Thursday, September 23, 2010
CCIE R&S Bootcamp In India By Narbik & Scott Morris
If you were ever dreaming about attending a CCIE R&S bootcamp taught by Evil CCIE Instructor Scott Morris :-) or Narbik....here is the biggest opportunity that can ever come for you right in India.
Yes...both of them are coming together in India to conduct 12 Day bootcamp class....and If I am not wrong...It's going to be first time ever when they will be conducting CCIE Bootcamp in India.
I am not sure about you guys but this is the opportunity I would have never missed if I were there... never...ever...ever :-)
http://www.ccieflyer.com/2010-09-Eman_Narbik_Scott.php
Yes...both of them are coming together in India to conduct 12 Day bootcamp class....and If I am not wrong...It's going to be first time ever when they will be conducting CCIE Bootcamp in India.
I am not sure about you guys but this is the opportunity I would have never missed if I were there... never...ever...ever :-)
http://www.ccieflyer.com/2010-09-Eman_Narbik_Scott.php
Bangalore India – January 17 – 28, 2011
Milton Keynes, UK – April 11 – 22, 2011
Wilmington, DE USA – July 18 – 29, 2011
Dubai, UAE – October 17 – 28, 2011
Sydney, Australia – January 2012
Wednesday, September 22, 2010
OSPF Mock Lab - Another Challenge To Solve (Solution 2 & 3)
Last month when I posted my OSPF challenge I thought there is only one way to accomplish this challenge. But soon I had another working solution too which was working perfectly fine. Lets now call it Solution 1 for our sake.
So where is my solution or so called Solution 2 ? :-)
hmmm...Ok...Today I am not only going to show you mine original solution which I figured out but also a 3rd solution.....isn't that cool ? :-)
Yup...I picked some pieces of solution 1 and solution 2 and combined them together in a new way :-)
Okay...first of all...my solution 2 may look ugly to you...but solution 3 will definitely look ugly and actually involves good piece of troubleshooting too.
It actually reminds me of a old TV cartoon show - ED, EDD & EDDY
Ok, Lets talk about solution 2 first:
Lets put Initials first, which would be matching the GNS topology I presented during solution 1 post. So lets get started:
<<< R1 >>>
-------------------------
en
!
conf t
!
no ip domain-lo
!
ho R1
!
int s0/0
ip add 123.123.123.1 255.255.255.0
en f
no frame inv
no arp fr
frame map ip 123.123.123.2 102 b
frame map ip 123.123.123.3 103 b
frame map ip 123.123.123.1 102
ip ospf net point-to-m
no sh
exit
!
int f1/0
ip add 14.14.14.1 255.255.255.0
no sh
exit
!
router ospf 1
router-id 1.1.1.1
net 123.123.123.1 0.0.0.0 a 0
net 14.14.14.1 0.0.0.0 a 1
exit
!
int lo0
ip add 11.11.11.11 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 0
exit
end
!
------------------------------------
<<< R2 >>>
en
!
conf t
!
no ip domain-lo
!
ho R2
!
int s0/0
ip add 123.123.123.2 255.255.255.0
en f
no frame inv
no arp fr
frame map ip 123.123.123.1 201 b
frame map ip 123.123.123.2 201
ip ospf net point-to-m
no sh
exit
!
int lo0
ip add 22.22.22.22 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 0
exit
!
router ospf 1
router-id 2.2.2.2
net 123.123.123.2 0.0.0.0 a 0
exit
end
!
-------------------------------------
<<< R3 >>>
en
!
conf t
!
no ip domain-lo
!
ho R3
!
int s0/0
ip add 123.123.123.3 255.255.255.0
en f
no frame inv
no arp fr
frame map ip 123.123.123.1 301 b
frame map ip 123.123.123.3 301
ip ospf net point-to-m
no sh
exit
!
int lo0
ip add 33.33.33.33 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 0
exit
!
router ospf 1
router-id 3.3.3.3
net 123.123.123.3 0.0.0.0 a 0
exit
end
!
--------------------------------------
<<< R4 >>>
en
!
conf t
!
no ip domain-lo
!
ho R4
!
int f0/0
ip add 14.14.14.4 255.255.255.0
no sh
exit
!
int f1/0
ip add 45.45.45.4 255.255.255.0
no sh
exit
!
router ospf 1
router-id 4.4.4.4
net 14.14.14.4 0.0.0.0 a 1
exit
!
int lo0
ip add 44.44.44.44 255.255.255.0
exit
!
int lo1
ip add 144.144.144.144 255.255.255.0
ip ospf 1 a 1
exit
!
router rip
v 2
no au
net 44.0.0.0
net 45.0.0.0
exit
end
!
