¡GoConqr estrena diseño! Cuéntanos qué te parece.

Fichas

E3_5 Single-Area OSPF

John Dedios CCNA CCNA Español 76 fichas

E3_5  Single-Area OSPF

Fichas del conjunto (76)

  1. 1Static Routing Static routing has three primary uses: * Providing ease of routing table maintenance in smaller networks that are not expected to grow significantly. * Routing to and from stub networks. A stub network is a network accessed by a single route, and the router has only one neighbor. * Using a single default route to represent a path to any network that does not have a more specific match with another route in the routing table. Default routes are used to send traffic to any destination beyond the next upstream router.Static Routing Static routing has three primary uses: * Providing ease of routing table maintenance in smaller networks that are not expe...
  2. 2Dynamic Routing A primary benefit of dynamic routing protocols is that routers exchange routing information when there is a topology change. This exchange allows routers to automatically learn about new networks and also to find alternate paths when there is a link failure to a current network. Compared to static routing, dynamic routing protocols require less administrative overhead. However, the expense of using dynamic routing protocols is dedicating part of a router’s resources for protocol operation, including CPU time and network link bandwidth.Dynamic Routing A primary benefit of dynamic routing protocols is that routers exchange routing information when there is a topology chan...
  3. 3Open Shortest Path First OSPF is a commonly implemented link-state routing protocol. It was developed as a replacement for the distance vector routing protocol, RIP. 1. Classless - It is classless by design; therefore, it supports VLSM and CIDR. 2. Efficient - Routing changes trigger routing updates (no periodic updates). It uses the SPF algorithm to choose the best path.3. Fast convergence - It quickly propagates network changes.
    4. Scalable - It works well in small and large network sizes. Routers can be grouped into areas to support a hierarchical system.
    5. Secure - It supports Message Digest 5 (MD5) authentication. When enabled, OSPF routers only accept encrypted routing updates from peers with the same pre-shared password.
  4. 4Configuring Single-Area OSPF Ej]: the Gigabit Ethernet 0/0 interface of R1 is configured to reflect its true bandwidth of 1,000,000 kilobits (i.e.1,000,000,000 b/s). Next, from OSPF router configuration mode, the router ID is assigned, the reference bandwidth is adjusted to account for fast interfaces, and the three networks attached to R1 are advertised. Notice how the wildcard mask is used to identify the specific networks.Configuring Single-Area OSPF Ej]: the Gigabit Ethernet 0/0 interface of R1 is configured to reflect its true bandwidth of 1,000,000 kilob...
  5. 5Configuring Single-Area OSPF Ej]: the Gigabit Ethernet 0/0 interface of R2 is also configured to reflect its true bandwidth, the router ID is assigned, the reference bandwidth is adjusted to account for fast interfaces, and the three networks attached to R2 are advertised. ** Notice how the use of the wildcard mask can be avoided by identifying the actual router interface with a quad zero mask. This effectively makes OSPF use the subnet mask assigned to the router interface as the advertised network maskConfiguring Single-Area OSPF Ej]: the Gigabit Ethernet 0/0 interface of R2 is also configured to reflect its true bandwidth, the router I...
  6. 6Verifying Single-Area OSPF " show ip ospf neighbor " Command to verify that the router has formed an adjacency with its neighboring routers. If the router ID of the neighboring router is not displayed, or if it does not show as being in a state of FULL, the two routers have not formed an OSPF adjacency.Verifying Single-Area OSPF " show ip ospf neighbor " Command to verify that the router has formed an adjacency with its neighboring route...
  7. 7Verifying Single-Area OSPF " show ip protocols" - Command provides a quick way to verify vital OSPF configuration information. This includes the OSPF process ID, the router ID, networks the router is advertising, the neighbors the router is receiving updates from, and the default administrative distance, which is 110 for OSPF.Verifying Single-Area OSPF " show ip protocols" - Command provides a quick way to verify vital OSPF configuration information. This inclu...
  8. 8Verifying Single-Area OSPF " show ip ospf " Command is used to display the OSPF process ID and router ID as well as the OSPF SPF and OSPF area information.Verifying Single-Area OSPF " show ip ospf " Command is used to display the OSPF process ID and router ID as well as the OSPF SPF and OSPF...
  9. 9Verifying Single-Area OSPF " show ip ospf interface" - Command provides a detailed list for every OSPF-enabled interface and is very useful to determine whether the network statements were correctly composed.Verifying Single-Area OSPF " show ip ospf interface" - Command provides a detailed list for every OSPF-enabled interface and is very usef...
