Ugrás a fő tartalomra

CCIE SP v5.x Lerning journey #xxxxx3 Deep Dive of IGPs: OSPF part 1

 Everything what you do not want know about the OSPF!

In a Service Provider network, one of the most important part is the IGP (Interior Gateway Protocol). Why? Because the network core convergence and routing strategy is depend on the IGP routing rules. If the IGP can not support some features what  are needed for the traffic engineering, it could be a  future operation or development problem.
So SPs select IGPs which are satisfy every operational and business needs, and it will be a future proof protocol.

Star Wars Yoda Meme - Imgflip

Many of service providers typically choose OSPF or ISIS for IGP, because:

- they are RFC and ITU-T conform, vendor independent protocols (in general)

- they support MPLS traffic engineering features (OSPF opaque LSA 10 11)

- link-state routing protocols, which means  that these can provide faster convergence than vector-path or distance vector protocols, and they are more scalable.

What is OSPF?

 OSPF (Open Shortest Path First) protocol is a dynamic link-state based routing protocol, which is responsible to select the shortest path from the OSPF database and inject it to the routing table. The SPF algorithm (Dijkstra's algorithm) is used by OSPF for the path cost calculation. Based on  path cost  (and other OSPF parameters) the router can select the shortest route and make forwarding decision to route the packet to the next-hop router or ip address.

History

OSPF (Open Shortest Path First) protocol is started to develop by the IETF in 1987. OSPFv1 was standardized by RFC 1131 and first implementation  was designed for UNIX workstation and routers. OSFPv1 did not support classless routing and VLSM. 

OSPFv2 released in RFC 1247 and it design for CIDR and VLSM.

OSPFv2 updated by RFC 2178 and the last RFC is 2328 at 1998.

Many newer RFC update the basics of OSPFv2 which means that the OSPFv3 does not obsolete the OSPFv2 and the the versions are not compatible with each other.

The following updates and expansions are available from the IETF:

https://datatracker.ietf.org/doc/html/rfc1587

https://datatracker.ietf.org/doc/html/rfc3101

https://www.rfc-editor.org/rfc/rfc6845

https://www.rfc-editor.org/rfc/rfc6860

https://www.rfc-editor.org/rfc/rfc7474

https://www.rfc-editor.org/rfc/rfc8042

https://www.rfc-editor.org/rfc/rfc9355

https://www.rfc-editor.org/rfc/rfc9454

https://www.rfc-editor.org/rfc/rfc6549

https://www.rfc-editor.org/rfc/rfc5709

They are really interesting reads about the protocol updates (not really), so if somebody interested in bit and byte fucking they can read more about that.

Classic early computer show | Bits and Bytes Episode 1: Getting Started  1983 - YouTube

Why is important to know these RFCs to CCIE exam?

Because there is huge difference in IOS-XE and IOS-XR OSPF implementation. Since XE based routers from IOS 15.7 release implemented by the RFC 3101 and IOS-XR platform still use the RFC1587. What does it mean it human language?

For the answer we know more about OSPF path selection.

OSPF path selection

OSPF basically select the lowest cost metric prefix. It is not really true, because the path selection method is gonna be the following:

- longest prefix match  (actually it is a basic router function not specific for OSPF)

-  type of OSPF route

- cost metric (lasr)

OSPF route types are the following:

O          - Intra-Area

O IA     - Inter-Area

E1        - External Type 1

N1        -NSSA Type 1

E2        -External Type 2

N2        -NSSA Type 2

In RFC 1587 the route preference is the following:
O>O IA>E1>N1>E2>N2

In RFC 3101 the NSSA routes are better than external routes:
O>O IA>N1>E1>N2>E2

Now you see how the stronger dog (OSPF type) validate the right for the love :)

Is it easy? Not sure! For understand the type of OSPFv2 routes you need to understand concept of areas and area types.

What is OSPF Area?