-----------------------------------------
<<< R5 >>>
en
!
conf t
!
no ip domain-lo
!
ho R5
!
int f0/0
ip add 45.45.45.5 255.255.255.0
no sh
exit
!
int lo0
ip add 55.55.55.55 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 2
exit
!
int lo1
ip add 155.155.155.155 255.255.255.0
exit
!
int f1/0
ip add 56.56.56.5 255.255.255.0
no sh
!
router ospf 1
router-id 5.5.5.5
net 56.56.56.5 0.0.0.0 a 2
exit
!
router rip
net 45.0.0.0
net 155.155.0.0
v 2
no au
exit
end
!
--------------------------------------------
<<< R6 >>>
en
!
conf t
!
no ip domain-lo
!
ho R6
!
int f0/0
ip add 56.56.56.6 255.255.255.0
no sh
exit
!
int lo0
ip add 66.66.66.66 255.255.255.0
ip ospf 1 a 2
ip ospf net point-to-p
exit
!
router ospf 1
router-id 6.6.6.6
net 56.56.56.6 0.0.0.0 a 2
exit
end
!
---------------------------------------------
Now we have all basic reachability. The problem is that we can not have route exchange between two different ospf areas without having area 0 in middle or some way logically connected to it. That's why we designed Virtual Links Right ? :-)
But problem here is that we are not allowed to use them :-(
Ok...next idea that comes in mind is GRE tunnels :-)
But that's also not allowed :-(
Hey...but remember If I go under tunnel interface and change tunnel mode to IP-IP with command "tunnel mode ipip" at that point I am not running GRE tunnel technically but IP-IP tunnel. Which also adds benefit of less overhead.
I know...some of you may be saying that's not right :-)...but didn't you notice from comments of CCIE people over web that real lab may trick you same way with wording of tasks ?
So lets create our first tunnel between R5 & R4 and ultimate goal here is to pull area 2 upto area 1 first.
-----------------------------------------------
<<< R4 >>>
<<< R5 >>>
*Mar 1 00:24:35.739: %OSPF-5-ADJCHG: Process 1, Nbr 5.5.5.5 on Tunnel0 from LOADING to FULL, Loading Done
---------------------------------------------------
<<< R4 >>>
R4#s ip ro os | i T
O 55.55.55.0 [110/11112] via 100.100.100.100, 00:04:40, Tunnel0
O 66.66.66.0 [110/11113] via 100.100.100.100, 00:04:40, Tunnel0
O 56.56.56.0 [110/11112] via 100.100.100.100, 00:04:40, Tunnel0
---------------------------------------------------
<<< R5 >>>
R5#sh ip ro os
66.0.0.0/24 is subnetted, 1 subnets
O 66.66.66.0 [110/2] via 56.56.56.6, 00:05:50, FastEthernet1/0
-----------------------------------------------------------
Now lets create another tunnel between R1 & R4 and pulls area 2 which is at R4 now back to Area 0 over R1:
------------------------------------------------------------
<<< R4 >>>
R4(config)#int tu 1
R4(config-if)#ip add 125.125.125.4 255.255.255.0
R4(config-if)#tu so tu0 <- See I am putting one tunnel inside another here
R4(config-if)#tu dest 11.11.11.11
R4(config-if)#ip ospf 1 a 2
R4(config-if)#tunnel mode ipip
R4(config-if)#exit
----------------------------------------------------
<<< R1 >>>
R1(config)#int tu 1
R1(config-if)#ip add 125.125.125.1 255.255.255.0
R1(config-if)#tu so lo0
R1(config-if)#tu dest 100.100.100.101
R1(config-if)#ip ospf 1 a 2
R1(config-if)#tunnel mode ipip
R1(config-if)#exit
----------------------------------------------------
Now lets check the Routing Table over R1 and See if we have Route for R6's loopback:
R1(config-if)#do sh ip ro | i T
R1(config-if)# <- Nothing in here
-----------------------------------------------------
Hmmm... Lets see if tunnel is indeed UP:
So tunnel is down.
