Distance Vector vs.

Link
State
B

D
X

Distance Vector
Link State
Hybrid

Routing by rumor
Route table
Topology

Periodic Update

Incremental Update

Distance Vector vs. Link

State
Distance Vector
Updates frequently
Each router is
"aware" only of its
immediate
neighbors
Slow convergence
Prone to routing
loops
Easy to configure

Link State
Updates are event
triggered
Each router is
"aware" of all other
routers in the "area"
Fast convergence
Less subject to
routing loops
More difficult to
configure
2

Comparison Continued
Distance Vector
Fewer router resources
required
Updates require more
bandwidth
Does not "understand"
the topology of the
network

Link State
More router resource
intensive
Updates require less
bandwidth
Has detailed knowledge
of distant networks and
routers

Link State
Example
OSPF
IS-IS

OSPF is used for corporate networks

IS-IS is used for ISPs

Open Shortest Path First

(OSPF)
OSPF is an open standards routing protocol
This works by using the Dijkstra algorithm
OSPF provides the following features:
Minimizes routing update traffic
Allows scalability (e.g. RIP is limited to 15
hops)
Has unlimited hop count
Supports VLSM/CIDR
Allows multi-vendor deployment (open
standard)
7

Link State
There are two types of Packets
Hello
LSAs

OSPF Hello
A

When router A starts it send Hello packet uses 224.0.0.5

Hello packets are received by all neighbors
B will write As name in its neighbor table
C also process the same way

"Hello" Packets
Small frequently issued packets
Discover neighbours and negotiate "adjacencies"
Verify continued availability of adjacent
neighbours
Hello packets and Link State Advertisements
(LSAs) build and maintain the topological
database
Hello packets are addressed to 224.0.0.5.

10

Link State Advertisement

(LSA)
An OSPF data packet containing link state and
routing information that is shared among OSPF
routers
LSAs are shared only with routers with whom it
has formed adjacencies
LSA packets are used to update and maintain
the topology database.

11

Link State
There are three type of tables
Neighbor
Topology
Routing

12

Tables
Neighbor
Contain information about the neighbors
Neighbor is a router which shares a link on
same network
Another relationship is adjacency
Not necessarily all neighbors
LSA updates are only when adjacency is
established

13

Tables
Topology
Contain information about all network and path
to reach any network
All LSAs are entered in to topology table
When topology changes LSAs are generated
and send new LSAs
On topology table an algorithm is run to create
a shortest path, this algorithm is known as SPF
or dijkstra algorithm

14

Tables
Routing Table
Also knows as forwarding database
Generated when an algorithm is run on the
topology database
Routing table for each router is unique

15

OSPF Terms
Link
Router ID
Neighbours
Adjacency
OSPF Area

Backbone area
Internal routers
Area Border Router
(ABR)
Autonomous
System Boundary
Router (ASBR)

16

Link
A network or router interface assigned to a
given network
Link
(interface)
will
have
"state"
information associated with it
Status (up or down)
IP Address
Network type (e.g. Fast Ethernet)
Bandwidth
Addresses of other routers attached to
this interface
17

OSPF Term: Link

A link is a network or router interface assigned to any

given network
This link, or interface, will have state information
associated with it (up or down) as well as one or more IP 18
addresses

OSPF Term: Link State

Status of a link between two routers

Information is shared between directly connected routers.
This information propagates throughout the network
unchanged and is also used to create a shortest path first
19
(SPF) tree.

Router ID
The Router ID (RID) is an IP address used to identify the
router
Cisco chooses the Router ID by using the highest IP address
of all configured loopback interfaces
If no loopback interfaces are configured with addresses,
OSPF will choose the highest IP address of all active
physical interfaces.
You can manually assign the router ID.
The RID interface MUST always be up, therefore loopbacks
are preferred
20

Neighbours
Neighbours are two or more routers
that have an interface on a common
network
E.g. two routers connected on a serial link
E.g. several routers connected on a
common Ethernet or Frame relay network

Communication takes place between /

among neighbours
neighbours form "adjacencies"
21

Adjacency
A relationship between two routers
that permits the direct exchange of
route updates
Not
all
neighbours
will
form
adjacencies
This is done for reasons of efficiency
more later

22

OSPF Design

Each router connects to the backbone called area 0, or the backbone area.
Routers that connect other areas to the backbone within an AS are called Area Border Routers
(ABRs). One interface must be in area 0.
OSPF runs inside an autonomous system, but can also connect multiple autonomous systems
together. The router that connects these ASes together is called an Autonomous System
23
Boundary Router (ASBR).

