Professional Documents
Culture Documents
Link State
A B C D X E
Periodic Update
Comparison Continued
Distance Vector Fewer router resources required Updates require more bandwidth Does not "understand" the topology of the network Link State More router resource intensive Updates require less bandwidth Has detailed knowledge of distant networks and routers
Link State
Example
OSPF IS-IS
Link State
There are two types of Packets
Hello LSAs
OSPF Hello
A
When router A starts it send Hello packet uses 224.0.0.5 Hello packets are received by all neighbors B will write As name in its neighbor table C also process the same way
"Hello" Packets
Small frequently issued packets Discover neighbours and negotiate "adjacencies" Verify continued availability of adjacent neighbours Hello packets and Link State Advertisements (LSAs) build and maintain the topological database Hello packets are addressed to 224.0.0.5.
10
11
Link State
There are three type of tables
Neighbor Topology Routing
12
Tables
Neighbor Contain information about the neighbors Neighbor is a router which shares a link on same network Another relationship is adjacency Not necessarily all neighbors LSA updates are only when adjacency is established
13
Tables
Topology Contain information about all network and path to reach any network All LSAs are entered in to topology table When topology changes LSAs are generated and send new LSAs On topology table an algorithm is run to create a shortest path, this algorithm is known as SPF or dijkstra algorithm
14
Tables
Routing Table Also knows as forwarding database Generated when an algorithm is run on the topology database Routing table for each router is unique
15
OSPF Terms
Link Router ID Neighbours Adjacency OSPF Area Backbone area Internal routers Area Border Router (ABR) Autonomous System Boundary Router (ASBR)
16
Link
A network or router interface assigned to a given network Link (interface) will have "state" information associated with it Status (up or down) IP Address Network type (e.g. Fast Ethernet) Bandwidth Addresses of other routers attached to this interface
17
A link is a network or router interface assigned to any given network This link, or interface, will have state information associated with it (up or down) as well as one or more IP addresses
18
Status of a link between two routers Information is shared between directly connected routers. This information propagates throughout the network unchanged and is also used to create a shortest path first (SPF) tree. 19
Router ID
The Router ID (RID) is an IP address used to identify the router Cisco chooses the Router ID by using the highest IP address of all configured loopback interfaces If no loopback interfaces are configured with addresses, OSPF will choose the highest IP address of all active physical interfaces. You can manually assign the router ID. The RID interface MUST always be up, therefore loopbacks are preferred
20
Neighbours
Neighbours are two or more routers that have an interface on a common network
E.g. two routers connected on a serial link E.g. several routers connected on a common Ethernet or Frame relay network
Adjacency
A relationship between two routers that permits the direct exchange of route updates Not all neighbours will form adjacencies
This is done for reasons of efficiency more later
22
OSPF Design
Each router connects to the backbone called area 0, or the backbone area. Routers that connect other areas to the backbone within an AS are called Area Border Routers (ABRs). One interface must be in area 0. OSPF runs inside an autonomous system, but can also connect multiple autonomous systems together. The router that connects these ASes together is called an Autonomous System Boundary Router (ASBR). 23
OSPF Areas
An OSPF area is a grouping of contiguous networks and routers Share a common area ID A router can be a member of more than one area (area border router) All routers in the same area have the same topology database When multiple areas exist, there must always be an area 0 (the backbone) to which other areas connect
24
Why areas?
