LT Port Security, lab cu hnh c bn switch v port security Nhc li hot ng c bn ca Switch:

Security c bn trn Switch:+ t password+ M ha password Port-security trn Switch: chn tn cng loi MAC

+ Da trn hot ng ca Switch, khi c 1 PC kt ni vo th ngay lp tc Switch s hc a ch MAC ca PC ny.+ Trong hnh trn gi s PC B l ca attacker, s dng phn mm tung MAC gi vo Switch bng cch t ng khi to cc frame vi mi frame l 1 S.MAC gi. Do , Switch lin tc hc a ch MAC gi (v 1 cng ca switch c th hc c nhiu a ch MAC). Nhng bng MAC ca Switch cha mt s gii hn a ch MAC. V vy, bng MAC c th b trn.+ Xy ra 1 trong 2 trng hp sau khi bng MAC b trn: Th nht, Switch bi trn va l con Switch b t lit bng CAM. Switch lc ny tr thnh con Hub. Lc ny, khi c mt frame n Switch, Switch s y ra tt c cc cng, trong c cng ang ni vi PC ca attacker. Attacker ch cn dng cc phn mm bt gi thu thp thng tin ca h thng mng. Th hai, bng CAM trn, nhng attacker vn tip tc to cc frame v l cho Switch c th b treo, lm mng LAN khng hot ng c.+ Do , port-security dng hn ch s lng a ch MAC c php truy cp vo Switch. Cu hnh port-security: Cu hnh port-security gii hn a ch MAC hc c trn cng f0/1 Switch.

Bc 1: Vo interface mun gii hn a ch MAC.Switch>enableSwitch#conf tSwitch(config)#interface f0/1Switch(config-if)#shutdown Bc 2: a port vo ch access, y l ch bt buc cho port khi cu hnh port security.Switch(config-if)#switchport mode accessBc 3: Khi ng port security.Switch(config-if)#switchport port-securityBc 4: Ch nh s a ch MAC c hc vo interface.Switch(config-if)#switchport port-security maximum maximum Bc 5: Ch nh a ch MAC, dng 1 trong 2 cch sau.Switch(config-if)#switchport port-security mac-addressmac-address Nhp a ch MAC bng tay. Ty theo s maximum cu lnh trn, 1 a ch MAC cho php s tng ng vi 1 dng lnh. Ch v nh dng v a ch MAC trong cu lnh trn l: AAAA.BBBB.CCCC.Switch(config-if)#switchport port-security mac-addresssticky Sau khi cu hnh port-security xong th ty theo s maximum cu lnh trn m khi kt ni nhng PC u tin vo f0/1 ca Switch, Switch s cho php MAC ca nhng PC ny.Bc 6: Ch nh trng thi ca cng s thay i khi a ch MAC kt ni b sai.Switch(config-if)#switchport port-security violation [shutdown | restrict | protect]restrict: Cng vn trng thi up mc da ch MAC kt ni b sai. Tuy nhin cc gitin n port ny u b hy v s c mt bnthng bo (syslog) vi phm.protect: Cng vn up nh restrict, cc gi tinn port b hy v khng c thng bo v vicvi phm.shutdown: Cng s c a vo trng thili (err-disable) v b shutdown.