Hmmm...for tunnel to come up we should have reachability between Tunnel Source and Destination address...right?
lets check that:
R1(config-if)#do sh ip ro 100.100.100.101
% Network not in table
---------------------------------------------------------
Hmmm...lets make tunnel destination reachable by adding /32 static route: Remember I allowed to use one static route in entire config :-)
R1(config)#do sh ip ro 100.100.100.101
Routing entry for 100.100.100.101/32
Known via "static", distance 1, metric 0
Routing Descriptor Blocks:
* 14.14.14.4
Route metric is 0, traffic share count is 1
------------------------------------------------------
R1(config)#do ping 100.100.100.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.100.100.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/10/16 ms
-------------------------------------------------------
So finally our magical tunnel has come up and by this time we should have reachability to R6's loopback:
Which we have :-)
------------------------------------------------
The major problem (not exactly) with My solution 2 is that you have full reachability among all OSPF routes but No reachability for RIP routes. Although In my original post I just asked for OSPF routes reachability only so which makes my Solution perfectly valid :-)
Now lets put some more restrictions once again :-P
1. No Static Routing Is allowed anywhere now
2. RIP Routes should also be reachable from entire ospf Domain and vice versa
Hmmm...that really makes life very complicated now.
Lets remove static route from R1 now:
R1(config)#do sh run | i ip route
R1(config)# <- So As you can see I removed it
Now lets put "default information originate always" command over R4 since we don't have static route now for reachability upto R4's Tunnel 1 Source & see if this can help us
R4(config-if)#do sh run | s r o
router ospf 1
router-id 4.4.4.4
log-adjacency-changes
redistribute rip
network 14.14.14.4 0.0.0.0 area 1
network 100.100.100.101 0.0.0.0 area 2
default-information originate always
R2#sh ip ro | i 0.0.0.0
Gateway of last resort is 123.123.123.1 to network 0.0.0.0
100.0.0.0/24 is subnetted, 1 subnets
O*E2 0.0.0.0/0 [110/1] via 123.123.123.1, 01:53:08, Serial0/0
R6#sh ip ro | i 0.0.0.0
Gateway of last resort is 56.56.56.5 to network 0.0.0.0
100.0.0.0/24 is subnetted, 1 subnets
O*E2 0.0.0.0/0 [110/1] via 56.56.56.5, 01:53:41, FastEthernet0/0
But...As soon as I do that I have another problem:
R1(config-router)#
*Mar 1 01:50:01.775: %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing
*Mar 1 01:50:02.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
*Mar 1 01:50:02.791: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from FULL to DOWN, Neighbor Down: Interface down or detached
*Mar 1 01:51:02.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar 1 01:51:02.867: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from LOADING to FULL, Loading Done
*Mar 1 01:51:09.771: %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing
*Mar 1 01:51:10.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
*Mar 1 01:51:10.787: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from FULL to DOWN, Neighbor Down: Interface down or detached
Hmmm...so our old GRE route recursion issue comes back which we discussed in detail few posts back :-)
So no need to panic...right :-)
Lets dig little deeper to find the cause of issue:
R1(config-router)#do debug ip routing
*Mar 1 01:52:28.919: RT: Pruning routes for Tunnel1 (4)
*Mar 1 01:52:28.919: RT: delete route to 100.100.100.0 via 125.125.125.4, Tunnel1
*Mar 1 01:52:28.919: RT: no routes to 100.100.100.0, flushing
*Mar 1 01:52:28.919: RT: NET-RED 100.100.100.0/24
*Mar 1 01:52:28.919: RT: delete network route to 100.0.0.0
*Mar 1 01:52:28.919: RT: NET-RED 100.0.0.0/8
Hmmm... You see ? We are learning tunnel destination from R1's point of view from tunnel itself.
