As I was reviewing my posts on OSPF LSA packet types and the Area types they are used in, it struck me that I missed off the last of the 4 area types.
We have a Stub area, totally stubby area, a Not-So-Stubby-Area, and the last one is NSSA Totally Stubby Area.
A NSSA Totally Stubby Area works in a similar manner to a Totally Stubby Area (blocking External type5 LSAs, Interarea route type4 LSA's and Summary type 3 LSA's). A single default route replaces all of these.
To configure a NSSA Totally Stubby Area you do the following:
On the NSSA ABR (this is the router that now has links to external networks/ Autonomous Systems):
R5(config)#router ospf 1
R5(config-router)#area 6 nssa
!
On the ABR that links to Area 0 do:
R4(config)#router ospf 1
R4(config-router)#area 6 nssa no-summary
!
In this situation R4 will automatically generate an O*N2 default route therefore you are not required to enter 'default-information originate'
Note that this is a Cisco propriortary config.
Saturday, August 28, 2010
Thursday, August 26, 2010
CCNP - ENTERPRISE - Route Redistribution - #ip helper-address cmd
If you have DHCP host sat on one side of a router but the DHCP server is sat on the other side of the router then without further configuration the Host will not be able to communicate with the server as routers, by default, do not forward broadcast traffic.
To get round this you use the #ip helper-address [ip address of DHCP or Broadcast address of network where multiple DHCP reside] cmd.
Applied to the default gateway interface for the Host do the following:
R1(config)#int e0
R1(config-if)#ip helper-address 192.168.5.255
!
R1(config)#int e1
R1(config-if)#ip directed-broadcast
In the example above the admin knows there are multiple DHCP servers on the 192.168.5.0/24 network connected to int e1. So instead of specifying a single DHCP server the router is configured to pass the DHCP request to the broadcast address of that network.
On interface e1, the #ip directed-broadcast cmd is used to convert the unicast traffic to a link-layer broadcast. a further explanation is here (taken from www.lansweeper.com):
An IP directed broadcast is a datagram which is sent to the broadcast address of a subnet to which the sending machine is not directly attached. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link-layer broadcast. Because of the nature of the IP addressing architecture, only the last router in the chain, the one that is connected directly to the target subnet, can conclusively identify a directed broadcast
To get round this you use the #ip helper-address [ip address of DHCP or Broadcast address of network where multiple DHCP reside] cmd.
Applied to the default gateway interface for the Host do the following:
R1(config)#int e0
R1(config-if)#ip helper-address 192.168.5.255
!
R1(config)#int e1
R1(config-if)#ip directed-broadcast
In the example above the admin knows there are multiple DHCP servers on the 192.168.5.0/24 network connected to int e1. So instead of specifying a single DHCP server the router is configured to pass the DHCP request to the broadcast address of that network.
On interface e1, the #ip directed-broadcast cmd is used to convert the unicast traffic to a link-layer broadcast. a further explanation is here (taken from www.lansweeper.com):
An IP directed broadcast is a datagram which is sent to the broadcast address of a subnet to which the sending machine is not directly attached. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link-layer broadcast. Because of the nature of the IP addressing architecture, only the last router in the chain, the one that is connected directly to the target subnet, can conclusively identify a directed broadcast
Monday, July 26, 2010
CCNP - ENTERPRISE - Authentication in EIGRP, OSPF, IS-IS, BGP
Like my previous post, the way authentication is applied for each protocol varies in a EIGRP, OSPF, IS-IS, and BGP.
EIGRP:
Supports MD5/Plain text
Applied to the interface that connects to the neighbour, must be the same at each side.
Configure by doing:
R1(config)#int s0/0
R1(config0if)#ip authentication eigrp 1 md5
R1(config-if)#ip authentication key-chain eigrp 1 EIGRP_AUTH
!
R1(config)#key-chain EIGRP_AUTH
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string P@ssw0rd
!
OSPF:
Applied on the interface
Can be MD5/Plain text
Configure the same authentication on all neighbors
Configure plain text:
R1(config)#int s0/0
R1(config-if)#ip ospf authentication*
R1(config-if)#ip ospf authentication-key 1 P@ssw0rd
*This cmd, without any switches, configures authentication in plain text
Configure MD5 authentication:
R1(config)#int s0/0
EIGRP:
Supports MD5/Plain text
Applied to the interface that connects to the neighbour, must be the same at each side.
Configure by doing:
R1(config)#int s0/0
R1(config0if)#ip authentication eigrp 1 md5
R1(config-if)#ip authentication key-chain eigrp 1 EIGRP_AUTH
!
