FUNDAMENTAL ROUTING CONCEPTS

Transcription

1 PART I Chapter 1 FOUNDATION TOPICS Routing Protocol Fundamentals FUNDAMENTAL ROUTING CONCEPTS Characteristics of Routing Protocols Routing occurs when a router or some other Layer 3 device makes a forwarding decision based on network address information. A fundamental question is from where does the routing information originate? For large enterprises, the use of static routes does not scale well. Therefore, dynamic routing protocols are typically seen in larger networks. The Role of Routing in an Enterprise Network An enterprise network typically interconnects multiple buildings, has connectivity to one or more remote offices, and has one or more connections to the Internet. See Figure 1-1. Some of the architectural layers often found in an enterprise network design: Building Access : Security is important at this layer. Layer 2 switching is typically used at this layer, in conjunction with VLANs. Building Distribution : Multilayer switches are often used here. Campus Backbone : is concerned with the high-speed transfer of data through the network. High-end multilayer switches are often used here. Edge Distribution : Serves as the ingress and egress point for all traffic into and out of the Campus network. Routers or multilayer switches are appropriate for this layer. Internet Gateways : Contains routers that connect the Campus network out to the Internet. Some enterprise networks have a single connection, while others have multiple connections out to one or more ISPs. WAN Aggregation : Contains routers that connect the Campus network out to remote offices. Routing protocols used within the Campus Network and within the WAN aggregation layers are often: Routing Information Protocol (RIP) (RIPv2 RIPng) Open Shortest Path First (OSPF) (OSPFv2 OSPFv3) Enhanced Interior Gateway Protocol (EIGRP) When connecting out to the Internet, only one routing protocol is used: Border Gateway Protocol (BGP) (BGP MPBGP) 1

2 Routing Protocol Selection As you learn more about these routing protocols, keeping the following characteristics in mind can help you do a side-by-side comparison of protocols: Scalability Vendor Interoperability IT staff s familiarity with protocol Speed of Convergence Capability to Perform Summarization Interior or Exterior Routing Type of Routing Protocol Let s taking a closer look at these Scalability How large is your network now, and how large is it likely to become? The answers to those questions can help determine which routing protocols not to use in your network. We have to be aware of some kind of limitations about the routing protocols. For example, all versions of RIP have a maximum hop count (that is, the maximum number of routers across which routing information can be exchanged) of 15 routers. BGP, on the other hand, is massively scalable. In fact, BGP is the primary routing protocol used on the Internet. Vendor Interoperability Will you be using all Cisco routers in your network, or will you Cisco routers need to interoperate with non- Cisco routers? If you are working in an enviroment with routers from multiple vendors, you should ensure that your Cisco router has an appropriate Cisco IOS feature set to support your desired routing protocol and that the third-party router(s) also support that routing protocol. 2

3 IT Staff s Familiarity with Protocol Choosing the routing protocol with which the IT staff is more familiar could reduce downtime (because of faster resolutions to troubleshooting issues). Speed of Convergence A benefit of dynamic routing protocols over statically configured routes is the ability of a dynamic routing protocol to reroute around a network failure. See Figure 1-2. There are two new important things here. Convergence Time : The amount of time for the network failover to occur. Converged Network : Failover occurs and the network reaches a steady state condition. Some routing protocols have faster convergence times than others. RIP and BGP, for example, might take a few minutes to converge, depending on the network topology. By contrast, OSPF and EIGRP can converge in just a few seconds. SLOW: RIP BGP FAST: OSPF EIGRP Capability to Perform Summarization The more entries a router maintains in its routing table, the more router CPU resources are required to calculate the best path to a destination network. Network summarization allows multiple routes to be summarized in a single route advertisement. Not only does summarization reduce the number of entries in a router s routing table, but it also reduces the number of network advertisements that need to be sent. See Figure

