Showing posts with label Cisco configuration. Show all posts
Showing posts with label Cisco configuration. Show all posts

Monday, 28 October 2019

OSPF Multi-Area Configuration & Summary Routes

Cisco OSPF Multi-Area Configuration & Summary Routes

This article is a complete step by step guide for OSPF Multi-Area Configuration & Summary Routes on Cisco Router. Also topology examples of multi-area OSPF v2 and OSPF v3 configuration are explained here. Following are some OSPF related articles:


Configuration of OSPF Multi-Area 

The OSPF implementation can be single or multi-area. The type of OSPF implementation chosen depends on the specific requirements and the existing topology.
To implement multi-area OSPF, four steps must be followed.
Steps 1 and 2 are part of the planning process.

  • Step 1. Collect network parameters and requirements : this includes determining the number of host and network devices, the IP addressing scheme (if already implemented), the size of the domain and routing tables, the risk of changes in the topology and other characteristics of the network.
  • Step 2. Define the OSPF parameters : Based on the information you collected in step 1, the network administrator must determine if the preferred implementation is single-area or multi-area OSPF. If multi-area OSPF is selected, the network administrator must consider the following:
    •  IP addressing plan : this governs the way in which OSPF can be implemented and how well the OSPF implementation could be scaled.
    •  OSPF Areas : The division of an OSPF network into areas decreases the size of the LSDB and limits the propagation of link state updates when the topology is modified. The routers that are going to fulfill the function of ABR and ASBR must be identified, as well as those that will carry out the summarization or redistribution.
    •  Network topology: this consists of links that connect the network equipment and that belong to different OSPF areas in a multi-area OSPF design. The network topology is important to determine the main and backup links.
  • Step 3 . Configure the multi-area OSPF implementation according to the parameters.
  • Step 4 . Verify the implementation of multi-area OSPF according to the parameters.

OSPF Configuration of Different Areas


In Figure 1, the multi-area OSPF reference topology is shown. In this example:

  • R1 is an ABR because it has interfaces in area 1 and an interface in area 0.
  • R2 is an internal backup router because all its interfaces are in area 0.
  • R3 is an ABR because it has interfaces in area 2 and an interface in area 0.

No special commands are required to implement this OSPF network from various areas. A router simply becomes ABR when it has two network instructions in different areas .

OSPF v2 Multi-Area Configuration Example

As shown below, router ID 1.1.1.1 was assigned to R1. This example activates OSPF on the two LAN interfaces in area 1.
The serial interface is configured as part of OSPF area 0. Since R2 has interfaces connected to two different areas, it is an ABR.
R1 (config) # router ospf 10
R1 (config-router) # router-id 1.1.1.1
R1 (config-router) # network 10.1.1.1 0.0.0.0 area 1
R1 (config-router) # network 10.1.2.1 0.0.0.0 area 1
R1 (config-router) # network 192.168.10.1 0.0.0.0 area 0
R1 (config-router) # end
R1 #
Multi-area OSPF is configured on R2 and the wildcard mask of the interface network address is used:
R2 (config) # router ospf 10
R2 (config-router) # router-id 2.2.2.2
R2 (config-router) # network 192.168.10.0 0.0.0.3 area 0
R2 (config-router) # network 192.168.10.4 0.0.0.3 area 0
R2 (config-router) # network 10.2.1.0 0.0.0.255 area 0
R2 (config-router) # end
R2 #
* Apr 19 18: 11: 04.029:% ​​OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on 
Serial0 / 0/0 from LOADING to FULL, Loading Done
R2 #
Then multi-area OSPF is configured on R3. Here the wildcard mask 0.0.0.0 is used for all networks.
R3 (config) # router ospf 10
R3 (config-router) # router-id 3.3.3.3
R3 (config-router) # network 192.168.10.6 0.0.0.0 area 0
R3 (config-router) # network 192.168.1.1 0.0.0.0 area 2
R3 (config-router) # network 192.168.2.1 0.0.0.0 area 2
R3 (config-router) # end
Apr 19 18: 12: 55,881:% OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on 
Serial0 / 0/1 from LOADING to FULL, Loading Done

OSPFv3 Configuration of various areas

As in OSPFv2, the implementation of the multi-area OSPFv3 topology of Image 2 is simple.

