Transcript CCNA - Day 3 - UMT Admin Panel

Distance Vector vs. Link State
B
A
C
D
X
E
Distance Vector
Link State
Hybrid
Routing by rumor
Route table
Topology
Periodic Update
Incremental Update
1
Distance Vector vs. Link State
Distance Vector
• Updates frequently
• Each router is
"aware" only of its
immediate neighbors
• Slow convergence
• Prone to routing loops
• Easy to configure
Link State
• Updates are event
triggered
• Each router is
"aware" of all other
routers in the "area"
• Fast convergence
• Less subject to
routing loops
• More difficult to
configure
2
Comparison Continued
Distance Vector
• Fewer router resources
required
• Updates require more
bandwidth
• Does not "understand"
the topology of the
network
Link State
• More router resource
intensive
• Updates require less
bandwidth
• Has detailed knowledge
of distant networks and
routers
3
Link State
Example
OSPF
IS-IS
OSPF is used for corporate networks
IS-IS is used for ISP’s
5
6
Open Shortest Path First (OSPF)
 OSPF is an open standards routing protocol
 This works by using the Dijkstra algorithm
 OSPF provides the following features:
 Minimizes routing update traffic
 Allows scalability (e.g. RIP is limited to 15 hops)
 Has unlimited hop count
 Supports VLSM/CIDR
 Allows multi-vendor deployment (open standard)
7
Link State
There are two types of Packets
Hello
LSA’s
8
OSPF Hello
A
B
•
•
•
•
C
When router A starts it send Hello packet – uses 224.0.0.5
Hello packets are received by all neighbors
B will write A’s name in its neighbor table
C also process the same way
9
"Hello" Packets
•
•
•
•
Small frequently issued packets
Discover neighbours and negotiate "adjacencies"
Verify continued availability of adjacent neighbours
Hello packets and Link State Advertisements (LSAs) build
and maintain the topological database
• Hello packets are addressed to 224.0.0.5.
10
Link State Advertisement
(LSA)
 An OSPF data packet containing link state and routing
information that is shared among OSPF routers
 LSAs are shared only with routers with whom it has
formed adjacencies
 LSA packets are used to update and maintain the
topology database.
11
Link State
There are three type of tables
Neighbor
Topology
Routing
12
Tables
 Neighbor
Contain information about the neighbors
Neighbor is a router which shares a link on same
network
Another relationship is adjacency
Not necessarily all neighbors
LSA updates are only when adjacency is established
13
Tables
 Topology
Contain information about all network and path to
reach any network
All LSA’s are entered in to topology table
When topology changes LSA’s are generated and send
new LSA’s
On topology table an algorithm is run to create a
shortest path, this algorithm is known as SPF or
dijkstra algorithm
14
Tables
 Routing Table
Also knows as forwarding database
Generated when an algorithm is run on the topology
database
Routing table for each router is unique
15
OSPF Terms
Link
Router ID
Neighbours
Adjacency
OSPF Area
Backbone area
Internal routers
Area Border Router
(ABR)
Autonomous System
Boundary Router
(ASBR)
16
Link
 A network or router interface assigned to a
given network
 Link (interface) will have "state" information
associated with it
Status (up or down)
IP Address
Network type (e.g. Fast Ethernet)
Bandwidth
Addresses of other routers attached to this
interface
17
OSPF Term: Link
A link is a network or router interface assigned to any given
network
This link, or interface, will have state information associated
with it (up or down) as well as one or more IP addresses
18
OSPF Term: Link State
Status of a link between two routers
Information is shared between directly connected routers.
This information propagates throughout the network unchanged and
is also used to create a shortest path first (SPF) tree.
19
Router ID
 The Router ID (RID) is an IP address used to identify the router
 Cisco chooses the Router ID by using the highest IP address of all
configured loopback interfaces
 If no loopback interfaces are configured with addresses, OSPF will
choose the highest IP address of all active physical interfaces.
 You can manually assign the router ID.
 The RID interface MUST always be up, therefore loopbacks are
preferred
20
Neighbours
Neighbours are two or more routers that
have an interface on a common network
E.g. two routers connected on a serial link
E.g. several routers connected on a common
Ethernet or Frame relay network
Communication takes place between /
among neighbours
neighbours form "adjacencies"
21
Adjacency
A relationship between two routers that
permits the direct exchange of route
updates
Not all neighbours will form adjacencies
This is done for reasons of efficiency – more
later
22
OSPF Design
Each router connects to the backbone called area 0, or the backbone area.