2. CDP (Cisco Discovery Protocol) C mt cu hi t ra l: bng 1 cu lnh no gip v ra ton b s mng. Ch cn nh vo giao thc CDP. y l giao thc c quyn ca Cisco, c bt mc nh v dng thu thp thng tin v cc thit b ln cn (cc thit b kt ni trc tip). Thu thp cc thng tin v:+ Thng tin v Hostname.+ Thng tin IOS.+ Thng tin flatform: dng sn phm ca thit b.+ Thng tin v kh nng ca thit b (l Router hay Switch).+ Thng tin v IP v tn interface. Hot ng ca CDP:+ Cc thit b kt ni trc tip vi nhau c 60s m ln gi cho nhau mt gi CDP message. Da trn thng tin c trong gi CDP message m cc thit b s thu thp thng tin ca nhau. Thi gian 60s ny gi l CDP timer.+ 180s l thi gian m thit b gi gi CDP message ca thit b ln cn. Nu sau 60s m thit b li nhn c gi CDP message t thit b ln cn th thit b ny t cp nht thi gian t 120s thnh 180s. Nhng nu 60s trong nhng ln tip theo m khng nhn c gi CDP th thi gian 180s c a xung s 0. Khi m thi gian ny c a xung s o th thit b xem thit b ln cn b down, ngha l khng bit thng tin g v thit b ln cn ny na. Thi gian180s ny gi l thi gian CDP holdtime. Cc cu lnh xem thng tin CDP:+ Xem thng tin v thng s thi gian ca CDPRouter#show cdp+ Lnh chnh cc khong thi gianRouter(config)#cdp timer 90Router(config)#cdp holdtime 240+ Lnh xem thng tin thit b ln cnRouter#show cdp neighbors {khng xem c IP v IOS}Router#show cdp neighbors detail {Xem c thm IP v IOS}Router#show cdp entry * {tng t show cdp neighbors detail}+ Hin th lu lng CDP ti cc interface (gm c s gi CDP gi nhn v b li)Router#show cdp trafficRouter#show cdp interface+ Tt giao thc CDPTt ton b: Router(config)#no cdp runTt trn interface c chn:Router(config)#interface fastEthernet 0/0Router(config-if)#no cdp enable

L thuyt Load IOS1. Thanh ghi cu hnh v qu trnh khi ng ca Router2. Recovery password3. Backup/Upload file cu hnh, IOS1. Thanh ghi cu hnh v qu trnh khi ng ca Router Trn Router c mt thanh ghi cu hnh di 16 bit. Thanh ghi ny c lu trn NVRAM ca Router.1514131211109876543210

Vic bt hot tt cc bit ca thanh ghi c th nh hng n hot ng ca Router.+ Cc bit 12, 11, 5 quyt nh tc console ca Router. Vi 3 bit to ra gi tr. Gi tr mc nh l 9600.+ Bit 6 quyt nh n vic ti tp tin cu hnh cho Router.+ cc bit 3,2,1,0 gi l boot field, nh hng n tin trnh khi ng ca Router. Ngi qun tr c thanh ghi di dng s hexa.V d: 0x21420x: gi tr thanh ghi c th hin di s hexa.2142 theo nh phn: 0010.0001.0100.0010. Tin trnh khi ng ca Router theo mt cch y :+ Bc 1: Chng trnh Power-on diagnostics trong ROM s c chy test cc module phn cng ca thit b.+ Bc 2: Chng trnh bootstrap s c np t ROM sang RAM.+ Bc 3: Chng trnh bootstrap sau khi c np sang RAM th chng trnh ny s thc hin vo flash load IOS cho Router. Nu boot field c gi tr l 0 (0000): Thanh ghi c gi tr 0x2100. Router s Boot t ROM. Ni cch khc Router s vo ROM load ln IOS ph, mode rommon (mc d IOS chnh c th c). Nu boot field c gi tr l 1 (0001): Thanh ghi c gi tr l 0x2101. Router s load IOS u tin. IOS u tin c xem l IOS ci t trc trn thit b, v flash ca Router c th cha nhiu IOS. Nu mt Router c nhiu IOS th c th thc hin mt cu lnh chn IOS s c load, nhng lu rng nu thanh ghi c gi tr l 0x2101 th IOS u tin lun c load. Nu boot field c gi tr l 2 (0010) v bit 6 c gi tr l 0: Thanh ghi c gi tr l 0x2102. Thanh ghi mc nh ca Router. Nu thanh ghi ca Router c gi tr mc nh th qu trnh khi ng ca Router nh bi 6. Nu boot field c gi tr l 2 (0010) v bit 6 c gi tr l 1: Thanh ghi c gi tr l 0x2142. Nu thanh ghi Router c gi tr l 0x2142 th sau khi Router load xong IOS th khng vo NVRAM load file cu hnh m load ln thng cu hnh trng.Ch : thc hin lnh Router#show version xem gi tr thanh ghi.2. Recovery password Bc 1: Tt Router, sau bt li. Nht Ctrl+ Break lin tc router vo c mode rommon: rommon 1> Bc 2: Chuyn gi tr thanh ghi v khi ng li thit b.Rommon 1> confreg 0x2142Rommon 2> reset Bc 3: Do thanh ghi l 0x2142 nn trong ln khi ng tip theo s v c cu hnh trng. bc ny cn em ton b cu hnh t NVRAM sang sang RAM, thc hin lnh show running-config xem cc password. Nu password c m ha th phi i li ton b password. Cn lu l l password va i ch ang nm trn RAM nn cn em ton b cu hnh t RAM sang NVRAM.Router>enableRouter#copy startup-config running-configR1#show running-configR1# . i li ton b passwordR1#copy running-config startup-config Bc 4: Khi phc gi tr thanh ghi 0x2102.R1#configure terminalR1(config)#config-register 0x2102R1#reload3. Backup/upload file cu hnh, IOSRouter (172.16.1.1)---------------PC(172.16.1.2) Cho router ping thnh cng PC Tao th mc cha file cu hnh IOS Back up file config r1#copy startup-config tftp: Address or name of remote host []? 172.16.1.2 Destination filename [r1-confg]? !! 608 bytes copied in 0.036 secs (16889 bytes/sec) Upload file configRouter#copy tftp: running-configAddress or name of remote host []? 172.16.1.2Source filename []? r1-confgDestination filename [running-config]?Accessing tftp://172.16.1.2/r1-confg...Loading r1-confg from 172.16.1.2 (via FastEthernet0/0): ![OK - 608 bytes]

