Re: OSPF filtering

It should work because devices typically reply back, let me know if it
works.

Thanks

On Fri, Feb 12, 2010 at 4:15 PM, Ivan Hrvatska <ivanzghr_at_gmail.com> wrote:

> Of course. I only work with Cisco. Yes, all network equipment on both
> location is Cisco and even the transit network is Cisco.
>
> Narbik, I think I remember that lab :)
> I didn't have time last couple of days to study that solution and try
> to apply it on my case, but weekend is here, so I'll do it... I'll let
> you know is it working in my scenario...
>
> Regards
>
>
> On Thu, Feb 11, 2010 at 11:13 PM, Narbik Kocharians <narbikk_at_gmail.com>
> wrote:
> > Ivan,
> >
> > Are you using Cisco equipments?
> >
> > On Thu, Feb 11, 2010 at 11:04 AM, Marko Milivojevic <markom_at_ipexpert.com
> >
> > wrote:
> >>
> >> Of course, this relies on the other side responding to pings, which is
> >> perfectly fine in the lab, but in live environments not something we
> >> should rely on, especially when dealing wth 3rd party networks.
> >>
> >> Pretty nice solution, though.
> >>
> >> --
> >> Marko Milivojevic - CCIE #18427
> >> Senior Technical Instructor - IPexpert
> >>
> >> Mailto: markom_at_ipexpert.com
> >> Telephone: +1.810.326.1444
> >> Fax: +1.810.454.0130
> >> R&S Video on Demand Demo: http://bit.ly/aFyrU4
> >>
> >> On Thu, Feb 11, 2010 at 18:57, Narbik Kocharians <narbikk_at_gmail.com>
> >> wrote:
> >> > First of all I am sorry for the long post, this is part of my NEW boot
> >> > camp
> >> > 2.0, but lab it up this thing works, we have lots of nice stuff like
> >> > this.
> >> >
> >> > Topology:
> >> > R1 has three F0/0 sub-interfaces configured:
> >> >
> >> >
> >> >
> >> > R1s F0/0.11 (192.168.1.1) connects R1 to BB1s F0/0 (192.168.1.11)
> >> >
> >> > R1s F0/0.12 (192.168.2.1) connects R1 to BB2s F0/0 (192.168.2.22)
> >> >
> >> > R1s F0/0.13 (192.168.3.1) connects R1 to BB3s F0/0 (192.168.3.33)
> >> >
> >> >
> >> >
> >> > BB1 is advertising its Lo0 (1.1.1.11/32)
> >> >
> >> > BB2 is advertising its Lo0 (1.1.1.22/32)
> >> >
> >> > BB3 is advertising its Lo0 (1.1.1.33/32)
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1(config)#Router ospf 1
> >> >
> >> > R1(config-router)#Netw 192.168.1.1 0.0.0.0 area 0
> >> >
> >> > R1(config-router)#Netw 192.168.2.1 0.0.0.0 area 0
> >> >
> >> > R1(config-router)#Netw 192.168.3.1 0.0.0.0 area 0
> >> >
> >> >
> >> >
> >> > I do that to speed up recovery:
> >> >
> >> >
> >> >
> >> > R1(config)#Int F0/0.11
> >> >
> >> > R1(config-subif)#IP OSPF dead-interval minimal hello-multiplier 4
> >> >
> >> >
> >> >
> >> > R1(config)#Int F0/0.12
> >> >
> >> > R1(config-subif)#IP OSPF dead-interval minimal hello-multiplier 4
> >> >
> >> >
> >> >
> >> > R1(config)#Int F0/0.13
> >> >
> >> > R1(config-subif)#IP OSPF dead-interval minimal hello-multiplier 4
> >> >
> >> >
> >> >
> >> > On BB1
> >> >
> >> >
> >> >
> >> > BB1(config)#Router ospf 1
> >> >
> >> > BB1(config-router)#router-id 1.1.1.11
> >> >
> >> > BB1(config-router)#Netw 192.168.1.11 0.0.0.0 area 0
> >> >
> >> > BB1(config-router)#Netw 1.1.1.11 0.0.0.0 area 0
> >> >
> >> >
> >> >
> >> > BB1(config)#int F0/0
> >> >