Lets fix this with a Distribute list:
R1(config-router)#do sh ip access-l 1
Standard IP access list 1
10 deny 100.100.100.0
or
ip access-l 1 de 100.100.100.0 0.0.0.0<- Actual ACL I applied was this :-)
R1(config)#router ospf 1
R1(config-router)#distribute-list 1 in Tunnel1
*Mar 1 01:54:26.651: RT: add 0.0.0.0/0 via 14.14.14.4, ospf metric [110/1]
*Mar 1 01:54:26.655: RT: NET-RED 0.0.0.0/0
*Mar 1 01:54:26.655: RT: default path is now 0.0.0.0 via 14.14.14.4
*Mar 1 01:54:26.655: RT: new default network 0.0.0.0
*Mar 1 01:54:26.655: RT: NET-RED 0.0.0.0/0
*Mar 1 01:54:31.627: RT: NET-RED 0.0.0.0/0
*Mar 1 01:54:36.915: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar 1 01:54:36.915: RT: is_up: Tunnel1 1 state: 4 sub state: 1 line: 0 has_route: False
*Mar 1 01:54:36.915: RT: SET_LAST_RDB for 125.125.125.0/24
NEW rdb: is directly connected
*Mar 1 01:54:36.915: RT: add 125.125.125.0/24 via 0.0.0.0, connected metric [0/0]
*Mar 1 01:54:36.915: RT: NET-RED 125.125.125.0/24
*Mar 1 01:54:36.915: RT: interface Tunnel1 added to routing table
R1(config)#do sh access-l 1
Standard IP access list 1
10 deny 100.100.100.0 (2 matches) <- See we have hits for this ACL
By this point we should be good to go and run our final TCL script to verify full connectivity including for RIP routes:
--------------------------------------------------
R3>en
R3#tclsh
R3(tcl)#foreach address {
+>(tcl)#123.123.123.1
+>(tcl)#14.14.14.1
+>(tcl)#11.11.11.11
+>(tcl)#123.123.123.2
+>(tcl)#22.22.22.22
+>(tcl)#123.123.123.3
+>(tcl)#33.33.33.33
+>(tcl)#14.14.14.4
+>(tcl)#45.45.45.4
+>(tcl)#44.44.44.44
+>(tcl)#144.144.144.144
+>(tcl)#45.45.45.5
+>(tcl)#56.56.56.5
+>(tcl)#55.55.55.55
+>(tcl)#155.155.155.155
+>(tcl)#56.56.56.6
+>(tcl)#66.66.66.66
+>(tcl)#} {ping $address}
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.123.123.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/9/20 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 14.14.14.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/12/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.11.11.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/17/24 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.123.123.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/38/56 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 22.22.22.22, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/36 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.123.123.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/40/52 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 33.33.33.33, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 14.14.14.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/37/60 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 45.45.45.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/23/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 44.44.44.44, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/20/40 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 144.144.144.144, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/15/24 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 45.45.45.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/36 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 56.56.56.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/33/40 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 55.55.55.55, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/46/60 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 155.155.155.155, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/43/56 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 56.56.56.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/39/60 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 66.66.66.66, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/36/56 ms
R3(tcl)#
So again ...one problem and multiple ways to fix it :-)
So where is my solution or so called Solution 2 ? :-)
hmmm...Ok...Today I am not only going to show you mine original solution which I figured out but also a 3rd solution.....isn't that cool ? :-)
Yup...I picked some pieces of solution 1 and solution 2 and combined them together in a new way :-)
Okay...first of all...my solution 2 may look ugly to you...but solution 3 will definitely look ugly and actually involves good piece of troubleshooting too.
It actually reminds me of a old TV cartoon show - ED, EDD & EDDY
Ok, Lets talk about solution 2 first:
Lets put Initials first, which would be matching the GNS topology I presented during solution 1 post. So lets get started:
------------------
Solution 2
------------------<<< R1 >>>
-------------------------
Initials
------------------------en
!
conf t
!
no ip domain-lo
!
ho R1
!
int s0/0
ip add 123.123.123.1 255.255.255.0
en f
no frame inv
no arp fr
frame map ip 123.123.123.2 102 b
frame map ip 123.123.123.3 103 b
frame map ip 123.123.123.1 102
ip ospf net point-to-m
no sh
exit
!
int f1/0
ip add 14.14.14.1 255.255.255.0
no sh
exit
!
router ospf 1
router-id 1.1.1.1
net 123.123.123.1 0.0.0.0 a 0
net 14.14.14.1 0.0.0.0 a 1
exit
!
int lo0
ip add 11.11.11.11 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 0
exit
end
!
------------------------------------
<<< R2 >>>
en
!
conf t
!
no ip domain-lo
!
ho R2
!
int s0/0
ip add 123.123.123.2 255.255.255.0
en f
no frame inv
no arp fr
frame map ip 123.123.123.1 201 b
frame map ip 123.123.123.2 201
ip ospf net point-to-m
no sh
exit
!
int lo0
ip add 22.22.22.22 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 0
exit
!
router ospf 1
router-id 2.2.2.2
net 123.123.123.2 0.0.0.0 a 0
exit
end
!
