10.04 IP Traffic Export (RITE)

Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4
User Security Configuration

- The MAC of the device receiving the exported traffic must be on the same LAN.
- The outgoing interface must be 10/100/1000 Ethernet only.
- can fileted copied packets with ACL to export
- default- incoming only. can configure bidirectional
- Packet exporting is performed before packet switching or filtering

Configuration
Router> enable
Router# configure terminal
Router(config)# ip traffic-export profile profile-name
Router(config-rite)# interface FastEthernet 0/1 //to IDS
Router(config-rite)#bidirectional
mac-address 00a.8aab.90a0
incoming {access-list {standard extended named} sample one-in-every packet-number} outgoing {access-list {standard extended named} sample one-in-every packet-number} exit

Router(config)# interface FastEthernet0/0 //monitor traffic
Router(config-if)#ip traffic-export apply profile-name

http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_ip_traff_export_ps6350_TSD_Products_Configuration_Guide_Chapter.html

7.60 WCCP

Cisco IOS IP Application Services http://www.cisco.com/en/US/docs/ios/ipapp/configuration/guide/ipapp_wccp_ps6350_TSD_Products_Configuration_Guide_Chapter.html

- WCCP works only with IPv4 Networks.
- Can cluster up to 32 content engines
- WCCP1 only support http
- WCCP1, Router to content engine communicate via Control channel, port UDP 2048
- WCCP2, Unicast Ip or Multicast to communicate between all routers in the service group and content engines. 224.0.0.100
- WCCP2 support up to 32 routers per service group. Max service group - 256
- WCCP2 load Dsitribution,
hot spot handling
Load balacing
Load Shedding

Configuring a General WCCPv2 Session: Example
configure terminal
ip wccp web-cache group-address 224.1.1.100 password password1
interface ethernet0 ip wccp web-cache redirect out
exit
ip wccp check services all ! Configures a check of all WCCP services.

ip wccp
To enable support of the specified Web Cache Communication Protocol (WCCP) service for participation in a service group, use the ip wccp command in global configuration mode.

ip wccp check acl outbound
To check the outbound access control list (ACL) for Web Cache Communication Protocol (WCCP), use the ip wccp check acl outbound command in global configuration mode.

ip wccp check services all
To enable all Web Cache Communication Protocol (WCCP) services, use the ip wccp check services all command in global configuration mode.

ip wccp group-listen
To configure an interface on a router to enable or disable the reception of IP multicast packets for Web Cache Communication Protocol (WCCP), use the ip wccp group-listen command in interface configuration mode.

Router# configure terminal
Router(config)# ip multicast-routing
Router(config)# ip wccp web-cache group-address 224.1.1.100
Router(config)# interface ethernet 0
Router(config-if)# ip wccp web-cache group-listen

ip wccp redirect
To enable packet redirection on an outbound or inbound interface using Web Cache Communication Protocol (WCCP), use the ip wccp redirect command in interface configuration mode.

The following example shows how to configure a session in which HTTP traffic arriving on Ethernet interface 0/1 is redirected to a Cisco Cache Engine:
Router(config)# ip wccp web-cache
Router(config)# interface ethernet 0/1
Router(config-if)# ip wccp web-cache redirect in

ip wccp redirect exclude in
To configure an interface to exclude packets received on an interface from being checked for redirection, use the ip wccp redirect exclude in command in interface configuration mode.

ip wccp version
To specify the version of Web Cache Communication Protocol (WCCP), use the ip wccp version command in global configuration mode.
ip wccp version {1 2}

ip wccp web-cache accelerated
To enable the hardware acceleration for WCCP version 1, use the ip wccp web-cache accelerated command in global configuration mode.

