Top-Down Network Design

Transcription

1 Top-Down Network Design Chapter Six Designing Models for Addressing and Naming Original slides copyright by Cisco Press & Priscilla Oppenheimer

2 General Guidelines for Addressing and Naming Use a structured model for addressing and naming Assign addresses and names hierarchically Decide in advance if you will use Central or distributed authority for addressing and naming Public or private addressing Static or dynamic addressing and naming

3 Simple rules for network layer addressing Design a structured model for addressing before assigning any addresses. Leave room for growth in the addressing model. If you do not plan for growth, you might later have to renumber many devices, which is labor-intensive. Assign blocks of addresses in a hierarchical fashion to foster good scalability and availability. Assign blocks of addresses based on the physical network, not on group membership, to avoid problems when groups or individuals move. If the level of network management expertise in regional and branch offices is high, you can delegate authority for addressing regional and branch-office networks, subnets, servers, and end systems. To maximize flexibility and minimize configuration, use dynamic addressing for end systems. To maximize security and adaptability, use private addresses with Network Address Translation (NAT) in IP environments.

4 Advantages of Structured Models for Addressing & Naming It makes it easier to Read network maps Operate network management software Troubleshoot Recognize devices in protocol analyzer traces Meet goals for usability Design filters on firewalls and routers Implement route summarization

5 When there is no model for addressing Duplicate network and host addresses Illegal addresses that cannot be routed on the Internet Not enough addresses in total, or by group Addressees that cannot be used, and so are wasted

6 Questions regarding public versus private addresses Are public, private, or are both address types required? How many end systems need access to the private network only? How many end systems need to be visible to the public network also? How will translation between private and public addresses occur? Where in the network topology will the boundary between private and public addresses exist?

7 Public IP Addresses Managed by the Internet Assigned Numbers Authority (IANA) Users are assigned IP addresses by Internet service providers (ISPs). ISPs obtain allocations of IP addresses from their appropriate Regional Internet Registry (RIR)

8 Regional Internet Registries (RIR) APNIC (Asia Pacific Network Information Centre) Asia/Pacific Region ARIN (American Registry for Internet Numbers) North America and Sub-Sahara Africa LACNIC (Regional Latin-American and Caribbean IP Address Registry) Latin America and some Caribbean Islands RIPE NCC (Réseaux IP Européens) Europe, the Middle East, Central Asia, and African countries located north of the equator

9 Distributing Authority for Addressing If addressing and configuration will be carried out by inexperienced network administrators, you should keep the model simple If there is a shortage of network administrators, (which there is in many organizations), then simplicity is important as well as minimizing the amount of configuration required In these situations, dynamic addressing is a good recommendation, where very little, if any, configuration is necessary If network administrators in regional and branch offices are inexperienced, you might consider not delegating authority for addressing and naming. A lot of small and medium-size companies maintain strict control of addressing and naming at a corporate (centralized) level Maintaining strict control avoids mistakes that can cause user frustration and network failures

10 Criteria for Static vs Dynamic Addressing The number of end systems When there are more than about 30 systems, dynamic addressing is usually preferable. Renumbering If it is likely you will need to renumber systems in the future and there are many end systems, dynamic address assignment is the better choice Renumbering for public addresses will become necessary if a new ISP is selected In addition, you may plan to renumber because the current plan is not well structured or will run out of numbers soon. High availability Statically assigned IP addresses are available anytime. Dynamically assigned IP addresses have to be acquired from a server first. If the server fails, an address cannot be acquired. To avoid this problem, you can deploy redundant DHCP servers or use static addresses.

11 Criteria for Static vs Dynamic Addressing Security With dynamic address assignment, in most cases, any device that connects to the network can acquire a valid address. This imposes some security risk and may mean that dynamic addressing is not appropriate for a company with a very strict security policy. Address tracking If a management or security policy requires that addresses be tracked, static addressing might be easier to implement than dynamic addressing. Additional parameters If end systems need information beyond an address, dynamic addressing is useful because a server can provide additional parameters to clients along with the address. For example, a DHCP server provides a subnet mask, a default gateway, and optional information such as one or more name server addresses, including Domain Name System (DNS) and Windows Internet Naming Service (WINS) server addresses.

