Deploying OSPF for ISPs. ISP Training Workshops

Transcription

1 Deployig OSPF for ISPs ISP Traiig Workshops 1

2 Ageda p OSPF Desig i SP Networks p Addig Networks i OSPF p OSPF i Cisco s IOS 2

3 OSPF Desig As applicable to Service Provider Networks 3

4 Service Providers p p p p p SP etworks are divided ito PoPs PoPs are liked by the backboe Trasit routig iformatio is carried via ibgp IGP is oly used to carry the ext hop for BGP Optimal path to the ext hop is critical 4

5 SP Architecture p p Major routig iformatio is ~430K prefixes via BGP Largest kow IGP routig table is ~9 10K POP Area 1/L1 BGP 1 POP Area 2/L1 BGP 1 p p p Total of 440K 10K/440K is 2½% of IGP routes i a ISP etwork A very small factor but has a huge impact o etwork covergece! Area 6/L1 BGP 1 POP IP Backboe Area 5/L1 BGP 1 POP Area0/L2 BGP 1 Area 4/L1 BGP 1 POP Area 3/L1 BGP 1 POP 5

6 SP Architecture p p p p You ca reduce the IGP size from 10K to approx the umber of routers i your etwork This will brig really fast covergece Optimise where you must ad summarise where you ca Stops uecessary flappig RR Access Regioal Core IGP customer customer customer 6

7 OSPF Desig: Addressig p OSPF Desig ad Addressig go together Objective is to keep the Lik State Database lea Create a address hierarchy to match the topology Use separate Address Blocks for loopbacks, etwork ifrastructure, customer iterfaces & customers Customer Address Space PtP Liks Ifrastructure Loopbacks 7

8 OSPF Desig: Addressig p Miimisig the umber of prefixes i OSPF: Number loopbacks out of a cotiguous address block p But do ot summarise these across area boudaries: ibgp peer addresses eed to be i the IGP Use cotiguous address blocks per area for ifrastructure poit-to-poit liks p Use area rage commad o ABR to summarise p With these guidelies: Number of prefixes i area 0 will the be very close to the umber of routers i the etwork It is critically importat that the umber of prefixes ad LSAs i area 0 is kept to the absolute miimum 8

9 OSPF Desig: Areas p Examie physical topology Is it meshed or hub-ad-spoke? p Use areas ad summarisatio This reduces overhead ad LSA couts (but watch ext-hop for ibgp whe summarisig) p Do t bother with the various stub areas No beefits for ISPs, causes problems for ibgp p Push the creatio of a backboe Reduces mesh ad promotes hierarchy 9

10 OSPF Desig: Areas p Oe SPF per area, floodig doe per area Watch out for overloadig ABRs p Avoid exterals i OSPF DO NOT REDISTRIBUTE ito OSPF Exteral LSAs flood through etire etwork p Differet types of areas do differet floodig Normal areas Stub areas Totally stubby (stub o-summary) Not so stubby areas (NSSA) 10

11 OSPF Desig: Areas p Area 0 must be cotiguous Do NOT use virtual liks to joi two Area 0 islads p Traffic betwee two o-zero areas always goes via Area 0 There is o beefit i joiig two o-zero areas together Avoid desigs which have two o-zero areas touchig each other (Typical desig is a area per PoP, with core routers beig ABR to the backboe area 0) 11

12 OSPF Desig: Summary p Thik Redudacy Dual Liks out of each area usig metrics (cost) for traffic egieerig p Too much redudacy Dual liks to backboe i stub areas must be the same cost other wise sub-optimal routig will result Too Much Redudacy i the backboe area without good summarisatio will effect covergece i the Area 0 12

13 OSPF Areas: Migratio p Where to place OSPF Areas? Follow the physical topology! Remember the earlier desig advice p Cofigure area at a time! Start at the outermost edge of the etwork Log ito routers at either ed of a lik ad chage the lik from Area 0 to the chose Area Wait for OSPF to re-establish adjacecies Ad the move oto the ext lik, etc Importat to esure that there is ever a Area 0 islad aywhere i the migratig etwork 13

