route-policy next permit node 10
if-match acl 2000
apply ip-address next-hop 10.0.7.7
#
route-policy next permit node 20
#
return
Chapter 6 Route Import and Control Hands-on Exercise Guide
Overview
You can configure route importing to enable protocols to exchange routing information.
Due to ever changing network environments, design defects, or misoperations, routing loops may occur and sub-optimal routes may be generated. In this situation, network resources are wasted, and communication failures may even occur. To prevent these problems, add some matching conditions during route importing and use route policies for route control.
Route policies use different matching conditions and matching modes to select routes and change route attributes. A route policy may consist of multiple nodes. Each node has the permit or deny action. A route policy can reference other route selection tools such as ACL and IP prefix list.
Objectives
Upon completion of this exercise guide, you will be able to:
Configure an ACL and an IP prefix list.
Configure a route policy.
Filter routes in OSPF.
Filter routes in IS-IS.
Configure route importing in different scenarios.
Understand why routing loops occur.
Prevent routing loops.
Tasks
The topology shows the network of a company. OSPF runs in the company's headquarters, and IS-IS runs in the company's branch. The headquarters and branch have some service network segments. Network segments 172.16.1.0/24, 172.16.3.0/24, 192.168.1.0/24, and 192.168.3.0/24 are service A network segments, and network segments 172.16.2.0/24, 172.16.4.0/24, 192.168.2.0/24, and 192.168.43.0/24 are service B network segments. Deploy the network according to the following requirements:
(1) Build an OSPF network for the headquarters and an IS-IS network for the branch according to
the topology. Minimize the number of routing entries to be maintained by the devices in OSPF
Area 1.
(2) Import IS-IS routes on R1 into OSPF, and import OSPF routes on R2 into IS-IS. Perform correct commissioning to ensure that service network segments communicate normally.
(3) Deploy bidirectional route importing on R1 and R2 to prevent single-point failures between the headquarters and branch from resulting in network disconnection. Perform correct commissioning to ensure that service network segments communicate normally.
(4) Implement load balancing on traffic between the headquarters and branch to ensure that traffic of service A is forwarded through R1, and traffic of service B is forwarded through R2.
(5) Forward traffic of service A and traffic of service B in OSPF Area 1 of the headquarters using different links to implement load balancing. Do not use any route policy.
Topology
IP Address Table
Device Interface IP Address Subnet Mask Default
Gateway
R1
G 0/0/0 10.0.13.1 255.255.255.0 N/A
G 0/0/1 10.0.14.1 255.255.255.0 N/A
Loopback 0 10.0.1.1 255.255.255.255 N/A
R2
G 0/0/0 10.0.23.2 255.255.255.0 N/A
G 0/0/1 10.0.24.2 255.255.255.0 N/A
Loopback 0 10.0.2.2 255.255.255.255 N/A
R3
G 0/0/0 10.0.13.3 255.255.255.0 N/A
G 0/0/1 10.0.23.3 255.255.255.0 N/A
Loopback 0 10.0.3.3 255.255.255.255 N/A
R4
G 0/0/0 10.0.14.4 255.255.255.0 N/A
G 0/0/1 10.0.24.4 255.255.255.0 N/A
S 1/0/0 10.0.45.4 255.255.255.0 N/A
S 1/0/1 10.0.54.4 255.255.255.0 N/A
Loopback 0 10.0.4.4 255.255.255.255 N/A
R5
S 1/0/0 10.0.45.5 255.255.255.0 N/A
S 1/0/1 10.0.54.5 255.255.255.0 N/A
Loopback 0 10.0.5.5 255.255.255.255 N/A
Configuration and Verification
1. Build an OSPF network for the headquarters and an IS-IS network for the branch according to the topology. Minimize the number of routing entries to be maintained by the devices in OSPF Area 1.
Perform basic configuration according to the IP address table, and then check the establishment of OSPF and IS-IS neighbor relationships.
