all in one cisco ccie lab study guide second edition phần 7 ppsx

Capability Codes: R ư Router, T ư Trans Bridge, B ư Source Route Bridge S ư Switch, H ư Host, I ư IGMP, r ư Repeater Device ID Local Intrfce Holdtme Capability Platform Port ID RouterB S

Trang 1

Monitoring and Testing the Configuration

From RouterA, monitor the policy routing using the debug ip policy command Telnet from RouterA to

152.1.1.1 What follows is the output from the debug command; note that the telnet packet matched item 20 ofroute map lab1 and was forwarded to 151.1.1.2

IP: s=151.1.1.1 (local), d=152.1.1.1, len 44, policy match

IP: route map lab1, item 20, permit

IP: s=151.1.1.1 (local), d=152.1.1.1 (Serial1), len 44, policy routed

IP: local to Serial1 151.1.1.2

From RouterA, use the extended telnet command to send a HTTP packet to 152.1.1.2 To use this command,

simply type in Telnet 152.1.1.1 www at the privileged level What follows is the output from the debug

command; note that the HTTP packet matched item 10 of route map lab1 and was forwarded to 150.1.1.2

IP: s=151.1.1.1 (local), d=152.1.1.1, len 44, policy match

IP: s=151.1.1.1 (local), d=152.1.1.1 (Serial0), len 44, policy routed

IP: local to Serial0 150.1.1.2

Lab #67: Load Balancing Across Default Routes

Equipment Needed

The following equipment is needed to perform this lab exercise:

Two Cisco routers each having one Ethernet port and two serial ports

no explicit route for the packets' destination is in the routing table Packets arriving from 192.1.1.12 are sent

to default interface S1 if the router has no explicit route for the packets destination

Figure 13−5: Load balancing across default routes

This lab uses the default interface command, which differs from the next hop interface and next hop IP

address set commands we used in previous labs The next hop set commands send the matching packet outthat interface or to that IP address regardless of the routing table The default interface command only sendsthe packet out that particular interface if there is no explicit route in the routing table

Note When using the default interface set command, the router will first check the routing table for an

explicit route If there is no explicit route available to the destination address of the packet beingconsidered for policy routing, then the router will route the packet out the default interface

Trang 2

ip policy route−map lab1 ← Enables policy routing on interface E0 and

identifies the route map lab1, which will be

applied to the packet

10 of route map lab1

match ip address 1 ← This defines the match criteria tied to access list 1

set default interface Serial0 ← Sets the default interface to S0

!

route−map lab1 permit 20 ← Defines the route map lab1, the number specifies the order of the route maps This is referred to as item

10 of route map lab1

match ip address 2 ← This defines the match criteria tied to access list 1

set default interface Serial1 ← Sets the default interface to S0

Trang 3

When using the default interface set command, the router will first check the routing table for an explicitroute RouterA does not have an explicit route to 152.1.1.1 because RouterB suppresses RIP updates with the

Trang 4

passive interface commands.

From RouterA, monitor the policy routing using the debug ip policy command From RouterC, ping

152.1.1.1 using the extended ping command to source the packet from 192.1.1.11 What follows is the outputfrom the debug command on RouterA; note that the source address 192.1.1.11 matched item 10 of route maplab1 and was forwarded out interface S1

IP: s=192.1.1.11 (Ethernet0), d=152.1.1.1, len 100, policy match

IP: route map lab1, item 10, permit

IP: s=192.1.1.11 (Ethernet0), d=152.1.1.1 (Serial0), len 100, policy routed

IP: Ethernet0 to Serial0 152.1.1.1

From RouterA, ping 152.1.1.1, sourcing the packet from 192.1.1.12 What follows is the output from thedebug command on RouterA; note that the source address 192.1.1.12 matched item 20 of route map lab1 andwas forwarded out interface S0

IP: s=192.1.1.12 (Ethernet0), d=152.1.1.1 (Serial1), len 100, policy routed

IP: Ethernet0 to Serial1 152.1.1.1

On RouterB remove the passive interface commands to allow RIP updates to be sent to RouterA Now thatRouterA has a route for 152.1.1.1 learned via RIP, it will not policy−route the packet Remember when usingthe default interface set command, the router will first check the routing table for an explicit route If therouter has a route to the destination, the packet is forwarded using that route; if there is no explicit routeavailable to the destination address, then the router will route the packet out the default interface, which is setusing policy routing

routerb(config)#router rip

routerb(config−router)#no passive−interface s0

routerb(config−router)#no passive−interface s1

From RouterC, ping 152.1.1.1 What follows is the output from the debug ip policy command on RouterA;

note that the packet matched item 20 in route map lab1 However, the set policy was rejected because therouting table has an explicit route to 152.1.1.1

IP: s=192.1.1.12 (Ethernet0), d=152.1.1.1 (Serial1), len 100, policy rejected −

normal forwarding

Troubleshooting Policy Routing

The Cisco IOS provides many tools for troubleshooting policy routing What follows is a list of key

commands along with sample output from each

{show ip policy} This privileged exec command displays which route map is used on which interface.

