc/elasticsearch

# jvm.options

## 메모리 변경. 공백이 없어야 함.
-Xms4g
-Xmx4g

# elasticsearch.yml

## 클러스터 명
cluster.name: my-application

## Node 명
node.name: node-1

## Node Network 설정
network.host: 172.16.20.8

## 사용할 HTTP 포트
http.port: 9200

## 동작 확인 HOST IP
discovery.seed_hosts: ["127.0.0.1", "172.16.20.8"]

## 클러스트 노드 설정
## 에러 발생시 주석처리
## 혹은 109 line 에서 localhost 주석처리 
cluster.initial_master_nodes: ["node-1"]




## xpack 비활성화
xpack.security.enabled: false

xpack.security.enrollment.enabled: false

재시작

systemctl restart eleasticsearch.service

설치 확인

[root@localhost elasticsearch]# curl -XGET http://172.16.20.8:9200
{
  "name" : "node-1",
  "cluster_name" : "my-application",
  "cluster_uuid" : "2hDhpHcfS9yC1aHVyh6d4g",
  "version" : {
    "number" : "8.16.1",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "ffe992aa682c1968b5df375b5095b3a21f122bf3",
    "build_date" : "2024-11-19T16:00:31.793213192Z",
    "build_snapshot" : false,
    "lucene_version" : "9.12.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

2. Kibana 설치 --> WAS 필요

https://www.elastic.co/downloads/kibana

Download Kibana Free | Get Started Now

Download Kibana or the complete Elastic Stack (formerly ELK stack) for free and start visualizing, analyzing, and exploring your data with Elastic in minutes....

www.elastic.co

kibana.repo 파일을 /etc/yum.repos.d/에 생성

[kibana-8.x]
name=Kibana repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

설치

sudo dnf install kibana

[root@localhost yum.repos.d]# sudo dnf install kibana -y
Kibana repository for 8.x packages                                                                                                                                                    5.7 MB/s |  80 MB     00:14
마지막 메타자료 만료확인(0:00:30 이전): 2024년 12월 11일 (수) 오후 04시 26분 00초.
종속성이 해결되었습니다.
======================================================================================================================================================================================================================
 꾸러미                                            구조                                              버전                                                 저장소                                                 크기
======================================================================================================================================================================================================================
설치 중:
 kibana                                            x86_64                                            8.16.1-1                                             kibana-8.x                                            333 M

연결 요약
======================================================================================================================================================================================================================
설치  1 꾸러미

전체 내려받기 크기: 333 M
설치된 크기 : 993 M
꾸러미 내려받기 중:
kibana-8.16.1-x86_64.rpm                                                                                                                                                               13 MB/s | 333 MB     00:24
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
합계                                                                                                                                                                                   13 MB/s | 333 MB     00:24
연결 확인 실행 중
연결 확인에 성공했습니다.
연결 시험 실행 중
연결 시험에 성공했습니다.
연결 실행 중
  준비 중     :                                                                                                                                                                                                   1/1
  구현 중     : kibana-8.16.1-1.x86_64                                                                                                                                                                            1/1
  설치 중     : kibana-8.16.1-1.x86_64                                                                                                                                                                            1/1
  구현 중     : kibana-8.16.1-1.x86_64                                                                                                                                                                            1/1
Creating kibana group... OK
Creating kibana user... OK

Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/8.16/production.html#openssl-legacy-provider
Created Kibana keystore in /etc/kibana/kibana.keystore

/usr/lib/tmpfiles.d/elasticsearch.conf:1: Line references path below legacy directory /var/run/, updating /var/run/elasticsearch → /run/elasticsearch; please update the tmpfiles.d/ drop-in file accordingly.

  확인 중     : kibana-8.16.1-1.x86_64                                                                                                                                                                            1/1

설치되었습니다:
  kibana-8.16.1-1.x86_64

완료되었습니다!

설정 --> Kibana 와 Elastic Search 연동

Path : /etc/kibana

# kibana.yml

## kibana port
server.port: 5601

## kibana host IP
server.host: "172.16.20.8"

## elastic search 연동
elasticsearch.hosts: ["http://172.16.20.8:9200"]

재시작

[root@localhost kibana]# systemctl restart kibana.service
[root@localhost kibana]# systemctl status kibana.service
● kibana.service - Kibana
     Loaded: loaded (/usr/lib/systemd/system/kibana.service; disabled; preset: disabled)
     Active: active (running) since Wed 2024-12-11 16:51:50 KST; 8s ago
       Docs: https://www.elastic.co
   Main PID: 8619 (node)
      Tasks: 11 (limit: 48580)
     Memory: 332.8M
        CPU: 9.551s
     CGroup: /system.slice/kibana.service
             └─8619 /usr/share/kibana/bin/../node/glibc-217/bin/node /usr/share/kibana/bin/../src/cli/dist

12월 11 16:51:50 localhost.localdomain systemd[1]: Started Kibana.
12월 11 16:51:50 localhost.localdomain kibana[8619]: Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/8.1>
12월 11 16:51:51 localhost.localdomain kibana[8619]: {"log.level":"info","@timestamp":"2024-12-11T07:51:51.567Z","log.logger":"elastic-apm-node","ecs.version":"8.10.0","agentVersion":"4.7.3","env":{"pid":8619,"pro>
12월 11 16:51:51 localhost.localdomain kibana[8619]: Native global console methods have been overridden in production environment.
12월 11 16:51:52 localhost.localdomain kibana[8619]: [2024-12-11T16:51:52.941+09:00][INFO ][root] Kibana is starting
12월 11 16:51:52 localhost.localdomain kibana[8619]: [2024-12-11T16:51:52.980+09:00][INFO ][node] Kibana process configured with roles: [background_tasks, ui]

Kibana 접속

http://172.16.20.8:5601

3. Logstash 설치

https://www.elastic.co/kr/downloads/logstash

Download Logstash Free | Get Started Now

Download Logstash or the complete Elastic Stack (formerly ELK stack) for free and start collecting, searching, and analyzing your data with Elastic in minutes....

www.elastic.co

GPG키 등록

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

/etc/yum.repos.d/ 디렉터리에 logstash.repo파일 생성

[logstash-8.x]
name=Elastic repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

설치

sudo yum install logstash

설정

Path : /etc/logstash/

# logstash.yml

# ------------ API Settings -------------
## api 사용 설정
api.enabled: true

## api ip
api.http.host: 172.16.20.8


## api port
api.http.port: 9600-9700

## logstash ssh Brute Force 탐지 예제

cd /etc/logstash/conf.d
echo "input {
        file {
                type => "Secure_log"
                path => "/var/log/secure"
        }
}
filter{
        grok {
                add_tag => [ "sshd_fail" ]
                match => { "message" => "Failed %{WORD:sshd_auth_type} for %{USERNAME:sshd_invalid_user} from %{IP:sshd_client_ip} port %{NUMBER:sshd_port} %{GREEDYDATA:sshd_protocol}" }
  }
}
output{
        elasticsearch {
                hosts => ["http://172.16.20.8:9200"]
                index => "sshd_fail-%{+YYYY.MM}"
        }
}" > sshd.conf

Secure_log 파일에서 match에 해당하는 에러 발생 시 add_tag에 해당하는 태그를 달아서 elasticsearch에 전달.

logstash 서비스가 /var/log/secrue에 접근이 가능해야하므로 permition을 확인해야 한다.

[root@localhost conf.d]# chgrp logstash /var/log/secure
[root@localhost conf.d]# chmod 640 /var/log/secure

또다른 snort 예시

# snort 예시

input {
  file {
    path => "/var/log/snort/alert"
    type => "snort_log"
    start_position => beginning
    ignore_older => 0
    sincedb_path => "/dev/null"
  }
}

filter {
  if [type] == "snort_log" {
    grok {
      match => [ "message", "%{SNORTTIME:snort_time}\s+\[\*\*]\s+\[%{INT:gid}\:%{INT:sid}\:%{INT:rev}\]\s+\[%{DATA:atk_cat}\]\s+\[\*\*\]\s+\[Priority:\s+%{INT:priority}\]\s+{%{DATA:protocol}}\s+%{IP:src_ip}(\:%{INT:src_port})?\s+\-\>\s+%{IP:dst_ip}(\:%{INT:dst_port})?"]
      }
  }
  date {
    match => [ "snort_time", "MM/dd-HH:mm:ss.SSSSSS" ]
  }
  geoip {
    source => "src_ip"
    target => "geoip_snort_src"
  }
  geoip {
    source => "dst_ip"
    target => "geoip_snort_dst"
  }
  mutate {
    convert => {"[location][lat]" => "float"}
    convert => {"[location][lon]" => "float"}
  }
}


output {
          elasticsearch {
                hosts => ["http://172.16.20.8:9200"]
                index => "logstash_snort-%{+YYYY.MM}"
         }
}

4. Beats 설치

https://www.elastic.co/kr/downloads/beats

Beats 다운로드: Elasticsearch를 위한 데이터 수집기

Elastic Stack용 경량 데이터 수집기인 Beats를 사용하여 데이터를 Elasticsearch로 손쉽게 수집하고 로그 파일, CPU 메트릭, 네트워크 데이터 등을 처리하세요....

www.elastic.co

패킷 beat 설치

dnf -y install packetbeat

설정

Path : /etc/packetbeat

# packetbeat.yml

## Kibana의 dashboard setup 가능 여부
## elastic search 인덱스와 연동을 자동으로 함.
setup.dashboards.enabled: true

## kibana setting
setup.kibana:
  host: "172.16.20.8:5601"

## output 설정
## elastac search or logstash
output.elasticsearch:
  hosts: ["172.16.20.8:9200"]
  
#output.logstash:
  #hosts: ["172.16.20.8:5044"]

시작

systemctl start packetbeat

Dashboard Setup

elastic search 에서 정보를 받도록 설정

packetbeat setup --dashboards

# Heartbeat
# heartbeat setup -e

[root@localhost packetbeat]# packetbeat setup --dashboards
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

5. packetbeat 확인

Stack Management --> Index Management --> Data Streams

Discovery

Beats

Filebeat

로그 파일 데이터를 수집
시스템, 애플리케이션 등의 로그에서 사용
Web log 또는 machine log 등이 저장되는 파일 경로를 지정하기만 하면 Filebeat은 해당 경로에 적재되는 파일을 읽어들이며 새로운 내용이 추가될 때 마다 전송

[설치]

dnf install filebeat -y

# /etc/filebeat/filebeat.yml

filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
    - /var/log/*.log

setup.dashboards.enabled: true


setup.kibana:
  host: "172.16.20.8:5601"

output.elasticsearch:
  hosts: ["172.16.20.8:9200"]

systemctl start filebeat
filbeat setup --dashboards

[root@localhost filebeat]# filebeat setup --dashboards
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

Packetbeat

설치된 시스템의 패킷을 스니핑 하여 트래픽을 모니터링하고 패킷 데이터를 수집
네트워크 성능 모니터링 등에 사용
HTTP, MySQL, DNS등 프로토콜 데이터 분석 가능

Winlogbeat

Windows 이벤트 로그 데이터 수집
Windows 서버 및 클라이언트 로그에 사용

Metricbeat

System, Service 등의 메트릭 데이터 수집
CPU 사용률, 메모리 상태, 디스크 I/O, 네트워크 트래픽 등의 모니터링에 사용
Docker과 같은 서버스의 메트릭 또한 수집 가능

[설치]

 dnf -y install metricbeat

# /etc/metricbeat/metricbeat.yml

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  _source.enabled: true


setup.dashboards.enabled: true


setup.kibana:
  host: "172.16.20.8:5601"
  
output.elasticsearch:
  hosts: ["172.16.20.8:9200"]

[root@localhost filebeat]# systemctl start metricbeat
[root@localhost filebeat]# metricbeat setup --dashboards
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

Heartbeat

Application 및 Service의 가용성을 모니터링
Web Service, DB, 기타 네트워크 서비스 상태 확인에 사용
ICMP, HTTP, TCP 등의 프로토콜을 활용하여 주기적인 상태를 점검

