OSPF: Difference between revisions
Content added Content deleted
| Line 147: | Line 147: | ||
ip ospf demand-circuit |
ip ospf demand-circuit |
||
* Only ABR & ASBR can do Summarization in OSPF. In EIGRP Summarization can be done anywhere. |
|||
* All Areas must connect to Area 0. |
|||
<br /> |
<br /> |
||
Revision as of 20:20, 11 January 2019
Introduction
- Attributes:
| Type | Link-State |
| Algorithm | Dijkstra |
| Metric | Cost (Bandwidth) |
| AD | 110 |
| Standard | RFC 2328, RFC 2740 |
| Protocols | IP |
| Transport | IP/89 |
| Authentication | Plaintext, MD5 |
| AllSPF Address | 224.0.0.5 |
| AllDR Address | 224.0.0.6 |
- OSPF Hello Packet has TTL=1. It cannot cross a hop.[1]
- Change AD in OSPF:
#router ospf 1 #distance 250 (useful in Protocol Migration) #distance 255 (invalid; do not use these routes)
- Various Packet types in OSPF:
| Type | Packet Name | Description |
|---|---|---|
| 1 | Hello | Discovers Neighbors & builds adjacencies between them |
| 2 | Database Description(DBD) | Checks for database sync between routers |
| 3 | Link-State request(LSR) | Requests specific link-state records from other router |
| 4 | LSU | Sends specifically requested link-state records |
| 5 | LSAck | Acknowledges the other packet types |
- OSPF has 3 databases which are used to create 3 Tables:
| Database | Table Name | Description |
|---|---|---|
| Adjacency Database | Neighbor Table |
|
| Link-State Database | Topology Table |
|
| Forwarding Database | Routing Table |
|
- DR/BDR Election
The DR serves as a common point for all adjacencies on a multiaccess segment The BDR also maintains adjacencies with all routers in case the DR fails Election does not occur on point-to-point or multipoint links Default priority (0-255) is 1 Highest priority wins 0 cannot be elected In case of tie, Router with Highest Router ID wins election DR preemption will not occur unless the current DR is reset
- Virtual Links
Tunnel formed to join two areas across an intermediate Both end routers must share a common area At least one end must reside in area 0 Cannot traverse stub areas area 2 virtual-link 10.0.34.2
- Metric Formula
This can be modifiable with cmd:
ospf auto-cost reference-bandwidth
- To change route cost in OSPF:
ip ospf cost
- What is a Demand Circuit?
 This section is under construction.
|
Source: cisco.com
Demand circuit options were introduced for Open Shortest Path First (OSPF) in Cisco IOS® Software release 11.2 in response to the OSPF RFC 1793 leavingcisco.com. OSPF sends hellos every 10 seconds and refreshes its link-state advertisements (LSAs) every 30 minutes. These functions maintain neighbor relationships and ensure that the link-state databases are accurate and use far less bandwidth than similar functions in Routing Information Protocol (RIP) and Interior Gateway Routing Protocol (IGRP). However, even this amount of traffic is undesirable on demand circuits. Using OSPF demand circuit options suppresses hello and LSA refresh functions. OSPF can establish a demand link to form an adjacency and perform initial database synchronization, the adjacency remains active even after Layer 2 of the demand circuit goes down.
Cisco IOS version 12.1(2)T introduces the flooding reduction feature for OSPF. This feature is intended to minimize traffic created by a periodic refresh of LSAs in OSPF domains with large number of LSAs. Unlike the OSPF demand circuit feature, flooding reduction is usually configured on leased lines. Flooding reduction uses same technique as demand circuits to suppress the periodic LSA refresh. This feature is submitted for standardization into the IETF OSPF working group.
The main difference between flooding reduction and demand circuits is that former suppresses only periodic LSA refreshes; it does not suppress periodic hello packets. Thus, the flooding reduction feature does not impair the detection of a neighbor router going down.
ip ospf demand-circuit
- Only ABR & ASBR can do Summarization in OSPF. In EIGRP Summarization can be done anywhere.
- All Areas must connect to Area 0.
Area Summary
- Standard areas can contain LSAs of type 1, 2, 3, 4, and 5, and may contain an ASBR. The backbone is considered a standard area.
- Stub areas can contain type 1, 2, and 3 LSAs. A default route is substituted for external routes.
- Totally stubby areas can only contain type 1 and 2 LSAs, and a single type 3 LSA. The type 3 LSA describes a default route, substituted for all external and inter-area routes.
- Not-so-stubby areas implement stub or totally stubby functionality yet contain an ASBR. Type 7 LSAs generated by the ASBR are converted to type 5 by ABRs to be flooded to the rest of the OSPF domain.