7.40 Implement Network Time Protocol

While reading about NTP for exam preparation, I got an idea to put short notes from Cisco Doc CD.
Doc CD path : Cisco IOS Network Management Configuration Guide, Release 12.4
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_basic_sys_manage_ps6350_TSD_Products_Configuration_Guide_Chapter.html
http://www.cisco.com/en/US/docs/ios/netmgmt/command/reference/nm_10.html

ntp access-group
To control access to the Network Time Protocol (NTP) services on the system
Router(config)# ntp access-group peer 99
Router(config)# ntp access-group serve-only 42

ntp authenticate
To enable Network Time Protocol (NTP) authentication, use the ntp authenticate command in global configuration mode.
Router(config)# ntp authenticate Router(config)# ntp authentication-key 42 md5 aNiceKey Router(config)# ntp trusted-key 42

ntp authentication-key
To define an authentication key for Network Time Protocol (NTP), use the ntp authentication-key command in global configuration mode. Only MD5 is supported

ntp broadcast
To configure the options for broadcasting Network Time Protocol (NTP) traffic, use the ntp broadcast command in interface configuration mode.
Router(config)# interface ethernet 0
Router(config-if)# ntp broadcast version 2

ntp broadcast client
To configure a device to receive Network Time Protocol (NTP) broadcast messages on a specified interface, use the ntp broadcast client command in interface configuration mode. Router(config)# interface ethernet 1
Router(config-if)# ntp broadcast client

ntp broadcastdelay
To set the estimated round-trip delay between the Cisco IOS software and a Network Time Protocol (NTP) broadcast server, use the ntp broadcastdelay command in global configuration mode.
Command Default - 3000 microseconds Use when the router is configured as a broadcast client and the round-trip delay on the network is other than 3000 microseconds

ntp clock-period
Information Only. Do not manually set a value for the NTP clock-period. The system automatically generates this command as Network Time Protocol (NTP) determines the clock error and compensates.

ntp disable
To prevent an interface from receiving Network Time Protocol (NTP) packets, use the ntp disable command in interface configuration mode.
Router(config)# interface ethernet 0
Router(config-if)# ntp disable

ntp logging
To enable Network Time Protocol (NTP) message logging, use the ntp logging command in global configuration mode.
Router(config)# ntp logging

ntp master
To configure the Cisco IOS software as a Network Time Protocol (NTP) master clock to which peers synchronize themselves when an external NTP source is not available, use the ntp master command in global configuration mode.
Router(config)# ntp master 10

ntp max-associations
To configure the maximum number of Network Time Protocol (NTP) peers and clients for a routing device, use the ntp max-associations command in global configuration mode. Specifies the number of NTP associations. The range is 0 to 4294967295. The default is 100.
Router(config)# ntp max-associations 200

ntp multicast
To configure a system to send Network Time Protocol (NTP) multicast packets on a specified interface, use the ntp multicast interface configuration command. Default - IPV4 - 224.0.1.1, IPV6- FF02:1 Default - ttl - 16, range 1-255 (limit the scope of an audience for multicast routing)
Router(config)# interface ethernet 0
Router(config-if)# ntp multicast version 2

ntp multicast client
To configure the system to receive Network Time Protocol (NTP) multicast packets on a specified interface, use the ntp multicast client interface configuration command.
Router(config)# interface ethernet 1
Router(config-if)# ntp multicast client
Default - 224.0.1.1

ntp peer
To configure the software clock to synchronize a peer or to be synchronized by a peer, use the ntp peer command in global configuration mode. The default maxpoll number is 10 seconds. The default minpoll number is 6 seconds.
When a peer is configured, the default NTP version number is 3, no authentication key is used, and the source IPv4 or IPv6 address is taken from the outgoing interface.
To achieve faster NTP synchronization, enable the burst or iburst modes by using the burst or iburst keywords.
Router(config)# ntp peer 192.168.22.33 version 2 source ethernet 0
Router(config)# ntp peer 2001:0DB8:0:0:8:800:200C:417A version 4

ntp refclock
To configure an external clock source for use with Network Time Protocol (NTP) services, use the ntp refclock command in line configuration mode. Line configuration (for auxilary 0 only) Router(config)# ntp master
Router(config)# ntp update-calendar
Router(config)# line aux 0
Router(config-line)# ntp refclock trimble pps none

