Cisco 826, 827, 828, 831, 836, and 837 and SOHO 76, 77, 78, 91, 96, and 97 Routers Software Configuration Guide - Basic Router Configuration [Cisco 800 Series Routers]

Table Of Contents

Basic Router Configuration

Before You Configure Your Network

Configuring Basic Parameters

Configuring Global Parameters

Configuring the Ethernet Interface

Configuration Example

Verifying Your Configuration

Configuring the Dialer Interface

Configuration Example

Verifying Your Configuration

Configuring the Loopback Interface

Configuration Tasks

Sample Configuration

Verifying Your Configuration

Configuring the Asynchronous Transfer Mode Interface

AAL5SNAP Encapsulation Configuration Example

Verifying Your Configuration

AAL5MUX PPP Encapsulation Configuration Example

Verifying Your Configuration

Configuring Command-Line Access to the Router

Configuration Example

Configuring Bridging

Configuration Example

Verifying Your Configuration

Configuring Static Routing

Configuration Example

Verifying Your Configuration

Configuring Dynamic Routing

Configuring RIP

Configuration Example

Verifying Your Configuration

Configuring IP Enhanced IGRP

Configuration Example

Verifying Your Configuration

Configuring Addressing Parameters

Configuring NAT

Configuration Example

Verifying Your Configuration

Configuring Easy IP (Phase 1)

Configuring Easy IP (Phase 2)

Configuring DHCP

Configuring DHCP Client Support

Configuration Example

Configuring DHCP Server

Configuration Example

Verifying Your Configuration

Configuring the DHCP Relay

Configuration Example

Verifying Your Configuration

Configuring TACACS+

Configuring an Extended Access List

Configuration Example

Configuring Quality of Service Parameters

Configuring a Single PVC Environment

Configuring IP Precedence

Configuring an Access List and Voice Class

Configure a Policy Map and Specify Voice Queuing

Configuring a Policy Map and Specifying Priority Queuing for Voice Class

Associating the Policy Map to the ATM PVC and Decreasing the ATM Interface MTU

Configuration Example

Configuring a Multiple PVC Environment

Voice and Data on Different Subnets

Configuring the ATM Interface and Subinterfaces

Configuration Example

Voice and Data on the Same Subnet Using Virtual Circuit Bundling

Configuring the ATM Interface

Specifying IP Precedence and the Service Class for the Voice Network

Configuration Example

Configuring Multilink PPP Fragmentation and Interleaving

Configuration Example

Verifying Your Configuration

Configuring IP Precedence

Configuration Example

Configuring RSVP

Configuration Example

Configuring Dial Backup

Specifying the Backup Interface

Defining Backup Line Delays

Defining Traffic Load Threshold

Dial Backup Using the Console Port

Configuration Example

Configuration Example

Configuring IGMP Proxy and Sparse Mode

Configuration Example

Verifying Your Configuration

Configuring IP Security and GRE Tunneling

Configuring Internet Protocol Parameters

Configuring an Access List

Configuring IPSec

Configuring a GRE Tunnel Interface

Configuring the Ethernet Interfaces

Configuring Static Routes

Configuring and Monitoring High-Speed Crypto

Configuration Example

Configuring Multilink PPP Fragmentation and Interleaving

Configuration Example

Verifying Your Configuration

Configuring IP Precedence

Configuration Example

Configuring Voice

Prerequisite Tasks

Configuring Voice for H.323 Signaling

Configuring the POTS Dial Peers

Configuring Voice Dial Peers for H.323 Signaling

Configuring Voice Ports for H.323 Signaling

Configuring Number Expansion

Configuration Example

Cisco 827 Routers Configuration Examples

Cisco 827-4V Router Configuration

Cisco 827 Router Configuration

Corporate or Endpoint Router Configuration for Data Network

Corporate or Endpoint Router Configuration for Data and Voice Network

Basic Router Configuration

This chapter includes basic feature-by-feature configuration procedures. This chapter is useful if you have a network in place and you want to add specific basic features.

Note Every feature described is not necessarily supported on every router model. Where possible and applicable, these feature limitations will be listed.

If you prefer to use network scenarios to build a network, see Chapter 2, "Network Scenarios." For advanced router configuration topics and feature descriptions, see Chapter 4, "Advanced Router Configuration."

This chapter contains the following sections:

•Before You Configure Your Network

•Configuring Basic Parameters

•Configuring Bridging

•Configuring Static Routing

•Configuring Dynamic Routing

•Configuring IP Enhanced IGRP

•Configuring Addressing Parameters

•Configuring DHCP

•Configuring TACACS+

•Configuring an Extended Access List

•Configuring Quality of Service Parameters

•Configuring Dial Backup

•Configuring IGMP Proxy and Sparse Mode

•Configuring IP Security and GRE Tunneling

•Configuring IP Precedence

•Configuring Voice

•Cisco 827 Routers Configuration Examples

•Corporate or Endpoint Router Configuration for Data and Voice Network

Each section includes a configuration example and verification steps, where available.

Before You Configure Your Network

Before you configure your network, you must do the following:

•Order an ADSL or G.SHDSL line from your telephone service provider.

•Determine the number of PVCs your service provider is giving you together with their virtual path identifiers (VPIs) and virtual channel identifiers (VCIs).

•For each PVC determine the type of AAL5 encapsulation supported. It can be one of the following:

–AAL5SNAP: This can be either routed RFC 1483 or bridged RFC 1483. In the case of routed RFC 1483, the service provider has to provide you with a static IP address. In the case of bridged RFC 1483, you may use DHCP to obtain your IP address or you may be given a static IP address from your service provider.

–AAL5MUX PPP: With this type, you need to determine PPP-related configuration items.

•If you are setting up an Internet connection, gather the following information:

– Point-to-Point Protocol (PPP) client name that is assigned as your login name.

–PPP authentication type: Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP).

–PPP password to access your Internet Service Provider (ISP) account.

–DNS server IP address and default gateways.

•If you are setting up a connection to a corporate network, you and its network administrator must generate and share the following information for the WAN interfaces of the routers:

–PPP authentication type: CHAP or PAP.

–PPP client name to access the router.

–PPP password to access the router.

•If you are setting up IP routing, generate the addressing scheme for your IP network.

Configuring Basic Parameters

To configure the router, perform the tasks described in the following sections:

•Configuring Global Parameters

•Configuring the Ethernet Interface

•Configuring the Dialer Interface

•Configuring the Loopback Interface

•Configuring the Asynchronous Transfer Mode Interface

•Configuring Command-Line Access to the Router

A configuration file example that illustrates how to configure the network is presented after the tasks.

After your router boots, the following prompt displays. Enter no.
Would you like to enter the initial configuration dialog [yes]: no
For complete information on how to access global configuration mode, see the "Entering Global Configuration Mode" section in Appendix A, "Cisco IOS Basic Skills." For more information on the commands used in the following tables, see the Cisco IOS Release 12.2 documentation set.

Configuring Global Parameters

Use the following table to configure the router for global parameters.

Command

Purpose

Step 1

configure terminal

Enters configuration mode.

Step 2

hostname name

Specifies the name for the router.

Step 3

enable secret password

Specifies an encrypted password to prevent unauthorized access to the router.

Step 4

ip subnet-zero

Configures the router to recognize zero subnet range as valid range of addresses.

Step 5

no ip domain-lookup

Disables the router from translating unfamiliar words (typos) entered during a console session into IP addresses.

For complete information on the global parameter commands, see the Cisco IOS Release 12.2 documentation set.

Configuring the Ethernet Interface

To configure the Ethernet interface, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

interface ethernet 0

Enters configuration mode for the Ethernet interface.

Step 2

ip address ip-address mask

Sets the IP address and subnet mask for the Ethernet interface.

Step 3

no shutdown

Enables the Ethernet interface to change the state from administratively down to up.

Step 4

exit

Exits configuration mode for the Ethernet interface.

For complete information on the Ethernet commands, see the Cisco IOS Release 12.2 documentation set. For more general information on Ethernet concepts, see "Concepts."

Note The SOHO 97 Router Ethernet interface remains in an up state when the connected switchport is down and when no cable is connect to the Ethernet interface. In addition, the switchport that is connected to the SOHO 97 Ethernet port stays up when the SOHO 97 Ethernet port is down.

Configuration Example

The following example shows the Ethernet interface configuration. You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
no ip directed-broadcast (default)
!
Verifying Your Configuration

To verify that you have properly configured the Ethernet interface, enter the show interface ethernet0 command. You should see a verification output like the example shown below.
router#show interface eth0
Ethernet0 is up, line protocol is up
	Hardware is PQUICC Ethernet, address is 0000.Oc13.a4db 
	(bia0010.9181.1281)
	Internet address is 170.1.4.101/24
	MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, 
		reliability 255/255., txload 1/255, rxload 1/255
	Encapsulation ARPA, loopback not set
	Keepalive set (10 sec)
Configuring the Dialer Interface

Use these commands if you are using PPP encapsulation for the ATM PVC.

Use the following table to configure the dialer interface, beginning in global configuration mode.

Command

Purpose

Step 1

interface dialer number

Enters configuration mode for the dialer interface.

Step 2

encapsulation ppp

Specifies the encapsulation type for the PVC as PPP.

Step 3

ip address ip-address mask

Sets the IP address and subnet mask for the dialer interface.

Step 4

dialer pool number

Specifies which dialer pool number you are using.

Step 5

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 6

encapsulation aal5mux ppp dialer

Specifies the encapsulation type as AAL5MUX PPP.

Step 7

dialer pool-member number

Specifies a dialer pool-member.

Step 8

dialer-group number

Specifies a dialer group. The dialer group is required to fast-switch outgoing packets.

Step 9

exit

Exits configuration mode for the ATM interface.

Configuration Example

The following example shows the dialer interface configuration. You do not need to input the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface atm0
pvc 1/40
	encapsulation aal5mux ppp dialer
	dialer pool-member 1
!
interface dialer 0
ip address 200.200.100.1 255.255.255.0
encapsulation ppp
dialer pool 1
!
Verifying Your Configuration

To verify that you have properly configured the dialer interface, enter the show interface virtual-access 1 command. Both line protocol and dialer 0 should be up and running. You should see a verification output like the example shown below.
router(config-if)#show interface virtual-access 1
Virtual-Access1 is up, line protocol is up 
	Hardware is Virtual Access interface
	Interface is unnumbered. Using address of Dialer0 (2.2.2.1)
	MTU 1500 bytes, BW 100000 Kbit, DLY 100000 usec, 
	reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, loopback not set
Virtual-access 1 is up means that the interface is up and running. If you see the output Virtual-access 1 is down, it means that the interface is "administratively down," and the interface is configured with the shutdown command. To bring the interface up, you must enter the no shutdown command.

Configuring the Loopback Interface

This section describes configuring the loopback interface. The loopback interface acts as a placeholder for the static IP address and provides default routing information.

For complete information on the loopback commands, see the Cisco IOS Release 12.2 documentation set.

Configuration Tasks

Use the following table to configure the loopback interface.

Command

Purpose

Step 1

interface Loopback 0

Enters configuration mode for the loopback interface.

Step 2

ip address ip-address mask

Sets the IP address and subnet mask for the loopback interface.

Step 3

ip nat outside

Sets the interface to be connected to the outside network.

Step 4

exit

Exits configuration mode for the loopback interface.