  10. 10Verifying Single-Area OSPF " show ip ospf interface brief " - Command is useful to display a summary and status of OSPF-enabled interfaces.Verifying Single-Area OSPF " show ip ospf interface brief " - Command is useful to display a summary and status of OSPF-enabled interfaces.
  11. 11Configuring Single-Area OSPFv3 Ej: from OSPFv3 router configuration mode on R2, the router ID is manually assigned and the reference bandwidth is adjusted to account for fast interfaces. ** Next the interfaces participating in OSPFv3 are configured. Again, the Gigabit Ethernet 0/0 is also configured to reflect its true bandwidth. Notice the informational messages displaying that R3 has established a full neighbor adjacency with R1 with router ID 1.1.1.1 and R2 with router ID 2.2.2.2. The OSPFv3 network has converged.Configuring Single-Area OSPFv3 Ej: from OSPFv3 router configuration mode on R2, the router ID is manually assigned and the reference band...
  12. 12Verifying Single-Area OSPFv3 "show ipv6 ospf neighbor" - Command to verify that the router has formed an adjacency with its neighboring routers. If the router ID of the neighboring router is not displayed, or if it does not show as being in a state of FULL, the two routers have not formed an OSPF adjacency.Verifying Single-Area OSPFv3 "show ipv6 ospf neighbor" - Command to verify that the router has formed an adjacency with its neighboring r...
  13. 13Verifying Single-Area OSPFv3 " show ipv6 protocols" - Command provides a quick way to verify vital OSPFv3 configuration information, including the OSPF process ID, the router ID, and the interfaces enabled for OSPFv3.Verifying Single-Area OSPFv3 " show ipv6 protocols" - Command provides a quick way to verify vital OSPFv3 configuration information, incl...
  14. 14Verifying Single-Area OSPFv3 " show ipv6 route ospf" - Command provides specifics about OSPFv3 routes in the routing tableVerifying Single-Area OSPFv3 " show ipv6 route ospf" - Command provides specifics about OSPFv3 routes in the routing table
  15. 15Verifying Single-Area OSPFv3 " show ipv6 ospf interface brief" - Command is useful to display a summary and status of OSPFv3 enabled interfaces.Verifying Single-Area OSPFv3 " show ipv6 ospf interface brief" - Command is useful to display a summary and status of OSPFv3 enabled inte...
  16. 16OSPF Network Types OSPF defines five network types: 1. Point-to-point - Two routers interconnected over a common link. No other routers are on the link. This is often the configuration in WAN links.OSPF Network Types OSPF defines five network types: 1. Point-to-point - Two routers interconnected over a common link. No other routers a...
  17. 17OSPF Network Types OSPF defines five network types: 2. Broadcast multiaccess - Multiple routers interconnected over an Ethernet network..OSPF Network Types OSPF defines five network types: 2. Broadcast multiaccess - Multiple routers interconnected over an Ethernet network..
  18. 18OSPF Network Types OSPF defines five network types: 3. Nonbroadcast multiaccess (NBMA) - Multiple routers interconnected in a network that does not allow broadcasts, such as Frame Relay.OSPF Network Types OSPF defines five network types: 3. Nonbroadcast multiaccess (NBMA) - Multiple routers interconnected in a network tha...
  19. 19OSPF Network Types OSPF defines five network types: 4. Point-to-multipoint - Multiple routers interconnected in a hub-and-spoke topology over an NBMA network. Often used to connect branch sites (spokes) to a central site (hub).OSPF Network Types OSPF defines five network types: 4. Point-to-multipoint - Multiple routers interconnected in a hub-and-spoke topology ...
  20. 20OSPF Network Types OSPF defines five network types: 5. Virtual links - Special OSPF network used to interconnect distant OSPF areas to the backbone area.OSPF Network Types OSPF defines five network types: 5. Virtual links - Special OSPF network used to interconnect distant OSPF areas to th...
  21. 21Challenges in Multiaccess Networks Multiaccess networks can create two challenges for OSPF regarding the flooding of LSAs: * Creation of multiple adjacencies - Creating adjacencies with every router is unnecessary and undesirable. This would lead to an excessive number of LSAs exchanged between routers on the same network. * Extensive flooding of LSAs - Link-state routers flood their link-state packets when OSPF is initialized, or when there is a change in the topology. This flooding can become excessive. Ej: that as routers are added to the network, the number of adjacencies increases dramatically.Challenges in Multiaccess Networks Multiaccess networks can create two challenges for OSPF regarding the flooding of LSAs: * Creation of ...
  22. 22Challenges in Multiaccess Networks The number of adjacencies required for any number of routers (designated as n) on a multiaccess network is: n (n – 1) / 2 Ej: a simple topology of four routers, all of which are attached to the same multiaccess Ethernet network. * Without some type of mechanism to reduce the number of adjacencies, collectively these routers would form six adjacencies: 4 (4 - 1) / 2 = 6Challenges in Multiaccess Networks The number of adjacencies required for any number of routers (designated as n) on a multiaccess networ...
