Thursday, 18 August 2011

IPv6 Tunnelling over IPv4

Today I'm going to play around with some IPv6 tunnelling techniques

The topology for this example will be a string of 4 IPv4 enabled routers connected by Ethernet, each with a Loopback 100.100.100.x/32 with all the interfaces advertised into OSPF

Here are their base configurations:

R1
hostname R1
interface Loopback0
 ip address 100.100.100.1 255.255.255.255
!
interface FastEthernet0/0
 description R2 Fa0/0
 ip address 10.1.12.1 255.255.255.0
!
router ospf 1
 network 10.1.12.1 0.0.0.0 area 0
 network 100.100.100.1 0.0.0.0 area 0

R2
hostname R2
interface Loopback0
 ip address 100.100.100.2 255.255.255.255
!
interface FastEthernet0/0
 description R1 Fa0/0
 ip address 10.1.12.2 255.255.255.0
!
interface FastEthernet0/1
 description R3 Fa0/1
 ip address 10.1.23.2 255.255.255.0
!
router ospf 1
 network 10.1.12.2 0.0.0.0 area 0
 network 10.1.23.2 0.0.0.0 area 0
 network 100.100.100.2 0.0.0.0 area 0

R3
hostname R3
interface Loopback0
 ip address 100.100.100.3 255.255.255.255
!
interface FastEthernet0/0
 description R4 Fa0/0
 ip address 10.1.34.3 255.255.255.0
!
interface FastEthernet0/1
 description R2 Fa0/1
 ip address 10.1.23.3 255.255.255.0
!
router ospf 1
 network 10.1.23.3 0.0.0.0 area 0
 network 10.1.34.3 0.0.0.0 area 0
 network 100.100.100.3 0.0.0.0 area 0

R4
hostname R4
interface Loopback0
 ip address 100.100.100.4 255.255.255.255
!
interface FastEthernet0/0
 description R3 Fa0/0
 ip address 10.1.34.4 255.255.255.0
!
router ospf 1
 log-adjacency-changes
 network 10.1.34.4 0.0.0.0 area 0
 network 100.100.100.4 0.0.0.0 area 0

IPv6 over GRE and IPv6 over IPv4

IPv6 over GRE over IPv4 is the easiest configuration method for a point-to-point tunnel IPv6 over an IPv4 network.

The initial tunnel configuration between R1 and R3 in this example is nothing special - we're just specifying that the tunnel needs to be set up between the Loopback interfaces, the only thing we are doing here is assigning the IPv6 address to each tunnel endpoint

R1
interface Tunnel13
 ipv6 address FEC0:13::1/64
 
tunnel source 100.100.100.1
 tunnel destination 100.100.100.3

R3
interface Tunnel13
  ipv6 address FEC0:13::3/64
 
tunnel source 100.100.100.3
 tunnel destination 100.100.100.1



R1#ping fec0:13::1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FEC0:13::1, timeout is 2 seconds:
!!!!!

IPv6 over IPv4 is working fine


R1#sh int tun13 | i transport
  Tunnel protocol/transport GRE/IP


As we can see we are tunneling IPv6 over GRE over IPv4 - GRE is a handy protocol since it carries all sorts of protocols over it but in this case it's a little inefficient with regards to the encapsulation overhead and potentially reducing the effective MTU on this path so we could look at directly transporting IPv6 over IPv4 and skip the GRE middle man and have a larger payload MTU

R1
interface Tunnel13
  tunnel mode ipv6ip

R3
interface Tunnel13
  tunnel mode ipv6ip

R1#sh int tun13 | i transport
  Tunnel protocol/transport IPv6/IP
 
IPv6 over IPv4 automatic tunnels


Another type of tunnelling method is quite interesting in the way that it's defined.  The destination address of the tunnel is not actually specified, this is because this is encoded within the destination IPv6 Address.  The 2002::/16 network is a special segment that is used to contain the IPv4 destination address and network

R1
interface Tunnel123
 no ip address
 no ip redirects
 ipv6 address 2002:6464:6401:1::/128
 tunnel source 100.100.100.1
 tunnel mode ipv6ip 6to4
!
ipv6 route 2002::/16 Tunnel123

In this case, the tunnel source IPv4 address is converted to hexadecimal 100.100.100.1 becomes 6464:6401 and the associated network is 1 (this way we can terminate multiple IPv6 networks using the same IPv4 address if we had to)

All of the remote ends of the tunnel are in the 2002::/16 network so we instruct the router to reach them via the tunnel where it inspects the destination and automatically establishes the tunnel destination

R2
interface Tunnel123
 no ip address
 no ip redirects
 ipv6 address 2002:6464:6402:1:/128
 tunnel source 100.100.100.2
 tunnel mode ipv6ip 6to4
!
ipv6 route 2002::/16 Tunnel123

