VIRTUALRACK for Network Engineers... This blog is all about networking technologies that drives the human network today... Welcome to the Human Network!!
Showing posts with label OSPF. Show all posts
Showing posts with label OSPF. Show all posts
Saturday, July 9, 2011
Friday, July 8, 2011
LAB: OSPF OSPF Features
- Configure SW4 so that it goes not generate a log message upon receipt of a Type-6 LSA advertisement.
- Configure SW4 so that it does not take the MTU value into account when establishing adjacencies on its Port-Channel1 interface.
- Configure SW4 to reflect the following output:
commands:
SW4:
ip host Rack1SW2 150.1.8.8
!
ip ospf name-lookup
!
interface Port-channel1
ip ospf mtu-ignore
!
router ospf 1
ignore lsa mospf
cisco's OSPV v2 doesnt support multicast OSPF which is advertised through lsa type6, to disable generating of log message when an LSA type6 received by the router "ignore lsa mospf" is used.
if the 2 routers having different mtu, it will not formed neighbor relationship. to ignore the mtu, "ip ospf mtu-ignore is used.
"ip ospf name-lookup" cmd is used by the router to perform a dns lookup to ospf neighbhors using their router-id.
- Configure SW4 so that it does not take the MTU value into account when establishing adjacencies on its Port-Channel1 interface.
- Configure SW4 to reflect the following output:
Neighbor ID Pri State Dead Time Address Interface
Rack1SW2 1 FULL/BDR 00:00:35 155.1.108.8 Port-channel1
Rack1SW2 1 FULL/BDR 00:00:35 155.1.108.8 Port-channel1
commands:
SW4:
ip host Rack1SW2 150.1.8.8
!
ip ospf name-lookup
!
interface Port-channel1
ip ospf mtu-ignore
!
router ospf 1
ignore lsa mospf
cisco's OSPV v2 doesnt support multicast OSPF which is advertised through lsa type6, to disable generating of log message when an LSA type6 received by the router "ignore lsa mospf" is used.
if the 2 routers having different mtu, it will not formed neighbor relationship. to ignore the mtu, "ip ospf mtu-ignore is used.
"ip ospf name-lookup" cmd is used by the router to perform a dns lookup to ospf neighbhors using their router-id.
LAB: OSPF Resource Limiting
- Configure R4 so that no more than 5000 LSAs can exist in the database.
- No more than 500 of these routes should be originated through
redistribution.
- R4’s OSPF process should be allowed to use up to 20% CPU utilization before allowing interrupts from higher priority processes.
R4:
router ospf 1
max-lsa 5000
redistribute maximum-prefix 500
process-min-time percent 20
LSA prefix limiting is used to prevent against attacks or misconfiguration in the OSPF, which can affect the normal forwarding traffic of the router. such as full internet bgp table is accidentally redistributed into IGP. also the process-min-time limits the OSPF's CPU usage.
verification:
- No more than 500 of these routes should be originated through
redistribution.
- R4’s OSPF process should be allowed to use up to 20% CPU utilization before allowing interrupts from higher priority processes.
R4:
router ospf 1
max-lsa 5000
redistribute maximum-prefix 500
process-min-time percent 20
LSA prefix limiting is used to prevent against attacks or misconfiguration in the OSPF, which can affect the normal forwarding traffic of the router. such as full internet bgp table is accidentally redistributed into IGP. also the process-min-time limits the OSPF's CPU usage.
verification:
Rack1R4#show ip ospf
Routing Process "ospf 1" with ID 150.1.4.4
Start time: 00:00:12.492, Time elapsed: 00:12:05.060
Supports only single TOS(TOS0) routes
Supports opaque LSA
Supports Link-local Signaling (LLS)
Supports area transit capability
Maximum number of non self-generated LSA allowed 5000
Threshold for warning message 75%
Ignore-time 5 minutes, reset-time 10 minutes
Ignore-count allowed 5, current ignore-count 0
It is an area border and autonomous system boundary router
Redistributing External Routes from,
rip, includes subnets in redistribution
Maximum limit of redistributed prefixes 500
Threshold for warning message 75%
Originating router-LSAs with maximum metric
Condition: always, State: active
Initial SPF schedule delay 100 msecs
Minimum hold time between two consecutive SPFs 1000 msecs
Maximum wait time between two consecutive SPFs 10000 msecs
Incremental-SPF disabled
Initial LSA throttle delay 10 msecs
Minimum hold time for LSA throttle 4000 msecs
Maximum wait time for LSA throttle 6000 msecs
Minimum LSA arrival 2000 msecs
LSA group pacing timer 240 secs
Interface flood pacing timer 50 msecs
Retransmission pacing timer 75 msecs
Number of external LSA 21. Checksum Sum 0x127F78
Number of opaque AS LSA 0. Checksum Sum 0x000000
Number of DCbitless external and opaque AS LSA 0
Number of DoNotAge external and opaque AS LSA 11
Number of areas in this router is 2. 2 normal 0 stub 0 nssa
Number of areas transit capable is 0
External flood list length 0
Area BACKBONE(0)
Number of interfaces in this area is 3 (1 loopback)
Area has no authentication
SPF algorithm last executed 00:00:46.804 ago
SPF algorithm executed 4 times
Area ranges are
Number of LSA 38. Checksum Sum 0x2BD18A
Number of opaque link LSA 0. Checksum Sum 0x000000
Number of DCbitless LSA 0
Number of indication LSA 0
Number of DoNotAge LSA 37
Flood list length 0
Area 1
Number of interfaces in this area is 1
Area has no authentication
SPF algorithm last executed 00:00:53.592 ago
SPF algorithm executed 2 times
Area ranges are
Number of LSA 93. Checksum Sum 0x4D8CD6
Number of opaque link LSA 0. Checksum Sum 0x000000
Number of DCbitless LSA 0
Number of indication LSA 0
Number of DoNotAge LSA 0
Flood list length 0
Routing Process "ospf 1" with ID 150.1.4.4
Start time: 00:00:12.492, Time elapsed: 00:12:05.060
Supports only single TOS(TOS0) routes
Supports opaque LSA
Supports Link-local Signaling (LLS)
Supports area transit capability
Maximum number of non self-generated LSA allowed 5000
Threshold for warning message 75%
Ignore-time 5 minutes, reset-time 10 minutes
Ignore-count allowed 5, current ignore-count 0
It is an area border and autonomous system boundary router
Redistributing External Routes from,
rip, includes subnets in redistribution
Maximum limit of redistributed prefixes 500
Threshold for warning message 75%
Originating router-LSAs with maximum metric
Condition: always, State: active
Initial SPF schedule delay 100 msecs
Minimum hold time between two consecutive SPFs 1000 msecs
Maximum wait time between two consecutive SPFs 10000 msecs
Incremental-SPF disabled
Initial LSA throttle delay 10 msecs
Minimum hold time for LSA throttle 4000 msecs
Maximum wait time for LSA throttle 6000 msecs
Minimum LSA arrival 2000 msecs
LSA group pacing timer 240 secs
Interface flood pacing timer 50 msecs
Retransmission pacing timer 75 msecs
Number of external LSA 21. Checksum Sum 0x127F78
Number of opaque AS LSA 0. Checksum Sum 0x000000
Number of DCbitless external and opaque AS LSA 0
Number of DoNotAge external and opaque AS LSA 11
Number of areas in this router is 2. 2 normal 0 stub 0 nssa
Number of areas transit capable is 0
External flood list length 0
Area BACKBONE(0)
Number of interfaces in this area is 3 (1 loopback)
Area has no authentication
SPF algorithm last executed 00:00:46.804 ago
SPF algorithm executed 4 times
Area ranges are
Number of LSA 38. Checksum Sum 0x2BD18A
Number of opaque link LSA 0. Checksum Sum 0x000000
Number of DCbitless LSA 0
Number of indication LSA 0
Number of DoNotAge LSA 37
Flood list length 0
Area 1
Number of interfaces in this area is 1
Area has no authentication
SPF algorithm last executed 00:00:53.592 ago
SPF algorithm executed 2 times
Area ranges are
Number of LSA 93. Checksum Sum 0x4D8CD6
Number of opaque link LSA 0. Checksum Sum 0x000000
Number of DCbitless LSA 0
Number of indication LSA 0
Number of DoNotAge LSA 0
Flood list length 0
Sunday, July 3, 2011
LAB: OSPF Database Filtering
- Configure SW1 so that SW3 cannot learn any OSPF routes from SW1, but SW1 can still learn OSPF routes from SW3.
- Configure R5 so that R2 cannot learn from R5, but R5 can still learn OSPF routes from R2.
R5:
router ospf 1
neighbor 155.1.0.2 database-filter all out
SW1:
interface Vlan79
ip ospf database-filter all out
Note: OSPF command database-filter all out is similar in operation to the passive-interface command in RIPv2. this features allows formation of OSPF neighbors, since hello packets are not filtered out. but stops the advertisements of all LSAs out the interface or to the neighbor in question.
- Configure R5 so that R2 cannot learn from R5, but R5 can still learn OSPF routes from R2.
R5:
router ospf 1
neighbor 155.1.0.2 database-filter all out
SW1:
interface Vlan79
ip ospf database-filter all out
Note: OSPF command database-filter all out is similar in operation to the passive-interface command in RIPv2. this features allows formation of OSPF neighbors, since hello packets are not filtered out. but stops the advertisements of all LSAs out the interface or to the neighbor in question.
LAB: OSPF NSSA ABR External Filtering
- Disable R6’s link to VLAN 146 and Loopback0.
- Configure area 2 as an NSSA.
- Configure summarization on R3 so that devices outside of area 2 do not have a route to the network 200.0.0.0/24.
- This filter should not affect any other prefixes.
commands:
R3:
router ospf 1
area 2 nssa
R6:
interface FastEthernet0/0.146
shutdown
!
interface Loopback0
shutdown
!
router ospf 1
area 2 nssa
SW1:
router ospf 1
area 2 nssa
SW3:
router ospf 1
area 2 nssa
summary address can be used to suppress the origination of Type-5 External LSA into Area0, the key difference of this from distribute-list and administrative distance filters is that the prefix is also filtered out in the ospf database not just the routing table.
before the summary-address filters is applied at R3.
applying the summary-address filter at R3.
Rack1R3(config)#router ospf 1
Rack1R3(config-router)#summary-address 200.0.0.0 255.255.255.0 not-advertise
verification:
- Configure area 2 as an NSSA.
- Configure summarization on R3 so that devices outside of area 2 do not have a route to the network 200.0.0.0/24.
