Showing posts with label router. Show all posts
Showing posts with label router. Show all posts

Tuesday, November 26, 2013

VRF Maximum Routes

 

Maximum routes under customer vrf, if the service provider had unlimited resources he would not have needed that!
however normally resources are limited and expensive, and Service provider would like to make money from his available resources. maximum routes configured under VRF provide a mean of controlling PE local resource and abuse avoidance from the CE side.

 

I have vrf called DC_EXTRANET, you can see that I have 16 routes, I have configured

10 maximum routes under that vrf however I did not want to be aggressive so I have set the

 
warning only option.

See that immediately I get a notice that I have more routes then the maximum, however no action

is taken other then alerting and sending a syslog.

!

PE_ashdod_otherisp.n(config-vrf)# maximum routes 10 warning-only 

% The current number of routes in the routing table is equal to, or exceeds the configured warning limit

PE_ashdod_otherisp.n(config-vrf)#

*Nov 26 20:39:41.175: %IPRT-3-ROUTELIMITWARNING: IP routing table limit warning - DC_EXTRANET

PE_ashdod_otherisp.n(config-vrf)#do sh ip rou vrf DC_EXTRANET

Routing Table: DC_EXTRANET

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      50.0.0.0/8 is variably subnetted, 3 subnets, 3 masks

B        50.0.0.0/30 [200/0] via 20.255.10.10, 00:09:31

B        50.0.100.0/24 [200/0] via 20.255.10.10, 00:09:31

B        50.255.255.1/32 [200/0] via 20.255.10.10, 00:09:31

      60.0.0.0/8 is variably subnetted, 6 subnets, 3 masks

B        60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:04

B        60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:04

B        60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:04

B        60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:04

B        60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:04

B        60.255.255.1/32 [200/0] via 7.7.7.7, 00:00:04

      70.0.0.0/8 is variably subnetted, 7 subnets, 3 masks

C        70.0.0.0/30 is directly connected, FastEthernet2/0

L        70.0.0.1/32 is directly connected, FastEthernet2/0

B        70.0.100.0/24 [20/0] via 70.0.0.2, 00:20:22

B        70.0.101.0/24 [20/0] via 70.0.0.2, 00:20:22

B        70.0.102.0/24 [20/0] via 70.0.0.2, 00:20:22

B        70.0.103.0/24 [20/0] via 70.0.0.2, 00:20:22

B        70.255.255.1/32 [20/0] via 70.0.0.2, 00:20:22

PE_ashdod_otherisp.n(config-vrf)#
 


 


now I would like to show you what will happen from RIB/FIB and BGP when I am activating the maximum prefix’s in aggressive mode:


 
Prior to modifying the maximum value, on the CE you can see that I am getting BGP updates:

CE_ashdod_DC_SERVICES#  show ip bgp     

BGP table version is 160, local router ID is 70.255.255.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*> 50.0.0.0/30      70.0.0.1                               0 9002 33462 ?

*> 50.0.100.0/24    70.0.0.1                               0 9002 33462 ?

*> 50.255.255.1/32  70.0.0.1                               0 9002 33462 ?

*> 60.0.0.0/30      70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.100.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.101.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.102.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.103.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.255.255.1/32  70.0.0.1                               0 9002 9001 33462 ?

Now maximum routes is set to 10 and Threshold before sending warning to 100% notice

immediately RIB and FIB will be updated accordingly however BGP is not effected meaning that

this is locally significant and will not cause a lot of noise due to a local problem / over utilizing allowed

resources.

PE_ashdod_otherisp.n(config-vrf)# maximum routes 10 100 

% The current number of routes in the routing table is equal to, or exceeds the configured warning limit

% The routing table is being reloaded to enforce (or allow) the new route limit.

PE_ashdod_otherisp.n(config-vrf)#

*Nov 26 20:57:08.359: %IPRT-3-ROUTELIMITWARNING: IP routing table limit warning - DC_EXTRANET

*Nov 26 20:57:08.363: %IPRT-3-ROUTELIMITEXCEEDED: IP routing table limit exceeded - DC_EXTRANET

PE_ashdod_otherisp.n(config-vrf)#

PE_ashdod_otherisp.n(config-vrf)#

PE_ashdod_otherisp.n(config-vrf)#do sh ip rou vrf DC_EXTRANET       

Routing Table: DC_EXTRANET

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      50.0.0.0/8 is variably subnetted, 3 subnets, 3 masks

