Professional Documents
Culture Documents
Link State
A B C D
1
Distance Vector vs. Link State
Distance Vector Link State
Updates frequently Updates are event
triggered
Each router is
"aware" only of its Each router is
"aware" of all other
immediate neighbors routers in the "area"
Slow convergence Fast convergence
Prone to routing loops Less subject to
Easy to configure routing loops
More difficult to
configure 2
Comparison Continued
Distance Vector Link State
Fewer router resources More router resource
required intensive
Updates require more Updates require less
bandwidth bandwidth
Does not "understand" Has detailed knowledge
the topology of the of distant networks and
network routers
3
Link State
Example
OSPF
IS-IS
5
6
Open Shortest Path First (OSPF)
7
Link State
There are two types of Packets
Hello
LSAs
8
OSPF Hello
B C
9
"Hello" Packets
Small frequently issued packets
Discover neighbours and negotiate "adjacencies"
Verify continued availability of adjacent neighbours
Hello packets and Link State Advertisements (LSAs) build
and maintain the topological database
Hello packets are addressed to 224.0.0.5.
10
Link State Advertisement
(LSA)
An OSPF data packet containing link state and routing
information that is shared among OSPF routers
11
Link State
There are three type of tables
Neighbor
Topology
Routing
12
Tables
Neighbor
Contain information about the neighbors
Neighbor is a router which shares a link on same
network
Another relationship is adjacency
Not necessarily all neighbors
LSA updates are only when adjacency is established
13
Tables
Topology
Contain information about all network and path to
reach any network
All LSAs are entered in to topology table
When topology changes LSAs are generated and send
new LSAs
On topology table an algorithm is run to create a
shortest path, this algorithm is known as SPF or
dijkstra algorithm
14
Tables
Routing Table
Also knows as forwarding database
Generated when an algorithm is run on the topology
database
Routing table for each router is unique
15
OSPF Terms
Link Backbone area
Router ID Internal routers
Neighbours Area Border Router
Adjacency (ABR)
OSPF Area Autonomous System
Boundary Router
(ASBR)
16
Link
A network or router interface assigned to a
given network
Link (interface) will have "state" information
associated with it
Status (up or down)
IP Address
Network type (e.g. Fast Ethernet)
Bandwidth
Addresses of other routers attached to this
interface
17
OSPF Term: Link
20
Neighbours
Neighbours are two or more routers that
have an interface on a common network
E.g. two routers connected on a serial link
E.g. several routers connected on a common
Ethernet or Frame relay network
Communication takes place between /
among neighbours
neighbours form "adjacencies"
21
Adjacency
A relationship between two routers that
permits the direct exchange of route
updates
Not all neighbours will form adjacencies
This is done for reasons of efficiency more
later
22
OSPF Design
Each router connects to the backbone called area 0, or the backbone area.
Routers that connect other areas to the backbone within an AS are called Area Border Routers (ABRs). One
interface must be in area 0.
OSPF runs inside an autonomous system, but can also connect multiple autonomous systems together. The
router that connects these ASes together is called an Autonomous System Boundary Router (ASBR). 23
OSPF Areas
An OSPF area is a grouping of contiguous networks and
routers
Share a common area ID
A router can be a member of more than one area (area
border router)
All routers in the same area have the same topology
database
When multiple areas exist, there must always be an area
0 (the backbone) to which other areas connect
24
Why areas?