-------------------------------------
<<< R3 >>>
en
!
conf t
!
no ip domain-lo
!
ho R3
!
int s0/0
ip add 123.123.123.3 255.255.255.0
en f
no frame inv
no arp fr
frame map ip 123.123.123.1 301 b
frame map ip 123.123.123.3 301
ip ospf net point-to-m
no sh
exit
!
int lo0
ip add 33.33.33.33 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 0
exit
!
router ospf 1
router-id 3.3.3.3
net 123.123.123.3 0.0.0.0 a 0
exit
end
!
--------------------------------------
<<< R4 >>>
en
!
conf t
!
no ip domain-lo
!
ho R4
!
int f0/0
ip add 14.14.14.4 255.255.255.0
no sh
exit
!
int f1/0
ip add 45.45.45.4 255.255.255.0
no sh
exit
!
router ospf 1
router-id 4.4.4.4
net 14.14.14.4 0.0.0.0 a 1
exit
!
int lo0
ip add 44.44.44.44 255.255.255.0
exit
!
int lo1
ip add 144.144.144.144 255.255.255.0
ip ospf 1 a 1
exit
!
router rip
v 2
no au
net 44.0.0.0
net 45.0.0.0
exit
end
!
-----------------------------------------
<<< R5 >>>
en
!
conf t
!
no ip domain-lo
!
ho R5
!
int f0/0
ip add 45.45.45.5 255.255.255.0
no sh
exit
!
int lo0
ip add 55.55.55.55 255.255.255.0
ip ospf net point-to-p
ip ospf 1 a 2
exit
!
int lo1
ip add 155.155.155.155 255.255.255.0
exit
!
int f1/0
ip add 56.56.56.5 255.255.255.0
no sh
!
router ospf 1
router-id 5.5.5.5
net 56.56.56.5 0.0.0.0 a 2
exit
!
router rip
net 45.0.0.0
net 155.155.0.0
v 2
no au
exit
end
!
--------------------------------------------
<<< R6 >>>
en
!
conf t
!
no ip domain-lo
!
ho R6
!
int f0/0
ip add 56.56.56.6 255.255.255.0
no sh
exit
!
int lo0
ip add 66.66.66.66 255.255.255.0
ip ospf 1 a 2
ip ospf net point-to-p
exit
!
router ospf 1
router-id 6.6.6.6
net 56.56.56.6 0.0.0.0 a 2
exit
end
!
---------------------------------------------
Now we have all basic reachability. The problem is that we can not have route exchange between two different ospf areas without having area 0 in middle or some way logically connected to it. That's why we designed Virtual Links Right ? :-)
But problem here is that we are not allowed to use them :-(
Ok...next idea that comes in mind is GRE tunnels :-)
But that's also not allowed :-(
Hey...but remember If I go under tunnel interface and change tunnel mode to IP-IP with command "tunnel mode ipip" at that point I am not running GRE tunnel technically but IP-IP tunnel. Which also adds benefit of less overhead.
I know...some of you may be saying that's not right :-)...but didn't you notice from comments of CCIE people over web that real lab may trick you same way with wording of tasks ?
So lets create our first tunnel between R5 & R4 and ultimate goal here is to pull area 2 upto area 1 first.
-----------------------------------------------
<<< R4 >>>
R4(config)#do sh run int tu0
Building configuration...
Current configuration : 146 bytes
!
interface Tunnel0
ip address 100.100.100.101 255.255.255.0
tunnel source Loopback0
tunnel destination 155.155.155.155
tunnel mode ipip
end
R4(config)#router ospf 1
R4(config-router)#net 100.100.100.101 0.0.0.0 a 2
--------------------------------------Building configuration...
Current configuration : 146 bytes
!
interface Tunnel0
ip address 100.100.100.101 255.255.255.0
tunnel source Loopback0
tunnel destination 155.155.155.155
tunnel mode ipip
end
R4(config)#router ospf 1
R4(config-router)#net 100.100.100.101 0.0.0.0 a 2
<<< R5 >>>
R5#sh run int tu0
Building configuration...
