Facts to remember about OSPF - Part4

OSPF NSSA ABR External Prefix Filtering
We want the ABR stop translating a type 7 to a type 5 from an nssa area 3 and advertise it into area 0. This can be done with the command summary and the argument not-advertise, The main difference with other filter techniques like "distribute-list" and "administrative distance" is that the prefix is eliminated from the ospf database (show ip ospf database external) so it can't be translated into type 5 and distributed into area 0 but remains in the nssa area 3

The summary must have the same mask that the prefix we are filtering.

This must be applied in the ABR NSSA not in the ASBR prefix originator

I didn't see a summary address with null 0 created in the routing table and the "show ip route" in each router inside NSSA showed the prefix as "O N2" (cause it was redistributed for another router in the nssa area (ASBR))

router ospf 1
 summary-address 160.1.10.10 255.255.255.255 not-advertise




OSPF database filtering
This is similar in operation to the passive-interface command in RIPv2. This feature allows the formation of OSPF neighbors, because hello packets are not filtered out, but it stops the advertisements of all LSAs out the interface or to the neighbor in question. This type of filtering breaks the OSPF protocol cause we will have routers inside the area with different OSPF databases

Configure R5 so that R2 cannot learn from R5, but R5 can still learn OSPF routes from R2. "database-filter" command is allowed with neighbor command  only on NBMA and point-to-multipoint networks

router ospf 1
 neighbor 155.1.0.2 database-filter all out

Configure R7 so that R9 cannot learn any OSPF routes from R7, but R7 can still learn OSPF routes from R9

R7:
interface GigabitEthernet1.79
 ip ospf database-filter all out

OSPF Stub Router Advertisement
Don't confuse with OSPF stub areas. Essentially, this feature causes the router to advertise a maximum metric for non-stub destinations, making it the worst cost path to all destinations. The result is that upon initializing the OSPF process, transit traffic will not flow through the stub router unless it is the only possible path.
Configure R4 to advertise the maximum metric value to all neighbors inside its Type-1 Router LSA.( Maximum metric in self-originated router-LSAs)

router ospf 1
 max-metric router-lsa

Example:  A_B and B_C links have been set to LSInfinity (65535) by the ‘max-metric; command on router B. So the only way to Router A will reach 3.3.3.3 will be through Link A_C

OSPF interface timers
Configure R5 and R8 to send OSPF hello packets every five seconds on VLAN 58, and wait for seven seconds before declaring a neighbor down

interface GigabitEthernet1.58
 ip ospf hello-interval 5
 ip ospf dead-interval 7

Configure R4 and R5 to send OSPF hello packets every 250ms on VLAN 45. The argument minimal set the dead interval to 1 sec, hello-multiplier states that dead interval is 4 times hello. Then hello interval will be 0.25 secs or 250ms

interface GigabitEthernet1.45

 ip ospf dead-interval minimal hello-multiplier 4

OSPF Resource Limiting

• No more than 5000 LSAs can exist in the database. (Non self-generated LSA)
• No more than 500 of these routes should be originated through redistribution.

router ospf 1
  max-lsa 5000
 redistribute maximum-prefix 500

Miscellaneous OSPF Features

• Configure R10 so that it does not generate a log message upon receipt of a Type-6 LSA advertisement.(OSPFv2 doesn't support Type 6 LSA so a error status in the log will be generated so we must stop receiving Type 6 LSA)
• Configure R10 so that it does not account for the MTU value when establishing adjacencies on its GigabitEthernet1.108 interface.(MTU mismatches are the primary reason an OSPF adjacency becomes stuck in the EXSTART state.)
• Configure R10 so that the command "show ip ospf neighbor" shows a host name and not an ip address under the column Neighbor ID

ip host R8 150.1.8.8
ip ospf name-lookup
!
interface GigabitEthernet1.108
 ip ospf mtu-ignore
!
router ospf 1
 ignore lsa mospf

Facts to remember about OSPF - Part3

OSPF Default Routing

Advertise an external type-2 default route with metric 60 as long as a static default route exist

ip route 0.0.0.0 0.0.0.0 Null0
!
router ospf 1
 default-information originate metric 60

Advertise an external type-1 default route with metric 40 no matter if a static defaul route exist

router ospf 1
 default-information originate always metric 40 metric-type 1

Conditional default routing: Advertise a default route only if prefix 66.66.66.66/32 is in the routing table (when use  route-map option always key is not needed)

interface Loopback66
 ip address 66.66.66.66 255.255.255.255
!
ip prefix-list LOOPBACK66 seq 5 permit 66.66.66.66/32
!
route-map TRACK_LOOPBACK66 permit 10
 match ip address prefix-list LOOPBACK66
!
router ospf 1
 default-information originate route-map TRACK_LOOPBACK66