Decreases routing overhead
Compare to multiple smaller broadcast domains
instead of one large one
Speeds convergence
26
LSAs in Area
LSAs communicate with adjacent routers in the same
OSPF area
27
Path Calculation
Changes to the topological database of a router trigger a
recalculation to re-establish the best route(s) to known
networks
Uses the SPF (shortest path first) algorithm developed
by a computer scientist named Dijkstra
This is done by each individual router using its
detailed "knowledge" of the whole network
Leads to rapid and accurate convergence
Based on detailed knowledge of every link in the area
and the OSPF "cost" of each
builds an OSPF tree with itself at the route
28
Terminology: Cost
Various criteria can be selected by
the administrator to determine the
metric
Usually,
OSPF cost=108/bandwidth
Do not forget to
configure the
bandwidth`
command on serial
links to ensure
correct
default OSPF cost
29
Pros and Cons
Note that OSPF is a more sophisticated routing protocol
Converges rapidly and accurately
Can use a metric calculation that effectively selects
the "best" route(s) primarily based on bandwidth,
although an OSPF cost can be administratively
assigned
Use of OSPF requires
More powerful routing hardware
More detailed knowledge by the administrator,
especially when large multi-area networks are used
30
Types of Neighbors
OSPF can be defined for three type of neighbors
Broadcast Multi Access (BMA) ex- Ethernet
Point to Point
Non-Broadcast Multi Access (NBMA)
31
OSPF Network Types
32
Adjacencies
Point to Point all routers form adjacencies
BMA & NBMA one router is elected as DR
DR establish adjacency with every neighbor router
LSA updates are exchanged only to DR
DR is the router which has highest priority
All CISCO routers has priority 1
If priority is same then router id is seen
The RID is highest IP address of all interfaces
33
Point-to-Point Links
34
Multi-access Broadcast Network
37
DR Responsibility
When a router sees a new or changed link-state, it sends
an LSA to its DR using a particular multicast address
38
OSPF Summary
AD -100
Hop count is unlimited
Metric = Cost 108/BW
Classless, VLSM
Load balance up to SIX routers
Require more processing power
39
Basic OSPF Configuration
Router(config)# router ospf 1
The number 1 in this example is a process-id # that
begins an OSPF process in the router
More than one process can be launched in a router,
but this is rarely necessary
Usually the same process-id is used throughout the
entire network, but this is not required
The process-id # can actually be any value from 1 to
"very large integer
The process-id # cannot be ZERO
This is NOT the same as the AS# used in IGRP and
EIGRP
40
Configuring OSPF Areas
After identifying the OSPF process, you need to identify the interfaces that
you want to activate OSPF communications
Lab_A#config t
Lab_A(config)#router ospf 1
Lab_A(config-router)#network 10.0.0.0 0.255.255.255
area ?
<0-4294967295> OSPF area ID as a decimal value
A.B.C.D OSPF area ID in IP address format
Lab_A(config-router)#network 10.0.0.0 0.255.255.255
area 0
Every OSPF network must have an area 0 (the backbone area) to which
other areas connect
So in a multiple area network, there must be an area 0
The wildcard mask represents the set of hosts supported by the
network and is really just the inverse of the subnet mask.
41
OSPF Configuration
OSPF Process ID number is irrelevant. It can be the same on every
router on the network
The arguments of the network command are the network number
(10.0.0.0) and the wildcard mask (0.255.255.255)
Wildcards - A 0 octet in the wildcard mask indicates that the
corresponding octet in the network must match exactly
A 255 indicates that you dont care what the corresponding octet is
in the network number
A network and wildcard mask combination of 1.1.1.1 0.0.0.0 would
match 1.1.1.1 only, and nothing else.
The network and wildcard mask combination of 1.1.0.0 0.0.255.255
would match anything in the range 1.1.0.01.1.255.255
42
OSPF Configuration -1
S0 S1
20.0.0.2 30.0.0.1
R2
R1 R3
S0
S0 20.0.0.1
30.0.0.2 40.0.0.1
E0
10.0.0.1 E0
40.0.0.2
10.0.0.2
A B
43
OSPF Configuration -1
S0 S1
20.0.0.2 30.0.0.1
R2
R1 R3
S0
S0
30.0.0.2 40.0.0.1
E0
10.0.0.1 E0 20.0.0.1
40.0.0.2
10.0.0.2
A B
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#network 10.0.0.0 0.255.255.255 area 0
R1(config-router)#network 20.0.0.0 0.255.255.255 area 0
R1(config-router)#^Z
44
OSPF Configuration -2
S0 S1
200.0.0.8/30
200.0.0.12/30
R2
R1 R3
S0
S0
E0
E0
200.0.0.16/28 200.0.0.32/27
A B
45
OSPF Configuration -2
S0 S1
200.0.0.10 200.0.0.13
255.255.255.252 R2 255.255.255.252
R1 R3
S0
S0 200.0.0.9 200.0.0.14 200.0.0.33
E0
200.0.0.17 E0
255.255.255.224
255.255.255.240 200.0.0.18 200.0.0.34
A B
46
OSPF Configuration -2
S0 S1
200.0.0.10 200.0.0.13
255.255.255.252 R2 255.255.255.252
R1 R3
S0
S0 200.0.0.9
200.0.0.14 200.0.0.33
E0
200.0.0.17 E0
255.255.255.224
255.255.255.240 200.0.0.18 200.0.0.34
A B
R3#config t
R1#config t Enter configuration commands, one per line. End with CNTL/Z.