Current configuration : 142 bytes
!
interface Tunnel0
ip address 100.100.100.100 255.255.255.0
tunnel source Loopback1
tunnel destination 44.44.44.44
tunnel mode ipip
end
R5(config)#router ospf 1
R5(config-router)#net 100.100.100.100 0.0.0.0 a 2
Building configuration...
Current configuration : 142 bytes
!
interface Tunnel0
ip address 100.100.100.100 255.255.255.0
tunnel source Loopback1
tunnel destination 44.44.44.44
tunnel mode ipip
end
R5(config)#router ospf 1
R5(config-router)#net 100.100.100.100 0.0.0.0 a 2
*Mar 1 00:24:35.739: %OSPF-5-ADJCHG: Process 1, Nbr 5.5.5.5 on Tunnel0 from LOADING to FULL, Loading Done
---------------------------------------------------
<<< R4 >>>
R4#s ip ro os | i T
O 55.55.55.0 [110/11112] via 100.100.100.100, 00:04:40, Tunnel0
O 66.66.66.0 [110/11113] via 100.100.100.100, 00:04:40, Tunnel0
O 56.56.56.0 [110/11112] via 100.100.100.100, 00:04:40, Tunnel0
---------------------------------------------------
<<< R5 >>>
R5#sh ip ro os
66.0.0.0/24 is subnetted, 1 subnets
O 66.66.66.0 [110/2] via 56.56.56.6, 00:05:50, FastEthernet1/0
-----------------------------------------------------------
Now lets create another tunnel between R1 & R4 and pulls area 2 which is at R4 now back to Area 0 over R1:
------------------------------------------------------------
<<< R4 >>>
R4(config)#int tu 1
R4(config-if)#ip add 125.125.125.4 255.255.255.0
R4(config-if)#tu so tu0 <- See I am putting one tunnel inside another here
R4(config-if)#tu dest 11.11.11.11
R4(config-if)#ip ospf 1 a 2
R4(config-if)#tunnel mode ipip
R4(config-if)#exit
----------------------------------------------------
<<< R1 >>>
R1(config)#int tu 1
R1(config-if)#ip add 125.125.125.1 255.255.255.0
R1(config-if)#tu so lo0
R1(config-if)#tu dest 100.100.100.101
R1(config-if)#ip ospf 1 a 2
R1(config-if)#tunnel mode ipip
R1(config-if)#exit
----------------------------------------------------
Now lets check the Routing Table over R1 and See if we have Route for R6's loopback:
R1(config-if)#do sh ip ro | i T
R1(config-if)# <- Nothing in here
-----------------------------------------------------
Hmmm... Lets see if tunnel is indeed UP:
R1(config-if)#do sh ip int b | i T
Tunnel1 125.125.125.1 YES manual up down
Tunnel1 125.125.125.1 YES manual up down
Hmmm...for tunnel to come up we should have reachability between Tunnel Source and Destination address...right?
lets check that:
R1(config-if)#do sh ip ro 100.100.100.101
% Network not in table
---------------------------------------------------------
Hmmm...lets make tunnel destination reachable by adding /32 static route: Remember I allowed to use one static route in entire config :-)
R1(config)#ip route 100.100.100.101 255.255.255.255 14.14.14.4
R1(config)#
*Mar 1 01:01:18.051: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar 1 01:01:18.247: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from LOADING to FULL, Loading Done
R1(config)#
*Mar 1 01:01:18.051: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar 1 01:01:18.247: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from LOADING to FULL, Loading Done
Routing entry for 100.100.100.101/32
Known via "static", distance 1, metric 0
Routing Descriptor Blocks:
* 14.14.14.4
Route metric is 0, traffic share count is 1
------------------------------------------------------
R1(config)#do ping 100.100.100.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.100.100.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/10/16 ms
-------------------------------------------------------
So finally our magical tunnel has come up and by this time we should have reachability to R6's loopback:
R1(config)#do sh ip ro | i T
O 100.100.100.0/24 [110/22222] via 125.125.125.4, 00:01:17, Tunnel1
O 55.55.55.0 [110/22223] via 125.125.125.4, 00:01:17, Tunnel1
O 66.66.66.0 [110/22224] via 125.125.125.4, 00:01:17, Tunnel1
C 125.125.125.0 is directly connected, Tunnel1
O 56.56.56.0 [110/22223] via 125.125.125.4, 00:01:17, Tunnel1
O 100.100.100.0/24 [110/22222] via 125.125.125.4, 00:01:17, Tunnel1
O 55.55.55.0 [110/22223] via 125.125.125.4, 00:01:17, Tunnel1
O 66.66.66.0 [110/22224] via 125.125.125.4, 00:01:17, Tunnel1
C 125.125.125.0 is directly connected, Tunnel1
O 56.56.56.0 [110/22223] via 125.125.125.4, 00:01:17, Tunnel1
Which we have :-)
------------------------------------------------
------------------
Solution 3
------------------The major problem (not exactly) with My solution 2 is that you have full reachability among all OSPF routes but No reachability for RIP routes. Although In my original post I just asked for OSPF routes reachability only so which makes my Solution perfectly valid :-)
Now lets put some more restrictions once again :-P
1. No Static Routing Is allowed anywhere now
2. RIP Routes should also be reachable from entire ospf Domain and vice versa
Hmmm...that really makes life very complicated now.