Sample Configuration

The loopback interface in this sample configuration is used to support NAT on the virtual-template interface. This sample configuration shows the loopback interface configured on the Ethernet interface with an IP address of 200.200.100.1/24, which acts as a static IP address. The loopback interface points back to virtual-template1, which has a negotiated IP address.
!
interface Loopback0
ip address 200.200.100.1 255.255.255.0 (static IP address)
ip nat outside
!
interface Virtual-Template1
ip unnumbered loopback0
no ip directed-broadcast
ip nat outside
!
Verifying Your Configuration

To verify that you have properly configured the loopback interface, enter the show interface loopback 0 command. You should see a verification output similar to the following example.
Router #show interface loopback 0
Loopback0 is up, line protocol is up 
  Hardware is Loopback
  Internet address is 200.200.100.1/24
  MTU 1514 bytes, BW 8000000 Kbit, DLY 5000 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation LOOPBACK, loopback not set
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/0, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out
Another way to verify the loopback interface is to send multiple ping packets to it:
Router#ping 200.200.100.1 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.200.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Configuring the Asynchronous Transfer Mode Interface

To configure the Asynchronous Transfer Mode (ATM) interface, use the following table, beginning in global configuration mode.

Note The default service class for configuring the ATM interface is unspecified bit rate (ubr). You can change the service class to variable bit rate non-real time (vbr-nrt) or variable bit rate real time (vbr-rt) by using one of these commands: vbr-nrt or vbr-rt. See the Cisco IOS Release 12.2 documentation set. For more information on definitions of service classes, see "Concepts."

Command

Purpose

Step 1

interface ATM 0

Enters configuration mode for the ATM interface.

Step 2

dsl equipment-type {co | cpe}

Configures the DSL equipment type, if applicable.

Step 3

dsl linerate {number | auto}

Specifies the G.SHDSL line rate, if applicable. The range of valid numbers is between 72 and 2312.

Step 4

dsl operating-mode gshdsl symmetric annex annex

Sets the G.SHDSL operating mode, if applicable, and select the G.991.2 annex.

Step 5

ip address ip-address mask

Sets the IP address and subnet mask for the ATM interface.

Step 6

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 7

protocol ip ip-address broadcast

Sets the protocol broadcast for the IP address.

Step 8

encapsulation protocol

Specifies the encapsulation type for the PVC. Encapsulations can be specified as AAL5SNAP, AAL5MUX IP, or AAL5MUX PPP.¹

Step 9

tx-ring-limit number

Configures the size of the PVC transmit queue. The default setting is 6.

Step 10

no shutdown

Enables the ATM interface.

Step 11

exit

Exits configuration mode for the ATM interface.

¹This step is optional. If you specify the AAL5MUX PPP encapsulation, you will need to add an additional step to specify the dialer pool-member number using the command dialer-pool member number.

For complete information on the ATM commands, see the Cisco IOS Release 12.2 documentation set. For more general information on ATM concepts, see "Concepts."

AAL5SNAP Encapsulation Configuration Example

The following example shows the ATM interface configuration for AAL5SNAP encapsulation.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface ATM0
ip address 200.200.100.1 255.255.255.0
no ip directed-broadcast (default)
no atm ilmi-keepalive (default)
pvc 8/35
encapsulation aal5snap
protocol ip 200.200.100.254 broadcast
!
Verifying Your Configuration

To verify that you have properly configured the ATM interface with AAL5SNAP encapsulation, enter the show interface atm0 command. You should see a verification output like the example shown below.
router#sh int atm0
ATM0 is up, line protocol is up
	Hardware is PQUICC_SAR (with Alcatel ADSL Module)
Internet address is 1.1.1.1/24	
MTU 1500 bytes, sub MTU 1500, BW 640 Kbit, DLY 80 usec, reliability
		113/255. txload 1/255, rxload 1/255
	Encapsulation aal5snap, loopback not set
	Keepalive not supported
DTR is pulsed for 5 seconds on reset
LCP Closed
AAL5MUX PPP Encapsulation Configuration Example

The following example shows an ATM interface configuration for an AAL5MUX PPP encapsulation.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface ATM0
no ip directed-broadcast (default)
no atm ilmi-keepalive (default)
pvc 8/35 
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
Verifying Your Configuration

To verify that you have properly configured the ATM interface with AAL5MUX PPP encapsulation, enter the virtual-access 1 command. You should see a verification output like the example shown below.
router#sh int virtual-access 1
Virtual-Access1 is up, line protocol is up 
	Hardware is Virtual Access interface
	Interface is unnumbered. Using address of Dialer0 (2.2.2.1)
	MTU 1500 bytes, BW 100000 Kbit, DLY 100000 usec, 
	reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, loopback not set
Virtual-access 1 is up means that the interface is up and running. If you see the output Virtual-access 1 is down, it means that the interface is "administratively down," and the interface is configured with the shutdown command. To bring the interface up, you must enter the no shutdown command.

Configuring Command-Line Access to the Router

To configure parameters to control access to the router, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

line console 0

Enters line configuration mode, and specify the console terminal line.

Step 2

password password

Specifies a unique password on the line.

Step 3

login

Enables password checking at terminal session login.

Step 4

exec-timeout 10 0

Sets the interval that EXEC command interpreter waits until user input is detected. Exec-timeout 10 0 is the default.

Step 5

line vty 0 4

Specifies a virtual terminal for remote console access.

Step 6

password password

Specifies a unique password on the line.

Step 7

login

Enables password checking at virtual terminal session login.

Step 8

end

Exits line configuration mode, and return to privileged EXEC mode.

For complete information on the command line commands, see the Cisco IOS Release 12.2 documentation set.

Configuration Example

The following configuration shows the command-line access commands.

You do not need to input the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
line con 0
exec-timeout 10 0
password 4youreyesonly
login
transport input none (default)
stopbits 1 (default)
line vty 0 4
password secret
login
!
Configuring Bridging

Bridges are store-and-forward devices that use unique hardware addresses to filter traffic that would otherwise travel from one segment to another. You can configure the routers as pure bridges.

To configure bridging, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

no ip routing

Disables IP routing.

Step 2

bridge number protocol protocol

Specifies the bridge protocol to define the type of Spanning-Tree Protocol (STP).

Step 3

interface ethernet 0

Enters configuration mode for the Ethernet interface.

Step 4

bridge-group number

Specifies the bridge-group number to which the Ethernet interface belongs.

Step 5

no shutdown

Enables the Ethernet interface.

Step 6

exit

Exits configuration mode for the Ethernet interface and the router.

Step 7

interface ATM 0

Enters configuration mode for the ATM interface.

Step 8

dsl equipment-type {co | cpe}

Configures the DSL equipment type, if applicable.

Step 9

dsl linerate {number | auto}

Specifies the G.SHDSL line rate, if applicable. The range of valid numbers is between 72 and 2312.

Step 10

dsl operating-mode gshdsl symmetric annex annex

Sets the G.SHDSL operating mode, if applicable, and select the G.991.2 annex.

Step 11

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 12

encapsulation type

Specifies the encapsulation type for the PVC.

Step 13

bridge-group number

Specifies the bridge-group number to which the ATM interface belongs.

Step 14

no shutdown

Enables the ATM interface.

Step 15

end

Exits the configuration mode for the ATM interface.

For complete information on the bridging commands, see the Cisco IOS Release 12.2 documentation set. For more general concepts on bridging, see "Concepts."

Configuration Example

The following configuration example uses bridging with AAL5SNAP encapsulation. You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.

This configuration example shows the Ethernet and ATM interfaces configured. The Ethernet interface has IP addressing turned off for bridging, and IP directed broadcast is disabled, which prevents the translation of directed broadcasts to physical broadcasts. The bridge-group number to which the ATM interface is associated is set to 1.

The ATM interface has a PVC of 8/35, and the encapsulation is set to AAL5SNAP. The IP address is disabled for bridging and the IP directed broadcast is disabled, which prevents the translation of directed broadcasts to physical broadcasts. The bridge protocol is set to 1 to define the STP.
no ip routing
!
interface Ethernet0
no ip address
no ip directed-broadcast (default)
bridge-group 1
!
interface ATM0
no ip address
no ip directed-broadcast (default)
pvc 8/35 
encapsulation aal5snap
!
bridge-group 1
!
ip classless (default)
!
bridge 1 protocol ieee
!
end
Verifying Your Configuration

To verify that you have properly configured bridging, enter the show spanning-tree command. You should see a verification output like the example shown below.
router#show spanning-tree 
Bridge group 1 is executing the IEEE compatible Spanning Tree protocol
	Bridge Identifier has priority 32768, address 1205.9356.0000
	Configured hello time 2, max age 20, forward delay 15
	We are the root of the spanning tree
	Port Number size is 9
	Topology change flag set, detected flag set
	Times: hold 1, topology change 35, notification 2
	hello 2, max age 20, forward delay 15 
	Timers:hello 1, topology change 34, notification 0
	bridge aging time 15
Port 2 (Ethernet0) of Bridge group 1 is forwarding
	Port path cost 100, Port priority 128
	Designated root has priority 32768, address 1205.9356.0000
	Designated bridge has priority 32768, address 1205.9356.0000
	Designated port is 2, path cost 0
	Timers:message age 0, forward delay 0, hold 0
	BPDU:sent 0, received 0
Port 3 (ATM0 RFC 1483) of Bridge group 1 is forwarding
	Port path cost 1562, Port priority 128
	Designated root has priority 32768, address 1205.9356.0000
	Designated bridge has priority 32768, address 1205.9356.0000
	Designated port is 3, path cost 0
	Timers:message age 0, forward delay 0, hold 0
	BPDU:sent 0, received 0
Configuring Static Routing

Static routes are routing information that you manually configure into the router. If the network topology changes, the static route must be updated with a new route. Static routes are private routes, unless they are redistributed by a routing protocol. Configuring static routing on the 800-series routers is optional.

To configure static routing, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

ip classless

Sets up a best route for packets destined for networks unknown by the router.

Step 2

ip route network-number mask

Specifies the static route for the IP packets.

Step 3

end

Exits router configuration mode.

For complete information on the static routing commands, see the Cisco IOS Release 12.2 documentation set. For more general information on static routing, see "Concepts."

Configuration Example

In the following configuration example, the static route is sending all IP packets with a destination of 1.0.0.0 and a subnet mask of 255.0.0.0 out on the ATM interface to another device with an IP address of 14.0.0.1. Specifically, the packets are being sent to the configured PVC.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
ip classless (default)
ip route 1.0.0.0 255.0.0.0 atm0 14.0.0.1 
no ip http server (default)
!
Verifying Your Configuration

To verify that you have properly configured static routing, enter the show ip route command and look for static routes signified by the "S."

You should see a verification output like the example shown below.
router#show ip route
Codes:C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS
			inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
5* 	2.0.0.0/24 is subnetted, 1 subnets
C			2.2.2.0 is directly connected, Ethernet0/0
S* 0.0.0.0/0 is directly connected, Ethernet0/0
Configuring Dynamic Routing

In dynamic routing, the network protocol adjusts the path automatically based on network traffic or topology. Changes in dynamic routing are shared with other routers in the network.

The IP routing protocol can use the Routing Information Protocol (RIP) or the Enhanced Interior Gateway Routing Protocol (IGRP) to learn routes dynamically. You can configure either one of these routing protocols.