ntp server
To allow the software clock to be synchronized by a Network Time Protocol (NTP) time server, use the ntp server command in global configuration mode. Use this command if you want to allow the system to synchronize with the specified server. The server will not synchronize to this machine.
Router(config)# ntp server 172.16.22.44
Router(config)# ntp server 2001:0DB8:0:0:8:800:200C:417A version 4

ntp source
To use a particular source address in Network Time Protocol (NTP) packets, use the ntp source command in global configuration mode. Source address is determined by the outgoing interface.
This command is useful if the address on an interface cannot be used as the destination for reply packets.
Router(config)# ntp source ethernet 0
ntp trusted-key To authenticate the identity of a system to which Network Time Protocol (NTP) will synchronize, use the ntp trusted-key command in global configuration mode.
Router(config)# ntp authenticate
Router(config)# ntp authentication-key 42 md5 aNiceKey
Router(config)# ntp trusted-key 42

ntp update-calendar
To periodically update the hardware clock (calendar) from a Network Time Protocol (NTP) time source, use the ntp update-calendar command in global configuration mode.
Router(config)# ntp update-calendar

Other time setting command ref;
Manually Setting the Software Clock
Router# clock set hh:mm:ss date month year

Setting the Hardware Clock
Router> calendar set hh:mm:ss day month year

Setting the Software Clock from the Hardware Clock
Router# clock read-calendar

Setting the Hardware Clock from the Software Clock
Router# clock update-calendar

Monitoring Time and Calendar Services
Router# show calendar

Displays the current hardware clock time.
Router# show clock [detail]

Displays the current software clock time.
Router# show ntp associations [detail]

Displays the status of NTP associations.
Router# show ntp status

Displays the status of NTP.
Router# show sntp Displays information about SNTP (Cisco 1003, Cisco 1004, Cisco 1005, Cisco 1600, Cisco 1720, or Cisco 1750 routers only).

NAT Extendable Notes

"Extendable" static translations:

The extendable keyword allows the user to configure several ambiguous static translations, where an ambiguous translations are translations with the same local or global address.Some customers want to use more than one service provider and translate into each provider's address space2 upstream service provider with 2 public IP address but same local IP

Cisco notes.

The software does not allow two static translations with the same local address, though, because it is ambiguous from the inside. The router will accept these static translations and resolve the ambiguity by creating full translations (all addresses and ports) if the static translations are marked as "extendable". For a new outside-to-inside flow, the appropriate static entry will act as a template for a full translation.

Sample config

ip nat inside source static 192.168.1.1 100.100.100.1 extendable

ip nat inside source static 192.168.1.1 200.200.200.1 extendable

Why you should hire a CCIE

• Maintenance of your network is fundamental to protect assets and to ensure seamless operations. The environment is growing more complex with operations conducted over VPNs, wireless, remote access and the Internet. You need proven experts to choose, implement and maintain the solutions required.


• Having certified staff can increase the confidence of your customers, investors and business partners, and thereby boost your organization’s credibility, reputation and value.


• Certified CCIEs are a highly-select group. Less than 3% of all Cisco certified individuals make it to the CCIE level, a tiny fraction of IT professionals worldwide.


• Passing the exams is not easy. Earning your CCIE requires passing a lab exam in a time pressured environment. Hands-on experience is the only way to prepare for the lab.


• CCIEs have invested a lot to expand their knowledge and further their careers. The average candidate spends thousands of their own dollars and at least 18 months pursuing certification. He or she will attempt the lab exam more than once before passing.


• CCIEs are committed to maintaining their expert skills. Keeping their status active requires passing a recertification exam every two years.

http://www.cisco.com/web/learning/le3/ccie/employers/index.html

CCIE labs changing from UniversCD to Cisco Documentation

On Sept 24 2008 CCIE labs will no longer support using the UniversCD documentation for the lab exam.

All labs are migrating to Cisco Documentation only. For those scheduled to take the CCIE lab prior to Sept 24 access will still be available for UniversCD.

The Cisco Documentation pages have the same information that currently resides on UniversCD, please refer to the links on the CCIE web pages to view these pages and become familiar with the new format.