> >> > BB1(config-if)#IP OSPF dead-interval minimal hello-multiplier 4
> >> >
> >> >
> >> >
> >> > On BB2
> >> >
> >> >
> >> >
> >> > BB2(config)#Router ospf 1
> >> >
> >> > BB2(config-router)#router-id 1.1.1.22
> >> >
> >> > BB2(config-router)#Netw 1.1.1.22 0.0.0.0 area 0
> >> >
> >> > BB2(config-router)#Netw 192.168.2.22 0.0.0.0 area 0
> >> >
> >> >
> >> >
> >> > BB2(config)#int F0/0
> >> >
> >> > BB2(config-if)#IP OSPF dead-interval minimal hello-multiplier 4
> >> >
> >> >
> >> >
> >> > On BB3
> >> >
> >> >
> >> >
> >> > BB3(config)#Router ospf 1
> >> >
> >> > BB3(config-router)#router-id 1.1.1.33
> >> >
> >> > BB3(config-router)#Netw 1.1.1.33 0.0.0.0 area 0
> >> >
> >> > BB3(config-router)#Netw 192.168.3.33 0.0.0.0 area 0
> >> >
> >> >
> >> >
> >> > BB3(config)#int F0/0
> >> >
> >> > BB3(config-if)#IP OSPF dead-interval minimal hello-multiplier 4
> >> >
> >> >
> >> >
> >> > To verify the configuration:
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > 1.1.1.33 1 FULL/DR 776 msec 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > 1.1.1.22 1 FULL/DR 816 msec 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > 1.1.1.11 1 FULL/DR 900 msec 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:37 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> >
> >> > R1#Show ip route ospf | Inc O
> >> >
> >> >
> >> >
> >> > O 1.1.1.11 [110/2] via 192.168.1.11, 00:04:23,
> FastEthernet0/0.11
> >> >
> >> > O 1.1.1.22 [110/2] via 192.168.2.22, 00:04:13,
> FastEthernet0/0.12
> >> >
> >> > O 1.1.1.33 [110/2] via 192.168.3.33, 00:00:55,
> FastEthernet0/0.13
> >> >
> >> >
> >> >
> >> > To configure the policy:
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1(config)#Int F0/0.12
> >> >
> >> > R1(config-subif)#IP OSPF Network Non-Broadcast
> >> >
> >> >
> >> >
> >> > R1(config-subif)#Int F0/0.13
> >> >
> >> > R1(config-subif)#IP OSPF Network Non-Broadcast
> >> >
> >> >
> >> >
> >> > R1(config-subif)#Int F0/0.14
> >> >
> >> > R1(config-subif)#IP OSPF Network Non-Broadcast
> >> >
> >> >
> >> >
> >> > R1(config)#Router ospf 1
> >> >
> >> > R1(config-router)#Neighbor 192.168.1.11
> >> >
> >> > R1(config-router)#Neighbor 192.168.2.22
> >> >
> >> > R1(config-router)#Neighbor 192.168.3.33
> >> >
> >> >
> >> >
> >> > On BB1, BB2 and BB3
> >> >
> >> >
> >> >
> >> > Rx(config)#Int F0/0
> >> >
> >> > Rx(config-subif)#IP OSPF Network Non-Broadcast
> >> >
> >> >
> >> >
> >> > To verify the configuration:
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > 1.1.1.33 1 FULL/BDR 888 msec 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > 1.1.1.22 1 FULL/BDR 904 msec 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > 1.1.1.11 1 FULL/BDR 888 msec 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:37 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> > To configure the policy:
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1(config)#Access-list 102 permit ospf host 192.168.2.1 host
> >> > 192.168.2.22
> >> >
> >> > R1(config)#Access-list 103 permit ospf host 192.168.3.1 host
> >> > 192.168.3.33
> >> >
> >> >
> >> >
> >> > R1(config)#IP SLA Monitor 11
> >> >
> >> > R1(config-rtr)#type echo protocol ipicmpecho 192.168.1.11
> source-ipaddr