RouterA#show ip policy

Interface Route map

Ethernet0 lab1

{show route−map} This privileged exec command displays configured route maps This command allows

you to view the policies defined by each route map The command also shows how many packets matched thepolicy clauses

RouterA#show route−map

route−map lab1, permit, sequence 10

Match clauses:

ip address (access−lists): 1

Trang 5

Set clauses:

default interface Serial0

Policy routing matches: 129 packets, 14526 bytes

Match clauses:

Set clauses:

{debug ip policy} This exec command helps you determine what policy routing is doing It displays

information about whether a packet matches the criteria, and if so, the resulting routing information for thepacket The first line indicates that a packet matched the policy The second line indicates the item of the routemap that the packet matched In this case, the packet matches item 20 in route map lab1 Line three indicatesthat the packet was policy−routed out interface S0

IP: s=192.1.1.11 (Ethernet0), d=152.1.1.1 (Serial0), len 100, policy routed

IP: Ethernet0 to Serial0 152.1.1.1

{show ip local policy} This exec command displays any route maps used for local policy routing By default,

packets that are generated by the router are not policy−routed Local policy routing must be enabled on therouter using the IP local policy route−map command

RouterA#show ip local policy

Local policy routing is enabled, using route map lab1

Match clauses:

Set clauses:

Match clauses:

Set clauses:

Conclusion

Policy−based routing provides network administrators a way to implement packet forwarding according toother criteria than traditional destination−based routing The following are some of the potential applicationsfor policy routing:

Carrier selection is available for WAN transmissions or internal data path selection for Internetaccess

•

ISPs can use policy routing to provide equal access to multiple carrier networks

•

Policy−based routing can be used to set either the precedence or type−of−service bits in an IP

datagram, which can be used to provide Quality of Service (QOS) across the backbone

•

Policy−based routing can be used to separate high− and low−priority traffic over separate links

•

Trang 6

Chapter 14: Cisco Discovery Protocol

Cisco Discovery Protocol Overview

CDP runs on all Cisco routers and switches It can run over any physical media and over any protocol Unlike

a routing protocol that shows a next−hop destination port for all known networks, CDP will only show

information for directly connected neighbors It is most useful for verifying that a router is connected to theproper port of its neighbor

Figure 14−1 gives an overview of the information that CDP can provide A CDP−enabled router will be able

to learn directly connected neighbor port and hostname information Additional information such as theneighbor's hardware model number and capabilities are also reported

Figure 14−1: CDP overview

How Does CDP Work?

A CDP−enabled router sends out a periodic multicast packet containing a CDP update The time between

these CDP updates is determined by the cdp timer command, the timer value default being 60 seconds.

The following code shows a captured CDP packet A Network Associates sniffer was put on an Ethernet LANthat also had several Cisco routers connected to it As can be seen from the packet trace, the router sending thepacket includes important information including:

Router hostname (Cisco1)

Trang 7

Although neighbor router IOS version, IOS platform, and hardware version are not critical pieces of

information, neighbor router hostname and neighbor router port information are critical for debug purposes

The use of the show cdp neighbor command is most useful in debug situations where one needs to verify

what router and router port a given router is connected to

Packet 1 captured at 12/21/1998 12:19:37 AM; Packet size is 318(0x13e)bytes

Relative time: 000:00:35.858

Delta time: 0.000.000

ETHER: Address: 00−E0−1E−5B−0A−81 —−>01−00−0C−CC−CC−CC

Logical Link Control

SSAP Address: 0xAA, CR bit = 0 (Command)

DSAP Address: 0xAA, IG bit = 0 (Individual address)

cdp enable: This interface command is used to enable CDP on a particular interface Since CDP is enabled

by default, this command will not be shown in the router configuration

cdp run: This global command enables CDP on the entire router Using the no cdp run command will disable any CDP on the router Since CDP is enabled by default, the cdp run command will not shown in the

router configuration

Trang 8

cdp timer: This global command specifies how often the router sends CDP updates The default time

between CDP updates is 60 seconds

clear cdp counters: This privileged exec command causes the router's CDP traffic counters to be reset clear cdp table: This privileged exec command causes the router's CDP table to be cleared When this occurs, the show cdp neighbor command will not show any information until another CDP update is received

from a neighbor router

show cdp interface: This privileged exec command will show the status of CDP for each interface on the

router

show cdp neighbor: This privileged exec command causes the router to display neighbor information for all

directly attached routers

show cdp traffic: This privileged exec command will show how many CDP packets have been sent and

received by the router It also shows how many errored CDP packets have been received

debug cdp [packets] [ip] [adjacency] [events]: This debug command will cause the router to display

debugging information for a variety of CDP events

IOS Requirements

CDP is supported in Cisco IOS releases 10.3 and higher

Lab #68: Cisco CDP WAN Example

Three Cisco routers, one of which must have two serial ports The other two routers can have oneserial port

Two Cisco DTE/DCE crossover cables If no crossover cables are available, you can make a

crossover cable by connecting a standard Cisco DTE cable to a standard Cisco DCE cable

•

Configuration Overview

This configuration will demonstrate the basics of CDP It will allow us to see the difference between

information supplied by CDP and information supplied by a routing protocol such as RIP

The three routers are serially connected as shown in Figure 14−2 RouterB will act as the DCE supplyingclock to RouterA and RouterC A PC running a terminal emulation program should be connected to theconsole port of one of the three routers using a Cisco rolled cable

Figure 14−2: CDP WAN example

Note

Trang 9

Keep in mind that CDP will only supply information for directly connected neighbors This is in contrast

to a routing protocol, which will provide information that allows the router to determine the next

interface hop to all known networks

Trang 10

Let's examine some commands that enable us to monitor the status and results of CDP The first important

command is show cdp traffic This command will display the number of CDP packets that have been received and sent by the router since the last clear cdp counter command:

RouterA#sh cdp traffic

CDP counters :