12 IP Dynamic Addressing When the IP protocols were first developed, a network administrator was required to configure each host with its unique IP address. In the mid-1980s, protocols were developed to support diskless stations dynamically learning an address, which was necessary because a diskless station has no storage for saving a configuration. These protocols included the Reverse Address Resolution Protocol (RARP) and BOOTP BOOTP has evolved into DHCP, which has gained considerable popularity since the late 1990s. RARP is limited in scope; the only information returned to a station using RARP is its IP address BOOTP is more sophisticated than RARP, and optionally returns additional information, including the address of the default gateway, the name of a boot file to download, and 64 bytes of vendor-specific information.

13 The Dynamic Host Configuration Protocol DHCP is based on BOOTP BOOTP hosts can interoperate with DHCP hosts, although DHCP adds many enhancements to BOOTP, including a larger vendorspecific information field (called the options field in DHCP) and the automatic allocation of reusable network layer addresses DHCP has bypassed BOOTP in popularity, because it is easier to configure. Unlike BOOTP, DHCP does not require a network administrator to maintain a MAC-to-IP address table. DHCP uses a client/server model. Servers allocate network layer addresses and save information about which addresses have been allocated. Clients dynamically request configuration parameters from servers. The goal of DHCP is that clients should require no manual configuration. In addition, the network manager should not have to enter any per-client configuration parameters into servers.

14 DHCP supports three methods for IP address allocation Automatic allocation A DHCP server assigns a permanent IP address to a client. Dynamic allocation A DHCP server assigns an IP address to a client for a limited period of time, called a lease Manual allocation A network administrator assigns a permanent IP address to a client, and DHCP is used simply to convey the assigned address to the client

15 Dynamic allocation in DHCP Dynamic allocation is the most popular method, partly because its reallocation feature supports environments where hosts are not online all the time, and there are more hosts than addresses. With dynamic allocation, a client requests the use of an address for a limited period of time. The period of time is called a lease. The allocation mechanism guarantees not to reallocate that address within the requested time, and attempts to return the same network layer address each time the client requests an address. The client may extend its lease with subsequent requests. The client may choose to relinquish its lease by sending a DHCP release message to the server. The allocation mechanism can reuse an address if the lease for the address has expired. As a consistency check, the allocating server should probe the reused address before allocating the address. It can do this with an Internet Control Message Protocol (ICMP) echo request (also known as a ping packet). The client should also probe the newly received address. It can do this with a ping packet or an Address Resolution Protocol (ARP) request.

16 DHCP steps When a client boots, it broadcasts a DHCP discover message on its local subnet. A station that has previously received a network layer address and lease can include them in the DHCP discover message to suggest that they be used again. A router can pass the DHCP discover message on to DHCP servers not on the same physical subnet to avoid a requirement that a DHCP server reside on each subnet. (The router acts as a DHCP relay agent.) Each server responds to the DHCP request with a DHCP offer message that includes an available network layer address in the your address (yiaddr) field. The DHCP offer message can include additional configuration parameters in the options field. After the client receives DHCP offer messages from one or more servers, the client chooses one server from which to request configuration parameters. The client broadcasts a DHCP request message that includes the server identifier option to indicate which server it has selected. This DHCP request message is broadcast and relayed through routers if necessary.

