Re: Security portion in CCIE R & S

From: ccie anees (ccieanees@yahoo.com)
Date: Thu Jan 04 2007 - 15:53:07 ART


Please take some time and look at this config
   
   
       area 1 (NSSA) Area 0
R1 --------------------- R2 ------------------- R3
      X.X.12.0/30 X.X.23.0/30
   
  Step1:
  ######
  R1:
    redistribute Loopback0 (1.1.1.1)
  
Verify Result
##############
  in R3:
   show ip route will show
  1.1.1.0/24 as E2 route.
X.X.12.0/30 as O IA route
  ************************************************************
  Step2:
  ######
  Suppress Area 1 route X.X.12.0/24 in Area 0
###########################################
  R2:
  router ospf 1
 area 1 range X.X.12.0 255.255.255.0 no-advertise
  
Verify in R3:
  show ip route
   you will not see both the routes X.X.12.0/30 and 1.1.1.0/24
  
R3#show ip ospf database external
              OSPF Router with ID (3.3.3.3) (Process ID 1)
                  Type-5 AS External Link States
    Routing Bit Set on this LSA
  LS age: 168
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 1.1.1.0 (External Network Number )
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000001
  Checksum: 0x38F0
  Length: 36
  Network Mask: /24
        Metric Type: 2 (Larger than any link state path)
        TOS: 0
        Metric: 20
        Forward Address: 1.1.12.1 <-----------------------------
        External Route Tag: 0
  Note:
     you can see above that the forwarding address 1.1.12.1 for the redistributed
route 1.1.1.0.
     And we filtered the X.X.12.0 from ABR (R2).
     Because R3 does not have route to reach X.X.12.1, it can not populate 1.1.1.1
in R3 Routing table.
  
**********************************************************************************
  Step3:
  ######
  NSSA forwarding address suppression
###################################
  R2:
  router ospf 1
 area 1 nssa translate type7 suppress-fa
  Verify in R3
  
R3#show ip ospf database external
              OSPF Router with ID (3.3.3.3) (Process ID 1)
                  Type-5 AS External Link States
    Routing Bit Set on this LSA
  LS age: 6
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 1.1.1.0 (External Network Number )
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000002
  Checksum: 0x61D6
  Length: 36
  Network Mask: /24
        Metric Type: 2 (Larger than any link state path)
        TOS: 0
        Metric: 20
        Forward Address: 0.0.0.0 <-----------------------------
        External Route Tag: 0
   
Note: Now the forwarding address is 0.0.0.0 which is nothing but the
border-router. Now the router knows how to reach the border-router
which is X.X.23.2, it populates 1.1.1.0/24 in the routing table.
  
R3#show ip ospf border-routers
  OSPF Process 1 internal Routing Table
  Codes: i - Intra-area route, I - Inter-area route
  
i 2.2.2.2 [647] via 1.1.23.2, Serial1/2, ABR/ASBR, Area 3, SPF 117
  
**********************************************************************************

johngibson1541@yahoo.com wrote:
  I am still looking into the nssa translated LSA forwarding address suppressing issue.

I am still in the dark. So exhausted in studying these days.

John



This archive was generated by hypermail 2.1.4 : Thu Feb 08 2007 - 23:46:55 ART