Feral Packet

OSPF -> Open Shortest Path First

– Open standard

– IP protocol 89

– Multicast addresses
-> 224.0.0.4 – all routers

-> 224.0.0.5 – all DR

– Metric is cost

– Link state protocol

– Uses 3 tables
-> Neighbor table

-> Database table

-> Routing table

– SPF algorithm

– Uses Designated Router and Backup Designated Router concept on multiaccess networks
->

– Uses concept of areas

– Types of packets
-> Hello

-> Database Descriptors (DBD)

-> Link State Request (LSR)

-> Link State Update (LSU)

-> Link State Acknowledgment (LSAck)

Neighbor formation

– Hellos are sent to 224.0.0.5

– Hello packet
-> Router-id (must be unique)

-> Area-id (must match)

-> Timers (must match)

-> hello timer – 10 sec (LAN) | 30 sec (WAN)

-> dead timer – 40 sec (LAN) | 120 sec (WAN)

-> Authentication

-> Network / subnet mask (must match)

-> MTU (must match)

-> Number of neighbors in the segment (must match)

Finite State Machine (FSM)

1. Down – no hellos sent

2. Attempt – frame-relay or non-broadcast networks where multicast hellos will not work

3. INIT – Hello is sent to 224.0.0.5

4. 2-WAY – Parameters in hello packets match and both routers list each other as neighbors in hello packets

5. EXSTART – Master / Slave election; router-ids are compared (higher is better)

6. EXCHANGE – DBDs are exchanged (header information of the database, not the entire database)

7. Loading – Exchange of database

8. Full – Both routers are completely synchronized

Steps 1 – 4, a basic neighborship is formed

Step 8, fully adjacent neighborship

Neighborship Control

– Timers -> 10 / 40
int fa0/0
ip ospf hello-interval <sec>
ip ospf dead-interval <sec>

sh ip ospf interface

int fa0/0
ip ospf dead-interval minimal hello-multiplier <number of hellos>
-> dead interval set to 1 sec

-> Hello -> e.g. – 4 times a second, every 250 ms

– Passive interface
-> multicast hello processing is disabled

router ospf 1
passive-interface { default | <int> }

sh ip protocols

Manual Neighborship

– Only allowed on non-broadcast multi-access (NBMA) networks
router ospf 1

neighbor

OSPF Authentication

– 3 types
-> type 0 – NULL

-> type 1 – plain text

-> type 2 – MD5

– Configuration
-> Interface – connected neighbor must be configured

-> Area-wide – all routers in the area must be configured

Interface level configuration

– Plain text (type 1)
int s0/0
ip ospf authentication
ip ospf authentication-key <password>

– MD5 (type 2)
int s0/0
ip ospf authentication
ip ospf message-digest-key <id> md5 <password>

Area Wide Authentication

Scenario -> Configure area wide authentication on R1 for area 0, but R2 is not configured for authentication, so skip s0/0 of R1.

R1(config)# router ospf 1
area 0 authentication
-> all interfaces must now use authentication

int s0/1
ip ospf authentication-key <password>
int s0/2
ip ospf authentication-key <password>
int s0/0
ip ospf authentication NULL

Interface configuration is preferred over area wide authentication

Virtual-links are a special case with authentication and commonly comes up in the lab

DR / BDR Election on multi-access networks

– One router is elected the DR
-> highest priority

-> highest router-id

-> any manual router-id config

-> highest loopback address

-> highest physical interface address

– Another router which is second best is elected the BDR

– All routers for a fully adjacent neighborship with the DR and BDR
-> 2-WAY neighborship is formed with all other routers

SPF is a point-to-point protocol

– It doesn’t work on multi-access networks

– DR becomes a pseudo node to create a logical point-to-point network

Transit network means you have to go through the pseudo node

R3# sh ip ospf nei
R1           2-way / DROTHERS

R2           2-way / DROTHERS

R4           Full / BDR

R5           Full / DR

Changing Priority

int fa0/0
ip ospf priority <number>
-> 0 – 255 (higher is better)

-> 0 – no participation in election

-> 1 – default priority

OSPF Network Types

– Depending on the interface OSPF is activated on, it decides some properties to be used
-> Timers

-> DR / BDR

-> Type of neighborship

1. Broadcast Multi-access

2. Point-to-point

3. Non-broadcast Multi-access (NBMA)

4. Point-to-multipoint

5. Point-to-multipoint Non-broadcast

Frame-relay default to NBMA

– When it is setup as a hub and spoke
-> If a spoke is elected DR, the other spokes will not be able to communicate with the DR

int s0/0
ip ospf network <options>

sh ip ospf database
-> shows database header information

Link State Update (LSU)

– A set of LSAs (Link State Advertisements)
-> LSA 1 – Router LSA

-> LSA-ID – router-id

-> neighbors connected to a router

-> networks connected to a router

-> LSA 2 – Network LSA

-> LSA-ID – IP address of DR

-> Information about transit network ( DR / BDR / DROTHERS )

