Thursday, August 21, 2014

OSPF – Open Shortest Path First



Open Shortest Path First is a routing protocol for Internet Protocols networks by Interior Gateway Protocol. In mid- 1980s RIP (Routing Information Protocol) was increasingly incapable of serving large, diverse network, for that Internet Engineering Task Force created OSPF based on shortest Path First (SPF) algorithm  
If there are several routers in network, OSPF build a table of the router connection. When data is send from one location to another, SPF or Dijkstra algorithm compares the available options and chooses the most efficient way for the data to be sent. This limits the unnecessary delays in data transmission and prevents infinite loops.

Why OSPF?
Compared to other protocols for routing, there are major reasons to select OSPF. Firstly, there is ease of configuration and availability in a wide range of routers, most routers support it as it is an open standard. As it is link-state route protocol used for allowing routers to learn routes dynamically from other router types and for advertising the route it finds to other router type as well. OSPF is a link-state routing protocol that calls for the sending of link-state advertisement (LSAs) which is summarized route information to all other routers within the same hierarchical area.
OSPF uses “Cost” as the value of metric and uses a Reference Bandwidth of 100 Mbps for cost calculation.
The formula to calculate the cost is Reference Bandwidth divided by Interface Bandwidth. For example, in the case of 10 Mbps Ethernet,
                                OSPF metric cost value is 100 Mbps/ 10 Mbps = 10.
Following table lists OSPF default cost values for some common interface bandwidth,
Bandwidth
OSPF Cost
100 Gbps
1
40 Gbps
1
10 Gbps
1
1 Gbps
1
100 Mbps
1
10 Mbps
10
1.544 Mbps
64
128 Kbps
781


OSPF Basic Operation:
  1. OSPF sends Hello Packets out of all OSPF-enabled interfaces. If certain parameters in Hello Packets match between the neighboring routers then they form the relationship called the Adjacency.
  2. Then each router exchange special packets called Link State Advertisements contain details such as address/network masks configured on the link, the metric, the state of link (which is its relation to the rest of network), list of neighbors connected.
  3. Each router stores the LSAs in its Link State Database (LSDB).
  4. Each router runs Dijkstra algorithm to select the best path with loop free using LSDB. The best path stores in routing table.

An OSPF network is divided into areas that are logical groupings of host and networks.
  • Backbone Area – The backbone area (known as area 0) forms the core of an OSPF network. All other areas are connected to it and inter-area routing happens via routers connected to the backbone area and to their own associated areas.
  • Stub Area - A stub area is an area which does not receive route advertisements external to the AS (Autonomous System-a collection of OSPF areas amongst which OSPF routing information is shared) and routing from within the area is based entirely on a default route of 0.0.0.0.
  • Not-So-Stubby Areas – These areas are derived from the OSPF stub areas. The motivation behind is to allow OSPF Stub areas to carry external routes (routes learned using other routing protocols like RIP, EIGRP, BGP etc).
  • Totally Stubby Area – Totally Stubby Areas protect internal routes by minimizing the routing table and summarizing everything outside the area with a default route. This is a proprietary Cisco solution. It keeps the topological databases and routing table as small as possible.
OSPF router Types:
When an OSPF AS is divided into areas, the routers are classified by one or more of categories defined in table,
Router Type
Description
Internal Router
A router with all interfaces connected to the same area. Internal routers each have a single LSDB.
Area Border Router (ABR)
A router with interfaces connected to different areas. ABRs have multiple LSDBs, one for each attached area.
Backbone Router
A router with an interface on the backbone area. This includes all ABRs and internal routers of the backbone area.
AS Boundary Router(ASBR)
A router that exchanges routes with sources outside of the OSPF AS. ASBRs advertise external routes throughout the OSPF AS.