Packets output: 16, Input: 11

Hdr syntax: 0, Chksum error: 0, Encaps failed: 4

No memory: 0, Invalid packet: 0, Fragmented: 0

The show cdp command will display how often CDP updates are sent (60 seconds) as well as how long CDP

incoming information is kept until it is discarded (180 seconds)

RouterB#sh cdp

Global CDP information:

Sending CDP packets every 60 seconds

Sending a holdtime value of 180 seconds

The show cdp neighbor command will display information on directly connected neighbors of the router,

provided that CDP is enabled on these interfaces In the following example, we see that interface S0/0 onRouterA is connected to interface S0/0 on RouterB:

Cisco1#sh cdp neigh

Trang 11

Capability Codes: R ư Router, T ư Trans Bridge, B ư Source Route Bridge

S ư Switch, H ư Host, I ư IGMP, r ư Repeater

Device ID Local Intrfce Holdtme Capability Platform Port ID

RouterB Ser 0/0 120 R 3620 Ser 0/0

Notice how the show cdp neighbor command output for router RouterB shows two directly connected

neighbors, RouterA and RouterC:

RouterB#show cdp neighbor

RouterA Ser 0/0 174 R 3620 Ser 0/0

RouterC Ser 0/1 125 R 3620 Ser 0/0

The show cdp neighbor detail command provides additional information such as what IOS version and

platform the neighboring device is running:

RouterA#sh cdp neighbor detail

Device ID: RouterB

Entry address(es):

IP address: 192.1.1.2

Platform: cisco 3620, Capabilities: Router

Interface: Serial0/0 , Port ID (outgoing port): Serial0/0

Holdtime : 174 sec

Version :

Cisco Internetwork Operating System Software

IOS (tm) 3600 Software (C3620ưIưM), Version 11.2(7a)P, SHARED PLATFORM,

RELEASE SOFTWARE (fc1)

Compiled Wed 02ưJulư97 08:25 by ccai

You can use the show cdp interface command to verify that CDP is enabled on the desired interfaces If an

interface does not have CDP enabled, it will not have an entry when using this command:

Once again, keep in mind the advantages and limitations of CDP CDP will only show directly connected

neighbors Recall that in this example, the show cdp neighbor command issued on router RouterA only shows RouterB as being directly connected The following show ip route command output shows that the

routing protocol RIP also has learned about the 196.1.1.0 network (which is RouterC):

RouterA#sh ip route

Codes: C ư connected, S ư static, I ư IGRP, R ư RIP, M ư mobile, B ư BGP

D ư EIGRP, EX ư EIGRP external, O ư OSPF, IA ư OSPF inter area

N1 ư OSPF NSSA external type 1, N2 ư OSPF NSSA external type 2

E1 ư OSPF external type 1, E2 ư OSPF external type 2, E ư EGP

i ư ISưIS, L1 ư ISưIS levelư1, L2 ư ISưIS levelư2, * ư candidate default

U ư perưuser static route, o ư ODR

Trang 12

Gateway of last resort is not set

192.1.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.1.1.0/24 is directly connected, Serial0/0

C 192.1.1.2/32 is directly connected, Serial0/0

R 196.1.1.0/24 [120/1 ] via 192.1.1.2, 00:00:08, Serial0/0

CDP Debug Commands

Several debug commands are available for advanced monitoring and troubleshooting of CDP

The following screen print shows all CDP debugging enabled:

CDPưPA: Packet received from RouterB on interface Serial0/0

**Entry found in cache**

The following example shows what occurs when the router sends out a CDP packet:

CDPưPA: Packet sent out on Serial0/0

An interesting experiment can be tried by the reader that will highlight the details of how CDP functions

Using the current threeưrouter configuration, turn on CDP debugging with the debug cdp command Then

pull the cable on serial 0/0 on RouterA The following screen print should be similar to what you will see

(remember to use the term mon command to direct output to the screen if you are not connected to the

console connector on the router):

First you will see the router declare the line protocol and the interface down:

%LINEPROTOư5ưUPDOWN: Line protocol on Interface Serial0/0, changed state to

down

%LINKư3ưUPDOWN: Interface Serial0/0, changed state to down

CDP will then declare the interface to be in a failed state:

Dec 27 09:14:05: CDPưAD: Interface Serial0/0 going down

Dec 27 09:14:05: CDPưEV: Encapsulation on interface Serial0/0 failed

Try typing the show cdp neighbor command every few seconds You will notice that the neighbor

information does not change even though the interface is down This is because of the holdtime value used byCDP By default, CDP will hold an incoming packet's information for 180 seconds before discarding it Thefollowing screen print shows that there are still 24 seconds remaining before the CDP process on RouterA willdelete the neighbor entry for RouterB

RouterA#sh cdp neigh

Trang 13

RouterB Ser 0/0 24 R 3620 Ser 0/0

As shown in the following example, the holdtime will eventually decrease to zero:

RouterB Ser 0/0 0 R 3620 Ser 0/0

When the holdtime expires, the router will then age out the entry Notice in the following screen print thatthere is no longer an entry for any neighbor router:

CDP will alert you to an aged entry via the following message:

Dec 27 09:16:33: CDPưAD: Aging entry for RouterB, on interface Serial0/0

When you reconnect the cable going to interface serial 0/0 on router RouterA, you will see the interface go to

an up state CDP will start to send out packets Notice that the first entry received will not be found in theCDP cache, since the old entry was already aged out