LSA
- LSA Details:
| LSA type | Name | Description |
|---|---|---|
| Type 1 | Router LSAs | Sent from a router to other routers in the same area. It contains information regarding the routers interfaces in the same area, relevant interfaces IPs, its adjacent routers on those interfaces and sub networks |
| Type 2 | Network LSAs | Represents the pseudonode (designated router) for a multiaccess link. Generated by the DR on a multi access segment, and provides similar information to an LSA type 1 for the multi access segment and subnet which it belongs |
| Type 3 | Network Summary LSA | Generated by ABRs and contain the subnets & costs but omit the topological data from all subnets in one area and sent to another area via the ABR |
| Type 4 | ASBR summary LSA | Represents ASBRs and are identical in structure to a type 3 LSA and sent when crossing an AS boundary |
| Type 5 | AS external LSA | Originated by ASBRs and describe a route external to the OSPF domain |
| Type 7 | NSSA External LSA | Used in stub areas in place of a type 5 LSA. Generated by the ASBR in an NSSA area |
- LSA as per Areas[2]:-
Adjacency
- OSPF neighbor requirements:
- Router should be in same area
- Router should have same authentication config
- Router should be on same subnet
- Router have same hello/dead interval
- Router have matching stub flags
- Difference between Adjacency & Neighbor:
- Only Adjacent Routers can sync Link State DB
- Point-to-Point Links: If Neighbors, Adjcency automatically established
- Broadcast Link: Adjacency established with DR & BDR only, rest are in 2-way state[3]
- Point-to-Multipoint:_________
- Neighbor means Physical Connectivity(Direct)
- Adjacency means Database Syncronization
- Neighbor Requirements:
- Hello exchange => Subnet Mask, Subnet Number, Hello/Dead Interval, Area ID, Authentication must match.
- Exchange hellos but not LSAs(2-Way State).
- Adjacency Requirements:
- Exchange LSAs
- Both routers are in Stable(Full) State.
- Still final LSDB is same even in Neighbors as well as Adjacent routers.
Neighbor States[4]
| State | Details |
|---|---|
| 1. Down |
|
| 2. Attempt |
|
| 3. Init |
|
| 4. 2-Way |
|
| 5. ExStart |
|
| 6. Exchange |
|
| 7. Loading |
|
| 8. Full |
|
R&S Quick Notes
The Neighbor IP used with OSPF distance command is the Neighbors Router-ID.
“area range” summarize type 3 LSA’.
“summary-address” summarize type 5 & 7 LSA’s.
Auto-cost reference BW (Default = 100mb), formula = Ref-BW/Int-Bw.
Switches do no support the interface command “ip ospf {pid} area {area-id}” .
OSPF path selection: O > O*IA > O*E1 > O*E2.
Using E1 metric type : Packets will be routed out the closest exit point of the network.
Using E2 metric type : If you want packets to exit your network at the closest point to their external destination.
Don’t forget with hub and spoke topology, “ip ospf priority 0″.
PITFALL, when forbid to use RID, Loopbacks created later on might change the DR on you network after a reload.
PITFALL, when forbid to use RID, Later requested to configure the same loopback on two routers, could break your adjacencies, as two router cant peer with the same RID.
“no capability transit” – Mimics OSPFv1 behaviour for all data traffic to pass through Area-0.
“max-metric” – Configures OSPF stub configurations
“max-lsa” – Limit amount of non-local LSA’s
“timers throttle lsa all” – Slow down update rate.
“timers pacing lsa-group” – Group more LSA’s together in updates.
“no ip ospf flood-reduction” – Disables every 30-min LSA DB refresh.
“ip ospf database filter all out” – Breaks RFC, Stop sending LSA’s, but still receive LSA’s
Concept Recap
Protocol Number = 89, TTL=1, DES IP = 224.0.0.5 & 6
Network Types:
PTP:
No DR, BDR and ospf packets are sent to MC address.
Broadcast: (ethernet, token ring, FDDI)
DR, BDR election occurs and communicates using .5 and .6 address.
DR and BDR listen to .5 and .6 addresses.
NBMA network: (Frame relay, ATM)
Manual configuration of neighbors and DR/BDR.
All communication via unicast
Point to multipoint:
No DR and BDR. Neighbor statement not necessary.
Unicast
Virtual link:
Packets are unicast.
OSPF packet types:
Hello – type 1
Database description – type 2
LS request – type 3
LS update – type 4
LS ACK – type 5
To bring neighborship up, following fields should be matched:
Hello interval, Dead interval, area ID, network mask, option fields and authentication, if any
Neighborship will not form via secondary address. Other words, router will not generate hello packet with SRC IP = secondary IP.
DR/BDR election:
Highest Priority
Tie, highest router ID
Tie, highest interface address.