608 bytes copied in 10.056 secs (60 bytes/sec)r1# Back up IOSr1#show flash: System flash dir File Length Name/status 1 16058640 c2600-ik9o3s3-mz.123-22.bin [16058704 bytes used, 718508 available, 16777212 total] 16384K bytes of processor board System flash (Read/Write) r1#copy flash: tftp: Source filename []? c2600-ik9o3s3-mz.123-22.bin Address or name of remote host []? 172.16.1.2 Destination filename [c2600-ik9o3s3-mz.123-22.bin]? !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! r1# Load IOSr1#copy tftp: flash:Address or name of remote host []? 172.16.1.2Source filename []? c2600-ik9o3s3-mz.123-22.binDestination filename [c2600-ik9o3s3-mz.123-22.bin]?%Warning:There is a file already existing with this nameDo you want to over write? [confirm]yAccessing tftp://172.16.1.2/c2600-ik9o3s3-mz.123-22.bin...Erase flash: before copying? [confirm]Erasing the flash filesystem will remove all files! Continue? [confirm]Erasing device... Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erasedErase of flash: completeLoading c2600-ik9o3s3-mz.123-22.bin from 172.16.1.2 (via FastEthernet0/0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!. Rt dy ra*Mar 1 00:11:58.859: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down... [timed out]%Error reading tftp://172.16.1.2/c2600-ik9o3s3-mz.123-22.bin (Timed out)r1#reloadrommon1 > setrommon 2 > IP_ADDRESS=172.16.1.1rommon 3 > IP_SUBNET_MASK=255.255.255.0rommon 4 > DEFAULT_GATEWAY=172.16.1.2rommon 5 > TFTP_SERVER=172.16.1.2rommon 6 > TFTP_FILE=c2600-ik9o3s3-mz.123-22.binrommon 7 > tftpdnld

Giao thc RIP (part 1)

Bi vit ny s review li hot ng ca giao thc RIP mt trong cc giao thc nh tuyn c cp n trong chng trnh CCNA.