Routers that connect other areas to the backbone within an AS are called Area Border Routers (ABRs). One
interface must be in area 0.
OSPF runs inside an autonomous system, but can also connect multiple autonomous systems together. The
router that connects these ASes together is called an Autonomous System Boundary Router (ASBR).
23
OSPF Areas
 An OSPF area is a grouping of contiguous networks and
routers
 Share a common area ID
 A router can be a member of more than one area (area
border router)
 All routers in the same area have the same topology
database
 When multiple areas exist, there must always be an area
0 (the backbone) to which other areas connect
24
Why areas?
 Decreases routing overhead
Compare to multiple smaller broadcast domains
instead of one large one
 Speeds convergence
 Confines network instability (e.g. route "flapping") to
single area of the network
 Adds considerably to the complexity of setting up OSPF
CCNA certification deals only with single-area OSPF
25
Area Terminology
26
LSA’s in Area
• LSAs communicate with adjacent routers in the same
OSPF area
• Subsequently, a change in a link state is "flooded" to all
area routers via LSAs
• In larger networks, multiple areas may be created
– LSAs are sent only to adjacent routers in the same
area
– "Area border routers" connect areas, passing
summarized route information between
27
Path Calculation
 Changes to the topological database of a router trigger a
recalculation to re-establish the best route(s) to known
networks
 Uses the SPF (shortest path first) algorithm developed
by a computer scientist named Dijkstra
 This is done by each individual router using its
detailed "knowledge" of the whole network
 Leads to rapid and accurate convergence
 Based on detailed knowledge of every link in the area
and the OSPF "cost" of each
 builds an OSPF tree with itself at the route
28
Terminology: Cost
• Various criteria can be selected by
the administrator to determine the
metric
• Usually,
OSPF cost=108/bandwidth
Do not forget to
configure the
bandwidth`
command on serial
links to ensure
correct
default OSPF cost
29
Pros and Cons
 Note that OSPF is a more sophisticated routing protocol
 Converges rapidly and accurately
 Can use a metric calculation that effectively selects
the "best" route(s) primarily based on bandwidth,
although an OSPF cost can be administratively
assigned
 Use of OSPF requires
 More powerful routing hardware
 More detailed knowledge by the administrator,
especially when large multi-area networks are used
30
Types of Neighbors
• OSPF can be defined for three type of neighbors
– Broadcast Multi Access (BMA) ex- Ethernet
– Point to Point
– Non-Broadcast Multi Access (NBMA)
31
OSPF Network Types
32
Adjacencies
 Point to Point all routers form adjacencies
 BMA & NBMA one router is elected as DR
 DR establish adjacency with every neighbor router
 LSA updates are exchanged only to DR
 DR is the router which has highest priority
 All CISCO routers has priority 1
 If priority is same then router id is seen
 The RID is highest IP address of all interfaces
33
Point-to-Point Links
 Usually
or HDLC
a
serial
interface
running
either
PPP
No DR or BDR election required
 OSPF autodetects this interface type
 OSPF packets are sent using multicast 224.0.0.5
All routers form adjacencies
34
Multi-access Broadcast Network
• Generally LAN technologies like Ethernet and Token Ring
• DR and BDR selection required
• All neighbor routers form full adjacencies with the DR and
BDR only
• Packets to the DR use 224.0.0.6
• Packets from DR to all other routers use 224.0.0.5
35
Electing the DR and BDR
 Hello packets are exchanged via IP multicast.
 The router with
selected as the DR.
the
highest
priority
is
If Priority is same then Router ID is seen
 Use the OSPF router ID as the tie breaker.
36
Terminology: DRs and BDRs
 The
designated
router (DR) is
responsible for
generating
LSAs on
behalf of all
routers
connected to
the same
segment
37
DR Responsibility
 When a router sees a new or changed link-state, it sends
an LSA to its DR using a particular multicast address
 The DR then forwards the LSA to all the other routers
with whom it is adjacent
 Minimizes the number of formal adjacencies that must
be formed and therefore the amount of LSU (link
state update) packet traffic in a multi-router network
38
OSPF Summary
 AD -100
 Hop count is unlimited
 Metric = Cost – 108/BW
 Classless, VLSM
 Load balance up to SIX routers
 Require more processing power
39
Basic OSPF Configuration
Router(config)# router ospf 1
 The number 1 in this example is a process-id # that
begins an OSPF process in the router
 More than one process can be launched in a router,
but this is rarely necessary
 Usually the same process-id is used throughout the
entire network, but this is not required
 The process-id # can actually be any value from 1 to
"very large integer“
 The process-id # cannot be ZERO
 This is NOT the same as the AS# used in IGRP and
EIGRP
40
Configuring OSPF Areas
 After identifying the OSPF process, you need to identify the interfaces that
you want to activate OSPF communications
Lab_A#config t
Lab_A(config)#router ospf 1
Lab_A(config-router)#network 10.0.0.0 0.255.255.255
area ?