  23. 23OSPF Designated Router The solution to managing the number of adjacencies and the flooding of LSAs on a multiaccess network is the DR. On multiaccess networks, OSPF elects a DR to be the collection and distribution point for LSAs sent and received. A BDR is also elected in case the DR fails. The BDR listens passively to this exchange and maintains a relationship with all the routers. If the DR stops producing Hello packets, the BDR promotes itself and assumes the role of DR. All other non-DR or BDR routers become DROTHER (a router that is neither the DR nor the BDR).OSPF Designated Router The solution to managing the number of adjacencies and the flooding of LSAs on a multiaccess network is the DR. On...
  24. 24OSPF Designated Router * Routers on a multiaccess network elect a DR and BDR. DROTHERs only form full adjacencies with the DR and BDR in the network. Instead of flooding LSAs to all routers in the network, DROTHERs only send their LSAs to the DR and BDR using the multicast address: 224.0.0.6 (all DR routers). Note: DR/BDR elections only occur in multiaccess networks and do not occur in point-to-point networks.The BDR also listens. The DR is responsible for forwarding the LSAs from R1 to all other routers. The DR uses the multicast address:
    224.0.0.5 (all OSPF routers).
    The end result is that there is only one router doing all of the flooding of all LSAs in the multiaccess network.
  25. 25Verifying DR/BDR Roles Because the routers are connected over a common multiaccess broadcast network, OSPF has automatically elected a DR and BDR. ** Ej: R3 has been elected as the DR because its router ID is 3.3.3.3, which is the highest in this network. R2 is the BDR because it has the second highest router ID in the network.Verifying DR/BDR Roles Because the routers are connected over a common multiaccess broadcast network, OSPF has automatically elected a DR...
  26. 26Verifying DR/BDR Roles " show ip ospf interface (interface)" Ej: The output generated by R1 confirms that: * R1 is not the DR or BDR, but is a DROTHER with a default priority of 1. (1) * The DR is R3 with router ID 3.3.3.3 at IP address 192.168.1.3, while the BDR is R2 with router ID 2.2.2.2 at IP address 192.168.1.2. (2) * R1 has two adjacencies: one with the BDR and one with the DR. (3)Verifying DR/BDR Roles " show ip ospf interface (interface)" Ej: The output generated by R1 confirms that: * R1 is not the DR or BDR, but...
  27. 27Verifying DR/BDR Roles " show ip ospf interface (interface)" Ej: The output generated by R2 confirms that: * R2 is the BDR with a default priority of 1. (1) * The DR is R3 with router ID 3.3.3.3 at IP address 192.168.1.3, while the BDR is R2 with router ID 2.2.2.2 at IP address 192.168.1.2. (2) * R2 has two adjacencies; one with a neighbor with router ID 1.1.1.1 (R1) and the other with the DR. (3)Verifying DR/BDR Roles " show ip ospf interface (interface)" Ej: The output generated by R2 confirms that: * R2 is the BDR with a default...
  28. 28Verifying DR/BDR Roles " show ip ospf interface (interface)" Ej: The output generated by R3 confirms that: * R3 is the DR with a default priority of 1. (1) * The DR is R3 with router ID 3.3.3.3 at IP address 192.168.1.3, while the BDR is R2 with router ID 2.2.2.2 at IP address 192.168.1.2. (2) * R3 has two adjacencies: one with a neighbor with router ID 1.1.1.1 (R1) and the other with the BDR. (3)Verifying DR/BDR Roles " show ip ospf interface (interface)" Ej: The output generated by R3 confirms that: * R3 is the DR with a default ...
  29. 29Verifying DR/BDR Adjacencies Unlike serial links that only display a state of FULL/-, the state of neighbors in multiaccess networks can be: 1. FULL/DROTHER - This is a DR or BDR router that is fully adjacent with a non-DR or BDR router. These two neighbors can exchange Hello packets, updates, queries, replies, and acknowledgments. 2. FULL/DR - The router is fully adjacent with the indicated DR neighbor. These two neighbors can exchange Hello packets, updates, queries, replies, and acknowledgments.Verifying DR/BDR Adjacencies Unlike serial links that only display a state of FULL/-, the state of neighbors in multiaccess networks can ...