-> Originated by DR

-> LSA 3 – Summary LSA

-> LSA-ID – for every network in the other area

-> Created by ABR

-> Cost to reach network from the ABR

-> LSA 4 – ASBR Summary

-> LSA-ID – router-id of ASBR

-> Contains cost of ABR to reach ASBR

-> LSA 5 – AS-External

-> LSA-ID – external networks

-> Created by ASBR

-> Cost of ASBR to reach external networks

-> LSA 7 – Not-so-stubby-area (NSSA)

-> LSA-ID – external network

-> Created by ASBR

-> Cost of ASBR to reach external networks

sh ip ospf database <LSA type>
– router

– network

– summary

– asbr-summary

– as-external

– nsaa-external

OSPF Cost Calculation

– Cumulative cost of all exit interfaces towards destination

Cost of serial ethernet = 100 / 1.544 = 64

Cost of fast ethernet = 100 / 100 = 1

Cost of gigabit ethernet = 100 / 1000 = 1

Fast ethernet and Gigabit ethernet having the same cost is not a good thing

On the exam, if you see Gigabit ethernet interfaces, you may need to change the formula

router ospf 1
auto-cost reference-bandwidth <Mbps>

R3# sh ip ospf database route 4.4.4.4
-> shows the cost to R4’s connected network from R4’s point of view

The change cost
-> bandwidth manipulation

int s0/0
bandwidth 2000

int s0/0
ip ospf cost < 1 – 65535 >

R1 to 50.0.0.0

– Route #1 – R1 -> R2 -> R4 -> 50.0.0.0 = cost of 66

– Route #2 – R1 -> R3 -> R5 -> 50.0.0.0 = cost of 66

Scenario -> Change the cost in this diagram in such a way that R1 goes to 50.0.0.0 by following the route R1 -> R2 -> R3 -> R5 -> 50.0.0.0

When asked a question about traffic engineering, always start at the end
-> R2’s link to R4 –
ip ospf cost 3
-> R1’s link to R3 –
ip ospf cost 67

OSPF Summarization

– Can be done on Area Border (ABR)

– Can be done on Domain Border (ASBR)
-> border between routing protocols

-You cannot summarize within an area
-> That would defeat the point of SPF

R2(config)# router ospf 1
area <source area> range <network> <subnet>

router ospf 1
area 0 range 10.0.0.0 255.255.252.0

R3(config)# router ospf 1
redistribute eigrp 1 subnets
summary-address 192.168.0.0 255.255.254.0

Default Route

router ospf 1
default-information originate [always] [router-map <name>] [metric <value>] [metric-type [1|2]]
-> always

->without this keyword, the local router needs a default route in the routing table

-> with this keyword, the default route is injected regardless of a default route being represent in the local routing table

-> metric – default is 1

OSPF Filtering

– Filtering is only possible on Area Borders

router ospf 1

area <number> filter-list prefix <name> in | out

Scenario -> Filter lo0 of R3 from Area 0

R2(config)# ip prefix-list ABC deny 3.3.3.3 255.255.255.255
ip prefix-list ABC permit 0.0.0.0 0.0.0.0 le 32

router ospf 1
area 0 filter-list prefix ABC in

It’s preferable to filter out of an area when multiple areas are present

– Filtering coming into an area does not stop the router from entering the database table
-> it can be filtered and prevented from entering the routing table

R1(config)# access-list 1 deny 3.3.3.3
access-list 1 permit any

router ospf 1
distribute-list 1 in

Not a good method;   it can cause problems, but will likely come up in the exam

– A static route pointing to NULL0 is much better, but static routes are heavily frowned upon in the exam

Filtering by Distance

router ospf 1
distance 255 <source> <wildcard> <acl>

Filtering External Routes

Scenario -> R3 is redistributing the following routes from EIGRP
– 10.0.0.0 /24

– 10.0.1.0 /24

– 10.0.2.0 /24

– 10.0.3.0 /24

-> Filer 10.0.0.0 and 10.0.1.0 when redistributing

R3(config)# router ospf 1
redistribute eigrp 1 subnets
summary-address 10.0.0.0 255.255.254.0 not-advertise

Virtual Links

– Used to connect discontiguous areas and broken area 0

– A virtual link is a point-to-point link in area 0

ABR1 – ABR between backbone and transit area

ABR2 – ABR between transit area and discontiguous area

ABR1 | ABR2

router ospf 1
area <transit area> virtual-link <router-id of other ABR>

R1(config)# router ospf 1

area 1 virtual-link 2.2.2.2

R2(config)# rotuer ospf 1
area 1 virtual-link 1.1.1.1

sh ip ospf interface

Stub Areas

– Stub area

– Totally stubby area

– Not-so-stubby-area (NSSA)

– Totally NSSA

Stub area

– Does not allow type 5 routes into the area

– All external routes (type 5) are filtered by ABR and replaced with one type 3 default route

Totally stubby area

– Do not allow type 3 or type 5 routes into the area

– Replaced with a type 3 default route

Stub Area Configuration

– On all routers in area 1, including the ABR

router ospf 1
area 1 stub

sh ip ospf

– lists areas and which ones are stubs

Totally Subby Area Configuration

– On all routers in the area except the ABR

router ospf 1
area 1 stub

– On ABR

router ospf 1
area 1 stub no-summary

NSSA

– Stub area with redistribution possible

– It’s a stub area with an ASBR

– External routes created inside the NSSA are type 7
-> Because type 5 LSAs are not allowed in stub areas