Configuring RIP

To configure RIP routing protocol on the router, use the following table, beginning in global configuration mode.

Command

Task

Step 1

router rip

Enter router configuration mode and enable RIP on the router.

Step 2

version 2

Specify use of RIP version 2.

Step 3

network network-number

Specify the network number for each directly connected network.

Step 4

no auto-summary

Disable automatic summarization of subnet routes into network-level routes. This allows subprefix routing information to transmit across classful network boundries.

Step 5

end

Exit router configuration mode.

For complete information on the dynamic routing commands, see the Cisco IOS Release 12.2 documentation set. For more general information on RIP, see "Concepts."

Configuration Example

The following configuration shows RIP version 2 enabled in IP network 10.10.10.0.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
	router rip
	version 2 
	network 10.0.0.0
	no auto-summary
!
Verifying Your Configuration

To verify that you have properly configured RIP, enter the show ip route command and look for RIP routes signified by "R." You should see a verification output like the example shown below.
router#show ip route
Codes:C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS
	inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route
Gateway of last resort is not set
     2.0.0.0/24 is subnetted, 1 subnets
C 		2.2.2.0 is directly connected, Ethernet0/0
R    3.0.0.0/8 [120/1] via 2.2.2.1, 00:00:02, Ethernet0/0
Configuring IP Enhanced IGRP

To configure IP Enhanced IGRP, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

router eigrp autonomous-system

Enters router configuration mode and enable Enhanced IGRP on the router. The autonomous-system number identifies the route to other Enhanced IGRP routers and is used to tag the Enhanced IGRP information.

Step 2

network network-number

Specifies the network number for each directly connected network.

Step 3

end

Exits router configuration mode.

For complete information on the IP Enhanced IGRP commands, see the Cisco IOS Release 12.2 documentation set. For more general information on Enhanced IGRP concepts, see "Concepts."

Configuration Example

The following configuration shows Enhanced IGRP routing protocol enabled in IP networks 10.0.0.0 and 172.17.0.0. The Enhanced IGRP autonomous system number is assigned as 100.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
router eigrp 100
	network 10.0.0.0
		network 172.17.0.0
!
Verifying Your Configuration

To verify that you have properly configured IP Enhanced IGRP, enter the show ip route command and look for Enhanced IGRP routes signified by "D." You should see a verification output like the example shown below.
router#show ip route
Codes:C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route
Gateway of last resort is not set
		2.0.0.0/24 is subnetted, 1 subnets
C 	2.2.2.0 is directly connected, Ethernet0/0
D    	3.0.0.0/8 [90/409600] via 2.2.2.1, 00:00:02, Ethernet0/0
Configuring Addressing Parameters

This section describes how to configure addressing using Network Address Translation (NAT) and Easy IP Phase 1 and 2.

Configuring NAT

You can configure NAT for either static or dynamic address translations.

To configure static or dynamic inside source translation using NAT, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}

Creates pool of global IP addresses for NAT.

Step 2

access-list access-list-number permit source [source-wildcard]

Defines a standard access list permitting addresses that need translation.

Step 3

ip nat inside source list access-list-number pool name

Enables dynamic translation of addresses permitted by access list to one of addresses specified in pool.

Step 4

ip nat inside source static local-ip global-ip number extendable

Enables static translation of specified inside local address to globally unique IP address. This command is optional.

Step 5

interface ethernet 0

Enters configuration mode for Ethernet interface.

Step 6

ip nat inside

Establishes Ethernet interface as inside interface.

Step 7

exit

Exits configuration mode for Ethernet interface.

Step 8

interface atm 0

Enters configuration mode for ATM interface.

Step 9

dsl equipment-type {co | cpe}

Configures the DSL equipment type, if applicable.

Step 10

dsl linerate {number | auto}

Specifies the G.SHDSL line rate, if applicable. The range of valid numbers is between 72 and 2312.

Step 11

dsl operating-mode gshdsl symmetric annex annex

Sets the G.SHDSL operating mode, if applicable, and select the G.991.2 annex.

Step 12

ip nat outside

Establishes ATM interface as outside interface.

Step 13

exit

Exits configuration mode for ATM interface.

Note If you want to use NAT with a Virtual-Template interface, you must configure a loopback interface.

For complete information on the NAT commands, see the Cisco IOS Release 12.2 documentation set. For more general information on NAT concepts, see "Concepts."

Configuration Example

The following configuration shows NAT configured for the Ethernet and ATM interfaces.

The Ethernet 0 interface has an IP address of 192.168.1.1 with a subnet mask of 255.255.255.0. NAT is configured for inside, which means that the interface is connected to the inside network that is subject to NAT translation.

The ATM 0 interface has an IP address of 200.200.100.1 and a subnet mask of 255.255.255.0. NAT is configured for outside, which means that the interface is connected to an outside network, such as the Internet.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
no ip directed-broadcast (default)
ip nat inside
!
interface ATM0
ip address 200.200.100.1 255.255.255.0
no ip directed-broadcast (default)
ip nat outside
no atm ilmi-keepalive (default)
pvc 8/35 
encapsulation aal5snap
!
ip route 0.0.0.0.0.0.0.0 200.200.100.254
!
ip nat pool test 200.200.100.1 200.200.100.1 netmask 255.255.255.0
ip nat inside source list 101 pool test overload
ip classless (default)
!
Verifying Your Configuration

To verify that you have properly configured NAT, enter the show ip nat statistics command. You should see a verification output like the example shown below.
router#show ip nat statistics 
Total active translations:45 (10 static, 35 dynamic; 45 extended)
Outside interfaces:
  ATM0
Inside interfaces:
  Ethernet0
Hits:34897598  Misses:44367
Expired translations:119305
Dynamic mappings:
-- Inside Source
access-list 1 pool homenet refcount 14
pool homenet:netmask 255.255.255.0
        start 200.200.100.1 end 200.200.100.1
        type generic, total addresses 1, allocated 1 (100%), misses 
Configuring Easy IP (Phase 1)

This section explains how to configure Easy IP (Phase 1). Easy IP Phase 1 includes NAT overload and PPP/Internet Protocol Control Protocol (IPCP). NAT overload means that you can use one registered IP address for the interface and use it to access the Internet from all devices in the network.

With PPP/IPCP, Cisco 800-series routers automatically negotiate a globally unique (registered or public) IP address for the interface from the ISP route.

To configure Easy IP (Phase 1), use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

access-list access-list-number permit source [source-wildcard]

Defines a standard access list that permits nonregistered IP addresses of hosts.

Step 2

ip nat inside source list access-list-number interface interface overload

Sets up translation of addresses identified by the access list defined in Step 1.

Step 3

interface ethernet 0

Enters configuration mode for Ethernet interface.

Step 4

ip nat inside

Establishes the Ethernet interface as inside interface for NAT.

Step 5

no shutdown

Enables the Ethernet interface and the configuration changes just made to it.

Step 6

exit

Exits configuration mode for Ethernet interface.

Step 7

interface dialer

Enters configuration mode for the dialer interface.

Step 8

ip address negotiated

Assigns a negotiated IP address to the dialer interface.

Step 9

ip nat outside

Establishes the dialer interface as the outside interface for NAT.

Step 10

dialer pool number

Specifies which dialer pool number you are using.

Step 11

exit

Exits the dialer interface.

Step 12

interface ATM 0

Enters configuration mode for the ATM interface.

Step 13

dsl equipment-type {co | cpe}

Configures the DSL equipment type, if applicable.

Step 14

dsl linerate {number | auto}

Specifies the G.SHDSL line rate, if applicable. The range of valid numbers is between 72 and 2312.

Step 15

dsl operating-mode gshdsl symmetric annex annex

Sets the G.SHDSL operating mode, if applicable, and select the G.991.2 annex.

Step 16

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 17

encapsulation aal5mux ppp dialer

Specifies the encapsulation type for the PVC to be AAL5MUX PPP and point back to the dialer interface.

Step 18

dialer pool-member number

Specifies which dialer pool-member you are using.

Step 19

no shutdown

Enables the interface and configuration changes just made to the ATM interface.

Step 20

exit

Exits configuration mode for the ATM interface.

For complete information on the Easy IP commands, see the Cisco IOS Release 12.2 documentation set. For more general information on Easy IP (Phase 1) concepts, see "Concepts."

Configuring Easy IP (Phase 2)

This section explains how to configure the Cisco 800 series routers as DHCP servers.

The Easy IP (Phase 2) feature combines DHCP server and relay. With DHCP, LAN devices on an IP network (DHCP clients) can request IP addresses from the DHCP server. The DHCP server allocates IP addresses from a central pool as needed. A DHCP server can be a workstation, PC, or a Cisco router. With the DHCP relay feature configured on the router, the routers can relay IP address requests from the LAN interface and to the DHCP server as shown in Figure 3-1.

Figure 3-1 Easy IP (Phase 2) - DHCP Server and Relay

1

DHCP client

4

Corporate office

2

Remote office

5

DHCP server

3

DHCP relay

Configuring DHCP

The following sections describe how to configure the router as a DHCP client, server, or relay.

Configuring DHCP Client Support

Follow these steps to configure the router for DHCP client support:

Step 1 Configure the BVI interface by entering the ip address dhcp client-id Ethernet 0 command.

Specifying the value client-id ethernet0 means that the MAC address of the Ethernet interface is used as the client ID when the DHCP request is sent. Otherwise, the MAC address of the BVI interface is used as the client ID.

Step 2 Configure NAT:

a. Configure the BVI interface by entering the ip nat outside command.

b. Configure the Ethernet interface by entering the ip nat inside command.

c. Create an access list under NAT by entering the access-list 1 permit ip address command to match all Ethernet IP addresses.

d. Configure the source list under NAT by entering the
ip nat inside source list 1 interface BVI 1 overload command.

Step 3 Configure the router to act as a DHCP server. This step is optional.

a. At the config-if router prompt, enter the ip dhcp pool server name command.

b. Enter the import all command to have the Cisco 827 router retrieve the Microsoft Windows nameserver (WINS) and domain name system (DNS) server addresses for name resolution.

Configuration Example

The following example shows a configuration of the DHCP client.
Current configuration:
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname c827
!
!
ip subnet-zero
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool SERVER
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1 
import all
! 
bridge irb
interface Ethernet0
ip address 10.10.10.1 255.255.255.0
no ip directed-broadcast
ip nat inside
!
interface ATM0
no ip address
no ip directed-broadcast
no atm ilmi-keepalive
bundle-enable
hold-queue 208 in
!
interface ATM0.1 point-to-point
no ip directed-broadcast
pvc 1/100 
encapsulation aal5snap
!
bridge-group 1
!
interface ATM0.2 point-to-point
ip address 5.0.0.2 255.0.0.0
no ip directed-broadcast
pvc 1/101 
protocol ip 5.0.0.1 broadcast
protocol ip 5.0.0.5 broadcast
encapsulation aal5snap
!
!
interface BVI1
ip address dhcp client-id Ethernet0
no ip directed-broadcast
ip nat outside
!
ip nat inside source list 1 interface BVI1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 BVI1
no ip http server
!
access-list 1 permit 10.10.10.0 0.0.0.255
bridge 1 protocol ieee
bridge 1 route ip
!
voice-port 1
timing hookflash-in 0
!
voice-port 2
timing hookflash-in 0
!
voice-port 3
timing hookflash-in 0
!
voice-port 4
timing hookflash-in 0
!
!
line con 0
exec-timeout 0 0
transport input none
stopbits 1
line vty 0 4
password lab
login    
!
scheduler max-task-time 5000
end
Configuring DHCP Server

To configure the router as a DHCP server, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

ip dhcp pool name

Enters DHCP configuration mode, and create a pool of IP addresses that can be assigned to DHCP clients.