After Sept 24 2008 only the Cisco Documentation web pages will be available for CCIE labs.

http://cisco.com/web/psa/products/tsd_products_support_configure.html

Cacti, the complete traffic monitoring

I've been using it for almost 2 years and it's really great tools for traffic monitoring.
I installed on Fedoara core 6 and after installation, i dont need to touch any configuration.
Just using web administration and add/remove devices to monitor.
Comapre to MRTG, it has SQL database inside and can store history data and its good for reporting.
Because of php frontend, its slighter longer than to view simple html on MRTG.
Build in user management and authentication features, I can easily specify use level, graph levels and permission
which are not so easy to do with MRTG and Apache.
The graph trees also useful for collecting groups of interfaces/devices under the same link.

The plug-in architecture will complete you more with lots of features.
I found 1 post in forum and list all the plug-in
http://forums.cacti.net/post-72427.html

can downloads those inside this.
http://cactiusers.org/downloads/

If you dont want to read about intallation and just want to use cacti, CactiEz is the right thing.
It comes with OS and just install OS by bootable CD. Once complte, can start to use cacti.

more details
http://www.cacti.net/

Installation notes/ manual
http://www.cacti.net/documentation.php
http://docs.cacti.net/

Installation notes on Ubuntu
https://help.ubuntu.com/community/Cacti?action=show&redirect=CactiHowTo

CAR configuration example.

In/Out rate-limiting (limit 15MB out of 45MB)

interface Hssi0/0/0
description 45Mbps to R1
rate-limit input 15000000 2812500 2812500 conform-action transmit exceed-action drop
rate-limit output 15000000 2812500 2812500 conform-action transmit exceed-action drop

Ratelimit by access list

access-list 101 permit tcp any any eq www
access-list 102 permit tcp any any eq ftp

interface Hssi0/0/0
description 45Mbps to R2
rate-limit output access-group 101 20000000 3750000 7500000 conform-action set-prec-
transmit 5 exceed-action set-prec-transmit 0
rate-limit output access-group 102 10000000 1875000 3750000 conform-action
set-prec-transmit 5 exceed-action drop
rate-limit output 8000000 1500000 3000000 conform-action set-prec-transmit 5
exceed-action drop

NBAR using MQC (sample from cisco)

must enable cef
ip cef

define class
class-map

define policy
policy-map

Apply the service policy
service-policy

Router# configure terminal
Router(config)# class-map cmap1
Router(config-cmap)# match protocol citrix

Router# configure terminal
Router(config)# policy-map policy1
Router(config-pmap)# class class1
Router(config-pmap-c)# bandwidth percent 50

Router# configure terminal
Router(config)# interface ethernet 2/4
Router(config-if)# service-policy input policy1

Done featuers rich BGP

Hard week to finish features rich BGP LABS. will have to practice some more labs from other work book.
Need to memorize regular expression for route filtering with regexp.
so far only remember :P
.
^
_
+
$
( )

bgp regexp deterministic

Short notes from cisco

The default Cisco IOS regular expression engine uses a recursive algorithm.
This engine is effective but uses more system resources as the complexity of regular expressions increase.
In some cases, CPU watchdog timeouts and stack overflow traces have occurred because of the length of time that the default engine requires to process very complex regular expressions.
The Regex Engine Performance Enhancement feature introduces a deterministic processing time regular expression engine in Cisco IOS software.
if you need to evaluate complex regular expressions or if you have observed problems related to evaluating regular expressions, recommanded use new regular expression engine.

Steps to do,
- enable BGP
- bgp regexp deterministic

Router> enable
Router# configure terminal
Router(config)# router bgp 1
Router(config-router)#bgp regexp deterministic

more
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gt_rexpe.html

Jeff Doyle's Favorite Interview Question

Why does OSPF require all traffic between non-backbone areas to pass through a backbone area (area 0)?

Because inter-area OSPF is distance vector, it is vulnerable to routing loops.
It avoids loops by mandating a loop-free inter-area topology,
in which traffic from one area can only reach another area through area 0.