14 OSPF Areas: Migratio A Area 0 B E D Area 10 F C G p Migrate small parts of the etwork, oe area at a time Remember to itroduce summarisatio where feasible p With careful plaig, the migratio ca be doe with miimal etwork dowtime 14

15 OSPF for Service Providers Cofigurig OSPF & Addig Networks 15

16 OSPF: Cofiguratio p Startig OSPF i Cisco s IOS router ospf 100 Where 100 is the process ID p OSPF process ID is uique to the router Gives possibility of ruig multiple istaces of OSPF o oe router Process ID is ot passed betwee routers i a AS May ISPs cofigure the process ID to be the same as their BGP Autoomous System Number 16

17 OSPF: Establishig Adjacecies p Cisco IOS OSPFv2 automatically tries to establish adjacecies o all defied iterfaces (or subets) p Best practice is to disable this Potetial security risk: sedig OSPF Hellos outside of the autoomous system, ad riskig formig adjacecies with exteral etworks Example: Oly POS4/0 iterface will attempt to form a OSPF adjacecy router ospf 100 passive-iterface default o passive-iterface POS4/0 17

18 OSPF: Addig Networks Optio Oe p Redistributio: Applies to all coected iterfaces o the router but seds etworks as exteral type-2s which are ot summarised router ospf 100 redistribute coected subets p Do NOT do this! Because: Type-2 LSAs flood through etire etwork These LSAs are ot all useful for determiig paths through backboe; they simply take up valuable space 18

19 OSPF: Addig Networks Optio Two p Per lik cofiguratio from IOS 12.4 owards OSPF is cofigured o each iterface (same as ISIS) Useful for multiple subets per iterface iterface POS 4/0 ip address ip address secodary ip ospf 100 area 0! router ospf 100 passive-iterface default o passive-iterface POS 4/0 19

20 OSPF: Addig Networks Optio Three p Specific etwork statemets Every active iterface with a cofigured IP address eeds a OSPF etwork statemet Iterfaces that will have o OSPF eighbours eed passive-iterface to disable OSPF Hello s p That is: all iterfaces coectig to devices outside the ISP backboe (i.e. customers, peers, etc) router ospf 100 etwork area 51 etwork area 51 passive-iterface Serial 1/0 20

21 OSPF: Addig Networks Optio Four p Network statemets wildcard mask Every active iterface with cofigured IP address covered by wildcard mask used i OSPF etwork statemet Iterfaces covered by wildcard mask but havig o OSPF eighbours eed passive-iterface (or use passiveiterface default ad the activate the iterfaces which will have OSPF eighbours) router ospf 100 etwork area 51 passive-iterface default o passive iterface POS 4/0 21

22 OSPF: Addig Networks Recommedatios p Do t ever use Optio 1 p Use Optio 2 if supported; otherwise: p Optio 3 is fie for core/ifrastructure routers Does t scale too well whe router has a large umber of iterfaces but oly a few with OSPF eighbours solutio is to use Optio 3 with o passive o iterfaces with OSPF eighbours p Optio 4 is preferred for aggregatio routers Or use ibgp ext-hop-self Or eve ip uumbered o exteral poit-to-poit liks 22

23 OSPF: Addig Networks Example Oe (Cisco IOS 12.4) p Aggregatio router with large umber of leased lie customers ad just two liks to the core etwork: iterface loopback 0 ip address ip ospf 100 area 0 iterface POS 0/0 ip address ip ospf 100 area 0 iterface POS 1/0 ip address ip ospf 100 area 0 iterface serial 2/0:0... ip uumbered loopback 0! Customers coect here ^^^^^^^ router ospf 100 passive-iterface default o passive iterface POS 0/0 o passive iterface POS 1/0 23

24 OSPF: Addig Networks Example Oe (Cisco IOS < 12.4) p Aggregatio router with large umber of leased lie customers ad just two liks to the core etwork: iterface loopback 0 ip address iterface POS 0/0 ip address iterface POS 1/0 ip address iterface serial 2/0:0... ip uumbered loopback 0! Customers coect here ^^^^^^^ router ospf 100 etwork area 51 etwork area 51 etwork area 51 passive-iterface default o passive iterface POS 0/0 o passive iterface POS 1/0 24