Areas can help to reduce the OSPF Link State DataBase (LSDB)  in a regular area. OSPF routers know details about their network topology which are connected in the same routing domain (area). The routers do not have detailed information from outside of the topology. The LSDB must be synchronized between the routers which are belong to the same area. Based on the topology there are 5 type of areas can be differentiated:

 - normal / general area

 - backbone area (0 or 0.0.0.0)
   It is an special area which responsible to connect the other areas each other.

 - stub area

 - totally stub area

 - not so stub area

 - totally not so stub area

Based on the router position in the area topology the routers can be:

- regular routers

- DRs       - Designated Routers

- BDRs     - Backup Designated Routers

Routers in a topology are typically connected to the same ospf area on point-to-point links, if the network type is not configured, the automatic type is going to be broadcast in a case of Ethernet interface, which means that OSPF DR/BDR election can be happened during the adjacency process.

Adjacency process should be the following:

DOWN

INIT

EXTSTART

EXCHANGE

2WAY

LOADING

FULL

In a case of broadcast network type the OSPF neighbor adjacency state could be FULL/DR or FULL/BDR. OSPF adjacency state can be checked by show ip ospf neighbor (ios-xe) show ospf neighbor (ios-xr).  DR election is based on the OSPF router-id, the highest id will be the DR, the second highest will be the BDR. In an real broadcast segment only the with DR and BDR router could be in FULL state with other routers. Other adjacency is going to be 2WAY/DROTHER or EXCHANGE/DROTHER, because only the DR will (in case network failure BDR) is going to flood the LSAs in the OSPF area with LSU packet, so the FULL adjacency is need for these two boss.


- ABRs     - Area Border Routers

-ASBRs    - Autonomus System Boundary Routers


Based on the OSPF connection (adjacency) topology the network type can be:

- broadcast

- non broadcast

- point-to-point

- point-to-multi-point

- point-to-multi-point non broadcast

And finally the LSDB contain the prefix information from the areas which is advertised by the routers with LSA packet (Link-State Advertisement) 

The following OSPFv2 LSA are:

- Type 1  - Router LSA

Its deliver detailed information the 

- Type 2 - Network LSA

- Type 3 - Summary LSA

- Type 4 - Summary ASBR

- Type 5 - AS external LSA 

- Type 6 - Multicast OSPF LSA

- Type 7 - NSSA LSA

- Type 8 - External attribute

Opaque

- Type 9 - Link Scope / Intra Area LSA

- Type 10 - Area Scope

- Type 11 - AS Scope

Ok! How the OSPF areas are work, what these stuffs mean?

First we need to understand which LSA responsible for which data. Start with LSA1

LSA1  the router LSA is update from detailed information about the OSPF router connected interfaces. In case of OSPF routers which are belongs to the same regular / normal area LSA1 is going to flooded to all router. LSA1 contain the router own interfaces and the carries information about the neighbors to adjacent router in the same area. LSA1 is not leave the area.


LSA2 Network LSAs generated by the DR to describe all routers to its segment directly. LSA2 packet will be  flooded between the neighbors in the same area of origin and remain with that area.


 LSA3 is a summary LSA which is generated by ABRs and advertise an inter-area router information to the other areas. ABR generate a summary prefix from the area routes. LSA3 is flooded through the areas.

LSA4 ASBR Summary LSA is generated an AS Boundary Router which connected an external routing domain and redistribute the prefixes to OSPF, the Type LSA is represent the sense of ASBR Router connected networks.

 

 LSA5 ASBR external LSA is responsible for the prefixes which are redistributed from an external routing protocol.

 

LSA6 Multicast LSA is not implemented on Cisco Routers, it is deprecated.

LSA7 is special nssa area LSA which is exactly has the same function that LSA5 but in this case the ASBR router is in the nssa area.

 

LSA8 is External Attribute LSA which can be used to carrying BGP attribute information, actually it is not supported most of the routers. BGP destinations actually converted to Type 5.

LSA9 Links Scope Opaque in OSPFv3 carries a special stub information.

LSA10 can extend OSPF function like traffic-engineering information

LSA11 is the function as 10 but it can be flooded in stub areas.