[설치]

dnf -y install heartbeat-elastic

# /etc/heartbeat/heartbeat.yml

heartbeat.config.monitors:
  path: ${path.config}/monitors.d/*.yml
  reload.enabled: true
  reload.period: 5s

heartbeat.monitors:
- type: http
  enabled: true
  id: my-monitor
  name: My Monitor
  urls: ["http://172.16.20.8:9200"]
  schedule: '@every 10s'


setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  _source.enabled: true



setup.kibana:
  host: "172.16.20.8:5601"

output.elasticsearch:
  hosts: ["172.16.20.8:9200"]
  preset: balanced

[root@localhost filebeat]# systemctl start heartbeat-elastic.service
[root@localhost filebeat]# heartbeat setup -e
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.184+0900","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":1058},"message":"Home path: [/usr/share/heartbeat] Config path: [/etc/heartbeat] Data path: [/var/lib/heartbeat] Logs path: [/var/log/heartbeat]","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.184+0900","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":1066},"message":"Beat ID: a7248814-935a-4655-8e1e-5d0ee345b29b","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.332+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).createBeater","file.name":"instance/beat.go","file.line":570},"message":"Setup Beat: heartbeat; Version: 8.16.1","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.332+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).logSystemInfo","file.name":"instance/beat.go","file.line":1619},"message":"Beat info","service.name":"heartbeat","system_info":{"beat":{"path":{"config":"/etc/heartbeat","data":"/var/lib/heartbeat","home":"/usr/share/heartbeat","logs":"/var/log/heartbeat"},"type":"heartbeat","uuid":"a7248814-935a-4655-8e1e-5d0ee345b29b"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.333+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).logSystemInfo","file.name":"instance/beat.go","file.line":1628},"message":"Build info","service.name":"heartbeat","system_info":{"build":{"commit":"f17e0828f1de9f1a256d3f520324fa6da53daee5","libbeat":"8.16.1","time":"2024-11-14T14:57:17.000Z","version":"8.16.1"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.333+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).logSystemInfo","file.name":"instance/beat.go","file.line":1631},"message":"Go runtime info","service.name":"heartbeat","system_info":{"go":{"os":"linux","arch":"amd64","max_procs":8,"version":"go1.22.9"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.333+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).logSystemInfo","file.name":"instance/beat.go","file.line":1637},"message":"Host info","service.name":"heartbeat","system_info":{"host":{"architecture":"x86_64","native_architecture":"","boot_time":"2024-12-11T15:18:13+09:00","containerized":false,"name":"localhost.localdomain","ip":["127.0.0.1","::1","172.16.20.8","fe80::20c:29ff:fee4:da27"],"kernel_version":"5.14.0-496.el9.x86_64","mac":["00:0c:29:e4:da:27"],"os":{"type":"linux","family":"redhat","platform":"centos","name":"CentOS Stream","version":"9","major":9,"minor":0,"patch":0},"timezone":"KST","timezone_offset_sec":32400,"id":"75fc1165d88849bbbaba1e6e7e8d758c"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.334+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).logSystemInfo","file.name":"instance/beat.go","file.line":1666},"message":"Process info","service.name":"heartbeat","system_info":{"process":{"capabilities":{"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","perfmon","bpf","checkpoint_restore"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","perfmon","bpf","checkpoint_restore"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","perfmon","bpf","checkpoint_restore"],"ambient":null},"cwd":"/etc/filebeat","exe":"/usr/share/heartbeat/bin/heartbeat","name":"heartbeat","pid":48906,"ppid":6687,"seccomp":{"mode":"disabled","no_new_privs":false},"start_time":"2024-12-11T18:59:33.230+0900"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.341+0900","log.logger":"elasticsearch","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.makeES","file.name":"elasticsearch/elasticsearch.go","file.line":63},"message":"Applying performance preset 'balanced': {\n  \"bulk_max_size\": 1600,\n  \"compression_level\": 1,\n  \"idle_connection_timeout\": \"3s\",\n  \"queue\": {\n    \"mem\": {\n      \"events\": 3200,\n      \"flush\": {\n        \"min_events\": 1600,\n        \"timeout\": \"10s\"\n      }\n    }\n  },\n  \"worker\": 1\n}","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2024-12-11T18:59:34.341+0900","log.logger":"elasticsearch","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.makeES","file.name":"elasticsearch/elasticsearch.go","file.line":66},"message":"Performance preset 'balanced' overrides user setting for field 'bulk_max_size'","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.342+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection","file.name":"eslegclient/connection.go","file.line":133},"message":"elasticsearch url: http://172.16.20.8:9200","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.342+0900","log.logger":"publisher","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.LoadWithSettings","file.name":"pipeline/module.go","file.line":105},"message":"Beat name: localhost.localdomain","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.343+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection","file.name":"eslegclient/connection.go","file.line":133},"message":"elasticsearch url: http://172.16.20.8:9200","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.345+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping","file.name":"eslegclient/connection.go","file.line":322},"message":"Attempting to connect to Elasticsearch version 8.16.1 (default)","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.345+0900","log.origin":{"function":"github.com/elastic/beats/v7/heartbeat/beater.New.AtomicStateLoader.func3","file.name":"monitorstate/tracker.go","file.line":157},"message":"Updated atomic state loader","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.345+0900","log.origin":{"function":"github.com/elastic/beats/v7/heartbeat/scheduler.getJobLimitSem","file.name":"scheduler/scheduler.go","file.line":79},"message":"limiting to 2 concurrent jobs for 'browser' type","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.346+0900","log.origin":{"function":"github.com/elastic/beats/v7/heartbeat/beater.New","file.name":"beater/heartbeat.go","file.line":144},"message":"heartbeat starting, running from: <unknown location>","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.346+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection","file.name":"eslegclient/connection.go","file.line":133},"message":"elasticsearch url: http://172.16.20.8:9200","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.347+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping","file.name":"eslegclient/connection.go","file.line":322},"message":"Attempting to connect to Elasticsearch version 8.16.1 (default)","service.name":"heartbeat","ecs.version":"1.6.0"}
Overwriting lifecycle policy is disabled. Set `setup.ilm.overwrite: true` to overwrite.
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.347+0900","log.logger":"index-management","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt.(*indexManager).Setup","file.name":"idxmgmt/index_support.go","file.line":254},"message":"Auto lifecycle enable success.","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.350+0900","log.logger":"index-management.ilm","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt/lifecycle.(*stdManager).EnsurePolicy","file.name":"lifecycle/standard_manager.go","file.line":111},"message":"lifecycle policy heartbeat exists already.","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.350+0900","log.logger":"index-management","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt.applyLifecycleSettingsToTemplate","file.name":"idxmgmt/index_support.go","file.line":402},"message":"Set settings.index.lifecycle.name in template to heartbeat as ILM is enabled.","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.353+0900","log.logger":"template","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*templateBuilder).buildBody","file.name":"template/load.go","file.line":263},"message":"Existing template will be overwritten, as overwrite is enabled.","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.472+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).loadTemplate","file.name":"template/load.go","file.line":177},"message":"Try loading template heartbeat-8.16.1 to Elasticsearch","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.497+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).Load","file.name":"template/load.go","file.line":134},"message":"Template with name \"heartbeat-8.16.1\" loaded.","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.498+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).Load","file.name":"template/load.go","file.line":150},"message":"Data stream with name \"heartbeat-8.16.1\" already exists.","service.name":"heartbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-12-11T18:59:34.499+0900","log.logger":"index-management","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt.(*indexManager).Setup","file.name":"idxmgmt/index_support.go","file.line":299},"message":"Loaded index template.","service.name":"heartbeat","ecs.version":"1.6.0"}
Index setup finished.

Auditbeat

사용자의 활동이나 파일 엑세스, 보안 이벤트 등을 모니터링
시스템 보안 모니터링, 사용자 행위 감사, 정책 준수 확인
Linux Audit Framework와 연동이 가능하다

Functionbeat

클라우드 환경의 Serverless 데이터 수집
AWS Lambda를 활용한 이벤트 기반 데이터 수집

Elastic Index

조회

[root@localhost elasticsearch]# curl http://172.16.20.8:9200/_aliases?pretty
{ }

Indice(인덱스) 생성

[root@localhost elasticsearch]# curl -X PUT http://172.16.20.8:9200/test_index
{"acknowledged":true,"shards_acknowledged":true,"index":"test_index"}

[root@localhost elasticsearch]# curl http://172.16.20.8:9200/_aliases?pretty
{
  "test_index" : {
    "aliases" : { }
  }
}

Indice(인덱스) 리스트 조회

[root@localhost elasticsearch]# curl -XGET http://172.16.20.8:9200/_cat/indices?v
health status index      uuid                   pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open   test_index u7eRVfPtSIyXhGpOBiEAfA   1   1          0            0       227b           227b         227b

status 가 open이여야 파이프 단위로 정보가 수신이 가능.

Shard 조회

Elastic Search 요청 결과 --> Shard(샤드)

샤드는 DBMS의 View와 같음.

[root@localhost elasticsearch]# curl -XGET http://172.16.20.8:9200/_cat/shards?v
index      shard prirep state      docs store dataset ip          node
test_index 0     p      STARTED       0  249b    249b 172.16.20.8 node-1
test_index 0     r      UNASSIGNED

WAF

잉여토끼 — Wed, 11 Dec 2024 13:47:55 +0900

WAF

Web Application Firewall

WAS + 추가모듈(mod_security)

기존 방화벽과의 차이.

기존 방화벽 : selinux, iptables, firewalld(ufw), tcp wrapper

--> 주로 헤더의 확인을 통한 접근제어

WAF : WAS의 앞단에서 공격을 감지. 공격 감지 대상은 웹 패킷의 Payload(웹 해킹)

WAF의 필요성

payload를 검사.
- web(http/https) 프로토콜
- 동적 언어(PHP, ASP, JSP)
- system 언어 perl / cgi / fcgi / wcgi --> 사용상 편리. 단, 시스템 명령어 처리가능.
- DBMS 연동 룰
- was가 없음 --> waf를 못함.

설치

1. Apache 동작 확인

[root@rocky-9 named]# systemctl status httpd
● httpd.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)
    Drop-In: /etc/systemd/system/httpd.service.d
             └─php-fpm.conf
     Active: active (running) since Tue 2024-12-03 18:27:39 KST; 1 week 0 days ago
       Docs: man:httpd.service(8)
    Process: 1500533 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/S>
   Main PID: 900837 (httpd)
     Status: "Total requests: 11144; Idle/Busy workers 100/0;Requests/sec: 0.0168; Bytes serv>
      Tasks: 230 (limit: 10754)
     Memory: 16.6M
        CPU: 4min 28.885s
     CGroup: /system.slice/httpd.service
             ├─ 900837 /usr/sbin/httpd -DFOREGROUND
             ├─1500573 /usr/sbin/httpd -DFOREGROUND
             ├─1500574 /usr/sbin/httpd -DFOREGROUND
             ├─1500575 /usr/sbin/httpd -DFOREGROUND
             ├─1500580 /usr/sbin/httpd -DFOREGROUND
             └─1500837 /usr/sbin/httpd -DFOREGROUND

2. mod_secrutiy 설치

# Redhat
dnf -y install mod_security
# Debian
apt-get install libapache2-mod-security2
a2enmod mod-security

3. 공식 룰 적용

Url : https://github.com/coreruleset/coreruleset/archive/refs/heads/v3.4/dev.zip
Path : /etc/httpd/modsecurity.d

기본 룰셋

RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example
REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example

해당 기본 룰셋을 active_rules에 넣기

cp -ap RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example ../../activated_rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
cp -ap REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example ../../activated_rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

기존 snort/ mod_security --> SIG와 일치하는 payload값을 검출. 정규화 표현식을 적용하기 위해 pcre설치

dnf -y install pcre-devel

4. 설정파일 변경

# path : /etc/httpd/conf.d/mod_security.conf

SecAuditEngine RelevantOnly     --> mod_secrity 감사 동작 모드

감사 동작 모드

On : mod_security 기능 활성화.(IPS Mode)
Off : mod_security 기능 비활성화.
RelevantOnly : 활성화를 하지만 차단하지 않으며 탐지만 한다. (IDS mode)

5. 재시작 후 로그파일 확인

/var/log/httpd/modsec_audit.log,

/var/log/httpdmodsec_debug.log

6. Tool을 이용한 WAF 탐지 및 로그 확인

--67baae6f-B--
GET /9PF8pkrX.shm HTTP/1.1
Host: 172.16.20.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Connection: Keep-Alive