<0-4294967295> OSPF area ID as a decimal value
A.B.C.D OSPF area ID in IP address format
Lab_A(config-router)#network 10.0.0.0 0.255.255.255
area 0
• Every OSPF network must have an area 0 (the backbone area) to which
other areas connect
 So in a multiple area network, there must be an area 0
 The wildcard mask represents the set of hosts supported by the
network and is really just the inverse of the subnet mask.
41
OSPF Configuration
• OSPF Process ID number is irrelevant. It can be the same on every
router on the network
• The arguments of the network command are the network number
(10.0.0.0) and the wildcard mask (0.255.255.255)
• Wildcards - A 0 octet in the wildcard mask indicates that the
corresponding octet in the network must match exactly
• A 255 indicates that you don’t care what the corresponding octet is
in the network number
• A network and wildcard mask combination of 1.1.1.1 0.0.0.0 would
match 1.1.1.1 only, and nothing else.
• The network and wildcard mask combination of 1.1.0.0 0.0.255.255
would match anything in the range 1.1.0.0–1.1.255.255
42
OSPF Configuration -1
S0
S1
20.0.0.2
30.0.0.1
R2
R1
S0
10.0.0.1
20.0.0.1
E0
A
10.0.0.2
S0
R3
30.0.0.2
E0
40.0.0.1
40.0.0.2
B
43
OSPF Configuration -1
S0
S1
20.0.0.2
30.0.0.1
R2
R1
S0
R3
S0
E0
10.0.0.1
A
20.0.0.1
30.0.0.2
10.0.0.2
E0
40.0.0.1
40.0.0.2
B
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#network 10.0.0.0 0.255.255.255 area 0
R1(config-router)#network 20.0.0.0 0.255.255.255 area 0
R1(config-router)#^Z
44
OSPF Configuration -2
S0
S1
200.0.0.8/30
R2
200.0.0.12/30
R1
R3
S0
S0
E0
E0
200.0.0.16/28
A
200.0.0.32/27
B
45
OSPF Configuration -2
S0
S1
200.0.0.10
R2
255.255.255.252
R1
S0
200.0.0.17
200.0.0.13
200.0.0.9
255.255.255.252
S0
R3
200.0.0.14
E0
E0
200.0.0.33
255.255.255.224
255.255.255.240
200.0.0.18
A
200.0.0.34
B
46
OSPF Configuration -2
S0
S1
200.0.0.10
R2
255.255.255.252
R1
S0
200.0.0.17
200.0.0.13
200.0.0.9
255.255.255.252
S0
R3
200.0.0.14
E0
E0
200.0.0.33
255.255.255.224
255.255.255.240
A
200.0.0.18
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#network 200.0.0.16 0.0.0.15 area 0
R1(config-router)#network 200.0.0. 8 0.0.0.3 area 0
R1(config-router)#^Z
200.0.0.34
B
R3#config t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#router ospf 1
R3(config-router)#network 200.0.0. 32 0.0.0.31 area 0
R3(config-router)#network 200.0.0. 12 0.0.0.3 area 0
R3(config-router)#^Z
47
OSPF and Loopback Interfaces
 Configuring loopback interfaces when using the OSPF routing
protocol is important
 Cisco suggests using them whenever you configure OSPF on a
router
 Loopback interfaces are logical interfaces, which are virtual,
software-only interfaces; they are not real router interfaces
 Using loopback interfaces with your OSPF configuration ensures that
an interface is always active for OSPF processes.
 The highest IP address on a router will become that router’s RID
 The RID is used to advertise the routes as well as elect the DR and
BDR.
 If you configure serial interface of your router with highest IP
Address this Address becomes RID of t is the RID of the router
because e router
 If this interface goes down, then a re-election must occur
 It can have an big impact when the above link is flapping
48
Configuring Loopback Interfaces
R1#config t
Enter configuration commands, one per line. End
with CNTL/Z.
