Presentation on theme: "Chap 7 – Implementing IP Addressing Services Learning Objectives"— Presentation transcript:
1 Chap 7 – Implementing IP Addressing Services Learning Objectives Configure DHCP in an enterprise branch networkConfigure NAT on a Cisco routerConfigure new generation RIP (RIPng) to use IPv6
2 Dynamic Host Configuration Protocol (DHCP) Automatically assigns IP addressesOnly DHCP server needs to be assigned an addressClient computers are configured to accept address from server after boot-upDHCP makes the process of assigning new IP addresses almost transparent. DHCP assigns IP addresses and other important network configuration information dynamically. Because desktop clients typically make up the bulk of network nodes, DHCP is an extremely useful and timesaving tool for network administrators. RFC 2131 describes DHCP.Administrators typically prefer a network server to offer DHCP services, because these solutions are scalable and relatively easy to manage.However, in a small branch or SOHO location, a Cisco router can be configured to provide DHCP services without the need for an expensive dedicated server. A Cisco IOS feature set called Easy IP offers an optional, full-featured DHCP server.
3 Dynamic Host Configuration Protocol Dynamic Host Configuration Protocol (DHCP) works in a client/server mode.DHCP enables DHCP clients on an IP network to obtain their configurations from a DHCP server.Less work is involved in managing an IP network when DHCP is used.The most significant configuration option the client receives from the server is its IP address.The DHCP protocol is described in RFC 2131DHCP is similar in operation. However, BOOTP does not dynamically allocate IP addresses to a host. When a client requests an IP address, the BOOTP server searches a predefined table for an entry that matches the MAC address for the client.If an entry exists, then the corresponding IP address for that entry is returned to the client.This means that the binding between the MAC address and the IP address must have already been configured in the BOOTP server.
4 Dynamic Host Configuration Protocol There are three mechanisms used to assign an IP address to the client:Automatic allocation – DHCP assigns a permanent IP address to a client.Manual allocation – The IP address for the client is assigned by the administrator. DHCP conveys the address to the client.Dynamic allocation – DHCP assigns, or leases, an IP address to the client for a limited period of time.
5 Major DHCP featuresThe focus of this section is the dynamic allocation mechanism.Some of the configuration parameters available are listed in IETF RFC 1533:Subnet maskRouterDomain NameDomain Name Server(s)WINS Server(s)The DHCP server creates pools of IP addresses and associated parameters. Pools are dedicated to an individual logical IP subnet. This allows multiple DHCP servers to respond and IP clients to be mobile. If multiple servers respond, a client can choose only one of the offers.
6 Dynamic Host Configuration Protocol (DHCP) DHCP Server1. Discover (Broadcast)PC 1DHCP Pool2. Offer (Unicast – do you want ?)The process of leasing an IP address using DHCP is as follows:Discover – client PC broadcasts a frame (MAC=FF:FF:FF:FF:FF:FF), requesting configuration info from any DHCP server.Offer – the DHCP server unicasts (has just learnt host’s MAC address). Provides the physical address of the requesting client, and provides an IP address and subnetmask.Request – Client responds with a broadcast identifying the server that it is accepting the IP address and subnet mask. Also informs other DHCP servers that it does not require their services (slim possibility that two DHCP servers are on the segment).Acknowledge – DHCP confirms that the IP address is now assigned to the client. Also details the lease duration, after which client must re-request IP address.3. Request (Broadcast – yes please)4. Acknowledge (Unicast – you have )
7 DHCP Detailed Operation The DHCP client configuration process uses the following steps:A client must have DHCP configured when starting the network membership process. The client sends a request to a server requesting an IP configuration. The client locates a DHCP server by sending a broadcast called a DHCPDISCOVER.When the server receives the broadcast, it determines whether it can service the request from its own database. If it cannot, the server may forward the request on to another DHCP server. If it can, the DHCP server offers the client IP configuration information in the form of a unicast DHCPOFFER.If the client finds the offer agreeable, it will send another broadcast, a DHCPREQUEST, specifically requesting those particular IP parameters. A broadcast is used because the first message, the DHCPDISCOVER, may have reached more than one DHCP server. If more than one server makes an offer, the broadcast DHCPREQUEST informs the other servers which offer was accepted.The server that receives the DHCPREQUEST makes the configuration official by sending a unicast acknowledgment, the DHCPACK. It is possible, but highly unlikely, that the server will not send the DHCPACK. This may happen because the server may have leased that information to another client in the interim. Receipt of the DHCPACK message enables the client to begin using the assigned address immediately.If the client detects that the address is already in use on the local segment it will send a DHCPDECLINE message and the process starts again. If the client received a DHCPNACK from the server after sending the DHCPREQUEST, then it will restart the process again.If the client no longer needs the IP address, the client sends a DHCPRELEASE message to the server.Clients lease the information from the server for an administratively defined period. Administrators configure DHCP servers to set the leases to time out at different intervals. Most ISPs and large networks use default lease durations of up to three days. When the lease expires, the client must ask for another address, although the client is typically reassigned the same address.Discover (Broadcast)Offer (Unicast)Request (Broadcast)Acknowledge (Unicast)
