Skip to main content

EIGRP - routing optimalization - part2

This is the second part of 'EIGRP - routing optimalization' series. Before reading this one, please review part 1 available here.

This is the network and as I said in part 1 I'm going to enable 'stub' feature to see what is the impact and how EIGRP works:


R5(config-router)#
R5(config-router)#router eigrp 100
R5(config-router)#eigrp stub
R5(config-router)#


The same configuration I add to R6, R9 and R10. The test I'm going to perform is the same from previous post. I shutdown 10.5.2.0/24 network and I check the query scope.


R5(config)#int loop2
R5(config-if)#sh
R5(config-if)#


R3#
*Feb 19 23:47:06.411: DUAL: AS(100) rcvquery: 10.5.2.0/24 via 8.1.7.5 metric 72057594037927935/72057594037927935, RD is 156160 for tid 0
*Feb 19 23:47:06.411: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 156160, RD is 156160 on tid 0
*Feb 19 23:47:06.415: EIGRP-IPv4(100):  8.1.7.5 metric 72057594037927935/72057594037927935 not found Dmin is 72057594037927935
*Feb 19 23:47:06.419: DUAL: AS(100) Peer total 2 stub 0 template 1 for tid 0
*Feb 19 23:47:06.423: DUAL: AS(100) Dest 10.5.2.0/24 entering active state for tid 0.
*Feb 19 23:47:06.423: EIGRP-IPv4(100): Set reply-status table. Count is 1.
*Feb 19 23:47:06.427: EIGRP-IPv4(100): Doing split horizon
R3# on FastEthernet1/0. Query stub suppressed
*Feb 19 23:47:06.431: DUAL: AS(100) Going from state 1 to state 3
*Feb 19 23:47:06.655: EIGRP-IPv4(100): dest(10.5.2.0/24) active
*Feb 19 23:47:06.659: EIGRP-IPv4(100): rcvreply: 10.5.2.0/24 via 8.1.6.1 metric 72057594037927935/72057594037927935 for tid 0
*Feb 19 23:47:06.659: EIGRP-IPv4(100): reply count is 1
*Feb 19 23:47:06.663: DUAL: AS(100) Clearing handle 0, count now 0
*Feb 19 23:47:06.663: DUAL: AS(100) Freeing reply status table
*Feb 19 23:47:06.667: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 72057594037927935, RD is 72057594037927935 on tid 0found
R3#
*Feb 19 23:47:06.671: DUAL: AS(100) Send REPLY(r1/n1) about 10.5.2.0/24 to 8.1.7.5 for tid 0
*Feb 19 23:47:06.675: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.6.1
*Feb 19 23:47:06.675: DUAL: AS(100) Send update about 10.5.2.0/24. Reason: rt net gone on tid 0
*Feb 19 23:47:06.679: DUAL: AS(100) Send update about 10.5.2.0/24. Reason: lost if on tid 0
*Feb 19 23:47:06.679: DUAL: AS(100) Going from state 3 to state 1
*Feb 19 23:47:06.731: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.7.5
R3#