  30. 30Verifying DR/BDR Adjacencies Unlike serial links that only display a state of FULL/-, the state of neighbors in multiaccess networks can be: 3. FULL/BDR - The router is fully adjacent with the indicated BDR neighbor. These two neighbors can exchange Hello packets, updates, queries, replies, and acknowledgments. 4. -WAY/DROTHER - The non-DR or BDR router has a neighbor relationship with another non-DR or BDR router. These two neighbors exchange Hello packets.Verifying DR/BDR Adjacencies Unlike serial links that only display a state of FULL/-, the state of neighbors in multiaccess networks can ...
  31. 31Verifying DR/BDR Adjacencies ** The normal state for an OSPF router is usually FULL. If a router is stuck in another state, it is an indication that there are problems in forming adjacencies. The only exception to this is the 2-WAY state, which is normal in a multiaccess broadcast network. DROTHERs will form a 2-WAY neighbor adjacency with any DROTHERs that join the network. This means that all DROTHER routers in the multiaccess network still receive Hello packets from all other DROTHER routers. In this way, they are aware of all routers in the network. When two DROTHER routers form a neighbor adjacency, the neighbor state displays as: 2-WAY/DROTHER.Verifying DR/BDR Adjacencies ** The normal state for an OSPF router is usually FULL. If a router is stuck in another state, it is an indi...
  32. 32Default DR/BDR Election Process 1. The routers in the network elect the router with the highest interface priority as the DR. The router with the second highest interface priority is elected as the BDR. The priority can be configured to be any number between 0 – 255. ** The higher the priority, the likelier the router will be selected as the DR. If the priority is set to 0, the router is not capable of becoming the DR. The default priority of multiaccess broadcast interfaces is 1. * Note: In an IPv6 network, if there are no IPv4 addresses configured on the router, then the router ID must be manually configured with the "router-id (rid)" command; otherwise, OSPFv3 does not start.2. If the interface priorities are equal, then the router with the highest router ID is elected the DR. The router with the second highest router ID is the BDR.
    Recall that the router ID is determined in one of three ways:
    a. The router ID can be manually configured.
    b. If no router IDs are configured, the router ID is determined by the highest loopback IP address.
    c. If no loopback interfaces are configured, the router ID is determined by the highest active IPv4 address.
  33. 33DR/BDR Election Process ** OSPF DR and BDR elections are not preemptive. If a new router with a higher priority or higher router ID is added to the network after the DR and BDR election, the newly added router does not take over the DR or the BDR role. This is because those roles have already been assigned. The addition of a new router does not initiate a new election process.After the DR is elected, it remains the DR until one of the following events occurs:
    * The DR fails
    * The OSPF process on the DR fails or is stopped
    * The multiaccess interface on the DR fails or is shutdown
  34. 34DR/BDR Election Process ** If the DR fails, the BDR is automatically promoted to DR. This is the case even if another DROTHER with a higher priority or router ID is added to the network after the initial DR/BDR election. ** However, after a BDR is promoted to DR, a new BDR election occurs and the DROTHER with the higher priority or router ID is elected as the new BDR. Ej: R2 has failed. The BDR (R1) automatically becomes the DR and an election process selects R4 as the BDR because it has the higher router IDDR/BDR Election Process ** If the DR fails, the BDR is automatically promoted to DR. This is the case even if another DROTHER with a high...
  35. 35The OSPF Priority * Instead of relying on the router ID, it is better to control the election by setting interface priorities. Priorities are an interface-specific value, which means it provides better control on a multiaccess network. This also allows a router to be the DR in one network and a DROTHER in another. To set the priority of an interface, use the following commands: * "ip ospf priority (value)" - OSPFv2 interface command * "ipv6 ospf priority (value)" - OSPFv3 interface commandThe value can be:
    ** 0 - Does not become a DR or BDR.
    * 1 – 255 - The higher the priority value, the more likely the router becomes the DR or BDR on the interface.
    ** If the interface priority is configured after OSPF is enabled, the administrator must shut down the OSPF process on all routers, and then re-enable the OSPF process, to force a new DR/BDR election.
  36. 36Changing the OSPF Priority Ej: changes the R1 interface Gigabit 0/0 priority from 1 to 255.Changing the OSPF Priority Ej: changes the R1 interface Gigabit 0/0 priority from 1 to 255.
  37. 37Changing the OSPF Priority The changes do not automatically take effect because the DR and BDR are already elected. Therefore, the OSPF election must be negotiated using one of the following methods: ** Shutdown the router interfaces and then re-enable them starting with the DR, then the BDR, and then all other routers. ** Reset the OSPF process using the "clear ip ospf process" privileged EXEC mode command on all routers.Changing the OSPF Priority The changes do not automatically take effect because the DR and BDR are already elected. Therefore, the OSPF e...