OSPF Areas
An OSPF area is a grouping of contiguous
networks and routers
Share a common area ID
A router can be a member of more than one area
(area border router)
All routers in the same area have the same
topology database
When multiple areas exist, there must always be
an area 0 (the backbone) to which other areas
connect
24

Why areas?
Decreases routing overhead
Compare to multiple smaller broadcast domains
instead of one large one
Speeds convergence
Confines network instability (e.g. route "flapping") to
single area of the network
Adds considerably to the complexity of setting up
OSPF
CCNA certification deals only with single-area OSPF
25

Area Terminology

26

LSAs in Area
LSAs communicate with adjacent routers in the
same OSPF area
Subsequently, a change in a link
"flooded" to all area routers via LSAs

state

is

In larger networks, multiple areas may be created

LSAs are sent only to adjacent routers in the
same area
"Area border routers" connect areas, passing
summarized route information between
27

Path Calculation
Changes to the topological database of a router
trigger a recalculation to re-establish the best
route(s) to known networks
Uses the SPF (shortest path first) algorithm
developed by a computer scientist named Dijkstra
This is done by each individual router using its
detailed "knowledge" of the whole network
Leads to rapid and accurate convergence
Based on detailed knowledge of every link in the
area and the OSPF "cost" of each
builds an OSPF tree with itself at the route
28

Terminology: Cost
Various
criteria
can
be
selected by the administrator
to determine the metric
Usually,
OSPF cost=108/bandwidth

Do not forget to
configure the
bandwidth`
command on
serial links to
ensure correct
default OSPF cost
29

Pros and Cons

Note that OSPF is a more sophisticated routing
protocol
Converges rapidly and accurately
Can use a metric calculation that effectively selects
the "best" route(s) primarily based on bandwidth,
although an OSPF cost can be administratively
assigned
Use of OSPF requires
More powerful routing hardware
More detailed knowledge by the administrator,
especially when large multi-area networks are used
30

Types of Neighbors
OSPF can be defined for three type of
neighbors
Broadcast Multi Access (BMA) ex- Ethernet
Point to Point
Non-Broadcast Multi Access (NBMA)

31

OSPF Network Types

32

Adjacencies
Point to Point all routers form adjacencies
BMA & NBMA one router is elected as DR
DR establish adjacency with every neighbor
router
LSA updates are exchanged only to DR
DR is the router which has highest priority
All CISCO routers has priority 1
If priority is same then router id is seen
The RID is highest IP address of all interfaces
33

Point-to-Point Links

Usually a serial interface running either PPP

or HDLC

No DR or BDR election required

OSPF autodetects this interface type
OSPF packets are sent using multicast 224.0.0.5
All routers form adjacencies
34

Multi-access Broadcast
Network

Generally LAN technologies like Ethernet and Token Ring

DR and BDR selection required
All neighbor routers form full adjacencies with the DR and
BDR only
Packets to the DR use 224.0.0.6
Packets from DR to all other routers use 224.0.0.5

35

Electing the DR and BDR

Hello packets are exchanged via IP multicast.

The router with the highest priority is
selected as the DR.
If Priority is same then Router ID is seen
Use the OSPF router ID as the tie breaker.

36

Terminology: DRs and BDRs

The
designated
router (DR)
is
responsible
for
generating
LSAs on
behalf of all
routers
connected
to the same
segment
37

DR Responsibility
When a router sees a new or changed link-state,
it sends an LSA to its DR using a particular
multicast address
The DR then forwards the LSA to all the other
routers with whom it is adjacent
Minimizes the number of formal adjacencies
that must be formed and therefore the amount
of LSU (link state update) packet traffic in a
multi-router network
38

OSPF Summary
AD -100
Hop count is unlimited
Metric = Cost 108/BW
Classless, VLSM
Load balance up to SIX routers
Require more processing power

39

Basic OSPF Configuration

Router(config)# router ospf 1

The number 1 in this example is a process-id #

that begins an OSPF process in the router
More than one process can be launched in a
router, but this is rarely necessary
Usually the same process-id is used throughout
the entire network, but this is not required
The process-id # can actually be any value
from 1 to "very large integer
The process-id # cannot be ZERO
This is NOT the same as the AS# used in IGRP
and EIGRP
40

Configuring OSPF Areas

After identifying the OSPF process, you need to identify the
interfaces that you want to activate OSPF communications
Lab_A#config t
Lab_A(config)#router ospf 1
Lab_A(config-router)#network 10.0.0.0 0.255.255.255
area ?
<0-4294967295> OSPF area ID as a decimal value
A.B.C.D OSPF area ID in IP address format
Lab_A(config-router)#network 10.0.0.0 0.255.255.255
area 0
Every OSPF network must have an area 0 (the backbone area) to
which other areas connect
So in a multiple area network, there must be an area 0
The wildcard mask represents the set of hosts supported by the
network and is really just the inverse of the subnet mask .