--67baae6f-F--
HTTP/1.1 500 Proxy Error
Content-Length: 264
Connection: close
Content-Type: text/html; charset=iso-8859-1

--67baae6f-E--

--67baae6f-H--
Apache-Error: [file "proxy_util.c"] [line 415] [level 3] [status 670002] AH00898: DNS lookup failure for: w4.tired.com returned by /9PF8pkrX.shm
Apache-Handler: proxy-server
Stopwatch: 1733884925756790 3304168 (- - -)
Stopwatch2: 1733884925756790 3304168; combined=14, p1=2, p2=8, p3=1, p4=1, p5=2, sr=0, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.6 (http://www.modsecurity.org/).
Server: Apache/2.4.62 (Rocky Linux) OpenSSL/3.2.2
Engine-Mode: "ENABLED"

--67baae6f-Z--

Wafw00f

WAF 감지 툴

# WAF 미설정시
┌──(root㉿kaya)-[~]
└─# wafw00f http://172.16.20.6

                ______
               /      \
              (  W00f! )
               \  ____/
               ,,    __            404 Hack Not Found
           |`-.__   / /                      __     __
           /"  _/  /_/                       \ \   / /
          *===*    /                          \ \_/ /  405 Not Allowed
         /     )__//                           \   /
    /|  /     /---`                        403 Forbidden
    \\/`   \ |                                 / _ \
    `\    /_\\_              502 Bad Gateway  / / \ \  500 Internal Error
      `_____``-`                             /_/   \_\

                        ~ WAFW00F : v2.2.0 ~
        The Web Application Firewall Fingerprinting Toolkit

[*] Checking http://172.16.20.6
[+] Generic Detection results:
[-] No WAF detected by the generic detection
[~] Number of requests: 7

┌──(root㉿kaya)-[~]
└─# nmap -p 80,443 --script=http-waf-detect 172.16.20.6
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-11 10:46 KST
Nmap scan report for 172.16.20.6
Host is up (0.00052s latency).

PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
MAC Address: 00:50:56:2B:51:F3 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 13.42 seconds

ASA 방화벽

잉여토끼 — Tue, 10 Dec 2024 18:03:25 +0900

ASA

포트 4개 (e0 - e3)

management port (M0/0)

inside port (G0/1)

outside port (G0/2)

dmz port (G0/3)

<---> e0 / e1 / e2 / e3

MGNT( managemetn port ) --> GUI환경의 ASA 방화벽 Controler PC와 연결된 Port

ASDM 옵션시 동일레벨이면 Drop(Option으로 해제)

ASA의 ASDM(ASA GUI Control Software)은별개의 프로그램

ASDM의 MGNT에 연결된 PC가 있을 경우 ASA가 자동으로 배포함.

다만 ASDM 이미지가 없을 수 있으므로 이를 먼저 설치 할 수 있어야함.

TFTP서버를 통한 Management

이를 라우터에 적용 하게 되면 Startconfig Runningconfig 등 운영에 필요한 파일을 TFTP서버로부터 가져오며 생성되는 로그 또한 TFTP로 전송할 경우 라우터는 더미프록시와 같이 동작 가능.

TFTP 서버 192.168.56.

asdm 파일을 TFTP로 전송 :

copy flash :/asdm-792-152.bin tftp://192.168.56.22

del flush:/asdm-729-152.bin

copy tftp://192.168.56.22 /asdm-792-152.bin flash :/asdm-792-152.bin

ASA(Adaptive Security Appliance)

ASDM (Cisco Adaptive Security Device Manager)

ASA를 mgmt를 통한 관리 PC에서 웹 환경을 이용하여 관리

관리 PC --> JAVA기반의 웹환경

ASA에서 ASDM이 동작하기 위한 설정

1. ASDM이미지 등록

conf t
asdm inage flash:/asdm-792-152.bin

2. ASA에서 웹 서비스를 활성화

conf t
http server enable
http [접근 가능 NI] [SM] Management

3. 이용할 계정(로그인) 필요

conf t
username [UserName] password cisco privilege [권한 등급]

4. Java(jdk-7u80 버전)가 설치된 운영체제에서

ASA 기본 내장 설정들

conf t
icmp permit any dmz
icmp permit any inside
icmp permit any management
icmp permit any outside
policy-map global_policy
class inspection_default
ispect icmp

ACL 설정 예시

기본적으로 Cisco 라우터/스위치 장비 ACL설정 명령어와 같음

access-list OUT->IN permit icmp any any : nacl    ---->  (Name Access List 생성) 
access-group OUT->IN in interface outside

DNSSec

잉여토끼 — Tue, 10 Dec 2024 17:57:39 +0900

전자서명 복호화 값과 원본 데이터의 해시값이 일치한지 여부를 확인하여 무결성을 확인한다.

DNS서버와 DNS서버간의 데이터 전달에서 위변조를 막기 위한 방법

zone 키 생성

zsk(zone 서명 키) -- 공개키 / 비밀키. (공개키를 외부에 배포하여 zsk/ksk 공개키를 존파일에 반영) --> 해시값

ksk (key 서명 키) -- 공개키 / 비밀키

public key 존 반영

개인키

zone 서명

dnssec-dignzone(개인키에 의해 서명됨_

kaya.com.zone.signed

Name Server에 Zone 반영

스마트 샤이닝 : bind의 서명 도구(dnssec-signed)의 옵션

public key 존 반영 : 절차없이 서명처리가 가능

설정

1. zone key 생성

dnssec-keygen -a RSASHA256 -b 1024 -n zone kaya.com

[root@rocky-9 named]# dnssec-keygen -a RSASHA256 -b 1024 -n zone kaya.com
Generating key pair................................++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ..++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Kkaya.com.+008+42928

Kkaya.com.+008+42928.key : zsk 공개키

Kkaya.com.+008+42928.private : ksk 비밀키

dnssec-keygen -a RSASHA256 -b 2048 -n zone -f KSK kaya.com

[root@rocky-9 named]# dnssec-keygen -a RSASHA256 -b 2048 -n zone -f KSK kaya.com
Generating key pair...+.+......+........+.+.........+.....+.+...+.....+...+...+......+.........+......+.+..+...............+...+....+........+.+.....+.+.....+....+...........+.........+.+...+...+..+.............+...+...........+++++++++++++++++++++++++++++++++++++++*.....+...+...............+.......+...+...........+++++++++++++++++++++++++++++++++++++++*.+....+...........+......+.........+.+............+...+........+.........+.+......+.....+......+....+...........+...+.+....................+...+.+...........+.+.....+..........+..............+...+.+.........+...........+.+........+.......+..............+.+........+..........+..+..........+.........+.....+....+...+..............+....+.....+...............+......+....+......+......+.....+............+......+.+...+........+.......+...+.......................+.+.........+..+...+.+.....+.+...+............+..+.+..+.......+..+...+......+.+......+........+.........................+..+....+........+..........+...+.........+......+..+.......+...+...+..+..........+..+....++++++ .+..+...+++++++++++++++++++++++++++++++++++++++*....+...+...........+.+++++++++++++++++++++++++++++++++++++++*............+..+.......+..+.........+.+......+.....+...+................+...+.....++++++
Kkaya.com.+008+41476

Kkaya.com.+008+41476.key : ksk 공개키

Kkaya.com.+008+41476.private : zsk 비밀키

2. zone파일에 내용 추가

$INCLUDE "/var/named/Kkaya.com.+008+42928.private "

$INCLUDE "/var/named/Kkaya.com.+008+41476.private "

3. 기존 zone 파일과 zsk를 결합.

dnssec-signzone -k Kkaya.com.+008+41476.key -o kaya.com.zone Kkaya.com.+008+42928.key

signed파일생성됨

해당 해시값으로 무결성 검증.

cat kaya.com.zone.signed

w22.kaya.com.           86400   IN A    172.16.20.3
                        86400   RRSIG   A 8 3 86400 (
                                        20250109072822 20241210072822 42928 kaya.com.
                                        BM5cyoNpfbF+uNDRRjfZMzchg2V9Jzi+CArx
                                        gzv0f+6gPyH8A73bShBoVBNddTTxQrLoKkAP
                                        e1GiBUY749Ln6ugiJZm0efVKGuJst2psAjHG
                                        DXUJv6izf/FY23UOb56MJCH7+ASn0Sf8PkXO
                                        n+oCkA9wiCRDFpQxA5YLK5K76vs= )
                        10800   NSEC    kaya.com. A RRSIG NSEC
                        10800   RRSIG   NSEC 8 3 10800 (
                                        20250109072822 20241210072822 42928 kaya.com.
                                        S7UugYAftNSwpGHIkWePkO05jd0+UGnwlOq2
                                        7VylsZcqDHMUh2JPMRlomq1USWmtdvvOkCWY
                                        o4N8txBKbjO8X77mC74A7my9+gPPQ5dL312P
                                        WGtyooz4bH0O/YqKEDoJM3PD/oupJCYb78b1
                                        JqI1gkX+tkERJb9ts5fj7x/trmw= )
ub.kaya.com.            86400   IN A    172.16.20.9
                        86400   RRSIG   A 8 3 86400 (
                                        20250109072822 20241210072822 42928 kaya.com.
                                        SuRqxfiKkPAFprR4DdJYadM5PeIG4ya5EFvR
                                        vxk38DkrQzk1lRji946qK2Xd7pKrpAjl0yTR
                                        rggDY59AV6AR7mami7I3ceepuvjF8j5fNuQ8
                                        86lkPiDf2kCn4tb+5I6wNfhIC3xeuFDybwb5
                                        O/hDvP6RzFlBuX0eZjLYo03zmW4= )
                        10800   NSEC    w22.kaya.com. A RRSIG NSEC
                        10800   RRSIG   NSEC 8 3 10800 (
                                        20250109072822 20241210072822 42928 kaya.com.
                                        ZaNepBOOJK5npAb/aJIKCwCNstoPdGYMQqzI
                                        qIgr0fl7OhTCdwIruiYleI3gS6tHAdmQ8EY0
                                        BQykOp45VD2qZbv8THht9H+BF8foaJkD8u+7
                                        RdPwXKEuW+ckwtSPJDctgw7daN/bThACRMSN
                                        jqIazQ45VSruYvDm85gOH4aQe34= )

4. dnssec 설정

dnssec-validation yes;

cat /etc/named.root.key 주석을 참조하여 설정

 # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
        # for current trust anchor information.
        #
        # This key (20326) was published in the root zone in 2017.
        # Servers which were already using the old key (19036) should
        # roll seamlessly to this new one via RFC 5011 rollover. Servers
        # being set up for the first time can use the contents of this
        # file as initializing keys; thereafter, the keys in the
        # managed key database will be trusted and maintained
        # automatically.
        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
};

/etc/named.rfc1912.zones 수정


zone "kaya.com" IN{
        type master;
        file "kaya.com.zone.signed";
        #key-directory "key";
        auto-dnssec maintain;
        #inline-signing yes;
        allow-update { any; };
};

dig @172.16.20.6 nk.kaya.com SOA a +dnssec +norecurse +multiline

flags에 ad가 나오면 검증이 된 것임. 다만 클라이언트는 이를 검증할 방법이 없음. 서버-서버관계만 유효.