R1(config)#int loopback 0
R1(config-if)#ip address 172.16.10.1
255.255.255.255
R1(config-if)#no shut
R1(config-if)#^Z
R1#
49
Verifying OSPF Operation
Router#
show ip protocols
• Verifies the configured IP routing protocol
processes, parameters and statistics
Router#
show ip route ospf
• Displays all OSPF routes learned by the router
Router#
show ip ospf interface
• Displays the OSPF router ID, area ID and
adjacency information
50
Verifying OSPF Operation
(Cont.)
Router#
show ip ospf
• Displays the OSPF router ID, timers, and statistics
Router#
show ip ospf neighbor [detail]
• Displays information about the OSPF neighbors,
including Designated Router (DR) and Backup
Designated Router (BDR) information on
broadcast networks
51
The show ip route ospf
Command
RouterA# show ip route ospf
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile,
B - BGP, D - EIGRP, EX - EIGRP external, O - OSPF,
IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, E - EGP, i - IS-IS, L1 - IS-IS
level-1, L2 - IS-IS level-2, * - candidate default
Gateway of last resort is not set
10.0.0.0 255.255.255.0 is subnetted, 2 subnets
O
10.2.1.0 [110/10] via 10.64.0.2, 00:00:50, Ethernet0
52
The show ip ospf interface
Command
RouterA# show ip ospf interface e0
Ethernet0 is up, line protocol is up
Internet Address 10.64.0.1/24, Area 0
Process ID 1, Router ID 10.64.0.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DROTHER, Priority 1
Designated Router (ID) 10.64.0.2, Interface address 10.64.0.2
Backup Designated router (ID) 10.64.0.1, Interface address 10.64.0.1
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:04
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 10.64.0.2 (Designated Router)
Suppress hello for 0 neighbor(s)
53
The show ip ospf neighbor
Command
RouterB# show ip ospf neighbor
Neighbor ID
10.64.1.1
10.2.1.1
Pri
1
1
State
FULL/BDR
FULL/-
Dead Time
00:00:31
00:00:38
Address
10.64.1.1
10.2.1.1
Interface
Ethernet0
Serial0
54
show ip ospf neighbor detail
show ip ospf database
55
Setting Priority for DR Election
Router(config-if)#
ip ospf priority number
This interface configuration command assigns the OSPF
priority to an interface.
Different interfaces on a router may be assigned different
values.
The default priority is 1. The range is from 0 to 255.
0 means the router is a DROTHER; it can’t be the DR or
BDR.
56
57
EIGRP
• IGRP
–
–
–
–
–
–
• OSPF
DV
Easy to configure
Neighbor
Advanced Metric
Periodic
Broadcast
–
–
–
–
LS
Incremental Updates
Multicast
Open Standard
• EIGRP
–
–
–
–
–
Hybrid
DUAL
Topology Database
Rapid Convergence
Reliable
58
Overview
Enhanced Interior Gateway Routing Protocol (EIGRP) is a Ciscoproprietary routing protocol based on Interior Gateway Routing Protocol
(IGRP).
Released in 1994, Unlike IGRP, which is a classful routing protocol,
EIGRP supports CIDR and VLSM.
 it is probably one of the two most popular routing protocols in use
today.
Compared to IGRP, EIGRP boasts faster convergence times, improved
scalability, and superior handling of routing loops.
EIGRP is often described as a hybrid routing protocol, offering the
59
best of distance vector and link-state algorithms.
Comparing EIGRP with IGRP
IGRP and EIGRP are compatible with each other.
EIGRP offers multiprotocol support, but IGRP does not.
Communication via Reliable Transport Protocol (RTP)
Best path selection via Diffusing Update Algorithm (DUAL)
Improved convergence time
Reduced network overhead
60
Introducing EIGRP
EIGRP supports:
Rapid convergence
Reduced bandwidth usage
Multiple network-layer protocols
EIGRP Tables
• EIGRP maintains 3 tables
– Neighbor table
– Topology table
– Routing table
62
Neighbor Discovery
There are three conditions that must be
met for neighborship establishment
Hello or ACK received
AS numbers match
Identical metrics (K values)
? AS
?K
K1 – BW
K2- Delay
K3-Load
K3-Reliability
K5-MTU
63
Metric Calculation
 The metrics used by EIGRP in making routing decisions are (lower the metric the
better):





bandwidth
delay
load
Reliability
MTU
 By default, EIGRP uses only:
 Bandwidth
 Delay
Analogies:
Think of bandwidth as the width of the pipe
and
delay as the length of the pipe.
 Bandwidth is the carrying capacity
 Delay is the end-to-end travel time.