4 Interior or Exterior Routing An autonomous system (AS) is a network under a single administrative control. When your company connects out two different ISPs, they are each in their own AS. When selecting a routing procotol, you need to determine where the protocol will run. IGP or EGP. IGP : An IGP exchanges routes between routers in a single AS. (OSPF EIGRP ISIS RIP) EGP : Today, the only EGP in use is BGP. Type of Routing Protocol Routing Protocol Categories Another way to categorize a routing protocol is based on how it receives, advertises, and stores routing information. Three fundamental approaches are: Distance-Vector, Link-State and Path-Vector. Distance-Vector A distance-vector routing protocol sends a full copy of its routing table to its directly attached neighbors. Ideally, you want a full exchange of route information to occur only once and subsequent updates to be triggered by topological changes. Another drawback is the time they take to converge. Yet another issue with distance-vector routing protocols is the potential of a routing loop. Distance-vector routing protocols typically use one of two approaches for preventing routing loops: Split Horizon : This feature prevents a route learned on one interface from being advertised back out that same interface. Poison Reverse : This feature causes a route received on one interface to be advertised back out of that same interface with a metric considered to be infinite. Distance-Vector Category Includes: Routing Information Protocol (RIP): Uses a metric of hop count. Max= is considered to be infinite. Three primary versions of RIP exist. RIPv1 : Broadcasts its entire IP routing table and supports only fixed-length subnet masks. Supports the routing of IPv4. RIPv2 : Supports variable-length subnet masks and it uses multicasts to advertise its IP routing table. Supports the routing of IPv4. RIPng : Supports the routing of IPv6 networks. Enhanced Interior Gateway Routing Protocol (EIGRP) : Cisco-proprietary until early EIGRP uses triggered updates and it converges quickly. Supports IPv4 and IPv6 networks. EIGRP uses Diffusing Update Algorithm (DUAL). Link-State Unlike distance-vector routing protocols, link-state routing protocols exchange full routing information only when two routers initially form their adjacency. Then, routing updates are sent in response to changes in the network, as opposed to being sent periodically. Link-state routing protocols benefit from shorter convergence times. Link-state routing protocols include: Open Shortest Path First (OSPF) : Uses a metric of COST, which is based on the link speed between two routers. Intermediate System-to-Intermediate System (IS-IS) : This routing protocol is like OSPF but it has not been as widely deployed as OSPF. Path-Vector A path-vector routing protocol includes information about the exact path packets take to reach a specific destination network. Borger Gateway Protocol (BGP) is the only path-vector protocol you are likely to encounter in a modern network. Also, BGP is the only EGP in widespead use today. 4

5 Summary of Categories See table 1-2. Distance-Vector (IGP) : RIP & EIGRP Link-State (IGP) : OSPF & IS-IS Path-Vector (EGP) : BGP Network Technology Fundamentals The ability to determine how traffic flows through that network is a necessary skill. Traffic flow is determined both by traffic type and the network architecture type. Traffic Types : Unicast Multicast Broadcast Anycast Network Types : Point-toPoint Broadcast Nonbroadcast Multiaccess (NBMA) Network Traffic Types Unicast Traffic travels from a single source device to a single destination device. In IPv4 networks, unicast addresses are made up of Class A, B, and C addresses. IPv6 networks instead use global unicast addresses, which begin with the 2000::/3 prefix. Broadcast Traffic travels from a single source to all destinations in a subnet. Another type of broadcast address is a directed broadcast address, which targets all devices in a remote network. For example, the address /16 is a directed broadcast targeting all devices in the /16 network : targets all devices on a single network : targets all devices in the /16 network. Multicast Multicast technology provides an efficient mechanism for a single host to send traffic to multiple, yet spesific, destinations. Based on the device request, switches and routers in the topology can then dynamically determine out of which ports the video stream should be forwarded. In IPv6 networks, multicast addresses have a prefix of FF00::/8. 5

6 Anycast A single IPv6 address is assigned to multiple devices. See figure The communication flow is one-to-nearest (from the perspective of a router s routing table). Anycast is an IPv6 concept and is not found in IPv4 networks. Also, note that IPv6 anycast addresses are not unique from IPv6 unicast addresses. Network Architecture Types For desing and troubleshooting purposes, you should be familiar with the characteristic of each. Point-to-Point Network A single network link interconnecting two routers and commonly found on serial links. Broadcast Network A broadcast network segment uses an architecture in which a broadcast sent from one of the routers on the network segment is propagated to all other routers on that segment. Nonbroadcast MultiAccess Network (NBMA) This king of network does not support broadcasts. As a result, if an interface on a router connects to two other routers, individual messages must be sent to each other. See Figute The absence of broadcast support also implies an absence of multicast support. 6