 Based on the network type, OSPF router can elect one router to be a Designated Router (DR) and one router to be a Backup Designated Router (BDR). For example, on multi-access broadcast networks (Such as LANs) routers defaults to elect a DR and BDR. DR and BDR serve as the central point for exchanging OSPF routing information. Non-BDR router will exchange routing information with the DR and BDR. Instead of exchanging updates with every router on the network segment, DR will distribute topology information to every router. This greatly reduces OSPF traffic.
 
For more, please visit my youtube channel -https://www.youtube.com/user/showkat

Wednesday, June 11, 2014

SSH should replace Telnet for management connections


Device
Interface
IP Address
Subnet Mask
S1
VLAN 1
10.10.10.2
255.255.255.0
PC1
NIC
10.10.10.10
255.255.255.0

SSH should replace Telnet for management connections. Telnet uses insecure plain text communications. SSH provides security for remote connections by providing strong encryption of all transmitted data between devices. In this activity, you will secure a remote switch with password encryption and SSH.

As we already have telnet connection, so firstly we are going to connect by telnet through PC1 to S1 for changing the switch configuration telnet to ssh access.

From PC1 command prompt telnet to S1 vlan IP:

PC>telnet 10.10.10.2
Trying 10.10.10.2 ...Open
User Access Verification
Password:
S1>enable
Password:
S1#

Configure the domain name to nrt.com:

S1#conf t
S1(config)#ip domain-name nrt.com

Secure keys are needed to encrypt the data. Generate the RSA keys using a 1024 key length:

S1(config)#crypto key generate rsa
The name for the keys will be: S1.nrt.com
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

Create an SSH user and reconfigure the VTY lines for SSH-only access:

S1(config)#username administrator password sshlogin
S1(config)#service password-encryption

Configure the VTY lines to check the local username database for login credentials and to only allow SSH for remote access. Remove the existing vty line password:

S1(config)#line vty 0 15
S1(config-line)#login local
S1(config-line)#no password
S1(config-line)#transport input ssh

  Exit the Telnet session and attempt to log back in using Telnet. The attempt should fail. Attempt to log in using SSH with below command at PC1 command prompt (Password- sshlogin).

PC>ssh -l administrator 10.10.10.2
Open
Password:

Port Security by MAC Address Sticky

Device
Interface
IP Address
Subnet Mask
S1
VLAN 1
10.10.10.2
255.255.255.0
PC1
NIC
10.10.10.10
255.255.255.0
PC2
NIC
10.10.10.11
255.255.255.0
Rogue Laptop
NIC
10.10.10.12
255.255.255.0

Port security allows you to restrict a port’s ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port.

MAC address sticky configuration at Interface Fast Ethernet 0/1 end where PC1 MAC address will sticky:

S1#conf t
S1(config)#interface fastEthernet 0/1
S1(config-if-range)#switchport port-security
S1(config-if-range)#switchport port-security maximum 1
S1(config-if-range)#switchport port-security mac-address sticky
S1(config-if-range)#switchport port-security mac-address 00E0.B027.2245
S1(config-if-range)#switchport port-security violation restrict

MAC address sticky configuration at Interface Fast Ethernet 0/2 end where PC2 MAC address will sticky:

S1#conf t
S1(config)#interface fastEthernet 0/2
S1(config-if-range)#switchport port-security
S1(config-if-range)#switchport port-security maximum 1
S1(config-if-range)#switchport port-security mac-address sticky
S1(config-if-range)#switchport port-security mac-address 0001.647C.697E
S1(config-if-range)#switchport port-security violation restrict

Disconnect PC2 and connect Rogue Laptop to PC2’s port. Verify that Rogue Laptop is unable to ping PC1.
Disconnect Rouge Laptop and reconnect PC2. Verify PC2can ping PC1.


Configuring Telnet for accessing remotely from a PC to Switch end



Firstly connect PC0 & Switch through console cable, then login Switch by Terminal from PCO.