No preempt. So, first come will elect as DR, BDR, DRother. So, always start the router which has to be DR and then BDR and then other routers.
Priority=0 means ineligible to become DR/BDR.
When interface comes up, it sets DR,BDR to 0.0.0.0 and wait for ‘wait timer’= router dead interval. Within that period, if it receives hello with DR/BDR filled, accept those. Else if the time period elapse, move to BDR and then to DR.
Timers:
Default H=10 sec and D= 40 sec
InfTransDelay = 1 sec. change by “ip ospf transmit-delay’
RxmtInterval = 5 sec. Change by “ip ospf retramit-delay’
Neighbor state machine:
Down: at initial
Attempt: Only in NBMA
Init: Hello packet received. But couldn’t see our ID in its active neighbor list.
2-way:Could see our ID in neighbor list
Exstart: Start electing master/slave to exchange DBD packets. Highest router ID becomes master.
Exchange: exchange the LSA headers using DBD packets.
Loading: Syn the LSD using LS request and LS update. In real scenario, both Exchange and loading occurs parallel.
Full: Database was sync-ed.
DBD packet:
Have Interface MTU settings.
Initial(I) bit, More (M) bit and Master/Slave (MS) bit
First DBD packet sent with I/M/MS = 1/1/1 with seq =x
Neighbor sends DBD with I/M/MS = 1/1/1 with seq = y
After master selection, slave send DBD with I/M/MS = 0/1/0 with seq = master seq + 1.
Retransmission packets are always unicast.
Use stub concept and summarization to reduce memory and CPU utilization.
Sequence number, checksum and age uniquely defines as LSA:
Seq #:
From 0×80000001 to 0x7fffffff
If the seq# reaches 0x7ffffff, router flushes those LSA with age = MAXage.
Checksum:
Calculated entire LSA except age field.
Checksum is verified every 5 mins as it resides in LSD.
Age:
0 to 3600 (1 Hr-MaxAge)
Age increments when it resides in LSA and also incremented by ‘Infdelay’ value as it transits an interface.
Virtual Links:
Must be configured between 2 ABRs alone.
Transit area must have full routing information.
Transit area cannot be stub.
Usually it is the worst design and needs to be changed.
Can temporarily deploy to avoid partitioned area.
LSA types:
Router LSA:
Type-1. Generated by all routers with all active networks which has ospf configured.
Show ip ospf database router
LSAs are flooded within an area only.
Above command should have same output in all routers in an area. Seq #,checksum etc should be same.
Network LSA:
Type-2: Generated by the DR with network ID of the BC network.
Show ip ospf database network
No metric field as in router LSA.
LSAs are flooded within an area only.
N/w summary LSA:
Type-3: Generated by ABR to advertise the networks in another area.
If there are multiple routes to a destination, ABR advertise only the lowest cost route to its area along with cost metric.
Means, intra area routers use distance-vector protocol to know about inter-area routes.
Show ip ospf database summary
ASBR summary LSA:
Type-4; Same as summary LSA except the destination advertised by ABR is ASBR.
Show ip ospf database asbr-summary
AS external LSA:
Type-5; Advertise routes external to OSPF domain.
Typically redistribution of RIP, ISIS etc
Show ip ospf database external
Not associated with any area.
Group-Membership LSA:
Type-6; Used in MOSPF- multicast ospf
NSSA external LSA:
Type-7; originated by ASBR within NSSA
Show ip ospf database nssa-external
Flooded within NSSA region only.
ASBR can set/reset “P-bit” under “options field” of every LSA.
Only if NSSA-ABR receives type-7 LSA with P-bit set, it will translate into type-5 LSA and flood to other areas.
External Attribute LSA:
Type-8. Can be used as alternative to iBGP
Not deployed yet.
Opaque LSA:
Type- 9,10,11
Extension to OSPF. Used for TE in MPLS.
Areas:
Backbone area:
Area-0. Need for inter-area communication.
If there is only one area, no need for area-0
All types of LSAs except type-7 can be seen.
Stub area:
Single exist point for inter-area communication. But still can have more than one ABR.
Have info about OSPF domain areas. Both intra and inter-area routes.
No info about external (other domain) routes. Hence, ABR sends a default route.
Type-1,2 and 3 LSAs can be seen.
All the routers should have “E-bit” set to 0 in their hello packets to form adjacency.
Command: “area x stub”
Totally stubby area:
Router has info about its area alone. No info about inter-area routes.
Can see type-1, type-2 LSAs and single default route type-3 LSA by ABR.
Command: ‘area x stub no-summary’
NSSA:
Same property as stub area (not totally-stub area) with exception of allowing other domain routes as Lype-7 LSA.