Enter configuration commands, one per line. End with CNTL/Z. R3(config)#router ospf 1
R1(config)#router ospf 1 R3(config-router)#network 200.0.0. 32 0.0.0.31 area 0
R1(config-router)#network 200.0.0.16 0.0.0.15 area 0 R3(config-router)#network 200.0.0. 12 0.0.0.3 area 0
R1(config-router)#network 200.0.0. 8 0.0.0.3 area 0 R3(config-router)#^Z
R1(config-router)#^Z
47
OSPF and Loopback Interfaces
Configuring loopback interfaces when using the OSPF routing
protocol is important
Cisco suggests using them whenever you configure OSPF on a
router
Loopback interfaces are logical interfaces, which are virtual,
software-only interfaces; they are not real router interfaces
Using loopback interfaces with your OSPF configuration ensures that
an interface is always active for OSPF processes.
The highest IP address on a router will become that routers RID
The RID is used to advertise the routes as well as elect the DR and
BDR.
If you configure serial interface of your router with highest IP
Address this Address becomes RID of t is the RID of the router
because e router
If this interface goes down, then a re-election must occur
It can have an big impact when the above link is flapping
48
Configuring Loopback Interfaces
R1#config t
Enter configuration commands, one per line. End
with CNTL/Z.
R1(config)#int loopback 0
R1(config-if)#ip address 172.16.10.1
255.255.255.255
R1(config-if)#no shut
R1(config-if)#^Z
R1#
49
Verifying OSPF Operation
Router#
show ip protocols
Router#
show ip ospf
Router#
show ip ospf neighbor [detail]
52
The show ip ospf interface
Command
53
The show ip ospf neighbor
Command
RouterB# show ip ospf neighbor
54
show ip ospf neighbor detail
55
Setting Priority for DR Election
Router(config-if)#
ip ospf priority number
56
57
EIGRP
IGRP OSPF
DV
LS
Easy to configure
Neighbor Incremental Updates
Advanced Metric Multicast
Periodic Open Standard
Broadcast
EIGRP
Hybrid
DUAL
Topology Database
Rapid Convergence
Reliable
58
Overview
60
Introducing EIGRP
EIGRP supports:
Rapid convergence
Reduced bandwidth usage
Multiple network-layer protocols
EIGRP Tables
EIGRP maintains 3 tables
Neighbor table
Topology table
Routing table
62
Neighbor Discovery
There are three conditions that must be
met for neighborship establishment
Hello or ACK received
AS numbers match
Identical metrics (K values)
? AS
?K
K1 BW
K2- Delay
K3-Load
K3-Reliability
K5-MTU
63
Metric Calculation
The metrics used by EIGRP in making routing decisions are (lower the metric the
better):
bandwidth
delay
load
Reliability
MTU
Analogies:
Think of bandwidth as the width of the pipe
and
delay as the length of the pipe.
65
Topology Table
Network
66
Topology Table
The topology table is made up of all the EIGRP routing tables in the
autonomous system.
DUAL takes the information and calculates the lowest cost routes to each
destination.
The information that the router learns from the DUAL is used to determine
the successor route, which is the term used to identify the primary or best
route.
56Kbps
1.544Mbps
10Mbps 100
1,544Mbps 250
1.544Mbps
56Kbps -1000
71
EIGRP Terminology and
Operations
Successor Current Route
A successor is a route selected as the primary route to use to reach
a destination.
Successors are the entries kept in the routing table.
72
Reliable Transport Protocol (RTP)
Used by EIGRP for its routing updates in place of TCP
EIGRP can call on RTP to provide reliable or unreliable service
EIGRP uses reliable service for route updates
Unreliable for Hellos
73
Diffusing Update Algorithm
(DUAL)
All route computations in EIGRP are handled by DUAL
One of DUAL's tasks is maintaining a table of loop-free paths to
every destination.