Decreases routing overhead Compare to multiple smaller broadcast domains instead of one large one Speeds convergence Confines network instability (e.g. route "flapping") to single area of the network Adds considerably to the complexity of setting up OSPF CCNA certification deals only with single-area OSPF
25
Area Terminology
26
LSAs in Area
LSAs communicate with adjacent routers in the same OSPF area Subsequently, a change in a link state is "flooded" to all area routers via LSAs In larger networks, multiple areas may be created LSAs are sent only to adjacent routers in the same area "Area border routers" connect areas, passing summarized route information between
27
Path Calculation
Changes to the topological database of a router trigger a recalculation to re-establish the best route(s) to known networks Uses the SPF (shortest path first) algorithm developed by a computer scientist named Dijkstra This is done by each individual router using its detailed "knowledge" of the whole network Leads to rapid and accurate convergence Based on detailed knowledge of every link in the area and the OSPF "cost" of each builds an OSPF tree with itself at the route
28
Terminology: Cost
Various criteria can be selected by the administrator to determine the metric Usually, OSPF cost=108/bandwidth
Do not forget to configure the bandwidth` command on serial links to ensure correct default OSPF cost
29
Types of Neighbors
OSPF can be defined for three type of neighbors
Broadcast Multi Access (BMA) ex- Ethernet Point to Point Non-Broadcast Multi Access (NBMA)
31
32
Adjacencies
Point to Point all routers form adjacencies BMA & NBMA one router is elected as DR DR establish adjacency with every neighbor router LSA updates are exchanged only to DR DR is the router which has highest priority All CISCO routers has priority 1 If priority is same then router id is seen The RID is highest IP address of all interfaces
33
Point-to-Point Links
Usually
or HDLC
serial
interface
running
either
PPP
No DR or BDR election required OSPF autodetects this interface type OSPF packets are sent using multicast 224.0.0.5
Generally LAN technologies like Ethernet and Token Ring DR and BDR selection required All neighbor routers form full adjacencies with the DR and BDR only Packets to the DR use 224.0.0.6 Packets from DR to all other routers use 224.0.0.5
35
37
DR Responsibility
When a router sees a new or changed link-state, it sends an LSA to its DR using a particular multicast address The DR then forwards the LSA to all the other routers with whom it is adjacent Minimizes the number of formal adjacencies that must be formed and therefore the amount of LSU (link state update) packet traffic in a multi-router network
38
OSPF Summary
AD -100 Hop count is unlimited Metric = Cost 108/BW Classless, VLSM Load balance up to SIX routers Require more processing power
39
OSPF Configuration
OSPF Process ID number is irrelevant. It can be the same on every router on the network The arguments of the network command are the network number (10.0.0.0) and the wildcard mask (0.255.255.255) Wildcards - A 0 octet in the wildcard mask indicates that the corresponding octet in the network must match exactly A 255 indicates that you dont care what the corresponding octet is in the network number A network and wildcard mask combination of 1.1.1.1 0.0.0.0 would match 1.1.1.1 only, and nothing else. The network and wildcard mask combination of 1.1.0.0 0.0.255.255 would match anything in the range 1.1.0.01.1.255.255
42
OSPF Configuration -1
S0 S1
20.0.0.2
30.0.0.1
R2 R1
S0
20.0.0.1
S0
R3
E0
10.0.0.1
E0
30.0.0.2
40.0.0.1
10.0.0.2
40.0.0.2
43
OSPF Configuration -1
S0 S1
20.0.0.2
30.0.0.1
R2 R1
S0 E0 S0
R3
E0
10.0.0.1
20.0.0.1
30.0.0.2
40.0.0.1
10.0.0.2
40.0.0.2
R1#config t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#router ospf 1 R1(config-router)#network 10.0.0.0 0.255.255.255 area 0 R1(config-router)#network 20.0.0.0 0.255.255.255 area 0 R1(config-router)#^Z
44
OSPF Configuration -2
S0 S1
200.0.0.8/30
R2 R1
200.0.0.12/30
R3
S0 S0 E0 E0
200.0.0.16/28
200.0.0.32/27
45
OSPF Configuration -2
S0 S1
200.0.0.10
255.255.255.252
200.0.0.13
R2
200.0.0.9
255.255.255.252
S0
R1
S0
R3
E0
200.0.0.14
200.0.0.33
255.255.255.224
200.0.0.17
255.255.255.240
E0
200.0.0.18
200.0.0.34
46
OSPF Configuration -2
S0 S1
200.0.0.10
255.255.255.252
200.0.0.13
R2
200.0.0.9
255.255.255.252
S0
R1
S0
R3
E0
200.0.0.14
200.0.0.33
255.255.255.224
200.0.0.17
255.255.255.240
E0
200.0.0.18
200.0.0.34
R1#config t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#router ospf 1 R1(config-router)#network 200.0.0.16 0.0.0.15 area 0 R1(config-router)#network 200.0.0. 8 0.0.0.3 area 0 R1(config-router)#^Z
R3#config t Enter configuration commands, one per line. End with CNTL/Z. R3(config)#router ospf 1 R3(config-router)#network 200.0.0. 32 0.0.0.31 area 0 R3(config-router)#network 200.0.0. 12 0.0.0.3 area 0 R3(config-router)#^Z
47
show ip protocols
50
show ip ospf
Displays information about the OSPF neighbors, including Designated Router (DR) and Backup Designated Router (BDR) information on broadcast networks
51
52
53
54
55
This interface configuration command assigns the OSPF priority to an interface. Different interfaces on a router may be assigned different values. The default priority is 1. The range is from 0 to 255. 0 means the router is a DROTHER; it cant be the DR or BDR.