7 Therefore, neighboring IP addresses must be statically configured. There are also two issues stemming from NBMA network. Consider these: Split Horizon issues : You can administratively disable Split Horizon to solve this. Designated Rotuter issues: OSPF elects a designated router (DR), with which all other routers on a network segment form an adjacency. See Figure Specifically in such a topology, you would need to set the OSPF Priority to 0 on both Routers BR1 and BR2, which prevents them from participating in a DR election. TCP/IP Fundamentals IP Characteristics IPv4: Type of Service Field : The Type of Service (ToS) field (commonly referred to as the ToS Byte or DHCP field) has 8 bits used to set quality of service (QoS) markings. Specifically, the 6 leftmost bits are used for the Differentiated Service Code Point (DSCP) marking, and the 2 rightmost bits are used for Explicit Congestion Notification (an extension of Weighted Random Early Detection (WRED), used for flow control). Total Length Field : Indicates the size of the packet in bytes. IP Flags Field : The IP Flags field is a 3-bit field, where the first bit is always set to a 0. The second bit (the Don t Fragment [DF] bit) indicates that a packet should not be fragmented. The third bit (the More Fragments [MF] bit) is set on all of a packet s fragments, except the last fragment. Protocol Field : Specifies the type of data encapsulated in the packet. TCP and UDP are common protocols identified by this field. 7

8 IPv6: Traffic Class Field : Performs the same functions, and takes on the same values as the Type of Service field in an IPv4 header. Hop Limit Field : Performs the same function as the IPv4 header s TTL field. Routing Review Note: ARP uses broadcasts, which are not supported by IPv6. IPv6 exchanges Neighbor Discovery messages with adjacent devices to perform functions similar to ARP. Note: ARPs are not required for serial interfaces, because these interface types do not have MAC addresses. Asymmetric Routing (Unicast Flooding) Asymmetric routing is an issue that traffic might have through one path and return through a different path. Another name given to this issue is unicast flooding. See Figure

9 Maximum Transmission Unit (MTU) Typically refers to the largest packet size supported on a router interface; 1500 bytes is a common value. Smaller MTU sizes result in more overhead, because more packets (and therefore more headers) are required to transmit the same amount of data. However, if you are sending data over slower link speeds, large MTU values could cause delay for latency-sensitive traffic. Note: Latency is the time required for a packet to travel from its source to destination. Some applications, such as Voice over IP (VoIP), are latency sensitive, meaning that they do not perform satisfactorily if the latency of their packets is too high. G.114 recommendation states that the one-way latency for VoIP traffic should not exceed 150 ms. Latency is a factor in the calculation of the bandwidth-delay product. Specifically, the bandwidth-delay product is a measurement of the maximum number of bits that can be on a network segment at any one time, and it is calculated by multiplying the segment s bandwidth (in bits/sec) by the latency packets experience as they cross the segment (in sec). For example, a network segment with a bandwidth of 768 kbps and an end-to-end latency of 100 ms would have a bandwidth-delay product of 76,800 bits (that is 768,000 * 0,1 = 76,800). ICMP (Internet Control Message Protocol) Messages ICMP is most often associated with the Ping utility (using ICMP Echo Request and ICMP Echo Reply messages). See Figure Type : The specific type of ICMP message: TYPE 0 : Echo Reply TYPE 3 : Destination Unreachable TYPE 5 : Redirect Message TYPE 8 : ICMP Echo Request Code : Further defines the ICMP type. There are 16 codes for Destination Unreachable ICMP messages. 0 : Destination network is unreachable 1 : Destination host is unreachable You should primarily familiar with the two following ICMP message types: Destination Unreachable : A packet enters a router destined for an address that the router does not know how to reach, the router sends a Destination Unreachable ICMP message back to the sender. Redirect : If network conditions change and a different next-hop IP address should be used, the original next-hop router can let the host know to use a different path by sending the host a Redirect ICMP message. TCP Characteristics See Figure Sequence Number Field : A 32-bit field indicating the amount of data sent during a TCP session. The sending party can be assured that the receiving party really received the data, because the receiving party uses the sequence number as the basis for the acknowledgement number in the next segment it sends back to the sender. Acknowledgement Number Field : This field is used by the recepient of a segment to request the next segment in the TCP session. TCP Flags Field : This field is comprised of 9 flag bits (also known as control or code bits), which indicate a variety of segment parameters. Window Field : This field specifies the number of bytes a sender is willing to transmit before receiving an acknowledgement from the receiver. 9

10 Three-Way Handshake See Figure TCP Sliding Window TCP communication uses windowing, meaning that one or more segments are sent at one time, and a receiver can acknowledge the receipt of all segments in a window with a single acknowledgment. MSS (Maximum Segment Size) : is the amount of data that can be contained in a single TCP segment. The value is dependent on the current TCP window size. Note : The term MSS seems to imply the size of the entire Layer 4 segment (that is, including Layer 2, Layer 3, and Layer 4 headers). However, MSS only refers to the amount of data in a segment. Our-of-Order Delivery Imagine that some packets in a traffic flow might go out one interface, while other packets go out of another interface. In this case, there is a chance that the packets will arrive out of order. Fortunately, TCP can help prevent out-of-order packets by either sequencing them in the correct order or by requesting the retransmission of out-of-order packets. UDP Characteristics See Figure