This table is referred to as the topology table
DUAL saves all paths in the topology table
The least-cost path(s) is copied from the topology table to the
routing table
In the event of a failure, the topology table allows for very quick
convergence if another loop-free path is available
If a loop-free path is not found in the topology table, a route
recomputation must occur
DUAL queries its neighbors, who, in turn, may query their
neighbors, and so on...
Hence the name "Diffusing" Update Algorithm
74
VLSM Support
EIGRP supports the use of Variable- Length Subnet
Masks
75
Discontiguous Network
76
Configuring EIGRP
Router(config-router)#network network-number
200.0.0.10 200.0.0.13
255.255.255.252 R2 255.255.255.252
R1 R3
S0
S0 200.0.0.9
200.0.0.14 200.0.0.33
E0
200.0.0.17 E0
255.255.255.224
255.255.255.240 200.0.0.18 200.0.0.34
A B
R3#config t
R1#config t Enter configuration commands, one per line. End with CNTL/Z.
Enter configuration commands, one per line. End with CNTL/Z. R3(config)#router eigrp 10
R1(config)#router eigrp 10 R3(config-router)#network 200.0.0. 32
R1(config-router)#network 200.0.0.16 R3(config-router)#network 200.0.0. 12
R1(config-router)#network 200.0.0. 8 R3(config-router)#^Z
R1(config-router)#^Z
80
Verifying the EIGRP Configuration
81
show ip eigrp topology
82
show ip eigrp topology
all-links
83
Administrative Distances
84
TELNET
Getting information about remote device
Can connect to remote device and configure a device
Password must be set
R1(config)# line vty 0 4
Password cisco
login
85
Discovering Neighbors on the
Network
86
Router(config)#cdp timer 90
89
Using CDP
90
Using the show cdp
neighbors Command
The show cdp neighbor command (sh cdp nei for short) delivers
information about directly connected devices.
91
CDP
show cdp neighbor detail
92
Using the show cdp entry
Command
The show cdp entry * command displays the same information as the show cdp
neighbor details command.
93
Additional CDP Commands
95
Summary
Cisco Discovery Protocol is an information-gathering tool used
by network administrators to get information about directly
connected devices.
The show cdp entry, show cdp traffic, and show cdp interface
commands display detailed CDP information on a Cisco device.
96
97
Why Use Access Lists?
ACLs are lists of conditions that are applied to traffic traveling across
a router's interface.
These lists tell the router what types of packets to accept or deny.
99
Reasons to Create ACLs
100
ACLs
Different access list for Telnet
When configuring ISDN you need to use access list
Implicit deny at bottom
All restricted statements should be on first
There are two types
Standard
Extended
101
Network
192.168.12.2 N1 192.168.12.0 N2
192.168.12.3
B C
192.168.34.0
N3 N4 N5 192.168.56.0 N6
102
IP Packet
SRC IP Address
DEST IP Address
Protocol type
SRC Port
DEST Port
The first 2 bytes in the TCP/UDP header are the source port number
The next 2 bytes in the TCP/UDP header are the Destination port number
103
Types of Access Lists
Standard
Checks source address
Permits or denies entire protocol suite
Extended
Checks source and destination address
Generally permits or denies specific protocols
104
How to Identify Access Lists
106
Wildcard Mask
Access-list 99 permit 192.168.1.1 wildcard mask
All 32 bits of an IP Address can be filtered
Wildcard inverse mask
0=must match
1= ignore
MASK (192.168.1.1) Matching IP
0.0.0.0 (host) 192.168.1.1
0.0.0.255 192.168.1.0-255
0.0.255.255 192.168.0-255.0-255
0.255.255.255 192.0-255.0-255.0-255
255.255.255.255 0-255.0-255.0-255.0-255 (any) 107
The ANY and HOST keyword
Access-list 1 permit 0.0.0.0 255.255.255.255
Or
permit any
108
Testing Packets with
Standard Access Lists
Outbound ACL Operation
111
Creating ACLs
ACLs are created in the global configuration mode. There are many
different types of ACLs including standard, extended, IPX, AppleTalk, and
others. When configuring ACLs on a router, each ACL must be uniquely
identified by assigning a number to it. This number identifies the type of
access list created and must fall within the specific range of numbers that
is valid for that type of list.