17 DHCP steps The server selected in the DHCP request message commits the configuration parameters for the client to persistent storage and responds with a DHCP ACK message, containing the configuration parameters for the requesting client. If a client receives no DHCP offer or DHCP ACK messages, the client times out and retransmits the DHCP discover and request messages. To avoid synchronicity and excessive network traffic, the client uses a randomized exponential backoff algorithm to determine the delay between retransmissions. The delay between retransmissions should be chosen to allow sufficient time for replies from the server, based on the characteristics of the network between the client and server. For example, on a 10-Mbps Ethernet network, the delay before the first retransmission should be 4 seconds, randomized by the value of a uniform random number chosen from the range 1 to +1. The delay before the next retransmission should be 8 seconds, randomized by the value of a uniform number chosen from the range 1 to +1. The retransmission delay should be doubled with subsequent retransmissions up to a maximum of 64 seconds.

18 Private Addressing Private IP addresses are addresses that an enterprise network administrator assigns to internal networks and hosts without any coordination from an ISP or one of the regional registries An ISP or the registry provides public addresses for web servers or other servers that external users access, but public addresses are not necessary for internal hosts and networks Addressing for internal hosts that need access to outside services, such as , FTP, or web servers, can be handled by a Network Address Translation (NAT) gateway IETF reserves the following numbers for addressing nodes on internal private networks

19 Benefits of Private Addressing Security Private network numbers are not advertised to the Internet. In fact, private network numbers must not be advertised to the Internet because they are not globally unique. By not advertising private internal network numbers, a modicum of security is achieved. Adaptability and flexibility Using private addressing makes is easier to change ISPs in the future. If private addressing has been used, when moving to a new ISP, the only address changes required are in the router or firewall providing NAT services and in any public servers. Advertise just one network number, or a small block of network numbers, to the Internet One of the goals of modern Internet practices is that Internet routers should not need to manage huge routing tables. As an enterprise network grows, the network manager can assign private addresses to new networks, rather than requesting additional public network numbers from an ISP or registry. Saves address space During the mid-1990s, as the Internet became commercialized and popularized, a scare rippled through the Internet community regarding the shortage of addresses. Many companies (and many ISPs) were given a small set of addresses that needed to be carefully managed to avoid depletion.

20 Drawbacks of Private Addressing Outsourcing network management is difficult When a company delegates network management responsibility to an outside company, the outside company typically sets up network consoles at its own site that communicate with internetworking devices inside the client's network. With private addressing, however, the consoles cannot reach the client's devices, because no routes to internal networks are advertised to the outside. NAT can be used to translate the private addresses to public addresses, but then there may be problems with interoperability between NAT and network management protocols such as the Simple Network Management Protocol (SNMP). Difficulty of communicating with partners, vendors, suppliers, and so on Because the partner companies are also probably using private addresses, building extranets becomes more difficult. Also, companies that merge with each other face a difficult chore of renumbering any duplicate addresses caused by both companies using the same private addresses. May forget to use a structured model with the private addresses Enterprise network managers, who were once starved for addresses that were carefully doled out by ISPs and the registries, get excited when they move to private addressing and have all of network at their disposal. The excitement should not overshadow the need to assign the new address space in a structured, hierarchical fashion. Hierarchical addressing facilitates route summarization within the enterprise network, which decreases bandwidth consumption by routing protocols, reduces processing on routers, and enhances network resiliency.

21 Network Address Translation Network Address Translation (NAT) converts addresses from an inside network to addresses that are appropriate for an outside network, and vice versa. NAT is useful when hosts that need access to Internet services have private addresses NAT functionality can be implemented in a separate appliance, router, or firewall. The NAT administrator configures a pool of outside addresses that can be used for translation. When an inside host sends a packet, the source address is translated dynamically to an address from the pool of outside addresses. NAT also has a provision for static addresses for servers that need a fixed address for example, a web or mail server that must always map to the same well-known address Some NAT products also offer port translation for mapping several addresses to the same address (port NAT) With port translation, all traffic from an enterprise has the same address Port numbers are used to distinguish separate conversations Port translation reduces the number of required outside addresses Port translation is sometimes called overloading addresses.