41

OSPF Configuration
OSPF Process ID number is irrelevant. It can be the same on
every router on the network
The arguments of the network command are the network
number (10.0.0.0) and the wildcard mask (0.255.255.255)
Wildcards - A 0 octet in the wildcard mask indicates that the
corresponding octet in the network must match exactly
A 255 indicates that you dont care what the corresponding
octet is in the network number
A network and wildcard mask combination of 1.1.1.1 0.0.0.0
would match 1.1.1.1 only, and nothing else.
The network and wildcard mask combination of 1.1.0.0
0.0.255.255 would match anything in the range 1.1.0.0
1.1.255.255
42

OSPF Configuration -1
S0

S1

20.0.0.2

30.0.0.1

R2
R1
S0

10.0.0.1

20.0.0.1

E0

10.0.0.2

S0

R3

30.0.0.2

E0

40.0.0.1

40.0.0.2

43

OSPF Configuration -1
S0

S1

20.0.0.2

30.0.0.1

R2
R1
S0
E0

10.0.0.1

20.0.0.1

S0

R3

30.0.0.2

10.0.0.2

E0

40.0.0.1

40.0.0.2

R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#network 10.0.0.0 0.255.255.255 area 0
R1(config-router)#network 20.0.0.0 0.255.255.255 area 0
R1(config-router)#^Z

44

OSPF Configuration -2
S0

S1

200.0.0.8/30

R2

200.0.0.12/30

R1

R3
S0
S0
E0

E0

200.0.0.16/28

200.0.0.32/27

45

OSPF Configuration -2
S0

S1

200.0.0.10

R2

255.255.255.252

R1

S0

200.0.0.17

200.0.0.13

200.0.0.9

255.255.255.252
S0

R3

200.0.0.14
E0

E0

255.255.255.240

200.0.0.18

200.0.0.33
255.255.255.224

200.0.0.34

46

OSPF Configuration -2
S0

S1

200.0.0.10

R2

255.255.255.252

R1

S0

200.0.0.17

200.0.0.13

200.0.0.9

255.255.255.252
S0

R3

200.0.0.14

E0

E0

255.255.255.240

255.255.255.224

200.0.0.18

R1#config t
Enter configuration commands, one per line. End with
CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#network 200.0.0.16
0.0.0.15 area
0
R1(config-router)#network 200.0.0. 8
0.0.0.3
area
0
R1(config-router)#^Z

200.0.0.33
200.0.0.34

R3#config t
Enter configuration commands, one per line. End with
CNTL/Z.
R3(config)#router ospf 1
R3(config-router)#network 200.0.0. 32 0.0.0.31 area
0
R3(config-router)#network 200.0.0. 12
0.0.0.3
area 0
R3(config-router)#^Z

47

OSPF and Loopback

Interfaces
Configuring loopback interfaces when using the OSPF routing
protocol is important
Cisco suggests using them whenever you configure OSPF on a
router
Loopback interfaces are logical interfaces, which are virtual,
software-only interfaces; they are not real router interfaces
Using loopback interfaces with your OSPF configuration ensures
that an interface is always active for OSPF processes.
The highest IP address on a router will become that routers RID
The RID is used to advertise the routes as well as elect the DR
and BDR.
If you configure serial interface of your router with highest IP
Address this Address becomes RID of t is the RID of the router
because e router
If this interface goes down, then a re-election must occur
It can have an big impact when the above link is flapping
48

Configuring Loopback
Interfaces
R1#config t
Enter configuration commands, one per line.
End with CNTL/Z.
R1(config)#int loopback 0
R1(config-if)#ip address 172.16.10.1
255.255.255.255
R1(config-if)#no shut
R1(config-if)#^Z
R1#
49

