Notes on various RFCs (re: Ch. 5)

VRRP

RFC 3768 - VRRP creates a virtual router, managed by an elected master router which forwards packets to ensure load balancing among gateways. The assigned multicast address is 224.0.0.18.
Cisco - VRRP priority values are 1-254, higher being preferred; preemption occurs by default. VRRP object tracking can be used to modify values dynamically. The default authentication for VRRP is plaintext; MD5 strings or key chains can also be used. Note: per Cisco MD5 key chains are supposed to be rotating; I can find no config commands to do this for VRRP though. The punks in programming need to get on the stick!


NTP (v3)

RFC 1305 - discusses truechimers and falsetickers, convergence functions to eliminate the effects of falsetickers. It specifies the following five modes-

• Symmetric Active: a host sends messages regardless of peer reachability or stratum (it will synch and be synched by the peer)
• Symmetric Passive: normally created by receipt of message from a symmetric active peer; only persists while peer is reachable and operating at a stratum <= that of the host receiving the message. This state always lasts at least until one reply is sent to the peer.
• Client: host sends periodic messages regardless of peer reachability or stratum. Think a LAN workstation.
• Server: normally created when receiving a client request message; exists only to reply to that message and the association is then dissolved. So the server will synchronize, but won't synch with, a client.
• Broadcast: a time server that will synch devices on a LAN but won't synchronize with them

NTP Configuration for Cisco Nexus
Cisco IOS 12.1 NTP Configuration Commands (side note: Nexus doesn't yet have NTP authentication commands)

Syslog

RFC 5424 - describes the standard format for syslog messages
PCAP- the Wireshark Book website has an example file available (syslog.pcap) for download
Cisco - All IOS syslogs have the following attributes: timestamp (optional), facility (where it came from), severity, message name, message text

SNMPv3 Beginner's reference

RFC 3410 - Describes the origin and evolution of SNMP. Leaving aside clients and management servers, SNMP is a framework consisting of a management protocol and the Management Information Base (MIB). By decoupling the protocol and the MIB, SNMP has been able to expand through several versions.SNMPv3 is based on RFCs 1902-1908 and adds security and administration capabilities.
RFC 3416 - this is the nitty gritty for network engineers: SNMP operations you will see (GETREQUEST, GETBULKREQUEST, etc). You want to know section 4 of the RFC pretty well.
RFC 3414 -  describes how that new authentication model (user-based security) works in SNMPv3
PCAP - don't rely on the Wireshark book downloads here! Their pcaps are only SNMP v1. Try PCAPR which has examples of all SNMP versions available.

This concludes today's blog, netizens. Move along, nothing to see here.