- This filter should not affect any other prefixes.
commands:
R3:
router ospf 1
area 2 nssa
R6:
interface FastEthernet0/0.146
shutdown
!
interface Loopback0
shutdown
!
router ospf 1
area 2 nssa
SW1:
router ospf 1
area 2 nssa
SW3:
router ospf 1
area 2 nssa
summary address can be used to suppress the origination of Type-5 External LSA into Area0, the key difference of this from distribute-list and administrative distance filters is that the prefix is also filtered out in the ospf database not just the routing table.
before the summary-address filters is applied at R3.
Rack1R5#show ip ospf database external 200.0.0.0
OSPF Router with ID (150.1.5.5) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 16
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 200.0.0.0 (External Network Number )
Advertising Router: 150.1.3.3
LS Seq Number: 80000001
Checksum: 0x3BFE
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
LS age: 627
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 200.0.0.0 (External Network Number )
Advertising Router: 150.1.6.6
LS Seq Number: 80000005
Checksum: 0xC24
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
Rack1R5#
Rack1R5#
Rack1R5#sho ip route | inc E2
E1 - OSPF external type 1, E2 - OSPF external type 2
O E2 51.51.51.51 [110/20] via 155.1.0.2, 00:03:31, Serial0/0
O E2 204.12.1.0/24 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 200.0.0.0/24 [110/20] via 155.1.0.3, 00:00:19, Serial0/0
O E2 54.1.1.0 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 200.0.1.0/24 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 200.0.2.0/24 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 200.0.3.0/24 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 9.9.9.9 [110/20] via 155.1.0.3, 00:03:30, Serial0/0
O E2 31.3.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 31.2.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 31.1.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 31.0.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.2.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.3.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.0.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.1.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
OSPF Router with ID (150.1.5.5) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 16
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 200.0.0.0 (External Network Number )
Advertising Router: 150.1.3.3
LS Seq Number: 80000001
Checksum: 0x3BFE
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
LS age: 627
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 200.0.0.0 (External Network Number )
Advertising Router: 150.1.6.6
LS Seq Number: 80000005
Checksum: 0xC24
Length: 36
Network Mask: /24
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
Rack1R5#
Rack1R5#
Rack1R5#sho ip route | inc E2
E1 - OSPF external type 1, E2 - OSPF external type 2
O E2 51.51.51.51 [110/20] via 155.1.0.2, 00:03:31, Serial0/0
O E2 204.12.1.0/24 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 200.0.0.0/24 [110/20] via 155.1.0.3, 00:00:19, Serial0/0
O E2 54.1.1.0 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 200.0.1.0/24 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 200.0.2.0/24 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 200.0.3.0/24 [110/20] via 155.1.0.3, 00:03:31, Serial0/0
O E2 9.9.9.9 [110/20] via 155.1.0.3, 00:03:30, Serial0/0
O E2 31.3.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 31.2.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 31.1.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 31.0.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.2.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.3.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.0.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
O E2 30.1.0.0 [110/20] via 155.1.45.4, 00:03:31, Serial0/1
applying the summary-address filter at R3.
Rack1R3(config)#router ospf 1
Rack1R3(config-router)#summary-address 200.0.0.0 255.255.255.0 not-advertise
verification:
Rack1R5#show ip ospf database external 200.0.0.0
OSPF Router with ID (150.1.5.5) (Process ID 1)
Rack1R5#sho ip route | inc E2
E1 - OSPF external type 1, E2 - OSPF external type 2
O E2 51.51.51.51 [110/20] via 155.1.0.2, 00:01:33, Serial0/0
O E2 204.12.1.0/24 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 54.1.1.0 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 200.0.1.0/24 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 200.0.2.0/24 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 200.0.3.0/24 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 9.9.9.9 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 31.3.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 31.2.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 31.1.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 31.0.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.2.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.3.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.0.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.1.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
OSPF Router with ID (150.1.5.5) (Process ID 1)
Rack1R5#sho ip route | inc E2
E1 - OSPF external type 1, E2 - OSPF external type 2
O E2 51.51.51.51 [110/20] via 155.1.0.2, 00:01:33, Serial0/0
O E2 204.12.1.0/24 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 54.1.1.0 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 200.0.1.0/24 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 200.0.2.0/24 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 200.0.3.0/24 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 9.9.9.9 [110/20] via 155.1.0.3, 00:01:33, Serial0/0
O E2 31.3.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 31.2.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 31.1.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 31.0.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.2.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.3.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.0.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
O E2 30.1.0.0 [110/20] via 155.1.45.4, 00:01:33, Serial0/1
LAB: OSPF Filtering with Route-maps
- Configure route-map filtering on R6 so that traffic going towards the Loopback0 network of R3 is sent towards R1.
using route-map with distribute-list command extends the filtering capability with additional match criteria
-outgoing interface in the routing table
- ip address
-ip next-hop
- ip route-source
- router-id
- metric
- route type (intra, inter etc.)
- tag
@ R6
adding the filter to eliminate route to 150.1.3.3 via R4
Rack1R6(config)#access-list 3 permit 150.1.3.3
Rack1R6(config)#access-list 4 permit 155.1.146.4
Rack1R6(config)#route-map DENY_R3_LOOPBACK_FROM_R4 deny 10
Rack1R6(config-route-map)#match ip address 3
Rack1R6(config-route-map)#match ip next-hop 4
Rack1R6(config-route-map)#route-map DENY_R3_LOOPBACK_FROM_R4 permit 20
Rack1R6(config)#router ospf 1
Rack1R6(config-router)#distribute-list route-map DENY_R3_LOOPBACK_FROM_R4 in
verification: route to 150.1.3.3 via R4 is not installed in the routing table.
Rack1R6#show ip route 150.1.3.3
Routing entry for 150.1.3.3/32
Known via "ospf 1", distance 110, metric 130, type intra area
Redistributing via eigrp 10
Advertised by eigrp 10 metric 10000 1000 255 1 1500
Last update from 155.1.146.1 on FastEthernet0/0.146, 00:00:06 ago
Routing Descriptor Blocks:
* 155.1.146.1, from 150.1.3.3, 00:00:06 ago, via FastEthernet0/0.146
Route metric is 130, traffic share count is 1
using route-map with distribute-list command extends the filtering capability with additional match criteria
-outgoing interface in the routing table
- ip address
-ip next-hop
- ip route-source
- router-id
- metric
- route type (intra, inter etc.)
- tag
@ R6
Rack1R6#show ip route 150.1.3.3
Routing entry for 150.1.3.3/32
Known via "ospf 1", distance 110, metric 130, type intra area
Redistributing via eigrp 10
Advertised by eigrp 10 metric 10000 1000 255 1 1500
Last update from 155.1.146.1 on FastEthernet0/0.146, 00:31:23 ago
Routing Descriptor Blocks:
155.1.146.4, from 150.1.3.3, 00:31:23 ago, via FastEthernet0/0.146
Route metric is 130, traffic share count is 1
* 155.1.146.1, from 150.1.3.3, 00:31:23 ago, via FastEthernet0/0.146
Route metric is 130, traffic share count is 1
Routing entry for 150.1.3.3/32
Known via "ospf 1", distance 110, metric 130, type intra area
Redistributing via eigrp 10
Advertised by eigrp 10 metric 10000 1000 255 1 1500
Last update from 155.1.146.1 on FastEthernet0/0.146, 00:31:23 ago
Routing Descriptor Blocks:
155.1.146.4, from 150.1.3.3, 00:31:23 ago, via FastEthernet0/0.146
Route metric is 130, traffic share count is 1
* 155.1.146.1, from 150.1.3.3, 00:31:23 ago, via FastEthernet0/0.146
Route metric is 130, traffic share count is 1
adding the filter to eliminate route to 150.1.3.3 via R4
Rack1R6(config)#access-list 3 permit 150.1.3.3
Rack1R6(config)#access-list 4 permit 155.1.146.4
Rack1R6(config)#route-map DENY_R3_LOOPBACK_FROM_R4 deny 10
Rack1R6(config-route-map)#match ip address 3
Rack1R6(config-route-map)#match ip next-hop 4
Rack1R6(config-route-map)#route-map DENY_R3_LOOPBACK_FROM_R4 permit 20
Rack1R6(config-router)#distribute-list route-map DENY_R3_LOOPBACK_FROM_R4 in
verification: route to 150.1.3.3 via R4 is not installed in the routing table.
Rack1R6#show ip route 150.1.3.3
Routing entry for 150.1.3.3/32
Known via "ospf 1", distance 110, metric 130, type intra area
Redistributing via eigrp 10
Advertised by eigrp 10 metric 10000 1000 255 1 1500
Last update from 155.1.146.1 on FastEthernet0/0.146, 00:00:06 ago
Routing Descriptor Blocks:
* 155.1.146.1, from 150.1.3.3, 00:00:06 ago, via FastEthernet0/0.146
Route metric is 130, traffic share count is 1
LAB: OSPF Filtering with Administrative Distance
- Configure administrative distance filtering on R5 so that traffic going towards the VLAN 67 network is sent towards R3.
Administrative distance can be changed on a per-prefix and per-neighbor basis in OSPF, the main difference here is that the address field in the distance command refers to the originator of the prefix into the area. not necessarily the neighbor you are learning the routes from.
in the scenario below. routes going to 155.1.67.0 network is reachable via two ABRs,
1. 155.1.0.3 which is advertised by 150.1.3.3 (R3)-ABR
2. 155.1.0.1 which is advertised by 150.1.6.6 (R6)-ABR
so we can match either one of the above ABR ip address for the address field in the distance command.
adding the distance command at R5
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#distance 255 150.1.6.6 0.0.0.0 67
verification: now only the routes toward R3 is installed.
Rack1R5#traceroute 155.1.67.6
Type escape sequence to abort.
Tracing the route to 155.1.67.6
1 155.1.0.3 20 msec 36 msec 0 msec
2 155.1.37.7 16 msec 8 msec 8 msec
3 155.1.67.6 12 msec * 56 msec
Administrative distance can be changed on a per-prefix and per-neighbor basis in OSPF, the main difference here is that the address field in the distance command refers to the originator of the prefix into the area. not necessarily the neighbor you are learning the routes from.
in the scenario below. routes going to 155.1.67.0 network is reachable via two ABRs,
1. 155.1.0.3 which is advertised by 150.1.3.3 (R3)-ABR
2. 155.1.0.1 which is advertised by 150.1.6.6 (R6)-ABR
so we can match either one of the above ABR ip address for the address field in the distance command.