R1#
*Feb 19 23:45:26.935: DUAL: AS(100) rcvquery: 10.5.2.0/24 via 8.1.6.3 metric 72057594037927935/72057594037927935, RD is 158720 for tid 0
*Feb 19 23:45:26.939: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 158720, RD is 158720 on tid 0
*Feb 19 23:45:26.943: EIGRP-IPv4(100):  8.1.6.3 metric 72057594037927935/72057594037927935 not found Dmin is 72057594037927935
*Feb 19 23:45:26.947: DUAL: AS(100) Peer total 3 stub 0 template 3 for tid 0
*Feb 19 23:45:26.947: DUAL: AS(100) Dest 10.5.2.0/24 entering active state for tid 0.
*Feb 19 23:45:26.951: EIGRP-IPv4(100): Set reply-status table. Count is 2.
*Feb 19 23:45:26.951: EIGRP-IPv4(100): Doing split horizon on FastEthernet0/0
*Feb 19 23:45:26.955: DUAL: AS(100) Going from state 1 to state 3
*Feb 19 23:45:27.039: EIGRP-IPv4(100): dest(10.5.2.0/24) active
*Feb 19 23:45:27.039: EIGRP-IPv4(100): rcvreply: 10.5.2.0/24 via 8.1.2.8 metric 72057594037927935/72057594037927935 for tid 0
*Feb 19 23:45:27.043: EIGRP-IPv4(100): reply c
R1#ount is 2
*Feb 19 23:45:27.047: DUAL: AS(100) Clearing handle 1, count now 1
*Feb 19 23:45:27.047: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.2.8
*Feb 19 23:45:27.099: EIGRP-IPv4(100): dest(10.5.2.0/24) active
*Feb 19 23:45:27.103: EIGRP-IPv4(100): rcvreply: 10.5.2.0/24 via 8.1.1.2 metric 72057594037927935/72057594037927935 for tid 0
*Feb 19 23:45:27.103: EIGRP-IPv4(100): reply count is 1
*Feb 19 23:45:27.107: DUAL: AS(100) Clearing handle 0, count now 0
*Feb 19 23:45:27.111: DUAL: AS(100) Freeing reply status table
*Feb 19 23:45:27.111: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 72057594037927935, RD is 72057594037927935 on tid 0found
*Feb 19 23:45:27.115: DUAL: AS(100) Send REPLY(r1/n1) about 10.5.2.0/24 to 8.1.6.3 for tid 0
*Feb 19 23:45:27.115: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.1.2
*Feb 19 23:45:27.115: DUAL: AS(100) Going from state 3 to state 1
*Feb 19 23:45:27.183: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.6.3
*Feb
R1#19 23:45:27.183: DUAL: AS(100) No routes.  Flushing dest 10.5.2.0/24
R1#



R2#
*Feb 19 23:47:06.747: DUAL: AS(100) rcvquery: 10.5.2.0/24 via 8.1.1.1 metric 72057594037927935/72057594037927935, RD is 161280 for tid 0
*Feb 19 23:47:06.751: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 161280, RD is 161280 on tid 0
*Feb 19 23:47:06.751: EIGRP-IPv4(100):  8.1.1.1 metric 72057594037927935/72057594037927935 not found Dmin is 72057594037927935
*Feb 19 23:47:06.755: DUAL: AS(100) Peer total 3 stub 0 template 3 for tid 0
*Feb 19 23:47:06.759: DUAL: AS(100) Dest 10.5.2.0/24 entering active state for tid 0.
*Feb 19 23:47:06.759: EIGRP-IPv4(100): Set reply-status table. Count is 2.
*Feb 19 23:47:06.759: EIGRP-IPv4(100): Doing split horizon on FastEthernet1/1
*Feb 19 23:47:06.759: DUAL: AS(100) Going from state 1 to state 3
*Feb 19 23:47:06.823: EIGRP-IPv4(100): dest(10.5.2.0/24) active
*Feb 19 23:47:06.827: EIGRP-IPv4(100): rcvreply: 10.5.2.0/24 via 8.1.8.4 metric 72057594037927935/72057594037927935 for tid 0
*Feb 19 23:47:06.827: EIGRP-IPv4(100): reply c
R2#ount is 2
*Feb 19 23:47:06.831: DUAL: AS(100) Clearing handle 2, count now 1
*Feb 19 23:47:06.831: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.8.4
*Feb 19 23:47:06.851: EIGRP-IPv4(100): dest(10.5.2.0/24) active
*Feb 19 23:47:06.851: EIGRP-IPv4(100): rcvreply: 10.5.2.0/24 via 8.1.4.7 metric 72057594037927935/72057594037927935 for tid 0
*Feb 19 23:47:06.851: EIGRP-IPv4(100): reply count is 1
*Feb 19 23:47:06.851: DUAL: AS(100) Clearing handle 1, count now 0
*Feb 19 23:47:06.851: DUAL: AS(100) Freeing reply status table
*Feb 19 23:47:06.851: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 72057594037927935, RD is 72057594037927935 on tid 0found
*Feb 19 23:47:06.851: DUAL: AS(100) Send REPLY(r1/n1) about 10.5.2.0/24 to 8.1.1.1 for tid 0
*Feb 19 23:47:06.855: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.4.7
*Feb 19 23:47:06.855: DUAL: AS(100) Going from state 3 to state 1
*Feb 19 23:47:06.899: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.1.1
*Feb
R2#19 23:47:06.899: DUAL: AS(100) No routes.  Flushing dest 10.5.2.0/24
R2#