Jeff's full explanation.

Here

Study Notes; OSPF over NBMA

OSPF characterizes FR networks as non-broadcast multiple access (NBMA)
because they can support more than two attached routers, but do not have a broadcast capability.

In an NBMA network topology, which is inherently nonbroadcast, neighbors are not discovered automatically.
OSPF tries to elect a DR and a BDR due to the multi-access nature of the network, but the election fails since neighbors are not discovered.
Neighbors must be configured manually to overcome these problems.

OSPF can run into 2 modes.
NBMA and Point-to-multipoint

Configurations for NBMA (Using Network Type Broadcast)
Router1
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
!
interface Serial2
ip address 1.1.1.2 255.255.255.0
encapsulation frame-relay
ip ospf network broadcast
no keepalive
frame-relay map ip 1.1.1.1 16 broadcast
!
!
router ospf 1
network 1.1.1.0 0.0.0.255 area 0

Router2
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Serial1/0
ip address 1.1.1.1 255.255.255.0
encapsulation frame-relay
ip ospf network broadcast
no keepalive
clockrate 2000000
frame-relay map ip 1.1.1.2 16 broadcast
!
router ospf 1
network 1.1.1.0 0.0.0.255 area 0

Router1# show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/BDR 00:00:37 1.1.1.1 Serial2

Router1# show ip ospf interface s2
Serial2 is up, line protocol is up
Internet Address 1.1.1.2/24, Area 0
Process ID 1, Router ID 3.3.3.3, Network Type BROADCAST, Cost: 64
Transmit Delay is 1 sec, State DR, Priority 1

Configurations for NBMA (Using Neighbor Statements)
Router1
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface Serial2
ip address 1.1.1.2 255.255.255.0
encapsulation frame-relay
ip ospf priority 2
no keepalive
frame-relay map ip 1.1.1.1 16
!
router ospf 1
network 1.1.1.0 0.0.0.255 area 0
neighbor 1.1.1.1

Router2
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Serial1/0
ip address 1.1.1.1 255.255.255.0
encapsulation frame-relay
no keepalive
clockrate 2000000
frame-relay map ip 1.1.1.2 16
!
router ospf 1
network 1.1.1.0 0.0.0.255 area 0
neighbor 1.1.1.2
!
frame-relay map commands do not need to have the broadcast parameter because the OSPF packets are unicasted with the neighbor statement.

Router2# show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
3.3.3.3 1 FULL/DR 00:01:49 1.1.1.2 Serial1/0

Router2# show ip ospf interface s1/0
Serial1/0 is up, line protocol is up
Internet Address 1.1.1.1/24, Area 0
Process ID 1, Router ID 2.2.2.2, Network Type NON_BROADCAST, Cost: 64
Transmit Delay is 1 sec, State BDR, Priority 1

Configurations for Point-to-Multipoint
Router1
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface Serial2
ip address 1.1.1.2 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-multipoint
no keepalive
frame-relay map ip 1.1.1.1 16 broadcast
!
router ospf 1
network 1.1.1.0 0.0.0.255 area 0
!

Router2

interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Serial1/0
ip address 1.1.1.1 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-multipoint
no keepalive
clockrate 2000000
frame-relay map ip 1.1.1.2 16 broadcast
!
router ospf 1
network 1.1.1.0 0.0.0.255 area 0

Router1# show ip ospf neighbors

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/ - 00:01:53 1.1.1.1 Serial2
Router1# show ip ospf interface s2
Serial2 is up, line protocol is up
Internet Address 1.1.1.2/24, Area 0
Process ID 1, Router ID 3.3.3.3, Network Type POINT_TO_MULTIPOINT, Cost: 64
Transmit Delay is 1 sec, State POINT_TO_MULTIPOINT,

There are no DR and BDR elected when the NBMA network is configured as Point-to-Multipoint, since it is treated as a collection of point-to-point links.

Finished Dramatic OSPF LABS.