<R1>display ospf peer
OSPF Process 1 with Router ID 10.0.1.1
Neighbors
Area 0.0.0.0 interface 10.0.14.1(GigabitEthernet0/0/1)'s neighbors
Router ID: 10.0.4.4 Address: 10.0.14.4
State: Full Mode:Nbr is Master Priority: 1
DR: 10.0.14.1 BDR: 10.0.14.4 MTU: 0
Dead timer due in 39 sec
Retrans timer interval: 5
Neighbor is up for 03:13:21
Authentication Sequence: [ 0 ]
<R1>display isis peer
Peer information for ISIS(1)
System Id Interface Circuit Id State HoldTime Type PRI
---
0000.0000.0003 GE0/0/0 0000.0000.0003.01 Up 8s L1(L1L2) 64
0000.0000.0003 GE0/0/0 0000.0000.0003.01 Up 7s L2(L1L2) 64
Total Peer(s): 2
2. Import IS-IS routes on R1 into OSPF, and import OSPF routes on R2 into IS-IS. Perform correct commissioning to ensure that service network segments communicate normally.
Note: ISIS need wide metric to carry tag with route. Pay attention to the external ospf route imported by R5.
After configuration, we can see that R1 has imported the ISIS route by check the LSDB on R4 ; also we can see R2 has imported the OSPF route .
<R4>display ospf lsdb
OSPF Process 1 with Router ID 10.0.4.4
AS External Database
Type LinkState ID AdvRouter Age Len Sequence Metric
External 172.16.4.0 10.0.4.4 1558 36 80000001 1
External 172.16.2.0 10.0.4.4 1558 36 80000001 1
External 172.16.3.0 10.0.4.4 1558 36 80000001 1
External 172.16.1.0 10.0.4.4 1558 36 80000001 1
External 192.168.4.0 10.0.1.1 824 36 80000001 1
External 192.168.2.0 10.0.1.1 824 36 80000001 1
External 192.168.3.0 10.0.1.1 824 36 80000001 1
External 192.168.1.0 10.0.1.1 825 36 80000001 1
……
<R3>display isis lsdb level-2
Database information for ISIS(1)
Level-2 Link State Database
LSPID Seq Num Checksum Holdtime Length ATT/P/OL
0000.0000.0002.00-00 0x0000001b 0x23f 1024 80 0/0/0
0000.0000.0002.00-01 0x00000002 0x375f 1024 213 0/0/0
……
<R3>display isis lsdb level-2 0000.0000.0002.00-01 ver
Database information for ISIS(1)
Level-2 Link State Database
LSPID Seq Num Checksum Holdtime Length ATT/P/OL
0000.0000.0002.00-01 0x00000002 0x375f 865 213 0/0/0
SOURCE 0000.0000.0002.00
…….
+IP-Extended 172.16.1.0 255.255.255.0 COST: 0 Tag: 200
+IP-Extended 172.16.2.0 255.255.255.0 COST: 0 Tag: 200
+IP-Extended 172.16.3.0 255.255.255.0 COST: 0 Tag: 200
+IP-Extended 172.16.4.0 255.255.255.0 COST: 0 Tag: 200
Total LSP(s): 1
*(In TLV)-Leaking Route, *(By LSPID)-Self LSP, +-Self LSP(Extended), ATT-Attached, P-Partition, OL-Overload
3. Deploy bidirectional route importing on R1 and R2 to prevent single-point failures between the headquarters and branch from resulting in network disconnection. Perform correct commissioning to ensure that service network segments communicate normally.
Note: the solution is the same as the before.
4. Implement load balancing on traffic between the headquarters and branch to ensure that traffic of service A is forwarded through R1, and traffic of service B is forwarded through R2.
Note: we can apply cost to specified routes when import route.
<R3>display ip routing-table
Destination/Mask Proto Pre Cost Flags NextHop Interface
172.16.1.0/24 ISIS-L2 15 110 D 10.0.13.1 GigabitEthernet0/0/0
172.16.2.0/24 ISIS-L2 15 110 D 10.0.23.2 GigabitEthernet0/0/1
172.16.3.0/24 ISIS-L2 15 110 D 10.0.13.1 GigabitEthernet0/0/0
172.16.4.0/24 ISIS-L2 15 110 D 10.0.23.2 GigabitEthernet0/0/1
……
<R4>display ip routing-table
Destination/Mask Proto Pre Cost Flags NextHop Interface
192.168.1.0/24 O_ASE 150 100 D 10.0.14.1 GigabitEthernet0/0/0
192.168.2.0/24 O_ASE 150 100 D 10.0.24.2 GigabitEthernet0/0/1
192.168.3.0/24 O_ASE 150 100 D 10.0.14.1 GigabitEthernet0/0/0
192.168.4.0/24 O_ASE 150 100 D 10.0.24.2 GigabitEthernet0/0/1
……
5. Forward traffic of service A and traffic of service B in OSPF Area 1 of the headquarters using different links to implement load balancing. Do not use any route policy.