OSPF Reliable Conditional Default Routing: Advertise a default route only if ICMP reachability is possible every 5 seconds

ip sla 1
 icmp-echo 155.1.108.10
 frequency 5
!
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 state
!
ip route 169.254.0.1 255.255.255.255 Null0 track 1
ip prefix-list PLACEHOLDER seq 5 permit 169.254.0.1/32
!
route-map TRACK_PLACEHOLDER permit 10
 match ip address prefix-list PLACEHOLDER
!
router ospf 1
 default-information originate route-map TRACK_PLACEHOLDER

OSPF Filtering with Distribute-Lists (Intra-area filtering)
This filtering affects only the local routing table not the OSPF database so if you apply this in ABR the routers behind will still point the ABR as the gateway to reach the filtered prefix. So it must be apply to all the routers in the area. Another techniques must be apply for inter area filtering (check stub areas and type 3 LSA filter)

router ospf 1
 distribute-list 1 in
!
access-list 1 deny 150.1.1.1 0.0.0.0
access-list 1 deny 150.1.2.2 0.0.0.0
access-list 1 permit any

OSPF Summarization and Discard Routes
Suppress the matching route to Null0 when a summary in the ABR or ASBR is created in the OSPF domain.
The automatic origination of the discard route can be disabled with the no discard-route [internal | external], where internal refers to inter-area summarization performed with the area range command, and external refers to redistributed summarization performed with the summary-address command.

router ospf 1
 no discard-route internal
 area 2 range 150.1.0.0 255.255.240.0

OSPF Filtering with Administrative Distance
An OSPF route with a 255 AD will not be installed in the routing table but it will not be filtered from the OSPF database ("show ip route" will no show it but "show ip ospf summary A.B.C.D" will), the command "distance" ask for the source address, this is the originator of the prefix (ABR) not the neighbor from which you are learning the route. The originator of the prefix "advertising router"  can be check with the command "show ip ospf database summary A.B.C.D"

access-list 10 permit 155.1.146.0
!
router ospf 1
 distance 255 150.1.5.5 0.0.0.0 10

OSPF Filtering with Route-Maps
"show ip route" shows two ways to reach 155.1.146.0 by  155.1.0.4 and 155.1.0.1 (equal AD and metric). The goal is to use only 155.1.0.1. This doesn't modify OSPF database. I tried to get the same result changing metrics in the route-map but it didn't work cause that would change the OSPF database and this has to be consistent in all the members of the area

access-list 3 permit 155.1.146.0
access-list 4 permit 155.1.0.4
!
route-map DENY_VLAN146_FROM_R4 deny 10
 match ip address 3
 match ip next-hop 4
!         
route-map DENY_VLAN146_FROM_R4 permit 20
!
router ospf 1
 distribute-list route-map DENY_VLAN146_FROM_R4 in

Facts to remember about OSPF - Part2

OSPF summarization
Internal Must be done in the ABR which contains the subnets to be summarize, Apply this command at router ospf level configuration: "area # range ip address mask", The area must be different than 0 (area 0)

External Must be done in the ASBR which contains the subnets to be summarize, Apply this command at router ospf level configuration: "summary-address ip address mask"  



OSPF Stub area
Apply this command at router ospf configuration level in all the routers members of the stub area  "area # stub", the ABR will filter all type 5 LSA that come from area 0 into the stub area but it will allow type 3 LSAs. ABR will inject a type 3 default route

OSPF Totally Stubby area
Apply this command at router ospf configuration level in the ABR route totally stubby area "area # stub no-summary" and this command in the other routers of the totally stubby area "area # stub", the ABR will filter all type 5 and type 3 LSA that come from area 0 into the stub area but they still will reach external routes cause ABR will inject a type 3 default route (Notice that this is the only summary LSA allowed in a totally stubby area)

OSPF Not so Stubby area
Apply this command at router ospf configuration level in all the routers members of the not so stubby area: "area # nssa", the ABR will filter all type 5 LSA that come from area 0 into the stub area but it will allow type 3 LSAs, the ABR will not inject a type 3 default route, if you want to reach routes outside the ospf doman in a nssa you got to advertise a default route in the ABR with the command "area # nssa default-information-originate" , this will advertise a default route type 7 into nssa area (O*N2). Only type 7 LSA's are accepted inside NSSA, when the ABR from a NSSA receives a type 7 LSA it will turn into type 5 LSA and redistribute it into area 0. Type 7 LSA are created when extenal routes are redistributed by routers inside NSSA