Rack1R5#show ip route 155.1.67.0
Routing entry for 155.1.67.0/24
Known via "ospf 1", distance 110, metric 66, type inter area
Last update from 155.1.0.3 on Serial0/0, 00:00:02 ago
Routing Descriptor Blocks:
155.1.0.3, from 150.1.3.3, 00:00:02 ago, via Serial0/0
Route metric is 66, traffic share count is 1
* 155.1.0.1, from 150.1.6.6, 00:00:02 ago, via Serial0/0
Route metric is 66, traffic share count is 1
Routing entry for 155.1.67.0/24
Known via "ospf 1", distance 110, metric 66, type inter area
Last update from 155.1.0.3 on Serial0/0, 00:00:02 ago
Routing Descriptor Blocks:
155.1.0.3, from 150.1.3.3, 00:00:02 ago, via Serial0/0
Route metric is 66, traffic share count is 1
* 155.1.0.1, from 150.1.6.6, 00:00:02 ago, via Serial0/0
Route metric is 66, traffic share count is 1
adding the distance command at R5
Rack1R5(config)#access-list 67 permit 155.1.67.0
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#distance 255 150.1.6.6 0.0.0.0 67
verification: now only the routes toward R3 is installed.
Routing entry for 155.1.67.0/24
Known via "ospf 1", distance 110, metric 66, type inter area
Last update from 155.1.0.3 on Serial0/0, 00:00:06 ago
Routing Descriptor Blocks:
* 155.1.0.3, from 150.1.3.3, 00:00:06 ago, via Serial0/0
Route metric is 66, traffic share count is 1
Known via "ospf 1", distance 110, metric 66, type inter area
Last update from 155.1.0.3 on Serial0/0, 00:00:06 ago
Routing Descriptor Blocks:
* 155.1.0.3, from 150.1.3.3, 00:00:06 ago, via Serial0/0
Route metric is 66, traffic share count is 1
Rack1R5#traceroute 155.1.67.6
Type escape sequence to abort.
Tracing the route to 155.1.67.6
1 155.1.0.3 20 msec 36 msec 0 msec
2 155.1.37.7 16 msec 8 msec 8 msec
3 155.1.67.6 12 msec * 56 msec
LAB: OSPF Summarization and Discard Routes
- Configure R5 to advertise the summary 150.X.0.0/22 into area 3.
- Ensure that R5, SW2, and SW4 can still reach the Loopback0 networks of R1 and R2, even with the previously configured distribute-list filter applied.
when performing summarization in OSPF, similar with other protocols (EIGRP/BGP) a matching route to Null0 for the summary is installed locally in the routing table. the "discard" route is used to prevent the forwarding traffic towards a shorter match, such as a default route if no specific route towards the actual destination.
command:
external - refers to redistributed summarization with summary-address command.
@ SW2 before adding the area-range command in R5
at SW2 after adding the area-range command in R5
Rack1SW2#show ip route | include 150.
150.1.0.0/16 is variably subnetted, 8 subnets, 3 masks
O IA 150.1.7.0/24 [110/97] via 155.1.58.5, 00:02:00, Vlan58
O IA 150.1.6.6/32 [110/96] via 155.1.58.5, 00:02:00, Vlan58
O 150.1.5.5/32 [110/31] via 155.1.58.5, 00:06:58, Vlan58
O IA 150.1.4.4/32 [110/95] via 155.1.58.5, 00:02:00, Vlan58
O IA 150.1.0.0/22 [110/95] via 155.1.58.5, 00:00:06, Vlan58
O 150.1.10.0/24 [110/151] via 155.1.108.10, 00:06:58, Port-channel1
O IA 150.1.9.0/24 [110/98] via 155.1.58.5, 00:02:00, Vlan58
C 150.1.8.0/24 is directly connected, Loopback0
@ SW2 reachabilit to 150.1.3.3 is ok but not with 150.1.1.1
let us examine the R5's longest match to 150.1.1.1 is discard route via null0. which shows that the null0 is the longest match against the default route 0.0.0.0/0.
Rack1R5#show ip route 150.1.1.1
Routing entry for 150.1.0.0/22
Known via "ospf 1", distance 110, metric 0, type intra area
Routing Descriptor Blocks:
* directly connected, via Null0
Route metric is 0, traffic share count is 1
Rack1R5#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 104, candidate default path
Tag 1, type extern 1
Last update from 155.1.0.4 on Serial0/0, 00:00:53 ago
Routing Descriptor Blocks:
* 155.1.45.4, from 150.1.4.4, 00:00:53 ago, via Serial0/1
Route metric is 104, traffic share count is 1
Route tag 1
155.1.0.4, from 150.1.4.4, 00:00:53 ago, via Serial0/0
Route metric is 104, traffic share count is 1
Route tag 1
with disabling the discard route at R5.
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#no discard-route internal
Rack1R5#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 104, candidate default path
Tag 1, type extern 1
Last update from 155.1.0.4 on Serial0/0, 00:00:16 ago
Routing Descriptor Blocks:
* 155.1.45.4, from 150.1.4.4, 00:00:16 ago, via Serial0/1
Route metric is 104, traffic share count is 1
Route tag 1
155.1.0.4, from 150.1.4.4, 00:00:16 ago, via Serial0/0
Route metric is 104, traffic share count is 1
Route tag 1
final result is SW2 will use the 150.1.0.0/22 route as a result of the area-range command in R5 to reach 150.1.1.1 and R5 will use the 0.0.0.0/0 prefix to route the traffic towards R4.
- Ensure that R5, SW2, and SW4 can still reach the Loopback0 networks of R1 and R2, even with the previously configured distribute-list filter applied.
when performing summarization in OSPF, similar with other protocols (EIGRP/BGP) a matching route to Null0 for the summary is installed locally in the routing table. the "discard" route is used to prevent the forwarding traffic towards a shorter match, such as a default route if no specific route towards the actual destination.
command:
no discard-route [internal|external]
internal - refers to inter area summarization with area-range commandexternal - refers to redistributed summarization with summary-address command.
@ SW2 before adding the area-range command in R5
Rack1SW2#show ip route | include 150.
150.1.0.0/16 is variably subnetted, 8 subnets, 2 masks
O IA 150.1.7.0/24 [110/97] via 155.1.58.5, 00:00:06, Vlan58
O IA 150.1.6.6/32 [110/96] via 155.1.58.5, 00:00:06, Vlan58
O 150.1.5.5/32 [110/31] via 155.1.58.5, 00:05:04, Vlan58
O IA 150.1.4.4/32 [110/95] via 155.1.58.5, 00:00:06, Vlan58
O IA 150.1.3.3/32 [110/95] via 155.1.58.5, 00:00:06, Vlan58
O 150.1.10.0/24 [110/151] via 155.1.108.10, 00:05:04, Port-channel1
O IA 150.1.9.0/24 [110/98] via 155.1.58.5, 00:00:06, Vlan58
C 150.1.8.0/24 is directly connected, Loopback0
150.1.0.0/16 is variably subnetted, 8 subnets, 2 masks
O IA 150.1.7.0/24 [110/97] via 155.1.58.5, 00:00:06, Vlan58
O IA 150.1.6.6/32 [110/96] via 155.1.58.5, 00:00:06, Vlan58
O 150.1.5.5/32 [110/31] via 155.1.58.5, 00:05:04, Vlan58
O IA 150.1.4.4/32 [110/95] via 155.1.58.5, 00:00:06, Vlan58
O IA 150.1.3.3/32 [110/95] via 155.1.58.5, 00:00:06, Vlan58
O 150.1.10.0/24 [110/151] via 155.1.108.10, 00:05:04, Port-channel1
O IA 150.1.9.0/24 [110/98] via 155.1.58.5, 00:00:06, Vlan58
C 150.1.8.0/24 is directly connected, Loopback0
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#area 0 range 150.1.0.0 255.255.252.0
Rack1R5(config-router)#area 0 range 150.1.0.0 255.255.252.0
at SW2 after adding the area-range command in R5
150.1.0.0/16 is variably subnetted, 8 subnets, 3 masks
O IA 150.1.7.0/24 [110/97] via 155.1.58.5, 00:02:00, Vlan58
O IA 150.1.6.6/32 [110/96] via 155.1.58.5, 00:02:00, Vlan58
O 150.1.5.5/32 [110/31] via 155.1.58.5, 00:06:58, Vlan58
O IA 150.1.4.4/32 [110/95] via 155.1.58.5, 00:02:00, Vlan58
O IA 150.1.0.0/22 [110/95] via 155.1.58.5, 00:00:06, Vlan58
O 150.1.10.0/24 [110/151] via 155.1.108.10, 00:06:58, Port-channel1
O IA 150.1.9.0/24 [110/98] via 155.1.58.5, 00:02:00, Vlan58
C 150.1.8.0/24 is directly connected, Loopback0
@ SW2 reachabilit to 150.1.3.3 is ok but not with 150.1.1.1
let us examine the R5's longest match to 150.1.1.1 is discard route via null0. which shows that the null0 is the longest match against the default route 0.0.0.0/0.
Rack1R5#show ip route 150.1.1.1
Routing entry for 150.1.0.0/22
Known via "ospf 1", distance 110, metric 0, type intra area
Routing Descriptor Blocks:
* directly connected, via Null0
Route metric is 0, traffic share count is 1
Rack1R5#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 104, candidate default path
Tag 1, type extern 1
Last update from 155.1.0.4 on Serial0/0, 00:00:53 ago
Routing Descriptor Blocks:
* 155.1.45.4, from 150.1.4.4, 00:00:53 ago, via Serial0/1
Route metric is 104, traffic share count is 1
Route tag 1
155.1.0.4, from 150.1.4.4, 00:00:53 ago, via Serial0/0
Route metric is 104, traffic share count is 1
Route tag 1
with disabling the discard route at R5.
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#no discard-route internal
Rack1R5#show ip route 150.1.1.1
% Subnet not in table
% Subnet not in table
Rack1R5#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 104, candidate default path
Tag 1, type extern 1
Last update from 155.1.0.4 on Serial0/0, 00:00:16 ago
Routing Descriptor Blocks:
* 155.1.45.4, from 150.1.4.4, 00:00:16 ago, via Serial0/1
Route metric is 104, traffic share count is 1
Route tag 1
155.1.0.4, from 150.1.4.4, 00:00:16 ago, via Serial0/0
Route metric is 104, traffic share count is 1
Route tag 1
final result is SW2 will use the 150.1.0.0/22 route as a result of the area-range command in R5 to reach 150.1.1.1 and R5 will use the 0.0.0.0/0 prefix to route the traffic towards R4.
LAB: OSPF Filtering with Distribute-Lists
- Configure distribute-list filtering on R5, SW2, and SW4 so that these devices do not install routes to the loopback0 networks of R1 and R2.
Intra-area filtering can be accomplished in OSPF with an inbound distribute-list, filtering only affects the local routing table not the OSPFdatabase.