22 Network Address Translation When using NAT, all traffic between an enterprise network and the Internet must go through the NAT gateway NAT gateway has superior throughput and low delay, particularly if enterprise users depend on Internet video or voice applications. The NAT gateway should have a fast processor that can examine and change packets very quickly Keep in mind that, in addition to modifying IP addresses, a NAT gateway must modify the IP, TCP, and UDP checksums. (The checksums for TCP and UDP cover a pseudo header that contains source and destination IP addresses.) In many cases, NAT must also modify IP addresses that occur inside the data part of a packet. IP addresses can appear in ICMP, FTP, DNS, SNMP, and other types of packets. Because NAT has the job of translating network layer addresses, it can be tricky to guarantee correct behavior with all applications A NAT gateway should be thoroughly tested in a pilot environment before it is generally deployed

23 Network Address Translation NAT Box (router) takes over the task of the translation Provides transparent IP-level access to internet from a host with a private address NAT Translation Table Creation Manual initialization Outgoing datagrams (records internal host source address and destination address-what about the case where two internal hosts contact the same external host?) Incoming name lookups (a record is created for each lookup and all internal hosts appear to the external world a having the same globally valid IP address of the gateway) 1-to-1 mapping vs multi address NAT For each foreign internet address there are up to k global valid internet addresses (G1, G2,,Gk)

24 Port-mapped NAT Private Address Private Port External Address External Port NAT Port Protocol tcp tcp tcp tcp Internal Datagrams ( , 21023, , 80) ( , 386, , 80) External Datagrams (Unique addr, 14003, , 80) (Unique addr, 14010, , 80)

25 Other NAT issues Interaction between NAT and ICMP What about an incoming ICMP redirect or ICMP destination unreachable message? Interaction between NAT and Applications What about Applications (like FTP) that carry port numbers Changing data values in segments is not the best way to solve the translation problem because On one hand, NAT becomes aware of the application which is not acceptable On the other hand, adding octets in the data stream renders sequence numbers of the segments invalid

26 The Two Parts of an IP Address 32 Bits Prefix Host Prefix Length

27 IP Address Classes Classes are now considered obsolete But you have to learn them because Everyone in the industry still talks about them! You may run into a device whose configuration is affected by the classful system

28 Classful IP Addressing Class First First Byte Prefix Intent Few Bits Length A * 8 Very large networks B Large networks C Small networks D NA IP multicast E NA Experimental *Addresses starting with 127 are reserved for IP traffic local to a host.

29 Division of the Classful Address Space Class Prefix Number of Addresses Length per Network A = 16,777,214 B = 65,534 C = 254

30 Classful IP is Wasteful Class A uses 50% of address space Class B uses 25% of address space Class C uses 12.5% of address space Class D and E use 12.5% of address space

31 Prefix Length An IP address is accompanied by an indication of the prefix length Subnet mask /Length Examples /24

32 Subnet Mask 32 bits long Specifies which part of an IP address is the network/subnet field and which part is the host field The network/subnet portion of the mask is all 1s in binary. The host portion of the mask is all 0s in binary. Convert the binary expression back to dotted-decimal notation for entering into configurations. Alternative Use slash notation (for example /24) Specifies the number of 1s

33 Subnet Mask Example What is this in slash notation? What is this in dotted-decimal notation?

34 Another Subnet Mask Example What is this in slash notation? What is this in dotted-decimal notation?

35 One More Subnet Mask Example What is this in slash notation? What is this in dotted-decimal notation?

36 Designing Networks with Subnets Determining subnet size Computing subnet mask Computing IP addresses

37 Addresses to Avoid When Subnetting A node address of all ones (broadcast) A node address of all zeros (network) The next ones are allowed by the subnet standard A subnet address of all ones (all subnets) A subnet address of all zeros (confusing)

38 Practice Network is You want to divide the network into subnets. You will allow 600 nodes per subnet. What subnet mask should you use? What is the address of the first node on the first subnet? What address would this node use to send to all devices on its subnet?

39 More Practice Network is You have eight LANs, each of which will be its own subnet. What subnet mask should you use? What is the address of the first node on the first subnet? What address would this node use to send to all devices on its subnet?