– When type 7 LSAs reach an ABR between the NSSA and area 0, the LSAs are translated to type 5 LSAs by a “translator ABR”

– If multiple ABRs are present, there will be a translator election and the one with the highest router-id wins

If area 2 is filtering R6’s address from area 0, then after translation from type 7 to type 5, area 0 routes would not be able to reach the external routers from the NSSA

type 5

network 50.0.0.0

originator-id 4.4.4.4

forwarding address 6.6.6.6 -> 0.0.0.0
-> forwarding address would need to be suppressed when translated from type 7 to type 5

NSSA Configuration

– On all routers in the area, including the ABR

router ospf 1
area 2 nssa

Totally NSSA Configuration

– On all routers in the area, except the ABR

router ospf 1
area 2 nssa

– On the ABR

router ospf 1
area 2 nssa no-summary

To suppress forwarding address on translator ABR

router ospf 1
area 2 nssa translate type 7 supress-fa

no-redistribution

– When no-redistribution is done, it will normally create type 5 and type 7 LSAs

– By using the keyword “no-redistribution”, the ABR is instructed not to generate type 7 LSAs

R4(config)# router ospf 1

area 2 nssa no-redistribution

-> Stub area – injects a default router type 3 LSA

-> Totally stubby area – injects a default route type 3 LSA

-> NSSA – no default route is injected

-> Totally NSSA – default router type 3 LSA

To inject a default router in a NSSA

router ospf 1

area 2 nssa default-information-originate

-> This will create a type 7 default route be injected into the NSSA

IPV6 OSPFv3

– Multicast FF02::5 – all routers

– Multicast FF02::6 – all DR routers

R1(config)# int s0/0

ipv6 ospf 1 area 0

ipv6 router ospf 1

ospf router-id 1.1.1.1

Summarization

– Inside routing mode

ipv6 router ospf 1

area 0 range <summary address/nm>

Default Routing

– Inside routing mode

ipv6 router ospf 1

default-information originate [ always | route-map <name> ]

Filtering

– Only distribute-list is supported

– Inter-area filtering is not supported

– Filtering is done on the local router between the database and the routing table

ipv6 router ospf

distribute-list prefix <name> in

Authentication

– OSPFv3 supports IPsec authentication

-> Authentication

-> MD5

-> SHA1 (Secure Hash Algorithm)

-> Encryption

-> DES

->3DES

-> AES

int s0/0

ipv6 ospf authentication ipsec spi 500 { md5 | sha1 } <password>

-> For MD5, password is 32 characters long

-> For SHA1, password is 40 characters long

ipv6 ospf encryption ipsec spi 500 { des | 3des | aes }

New LSAs and Changes

– LSA 8

-> Intra Area Prefixes

-> All connected networks of all routers within the area

– LSA 1

-> Only lists the neighbors / routers in the area

– LSA 9

-> Link LSA

-> It consists of the link-local address

-> Scope is link-local

Potential Problems

No OSPF Neighborship:  

– Interface not participating

-> Check passive interface configuration

-> show ip ospf int bri (IOS)

-> show ipv6 ospf int bri (IOS)

-> show ospf int bri  (XR)

-> show ospfv3 int bri (XR)

– Hello interval mismatch

– MTU mismatch

– Area mismatch

– IP address / mask wrong

– Authentication error

OSPF Neighborship up:

– mismatch network types

-> broadcast and point-to-point

-> show ip ospf nei (IOS)

-> show ipv6 ospf nei (IOS)

-> one side shows “DR or BDR”, otherside shows “-”

-> show ospf nei (XR)

-> show ospfv3 nei (XR)

– no database exchange

-> show ip route ospf

-> show ipv6 route ospf

-> loopback of neighbor router comes from a different router

– Wrong router-id

Verification (IOS):

  – sh ip ospf int

  – sh ipv6 ospf int

  – sh ip ospf int bri

  – sh ipv6 ospf int bri

  – sh ip ospf nei

  – sh ipv6 ospf nei

  – sh ip protocols

  – sh ipv6 protocols

  – sh ipv6 ospf  

-> To check router-id

  – sh ip ospf database

  – sh ip ospf datebase | be Ex

  – sh ip ospf virtual-link

  – sh ip route ospf

  – sh ipv6 route ospf

  – debug ip ospf hello

  – debug ip routing

 

  – ping 2.2.0.8 source lo0

  – ping 2002:2:2::8 source lo0

Verification (XR):

  – sh ospf int

  – sh ospf int bri

  – sh ospf nei

  – sh protocols

  – sh ospfv3 int

  – sh ospfv3 int bri

  – sh ospfv3 nei

  – sh protocols ipv6

  – sh route ipv4 ospf

       -> sh route ospf (also works)

  – sh route ipv6 ospf

 

  – ping 2.2.0.2 source 2.2.0.8

  – pint 2002:2:2::2 source 2002:2:2::8