56
57
EIGRP
IGRP
DV Easy to configure Neighbor Advanced Metric Periodic Broadcast
OSPF
LS Incremental Updates Multicast Open Standard
EIGRP
Hybrid DUAL Topology Database Rapid Convergence Reliable
58
Overview
Enhanced Interior Gateway Routing Protocol (EIGRP) is a Ciscoproprietary routing protocol based on Interior Gateway Routing Protocol (IGRP). Released in 1994, Unlike IGRP, which is a classful routing protocol, EIGRP supports CIDR and VLSM. it is probably one of the two most popular routing protocols in use today.
Compared to IGRP, EIGRP boasts faster convergence times, improved scalability, and superior handling of routing loops.
EIGRP is often described as a hybrid routing protocol, offering the 59 best of distance vector and link-state algorithms.
60
Introducing EIGRP
EIGRP supports: Rapid convergence Reduced bandwidth usage Multiple network-layer protocols
EIGRP Tables
EIGRP maintains 3 tables
Neighbor table Topology table Routing table
62
Neighbor Discovery
There are three conditions that must be met for neighborship establishment
Hello or ACK received AS numbers match Identical metrics (K values)
? AS ?K
K1 BW K2- Delay K3-Load K3-Reliability K5-MTU
63
Metric Calculation
The metrics used by EIGRP in making routing decisions are (lower the metric the better):
bandwidth delay load Reliability MTU
Analogies:
Think of bandwidth as the width of the pipe and delay as the length of the pipe. Bandwidth is the carrying capacity Delay is the end-to-end travel time.
64
Neighbor Table
The neighbor table is the most important table in EIGRP Stores address and interface of neighbor
65
Topology Table
Network
66
Topology Table
The topology table is made up of all the EIGRP routing tables in the autonomous system. DUAL takes the information and calculates the lowest cost routes to each destination. By tracking this information, EIGRP routers can identify and switch to alternate routes quickly. The information that the router learns from the DUAL is used to determine the successor route, which is the term used to identify the primary or best route. Every EIGRP router maintains a topology table. All learned routes to a destination are maintained in the topology table.
67
Routing Tables
A successor is a route selected as the primary route to use to reach a destination. DUAL calculates Successor (Primary Route) and places it in the routing table (and topology table) Can have up to 4 successors of equal or unequal value DUAL calculates Feasible Successor (Backup Route) and places it in the Topology Table. Promoted to successor if the route goes down if it has a lower cost than current successor If no FS in Table - Send query Multiple feasible successors for a destination can be retained in the topology table although it is not mandatory
68
10Mbps
172.16.100.0
56Kbps 1.544Mbps
10Mbps 100 1,544Mbps 250 56Kbps -1000
1.544Mbps
EIGRP Terms
Feasible distance (FD) - This is the lowest calculated metric to reach destination. This is the route that you will find in the routing table, because it is considered the best path Reported distance (RD) - The distance reported by an adjacent neighbor to a specific destination. Interface information - The interface through which the destination can be reached. Route status - The status of a route. Routes are identified as being either passive, which means that the route is stable and ready for use, or active, which means that the route is in the process of being recomputed by DUAL
71
72
VLSM Support
EIGRP supports the use of Variable- Length Subnet Masks Can use 30-bit subnet masks for point-to-point networks
Because the subnet mask is propagated with every route update, EIGRP also supports the use of discontiguous subnets
Discontiguous network is the one that has two or more subnetworks of a classful network connected together by different classful networks
75
Discontiguous Network
76
Configuring EIGRP
Router(config-router)#network network-number
EIGRP Configuration
S0 S1
200.0.0.10
255.255.255.252
200.0.0.13
R2
200.0.0.9
255.255.255.252
S0
R1
S0
R3
E0
200.0.0.14
200.0.0.33
255.255.255.224
200.0.0.17
255.255.255.240
E0
200.0.0.18
200.0.0.34
R1#config t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#router eigrp 10 R1(config-router)#network 200.0.0.16 R1(config-router)#network 200.0.0. 8 R1(config-router)#^Z
R3#config t Enter configuration commands, one per line. End with CNTL/Z. R3(config)#router eigrp 10 R3(config-router)#network 200.0.0. 32 R3(config-router)#network 200.0.0. 12 R3(config-router)#^Z
80
81
83
Administrative Distances
84
TELNET
Getting information about remote device Can connect to remote device and configure a device Password must be set
R1(config)# line vty 0 4 Password cisco login
85
86
2002, Cisco Systems, Inc. All rights reserved. 86
CDP is a proprietary utility that gives you a summary of directly connected switches, routers, and other Cisco devices.