R1#ping 2002:6464:6402:1::

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2002:6464:6402:1::, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms

This is a multipoint tunnel, if we add another IPv6overIPv4 tunnel or R3, things should work just as easily


R3
interface Tunnel123
 no ip address
 no ip redirects
 ipv6 address 2002:6464:6403:9:/128
 tunnel source 100.100.100.3
 tunnel mode ipv6ip 6to4
!
ipv6 route 2002::/16 Tunnel123

R1#ping 2002:6464:6403:9::

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2002:6464:6403:9::, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/10/12 ms

ISATAP tunnels

A similar concept to the above but somewhat different are ISATAP tunnels - unlike IPv6inIPv4 auto tunnels which have to use the 2002::/16 network, ISATAP tunnels are a lot more flexible in the address allocations available. IPv6 addresses are automatically derived from the tunnel source IPv4 address but are created using the eui-64 method to embed the IPv4 address and the special 5EFE identifier which is used before the hex encoded IPv4 address to let us know that this is an ISATAP address

R2
interface Tunnel24
 no ip address
 no ip redirects
 ipv6 address FEC0:24::/64 eui-64
 no ipv6 nd ra suppress
 tunnel source 100.100.100.2
 tunnel mode ipv6ip isatap

R4
interface Tunnel24
 no ip address
 no ip redirects
 ipv6 address FEC0:24::/64 eui-64
 no ipv6 nd ra suppress
 tunnel source 100.100.100.4
 tunnel mode ipv6ip isatap

R2#sh ipv6 int tun24 | i EUI
    FEC0:24::5EFE:6464:6402, subnet is FEC0:24::/64 [EUI]



We can see that the EUI address is using the 5EFE flag for ISATAP addressing and 6161:6402 which is the hex encoded version of 100.100.100.2

R4#sh ipv6 int tun24 | i EUI
    FEC0:24::5EFE:6464:6404, subnet is FEC0:24::/64 [EUI]


As R4 is on the same subnet as R2 in tunnel 24 we don't need a specific route for it, however a tunnel to R4 (100.100.100.4) will be established by inspecting the destination address

R2#ping FEC0:24::5EFE:6464:6404 source tun24

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FEC0:24::5EFE:6464:6404, timeout is 2 seconds:
Packet sent with a source address of FEC0:24::5EFE:6464:6402
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/12 ms

These are the main transition techniques for carrying IPv6 over IPv4 enabled networks at least for what should be found in the CCIE for Routing and Switching Version 4.0

Wednesday, 17 August 2011

Enabling RSH in IOS

Here's a very quick recipe for enabling RSH on IOS routers - Where abouts on the DOC-CD?  Assuming you're starting at the beginning of the IOS Software Release page for the version you care about (12.4T)

Configuration Guides -> System Management -> Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.4T -> Part 6: Configuring Basic File Transfer Services

Lets start with a very simple topology R1 and R2 are back to back over ethernet:

R1
interface FastEthernet0/0
 ip address 10.10.12.1 255.255.255.0
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
router eigrp 12
 network 1.1.1.1 0.0.0.0
 network 10.10.12.1 0.0.0.0
 no auto-summary


R2
interface FastEthernet0/0
 ip address 10.10.12.2 255.255.255.0
!

interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
router eigrp 12
 network 2.2.2.2 0.0.0.0
 network 10.10.12.2 0.0.0.0
 no auto-summary

Make sure we have Loopback to Loopback connectivity before we go further:

R1#sh ip route eigrp
     2.0.0.0/32 is subnetted, 1 subnets
D       2.2.2.2 [90/409600] via 10.10.12.2, 00:00:19, FastEthernet0/0
R2#sh ip route eigrp
     1.0.0.0/32 is subnetted, 1 subnets
D       1.1.1.1 [90/409600] via 10.10.12.1, 00:00:31, FastEthernet0/0
R2#ping 1.1.1.1 source 2.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms

Okay, so in this example R1 will be the RSH server and R2 will be the RSH client


Lets create two local accounts which will be able to be used for RSH one will be used to execute non-priviledged commands while the other will be used for enable level commands


R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#username level1 password 0 admin
R1(config)#username level2 password 0 admin

Now we want to enable R2 to use the above accounts for RSH commands that come from R2's Loopback0.  The level2 user will be able to execute enable level commands

R1(config)#ip rcmd remote-host level1 2.2.2.2 R2
R1(config)#ip rcmd remote-host level2 2.2.2.2 R2 enable

Now we enable RSH

R1(config)#ip rcmd rsh-enable

For R2, we want to set our source interface to be loopback 0, otherwise we will just use the closest interface IP to the destination (Fa0/0)