u tin, chng ta cng trao i li mt vi c im ca RIP:1. RIP l mt giao thc distance vector in hnh. Mi router s gi ton b bng nh tuyn ca n cho router lng ging theo nh k 30s/ln. Thng tin ny li tip tc c lng ging lan truyn tip cho cc lng ging khc v c th lan truyn ra mi router trn ton mng. Kiu trao i thng tin nh th cn c gi l lan truyn theo tin n. ( y, ta c th hiu router lng ging l router kt ni trc tip vi router ang xt).2. Metric trong RIP c tnh theo hop count s node lp 3 (router) phi i qua trn ng i n ch. Vi RIP, gi tr metric ti a l 15, gi tr metric = 16 c gi l infinity metric (metric v hn), c ngha l mt mng ch c php cch ngun tin 15 router l ti a, nu n cch ngun tin t 16 router tr ln, n khng th nhn c ngun tin ny v c ngun tin xem l khng th i n c.3. RIP chy trn nn UDP port 520.4. RIPv2 l mt giao thc classless cn RIPv1 li l mt giao thc classful.5. Cch hot ng ca RIP c th dn n loop nn mt s quy tc chng loop v mt s timer c a ra. Cc quy tc v cc timer ny c th lm gim tc hi t ca RIP.6. AD ca RIP l 120.

Ta cng kho st hot ng lan truyn theo tin n ca RIP bng mt v d nh sau:

Hnh 1 S v d 1.

Trn hnh 1 l s kt ni ca 03 router R1, R2 v R3. Cc router ny c kt ni vi nhau bng cc ng serial point to point m t cc kt ni leased line. Bn thn mi router li u ni xung cc mng LAN bng cc cng F0/0 ca chng. Quy hoch IP cho cc phn on mng c m t chi tit trn s .Nh tho lun trong bi vit trc, khi cha chy nh tuyn mi router ch bit cc mng kt ni trc tip trn cc cng u ni ca mnh v a cc subnet ny vo bng nh tuyn. Trn hnh 1 cng hin th bng nh tuyn ca mi router ti thi im u tin khi cha chy nh tuyn. Cc gi tr 0 bn cnh phn nh rng metric i n cc mng ny bng 0 theo quan im metric ca RIP (cc mng ny u kt ni trc tip nn i n chng khng phi bc qua router no c).Tip theo, cc router c th ly c thng tin ca nhau, ta thc hin chy nh tuyn RIP trn cc router chng qung b thng tin cho nhau bng cch vo cc router bt RIP trn cc cng thch hp. Cu lnh bt RIP s c cp n sau trong bi vit. bc ny, ta ch kho st hot ng ca RIP.Nh ni, RIP hot ng theo kiu Distance vector, mi router s gi ton b bng nh tuyn ca mnh cho cc router lng ging theo nh k. Khng mt tnh tng qut, ta gi s R3 s gi cho R2 trc tin bng nh tuyn ca mnh.

Hnh 2 R3 gi cho R2 bng nh tuyn ca n.

Khi R2 nhn bng nh tuyn ny, n s kim tra thng tin v tip nhn nhng route n cha c. C mt route 192.168.3.0/24 m R2 cha c trong bng nh tuyn, n s tip nhn route ny vo bng nh tuyn ca n. Sau khi tip nhn xong thng tin t R3, bng nh tuyn t R2 s l:

Hnh 3 Bng nh tuyn ca R2.

Ta thy route mi c cp nht ch cng ra l S2/1 v route ny c cp nht t pha cng S2/1, v n ch ra rng i n c mng 192.168.3.0/24, gi tin t R2 phi c y ra cng S2/1. Thm na, ta cng thy metric ca route ny c tng thm 1 n v khi lan truyn qua thm mt router. Quan st trn hnh 1, ta cng thy r rng rng t R2 mun i n c mng 192.168.3.0/24 , ta phi bc qua mt con router (R3) trn ng i.Tip theo, n lt router R2 li em ton b bng nh tuyn ca mnh gi cho R1:

Hnh 4 R2 gi bng nh tuyn ca n cho R1.