Step 2

network ip-address subnet-mask

Specifies a range of IP addresses that can be assigned to the DHCP clients.

Step 3

domain-name domain name

Configures the domain name.

Step 4

dns-server ip-address

Configures the DNS server.

Step 5

netbios-name-server ip-address

Configures the netbios name server.

Step 6

default-router ip-address

Designates the router as the default router, and specify an IP address.

Step 7

lease days hours minutes

Specifies the duration of the lease.

Step 8

exit

Exits DHCP configuration mode.

For more information on the features not used in this configuration, see the Cisco IOS DHCP Server feature module. For more general information on DHCP servers, see "Concepts."

Configuration Example

The following configuration shows a DHCP server configuration for the IP address 20.1.1.2.
!
ip dhcp pool CLIENT
   network 20.20.20.0 255.255.255.0
   domain-name cisco.com
   default-router 20.20.20.20
   netbios-name-server 1.1.1.1
   dns-server 1.1.1.2
   lease 0 1
!
Verifying Your Configuration

To verify that you have properly configured the DHCP server, enter the show dhcp server command and look for the assigned server IP. You should see a verification output like the example shown below.
router# show dhcp server 
show ip dhcp binding
show ip dhcp conflict
show ip dhcp server statics
Configuring the DHCP Relay

This section describes how to configure the router to forward User Datagram Protocol (UDP) broadcasts, including IP address requests, from DHCP clients.

To configure the DHCP relay, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

interface Ethernet 0

Enters configuration mode for the Ethernet interface.

Step 2

ip helper-address address

Forwards default UDP broadcasts including IP configuration requests to the DHCP server.

Step 3

no shutdown

Enables the Ethernet interface and the configuration changes.

Step 4

exit

Exits configuration mode for the Ethernet interface.

For complete information on the DHCP relay commands, see the Cisco IOS Release 12.2 documentation set. For more general information on DHCP relays, see "Concepts."

Configuration Example

The following configuration contains commands relevant to DHCP relay only.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
int Ethernet0
ip address 192.168.100.1 255.255.255.0
ip helper-address 200.200.200.1
!
Verifying Your Configuration

To verify that you have properly configured the DHCP relay, enter the show dhcp server command. You should see a verification output like the example shown below.
router#show dhcp server 
   DHCP server:2.2.2.2
    Leases:  0
    Offers:  0      Requests:0     Acks:0     Naks:0
Declines:0      Releases:0     Bad: 0
Configuring TACACS+

The Cisco 827, 831, 836, 837, 827H, and 827-4V routers and the Cisco SOHO 71, 91, 96, and 97 routers support the Terminal Access Controller Access Control System Plus (TACACS+) protocol through Telnet. TACACS+ is a Cisco proprietary authentication protocol that provides remote access authentication and related network security services, such as event logging. User passwords are administered in a central database rather than in individual routers. TACACS+ also provides support for separate modular authentication, authorization, and accounting (AAA) facilities that are configured at individual routers.

To configure your router to support TACACS+, you must perform the following tasks:

Step 1 Use the aaa new-model global configuration command to enable AAA. AAA must be configured if you plan to use TACACS+.

Step 2 Use the tacacs-server host command to specify the IP address of one or more TACACS+ daemons.

Step 3 Use the tacacs-server key command to specify an encryption key that will be used to encrypt all exchanges between the network access server and the TACACS+ daemon. This same key must also be configured on the TACACS+ daemon.

Step 4 Use the aaa authentication global configuration command to define the method lists that use TACACS+ for authentication.

Step 5 Use line and interface commands to apply the defined method lists to various interfaces.

You may need to perform other configuration steps if you need to enable accounting for TACACS+ connections. For instructions on configuring TACACS+, see the Security Configuration Guide.

Configuring an Extended Access List

To include one or more extended access lists in your router configuration, you can use the following commands, beginning in global configuration mode.

Command

Purpose

Step 1

access-list 100 permit tcp any ip ip address-mask established

Permits any host on the network to access any Internet server.

Step 2

access-list 100 deny ip ip address-mask any

Denies any Internet host from spoofing any host on the network.

Step 3

access-list 100 permit tcp host ip address-mask

Permits Internet DNS server to send TCP replies to any host on the network.

Step 4

access-list 100 permit udp host ip address-mask

Permits Internet DNS server to send UDP replies to any host on the network.

Step 5

access-list 100 permit tcp any host ip address

Permits SMTP mail server to access any Internet server.

Step 6

access-list 100 permit tcp any host ip address

Permits web server to access any Internet server.

Step 7

access-list 100 permit tcp any host ip address

Permits FTP server to access any Internet server.

Step 8

access-list 100 deny tcp any ip address-mask

Restricts any Internet host from making a Telnet connection to any host on the network.

Step 9

interface atm 0

Enters configuration mode for the ATM interface.

Step 10

dsl equipment-type co/cpe

Configures the DSL equipment type, if applicable.

Step 11

dsl linerate number/auto

Specifies the G.SHDSL line rate, if applicable. The range of valid numbers is between 72 and 2312.

Step 12

dsl operating-mode gshdsl symmetric annex annex

Sets the G.SHDSL operating mode, if applicable, and select the G.991.2 annex.

Step 13

ip access-group 100 in

Activates access list 100.

Step 14

no shutdown

Enables interface and configuration changes made to the interface.

Step 15

exit

Exits configuration mode for the ATM interface.

For more complete information on the extended access list commands, see the Cisco IOS Release 12.2 documentation set. For information on TCP and UDP port assignments, see "Common Port Assignments."

Configuration Example

This configuration shows an access list being applied to IP address 192.168.1.0.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
access-list 101 permit tcp any host 192.168.1.0 0.0.0.255
! 
Configuring Quality of Service Parameters

This section describes how to configure Quality of Service (QoS) parameters. The requirements for voice QoS are:

•Priority queuing for voice traffic

•Fragmenting large data packets and interleaving voice packets

You can configure QoS in a single or multiple PVC environment. In a single PVC environment, the traffic relies on Cisco IOS to provide priority queuing, using Class Based Weighted Fair Queuing (CBWFQ) to prioritize voice traffic and MTU size reduction to perform Layer 3 fragmentation of data packets. In a multiple PVC environment, the traffic relies on the ATM interface to provide priority queuing for voice and fragmentation and interleaving.

Note QoS parameters are supported only on routers with voice features.

For complete information on the QoS commands, see the Cisco IOS documentation set. For more general information on QoS concepts, see "Concepts."

Configuring a Single PVC Environment

In the single PVC environment, the traffic relies on Cisco IOS to provide priority queuing (using CBWFQ). The tasks to configure a single PVC environment are:

•Configuring IP precedence 5 for voice packets

•Configuring an access list and voice class

•Configuring a policy map and specify priority queuing for voice class

•Associating the policy map to the ATM PVC and decreasing the MTU of the ATM interface

Configuring IP Precedence

IP precedence gives voice packets a higher priority than other IP data traffic. The ip precedence command is used by the router to differentiate voice traffic from data traffic. So you need to ensure that the data IP packets do not have the same IP precedence as that of the voice packets.

To configure real-time voice traffic precedence over other IP network traffic, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

dial-peer voice number voip

Enters the dial peer configuration mode to configure a VoIP dial peer.

Step 2

destination-pattern number

Sets a destination pattern.

Step 3

session target {ipv4:destination-address}

Specifies a destination IP address for the dial peer.

Step 4

ip precedence number

Selects a precedence level for the voice traffic associated with that dial peer.

Step 5

exit

Exits configuration mode for the dial peer interface.

Note In IP precedence, the numbers 1 through 5 identify classes for IP flows; the numbers 6 through 7 are used for network and backbone routing and updates. It is recommended that IP precedence 5 is used for voice packets.

Configuring an Access List and Voice Class

To create a policy map and associate a priority queue to the voice class, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

access-list 101 permit ip any any precedence 5

Configures an access list to match voice packets.

Step 2

class-map voice

Configures a voice class.

Step 3

match access-group 101

Associates the voice class with the access list.

Configure a Policy Map and Specify Voice Queuing

Follow the steps below to configure a policy map and to specify voice queuing, beginning in global configuration mode.

Command

Purpose

Step 1

policy map name

Configures a policy map¹.

Step 2

class voice

Specifies the class for queuing.

Step 3

priority number

Specifies the priority for queuing.

¹Total bandwidth for the policy map may not exceed 75 percent of the total PVC bandwidth.

Configuring a Policy Map and Specifying Priority Queuing for Voice Class

To associate the policy map to the ATM PVC and decrease the MTU of the ATM interface so that large data packets are fragmented, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

policy map name

Configures a policy map¹.

Step 2

class voice

Specifies the class for queuing.

Step 3

priority bandwidth

Specifies the priority for queuing.

Step 4

exit

Exits configuration mode for the policy map.

¹Total bandwidth for the policy map may not exceed 75 percent of the total PVC bandwidth.

Associating the Policy Map to the ATM PVC and Decreasing the ATM Interface MTU

To associate the policy map to the ATM PVC and decrease the MTU, use the following table, beginning in global configuration mode. It is recommended that 300 be used for the MTU size because it is larger than the size of the voice packets generated by the different codecs.

Note The default service class for configuring the ATM interface is unspecified bit rate (ubr). In order to attach the policy map to the ATM PVC, you must use a service class of vbr-nrt or vbr-rt.

Command

Purpose

Step 1

interface ATM 0

Enters configuration mode for the ATM interface.

Step 2

ip address ip-address mask

Sets the IP address and subnet mask for the ATM interface.

Step 3

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 4

encapsulation protocol

Specifies the encapsulation type for the PVC. Encapsulations can be specified as AAL5SNAP or AAL5MUX PPP.

Step 5

service policy out name

Associates the service policy name.

Step 6

vbr-rt pcr scr bs

Specifies the service class.

Step 7

exit

Exits configuration mode for the ATM PVC.

Step 8

mtu number

Specifies the MTU for the ATM interface.

Step 9

no shutdown

Enables the ATM interface.

Step 10

exit

Exits configuration mode for the ATM interface.

Configuration Example

The following example shows a voice QoS configuration in a single PVC environment using AAL5SNAP encapsulation.
!
dial-peer voice 105 voip 
destination-pattern 3.. 
session target ipv4:10.1.2.3 
ip precedence 5
access-list 101 permit ip any any precedence critical
class-map voice 
match access-group 101
policy-map mypolicy 
class voice   
priority 480
int atm0
mtu 300
pvc 8/35 
encapsulation aal5snap   
service-policy out mypolicy 
vbr-rt 640 640 10
!
Configuring a Multiple PVC Environment

In a multiple PVC environment, the traffic relies on the ATM interface to provide priority queuing for voice and fragmentation and interleaving. The following figures show the configurations that you can use.

Voice and Data on Different Subnets

Figure 3-2 shows voice and data packets on different subnets. You can have all voice traffic on an ATM PVC with a VBR-RT service class while the data traffic is transported on an ATM PVC with a UBR service class.