%LINKư3ưUPDOWN: Interface Serial0/0, changed state to up

%LINEPROTOư5ưUPDOWN: Line protocol on Interface Serial0/0 , changed state to up

Dec 27 09:17:06: CDPưAD: Interface Serial0/0 coming up

Dec 27 09:17:06: CDPưPA: Packet sent out on Serial0/0

Dec 27 09:17:06: CDPưPA: Packet received from Cisco2 on interface Serial0/0

Dec 27 09:17:06: **Entry NOT found in cache**

The show cdp neighbor command will now show an entry for directly connected neighbor RouterB:

RouterB Ser 0/0 171 R 3620 Ser 0/0

Lab #69: Cisco CDP LAN Example

Three Cisco routers, each having an Ethernet port

Trang 14

This configuration will show how CDP works on a shared−media Ethernet LAN

The three routers are all connected to the same Ethernet hub, as shown in Figure 14−3 An optional LANsniffer can also be connected into the Ethernet hub The LAN sniffer can be used to capture the CDP packets

Figure 14−3: CDP LAN example

Note Keep in mind that CDP will only supply information for directly connected neighbors This is in contrast

to a routing protocol such as RIP, which will provide information that allows the router to determine thenext interface hop to all known networks

Trang 15

The key CDP monitoring and debug commands were covered in the previous section Since all the routers inthis configuration are connected to the same LAN, each of the three routers will display the same neighbor

table, as shown in the following show cdp neighbor command:

Capability Codes: R − Router, T − Trans Bridge, B − Source Route Bridge

S − Switch, H − Host, I − IGMP, r − Repeater

RouterC Eth 0/0 121 R 3620 Eth 0/0

RouterB Eth 0/0 177 R 3620 Eth 0/0

Conclusion

In this chapter, we examined the Cisco Discovery Protocol CDP is a media− and protocol−independentproprietary protocol used for neighbor discovery CDP does not replace a routing protocol CDP will only

Trang 16

show information on directly connected neighbors CDP is particularly useful in determining what neighborrouter and port a given router is connected to.

Trang 17

Chapter 15: Network Address Translation

Overview

Topics Covered in This Chapter

Detailed NAT overview

Network Address Translation Overview

One of the greatest problems facing the Internet today is the issue of address depletion Network AddressTranslation promises to relieve some of this pressure by allowing organizations to reuse globally uniqueregistered IP addresses in other parts of their network

NAT allows organizations to reuse registered IP addresses within multiple domains, as long as the addressesare translated to globally unique Internet registered addresses before they leave that domain Figure 15−1shows how basic NAT works Both stub networks are using the class A address 10.0.0.0 for their internalnetwork Each organization is assigned an Internet registered unique class C address This address is usedwhen traffic wishes to flow off the private intranet onto the public Internet

Figure 15−1: Network Address Translation

In Figure 15−1, when HostA (10.1.1.1) wishes to send a packet to HostB (10.2.2.2), it uses HostB's globallyunique address 196.1.1.1 as the packet's destination When the packet arrives at RouterA, the source address

of 10.1.1.1 is translated to the globally unique address of 195.1.1.1 When the packet arrives at RouterB, the

Trang 18

destination address is translated to the unregistered IP address 10.2.2.2 Likewise, packets on the return path

go through similar address translation

This requires no additional configuration to hosts on the internal network; as far as HostA is concerned,196.1.1.1 is the IP address of the HostB (10.2.2.2) on Network B As far as HostB is concerned, 195.1.1.1 isthe IP address of HostA (10.1.1.1) on Network A

NAT Terminology

When dealing with NAT on a Cisco router, it is important to understand the terminology used, as illustrated inFigure 15−2

Figure 15−2: NAT terminology

Inside local address: The IP address that is assigned to a host on the inside network This address is

probably not an IP address assigned by the Network Information Center (NIC) or service provider

Inside global address: An NIC−registered IP address that is used to represent one or more inside local IP

addresses to the outside world

Outside local address: The IP address of an outside host as it appears to the inside network Not necessarily

a legitimate address, it was allocated from address space routable on the inside

Outside global address: The IP address assigned to a host on the outside network by the host's owner The

address was allocated from globally routable address or network space

Commands Discussed in This Chapter

clear ip nat translations

debug ip nat

ip nat {inside | outside}

ip nat inside destination list {access−list−number | name} pool name

ip nat inside source {list {access−list−number | name} pool name [overload] | static local−ip global−ip}

ip nat outside source {list {access−list−number | name} pool name | static global−ip local−ip}

ip nat pool name start−ip end−ip {netmask | prefix−length prefix−length} [type rotary]

ip nat translation {timeout | udp−timeout | dns−timeout | tcp−timeout | finrst−timeout} seconds

Trang 19

show ip nat statistics

show ip nat translations

Definitions

clear ip nat: This exec command is used to clear all or specific active NAT translations.

ip nat: This command is used to enable Network Address Translation for packets originating from (inside) or destined to (outside) interfaces.

ip nat inside destination list: This global command enables Network Address Translation of the inside

destination address This command can be configured for both dynamic and static address translations

ip nat inside source: This global command enables Network Address Translation of the inside source

address This command can be configured for both dynamic and static address translations

ip nat outside source: This global command enables Network Address Translation of outside source

addresses This command can be configured for both dynamic and static address translations

ip nat pool name: This global command defines a pool of IP addresses used for network translations The

pool could define either an inside global pool, an outside local pool, or a rotary pool

ip nat translation: This global command is used to change the amount of time after which Network Address Translations time out.

show ip nat statistics: This command is used to display Network Address Translation statistics.

show ip nat translations: This command displays all active Network Address Translations.