[root@rocky-9 named]# dig @172.16.20.6 nk.kaya.com SOA a +dnssec +norecurse +multiline
;; Warning, extra type option

; <<>> DiG 9.16.23-RH <<>> @172.16.20.6 nk.kaya.com SOA a +dnssec +norecurse +multiline
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46524
;; flags: qr aa ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 6922ce70da9cee7301000000675802305c68841eaf424899 (good)
;; QUESTION SECTION:
;nk.kaya.com.           IN A

;; ANSWER SECTION:
nk.kaya.com.            86400 IN A 172.16.20.7
nk.kaya.com.            86400 IN RRSIG A 8 3 86400 (
                                20250109072822 20241210072822 42928 kaya.com.
                                CkKLf+dFBgiv6kAP88/T+KcxvSGFSnBjucFjVS981M7a
                                OFiCf4aNfOHUdk0Ald6VfT1JgrFdzc4lo1jVNqRZq46o
                                bOM0MXeWv62ZwaRC0/QU96/9S1v87f3CP1R32xzIPt+N
                                ooQPjK40754aw7//JX8SQfjvIaz8Q/85B8jINFU= )

;; AUTHORITY SECTION:
kaya.com.               86400 IN NS ns.kaya.com.
kaya.com.               86400 IN RRSIG NS 8 2 86400 (
                                20250109072822 20241210072822 42928 kaya.com.
                                VnzOB52JQOqzkTp3jFsH1oFl5j2BMaAiuuerzGU/mDCG
                                bG+bmu4SPfvX3xTdOrg4vG/gsi0J0HUqbM4kVtDLm7LX
                                NBu+ffYbAtWFM04IVqRlL76GwBacUjCWpJ1/XEeoAyNB
                                /pg02NTEExw/02w+G/BqSrvF4kP3QlnQRZ3GMbs= )

;; ADDITIONAL SECTION:
ns.kaya.com.            86400 IN A 172.16.20.6
ns.kaya.com.            86400 IN RRSIG A 8 3 86400 (
                                20250109072822 20241210072822 42928 kaya.com.
                                N0ICvCB8PvHxdPzBCz3WmI/8FXRP0n1ldKjSNuUSdfA+
                                4HvhwffyaiMhDlg0cr0kNEs7IgPGU4adF6ZujUgGiVaB
                                q3UVP3FDG21Z++87TExo3lr7+Hh57bfBxAlha/1oalod
                                m+9oQvk+X4ar2n6E49RFduO5Jx3/rW6LuI1lCwc= )

;; Query time: 0 msec
;; SERVER: 172.16.20.6#53(172.16.20.6)
;; WHEN: Tue Dec 10 17:56:16 KST 2024
;; MSG SIZE  rcvd: 621

SSH 인증서 로그인

잉여토끼 — Tue, 10 Dec 2024 16:49:03 +0900

파일 동기화

원격 폴더 : SMB / NFS
원격 디스크 : iSCSI

--> 사용을 위해서는 반드시 인증이 필요.

ID/PW사용 --> 불편

expect --> 보안상 취약

==>> 인증서를 이용한 로그인이 가능

백업 --> 클라이언트가 서버에 접속.

FTP 접속

: [ID]:[PW]@[Domain]

EX ) ftp kaya:1234@172.16.20.1

--> 신형 OS에서는 막힘

--> FTP 자체 취약성 및 보안성으로 인해 순수 FTP는 사용되지 않고 있음.

SSH

rsync
- 파일 전송이 가능하나 보안기능이없음
- rsync -e "ssh port 22" --> 보안기능을 위해 -e 뒷부분을 모두 써야함
- but 신형에서는 생략 가능
- 주로 백업(증분)에 사용
- SSH 접속을 위해 PW를 입력해야한다.
scp
- 기본적으로 자체적인 보안기능을 가짐.
- 모든 리눅스에 포함됨
- 사용법 : scp [src 대상경로] [des 대상경로]
- Ex: scp root@172.16.20.1:/root/hi.txt /root
- ~/.ssh/known_hosts 에서 한번이라도 자신이 접속한 host의 인증서를 저장 --> 인증서를 서로 교환함.

차등 백업 : 백업 이후 추가된 내용을 포함하여 전부 백업

증분 백업 : 백업 이후 추가된 내용만을 백업

인증서 생성

개인키를 이용하여 공개키를 생성 가능

공개키에 서명 후 배포시 클라이언트는 서명된 공개키를 저장하고 이 공개키와 자신의 공개키를 가지고 서버에 접속시 인증을 받을 수 있음.

ssh-keygen <-- openssl이 있으면 실행 됨.

서버 인증서 생성시 현제 사용 버전은 RSA2(2048bit)임

ssh-keygen -t rsa -b 2048

[root@Centos-8 .ssh]# ssh-keygen -t rsa -b 2048
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):               --  서버 개인키
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.               --  서버 공개키
The key fingerprint is:
SHA256:jrDeDJzNqPNayJBnnkDhcp0IABNl8TDbW6CzO5DomSs root@Centos-8
The key's randomart image is:
+---[RSA 2048]----+
|O+*..            |
|.+.X o           |
|.o* = .          |
|++ o o           |
|B + o   S        |
|.Oo= B o         |
| +B B + .        |
|E o= +           |
|..o+o o          |
+----[SHA256]-----+

서버에서 생성된 id_rsa.pub를 배포하여 사용.

개인키를 이용하여 서명한 인증서를 생성

openssl rsa -in [복호화할 개인키]

ssh-copy-id root@172.16.20.7

클라이언트의 인증서를 서버에 복제

클라이언트의 ~/.ssh/authorized_keys에 내 공개키 인증서를 저장

서버와 클라이언트에 저장된 공개키가 같음을 확인 가능.

VPN

잉여토끼 — Fri, 6 Dec 2024 18:04:33 +0900

Virtual Private Network

가상망을 통하여 특정 네트워크를 캡슐화를 통해 넘어가는 기술

새로운 헤더를 추가하여 이중화하는 기술

vpnd : cisco vpn 서버에 붙인 이름.

가상 인터페이스 ==> svi(vlan) / loopback / subinterface / gre

GRE (Generic Route Encapsulation)

: Cisco의 터널링 기본형. 자체로는 터널링만을 제공.

vpnd : host to site

특정 Host를 해당 네트워크에 편입시킴

--> 자택근무를 주로 사용

router의 vpn 서버 setting

외부에서 접근 하는 host에게 자신의 사설 네트워크 IP를 부여

현제 사설 네트워크 IP 범위 : 10.1.1.1~10.1.1.3

vpnd에서 부여할 IP범위를 지정.

conf t

ip local pool test 10.1.1.10 10.1.1.13

vpnd에서 사용할 가상 Interface : Virtual-Template

lo 0 : 172.16.1.1. 255.255.0.0

사용 목적 : unnumbered

conf t

int virtual-terminal

ip unnumberde lo 0

peer default ip adderss pol test

ppp authe chap callout

ppp ipcp dns 8.8.8.8

conf

vpdn enable

vpdn-group 1

accept-dialin

protocol l2tp

virtual-templat 1

exit

no l2tp tunnel authentication

인증 프로토콜로 chap을 사용하므로 별도의 l2tp 프로토콜 상의 인증이 불필요함.

ppp 회선 : LCP

IP매핑 : NCP

터널링 구현 L2TP / PPTP

해당 대역으로 접근시 chap을 통해 인증을 실시하며 l2tp인증은 하지 않음

인증에 성공시 10.1.1.10~ 10.1.1.13까지의 IP중 적은 숫자 IP부터 할당. 동일 네트워크로 취급

인증에 사용할 id pw ㅅ생성

username asd secret cisco

-----------------------------------------------------------------------------------------------------------------------------------

망 이중화

: 물리적인 망과 별개의 가상 네트워크망을 통해 정보를 전달.

ipv4는 IPsec을 지원하지 않음.

ipsec over gre --> iskamp

SA : 보안 요소 \

SA를 협상 --> IKE

IKE : 키 교환 알고리즘.

GRE : Generic Routing Encapsulation

여기서 Generic은 Cisco의 Generic 즉, cisco 독자 표준.

특정 트래픽의 캡슐화 cisco 표준. VPN의 cisco version

GRE의 경우 암호화를 하지 않으므로 기밀성을 보장받지 못함.

단 암호화를 사용하는 vpn에 비해 데이터의 전송처리가 빠름.

특정 트래픽의 터널링 + 암호화 적용이 목표

기존 패킷 을 IPSec으로 캡슐화 하여 GRE터널로 전송하며 다시 이를 Decapsulatio.

GRE 구현

R1
conf t
int tu 14
ip add 100.0.0.1 255.255.255.0
tu sorce 1.1.2.1
tu des 1.1.4.2

R4
conf t
int tu 14
ip add 100.0.0.2 255.255.255.0
tu source 1.1.4.2
tu des 1.1.2.1

특정 트래픽을 GRE 터널을 통해 전달.

site to site : 특정 네트워크 정보만 GRE로 전달.

--> Routing Table에 등록 필요. 다만 해당 라우터에서만 사용해야함 --> Static등록, 재분배 x(따라서 인터페이스로 라우팅테이블 등록하는 것이 좋음.)

1.1.5.0 1.1.1.0 통신에는 GRE 사용.

R1
conf t
ip route 1.1.5.0 255.255.255.0 tunnel 14

R4
conf t
ip route 1.1.1.0 255.255.255.0 tunnel 14

IPSec

기밀성 + 무결성

--> 헤더 정보를 캡슐화 및 암호화

IPv4는 IPSec을 지원하지 않으므로 추가적인 모듈(IKE/IPSEX)\이 필요\

IPv4는 프로토콜이 패킷이 보호하기위한 보안 Fild가 없으므로 스니핑을 통해 IP 헤더, TCP/UDP 헤더 , Psylod 내용을 쉽게 확인 가능.

--> 헤더 정보 인증을 통한 기밀성 보장

일반적으로 해시를 통해 무결성을 보장.

IPSec 프로토콜 유형

AH : Auth Headr. 기밀성

1. Transeport Mode

2. Tunenel Mode

ESP : payload. 무결성

1. Transeport Mode

2. Tunenel Mode

AH : 두 시스템이 송수신하는 IP 패킷에 대한 무결성 및 인증을 제공하며 암호화는 제공하지 않는 프로토콜. ip 프로토콜 51번 사용.

MD5 HMAC/ SHA HMAC 암호화 알고리즘 사용

인증 범위 : 원본 IP 헤더 일부 필드를 제외한 전체 범위

인증 대상 : 헤더

AH헤더의 경우 원본 IP 헤더와 TCP 헤더 사이 캡슐화.

*********************

SA (Security Associations) : 보안 요소

- AH / ESP 프로토콜을 통해 IPSec 구현시 필요한 암호화 및 인증에 필요한 요소.

- 암호화 알고리즘 및 인증 알고리즘이 필요.

- DES/3DES/AES, HMAC

KMS --> 윈도우 / 오피스 크랙 프로그램

key management service.

- 암호화/복호화를 위한 키의 수명(생명주기)을 관리.

- 용량(4,608,000 kbyte) or 시간(3600 s)

- SA는 단방향 연결로 생성되며 AH, ESP 는 개별적으로 생성

- SA 수동생성 : 생성시 바로 연결

- SA 자동생성 : IKEv2 : IKE 자동생성 : 용량 / 시간에 따라 자동 삭제 .

--> 주기적인 SA 갱신 및 키 업데이트를 이용하여 새로운 SA정보 및 키를 공격자로부터 유출 방지.

IKE : 인터넷 표준 암호키 교환 알고리즘.

IKE : IPSec Vpn에서 상대방을 인증하고 IKE와 AK를 협상하는데 필요한 프로토콜.

인증 알고리즘 : AH ESP

세션 키를 생성하여 상대방과의 인증을 수행 <<== 별도의 ID/PW가 필요하지 않음.

키의 생성과 인증 + 교환을 담당.

생성된 키를 배포하여 상대방과 동기화.

Diffie Hellma : 비대칭키를 이용하여 대칭키를 교환하는 프로토콜

비대칭키 알고리즘으로 상호간에 안전하지 않은 채널상에서 공개키 비밀키 세션키를 생성하여 상대방의 인증을 수행. 상호 보안채널을 구성.

SA 정보를 생성하는 방법 2가지.

수동 : 관리자가 직접 생성

자동 : IKE 프로토콜을 이용한 협상 방식. --> AH / ESP

SA 정보를 생성 / 관리하는 프로토콜 : ISAKMP(Internet Security Association & Key Management Protocol)

Cisco Router에서는 기본적으로 동작한다.

인증 알고리즘, 암호화 알고리즘, 암호 키 교환 규약이 통합적으로 관리되고 있음

IPSec으로 암/복호화 전 설정되어야하는 단계로 IKE 1단계(Phase 1)/ 2 단계 (Phase 2 ) / 적용 단계가 존재.

이를 설정할때도 절차에 의해 움직여야 하나 해제시에서 역순으로 움직여야 함. --> 계층적 구조

두 IPSec 개체간의 인증 및 2단계 SA를 성립하는 메시지를 보호하기 위한 세션키를 협상 ---> 디피 헬먼

2단계 SA를 설정하기 위한 메시지 보호에만 사용.