64
Neighbor Table
 The neighbor table is the most important table in EIGRP
 Stores address and interface of neighbor
65
Topology Table
Network
66
Topology Table
The topology table is made up of all the EIGRP routing tables in the
autonomous system.
DUAL takes the information and calculates the lowest cost routes to each
destination.
By tracking this information, EIGRP routers can identify and switch to
alternate routes quickly.
The information that the router learns from the DUAL is used to determine
the successor route, which is the term used to identify the primary or best
route.
Every EIGRP router maintains a topology table. All learned routes to a
destination are maintained in the topology table.
67
Routing Tables
 A successor is a route selected as the primary route to
use to reach a destination.
 DUAL calculates Successor (Primary Route) and places it
in the routing table (and topology table)
 Can have up to 4 successors of equal or unequal value
 DUAL calculates Feasible Successor (Backup Route) and
places it in the Topology Table.
 Promoted to successor if the route goes down if it has a
lower cost than current successor
 If no FS in Table - Send query
 Multiple feasible successors for a destination can be
retained in the topology table although it is not
mandatory
68
EIGRP Concepts & Terminology
 EIGRP routers that belong to different autonomous
systems (ASes) don’t automatically share routing
information
 The only time EIGRP advertises its entire routing table is
when it discovers a new neighbor and forms an
adjacency with it through the exchange of Hello packets
 When this happens, both neighbors advertise their entire
routing tables to one another
 After each has learned its neighbor’s routes, only
changes to the routing table are propagated
69
10Mbps
Dist to 172.16.100.0 =100
172.16.100.0
Dist to 172.16.100.0 =100
56Kbps
1.544Mbps
1.544Mbps
10Mbps – 100
1,544Mbps – 250
56Kbps -1000
Dist to 172.16.100.0 =350
Chennai receives an update from Mumbai with a cost of 100, which is Mumbai's cost to reach 172.16.100.0, This
cost is referred to as the reported distance (RD)
Bangalore will report its cost to reach 172.16.100.0. Bangalore's RD is 350
Chennai will compute its cost to reach 172.16.100.0 via Mumbai and Bangalore and compare the metrics for the
two paths
Chennai's cost via Mumbai is 1100. Chennai's cost via Bangalore is 600. The lowest cost to reach a destination is
referred to as the feasible distance (FD) for that destination
Chennai's FD to 172.16.100.0 is 600. The next-hop router in the lowest-cost path to the destination is referred to
as the successor.
70
A feasible successor is a path whose reported distance is less than the feasible distance, and it is considered a
backup route.
EIGRP Terms
 Feasible distance (FD) - This is the lowest calculated metric to
reach destination. This is the route that you will find in the
routing table, because it is considered the best path
 Reported distance (RD) - The distance reported by an
adjacent neighbor to a specific destination.
 Interface information - The interface through which the
destination can be reached.
 Route status - The status of a route. Routes are identified as
being either passive, which means that the route is stable and
ready for use, or active, which means that the route is in the
process of being recomputed by DUAL
71
EIGRP Terminology and
Operations
 Successor – Current Route
 A successor is a route selected as the primary route to use to reach
a destination.
 Successors are the entries kept in the routing table.
 Feasible Successor - A backup route
 A feasible successor is a backup route.
 These routes are selected at the same time the successors are
identified, but they are kept in the topology table.
 Multiple feasible successors for a destination can be retained in the
topology table.
72
Reliable Transport Protocol (RTP)
 Used by EIGRP for its routing updates in place of TCP
 EIGRP can call on RTP to provide reliable or unreliable service
 EIGRP uses reliable service for route updates
 Unreliable for Hellos
 Reliable Transport Protocol (RTP) is a transport layer protocol that
guarantees ordered delivery of EIGRP packets to all neighbors.
 On an IP network, hosts use TCP to sequence packets and ensure
their timely delivery. RIP uses UDP
 However, EIGRP is protocol-independent and does not rely on TCP/IP
to exchange routing information the way that RIP, IGRP, and OSPF do.
 EIGRP uses RTP as its own proprietary transport layer protocol to
guarantee delivery of routing information.
 With RTP, EIGRP can multicast and unicast to different peers
simultaneously.
73
Diffusing Update Algorithm
(DUAL)
 All route computations in EIGRP are handled by DUAL
 One of DUAL's tasks is maintaining a table of loop-free paths to
every destination.
 This table is referred to as the topology table
 DUAL saves all paths in the topology table
 The least-cost path(s) is copied from the topology table to the
routing table
 In the event of a failure, the topology table allows for very quick
convergence if another loop-free path is available
 If a loop-free path is not found in the topology table, a route
recomputation must occur
 DUAL queries its neighbors, who, in turn, may query their
neighbors, and so on...