R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#ip rcmd source-interface Loopback0



Lets see if R2 can get the IOS version that is running R1



R2(config)#do rsh 1.1.1.1 /user level1 show ver | i IOS
Cisco IOS Software, 3700 Software (C3725-ADVENTERPRISEK9-M), Version 12.4(15)T14, RELEASE SOFTWARE (fc2)

Cool - ok, lets verify that the enable permissions are working - lets try to get the running config of interface loopback0 using the level1 user

R2(config)#do rsh 1.1.1.1 /user level1 show run int lo0

Line has invalid autocommand "show run int lo0"

Okay, that appears to have failed as expected, lets try with the level2 user

R2(config)#do rsh 1.1.1.1 /user level2 show run int lo0

Building configuration...

Current configuration : 63 bytes
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
end

Working as desired.  The biggest part is to make sure the router acting as the rsh server has the command string for the remote user set up correctly in this form:

ip rcmd remote-host LOCAL-USER-ACCOUNT REMOTE-IP REMOTE-HOSTNAME



Monday, 15 August 2011

Scheduled Attempt #2

It's just about 4 weeks before I have my second stab at the CCIE Lab.  When I attended the Micronics Bootcamp they were running the Cisco LabSafe program which included a lab-retake voucher if you did well enough in the assessment labs, which is quite helpful as it takes away some of the costs for the next shot.  Interestingly, Cisco has increased the price from $US1400 to $US1500 on the first of August.  The voucher covered $US1400, so I had to make up the difference plus the 10% Goods and Service Tax that they like to charge us in Australia, so having to pay $US250 for another go at the lab is not too bad at all - flights and accomodation also need paying for too but thats the price.  Looking at the CCIE numbers being announced in places like GroupStudy, should I get through this time my guess is that my number will be in the 30,000+ range.

As for my preparation - I've been pretty flat out with work particularly since I've been inter-state but I have been keeping at the labs (I brought a personal laptop that is running dynamips to lab small things up).  When I'm home I'm still going through the Troubleshooting workbook with two labs left to do I will have gone through it all once but I plan to revisit some of the labs just to keep the practice going.  There seems to be a pretty good level of difficulty and variety in there, I'm finding it useful because sometimes I jump into trying to fix a problem that is probably deep, when it's possibly something as basic as  a sub-interface is up but the main interface is down.

Sunday, 7 August 2011

External BGP Next Hop

Here's an interesting BGP discovery (well at least it's interesting to me...)

A common belief that is not quite true is that EBGP peers set the advertised next hop to be themselves. If we have a look at RFC 1771 section 5.1.3 (NEXT_HOP)

A BGP speaker can advertise any internal border router as the next hop provided that the interface associated with the IP address of this border router (as specified in the NEXT_HOP path attribute) shares a common subnet with both the local and remote BGP speakers. A BGP speaker can advertise any external border router as the next hop, provided that the IP address of this border router was learned from one of the BGP speaker's peers, and the interface associated with the IP address of this border router (as specified in the NEXT_HOP path attribute) shares a common subnet with the local and remote BGP speakers.

Take this example to verify it:

We have 3 routers each in a separate BGP AS.  R1 is peered with R2, and R3 is peered with R2:

R1 and R3 are connected to a switch belonging to R2 and Fa0/0 of R1/R2/R3 are all in the same VLAN.

Below are the relevant configs:

R1
hostname R1
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.123.1 255.255.255.0
!
router bgp 1
 no synchronization
 network 1.1.1.1 mask 255.255.255.255
 neighbor 10.1.123.2 remote-as 2
 no auto-summary

R2
hostname R2
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface FastEthernet0/0
 ip address 10.1.123.2 255.255.255.0
!
router bgp 2
 no synchronization
 network 2.2.2.2 mask 255.255.255.255
 neighbor 10.1.123.1 remote-as 1
 neighbor 10.1.123.3 remote-as 3
 no auto-summary

R3
hostname R3
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
interface FastEthernet0/0
 ip address 10.1.123.3 255.255.255.0
!
router bgp 3
 no synchronization
 bgp log-neighbor-changes
 network 3.3.3.3 mask 255.255.255.255
 neighbor 10.1.123.2 remote-as 2
 no auto-summary

Lets make sure everyone has BGP connectivity and has learnt prefixes:

R1#sh ip bgp summ | b Neighbor
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.123.2      4     2      26      20       28    0    0 00:13:46        2

R2#sh ip bgp summ | b Neighbor
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.123.1      4     1      20      26       28    0    0 00:13:48        1
10.1.123.3      4     3      20      27       28    0    0 00:12:44        1

R3#sh ip bgp summ | b Neighbor
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.123.2      4     2      27      20       28    0    0 00:12:31        2