OSPF Totally Not so Stubby area
Apply this command at router ospf configuration level the ABR route totally stubby area "area # nssa no-summary" and this command in the other routers of the totally stubby area "area # nssa", the ABR will filter all type 5 LSA that come from area 0 into the stub area, the ABR will inject a type 3 default route. Only type 7 LSA's are accepted inside NSSA, when the ABR from a NSSA receives a type 7 LSA it will turn into type 5 LSA and redistribute it into area 0. Type 7 LSA are created when extenal routes are redistributed by routers inside NSSA

Type-7 to Type-5 Translator Election
Only the ABR with the highest router-id will make the translation from a LSA type 7(NSSA area) to LSA type 5 (area 0)


When there is more than one exit point (ABR) into a NSSA, a sort of Traffic engineering can be made suppressing incoming intra area routes in one of he ABR's with the command area # nssa no-summary (turning it into a totally NSSA ABR)



OSPF NSSA Redistribution Filtering
There are situations where there is no need to inject type 7 external routes into the Totally NSSA. This situation usually occurs when an ASBR is also an Totally NSSA ABR and all the routers in the NSSA use it as default gateway. When redistribution takes place in this scenario, the router generates type 5 (into area 0) as well as type 7 LSAs (into nssa). You can prevent the router from creating type 7 LSAs for NSSA with this command:

router ospf 1
 redistribute connected subnets route-map CONNECTED->OSPF
 area 3 nssa no-redistribution no-summary

OSPF LSA Type-3 Filtering
This command aplies on the ABR at router level configuration. here some examples

area 3 filter-list prefix R1_LOOPBACK in (filter LSA leaving area 0 and entering area 3)
area 3 filter-list prefix AREA_3_ROUTES out (filter LSA leaving area 3 and entering area 0)
area 0 filter-list prefix R1_LOOPBACK out (filters LSA leaving area 0 and going to any area, that means that none areas behind the ABR will receive the route even new areas)


OSPF forwarding address supression
 When OSPF database lookups on external routes, the "Forward Address" field determines who the next recursive lookup should be performed toward. This "forward address" is preserved when the ABR makes a translation from LSA type 7 to LSA type5. But there will be a problem if that "forward address" was filtered in the ABR and nobody knows about it in the ospf domain. To overcome this use this command at router configuration level in the ABR which makes the translation area # nssa translate type7 suppress-fa where # is the area which originates the LSA type 7

router ospf 1
 area 3 nssa translate type7 suppress-fa

The whole idea behind forward address: If only R1 redistributes external routes from R100 to the OSPF domain, then R2 will always have go through R1 to reach those extrenal routes. Forward address let R2 to ask R100 directly. So when R1 makes the translation from type 7 to type 5 it will preserve the R100 address in the forward address parameter

Facts to remember about OSPF - Part1

OSPF election process happens in the Init phase during wich OSPF Hello protocol (multicast) is in charge of the DR/BDR elections for a network segment combining  various factors in the following order:

1- Choose the highest OSPF priority (default is 1, note that if you configure priority of 0 that router wont enter the election process - used on FR networks.)

2- Choose the highest router-id

3- Choose the highest loopback interface

4- Choose the highest configured physical interface (must be up/up)

Mind that there is no preemption meaning that when a DR goes ofline, the BDR takes his place and when it comes back online it wont be the DR again, for it to be considered for another election process in a network segment, all DR/BDR must go offline so that one router can become the DR again for that segment.

The BDR is actually elected first, followed by the DR.  The RFC explains why:

 "The reason behind the election algorithm's complexity is the desire for an orderly transition from Backup Designated Router to Designated Router, when the current Designated Router fails. This orderly transition is ensured through the introduction of hysteresis: no new Backup Designated Router can be chosen until the old Backup accepts its new Designated Router responsibilities."