11 Because a UDP segment header is so much smaller than a TCP segment header, UDP becomes a good candidate for the transport layer protocol serving applications that need to maximize bandwidth and do not require acknowledgments (for example, audio or video streams). In fact, the primary protocol used to carry voice and video traffic, Realtime Transport Protocol (RTP), is a Layer 4 protocol that is encapsulated inside of UDP. RTP : Realtime Transport Protocol, Layer 4 protocol. Network Migration Strategies Routing Protocol Changes There are two common approaches to routing protocol migration: Using Administrative Distance (AD) : First, when you do your configuration of the new routing protocol, you should make sure that it has a higher AD that the existing one. With this approach, new routing protocol has successfully learned all the routes. After that, when you convinced that the new routing protocol is configured appropriately, you can adjust the AD. Using Route Redistribution : This is the another approach of the migration. IPv6 Migration There are two kinds of IP networks: those that have already migrated to IPv6, and those that will migrate to IPv6. There are a few strategies to consider when migrating from IPv4 to IPv6: Check Equipment fo IPv6 Compatibility : You should check your existing network devices for IPv6. In some cases, you might be able to upgrade the Cisco IOS on your existing gear to add IPv6 support. Run IPv4 and IPv6 Concurrently : You can use dual-stack configuration meaning that IPv4 and IPv6 works together. Check the ISP s IPv6 Support : Configure NAT64 : You might have an IPv6 host that needs to communicate with an IPv4 host. One approach to allow this is to use NAT64. NAT64 allows IPv6 addresses to be translated into corresponding IPv4 addresses, thus permitting communication between an IPv4 host and an IPv6 host. There are two kind of translations for this: stateless translation, stateful translation. Stateless translation: maintains a mapping table that specifies which IPv4 address corresponds to an IPv6 address. This configuration is not very scalable. If you have very small of IPv4 hosts you can use it. Stateful translation: allows a dynamic IPv6-to-IPv4 address. Use NPTv6 (Network Prefix Translation : This simply translates one IPv6 prefix to another. Note that many IPv6 networks will have no need for NPTv6. Send IPv6 Traffic Over an IPv6-over-IPv4 Tunnel : Routers at each end of the tunnel can run both IPv4 and IPv6 and can encapsulate IPv6 traffic inside of the IPv4 tunnel packets, thus allowing IPv6 traffic to traverse an IPv4-only portion of the network. Spanning Tree Protocol Migration Typically, the optimal type of STP to run on today s Cisco Catalyst switches is Rapid Per-VLAN STP+. This allows much more faster convergence. Another benefit of running Rapid-PVST+ is that it allows each VLAN to run its own instance of STP, as opposed to all VLANs using the same stp topology (which could lead to suboptimal paths for some VLANs). If you use Rapid-PVST+ on Cisco switches, you can remove the following features, because similar features are built into Rapid-PVST+: UplinkFast BackboneFast On the other hand, you dont have to remove the following features, because they are still function: PortFast BPDU Guard BPDU Filter Root Guard 11

12 Loop Guard Migration to Easy Virtual Networking (EVN) Cisco supports a technology called Virtual Routing and Forwarding (VRF), which allows a single router to run multiple virtual router instances. Each virtual router instance can have its own configuration and its own IP routing process. VRF-Lite : A traditional way to configure VRF on Cisco routers. Cisco Easy Virtual Network (EVN) : A newer approach to virtualized network configuration. It dramatically simplifies the relatively complex configuration required by VRF-Lite. An EVN uses a Virtual Network Trunk (VNET Trunk) to carry traffic for each virtual network, and eliminates the need to manually configure a subinterface for each virtual network on all routers. See Figure Route Replication: There is an occasional need for one of the virtual network to be accessible by other virtual networks. Normally, these networks are seperate. Cisco EVN makes this possible through a service called Route Replication. It allows IP routes known to one virtual network to be known to other virtual networks. See Figure