Looks reasonable, lets check what we routes have learnt from BGP


R1#sh ip route bgp
     2.0.0.0/32 is subnetted, 1 subnets
B       2.2.2.2 [20/0] via 10.1.123.2, 00:11:57
     3.0.0.0/32 is subnetted, 1 subnets
B       3.3.3.3 [20/0] via 10.1.123.3, 00:10:56


R2#sh ip route bgp
     1.0.0.0/32 is subnetted, 1 subnets
B       1.1.1.1 [20/0] via 10.1.123.1, 00:11:45
     3.0.0.0/32 is subnetted, 1 subnets
B       3.3.3.3 [20/0] via 10.1.123.3, 00:11:45


R3#sh ip route bgp
     1.0.0.0/32 is subnetted, 1 subnets
B       1.1.1.1 [20/0] via 10.1.123.1, 00:12:05
     2.0.0.0/32 is subnetted, 1 subnets
B       2.2.2.2 [20/0] via 10.1.123.2, 00:13:06


The interesting thing here is that R1 has 3.3.3.3/32 reachable via R3 Fa0/0 and R3 has see 1.1.1.1/32 reachable via R1 Fa0/0 even though neither of these guys have a direct BGP peering with each other.

It appears that R2 is smart enough to realise since R1 and R3 are on the same subnet rather than having R2 get in the way, it will not change the advertised next-hop IP address to be itself even though R1 and R2 are in different autonomous systems

R1#sh ip bgp
BGP table version is 28, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.1/32       0.0.0.0                  0         32768 i
*> 2.2.2.2/32       10.1.123.2               0             0 2 i
*> 3.3.3.3/32       10.1.123.3                             0 2 3 i

R2#sh ip bgp
BGP table version is 28, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.1/32       10.1.123.1               0             0 1 i
*> 2.2.2.2/32       0.0.0.0                  0         32768 i
*> 3.3.3.3/32       10.1.123.3               0             0 3 i

R3#sh ip bgp
BGP table version is 28, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.1/32       10.1.123.1                             0 2 1 i
*> 2.2.2.2/32       10.1.123.2               0             0 2 i
*> 3.3.3.3/32       0.0.0.0                  0         32768 i

We can see that R2's AS is still included within the AS-PATH for the routing information even if it is not in the traffic forwarding path

Sunday, 17 July 2011

Troubleshooting Workbook

As my lab attempt revealed, my troubleshooting technique isn't as good as I thought it was.  As such I've been going through the Micronics Troubleshooting workbook which was written by Narbik and Dan Shechter.  So far I find it pretty helpful.

It comes with 10 Troubleshooting labs following the Narbik topology,  it ships with two Locklizard PDFs - one is just questions only, and the other with the answers for verification or when you finally give up.  Each lab has around 15 tickets which encompass routers and switches.  Currently I've been allocating myself 2 hours per lab.  Some tickets I can resolve very quickly, others take a bit of time to identify and resolve the problem - it's good though.

Although its a very small thing, I have stopped using Putty Connection Manager and have gone back to untabbed Putty windows with the "Always on top" and "Right Click = menu" which is what the lab environment uses - when I encountered this in the lab I found it a little disconcerting particulary during the troubleshooting when there were on the order of 30 possible devices to work with.  It wasn't the cause of me failing that section, it just help fluster me a little.  Already I am taking this into my workflow and learning to close down sessions that I don't actively require, while a very small thing on the scheme of things.  I think it might give a slight advantage next time I sit the lab (BTW it is possible during the lab to change the settings of Putty but I would rather save those few minutes of terminal configuration to be used for solving tickets)

If you're interested in trying out some of the tickets from the workbook without risking your cash - checkout some of Dan's mini TS Lab tickets to get a sense of the style and the whole of Lab #3 is available for free for you to evaluate.

Sunday, 3 July 2011

Status Update

It's been two weeks since I attempted the CCIE R&S Version 4.0 Lab in Sydney (I have just returned from a vacation in Europe which started right after my lab attempt).  I found the lab pretty tough but doable.  For me by the time lunch time came around I was pretty sure that by the middle of the day, I was doing the famous expensive lunch (which at the Sydney campus was not bad to be honest)  My technique for troubleshooting just let me down - I have no excuses in this area, my speed and technique did not do me any favours here.  It was difficult to keep going once that section closed down with a number of outstanding tickets.  The configuration section was a different story, I found it relatively straight forward - a few variations of things I didn't necessarily expect but the experience gained using training materials from IPexpert and Narbik did arm me with the capability to deal with them and with the config section I achieved a pass.