25 OSPF: Addig Networks Example Two (Cisco IOS 12.4) p Core router with oly liks to other core routers: iterface loopback 0 ip address ip ospf 100 area 0 iterface POS 0/0 ip address ip ospf 100 area 0 iterface POS 1/0 ip address ip ospf 100 area 0 iterface POS 2/0 ip address ip ospf 100 area 0 iterface POS 2/1 ip address ip ospf 100 area 0 router ospf 100 passive iterface loopback 0 25

26 OSPF: Addig Networks Example Two (Cisco IOS < 12.4) p Core router with oly liks to other core routers: iterface loopback 0 ip address iterface POS 0/0 ip address iterface POS 1/0 ip address iterface POS 2/0 ip address iterface POS 2/1 ip address router ospf 100 etwork area 0 etwork area 0 etwork area 0 etwork area 0 etwork area 0 passive iterface loopback 0 26

27 OSPF: Addig Networks Summary p Key Theme whe selectig a techique: Keep the Lik State Database Lea Icreases Stability Reduces the amout of iformatio i the Lik State Advertisemets (LSAs) Speeds Covergece Time 27

28 OSPF i Cisco IOS Useful features for ISPs 28

29 Areas p A area is stored as a 32-bit field: Area 3 Defied i IPv4 address format (i.e. Area ) Ca also be defied usig sigle decimal value (i.e. Area 0) p reserved for the backboe area Area 2 Area 0 Area 1 29

30 Loggig Adjacecy Chages p The router will geerate a log message wheever a OSPF eighbour chages state p Sytax: [o] [ospf] log-adjacecy-chages (OSPF keyword is optioal, depedig o IOS versio) p Example of a typical log message: %OSPF-5-ADJCHG: Process 1, Nbr o Etheret0 from LOADING to FULL, Loadig Doe 30

31 Number of State Chages p The umber of state trasitios is available via SNMP (ospfnbrevets) ad the CLI: show ip ospf eighbor [type umber] [eighbor-id] [detail] Detail (Optioal) Displays all eighbours give i detail (list all eighbours). Whe specified, eighbour state trasitio couters are displayed per iterface or eighbour ID 31

32 State Chages (Cotiued) p To reset OSPF-related statistics, use the clear ip ospf couters commad This will reset eighbour state trasitio couters per iterface or eighbour id clear ip ospf couters [eighbor [<type umber>] [eighbor-id]] 32

33 Router ID p If the loopback iterface exists ad has a IP address, that is used as the router ID i routig protocols stability! p If the loopback iterface does ot exist, or has o IP address, the router ID is the highest IP address cofigured dager! p OSPF sub commad to maually set the Router ID: router-id <ip address> 33

34 Cost & Referece Badwidth p Badwidth used i Metric calculatio Cost = 10 8 /badwidth Not useful for iterface badwidths > 100 Mbps p Sytax: ospf auto-cost referece-badwidth <referecebw> p Default referece badwidth still 100 Mbps for backward compatibility p Most ISPs simply choose to develop their ow cost strategy ad apply to each iterface type 34

35 Cost: Example Strategy 100GE 100Gbps cost = 1 40GE/OC768 40Gbps cost = 2 10GE/OC192 10Gbps cost = 5 OC48 2.5Gbps cost = 10 GigEtheret 1Gbps cost = 20 OC12 622Mbps cost = 50 OC3 155Mbps cost = 100 FastEtheret 100Mbps cost = 200 Etheret 10Mbps cost = 500 E1 2Mbps cost =

36 Default routes p Origiatig a default route ito OSPF default-iformatio origiate metric <> Will origiate a default route ito OSPF if there is a matchig default route i the Routig Table (RIB) The optioal always keyword will always origiate a default route, eve if there is o existig etry i the RIB 36