Note: when implementing this it can result traffic black holes, ensure that all routers still agree on the forwarding paths in the network.
pre-verification:
applying the distribute-list command on R5
result: 150.1.1.1 and 150.1.2.2 is not installed in the routing table.
@ SW2, the route to 150.1.1.1 and 150.1.2.2 is in the routing table and ospf database, but unable to ping, this is due to at ABR R5 distribute-list filter.
Rack1SW2#show ip route 150.1.1.1
Routing entry for 150.1.1.1/32
Known via "ospf 1", distance 110, metric 95, type inter area
Last update from 155.1.58.5 on Vlan58, 00:00:45 ago
Routing Descriptor Blocks:
* 155.1.58.5, from 150.1.5.5, 00:00:45 ago, via Vlan58
Route metric is 95, traffic share count is 1
Rack1SW2#show ip route 150.1.2.2
Routing entry for 150.1.2.2/32
Known via "ospf 1", distance 110, metric 95, type inter area
Last update from 155.1.58.5 on Vlan58, 00:00:51 ago
Routing Descriptor Blocks:
* 155.1.58.5, from 150.1.5.5, 00:00:51 ago, via Vlan58
Route metric is 95, traffic share count is 1
Rack1SW2#show ip route 150.1.2.2
Routing entry for 150.1.2.2/32
Known via "ospf 1", distance 110, metric 95, type inter area
Last update from 155.1.58.5 on Vlan58, 00:01:22 ago
Routing Descriptor Blocks:
* 155.1.58.5, from 150.1.5.5, 00:01:22 ago, via Vlan58
Route metric is 95, traffic share count is 1
Rack1SW2#ping 150.1.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 150.1.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
adding the distribute-list filter at SW2
Rack1SW2(config)#access-list 1 deny 150.1.1.1
Rack1SW2(config)#access-list 1 deny 150.1.2.2
Rack1SW2(config)#access-list 1 permit any
Rack1SW2(config)#router ospf 1
Rack1SW2(config-router)# distribute-list 1 in
verifcation: the route is not in the routing table but inside the ospf database.
Note: SW4 has similar result with SW2.
Intra-area filtering can be accomplished in OSPF with an inbound distribute-list, filtering only affects the local routing table not the OSPFdatabase.
Note: when implementing this it can result traffic black holes, ensure that all routers still agree on the forwarding paths in the network.
pre-verification:
Rack1R5#show ip route | inc 150.
150.1.0.0/16 is variably subnetted, 10 subnets, 2 masks
O IA 150.1.7.0/24 [110/67] via 155.1.0.1, 00:05:53, Serial0/0
C 150.1.5.0/24 is directly connected, Loopback0
O IA 150.1.6.6/32 [110/66] via 155.1.0.1, 00:05:53, Serial0/0
O 150.1.4.4/32 [110/65] via 155.1.45.4, 00:05:53, Serial0/1
O 150.1.3.3/32 [110/65] via 155.1.0.3, 00:05:53, Serial0/0
O 150.1.2.2/32 [110/65] via 155.1.0.2, 00:05:53, Serial0/0
O 150.1.1.1/32 [110/65] via 155.1.0.1, 00:05:53, Serial0/0
O 150.1.10.0/24 [110/152] via 155.1.58.8, 00:07:41, FastEthernet0/0
O IA 150.1.9.0/24 [110/68] via 155.1.0.1, 00:05:53, Serial0/0
O 150.1.8.0/24 [110/2] via 155.1.58.8, 00:07:41, FastEthernet0/0
150.1.0.0/16 is variably subnetted, 10 subnets, 2 masks
O IA 150.1.7.0/24 [110/67] via 155.1.0.1, 00:05:53, Serial0/0
C 150.1.5.0/24 is directly connected, Loopback0
O IA 150.1.6.6/32 [110/66] via 155.1.0.1, 00:05:53, Serial0/0
O 150.1.4.4/32 [110/65] via 155.1.45.4, 00:05:53, Serial0/1
O 150.1.3.3/32 [110/65] via 155.1.0.3, 00:05:53, Serial0/0
O 150.1.2.2/32 [110/65] via 155.1.0.2, 00:05:53, Serial0/0
O 150.1.1.1/32 [110/65] via 155.1.0.1, 00:05:53, Serial0/0
O 150.1.10.0/24 [110/152] via 155.1.58.8, 00:07:41, FastEthernet0/0
O IA 150.1.9.0/24 [110/68] via 155.1.0.1, 00:05:53, Serial0/0
O 150.1.8.0/24 [110/2] via 155.1.58.8, 00:07:41, FastEthernet0/0
applying the distribute-list command on R5
Rack1R5(config)#access-list 1 deny 150.1.1.1
Rack1R5(config)#access-list 1 deny 150.1.2.2
Rack1R5(config)#access-list 1 permit any
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#distribute-list 1 in
Rack1R5(config)#access-list 1 deny 150.1.2.2
Rack1R5(config)#access-list 1 permit any
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#distribute-list 1 in
result: 150.1.1.1 and 150.1.2.2 is not installed in the routing table.
Rack1R5#show ip route | inc 150.
150.1.0.0/16 is variably subnetted, 8 subnets, 2 masks
O IA 150.1.7.0/24 [110/67] via 155.1.0.1, 00:00:08, Serial0/0
C 150.1.5.0/24 is directly connected, Loopback0
O IA 150.1.6.6/32 [110/66] via 155.1.0.1, 00:00:08, Serial0/0
O 150.1.4.4/32 [110/65] via 155.1.45.4, 00:00:08, Serial0/1
O 150.1.3.3/32 [110/65] via 155.1.0.3, 00:00:08, Serial0/0
O 150.1.10.0/24 [110/152] via 155.1.58.8, 00:00:08, FastEthernet0/0
O IA 150.1.9.0/24 [110/68] via 155.1.0.1, 00:00:08, Serial0/0
O 150.1.8.0/24 [110/2] via 155.1.58.8, 00:00:08, FastEthernet0/0
150.1.0.0/16 is variably subnetted, 8 subnets, 2 masks
O IA 150.1.7.0/24 [110/67] via 155.1.0.1, 00:00:08, Serial0/0
C 150.1.5.0/24 is directly connected, Loopback0
O IA 150.1.6.6/32 [110/66] via 155.1.0.1, 00:00:08, Serial0/0
O 150.1.4.4/32 [110/65] via 155.1.45.4, 00:00:08, Serial0/1
O 150.1.3.3/32 [110/65] via 155.1.0.3, 00:00:08, Serial0/0
O 150.1.10.0/24 [110/152] via 155.1.58.8, 00:00:08, FastEthernet0/0
O IA 150.1.9.0/24 [110/68] via 155.1.0.1, 00:00:08, Serial0/0
O 150.1.8.0/24 [110/2] via 155.1.58.8, 00:00:08, FastEthernet0/0
@ SW2, the route to 150.1.1.1 and 150.1.2.2 is in the routing table and ospf database, but unable to ping, this is due to at ABR R5 distribute-list filter.
Rack1SW2#show ip route 150.1.1.1
Routing entry for 150.1.1.1/32
Known via "ospf 1", distance 110, metric 95, type inter area
Last update from 155.1.58.5 on Vlan58, 00:00:45 ago
Routing Descriptor Blocks:
* 155.1.58.5, from 150.1.5.5, 00:00:45 ago, via Vlan58
Route metric is 95, traffic share count is 1
Rack1SW2#show ip route 150.1.2.2
Routing entry for 150.1.2.2/32
Known via "ospf 1", distance 110, metric 95, type inter area
Last update from 155.1.58.5 on Vlan58, 00:00:51 ago
Routing Descriptor Blocks:
* 155.1.58.5, from 150.1.5.5, 00:00:51 ago, via Vlan58
Route metric is 95, traffic share count is 1
Rack1SW2#show ip route 150.1.2.2
Routing entry for 150.1.2.2/32
Known via "ospf 1", distance 110, metric 95, type inter area
Last update from 155.1.58.5 on Vlan58, 00:01:22 ago
Routing Descriptor Blocks:
* 155.1.58.5, from 150.1.5.5, 00:01:22 ago, via Vlan58
Route metric is 95, traffic share count is 1
Rack1SW2#ping 150.1.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 150.1.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Rack1SW2(config)#access-list 1 deny 150.1.1.1
Rack1SW2(config)#access-list 1 deny 150.1.2.2
Rack1SW2(config)#access-list 1 permit any
Rack1SW2(config)#router ospf 1
Rack1SW2(config-router)# distribute-list 1 in
verifcation: the route is not in the routing table but inside the ospf database.
Rack1SW2#show ip route 150.1.1.1
% Subnet not in table
Rack1SW2#show ip route 150.1.2.2
% Subnet not in table
Rack1SW2#show ip ospf database summary 150.1.1.1
OSPF Router with ID (150.1.8.8) (Process ID 1)
Summary Net Link States (Area 3)
Routing Bit Set on this LSA
LS age: 1 (DoNotAge)
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 150.1.1.1 (summary Network Number)
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0x605A
Length: 28
Network Mask: /32
TOS: 0 Metric: 65
Rack1SW2#show ip ospf database summary 150.1.2.2
OSPF Router with ID (150.1.8.8) (Process ID 1)
Summary Net Link States (Area 3)
Routing Bit Set on this LSA
LS age: 1 (DoNotAge)
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 150.1.2.2 (summary Network Number)
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0x4B6D
Length: 28
Network Mask: /32
TOS: 0 Metric: 65
% Subnet not in table
Rack1SW2#show ip route 150.1.2.2
% Subnet not in table
Rack1SW2#show ip ospf database summary 150.1.1.1
OSPF Router with ID (150.1.8.8) (Process ID 1)
Summary Net Link States (Area 3)
Routing Bit Set on this LSA
LS age: 1 (DoNotAge)
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 150.1.1.1 (summary Network Number)
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0x605A
Length: 28
Network Mask: /32
TOS: 0 Metric: 65
Rack1SW2#show ip ospf database summary 150.1.2.2
OSPF Router with ID (150.1.8.8) (Process ID 1)
Summary Net Link States (Area 3)
Routing Bit Set on this LSA
LS age: 1 (DoNotAge)
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 150.1.2.2 (summary Network Number)
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0x4B6D
Length: 28
Network Mask: /32
TOS: 0 Metric: 65
Note: SW4 has similar result with SW2.
Saturday, July 2, 2011
LAB: OSPF Reliable Conditional default routing using IP SLA
- Remove the previous default route advertisement on R4.
- Configure an IP SLA instance on R4 to check ICMP reachability to BB3 every five seconds.
- R4 should advertise a default route into OSPF, but only if the SLA
monitoring reports its status as OK.