I guess a little distance between reporting the status here allows the emotions to settle, and the time away from the routers and mailing lists are able to let me have a little break to regroup, re-energise and know that this is definitely something I can pass and that I intend to face the lab again in the next couple of months.  I intend to mainly focus on my increasing TS capability to be much faster in problem diagrnose and repair (but not ignoring the config portions) as to when I set my next date it will depend on when I believe I am ready and my workload (returning from a long vacation may mean I have a lot of catch up there)

For those interested in what the lab is like, the lab exam demo is very much on the money and may be helpful.

Wednesday, 1 June 2011

EIGRP Unequal Cost Paths

This post is going to be about how to perform unequal cost load balancing using EIGRP.  There's going to be a little bit of mathematics here but nothing beyond some basic algebra.


The topology for this post is shown below:  We have 4 routers, with multiple paths between them, each has a loopback interface and all interfaces are in EIGRP AS 100.



R1--FR-256kbps--R2--FR-256kbps--R4
 \                              /
  \-FR-512kbps-R3-FastEthernet-/



The initial configs are shown below:
R1
hostname R1
interface Loopback0
 ip address 1.1.1.1 255.0.0.0
!
interface Serial0/0
 description to Frame Switch
 no ip address
 encapsulation frame-relay
 no frame-relay inverse-arp
!
interface Serial0/0.12 point-to-point
 description R1-R2
 bandwidth 256
 ip address 10.1.12.1 255.255.255.0
 frame-relay interface-dlci 102
!
interface Serial0/0.13 point-to-point
 description R1-R3
 bandwidth 512
 ip address 10.1.13.1 255.255.255.0
 frame-relay interface-dlci 103
!
router eigrp 100
 network 1.1.1.1 0.0.0.0
 network 10.1.12.1 0.0.0.0
 network 10.1.13.1 0.0.0.0
 no auto-summary
!

R2
hostname R2
interface Loopback0
 ip address 2.2.2.2 255.0.0.0
!
interface Serial0/0
 description to Frame Switch
 no ip address
 encapsulation frame-relay
 no frame-relay inverse-arp
!
interface Serial0/0.21 point-to-point
 bandwidth 256
 description R2-R1
 ip address 10.1.12.2 255.255.255.0
 frame-relay interface-dlci 201
!
interface Serial0/0.24 point-to-point
 bandwidth 256
 description R2-R4
 ip address 10.1.24.2 255.255.255.0
 frame-relay interface-dlci 204
!
router eigrp 100
 network 2.2.2.2 0.0.0.0
 network 10.1.12.2 0.0.0.0
 network 10.1.24.2 0.0.0.0
 no auto-summary
!

R3
hostname R3
interface Loopback0
 ip address 3.3.3.3 255.0.0.0
!
interface FastEthernet0/0
 description to R3-R4
 ip address 10.1.34.3 255.255.255.0
 speed 100
 full-duplex
!
interface Serial0/0
 description to Frame Switch
 no ip address
 encapsulation frame-relay
 no frame-relay inverse-arp
!
interface Serial0/0.31 point-to-point
 description R3-R1
 ip address 10.1.13.3 255.255.255.0
 frame-relay interface-dlci 301
!
router eigrp 100
 network 3.3.3.3 0.0.0.0
 network 10.1.13.3 0.0.0.0
 network 10.1.34.3 0.0.0.0
 no auto-summary
!

R4
hostname R4
interface Loopback0
 ip address 4.4.4.4 255.0.0.
!
interface FastEthernet0/0
 description to R4-R3
 ip address 10.1.34.4 255.255.255.0
 speed 100
 full-duplex
!
interface Serial0/0
 description to Frame Switch
 no ip address
 encapsulation frame-relay
 no frame-relay inverse-arp
!
interface Serial0/0.42 point-to-point
 bandwidth 256
 description R4-R2
 ip address 10.1.24.4 255.255.255.0
 frame-relay interface-dlci 402
!
router eigrp 100
 network 4.4.4.4 0.0.0.0
 network 10.1.24.4 0.0.0.0
 network 10.1.34.4 0.0.0.0
 no auto-summary
!


As you can see we are using the default metric weights here: since we haven't changed anything K1 (Bandwidth) and K3 (Delay) are set to 1, with K2 , K4 and K5 left at 0

Therefor EIGRP metrics are calculated by 256 * ( 10^7 / WorstPathBandwidth + (TotalPathDelay/10) ) Where WorstPathBandwidth is in kbps and TotalPathDelay is in usecs.

From R1 if we were to work out the EIGRP Metric to 4.0.0.0 (Loopback 0 on R4) we can see two paths based on the topology - one via R2 and one via R3

Path 1 Metric calculation For R1 to 4.0.0.0 (R4 Lo0) via R2

Using the default metric weights, we can follow the same process EIGRP uses to calculate metrics by following the paths hop by hope and obtain the interface bandwidth (BW) and delay (DLY) values from show interface | inc DLY

Before we directly see what metric R1 has to 4.0.0.0, we need to calculate the metric R2 has to reach 4.0.0.0 as this is used by EIGRP to determine the feasibility condition on R1.  I'll get into the importance of this a little further down but right now it should be enough to know that our router of interest (R1) needs to know the advertised metric from our EIGRP upstream neighbor as well as computing the metric locally.