NAT first became available in IOS 11.2

Lab #70: Static Inside Source Address Translation

Two Cisco routers with one Ethernet port and one serial port

Trang 20

Figure 15−3: Inside source address translation

RouterA and RouterB are connected serially via a crossover cable RouterA will act as the DCE supplyingclock to RouterB The IP addresses are assigned as per Figure 15−4 A PC with an Ethernet NIC (or anadditional router) is connected to an Ethernet LAN attached to RouterA RouterA is configured for NAT andwill translate source IP address 10.1.1.1 to 195.1.1.1

Figure 15−4: Inside source address translation

Trang 21

From HostA, ping HostB (152.1.1.1) and analyze the packets coming from RouterB with the debug ip packet

command What follows is the output from the command; note that the source address of the ICMP Pingpacket is 195.1.1.1

IP: s=195.1.1.1 (Serial0/0), d=152.1.1.1, len 104, rcvd 4 ← ICMP ECHO

IP: s=152.1.1.1 (local), d=195.1.1.1 (Serial0/0 ), len 104 ← ICMP ECHO REPLY

From the debug ip nat output on RouterA, we can see that the source IP address 10.1.1.1 has been translated

to 195.1.1.1 We also see this is a two−way process; the return packet that has the destination IP address195.1.1.1 is changed back to 10.1.1.1

NAT: s=10.1.1.1−>195.1.1.1, d=152.1.1.1 [2542]

NAT*: s=152.1.1.1, d=195.1.1.1−>10.1.1.1 [2542]

In the preceding section, we covered a one−to−one mapping between an inside local address and an insideglobal address This method is very inefficient and does not scale, because each registered IP address can only

be used by one end station Static translation is most often used when a host on the inside needs to be accessed

by a fixed IP address from the outside world

Figure 15−5 shows an example of when static address mapping is required HostA wishes to access files onthe FTP server; however, the FTP server resides on an inside network and does not have a unique globallysignificant IP address Static mapping is used to define the globally significant address of 195.1.1.1 to thelocally significant address of 10.1.1.1

Trang 22

Figure 15−5: Static mapping

Lab #71: Dynamic Inside Source Address Translation

The other type of inside address translation is dynamic translation, which establishes a mapping between a

group of inside local addresses and a pool of global addresses This is very useful when you have a largegroup of unregistered users who wish to access off−net services

Dynamic inside address translation dynamically translates an unregistered IP address to a registered IPaddress, using a predefined pool This is a one−to−one relationship; as an outside connection is requested, an

IP address is used from the pool When the connection is finished, the globally significant IP address isreleased back into the pool, where it can be used for another connection Dynamic address translation is veryefficient, because the same global IP address can be used over and over as needed, by multiple end stations.This is in contrast to the previous static translation, where only one particular end station can use the globaladdress

Figure 15−6 shows three workstations on a LAN, all of which need access to the outside network As packetsarrive at RouterA, the source address is translated to an Internet registered address, using the predefined pool.This is still a one−to−one mapping; you need an Internet registered IP address for each workstation thatwishes to communicate outside the private network However, not all PCs will access the Internet at the sametime For example, depending on the traffic pattern, 10 registered IP addresses possibly could service 40 PCs

Trang 23

Figure 15−6: Dynamic address translation

Note Although dynamic address translation is more scalable, more efficient, and simpler to administer,outside users cannot access inside addresses, because there is no static mapping between IP addresses.After each session is closed, the global IP address is released back into the pool, where it can be used byother sessions Each end station can and most likely will be mapped to a different global address when itopens a new connection Therefore, it is impossible to reference a particular inside address with a globaladdress

This problem can be avoided by using a combination of dynamic and static translations All hosts that need to

be accessed by outside users, such as FTP and HTTP servers, will be configured using static translations,while all other end stations will use dynamic translations

This configuration will demonstrate dynamic translation of inside source addresses to outside global

addresses RouterA will translate any source address within the range of 10.1.1.1 to 10.1.1.3 to any of thethree global addresses defined in the address pool "globalpool."

Two Cisco routers are connected serially RouterA is connected to RouterB via a crossover cable RouterBacts as the DCE providing clock for RouterA A PC running a terminal emulation program is connected to theconsole port of RouterA All IP addresses are as per Figure 15−7

Figure 15−7: Dynamic address translation

RouterA is configured for Network Address Translation and will dynamically translate any inside sourceaddress within the range specified by access−list 1 to a unique Internet registered global address, which ispredefined by the pool "globalpool."

Router Configurations

The configurations for the two routers in this example are as follows (key NAT configurations for RouterAare highlighted in bold)

Trang 24

↓ Name of the pool

ip nat pool globalpool 195.1.1.1 195.1.1.3 netmask 255.255.255.0 ← Defines the pool of address List 1 reference access−list 1 and defines which

↓ addresses will be translated

ip nat inside source list 1 pool globalpool ← Globalpool references the pool of addresses defined in the previous line

access−list 1 permit 10.1.1.1 → Access list 1 defines which inside source

addresses will be translated

Trang 25

line aux 0

line vty 0 4

password cisco

login

To test the configuration, use the extended ping command on RouterA This command will allow you to

source the ping packet from any active IP address on the router To use this command, simply type in ping at

the privileged level

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

The following examples all use the extended ping command on RouterA to source the packets from thesecondary IP addresses defined in the configuration This is used instead of multiple PCs on RouterA's LAN