37 Clear/Restart p OSPF clear commads If o process ID is give, all OSPF processes o the router are assumed p clear ip ospf [pid] redistributio This commad clears redistributio based o OSPF routig process ID p clear ip ospf [pid] couters This commad clears couters based o OSPF routig process ID p clear ip ospf [pid] process This commad will restart the specified OSPF process. It attempts to keep the old router-id, except i cases where a ew router-id was cofigured or a old user cofigured router-id was removed. Sice this commad ca potetially cause a etwork chur, a user 37 cofirmatio is required before performig ay actio

38 Use OSPF Autheticatio p Use autheticatio Too may operators overlook this basic requiremet p Whe usig autheticatio, use the MD5 feature Uder the global OSPF cofiguratio, specify: area <area-id> autheticatio message-digest Uder the iterface cofiguratio, specify: ip ospf message-digest-key 1 md5 <key> p Autheticatio ca be selectively disabled per iterface with: ip ospf autheticatio ull 38

39 Poit to Poit Etheret Liks p For ay broadcast media (like Etheret), OSPF will attempt to elect a desigated ad backup desigated router whe it forms a adjacecy If the iterface is ruig as a poit-to-poit WAN lik, with oly 2 routers o the wire, cofigurig OSPF to operate i "poit-to-poit mode" scales the protocol by reducig the lik failure detectio times Poit-to-poit mode improves covergece times o Etheret etworks because it: p Prevets the electio of a DR/BDR o the lik, p Simplifies the SPF computatios ad reduces the router's memory footprit due to a smaller topology database. iterface fastetheret0/2 ip ospf etwork poit-to-poit 39

40 Tuig OSPF (1) p DR/BDR Selectio ip ospf priority 100 (default 1) This feature should be i use i your OSPF etwork Forcibly set your DR ad BDR per segmet so that they are kow Choose your most powerful, or most idle routers, so that OSPF coverges as fast as possible uder maximum etwork load coditios Try to keep the DR/BDR limited to oe segmet each 40

41 Tuig OSPF (2) p OSPF startup max-metric router-lsa o-startup wait-for-bgp Avoids blackholig traffic o router restart Causes OSPF to aouce its prefixes with highest possible metric util ibgp is up ad ruig Whe ibgp is ruig, OSPF metrics retur to ormal, make the path valid p ISIS equivalet: set-overload-bit o-startup wait-for-bgp 41

42 Tuig OSPF (3) p Hello/Dead Timers ip ospf hello-iterval 3 (default 10) ip ospf dead-iterval 15 (default is 4x hello) This allows for faster etwork awareess of a failure, ad ca result i faster recovergece, but requires more router CPU ad geerates more overhead p LSA Pacig timers lsa-group-pacig 300 (default 240) Allows groupig ad pacig of LSA updates at cofigured iterval Reduces overall etwork ad router impact 42

43 Tuig OSPF (4) p OSPF Iteral Timers timers spf 2 8 (default is 5 ad 10) Allows you to adjust SPF characteristics The first umber sets wait time from topology chage to SPF ru The secod is hold-dow betwee SPF rus BE CAREFUL WITH THIS COMMAND; if you re ot sure whe to use it, it meas you do t eed it; default is sufficiet 95% of the time 43

44 Tuig OSPF (5) p LSA filterig/iterface blockig Per iterface: p ip ospf database-filter all out (o optios) Per eighbor: p eighbor database-filter all out (o optios) OSPFs router will flood a LSA out all iterfaces except the receivig oe; LSA filterig ca be useful i cases where such floodig uecessary (i.e., NBMA etworks), where the DR/BDR ca hadle floodig chores area <area-id> filter-list <acl> Filters out specific Type 3 LSAs at ABRs p Improper use ca result i routig loops ad black-holes that ca be very difficult to troubleshoot 44

45 Summary p OSPF has a bewilderig umber of features ad optios p Observe ISP best practices p Keep desig ad cofiguratio simple p Ivestigate tuig optios ad suitability for your ow etwork Do t just tur them o! 45

46 Deployig OSPF for ISPs ISP Traiig Workshops 46