Lets remove static route from R1 now:
R1(config)#do sh run | i ip route
R1(config)# <- So As you can see I removed it
R4(config-if)#do sh run | s r o
router ospf 1
router-id 4.4.4.4
log-adjacency-changes
redistribute rip
network 14.14.14.4 0.0.0.0 area 1
network 100.100.100.101 0.0.0.0 area 2
default-information originate always
R2#sh ip ro | i 0.0.0.0
Gateway of last resort is 123.123.123.1 to network 0.0.0.0
100.0.0.0/24 is subnetted, 1 subnets
O*E2 0.0.0.0/0 [110/1] via 123.123.123.1, 01:53:08, Serial0/0
R6#sh ip ro | i 0.0.0.0
Gateway of last resort is 56.56.56.5 to network 0.0.0.0
100.0.0.0/24 is subnetted, 1 subnets
O*E2 0.0.0.0/0 [110/1] via 56.56.56.5, 01:53:41, FastEthernet0/0
But...As soon as I do that I have another problem:
R1(config-router)#
*Mar 1 01:50:01.775: %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing
*Mar 1 01:50:02.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
*Mar 1 01:50:02.791: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from FULL to DOWN, Neighbor Down: Interface down or detached
*Mar 1 01:51:02.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar 1 01:51:02.867: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from LOADING to FULL, Loading Done
*Mar 1 01:51:09.771: %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing
*Mar 1 01:51:10.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
*Mar 1 01:51:10.787: %OSPF-5-ADJCHG: Process 1, Nbr 4.4.4.4 on Tunnel1 from FULL to DOWN, Neighbor Down: Interface down or detached
Hmmm...so our old GRE route recursion issue comes back which we discussed in detail few posts back :-)
So no need to panic...right :-)
Lets dig little deeper to find the cause of issue:
R1(config-router)#do debug ip routing
*Mar 1 01:52:28.919: RT: Pruning routes for Tunnel1 (4)
*Mar 1 01:52:28.919: RT: delete route to 100.100.100.0 via 125.125.125.4, Tunnel1
*Mar 1 01:52:28.919: RT: no routes to 100.100.100.0, flushing
*Mar 1 01:52:28.919: RT: NET-RED 100.100.100.0/24
*Mar 1 01:52:28.919: RT: delete network route to 100.0.0.0
*Mar 1 01:52:28.919: RT: NET-RED 100.0.0.0/8
Hmmm... You see ? We are learning tunnel destination from R1's point of view from tunnel itself.