  38. 38Propagating a Default Static Route in OSPFv2 With OSPF, the router connected to the Internet is used to propagate a default route to other routers in the OSPF routing domain. This router is sometimes called the edge, the entrance, or the gateway router. ** However, in OSPF terminology, the router located between an OSPF routing domain and a non-OSPF network is also called the autonomous system boundary router (ASBR). Ej: R2 is single-homed to a service provider. Therefore, all that is required for R2 to reach the Internet is a default static route to the service provider.Propagating a Default Static Route in OSPFv2 With OSPF, the router connected to the Internet is used to propagate a default route to othe...
  39. 39Propagating a Default Static Route in OSPFv2 To propagate a default route, the edge router (R2) must be configured with: ** A default static route using the: ip route 0.0.0.0 0.0.0.0 {ip-address | exit-intf} Ej: The default-information originate router configuration mode command. This instructs R2 to be the source of the default route information and propagate the default static route in OSPF updates.Propagating a Default Static Route in OSPFv2 To propagate a default route, the edge router (R2) must be configured with: ** A default sta...
  40. 40Verifying the Propagated Default Route ** the route source is "O*E2" , signifying that it was learned using OSPF. The asterisk identifies this as a good candidate for the default route. The E2 designation identifies that it is an external route. ** External routes are either external type 1 or external type 2. The difference between the two is in the way the cost (metric) of the route is being calculated. The cost of a type 2 route is always the external cost, regardless of the interior cost to reach that route. A type 1 cost is the addition of the external cost and the internal cost used to reach that route. A type 1 route is always preferred over a type 2 route for the same destination.Verifying the Propagated Default Route ** the route source is "O*E2" , signifying that it was learned using OSPF. The asterisk identifies...
  41. 41Propagating a Default Static Route in OSPFv3 To propagate a default route, the edge router (R2) must be configured with: * A default static route using the: "ipv6 route ::/0 {ipv6-address | exit-intf}" * The "default-information originate" router configuration mode command. This instructs R2 to be the source of the default route information and propagate the default static route in OSPF updates.Propagating a Default Static Route in OSPFv3 To propagate a default route, the edge router (R2) must be configured with: * A default stat...
  42. 42Verifying the Propagated IPv6 Default Route * "OE2" signifying that it was learned using OSPFv3. The E2 designation identifies that it is external route. Unlike the IPv4 routing table, IPv6 does not use the asterisk to signify that the route is a good candidate for the default route.Verifying the Propagated IPv6 Default Route * "OE2" signifying that it was learned using OSPFv3. The E2 designation identifies that it is...
  43. 43OSPF Hello and Dead Intervals The OSPF Hello and Dead intervals are configurable on a per-interface basis. The OSPF intervals must match or a neighbor adjacency does not occur. "show ip ospf interface"OSPF Hello and Dead Intervals The OSPF Hello and Dead intervals are configurable on a per-interface basis. The OSPF intervals must match ...
  44. 44OSPF Hello and Dead Intervals Ej: provides an example of using a filtering technique to display the OSPF intervals for the OSPF enabled interface Serial 0/0/0 on R1.OSPF Hello and Dead Intervals Ej: provides an example of using a filtering technique to display the OSPF intervals for the OSPF enabled i...
  45. 45OSPF Hello and Dead Intervals "show ip ospf neighbor" command is used on R1 to verify that R1 is adjacent to R2 and R3. Ej: Notice in the output that the Dead Time is counting down from 40 seconds. By default, this value is refreshed every 10 seconds when R1 receives a Hello from the neighbor.OSPF Hello and Dead Intervals "show ip ospf neighbor" command is used on R1 to verify that R1 is adjacent to R2 and R3. Ej: Notice in the...
  46. 46Modifying OSPFv2 Intervals It may be desirable to change the OSPF timers so that routers detect network failures in less time. Doing this increases traffic, but sometimes the need for quick convergence is more important than the extra traffic it creates.OSPF Hello and Dead intervals can be modified manually using the following interface configuration mode commands:
    "ip ospf hello-interval (seconds)"
    "ip ospf dead-interval (seconds)"
    Use the "no ip ospf hello-interval" and "no ip ospf dead-interval" commands to reset the intervals to their default.
  47. 47Modifying OSPFv2 Intervals * it is always good practice to explicitly modify the timer instead of relying on an automatic IOS feature so that modifications are documented in the configuration. Therefore, the Dead interval is also manually set to 20 seconds on the R1 Serial 0/0/0 interface. Ej: when the Dead Timer on R1 expires, R1 and R2 lose adjacency. The reason is because the values have only been altered on one side of the serial link between R1 and R2. Recall that the OSPF Hello and Dead intervals must match between neighbors.Modifying OSPFv2 Intervals * it is always good practice to explicitly modify the timer instead of relying on an automatic IOS feature so ...