Figure 3-2 Voice and Data on Different Subnets

1

Ethernet 0

2

PVC 1/40 VBR (RT), Voice

3

PVC 8/35 UBR, Data

Configuring the ATM Interface and Subinterfaces

Use this table to configure the ATM interface and subinterfaces, beginning in global configuration mode.

Command

Purpose

Step 1

interface ATM 0.1 point-to-point

Specifies the ATM0.1 subinterface.

Step 2

ip address ip-address mask

Sets the IP address and subnet mask for the ATM0.1 subinterface.

Step 3

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 4

encapsulation type

Specifies the encapsulation type for the PVC.

Step 5

protocol ip address broadcast

Sets the protocol broadcast for the IP address.

Step 6

interface ATM 0.2 point-to-point

Specifies the ATM0.2 subinterface.

Step 7

ip address ip-address mask

Sets the IP address and subnet mask for the ATM0.2 subinterface.

Step 8

pvc vpi/vci

Creates an ATM PVC for each end node with which the router communicates.

Step 9

encapsulation type

Specifies the encapsulation type for the PVC.

Step 10

protocol ip address broadcast

Sets the protocol broadcast for the IP address.

Step 11

exit

Exits configuration mode for the ATM interface.

Configuration Example

The following example shows a voice QoS configuration with all data traffic on the 30.0.0.1 network and all voice traffic on the 20.0.0.1 network.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface ATM0.1 point-to-point
ip address 20.0.0.1 255.0.0.0
no ip directed-broadcast (default)
	pvc 1/100
protocol ip 20.0.0.2 broadcast
	vbr-rt 424 424 5
	encapsulation aal5snap
!
interface ATM0.2 point-to-point
ip address 30.0.0.1 255.0.0.0
no ip directed-broadcast (default)
pvc 1/101
protocol ip 30.0.0.2 broadcast
encapsulation aal5snap
Voice and Data on the Same Subnet Using Virtual Circuit Bundling

Figure 3-3 shows voice and data packets on the same subnet using virtual circuit bundling. Virtual circuit bundling allows multiple PVCs on the same bundle. Using virtual circuit bundling and assigning precedence 5 to the voice packets but not to the data packets ensures that the two types of traffic are separated onto two PVCs.

Figure 3-3 Voice and Data on the Same Subnet with Virtual Circuit Bundling

1

Ethernet 0

3

PVC Bundle 1/40 BVR (RT), Voice

2

Bundle

4

PVC Bundle 8/35 UBR, Data

The tasks for configuring a voice and data network on the same subnet with virtual circuit bundling are as follows:

•Configuring the ATM interface

•Configuring the pvc-bundle for voice

•Configuring the pvc-bundle for data

•Configuring IP precedence for voice packet

Configuring the ATM Interface

Use the following table to configure the ATM interface, beginning in global configuration mode.

Command

Purpose

Step 1

interface ATM 0

Enters configuration mode for the ATM interface.

Step 2

dsl equipment-type co/cpe

Configures the DSL equipment type.

Step 3

dsl linerate number/auto

Specifies the G.SHDSL line rate. The range of valid numbers is between 72 and 2312.

Step 4

dsl operating-mode gshdsl symmetric annex annex

Sets the G.SHDSL operating mode, and selects the G.991.2 annex.

Step 5

ip address ip-address mask

Sets the IP address and subnet mask for the ATM interface.

Step 6

bundle name

Specifies a bundle name.

Step 7

encapsulation type

Specifies the encapsulation type for the voice bundle PVC.

Step 8

protocol ip ip-address broadcast

Sets the protocol broadcast for the IP address.

Step 9

pvc-bundle name vpi/vci

Creates a PVC for the voice bundle.

Step 10

vbr-rt pcr scr bs

Sets the service class for the voice bundle.¹

Step 11

ip precedence number

Selects an IP precedence level specific to the voice bundle that you created.

Step 12

pvc-bundle name vpi/vci

Creates a PVC for the data bundle.

Step 13

ubr pcr

Sets the service class for the data² bundle.

Step 14

precedence other

Sets the IP precedence level other to the data bundle that you created.

Step 15

exit

Exits configuration mode for the ATM interface.

¹For voice, the service class must be vbr-rt or vbr-nrt.

²For data, the service class must be vbr-nrt or ubr.

Specifying IP Precedence and the Service Class for the Voice Network

To configure real-time voice traffic precedence over other IP network traffic, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

dial-peer voice number voip

Enters the dial peer configuration mode to configure a VoIP dial peer.

Step 2

destination-pattern number

Sets a destination pattern.

Step 3

session target {ipv4:destination-address}

Specifies a destination IP address for the dial peer.

Step 4

precedence number

Selects a precedence level for the voice traffic associated with that dial peer.

Note In IP precedence, the numbers 1 through 5 identify classes for IP flows; the numbers 6 through 7 are used for network and backbone routing and updates. It is recommended that IP precedence of 5 be used for voice packets.

Configuration Example

The following configuration shows both voice and data on the same subnet with virtual circuit bundling. IP precedence is set to 5 for the voice packets, but not for the data packets, so that the two types of traffic can be separated onto two different ATM PVCs.
!
interface atm0
ip address 20.0.0.1 255.0.0.0
bundle test
	encapsulation aal5snap
	protocol ip 20.0.0.2 broadcast
!
pvc-bundle voice 1/100 
vbr-rt 424 424 5
precedence 5
!
pvc-bundle data 1/101
precedence other
!
dial-peer voice 100 voip
destination-pattern 26..
session target ipv4:20.0.0.8
ip precedence 5
!
Configuring Multilink PPP Fragmentation and Interleaving

You should configure multilink PPP fragmentation if you have point-to-point connection using PPP encapsulation or links slower than 2 Mbps in your network.

PPP support for interleaving can be configured on dialer or PRI interfaces.

To configure multilink PPP and interleaving on a dialer interface, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

interface dialer

Enters configuration mode for the dialer interface.

Step 2

ppp multilink

Enables multilink PPP for the dialer interface.

Step 3

bandwidth n

Specifies the bandwidth number associated with the PVC that is using the dialer interface, where n is the value of the sustained cell rate (SCR) parameter of the PVC using that dialer interface. This is important because otherwise the dialer interface will assume a value of 100 kbps if a specific class of service is configured.

Step 4

ppp multilink interleave

Enables interleaving for RTP packets among the fragments of larger packets on a multilink PPP bundle.

Step 5

ppp multilink fragment-delay milliseconds

Configures a maximum fragment delay of 20 ms. This command is optional.

Step 6

ip rtp reserve lowest-UDP-port range-of-ports [maximum-bandwidth]

Reserves a special queue for real-time packet flows to specified destination UDP ports, allowing real-time traffic to have higher priority than other flows. This only applies if you have not configured RSVP.

Step 7

exit

Exits configuration mode for the dialer interface.

Note You can use the ip rtp reserve command instead of configuring RSVP. If you configure RSVP, this command is not required.

For complete information on the PPP fragmentation and interleaving commands, see the Dial Solutions Configuration Guide for Cisco IOS Release 12.2. For more general information on PPP fragmentation and interleaving concepts, see "Concepts."

Configuration Example

The following configuration defines a dialer interface that enables multilink PPP with interleaving and a maximum real-time traffic delay of 20 ms. The encapsulation type is defined as aal5mux.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface dialer 1
ppp multilink
encapsulated ppp
ppp multilink interleave
bandwidth 640
ppp multilink fragment-delay 20
ip rtp reserve 16384 100 64
!
interface ATM0
	pvc 8/35
	encapsulation aal5mux ppp dialer
dialer pool-member 1
Verifying Your Configuration

To verify that you have properly configured PPP fragmentation and interleaving, enter the debug ppp multilink fragment command, and then send out one 1500-byte ping packet. The debug message will display information about the fragments being transmitted.

Configuring IP Precedence

IP Precedence gives voice packets a higher priority than other IP data traffic. The ip precedence command should also be used if RSVP is not enabled and you would like to give voice packets a priority over other IP data traffic. IP Precedence scales better than RSVP, but it provides no admission control.

To configure real-time voice traffic precedence over other IP network traffic, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

configure terminal

Enters configuration mode.

Step 2

dial-peer voice number voip

Enters the dial peer configuration mode to configure a VoIP dial peer.

Step 3

destination-pattern number

Sets a destination pattern.

Step 4

ip precedence number

Selects a precedence level for the voice traffic associated with that dial peer.

Note In IP Precedence, the numbers 1 through 5 identify classes for IP flows; the numbers 6 through 7 are used for network and backbone routing and updates.

For complete information on the IP Precedence commands, see the Cisco IOS Release 12.2 documentation set. For more general information on IP Precedence, see "Concepts."

Configuration Example

This configuration example shows a voice configuration with IP precedence set. The IP destination target is set to 8 dialing digits, which automatically sets the IP precedence to 5 by the Cisco 827 routers. The dial peer session target is RAS, which is a protocol that runs between the H.323 voice protocol gateway and gatekeeper.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
access-list 101 permit
route-map data permit 10
set ip precedence routing
!
Configuring RSVP

To minimally configure RSVP for voice traffic, you must enable RSVP on each interface where priority needs to be set. The RSVP feature applies to a single-PVC network only.

By default, RSVP is disabled so that it is backwards compatible with systems that do not implement RSVP. To enable RSVP for IP on an interface, use the following interface configuration command:
Router(config-if)# ip rsvp bandwidth [interface-kbps] [single-flow-kbps]
This command starts RSVP and sets the bandwidth and single-flow limits. The default maximum bandwidth is up to 75 percent of the bandwidth available on the interface. By default, a flow can reserve up to the entire reservable bandwidth.

On subinterfaces, RSVP applies to the more restrictive of the available bandwidths of the physical interface and the subinterface.

After enabling RSVP, you must also use the req-qos dial-peer configuration command to request an RSVP session on each VoIP dial peer. Otherwise, no bandwidth is reserved for voice traffic.

To request an RSVP session on each VoIP dial peer, use the following table, beginning in global configuration mode:

Command

Purpose

Step 1

configure dial-peer

Enters configuration mode for the dial peer.

Step 2

dial-peer voice number voip

Assigns the dial peer voice number to configure a VoIP dial peer.

Step 3

req-qos controlled load

Requests an RSVP session for each dial peer.

For more information about configuring RSVP, see the "Configuring RSVP" chapter of the Network Protocols Configuration Guide, Part 1, for Cisco IOS Release 12.2. For more general information on RSVP commands, see "Concepts."

Configuration Example

This configuration shows two voice dial peers (number 211 and 212) being configured for RSVP.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
dial-peer voice 211 voip
req-qos controlled-load
!
dial-peer voice 212 voip
		req-qos controlled-load
!
Configuring Dial Backup

You must decide whether to activate the backup interface when the primary line goes down, when the traffic load on the primary line exceeds the defined threshold, or when either occurs. The tasks you perform depend on your decision. Perform the tasks in the following sections to configure dial backup:

•Specifying the Backup Interface (mandatory)

•Defining Backup Line Delays (optional)

•Defining Traffic Load Threshold (optional)

Then configure the backup interface for DDR, so that calls are placed as needed.

Specifying the Backup Interface

To specify a backup interface for a primary WAN interface or subinterface, enter the backup interface type number command to select a backup interface.