R8#
*Feb 19 23:46:57.135: DUAL: AS(100) rcvquery: 10.5.2.0/24 via 8.1.2.1 metric 72057594037927935/72057594037927935, RD is 161280 for tid 0
*Feb 19 23:46:57.135: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 161280, RD is 161280 on tid 0
*Feb 19 23:46:57.139: EIGRP-IPv4(100):  8.1.2.1 metric 72057594037927935/72057594037927935 not found Dmin is 72057594037927935
*Feb 19 23:46:57.143: DUAL: AS(100) Peer total 2 stub 0 template 1 for tid 0
*Feb 19 23:46:57.147: DUAL: AS(100) Dest 10.5.2.0/24 (Split Horizon) not entering active state for tid 0.
*Feb 19 23:46:57.147: DUAL: AS(100) Send REPLY(r1/n1) about 10.5.2.0/24 to 8.1.2.1 for tid 0
*Feb 19 23:46:57.147: DUAL: AS(100) Send update about 10.5.2.0/24. Reason: rt net gone on tid 0
*Feb 19 23:46:57.151: DUAL: AS(100) Send update about 10.5.2.0/24. Reason: lost if on tid 0
*Feb 19 23:46:57.235: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.2.1
*Feb 19 23:46:57.255: DUAL: AS(100) No routes.  Flushing dest 10.5.2.0/24
*
R8#Feb 19 23:46:57.267: EIGRP-IPv4(100): dest(10.5.2.0/24) not active
*Feb 19 23:46:57.267: DUAL: AS(100) rcvquery: 10.5.2.0/24 via 8.1.3.9 metric 72057594037927935/72057594037927935, RD is 72057594037927935 for tid 0
*Feb 19 23:46:57.271: DUAL: AS(100) Send REPLY(r1/n1) about 10.5.2.0/24 to 8.1.3.9 for tid 0
*Feb 19 23:46:57.299: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.3.9
*Feb 19 23:46:57.303: DUAL: AS(100) No routes.  Flushing dest 10.5.2.0/24
R8#


R9#
*Feb 19 23:47:07.263: EIGRP-IPv4(100): rcvupdate: 10.5.2.0/24 via 8.1.3.8 metric 72057594037927935/72057594037927935 on tid 0
*Feb 19 23:47:07.263: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 163840, RD is 163840 on tid 0
*Feb 19 23:47:07.267: EIGRP-IPv4(100):  8.1.3.8 metric 72057594037927935/72057594037927935 not found Dmin is 72057594037927935
*Feb 19 23:47:07.271: DUAL: AS(100) Peer total 1 stub 0 template 1 for tid 0
*Feb 19 23:47:07.275: DUAL: AS(100) Dest 10.5.2.0/24 entering active state for tid 0.
*Feb 19 23:47:07.275: EIGRP-IPv4(100): Set reply-status table. Count is 1.
*Feb 19 23:47:07.275: EIGRP-IPv4(100): Not doing split horizon
R9#
*Feb 19 23:47:07.331: EIGRP-IPv4(100): rcvreply: 10.5.2.0/24 via 8.1.3.8 metric 72057594037927935/72057594037927935 for tid 0
*Feb 19 23:47:07.331: EIGRP-IPv4(100): reply count is 1
*Feb 19 23:47:07.335: DUAL: AS(100) Clearing handle 0, count now 0
*Feb 19 23:47:07.335: DUAL: AS(100) Freeing reply status table
*Feb 19 23:47:07.339: EIGRP-IPv4(100): Find FS for dest 10.5.2.0/24. FD is 72057594037927935, RD is 72057594037927935 on tid 0found
*Feb 19 23:47:07.339: DUAL: AS(100) Removing dest 10.5.2.0/24, nexthop 8.1.3.8
*Feb 19 23:47:07.343: DUAL: AS(100) No routes.  Flushing dest 10.5.2.0/24
R9#