8 DHCP Message Format 8 16 24 31 OP Code Hardware HW Address Hops 8162431OP CodeHardwareHW AddressHopsTransaction IdentifierSecondsFlagsOperation Code (OP) - Specifies the general type of message. A value of 1 indicates a request message; a value of 2 is a reply message.Hardware Type - Identifies the type of hardware used in the network. For example, 1 is Ethernet, 15' is Frame Relay, and 20 is a serial line.Hardware Address length - 8 bits to specify the length of the address.Hops - Set to 0 by a client before transmitting a request and used by relay agents to control the forwarding of DHCP messages.Transaction Identifier - 32-bit identification generated by the client to allow it to match up the request with replies received from DHCP servers.Seconds - Number of seconds elapsed since a client began attempting to acquire or renew a lease. Busy DHCP servers use this number to prioritize replies when multiple client requests are outstanding.Flags - Only one of the 16 bits is used, which is the broadcast flag. A client that does not know its IP address when it sends a request, sets the flag to 1. This value tells the DHCP server or relay agent receiving the request that it should send the reply back as a broadcast.Client IP Address - The client puts its own IP address in this field if and only if it has a valid IP address while in the bound state; otherwise, it sets the field to 0. The client can only use this field when its address is actually valid and usable, not during the process of acquiring an address.Your IP Address - IP address that the server assigns to the client.Server IP Address - Address of the server that the client should use for the next step in the bootstrap process, which may or may not be the server sending this reply. The sending server always includes its own IP address in a special field called the Server Identifier DHCP option.Gateway IP Address - Routes DHCP messages when DHCP relay agents are involved. The gateway address facilitates communications of DHCP requests and replies between the client and a server that are on different subnets or networks.Client Hardware Address - Specifies the Physical layer of the client.Server Name - The server sending a DHCPOFFER or DHCPACK message may optionally put its name in this field. This can be a simple text nickname or a DNS domain name, such as dhcpserver.netacad.net.Boot Filename - Optionally used by a client to request a particular type of boot file in a DHCPDISCOVER message. Used by a server in a DHCPOFFER to fully specify a boot file directory and filename.Options - Holds DHCP options, including several parameters required for basic DHCP operation. This field is variable in length. Both client and server may use this field.Client IP Address (CIADDR)Your Address (YIADDR)Server IP Address (SIADDR)Gateway IP Address (GIADDR)Client Hardware Address (CHADDR)Server Name (SNAME)Boot FilenameDHCP Options
9 Client broadcasts DHCP request on UDP port 67 DHCP DiscoverWhen a client wants to join the network, it requests addressing values from the network DHCP server. If a client is configured to receive its IP settings dynamically, it transmits a DHCPDISCOVER message on its local physical subnet when it boots or senses an active network connection.Because the client has no way of knowing the subnet to which it belongs, the DHCPDISCOVER is an IP broadcast (destination IP address of ).The client does not have a configured IP address, so the source IP address of is used. As you see in the figure, the client IP address (CIADDR), default gateway address (GIADDR), and subnetwork mask are all marked with question marks.Client broadcasts DHCP request on UDP port 67
10 Server responds to DHCP request on UDP port 68 DHCP OfferWhen the DHCP server receives the DHCPDISCOVER message, it responds with a DHCPOFFER message. This message contains initial configuration information for the client, including the MAC address of the client, followed by the IP address that the server is offering, the subnet mask, the lease duration, and the IP address of the DHCP server making the offer. The subnet mask and default gateway are specified in the options field, subnet mask, and router options, respectively. The DHCPOFFER message can be configured to include other information, such as the lease renewal time, domain name server, and NetBIOS Name Service (Microsoft Windows Internet Name Service [Microsoft WINS]).The server determines the configuration, based on the hardware address of the client as specified in the CHADDR field.Administrators set up DHCP servers to assign addresses from predefined pools. Most DHCP servers also allow the administrator to define specifically which client MAC addresses can be serviced and automatically assign them the same IP address each time.DHCP uses User Datagram Protocol (UDP) as its transport protocol. The client sends messages to the server on port 67. The server sends messages to the client on port 68.The client and server acknowledge messages, and the process is complete. The client sets the CIADDR only when a host is in a bound state, which means that the client has confirmed and is using the IP address.Server responds to DHCP request on UDP port 68
11 Configure DHCP Server – Exclude Addresses Define a range of addresses that DHCP is not to allocate.These are usually static addresses reserved for the router interface, switch management IP address, servers, and local network printers.A best practice is to configure excluded addresses in global configuration mode before creating the DHCP pool. This ensures that DHCP does not assign reserved addresses accidentally.Specify the IP addresses that the DHCP server should not assign to clients. Typically, some IP addresses belong to static network devices, such as servers or printers. DHCP should not assign these IP addresses to other devices.A best practice is to configure excluded addresses in global configuration mode before creating the DHCP pool. This ensures that DHCP does not assign reserved addresses accidentally. To exclude specific addresses, use the ip dhcp excluded-address command.
12 Configure DHCP Server – DHCP Address Pool Configuring a DHCP server involves defining a pool of addresses to assign.The ip dhcp pool command creates a pool with the specified name and puts the router in DHCP configuration mode, which is identified by the Router(dhcp-config)# prompt.
13 Configure DHCP Server – DHCP Tasks Configure the available addresses and specify the subnet network number and mask of the DHCP address pool. Use the network statement to define the range of available addresses.Define the default gateway or router for the clients to use with the default-router command.Some of DHCP pool tasks are optional, while others must be configured.Compulsory - configure the available addresses and specify the subnet network number and mask of the DHCP address pool. Define the default gateway or router for the clients to use with the default-router command.Optional - IP address of the DNS server that is available to a DHCP client using the dns-server command, duration of the DHCP lease, NetBIOS WINS server that is available to a Microsoft DHCP client (Usually, this would be configured in an environment that supports pre-Windows 2000 clients. Because most installations now have clients with newer Windows operating system, this parameter is usually not required).