No special commands are required. A router becomes ABR when it has two interfaces in two different areas.

OSPFv3 Multi-Area Configuration Example

For example, in the scheme below, router ID 1.1.1.1 was assigned to R1. The example also enables OSPF on the two LAN interfaces in area 1 and on the serial interface in area 0. Since R1 has interfaces connected to two different areas, it is an ABR.
R1 (config) # ipv6 router ospf 10
R1 (config-rtr) # router-id 1.1.1.1
R1 (config-rtr) # exit
R1 (config) # 
R1 (config) # interface GigabitEthernet 0/0
R1 (config-if) # ipv6 ospf 10 area 1
R1 (config-if) # 
R1 (config-if) # interface Serial0 / 0/0
R1 (config-if) # ipv6 ospf 10 area 0
R1 (config-if) # end
R1 #
For R2, we enter the OSPFv3 router configuration mode with process ID 10 and configure router ID 2.2.2.2.
R2 (config) # ipv6 router ospf 10
* Apr 24 14: 18: 10,463:% OSPFv3-4-NORTRID: Process OSPFv3-10-IPv6 
could not pick a router-id, please configure manually
R2 (config-rtr) # router-id 2.2.2.2
R2 (config-rtr) # exit
Now, OSPFv3 is configured for process ID 10 on each of the interfaces:
R2 (config) # interface g0 / 0
R2 (config-if) # ipv6 ospf 10 area 0
R2 (config-if) # interface S0 / 0/0
R2 (config-if) # ipv6 ospf 10 area 0
R2 (config-if) # interface S0 / 0/1
R2 (config-if) # ipv6 ospf 10 area 0
R2 (config-if) # end
* Apr 24 14: 18: 35.135:% OSPFv3-5-ADJCHG: Process 10, Nbr 1.1.1.1 on 
Serial0 / 0/0 from LOADING to FULL, Loading Done
For R3, we enter the OSPFv3 router configuration mode with process ID 10 and configure router ID 3.3.3.3.
R3 (config) # ipv6 router ospf 10
* Apr 24 14: 20: 42.463:% OSPFv3-4-NORTRID: Process OSPFv3-10-IPv6 
could not pick a router-id, please configure manually
R3 (config-rtr) # router-id 3.3.3.3
R3 (config-rtr) # exit
And finally, OSPFv3 is configured for process ID 10 in each of the interfaces:
R3 (config) # interface g0 / 0
R3 (config-if) # ipv6 ospf 10 area 2
R3 (config-if) # interface S0 / 0/1
R3 (config-if) # ipv6 ospf 10 area 0
R3 (config-if) # end
* Apr 24 14: 21: 01.439:% OSPFv3-5-ADJCHG: Process 10, Nbr 2.2.2.2 on 
Serial0 / 0/1 from LOADING to FULL, Loading Done
R3 #

OSPF Summary Routes

The summary helps to make the routing tables shorter. It involves consolidating several routes into a single ad, which then spreads to the backbone area.
Typically, type 1 and type 2 LSAs are generated within each area , translated into type 3 LSAs and sent to other areas. If area 1 had thirty networks to announce, thirty Type 3 LSAs would be forwarded to the backbone network. With the route summary, the ABR consolidates the 30 networks into one of two advertisements.
In Image 3, R1 consolidates all network announcements in a summary LSA.

Instead of resending LSA individually for each route in area 1, R1 forwards a summary LSA to core router C1. C1, in turn, forwards the summary LSA to R2 and R3. R2 and R3 then forward it to their respective internal routers.
The summary also helps increase network stability, because it reduces unnecessary flooding of LSA.
This situation directly affects the amount of memory, CPU and bandwidth resources used by the OSPF routing process. Without a route summary, all specific link LSAs propagate on the OSPF backbone network and beyond, which generates unnecessary network traffic and router reload.
In Image, a network link on R1 fails. R1a sends an LSA to R1. However, R1 does not propagate the update, since it has a summary route configured. The saturation of specific links outside the area with LSA does not occur.