 Hence the name "Diffusing" Update Algorithm
74
VLSM Support
• EIGRP supports the use of Variable- Length Subnet
Masks
• Can use 30-bit subnet masks for point-to-point networks
• Because the subnet mask is propagated with every route
update, EIGRP also supports the use of discontiguous
subnets
• Discontiguous network is the one that has two or more
subnetworks of a classful network connected together by
different classful networks
75
Discontiguous Network
76
Configuring EIGRP
Router(config)#router eigrp autonomous-system
• Defines EIGRP as the IP routing protocol
Router(config-router)#network network-number
• Selects participating attached networks
EIGRP Configuration Example
EIGRP Configuration
S0
S1
200.0.0.10
R2
255.255.255.252
R1
S0
200.0.0.17
200.0.0.13
200.0.0.9
255.255.255.252
S0
R3
200.0.0.14
E0
E0
200.0.0.33
255.255.255.224
255.255.255.240
A
200.0.0.18
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router eigrp 10
R1(config-router)#network 200.0.0.16
R1(config-router)#network 200.0.0. 8
R1(config-router)#^Z
200.0.0.34
B
R3#config t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#router eigrp 10
R3(config-router)#network 200.0.0. 32
R3(config-router)#network 200.0.0. 12
R3(config-router)#^Z
80
Verifying the EIGRP Configuration
To verify the EIGRP configuration a number of show
and debug commands are available.
These commands are shown on the next few slides.
81
show ip eigrp topology
show ip eigrp topology
[active | pending | successors]
82
show ip eigrp topology
all-links
show ip eigrp traffic
83
Administrative Distances
84
TELNET
 Getting information about remote device
 Can connect to remote device and configure a device
 Password must be set
R1(config)# line vty 0 4
Password cisco
login
85
Discovering Neighbors on the
Network
86
© 2002, Cisco Systems, Inc. All rights reserved.
86
Cisco Discovery Protocol
CDP is a proprietary utility that gives you a summary of directly
connected switches, routers, and other Cisco devices.
CDP discovers neighboring devices regardless of which protocol
suite they are running.
Runs on the Data link layer
Physical media must support the Subnetwork Access Protocol
(SNAP) encapsulation.
Only give directly connected device
By default enabled, you can enable or disable
Discovering Neighbors with
CDP
CDP runs on routers with Cisco IOS®
software Release 10.3 or later and on Cisco
switches.
Show CDP ?
Summary information
includes:





Device ID
Local Interface
Port ID
Capabilities list
Platform
CDP
 CDP timer is how often CDP packets are transmitted to
all active interfaces.
Router(config)#cdp timer 90
 CDP holdtime is the amount of time that the device will
hold packets received from neighbor devices.
Router(config)#cdp holdtime 240
89
Using CDP
90
Using the show cdp
neighbors Command
The show cdp neighbor command (sh cdp nei for short) delivers
information about directly connected devices.
91
CDP
show cdp neighbor detail
This command can be run on both routers
and switches, and it displays detailed
information about each device connected
to the device
92
Using the show cdp entry
Command
The show cdp entry * command displays the same information as the show cdp
neighbor details command.
93
Additional CDP Commands
The show cdp traffic command displays information about
interface traffic, including the number of CDP packets sent and
received and the errors with CDP.
94
CDP Commands
To disable the CDP on particular interface use
the "no cdp enable" command
To disable CDP on the entire router use the "no
cdp run" in global configuration mode.
95
Summary
 Cisco Discovery Protocol is an information-gathering tool used
by network administrators to get information about directly
connected devices.
 CDP exchanges hardware and software device information
with its directly connected CDP neighbors.
 You can enable or disable CDP on a router as a whole or on a
port-by-port basis.
 The show cdp neighbors command displays information about
a router’s CDP neighbors.
 The show cdp entry, show cdp traffic, and show cdp interface
96
commands display detailed CDP information on a Cisco device.
97
Why Use Access Lists?
Manage IP traffic as network access grows
Filter packets as they pass through the router
What are ACLs?
ACLs are lists of conditions that are applied to traffic traveling across
a router's interface.
These lists tell the router what types of packets to accept or deny.
Acceptance and denial can be based on specified conditions.
ACLs can be configured at the router to control access to a network
or subnet.
Some ACL decision points are source and destination addresses,
protocols, and upper-layer port numbers.