14 Configuring DHCP Server The DHCP service is enabled by default on versions of Cisco IOS that support it.To disable the service, use the no service dhcp command.Use the service dhcp global configuration command to re-enable the DHCP server process.
15 Verifying and Troubleshooting DHCP To verify the operation of DHCP, use the show ip dhcp binding command.This command displays a list of all IP address to MAC address bindings that have been provided by the DHCP service.
16 Verifying and Troubleshooting DHCP To verify that messages are being received or sent by the router, use the show ip dhcp server statistics command.This command displays count information regarding the number of DHCP messages that have been sent and received.
17 Verifying and Troubleshooting DHCP View multiple DHCP pools using the show ip dhcp pool command.
18 Verifying and Troubleshooting DHCP From the Client PC command line, enter <IPCONFIG /ALL> to display the IP settings of the computer:IP Address – Layer 3 address of this PC.Subnet Mask – Used to identify network.Default Gateway – destination for all packets with destination IP addresses outside the local network – usually the local router.DHCP – assigns IP address assigned by a central server – explanation in a few slides time.DNS – resolves URLs to IP addresses – explanation coming up.Lease – how long the IP address can be held before the client need to renew it via the DHCP server.
19 Configuring DHCP Client Fa0/1Fa0/0DHCPServerSOHOISPCisco routers in SOHO and branch sites may have to be configured to accept an interface IP address from the ISP’s DHCP server.Frequently, it is the Ethernet interface that is used to connect to a cable modem.
20 DHCP RelayDHCP clients use IP broadcasts to find the DHCP server on thesegment - Routers do not forward these broadcasts.When possible, administrators should use the ip helper-addresscommand to relay broadcast requests for these key UDP services.DHCP is not the only critical service that uses broadcasts. Cisco routers and other devices may use broadcasts to locate TFTP servers. Some clients may need to broadcast to locate a TACACS authentication server.Typically, in a complex hierarchical network, clients do not reside on the same subnet as key servers. Such remote clients will broadcast to locate these servers. However, routers, by default, will not forward client broadcasts beyond their subnet.Because some clients are useless without services such as DHCP, one of two choices must be implemented. The administrator will need to place servers on all subnets or use the Cisco IOS helper address feature. Running services such as DHCP or DNS on several computers creates overhead and administrative difficulties making the first option inefficient. When possible, administrators should use the ip helper-address command to relay broadcast requests for these key UDP services.
21 DHCP RelayBy default, the ip helper-address command forwards the following eight UDP services:TimeTACACSDNSBOOTP/DHCP ServerBOOTP/DHCP ClientTFTPNetBIOS Name ServiceNetBIOS datagram ServiceDHCP is not the only service that the router can be configured to relay. By default, the ip helper-address command forwards the following eight UDP services:Port 37: TimePort 49: TACACSPort 53: DNSPort 67: DHCP/BOOTP clientPort 68: DHCP/BOOTP serverPort 69: TFTPPort 137: NetBIOS name servicePort 138: NetBIOS datagram serviceTo specify additional ports, use the ip forward-protocol command to specify exactly which types of broadcast packets to forward.
22 Configuring IP helper addresses To configure RTA e0, the interface that receives the Host Abroadcasts, to relay DHCP broadcasts as a unicast to the DHCP server,use the following commands:RTA(config)#interface e0RTA(config-if)#ip helper-addressIP helper-address is used to ‘point’ broadcasts at the right server.It is applied to the router interface that first accepts the broadcast.
23 Trouble Shooting DHCP Resolving IP Address Conflicts Verify Physical ConnectivityTest Network Connectivity by Configuring Client workstation with a Static IP AddressVerify Switch Port Configuration (STP Portfast and other Commands)Distinguishing whether DHCP Clients Obtain IP address on the Same Subnet or VLAN as DHCP ServerThe show ip dhcp conflict command displays all address conflicts recorded by the DHCP server. The server uses the ping command to detect conflicts. The client uses Address Resolution Protocol (ARP) to detect clients. If an address conflict is detected, the address is removed from the pool and not assigned until an administrator resolves the conflict.When troubleshooting any DHCP issue, verify network connectivity by configuring a static IP address on a client workstation. If the workstation is unable to reach network resources with a statically configured IP address, the root cause of the problem is not DHCP. At this point, network connectivity troubleshooting is required.