R2's Metric to 4.0.0.0 (R4 Lo0)

From R2 S0/0.24 to R4 S0/0.24 (Bandwidth 256 kbps and 20000 usec Delay)
From R4 To R4 Lo (Bandwidth 8000000 kbps and 5000 usec Delay)

B = round (10 ^ 7 / WorstPathBandwidth) = 39062
D = TotalPathDelay / 10 = 2500

Metric = 256 * (B + D)

  = 10639872

This metric (which R1 will use as part of the feasbility calculations) as well as the worst bandwidth and total delay will be advertised to R1 in order for it to compute the end metric to 4.0.0.0


R1's Metric to 4.0.0.0 (R4 Lo0) via R2



R1 will look at its connection to R2 (R1 S0/0.12 to R2 S0/0.21) indentifying the link bandwidth is 256 kbps and 20000 usec Delay and factor this into it's metric calculation, including the bandwidth and delay values received from R2:

WorstPathBandwidth = 256 kbps and TotalPathDelay = 45000 usec

R1's computed Metric to 4.0.0.0 via R2 is therefore


Metric = 256 * (B + D)
Where:
    B = round (10 ^ 7 / WorstPathBandwidth) = 39062
    D = TotalPathDelay / 10 = 4500

Which results in 11151872


Path 2 Metric calculation For R1 to 4.0.0.0 (R4 Lo0) via R3

This is a higher bandwidth path so we expect to see a lower metric here.

R3's Metric to 4.0.0.0 (R4 Lo0)

From R3 Fa0/0 to R4 Fa0/0 (Bandwidth 100000 kbps and 100 usec Delay)
To R4 Lo (Bandwidth 8000000 kbps and 5000 usec Delay)

Metric = 256 * (B + D)
Where:   B = round (10 ^ 7 / WorstPathBandwidth) = 100
   D = TotalPathDelay / 10 = 510

Which results in 156160

R1's Metric to 4.0.0.0 (R4 Lo0) via R3



R1 will look at its connection to R3 (R1 S0/0.13 to R3 S0/0.31) indentifying the link Bandwidth 512 kbps and 20000 usec Delay and factor this into it's metric calculation, including the bandwidth and delay values advertised from R3:

WorstPathBandwidth = 512 kbps and TotalPathDelay = 25100 usec

Metric = 256 * (B + D)
Where:   B = round (10 ^ 7 / WorstPathBandwidth) = 19531
   D = TotalPathDelay / 10 = 2510

Which results in 5642496

Okay, so we can work out metric calculations by hand, lets see if R1 agrees with our findings:

R1#sh ip eigrp topology 4.0.0.0
IP-EIGRP (AS 100): Topology entry for 4.0.0.0/8
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 5642496
  Routing Descriptor Blocks:
  10.1.13.3 (Serial0/0.13), from 10.1.13.3, Send flag is 0x0
      Composite metric is (5642496/156160), Route is Internal
      Vector metric:
        Minimum bandwidth is 512 Kbit
        Total delay is 25100 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 2
  10.1.12.2 (Serial0/0.12), from 10.1.12.2, Send flag is 0x0
      Composite metric is (11151872/10639872), Route is Internal
      Vector metric:
        Minimum bandwidth is 256 Kbit
        Total delay is 45000 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 2

We can see that the minimum bandwidth aligns with our WorstPathBandwidth and that the total delay is also in agreement with our manual calculations.

When we look at the composite metrics we can see two values (A/B) where A represents the computed metric to 4.0.0.0 (R4 Lo0) as far as R1 is concerned for a particular next-hop and B represents the metric that the next-hop has to reach 4.0.0.0

Task

Make R1 load balance traffic destined to R4 Lo0 with a traffic-share of 2:1 (matching with our PVC bandwidths)

Obviously this means that we use the eigrp "variance" command, however on its own this will not be enough to achieve the goal:

If we look at the metrics associated with both paths by examing the EIGRP topology database:

R1#sh ip eigrp topology 4.0.0.0 | inc from|Composite|bandwidth|delay
  10.1.13.3 (Serial0/0.13), from 10.1.13.3, Send flag is 0x0
      Composite metric is (5642496/156160), Route is Internal
        Minimum bandwidth is 512 Kbit
        Total delay is 25100 microseconds
  10.1.12.2 (Serial0/0.12), from 10.1.12.2, Send flag is 0x0
      Composite metric is (11151872/10639872), Route is Internal
        Minimum bandwidth is 256 Kbit
        Total delay is 45000 microseconds

Although we need to consider that while 11151872 and 5642496 doesn't exactly equal 2, more importantly in order for EIGRP install another route into the routing table for the same destination, the feasbility condition has to be met.  In this case it means that for the path via 10.1.12.2 to be considered, the advertised metric from R2 (10639872) must be less than R1's computed metric via R3 (5642496) which at this point in time is not the case.