No default route from ABR. (unless ‘default-info originate’ CLI configured where N2 default route (or) ‘area x nssa no-summary’ configured. In later, IA routes will not be available and default route has IA tag)
Can see Type-1,2,3,4 and type-7 LSAs.
Command: ‘area x nssa’.
Path types:
Intra-area paths
Inter-area paths. Denoted by “IA” in show ip route.
E1:
Cost = advertised by ASBR + cost to ASBR
E2:
Cost = advertised by ASBR. Enabled by default.
If there is only one ASBR in OSPF, there is no necessity of adding cost to ASBR. Hence E2 is default.
If there are more than on ASBR, enable E1.
Authentication:
No authentication: Type-0
Simple password: Type-1
MD5 password: Type-2
Few points:
Router LSA of ABR will have “B-bit” set in router-lsa packet
Router LSA of ASBR will have “E-bit” set in router-lsa packet
When NSSA ABR, translates type-7 LSA to type-5 LSA, it advertise with “Advertising Router” field set to its own router ID and it changes to ASBR. It could be confirmed by seeing “E” bit set in router LSA packet.
“Options field” in OSPF hello, DBD and every LSA: From MSB
DN – used in MPLS VPN. To detect loop.
O- Set to indicate routers’ opaque LSA support.
DC- OSPF over Demand circuit.
EA – external attribute support
N/P bit
N bit in hello: Set to indicate support for NSSA external LSAs. Mismatch will not bring adjacency
P-bit in NSSA external LSA header: to inform ABR to translate T-7 to T-5 LSAs.
MC – set to indicate multicast ospf capability
E – E bit=0 to indicate stub area.
MT – set to indicate Multi-topology OSPF support. Under development.
Troubleshooting point of view: few
Neighborship not coming UP:
Check for Hello packet parameter match
Network ID in correct area??
Access-list blocking OSPF packets??
Packet dropped on the way to CP incase if interface multicast count is incrementing??
Check Stub-area configuration?? Virtual link via stub area??
Neighborship UP but no advertised routes in database:
Enable debug and check for LSupdate packets.
Routes in OSPF database but not in routing table:
Routes via another protocol which has AD less than OSPFs??
One end of router has “ip ospf network PTP’ whereas other end router has default BC network type.
In case of external routes not installed in routing table, check whether the forwarding address is reachable. If not, configure ‘suppress-fa’ option at the NSSA ABR.
If an LSA has less age or high sequence number among others, we need to look for why this network was keep flapping and flooding updates. Might be reason for high CPU utilization.
Observations:
ABR with area-1 and area-2 only.
Routes from area-1 are not leaked into area-2 using type-3 network summary LSA.
Authentication:
Configure ‘ip ospf authentication’ to change to type-1. No user-defined password possible.
For loopback IP to become router-id either remove and reapply the ospf configuration or configure ‘router-id’ command.
DBD packet can have multiple LSA headers each can be of different type.(T1/T2)
When we change the network type to ‘point-point’, the interface will send a hello with DR,BDR =0 and no neighbor IDs in active neighbor field. This makes other end router to move to init.
In BC network: DBD, LS request and LS updates are exchanged via unicast. LS update (repeat) and LS ACK are sent to 224.0.0.5
In PTP, all communications via 224.0.0.5
Changing hello packet parameters (hello interval, dead interval etc) on one end makes the other end router to ignore those hello packets which has modified parameters.
Both side of router configured with priority =0 with default n/w type, they will stuck in 2way/DRother.
In an already existing stub network, if we change to totally stub, border router send an update with IA routes’ age= 3600 for flushing from database. Same as in ‘clear ip ospf process’
Redistributing RIP to ospf in a router which is inside a stub network:
“%OSPF-4-ASBR_WITHOUT_VALID_AREA: Router is currently an ASBR while having only one area which is a stub area”
Summarization has no effect of external routes (E1/E2).
LAB
Troubleshooting
- If OSPF is stuck in INIT State, check Netmask, Hello/Dead Timer, Area ID, Authentication password.
- On a shared/ethernet network, only 2 router, DR & BDR will form full relationship, all others will stay in 2-way state.[5]
- If OSPF is stuck in ExStart State, MTU mismatch may be the cause, as it is requirement to successfully pass DBD Packets.
Matching MTU is not a Adjacency Requirement, but is required to successfully pass Database Descriptor Packets
- In OSPF, MTU Mismatch causes neighbors swinging between ExStart state to Down state
Mar 1 00:10:09.535: %OSPF-5-ADJCHG: Process 1, Nbr 10.10.10.1 on Ethernet0/0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
Complete OSPF Lab
| This section is under construction.
|
References
{{#widget:DISQUS |id=networkm |uniqid=OSPF |url=https://aman.awiki.org/wiki/OSPF }}