This OSPF technology-lab topic is the interesting and lots of things to understand and remember for LAB exams.
Practical studies Vol I and TCP/IP vol I is very good reference for theory.
But Cisco, OSPF Command and Configuration Handbook By: William R. Parkhurst is the one need to reference for commands.
Even finished those practice Labs, I still don't know some topic and don't remember.
I will have to give some more time to do it again after other technology Labs.

Cisco and Pearson VUE Launch Global Test Delivery Exam Security Enhancements

Cisco and its global testing provider, Pearson VUE, a business of Pearson Inc. are pleased to announce a series of security enhancements that will reinforce the integrity and value of its Career certification program.
The advanced security enhancements include the use of digital photographs for candidate-identity verification and forensic analysis of testing data. The new measures, to be implemented beginning on Aug. 1, will include:


Photo on Score Report and Web – On completion of a certification exam at the test center, candidates will receive preliminary score reports imprinted with their photos and unique authentication codes. The authentication code can be used to access a candidate’s official score online at Pearson VUE’s website usually within 72 hours of the examination. The online score report will also display the candidate’s photo. Candidates may share access to their online records with employers or other third parties.

Forensic Analysis – Exam results and other testing data will be continuously analyzed by forensic software to detect aberrant testing behavior and to flag suspect exams for further investigation.

Preliminary Score Report – All paper score reports will be preliminary, pending the results of forensic analysis, until official exam scores are posted to the Web usually within 72 hours of exam completion. Once the exam scores are official, candidates may use the authentication codes on their score reports to access the Pearson VUE website for score and photo verification.
These new exam security measures are part of Cisco’s overall strategy to protect the value and integrity of its certifications. Other measures include simulation-based testing, dynamically generated questions and emulations to help ensure that Cisco certified networking professionals continue to have the knowledge, skills, and credentials to perform well on the job.
To find out more about Cisco Career Certifications access the Cisco Learning Network at www.cisco.com/go/learnnetspace.

Finished EIGRP Lab

EIGRP configurations notes

#router eigrp 10 (AS number)
#no autosummary
#network netID wildcast

Tune the update interval,hold time
Under interface config mode
#ip hello-interval eigrp 10 30
#ip hold-time eigrp 10 120

Tune timer
Under router eigrp mode
#timers avtive-time 60 or disabled

Change the AD for internal/external
Under router mode
#distance eigrp 90 110 (90-internal, 110-exterlnal, default 170)

summarization
Under interface config mode
#ip summary-address eigrp 10 192.168.0.0 255.255.252.0

Verify by #show ip route
EIGRP will inject a discard route to Null0
D 192.168.0.0/22 is a summary, ....., Null0

Advertise a summary route plus specific routes
use leak-map under interface config mode
#ip summary-address egirp 10 192.168.0.0 255.225.252.0 leak-map ROUTE-map

If the routemap doesnt exit, only summary routes will adv
If the routemap exist, but the route map refer to ACL that doents exist, the summary routes + all the specific routes will adv
If the routemap exist, but the route map refer to the ACL, the summary route + routs in the ACL will adv

Load balancing for unequal cost
Use variance under router mode

Authentication
use the same config as RIPv2 by using Key chain.
But only support MD5. dont support cleartext.

LAB Exam Locations.

Where to go out of nearest 5????

Bangalore, India Routing and Switching, Security
Beijing, PRC Routing and Switching, Security, Service Provider
Dubai, UAE Routing and Switching, Security
Hong, Kong, PRC Routing and Switching
Sydney, Australia Routing and Switching, Security, Service Provider, Voice

Others Far away

RTP, USA Routing and Switching, Security, Service Provider, Storage Networking, Voice
San Jose, USA Routing and Switching, Security, Voice
Sao Paulo, Brazil Routing and Switching, Service Provider
Tokyo, Japan Routing and Switching, Security
Brussels, Belgium Routing and Switching, Security, Service Provider, Storage Networking, Voice

Finished RIPv2 LAB! Narbik's workbook

RIPv2 Lab summary configurations

#router rip
version 2
no auto summary (turn off auto summary)