A DR and a BDR is eligible for each LAN segment inside an area (broadcast network type)

Network types:

Broadcast: DR/BDR election, multicast hellos

Non-broadcast: DR/BDR election, no multicast hellos, Hub is force to be DR with high priority value, Hub defines neighbors, spokes are forced to not participate in DR election with priority 0

Point - Point: No DR/BDR election, multicast hellos (224.0.0.5)

Point - Multipoint: No DR/BDR election, multicast hellos (224.0.0.5)

Point - Multipoint Nonbroadcast: No DR/BDR election, unicast hellos that's why hub must define neighbors

OSPF will always advertise loopback interfaces with mask /32, changing the ospf network type to point-point will advertise the real mask

Interface Cost= Reference bandwidth/interface bandwidth = 10^8/(interface bandwidth(Mbps))

To change Reference bandwidth apply the command auto-cost reference-bandwidth (Mbps) 

OSPF Path Selection with Per-Neighbor Cost: valid for network type’s point-to-multipoint and point-to-multipoint non-broadcast) neighbor x.y.z.w cost x


Non-backbone (not area 0) areas can be used for inter-area transit if a shorter path can be found through them, and if the "TransitCapability parameter has been set to TRUE, (default on cisco routers)
Ej: 
router ospf 1
 area 1 virtual-link 150.1.1.1
 no capability transit


Demand circuit This feature is enabled with the interface-level command ip ospf demand-circuit, OSPF Hellos are suppressed and periodic LSA refreshes (30 minutes) by setting the DoNotAge (DNA) bit in the LSA.  The link is bring up only when they are exchanged for the first time, or when a change occurs in the information they contain. Change the network type to point-to-point or point-to-multipoint to suppress hellos cause in broadcast networks OSPF Hellos are not supressed


Flood reduction This feature is enabled with the interface-level command ip ospf flood-reduction, periodic LSA refreshes (30 minutes) are suppres by setting the DoNotAge (DNA) bit in the LSA. 


OSPF authentication clear text:(two ways)

• On each interface: ip ospf authentication, ip ospf authentication-key PASSWORD
• On router process: area # autentication,  on each interface: ip ospf authentication-key PASSWORD

OSPF authentication md5 with one or multiple keys:(two ways)

• On each interface: ip ospf authentication message-digest, ip ospf message-digest-key # md5 PASSWORD
• On router process: area # autentication message-digest, on each interface: ip ospf message-digest-key # md5 PASSWORD

OSPF authentication SHA authentication

• On interface level: ip ospf authentication key-chain "name of the chain", then create the key chain at general configuration level: In this case 256 bits digest, it could be 160, 384 and 512

        key chain "name of the chain"
          key 1
            key-string "password"
            cryptographic-algorithm hmac-sha-256


OSPF authentication null

Enable ospf authentication at router opsf configuration level, then choose which interfaces wil not participate in authentication with interface level command ip ospf authentication null

Tshoot OSPF Default-Information Originate always ( track sla failure solution)

This exercise was first post by Costi Serban (http://www.costiser.ro/2014/05/10/quiz-24/). I just found my own solution to the problem that he proposed

My solution includes tracking a sla failure instead of the traditional "ip sla reachability" (up)

 

Startup file (VIRL)

 Final configuration (VIRL)

THE PROBLEM

CORE-A must always have internet Access even if ISP-1 goes down. This is not happening with the actual configuration. Please do the tshoot to find the answer and propose a solution

THE SOLUTION

BR-B is getting a default route from ISP-1 (EBGP), but from BR-C too (OSPF). So which one it will choose?. it chooses the route with the lower administrative distance in this case the one from ISP-1. the same applies for BR-C

BGP administrative distance = 20, OSPF administrative distance = 110

BR-B#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
  Known via "bgp 65001", distance 20, metric 0, candidate default path
  Tag 100, type external
  Last update from 1.1.1.1 00:38:22 ago
  Routing Descriptor Blocks:
  * 1.1.1.1, from 1.1.1.1, 00:38:22 ago
      Route metric is 0, traffic share count is 1
      AS Hops 1
      Route tag 100
      MPLS label: none


BR-B is advertising a default route into ospf using "default-information originate always". the same happens in BR-C

BR-B#show run | section ospf
router ospf 1
 network 192.168.0.0 0.0.255.255 area 0
 default-information originate always



CORE-A gets the advertisement from BR-C and install a default route in its routing table

CORE-A#show ip route 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
  Known via "ospf 1", distance 110, metric 1, candidate default path
  Tag 1, type extern 2, forward metric 2
  Last update from 192.168.15.1 on GigabitEthernet0/1, 02:11:50 ago
  Routing Descriptor Blocks:
  * 192.168.15.1, from 192.168.0.5, 02:11:50 ago, via GigabitEthernet0/1
      Route metric is 1, traffic share count is 1
      Route tag 1