Conditional default routing by monitoring layer 2 interface state is not a good indication of end-to-end reachability. A good design is to employ IPL SLA tracking which is more reliable than layer 2 interface status, this provides an accurate end-to-end reachability information.
Rack1R4(config)#ip sla monitor 1
Rack1R4(config-sla-monitor)#type echo protocol ipicmpEcho 204.12.1.254
Rack1R4(config-sla-monitor-echo)#timeout 2000
Rack1R4(config-sla-monitor-echo)#frequency 5
Rack1R4(config-sla-monitor-echo)#exit
Rack1R4(config)#ip sla monitor schedule 1 start-time now life forever
Rack1R4(config)#track 1 rtr 1
Rack1R4(config)#ip route 169.254.0.1 255.255.255.255 null0 track 1
configuring the route-map
Rack1R4(config)#router ospf 1
Rack1R4(config-router)#default-information originate always route-map TRACK_PLACEHOLDER
before shutting down SW4 fa0/24 on the far-end of the connection.
shutting down SW4 fa0/24
Rack1R4#
*Mar 1 01:41:29.419: %TRACKING-5-STATE: 1 rtr 1 state Up->Down
Rack1R4#show ip route 169.254.0.1
% Network not in table
Rack1R4#show ip ospf database | inc _0.0.0.0
0.0.0.0 150.1.6.6 1288 0x80000002 0x009776 1
- Configure an IP SLA instance on R4 to check ICMP reachability to BB3 every five seconds.
- R4 should advertise a default route into OSPF, but only if the SLA
monitoring reports its status as OK.
Conditional default routing by monitoring layer 2 interface state is not a good indication of end-to-end reachability. A good design is to employ IPL SLA tracking which is more reliable than layer 2 interface status, this provides an accurate end-to-end reachability information.
Rack1R4(config)#ip sla monitor 1
Rack1R4(config-sla-monitor)#type echo protocol ipicmpEcho 204.12.1.254
Rack1R4(config-sla-monitor-echo)#timeout 2000
Rack1R4(config-sla-monitor-echo)#frequency 5
Rack1R4(config-sla-monitor-echo)#exit
Rack1R4(config)#ip sla monitor schedule 1 start-time now life forever
Rack1R4(config)#track 1 rtr 1
Rack1R4(config)#ip route 169.254.0.1 255.255.255.255 null0 track 1
Rack1R4#show track
Track 1
Response Time Reporter 1 state
State is Up
1 change, last change 00:02:35
Latest operation return code: OK
Latest RTT (millisecs) 36
Tracked by:
STATIC-IP-ROUTING 0
Track 1
Response Time Reporter 1 state
State is Up
1 change, last change 00:02:35
Latest operation return code: OK
Latest RTT (millisecs) 36
Tracked by:
STATIC-IP-ROUTING 0
configuring the route-map
Rack1R4(config)#ip prefix-list PLACEHOLDER permit 169.254.0.1/32
Rack1R4(config)#route-map TRACK_PLACEHOLDER
Rack1R4(config-route-map)#match ip address prefix-list PLACEHOLDER
Rack1R4(config-route-map)#match ip address prefix-list PLACEHOLDER
Rack1R4(config)#router ospf 1
Rack1R4(config-router)#default-information originate always route-map TRACK_PLACEHOLDER
before shutting down SW4 fa0/24 on the far-end of the connection.
Rack1R4#show ip ospf database | inc _0.0.0.0
0.0.0.0 150.1.4.4 44 0x80000001 0x00B35F 1
0.0.0.0 150.1.6.6 1152 0x80000002 0x009776 1
Rack1R4#
Rack1R4#show ip route 169.254.0.1
Routing entry for 169.254.0.1/32
Known via "static", distance 1, metric 0 (connected)
Routing Descriptor Blocks:
* directly connected, via Null0
Route metric is 0, traffic share count is 1
0.0.0.0 150.1.4.4 44 0x80000001 0x00B35F 1
0.0.0.0 150.1.6.6 1152 0x80000002 0x009776 1
Rack1R4#
Rack1R4#show ip route 169.254.0.1
Routing entry for 169.254.0.1/32
Known via "static", distance 1, metric 0 (connected)
Routing Descriptor Blocks:
* directly connected, via Null0
Route metric is 0, traffic share count is 1
shutting down SW4 fa0/24
Rack1R4#
*Mar 1 01:41:29.419: %TRACKING-5-STATE: 1 rtr 1 state Up->Down
Rack1R4#show ip route 169.254.0.1
% Network not in table
Rack1R4#show ip ospf database | inc _0.0.0.0
0.0.0.0 150.1.6.6 1288 0x80000002 0x009776 1
LAB: OSPF Conditional Routing
- Remove the previous default route advertisement on R6.
- Configure R6 to originate a default route into OSPF, but only if the local Serial interface connecting to BB1 is up.
conditional default-information origination in OSPF can use route-map to check the existence of a specific prefix in the routing table before the default route is originated.
int this scenario R6 is tracking the s0/0 interface which leads to the upstream network.
Rack1R6(config)#router ospf 1
Rack1R6(config-router)#default-information originate always route-map TRACK_LINK_TO_BB1
@ R1 before shutting down R6's s0/0 interface
after shutting down R6's s0/0 interface, R6 type-5 external 0.0.0.0 route is not in the database.
Rack1R1#show ip ospf database external 0.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 349
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000002
Checksum: 0xB5B5
Length: 36
Network Mask: /0
Metric Type: 1 (Comparable directly to link state metric)
TOS: 0
Metric: 40
Forward Address: 0.0.0.0
External Route Tag: 1
- Configure R6 to originate a default route into OSPF, but only if the local Serial interface connecting to BB1 is up.
conditional default-information origination in OSPF can use route-map to check the existence of a specific prefix in the routing table before the default route is originated.
int this scenario R6 is tracking the s0/0 interface which leads to the upstream network.
Rack1R6(config)#ip prefix-list LINK_TO_BB1 SEq 5 PERmit 54.1.1.0/24
Rack1R6(config)#route-map TRACK_LINK_TO_BB1 permit 10
Rack1R6(config-route-map)#match ip address prefix-list LINK_TO_BB1
Rack1R6(config)#route-map TRACK_LINK_TO_BB1 permit 10
Rack1R6(config-route-map)#match ip address prefix-list LINK_TO_BB1
Rack1R6(config-router)#default-information originate always route-map TRACK_LINK_TO_BB1
@ R1 before shutting down R6's s0/0 interface
Rack1R1#show ip ospf database external 0.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 298
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000002
Checksum: 0xB5B5
Length: 36
Network Mask: /0
Metric Type: 1 (Comparable directly to link state metric)
TOS: 0
Metric: 40
Forward Address: 0.0.0.0
External Route Tag: 1
LS age: 50
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.6.6
LS Seq Number: 80000003
Checksum: 0x9577
Length: 36
Network Mask: /0
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 1
Forward Address: 0.0.0.0
External Route Tag: 1
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 298
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000002
Checksum: 0xB5B5
Length: 36
Network Mask: /0
Metric Type: 1 (Comparable directly to link state metric)
TOS: 0
Metric: 40
Forward Address: 0.0.0.0
External Route Tag: 1
LS age: 50
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.6.6
LS Seq Number: 80000003
Checksum: 0x9577
Length: 36
Network Mask: /0
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 1
Forward Address: 0.0.0.0
External Route Tag: 1
after shutting down R6's s0/0 interface, R6 type-5 external 0.0.0.0 route is not in the database.
Rack1R1#show ip ospf database external 0.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 349
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000002
Checksum: 0xB5B5
Length: 36
Network Mask: /0
Metric Type: 1 (Comparable directly to link state metric)
TOS: 0
Metric: 40
Forward Address: 0.0.0.0
External Route Tag: 1
LAB: OSPF Default Routing
- Configure R6 with a static default route pointing to BB1.
- Configure R6 to originate an external type-2 default route with a metric of 60 into OSPF as long as the static default route is installed in the routing table.
- Do not use a route-map to accomplish this.
- Configure R4 to originate an external type-1 default route with a metric of 40 regardless of whether it has a default route already installed in the routing table.
On a non-stub areas default routing is achieve by using default-information originate command. OSPF first checks to see if a default route is installed in the routing table. if the default route exists either via static or learned via other routing protocols, the OSPF default route is originated. but if the default route is not found, no origination will occur. This design is desirable whereby you have 2 or more exit points out of the OSPF domain to ISP network. Individual exit point will only originate a default traffic if they themselves have a default exit point to upstream network.
the default-information originate always argument skips over the checking for a default route already being installed in the table.
Rack1R1#show ip ospf database external 0.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
command sets
Rack1R4(config)#router ospf 1
Rack1R4(config-router)#default-information originate always metric 40 metric-type 1
verification:
R4 is originating a E1 default route with metric of 40 and R6 with default E2 metric of 60. same route logic is applied to these default routes. E1 is proffered over E2. and if both are E2 then forward metrics are compared.
- Configure R6 to originate an external type-2 default route with a metric of 60 into OSPF as long as the static default route is installed in the routing table.
- Do not use a route-map to accomplish this.
- Configure R4 to originate an external type-1 default route with a metric of 40 regardless of whether it has a default route already installed in the routing table.
On a non-stub areas default routing is achieve by using default-information originate command. OSPF first checks to see if a default route is installed in the routing table. if the default route exists either via static or learned via other routing protocols, the OSPF default route is originated. but if the default route is not found, no origination will occur. This design is desirable whereby you have 2 or more exit points out of the OSPF domain to ISP network. Individual exit point will only originate a default traffic if they themselves have a default exit point to upstream network.
the default-information originate always argument skips over the checking for a default route already being installed in the table.
Rack1R1#show ip ospf database external 0.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
command sets
Rack1R6(config)#router ospf 1
Rack1R6(config-router)#default-information originate metric 60
Rack1R6(config-router)#default-information originate metric 60
Rack1R4(config-router)#default-information originate always metric 40 metric-type 1
verification:
R4 is originating a E1 default route with metric of 40 and R6 with default E2 metric of 60. same route logic is applied to these default routes. E1 is proffered over E2. and if both are E2 then forward metrics are compared.