Default parameters
Update interval - 30s
Invalid - 180s
Holddown - 180s
Flush - 240s

Can tune under router rip
timers basic (Update int) (Invalid) (Holddown) (Flush)

Authentication
- Define the Key
- Apply on the interface
Under config mode
#key chain Keyname
key 1
key-string password

under interface-config mode
#ip rip authentication key-chain Keyname (this is clear text)

Use MD5
#ip rip authentication mode md5

RIPv2 Updates
- By default, Multicast 224.0.0.9

Change type by these under router rip mode //use unicast
#passive-interface Fa1/0
#neighbor neighbor-IP-address

Change type under interface mode //use broadcast
#ip rip v2-broadcast

Validate update source
by default, RIP/IGRP valid the source IP as the same IP address as the connected link.
If not same, it will not update. To turn off this, under router rip mode
#no validate-update-source

Offset-list
To add an offset to incoming and outgoing metrics to routes learned via RIP,
use the offset-list router configuration command
#offset-list {access-list-number | name} {in | out} offset [type number]
define ACL
access-list 1 permit 10.0.0.0 0.255.255.255

Apply under router rip
offset-list 1 out 14 fa1/0

Routes summary under interface config mode
#ip summary-address rip 192.168.0.0 255.255.252.0

RIP commands
http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/cs/csprtn1/csrip.htm#xtocid2534115

Frame relay Authenticaton by using Virtual template with PPP CHAP

Frame relay don't support Authentication by itslef and use PPP authentication with Virtual template.
Configuration

username ROUTER password 0 cisco
interface Virtual-Template1
ip address 100.100.100.1 255.255.255.0
ppp authentication chap
(virtual template is encapsulated with PPP, no need to add encapsualtion frame-relay)
interface Serial1/0.1 point-to-point
frame-relay interface-dlci 101 ppp Virtual-Template1

once configured the virtual-template interface, Virtual-access interface will come up

Router#show ip int brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES manual administratively down down
FastEthernet0/1 unassigned YES manual administratively down down
Serial1/0 unassigned YES manual up up
Serial1/0.1 unassigned YES unset up up
Serial1/1 unassigned YES manual administratively down down
Serial1/2 unassigned YES manual administratively down down
Serial1/3 unassigned YES manual administratively down down
Virtual-Access1 100.100.100.1 YES TFTP up up
Virtual-Template1 100.100.100.1 YES manual down down
Virtual-Access2 unassigned YES unset down down

Take note that Access interface is up and Virtual template is in down state.

Router#show frame-relay pvc interface serial 1/0.1
PVC Statistics for interface Serial1/0.1 (Frame Relay DTE)
Active Inactive Deleted Static
Local 3 0 0 0
Switched 0 0 0 0
Unused 0 0 0 0

DLCI = 104, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial1/0.1

input pkts 55 output pkts 87 in bytes 3112
out bytes 3784 dropped pkts 0 in pkts dropped 0 out pkts dropped 0 out bytes dropped 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 7 out bcast bytes 2316
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec pvc create time 00:07:18, last time
pvc status changed 00:04:02
Bound to Virtual-Access1 (up, cloned from Virtual-Template1)

Router#show interfaces virtual-access 1
Virtual-Access1 is up, line protocol is up
Hardware is Virtual Access interface
Internet address is 100.100.100.1/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, LCP Open
Open: IPCP
PPPoFR vaccess, cloned from Virtual-Template1

Router#show interfaces virtual-access 1 configuration
Virtual-Access1 is a PPP over FR PVC (sub)interface
Derived configuration : 95 bytes
!
interface Virtual-Access1
ip address 100.100.100.1 255.255.255.0
ppp authentication chap
end

Terminal Length

When need to copy the whole config to the notepad,
change the terminal length to 0 (no pausing)

#show run
no pasuing on the console and can copy the whole running config and can easily paste back on the router.
Without this, if your open terminal window size is small, cannot see all the config at 1 time.

R4#terminal length ?
<0-512> Number of lines on screen (0 for no pausing)