Verifying OSPF Operation

Router#

show ip protocols

Verifies the configured IP routing protocol

processes, parameters and statistics
Router#

show ip route ospf

Displays all OSPF routes learned by the router

Router#

show ip ospf interface

Displays the OSPF router ID, area ID and

adjacency information

50

Verifying OSPF Operation

(Cont.)
Router#

show ip ospf

Displays the OSPF router ID, timers, and statistics

Router#

show ip ospf neighbor [detail]

Displays information about the OSPF neighbors,

including Designated Router (DR) and Backup
Designated Router (BDR) information on
broadcast networks

51

The show ip route ospf

Command
RouterA# show ip route ospf
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile,
B - BGP, D - EIGRP, EX - EIGRP external, O - OSPF,
IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, E - EGP, i - IS-IS, L1 - IS-IS
level-1, L2 - IS-IS level-2, * - candidate default
Gateway of last resort is not set
10.0.0.0 255.255.255.0 is subnetted, 2 subnets
O
10.2.1.0 [110/10] via 10.64.0.2, 00:00:50, Ethernet0

52

The show ip ospf interface

Command
RouterA# show ip ospf interface e0
Ethernet0 is up, line protocol is up
Internet Address 10.64.0.1/24, Area 0
Process ID 1, Router ID 10.64.0.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DROTHER, Priority 1
Designated Router (ID) 10.64.0.2, Interface address 10.64.0.2
Backup Designated router (ID) 10.64.0.1, Interface address 10.64.0.1
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:04
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 10.64.0.2 (Designated Router)
Suppress hello for 0 neighbor(s)

53

The show ip ospf neighbor

Command
RouterB# show ip ospf neighbor
Neighbor ID
10.64.1.1
10.2.1.1

Pri
1
1

State
FULL/BDR
FULL/-

Dead Time
00:00:31
00:00:38

Address
10.64.1.1
10.2.1.1

Interface
Ethernet0
Serial0

54

show ip ospf neighbor detail

show ip ospf database

55

Setting Priority for DR

Election
Router(config-if)#
ip ospf priority number

This interface configuration command assigns the

OSPF priority to an interface.
Different interfaces on a router may be assigned
different values.
The default priority is 1. The range is from 0 to 255.
0 means the router is a DROTHER; it cant be the DR
or BDR.
56

57

EIGRP
IGRP

OSPF

DV
Easy to configure
Neighbor
Advanced Metric
Periodic
Broadcast

LS
Incremental Updates
Multicast
Open Standard

EIGRP

Hybrid
DUAL
Topology Database
Rapid Convergence
Reliable

58

Overview
Enhanced Interior Gateway Routing Protocol (EIGRP) is a
Cisco-proprietary routing protocol based on Interior Gateway
Routing Protocol (IGRP).
Released in 1994, Unlike IGRP, which is a classful routing
protocol, EIGRP supports CIDR and VLSM.
it is probably one of the two most popular routing protocols
in use today.
Compared to IGRP, EIGRP boasts faster convergence times,
improved scalability, and superior handling of routing loops.
EIGRP is often described as a hybrid routing protocol, offering
59
the best of distance vector and link-state algorithms.

Comparing EIGRP with IGRP

IGRP and EIGRP are compatible with each other.
EIGRP offers multiprotocol support, but IGRP does
not.
Communication via Reliable Transport Protocol (RTP)
Best path selection via Diffusing Update Algorithm
(DUAL)
Improved convergence time
Reduced network overhead

60

Introducing EIGRP

EIGRP supports:
Rapid convergence
Reduced bandwidth usage
Multiple network-layer protocols

EIGRP Tables
EIGRP maintains 3 tables
Neighbor table
Topology table
Routing table

62

Neighbor Discovery
There are three conditions that must be
met for neighborship establishment
Hello or ACK received
AS numbers match
Identical metrics (K values)
Hello

? AS
?K
K1 BW
K2- Delay
K3-Load
K3-Reliability
K5-MTU

63

Metric Calculation
The metrics used by EIGRP in making routing decisions are (lower the metric the
better):

bandwidth
delay
load
Reliability
MTU

By default, EIGRP uses only:

Bandwidth
Delay

Analogies:
Think of bandwidth as the width of the pipe
and
delay as the length of the pipe.
Bandwidth is the carrying capacity
Delay is the end-to-end travel time.