Note When you use a BRI for a dial backup, neither of the B channels can be used while the interface is in standby mode. In addition, when a BRI is used as a backup interface and the BRI is configured for legacy DDR, only one B channel is usable. Once the backup is initiated over one B channel, the second B channel is unavailable. When the backup interface is configured for dialer profiles, both B channels can be used.

For more information regarding the available dial backup mechanisms in Cisco IOS, please go to the following URL:

http://www.cisco.com/en/US/tech/tk801/tk133/technologies_tech_note09186a008009457d.shtml

Defining Backup Line Delays

You can configure a value that defines how much time should elapse before a secondary line status changes after a primary line status has changed. You can define two delays:

•A delay that applies after the primary line goes down but before the secondary line is activated

•A delay that applies after the primary line comes up but before the secondary line is deactivated

To define these delays, use the following syntax:

Router (config-if) # backup delay {enable-delay | never} {disable-delay | never}

Defining Traffic Load Threshold

You can configure dial backup to activate the secondary line, based on the traffic load on the primary line. The software monitors the traffic load and computes a 5-minute moving average. If this average exceeds the value you set for the line, the secondary line is activated and, depending on how the line is configured, some or all of the traffic will flow onto the secondary dialup line.

You can configure a load level for traffic at which additional connections will be added to the primary WAN interface. The load level values range from 1 (unloaded) to 255 (fully loaded).

Use the following syntax to define a WAN line threshold:

Router (config-if) # dialer load-threshold 8 outbound {enable-threshold | never}
{disable-threshold | never}

Dial Backup Using the Console Port

The following example shows dial backup using a console port configured for DDR:
interface atm 0
ip address 172.30.3.4 255.255.255.0
backup interface async1
backup delay 10 10 
!
interface async 1
ip address 172.30.3.5 255.255.255.0
dialer in-band
dialer string 5551212
dialer-group 1
async dynamic routing
dialer list 1 protocol ip permit
chat-script sillyman """atdt 5551212" TIMEOUT 60 "CONNECT"
line aux 0
modem chat-script sillyman
modem inout
speed 9600
Configuration Example

The following example shows configuration of dial backup and remote router management on the Cisco 831 and Cisco 837 routers using the console port and dialer watch.
!
username Router password!PASSWORD
!
modemcap entry MY_USR_MODEM:MSC=&F1S0=1
!
chat-script Dialout ABORT ERROR ABORT BUSY "" "AT" OK "ATDT 5555102\T" TIMEOUT 60 CONNECT 
\c
!
interface Async1
 no ip address
 encapsulation ppp
 dialer in-band
 dialer pool-member 3
 autodetect encapsulation ppp
 async default routing
 async dynamic routing
 async mode dedicated
 pap authentication pap callin
!
! Dialer3 is for dial backup and remote router management
!
interface Dialer3
 ip address negotiated
 encapsulation ppp
 no ip route-cache
 no ip mroute-cache
 dialer pool 3
 dialer remote-name !REMOTE-NAME
 dialer idle-timeout 300
 dialer string 5555102 modem-script Dialout
 dialer watch-group 1
 dialer-group 1
 autodetect encapsulation ppp
 peer default ip address 192.168.2.2
 no cdp enable
 ppp pap sent-username ! USER SPECIFIC password ! USER SPECIFIC
 ppp ipcp dns request
 ppp ipcp wins request
 ppp ipcp mask request
!
! IP NAT over Dialer interface using route-map
ip nat inside source route-map main interface Dialer1 overload
ip nat inside source route-map secondary interface Dialer3 overload
ip classless
ip route 0.0.0.0 0.0.0.0 !(dial backup peer address @ISP)
ip route 0.0.0.0 0.0.0.0 Dialer1 150
!
no ip http server
ip pim bidir-enable
!
!
access-list 101 permit ip 192.168.0.0 0.0.255.255 any
dialer watch-list 1 ip !(ATM peer address @ISP) 255.255.255.255
dialer-list 1 protocol ip permit
!
! To direct traffic to an interface only if the Dialer gets assigned with an ip address
route-map main permit 10
match ip address 101
match interface Dialer1
!
route-map secondary permit 10
match ip address 101
match interface Dialer3
!
line con 0
 exec-timeout 0 0
 modem enable
 stopbits 1
line aux 0
 exec-timeout 0 0
 script dialer Dialout
 modem InOut
 modem autoconfigure type MY_USR_MODEM
 transport input all
 stopbits 1
 speed 38400
 flowcontrol hardware
line vty 0 4
 exec-timeout 0 0
 login local
!
The following example shows configuration of remote management using a console port for the Cisco SOHO 91 and Cisco SOHO 97 routers.
!
username Router password !PASSWORD
!
modemcap entry MY_USR_MODEM:MSC=&F1S0=1
!
interface Async1
no ip address
encapsulation ppp
dialer in-band
autodetect encapsulation ppp
async default routing
async dynamic routing
async mode dedicated
pap authentication pap callin
peer default ip address pool clientpool
!
! dialer 1 used for PPPoE or PPPoATM
! PPPoE or PPPoATM dialer1 configurations are not shown in this sample
!
ip route 0.0.0.0 0.0.0.0 dialer 1 150
!
dialer list 1 protocol ip permit
!
ip local pool clientpool 192.168.0.2 192.168.0.10
!
line con 0
exec-timeout 0 0
modem enable
stopbits 1
line aux 0
exec-timeout 0 0
modem Dialin
modem autoconfigure type MY_USER_MODEM
transport input all
stopbits 1
speed 38400
flowcontrol hardware
to align with line aux 0
exec-timeout 0 0
login local
!
Configuration Example

The following example shows dial backup and remote management configuration on the Cisco 836 router, using the ISDN S/T port and dialer watch.
Cisco836#
!
vpdn enable
!
vpdn-group 1
accept-dialin
protocol pppoe
!
!Specifies the ISDN switch type
isdn switch-type basic-net3
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
hold-queue 100 out
!
!ISDN interface to be used as a backup interface
interface BRI0
no ip address
encapsulation ppp
dialer pool-member 1
isdn switch-type basic-net3
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 1/40
encapsulation aal5snap
pppoe-client dial-pool-number 2
!
dsl operating-mode auto
!
! Dial backup interface, associated with physical BRI0 interface. Dialer pool 1 associates 
it with BRI0's dialer pool member 1. Note "dialer watch-group 1" associates a watch list 
with corresponding "dialer watch-list" command
interface Dialer0
ip address negotiated
encapsulation ppp
dialer pool 1
dialer idle-timeout 30
dialer string 384040
dialer watch-group 1
dialer-group 1
!
! Primary interface associated with physical ATM0 interface, dialer pool 2 associates it 
with ATM0's dial-pool-number2
interface Dialer2
ip address negotiated
ip mtu 1492
encapsulation ppp
dialer pool 2
dialer-group 2
no cdp enable
!
ip classless
!Primary and backup interface given route metric
ip route 0.0.0.0 0.0.0.0 22.0.0.2
ip route 0.0.0.0 0.0.0.0 192.168.2.2 80
ip http server
!
!Watch for interesting traffic
dialer watch-list 1 ip 22.0.0.2 255.255.255.255
!Specifies interesting traffic to trigger backup ISDN traffic
dialer-list 1 protocol ip permit
!
Configuring IGMP Proxy and Sparse Mode

The Internet Group Management Protocol (IGMP) proxy feature was added to the unidirectional link routing feature to permit hosts that are not directly connected to a downstream router to join a multicast group sourced from an upstream network.

Follow the steps below to configure IGMP proxy and sparse mode, starting in global configuration mode.

Command

Purpose

Step 1

ip multicast-routing

Enables IP multicast forwarding.

Step 2

ip pim rp-address address

Configures the Protocol Independent Multicast (PIM) Rendezvous Point (RP) address.

Step 3

interface ethernet 0

Enters Ethernet 0 interface configuration mode.

Step 4

ip address ip-address subnet-mask

Configures an IP address and subnet mask for the Ethernet 0 interface.

Step 5

ip pim { sparse |dense }-mode

Configures the Ethernet 0 interface for PIM sparse mode or PIM dense mode.

Step 6

interface Ethernet 1

Enters Ethernet 1 configuration mode.

Step 7

ip address {ip-address subnet-mask negotiated}

Specifies an IP address and subnet mask for the dialer interface, or indicates that the IP address is to be negotiated.

Step 8

ip pim {sparse | dense} -mode

Configures the dialer interface for PIM sparse mode or PIM dense mode.

Step 9

ip igmp mroute-proxy loopback 0

When used with the ip igmp proxy-service command, this command enables all forwarding entries in the multicast forward table of IGMP to report to a proxy service interface.

Step 10

end

Exits router configuration mode.

Step 11

interface loopback 0

Enters loopback interface configuration mode.

Step 12

ip address ip-address subnet-mask

Configures an IP address and subnet mask for the loopback 0 interface.

Step 13

ip pim sparse-mode

Configures the loopback interface for PIM sparse mode or PIM dense mode.

Step 14

ip igmp helper-address udl ethernet 0

Enters IGMP helper-address unidirectional link to Ethernet 0

Step 15

ip igmp proxy-service

Enables the multicast route proxy service. Based on the IGMP query interval, the router periodically checks the mroute table for forwarding entries that match interfaces configured with the ip igmp mroute-proxy command. Where there is a match, one IGMP report is created and received on this interface. This command is intended to be used with the ip igmp helper-address udl command, which forwards the IGMP report to an upstream router.

Configuration Example

The following example shows the relevant IGMP proxy and sparse mode commands. The Ethernet 0, Ethernet 1, and loopback 0 interfaces have been configured for PIM sparse mode; the PIM RP address has been defined as 10.5.1.1.
ip pim rp-address 10.5.1.1 5 
access-list 5 permit 239.0.0.0 255.255.255.255
!
interface loopback 0
ip address 10.7.1.1 255.255.255.0
ip pim sparse-mode
ip igmp helper-address udl ethernet 0
ip igmp proxy-service
!
interface ethernet 0
ip address 10.2.1.2 255.255.255.0
ip pim sparse-mode
ip igmp unidirectional link
!
interface ethernet 1
ip address 10.5.1.1 255.255.255.0
ip pim sparse-mode
ip igmp mroute-proxy loopback 0
!
Verifying Your Configuration

You can verify your configuration by using the show ip igmp interface ethernet 0 multicasting command. You should see a verification output similar to the following:
router#show ip igmp interface ethernet 0
Ethernet0 is up, line protocol is up
Internet address is 10.2.1.2 255.255.255.0
IGMP is enabled on interface
Current IGMP host version is 2
Current IGMP router version is 2
IGMP query interval is 60 seconds
IGMP querier timeout is 120 seconds
IGMP max query response time is 10 seconds
Last member query response interval is 1000 ms
Inbound IGMP access group is not set
IGMP activity: 1 joins, 0 leaves
Multicast routing is enabled on interface
Multicast designated router (DR) is 10.2.1.2 (this system)
IGMP querying router is 10.2.1.2 (this system)
Multicast groups joined (number of users):
224.0.1.40 (1)
Configuring IP Security and GRE Tunneling

IP Security (IPSec) provides secure tunnels between two peers, such as two routers. You can define which packets are to be considered sensitive and sent through these secure tunnels. You can also define the parameters which should be used to protect these sensitive packets, by specifying characteristics of these tunnels. When the IPSec peer sees a sensitive packet, it sets up the appropriate secure tunnel and sends the packet through the tunnel to the remote peer.