R1(config)#key-chain EIGRP_AUTH
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string P@ssw0rd
!
OSPF:
Applied on the interface
Can be MD5/Plain text
Configure the same authentication on all neighbors
Configure plain text:
R1(config)#int s0/0
R1(config-if)#ip ospf authentication*
R1(config-if)#ip ospf authentication-key 1 P@ssw0rd
*This cmd, without any switches, configures authentication in plain text
Configure MD5 authentication:
R1(config)#int s0/0
R1(config-if)#ip ospf authentication message-digest
R1(config-if)#ip ospf message-digest-key 1 md5 P@ssw0rd
!
IS-IS:
Offers 2 layers of authentication
i) Area-Passwords - between Level1 routers
ii)Domain-Password - between Level2 routers
Can be plain text or MD5 (out of scope of BSCI though)
Apply the cmd on all routers within the area or domain (for Level2)
Configure Level1 plain text authentication by:
R1(config)#router isis
R1(config-router)#area-password P@ssW0rd
!
Configure Level2 plain text authentication by:
R2(config)#router isis
R2(config-router)#domain-password P@ssw0rd
!
Protect specific links by applying the authentication on the interface:
R2(config)#int s0/0
R2(config-if)#isis password P@ssw0rd level-2*
*you should state the router level to apply the authentication to, default is level1
BGP:
Uses MD5 authentication
Must be configured on each side of the neighbor relationship otherwise the connection is not made
Configure authentication by:
R4(config)#router bgp 100
R4(config-router)#neighbor 10.1.1.1 password P@ssw0rd
CCNP - ENTERPRISE - Route Summarisation with RIPv2, EIGRP, OSPF, IS-IS, BGP
In this post I'm going set down the necessary steps to implement summarisation in each protocol.
RIPv2:
On the router running RIPv2 you apply the summary to the outgoing interface:
R1(config)#int s0/0
R1(config-if)#ip summary-address rip 10.0.0.0 255.252.0.0
EIGRP:
Firstly disable auto summarisation-
R1(config)#router eigrp 1
R1(config-router)#no auto-summary
Next apply your summary route to the OUT Bound interface -
R1(config)#int s0/0/0
R1(config-if)#ip summary-address eigrp 1 172.16.0.0 255.255.224.0
Points - Configured on a per interface basis, Router creates a NULL0 entry as loop prevention (longest match rule works here so if there isn't a more specific route within the summary route the router will drop the packet), When the last specific route within the summary is removed the NULL0 entry is removed.
OSPF:
Summarisation is performed on the ABR and ASBR only.
ABR - Applied to routes from within one area and summarised in to another area
ASBR - External routes are redistributed INTO ospf from protocols such as RIPv2 or EIGRP
For Intra-area route summarisation, on the ABR do:
R1(config)#router ospf 1
R1(config-router)# area 1 range 192.168.64.0 255.255.224.0
*Area number is the area you are summarising FROM
*#sh ip route - will show a NULL0 route to help prevent routing loops
* #sh ip ospf database - will show the summary route
For Inter-area route summarisation, on the ASBR do:
R4(config)#router ospf 1
R4(config-router)#summary address 192.168.64.0 255.255.224.0
*Advertises a summary route for all routes within 192.168.64.0/19 subnet
Note - By default ABR's and ASBR's do not summarise routes.
IS-IS:
Summarisation to be done on a Level1/2 router, which injects level 1 routes in to level 2.
If summarisation is being implemented, ALL level1/2 routers in the area need to be configured for summarisation.
Otherwise if one router advertises a more specific route then the Level 2 router will direct all traffic to that one router (due to the Longest Match rule).
On the Level1/2 router do:
R5(config)#router isis
R5(config-router)#summary-address 192.168.0.0 255.255.0.0 level-2
*You state which level router you are summarising in to (default is level-2).
BGP:
BGP will not advertise a summary route unless the route can be first located in the Routing Table. As a result you can't simply apply a summary in the BGP process as it won't exist in the RT and therefore will not be advertised.
To get round this you first add a static route for the summary point to NULL0 and then you apply your summary route in BGP.
To do this do:
R2(config)#ip route 192.168.0.0 255.255.0.0 NULL0
!