B        50.0.0.0/30 [200/0] via 20.255.10.10, 00:00:15

B        50.0.100.0/24 [200/0] via 20.255.10.10, 00:00:15

B        50.255.255.1/32 [200/0] via 20.255.10.10, 00:00:15

      60.0.0.0/8 is variably subnetted, 5 subnets, 2 masks

B        60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:15

B        60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:15

B        60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:15

B        60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:15

B        60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:15

      70.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        70.0.0.0/30 is directly connected, FastEthernet2/0

L        70.0.0.1/32 is directly connected, FastEthernet2/0

PE_ashdod_otherisp.n(config-vrf)#

CE_ashdod_DC_SERVICES#  show ip bgp 

BGP table version is 184, local router ID is 70.255.255.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*> 50.0.0.0/30      70.0.0.1                               0 9002 33462 ?

*> 50.0.100.0/24    70.0.0.1                               0 9002 33462 ?

*> 50.255.255.1/32  70.0.0.1                               0 9002 33462 ?

*> 60.0.0.0/30      70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.100.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.101.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.102.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.0.103.0/24    70.0.0.1                               0 9002 9001 33462 ?

*> 60.255.255.1/32  70.0.0.1                               0 9002 9001 33462 ?


Additional scenario: 


maximum prefix’s are at 14


 
Routing Table: DC_EXTRANET

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      50.0.0.0/8 is variably subnetted, 3 subnets, 3 masks

B        50.0.0.0/30 [200/0] via 20.255.10.10, 00:01:23

B        50.0.100.0/24 [200/0] via 20.255.10.10, 00:01:23

B        50.255.255.1/32 [200/0] via 20.255.10.10, 00:01:23

      60.0.0.0/8 is variably subnetted, 6 subnets, 3 masks

B        60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:20

B        60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:20

B        60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:20

B        60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:20

B        60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:20

B        60.255.255.1/32 [200/0] via 7.7.7.7, 00:00:20

      70.0.0.0/8 is variably subnetted, 5 subnets, 3 masks

C        70.0.0.0/30 is directly connected, FastEthernet2/0

L        70.0.0.1/32 is directly connected, FastEthernet2/0

B        70.0.100.0/24 [20/0] via 70.0.0.2, 00:01:23

B        70.0.101.0/24 [20/0] via 70.0.0.2, 00:01:23

B        70.0.102.0/24 [20/0] via 70.0.0.2, 00:01:23



 


I send withdraw  for 70.0.101.0/24 from the CE router, now I have one more spot (14 –1) available, however the router does not re-evaluate the table and insert the next available, think of what if it did! (the CE could have abuse the router causing him to always re-evaluate what need to be inserted/removed to/from RIB/FIB!!), re-evaluation happen when you modify maximum routes value or when you re-send (withdraw and update) the un-used  routes  :


 
PE_ashdod_otherisp.n(config)#do sh ip rou vrf DC_EXTRANET

Routing Table: DC_EXTRANET

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

       + - replicated route, % - next hop override

Gateway of last resort is not set

      50.0.0.0/8 is variably subnetted, 3 subnets, 3 masks

B        50.0.0.0/30 [200/0] via 20.255.10.10, 00:01:30

B        50.0.100.0/24 [200/0] via 20.255.10.10, 00:01:30

B        50.255.255.1/32 [200/0] via 20.255.10.10, 00:01:30

      60.0.0.0/8 is variably subnetted, 6 subnets, 3 masks

B        60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:27

B        60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:27

B        60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:27

B        60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:27

B        60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:27

B        60.255.255.1/32 [200/0] via 7.7.7.7, 00:00:27

      70.0.0.0/8 is variably subnetted, 4 subnets, 3 masks

C        70.0.0.0/30 is directly connected, FastEthernet2/0

L        70.0.0.1/32 is directly connected, FastEthernet2/0

B        70.0.100.0/24 [20/0] via 70.0.0.2, 00:01:30

B        70.0.102.0/24 [20/0] via 70.0.0.2, 00:01:30

PE_ashdod_otherisp.n(config)#


 


However if you do not care about abuse from CE side you can use the below command, that will re-evaluate once crossing certain threshold, but I think that if you do not care about the abuse (do not limit the amount of prefix’s):
PE_ashdod_otherisp.n(config-vrf)# maximum routes 14 100 reinstall ?  