  48. 48Modifying OSPFv2 Intervals Ej: show ip ospf neighbor command on R1 to verify the neighbor adjacencies, Notice that the only neighbor listed is the 3.3.3.3 (R3) router and that R1 is no longer adjacent with the 2.2.2.2 (R2) neighbor. The timers set on Serial 0/0/0 do not affect the neighbor adjacency with R3.Modifying OSPFv2 Intervals Ej: show ip ospf neighbor command on R1 to verify the neighbor adjacencies, Notice that the only neighbor list...
  49. 49Modifying OSPFv2 Intervals To restore adjacency between R1 and R2, the R2 Serial 0/0/0 interface Hello interval is set to 5 seconds, Ej: Almost immediately, the IOS displays a message that adjacency has been established with a state of FULLModifying OSPFv2 Intervals To restore adjacency between R1 and R2, the R2 Serial 0/0/0 interface Hello interval is set to 5 seconds, Ej: ...
  50. 50Modifying OSPFv2 Intervals "show ip ospf interface" Notice that the Hello time is 5 seconds and that the Dead Time was automatically set to 20 seconds instead of the default 40 seconds. * Remember that the OSPF automatically sets the Dead interval to four times the Hello interval.Modifying OSPFv2 Intervals "show ip ospf interface" Notice that the Hello time is 5 seconds and that the Dead Time was automatically set ...
  51. 51Modifying OSPFv3 Intervals Ej: Once the Dead Timer on R1 expires, R1 and R2 lose adjacency, as displayed by the highlighted OSPFv3 adjacency message in Figure, because the values have only been altered on one side of the serial link between R1 and R2. Recall that the OSPFv3 Hello and Dead intervals must be equivalent between neighbors.Modifying OSPFv3 Intervals Ej: Once the Dead Timer on R1 expires, R1 and R2 lose adjacency, as displayed by the highlighted OSPFv3 adjace...
  52. 52Modifying OSPFv3 Intervals "show ipv6 ospf interface" Ej: Notice that the Hello time is 5 seconds and that the Dead Time was automatically set to 20 seconds instead of the default 40 seconds. Remember that the OSPF automatically sets the Dead interval to four times the Hello interval.Modifying OSPFv3 Intervals "show ipv6 ospf interface" Ej: Notice that the Hello time is 5 seconds and that the Dead Time was automaticall...
  53. 53Routers are Targets In general, routing systems can be attacked by disrupting the routing peers or by falsifying the information carried within the routing protocol. ** Falsified routing information may generally be used to cause systems to misinform (lie to) each other, cause a denial-of-service (DoS) attack, or cause traffic to follow a path it would not normally follow. To mitigate against routing protocol attacks, configure OSPF authentication.The consequences of falsifying routing information are:
    * Redirecting traffic to create routing loops
    * Redirecting traffic so it can be monitored on an insecure link
    * Redirecting traffic to discard it
  54. 54Routers are Targets * Ej: An attacker has been able to connect directly to the link between routers R1 and R2. The attacker injects false routing information destined to router R1 only, indicating that R2 is the preferred destination to the 192.168.10.10/32 host route. ** Although R1 has a routing table entry to the directly connected 192.168.10.0/24 network, it adds the injected route to its routing table because of the longer subnet mask. A route with a longer matching subnet mask is considered to be superior to a route with a shorter subnet mask. Consequently, when a router receives a packet, it selects the longer subnet mask, because it is a more precise route to the destination.Routers are Targets * Ej: An attacker has been able to connect directly to the link between routers R1 and R2. The attacker injects false...
  55. 55Routers are Targets * Ej: When PC3 sends a packet to PC1 (192.168.10.10/24), R1 does not forward the packet to the PC1 host. Instead, it routes the packet to router R2, because the apparent best path to 192.168.10.10/32 is through R2. When R2 gets the packet, it looks in its routing table and forwards the packet back to R1, which creates the loop.Routers are Targets * Ej: When PC3 sends a packet to PC1 (192.168.10.10/24), R1 does not forward the packet to the PC1 host. Instead, it ...
  56. 56Secure Routing Updates OSPF supports 3 types of authentication: 1. Null - This is the default method and means that no authentication is used for OSPF. 2. Simple password authentication - This is also referred to as plaintext authentication because the password in the update is sent in plaintext over the network. This is considered to be a legacy method of OSPF authentication.3. MD5 authentication - This is the most secure and recommended method of authentication. MD5 authentication provides higher security because the password is never exchanged between peers.
    Instead it is calculated using the MD5 algorithm. Matching results authenticate the sender.
  57. 57MD5 Authentication 1. Ej: R1 combines the routing message with the pre-shared secret key and calculates the signature using the MD5 algorithm. * The signature is also known as a hash value.MD5 Authentication 1. Ej: R1 combines the routing message with the pre-shared secret key and calculates the signature using the MD5 algor...