R2(config)#router bgp 100
R2(config-router)#network 192.168.0.0 mask 255.255.0.0
RIPv2:
On the router running RIPv2 you apply the summary to the outgoing interface:
R1(config)#int s0/0
R1(config-if)#ip summary-address rip 10.0.0.0 255.252.0.0
EIGRP:
Firstly disable auto summarisation-
R1(config)#router eigrp 1
R1(config-router)#no auto-summary
Next apply your summary route to the OUT Bound interface -
R1(config)#int s0/0/0
R1(config-if)#ip summary-address eigrp 1 172.16.0.0 255.255.224.0
Points - Configured on a per interface basis, Router creates a NULL0 entry as loop prevention (longest match rule works here so if there isn't a more specific route within the summary route the router will drop the packet), When the last specific route within the summary is removed the NULL0 entry is removed.
OSPF:
Summarisation is performed on the ABR and ASBR only.
ABR - Applied to routes from within one area and summarised in to another area
ASBR - External routes are redistributed INTO ospf from protocols such as RIPv2 or EIGRP
For Intra-area route summarisation, on the ABR do:
R1(config)#router ospf 1
R1(config-router)# area 1 range 192.168.64.0 255.255.224.0
*Area number is the area you are summarising FROM
*#sh ip route - will show a NULL0 route to help prevent routing loops
* #sh ip ospf database - will show the summary route
For Inter-area route summarisation, on the ASBR do:
R4(config)#router ospf 1
R4(config-router)#summary address 192.168.64.0 255.255.224.0
*Advertises a summary route for all routes within 192.168.64.0/19 subnet
Note - By default ABR's and ASBR's do not summarise routes.
IS-IS:
Summarisation to be done on a Level1/2 router, which injects level 1 routes in to level 2.
If summarisation is being implemented, ALL level1/2 routers in the area need to be configured for summarisation.
Otherwise if one router advertises a more specific route then the Level 2 router will direct all traffic to that one router (due to the Longest Match rule).
On the Level1/2 router do:
R5(config)#router isis
R5(config-router)#summary-address 192.168.0.0 255.255.0.0 level-2
*You state which level router you are summarising in to (default is level-2).
BGP:
BGP will not advertise a summary route unless the route can be first located in the Routing Table. As a result you can't simply apply a summary in the BGP process as it won't exist in the RT and therefore will not be advertised.
To get round this you first add a static route for the summary point to NULL0 and then you apply your summary route in BGP.
To do this do:
R2(config)#ip route 192.168.0.0 255.255.0.0 NULL0
!
R2(config)#router bgp 100
R2(config-router)#network 192.168.0.0 mask 255.255.0.0
Friday, July 23, 2010
CCNP - ENTERPRISE - OSPF - Area Types - Not-So-Stubby-Area (Dude!*)
(*sorry, can't help it - I just keep hearing some surf dude trying to think up a clever name to describe these area types and not succeeding very well...)
Not-So-Stubby-Area (NSSA) - special area type for when you end up adding a way out of the network via a Stub Area. For example you take over another company and you want to extend their RIPv2 network in to yours by making a router that was in your stub area an ASBR.
ISP~~~~(ASBR1) ----AREA0----(RouterB)---Area1-NSSA---(RouterA)~~~~New RIPv 2 Network
Not-So-Stubby-Area (NSSA) - special area type for when you end up adding a way out of the network via a Stub Area. For example you take over another company and you want to extend their RIPv2 network in to yours by making a router that was in your stub area an ASBR.
ISP~~~~(ASBR1) ----AREA0----(RouterB)---Area1-NSSA---(RouterA)~~~~New RIPv 2 Network
- In the (crude) example above, RouterA was within the stub area attached to RouterB. It now has a path to external networks attached to it.
- To Address the fact that RouterA is in a stub area, this area is configured to be a NSSA and in turn RouterA directs Type7 LSA packets to the ABR, in this case RouterB.
- RouterB in turn takes this Type7 LSA and converts it in to a Type5, External Link, LSA and propagates into Area0.
Configure a NSSA
1) On all the routers in the NSSA do:
RouterA(config)#router ospf 1
RouterA(config-router)#no area 1 stub
*remove the stub configuration
RouterA(config-router)#area 1 nssa
2) On the new ASBR within the NSSA redistribute your required RIPv2 netrworks:
RouterA(config)#router ospf 1
RouterA(config-router)#redistribute rip subnets
3) On the NSSA ABR, which is RouterB in the example above, do:
RouterB(config)#router ospf 1
RouterB(config-router)#area 1 nssa default-information originate
*This causes RouterB to generate a O* N2 default route of 0.0.0.0/0 and propagate in to the NSSA
CCNP - ENTERPRISE - OSPF - Area Types - Totally Stubby Area (Dude!)
Totally Stubby Area - Cisco Proprietary, reduces the Routing Table further.