  <1-100>  Threshold value (%) at which to reinstall routes back to VRF

  











at





No comments:
  


















Labels:
,
,
,
,
,
,
,
,
,
,
,
,
,

















          

        

          

        

Tuesday, November 19, 2013


          

        









ISIS Database Reading











 
 
ISIS is simple to operate normally while everything is working, most common deployments are flat network based on L2, however when there is a problem and we need to start troubleshooting then people start to get lost.
 
So I would like to provide some tools on how to read ISIS database.
 
 
 
     
  • notice to the “*” sign, that mean LSP was generated on the router you did the show command, you can see that host name from the show command match also host name on the LSPID,
    •  
  • LSPID identified by hostname.xx-yy,  xx is normally 00 unless that LSP is pseudo node LSP generated by DIS , yy is representing the number of fragments for that LSP 00 – FF (max 255 fragments, plenty), most cases all the important information will be in 00 unless there are many fragments.
    •  
  • LSP Holdtime is the amount of time an LSP will stay in database without any refresh.
    •  
  • ATT/P/OL - 0/0/0, ATT bit or attached bit is used on L1/L2 connected to L1 node, if set to 1 L1 node will generate default route to the best L1/L2 node (best metric)
    •  
  • ATT/P/OL - 0/0/0, OL bit or overload bit, in the past it was used when router was over loaded to set all links on the router as unusable, preventing others from transiting, that node, today it is used mostly to wait for bgp convergence.
 
  
P_london_someisp.net#show isis database 

IS-IS Level-2 Link State Database:

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P_london_somei.00-00* 0x00000005   0x65C5        1177              0/0/0

P_dublin_somei.00-00  0x00000004   0x8346        1176              0/0/0

P_cyprus_somei.00-00  0x00000005   0x5634        1183              0/0/0

P_LA_someisp.n.00-00  0x00000005   0xDE33        1175              0/0/0

PE_newyork_som.00-00  0x00000003   0x2EF0        1179              0/0/0

PE_telaviv_som.00-00  0x00000004   0x2877        1181              0/0/0

PE_Jerusalem_s.00-00  0x00000002   0x2994        1172              0/0/0

PE_Jerusalem_s.02-00  0x00000001   0x2ED2        1171              0/0/0


 From the database each router build a topology using SPF (dijkstra algorithm), if I would like to understand how to get from one router to another I can look into the ISIS database detail and understand that:
For the example, I would like to see only with the database, how to get from my self

to PE_telaviv without looking into the topology or routing table (just for fun): 

Notice that according to my LSP I can see the neighbors I am connected to, and the net address

for each link along with metric.

P_london_someisp.net#$atabase  level-2 det P_london_someisp.net.00-00   

IS-IS Level-2 LSP P_london_somei.00-00

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P_london_somei.00-00* 0x00000006   0x63C6        409               0/0/0

  Area Address: 49.0001

  NLPID:        0xCC 

  Hostname: P_london_someisp.net

  IP Address:   1.1.1.1

  Metric: 10         IS-Extended P_dublin_somei.00

  Metric: 10         IS-Extended P_cyprus_somei.00

  Metric: 10         IS-Extended P_LA_someisp.n.00

  Metric: 10         IS-Extended PE_newyork_som.00

  Metric: 10         IP 1.1.1.1/32

  Metric: 10         IP 10.100.1.4/30

  Metric: 10         IP 10.100.1.16/30

  Metric: 10         IP 10.100.1.20/30

  Metric: 10         IP 10.100.1.24/30

P_london_someisp.net#

 
 
now if I take the first neighbor from my LSP P_dublin and look into his LSP:

notice that one of his neighbors is PE_telaviv.

So 10 to reach dublin + 10 to reach telaviv = 20 total cost from london to telaviv 

I have taken the next neighbor cyprus and it looks like we have also 20 metric path using 

cyprus, so we will have load sharing between them.

notice that P_LA and PE_newyork does not have direct link to PE_telaviv, that mean we do not

need to explorer more in that direction as any route using them will have higher cost.