From RouterA ping 152.1.1.1 using source address 10.1.1.2

From the debug ip nat translation's output on RouterA, we see that the source address 10.1.1.2 has been

translated to 195.1.1.1, which is the first address in the pool The global IP addresses from the pool areassigned in the order that they are requested

NAT: s=10.1.1.2−>195.1.1.1, d=152.1.1.1 [20]

NAT: s=10.1.1.1−>195.1.1.2, d=152.1.1.1 [25]

NAT: s=10.1.1.3−>195.1.1.3, d=152.1.1.1 [35]

The following output from the debug ip nat translation command on RouterA shows what happens when a

fourth end station wishes to access the outside network but all of the global addresses are being used

NAT: translation failed (L), dropping packet s=10.1.1.4 d=152.1.1.1

From the preceding examples, you can see that although dynamic address translation provides more efficientuse of global addresses than do static translations, each translation still requires its own address Therefore,the network administrator must accurately gauge the amount of off−net traffic and define the address poolaccordingly

Lab #72 Overloading an Inside Global Address

Trang 26

The Cisco IOS allows you to overload a global address, thereby bypassing the need for a one−to−one

mapping between the local address and the global address This greatly reduces the number of registered IPaddresses needed

When overloading is configured, the router maintains enough information from higher−level protocols (forexample, TCP or UDP port numbers) to translate the global address back to the correct local address Whenmultiple local addresses map to one global address, the TCP or UDP port numbers of each inside host are used

to distinguish between the local addresses

In Figure 15−8 all of the local addresses on the LAN are translated to one global IP address, 195.1.1.1 Therouter reuses the inside global address for each translation and uses the TCP or UDP port number to

differentiate between end stations

Figure 15−8: Overloading an inside global address

The following steps are taken by RouterA when overloading is enabled:

HostA ( 10.1.1.1) opens a connection to Host 152.1.1.1 on the Internet

The following is output from the show ip nat translations command on RouterA; notice the port number

after the address The port number 1029 after the inside global address is the ephemeral port that HostAchooses; port number 23 after the outside address is the well−known port for telnet

routerA# show ip nat translations

Pro I inside global Inside local Outside local Outside global

icmp 195.1.1.1:256 10.1.1.1:256 152.1.1.1:256 152.1.1.1:256

tcp 195.1.1.1:1029 10.1.1.1:1029 152.1.1.1:23 152.1.1.1:23

Trang 27

Figure 15−9: Overloading an inside global address

RouterA is configured for Network Address Translation and will dynamically translate any inside sourceaddress within the range specified to the unique Internet registered global address 195.1.1.1

↓ Name of the pool

ip nat pool globalpool 195.1.1.1 195.1.1.1 netmask 255.255.255.0 ← Defines

List 1 references access list 1 and defines which

↓ address will be translated

ip nat inside source list 1 pool globalpool overload ← Allows multiple inside

á Defines what local addresses to be global address translated to one

to use outside global address

Trang 28

access−list 1 permit 10.1.1.1 → Access list 1 defines which inside source

addresses that will be translated

To test the configuration, ping RouterB (195.1.1.3) and, using the extended ping command on RouterA,

source the packet from 10.1.1.1 and 10.1.1.2 Monitor the translation using the command debug ip nat.

What follows is the output from the command; notice that both the inside

source addresses 10.1.1.1 and 10.1.1.2 have been translated to 195.1.1.1

NAT: s=10.1.1.1−>195.1.1.1, d=195.1.1.3 [5]

NAT: s=10.1.1.2−>195.1.1.1, d=195.1.1.3 [10]

Now show the NAT table using the command show ip nat translations What follows is the output from the

command; notice the port number after each IP address This port number and address are used as a key tomap return packets to the correct inside local IP address

RouterA#show ip nat translations

Pro Inside global Inside local Outside local Outside global

Trang 29

148.1.1.1 The inside local address overlaps with the outside address

Figure 15−10: IP address overlapping

The Cisco IOS solves this problem by translating the outside global address to an outside local address.The following steps are taken by RouterA:

HostA opens a connection to HostB using its name, and a request is sent to the DNS server for aname−to−address resolution

The following is output from the show ip nat translations command on RouterA; the outside global address

148.1.1.1 is mapped to outside local address 2.2.2.2, which is defined in the router configuration

Trang 30

RouterA#show ip nat translations

−−− −−− −−− 2.2.2.2 148.1.1.1

tcp 195.1.1.1:1071 10.1.1.1:1071 148.1.1.1:23 148.1.1.1:23

This configuration demonstrates outside global address translation RouterA monitors all DNS responses, and

if the resolved address overlaps with the inside local address (10.1.1.1), RouterA translates that address to2.2.2.2

Two Cisco routers are connected serially RouterA is connected to RouterB via a crossover cable RouterBacts as the DCE providing clock for RouterA A PC running a terminal emulation program is connected to theconsole port of RouterA All IP address are as Figure 15−11

Figure 15−11: IP address overlapping

HostA is configured with a default route of 10.1.1.5 and a DNS entry of 152.1.1.2 RouterA is configured forNetwork Address Translation and will monitor all DNS responses If the resolved address overlaps with10.1.1.1, it will statically translate the address of the resolved host to 2.2.2.2

The second workstation is configured as a domain name server and will resolve the name HostB to 10.1.1.1

Router Configurations (Static Mapping)