> >> > 192.168.1.1
> >> >
> >> > R1(config-rtr-echo)#Freq 5
> >> >
> >> >
> >> >
> >> > R1(config)#IP SLA schedule 11 start now life forever
> >> >
> >> >
> >> >
> >> > R1(config)#Track 1 rtr 11 reachability
> >> >
> >> > R1(config-track)#delay down 3
> >> >
> >> > R1(config-track)#delay up 3
> >> >
> >> >
> >> >
> >> > R1(config)#IP SLA Monitor 12
> >> >
> >> > R1(config-rtr)#type echo protocol ipicmpecho 192.168.2.22
> source-ipaddr
> >> > 192.168.2.1
> >> >
> >> > R1(config-rtr-echo)#Freq 5
> >> >
> >> >
> >> >
> >> > R1(config)#IP SLA schedule 12 start now life forever
> >> >
> >> >
> >> >
> >> > R1(config)#Track 2 rtr 12 reachability
> >> >
> >> > R1(config-track)#delay down 3
> >> >
> >> > R1(config-track)#delay up 3
> >> >
> >> >
> >> >
> >> > 1(config)#Route-map TST permit 10
> >> >
> >> > R1(config-route-map)#match ip addr 102 103
> >> >
> >> > R1(config-route-map)#set ip next-hop verify-availability 192.168.1.11
> 1
> >> > track 1
> >> >
> >> > R1(config-route-map)#set ip next-hop verify-availability 192.168.2.22
> 2
> >> > track 2
> >> >
> >> >
> >> >
> >> > R1(config)#ip local policy route-map TST
> >> >
> >> >
> >> >
> >> > To verify the configuration:
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > 1.1.1.11 1 FULL/BDR 920 msec 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:36 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> >
> >> > To test the configuration:
> >> >
> >> >
> >> >
> >> > On BB1
> >> >
> >> >
> >> >
> >> > BB1(config)#Int F0/0
> >> >
> >> > BB1(config-if)#Shut
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > You should see the following console message:
> >> >
> >> >
> >> >
> >> > %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.11 on FastEthernet0/0.12 from
> FULL
> >> > to
> >> > DOWN, Neighbor Down: Dead timer expired
> >> >
> >> >
> >> >
> >> > %TRACKING-5-STATE: 1 rtr 11 reachability Up->Down
> >> >
> >> >
> >> >
> >> > %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.22 on FastEthernet0/0.13 from
> >> > LOADING
> >> > to FULL,
> >> >
> >> >
> >> >
> >> > Loading Done
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > 1.1.1.22 1 FULL/DR 876 msec 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:30 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> >
> >> > On BB2
> >> >
> >> >
> >> >
> >> > BB2(config)#int f0/0
> >> >
> >> > BB2(config-if)#Shut
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > 1.1.1.33 1 FULL/DR 996 msec 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:32 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> >
> >> > To test the failover:
> >> >
> >> >
> >> >
> >> > On BB2
> >> >
> >> >
> >> >
> >> > BB2(config)#Int F0/0
> >> >
> >> > BB2(config-if)#NO Shut
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > You should see the following console messages:
> >> >
> >> >
> >> >
> >> > %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.22 on FastEthernet0/0.13 from
> >> > LOADING
> >> > to FULL, Loading Done
> >> >
> >> >
> >> >
> >> > %TRACKING-5-STATE: 2 rtr 12 reachability Down->Up
> >> >
> >> >
> >> >
> >> > %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.33 on FastEthernet0/0.14 from
> FULL
> >> > to