Summarization of external and inter-area routes

In OSPF, summarization can be configured only in ABRs or ASBRs. Instead of announcing many specific networks, ABR and ASBR routers announce a summary route. The ABR summary LSA type 3 routers and the ASBR summary LSA type 5 routers.
By default, summary LSAs (type 3 LSAs) and external LSAs (type 5) do not contain summary (aggregate) routes; that is, by default, summary LSAs are not summarized.

As shown in above Images , route summarization can be configured as follows:

  • Inter-area route summarization : inter-area route summarization occurs in the ABRs and is applied to routes within each area. It does not apply to external routes introduced in OSPF through redistribution.

To effectively summarize inter-area routes, network addresses must be assigned contiguously, so that these addresses can be summarized in a minimum number of summary addresses.

  • Summarization of external routes : the summarization of external routes is specific to the external routes that are introduced in OSPF through the redistribution of routes. Again, it is important to ensure the contiguity of the external address ranges that are summarized.

Usually, only ASBRs summarize external routes. As shown in Image 6, ASBR R2 summarizes the external EIGRP routes in a single LSA and sends them to R1 and R3.
Note : In ASBRs, the summarization of external routes is configured using the summary-address address mask command of the router configuration mode.

 Inter-area route summarization

OSPF does not perform automatic summarization. The inter-area summarization must be manually configured in the ABRs.
Only ABRs can summarize internal routes. When summarization is enabled in an ABR, a single type 3 LSA describing the summary route is introduced into the backbone. This unique LSA summarizes several routes within the area.
A summary route is generated if at least one subnet within the area is within the range of summary addresses. The summary route metric equals the lowest cost of all subnets within the range of summary addresses.

In Image, a multi-area OSPF topology is shown. The routing tables of R1 and R3 are analyzed to see the effect of summarization.

In Image below, the routing table of R1 is shown before summarization is configured, while in next Image , the routing table of R3 is shown.


Calculation of the summary route


The figure shows that the summary of networks in a single address and mask can be done in three steps:

  • Step 1 . List the networks in binary format. In the example, the two networks in area 1 (10.1.1.0/24 and 10.1.2.0/24) are indicated in binary format.
  • Step 2 . Count the number of bits that match on the far left to determine the summary path mask. As highlighted, the first 22 digits of the far left match. This produces the prefix / 22 or subnet mask 255.255.252.0.
  • Step 3 . Copy the matching bits and then add the zero bits to determine the summarized network address. In this example, the bits coinciding with leading zeros show us as a result the network address 10.1.0.0/22. This summary address brings together four networks: 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24 and 10.1.3.0/24.

In the example, the summary address matches four networks although there are only two networks.

Inter-route summary configuration

In Image, to demonstrate the effect of route summarization, R1 is configured to summarize the internal routes of area 1.
To manually configure inter-route route summarization in an ABR, use the area area-id range address mask command in router configuration mode. This instructs the ABR to summarize the routes for a specific area before introducing them into another area in the form of LSA type 3 summary through the backbone.
Note : In OSPFv3, the command is identical, except for the IPv6 network address. The command syntax for OSPFv3 is area area id range prefix / prefix-length .
The two internal routes of area 1 are summarized below in an OSPF inter-area summary route on R1. The summary route 10.1.0.0/22 ​​summarizes four network addresses: from 10.1.0.0/24 to 10.1.3.0/24.
R1 (config) # router ospf 10
R1 (config-router) # area 1 range 10.1.0.0 255.255.252.0
R1 (config-router) #

Sunday, 27 October 2019

OSPF Authentication Types, Configuration & Verification

OSPF Authentication Types, Configuration & Verification

This article is relate to OSPF Authentication Types, Configuration & Verification. OSPF supports three types of authentication: null, simple password authentication and MD5 authentication. OSPF MD5 authentication can be configured globally or by interface. OSPF authentication is for security purpose. There are different types of OSPF authentication.