 
 
P_london_someisp.net#$atabase  level-2 det P_dublin_someisp.net.00-00

IS-IS Level-2 LSP P_dublin_somei.00-00

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P_dublin_somei.00-00  0x00000006   0x7F48        1077              0/0/0

  Area Address: 49.0001

  NLPID:        0xCC 

  Hostname: P_dublin_someisp.net

  IP Address:   2.2.2.2

  Metric: 10         IS-Extended P_london_somei.00

  Metric: 10         IS-Extended P_cyprus_somei.00

  Metric: 10         IS-Extended P_LA_someisp.n.00

  Metric: 10         IS-Extended PE_telaviv_som.00

  Metric: 10         IP 2.2.2.2/32

  Metric: 10         IP 10.100.1.0/30

  Metric: 10         IP 10.100.1.12/30

  Metric: 10         IP 10.100.1.16/30

  Metric: 10         IP 10.100.1.36/30

P_london_someisp.net#$atabase  level-2 det P_cyprus_someisp.net.00-00

IS-IS Level-2 LSP P_cyprus_somei.00-00

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P_cyprus_somei.00-00  0x00000007   0x5236        854               0/0/0

  Area Address: 49.0001

  NLPID:        0xCC 

  Hostname: P_cyprus_someisp.net

  IP Address:   3.3.3.3

  Metric: 10         IS-Extended P_london_somei.00

  Metric: 10         IS-Extended P_dublin_somei.00

  Metric: 10         IS-Extended P_LA_someisp.n.00

  Metric: 10         IS-Extended PE_telaviv_som.00

  Metric: 10         IS-Extended PE_Jerusalem_s.02

  Metric: 10         IP 3.3.3.3/32

  Metric: 10         IP 10.100.1.0/30

  Metric: 10         IP 10.100.1.4/30

  Metric: 10         IP 10.100.1.8/30

  Metric: 10         IP 10.100.1.32/30

  Metric: 10         IP 20.0.0.0/24

P_london_someisp.net#$atabase  level-2 det P_LA_someisp.net.00-00    

IS-IS Level-2 LSP P_LA_someisp.n.00-00

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P_LA_someisp.n.00-00  0x00000007   0xDA35        690               0/0/0

  Area Address: 49.0001

  NLPID:        0xCC 

  Hostname: P_LA_someisp.net

  IP Address:   4.4.4.4

  Metric: 10         IS-Extended P_london_somei.00

  Metric: 10         IS-Extended P_dublin_somei.00

  Metric: 10         IS-Extended P_cyprus_somei.00

  Metric: 10         IS-Extended PE_newyork_som.00

  Metric: 10         IP 4.4.4.4/32

  Metric: 10         IP 10.100.1.8/30

  Metric: 10         IP 10.100.1.12/30

  Metric: 10         IP 10.100.1.20/30

  Metric: 10         IP 10.100.1.28/30

P_london_someisp.net#show isis database  level-2 det PE_newyork_someisp.net.00$

IS-IS Level-2 LSP PE_newyork_som.00-00

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

PE_newyork_som.00-00  0x00000005   0x2AF2        499               0/0/0

  Area Address: 49.0001

  NLPID:        0xCC 

  Hostname: PE_newyork_someisp.net

  IP Address:   5.5.5.5

  Metric: 10         IS P_london_somei.00

  Metric: 10         IS P_LA_someisp.n.00

  Metric: 10         IS-Extended P_london_somei.00

  Metric: 10         IS-Extended P_LA_someisp.n.00

  Metric: 10         IP 5.5.5.5/32

  Metric: 10         IP 10.100.1.24/30

  Metric: 10         IP 10.100.1.28/30

  Metric: 10         IP 5.5.5.5 255.255.255.255

  Metric: 10         IP 10.100.1.24 255.255.255.252

  Metric: 10         IP 10.100.1.28 255.255.255.252

 
 
To see the topology now and see if we are on the right track, notice that we are correct 20 metric

one with dublin and the other trough cyprus with 20 metric doing load sharing.

 
 
P_london_someisp.net#show isis topology 

IS-IS paths to level-2 routers

System Id            Metric     Next-Hop             Interface   SNPA

P_london_someisp.net --

P_dublin_someisp.net 10         P_dublin_someisp.net Se1/2       *HDLC*         

P_cyprus_someisp.net 10         P_cyprus_someisp.net Se1/1       *HDLC*         

P_LA_someisp.net     10         P_LA_someisp.net     Se1/0       *HDLC*         

PE_newyork_someisp.ne10         PE_newyork_someisp.neMu1         *PPP*          

PE_telaviv_someisp.ne20         P_dublin_someisp.net Se1/2       *HDLC*         

                                P_cyprus_someisp.net Se1/1       *HDLC*         

PE_Jerusalem_someisp.20         P_cyprus_someisp.net Se1/1       *HDLC*         
  











at





No comments:
  


















Labels:
,
,
,
,
,
,
,
,
,
,
,
,
,
,

















          

        

          

        

Friday, November 04, 2011


          

        










IPV6 NAT-PT Dynamic











 
 
image
 
IPv6 NAT-PT is one of the methods out there for migration between V4 to V6, the NAT-PT is not a normal NAT as with normal NAT you would translate one address to another, in our case NAT-PT we do a translation between 2 different protocols ipv6 to ipv4 (and vice versa).
 