99
Reasons to Create ACLs
The following are some of the primary reasons to create
ACLs:
Limit network traffic and increase network performance.
Provide traffic flow control.
Provide a basic level of security for network access.
Decide which types of traffic are forwarded or blocked at the router
interfaces
For example: Permit e-mail traffic to be routed, but block all telnet traffic.
If ACLs are not configured on the router, all packets passing through the
router will be allowed onto all parts of the network.
100
ACL’s
 Different access list for Telnet
 When configuring ISDN you need to use access list
 Implicit deny at bottom
 All restricted statements should be on first
 There are two types
 Standard
 Extended
101
Network
192.168.12.2
N1
192.168.12.0
N2
192.168.12.3
A
C
B
N3
192.168.34.0
N4
N5
192.168.56.0
N6
102
IP Packet
SRC IP Address
DEST IP Address
Protocol type
SRC Port
DEST Port
The first 2 bytes in the TCP/UDP header are the source port number
The next 2 bytes in the TCP/UDP header are the Destination port number
103
Types of Access Lists
Standard
Checks source address
Permits or denies entire protocol suite
Extended
Checks source and destination address
Generally permits or denies specific protocols
104
How to Identify Access Lists
 Standard IP lists (1-99) test conditions of all IP packets from
source addresses.
 Extended IP lists (100-199) test conditions of source and destination
addresses, specific TCP/IP protocols, and destination ports.
 Standard IP lists (1300-1999) (expanded range).
 Extended IP lists (2000-2699) (expanded range).
Standard ACLs
The full syntax of the standard ACL command is:
Router(config)#access-list access-list-number {deny | permit} source
[source-wildcard ]
The no form of this command is used to remove a standard ACL. This is
the syntax:
Router(config)#no access-list access-list-number
Config# Access-list 1 deny 192.168.1.0 0.0.0.255
Config# access-list 1 permit any
106
Wildcard Mask
Access-list 99 permit 192.168.1.1 wildcard mask
All 32 bits of an IP Address can be filtered
Wildcard inverse mask
0=must match
1= ignore
MASK (192.168.1.1)
0.0.0.0 (host)
0.0.0.255
Matching IP
192.168.1.1
192.168.1.0-255
0.0.255.255
192.168.0-255.0-255
0.255.255.255
192.0-255.0-255.0-255
255.255.255.255
0-255.0-255.0-255.0-255 (any)
107
The ANY and HOST keyword
Access-list 1 permit 0.0.0.0 255.255.255.255
Or
permit any
Access-list 1 permit 200.0.0.9 0.0.0.0
Or
permit host 200.0.0.9
108
Testing Packets with
Standard Access Lists
Outbound ACL Operation
• If no access list statement matches, then discard the packet.
Reading an ACL

1.
First Hit or Best Fit?
Access-list 99 deny host 192.168.1.1 0.0.0.0
access-list 99 permit any 255.255.255.255
2.
Access-list 99 permit 192.168.1.0 0.0.0.255
Access-list 99 deny host 192.168.1.1
access-list 99 permit any
3.
Access-list 99 deny host 192.168.1.1

Implicit deny at the end of every ACL
111
Creating ACLs
ACLs are created in the global configuration mode.
There are many
different types of ACLs including standard, extended, IPX, AppleTalk, and
others. When configuring ACLs on a router, each ACL must be uniquely
identified by assigning a number to it. This number identifies the type of
access list created and must fall within the specific range of numbers that
is valid for that type of list.
Since IP is by far the most
popular routed protocol,
addition ACL numbers have
been added to newer router
IOSs.
Standard IP: 1300-1999
Extended IP: 2000-2699
112
The ip access-group command
{ in | out }
113
Exercise – Standard Access List
192.168.0.5
255.255.255.252
192.168.0.9
255.255.255.252
192.168.0.33
255.255.255.240
E0
A
192.168.0.18
255.255.255.248
S0
192.168.0.17
255.255.255.248
S0
192.168.0.6
255.255.255.252
S1
S0
E0
192.168.0.10
255.255.255.252
B
192.168.0.34
255.255.255.240
Account should be denied access to Sales
To steps to configure
•Create a standard Access list
•Apply ACL to proper interface inbound or outbound
114
Exercise – Standard Access List
192.168.0.5
255.255.255.252
192.168.0.9
255.255.255.252
192.168.0.33
255.255.255.240
E0
A
192.168.0.18
255.255.255.248
S0
192.168.0.17
255.255.255.248
S0
192.168.0.6
255.255.255.252
S1
S0
192.168.0.10
255.255.255.252
E0
B
192.168.0.34
255.255.255.240
Config# Access-list 1 deny 192.168.0.18 0.0.0.7
Config# access-list 1 permit any
Config#int e 0
Config-if# ip access-group 1 out
115
Extended ACLs
Extended ACLs are used more often than standard ACLs because they provide a
greater range of control.