OSPF Authentication Types 

When neighbor authentication is configured on a router, the router authenticates the origin of each routing update package it receives. This is achieved by exchanging an authentication key (sometimes called " password ") known to both the router that sends the packet and the one that receives it.
To exchange routing update information securely, OSPF authentication must be enabled. OSPF authentication can be none (null), simple or synthesis of message 5 (MD5).
OSPF supports three types of authentication:

  • Null : This is the default method and means that no authentication is used for OSPF.
  • Simple password authentication : it is also known as "authentication with unencrypted text", because the password in the update is sent as unencrypted text over the network.
  • MD5 authentication (MD5 authentication) : This is the most secure and recommended authentication method. MD5 authentication provides greater security, since the password is never exchanged between peers. Instead, it is calculated using the MD5 algorithm. The coincidence of the results authenticates the issuer.


OSPF MD5 Authentication

The following example shows how MD5 authentication is used to authenticate two neighboring OSPF routers.
In Image 1, R1 combines the routing message with the previously shared secret key and calculates the signature with the MD5 algorithm. The signature is also known as " hash value ".

In Image 2, R1 adds the signature to the routing message and sends it to R2.

MD5 does not encrypt the message; Therefore, the content can be read easily.
In Image 3, R2 opens the package, combines the routing message with the previously shared secret key and calculates the signature with the MD5 algorithm.


  • If the signatures match, R2 accepts the routing update.
  • If the signatures do not match, R2 discards the update.

OSPFv3 (OSPF for IPv6) does not include any authentication capabilities of its own . Instead, it relies entirely on IPSec to protect communications between neighbors with the ipv6 ospf authentication ipsec spi command from the interface configuration mode. This is beneficial, as it simplifies the OSPFv3 protocol and standardizes its authentication mechanism.

OSPF MD5 Authentication Configuration

OSPF supports authentication of routing protocols using MD5. MD5 authentication can be enabled globally for all interfaces or for each desired interface.

To enable OSPF MD5 authentication globally, configure the following:
Interface configuration mode command:
ip ospf message-digest-key key md5 password
Router configuration mode command:
area area-id authentication message-digest
This method imposes authentication on all interfaces with OSPF enabled. If an interface is not configured with the ip ospf message-digest-key command , you cannot establish adjacencies with other OSPF neighbors.
To provide more flexibility, interface authentication is now supported. To enable MD5 authentication per interface, configure the following:
Interface configuration mode command:
ip ospf message-digest-key key md5 password
Interface configuration mode command:
ip ospf authentication message-digest
The global OSPF MD5 authentication methods and per interface can be used on the same router. However, the configuration per interface replaces the global configuration. MD5 authentication passwords do not have to be the same in an entire area; however, they have to be the same among neighbors .
For example, suppose that all routers in the illustration converged using OSPF and that routing works correctly. OSPF authentication will be implemented on all routers.

OSPF MD5 Authentication example

In the example in Image 4, we show how to configure R1 to enable OSPF MD5 authentication on all interfaces.

Note that informational messages indicate that the adjacency of OSPF neighbors with R2 and R3 changed to the Down state (inactive), because R2 and R3 have not yet been configured to support MD5 authentication.
As an alternative to the global enable of MD5 authentication, the example in Image 5 shows how to configure R1 to enable OSPF MD5 authentication per interface. Note that, also in this case, the adjacencies of OSPF neighbors changed to the Down state.

Next, OSPF MD5 authentication is enabled globally on R2 and per interface on R3.
R2 (config) # router ospf 10
R2 (config-router) # area 0 authentication message-digest
R2 (config-router) # interface GigabitEthernet 0/0
R2 (config-if) # ip ospf message-digest-key 1 md5 CISCO-123
R2 (config-if) # interface Serial 0/0/0
R2 (config-if) # ip ospf message-digest-key 1 md5 CISCO-123
R2 (config-if) # interface Serial 0/0/1
R2 (config-if) # ip ospf message-digest-key 1 md5 CISCO-123
R2 (config-if) # end
R2 (config) # 
* Apr 8 10: 26: 46.783:% OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on Serial0 / 0/0 from LOADING to FULL, Loading Done 
R2 (config) # 
* Apr 8 10: 27: 16,435:% OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on Serial0 / 0/1 from FULL to DOWN, Neighbor Down: Dead timer expired 
R2 #
Informational messages also appear here. The first message is because the neighbor adjacency with R1 was re-established. However, the adjacency with R3 changed to the Down state, because R3 has not yet been configured.
R3 (config) # interface GigabitEthernet 0/0
R3 (config-if) # ip ospf message-digest-key 1 md5 CISCO-123
R3 (config-if) # ip ospf authentication message-digest
R3 (config-if) # interface Serial 0/0/0
R3 (config-if) # ip ospf message-digest-key 1 md5 CISCO-123
R3 (config-if) # ip ospf authentication message-digest
R3 (config-if) # interface Serial 0/0/1
R3 (config-if) # ip ospf message-digest-key 1 md5 CISCO-123
R3 (config-if) # ip ospf authentication message-digest
R3 (config-if) # end
R3 # 
* Apr 8 10: 29: 21.859:% OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on Serial0 / 0/1 from LOADING to FULL, Loading Done 
R3 (config) # 
* Apr 8 10: 29: 27.315:% OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on Serial0 / 0/0 from LOADING to FULL, Loading Done 
R3 #
After configuring R3, all neighborhood adjacencies were re-established.