24 Private & Public IP Addresses Public Internet addresses are regulated by five Regional Internet Registries (RIRs):ARINRIPEAPNICLACNICAfriNICAll public Internet addresses must be registered with a Regional Internet Regiestry (RIR).Organisations can lease public addresses from an ISP.Only the registered holder of a public Internet address can assign that address to a network device.Graphic
25 Private IP Addresses Class A 10.0.0.0 to 10.255.255.255 Class B Class CThese private addresses are for private, internal network use only. Packets containing these addresses are not routed over the Internet, and are referred to as non-routable addresses. RFC 1918 provides details.Unlike public IP addresses, private IP addresses are a reserved block of numbers that can be used by anyone. That means two networks, or two million networks, can each use the same private addresses. To prevent addressing conflicts, routers must never route private IP addresses. To protect the public Internet address structure, ISPs typically configure the border routers to prevent privately addressed traffic from being forwarded over the Internet.By providing more address space than most organizations could obtain through a RIR, private addressing gives enterprises considerable flexibility in network design. This enables operationally and administratively convenient addressing schemes as well as easier growth.to
26 Network Address Translation Router is configured to ‘hide’ private IP addresses by substituting them for the public IP address assigned to its Internet interface, and carrying out the reverse process for received packets.DestinationSourceSegmentRouterHowever, private addresses cannot be routed over the Internet, and there are not enough public addresses to allow organizations to provide one to every one of their hosts, networks need a mechanism to translate private addresses to public addresses at the edge of their network that works in both directions.Without a translation system, private hosts behind a router in the network of one organization cannot connect with private hosts behind a router in other organizations over the Internet.Network Address Translation (NAT) provides this mechanism. Before NAT, a host with a private address could not access the Internet. Using NAT, individual companies can address some or all of their hosts with private addresses and use NAT to provide access to the Internet.DestinationSourceSegmentPacket
27 Introducing NAT and PAT NAT, as defined by RFC 1631, is the process of swapping one address for another in the IP packet header.In practice, NAT is used to allow hosts that are privately addressed to access the Internet.NAT translations can occur dynamically or statically.The most powerful feature of NAT routers is their capability to use port address translation (PAT), which allows multiple inside addresses to map to the same outside address.
28 NAT Terms Cisco defines the following NAT terms: Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Centre (InterNIC) or service provider. This address is likely to be an RFC 1918 private address.Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this address.Inside local address - Usually not an IP address assigned by a RIR or service provider and is most likely an RFC 1918 private address. In the figure, the IP address is assigned to the host PC1 on the inside network.Inside global address - Valid public address that the inside host is given when it exits the NAT router. When traffic from PC1 is destined for the web server at , router R2 must translate the address. In this case, IP address is used as the inside global address for PC1.Outside global address - Reachable IP address assigned to a host on the Internet. For example, the web server is reachable at IP address
29 The translation from Private source IP address NAT ExampleDASADASARTAWhen a host inside the stub network wants to transmit to a host on the outside, it forwards the packet to the border gateway router - RTA in this example.The border gateway router performs the NAT process, translating the internal private address (inside local) of a host to a public, external routable address (outside global).Outside GlobalInside LocalOutside GlobalInside GlobalThe translation from Private source IP addressto Public source IP address.
30 Translation back, from Public destination IP NAT ExampleDASADASARTAThe outside host responds to the NAT host, addressing its packets to the inside global address assigned by RTA.Incoming packets are re-addressed by RTA, which removes the inside global address with the required inside local address being used by the NAT host.Inside LocalOutside GlobalInside GlobalOutside GlobalTranslation back, from Public destination IPaddress to Private destination IP address.
31 NAT FeaturesStatic NAT is designed to allow one-to-one mapping of local and global addresses. This is particularly useful for hosts which must have a consistent address that is accessible from the Internet. These internal hosts may be enterprise servers or networking devices.Dynamic NAT is designed to map a private IP address to a public address. Any IP address from a pool of public IP addresses is assigned to a network host.
32 NAT OverloadNAT Overload or Port Address Translation (PAT) uses unique source port numbers on the inside global IP address to distinguish between translations. The port number is encoded in 16 bits.The total number of internal addresses that can be translated to one external address could theoretically be as high as 65,536 per IP address. Realistically, the number of ports that can be assigned a single IP address is around 4000.PAT will attempt to preserve the original source port. If this source port is already used, PAT will assign the first available port number starting from the beginning of the appropriate port group 0-511, , orWhen there are no more ports available and there is more than one external IP address configured, PAT moves to the next IP address to try to allocate the original source port again. This process continues until it runs out of available ports and external IP addresses.NAT Overload allows you to use a single Public IP address and assign it up to 65,536 inside hosts (4,000 is more realistic).Modifies the TCP/UDP source port to track inside Host addresses if both hosts select the same source port.
33 NAT Benefits Conserves the legally registered addressing scheme Increases the flexibility of connections to the public networkProvides consistency for internal network addressing schemes.Provides network securityNAT conserves the legally registered addressing scheme by allowing the privatisation of intranets. NAT conserves addresses through application port-level multiplexing. With NAT overload, internal hosts can share a single public IP address for all external communications. In this type of configuration, very few external addresses are required to support many internal hosts.NAT increases the flexibility of connections to the public network. Multiple pools, backup pools, and load-balancing pools can be implemented to ensure reliable public network connections.NAT provides consistency for internal network addressing schemes. On a network without private IP addresses and NAT, changing public IP addresses requires the renumbering of all hosts on the existing network. The costs of renumbering hosts can be significant. NAT allows the existing scheme to remain while supporting a new public addressing scheme. This means an organization could change ISPs and not need to change any of its inside clients.NAT provides network security. Because private networks do not advertise their addresses or internal topology, they remain reasonably secure when used in conjunction with NAT to gain controlled external access. However, NAT does not replace firewalls.