With the default K values, we only have bandwidth and delay to play with and usually you do not want to change bandwidth values because that might break a number of other things such as QoS.

If we compare the two paths, we can see the link via R3 has a delay of 25100 usec and via R2 a delay of 45000 usec.  If we equalise the delay, the bandwidth values are already two to one, maybe that should make things work?

On R1 on the link facing R3, lets increase the delay by 45000 - 25100 = 19900 usecs

Firstly lets confirm the current delay

R1#sh int s0/0.13 | inc DLY
  MTU 1500 bytes, BW 1544 Kbit/sec, DLY 20000 usec,

So obviously the new delay should be 39900 usec but remember we set delay in 10s of usec

R1(config)#int s0/0.13
R1(config-subif)# delay 3990

Did this work? Lets set the variance and see what appears in the routing table

R1(config)#router eigrp 100
R1(config-router)#variance 2
R1(config-router)#do sh ip route 4.0.0.0
Routing entry for 4.0.0.0/8
  Known via "eigrp 100", distance 90, metric 6151936, type internal
  Redistributing via eigrp 100
  Last update from 10.1.13.3 on Serial0/0.13, 00:00:05 ago
  Routing Descriptor Blocks:
  * 10.1.13.3, from 10.1.13.3, 00:00:05 ago, via Serial0/0.13
      Route metric is 6151936, traffic share count is 1
      Total delay is 45000 microseconds, minimum bandwidth is 512 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 2

No, it doesn't appear to have worked - what do we see in the topology database?

R1(config-router)#do sh ip eigrp topology 4.0.0.0 | inc from|Composite|bandwidth|delay
  10.1.13.3 (Serial0/0.13), from 10.1.13.3, Send flag is 0x0
      Composite metric is (6151936/156160), Route is Internal
        Minimum bandwidth is 512 Kbit
        Total delay is 45000 microseconds
  10.1.12.2 (Serial0/0.12), from 10.1.12.2, Send flag is 0x0
      Composite metric is (11151872/10639872), Route is Internal
        Minimum bandwidth is 256 Kbit
        Total delay is 45000 microseconds


Well while the bandwidth and delay values are in alignment with the R1 computed metrics to 4.0.0.0 with the ratio of 2:1 the feasability condition is not being met, so only the route via R3 can be used

One way to satisfy the FC is to make the computed metric for R3 to exceed 10639872 (the advertised metric from R2)

Metric = 256 * (B + D)
Where:    B = round (10 ^ 7 / WorstPathBandwidth)
   D = TotalPathDelay / 10

10639872 = 256 * (10^7/512 + D/10)

10639872 / 256 - 10^7/512 = D/10

22031 = D/10

D = 220310 but 5100 usec of delay already exist, so D has to be greater than 215210 in order for the FC to pass...

R1(config-subif)#int s0/0.13
R1(config-subif)#delay 21522

So will EIGRP now install this route?

R1(config-subif)#do sh ip route 4.0.0.0
Routing entry for 4.0.0.0/8
  Known via "eigrp 100", distance 90, metric 10640128, type internal
  Redistributing via eigrp 100
  Last update from 10.1.12.2 on Serial0/0.12, 00:00:17 ago
  Routing Descriptor Blocks:
  * 10.1.13.3, from 10.1.13.3, 00:00:17 ago, via Serial0/0.13
      Route metric is 10640128, traffic share count is 240
      Total delay is 220320 microseconds, minimum bandwidth is 512 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 2
    10.1.12.2, from 10.1.12.2, 00:00:17 ago, via Serial0/0.12
      Route metric is 11151872, traffic share count is 229
      Total delay is 45000 microseconds, minimum bandwidth is 256 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 2

Yes, we have two routes to 4.0.0.0 but the traffic share count is wrong (it should be 2 to 1 not 240 to 229)

For this to work we need to play with delay again but this time on the R2 facing link so that the computed metric of the path using R2 is double that using R3

Metric = 256 * (B + D)
Where:    B = round (10 ^ 7 / WorstPathBandwidth)
   D = TotalPathDelay / 10



2 * 10640128 = 256 * (10^7/256 + D/10)

83126 = 39062 + D/10

D = 440640 usec (the current delay is 45000 usec, requiring an extra 395640 usec of added delay)

R1(config-subif)#do sh int s0/0.12 | inc DLY
  MTU 1500 bytes, BW 256 Kbit/sec, DLY 20000 usec,
R1(config-subif)#int s0/0.12
R1(config-subif)#delay 41564

So does this sort it out?