As you can see R8 didn't send query to the R9. It received only rcvupdate. When you check EIGRP neighbor details you see R8 recognizes R9 as a stub router:

R8#sh ip eigrp neighbors detail
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
1   8.1.3.9                 Fa0/0                    11 00:10:51   28   168  0  37
   Version 11.0/2.0, Retrans: 0, Retries: 0, Prefixes: 5
   Topology-ids from peer - 0
   Stub Peer Advertising (CONNECTED SUMMARY ) Routes
   Suppressing queries

0   8.1.2.1                 Fa1/0                    14 02:55:59   31   186  0  156
   Time since Restart 01:02:27
   Version 11.0/2.0, Retrans: 2, Retries: 0, Prefixes: 13
   Topology-ids from peer - 0
R8#
 


There are some limitation you should be aware of while implementing stub feature. Let's try to increase resiliency by adding 2nd router (R11) to the site with stub feature enabled. R12 will simulate end host.



R5 and R11 are stub routers and let's check if we can ping 10.9.3.0/24 from R12:

R12#ping 10.9.5.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.9.5.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R12#



The problem is R12 can see only 'connected' IP addresses of R5/R11:

R12#sh ip route eigrp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      8.0.0.0/24 is subnetted, 2 subnets
D        8.1.7.0 [90/30720] via 10.5.2.5, 00:00:55, FastEthernet0/0
D        8.1.10.0 [90/30720] via 10.5.2.11, 00:00:55, FastEthernet0/0
R12#


So, we can see R12 can't learn nothing else from stub neighbors. What about static route?

When I set a static route to one of these stub routers I can ping 10.9.5.1:

R12(config)#ip route 0.0.0.0 0.0.0.0 10.5.2.5
R12(config)#end
R12#
R12#ping 10.9.5.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.9.5.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/63/108 ms
R12#


Can we set HSRP on those stub routers to make this solution more dynamic? If yes, it would solve our problem with redundant path. Let's try:

R11(config-if)#standby ip 10.5.2.100
R11(config-if)#standby ip 10.5.2.101 secondary

R5(config-if)#standby ip 10.5.2.100
R5(config-if)#standby ip 10.5.2.101 secondary

R12(config)#no ip route 0.0.0.0 0.0.0.0 10.5.2.5
R12(config)#ip route 0.0.0.0 0.0.0.0 10.5.2.100





I can see I can ping now:

R12#ping 10.9.5.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.9.5.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/60/64 ms
R12#

Let's do one more test, shutdown the active HSRP interface to see what happens:

R11(config)#int fa2/1
R11(config-if)#sh
R11(config-if)#
*Feb 20 01:08:21.071: %HSRP-5-STATECHANGE: FastEthernet2/1 Grp 0 state Active -> Init
*Feb 20 01:08:21.123: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.5.2.12 (FastEthernet2/1) is down: interface down
*Feb 20 01:08:21.159: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.5.2.5 (FastEthernet2/1) is down: interface down
R11(config-if)#
*Feb 20 01:08:23.059: %LINK-5-CHANGED: Interface FastEthernet2/1, changed state to administratively down
*Feb 20 01:08:24.059: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet2/1, changed state to down
R11(config-if)#


We can see the standby took over the Active role:

R5#
*Feb 20 00:40:39.559: %HSRP-5-STATECHANGE: FastEthernet2/1 Grp 0 state Standby -> Active
R5#
*Feb 20 00:40:52.715: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.5.2.11 (FastEthernet2/1) is down: holding time expired
R5#


During this test I lost only one packet:

R12#ping 10.9.5.1 repeat 2147483647
Type escape sequence to abort.
Sending 2147483647, 100-byte ICMP Echos to 10.9.5.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!





