IP Design and Migration 1054_03F8_c2

sraza@cisco.com Cisco Systems GSE Khalid Raza sraza@cisco.com Cisco Systems GSE

Network Design Design a hierarchical network Break your network into regions Exchange regional routes via BGP

Network Design Advantages of regionalizing your network You can have multiple instances of routing protocols Your IGP does not need to carry unnecessary routes from other regions Regions can grow independently Merging organizations is less painful

Network Design Case study Organization X.com has merged with Y.com Both have registered networks X.com is a large organization and owns a class B network Y.com has 16 of class C networks, they own a CIDR block

Network Design Case Study Both organizations have different IGPs Both of their individual Internet connections This new merged organization wants to use their existing Internet connections They want to avoid Asymmetric routing

Internet Connection to ISP A Network Design Internet Connection to ISP C Internet Connection to ISP A SJ1 LA1 X.com 131.108.0.0 Y.com 205.10.16.0/20 NY1 DC1 Internet Connection to ISP B

Network Design Case Study More details CIDR block for network Y.com is out of ISP A’s address space Y.com want to keep ISP A as their primary service provider X.com wants to have ISP C as their primary service provider

Network Design First set Run BGP between the two organizations Make sure both the organizations advertise all the networks via BGP to all the ISPs for redundancy

Network Design Redistribute the BGP routes form Y.com only into the IGP of X.com if optimal routing is desired Redistribute the BGP routes form X.com only, into the IGP of Y.com if optimal routing is desired If optimal routing is desired each of the router connecting the two organizations should send MED

Network Design Configurations LA1# router bgp 321 network 205.10.16.0 mask 255.255.248.0 network 205.10.24.0 mask 255.255.248.0 aggregate-address 205.10.0.0 255.255.0.0 summary-only neighbor 131.108.1.1 remote-as 132 neighbor 205.10.16.1 remote-as 331 neighbor 131.108.1.1 remote-as 132 unsupress-map foo route-map foo permit 10 match ip address 1 set metric 2 set community no-export route-map foo 20 match ip address 2 access-list 1 permit 205.10.24.0 0.0.7.255 access-list 2 permit 205.10.16.0 0.0.7.255

Network Design X.com is running OSPF is there IGP Y.com 205.10.16.0/20 SJ1 205.10.16.0/21 LA1 X.com 131.108.0.0 NY1 205.10.24.0/21 DC1

Network Design X.com is running OSPF MED form X.com should be reflected as OSPF metric Redistribute BGP into OSPF as external type 2 metric

Network Design Configuration SJ1 router ospf 1 network 131.108.16.0 0.0.15.255 area 0 redistribute bgp 132 route-map MED route-map MED permit 10 match ip address 2 set metric 5 match ip address 1 access-list 1 permit 205.10.24.0 0.0.7.255 access-list 2 permit 205.10.16.0 0.0.7.255

Network Design X.com is advertising different ranges of the same class B to the Y.com X.com want Y.com to do optimal routing X.com will advertise MEDs to Y.com for optimal routing

Network Design Configuration SJ1 router bgp 132 network 131.108.0.0 mask 255.255.128.0 network 131.108.128.0 mask 255.255.128.0 aggregate-address 131.108.0.0 255.255.0.0 summary-only neighbor 131.108.1.2 remote-as 321 neighbor 131.108.10.1 remote-as 441 neighbor 131.108.1.2 remote-as 321 unsupress-map foo1 route-map foo1 permit 10 match ip address 1 set metric 2 set community no-export route-map foo permit 20 match ip address 2 access-list 1 permit 131.108.128.0 0.0.127.255 access-list 2 permit 131.108.0.0 0.0.127.255

Network Design Y.com is running EIGRP as their IGP MED should be redistributed into EIGRP metric properly EIGRP metric should be such that every router selects the correct egress routers