CDP discovers neighboring devices regardless of which protocol suite they are running.
Runs on the Data link layer Physical media must support the Subnetwork Access Protocol (SNAP) encapsulation. Only give directly connected device By default enabled, you can enable or disable
CDP
CDP timer is how often CDP packets are transmitted to
all active interfaces.
Router(config)#cdp timer 90
CDP holdtime is the amount of time that the device will hold packets received from neighbor devices.
Using CDP
90
The show cdp neighbor command (sh cdp nei for short) delivers information about directly connected devices.
91
CDP
show cdp neighbor detail This command can be run on both routers and switches, and it displays detailed information about each device connected to the device
92
The show cdp entry * command displays the same information as the show cdp neighbor details command.
93
The show cdp traffic command displays information about interface traffic, including the number of CDP packets sent and received and the errors with CDP.
94
CDP Commands
To disable the CDP on particular interface use the "no cdp enable" command
To disable CDP on the entire router use the "no cdp run" in global configuration mode.
95
Summary
Cisco Discovery Protocol is an information-gathering tool used by network administrators to get information about directly connected devices. CDP exchanges hardware and software device information with its directly connected CDP neighbors. You can enable or disable CDP on a router as a whole or on a port-by-port basis.
The show cdp neighbors command displays information about a routers CDP neighbors.
The show cdp entry, show cdp traffic, and show cdp interface 96 commands display detailed CDP information on a Cisco device.
97
Manage IP traffic as network access grows Filter packets as they pass through the router
Some ACL decision points are source and destination addresses, protocols, and upper-layer port numbers.
99
100
ACLs
Different access list for Telnet When configuring ISDN you need to use access list Implicit deny at bottom All restricted statements should be on first There are two types
Standard Extended
101
Network
192.168.12.2
N1
192.168.12.0
N2
192.168.12.3
N3
192.168.34.0
N4
N5
192.168.56.0
N6
102
IP Packet
SRC IP Address DEST IP Address Protocol type SRC Port DEST Port
The first 2 bytes in the TCP/UDP header are the source port number The next 2 bytes in the TCP/UDP header are the Destination port number
103
Standard Checks source address Permits or denies entire protocol suite Extended Checks source and destination address
Standard IP lists (1-99) test conditions of all IP packets from source addresses. Extended IP lists (100-199) test conditions of source and destination addresses, specific TCP/IP protocols, and destination ports. Standard IP lists (1300-1999) (expanded range). Extended IP lists (2000-2699) (expanded range).