34 NAT Drawbacks Performance is degraded End-to-end functionality is degradedEnd-to-end IP traceability is lostTunneling is more complicatedInitiating TCP connections can be disruptedArchitectures need to be rebuilt to accommodate changesNAT increases switching delays because the translation of each IP address within the packet headers takes time. The first packet is process-switched, meaning it always goes through the slower path. The router must look at every packet to decide whether it needs translation. The router needs to alter the IP header, and possibly alter the TCP or UDP header. Remaining packets go through the fast-switched path if a cache entry exists; otherwise, they too are delayed.Many Internet protocols and applications depend on end-to-end functionality, with unmodified packets forwarded from the source to the destination. By changing end-to-end addresses, NAT prevents some applications that use IP addressing. For example, some security applications, such as digital signatures, fail because the source IP address changes. Applications that use physical addresses instead of a qualified domain name do not reach destinations that are translated across the NAT router. Sometimes, this problem can be avoided by implementing static NAT mappings.End-to-end IP traceability is also lost. It becomes much more difficult to trace packets that undergo numerous packet address changes over multiple NAT hops, making troubleshooting challenging. On the other hand, hackers who want to determine the source of a packet find it difficult to trace or obtain the original source or destination address.Using NAT also complicates tunneling protocols, such as IPsec, because NAT modifies values in the headers that interfere with the integrity checks done by IPsec and other tunneling protocols.Services that require the initiation of TCP connections from the outside network, or stateless protocols such as those using UDP, can be disrupted. Unless the NAT router makes a specific effort to support such protocols, incoming packets cannot reach their destination. Some protocols can accommodate one instance of NAT between participating hosts (passive mode FTP, for example), but fail when both systems are separated from the Internet by NAT.
35 Configuring Static NAT Inside NetworkInternetS0/0/0S0/1/0R2ServerStatic TranslationTo configure static inside source address translation, perform the router configuration as per the slide.IP nat inside source static defines as the inside local address, and as the inside global.Each interface is then assigned the correct IP address.IP nat inside marks interface s0/0/0 as the inside local address.IP nat outside marks interface s0/1/0 as the inside global address.
36 Configuring Dynamic NAT S0/0/0S0/1/0InternetDynamic NATtranslates all source addresses passing access list 1, which have source address from /16, to an address from the pool named nat-pool1. The pool contains addresses from /27 to /27.IP nat pool nat-pool1 specifies the range of outside global addresses with the required subnet mask.Access-list 1 permit allows specifies that addresses to are candidates for translation.IP nat inside source list 1 pool nat-pool1 specifies that the local inside addresses that require translation are detailed in access list 1.Interfaces are assigned IP addresses, and configured as inside and outside.The access list must permit only those addresses that are to be translated. Remember that there is an implicit “deny all” at the end of each access list. An access list that is too permissive can lead to unpredictable results.Cisco advises against configuring access lists referenced by NAT commands with the permit any command. Using permit any can result in NAT consuming too many router resources, which can cause network problems.
37 Configuring NAT Overload (Single Address) S0/1/0InternetConfiguring NAT Overload for a Single Public IP AddressWith only one public IP address, the overload configuration typically assigns that public address to the outside interface that connects to the ISP. All inside addresses are translated to the single IP address when leaving the outside interface.The configuration is similar to dynamic NAT, except that instead of a pool of addresses, the interface keyword is used to identify the outside IP address. Therefore, no NAT pool is defined. The overload keyword enables the addition of the port number to the translation.This example shows how NAT overload is configured. In the example, all hosts from network /16 (matching ACL 1) sending traffic through router R2 to the Internet are translated to IP address (interface S0/1/0 IP address). The traffic flows are identified by port numbers, because the overload keyword was used.
38 Configuring NAT Overload (Multiple Addresses) S0/1/0InternetConfiguring NAT Overload for a Pool of Public IP AddressesIn the scenario where the ISP has provided more than one public IP address, NAT overload is configured to use a pool. The primary difference between this configuration and the configuration for dynamic, one-to-one NAT is that the overload keyword is used. Remember that the overload keyword enables port address translation.In this example, the configuration establishes overload translation for NAT pool NAT-POOL2. The NAT pool contains addresses and is translated using PAT. Hosts in the /16 network are subject to translation. Finally, the inside and outside interfaces are identified.
39 Re-direct traffic for port 80 to Port ForwardingWWW ServerS0/0/0S0/1/0InternetRe-direct traffic for port 80 toPort forwarding (sometimes referred to as tunneling) is the act of forwarding a network port from one network node to another. This technique can allow an external user to reach a port on a private IP address (inside a LAN) from the outside through a NAT-enabled router.The problem is that NAT does not allow requests initiated from the outside. This situation can be resolved with manual intervention. Port forwarding allows the identification of specific ports that can be forwarded to inside hosts.Port forwarding allows users on the Internet to access internal servers by using the WAN port address and the matched external port number.When users send these types of requests to your WAN port IP address via the Internet, the router forwards those requests to the appropriate servers on your LAN. For security reasons, broadband routers do not by default permit any external network request to be forwarded to an inside host.
40 Verifying & Troubleshooting NAT Configuration By default, NAT translation entries time out after 24 hours.It is sometimes useful to clear the dynamic entries sooner than the default timer. This is especially true when testing the NAT configuration.By default, translation entries time out after 24 hours, unless the timers have been reconfigured with the ip nat translation timeouttimeout_ seconds command in global configuration mode.It is sometimes useful to clear the dynamic entries sooner than the default. This is especially true when testing the NAT configuration. To clear dynamic entries before the timeout has expired, use the clear ip nat translation global command.The slide shows the various ways to clear the NAT translations. You can be very specific about which translation to clear, or you can clear all translations from the table using the clear ip nat translation * global command, as shown in the slideOnly the dynamic translations are cleared from the table. Static translations cannot be cleared from the translation table.
41 Verifying & Troubleshooting NAT Configuration Sh ip nat translations - R2 has been configured to provide NAT overload to the /16 clients. When the internal hosts exit router R2 to the Internet, they are translated to the IP address of the serial interface with a unique source port number.Adding verbose to the command displays additional information about each translation, including how long ago the entry was created and used.The command displays all static translations that have been configured as well as any dynamic translations that have been created by traffic. Each translation is identified by protocol as well as inside and outside local and global addresses.