--> IPSec 패킷 보호시 사용되지 않음.

1단계

- SA는 방향성을 가지지 않음. 단 수동으로 키 설정시 1단계가 필요 없음.

IKE 2단계

- IPSec을 이용하여 패킷에 전송할 SA를 의미. IN/OUT Bound에서의 SA가 다르므로 2개가 존재하며 방향성이다름.

SA로 인증키 생성 (단방향이므로 Outbound Packet의 인증키(받았던키)와 Inbound 인증키(제공한 키)가 다름. 서로 키를 교환함.)

- 내용 : 인증 메커니즘, 암호화 알고리즘, 해시 알고리즘, 암호화와 인증키 값, SA갱신기간.

IKE : ISAKMP --> SA 생성/관리 --> 접속 객체 협상

ISAKMP + Oakley 프로토콜의 결합으로 IPSec에서 사용되는 키 관리 프로토콜임.

상호 객체간에 인증된 보안 통신채널을 생성하며 SA정보를 협상 (ISAKMP or IKE 1/2 단계)

해당 단계에서 IKE 메시지를 교환. 출발지와 도착지의 포트 변호는 UDP 500을 사용한다.

IKE 1,2 단계 --> SA생성 --> 두 개체간 전송 패킷들은 IPSec에 의해 기밀성 및 무결성을 보장받음.

IKE 1단계 : Main 모드.

- 6개의 메시지를 교환하여 1단계를 성립

2단계 Quick모드

SA를 생성하기 위한 메시지 교환

IKE를 이용한 개체 인증 방신

1. Pre Shared Key : 상호간의 공개키 SA 를 같은값으로 저장

2. RSA Encryption

3. RSA SIgnature

1단계 정책 내용 : 표현방식

1. 장비간의 사용할 인증 : pre shared : authentication pre- share

2. 암호 방식 3DES : encryption 3des

3. 키고환 알고리즘 DH2 : group 2

4. 무결성 확인 MD5 /SHA : hash md5

5. 보안 정책 사용 시간 : lifetiome 3600

명령어

R1
--IKE 1단계--
conf t
crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    group 2 
    hash md5
    lifetim 60
end

conf t
crypto isakmp key 6 cisco address 1.1.4.2
end

--IKE 2단계--
# IPSec SA생성을 위한 정책 설정.
# 보호대상 트래픽 --> ACL
# Transeform set :
# IPSec Protocol : AH, ESP
# 암호화 방식 --> DES, AES, 3DES
# 무결성 확인 --> MD5-HMAC, SHA-HMAC

conf t 
access-list 110 permit gre 1.1.2.0 0.0.0.255 1.1.4.0 0.0.0.255
end
conf t
crypto ipsec transform-set TEST esp-3des esp-sha-hmac
end

--1/2단계 적용--

conf t
crypto map IPSEC 10 ipsec-isakmp
    set peer 1.1.4.2
    set transform-set TEST
    match address 110
end

# IPSec지원 Interface에서 활성화
conf t
int s1/0
crypto map IPSEC

확인

sh crypto isakmp policy
sh crypto session
sh crypto engine connections active
sh crypto isakmp sa
sh crypto ipsec transform-set
sh crypto ipsec sa address



R1#sh crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   Three key triple DES
        hash algorithm:         Message Digest 5
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               60 seconds, no volume limit


R1#sh crypto session
Crypto session current status

Interface: Serial1/0
Session status: UP-NO-IKE
Peer: 1.1.4.2 port 500
  IPSEC FLOW: permit 47 1.1.2.0/255.255.255.0 1.1.4.0/255.255.255.0
        Active SAs: 2, origin: crypto map


R1#sh crypto engine connections active
Crypto Engine Connections

   ID  Type    Algorithm           Encrypt  Decrypt IP-Address
    1  IPsec   3DES+SHA                  0       19 1.1.2.1
    2  IPsec   3DES+SHA                 25        0 1.1.2.1


R1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status

IPv6 Crypto ISAKMP SA

R1#sh crypto ipsec transform-set
Transform set TEST: { esp-3des esp-sha-hmac  }
   will negotiate = { Tunnel,  },

Transform set #$!default_transform_set_1: { esp-aes esp-sha-hmac  }
   will negotiate = { Transport,  },

Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac  }
   will negotiate = { Transport,  },


R1#sh crypto ipsec sa address
fvrf/address: (none)/1.1.2.1
   protocol: ESP
      spi: 0xD1B1CE64(3518090852)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 1, flow_id: SW:1, sibling_flags 80000046, crypto map: IPSEC
        sa timing: remaining key lifetime (k/sec): (4588954/1042)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

fvrf/address: (none)/1.1.4.2
   protocol: ESP
      spi: 0x89B27EED(2310176493)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 2, flow_id: SW:2, sibling_flags 80000046, crypto map: IPSEC
        sa timing: remaining key lifetime (k/sec): (4588954/1042)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

IPv6(2)

잉여토끼 — Thu, 5 Dec 2024 15:12:56 +0900

6 To 4 Tunneling

Tunneling

패킷을 Incapsulation 하여 전달하는 것을 Tunneling이라한다. 캡슐화를 풀지 않는 이상 어떤 패킷이 전달되는지 다른 노드에서 알 수 없다.

6 To 4 Tunneling

IPv6는 IPv4의 IP 고갈에 의해서 등장했다. 따라서 IPv4로 이미 구축된 망이 있으며 IPv4와 통신이 불가능하지만 새로운 망인 IPv6의 망을 구축할 수 있다.

다만 IPv6끼리 통신이 가능하나 IPv6 - IPv4 -IPv6와 같이 서로 이어지지 않은 망 구조일때 IPv6와 IPv4를 혼용하는 경계라우터에서 다른 경계라우터로 Incapsulation하여 전달하는 방식을 사용 할 수 있다. 이를 6 to 4 Tunneling이라한다. cisco에서는 GRE라 한다.

현제까지 공부한 가상 인터페이스 종류

1. Loopback Interface

2. SVI : vlan 인터페이스 --> L2 인터페이스로 L3

3. VL0 --> OSPF : ABR 및 ABR끼리의 가상 경로 생성. Tunneling

4. Tunnel Interface : 가상 터널로 여러동작 모드가 있음.

명령어

** 터널링시 해당 라우터끼리는 Next Hop(Neighbor Node)로 인식

6 To 4 Tunneling

conf t
interface tunnel [Interface]
ipv6 enable
#주소값을 사용하지 않음을 선언. 
#그러나 주소가 없을 경우 동작을 안하므로 다른 인터페이스의 주소를 끌어다 사용.
ipv6 unnumbered [Another Interface]
tunnel source [Tunneling Source Interface IP]
tunnel destination [Tunneling Destination Interface IP]
tunnel mode ipv6

실습

네트워크 랩

- R3와 R6에서 6 To 4 Tunneling

R1 show run

Building configuration...

Current configuration : 1650 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 ipv6 address 2000::1:1:1:1/64
 ipv6 enable
 ipv6 eigrp 100
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 100
 eigrp router-id 1.0.0.0
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R1 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 100"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/0
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R1 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   Link-local address:     Se1/0              8 04:38:57   23   200  0  11
    FE80::C802:78FF:FEA4:0

R1 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(100)/ID(1.0.0.0)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2000::/64, 1 successors, FD is 2169856
        via Connected, Serial1/0
P 2002::/64, 1 successors, FD is 2809856
        via FE80::C802:78FF:FEA4:0 (2809856/2297856), Serial1/0
P 2004::/64, 1 successors, FD is 2681856
        via FE80::C802:78FF:FEA4:0 (2681856/2169856), Serial1/0

R1 show ipv6 route

IPv6 Routing Table - Default - 5 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2000::/64 [0/0]
     via Serial1/0, directly connected
L   2000::1:1:1:1/128 [0/0]
     via Serial1/0, receive
D   2002::/64 [90/2809856]
     via FE80::C802:78FF:FEA4:0, Serial1/0
D   2004::/64 [90/2681856]
     via FE80::C802:78FF:FEA4:0, Serial1/0
L   FF00::/8 [0/0]
     via Null0, receive

R2 show run

Building configuration...

Current configuration : 1700 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 ipv6 address 2000::1:1:1:2/64
 ipv6 enable
 ipv6 eigrp 100
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 ipv6 address 2004::1:2:1:1/64
 ipv6 enable
 ipv6 eigrp 100
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 100
 eigrp router-id 2.0.0.0
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R2 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 100"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/0
    Serial1/1
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R2 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
1   Link-local address:     Se1/1              5 04:25:06   24   300  0  3
    FE80::C803:52FF:FE60:0
0   Link-local address:     Se1/0              8 04:39:02   28   200  0  5
    FE80::C801:8CFF:FE90:0

R2 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(100)/ID(2.0.0.0)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2000::/64, 1 successors, FD is 2169856
        via Connected, Serial1/0
P 2002::/64, 1 successors, FD is 2297856
        via FE80::C803:52FF:FE60:0 (2297856/128256), Serial1/1
P 2004::/64, 1 successors, FD is 2169856
        via Connected, Serial1/1

R2 show ipv6 route

IPv6 Routing Table - Default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2000::/64 [0/0]
     via Serial1/0, directly connected
L   2000::1:1:1:2/128 [0/0]
     via Serial1/0, receive
D   2002::/64 [90/2297856]
     via FE80::C803:52FF:FE60:0, Serial1/1
C   2004::/64 [0/0]
     via Serial1/1, directly connected
L   2004::1:2:1:1/128 [0/0]
     via Serial1/1, receive
L   FF00::/8 [0/0]
     via Null0, receive

R3 show run

Building configuration...

Current configuration : 2017 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 no ip address
 ipv6 address 2002::1:1:1:1/64
 ipv6 enable
 ipv6 eigrp 100
!
interface Tunnel36
 no ip address
 ipv6 unnumbered Loopback0
 ipv6 enable
 ipv6 eigrp 100
 tunnel source 1.1.1.1
 tunnel destination 1.1.2.2
 tunnel mode ipv6
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 ip address 1.1.1.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 ipv6 address 2004::1:2:1:2/64
 ipv6 enable
 ipv6 eigrp 100
 serial restart-delay 0
!
interface Serial1/2
 ip address 1.2.1.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
router rip
 version 2
 network 1.0.0.0
 no auto-summary
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 100
 eigrp router-id 3.0.0.0
 no shutdown
!
ipv6 router eigrp 10
 shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R3 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 100"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/1
    Loopback0
    Tunnel36
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

IPv6 Routing Protocol is "eigrp 10"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R3 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   Link-local address:     Se1/1             14 04:25:11   37   222  0  10
    FE80::C802:78FF:FEA4:0
IPv6-EIGRP neighbors for process 10
% EIGRP 10 is in SHUTDOWN

R3 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(100)/ID(3.0.0.0)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2000::/64, 1 successors, FD is 2681856
        via FE80::C802:78FF:FEA4:0 (2681856/2169856), Serial1/1
P 2002::/64, 1 successors, FD is 128256
        via Connected, Loopback0
P 2004::/64, 1 successors, FD is 2169856
        via Connected, Serial1/1
IPv6-EIGRP Topology Table for AS(10)/ID(1.2.1.1)
% EIGRP 10 is in SHUTDOWN

R3 show ipv6 route

IPv6 Routing Table - Default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
D   2000::/64 [90/2681856]
     via FE80::C802:78FF:FEA4:0, Serial1/1
C   2002::/64 [0/0]
     via Loopback0, directly connected
L   2002::1:1:1:1/128 [0/0]
     via Loopback0, receive
C   2004::/64 [0/0]
     via Serial1/1, directly connected
L   2004::1:2:1:2/128 [0/0]
     via Serial1/1, receive
L   FF00::/8 [0/0]
     via Null0, receive

R4 show run

Building configuration...

Current configuration : 1596 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 ip address 1.1.1.2 255.255.255.0
 serial restart-delay 0
!
interface Serial1/1
 ip address 1.1.2.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
router rip
 version 2
 network 1.0.0.0
 no auto-summary
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R4 show ipv6 route

% Specified IPv6 routing table does not exist

R5 show run

Building configuration...