Extended ACLs check the source and destination packet addresses as well as
being able to check for protocols and port numbers.
At the end of the extended ACL statement, additional precision is gained from a
field that specifies the optional Transmission Control Protocol (TCP) or User
Datagram Protocol (UDP) port number.
Logical operations may be specified such as, equal (eq), not equal (neq), greater
than (gt), and less than (lt), that the extended ACL will perform on specific
protocols.
Extended ACLs use an access-list-number in the range 100 to 199 (also from 2000
to 2699 in recent IOS).
116
Configuration
• Access-list acl# {permit/Deny}
• Protocol
IP
–
–
–
–
–
OSPF
EIGRP
ICMP
TCP
UDP
•
•
•
•
Protocol
Src IP src WCM
Dst IP dst WCM
Opetrator port
RP If you need to Block a routing protocol
• Operator
–
–
–
–
eq
gt
lt
neq
117
Testing Packets with
Extended Access Lists
Extended ACL Syntax
119
Extended ACL LAB -2
192.168.0.5
255.255.255.252
E0
192.168.0.17
255.255.255.248
S0
192.168.0.9
255.255.255.252
S0
192.168.0.6
255.255.255.252
S1
S0
192.168.0.10
255.255.255.252
E0
192.168.0.33
255.255.255.240
192.168.0.34
255.255.255.240
A
B
192.168.0.18
255.255.255.248
192.168.0.34 should be denied FTP of 192.168.0.18
192.168.0.18 should be denied website of 192.168.0.34
On Router R1
Config# Access-list 100 deny tcp 192.168.0.34 0.0.0.0 192.168.0.18
0.0.0.0 eq 21
Config# access-list 100 permit IP any any
On Router R3
Config# Access-list 100 deny tcp 192.168. 0.18 0.0.0.0 192.168.0.34
0.0.0.0 eq 80
Config# access-list 100 permit IP any any
Config#int s0
Config-if# ip access-group 100 IN
Config#int s0
Config-if# ip access-group 100 IN
121
Deny FTP
access-list 101 deny tcp any any eq 21
access-list 101 permit ip any any
or
access-list 101 deny tcp any any eq ftp
access-list 101 permit ip any any
122
Rules
For extended access list apply near to the
source
For standard access list apply near to the
destination
123
Named ACLs
IP named ACLs were introduced in Cisco IOS Software Release 11.2,
allowing standard and extended ACLs to be given names instead of
numbers.
The characteristics of named accesslist:




Identify an ACL using an alphanumeric name.
You can delete individual statements in a named access list
Named access lists must be specified as standard or extended
You can use the ip access-list command to create named access
lists.
Named ACLs are not compatible with Cisco IOS releases prior to Release
11.2.
The same name may not be used for multiple ACLs.
124
Named ACL’s
 Numbered Access list did not give you any hint, What is
filtered
 Named ACL’s are both basic and advanced filtering tool
 Name cannot start with a number or !
 Cannot have space in the name
 Should not have ? Character anywhere in the name
 Name is case sensitive
125
Named ACL Example
R1(config)#ip access-list standard blocksales
•
•
•
•
•
R1(config-std-nacl)#deny 172.16.40.0 0.0.0.255
R1(config-std-nacl)#permit any
R1(config-std-nacl)#exit
R1(config)#^Z
R1#
#Int e 0
#Ip access-group blocksales out
126
Verify Access List
127
Basic Rules for ACLs










Standard IP access lists should be applied closest to the destination.
Extended IP access lists should be applied closest to the source.
Use the inbound or outbound interface reference as if looking at the port
from inside the router.
Statements are processed sequentially from the top of list to the bottom
until a match is found, if no match is found then the packet is denied.
There is an implicit deny at the end of all access lists. This will not appear
in the configuration listing.
Access list entries should filter in the order from specific to general.
Specific hosts should be denied first, and groups or general filters should
come last.
Never work with an access list that is actively applied.
New lines are always added to the end of the access list.
A no access-list x command will remove the whole list. It is not possible
to selectively add and remove lines with numbered ACLs.
Outbound filters do not affect traffic originating from the local router.
128