To get started download the QEMU image and throw it somewhere on your hard drive. I put mine in my Virtual Machines folder.

Next, install GNS3 if you haven’t already done so.

Now the fun part- get GNS3 to talk to QEMU. From my testing there seems to be an issue with this when running it on a Mac. When you define where the QEMU image is located and then test it fails unless it’s already running. So what I have done here is started the Qemuwrapper from the CLI. Then I go back and load it up in GNS3:

terminal$:
terminal$:/Applications/GNS3.app/Contents/Resources/qemuwrapper/qemuwrapper.py
Qemu Emulator Wrapper (version 0.3.2)
Copyright (c) 2007-2009 Thomas Pani & Jeremy Grossmann


Unpacking pemu binary.
Qemu TCP control server started (port 10525).

Here you can see I have now tested QEMU:

And you can also see the QEMU image that I have defined:

Our next step is to build the topology. Mine is simple, two QEMU hosts and 1 router.

Now we can configure the router for simple IPv6 Connectivity:

!
ipv6 unicast-routing
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 ipv6 address 2001:DB8:1::1/64
 ipv6 enable
 ipv6 nd prefix 2001:DB8:1::/64
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 ipv6 address 2001:DB8:2::1/64
 ipv6 enable
 ipv6 nd prefix 2001:DB8:2::/64
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!

Because we have configured the Neighbor Discovery Prefix the QEMU hosts should obtain an IPv6 address via Router Advertisements. On the QEMU host we did nothing and looking at the interface shows us that we have an IPv6 address with the same prefix:

The last 64-bits of the host address was configured using EUI-64 formatting. This, for the most part, takes the Mac address of the interface and inserts FFFE in the middle of it.

Now we should be able to ping the gateway:

So far so good! We should also be able to verify the second QEMU host has an IPv6 address:

Now for the real test. Let’s see if this router is going to route traffic as a default gateway for the two QEMU hosts. From QEMU Host 2 we ping QEMU host 1:

Conclusion

As you can tell configuring a simple IPv6 lab is not difficult to do. For further testing you could add a few routers and configure IPv6 Routing Protocols like OSPFv3 and EIGRP and the pass IPv6 traffic between the QEMU hosts. Alternatively you could configure an IPv4 backbone and use VTI interfaces to encrypt the IPv6 traffic over the IPv4 network. There is a ton that you can do, and it’s really not that difficult.

Related Posts:

• Configuring OSPFv3 for IPv6…Not a big leap.
• Configuring Site-to-Site IPsec for IPv6 using Static VTI
• A New Version of GNS3 has been released.
• Link Round-Up 09/24/2010
• IPv6- Is it more Secure than IPv4

However, for most of us, this is not feasible. Because of the use of RFC 1918 addresses we are required to use NAT or PAT when we make connections to the Internet. Still situations may arise where you have NAT configured but for some reason you need to bypass it. Here are a few examples of how to do this along with the terminology that these methods are referred to in ASA 8.2.

Identity NAT

When you use Identity NAT the connections can only be originated by the address that’s covered in the statement. Of course, return traffic will be allowed, but you can’t originate an outside connection into the address in the NAT statement.

Here is how you configure it:

ASA1(config)# nat (inside) 0 10.1.1.0 255.255.255.0

In this code example you can initiate an outbound connection from addresses on the 10.1.1.0/24 subnet and it will not translate the source.

Static Identity NAT

A Static Identity NAT Translation is always active. This means that a connection can be initiated into this address, provided there is an ACL inbound on the lower security-level interface that permits the connection. You can also originate connections from the address defined in the statement for outbound connections and the ASA will not Translate the source.

Related Posts:

• Last Day to Enroll in 6-Week CCIE Security Evening Class.
• CCIE Security Bootcamp Topology
• IKEv1 Aggressive Mode vs. IKEv1 Main Mode
• New Video: Comparing Crypto Maps and VTI’s Part 1
• Configuring Etherchannel on Cisco ASA 8.4

warning: you may also learn something from what ASDM configures on the CLI.

Step 1

In The Tools Menu of ASDM Select Preferences :

Step 2

Next Select the Check Box “Preview commands before sending to the CLI” and then click “OK”.

Step 3

Make a few changes to the configuration and apply them. At this point you should see the changes that you have made via the GUI in CLI format.

Wrap-up

While the GUI can certainly be annoying at times there are hidden gems in it that can be beneficial at times.

Related Posts:

• IKEv1 Aggressive Mode vs. IKEv1 Main Mode
• Configuring Etherchannel on Cisco ASA 8.4
• Bypassing NAT on Cisco ASA 8.2
• Configuring Site-to-Site IPsec for IPv6 using Static VTI
• Dealing With Security Policies

First of all you need to install GNS3, which in turn takes the necessary steps to install the underlying dynamips. Special thanks for this excellent work goes to the folks around the dynamips and GNS3 team. Have a look at the GNS3 site ( www.gns3.net ) and download the “all-in-1″ package. For the installation and initial etup, there is an excellent tutorial here:   http://sourceforge.net/projects/gns-3/files/GNS3/0.5/GNS3-0.5-tutorial.pdf/download

I am running GNS3 in an XP64 environment on an AM2 platform with 8GB ram. I tried a few different router models and for my part the 2691 router runs rock solid. The 2621XM had its odds and crashed every now and then, but I cannot say what caused this. The downside of the 26xx series is the limited availability of up to date IOS if you want to test new features. Currently 12.4-15(T10) is the newest IOS which does not include some new SIP-related features. For testing and practicing standard VoIP features this will do the job in any case. I’m using an “Advanced IP-services” feature set. If you need to use the newest IOS-T-Versions, you need to simulate a 7200 series router for whichyou can download a 12.4-24(T1) version.