42 Verifying & Troubleshooting NAT Configuration The show ip nat statistics command displays information about the total number of active translations, NAT configuration parameters, how many addresses are in the pool, and how many have been allocated.
43 Verifying & Troubleshooting NAT Configuration When decoding the debug output, note what the following symbols and values indicate:The asterisk next to NAT indicates that the translation is occurring in the fast-switched path. The first packet in a conversation is always process-switched, which is slower. The remaining packets go through the fast-switched path if a cache entry exists.s= - Refers to the source IP address.a.b.c.d--->w.x.y.z - Indicates that source address a.b.c.d is translated to w.x.y.z.d= - Refers to the destination IP address.[xxxx] - The value in brackets is the IP identification number. This information may be useful for debugging in that it enables correlation with other packet traces from protocol analyzers.
44 IPv6 – The Reason WhyTo comprehend the IP addressing issues facing network administrators today, consider that the IPv4 address space provides approximately 4,294,967,296 unique addresses. Of these, only 3.7 billion addresses are assignable because the IPv4 addressing system separates the addresses into classes and reserves addresses for multicasting, testing, and other specific uses.Based on figures as recent as January 2007, about 2.4 billion of the available IPv4 addresses are already assigned to end users or ISPs. That leaves roughly 1.3 billion addresses still available from the IPv4 address space. Despite this seemingly large number, IPv4 address space is running out.Over the past decade, the Internet community has analyzed IPv4 address exhaustion and published mountains of reports. Some reports predict IPv4 address exhaustion by 2010, and others say it will not happen until 2013.The growth of the Internet, matched by increasing computing power, has extended the reach of IP-based applications.
45 IPv4 / IPv6 ComparisonThere are so many IPv6 addresses available that many trillions of addresses could be assigned to every human being on the planet.There are approximately 665,570,793,348,866,943,898,599 addresses per square meter of the surface of the planet Earth!The slide compares the binary and alphanumeric representations of IPv4 and IPv6 addresses.An IPv6 address is a 128-bit binary value, which can be displayed as 32 hexadecimal digits.IPv6 should provide sufficient addresses for future Internet growth needs for many years to come.There are enough IPv6 addresses to allocate more than the entire IPv4 Internet address space to everyone on the planet.Given the huge installed base of IPv4 in the world, it is not difficult to appreciate that transitioning to IPv6 from IPv4 deployments is a challenge. There are, however, a variety of techniques, including an auto-configuration option, to make the transition easier. The transition mechanism you use depends on the needs of a particular network.
46 IPv6 Representation Enhanced IP addressing: Global reachability and flexibilityAggregationMultihomingAutoconfigurationPlug-and-playEnd-to-end without NATRenumberingMobility and security:Mobile IP RFC-compliantIPsec mandatory (or native) for IPv6Simple header:Routing efficiencyPerformance and forwarding rate scalabilityNo broadcastsNo checksumsExtension headersFlow labelsTransition richness:Dual-stack6to4 and manual tunnelsTranslationThe development of IPv6 has presented opportunities to apply lessons learned from the limitations of IPv4 to create a protocol with new and improved features.A simplified header architecture and protocol operation translates into reduced operational expenses. Built-in security features mean easier security practices that are sorely lacking in many current networks. However, perhaps the most significant improvement offered by IPv6 is the address auto-configuration features it has.The Internet is rapidly evolving from a collection of stationary devices to a fluid network of mobile devices. IPv6 allows mobile devices to quickly acquire and transition between addresses as they move among foreign networks, with no need for a foreign agent. (A foreign agent is a router that can function as the point of attachment for a mobile device when it roams from its home network to a foreign network.)Address auto-configuration also means more robust plug-and-play network connectivity. Auto-configuration supports consumers who can have any combination of computers, printers, digital cameras, digital radios, IP phones, Internet-enabled household appliances, and robotic toys connected to their home networks. Many manufacturers already integrate IPv6 into their products.
47 IPv6 Packet Header 4 8 16 24 31 Traffic Class Flow Label 48162431VersionTraffic ClassFlow LabelPayload LengthNext HeaderHop LimitSource IP AddressSource IP AddressSource IP AddressSource IP AddressThe IPv6 header has 40 octets, three IPv4 basic header fields, and five additional header fields. The IPv6 simplified header offers several advantages over IPv4:Better routing efficiency for performance and forwarding-rate scalability.No broadcasts and thus no potential threat of broadcast storms.No requirement for processing checksums.Simplified and more efficient extension header mechanisms.Flow labels for per-flow processing with no need to open the transport inner packet to identify the various traffic flows.Destination IP AddressDestination IP AddressDestination IP AddressDestination IP Address
48 An IPv6 address can be shortened by applying the following guidelines: IPv6 Addressing2031:0000:130F:0000:0000:09C0:876A:130B.An IPv6 address can be shortened by applying the following guidelines:Leading zeros in a field are optional. For example, the field 09C0 equals 9C0, and the field 0000 equals 0. Therefore:2031:0000:130F:0000:0000:09C0:876A:130B can be written as 2031:0:130F:0000:0000:9C0:876A:130B.Successive fields of zeros can be represented as two colons "::". However, this shorthand method can only be used once in an address. Therefore:2031:0:130F:0000:0000:9C0:876A:130B can be written as 2031:0:130F::9C0:876A:130B.An unspecified address is written as "::" because it contains only zeros.
