Feral Packet

RIPv2

– UDP port 520

– Multicast IP 224.0.0.9

– Classless (not by default)

-> Cannot have discontiguous networks

– Metric is hop count

– Metric 16 is  infinite  metric

– Timers

-> Update timer:   30 seconds

-> Invalid timer:   180 seconds

-> Holddown timer:   180 seconds

-> Flush timer:   240 seconds

– Supports authentication

-> Plain text

-> MD5

– AD is 120

 

router rip

  version 2

  no auto-summary

  network x.x.x.x

 

Mismatched version updates can cause one way communication between the routers

– R1

-> Send v1 updates

-> Receive v1 and v2 updates

– R2

-> Send and receive v2 updates

 

Authentication

– Plain text

– MD5

-> Create key chain

-> Apply to an interface

 

key chain CISCO

  key 1

   key-string CCIE

 

int s0/0

  ip rip authentication mode { text | md5 }

  ip rip authentication key-chain CISCO

 

sh ip protocols

– Lists the authentication method

debug ip rip

– To troubleshoot authentication problems

-> Such as key mismatch

sh key chain

– To see if a space is present in the key-string

 

Summarization

Summary address 10.0.0.0/22

 

int fa0/0

  ip rip summary-address 10.0.0.0 255.255.252.0

 

A summary address is installed into the routing table pointing to the NULL interface

– Used when one of the more specific networks is not rachable

– This prevents the packets from being default routed to 0.0.0.0/0

– Causes packets to be dropped

– Summary address AS is still 120

 

RIP does not create a summary route pointing to NULL0

– Must be created manually

 

ip route 10.0.0.0 255.255.252.0 NULL0

 

172.16.0.0 /24

172.16.1.0 /24

172.16.2.0 /24

172.16.3.0 /24

-> 172.16.0.0 /22

-> Works with RIPv2

 

172.0.0.0 /16

172.1.0.0 /16

172.2.0.0 /16

172.3.0.0 /16

-> 172.0.0.0 /14

-> Will not work with RIPv2

-> Error message when trying to configure

 

RIPv2 summarization is only possible within the limits of a class (A, B, C)

-> RIPv2 summarization is not classless

 

Default Routing

R1(config)# router rip

  default-information originate

 

In other routing tables:

 

R*   0.0.0.0      [120|*]

-> The metric of the summary route is the least metric among more specific routes

 

Conditional Default Routing

In conditional default routing, the exit interface network is checked

– If the network is in the routing table, the default network will be injected

– If the network is not in the routing table, the default route is not injected

 

R1(config)# access-list 1 permit 200.0.0.0 0.0.0.255

route-map DR

  match ip address 1

router rip

  default-information originate route-map DR

 

This is conditional, but not reliable

– Have to make the route-map false to be reliable

– Link may be up, but the connection to the Internet may be down

 

Reliable Conditional Default Routing

– Uses IP SLA

 

Apply to RIP

– IP SLA (Step 1)  <- ->  Track (Step 2)  <– Dummy Static Route (Step 3)  <– Access-list (Step 5)  <– Route-map (Step 5)

 

R1(config)# ip sla 1

  icmp-echo 4.2.2.2

   timeout 2000

-> In milliseconds

frequency 4

-> In seconds

ip sla schedule 1 start-time now life forever

track 1 ip sla 1 reachability

ip route 169.254.0.0 255.255.0.0 NULL0 track 1

access-list 1 permit 169.254.0.0 0.0.255.255

route-map ABC

  match ip address 1

router rip

  default-information originate route-map ABC

 

RIP Filtering

Passive Interface

– It stops sending updates out the specified interface

 

router rip

  passive-interface { <interface> | default }

 

passive-interface default

– Can be used if there are a lot of loopback interfaces that you do not want to advertise

 

Distribute List

– Which network to filter

– Direction ( in | out )

– In | out which interface

-> If not specified, the network will be filtered from all interfaces

– Filter is outsourced!

-> ACL

-> Prefix-list

 

router rip

  distribute-list in | out int

 

router rip

  distribute-list prefix in | out int

 

 

Distribute List – Standard ACL

 

access-list 1 deny 1.1.1.1

access-list 1 permit any

router rip

  distribute-list 1 out fa0/0

Scenario -> Filter all even number octets (in the 3rd octet) of outgoing network

 

255.255.11111110.255

-> I don’t care about the first 7 bits, I only care about the last bit

-> Subnet mask:   255.255.254.255

-> Wild card mask:   0.0.1.0

 

10.0.0.0 – 00000000

10.0.2.0 – 00000010

-> Last bit doesn’t change

-> 0 – don’t care

-> 1 – do care

 

access-list 1 deny 0.0.0.0 255.255.254.255

access-list 1 permit any

 

– or –

 

access-list 1 permit 0.0.1.0 255.255.254.255

 

Distribute List – Extended ACL

 

access-list <number> permit | deny <protocol> <source> <destination>

– Protocol is ip

– Source is update source

– Destination is update network

 

Scenario -> On R1, filter incoming update for network 50.0.0.0 if it is coming from R3

 

R1(config)# access-list 100 deny ip host 123.0.0.3 host 50.0.0.0

access-list 100 permit ip any any

router rip

  distribute-list 100 in

 

Prefix Lists

– More flexible

– Can match on subnet masks

 

ip prefix-list <name> [seq <number>] permit | deny <network/wildcard mask> [le | ge <0 – 32>]

– <network/wildcard mask> – prefix

 

– le | ge – subnet mask

access-list <number> permit | deny <network> <wildcard mask>

 

10.0.0.0 0.255.255.255

 

10.0.0.0 /22

10.0.0.0 /24

 

ip prefix-list LIST1 deny 10.0.0.0/8 ge 24 le 24

– Matches 10.0.0.0 /24

 

Match any network starting with 172.16.x.x with subnet mask from 255.255.0.0 to 255.255.255.0

 

255.255.0.0           -> /16

255.255.128.0       -> /17

255.255.192.0       -> /18

255.255.224.0       -> /19

255.255.240.0       -> /20

255.255.248.0       -> /21

255.255.252.0       -> /22

255.255.254.0       -> /23

255.255.255.0       -> /24

 

ip prefix-list ABC deny 172.16.0.0/16 ge 16 le 24

 

1.