13 PART I Chapter 2 FOUNDATION TOPICS Remote Connectivity Overview FUNDAMENTAL ROUTING CONCEPTS Remote Site Connectivity MPLS-Based Virtual Private Networks Multiporotocol Label Switching (MPLS) is a technology commonly used by service providers although many large enterprises also use MPLS for their backbone network. MPLS makes forwarding decisions based on labels rather than IP addresses. A 32-bit label is inserted between a frame s Layer 2 and Layer 3 headers. MPLS header is often called a shim header, because it is stuck in between two existing headers. There are two primary categories for MPLS-based VPN: Layer 2 MPLS VPNs Layer 3 MPLS VPNs Tunnel-Based Virtual Private Networks A tunnel is a virtual connection that can physically span multiple router hops. However, from the perspective of the traffic flowing through the tunnel, the transit from one end of a tunnel to the other appears to be a single router hop. Tunnel-Based VPNs are: Generic Routing Encapsulation (GRE) Dynamic Multipoint VNP (DMVPN) Multipoint GRE IPsec Hybrid Virtual Private Networks You could meet the requirements of such a design by having a Layer 3 MPLS VPN set u over a DMVPN. When it comes to hybrid VPNs, a significant design consideration is overhead. Everytime you add an encapsulation, you are adding to the total header size of the packet. With more headers, the amount of data you can carry inside a single packet is decreased. As a result, you might have to configure a lower maximum transmission unit (MTU) size for frames on an interface. MPLS VPN These VPNs, most commonly found in service provider or large enterprise networks, can be categorized as either Layer 2 MPLS VPNs or Layer 3 MPLS VPNs. Layer 2 MPLS VPN With a Layer 2 MPLS VPN, the MPLS network allws customer edge (CE) routers at different sites to form routing protocol neighborships with one another as if they were Layer 2 adjacent. See Figure

14 Layer 3 MPLS VPN With a Layer 3 MPLS VPN, a service provider s provider edge (PE) router (also known) as an Edge Label Switch Router (ELSR) establishes a peering relationship with a CE router. See Figure 2-2. Routes learned from the CE router are then sent to the remote PE router in the MPLS cloud (typically using multiprotocol BGP(MP-BDP), where they are sent out to the remote CE router. GRE Generic Routing Encapsulation GRE tunnel can encapsulate nearly every type of data that you could send out of a physical router interface. In fact, GRE can encapsulate any Layer 3 protocol, which makes it very flexible. GRE by itself does not provide any security for the data it transmits; however, a GRE packet can be sent over an IPsec VPN, causing the GRE packet (and therefore its contents) to be protected. A GRE tunnel can encapsulate IP multicast packets. The resulting GRE packet is an IP unicast packet, which can then be protected by na IPsec tunnel. For the GRE over IPsec tunnel please see Figure

15 Example Topology Configuration and Verification: (See Figure 2-4) ROUTER R1: R1#configure terminal R1(config)#interface tunnel1 R1(config-if)#ip address R1(config-if)#tunnel source loopback0 R1(config-if)#tunnel destination R1(config-if)#end ROUTER R2: R2#configure terminal R2(config)#interface tunnel1 R2(config-if)#ip address R2(config-if)#tunnel source loopback0 R2(config-if)#tunnel destination R2(config-if)#end R1#show intercafes tunnel 1 Tunnel is up, line protocol is up Encapsulation TUNNEL R1#traceroute msec 100 msec 108 msec This shows that is logically a single hop away from R1 even though it is physically 3 hops away. DMVPN Dynamic Multipoint VPN 15

16 A more economical solution to providing optimal pathing necessitating a full-mesh topology is the DMVPN feature. DMVPN allows a VPN tunnel to be dynamically created and torn down between two remote sites on an as-needed basis. See Figure 2-5. From a troubleshooting perspective, a common issue experienced with DMVPN networks is flapping (that is, the DMVPN tunnel is repeatedly torn down and reestablished). When experiencing such an issue, Cisco recommends you check the routing protocol neighborship between the routers at each end of the DMVPN. If it is not always up, the DMVPN might flap. Multipoing GRE See Figure 2-6 and Figure 2-7. Multipoint GRE allows a router to support multiple GRE tunnels on a single GRE interface. Some GRE characteristics are: mgre can transport a wide variety of protocol (IP unicast, multicast, broadcast) like GRE. In a hub-and-spoke topology, a hub router can have a single mgre interface, and multiple tunnels can use that single interface. An interface configured for mgre is able to dynamically form a GRE tunnel by using Next Hop Resolution Protocol (NHRP) to discover the IP address of device at the far end of the tunnel. In the hub-and-spoke topology, only the hub router is configured with an mgre interface. In the spoke-to-spoke topology, each router has an mgre interface, which allows the sites in the network to interconnect using partial mesh or a full mesh collection of tunnels. NHRP Next Hop Resolution Protocol 16