The following configuration defines a static mapping between the outside global address of 10.1.1.1 and theoutside local address of 2.2.2.2

ip nat pool globalpool 195.1.1.1 195.1.1.3 netmask 255.255.255.0

ip nat inside source list 1 pool globalpool overload

ip nat outside source static 10.1.1.1 2.2.2.2 ← Defines translation from the

outside global address 10.1.1.1

to the outside local address of

Trang 31

ip nat inside ← Defines the inside interface

Router Configurations (Dynamic Mapping)

The following configuration defines a dynamic mapping between a pool of outside local addresses to a group

of outside global addresses defined by an access list

Trang 32

ip nat inside source list 1 pool globalpool overload

↓ References the outside local pool

ip nat outside source list 2 pool outsidelocal ← (If the outside global source

á Specifies what address matches access list 1

addresses should change to one of the addresses

be changed defined in pool outsidelocal)

access−list 2 permit 10.1.1.2 ← If the outside global source address matches

one of these change

To test the configuration, ping HostB from HostA using the domain name Use the Debug ip nat command and the show ip nat translations command to verify that the translation is working properly.

Trang 33

What follows is the output from the debug ip nat command; note that the DNS response is translated to

What follows is the output from the show ip nat translations on RouterA; note that the overlapping outside

global address of 10.1.1.1 is translated to 2.2.2.2

routerA#show ip nat translations

−−− 195.1.1.1 10.1.1.1 −−− −−−

−−− −−− −−− 2.2.2.2 10.1.1.1

Lab #74: Destination Address Rotary Translation

Figure 15−12: Load balancing using NAT

Trang 34

When RouterA receives a packet destined for the virtual IP address, it translates the destination address to thefirst FTP server When the next FTP connection is established to the virtual IP address, RouterA translates thedestination address to the second FTP server These translations occur in a round−robin fashion, providingequal load balancing across multiple FTP servers.

RouterA takes the following steps when translating a rotary address:

User A (148.1.1.100) establishes a connection to virtual host 152.1.1.10

RouterA receives the response packet from FTP server 152.1.1.2, performs the NAT lookup,

translates the source address to the virtual address, and forwards the packet

8

This configuration will demonstrate load sharing using destination address rotary translation RouterA willtranslate destination addresses of any packet that matches access list 2 using real host addresses from therotary pool "loadsharing."

The pool defines the addresses of the real hosts, and the access−list defines the virtual address If a translationdoes not already exist, TCP packets from serial 0 (the outside interface) whose destination address matchaccess−list 2 are translated to an address from the pool

RouterA and RouterB are connected serially via a crossover cable RouterB will act as the DCE supplyingclock to RouterA The IP addresses are assigned as per Figure 15−13 Secondary IP addresses are used onRouterA as test points only

Figure 15−13: Destination address rotary translation

RouterA is configured for destination address rotary translation From RouterB, telnet to virtual host

152.1.1.10 Instead of using multiple PCs off of the router's Ethernet, configure secondary IP addresses.RouterA will also be configured to allow VTY sessions, so that we can establish a telnet session to thesecondary IP address on RouterA

Router Configurations

The configurations for the two routers in this example are as follows (key NAT configurations for RouterAare highlighted in bold)

Trang 35

↓ Pool Name ↓ Pool Range ↓ as rotary

ip nat pool loadsharing 152.1.1.1 152.1.1.2 prefix−length 24 type rotary

ip nat inside destination list 2 pool loadsharing ← If the destination address

á References access matches access list 2,

list 2 replace with an IP

address from pool

password cisco ← Sets the VTY password to cisco

login ← Allows telnet access into the router

Trang 36

Perform the following steps to test the configuration:

On RouterA, enter the command debug ip nat.

1

On RouterB, telnet to IP address 152.1.1.10

The following is the output from the debug ip nat command on RouterA The first line is the

translation from destination 152.1.1.10 to the first address of the pool 152.1.1.1 The next line is thereturn packet from 152.1.1.1 Note that RouterA translated the source address to the virtual IP address152.1.1.10 before forwarding the packet to RouterB

NAT: s=195.1.1.3, d=152.1.1.10−>152.1.1.1 [0]

NAT: s=152.1.1.1−>152.1.1.10, d=195.1.1.3 [0]

2

On RouterB, telnet again to IP address 152.1.1.10

The following is the output from the debug ip nat command on RouterA Note that this time

destination address 152.1.1.10 is translated to the second address in the pool (152.1.1.2)

NAT: s=195.1.1.3, d=152.1.1.10−>152.1.1.2 [0]

NAT: s=195.1.1.3, d=152.1.1.10−>152.1.1.2 [0]

3

Show the NAT table on RouterA using the command show ip nat translations The following is the

output from the command Note that each address is followed by the port number, and this combinedwith the protocol type is used as a key to translate the return packet back

tcp 152.1.1.10:23 152.1.1.2:23 195.1.1.3:26658 195.1.1.3:26658

tcp 152.1.1.10:23 152.1.1.1:23 195.1.1.3:26146 195.1.1.3:26146

4

Changing Translation Timeouts

Dynamic translation will time out after a period of inactivity; by default, simple translation not configured foroverloading will time out after 24 hours To change the default timeout period, perform the following

command in global configuration mode:

ip nat translation timeout { seconds} ← Command changes the timeout value for

dynamic address translations that do

not use overloading

When overloading is configured, Cisco IOS allows finer control over translation entry timeouts because eachentry contains more information about the traffic that is using it The UDP, TCP, DNS, and finish timersshown here can be changed with the following global configuration commands:

ip nat translation udp−timeout {seconds}← Changes the UDP timeout value; the

ip nat translation finrst−timeout (seconds) ← Changes the Finish and reset

timeouts; the default is 1 minute

Trang 37

Troubleshooting NAT

The Cisco IOS provides many tools for troubleshooting Network Address Translation What follows is a list

of commands along with a sample output from each

{show ip nat statistics} This command displays the number of active translations along with the number of

translations that have expired An expired translation is a translation that has been inactive for a period of timeand has been removed from the table The command also shows the inside and outside configured interfaces