  58. 58MD5 Authentication 2. Ej: R1 adds the signature to the routing message and sends it to R2. MD5 does not encrypt the message; therefore, the content is easily readable.MD5 Authentication 2. Ej: R1 adds the signature to the routing message and sends it to R2. MD5 does not encrypt the message; therefore, t...
  59. 59MD5 Authentication 3. Ej: R2 opens the packet, combines the routing message with the pre-shared secret key and calculates the signature using the MD5 algorithm. ** OSPFv3 (OSPF for IPv6) does not include any authentication capabilities of its own. Instead it relies entirely on IPSec to secure communications between neighbors using the: "ipv6 ospf authentication ipsec spi" interface configuration mode command.MD5 Authentication 3. Ej: R2 opens the packet, combines the routing message with the pre-shared secret key and calculates the signature u...
  60. 60Configuring OSPF MD5 Authentication MD5 authentication can be enabled globally for all interfaces or on a per-interface basis. 1. To enable OSPF MD5 authentication globally, configure: * "ip ospf message-digest-key (key) md5 (password)" interface configuration mode command. * "area (area-id) authentication message-digest" router configuration mode command.This method forces authentication on all OSPF enabled interfaces.
    If an interface is not configured with the ip ospf message-digest-key command, it will not be able to form adjacencies with other OSPF neighbors.
  61. 61Configuring OSPF MD5 Authentication 2. To provide more flexibility, authentication is now supported on a per-interface basis. To enable MD5 authentication on a per-interface basis, configure: * "ip ospf message-digest-key (key) md5 (password)" interface configuration mode command. * " ip ospf authentication message-digest" interface configuration mode command.Global and per-interface OSPF MD5 authentication can be used on the same router.
    However, the interface setting overrides the global setting. MD5 authentication passwords do not have to be the same throughout an area; however, they do need to be the same between neighbors.
  62. 62OSPF MD5 Authentication Example Ej: configures R1 to enable OSPF MD5 authentication on all interfaces. Notice the informational messages stating that the OSPF neighbor adjacencies with R2 and R3 have changed to the Down state, because R2 and R3 have not yet been configured to support MD5 authentication.OSPF MD5 Authentication Example Ej: configures R1 to enable OSPF MD5 authentication on all interfaces. Notice the informational messages ...
  63. 63OSPF MD5 Authentication Example Ej: demonstrates how to configure R1 to enable OSPF MD5 authentication on a per-interface basis. Again, notice how the OSPF neighbor adjacencies have changed to the Down state.OSPF MD5 Authentication Example Ej: demonstrates how to configure R1 to enable OSPF MD5 authentication on a per-interface basis. Again, n...
  64. 64Verifying OSPF MD5 Authentication "show ip ospf interface" By verifying that the routing table is complete successful authentication can be confirmed. Ej: verifies the OSPF MD5 authentication on the serial 0/0/0 interface on R1.Verifying OSPF MD5 Authentication "show ip ospf interface" By verifying that the routing table is complete successful authentication can ...
  65. 65OSPF Adjacencies will not form if: 1. The interfaces are not on the same network. 2. OSPF network types do not match. 3. OSPF Hello or Dead Timers do not match. 4. Interface to neighbor is incorrectly configured as passive. 5. There is a missing or incorrect OSPF network command.Troubleshooting problems related to the exchange of routing information is one of the most essential skills for a network professional that is involved in the implementation and maintenance of large, routed enterprise networks that use OSPF as the IGP.
  66. 66OSPF States When troubleshooting OSPF neighbors, be aware that the FULL or 2WAY states are normal. All other states are transitory; that is, the router should not remain in those states for extended periods of time. 1. Down State: * No Hello packets received = Down. * Router sends Hello packets. * Transition to Init state. 2. Init State - Hello packets are received from the neighbor. * They contain the sending router’s Router ID. * Transition to Two-Way state. 3. Two-Way State - On Ethernet links, elect a DR, and a BDR. * Transition to ExStart state.OSPF States When troubleshooting OSPF neighbors, be aware that the FULL or 2WAY states are normal. All other states are transitory; that ...
  67. 67OSPF States 4. ExStart State - Negotiate master / slave relationship and DBD packet sequence number. * The master initiates the DBD packet exchange. 5. Exchange State - Routers exchange DBD packets. If additional router information is required then transition to Loading; otherwise, transition to Full. 6. Loading State - LSRs and LSUs are used to gain additional route information. * Routes are processed using the SPF algorithm. * Transition to the Full state. 7. Full State - Routers have converged.OSPF States 4. ExStart State - Negotiate master / slave relationship and DBD packet sequence number. * The master initiates the DBD packe...