The "always" means BR-B will continue telling everyone "hey guys use me as the default route" even if that's is true or not. To check this will shutdown interface in ISP-1 which faces BR-B and let's check BR-B's routing table again

BR-B#show ip route 0.0.0.0

There is no default route in the routing table, so now BR-B will receive the default route from BR-C (OSPF) right...no??. Well .., no, when you use "default-information originate always" you are telling everyone " hey guys i accept default routes from no one cause i got my own "
 so CORE-A will never reach internet when BR-B lose conectivity with ISP-1


SOLUTIONS

1) The most easy solution is to remove the "always" from "default-information originate "BR-B

BR-B#show run | section ospf
 network 192.168.0.0 0.0.255.255 area 0
 default-information originate

This will let BR-B receive the default Gateway from BR-C and CORE-A will no lose internet connectivity because now it will go out through ISP-2


2) The solution that i propose is not the most neat but it will work too

If the conection between BR-B and ISP-1 fails, i will install a default route in BR-B so all the internet goes thorugh 192.168.12.2

I'll use SLA/TRACK to achieve this. Generally we add a static route when the track response is OK, but this time we'll add the static route when the track response is FAIL

Let's create the sla which will make ping to ISP-1 interface

BR-B#show run | section sla
ip sla 1
 icmp-echo 1.1.1.1
 frequency 5
ip sla schedule 1 life forever start-time now


And the track which will check the sla

BR-B#show run | section track 1
track 1 ip sla 1 reachability


Here comes the magic. Now we'll créate another track object which denies track 1

BR-B#show run | section track 2
track 2 list boolean and
 object 1 not

Now we'll add a route static to BR-B routing table only if connectivity between BR-B and ISP-1 fails

ip route 0.0.0.0 0.0.0.0 192.168.12.2 track 2

That's it, make some tests with traceroute from CORE-A to 34.34.34.3 when interface in ISP-1 is down or up, and check the routing table everytime

I will upload the startup and solution files...They are in VIRL format but you can copy the configuration sections and paste them in GNS3

Please give me your feedback

Summarization challenge (thinking outside the box - solution2)

This exercise was first post by Arwin Reprakash (http://ithitman.blogspot.com/2015/03/configuring-ospf-summarization-lab.html#more). I just implement the solution that he proposed

 

 

THE PROBLEM

 

Summarize 192.168.1.2/32 from Area 2 as 192.168.1.0/24 into area 0.

 

RESTRICTIONS

 

Do not use area-range command or summary-address to summarize the routes into Area 0.

R3 and other routers in Area 0 or any new additional areas should only have the summary address to reach 192.168.1.2. 

If prefix 192.168.1.2/32 is withdrawn (i.e shutdown loopback0 on R2) from R1 OSPF database then 192.168.1.0/24 should not be summarized/advertised into area 0.

 

 

THE SOLUTION

 

First let's stop advertising 192.168.1.2 into área 0. This must be done in the ABR (R1), it has no effect if you apply the following command in R2. Check cisco documentation for more details (http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fiarospf.html)

 

R1#conf term

R1(config)#router ospf 1
R1(config-router)#area 2 filter-list prefix NOADVERTISE out

 

 

A prefix-list filter will be applied to the routes advertise by área 2. let's configure the prefix-filter:

 

R1(config)#ip prefix-list NOADVERTISE deny 192.168.1.2/32


If we check R3 routing table will see that there is no route for 192.168.1.2

The next step is to créate an SLA to check for interface l0 status by ping


R2#show run | section sla
ip sla 1
 icmp-echo 192.168.1.2
 frequency 5
ip sla schedule 1 life forever start-time now


We'll associate that SLA with a TRACK to check the  SLA status

R2(config)#track 1 ip sla 1 reachability
Now let's add a static route for 192.168.1.2 which will remain in R2's routing table as long as the TRACK for the SLA is ok

R2(config)#ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1 track 1


Finally we redistribute that static route into ospf

R2#show run | section ospf
 ip ospf cost 1
router ospf 1
 redistribute static subnets
 network 12.12.12.0 0.0.0.255 area 2
 network 192.168.1.2 0.0.0.0 area 2

If we check R3's routing table we'll see the route for 192.168.1.0/24

R3#show ip route ospf
O E2  192.168.1.0/24 [110/20] via 13.13.13.1, 00:52:37, GigabitEthernet0/1


To verify let's make a ping from R3 to 192.168.1.2

R3#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!


Please leave your comments