Network Design Y.com X.com 131.108.0.0/16 205.10.0.0/16 131.108.0.0/17 B=56K D= 2000 usec LA1 B=155MB D= 100 usec 131.108.0.0/17 SJ1 B=10MB D= 1000 usec R2 Y.com X.com 131.108.0.0/16 Network A R1 205.10.0.0/16 DC1 B=100 MB D= 100 usec B=128K D= 2100 usec NY1 131.108.128.0/17 NY1 B=56K D= 1000 usec Network B

[ ( ) ] Network Design Lets talk about EIGRP metric: EIGRP metric 10 * 7 10 min BW [ ( ) ] + Sum of delays * 256

Network Design Metric for router R1 to reach LA1 is Minimum BW = 10 MB Total delay = 100 + 1000 = 1100 R1 metric = [(10000000/10000)+1100)] *256 R1 metric = 537600

Network Design Metric for router R1 to reach DC1 Minimum BW = 128K Total delay = 2100 + 100 = 2200 R1 metric = [(10000000/128) + 2200] * 256 R1 metric = 20563200

Network Design Lets look at the metric for the redistributed route form BGP R1 should always prefer LA1 for 131.108.0.0/17 R1 should always prefer DC1 for 131.108.128.0/17 For set metric in route-map the values are set metric BW Delay Reliability Load MTU

Network Design Configuration LA1# router eigrp 321 redistribute bgp 321 route-map MED route-map MED permit 10 match ip address 1 set metric 1000000 802000 1 1 1 route-map MED permit 20 match ip address 2 set metric 100000 1 1 1 1 access-list 1 permit 131.108.128.0 0.0.127.255 access-list 2 permit 131.108.0.0 0.0.127.255

Network Design Configuration DC1# router eigrp 321 redistribute bgp 321 route-map MED route-map MED permit 10 match ip address 1 set metric 256 1 1 1 1 route-map MED permit 20 match ip address 2 access-list 1 permit 131.108.128.0 0.0.127.255 access-list 2 permit 131.108.0.0 0.0.127.255

Network Design How did we come up with metric values: R1 metric to LA1 = 537600 R1 metric to DC1 = 20563200 So R2 metric for destination should be larger than 20563456 for network 131.108.128.0/17 [ (10000000/155000) + 100 (current delay) + x ] * 256 = 20563200 [ (65 + 100 + x) ] = 20563200/256 x = 80162 We rounded up to 80200to be on the safe side

Network Design Metric verification For Subnets 131.108.0.0/17 We want R2 to prefer LA1 Total delay = 100 + 1 =101 R1 metric = [ (10000000/155000) + 101] * 256 R1 metric = 42496

Network Design R2 metric to reach network 131.108.128.0/17 via LA Total delay = 2100 + 100 + 1000 +80200 = R2 metric = [(10000000/155000) + 83400] *256 R2 metric = 21366784

Network Design R1 metric to reach 131.108.0.0/17 via DC1 Total delay = 2100 + 100 + 1 = 2201 R1 metric = [ ( 10000000/128) + 2201 ] * 256 R1 metric = 20563456

Network Design R2 metric to reach 131.108.128.0/17 via DC1 Total delay = 2100 + 100 + 1000 + 1 = 3201 R2 metric = [ ( 10000000/128) + 3201 ] * 256 R2 metric = 20819456

Network Design Comparing the metrics for network 131.108.128.0/17 for R2 Via LA1 = 21366784 Via DC1 = 20819456 You can do same thing with BW as well

Network Design Y.com wants to keep ISP A as their primary service provider What will happen ISP A ISP C C Will Have Two Choices Shorter AS Length Will Take Care of Symmetrical Routing Packet Flow X.com Y.com Direct Connect and Longest Prefix Match

Network Design X.com is multihomed X.com want ISP C to be primary and ISP B to be secondary ISP C ISP B AS 1 X.com Packet Flow

Network Design X.Com needs has two options 1. Community based local preference at the ISP 2. Set as-path prepend