Rack1R1#show ip ospf database external 0.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 2 (DoNotAge)
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000001
Checksum: 0xB7B4
Length: 36
Network Mask: /0
Metric Type: 1 (Comparable directly to link state metric)
TOS: 0
Metric: 40
Forward Address: 0.0.0.0
External Route Tag: 1
Routing Bit Set on this LSA
LS age: 173
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.6.6
LS Seq Number: 80000001
Checksum: 0xE9E9
Length: 36
Network Mask: /0
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 60
Forward Address: 0.0.0.0
External Route Tag: 1
Rack1R1#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 41, candidate default path
Tag 1, type extern 1
Last update from 155.1.146.4 on FastEthernet0/0, 00:00:13 ago
Routing Descriptor Blocks:
* 155.1.146.4, from 150.1.4.4, 00:00:13 ago, via FastEthernet0/0
Route metric is 41, traffic share count is 1
Route tag 1
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 2 (DoNotAge)
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000001
Checksum: 0xB7B4
Length: 36
Network Mask: /0
Metric Type: 1 (Comparable directly to link state metric)
TOS: 0
Metric: 40
Forward Address: 0.0.0.0
External Route Tag: 1
Routing Bit Set on this LSA
LS age: 173
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 0.0.0.0 (External Network Number )
Advertising Router: 150.1.6.6
LS Seq Number: 80000001
Checksum: 0xE9E9
Length: 36
Network Mask: /0
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 60
Forward Address: 0.0.0.0
External Route Tag: 1
Rack1R1#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
Known via "ospf 1", distance 110, metric 41, candidate default path
Tag 1, type extern 1
Last update from 155.1.146.4 on FastEthernet0/0, 00:00:13 ago
Routing Descriptor Blocks:
* 155.1.146.4, from 150.1.4.4, 00:00:13 ago, via FastEthernet0/0
Route metric is 41, traffic share count is 1
Route tag 1
LAB: OSPF Forwarding Address Supression
- Modify R5’s NSSA configuration so that devices outside of area 3 maintain connectivity to SW4’s redistributed Loopback 10.10.10.10/32.
for External routes in OSPF database, the Forward Address field determines who the next recursive lookup should be performed towards. for Type-5 external LSAs, such as RIP routes R4 redistributes into OSPF, the forward address is normally set to 0.0.0.0. it means the next router lookup should be performed towards the Advertising router.
Examining the normal Type-5 External LSA lookup, the output below shows the forward Address is 0.0.0.0 and the advertising router is 150.1.4.4
R1 sees that the DR for VLAN 146 is R6 155.1.146.1
Rack1R1#show ip ospf database network 155.1.146.6
OSPF Router with ID (150.1.1.1) (Process ID 1)
Net Link States (Area 1)
Routing Bit Set on this LSA
LS age: 406
Options: (No TOS-capability, DC)
LS Type: Network Links
Link State ID: 155.1.146.6 (address of Designated Router)
Advertising Router: 150.1.6.6
LS Seq Number: 80000001
Checksum: 0x324E
Length: 36
Network Mask: /24
Attached Router: 150.1.6.6
Attached Router: 150.1.1.1
Attached Router: 150.1.4.4
the output below shows that the 30.0.0.1 route is reachable via R4 with metric of 20 (type-2 external) and forwarding metric of 1.
Rack1R1#show ip route 30.0.0.1
Routing entry for 30.0.0.0/16
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 1
Last update from 155.1.146.4 on FastEthernet0/0, 00:05:41 ago
Routing Descriptor Blocks:
* 155.1.146.4, from 150.1.4.4, 00:05:41 ago, via FastEthernet0/0
Route metric is 20, traffic share count is 1
Examining the Type-5 External LSA that was translated from a type-7 NSSA External LSA.
in this scenario SW4 redistribute routes 10.10.10.10/32 into area 3 as a type-7 NSSA External LSA and R5 translate it into a Type-5 External LSA as it moves to area 0.
the output below shows a non-zero forwarding address, so the next recursive lookup is performed towards 150.10.10.10 , instead of the advertising router 150.1.5.5.
Rack1R3#show ip ospf database external 10.10.10.10
OSPF Router with ID (150.1.3.3) (Process ID 1)
Type-5 AS External Link States
LS age: 547
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 10.10.10.10 (External Network Number )
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0x1912
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 150.1.10.10
External Route Tag: 0
Rack1R3#show ip route 150.1.10.10
% Subnet not in table
the problem here is that 150.1.10.0 LSAs was filtered out at ABR R5. so the recursion towards the forwarding address fails and it cannot be installed in the routing table.
the solution here is the supression of forwarding address in translated type-5 LSAs. which instructs ABRs to not preserve the value in the forward address field as a type-7 NSSA External LSA is traslated into a type-5 Extenal LSA.
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#area 3 nssa no-redistribution no-summary translate type7 suppress-fa
verification: the result ow is that R3 now sees the forward address to be 0.0.0.0 which means a lookup must be performed on the advertising router 150.1.5.5
final result is that the external route is installed with a metric of 20 which derive from SW4 default redistribution metric type-2 , plus the forward metric of 65.
Rack1R3#show ip route 10.10.10.10
Routing entry for 10.10.10.10/32
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 64
Last update from 155.1.0.5 on Serial1/0, 00:00:53 ago
Routing Descriptor Blocks:
* 155.1.0.5, from 150.1.5.5, 00:00:53 ago, via Serial1/0
Route metric is 20, traffic share count is 1
Suboptimal routing may be introduced when there are multiple exit points out of the NSSA.
for type7 to type5 translator the ABR with the highest router-id wins. also the forward address calcution is kept separate which is base in metric. in short, the control plane advertisement of the route does not need to do the following the traffic forwarding plane, but with the forwarding address supression the traffic will always flow through the type-7 to 5 translator.
in this scenario. SW3's loopback int 9.9.9.9/32 that was redistributed to area 2. R5 sees the external LSA 9.9.9.9/32 with a advertising router 150.1.30.30 R3 (type 7 to 5 translator) and a forward address of 150.1.9.9
the lookup towards 150.1.9.9 results of using R6 exit point in area 2 via R1.
Rack1R5#show ip route 150.1.9.9
Routing entry for 150.1.9.0/24
Known via "ospf 1", distance 110, metric 68, type inter area
Last update from 155.1.0.1 on Serial0/0, 00:02:11 ago
Routing Descriptor Blocks:
* 155.1.0.1, from 150.1.6.6, 00:02:11 ago, via Serial0/0
Route metric is 68, traffic share count is 1
verified using traceroute
Rack1R5#traceroute 9.9.9.9
Type escape sequence to abort.
Tracing the route to 9.9.9.9
1 155.1.0.1 16 msec 60 msec 12 msec
2 155.1.146.6 56 msec 40 msec 12 msec
3 155.1.67.7 12 msec 12 msec 8 msec
4 155.1.79.9 8 msec * 44 msec
now adding the translate type7 supress-fa command
Rack1R3(config)#router ospf 1
Rack1R3(config-router)#area 2 nssa no-summary translate type7 suppress-fa
verification:
for External routes in OSPF database, the Forward Address field determines who the next recursive lookup should be performed towards. for Type-5 external LSAs, such as RIP routes R4 redistributes into OSPF, the forward address is normally set to 0.0.0.0. it means the next router lookup should be performed towards the Advertising router.
Examining the normal Type-5 External LSA lookup, the output below shows the forward Address is 0.0.0.0 and the advertising router is 150.1.4.4
Rack1R1#show ip ospf database external 30.0.0.0
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 2 (DoNotAge)
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 30.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000001
Checksum: 0xD80A
Length: 36
Network Mask: /16
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
OSPF Router with ID (150.1.1.1) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 2 (DoNotAge)
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 30.0.0.0 (External Network Number )
Advertising Router: 150.1.4.4
LS Seq Number: 80000001
Checksum: 0xD80A
Length: 36
Network Mask: /16
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
R1 sees that the DR for VLAN 146 is R6 155.1.146.1
Rack1R1#show ip ospf database router 150.1.1.1 self-originate | begi Area 1
Router Link States (Area 1)
LS age: 294
Options: (No TOS-capability, DC)
LS Type: Router Links
Link State ID: 150.1.1.1
Advertising Router: 150.1.1.1
LS Seq Number: 80000002
Checksum: 0xADEA
Length: 36
Area Border Router
Number of Links: 1
Link connected to: a Transit Network
(Link ID) Designated Router address: 155.1.146.6
(Link Data) Router Interface address: 155.1.146.1
Number of TOS metrics: 0
TOS 0 Metrics: 1
Router Link States (Area 1)
LS age: 294
Options: (No TOS-capability, DC)
LS Type: Router Links
Link State ID: 150.1.1.1
Advertising Router: 150.1.1.1
LS Seq Number: 80000002
Checksum: 0xADEA
Length: 36
Area Border Router
Number of Links: 1
Link connected to: a Transit Network
(Link ID) Designated Router address: 155.1.146.6
(Link Data) Router Interface address: 155.1.146.1
Number of TOS metrics: 0
TOS 0 Metrics: 1
Rack1R1#show ip ospf database network 155.1.146.6
OSPF Router with ID (150.1.1.1) (Process ID 1)
Net Link States (Area 1)
Routing Bit Set on this LSA
LS age: 406
Options: (No TOS-capability, DC)
LS Type: Network Links
Link State ID: 155.1.146.6 (address of Designated Router)
Advertising Router: 150.1.6.6
LS Seq Number: 80000001
Checksum: 0x324E
Length: 36
Network Mask: /24
Attached Router: 150.1.6.6
Attached Router: 150.1.1.1
Attached Router: 150.1.4.4
the output below shows that the 30.0.0.1 route is reachable via R4 with metric of 20 (type-2 external) and forwarding metric of 1.
Routing entry for 30.0.0.0/16
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 1
Last update from 155.1.146.4 on FastEthernet0/0, 00:05:41 ago
Routing Descriptor Blocks:
* 155.1.146.4, from 150.1.4.4, 00:05:41 ago, via FastEthernet0/0
Route metric is 20, traffic share count is 1
Examining the Type-5 External LSA that was translated from a type-7 NSSA External LSA.
in this scenario SW4 redistribute routes 10.10.10.10/32 into area 3 as a type-7 NSSA External LSA and R5 translate it into a Type-5 External LSA as it moves to area 0.
the output below shows a non-zero forwarding address, so the next recursive lookup is performed towards 150.10.10.10 , instead of the advertising router 150.1.5.5.
Rack1R3#show ip ospf database external 10.10.10.10
OSPF Router with ID (150.1.3.3) (Process ID 1)
Type-5 AS External Link States
LS age: 547
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 10.10.10.10 (External Network Number )
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0x1912
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 150.1.10.10
External Route Tag: 0
Rack1R3#show ip route 150.1.10.10
% Subnet not in table
the problem here is that 150.1.10.0 LSAs was filtered out at ABR R5. so the recursion towards the forwarding address fails and it cannot be installed in the routing table.
the solution here is the supression of forwarding address in translated type-5 LSAs. which instructs ABRs to not preserve the value in the forward address field as a type-7 NSSA External LSA is traslated into a type-5 Extenal LSA.