Note: Use policy route. In this requirement we need to use interface policy route.
<R4>display traffic policy user-defined
User Defined Traffic Policy Information:
Policy: loadbalance
Classifier: serviceA
Operator: OR
Behavior: SAbeh
Redirect:
Redirect ip-nexthop 10.0.45.5
Classifier: serviceB
Operator: OR
Behavior: SBbeh
Redirect:
Redirect ip-nexthop 10.0.54.5
<R5>display traffic policy user-defined
User Defined Traffic Policy Information:
Policy: loadbalance
Classifier: serviceA
Operator: OR
Behavior: SAbeh
Redirect:
Redirect ip-nexthop 10.0.45.4
Classifier: serviceB
Operator: OR
Behavior: SBbeh
Redirect:
Redirect ip-nexthop 10.0.54.4
Questions
Which problems will occur on the network after requirement 2 is met and how many methods are available to solve the problems?
Which problems will occur on the network after requirement 3 is met? Why do these problems occur? What are the differences between the problems in requirement 2 and requirement 3?
How many methods are available to meet requirement 4 and how to select a correct method?
What problem occurs on the network after requirement 5 is met and why do these problems occur?
Configuration List
<R1>display current-configuration
#
sysname R1
#
router id 10.0.1.1
#
acl number 2000
rule 10 permit source 172.16.1.0 0.0.2.0
acl number 2001
rule 10 permit source 172.16.0.0 0.0.6.0
acl number 2010
rule 10 permit source 192.168.1.0 0.0.2.0
acl number 2011
rule 10 permit source 192.168.0.0 0.0.6.0
#
isis 1
cost-style wide
network-entity 10.0000.0000.0001.00
import-route ospf 1 route-policy OSPF-TO-ISIS
#
interface GigabitEthernet0/0/0
ip address 10.0.13.1 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/1
ip address 10.0.14.1 255.255.255.0
#
interface LoopBack0
ip address 10.0.1.1 255.255.255.255
#
ospf 1
import-route isis 1 route-policy ISIS-TO-OSPF
preference ase route-policy OSPF-PREFERENCE 150
area 0.0.0.0
network 10.0.1.1 0.0.0.0
network 10.0.14.0 0.0.0.255
#
route-policy ISIS-TO-OSPF deny node 10
if-match tag 200
#
route-policy ISIS-TO-OSPF permit node 20
if-match acl 2010
apply cost 100
apply tag 100
#
route-policy ISIS-TO-OSPF permit node 30
if-match acl 2011
apply cost 500
apply tag 100
#
route-policy ISIS-TO-OSPF permit node 40
apply tag 100
#
route-policy OSPF-TO-ISIS deny node 10
if-match tag 400
#
route-policy OSPF-TO-ISIS permit node 20
if-match acl 2000
apply cost 100
apply tag 300
#
route-policy OSPF-TO-ISIS permit node 30
if-match acl 2001
apply cost 500
apply tag 300
#
route-policy OSPF-TO-ISIS permit node 40
apply tag 300
#
route-policy OSPF-PREFERENCE permit node 10
if-match tag 55
apply preference 12
#
return
<R2>display current-configuration
#
sysname R2
#
acl number 2000
rule 10 permit source 172.16.1.0 0.0.2.0
acl number 2001
rule 10 permit source 172.16.0.0 0.0.6.0
acl number 2010
rule 10 permit source 192.168.1.0 0.0.2.0
acl number 2011
rule 10 permit source 192.168.0.0 0.0.6.0
#
isis 1
cost-style wide
network-entity 10.0000.0000.0002.00
import-route ospf 1 route-policy OSPF-TO-ISIS
#
interface GigabitEthernet0/0/0
ip address 10.0.23.2 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/1
ip address 10.0.24.2 255.255.255.0
#
interface LoopBack0
ip address 10.0.2.2 255.255.255.255
#
ospf 1
import-route isis 1 route-policy ISIS-TO-OSPF
preference ase route-policy OSPF-PREFERENCE 150
area 0.0.0.0
network 10.0.2.2 0.0.0.0
network 10.0.24.0 0.0.0.255
#
route-policy OSPF-TO-ISIS deny node 10
if-match tag 100
#
route-policy OSPF-TO-ISIS permit node 20
if-match acl 2000