Khi R1 nhn bng nh tuyn ny, n s kim tra thng tin v tip nhn nhng route n cha c. C hai route l 192.168.23.0/24 v 192.168.3.0/24 m R1 cha c trong bng nh tuyn, n s tip nhn cc route ny vo bng nh tuyn. Sau khi tip nhn xong thng tin t R2, bng nh tuyn t R1 s l:

Hnh 5 Bng nh tuyn ca R1.

Bng nh tuyn ca R1 c thm cc route mi hc c: 192.168.23.0/24, cng ra l S2/0, metric = 1 v 192.168.3.0/24, cng ra S2/0 vi metric = 2. Quan st li trn s mng hnh 1, ta thy cc thng tin ny c cp nht hon ton ng n.Nh vy sau mt lt lan truyn thng tin nh tuyn t R3 n R1, cc subnet pha R3 c hc trn ton mng. Qu trnh hc ny bt u t lng ging R2 ca R3, sau lan t R2 sang R1. Kiu lan truyn ny c gi mt cch hnh nh l lan truyn theo tin n: R3 n thng tin ca n sang R2, R2 li n tip thng tin sang R1. Chng ta cn nm vng nguyn tc hot ng ny ca Distance vector v cc giao thc thuc trng phi link state nh OSPF li hot ng hon ton khc: thng tin nh tuyn c gi i khng phi l cc route trong bng nh tuyn m l cc trng thi ng link trong bng c s d liu trng thi ng link, v c gi i n mi router trong vng ch khng phi l ch gi i cho lng ging nh i vi Distance vector.Cui cng, sau mt vi lt lan truyn theo tin n nh m t trn, kt qu hi t cui cng ca cc bng nh tuyn trn cc router s l:

Hnh 6 Kt qu hi t cui cng ca v d 1.

Cc router u hc c cc subnet xa khng kt ni trc tip thng qua chy giao thc nh tuyn, m bo i n c mi ni trong h thng mng.Vi kiu hot ng ny, mi router u phi tin tng tuyt i vo thng tin nh tuyn nhn c t ngi lng ging ca mnh, t dn n c th xy ra hin tng loop trn s chy Distance vector. hiu r vn , ta cng quan st tip v d nu trn trong trng hp mng 192.168.3.0/24 b down:

Hnh 7 Mng 192.168.3.0/24 down.

Nh m t trn hnh 7, khi mng 192.168.3.0/24 down, R3 loi b mng ny ra khi bng nh tuyn v xem nh khng bit thng tin g v mng ny. Mt thi gian ngn sau, khi n hn, R2 li gi ton b bng nh tuyn ca n qua cho R3. R3 tip nhn thng tin nh tuyn mi v thy rng trong khi thng tin m R2 chuyn sang cho n c mng 192.168.3.0/24 m n khng bit, R3 cp nht thng tin ny vo bng nh tuyn ca mnh:

Hnh 8 Bng nh tuyn ca R3.

Ta thy R3 cp nht thng tin nh tuyn mt cch sai lm v ch mt ng hon ton sai n mng 192.168.3.0/24 khng cn tn ti na! Cha dng li , khi n hn, R3 li tip tc gi bng nh tuyn ca n sang cho R2. Khi R2 tip nhn thng tin t R3, R2 thy rng thng tin mng 192.168.3.0/24 m n hc t R3 trc c s thay i v metric v n cp nht li thng tin metric ny:

Hnh 9 Bng nh tuyn ca R2.

C nh th R2 v R3 trao i thng tin nh tuyn cho nhau v thng tin v metric ca route 192.168.3.0/24 ngy mt sai lch tng ln sau mi ln trao i.Khi mt gi tin nh i n mng 192.168.3.0/24 i n R2, R2 s tra bng nh tuyn ri y n sang R3 theo cng ra l S2/1 R3 khi tip nhn gi tin ny li tra bng nh tuyn ri y ngc li R2, R2 khi nhn c li y tr li v R3, T to nn mt vng loop trong vn chuyn gi tin (xem hnh 10).

