anchor.diff:  "no XXXX" -- Removes or takes away a command. For example, if you type "no shut", then it will bring UP an interface. Likewise, "no ip pim sparse-mode" will REMOVE the "ip pim sparse-mode" from the configuration. 
   
   
  -I recommend "write erase" first (to restore factory configuration), and then building out your topology from there.
  +Execute "write erase" first (to restore factory configuration).
   Next, "enable" to go into priviledged mode.
   Then, "show running-config" to see what the initial configuration looks like. 
  -Lastly, "config t" so you can start changing settings.
  +Lastly, "config t" so you can start changing settings (you should see the '#' prompt which means you can now issue commands).
  +
  +Once you are in this mode, type in the commands from the attached configuration file.
  +
  +== Step 5: Configure Linux
  +
  +In order to get this to work properly, you will need to: 1. diable RP filtering, 2. configure your firewall properly (or just turn it off), and 3. add the appropriate routing table entries so that traffic to CME goes to the correct interface. On the commands that follow, the interface for CME is enp3s0 (change it to match yours).
  +
  +Routing table:
  +route add -net 69.50.112.0 netmask 255.255.255.0 gw 10.249.71.1 dev enp3s0
  +
  +To see if multicast traffic is coming in on the interface:
  +tcpdump -i enp3s0 -s0 -vv net 224.0.28.0/24
   
   
  -
  +== Useful Links:
   http://stevehardie.com/2013/05/cisco-877w-configure-wireless-and-wired-on-single-subnet/
   https://supportforums.cisco.com/discussion/11801006/does-configuring-two-vlans-cisco-871-router-divides-bandwidth-internet-half
   https://supportforums.cisco.com/discussion/10567086/change-ip-router-cisco-871
   
  +== Sample Router Configuration
   
  +version 12.4
  +no service pad
  +service timestamps debug datetime msec
  +service timestamps log datetime msec
  +no service password-encryption
  +!
  +hostname Router
  +!
  +boot-start-marker
  +boot-end-marker
  +!
  +!
  +no aaa new-model
  +!
  +resource policy
  +!
  +ip cef
  +!
  +!
  +no ip dhcp use vrf connected
  +ip dhcp excluded-address 10.249.71.64 10.249.71.255
  +!
  +ip dhcp pool vlan1pool
  +   network 10.249.71.0 255.255.255.0
  +   default-router 10.249.71.1
  +   dns-server 8.8.8.8
  +!
  +!
  +ip multicast-routing
  +!
  +!
  +!
  +!
  +!
  +!
  +crypto isakmp policy 2
  + encr 3des
  + hash md5
  + authentication pre-share
  +crypto isakmp key XXXXXXXXXXXXXXXXXXXXX
  +!
  +!
  +crypto ipsec transform-set cmevpn esp-3des esp-md5-hmac
  +!
  +crypto map cmevpn 1 ipsec-isakmp
  + set peer XXX.XXX.XXX.XXX
  + set transform-set cmevpn
  + match address 100
  +!
  +bridge irb
  +!
  +!
  +!
  +interface Tunnel0
  + ip address XXX.XXX.XXX.XXX 255.255.255.252
  + ip pim sparse-mode
  + tunnel source XXX.XXX.XXX.XXX
  + tunnel destination XXX.XXX.XXX.XXX
  +!
  +interface Loopback0
  + ip address 10.249.0.229 255.255.255.255
  +!
  +interface FastEthernet0
  +!
  +interface FastEthernet1
  +!
  +interface FastEthernet2
  +!
  +interface FastEthernet3
  +!
  +interface FastEthernet4
  + ip address dhcp
  + ip nat outside
  + ip virtual-reassembly
  + duplex auto
  + speed auto
  + crypto map cmevpn
  +!
  +interface Dot11Radio0
  + no ip address
  + !
  + broadcast-key vlan 1 change 45
  + !
  + !
  + encryption vlan 1 mode ciphers tkip
  + !
  + ssid YOUR_SSID_NAME
  +    vlan 1
  +    authentication open
  +    authentication key-management wpa
  +    guest-mode
  +    wpa-psk ascii 0 YOUR_SSID_PASSWORD
  + !
  + speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
  + station-role root
  + no cdp enable
  +!
  +interface Dot11Radio0.1
  + encapsulation dot1Q 1 native
  + no cdp enable
  + bridge-group 1
  + bridge-group 1 subscriber-loop-control
  + bridge-group 1 spanning-disabled
  + bridge-group 1 block-unknown-source
  + no bridge-group 1 source-learning
  + no bridge-group 1 unicast-flooding
  +!
  +interface Vlan1
  + no ip address
  + ip access-group 102 in
  + bridge-group 1
  + bridge-group 1 spanning-disabled
  +!
  +interface BVI1
  + ip address 10.249.71.1 255.255.255.0
  + ip nat inside
  + ip virtual-reassembly
  +!
  +ip route 10.249.254.1 255.255.255.255 FastEthernet4
  +ip route 69.50.112.0 255.255.255.128 Tunnel0
  +ip route 69.50.112.128 255.255.255.128 FastEthernet4
  +ip route 69.50.112.254 255.255.255.255 Tunnel0
  +!
  +!
  +no ip http server
  +no ip http secure-server
  +ip pim rp-address XXX.XXX.XXX.XXX
  +ip mroute 69.50.112.0 255.255.255.128 Tunnel0
  +ip nat inside source list 1 interface FastEthernet4 overload
  +!
  +access-list 1 permit 10.249.71.0 0.0.0.255
  +
  
positive.code: VLAN - Virtual LAN. Note that on the 871W, you can not assign a specific IP or DHCP group to the physical interfaces. You must assign the interfaces to be part of a VLAN and then the VLAN can be assigned a DHCP pool for IP assignment.  
  Advanced Security or Advanced IP - Cisco offers two flavors of software to run on their routers. The "PIM" capabilities are in the Advanced IP package, not the Advanced Security package despite the need for a VPN tunnel! Make sure you are running a package with the K9 designator because it has AES/3DES encryption.
  ACL - Access Lists. These allow you to choose what traffic can and can not go through your router.
  
  == Step 2: Hardware
  In addition to the 800 series Router, to get started, you'll need a so-called "Rollover Cable". http://www.ebay.com/sch/i.html?_nkw=cisco+rollover+usb&_sacat=0
  
negative.code: 
  == Step 3: Big Picture
  Create two VLANs, one for public IP traffic ("Vlan 10"), and the other for CME New Release traffic ("Vlan 20"). For wireless models, you'll add the wireless connection to be part of Vlan 10.  Assign two of the fast ethernet ports to vlan 10, and the other two to Vlan 20. This will allow you to have two physical connections to public IP and two to New Release. You can always attach a switch to a vlan 10 port to expand access to other devices.  To have the appropriate IPs assigned to each VLAN, you'll create two DHCP pools for which IPs can come. On the vlan 10, you can stay with the traditional 192.168.1.x range and on vlan 20, you must use the range that the CME assigns you. 
  
  Note for Wireless users: In order to get wireless working propertly, you'll need to create a "bridge group". At a high level, this allows you to bridge the physical interface with the wireless interface into the same group. Note: don't assign an IP address range to vlan 10, just tell it to be part of the bridge group and with "no ip address". Then, in the bridge group configuration, you will assign the IP range for which the DHCP pool exits. However, for vlan 20 (because it's not part of a bridge group with a wireless interface), you will assign an ip range that matches what CME tells you. 
  
  
  == Step 4: Configure Router
  
  