R1(config-subif)#do sh ip route 4.0.0.0
Routing entry for 4.0.0.0/8
  Known via "eigrp 100", distance 90, metric 10640128, type internal
  Redistributing via eigrp 100
  Last update from 10.1.12.2 on Serial0/0.12, 00:00:03 ago
  Routing Descriptor Blocks:
  * 10.1.13.3, from 10.1.13.3, 00:00:03 ago, via Serial0/0.13
      Route metric is 10640128, traffic share count is 2
      Total delay is 220320 microseconds, minimum bandwidth is 512 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 2
    10.1.12.2, from 10.1.12.2, 00:00:03 ago, via Serial0/0.12
      Route metric is 21280256, traffic share count is 1
      Total delay is 440640 microseconds, minimum bandwidth is 256 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 2


Okay, the from a routing point of view this looks good, lets make sure that CEF is active and enable per-packet load balancing

R1(config-subif)#ip cef
R1(config)#int s0/0.12
R1(config-subif)#ip load-sharing per-packet
R1(config-subif)#int s0/0.13
R1(config-subif)#ip load-sharing per-packet

To see that things are going to plan, we shall set up a service policy to match icmp traffic and attach it to both exit interfaces:

R1(config-subif)#int s0/0
R1(config-if)#load-interval 30
R1(config-if)#access-list 100 permit icmp any any
R1(config)#class-map ICMP
R1(config-cmap)#match access-group 100
R1(config-cmap)#policy-map OUT
R1(config-pmap)#class ICMP
R1(config-pmap-c)#int s0/0.12
R1(config-subif)#service-policy output OUT
R1(config-subif)#int s0/0.13
R1(config-subif)#service-policy output OUT
R1(config-subif)#do show policy-map int | s Serial|ICMP
 Serial0/0.12
    Class-map: ICMP (match-all)
      0 packets, 0 bytes
      30 second offered rate 0 bps
      Match: access-group 100

 Serial0/0.13
    Class-map: ICMP (match-all)
      0 packets, 0 bytes
      30 second offered rate 0 bps
      Match: access-group 100

R1(config-subif)#do ping 4.4.4.4 source 1.1.1.1 repeat 100

Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 12/50/100 ms

Since the load is meant to be 2:1, we should see roughly 34 packets on S0/0.12 and 66 on S0/0.13


R1(config-subif)#do show policy-map int | s Serial|ICMP
 Serial0/0.12
    Class-map: ICMP (match-all)
      35 packets, 3640 bytes
      30 second offered rate 2000 bps
      Match: access-group 100

 Serial0/0.13
    Class-map: ICMP (match-all)
      65 packets, 6760 bytes
      30 second offered rate 2000 bps
      Match: access-group 100


Seems close enough, how is CEF handling the load sharing?

R1(config-subif)#do sh ip cef 4.0.0.0 internal
4.0.0.0/8, version 691, epoch 0, per-packet sharing
0 packets, 0 bytes
  via 10.1.13.3, Serial0/0.13, 0 dependencies
    traffic share 2
    next hop 10.1.13.3, Serial0/0.13
    valid adjacency
  via 10.1.12.2, Serial0/0.12, 0 dependencies
    traffic share 1, current path
    next hop 10.1.12.2, Serial0/0.12
    valid adjacency

  0 packets, 0 bytes switched through the prefix
  tmstats: external 0 packets, 0 bytes
           internal 0 packets, 0 bytes
  Load distribution: 0 1 0 1 0 1 0 1 0 1 0 0 0 0 0 (refcount 1)

  Hash  OK  Interface                 Address         Packets
  1     Y   Serial0/0.13              point2point           0
  2     Y   Serial0/0.12              point2point           0
  3     Y   Serial0/0.13              point2point           0
  4     Y   Serial0/0.12              point2point           0
  5     Y   Serial0/0.13              point2point           0
  6     Y   Serial0/0.12              point2point           0
  7     Y   Serial0/0.13              point2point           0
  8     Y   Serial0/0.12              point2point           0
  9     Y   Serial0/0.13              point2point           0
  10    Y   Serial0/0.12              point2point           0
  11    Y   Serial0/0.13              point2point           0
  12    Y   Serial0/0.13              point2point           0
  13    Y   Serial0/0.13              point2point           0
  14    Y   Serial0/0.13              point2point           0
  15    Y   Serial0/0.13              point2point           0
  refcount 6


Interestingly it appears that CEF alternates between both links for the first few packets and then concentrates on just using S0/0.13 towards the end of the sequence