  68. 68OSPF Troubleshooting Commands Ej: Used to verify vital OSPF configuration information, including the OSPF process ID, the router ID, networks the router is advertising, the neighbors the router is receiving updates from, and the default administrative distance, which is 110 for OSPF.OSPF Troubleshooting Commands Ej: Used to verify vital OSPF configuration information, including the OSPF process ID, the router ID, netw...
  69. 69OSPF Troubleshooting Commands Ej: Used to verify that the router has formed an adjacency with its neighboring routers. Displays the neighbor router ID, neighbor priority, OSPF state, Dead timer, neighbor interface IP address, and interface that the neighbor is accessible through. If the router ID of the neighboring router is not displayed, or if it does not show as a state of FULL or 2WAY, the two routers have not formed an OSPF adjacency. If two routers do not establish adjacency, link-state information will not be exchanged. Incomplete link-state databases can cause inaccurate SPF trees and routing tables. Routes to destination networks may not exist or may not be the most optimum path.OSPF Troubleshooting Commands Ej: Used to verify that the router has formed an adjacency with its neighboring routers. Displays the neigh...
  70. 70OSPF Troubleshooting Commands Ej: Used to display the OSPF parameters configured on an interface, such as the OSPF process ID that the interface is assigned to, the area that the interfaces are in, the cost of the interface, and the Hello and Dead intervals.OSPF Troubleshooting Commands Ej: Used to display the OSPF parameters configured on an interface, such as the OSPF process ID that the in...
  71. 71OSPF Troubleshooting Commands Ej: Used to examine the OSPF process ID and router ID. Additionally, this command displays the OSPF area information, as well as the last time the SPF algorithm was calculated.OSPF Troubleshooting Commands Ej: Used to examine the OSPF process ID and router ID. Additionally, this command displays the OSPF area in...
  72. 72OSPF Troubleshooting Commands Ej: Used to display only the OSPF learned routes in the routing table. The output shows that R1 has learned about four remote networks through OSPF. ** "clear ip ospf [ process-id ] process " - Used to reset the OSPFv2 neighbor adjacencies.OSPF Troubleshooting Commands Ej: Used to display only the OSPF learned routes in the routing table. The output shows that R1 has learned...
  73. 73Components of Troubleshooting OSPF OSPF problems usually relate to: 1. Neighbor adjacencies 2. Missing routes 3. Path selection 1. Verify if interfaces are operational and enabled for OSPF using the show ip interface brief and the show ip ospf interface commands. If the interfaces are operational and enabled for OSPF, ensure that interfaces on both routers are configured for the same OSPF area and the interfaces are not configured as passive interfaces.Components of Troubleshooting OSPF OSPF problems usually relate to: 1. Neighbor adjacencies 2. Missing routes 3. Path selection 1. Verify...
  74. 742. If adjacency between two routers is established, verify that there are OSPF routes in the routing table using the: " show ip route ospf" If there are no OSPF routes, verify that there are no other routing protocols with lower administrative distances running in the network. Verify if all of the required networks are advertised into OSPF. Also verify if an access list is configured on a router that would filter either incoming or outgoing routing updates.2. If adjacency between two routers is established, verify that there are OSPF routes in the routing table using the: " show ip route osp...
  75. 75Components of Troubleshooting OSPF 3. If all of the required routes are in the routing table, but the path that traffic takes is not correct, verify the OSPF cost on interfaces on the path. Also be careful in cases where the interfaces are faster than 100 Mb/s, because all interfaces above this bandwidth have the same OSPF cost, by default.Components of Troubleshooting OSPF 3. If all of the required routes are in the routing table, but the path that traffic takes is not corr...
  76. 76Troubleshooting Neighbor Issues Another problem that may arise is when two neighboring routers have mismatched MTU sizes on their connecting interfaces. ** The MTU size is the largest network layer packet that the router will forward out each interface. Routers default to an MTU size of 1500 bytes** However, this value can be changed for IPv4 packets using the "ip mtu (size)" interface configuration command or the " ipv6 mtu (size)" interface command for IPv6 packets.
    * If two connecting routers had mismatched MTU values, they would still attempt to form an adjacency but they would not exchange their LSDBs and the neighbor relationship would fail.

Información

Descripción
CCNA CCNA Fichas sobre E3_5 Single-Area OSPF, creado por John Dedios el 06/08/2016.
Creado por
John Dedios · ago 2016
Actualizado
10 ago 2016
Visitas
0
Valoración

Escríbenos

¿Sobre qué es tu mensaje?

¿Qué te parece el nuevo diseño?

¿Te gusta?