> >> > DOWN, Neighbor Down: Dead timer expired
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > 1.1.1.22 1 FULL/DR 940 msec 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:33 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> >
> >> > On BB1
> >> >
> >> >
> >> >
> >> > BB1(config)#Int F0/0
> >> >
> >> > BB1(config-if)#NO Shut
> >> >
> >> >
> >> >
> >> > On R1
> >> >
> >> >
> >> >
> >> > You should see the following console messages:
> >> >
> >> >
> >> >
> >> > %TRACKING-5-STATE: 1 rtr 11 reachability Down->Up
> >> >
> >> >
> >> >
> >> > %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.22 on FastEthernet0/0.13 from
> FULL
> >> > to
> >> > DOWN, Neighbor Down: Dead timer expired
> >> >
> >> >
> >> >
> >> > %OSPF-5-ADJCHG: Process 1, Nbr 1.1.1.11 on FastEthernet0/0.12 from
> >> > LOADING
> >> > to FULL, Loading Done
> >> >
> >> >
> >> >
> >> > R1#Show ip ospf neighbor
> >> >
> >> >
> >> >
> >> > Neighbor ID Pri State Dead Time Address
> >> > Interface
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.3.33
> >> > FastEthernet0/0.14
> >> >
> >> > N/A 0 ATTEMPT/DROTHER - 192.168.2.22
> >> > FastEthernet0/0.13
> >> >
> >> > 1.1.1.11 1 FULL/DR 772 msec 192.168.1.11
> >> > FastEthernet0/0.12
> >> >
> >> > 1.1.1.3 0 FULL/ - 00:00:37 100.1.1.3
> >> > Serial0/1
> >> >
> >> >
> >> >
> >> >
> >> >
> >> > I hope this helped.
> >> >
> >> > On Thu, Feb 11, 2010 at 10:14 AM, Marko Milivojevic
> >> > <markom_at_ipexpert.com>
> >> > wrote:
> >> >>
> >> >> On Thu, Feb 11, 2010 at 18:11, Ivan Hrvatska <ivanzghr_at_gmail.com>
> >> >> wrote:
> >> >> > Yes, I considered debug on reboot, so I made one event applet that
> >> >> > turns ON that debugging if it gets syslog msg of reboot. Tested it,
> >> >> > and it works.
> >> >>
> >> >> You are talking "programming routers" into whole new level, aren't
> you?
> >> >> :-)
> >> >>
> >> >> > Narbik, I think that your idea would work. How to do it? :)
> >> >>
> >> >> I'm also rather curious about that. I've never heard of such feature,
> >> >> but it does sound like something that would solve your issues...
> >> >>
> >> >> --
> >> >> Marko Milivojevic - CCIE #18427
> >> >> Senior Technical Instructor - IPexpert
> >> >>
> >> >> Mailto: markom_at_ipexpert.com
> >> >> Telephone: +1.810.326.1444
> >> >> Fax: +1.810.454.0130
> >> >> R&S Video on Demand Demo: http://bit.ly/aFyrU4
> >> >
> >> >
> >> >
> >> > --
> >> > Narbik Kocharians
> >> > CCSI#30832, CCIE# 12410 (R&S, SP, Security)
> >> > www.MicronicsTraining.com <http://www.micronicstraining.com/>
> >> > Sr. Technical Instructor
> >> > YES! We take Cisco Learning Credits!
> >> > Training And Remote Racks available
> >> >
> >
> >
> >
> > --
> > Narbik Kocharians
> > CCSI#30832, CCIE# 12410 (R&S, SP, Security)
> > www.MicronicsTraining.com <http://www.micronicstraining.com/>
> > Sr. Technical Instructor
> > YES! We take Cisco Learning Credits!
> > Training And Remote Racks available
> >
>

--
Narbik Kocharians
CCSI#30832, CCIE# 12410 (R&S, SP, Security)
www.MicronicsTraining.com
Sr. Technical Instructor
YES! We take Cisco Learning Credits!
Training And Remote Racks available
Blogs and organic groups at http://www.ccie.net