Current configuration : 1596 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R5
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 ip address 1.2.2.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 ip address 1.2.1.2 255.255.255.0
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
router rip
 version 2
 network 1.0.0.0
 no auto-summary
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R5 show ipv6 route

% Specified IPv6 routing table does not exist

R6 show run

Building configuration...

Current configuration : 2020 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R6
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 no ip address
 ipv6 address 2002::1:1:1:2/64
 ipv6 enable
 ipv6 eigrp 100
!
interface Tunnel36
 no ip address
 ipv6 unnumbered Loopback0
 ipv6 enable
 ipv6 eigrp 100
 tunnel source 1.1.2.2
 tunnel destination 1.1.1.1
 tunnel mode ipv6
!
interface Tunnel64
 no ip address
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 ip address 1.2.2.2 255.255.255.0
 serial restart-delay 0
!
interface Serial1/1
 ip address 1.1.2.2 255.255.255.0
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 ipv6 address 2001::1:1:1:1/64
 ipv6 enable
 ipv6 eigrp 100
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
router rip
 version 2
 network 1.0.0.0
 no auto-summary
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 100
 eigrp router-id 6.0.0.0
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R6 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 100"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/2
    Loopback0
    Tunnel36
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R6 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   Link-local address:     Se1/2             10 03:32:50   36   216  0  5
    FE80::C807:3AFF:FED8:0

R6 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(100)/ID(6.0.0.0)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2001::/64, 1 successors, FD is 2169856
        via Connected, Serial1/2
P 2002::/64, 1 successors, FD is 128256
        via Connected, Loopback0

R6 show ipv6 route

IPv6 Routing Table - Default - 5 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001::/64 [0/0]
     via Serial1/2, directly connected
L   2001::1:1:1:1/128 [0/0]
     via Serial1/2, receive
C   2002::/64 [0/0]
     via Loopback0, directly connected
L   2002::1:1:1:2/128 [0/0]
     via Loopback0, receive
L   FF00::/8 [0/0]
     via Null0, receive

R7 show run

Building configuration...

Current configuration : 1650 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R7
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 ipv6 address 2001::1:1:1:2/64
 ipv6 enable
 ipv6 eigrp 100
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 100
 eigrp router-id 7.0.0.0
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R7 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 100"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/2
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R7 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   Link-local address:     Se1/2              8 03:32:54   28   200  0  5
    FE80::C806:7FFF:FE34:0

R7 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(100)/ID(7.0.0.0)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2001::/64, 1 successors, FD is 2169856
        via Connected, Serial1/2
P 2002::/64, 1 successors, FD is 2297856
        via FE80::C806:7FFF:FE34:0 (2297856/128256), Serial1/2

R7 show ipv6 route

IPv6 Routing Table - Default - 4 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001::/64 [0/0]
     via Serial1/2, directly connected
L   2001::1:1:1:2/128 [0/0]
     via Serial1/2, receive
D   2002::/64 [90/2297856]
     via FE80::C806:7FFF:FE34:0, Serial1/2
L   FF00::/8 [0/0]
     via Null0, receive

IPv6

잉여토끼 — Wed, 4 Dec 2024 19:48:45 +0900

IPv6

- IPv4 주소체계의 고갈 문제를 해결하기 위한 인터넷 프로토콜 주소.

- 128 bit이며 콜론(:)을 통해 헥사를 구분

- Unicast / Broadcast / Anicast 사용
- IP 자동 생성 기능이 존재한다.

- Class의 구분이 없다.

- 예약대역이 존재.

Anycast

하나의 네트워크를 여러개의 노드에 할당하여 해당 네트워크에 요청시 가장 가까운 네트워크로 요청을 전달하는것.

이는 트레픽의 분산을 위해 사용한다.

--> 확산의 개념.

IPv6 주소 생성

IPv6의경우 주소를 지정하거나 DHCP를 통해 주소를 받아오지 않았을 경우 Link Local 주소를 생성하고 인터페이스에 할당. 해당 주소는 FE80:: 형태를 취한다. 해당 형태는 LinkLocal 예약주소이다.

해당 주소가 같은 네트워크 내에 존재하는지를 확인하며 이웃 단말에게 해당 주소를 확인 받으며 일정기간동안 응답이 없거나 정보를 받게되면 주소를 생성한다.

정보를 받았을 경우 해당 정보를 이용하여 prifix를 구성한다.

IPv6 예약주소

::/128
주소 미지정
::1/128
루프백 주소
::ffff:0:0/96, ::/96
IPv4매핑 및 호환성을 위한 주소
100::/64
해당 주소로 향하는 패킷을 Drop하도록 하는 예약주소
fe80::/10
Link Local 주소. 네트워크 유지관리에 사용. 모든 인터페이스는 하나 이상의 Link Local 주소가 있어야 함. 이웃단말을 확인.

IPv6 설정 명령어

** 모든 인터페이스는 하나이상의 Link Local 주소가 필요하므로 가상 인터페이스 생성시 링크로컬주소를 수동으로 지정해주어야 함. multipoint 환경일때가 해당.

해당 인터페이스의 IPv6활성화

conf t
int [인터페이스]
ipv6 enable

라우팅 프로토콜 IPv6 활성화

conf t
ipv6 unicast-routing

RIPng

포트 : UDP 521 (RIP : UDP 520)

프로토콜 ID 사용.

conf t
ipv6 unicast-routing
ipv6 router rip [PID]
exit
int [인터페이스]
ipv6 rip [PID] enable

EIGRPv3

Router ID의 경우 여전히 IPv4 형식을 따름.

conf t
ipv6 unicast-routing
ipv6 router eigrp [AS]
no shut
exit
int [인터페이스]
ipv6 eigrp [AS]

OSPF v3

conf t
ipv6 unicast-routing
ipv6 router ospf [AS]
no shut
exit
int [인터페이스]
ipv6 ospf [AS] area [Area]

비동기식 DB 백업(Mysql/Mariadb)

잉여토끼 — Wed, 4 Dec 2024 18:46:41 +0900

cluster : 여러 시스템이나 자원이 연결되어 하나의 시스템으로 동작되는 것.

분산되어 구축이 될 경우 시스템 장애 발생시 빠른 대처가 가능.

smb --> 동기화

비동기식 --> DB의 복제가 아닌 로그정보를 볼 때 DBMS에 전달된 쿼리문의 확인이 가능. 이 쿼리문을 백업 DB가 실행.

---> master slave방식.

장점 : 부하가 적음

단점 : 연결이 끊길 수 있으며 완전히 동일한 데이터라는 보장이 없음. Slave DB는 백업에만 사용하기에 서버 활용성이 떨어짐. 불필요한 조회 쿼리를 실행.

Replication --> DB복제를 의미

방식 : 1. Master/Slave 2. Master/Master 3. Master/다중 Slave

서버 고유 넘버를 지정하여 이 고유넘버를 서로 인식하여 작동.

실시간데이터 백업이 가능.

DB 서버 부하분산이 가능.

단. Master는 주로 삽입/삭제/수정, Slave는조회.

show variables like 'general_log%

general_log : 모든 로그, ErrodrLog

서비스 재시작시 OFF상태가 됨.

general_log의 경우 너무 많은 로그가 쌓이게 되므로 용량 문제가 발생 가능.

-->

정보를 전부 백업 로그서버에 보내서 처리.

고정적으로 활성화 시키기 위한 방법

mysql-bin : binary타입 log를 생성.

vim /etc/my.con.d/server.cnf

general_log = on
general_log_file = /var/log/mariadb/general.log
log-bin = /var/log/mariadb/mariadb-bin
# -> binary type log 생성
server-id = 1
binlog_format = low
expire_logs_days = 2
# --> 보관기간

grant replication slave on *.* to "slave_db"@"%" identified by "asd123!@";
show master status;


+------------------+----------+--------------+------------------+
| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000003 |      342 |              |                  |
+------------------+----------+--------------+------------------+
1 row in set (0.000 sec)

vim /etc/my.con.d/client.cnf

[mariadb]
log-bin = mysql-bin
server-id = 2 
binlog_format = row
expire_logs_days = 2

change master to 
	master_host = "172.16.20.6",
    master_user = "slave_db",
    master_password = "asd123!@",
    master_port = 3306,
    master_log_file = "mysql-bin.000003",
    master_log_pos = 342;
    
start slave;

MariaDB [(none)]> show slave status\G
*************************** 1. row ***************************
                Slave_IO_State: Waiting for master to send event
                   Master_Host: 172.16.20.6
                   Master_User: slave_db
                   Master_Port: 3306
                 Connect_Retry: 60
               Master_Log_File: mysql-bin.000003
           Read_Master_Log_Pos: 117144
                Relay_Log_File: mariadb-relay-bin.000016
                 Relay_Log_Pos: 555
         Relay_Master_Log_File: mysql-bin.000003
              Slave_IO_Running: Yes
             Slave_SQL_Running: Yes
               Replicate_Do_DB:
           Replicate_Ignore_DB: cacti
            Replicate_Do_Table:
        Replicate_Ignore_Table:
       Replicate_Wild_Do_Table:
   Replicate_Wild_Ignore_Table:
                    Last_Errno: 0
                    Last_Error:
                  Skip_Counter: 0
           Exec_Master_Log_Pos: 117144
               Relay_Log_Space: 866
               Until_Condition: None
                Until_Log_File:
                 Until_Log_Pos: 0
            Master_SSL_Allowed: No
            Master_SSL_CA_File:
            Master_SSL_CA_Path:
               Master_SSL_Cert:
             Master_SSL_Cipher:
                Master_SSL_Key:
         Seconds_Behind_Master: 0
 Master_SSL_Verify_Server_Cert: No
                 Last_IO_Errno: 0
                 Last_IO_Error:
                Last_SQL_Errno: 0
                Last_SQL_Error:
   Replicate_Ignore_Server_Ids:
              Master_Server_Id: 1
                Master_SSL_Crl:
            Master_SSL_Crlpath:
                    Using_Gtid: No
                   Gtid_IO_Pos:
       Replicate_Do_Domain_Ids:
   Replicate_Ignore_Domain_Ids:
                 Parallel_Mode: conservative
                     SQL_Delay: 0
           SQL_Remaining_Delay: NULL
       Slave_SQL_Running_State: Slave has read all relay log; waiting for the slave I/O thread to update it
              Slave_DDL_Groups: 1
Slave_Non_Transactional_Groups: 0
    Slave_Transactional_Groups: 141
1 row in set (0.000 sec)

특정 테이블/db 백업 무시 설정

#/etc/my.cnf.d/client.cnf
replicate-ignore-table=cacti.settings
replicate-ignore-db=cacti

IPv6 Network Routing Protocol 실습(1)

잉여토끼 — Wed, 4 Dec 2024 16:51:16 +0900

물리랩

RIPng

R1 show run

Building configuration...

Current configuration : 2163 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
 ipv6 address 2000::1:1:1:1/64
 ipv6 enable
 ipv6 rip 1 enable
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.1 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:1/64
 ipv6 enable
 ipv6 rip 1 enable
 frame-relay map ipv6 2001::123:1:1:3 103 broadcast
 frame-relay map ipv6 2001::123:1:1:2 102 broadcast
 frame-relay map ipv6 FE80::C803:31FF:FE98:0 103 broadcast
 frame-relay map ipv6 FE80::C802:42FF:FEE4:0 102 broadcast
 frame-relay map ip 123.1.1.3 103 broadcast
 frame-relay map ip 123.1.1.2 102 broadcast
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router rip 1
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R1 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "rip 1"
  Interfaces:
    Serial1/0.1
    Loopback0
  Redistribution:
    None

R1 show ipv6 rip

RIP process "1", port 521, multicast-group FF02::9, pid 266
     Administrative distance is 120. Maximum paths is 16
     Updates every 30 seconds, expire after 180
     Holddown lasts 0 seconds, garbage collect after 120
     Split horizon is on; poison reverse is off
     Default routes are not generated
     Periodic updates 66, trigger updates 3
  Interfaces:
    Serial1/0.1
    Loopback0
  Redistribution:
    None

R1 show ipv6 route

IPv6 Routing Table - Default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2000::/64 [0/0]
     via Loopback0, directly connected
L   2000::1:1:1:1/128 [0/0]
     via Loopback0, receive
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:1/128 [0/0]
     via Serial1/0.1, receive
R   2002::/64 [120/2]
     via FE80::C802:A0FF:FEBC:0, Serial1/0.1
R   2003::/64 [120/2]
     via FE80::C802:A0FF:FEBC:0, Serial1/0.1
     via FE80::C803:7AFF:FE54:0, Serial1/0.1
R   2004::/64 [120/2]
     via FE80::C803:7AFF:FE54:0, Serial1/0.1
L   FF00::/8 [0/0]
     via Null0, receive

R2 show run

Building configuration...