In the above scenario I have done a simple topology R1 is a host running only IPv6, R2 is my translator between IPv6 to IPv4 and R3 is my gateway out side (Only IPv4), on R3 as you can see from above I have connected it to my home network so I have done Normal IPv4 NAT between the what is coming in from f0/0 and going out f0/1 (my home net)
 
  
 R1 R2 R3
 
 
!

interface FastEthernet0/0

 no ip address

 duplex auto

 speed auto

 ipv6 address 2001:100:100::1/64

 ipv6 address FE80::1 link-local

!

interface FastEthernet0/1

 no ip address

 shutdown

 duplex auto

 speed auto

!

!

!

ip http server

no ip http secure-server

!

ipv6 route ::/0 2001:100:100::2

!

!



!

!

!

ipv6 unicast-routing

!

!

interface FastEthernet0/0

 no ip address

 duplex auto

 speed auto

 ipv6 address 2001:100:100::2/64

 ipv6 address FE80::2 link-local

 ipv6 nat

!

interface FastEthernet0/1

 ip address 100.100.0.1 255.255.255.0

 duplex auto

 speed auto

 ipv6 nat

!

ip route 0.0.0.0 0.0.0.0 100.100.0.2

!

!

ip http server

no ip http secure-server

!

ipv6 nat v6v4 source list NAT_TRANSLATIONS pool V4POOL

ipv6 nat v6v4 pool V4POOL 100.100.0.101 100.100.0.110 prefix-length 24

ipv6 nat prefix 2001::/96 v4-mapped NAT_TRANSLATIONS

!

!

!

!

ipv6 access-list NAT_TRANSLATIONS

 permit ipv6 any 2001::/96

!



!

!

!

interface FastEthernet0/0

 ip address 100.100.0.2 255.255.255.0

 ip nat inside

 ip virtual-reassembly

 duplex auto

 speed auto

!

interface FastEthernet0/1

 ip address dhcp

 ip nat outside

 ip virtual-reassembly

 duplex auto

 speed auto

!

!

!

ip http server

no ip http secure-server

ip nat inside source list 100 interface FastEthernet0/1 overload

!

access-list 100 permit ip 100.100.0.0 0.0.0.255 any

!



 


As you can see from above configuration R1 in IPv6 only, and R3 is IPv4 only
IPV6_HOST#ping 2001::808:808

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2001::808:808, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 128/142/184 ms

IPV6_HOST#

From above you can see I ping 2001::808:808, the 2001:: is the prefix I use

for the NAT-PT and the 32 last bits 0808:0808 is translated to 8.8.8.8 (Google DNS)



to verify the translation on the NAT-PT router:
NAT_PT_ROUTER#sh ipv nat translations

Prot  IPv4 source              IPv6 source

      IPv4 destination         IPv6 destination

---   ---                      ---

      10.0.0.2                 2001::A00:2

icmp  100.100.0.102,3764       2001:100:100::1,3764

      8.8.8.8,3764             2001::808:808,3764

---   100.100.0.102            2001:100:100::1

      10.0.0.2                 2001::A00:2

---   100.100.0.102            2001:100:100::1

      ---                      ---

NAT_PT_ROUTER#debug ipv6 nat

IPv6 NAT-PT debugging is on

NAT_PT_ROUTER#

*Mar  1 14:12:06.104: IPv6 NAT: icmp src (2001:100:100::1) -> (100.100.0.102), dst (2001::808:808) -> (8.8.8.8)

*Mar  1 14:12:06.236: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)

*Mar  1 14:12:06.256: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)

*Mar  1 14:12:06.264: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)

*Mar  1 14:12:06.280: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)

default timeout for the translation rule to expire from the table is 60 sec, to save some

work from the router i would suggest to increase that timeout

ipv nat translation timeout 300 (increase to 5 min)

now with that said you can increase or decrease timeout for tcp , udp , icmp , I would love if there would be also the

option to specifically decrease the timeout for SYN (prevent from SYN flood attack) currently there is an option only 

for FIN or RST flags (and I suggest to decrease their time out.

ipv nat translation finrst-timeout 10 












at





1 comment:
  


















Labels:
,
,
,
,
,
,
,
,
,

















        

      









Subscribe to:
Posts (Atom)