This section contains the following topics:

•Configuring Internet Protocol Parameters

•Configuring an Access List

•Configuring IPSec

•Configuring a GRE Tunnel Interface

•Configuring the Ethernet Interface

•Configuring Static Routes

•Configuring and Monitoring High-Speed Crypto

•Configuration Example

Configurations for both IPSec and Generic Routing Encapsulation (GRE) tunneling are presented in this section. Perform the following steps to configure IPSec using a GRE tunnel, beginning in global configuration mode.

Configuring Internet Protocol Parameters

Follow the steps below to configure IP parameters, starting in global configuration mode.

Command

Purpose

Step 1

ip subnet-zero

Configures the router to recognize the zero subnet range as the valid range of addresses.

Step 2

no ip finger

Blocks incoming IP finger packets.

Step 3

no ip domain-lookup

Disables the router from interpreting unfamiliar words (typographical errors) as host names entered during a console session.

Step 4

ip classless

Follows classless routing forwarding rules.

Configuring an Access List

Use the access-list command to create an access list that permits the GRE protocol and that specifies the starting and ending IP addresses of the GRE tunnel. Use the following syntax:

access-list 101 permit gre host ip-address host ip-address

In the preceding command line, the first host ip-address specifies the tunnel starting point, and the second host ip-address specifies the tunnel endpoint.

Configuring IPSec

Follow the steps below to configure IPSec, starting in global configuration mode.

Command

Purpose

Step 1

crypto isakmp policy 10

Defines an Internet Key Exchange (IKE) policy, and assigns the policy a priority. This command places the router in IKE policy configuration mode.

Step 2

hash md5

Specifies the MD5 hash algorithm for the policy.

Step 3

authentication pre-share

Specifies pre-share key as the authentication method.

Step 4

exit

Exits IKE policy configuration mode.

Step 5

crypto isakmp key name address ip-address

Configures a pre-shared key and static IP address for each VPN client.

Step 6

crypto ipsec transform-set name esp-des esp-md5-hmac

Defines a combination of security associations to occur during IPSec negotiations.

Step 7

crypto map name local-address ethernet 1

Creates a crypto map, and specifies and names an identifying interface to be used by the crypto map for IPSec traffic.

Step 8

crypto map name seq-num ipsec-isakmp

Enters crypto map configuration mode, and creates a crypto map entry in IPSec ISAKMP mode.

Step 9

set peer ip-address

Identifies the remote IPSec peer.

Step 10

set transform-set name

Specifies the transform set to be used.

Step 11

match address access-list-id

Specifies an extended access list for the crypto map entry.

Step 12

exit

Exits crypto map configuration mode.

Configuring a GRE Tunnel Interface

Follow the steps below to configure the generic routing encapsulation (GRE) tunnel interface, starting in global configuration mode.

Command

Purpose

Step 1

interface tunnel 0

Configures the tunnel 0 interface.

Step 2

ip address ip-address subnet-mask

Sets the IP address and subnet mask for the tunnel 0 interface.

Step 3

tunnel source ethernet 1

Specifies the Ethernet 1 interface as the tunnel source.

Step 4

tunnel destination default-gateway-ip-address

Specifies the default gateway as the tunnel destination.

Step 5

crypto map name

Associates a configured crypto map to the tunnel 0 interface.

Step 6

exit

Exits the tunnel 0 interface configuration.

Configuring the Ethernet Interfaces

Perform the following tasks to configure the Ethernet 0 and Ethernet 1 interfaces, starting in global configuration mode.

Command

Purpose

Step 1

interface ethernet 0

Configures the Ethernet 0 interface.

Step 2

ip address ip-address subnet-mask

Sets the IP address and subnet mask for the Ethernet 0 interface.

Step 3

exit

Exits the Ethernet 0 interface configuration.

Step 4

interface ethernet 1

Configures the Ethernet 1 interface.

Step 5

ip address ip-address subnet-mask

Sets the IP address and subnet mask for the Ethernet 1 interface.

Step 6

crypto map name

Associates a crypto map with the Ethernet 1 interface.

Step 7

end

Exits router configuration mode.

Configuring Static Routes

Follow the steps below to configure static routes, starting in global configuration mode.

Command

Purpose

Step 1

ip route default-gateway-ip-address mask ethernet 1

Creates a static route for the Ethernet 1 interface.

Step 2

ip route default-gateway-ip-address mask tunnel 0

Creates a static route for the tunnel 0 interface.

Step 3

ip route default-gateway-ip-address mask gateway-of-last-resort

Creates a static route to the gateway of last resort.

Step 4

end

Exits router configuration mode.

Configuring and Monitoring High-Speed Crypto

Use the following command to enable high-speed crypto, starting with global configuration mode.
crypto engine accelerator
To disable high-speed crypto, use the following command:
no crypto engine accelerator
To monitor high-speed crypto, use the following command:
show crypto engine accelerator statistic
For more information on configuring IPSec, see the Cisco IOS Security Configuration Guide.

Configuration Example

This configuration example for the Cisco 831 router shows IPSec being used over a GRE tunnel. The example also applies to a SOHO 91 router. You do not need to enter the commands marked "default." These commands appear automatically in the configuration file that is generated when you use the show running-config command.
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 831-uut1
!
memory-size iomem 10
!
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 1
encr 3des
authentication pre-share
crypto isakmp key grel address 100.1.1.1
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set strong esp-3des esp-sha-hmac
!
crypto map mymap local-address Ethernet1
crypto may mymap 1 ipsec-isakmp
set peer 100.1.1.1
set transform-set strong
match address 151
!
!
!
!
interface Tunnel0
ip address 1.1.1.1 255.255.255.0
tunnel source Ethernet1
tunnel destination 100.1.1.1
crypto map mymap
!
interface Ethernet0
ip address 202.2.2.2 255.255.255.0
hold-queue 100 out
!
interface Ethernet1
ip address 100.1.1.1 255.255.255.0
crypto map mymap
!
ip classless
ip route 200.1.1.0 255.255.255.0 Tunnel0
ip http server
!
!
access-list 151 permit gre host 100.1.1.2 host 100.1.1.1
! 
line con 0
no modem enable
stopbits 1
line aux 0
line vty 0 4
!
scheduler max-task-time 5000
The following example shows IPSec configuration on a Cisco 837 router.
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname 837-uutl
!
memory-size iomem 10
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
ip ssh time-out 120
ip ssh authentication-retries 3
!
crypto isakmp policy 1
encr 3des
authentication pre-share
crypto isakmp key grel address 100.1.1.1
!
crypto ipsec transform-set strong esp-3des esp-sha-hmac
!
crypto map mymap local-address ATM0
crypto map mymap 1 ipsec-isakmp
set peer 100.1.1.1
set transform-set strong
match address 151
!
interface Tunnel0
ip address 1.1.1.1 255.255.255.0
ip mtu 1440
tunnel source ATM0
tunnel destination 100.1.1.1
crypto map mymap
!
interface Ethernet0
ip address 202.2.2.2 255.255.255.0
hold-queue 100 out
!
interface ATM0
ip address 100.1.1.2 255.255.255.0
no atm ilmi-keepalive
pvc 1/40
protocol ip 100.1.1.1 broadcast
encapsulation aa15snap
!
dsl operating-mode auto
crypto map mymap
!
ip classless
ip route 200.1.1.0 255.255.255.0 Tunnel0
ip http server
ip pim bidir-enable
Configuring Multilink PPP Fragmentation and Interleaving

You should configure multilink PPP fragmentation if you have point-to-point connection using PPP encapsulation or if you have links slower than your network.

PPP support for interleaving can be configured on a dialer interface.

Follow the steps below to configure multilink PPP and interleaving on a dialer interface, beginning in global configuration mode.

Command

Purpose

Step 1

interface dialer

Enters configuration mode for the dialer interface.

Step 2

ppp multilink

Enables multilink PPP for the dialer interface.

Step 3

bandwidth n

Specifies the bandwidth number associated with the PVC that is using the dialer interface, where n is the value of the sustained cell rate (SCR) parameter of the PVC using that dialer interface. This is important because otherwise the dialer interface will assume a value of 100 kbps if a specific class of service is configured.

Step 4

ppp multilink interleave

Enables interleaving for RTP packets among the fragments of larger packets on a multilink PPP bundle.

Step 5

ppp multilink fragment-delay milliseconds

Configures a maximum fragment delay of 20 ms. This command is optional.

Step 6

ip rtp reserve lowest-UDP-port range-of-ports [maximum-bandwidth]

Reserves a special queue for real-time packet flows to specified destination UDP ports, allowing real-time traffic to have higher priority than other flows.

Step 7

exit

Exits configuration mode for the dialer interface.

For complete information on the PPP fragmentation and interleaving commands, see the Dial Solutions Configuration Guide for Cisco IOS Release 12.0T. For general information on PPP fragmentation and interleaving concepts, see "Concepts."

Configuration Example

The following configuration defines a dialer interface that enables multilink PPP with interleaving and a maximum real-time traffic delay of 20 ms. The encapsulation type is defined as aal5mux.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
interface dialer 1
ppp multilink
encapsulated ppp
ppp multilink interleave
bandwidth 640
ppp multilink fragment-delay 20
ip rtp reserve 16384 100 64
!
interface ATM0
	pvc 8/35
	encapsulation aal5mux ppp dialer
dialer pool-member 1
Verifying Your Configuration

To verify that you have properly configured PPP fragmentation and interleaving, enter the debug ppp multilink fragment command, and then send out one 1500-byte ping packet. The debug message will display information about the fragments being transmitted.

Configuring IP Precedence

IP Precedence gives voice packets higher priority than other IP data traffic. Complete the following steps to configure real-time voice traffic precedence over other IP network traffic, beginning in global configuration mode.

Command

Purpose

Step 1

configure terminal

Enters configuration mode.

Step 2

dial-peer voice number voip

Enters the dial peer configuration mode to configure a VoIP dial peer.

Step 3

destination-pattern number

Sets a destination pattern.

Step 4

ip precedence number

Selects a precedence level for the voice traffic associated with that dial peer.

Note In IP Precedence, the numbers 1 through 5 identify classes for IP flows; the numbers 6 through 7 are used for network and backbone routing and updates.

For complete information on the IP Precedence commands, see the Cisco IOS Release 12.2 documentation set. For general information on IP Precedence, see "Concepts."

Configuration Example

This configuration example shows a voice configuration with IP Precedence set. The IP destination target is set to 8 dialing digits, which automatically sets the IP precedence to 5 on the Cisco routers. The dial peer session target is RAS, which is a protocol that runs between the H.323 voice protocol gateway and gatekeeper.

You do not need to enter the commands marked "default." These commands appear automatically in the configuration file that is generated when you use the show running-config command.
!
access-list 101 permit
route-map data permit 10
set ip precedence routing
Configuring Voice

The Cisco 827 routers support voice using the H.323 signaling protocol.

•H.323

•SGCP

The default signaling protocol is H.323 signaling standard.

Prerequisite Tasks

Before you can configure your router to use voice, you need to perform the following tasks:

•Establish a working IP network.

•Complete your company dial plan.

•Establish a working telephony network based on your company dial plan.