50 IPv6 Address Structure128 BitsNetwork PortionHost Portion48 Bits16 Bits64 BitsGlobal Routing PrefixSubnet IDInterface IDInterface ID – identifies a host interface addressSubnet ID – 65,536 possible subnetsGlobal Routing Prefix – issued by IANA or RIR to ISPs at /32 or /35 in length, ISPs then issue to customers with /48 maskThe most striking difference between IPv4 and IPv6 addresses is the location of the subnet identifier as part of the network portion of the address rather than the host portion.This means that the Interface ID is a consistent size, which simplifies the parsing of the address.It also creates a clear separation of functions; the network portion provides the location of the device down to the specific datalink and the host portion provides the identity of the device on the data link.
51 IPv6 Address Types Address Type MSB (Binary) MSB (Hex) Unspecified 00..0::/128Loopback00..1::1/128MulticastFF00::/8Link-Local UnicastFExx::/10Global Unicast0012xxx::/4Or3xxx::/4Link Local - Routers do not forward datagrams using link-local addresses at all, not even within the organization; they are only for local communication on a particular physical network segment. They are used for link communications such as automatic address configuration, neighbor discovery, and router discovery. Many IPv6 routing protocols also use link-local addresses. Link-local addresses begin with "FE" and then have a value from "8" to "B" for the third hexadecimal digit. So, these addresses start with "FE8", "FE9", "FEA", or "FEB".Unspecified Address - an address of all zeroes refers to the host itself, and is used when a device does not know its own address. In IPv6, this all-zeroes address (0:0:0:0:0:0:0:0) is named the "unspecified" address.Loopback Address – provided for testing; datagrams sent to this address "loop back" to the sending device. Unlike IPv6, there is a single loopback address - 0:0:0:0:0:0:0:1.
52 Assigning IPv6 Addresses 64 BitsGlobal Routing PrefixSubnet IDInterface IDIPv6 addresses use interface identifiers to identify interfaces on a link.Interface identifiers are required to be unique on a specific link.Interface identifiers are always 64 bits and can be dynamically derived from a Layer 2 address (MAC).IPv6 address ID can be assigned statically or dynamically:Static assignment using a manual interface IDStatic assignment using an EUI-64 interface IDStateless auto-configurationDHCP for IPv6 (DHCPv6)
53 Manual Interface ID Assignment Statically assign an IPv6 address to a device by manually assigning both the prefix (network) and interface ID (host) portion of the IPv6 address:RouterX(config-if)#ipv6 address 2001:DB8:2222:7272::72/64
54 Manual Interface ID Assignment Each layer-2 MAC address consists of a 12-digit hexadecimal number, split into 2-digit pairs by colons: 07:57:AC:1F:B2:76EUI-64 stretches IEEE 802 MAC addresses from 48 to 64 bits by inserting 0xFFFE in the middle at the 24th bit of the MAC address to create a 64-bit, unique interface identifier:07:57:AC:FF:FE:1F:B2:76Assign an EUI-64 address to the interface of a Cisco router:RouterX(config-if)#ipv6 address 2001:DB8:2222:7272::/64 eui-64EUI – Extended Universal Identifier
55 IPv6 Transition Strategies Different transition mechanisms are available:Dual stackManual tunnel6to4 tunnelISATAP tunnelTeredo tunnelDifferent compatibility mechanisms:Proxying and translation (NAT-PT)"Dual stack where you can, tunnel where you must."Dual stacking is an integration method in which a node has implementation and connectivity to both an IPv4 and IPv6 network. This is the recommended option and involves running IPv4 and IPv6 at the same time. Router and switches are configured to support both protocols, with IPv6 being the preferred protocol.There are several tunneling techniques available, including:Manual IPv6-over-IPv4 tunneling - An IPv6 packet is encapsulated within the IPv4 protocol. This method requires dual-stack routers.Dynamic 6to4 tunneling - Automatically establishes the connection of IPv6 islands through an IPv4 network, typically the Internet. It dynamically applies a valid, unique IPv6 prefix to each IPv6 island, which enables the fast deployment of IPv6 in a corporate network without address retrieval from the ISPs or registries.Cisco IOS Release 12.3(2)T and later (with the appropriate feature set) also include NAT-PT between IPv6 and IPv4. This translation allows direct communication between hosts that use different versions of the IP protocol.
56 Cisco Dual IOS Stack IPv4 Internet IPv6 Internet Fa0/1IPv4InternetIPv4IPv6InternetIPv6ApplicationTransportIPv4IPv6EthernetDual stacking is an integration method that allows a node to have connectivity to an IPv4 and IPv6 network simultaneously. Each node has two protocol stacks with the configuration on the same interface or on multiple interfaces.The dual-stack approach to IPv6 integration, in which nodes have both IPv4 and IPv6 stacks, will be one of the most commonly used integration methods. A dual-stack node chooses which stack to use based on the destination address of the packet. A dual-stack node should prefer IPv6 when it is available. Old IPv4-only applications continue to work as before. New and modified applications take advantage of both IP layers.Cisco IOS Release 12.2(2)T and later are IPv6-ready. As soon as IPv4 and IPv6 is configured on the interface, it becomes dual-stacked and forwards IPv4 and IPv6 traffic on that interface.