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#area 3 nssa no-redistribution no-summary translate type7 suppress-fa
verification: the result ow is that R3 now sees the forward address to be 0.0.0.0 which means a lookup must be performed on the advertising router 150.1.5.5
Rack1R3#show ip ospf database external 10.10.10.10
OSPF Router with ID (150.1.30.30) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 24
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 10.10.10.10 (External Network Number )
Advertising Router: 150.1.5.5
LS Seq Number: 80000002
Checksum: 0x8352
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
OSPF Router with ID (150.1.30.30) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 24
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 10.10.10.10 (External Network Number )
Advertising Router: 150.1.5.5
LS Seq Number: 80000002
Checksum: 0x8352
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
Rack1R3#show ip ospf database router 150.1.30.30 self-originate
OSPF Router with ID (150.1.30.30) (Process ID 1)
Router Link States (Area 0)
LS age: 54
Options: (No TOS-capability, DC)
LS Type: Router Links
Link State ID: 150.1.30.30
Advertising Router: 150.1.30.30
LS Seq Number: 80000004
Checksum: 0xEEB8
Length: 60
Area Border Router
AS Boundary Router
Number of Links: 3
Link connected to: another Router (point-to-point)
(Link ID) Neighboring Router ID: 150.1.5.5
(Link Data) Router Interface address: 155.1.0.3
Number of TOS metrics: 0
TOS 0 Metrics: 64
OSPF Router with ID (150.1.30.30) (Process ID 1)
Router Link States (Area 0)
LS age: 54
Options: (No TOS-capability, DC)
LS Type: Router Links
Link State ID: 150.1.30.30
Advertising Router: 150.1.30.30
LS Seq Number: 80000004
Checksum: 0xEEB8
Length: 60
Area Border Router
AS Boundary Router
Number of Links: 3
Link connected to: another Router (point-to-point)
(Link ID) Neighboring Router ID: 150.1.5.5
(Link Data) Router Interface address: 155.1.0.3
Number of TOS metrics: 0
TOS 0 Metrics: 64
final result is that the external route is installed with a metric of 20 which derive from SW4 default redistribution metric type-2 , plus the forward metric of 65.
Routing entry for 10.10.10.10/32
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 64
Last update from 155.1.0.5 on Serial1/0, 00:00:53 ago
Routing Descriptor Blocks:
* 155.1.0.5, from 150.1.5.5, 00:00:53 ago, via Serial1/0
Route metric is 20, traffic share count is 1
Suboptimal routing may be introduced when there are multiple exit points out of the NSSA.
for type7 to type5 translator the ABR with the highest router-id wins. also the forward address calcution is kept separate which is base in metric. in short, the control plane advertisement of the route does not need to do the following the traffic forwarding plane, but with the forwarding address supression the traffic will always flow through the type-7 to 5 translator.
in this scenario. SW3's loopback int 9.9.9.9/32 that was redistributed to area 2. R5 sees the external LSA 9.9.9.9/32 with a advertising router 150.1.30.30 R3 (type 7 to 5 translator) and a forward address of 150.1.9.9
Rack1R5#show ip ospf database external 9.9.9.9
OSPF Router with ID (150.1.5.5) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 112
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 9.9.9.9 (External Network Number )
Advertising Router: 150.1.30.30
LS Seq Number: 80000001
Checksum: 0xE519
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 150.1.9.9
External Route Tag: 0
OSPF Router with ID (150.1.5.5) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 112
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 9.9.9.9 (External Network Number )
Advertising Router: 150.1.30.30
LS Seq Number: 80000001
Checksum: 0xE519
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 150.1.9.9
External Route Tag: 0
the lookup towards 150.1.9.9 results of using R6 exit point in area 2 via R1.
Rack1R5#show ip route 150.1.9.9
Routing entry for 150.1.9.0/24
Known via "ospf 1", distance 110, metric 68, type inter area
Last update from 155.1.0.1 on Serial0/0, 00:02:11 ago
Routing Descriptor Blocks:
* 155.1.0.1, from 150.1.6.6, 00:02:11 ago, via Serial0/0
Route metric is 68, traffic share count is 1
verified using traceroute
Rack1R5#traceroute 9.9.9.9
Type escape sequence to abort.
Tracing the route to 9.9.9.9
1 155.1.0.1 16 msec 60 msec 12 msec
2 155.1.146.6 56 msec 40 msec 12 msec
3 155.1.67.7 12 msec 12 msec 8 msec
4 155.1.79.9 8 msec * 44 msec
now adding the translate type7 supress-fa command
Rack1R3(config)#router ospf 1
Rack1R3(config-router)#area 2 nssa no-summary translate type7 suppress-fa
verification:
Rack1R5#show ip ospf database external 9.9.9.9
OSPF Router with ID (150.1.5.5) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 112
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 9.9.9.9 (External Network Number )
Advertising Router: 150.1.30.30
LS Seq Number: 80000001
Checksum: 0xE519
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
OSPF Router with ID (150.1.5.5) (Process ID 1)
Type-5 AS External Link States
Routing Bit Set on this LSA
LS age: 112
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 9.9.9.9 (External Network Number )
Advertising Router: 150.1.30.30
LS Seq Number: 80000001
Checksum: 0xE519
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 0.0.0.0
External Route Tag: 0
Rack1R5#traceroute 9.9.9.9
Type escape sequence to abort.
Tracing the route to 9.9.9.9
1 155.1.0.1 16 msec 60 msec 12 msec
2 155.1.146.6 56 msec 40 msec 12 msec
3 155.1.67.7 12 msec 12 msec 8 msec
4 155.1.79.9 8 msec * 44 msec
Type escape sequence to abort.
Tracing the route to 9.9.9.9
1 155.1.0.1 16 msec 60 msec 12 msec
2 155.1.146.6 56 msec 40 msec 12 msec
3 155.1.67.7 12 msec 12 msec 8 msec
4 155.1.79.9 8 msec * 44 msec
Rack1R5#show ip route 9.9.9.9
Routing entry for 9.9.9.9/32
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 64
Last update from 155.1.0.3 on Serial0/0, 01:37:23 ago
Routing Descriptor Blocks:
* 155.1.0.3, from 150.1.30.30, 01:37:23 ago, via Serial0/0
Route metric is 20, traffic share count is 1
Routing entry for 9.9.9.9/32
Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 64
Last update from 155.1.0.3 on Serial0/0, 01:37:23 ago
Routing Descriptor Blocks:
* 155.1.0.3, from 150.1.30.30, 01:37:23 ago, via Serial0/0
Route metric is 20, traffic share count is 1
LAB: OSPF LSA Type-3 Filtering
- Configure LSA Type-3 Filtering on R5 so that devices in area 0 do not have reachability information about the layer 3 EtherChannel link between SW2 and SW4 or SW4’s Loopback0 interface.
- Configure LSA Type-3 Filtering on R2 so that devices in area 51 do not have reachability information about the Loopback0 interface of R5; this should not affect devices in area 5.
LSA Type-3 Filtering is used to remove or filter LSAs from the database as advertisements move between areas. it can be used to permit/deny any arbitrary inter-area routes based on a prefix-list.
filter list syntax supports both direction in/out allow to control LSAs especially on ABRs that terminate multiple areas.
on this scenario for R5 which is the ABR for area 0 and area 3 only. we can use the syntax
area 3 filter-list prefix AREA_3_ROUTES out
orarea 0 filter-list prefix AREA_3_ROUTES in
achieving the same result.while on R2 which is the ABR of Areas 0, 5 and 51. filtering devices in area 51 to not have reachability information about the loopback int of R5.
area 51 filter-list prefix R5_LOOPBACK out this will apply to prefixes leaving area 0 going into 5 and 51, which in this case R5 loopback would not enter area 5 and 51 on R2.
area 51 filter-list prefix R5_LOOPBACK in this will apply prefixes leaving area 0 and 51, R5's loopback enters area 5 but not area 51.