64

Neighbor Table
The neighbor table is the most important table in
EIGRP
Stores address and interface of neighbor

65

Topology Table

Give

tion
a
m
r
nfo
me i

tes
u
o
r
t all
u
o
b
a

Network

66

Topology Table
The topology table is made up of all the EIGRP routing tables in
the autonomous system.
DUAL takes the information and calculates the lowest cost routes
to each destination.
By tracking this information, EIGRP routers can identify and switch
to alternate routes quickly.
The information that the router learns from the DUAL is used to
determine the successor route, which is the term used to identify
the primary or best route.
Every EIGRP router maintains a topology table. All learned routes
to a destination are maintained in the topology table.
67

Routing Tables
A successor is a route selected as the primary route
to use to reach a destination.
DUAL calculates Successor (Primary Route) and
places it in the routing table (and topology table)
Can have up to 4 successors of equal or unequal
value
DUAL calculates Feasible Successor (Backup Route)
and places it in the Topology Table.
Promoted to successor if the route goes down if it
has a lower cost than current successor
If no FS in Table - Send query
Multiple feasible successors for a destination can be
retained in the topology table although it is not
mandatory
68

EIGRP Concepts &

Terminology
EIGRP routers that belong to different autonomous
systems (ASes) dont automatically share routing
information
The only time EIGRP advertises its entire routing table
is when it discovers a new neighbor and forms an
adjacency with it through the exchange of Hello
packets
When this happens, both neighbors advertise their
entire routing tables to one another
After each has learned its neighbors routes, only
changes to the routing table are propagated
69

172.16.100.0

10Mbp
Dist to 172.16.100.0 s=100 Dist to 172.16.100.0 =100

56Kbp
s
1.544Mbps

1.544Mbps

10Mbps 100
1,544Mbps 250
56Kbps -1000

Dist to 172.16.100.0 =350

Chennai receives an update from Mumbai with a cost of 100, which is Mumbai's cost to reach
172.16.100.0, This cost is referred to as the reported distance (RD)
Bangalore will report its cost to reach 172.16.100.0. Bangalore's RD is 350
Chennai will compute its cost to reach 172.16.100.0 via Mumbai and Bangalore and compare the
metrics for the two paths
Chennai's cost via Mumbai is 1100. Chennai's cost via Bangalore is 600. The lowest cost to reach a
destination is referred to as the feasible distance (FD) for that destination
Chennai's FD to 172.16.100.0 is 600. The next-hop router in the lowest-cost path to the destination is
referred to as the successor.
70
A feasible successor is a path whose reported distance is less than the feasible distance, and it is
considered a backup route.

EIGRP Terms
Feasible distance (FD) - This is the lowest calculated
metric to reach destination. This is the route that you
will find in the routing table, because it is considered
the best path
Reported distance (RD) - The distance reported by an
adjacent neighbor to a specific destination.
Interface information - The interface through which the
destination can be reached.
Route status - The status of a route. Routes are
identified as being either passive, which means that
the route is stable and ready for use, or active, which
means that the route is in the process of being
recomputed by DUAL
71

EIGRP Terminology and

Operations
Successor Current Route
A successor is a route selected as the primary route to use
to reach a destination.
Successors are the entries kept in the routing table.
Feasible Successor - A backup route
A feasible successor is a backup route.
These routes are selected at the same time the successors
are identified, but they are kept in the topology table.
Multiple feasible successors for a destination can be
retained in the topology table.

72

Reliable Transport Protocol

(RTP)
Used by EIGRP for its routing updates in place of TCP
EIGRP can call on RTP to provide reliable or unreliable service
EIGRP uses reliable service for route updates
Unreliable for Hellos
Reliable Transport Protocol (RTP) is a transport layer protocol that
guarantees ordered delivery of EIGRP packets to all neighbors.
On an IP network, hosts use TCP to sequence packets and ensure
their timely delivery. RIP uses UDP
However, EIGRP is protocol-independent and does not rely on
TCP/IP to exchange routing information the way that RIP, IGRP,
and OSPF do.
EIGRP uses RTP as its own proprietary transport layer protocol to
guarantee delivery of routing information.
With RTP, EIGRP can multicast and unicast to different peers
simultaneously.
73

Diffusing Update Algorithm

(DUAL)
All route computations in EIGRP are handled by DUAL
One of DUAL's tasks is maintaining a table of loop-free
paths to every destination.
This table is referred to as the topology table
DUAL saves all paths in the topology table
The least-cost path(s) is copied from the topology table to
the routing table
In the event of a failure, the topology table allows for very
quick convergence if another loop-free path is available
If a loop-free path is not found in the topology table, a route
recomputation must occur
DUAL queries its neighbors, who, in turn, may query their
neighbors, and so on...
Hence the name "Diffusing" Update Algorithm
74