Hnh 10 Loop trong nh tuyn.

Giao thc RIP (part 2)

Cc quy tc chng loop

khc phc hin tng ny, RIP s dng mt quy tc chng loop gi l quy tcSplit horizon.

Lut Split horizon:Khi router nhn c cp nht nh tuyn ca mt mng t pha cng no th n khng gi ngc li cp nht cho mng y v pha cng m n nhn c na.Theo cch ny, tr li v d trn, khi R2 nhn cp nht nh tuyn cho mng 192.168.3.0/24 t cng S2/1 th trong nhng ln gi cp nht nh tuyn v pha cng S2/1, n s loi ra khng gi thng tin 192.168.3.0/24 i na. T R3 s khng nhn c thng tin nh tuyn sai lch khi mng 192.168.3.0/24 ca n b down.

Hnh 11 R2 s khng gi ngc thng tin n hc c t R3 v cho R3.

Ngoi ra, khi xy ra cc s c down mng nh trn, RIP cn s dng thm cc quy tc sau thc y nhanh hn tin trnh cp nht nh tuyn v h tr cho tin trnh chng loop:

Route poisoning:Khi mt subnet kt ni trc tip chuyn sang down, router s gi i mt bn tin cp nht cho subnet ny c metric = 16 (infinity metric) cho lng ging ca n. Router lng ging khi nhn c bn tin ny s cp nht c rng subnet khng cn na, n lt n, n li tip tc pht ra mt cp nht nh tuyn cho subnet ny vi metric =16 cho lng ging tip theo, c th c mng s nhanh chng bit c subnet ny khng cn na. Vic pht ra bn tin cp nht cho subnet down c thc hin ngay lp tc m khng cn phi ch ti hn nh k (ta gi vic ny ltrigger update).

Poison reverse:Khi router lng ging nhn c bn tin update cho mt subnet down c metric = 16 (infinity metric), n cng phi ngay lp tc hi p v cho lng ging mt bn tin cp nht cho subnet y cng vi metric = 16. Hot ng ny c gi l poison reverse.

Trigger update:Vic pht ra cc bn tin Route poisoning v Poison reverse phi c thc hin ngay lp tc m khng cn ch ti hn nh k gi cp nht nh tuyn c gi l hot ngtrigger update.

Hnh 12 Route poisoning v Poison reverse.

Ngoi ra, chng loop, RIP cn s dng mt tin trnh l tin trnh holddown, s dng mt b nh thi gi l holddown timer.

Holddown timer

Ta cng xem xt mt trng hp cho thy rng ngay c khi split horizon c bt, vn c th xy ra loop v li tng metric n infinity. S v d:

Hnh 13 S v d 2.

Nh tho lun trong v d trc, trong trng hp bnh thng, khi bt RIP trn cc router R1, R2 v R3, R3 s gi thng tin v mng 192.168.3.0/24 ca mnh ra khi cc cng serial u ni n R1 v R2 R1 v R2 cp nht thng tin v mng 192.168.3.0/24 vo bng nh tuyn ca mnh nh hnh 13. Tt nhin, R1 v R2 n lt chng cng li tip tc gi cp nht ra cc cng serial cn li sang nhau nhng R1 v R2 u b qua cc cp nht mng 192.168.3.0/24 nhn c t nhau v metric ca cc cp nht ny ln hn metric trong cp nht nhn c trc tip t R3.Khi mng 192.168.3.0/24 trn cng F0/0 ca R3 chuyn sang down, nh trnh by, R3 s gi cc bn tin route poisoning n R1 v R2 vi ni dung 192.168.3.0/24, metric = 16. R1 v R2 s cp nht v bit c mng 192.168.3.0/24 down, sau chng tip tc gi bn tin ny cho lng ging khc (gi cho nhau). Tuy nhin, mt trng hp c th xy ra l khi bn tin route poisoning i n c R1, R1 kt lun mng 192.168.3.0/24 down, nhng bn tin ny cha n kp R2 (c th do tr) v ng vo lc R2 gi cho R1 bn tin cp nht nh thng l v mng 192.168.3.0/24 (R2 lc ny cha bit mng ny down) (xem hnh 14).