•Integrate your dial plan and telephony network into your existing IP network topology.

Configuring Voice for H.323 Signaling

This section describes the tasks you need to perform to configure the router for H.323 signaling on the voice ports.

Configuring the POTS Dial Peers

To configure the POTS dial peers, use the following table, beginning in global configuration mode.

Command

Purpose

Step 1

dial-peer voice number POTS

Enters configuration mode for the dial peer.

Step 2

destination-pattern string

Defines the destination telephone number associated with the VoIP dial peer.

Step 3

port number

Specifies the port number.

Configuring Voice Dial Peers for H.323 Signaling

Follow the steps below to configure voice dial peers for H.323 signaling, beginning in global configuration mode.

Command

Purpose

Step 1

dial-peer voice number VoIP

Enters configuration mode for the dial peer.

Step 2

destination-pattern string

Defines the destination telephone number associated with each VoIP dial peer.

Step 3

codec string

Specifies a codec if you are not using the default codec of g.729.

Step 4

session target {ipv4:destination-address}

Specifies a destination IP address for each dial peer.

Configuring Voice Ports for H.323 Signaling

Voice port configuration should be automatic in the United States, however, if you are overseas, you may need to do the following voice port configuration, beginning in global configuration mode.

Command

Purpose

Step 1

configure dial-peer

Enters configuration mode for the dial peer.

Step 2

voice-port port

Identifies the voice port you want to configure and enters the voice port configuration mode.

Step 3

cptone country

Selects the appropriate voice call progress tone for this interface. The default country for this command is us.

Step 4

ring frequency (25 \ 50)

Selects the ring frequency (in Hz) specific to the equipment attached to this voice port and appropriate to the country you are in.

Step 5

description string

Attaches descriptive text about this voice port connection.

Step 6

comfort-noise

If voice activity detection (VAD) is activated, this command specifies that background noise is generated.

Step 7

impedance

Specifies impedance, which is related to the electrical characteristics of the device that is plugged into a POTS port. Impedance is measured in ohms.

For complete information on the dial peer commands, see the Cisco IOS Release 12.2 documentation set. For more general information on dial peer concepts, see "Concepts."

Configuring Number Expansion

This section describes how to expand an extension number into a particular destination pattern. Use the following global configuration command to expand the extension number:
Router(config)# num-exp extension-number extension-string
To verify that you have mapped the telephone numbers correctly, enter the show num-exp command.

After you have configured dial peers and assigned destination patterns to them, enter the show dialplan number command to see how a telephone number maps to a dial peer.

For complete information on the number expansion commands, see the Cisco IOS documentation set.

Configuration Example

This configuration shows voice traffic configured. You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!
class-map voice
match access-group 101
!
policy-map mypolicy
class voice
priority 128
class class-default
fair-queue 16
!
ip subnet-zero
!
gateway
!
interface Ethernet0
ip address 20.20.20.20 255.255.255.0
no ip directed-broadcast (default)
ip route-cache policy
ip policy route-map data
!
interface ATM0
ip address 10.10.10.20 255.255.255.0
no ip directed-broadcast (default)
no atm ilmi-keepalive (default)
pvc 1/40 
service-policy output mypolicy
protocol ip 10.10.10.36 broadcast
vbr-nrt 640 600 4
! 640 is the maximum upstream rate of ADSL
encapsulation aal5snap
!
bundle-enable
h323-gateway voip interface
h323-gateway voip id gk-twister ipaddr 172.17.1.1 1719
h323-gateway voip h323-id gw-820
h323-gateway voip tech-prefix 1#
!
router eigrp 100
network 10.0.0.0
network 20.0.0.0
!
ip classless (default)
no ip http server
!
access-list 101 permit ip any any precedence critical
route-map data permit 10
set ip precedence routine
!
!
line con 0
exec-timeout 0 0
transport input none
stopbits 1
line vty 0 4
login
!
!
voice-port 1
local-alerting
timeouts call-disconnect 0
!
voice-port 2
local-alerting
timeouts call-disconnect 0
!
voice-port 3
local-alerting
timeouts call-disconnect 0
!
voice-port 4
local-alerting
timeouts call-disconnect 0
!
dial-peer voice 10 voip
destination-pattern ........
ip precedence 5
session target ras
!
dial-peer voice 1 pots
destination-pattern 5258111
port 1
!
dial-peer voice 2 pots
destination-pattern 5258222
port 2
!
dial-peer voice 3 pots
destination-pattern 5258333
port 3
!
dial-peer voice 4 pots
destination-pattern 5258444
port 4
!
end
Cisco 827 Routers Configuration Examples

The following examples are for the following configurations:

•Cisco 827-4V Router Configuration

•Cisco 827 Router Configuration

•Corporate or Endpoint Router Configuration for Data Network

•Corporate or Endpoint Router Configuration for Data and Voice Network

These configurations are intended to be examples only. Your router configuration may look different depending on your network.

Cisco 827-4V Router Configuration

The following is a configuration for the Cisco 827-4V router configured for H.323 signaling voice traffic. These commands appear automatically in the configuration file generated when you use the show running-config command.
ip subnet-zero
!
bridge crb
!
interface Ethernet0
no ip address
no ip directed-broadcast
bridge-group 1
!
interface ATM0
no ip address
no ip directed-broadcast
no atm ilmi-keepalive
bundle-enable
!
interface ATM0.1 point-to-point
ip address 1.0.0.1 255.255.255.0
no ip directed-broadcast
pvc voice 1/40 
protocol ip 1.0.0.2 broadcast
encapsulation aal5snap
!
!
interface ATM0.2 point-to-point
no ip address
no ip directed-broadcast
pvc data 1/41 
encapsulation aal5snap
!
bridge-group 1
!
ip classless
!
bridge 1 protocol ieee
!
voice-port 1
local-alerting
timeouts call-disconnect 0
!
voice-port 2
local-alerting
timeouts call-disconnect 0
!
voice-port 3
local-alerting
timeouts call-disconnect 0
!
voice-port 4
local-alerting
timeouts call-disconnect 0
!
dial-peer voice 101 pots
destination-pattern 14085271111
port 1
!
dial-peer voice 1100 voip
destination-pattern 12123451111
codec g711ulaw
session target ipv4:1.0.0.2
!
dial-peer voice 102 pots
destination-pattern 14085272222
port 2
!
dial-peer voice 1200 voip
destination-pattern 12123452222
codec g711ulaw
session target ipv4:1.0.0.2
!
dial-peer voice 103 pots
destination-pattern 14085273333
port 3
!
dial-peer voice 1300 voip
destination-pattern 12123453333
codec g711ulaw
session target ipv4:1.0.0.2
!
dial-peer voice 104 pots
destination-pattern 14085274444
port 4
!
dial-peer voice 1400 voip
destination-pattern 12123454444
codec g711ulaw
session target ipv4:1.0.0.2
!
Cisco 827 Router Configuration

The following is a configuration for the Cisco 827 router. These commands appear automatically in the configuration file generated when you use the show running-config command.
Current configuration:
!
version 12.2
no service pad (default)
service timestamps debug uptime (default)
service timestamps log uptime (default)
no service password-encryption (default)
hostname Cisco827
enable secret 5 $1$RnI.$K4mh5q4MFetaqKzBbQ7gv0
ip subnet-zero
no ip domain-lookup
ip dhcp-server 20.1.1.2
ipx routing 0010.7b7e.5499
!In the preceding command, the router MAC address is automatically used !as the router IPX 
address.
!
interface Ethernet0
ip address 10.1.1.1 255.255.255.0
no ip directed-broadcast (default)
ipx network 100 novell-ether
!
interface ATM0
 ip address 14.0.0.17 255.0.0.0
 no ip directed-broadcast (default)
 no atm ilmi-keepalive (default)
pvc 8/35 
  protocol ip 14.0.0.1 no broadcast
  encapsulation aal5snap
!
router rip
version 2
network 10.0.0.0
network 30.0.0.0
no auto-summary
!
no ip http server (default)
ip classless (default)
!
line con 0
exec-timeout 10 0
password 4youreyesonly
login
transport input none (default)
stopbits 1 (default)
line vty 0 4
password secret
login
!
end
Corporate or Endpoint Router Configuration for Data Network

This section shows a configuration that you can use to configure a Cisco 3600 router as a corporate or endpoint router in your data network.You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
Current configuration:
!
version 12.2
no service pad (default)
service timestamps debug uptime (default)
service timestamps log uptime (default)
no service password-encryption (default)
!
hostname c3600
enable secret 5 $1$8TI8$WjLcYWgZ7EZhqH49Y2hJV!
ip subnet-zero
no domain-lookup
ipx routing 0010.7b7e.5498
!In the preceding command, the router MAC address is automatically used as the router IPX 
address.
!
interface Ethernet0
 ip address 20.0.0.1 255.0.0.0
 no ip directed-broadcast (default)
ipx network 200
!
router rip
version 2
network 20.0.0.0
network 30.0.0.0
no auto-summary
!
no ip http server (default)
ip classless (default)
!
protocol ip 2.0.0.1 broadcast
!
line con 0
 exec-timeout 0 0
 transport input none (default)
 stopbits 1 (default)
line vty 0 4
password secret
login
!
end
Corporate or Endpoint Router Configuration for Data and Voice Network

This section shows a configuration that you can use to configure a Cisco 3600 router as a corporate or endpoint router in your data and voice network.You do not need to enter the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
Current configuration:
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname c3640
!
ip subnet-zero
!
cns event-service server
!
!
!
voice-port 1/0/0
 no echo-cancel enable
!
voice-port 1/1/0
!
voice-port 1/1/1
!
dial-peer voice 101 pots
 destination-pattern 5552222
 port 1/0/0
!
dial-peer voice 102 pots
 destination-pattern 5554444
 port 1/0/1
!
dial-peer voice 103 pots
 destination-pattern 5556666
 port 1/1/0
!
dial-peer voice 104 pots
 destination-pattern 5558888
 port 1/1/1
dial-peer voice 1100 voip
 destination-pattern 5551111
 codec g711alaw
 ip precedence 5
 no vad
 session target ipv4:2.0.0.3
!
dial-peer voice 1101 voip
 destination-pattern 5553333
 codec g711alaw
 ip precedence 5
 no vad
 session target ipv4:2.0.0.3
!
dial-peer voice 1102 voip
 destination-pattern 5555555
 codec g711alaw
 ip precedence 5
 session target ipv4:2.0.0.3
!
dial-peer voice 1103 voip
 destination-pattern 5557777
 codec g711alaw
 ip precedence 5
 session target ipv4:2.0.0.3
!
process-max-time 200
!
interface Ethernet0/1
 no ip address
 no ip directed-broadcast (default)
shutdown
!
router rip
version 2
network 3.0.0.0
!
ip classless (default)
ip route 0.0.0.0 0.0.0.0 Ethernet 0/0
ip route 1.0.0.0 255.0.0.0 3.0.0.0
ip route 2.0.0.0 255.0.0.0 3.0.0.1
ip route 5.0.0.0 255.0.0.0 3.0.0.1
ip route 40.0.0.0 255.255.255.0 172.28.9.1
ip route 172.28.5.0 255.255.255.0 172.28.9.1
ip route 172.28.9.0 255.255.255.0 172.28.9.1
no http server
!
line con 0
transport input none (default)
line aux 0
line vty 0 4
login
!
end