Verification of the OSPF MD5 Authentication

To verify that OSPF MD5 authentication is enabled, use the show ip ospf interface command in privileged EXEC mode. By verifying that the routing table is complete, it can be confirmed that the authentication was successful.
In Image, the verification of OSPF MD5 authentication is shown on serial interface 0/0/0 on R1.

In following Image, it is confirmed that the authentication was successful.

Interface configuration of OSPF and OSPFv3 IPv6 on Cisco

Interface configuration of OSPF and OSPFv3 IPv6 on Cisco

This section explain the Interface configuration of OSPF and OSPFv3 IPv6 on Cisco Router. In start of article you will learn how OSPF process starts, hand shaking process and different timers which are related to interface configurations.

OSPF Hello and dead intervals

The OSPF Hello and dead intervals can be configured per interface. The OSPF intervals must match, otherwise a neighbor adjacency is not created.
To verify the interface intervals currently configured, use the show ip ospf interface command , as shown in Image 1. The Hello and dead intervals of the Serial 0/0/0 interface are set to the default values: 10 seconds and 40 seconds, respectively.


In following image, an example of using a filtering technique to show the OSPF intervals of the Serial 0/0/0 interface with OSPF enabled on R1 is presented.


In Image, the show ip ospf neighbor command on R1 is used to verify that R1 is adjacent to R2 and R3.

Note in the result that the Dead Time counts down from 40 seconds. By default, this value is updated every 10 seconds when R1 receives a Hello from the neighbor.

 Configuration and Modification of the OSPF Helllo intervals

You may want to change the OSPF timers so that the routers detect network failures in less time. This increases traffic, but sometimes the need for rapid convergence is more important than the additional traffic it generates. Default Hello and dead intervals are based on best practices and should only be altered in exceptional situations.
The OSPF Hello and dead intervals can be modified manually using the following interface configuration mode commands:
ip ospf hello-interval  seconds
ip ospf dead-interval  seconds
Use the no ip ospf hello-interval and no ip ospf dead-interval commands to reset the intervals to the default value.

 Modification Example

In the example in Image 4, the Hello interval is changed to 5 seconds.

 
Immediately after changing the Hello interval, the Cisco IOS automatically modifies the dead interval to a value equivalent to four times the Hello interval.
However, it is always advisable to explicitly modify the timer instead of relying on the automatic IOS function so that the changes are documented in the configuration. Therefore, the dead interval is also set manually in 20 seconds on the Serial 0/0/0 interface of R1.
As shown in the OSPFv2 adjacency message highlighted in Image 4, when the dead time timer on R1 expires, R1 and R2 lose their adjacency. This is because the values ​​were only changed on one side of the serial link between R1 and R2. Remember that the OSPF Hello and dead intervals must match between neighbors.

Verification Example

Use the show ip ospf neighbor command on R1 to verify neighbor adjacencies, as shown in Image 5.