RouterA#show ip nat statistics

Total active translations: 0 (0 static, 0 dynamic; 0 extended)

Outside interfaces: Serial0

Inside interfaces: Ethernet0

Hits: 20 Misses: 20

Expired translations: 20

Dynamic mappings:

−− Inside Source

access−list 1 pool pool refcount 0

pool pool: netmask 255.255.255.0

start 195.1.1.1 end 195.1.1.1

type generic, total addresses 1, allocated 0 (0%), misses 0

{show ip nat translations} This command displays all active translations, the protocol of the packet

translated, the inside local address, the inside global address, the outside local address, and the outside globaladdress

From the following output, we can see that a ping packet (protocol icmp) with the inside local address of10.1.1.1 has been translated to the inside global address of 195.1.1.1 The number after the IP address is theport number; this is used in this particular translation because the router is configured for overloading

RouterA#show ip nat translations

{show ip nat translations verbose} This command is an extension of the previous command that displays

more detailed information about how long ago the translation was created and how long ago the translationwas last used

From the following output, we can see that the translation was created 1 minute and 31 seconds ago and lastused 31 seconds ago

RouterA#show ip nat translations verbose

icmp 195.1.1.1:4 10.1.1.1:4 195.1.1.3:4 195.1.1.3:4

create 00:01:31, use 00:00:31, left 00:00:28, flags: extended

icmp 195.1.1.1:3 10.1.1.1:3 195.1.1.3:3 195.1.1.3:3

create 00:00:31, use 00:00:31, left 00:00:28, flags: extended

{clear ip nat translation} This command is used to clear all or specific active translations The following is a

list of extensions that can be used with this command

* The asterisk clears all dynamic translations

Inside Clears specific inside address and port translations

Outside Clears specific outside address and port translations

TCP Clears specific inside address by protocol

Trang 38

UDP Clear specific inside address by protocol

{clear ip nat statistics} This command is used to clear the counters for all NAT statistics.

{debug ip nat} This command is used to verify the operation of the NAT feature by displaying information

about every packet that is translated by the router The command will also display information about certainerrors or exceptional conditions, such as the failure to allocate a global address

From the following output of the command, we can see that the source address 10.1.1.1 has been translated tothe global address 195.1.1.1

NAT: s=10.1.1.1−>195.1.1.1, d=195.1.1.3 [35]

Conclusion

This chapter explores Network Address Translation (NAT) NAT allows the addresses inside one stub domain

to be reused by any other stub domain NAT allows organizations to appear from the outside as if they areusing different IP address space than what it is actually used, thereby reducing the need for unique, registered

IP addresses Network Address Translation can also save private network administrators from having torenumber hosts and routers that do not confirm to global IP addressing NAT is defined in RFC 1631

Trang 39

Chapter 16: Hot Standby Router Protocol

Overview

The majority of today's TCP/IP LAN networks rely on the use of a default gateway (which is statically

configured in the host) in order to route packets to hosts on other networks The default gateway is usually arouter connected to the Internet or the company's intranet Each host on the LAN is configured to forwardpackets to this destination if the host they are trying to reach is not on the same network This provides for asingle point of failure on the network; if the gateway is down, all the hosts on the LAN are isolated from therest of the

network To combat this problem, many companies install redundant gateways, the problem with which is thatthe user host is pointed at one gateway If this router should fail, users must change their statically configureddefault gateway

HSRP resolves this problem by allowing the network administrator to configure a set of routers to worktogether to present the appearance of a single default gateway The routers in an HSRP group share a virtualMac address and IP address, which is used by hosts on the LAN as the default gateway The HSRP protocolselects which router is active; the active router receives and routes packets that are destined for the group'sMac address

HSRP uses multicast UDP−based hello packets to communicate with other routers that are part of the sameHSRP group Each router in the group watches for hello packets from the active and standby routers If theactive router becomes unavailable, the standby will assume the active role and route the packets for thenetwork

Commands Discussed in This Chapter

debug standby

show standby

Trang 40

standby [group−number] ip [ip−address [secondary]]

standby [group−number] priority priority−number

standby [group−number] timers hellotime holdtime standby [group−number] preempt

standby [group−number] track type number [interface−priority]

standby ip: Used to activate HSRP.

Definitions

standby priority: Used to set the HSRP priority on an interface; the HSRP member with the highest priority

(assuming preemption is enabled) becomes the active router

standby timers: Used to configure the time between hello packets (hello time) and the amount of time after

not hearing a hello packet from a HSRP neighbor that the router declares the neighbor down (holdtime)

standby preempt: Indicates that, when the local router's standby priority is higher than that of the current

active router, the local router should attempt to assume control as the active router

standby track: Used to configure an interface to change its HSRP priority according to the availability of

another interface

The HSRP feature set was first introduced in IOS 10.0

Lab #75: Basic HSRP Configuration (One HSRP Group)

Two Cisco routers

Định dạng
Số trang	89
Dung lượng	699,79 KB