- Blocks external Type5 LSA's, Summary Type3 LSA's, and ASBR Type4 LSA's
- Totally Stubby Area only recognises intra-area routes and the default route 0.0.0.0
- ABR's inject the default route in to the Totally Stubby Area
- Each area router picks the closest ABR as its DFG
Configure a Totally Stubby Area
1) Configure OSPF as usual
2) Define the area to be Totally Stubby, as a Stub on all routers in the area, using the cmd:
R4(config)#router ospf 1
R4(config-router)#area 4 stub
3) On the ABR configure Area 3 to be Totally Stubby:
R5(config)#router ospf 1
R5(config-router)#area 4 stub no-summary
On the ABR the Routing Table will not change.
On the Totally Stubby router the routing table should only see routes in it's area and a default route to the ABR.
CCNP - ENTERPRISE - OSPF - Area Types - Stub Area
Stub Area - Does not accept Type5 LSA's (External routes)
- Type5 LSA's replaced by a default route from the ABR
- All routers within the Stub area must be configured as a Stub Router
Configure a Stub Router:
R1(config)# router ospf 1
R1(config-router)#area 2 stub
*Note the adjacency will fail until the neighbor plus the ABR is configured as a Stub as well
NOTE - On the ABR #sh ip route - will not change
On the Stub router, #sh ip route - routes from the ABR are replaced by a default route.
CCNP - ENTERPRISE - OSPF - LSA types
Link-state Advertisement Types are as follows:
Type
1 - Router LSA - Most common, used in an Area, lists a routers neighbor and it's cost
2 - Network LSA - Generated by DR/BDR, advertises all routes with in an area - Does not cross the ABR
3 - Summary LSA - ABR's generate these to summarise routes from a different area, sent between areas, summarisation is manually configured.
4 - ASBR LSA - Sent FROM an ABR with the IP's of ASBR's in any OSPF areas. Routes in OSPF areas use these to locate the external network.
5 - External Link LSA - Advertises ASBR summary routes out, contains routes external to OSPF
7 - NSSA External LSA - Similar to Type5 LSA but generated by an ASBR in a Not-So-Stubby-Area, converted in to Type5 LSA's by the receiving ABR
Type
1 - Router LSA - Most common, used in an Area, lists a routers neighbor and it's cost
2 - Network LSA - Generated by DR/BDR, advertises all routes with in an area - Does not cross the ABR
3 - Summary LSA - ABR's generate these to summarise routes from a different area, sent between areas, summarisation is manually configured.
4 - ASBR LSA - Sent FROM an ABR with the IP's of ASBR's in any OSPF areas. Routes in OSPF areas use these to locate the external network.
5 - External Link LSA - Advertises ASBR summary routes out, contains routes external to OSPF
7 - NSSA External LSA - Similar to Type5 LSA but generated by an ASBR in a Not-So-Stubby-Area, converted in to Type5 LSA's by the receiving ABR
CCNP - ENTERPRISE - Study Pointers - IPv6
IPv6
R3(config-if)#tunnel mode ipv6ip
*apply this on both ends of the tunnel
- FF00::/8 = Multicast prefix for all multicast traffic
- Link-LSA's and Intra-area LSA's are not used in OSPFv2 (Included in OSPFv3)
- R2(config-if)#ipv6 ospf cost 50 - this cmd sets the cost of a packet on this interface
- R2(config)#ipv6 unicast-routing - required when configuring a router for IPv4/IPv6 Dual Stack
- In a tunnel the header will look like - | ipv4 header | ipv6 header | ipv6 data |
- In OSPFv3 Type3 and Type9 LSA's carry all IPv6 Prefix info
- Local-Link LSA's aree flooded through the OSPF area
- IPv6 autoconfiguration allows a device to connect to a network without further config or the use of a DHCP server
- Enable a IPv6-to-IPv4 tunnel using:
R3(config-if)#tunnel mode ipv6ip
*apply this on both ends of the tunnel
CCNP - ENTERPRISE - Study Pointers - Multicast
Multicast:
Disadvantages of Multicast:
Disadvantages of Multicast:
- Lack of congestion control results in increased network degradation as the volume of network traffic rises
- Best effort delivery - can lead to packet drops affecting VOIP/Video delivery
- Eavesdropping is a security issue due to the nature to the protocol
- 224.0.1.1 = NTP protocol
- GLOP and Limited scope addresses are types of Multicast address
- RP-Announce msgs sent to 224.0.1.39
- RP-Discovery msgs (group-to-RP mapping msgs) sent to 224.0.1.40
Subscribe to:
Posts (Atom)