40 One More Network is You want to divide the network into subnets. You will have approximately 25 nodes per subnet. What subnet mask should you use? What is the address of the last node on the last subnet? What address would this node use to send to all devices on its subnet?

41 Addressing example

42 Addressing example Step One. Count hosts on each subnet, and refer back to the chart showing how many addresses can be assigned for each prefix length. Two of the branch offices have 20 hosts (21 including the router), and the other has 25 hosts (26 including the router). Each of these subnets will require a /27 prefix, since these can handle up to 30 addresses. Of the headquarters subnets, the one with 30 hosts will require another /27, the one with 50 hosts will require a /26, and the two 10 host subnets each require a /28. The three WAN links, each requiring a /30, and the Ethernet connecting the two routers together, which also requires a /30. However, since more hosts might later be added to the Ethernet, we'll assign it a /29 for expansion purposes. Step Two. Assign largest subnets first. The largest subnet is the headquarters subnet with 50 hosts, requiring a /26 prefix. We'll assign to it /26, using numbers from 0 to 63 in the fourth byte. Next we need four /27s (one in the headquarters, and one for each of the branch offices). We'll assign /27, /27, /27, and /27. We've now used numbers from 0 to 191 in the fourth byte. The two /28s will be /28 and /28. That leaves /29 for the Ethernet between the two headquarters routers, and the remaining address space for the three WAN links: /30, /30 and /30.

43 Classless Addressing Prefix/host boundary can be anywhere Less wasteful Supports route summarization Also known as Aggregation Supernetting Classless routing Classless inter-domain routing (CIDR) Prefix routing

44 Supernetting Branch-Office Router Branch-Office Networks Enterprise Core Network Move prefix boundary to the left Branch office advertises /14

45 /14 Summarization Second Octet in Decimal Second Octet in Binary

46 Rules for route summarization The number of subnets to be summarized must be a power of 2 (for example, 2, 4, 8, 16, 32, and so on). The relevant octet in the first address in the block to be summarized must be a multiple of the number of subnets. The following network numbers are defined at a branch office. Can they be summarized? The number of subnets is 8, which is a power of 2, so the first condition is met. The relevant octet (third in this case) is 48, which is a multiple of the number of subnets The subnets can be summarized as /21

47 Discontiguous Subnets Area 0 Network Router A Router B Area 1 Subnets Area 2 Subnets

48 Discontiguous Subnets Classful routing protocols automatically summarize subnets. One side-effect of this is that discontiguous subnets are not supported Subnets must be next to each other that is, contiguous. With a classful routing protocol such as RIP version 1 or IGRP, Router A advertises that it can get to network Router B ignores this advertisement, because it can already get to network The opposite is also true: Router B advertises that it can get to network , but Router A ignores this information This means that the routers cannot reach remote subnets of network

49 A Mobile Host Router A Router B Subnets Host

50 Guidelines for Assigning Names Names should be Short Meaningful Unambiguous Distinct Case insensitive Avoid names with unusual characters Hyphens, underscores, asterisks, and so on

51 Domain Name System (DNS) Maps names to IP addresses Supports hierarchical naming example: frodo.rivendell.middle-earth.com A DNS server has a database of resource records (RRs) that maps names to addresses in the server s zone of authority Client queries server Uses UDP port 53 for name queries and replies Uses TCP port 53 for zone transfers

52 DNS Details Client/server model Client is configured with the IP address of a DNS server Manually or DHCP can provide the address DNS resolver software on the client machine sends a query to the DNS server. Client may ask for recursive lookup.

53 DNS Recursion A DNS server may offer recursion, which allows the server to ask other servers Each server is configured with the IP address of one or more root DNS servers. When a DNS server receives a response from another server, it replies to the resolver client software. The server also caches the information for future requests. The network administrator of the authoritative DNS server for a name defines the length of time that a nonauthoritative server may cache information.