– Wildcard ->16

– Range -> 16 – 24

2.

– Wildcard -> 16

– Range -> 18 – 32

-> If on the exam, upper boundary is not specific, assume it’s 32

3.

– Wildcard -> 16

– Range -> 18 – 24

 

ip prefix-list ABC deny 172.16.0.0/16 ge 18

ip prefix-list ABC deny 172.16.0.0/16 ge 18 le 24

 

Drawback of using prefix-lists

– ge cannot be lower than the wildcard mask

 

Scenario -> Match any network starting with 172.16.0.0 and subnet mask between 8 and 24

 

ip prefix-list ABC deny 172.16.0.0/16 ge 8 le 24

-> Will not work

-> ge cannot be lower than the wildcard mask

 

If a single subnet mask is to be matched and it happens to be equal to the wildcard mask, then ge and le can be skipped

– Compare first octet of 10.0.0.0 and subnet mask must be 255.0.0.0

 

ip prefix-list permit 10.0.0.0/8

 

Filter 1.1.1.1 /32 from R2

 

R1(config)# ip prefix-list ABC deny 1.1.1.1/32

  ip prefix-list ABC permit 0.0.0.0/0 le 32

router rip

  distribute-list prefix ABC out fa0/0

 

Filter from a specific source

Scenario -> Filter any network coming from R3 and accept all networks from R2

– In this scenario, two prefix lists will be used

-> 1. To identify which networks will be filtered

-> 2. To identify the source

 

Distribute List

 

distribute-list prefix <list1> gateway <list2> in | out [<interface>]

 

R1(config)# ip prefix-list LIST1 permit 50.0.0.0/8

  ip prefix-list LIST2 deny 123.0.0.3/32

  ip prefix-list LIST2 permit 123.0.0.2/32

router rip

  distribute-list prefix LIST1 gateway LIST2 in fa0/0

 

During the lab, always use extended ACLs unless using prefix-lists is spcified

 

sh ip protocols

– Displays the distribute-lists applied

 

Offset-list

– This is used to add an offset number to the metric value when updates are sent or received

Scenario -> R1 should always use R2 as next-hop to reach network x (50.0.0.0)

– If connection to R2 goes down, R1 should start using R3 as next-hop for network x

 

offset-list <acl> in | out <offset-number> [<interface>]

– Standard ACL is used

access-list 1 permit 50.0.0.0

router rip

  offset-list 1 in 2 s0/1

 

For filtering purposes, offset number 16 can be used

 

Scenario -> Filter all network from R3

 

access-list 1 permit any

router rip

  offset 1 in 16 s0/1

 

– or –

 

! No ACL needed

router rip

  offset-list 0 in 16 s0/1

 

Filtering By Manipulating AD

– AD 255

-> Unreachable

-> Route deleted from the routing table

 

Scenario -> Filter network 50.0.0.0 from any router

 

access-list 1 permit 50.0.0.0

router rip

  distance 255 0.0.0.0 255.255.255.255 1

-> 0.0.0.0 255.255.255.255 – the source

-> 1 – ACL

 

Scenario -> Filter 50.0.0.0 from R3 (123.0.0.3)

 

access-list 1 permit 50.0.0.0

router rip

  distance 255 123.0.0.3 0.0.0.0 1

 

RIP Miscellaneous Topics

– Change timers

– Unicast updates

– Triggered updates

– Send / receive version

 

Changing Timers

– rip configation

– inside interface

 

router rip

  timers basic

 

 

int fa0/0

  ip rip advertise

 

 

Scenario -> Change the RIP timers to 20, 90, 90, 120, but keep the update time to 30 seconds for fa0/0

 

R1(config)# router rip

  timers basic 20 90 90 120

int fa0/0

  ip rip advertise 30

 

Unicast Updates

To switch to unicast updates

– Stop sending multicast updates

– Start sending unicast updates

 

On R1 / R2:

 

router rip

  passive-interface fa0/0

  neighbor 12.0.0.x

 

Triggered Updates

– Any serial (point-to-point) interface the periodic updates can be disabled and made triggered

On R1 / R2:

 

int s0/0

  ip rip triggered

 

debug ip rip

sh ip protocols

 

Send | Receive Version

– By default if the version command is not used, then all interfaces

-> Send v1 updates

-> Receive v1 and v2 updates

– If the version command is used, the interfaces will send and receive the version specified

– The impact of the version command can be overridden by using interface specific commands

 

int fa0/0

  ip rip send version { 1 | 2 }

  ip rip receive version { 1 | 2 }

 

sh ip protocols

 

router rip will not display in show run if a network statement is not configured

ip rip advertise 30 will not show up in the sh run config because it is the default configuration

– Use sh ip route to verify the proper networks are received on the interface