Oh my gosh! Is it still not the end? No! But actually I am tired so... see you in the next post...


Érdekesebb bejegyzések

FortiGate - SEC előfizetésen túl

Végre megvan az új NGFW a cégben, megvettétek 3 vagy 5 éves enterprise vagy utp bundle-ben és biztonságban érzitek magatok (Szárazabb, magabiztosabb érzés nem?), hiszen van IPS , webfilter, antivirus stb... security profile, ami megvédhet az ismert támadásokkal szemben. Nyugodtan "hátradőltök" és készítitek az auditokhoz szükséges riportokat a FortiAnalyzerből... biztonságban eltelik az 5 év és "váratlanul ér" előfizetés megújítása, nincs budget, pánikolva néztek valamilyen alternatív alsópolcos megoldást, amit még be tudtok szerezni és kidobnátok a jó hardvert, ami éveken keresztül stabilan szolgált titeket... Ne tegyétek! Mutatom milyen feature-ket használhattok tovább ingyen: Persze az alábbi megoldások nem minden végfelhasználónak jelentenek megoldást a problémákra és kihívásokra, de KKV szektorbnan vagy olyan esetekben, ahol nem szükséges IPS, anitvirus, webfilter, még jól használhatók tovább ezek a hardverek/szoftverek előfizetések nélkül. Fontos, ha egyébként...

CCIE #69065 - SRv6, most már tényleg átállunk IPv6-ra?

Röviden: NEM Hosszabban: Nem egészen, a teljes IPv6 átálláshoz nem elegendő csak a hálózat eszközök (több mint 10 éve meglévő) képességeit kihasználni, hanem ehhez a teljes informatikai iparágnak kellene paradigmaváltáson átmenni, ami azt jelenti, hogy a felhasználói (business és consumer) alkalmazásoknak minden kétséget kizáróan nagy rendelkezésre állással kellene támogatni a TCP/IPv6 stack-et (sok helyen tapasztaltam, hogy még a TCPv4-et sem sikerült minden kétséget kizáróan jól implementálni, de még operációs rendszerek szintjén sem). Viszont a szolgáltatók a publikus IPv4 kifogyást megelőzendő a szolgáltatói környezetet már migrálhatják IPv6-os hálózatra, ami megfordíthatja a korábbi, IPv6 over IPv4 (MPLS vPE6) vagy dual-stack (Internet) architektúrát  akár natív  IPv4 over IPv6 (SRv6) jellegű felállásra. A teljes képhez sok mindent tisztába kellene tenni, de élek az alkotói szabadsággal és úgy vagyok vele, hogy nem célom most itt mindenkit telekommunikációs mérnökké avanz...

Fortinet minősítési rendszer változások - avagy a FortiThanos lecsap

 A Fortinet bizonyos időszakonként megváltoztatja a vizsga rendszerét és minősítési rendszerét...  Amikor 2018-ban elkezdtem foglalkozni a Fortinet Network Security megoldásaival, akkor még "lázasan" NSE4 vizsgára készültem, ami FortiGate alapok mellett néhány advanced témát is érintett.  Ekkor már átesett a Fortinet egy vizsgarendszer átalakításon, és korábban FCNSP (Fortinet Certified Network Security Professional) minősítések lettek NSE4 minősítéssé. Még ebben az időszakban terveztem tovább lépni NSE7 szintre, ami akkor egy vizsgával megléphető volt aztán bummm! Jött a vizsgarendszer átalakítása és a korábban NSE1 - 8 minősítések új rendszerbe kerültek.. Az NSE1 - 3 -ből lett a az FCF ás FCA azaz Foundamental és Associate minősítések (ezek online elvégezhető tanfolyamok és nem proctored vizsgák) NSE4 + NSE5 vagy NSE6-ből lettek az az FCP minősítések (Professional) NSE7 vizsgákból illetve azok kombinációiból lettek az FCSS minősítések (Specialist)  NSE8 pedig FCX a...