apply cost 500
apply tag 200
#
route-policy OSPF-TO-ISIS permit node 30
if-match acl 2001
apply cost 100
apply tag 200
#
route-policy OSPF-TO-ISIS permit node 40
apply tag 200
#
route-policy ISIS-TO-OSPF deny node 10
if-match tag 300
#
route-policy ISIS-TO-OSPF permit node 20
if-match acl 2010
apply cost 500
apply tag 400
#
route-policy ISIS-TO-OSPF permit node 30
if-match acl 2011
apply cost 100
apply tag 400
#
route-policy ISIS-TO-OSPF permit node 40
apply tag 400
#
route-policy OSPF-PREFERENCE permit node 10
if-match tag 55
apply preference 12
return
<R3>display current-configuration
#
sysname R3
#
isis 1
cost-style wide
network-entity 10.0000.0000.0003.00
import-route direct route-policy dirin
#
interface GigabitEthernet0/0/0
ip address 10.0.13.3 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/1
ip address 10.0.23.3 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/2
ip address 192.168.1.1 255.255.255.0
ip address 192.168.2.1 255.255.255.0 sub
ip address 192.168.3.1 255.255.255.0 sub
ip address 192.168.4.1 255.255.255.0 sub
#
interface LoopBack0
ip address 10.0.3.3 255.255.255.255
isis enable 1
#
route-policy dirin permit node 20
if-match interface GigabitEthernet0/0/2
#
return
<R4>display current-configuration
#
sysname R4
#
acl number 2000
rule 10 permit source 192.168.1.0 0.0.2.255
acl number 2001
rule 10 permit source 192.168.0.0 0.0.6.255
#
traffic classifier serviceA operator or
if-match acl 2000
traffic classifier serviceB operator or
if-match acl 2001
#
traffic behavior SAbeh
redirect ip-nexthop 10.0.45.5
traffic behavior SBbeh
redirect ip-nexthop 10.0.54.5
#
traffic policy loadbalance
classifier serviceA behavior SAbeh
classifier serviceB behavior SBbeh
#
interface Serial1/0/0
link-protocol ppp
ip address 10.0.45.4 255.255.255.0
#
interface Serial1/0/1
link-protocol ppp
ip address 10.0.54.4 255.255.255.0
#
interface GigabitEthernet0/0/0
ip address 10.0.14.4 255.255.255.0
traffic-policy loadbalance inbound
#
interface GigabitEthernet0/0/1
ip address 10.0.24.4 255.255.255.0
traffic-policy loadbalance inbound
#
interface LoopBack0
ip address 10.0.4.4 255.255.255.255
#
ospf 1
area 0.0.0.0
network 10.0.4.4 0.0.0.0
network 10.0.14.0 0.0.0.255
network 10.0.24.0 0.0.0.255
area 0.0.0.1
network 10.0.45.0 0.0.0.255
network 10.0.54.0 0.0.0.255
nssa no-summary
#
return
<R5>display current-configuration
#
sysname R5
#
acl number 2000
rule 10 permit source 172.16.1.0 0.0.2.255
acl number 2001
rule 10 permit source 172.16.0.0 0.0.6.255
#
traffic classifier serviceA operator or
if-match acl 2000
traffic classifier serviceB operator or
if-match acl 2001
#
traffic behavior SAbeh
redirect ip-nexthop 10.0.45.4
traffic behavior SBbeh
redirect ip-nexthop 10.0.54.4
#
traffic policy loadbalance
classifier serviceA behavior SAbeh
classifier serviceB behavior SBbeh
#
interface Serial1/0/0
link-protocol ppp
ip address 10.0.45.5 255.255.255.0
#
interface Serial1/0/1
link-protocol ppp
ip address 10.0.54.5 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 172.16.1.1 255.255.255.0
ip address 172.16.2.1 255.255.255.0 sub
ip address 172.16.3.1 255.255.255.0 sub
ip address 172.16.4.1 255.255.255.0 sub
traffic-policy loadbalance inbound
#
interface LoopBack0
ip address 10.0.5.5 255.255.255.255
#
ospf 1
import-route direct route-policy dirin
area 0.0.0.1
network 10.0.5.5 0.0.0.0
network 10.0.45.0 0.0.0.255
network 10.0.54.0 0.0.0.255
nssa no-summary
#
route-policy dirin permit node 10
if-match interface GigabitEthernet0/0/2
apply tag 55
#
return