Network Design Communities Grouping of destinations into a community for applying common policies Each destination can belong to multiple communities Second global attribute in BGP after AS-path

Network Design X.com wants symmetrical routing ISP will tell you the community number ISP will do the community-based local-pref matching

Network Design Config on X.com side on router that connects to ISP B NY1# router bgp 132 aggregate-address 131.108.0.0 255.255.0.0 summary-only network 131.108.0.0 mask 255.255.128.0 network 131.108.128.0 mask 255.255.128.0 neighbor 131.108.40.1 remote-as 703 neighbor 131.108.40.1 send-community neighbor 131.108.40.1 route-map set community out route-map set community permit 10 match ip address 2 set community 132 :70 access-list 2 permit any

Network Design Config on the ISP B router ISPB# router bgp 703 neighbor 131.108.40.2 remote-as 132 neighbor 131.108.40.2 route-map community in route-map community permit 10 match community 1 set local-preference 70 route-map community permit 20 match community 2 ip community-list 1 permit 132:70 ip community-list 2 permit Internet

Network Design Use of as-path prepend config of NY1 NY1# router bgp132 neighbor 131.108.40.1 remote-as 703 neighbor 131.108.4.1 route-map path route-map path match ip address 1 set as-path prepend 132 132 132 access-list 1 permit any

Network Design Case Study # 2 Organization Z.com has grown significantly They have four regions Their IGP is having scaling problems They want to isolate regional flaps Each region has a preferred service provider

Network Design One region has a very big hub and spoke setup Their IGP is OSPF and they want a backup solution for each area Their addressing is not contiguous

Network Design They have one customer who has a router that is attached to two areas They have a situation where they have to bring one interface in two areas They want to do good summarization

Network Design Network setup for Z.com ISP Connection ISP Connection Region 1 Region 2 Region 4 Region 3 ISP Connection ISP Connection

Network Design IGP is having scaling problems Introduce BGP between the regions Flaps will get confined to regions only Send default form BGP routers

Network Design Each region with preferred service provider If connected to same ISP just send MEDs If connected to different service providers, ask the ISP to do communities based local preference to avoid asymmetric routing If ISP does not support communities, use Cisco feature (as-path prepend)

Network Design When connected to same provider For rest of the world they are connected to one ISP Easier solution to asymmetrical routing MED send to the ISP will take care of return path Each regional BGP router will send out default within its region

Network Design Multihomed to different ISP Use community-based, local-preference Ask ISP to set their policies according to your requirement

Network Design One region has a very large hub and spoke Problem Protocols with neighbor relationship will not scale Lot of spoke sites You have multiple hub routers Static config becomes a problem

Network Design Hub and spoke Two options Multipoint interface Point-to-point interface

Network Design 300 Stub Sites

Network Design IF you want to run OSPF Cisco 7500 hundred can have up to 250 neighbors on a RSP4 without a problem Remote routers will have problems with database sync, flooding and SPF If we divide 30 remote routers in a single area then the Cisco 7500 is connected to 10 area it will have to run 10 SPFs, plus processing of summary LSA is more CPU intensive then router and network LSAs

Network Design If you run EIGRP on the hub router Just send default route to the remote routers Problem still exist of queries, router will query all the neighbors for a lost route

Network Design Three choices OSPF with totally stubby areas RIP2 if the interface is multipoint ODR if the interface is multipoint or point to point

Network Design OSPF with totally stubby area Central router will have connection to 10 areas Flap within an area will just cause one summary LSA for area 0 and two SPF’s one for the local area where flap happened and one for area 0 Remote areas don’t have to maintain large database

Network Design RIPv2 is the second option Just send default route via RIP Receive updates form remote routers via RIP RIP works well with multipoint interface

Network Design ODR is third option Install IP stub route on the hub router Does not require to configure IP routing protocol on the spoke router Spoke router advertises IP prefixes of all the connected interfaces

Network Design Routing information is propagated via CDP Use IP filtering to limit the number of network prefixes that a hub router will permit Configuration Router odr 1 Distribute-list 1