Lets fix this with a Distribute list:
R1(config-router)#do sh ip access-l 1
Standard IP access list 1
10 deny 100.100.100.0
or
ip access-l 1 de 100.100.100.0 0.0.0.0<- Actual ACL I applied was this :-)
R1(config)#router ospf 1
R1(config-router)#distribute-list 1 in Tunnel1
*Mar 1 01:54:26.651: RT: add 0.0.0.0/0 via 14.14.14.4, ospf metric [110/1]
*Mar 1 01:54:26.655: RT: NET-RED 0.0.0.0/0
*Mar 1 01:54:26.655: RT: default path is now 0.0.0.0 via 14.14.14.4
*Mar 1 01:54:26.655: RT: new default network 0.0.0.0
*Mar 1 01:54:26.655: RT: NET-RED 0.0.0.0/0
*Mar 1 01:54:31.627: RT: NET-RED 0.0.0.0/0
*Mar 1 01:54:36.915: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar 1 01:54:36.915: RT: is_up: Tunnel1 1 state: 4 sub state: 1 line: 0 has_route: False
*Mar 1 01:54:36.915: RT: SET_LAST_RDB for 125.125.125.0/24
NEW rdb: is directly connected
*Mar 1 01:54:36.915: RT: add 125.125.125.0/24 via 0.0.0.0, connected metric [0/0]
*Mar 1 01:54:36.915: RT: NET-RED 125.125.125.0/24
*Mar 1 01:54:36.915: RT: interface Tunnel1 added to routing table
R1(config)#do sh access-l 1
Standard IP access list 1
10 deny 100.100.100.0 (2 matches) <- See we have hits for this ACL
By this point we should be good to go and run our final TCL script to verify full connectivity including for RIP routes:
--------------------------------------------------
R3>en
R3#tclsh
R3(tcl)#foreach address {
+>(tcl)#123.123.123.1
+>(tcl)#14.14.14.1
+>(tcl)#11.11.11.11
+>(tcl)#123.123.123.2
+>(tcl)#22.22.22.22
+>(tcl)#123.123.123.3
+>(tcl)#33.33.33.33
+>(tcl)#14.14.14.4
+>(tcl)#45.45.45.4
+>(tcl)#44.44.44.44
+>(tcl)#144.144.144.144
+>(tcl)#45.45.45.5
+>(tcl)#56.56.56.5
+>(tcl)#55.55.55.55
+>(tcl)#155.155.155.155
+>(tcl)#56.56.56.6
+>(tcl)#66.66.66.66
+>(tcl)#} {ping $address}
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.123.123.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/9/20 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 14.14.14.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/12/16 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.11.11.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/17/24 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.123.123.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/38/56 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 22.22.22.22, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/36 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 123.123.123.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/40/52 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 33.33.33.33, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 14.14.14.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/37/60 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 45.45.45.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/23/32 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 44.44.44.44, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/20/40 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 144.144.144.144, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/15/24 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 45.45.45.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/36 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 56.56.56.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/33/40 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 55.55.55.55, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/46/60 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 155.155.155.155, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/43/56 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 56.56.56.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/39/60 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 66.66.66.66, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/36/56 ms
R3(tcl)#
So again ...one problem and multiple ways to fix it :-)
HTH...
Deepak Arora
Monday, September 20, 2010
Load Balancing Vs Load Sharing - In General
Load sharing is the ability to distribute outgoing traffic (or influence the flow of incoming traffic) over multiple paths. Load balancing is the ability to split the load toward the same destination (host or IP prefix) over multiple paths.
HTH...
Deepak Arora
HTH...
Deepak Arora
EIGRP Auto-Summary Now Disabled By Default
auto-summary (EIGRP)
To allow automatic summarization of subnet routes into network-level routes, use the auto-summary command in router configuration mode or address-family topology configuration mode. To disable this function and send subprefix routing information across classful network boundaries, use the no form of this command.
auto-summary
no auto-summary
Syntax Description
This command has no arguments or keywords.
Command Default
The behavior of this command is enabled by default (the software does not send subprefix routing information across classful network boundaries).
Cisco IOS Release 15.0(1)M, 12.2(33)SRE, 12.2(33)XNE, Cisco IOS XE Release 2.5, Cisco IOS Release 12.2(33)SXI4 and Later Releases
The behavior of this command is disabled by default (the software sends subprefix routing information across classful network boundaries).
Command Modes
Router configuration (config-router)
Address-family topology configuration (config-router-af-topology)
Address-family topology configuration (config-router-af-topology)
Command History
Usage Guidelines
To allow the software to create summary subprefixes to the classful network boundary when crossing classful network boundaries, use the auto-summary command.
Enhanced Interior Gateway Routing Protocol (EIGRP) summary routes are given an administrative distance value of 5. You cannot configure this value.
Examples
The following example enables automatic summarization for EIGRP process 109:
Router(config)# router eigrp 109
Router(config-router)# auto-summary
The following example enables automatic summarization for EIGRP autonomous-system 4473:
Router(config)# router eigrp virtual-name
Router(config-router)# address-family ipv4 autonomous-system 4473
Router(config-router-af)# topology base
Router(config-router-af-topology)# auto-summary
Related Commands
Subscribe to:
Posts (Atom)