Current configuration : 2241 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.0
 ipv6 address 2002::2:2:2:2/64
 ipv6 enable
 ipv6 rip 1 enable
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.2 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:2/64
 ipv6 enable
 ipv6 rip 1 enable
 frame-relay map ipv6 2001::123:1:1:3 201 broadcast
 frame-relay map ipv6 2001::123:1:1:1 201 broadcast
 frame-relay map ip 123.1.1.3 201 broadcast
 frame-relay map ip 123.1.1.1 201 broadcast
!
interface Serial1/0.2 point-to-point
 ip address 23.1.1.2 255.255.255.0
 snmp trap link-status
 ipv6 address 2003::23:1:1:2/64
 ipv6 enable
 ipv6 rip 1 enable
 frame-relay interface-dlci 203   
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router rip 1
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R2 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "rip 1"
  Interfaces:
    Serial1/0.2
    Serial1/0.1
    Loopback0
  Redistribution:
    None

R2 show ipv6 rip

RIP process "1", port 521, multicast-group FF02::9, pid 266
     Administrative distance is 120. Maximum paths is 16
     Updates every 30 seconds, expire after 180
     Holddown lasts 0 seconds, garbage collect after 120
     Split horizon is on; poison reverse is off
     Default routes are not generated
     Periodic updates 71, trigger updates 3
  Interfaces:
    Serial1/0.2
    Serial1/0.1
    Loopback0
  Redistribution:
    None

R2 show ipv6 route

IPv6 Routing Table - Default - 9 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
R   2000::/64 [120/2]
     via FE80::C801:14FF:FE2C:0, Serial1/0.1
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:2/128 [0/0]
     via Serial1/0.1, receive
C   2002::/64 [0/0]
     via Loopback0, directly connected
L   2002::2:2:2:2/128 [0/0]
     via Loopback0, receive
C   2003::/64 [0/0]
     via Serial1/0.2, directly connected
L   2003::23:1:1:2/128 [0/0]
     via Serial1/0.2, receive
R   2004::/64 [120/2]
     via FE80::C803:7AFF:FE54:0, Serial1/0.2
L   FF00::/8 [0/0]
     via Null0, receive

R3 show run

Building configuration...

Current configuration : 2359 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.0
 ipv6 address 2004::3:3:3:3/64
 ipv6 enable
 ipv6 rip 1 enable
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.3 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:3/64
 ipv6 enable
 ipv6 rip 1 enable
 frame-relay map ipv6 FE80::C802:2FFF:FEBC:0 301 broadcast
 frame-relay map ipv6 FE80::C802:42FF:FEE4:0 301 broadcast
 frame-relay map ipv6 2001::123:1:1:2 301 broadcast
 frame-relay map ipv6 2001::123:1:1:1 301 broadcast
 frame-relay map ip 123.1.1.2 301 broadcast
 frame-relay map ip 123.1.1.1 301 broadcast
!
interface Serial1/0.2 point-to-point
 ip address 23.1.1.3 255.255.255.0
 snmp trap link-status
 ipv6 address 2003::23:1:1:3/64
 ipv6 enable
 ipv6 rip 1 enable
 frame-relay interface-dlci 302   
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router rip 1
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R3 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "rip 1"
  Interfaces:
    Loopback0
    Serial1/0.2
    Serial1/0.1
  Redistribution:
    None

R3 show ipv6 rip

RIP process "1", port 521, multicast-group FF02::9, pid 250
     Administrative distance is 120. Maximum paths is 16
     Updates every 30 seconds, expire after 180
     Holddown lasts 0 seconds, garbage collect after 120
     Split horizon is on; poison reverse is off
     Default routes are not generated
     Periodic updates 74, trigger updates 4
  Interfaces:
    Loopback0
    Serial1/0.2
    Serial1/0.1
  Redistribution:
    None

R3 show ipv6 route

IPv6 Routing Table - Default - 9 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
R   2000::/64 [120/2]
     via FE80::C801:14FF:FE2C:0, Serial1/0.1
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:3/128 [0/0]
     via Serial1/0.1, receive
R   2002::/64 [120/2]
     via FE80::C802:A0FF:FEBC:0, Serial1/0.2
C   2003::/64 [0/0]
     via Serial1/0.2, directly connected
L   2003::23:1:1:3/128 [0/0]
     via Serial1/0.2, receive
C   2004::/64 [0/0]
     via Loopback0, directly connected
L   2004::3:3:3:3/128 [0/0]
     via Loopback0, receive
L   FF00::/8 [0/0]
     via Null0, receive

EIGRPv3

R1 show run

Building configuration...

Current configuration : 2199 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
 ipv6 address 2000::1:1:1:1/64
 ipv6 enable
 ipv6 eigrp 123
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.1 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:1/64
 ipv6 enable
 ipv6 eigrp 123
 frame-relay map ipv6 2001::123:1:1:3 103 broadcast
 frame-relay map ipv6 2001::123:1:1:2 102 broadcast
 frame-relay map ipv6 FE80::C803:31FF:FE98:0 103 broadcast
 frame-relay map ipv6 FE80::C802:42FF:FEE4:0 102 broadcast
 frame-relay map ip 123.1.1.3 103 broadcast
 frame-relay map ip 123.1.1.2 102 broadcast
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 123
 eigrp router-id 1.1.1.1
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R1 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 123"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/0.1
    Loopback0
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R1 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 123
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
1   Link-local address:     Se1/0.1          174 00:02:15    1  5000  1  0
    FE80::C803:7AFF:FE54:0

R1 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(123)/ID(1.1.1.1)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2000::/64, 1 successors, FD is 128256
        via Connected, Loopback0
P 2001::/64, 1 successors, FD is 2169856
        via Connected, Serial1/0.1

R1 show ipv6 route

IPv6 Routing Table - Default - 5 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2000::/64 [0/0]
     via Loopback0, directly connected
L   2000::1:1:1:1/128 [0/0]
     via Loopback0, receive
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:1/128 [0/0]
     via Serial1/0.1, receive
L   FF00::/8 [0/0]
     via Null0, receive

R2 show run

Building configuration...

Current configuration : 2274 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.0
 ipv6 address 2002::2:2:2:2/64
 ipv6 enable
 ipv6 eigrp 123
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.2 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:2/64
 ipv6 enable
 ipv6 eigrp 123
 frame-relay map ipv6 2001::123:1:1:3 201 broadcast
 frame-relay map ipv6 2001::123:1:1:1 201 broadcast
 frame-relay map ip 123.1.1.3 201 broadcast
 frame-relay map ip 123.1.1.1 201 broadcast
!
interface Serial1/0.2 point-to-point
 ip address 23.1.1.2 255.255.255.0
 snmp trap link-status
 ipv6 address 2003::23:1:1:2/64
 ipv6 enable
 ipv6 eigrp 123
 frame-relay interface-dlci 203   
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 123
 eigrp router-id 2.2.2.2
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R2 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 123"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/0.1
    Serial1/0.2
    Loopback0
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R2 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 123
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   Link-local address:     Se1/0.1          147 00:00:32    1  2000  0  0
    FE80::C801:14FF:FE2C:0
1   Link-local address:     Se1/0.2            9 00:01:55   23   200  0  6
    FE80::C803:7AFF:FE54:0

R2 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(123)/ID(2.2.2.2)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2001::/64, 1 successors, FD is 2169856
        via Connected, Serial1/0.1
P 2002::/64, 1 successors, FD is 128256
        via Connected, Loopback0
P 2003::/64, 1 successors, FD is 2169856
        via Connected, Serial1/0.2
P 2004::/64, 1 successors, FD is 2297856
        via FE80::C803:7AFF:FE54:0 (2297856/128256), Serial1/0.2

R2 show ipv6 route

IPv6 Routing Table - Default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:2/128 [0/0]
     via Serial1/0.1, receive
C   2002::/64 [0/0]
     via Loopback0, directly connected
L   2002::2:2:2:2/128 [0/0]
     via Loopback0, receive
C   2003::/64 [0/0]
     via Serial1/0.2, directly connected
L   2003::23:1:1:2/128 [0/0]
     via Serial1/0.2, receive
D   2004::/64 [90/2297856]
     via FE80::C803:7AFF:FE54:0, Serial1/0.2
L   FF00::/8 [0/0]
     via Null0, receive

R3 show run

Building configuration...

Current configuration : 2392 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.0
 ipv6 address 2004::3:3:3:3/64
 ipv6 enable
 ipv6 eigrp 123
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.3 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:3/64
 ipv6 enable
 ipv6 eigrp 123
 frame-relay map ipv6 FE80::C802:2FFF:FEBC:0 301 broadcast
 frame-relay map ipv6 FE80::C802:42FF:FEE4:0 301 broadcast
 frame-relay map ipv6 2001::123:1:1:2 301 broadcast
 frame-relay map ipv6 2001::123:1:1:1 301 broadcast
 frame-relay map ip 123.1.1.2 301 broadcast
 frame-relay map ip 123.1.1.1 301 broadcast
!
interface Serial1/0.2 point-to-point
 ip address 23.1.1.3 255.255.255.0
 snmp trap link-status
 ipv6 address 2003::23:1:1:3/64
 ipv6 enable
 ipv6 eigrp 123
 frame-relay interface-dlci 302   
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router eigrp 123
 eigrp router-id 3.3.3.3
 no shutdown
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R3 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "eigrp 123"
  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0
  EIGRP maximum hopcount 100
  EIGRP maximum metric variance 1
  Interfaces:
    Serial1/0.1
    Serial1/0.2
    Loopback0
  Redistribution:
    None
  Maximum path: 16
  Distance: internal 90 external 170

R3 show ipv6 eigrp neighbor

IPv6-EIGRP neighbors for process 123
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
1   Link-local address:     Se1/0.2           14 00:01:59 1005  5000  0  6
    FE80::C802:A0FF:FEBC:0
0   Link-local address:     Se1/0.1          144 00:02:03    1  5000  2  0
    FE80::C801:14FF:FE2C:0

R3 show ipv6 eigrp topology

IPv6-EIGRP Topology Table for AS(123)/ID(3.3.3.3)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 2001::/64, 1 successors, FD is 2169856
        via Connected, Serial1/0.1
P 2002::/64, 1 successors, FD is 2297856, U
        via FE80::C802:A0FF:FEBC:0 (2297856/128256), Serial1/0.2
P 2003::/64, 1 successors, FD is 2169856, U
        via Connected, Serial1/0.2
P 2004::/64, 1 successors, FD is 128256
        via Connected, Loopback0

R3 show ipv6 route

IPv6 Routing Table - Default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:3/128 [0/0]
     via Serial1/0.1, receive
D   2002::/64 [90/2297856]
     via FE80::C802:A0FF:FEBC:0, Serial1/0.2
C   2003::/64 [0/0]
     via Serial1/0.2, directly connected
L   2003::23:1:1:3/128 [0/0]
     via Serial1/0.2, receive
C   2004::/64 [0/0]
     via Loopback0, directly connected
L   2004::3:3:3:3/128 [0/0]
     via Loopback0, receive
L   FF00::/8 [0/0]
     via Null0, receive

OSPFv3

R1 show run

Building configuration...