112
The ip access-group command
{ in | out }
113
Exercise Standard Access List
192.168.0.5 192.168.0.9
255.255.255.252 255.255.255.252
192.168.0.33
E0 255.255.255.240
192.168.0.17 S0 S1 S0 E0
A 255.255.255.248 S0
192.168.0.10 B
255.255.255.252
192.168.0.6
192.168.0.18 192.168.0.34
255.255.255.252
255.255.255.248 255.255.255.240
To steps to configure
Create a standard Access list
Apply ACL to proper interface inbound or outbound
114
Exercise Standard Access List
192.168.0.5 192.168.0.9
255.255.255.252 255.255.255.252
192.168.0.33
E0 255.255.255.240
192.168.0.17 S0 S1 S0 E0
A 255.255.255.248 S0
192.168.0.10 B
255.255.255.252
192.168.0.6
192.168.0.18 192.168.0.34
255.255.255.252
255.255.255.248 255.255.255.240
Config#int e 0
Config-if# ip access-group 1 out
115
Extended ACLs
Extended ACLs are used more often than standard ACLs because they provide a
greater range of control.
Extended ACLs check the source and destination packet addresses as well as
being able to check for protocols and port numbers.
At the end of the extended ACL statement, additional precision is gained from a
field that specifies the optional Transmission Control Protocol (TCP) or User
Datagram Protocol (UDP) port number.
Logical operations may be specified such as, equal (eq), not equal (neq), greater
than (gt), and less than (lt), that the extended ACL will perform on specific
protocols.
Extended ACLs use an access-list-number in the range 100 to 199 (also from 2000
to 2699 in recent IOS).
116
Configuration
Protocol
Access-list acl# {permit/Deny}
Src IP src WCM
Dst IP dst WCM
Opetrator port
Protocol
OSPF RP If you need to Block a routing protocol
EIGRP
ICMP
Operator
IP TCP
eq
UDP
gt
lt
neq
117
Testing Packets with
Extended Access Lists
Extended ACL Syntax
119
Extended ACL LAB -2
192.168.0.9
192.168.0.5 255.255.255.252
255.255.255.252
S0 S0
S1
192.168.0.33
S0 192.168.0.6 192.168.0.10 E0 255.255.255.240
192.168.0.17 E0 255.255.255.252 255.255.255.252
255.255.255.248
192.168.0.34
255.255.255.240
A B
192.168.0.18
255.255.255.248
192.168.0.34 should be denied FTP of 192.168.0.18 192.168.0.18 should be denied website of 192.168.0.34
On Router R1 On Router R3
Config# Access-list 100 deny tcp 192.168.0.34 0.0.0.0 192.168.0.18 Config# Access-list 100 deny tcp 192.168. 0.18 0.0.0.0 192.168.0.34
0.0.0.0 eq 21 0.0.0.0 eq 80
Config# access-list 100 permit IP any any Config# access-list 100 permit IP any any
Config#int s0 Config#int s0
Config-if# ip access-group 100 IN Config-if# ip access-group 100 IN
121
Deny FTP
access-list 101 deny tcp any any eq 21
or
122
Rules
For extended access list apply near to the
source
For standard access list apply near to the
destination
123
Named ACLs
IP named ACLs were introduced in Cisco IOS Software Release 11.2,
allowing standard and extended ACLs to be given names instead of
numbers.
Named ACLs are not compatible with Cisco IOS releases prior to Release
11.2.
#Int e 0
#Ip access-group blocksales out
126
Verify Access List
127
Basic Rules for ACLs
Standard IP access lists should be applied closest to the destination.
Extended IP access lists should be applied closest to the source.
Use the inbound or outbound interface reference as if looking at the port
from inside the router.
Statements are processed sequentially from the top of list to the bottom
until a match is found, if no match is found then the packet is denied.
There is an implicit deny at the end of all access lists. This will not appear
in the configuration listing.
Access list entries should filter in the order from specific to general.
Specific hosts should be denied first, and groups or general filters should
come last.
Never work with an access list that is actively applied.
New lines are always added to the end of the access list.
A no access-list x command will remove the whole list. It is not possible
to selectively add and remove lines with numbered ACLs.
Outbound filters do not affect traffic originating from the local router.
128