Note that the only neighbor included is router 3.3.3.3 (R3) and that R1 is no longer adjacent to neighbor 2.2.2.2 (R2). The timers set in Serial 0/0/0 do not affect the adjacency of neighbors with R3.
To restore the adjacency between R1 and R2, the hello interval of the Serial 0/0/0 interface of R2 is set to 5 seconds, as shown below. Almost immediately, the IOS displays a message indicating that the adjacency was established with a FULL state.
R2 (config) # interface serial 0/0/0
R2 (config-if) # ip ospf hello-interval 5
R2 (config-if) # 
* Jan 7 17: 41: 49.001:% OSPF-5-ADJCHG: Process 10, Nbr 
1.1.1.1 on Serial0 / 0/0 from LOADING to FULL, Loading Done
R2 (config-if) # end 
R2 #
Now, we verify the interface intervals using the show ip ospf interface command , as shown below.
R2 # show ip ospf interface s0 / 0/0 | include Timer
 Timer intervals configured, Hello 5, Dead 20, Wait 20, 
Retransmit 5
R2 # 
R2 # show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
3.3.3.3 0 FULL / - 00:00:35 192.168.10.10 Serial0 / 0/1
1.1.1.1 0 FULL / - 00:00:17 172.16.3.1 Serial0 / 0/0
R2 #
Note that the Hello time is 5 seconds and the dead time is automatically set to 20 seconds instead of the default 40 seconds. Remember that OSPF automatically sets the dead interval to four times the Hello interval.

Configuration of IPV6 OSPF hello timers on OSPFv3

As with OSPFv2, the OSPFv3 intervals can also be adjusted.
The OSPFv3 Hello and dead intervals can be modified manually using the following interface configuration mode commands:
ipv6 ospf hello-interval  seconds
ipv6 ospf dead-interval  seconds
Note : Use the no ipv6 ospf hello-interval and no ipv6 ospf dead-interval commands to reset the intervals to the default value.

  IPv6 OSPFv3 Configuration example

See the IPv6 topology of Image 6. Assume that network convergence occurred through OSPFv3.

In the example in Image, the OSPFv3 Hello interval is changed to 5 seconds. Immediately after changing the Hello interval, the Cisco IOS automatically modifies the dead interval to a value equivalent to four times the Hello interval.

OSPFv3 Hello Interval configuration


However, as with OSPFv2, it is always advisable to explicitly modify the timer instead of relying on the automatic function of the IOS so that the modifications are documented in the configuration. Therefore, the dead interval is also set manually in 20 seconds on the Serial 0/0/0 interface of R1.
When the timeout timer on R1 expires, R1 and R2 lose their adjacency (as shown in the OSPFv3 adjacency message highlighted in Image 7) because the values ​​were only altered on one side of the serial link between R1 and R2. Remember that the OSPFv3 Hello and dead intervals must be the same between the neighbors.

OSPFv3 Verification Example

Use the show ipv6 ospf neighbor command on R1 to verify neighbor adjacencies (Image 8). Note that R1 is no longer adjacent to neighbor 2.2.2.2 (R2).
R1#show ipv6 ospf neighbor
To restore the adjacency between R1 and R2, the hello interval of the Serial 0/0/0 interface of R2 is set to 5 seconds, as shown below. Almost immediately, the IOS displays a message indicating that the adjacency was established with a FULL state.
R2 (config) # interface serial 0/0/0 
R2 (config-if) # ipv6 ospf hello-interval 5
R2 (config-if) # 
* Jan 10 15: 07: 28.815:% OSPFv3-5-ADJCHG: Process 10, Nbr
1.1.1.1 on Serial0 / 0/0 from LOADING to FULL, Loading Done
R2 (config-if) # end 
R2 #
Finally, the interface intervals are verified using the show ipv6 ospf interface command .
R2 # show ipv6 ospf interface s0 / 0/0 | include Timer
 Timer intervals configured, Hello 5, Dead 20, Wait 20,
Retransmit 5
R2 # 
R2 # show ipv6 ospf neighbor

OSPFv3 Router with ID (2.2.2.2) (Process ID 10)

Neighbor ID Pri State Dead Time Interface ID Interface
3.3.3.3 0 FULL / - 00:00:38 7 Serial0 / 0/1
1.1.1.1 0 FULL / - 00:00:19 6 Serial0 / 0/0
R2 #
Note that the Hello time is 5 seconds and the dead time is automatically set to 20 seconds instead of the default 40 seconds. Remember that OSPF automatically sets the dead interval to four times the Hello interval.