VLSM Support
EIGRP supports the use of Variable- Length Subnet
Masks
Can use 30-bit subnet masks for point-to-point
networks
Because the subnet mask is propagated with every
route update, EIGRP also supports the use of
discontiguous subnets
Discontiguous network is the one that has two or
more subnetworks of a classful network connected
together by different classful networks
75

Discontiguous Network

76

Configuring EIGRP

Router(config)#router eigrp autonomous-system

Defines EIGRP as the IP routing protocol

Router(config-router)#network network-number

Selects participating attached networks

EIGRP Configuration
Example

EIGRP Configuration
S0

S1

200.0.0.10

R2

255.255.255.252

R1

S0

200.0.0.17

200.0.0.13

200.0.0.9

255.255.255.252
S0

R3

200.0.0.14

E0

E0

255.255.255.240

255.255.255.224

200.0.0.18

R1#config t
Enter configuration commands, one per line. End with
CNTL/Z.
R1(config)#router eigrp 10
R1(config-router)#network 200.0.0.16
R1(config-router)#network 200.0.0. 8
R1(config-router)#^Z

200.0.0.33
200.0.0.34

R3#config t
Enter configuration commands, one per line. End with
CNTL/Z.
R3(config)#router eigrp 10
R3(config-router)#network 200.0.0. 32
R3(config-router)#network 200.0.0. 12
R3(config-router)#^Z

80

Verifying the EIGRP

Configuration
To verify the EIGRP configuration a number of show
and debug commands are available.
These commands are shown on the next few slides.

81

show ip eigrp topology

show ip eigrp topology

[active | pending |
successors]
82

show ip eigrp topology

all-links

show ip eigrp traffic

83

Administrative Distances

84

TELNET
Getting information about remote device
Can connect to remote device and configure a
device
Password must be set
R1(config)# line vty 0 4
Password cisco
login

85

Discovering Neighbors on
the Network

86
2002, Cisco Systems, Inc. All rights reserved.

86

Cisco Discovery Protocol

CDP is a proprietary utility that gives you a summary of

directly connected switches, routers, and other Cisco
devices.
CDP discovers neighboring devices regardless of which
protocol suite they are running.
Runs on the Data link layer
Physical media must support the Subnetwork Access
Protocol (SNAP) encapsulation.
Only give directly connected device

Discovering Neighbors with

CDP
CDP runs on routers with Cisco IOS
software Release 10.3 or later and on
Cisco switches.
Show CDP ?
Summary information
includes:

Device ID
Local Interface
Port ID
Capabilities list
Platform

CDP

CDP timer is how often CDP packets are

transmitted to all active interfaces.

Router(config)#cdp timer 90
CDP holdtime is the amount of time that the
device will hold packets received from neighbor
devices.

Router(config)#cdp holdtime 240

89

Using CDP

90

Using the show cdp

neighbors Command

The show cdp neighbor command (sh cdp nei for short)
delivers information about directly connected devices.
91

CDP
show cdp neighbor detail
This command can be run on both routers
and switches, and it displays detailed
information about each device connected
to the device

92

Using the show cdp entry

Command

The show cdp entry * command displays the same information as the
show cdp
neighbor details command.

93

Additional CDP Commands

The show cdp traffic command displays information about

interface traffic, including the number of CDP packets
sent and received and the errors with CDP.
94

CDP Commands
To disable the CDP on particular interface
use the "no cdp enable" command

To disable CDP on the entire router use the

"no cdp run" in global configuration mode.

95

Summary
Cisco Discovery Protocol is an information-gathering tool
used by network administrators to get information about
directly connected devices.
CDP exchanges hardware and software device information
with its directly connected CDP neighbors.
You can enable or disable CDP on a router as a whole or on
a port-by-port basis.
The show cdp neighbors command displays information
about a routers CDP neighbors.
The show cdp entry, show cdp traffic, and show cdp
interface commands display detailed CDP information on a
96
Cisco device.

97

Why Use Access Lists?

Manage IP traffic as network access grows

Filter packets as they pass through the router

What are ACLs?