After the installation and initial setup, I just built a simple network with 2 routers (1 virtual and 1 physical) connected to each other via the PC’s ethernet interface. After starting GNS3, placing a 2691 router and a “cloud” symbol on the workspace, my simple network looks like this:

I switched on the display for the interface names. This is why you see the “nio_gen_eth:.…” entry unter the cloud. This is the physical PC interface. Regardless what IP-address the PC-interface has, the router address is independent (f0/0). If the router address is in the same subnet as your PC, you will be able to access the router from your PC.  Lets assume a physical router with its f0/0 interface is reachable from the PC as well and has a FXS-VIC interface 0/1/0. The configuration of R0 (virtual router) and R1 (physical router) could look like this (assuming a very basic H323 connection to make the FXS interface reachable from CME):

R0: interface FastEthernet0/0  ip address 192.168.16.3 255.255.255.0  speed 100  half-duplex                         <– we are sharing the PC-port like a HUB ! dial-peer voice 100 voip  destination-pattern 1…                           <– H323 connection to the physical router  session target ipv4:192.168.16.100  <– IP-address of the physical router ! telephony-service           <– Switch on CME  max-ephones 2  max-dn 5  ip source-address 192.168.16.3  <- accept registration from IP-Phones at this address ! ! ephone-dn  1   <– the DN for the CIPC or 79xx phone  number 2000 ! ephone  1  description CME-Phone-1  mac-address 0000.0000.0001  <– put the real mac-addres of the phone here  type CIPC          <– phone type CIPC, 7940, 7960 etc.  button  1:1        <– first line gets DN #1 (2000) !

If you use a 79xx phone you will also need to get the tftp server address (option 150)handed out to the phone via DHCP. A sample configuration would look like this:

ip dhcp excluded-address 192.168.16.1 192.168.16.150 ! ip dhcp pool IP-Phones    network 192.168.16.0 255.255.255.0    default-router 192.168.16.3    option 150 ip 192.168.16.3

This should let the IP-phone register with the CME. The dial-peer with the destination pattern 1… will send all dialed numbers with 4 digits starting with 1 to the .100 IP-address. The configuration of R1 with the FXS-port in 0/1/0 will look like this:

R1:

interface FastEthernet0/0  ip address 192.168.16.100 255.255.255.0  speed 100  half-duplex       <– we are sharing the PC-port like a HUB ! dial-peer voice 200 voip  destination-pattern 2…                     <– H323 connection to the virtual router  session target ipv4:192.168.16.3  <– IP-address of the virtual router ! dial-peer voice 100 pots  destination-pattern 1000                <– DN of the analog phone  port 0/1/0                                              <– physical FXS-port

 The destination-pattern 1000 assigns DN 1000 to the analog port and is used as CLID on outgoing calls.

This should serve just as a starter configuration. Dive into the VoIP configurations and test any szenario with multiple routers – the sky is the limit. For demo purposes I connected the physical router with a FXO-port to my landline and so I got a PSTN integration. Further possibilities could be setting up a VPN to one of your routers and register the CIPC on your Laptop via the VPN at the CME….. 

An integration with UCM will be possible in a similar way. The router needs a Dial-peer pointing to the Callmanager and in turn the Callmanager needs to know a gateway entry with the routers IP-address…..

by Patrick Geschwindner, Ascolta

Related Posts:

• No Related Posts

It is correct that GNS3 cannot substitute Multiservice routers like 28xx etc because the DSP resources cannot be emulated. For using T1/E1 or FXS/FXO connections you need the real hardware interfaces and of course another PBX/router interface to connect your T1 to. If you have a double T1 you could use a T1 x-over to let the router do both ends.

For all other configurations like Dial-peers, translation patterns, SIP-UA configurations, CME, ephone registrations, CUBE etc, GNS3 can do the job. Just an example from my own lab: I have several accounts at SIP-Providers in US and Europe to use with a standard sip-phone like X-Lite. The router can log in this SIP-account and let CME or UCM handle the call. Via this way I provide a local german PSTN-number for my german friends which makes my phones in Minnesota ring. The thing has of course a downside… they keep forgetting that I am 7h behind, but for this purpose Unity will take the call. 

Where is GNS3 now coming into the ballpark? For each router you can specify only one SIP-registrar server, but I like to have all my SIP-accounts registered at the same time to route calls between them. GNS3 can now run the virtual routers, one for each SIP-provider, register your PSTN-numbers and UCM/CME can do the call handling.

by Patrick Geschwindner, Ascolta

Related Posts:

• No Related Posts

1. The Campaign will only run until may 15th.
2. After May 15th the eNewsletter popup will no longer appear.
3. Those that sign up for the eNewsletter will be enrolled in a drawing for a free signed copy of my Cisco Press book, CCNA Wireless Official Exam Certification Guide. (Drawing on June 1st)
4. You will receive a monthly newsletter filled with tips and tricks to help in your certification program.
5. You will get a special, “sneak peek,” of an upcoming publication soon to be released.

The Newsletter will cover tips for CCNA to CCIE level topics and will be sent once a month.  The content in the newsletter will not be the same content you find here on the blog.

Well thats about it.  If you missed the popup and wish to subscribe you can use the form on this page.

Related Posts:

• Heading for the Hills
• Introducing the Podcast
• HP Introduces the HP ExpertONE Certification Program
• Bad Blogger!
• Change in Venue