Network Design Stub routing On stub router do not configure IP routing Router is automatically considered to be a stub if no dynamic routing protocol is configured Configure default route on the stub router Configure IP classless on stub router

Network Design How should we propagate all the stub routes in the core On the hub router create a static null route for all the remote sites redistribute the null route into the ospf

Network Design Each area must have back up if the primary link to area 0 is down Problem Each backup router must have a backup connection within its area] If we have large number of areas then it does not scale

Network Design Problem Backup to a site that belongs to same area ISDN Primary ATM Area 1 R1 R2

Network Design Solution Use virtual profiles Put a central NAS Depending on the dialing router, virtual interface gets assigned to that area Area config and IP address for virtual interface are dynamic Do not configure the dialing routers interface as demand circuit

Network Design Virtual profiles Area 3 Area 4 Area 0 AAA Server Virtual Interface Area 3 Area 4 NAS Area 0 Dial Backup Primary Link

Network Design Discontiguous subnets Area 2 Area 1 D Region 2 A B C Backbone Area 0 BGP Router F E Subnet 1–63 FDDI Dual Ring Area 2 FDDI Dual Ring Area 1 Subnet 18, 19, 21

Network Design Problem Solution I have my subnets scattered all around the regions, can I summarize? Solution Summarize at the site that has the largest blocks and then leak specifics Longest prefix matching will take care of routing Migrate the address to the correct region

Network Design Solution (Cont.) Router F should advertise the least specific summary No configuration needed for router E let it leak the specific subnets Config for router F router ospf 1 network 131.108.0.0 0.0.63.255 area 2 range 131.108.0.0 255.255.192.0 ip route 131.108.0.0 255.255.192.0 null0

Network Design Solution (Cont.) For BGP regional routers leak the subnet routes through BGP from router D Config for router D router bgp 2 network 131.108.27.0 mask 255.255.255.0 network 131.108.28.0 mask 255.255.255.0 network 131.108.33.0 mask 255.255.255.0 no auto-summary

Network Design Solution (Cont.) From router A generate a longer summary then router F Config for router A router bgp 1 network 131.108.48.0 mask 255.255.248.0 no auto summary ip route 131.108.48.0 255.255.248.0 null0

Network Design Router B and C will not advertise the specific subnets via BGP, because they are covered in the range Both routers do have the specific routes via OSPF Routing table of router B and C will have 131.108.33.0 255.255.255.0 131.108.28.0 255.255.255.0 131.108.27.0 255.255.255.0 131.108.18.0 255.255.255.0 131.108.19.0 255.255.255.0 131.108.21.0 255.255.255.0 131.108.0.0 255.255.192.0 131.108.48.0 255.255.248.0

Network Design Core routers will have all the routes Routing table of A and D will have following route 131.108.27.0 255.255.255.0 131.108.28.0 255.255.255.0 131.108.33.0 255.255.255.0 131.108.48.0 255.255.248.0 131.108.0.0 255.255.192.0

Network Design Where do I make my area? BGP Router Area 2 Area 1 FDDI Dual Ring Area 2 FDDI Dual Ring Area 1 Customer Router

Network Design Problem Solution Where do I define my area Critical site that is dual attached Solution Don’t run OSPF on the Ethernet Use static routes at the customer router Redistribute connected for the Ethernet on both routers

Network Design Problem Which area do I put my interface in? Area 0 Should this Interface Be in Area 1 or Area 0? Area 1

Network Design Sub optimal routing if in area 0 Sub optimal if in area 1 Bring the interface in both areas How: Create a virtual link between the two ABRs

Network Design Use maximum route summarization Configure a null route to the summary on the ABR to avoid routing loops Use loopback on the ABR to generate the metric for the summary LSA Currently OSPF uses lowest cost for the summary route, rfc2178 has changed this behavior to the highest metric