Switch end configuration:
Switch#conf t
Switch(config)#vlan 10
Switch(config-vlan)#exit
Switch(config)#int vlan 10
Switch(config-if)#ip address 192.168.1.1 255.255.255.0
Switch(config-if)#exit
Switch(config)#enable password telnet123
Switch(config)#line vty 0 4
Switch(config-line)#password telnet321
Switch(config-line)#login

Switch(config)#int fa0/1
Switch(config)#no shut
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
Switch#copy running-config startup-config

Assign IP at PC1 as shown in below,


From PC1 end using command prompt login to Switch as below,
PC>telnet 192.168.1.1
Trying 192.168.1.1 ...Open
User Access Verification

Password:
Switch>enable
Password:
From Switch end you can check which line user currently login by telnet as below command,
Switch# show users

Configuring PVST


Enable the user ports on S1, S2, and S3 in access mode.

S1#conf t
S1(config)# int fa0/6
S1(config-if)#no shut
S1(config-if)#switchport mode access

S2#conf t
S2(config)# int fa0/18
S2(config-if)#no shut
S2(config-if)#switchport mode access

S3#conf t
S3(config)# int fa0/11
S3(config-if)#no shut
S3(config-if)#switchport mode access

Create VLANs.

S1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
S1(config)#vlan 10
S1(config-vlan)#vlan 20
S1(config-vlan)#vlan 30
S1(config-vlan)#vlan 40
S1(config-vlan)#vlan 50
S1(config-vlan)#vlan 60
S1(config-vlan)#vlan 70
S1(config-vlan)#vlan 80
S1(config-vlan)#vlan 99

Using above command create VLANs for S2 & S3.

  Assign VLANs & IP Address to switch ports.

S1(config)#int fa0/6
S1(config-if)#switchport access vlan 30
S1(config)#int vlan 30
S1(config-if)#ip address 172.17.30.1 255.255.255.0

S2(config)#int fa0/18
S2(config-if)#switchport access vlan 20
S2(config)#int vlan 20
S2(config-if)#ip address 172.17.20.1 255.255.255.0

S3(config)#int fa0/11
S3(config-if)#switchport access vlan 10
S3(config)#int vlan 10
S3(config-if)#ip address 172.17.10.1 255.255.255.0

Assign the trunks to native VLAN 99 for all SWs ports F0/1 to F0/4.

S1(config)#int range fa0/1-4
S1(config-if-range)#switchport mode trunk
S1(config-if-range)#switchport trunk native vlan 99
S1(config-if-range)#exit
S1(config)#int vlan 99

S1(config-if)#ip address 172.31.99.1 255.255.255.0
S2(config)#int range fa0/1-4
S2(config-if-range)#switchport mode trunk
S2(config-if-range)#switchport trunk native vlan 99
S2(config-if-range)#exit
S2(config)#int vlan 99
S2(config-if)#ip address 172.31.99.2 255.255.255.0

S3(config)#int range fa0/1-4
S3(config-if-range)#switchport mode trunk
S3(config-if-range)#switchport trunk native vlan 99
S3(config-if-range)#exit
S3(config)#int vlan 99
S3(config-if)#ip address 172.31.99.3 255.255.255.0

Configure STP mode.

 Configure S1 to be the primary root for VLANs 1, 10, 30, 50, and 70. Configure S3 to be the primary root for VLANs 20, 40, 60, 80, and 99. Configure S2 to be the secondary root for all VLANs

S1(config)#spanning-tree mode pvst
S1(config)#spanning-tree vlan 1,10,30,50,70 root primary
S3(config)#spanning-tree mode pvst
S3(config)#spanning-tree vlan 20,40,60,80,99 root  primary
S3(config)#spanning-tree mode pvst
S2(config)# spanning-tree vlan 1,10,20,30,40,50,60,70,80,99 root secondary

 Configure PortFast on the switches.

S1(config-if)#spanning-tree portfast

Configure BPDU guard on the switches.


S1(config-if)#spanning-tree bpduguard enable