Standard ACLs
The full syntax of the standard ACL command is: Router(config)#access-list access-list-number {deny | permit} source [source-wildcard ] The no form of this command is used to remove a standard ACL. This is the syntax: Router(config)#no access-list access-list-number
106
Wildcard Mask
Access-list 99 permit 192.168.1.1 wildcard mask All 32 bits of an IP Address can be filtered Wildcard inverse mask 0=must match 1= ignore MASK (192.168.1.1) 0.0.0.0 (host) 0.0.0.255 Matching IP 192.168.1.1 192.168.1.0-255
0.0.255.255
0.255.255.255 255.255.255.255
192.168.0-255.0-255
192.0-255.0-255.0-255 0-255.0-255.0-255.0-255 (any)
107
Reading an ACL
1. First Hit or Best Fit? Access-list 99 deny host 192.168.1.1 0.0.0.0 access-list 99 permit any 255.255.255.255 Access-list 99 permit 192.168.1.0 0.0.0.255 Access-list 99 deny host 192.168.1.1 access-list 99 permit any Access-list 99 deny host 192.168.1.1 Implicit deny at the end of every ACL
2.
3.
111
Creating ACLs
ACLs are created in the global configuration mode. There are many different types of ACLs including standard, extended, IPX, AppleTalk, and others. When configuring ACLs on a router, each ACL must be uniquely identified by assigning a number to it. This number identifies the type of access list created and must fall within the specific range of numbers that is valid for that type of list.
Since IP is by far the most popular routed protocol, addition ACL numbers have been added to newer router IOSs. Standard IP: 1300-1999 Extended IP: 2000-2699
112
{ in | out }
113
E0
192.168.0.33 255.255.255.240
A
192.168.0.18 255.255.255.248
S0 192.168.0.17 255.255.255.248
S0
192.168.0.6 255.255.255.252
S1
S0
192.168.0.10 255.255.255.252
E0
B
192.168.0.34 255.255.255.240
114
E0
192.168.0.33 255.255.255.240
A
192.168.0.18 255.255.255.248
S0 192.168.0.17 255.255.255.248
S0
192.168.0.6 255.255.255.252
S1
S0
192.168.0.10 255.255.255.252
E0
B
192.168.0.34 255.255.255.240
Extended ACLs
Extended ACLs are used more often than standard ACLs because they provide a greater range of control. Extended ACLs check the source and destination packet addresses as well as being able to check for protocols and port numbers. At the end of the extended ACL statement, additional precision is gained from a field that specifies the optional Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number. Logical operations may be specified such as, equal (eq), not equal (neq), greater than (gt), and less than (lt), that the extended ACL will perform on specific protocols. Extended ACLs use an access-list-number in the range 100 to 199 (also from 2000 to 2699 in recent IOS).
116
Configuration
Access-list acl# {permit/Deny}
Protocol
OSPF EIGRP ICMP TCP UDP
IP
Operator
eq gt lt neq
117
119
S0
192.168.0.6 255.255.255.252
S1
S0
192.168.0.10 255.255.255.252
E0 192.168.0.17 255.255.255.248
S0
E0
192.168.0.33 255.255.255.240
192.168.0.34 255.255.255.240
A
192.168.0.18 255.255.255.248
192.168.0.34 should be denied FTP of 192.168.0.18 On Router R1 Config# Access-list 100 deny tcp 192.168.0.34 0.0.0.0 192.168.0.18 0.0.0.0 eq 21 Config# access-list 100 permit IP any any Config#int s0 Config-if# ip access-group 100 IN
192.168.0.18 should be denied website of 192.168.0.34 On Router R3 Config# Access-list 100 deny tcp 192.168. 0.18 0.0.0.0 192.168.0.34 0.0.0.0 eq 80 Config# access-list 100 permit IP any any Config#int s0 Config-if# ip access-group 100 IN
121
Deny FTP
access-list 101 deny tcp any any eq 21
access-list 101 deny tcp any any eq ftp access-list 101 permit ip any any
122
Rules
For extended access list apply near to the source For standard access list apply near to the destination
123
Named ACLs
IP named ACLs were introduced in Cisco IOS Software Release 11.2, allowing standard and extended ACLs to be given names instead of numbers.
Identify an ACL using an alphanumeric name. You can delete individual statements in a named access list Named access lists must be specified as standard or extended You can use the ip access-list command to create named access lists.
Named ACLs are not compatible with Cisco IOS releases prior to Release 11.2.
The same name may not be used for multiple ACLs.
124
Named ACLs
Numbered Access list did not give you any hint, What is filtered Named ACLs are both basic and advanced filtering tool
127