ACLs are lists of conditions that are applied to traffic
traveling across a router's interface.
These lists tell the router what types of packets to accept or
deny.
Acceptance and denial can be based on specified conditions.
ACLs can be configured at the router to control access to a
network or subnet.
Some ACL decision points are source and destination
addresses, protocols, and upper-layer port numbers.
99

Reasons to Create ACLs

The following are some of the primary reasons to
create ACLs:
Limit network traffic and increase network performance.
Provide traffic flow control.
Provide a basic level of security for network access.
Decide which types of traffic are forwarded or blocked at the
router interfaces
For example: Permit e-mail traffic to be routed, but block all
telnet traffic.
If ACLs are not configured on the router, all packets passing
through the router will be allowed onto all parts of the network.

100

ACLs
Different access list for Telnet
When configuring ISDN you need to use access
list
Implicit deny at bottom
All restricted statements should be on first
There are two types
Standard
Extended

101

Network
192.168.12.2

N1

192.168.12.0

N2

192.168.12.3

N3

192.168.34.0

N4

N5

192.168.56.0

N6
102

IP Packet

SRC IP Address
DEST IP Address
Protocol type
SRC Port
DEST Port

The first 2 bytes in the TCP/UDP header are the source port number
The next 2 bytes in the TCP/UDP header are the Destination port number

103

Types of Access Lists

Standard
Checks source address
Permits or denies entire protocol suite
Extended
Checks source and destination address
Generally permits or denies specific protocols
104

How to Identify Access

Lists

Standard IP lists (1-99) test conditions of all IP packets from

source addresses.
Extended IP lists (100-199) test conditions of source and
destination addresses, specific TCP/IP protocols, and
destination ports.
Standard IP lists (1300-1999) (expanded range).
Extended IP lists (2000-2699) (expanded range).

Standard ACLs
The full syntax of the standard ACL command is:
Router(config)#access-list access-list-number {deny | permit}
source [source-wildcard ]
The no form of this command is used to remove a standard ACL.
This is the syntax:
Router(config)#no access-list access-list-number

Config# Access-list 1 deny 192.168.1.0 0.0.0.255

Config# access-list 1 permit any

106

Wildcard Mask
Access-list 99 permit 192.168.1.1 wildcard mask
All 32 bits of an IP Address can be filtered
Wildcard inverse mask
0=must match
1= ignore

MASK (192.168.1.1)

Matching IP

0.0.0.0 (host)

192.168.1.1

0.0.0.255

192.168.1.0-255

0.0.255.255

192.168.0-255.0-255

0.255.255.255

192.0-255.0-255.0-255

255.255.255.255

0-255.0-255.0-255.0-255 (any)

107

The ANY and HOST keyword

Access-list 1 permit 0.0.0.0 255.255.255.255
Or
permit any

Access-list 1 permit 200.0.0.9 0.0.0.0

Or
permit host 200.0.0.9
108

Testing Packets with

Standard Access Lists

Outbound ACL Operation

If no access list statement matches, then discard the packet.

Reading an ACL

1.

First Hit or Best Fit?

Access-list 99 deny host 192.168.1.1 0.0.0.0
access-list 99 permit any
255.255.255.255

2.

Access-list 99 permit 192.168.1.0 0.0.0.255

Access-list 99 deny host 192.168.1.1
access-list 99 permit any

3.

Access-list 99 deny host 192.168.1.1

Implicit deny at the end of every ACL

111

Creating ACLs
ACLs are created in the global configuration mode.
There are
many different types of ACLs including standard, extended, IPX,
AppleTalk, and others. When configuring ACLs on a router, each
ACL must be uniquely identified by assigning a number to it. This
number identifies the type of access list created and must fall
within the specific range of numbers that is valid for that type of
list.
Since IP is by far the
most popular routed
protocol, addition ACL
numbers
have
been
added to newer router
IOSs.
Standard IP: 13001999
112
Extended IP: 20002699

The ip access-group
command

{ in | out }

113

Exercise Standard Access

List
192.168.0.5
192.168.0.9
255.255.255.252255.255.255.252

192.168.0.33
255.255.255.240

E0

192.168.0.17 S0
255.255.255.248

192.168.0.18
255.255.255.248

S0

S1

192.168.0.6
255.255.255.252

S0

E0

192.168.0.10
255.255.255.252

192.168.0.34
255.255.255.240

Account should be denied access to Sales

To steps to configure
Create a standard Access list
Apply ACL to proper interface inbound or outbound