57 IPv6 TunnellingTunneling is an integration method in which an IPv6 packet is encapsulated within another protocol, such as IPv4.Requires dual-stack routersTunneling is an integration method where an IPv6 packet is encapsulated within another protocol, such as IPv4. This method enables the connection of IPv6 islands without needing to convert the intermediary networks to IPv6. When IPv4 is used to encapsulate the IPv6 packet, a protocol type of 41 is specified in the IPv4 header, and the packet includes a 20-byte IPv4 header with no options and an IPv6 header and payload. It also requires dual-stack routers.Tunneling presents these two issues. The maximum transmission unit (MTU) is effectively decreased by 20 octets if the IPv4 header does not contain any optional fields. In addition, a tunneled network is often difficult to troubleshoot.Tunneling is an intermediate integration and transition technique and should not be considered as a final solution. A native IPv6 architecture should be the ultimate goal.
58 IPv6 Routing Considerations IPv6 address size - Address size affects the information-processing functions of a router. Systems using a 64-bit CPU, bus, or memory structure can pass both the IPv4 source and destination address in a single processing cycle. For IPv6, the source and destination addresses require two cycles each-four cycles to process source and destination address information – reduction in performance.Multiple IPv6 node addresses - Because IPv6 nodes can use several IPv6 unicast addresses, memory consumption of the Neighbor Discovery cache may be affected.IPv6 routing protocols - IPv6 routing protocols are similar to their IPv4 counterparts, but since an IPv6 prefix is four times larger than an IPv4 prefix, routing updates have to carry more information.Routing table Size -Increased IPv6 address space leads to larger networks and a much larger Internet. This implies larger routing tables and higher memory requirements to support them.
59 Routing Information Protocol Next Generation (RIPng) RFC 2080 defines RIPng as a simple routing protocol based on RIP. RIPng is no more or less powerful than RIP, however, it provides a simple way to bring up an IPv6 network without having to build a new routing protocol.RIPng includes the following features:Based on IPv4 RIP version 2 (RIPv2) and is similar to RIPv2Uses IPv6 for transportIncludes the IPv6 prefix and next-hop IPv6 addressUses the multicast group FF02::9 as the destination address for RIP updates (this is similar to the broadcast function performed by RIP in IPv4)Sends updates on UDP port 521Is supported by Cisco IOS Release 12.2(2)T and laterRIPng is a distance vector routing protocol with a limit of 15 hops that uses split horizon and poison reverse updates to prevent routing loops.Its simplicity comes from the fact that it does not require any global knowledge of the network. Only neighboring routers exchange local messages.
60 Configure IPv6 Address MAC Address 0260:3e47.1530 Either completely specify the IPv6 address or compute the host identifier (rightmost 64 bits) from the EUI-64 identifier of the interface.In the example, the IPv6 address of the interface is configured using the EUI-64 format.Configuring an IPv6 address on an interface automatically configures the link-local address for that interface.
61 Configure RIPng With IPv6 R1 ConfigR1LAN1: 2001:db8:1:1::/64E0R2 ConfigR2E1The example shows a network of two routers. Router R1 is connected to the default network. On both router R2 and router R1, the name RT0 identifies the RIPng process.RIPng is enabled on the first Ethernet interface of router R1 using the ipv6 rip RT0 enable command. Router R2 shows that RIPng is enabled on both Ethernet interfaces using the ipv6 rip RT0 enable command.This configuration allows Ethernet 1 on router R2 and the Ethernet 0 interfaces of both routers to exchange RIPng routing information.LAN2: 2001:db8:1:2::/64
65 Chapter 7.1.8 – Configuring DHCP Lab TopologyChapter – Configuring DHCP/27ISPFa0/0/24S0/1/0R2.225S0/0/0S0/0/1DCEDNS Server/24.2.1/27/30/30S0/0/0DCES0/0/1.1.2R1R3/27The router (R1) connected to the Internet is used to propagate a default route to other routers in the OSPF routing domain.This router is sometimes called the edge, entrance or gateway router.However, in OSPF terminology, the router located between an OSPF routing domain and a non-OSPF network is called the Autonomous System Boundary Router (ASBR).In the topology shown, the Loopback1 (Lo1) represents a link to a non-OSPF network..1Fa0/1.1Fa0/0/24/24S1S3PC1PC3
67 Chapter 7.2.8 – Configuring NAT Lab TopologyChapter – Configuring NAT/27ISPFa0/0/24S0/1/0R2S0/0/0S0/0/1DCEInside WWW ServerLocal: /24Global:.2.1Outside Host/28/30/30S0/0/0DCES0/0/1.1.2R1R3/28The router (R1) connected to the Internet is used to propagate a default route to other routers in the OSPF routing domain.This router is sometimes called the edge, entrance or gateway router.However, in OSPF terminology, the router located between an OSPF routing domain and a non-OSPF network is called the Autonomous System Boundary Router (ASBR).In the topology shown, the Loopback1 (Lo1) represents a link to a non-OSPF network..1Fa0/1.1Fa0/0/24/24S1S3PC1PC3
69 Chapter 7.4.1 – Configuring DHCP & NAT Lab TopologyChapter – Configuring DHCP & NATFa0/0/24R2S0/0/1DCES0/0/0Inside WWW ServerLocal: /24Global:.2.225/30/30S0/0/0DCES0/0/1.1.226R1ISPFa0/0Fa0/1/24The router (R1) connected to the Internet is used to propagate a default route to other routers in the OSPF routing domain.This router is sometimes called the edge, entrance or gateway router.However, in OSPF terminology, the router located between an OSPF routing domain and a non-OSPF network is called the Autonomous System Boundary Router (ASBR).In the topology shown, the Loopback1 (Lo1) represents a link to a non-OSPF network..1.1/24S1S2PC1PC2