Current configuration : 2237 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
 ipv6 address 2000::1:1:1:1/64
 ipv6 enable
 ipv6 ospf 1 area 0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.1 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:1/64
 ipv6 enable
 ipv6 ospf network broadcast
 ipv6 ospf 1 area 0
 frame-relay map ipv6 2001::123:1:1:3 103 broadcast
 frame-relay map ipv6 2001::123:1:1:2 102 broadcast
 frame-relay map ipv6 FE80::C803:31FF:FE98:0 103 broadcast
 frame-relay map ipv6 FE80::C802:42FF:FEE4:0 102 broadcast
 frame-relay map ip 123.1.1.3 103 broadcast
 frame-relay map ip 123.1.1.2 102 broadcast
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router ospf 1
 router-id 1.1.1.1
 log-adjacency-changes
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R1 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "ospf 1"
  Interfaces (Area 0):
    Loopback0
    Serial1/0.1
  Redistribution:
    None

R1 show ipv6 ospf neighbor


Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
3.3.3.3           0   INIT/DROTHER    00:00:32    17              Serial1/0.1
2.2.2.2           0   EXSTART/DROTHER 00:00:35    16              Serial1/0.1

R1 show ipv6 ospf database


            OSPFv3 Router with ID (1.1.1.1) (Process ID 1)

		Router Link States (Area 0)

ADV Router      Age         Seq#        Fragment ID  Link count  Bits
1.1.1.1         16          0x80000006  0            0           None

		Link (Type-8) Link States (Area 0)

ADV Router      Age         Seq#        Link ID    Interface
1.1.1.1         155         0x80000001  17         Se1/0.1

		Intra Area Prefix Link States (Area 0)

ADV Router      Age         Seq#        Link ID    Ref-lstype  Ref-LSID
1.1.1.1         155         0x80000001  0          0x2001      0

R1 show ipv6 ospf int

Loopback0 is up, line protocol is up 
  Link Local Address FE80::C801:14FF:FE2C:0, Interface ID 16
  Area 0, Process ID 1, Instance ID 0, Router ID 1.1.1.1
  Network Type LOOPBACK, Cost: 1
  Loopback interface is treated as a stub Host
Serial1/0.1 is up, line protocol is up 
  Link Local Address FE80::C801:14FF:FE2C:0, Interface ID 17
  Area 0, Process ID 1, Instance ID 0, Router ID 1.1.1.1
  Network Type BROADCAST, Cost: 64
  Transmit Delay is 1 sec, State DR, Priority 1 
  Designated Router (ID) 1.1.1.1, local address FE80::C801:14FF:FE2C:0
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
  Index 1/2/2, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 2, Adjacent neighbor count is 0 
  Suppress hello for 0 neighbor(s)

R1 show ipv6 ospf int bri

Interface    PID   Area            Intf ID    Cost  State Nbrs F/C
Lo0          1     0               16         1     LOOP  0/0
Se1/0.1      1     0               17         64    DR    0/2

R1 show ipv6 route

IPv6 Routing Table - Default - 5 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2000::/64 [0/0]
     via Loopback0, directly connected
L   2000::1:1:1:1/128 [0/0]
     via Loopback0, receive
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:1/128 [0/0]
     via Serial1/0.1, receive
L   FF00::/8 [0/0]
     via Null0, receive

R2 show run

Building configuration...

Current configuration : 2338 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.0
 ipv6 address 2002::2:2:2:2/64
 ipv6 enable
 ipv6 ospf 1 area 0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.2 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:2/64
 ipv6 enable
 ipv6 ospf network broadcast
 ipv6 ospf priority 0
 ipv6 ospf 1 area 0
 frame-relay map ipv6 2001::123:1:1:3 201 broadcast
 frame-relay map ipv6 2001::123:1:1:1 201 broadcast
 frame-relay map ip 123.1.1.3 201 broadcast
 frame-relay map ip 123.1.1.1 201 broadcast
!
interface Serial1/0.2 point-to-point
 ip address 23.1.1.2 255.255.255.0
 snmp trap link-status
 ipv6 address 2003::23:1:1:2/64
 ipv6 enable
 ipv6 ospf 1 area 0
 frame-relay interface-dlci 203   
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router ospf 1
 router-id 2.2.2.2
 log-adjacency-changes
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R2 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "ospf 1"
  Interfaces (Area 0):
    Loopback0
    Serial1/0.1
    Serial1/0.2
  Redistribution:
    None

R2 show ipv6 ospf neighbor


Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
1.1.1.1           1   EXSTART/DR      00:00:31    17              Serial1/0.1
3.3.3.3           1   FULL/  -        00:00:32    18              Serial1/0.2

R2 show ipv6 ospf database


            OSPFv3 Router with ID (2.2.2.2) (Process ID 1)

		Router Link States (Area 0)

ADV Router      Age         Seq#        Fragment ID  Link count  Bits
2.2.2.2         111         0x80000012  0            1           None
3.3.3.3         27          0x80000016  0            1           None

		Link (Type-8) Link States (Area 0)

ADV Router      Age         Seq#        Link ID    Interface
2.2.2.2         139         0x80000001  16         Se1/0.1
2.2.2.2         133         0x80000004  17         Se1/0.2
3.3.3.3         203         0x80000002  18         Se1/0.2

		Intra Area Prefix Link States (Area 0)

ADV Router      Age         Seq#        Link ID    Ref-lstype  Ref-LSID
2.2.2.2         133         0x80000008  0          0x2001      0
3.3.3.3         203         0x80000006  0          0x2001      0

R2 show ipv6 ospf int

Loopback0 is up, line protocol is up 
  Link Local Address FE80::C802:A0FF:FEBC:0, Interface ID 18
  Area 0, Process ID 1, Instance ID 0, Router ID 2.2.2.2
  Network Type LOOPBACK, Cost: 1
  Loopback interface is treated as a stub Host
Serial1/0.1 is up, line protocol is up 
  Link Local Address FE80::C802:A0FF:FEBC:0, Interface ID 16
  Area 0, Process ID 1, Instance ID 0, Router ID 2.2.2.2
  Network Type BROADCAST, Cost: 64
  Transmit Delay is 1 sec, State DROTHER, Priority 0 
  Designated Router (ID) 1.1.1.1, local address FE80::C801:14FF:FE2C:0
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:02
  Index 1/2/2, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 0 
  Suppress hello for 0 neighbor(s)
Serial1/0.2 is up, line protocol is up 
  Link Local Address FE80::C802:A0FF:FEBC:0, Interface ID 17
  Area 0, Process ID 1, Instance ID 0, Router ID 2.2.2.2
  Network Type POINT_TO_POINT, Cost: 64
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:01
  Index 1/3/3, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 3
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1 
    Adjacent with neighbor 3.3.3.3
  Suppress hello for 0 neighbor(s)

R2 show ipv6 ospf int bri

Interface    PID   Area            Intf ID    Cost  State Nbrs F/C
Lo0          1     0               18         1     LOOP  0/0
Se1/0.1      1     0               16         64    DROTH 0/1
Se1/0.2      1     0               17         64    P2P   1/1

R2 show ipv6 route

IPv6 Routing Table - Default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:2/128 [0/0]
     via Serial1/0.1, receive
C   2002::/64 [0/0]
     via Loopback0, directly connected
L   2002::2:2:2:2/128 [0/0]
     via Loopback0, receive
C   2003::/64 [0/0]
     via Serial1/0.2, directly connected
L   2003::23:1:1:2/128 [0/0]
     via Serial1/0.2, receive
O   2004::3:3:3:3/128 [110/64]
     via FE80::C803:7AFF:FE54:0, Serial1/0.2
L   FF00::/8 [0/0]
     via Null0, receive

R3 show run

Building configuration...

Current configuration : 2456 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
ipv6 unicast-routing
ipv6 cef
!
multilink bundle-name authenticated
!
!
voice dsp waitstate 0
!
!
!
!
!
!
!
!
!
!
!
!
!
memory-size iomem 0
archive
 log config
  hidekeys
! 
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.0
 ipv6 address 2004::3:3:3:3/64
 ipv6 enable
 ipv6 ospf 1 area 0
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
!
interface Serial1/0.1 multipoint
 ip address 123.1.1.3 255.255.255.0
 snmp trap link-status
 ipv6 address 2001::123:1:1:3/64
 ipv6 enable
 ipv6 ospf network broadcast
 ipv6 ospf priority 0
 ipv6 ospf 1 area 0
 frame-relay map ipv6 FE80::C802:2FFF:FEBC:0 301 broadcast
 frame-relay map ipv6 FE80::C802:42FF:FEE4:0 301 broadcast
 frame-relay map ipv6 2001::123:1:1:2 301 broadcast
 frame-relay map ipv6 2001::123:1:1:1 301 broadcast
 frame-relay map ip 123.1.1.2 301 broadcast
 frame-relay map ip 123.1.1.1 301 broadcast
!
interface Serial1/0.2 point-to-point
 ip address 23.1.1.3 255.255.255.0
 snmp trap link-status
 ipv6 address 2003::23:1:1:3/64
 ipv6 enable
 ipv6 ospf 1 area 0
 frame-relay interface-dlci 302   
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet2/0
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/1
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/2
 no ip address
 shutdown
 duplex half
!
interface Ethernet2/3
 no ip address
 shutdown
 duplex half
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
no cdp log mismatch duplex
ipv6 router ospf 1
 router-id 3.3.3.3
 log-adjacency-changes
!
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp fax t38 ecm
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
end

R3 show ipv6 protocol

IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "ospf 1"
  Interfaces (Area 0):
    Loopback0
    Serial1/0.1
    Serial1/0.2
  Redistribution:
    None

R3 show ipv6 ospf neighbor


Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
1.1.1.1           1   DOWN/DROTHER       -        17              Serial1/0.1
2.2.2.2           1   FULL/  -        00:00:39    17              Serial1/0.2

R3 show ipv6 ospf database


            OSPFv3 Router with ID (3.3.3.3) (Process ID 1)

		Router Link States (Area 0)

ADV Router      Age         Seq#        Fragment ID  Link count  Bits
2.2.2.2         115         0x80000012  0            1           None
3.3.3.3         29          0x80000016  0            1           None

		Link (Type-8) Link States (Area 0)

ADV Router      Age         Seq#        Link ID    Interface
3.3.3.3         211         0x80000001  17         Se1/0.1
2.2.2.2         137         0x80000004  17         Se1/0.2
3.3.3.3         205         0x80000002  18         Se1/0.2

		Intra Area Prefix Link States (Area 0)

ADV Router      Age         Seq#        Link ID    Ref-lstype  Ref-LSID
2.2.2.2         137         0x80000008  0          0x2001      0
3.3.3.3         205         0x80000006  0          0x2001      0

R3 show ipv6 ospf int

Loopback0 is up, line protocol is up 
  Link Local Address FE80::C803:7AFF:FE54:0, Interface ID 16
  Area 0, Process ID 1, Instance ID 0, Router ID 3.3.3.3
  Network Type LOOPBACK, Cost: 1
  Loopback interface is treated as a stub Host
Serial1/0.1 is up, line protocol is up 
  Link Local Address FE80::C803:7AFF:FE54:0, Interface ID 17
  Area 0, Process ID 1, Instance ID 0, Router ID 3.3.3.3
  Network Type BROADCAST, Cost: 64
  Transmit Delay is 1 sec, State DROTHER, Priority 0 
  No designated router on this network
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:05
  Index 1/2/2, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 0, Adjacent neighbor count is 0 
  Suppress hello for 0 neighbor(s)
Serial1/0.2 is up, line protocol is up 
  Link Local Address FE80::C803:7AFF:FE54:0, Interface ID 18
  Area 0, Process ID 1, Instance ID 0, Router ID 3.3.3.3
  Network Type POINT_TO_POINT, Cost: 64
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:07
  Index 1/3/3, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 3
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1 
    Adjacent with neighbor 2.2.2.2
  Suppress hello for 0 neighbor(s)

R3 show ipv6 ospf int bri

Interface    PID   Area            Intf ID    Cost  State Nbrs F/C
Lo0          1     0               16         1     LOOP  0/0
Se1/0.1      1     0               17         64    DROTH 0/0
Se1/0.2      1     0               18         64    P2P   1/1

R3 show ipv6 route

IPv6 Routing Table - Default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2001::/64 [0/0]
     via Serial1/0.1, directly connected
L   2001::123:1:1:3/128 [0/0]
     via Serial1/0.1, receive
O   2002::2:2:2:2/128 [110/64]
     via FE80::C802:A0FF:FEBC:0, Serial1/0.2
C   2003::/64 [0/0]
     via Serial1/0.2, directly connected
L   2003::23:1:1:3/128 [0/0]
     via Serial1/0.2, receive
C   2004::/64 [0/0]
     via Loopback0, directly connected
L   2004::3:3:3:3/128 [0/0]
     via Loopback0, receive
L   FF00::/8 [0/0]
     via Null0, receive