Rack1R2#show ip ospf database | begin Area 51
*Mar 1 00:37:12.751: %SYS-5-CONFIG_I: Configured from console by console
Rack1R2#show ip ospf database | begin Area 51
Router Link States (Area 51)
Link ID ADV Router Age Seq# Checksum Link count
150.1.2.2 150.1.2.2 239 0x80000003 0x003AF9 1
192.10.1.254 192.10.1.254 195 0x80000003 0x00E61D 1
Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
192.10.1.254 192.10.1.254 195 0x80000002 0x0091AB
Summary Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
150.1.1.1 150.1.2.2 716 0x80000001 0x008B09
150.1.2.2 150.1.2.2 856 0x80000001 0x004ABA
150.1.3.3 150.1.2.2 837 0x80000001 0x00DFF0
150.1.4.4 150.1.2.2 804 0x80000001 0x004C42
150.1.5.5 150.1.2.2 3600 0x80000002 0x00FEFF
150.1.6.6 150.1.2.2 774 0x80000001 0x002C5D
150.1.7.0 150.1.2.2 239 0x80000003 0x006328
150.1.8.0 150.1.2.2 239 0x80000002 0x00CEFD
150.1.9.0 150.1.2.2 239 0x80000003 0x005731
*Mar 1 00:37:12.751: %SYS-5-CONFIG_I: Configured from console by console
Rack1R2#show ip ospf database | begin Area 51
Router Link States (Area 51)
Link ID ADV Router Age Seq# Checksum Link count
150.1.2.2 150.1.2.2 239 0x80000003 0x003AF9 1
192.10.1.254 192.10.1.254 195 0x80000003 0x00E61D 1
Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
192.10.1.254 192.10.1.254 195 0x80000002 0x0091AB
Summary Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
150.1.1.1 150.1.2.2 716 0x80000001 0x008B09
150.1.2.2 150.1.2.2 856 0x80000001 0x004ABA
150.1.3.3 150.1.2.2 837 0x80000001 0x00DFF0
150.1.4.4 150.1.2.2 804 0x80000001 0x004C42
150.1.5.5 150.1.2.2 3600 0x80000002 0x00FEFF
150.1.6.6 150.1.2.2 774 0x80000001 0x002C5D
150.1.7.0 150.1.2.2 239 0x80000003 0x006328
150.1.8.0 150.1.2.2 239 0x80000002 0x00CEFD
150.1.9.0 150.1.2.2 239 0x80000003 0x005731
Rack1R2(config)#ip prefix-list R5_LOOPBACK deny 150.1.5.5/32
Rack1R2(config)#ip prefix-list R5_LOOPBACK permit 0.0.0.0/0 le 32
Rack1R2(config)#router ospf 1
Rack1R2(config-router)#area 51 filter-list prefix R5_LOOPBACK in
verification
Rack1R2#show ip ospf database | begin Area 51
Router Link States (Area 51)
Link ID ADV Router Age Seq# Checksum Link count
150.1.2.2 150.1.2.2 263 0x80000003 0x003AF9 1
192.10.1.254 192.10.1.254 219 0x80000003 0x00E61D 1
Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
192.10.1.254 192.10.1.254 219 0x80000002 0x0091AB
Summary Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
150.1.1.1 150.1.2.2 740 0x80000001 0x008B09
150.1.2.2 150.1.2.2 880 0x80000001 0x004ABA
150.1.3.3 150.1.2.2 861 0x80000001 0x00DFF0
150.1.4.4 150.1.2.2 828 0x80000001 0x004C42
150.1.6.6 150.1.2.2 798 0x80000001 0x002C5D
150.1.7.0 150.1.2.2 263 0x80000003 0x006328
150.1.8.0 150.1.2.2 263 0x80000002 0x00CEFD
150.1.9.0 150.1.2.2 263 0x80000003 0x005731
150.1.10.0 150.1.2.2 263 0x80000002 0x00999A
Router Link States (Area 51)
Link ID ADV Router Age Seq# Checksum Link count
150.1.2.2 150.1.2.2 263 0x80000003 0x003AF9 1
192.10.1.254 192.10.1.254 219 0x80000003 0x00E61D 1
Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
192.10.1.254 192.10.1.254 219 0x80000002 0x0091AB
Summary Net Link States (Area 51)
Link ID ADV Router Age Seq# Checksum
150.1.1.1 150.1.2.2 740 0x80000001 0x008B09
150.1.2.2 150.1.2.2 880 0x80000001 0x004ABA
150.1.3.3 150.1.2.2 861 0x80000001 0x00DFF0
150.1.4.4 150.1.2.2 828 0x80000001 0x004C42
150.1.6.6 150.1.2.2 798 0x80000001 0x002C5D
150.1.7.0 150.1.2.2 263 0x80000003 0x006328
150.1.8.0 150.1.2.2 263 0x80000002 0x00CEFD
150.1.9.0 150.1.2.2 263 0x80000003 0x005731
150.1.10.0 150.1.2.2 263 0x80000002 0x00999A
Rack1R2#show ip ospf database | begin Area 5
Router Link States (Area 5)
Link ID ADV Router Age Seq# Checksum Link count
150.1.2.2 150.1.2.2 1707 0x80000004 0x00B5C4 2
150.1.3.3 150.1.3.3 1708 0x80000002 0x00F5E3 2
Summary Net Link States (Area 5)
Link ID ADV Router Age Seq# Checksum
150.1.1.1 150.1.2.2 755 0x80000001 0x008B09
150.1.1.1 150.1.3.3 756 0x80000001 0x00572D
150.1.2.2 150.1.2.2 894 0x80000001 0x004ABA
150.1.3.3 150.1.3.3 877 0x80000001 0x0028D8
150.1.4.4 150.1.2.2 843 0x80000001 0x004C42
150.1.4.4 150.1.3.3 844 0x80000001 0x001866
150.1.5.5 150.1.2.2 1040 0x80000001 0x00B517
150.1.5.5 150.1.3.3 1040 0x80000001 0x00803C
150.1.6.6 150.1.2.2 813 0x80000001 0x002C5D
150.1.6.6 150.1.3.3 813 0x80000001 0x00F781
150.1.7.0 150.1.2.2 278 0x80000003 0x006328
150.1.7.0 150.1.3.3 1666 0x80000001 0x004EC5
150.1.8.0 150.1.2.2 278 0x80000002 0x00CEFD
150.1.8.0 150.1.3.3 1628 0x80000001 0x009B22
150.1.9.0 150.1.2.2 278 0x80000003 0x005731
150.1.9.0 150.1.3.3 1668 0x80000001 0x0042CE
150.1.10.0 150.1.2.2 280 0x80000002 0x00999A
150.1.10.0 150.1.3.3 1630 0x80000001 0x0067BD
155.1.0.1 150.1.2.2 280 0x80000002 0x004947
155.1.0.1 150.1.3.3 1630 0x80000001 0x00176A
155.1.0.2 150.1.2.2 280 0x80000002 0x0013EE
155.1.0.3 150.1.3.3 1711 0x80000001 0x00FD02
155.1.0.4 150.1.2.2 280 0x80000002 0x002B62
155.1.0.4 150.1.3.3 1630 0x80000001 0x00F885
155.1.0.5 150.1.2.2 280 0x80000002 0x009F2D
155.1.0.5 150.1.3.3 1630 0x80000001 0x006C51
155.1.5.0 150.1.2.2 280 0x80000002 0x00A427
155.1.5.0 150.1.3.3 1630 0x80000001 0x00714B
155.1.7.0 150.1.2.2 280 0x80000003 0x002264
155.1.7.0 150.1.3.3 1668 0x80000001 0x000D02
155.1.8.0 150.1.2.2 280 0x80000002 0x00A00D
155.1.8.0 150.1.3.3 1630 0x80000001 0x006E30
155.1.9.0 150.1.2.2 280 0x80000003 0x00166D
155.1.9.0 150.1.3.3 1668 0x80000001 0x00010B
155.1.13.0 150.1.3.3 1711 0x80000001 0x000FA6
155.1.37.0 150.1.2.2 280 0x80000003 0x00D691
155.1.37.0 150.1.3.3 1711 0x80000001 0x00B73A
Router Link States (Area 5)
Link ID ADV Router Age Seq# Checksum Link count
150.1.2.2 150.1.2.2 1707 0x80000004 0x00B5C4 2
150.1.3.3 150.1.3.3 1708 0x80000002 0x00F5E3 2
Summary Net Link States (Area 5)
Link ID ADV Router Age Seq# Checksum
150.1.1.1 150.1.2.2 755 0x80000001 0x008B09
150.1.1.1 150.1.3.3 756 0x80000001 0x00572D
150.1.2.2 150.1.2.2 894 0x80000001 0x004ABA
150.1.3.3 150.1.3.3 877 0x80000001 0x0028D8
150.1.4.4 150.1.2.2 843 0x80000001 0x004C42
150.1.4.4 150.1.3.3 844 0x80000001 0x001866
150.1.5.5 150.1.2.2 1040 0x80000001 0x00B517
150.1.5.5 150.1.3.3 1040 0x80000001 0x00803C
150.1.6.6 150.1.2.2 813 0x80000001 0x002C5D
150.1.6.6 150.1.3.3 813 0x80000001 0x00F781
150.1.7.0 150.1.2.2 278 0x80000003 0x006328
150.1.7.0 150.1.3.3 1666 0x80000001 0x004EC5
150.1.8.0 150.1.2.2 278 0x80000002 0x00CEFD
150.1.8.0 150.1.3.3 1628 0x80000001 0x009B22
150.1.9.0 150.1.2.2 278 0x80000003 0x005731
150.1.9.0 150.1.3.3 1668 0x80000001 0x0042CE
150.1.10.0 150.1.2.2 280 0x80000002 0x00999A
150.1.10.0 150.1.3.3 1630 0x80000001 0x0067BD
155.1.0.1 150.1.2.2 280 0x80000002 0x004947
155.1.0.1 150.1.3.3 1630 0x80000001 0x00176A
155.1.0.2 150.1.2.2 280 0x80000002 0x0013EE
155.1.0.3 150.1.3.3 1711 0x80000001 0x00FD02
155.1.0.4 150.1.2.2 280 0x80000002 0x002B62
155.1.0.4 150.1.3.3 1630 0x80000001 0x00F885
155.1.0.5 150.1.2.2 280 0x80000002 0x009F2D
155.1.0.5 150.1.3.3 1630 0x80000001 0x006C51
155.1.5.0 150.1.2.2 280 0x80000002 0x00A427
155.1.5.0 150.1.3.3 1630 0x80000001 0x00714B
155.1.7.0 150.1.2.2 280 0x80000003 0x002264
155.1.7.0 150.1.3.3 1668 0x80000001 0x000D02
155.1.8.0 150.1.2.2 280 0x80000002 0x00A00D
155.1.8.0 150.1.3.3 1630 0x80000001 0x006E30
155.1.9.0 150.1.2.2 280 0x80000003 0x00166D
155.1.9.0 150.1.3.3 1668 0x80000001 0x00010B
155.1.13.0 150.1.3.3 1711 0x80000001 0x000FA6
155.1.37.0 150.1.2.2 280 0x80000003 0x00D691
155.1.37.0 150.1.3.3 1711 0x80000001 0x00B73A
@ R5
Rack1R5#show ip route | inc 150.1.10.0|155.1.108.0
O 155.1.108.0/24 [110/151] via 155.1.58.8, 00:03:31, FastEthernet0/0
O 150.1.10.0/24 [110/152] via 155.1.58.8, 00:03:31, FastEthernet0/0
O 155.1.108.0/24 [110/151] via 155.1.58.8, 00:03:31, FastEthernet0/0
O 150.1.10.0/24 [110/152] via 155.1.58.8, 00:03:31, FastEthernet0/0
applying filter on R5
Rack1R5(config)#ip prefix-list AREA_3_ROUTES deny 155.1.108.0/24
Rack1R5(config)#ip prefix-list AREA_3_ROUTES deny 150.1.10.0/24
Rack1R5(config)#ip prefix-list AREA_3_ROUTES permit 0.0.0.0/0 le 32
Rack1R5(config)#router ospf 1
Rack1R5(config-router)#area 3 filter-list prefix AREA_3_ROUTES out
Rack1R5(config-router)#end
verification:
Rack1R3#show ip route | inc 150.1.10.0|155.1.108.0
note:
Area 0 have type-5 external LSA 10.10.10.10/32 installed in the database, but not in the routing table, the problem is related to a lookup failure on the forward address 150.1.10.10 which was filtered out at R5.
Rack1R3#show ip ospf database external 10.10.10.10
OSPF Router with ID (150.1.3.3) (Process ID 1)
Type-5 AS External Link States
LS age: 933
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 10.10.10.10 (External Network Number )
Advertising Router: 150.1.5.5
LS Seq Number: 80000003
Checksum: 0x1514
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 150.1.10.10
External Route Tag: 0
Rack1R3#show ip route 10.10.10.10
% Network not in table
OSPF Router with ID (150.1.3.3) (Process ID 1)
Type-5 AS External Link States
LS age: 933
Options: (No TOS-capability, DC)
LS Type: AS External Link
Link State ID: 10.10.10.10 (External Network Number )
Advertising Router: 150.1.5.5
LS Seq Number: 80000003
Checksum: 0x1514
Length: 36
Network Mask: /32
Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 20
Forward Address: 150.1.10.10
External Route Tag: 0
Rack1R3#show ip route 10.10.10.10
% Network not in table
Subscribe to:
Posts (Atom)