Summary:

- query scope can be controlled by summarization and stub feature
- route summarization needs to be implemented in both direction (for example: summary to the core and default gateway to the branch)
- stub router can advertise only limited types of routes to its neighbor:

R11(config-router)#eigrp stub ?
  connected      Do advertise connected routes
  leak-map       Allow dynamic prefixes based on the leak-map
  receive-only   Set receive only neighbor
  redistributed  Do advertise redistributed routes
  static         Do advertise static routes
  summary        Do advertise summary routes
  <cr>

R11(config-router)#


- everything what is attached to stub (behind) requires static route to reach next hop as stub device won't advertise anything else except connected, static, etc. (depending on parameter you chose).

In next post I'm planning to test more failure scenarios.

Comments

Popular posts from this blog

What should you know about HA 'override enabled' setting on Fortigate?

High availability is mandatory in most of today's network designs. Only very small companies or branches can run their business without redundancy. When you have Fortigate firewall in your network you have many options to increase network availability. You can use Fortigate Clustering Protocol ( FGCP ) or Virtual Router Redundancy Protocol ( VRRP ). FGCP has two modes: 'override' disabled (default) and 'override' enabled . I'm not going to explain how to set up HA as you can find many resources on Fortinet websites: https://cookbook.fortinet.com/high-availability-two-fortigates-56/ https://cookbook.fortinet.com/high-availability-with-fgcp-56/ Let's recap what is the main difference between them. The default HA setting is 'override' disabled and this is an order of selection an active unit: 1) number of monitored interfaces - when both units have the same number of working (up) interfaces check next parameter 2) HA uptime - an

MAC Authentication Bypass

One of the method to control your network is using MAB feature. It is helpful in case you have devices without dot1x functionality. Today I will try to implement basic configuration and analyze log messages. There is only one switch SW1 and one device attached to port Fa1/0/2.   ! aaa new - model aaa authentication dot1x default group radius ! ! int Fas1 / 0 / 2 authentication host - mode single - host authentication port - control auto mab ! I haven’t configured ACS yet but let’s see what error message I receive:   SW1 ( config - if ) # mab - ev ( Fa1 / 0 / 2 ): Received MAB context create from AuthMgr mab - ev ( Fa1 / 0 / 2 ): Created MAB client context 0x1100000F mab : initial state mab_initialize has enter mab - ev ( Fa1 / 0 / 2 ): Sending create new context event to EAP from MAB for 0x1100000F ( 0000.0000 . 0000 ) mab - sm ( Fa1 / 0 / 2 ): Received event 'MAB_START' on handle 0x1100000F mab : during state mab_initia

Inpection of asymmetric sessions on FortiGate

There is one feature available on FortiGate, and I think you should know it, as it modifies a bit what we know about stateful firewalls. In past every packet was treated individually and you had to create policies in both directions. With stateful firewalls we can track connections, and by checking couple of attributes, we can treat them as part of the same session. For example when you initiate connection from a host1 to host2, the returning connection from host2 to host1 will be treated as part of the same connection (session). They have to have the same source/destination and destination/source IPs, port numbers and interfaces.There is an exception from this rule and FortiGate in some specific cases can accept connections on port which was not used in the initial connection. Let me explain how it works on the below example:      The host1 has a default gateway on R1 (10.0.1.2), but you may notice that it is not the optimal path to host2 subnet. When we analyze the packet flo