114

Exercise Standard Access

List
192.168.0.5
192.168.0.9
255.255.255.252255.255.255.252

192.168.0.33
255.255.255.240

E0

192.168.0.17 S0
255.255.255.248

192.168.0.18
255.255.255.248

S0

S1

192.168.0.6
255.255.255.252

S0

E0

192.168.0.10
255.255.255.252

B
192.168.0.34
255.255.255.240

Config# Access-list 1 deny 192.168.0.18 0.0.0.7

Config# access-list 1 permit any

Config#int e 0
Config-if# ip access-group 1 out

115

Extended ACLs
Extended ACLs are used more often than standard ACLs because they
provide a greater range of control.
Extended ACLs check the source and destination packet addresses as
well as being able to check for protocols and port numbers.
At the end of the extended ACL statement, additional precision is gained
from a field that specifies the optional Transmission Control Protocol (TCP)
or User Datagram Protocol (UDP) port number.
Logical operations may be specified such as, equal (eq), not equal (neq),
greater than (gt), and less than (lt), that the extended ACL will perform on
specific protocols.
Extended ACLs use an access-list-number in the range 100 to 199 (also
from 2000 to 2699 in recent IOS).
116

Configuration

Access-list acl# {permit/Deny}

IP

Protocol

OSPF
EIGRP
ICMP
TCP
UDP

Protocol
Src IP src WCM
Dst IP dst WCM
Opetrator port

RP If you need to Block a routing protocol

Operator

eq
gt
lt
neq

117

Testing Packets with

Extended Access Lists

Extended ACL Syntax

119

Extended ACL LAB -2

192.168.0.5
255.255.255.252

192.168.0.17 E0
255.255.255.248

S0

192.168.0.9
255.255.255.252

S0

192.168.0.6
255.255.255.252

S1

S0
192.168.0.10
255.255.255.252

E0

192.168.0.33
255.255.255.240

192.168.0.34
255.255.255.240

192.168.0.18
255.255.255.248

192.168.0.34 should be denied FTP of 192.168.0.18

192.168.0.18 should be denied website of 192.168.0.34

On Router R1
Config# Access-list 100 deny tcp 192.168.0.34 0.0.0.0
192.168.0.18 0.0.0.0 eq 21
Config# access-list 100 permit IP any any

On Router R3
Config# Access-list 100 deny tcp 192.168. 0.18 0.0.0.0
192.168.0.34 0.0.0.0 eq 80
Config# access-list 100 permit IP any any

Config#int s0
Config-if# ip access-group 100 IN

Config#int s0
Config-if# ip access-group 100 IN

121

Deny FTP
access-list 101 deny tcp any any eq 21
access-list 101 permit ip any any
or

access-list 101 deny tcp any any eq ftp

access-list 101 permit ip any any

122

Rules
For extended access list apply near
to the source
For standard access list apply near to
the destination

123

Named ACLs
IP named ACLs were introduced in Cisco IOS Software Release
11.2, allowing standard and extended ACLs to be given names
instead of numbers.

The characteristics of named accesslist:

Identify an ACL using an alphanumeric name.
You can delete individual statements in a named access
list
Named access lists must be specified as standard or
extended
You can use the ip access-list command to create
named access lists.
Named ACLs are not compatible with Cisco IOS releases prior to
Release 11.2.
124

The same name may not be used for multiple ACLs.

Named ACLs
Numbered Access list did not give you any hint, What is
filtered
Named ACLs are both basic and advanced filtering tool
Name cannot start with a number or !
Cannot have space in the name
Should not have ? Character anywhere in the name
Name is case sensitive
125

Named ACL Example

R1(config)#ip access-list standard blocksales

R1(config-std-nacl)#deny 172.16.40.0 0.0.0.255

R1(config-std-nacl)#permit any
R1(config-std-nacl)#exit
R1(config)#^Z
R1#

#Int e 0
#Ip access-group blocksales out
126

Verify Access List

127

Basic Rules for ACLs

Standard IP access lists should be applied closest to the

destination.

Extended IP access lists should be applied closest to the source.

Use the inbound or outbound interface reference as if looking at

the port
from inside the router.

Statements are processed sequentially from the top of list to the

bottom until a match is found, if no match is found then the packet is
denied.

There is an implicit deny at the end of all access lists. This will not
appear in the configuration listing.

Access list entries should filter in the order from specific to

general.
Specific hosts should be denied first, and groups or
general filters should come last.

Never work with an access list that is actively applied.

New lines are always added to the end of the access list.

A no access-list x command will remove the whole list. It is not

possible
to selectively add and remove lines with numbered ACLs.

Outbound filters do not affect traffic originating from the local128

router.