Network Design Area 2 Summary route to area 0 ABR FR FDDI Dual Ring Subnets 131.108.0.0 to 131.108.63.0

Network Design Config of ABR router ospf 1 network 131.108.0.0 0.0.63.255 area 2 area 2 range 131.108.0.0. 255.255.192.0 int loop 0 ip address 131.108.1.1 255.255.255.255 ip route 131.108.0.0 255.255.192.0 null0

Network Design NBMA networks (ATM, frame, etc.) Four choices Broadcast Non-broadcast Point to point Point to multipoint

Network Design Broadcast model Optimal flooding via DR No per VC costing Requires full mesh all the time Good if your NBMA cloud has rerouting capabilities

Network Design NBMA Very similar to broadcast model Flooding same as broadcast model Requires more config because neighbors need to be defined

Network Design Point to point Each VC is like a regular point-to-point interface Per VC costing Faster convergence Partial mesh allowed Flooding is a problem

Network Design Point to multipoint One IP address for the cloud No per VC costing available for now Sub optimal flooding Maintains host routes for every router in the cloud

Network Design Which model to choose If rerouting at Layer 2 is not an issue or your cloud is capable of rerouting use broadcast model for large mesh Otherwise use point to point, it is more robust

Network Design If you are running IS-IS use point to point Use mesh groups for IS-IS OSPF does not have mesh groups for now but will have it soon

Network Design Mesh groups Normal interface (do normal flooding) Blocked (never send LSPs over this interface) Part of a mesh group When LSP is received on non-meshgroup interface, flood it out over all interfaces (meshgroup or not) If LSP is received on meshgroup interface, flood on non-meshgroup interfaces, but don’t flood on other interfaces in this mesh group

Network Design Mesh groups Normal interface (do normal flooding) Blocked (never send LSPs over this interface) Part of a mesh group When LSP is received on non-meshgroup interface, flood it out over all interfaces (meshgroup or not) If LSP is received on meshgroup interface, flood on non-meshgroup interfaces, but don’t flood on other interfaces in this meshgroup

Network Migration Reasons Current routing protocol is classfull Does not support VLSM Slower convergence Having scaling problems

Network Migration Classless protocols No distinction between classes of network Groups class C or B networks What does IP classless command do on Cisco router

Network Migration First step If large network, divide the network using BGP Configure BGP at the core routers Passive existing protocol on the core links Generate default from the core routers

Network Migration Configuration of router for region 1 Similar configuration for each core router router bgp 1 network 140.10.0.0 network 150.10.16.0 mask 255.255.240.0 neighbor 131.108.1.1 remote-as 2 neighbor 131.108.1.2 remote-as 3 neighbor 131.108.1.3 remote-as 4

Network Migration Migrating from distance vector to link state Configure link state with higher admin distance Leave your current distance vector untouched Start removing your distance vector Link state should install the route once the distance vector route is gone Make sure you take care of offset-list (if you have defined it) for RIP

Network Migration Configuration router rip network 140.10.0.0 router ospf 1 network 140.10.0.0 0.0.255.255 area 0 distance 130

Network Migration Migration from IGRP to EIGRP Automatic redistribution IGRP routes are advertised into EIGRP as external Metric is compared before installing the route in the routing table

Network Migration Discontiguous networks Area 2 Area 1 D Region 2 A B Subnet 27, 28, 33 Subnet 48–55 Backbone Area 0 BGP Router F E Subnet 1–63 FDDI Dual Ring Area 2 FDDI Dual Ring Area 1 Subnet 18, 19, 21

Network Migration Migration for discontiguous subnets Move the addresses from area 1 of region 1, no config is required Move the addresses from region 2, BGP will not find the matching mask and will stop advertising the routes Later take the network and mask commands out

Network Migration Address moved from region 3 needs changes Move this range last so the routing table has already shrunk Stop aggregation from region 3 Start leaking specific routes so you can freely move addresses Again once addresses have moved remove the network and mask command from the BGP config

1054_03F8_c2 96