Hnh 14 Mng 192.168.3.0/24 down.

R1 khi nhn c bn tin cp nht t R2 lp tc cp nht mng 192.168.3.0/24 vo bng nh tuyn ca n v lc ny n ang trng thi khng bit mng 192.168.3.0/24. n lot n, n li gi tip cp nht 192.168.3.0/24 cho R3, R3 lc ny cng khng bit mng 192.168.3.0/24 nn li cp nht vo bng nh tuyn ch ng v R1. Sau R3 tip tc gi cp nht i cho R2 v R2 li cp nht li mng 192.168.3.0/24 vo bng nh tuyn ca n ch ng i v R3 C nh vy, loop li xy ra (xem hnh 15).

Hnh 15 S xy ra loop.

Cc giao thc Distance vector s dng holddown timer ngn chn vic xy ra loop trong trng hp nh th ny.LutHolddown timer: Sau khi nhn c mt poisoned route, router s khi ng b nh thi holddown timer cho route ny. Trc khi b timer ny ht hn, khng tin tng bt k thng tin nh tuyn no v route down ny, ngoi tr thng tin n t chnh lng ging cp nht cho mnh route ny u tin. Gi tr default ca holddown timer l 180s.Nh vy theo lut ny, khi R1 nhn c cp nht route poisoning t R3 cho mng 192.168.3.0/24 v kt lun rng route ny down, R1 s khng chp nhn bt k thng tin no n t ngun tin khc ngoi tr R3 trong sut khong thi gian holddown timer. Nh thng tin route poisoning cho mng 192.168.3.0/24 c cp nht kp thi n R2 v khng cn gy ra loop na.

Cc b timer

Bn cnh cc quy tc chng loop cp trn, RIP cn s dng mt s timer cho hot ng ca mnh:

Update timer: khong thi gian nh k gi bn tin cp nht nh tuyn ra khi cc cng chy RIP, gi tr default l 30s.

Invalid timer: khi router nhn c cp nht v mt subnet no m sau khong thi gian invalid timer vn khng nhn li cp nht v mng ny (m ng ra l phi nhn c 30s/ln), router s coi route i n subnet ny l invalid nhng vn cha xa route ny khi bng nh tuyn. Gi tr default ca timer ny l 180s.

Flush timer: khi router nhn c cp nht v mt subnet no m sau khong thi gian flush timer vn khng nhn li cp nht v mng ny (m ng ra l phi nhn c 30s/ln), router s xa b hn route ny khi bng nh tuyn. Gi tr default ca timer ny l 240s.

Nh vy, khi mt route cho mt subnet no xut hin trong bng nh tuyn, router k vng rng c 30s mt ln route ny phi c lng ging gi li cp nht refresh. Nu sau 30s, route khng c refresh, n s c theo di tip cho n ht giy th 180 v b nh du invalid. Khi invalid, route vn cn c duy tr trong bng nh tuyn thm 60s na (n ht giy th 240) mi b xa hon ton khi bng nh tuyn.

So snh gia RIPv1 v RIPv2

C hai version hot ng ca giao thc RIP l version 1 v 2. Hai version ny ging nhau hon ton v cch thc hot ng nh m t trn. Tuy nhin, cng c mt s im khc bit gia hai version:- RIPv1 l mt giao thc classful trong khi RIPv2 l mt giao thc classless. Cc giao thc classful c nhiu im hn ch nn ngy nay cc tin trnh RIP c chy ch yu l RIPv2.- RIPv1 s dng a ch broadcast 255.255.255.255 gi i cc bn tin cp nht trong khi RIPv2 s dng a ch multicast 224.0.0.9 gi i cc bn tin cp nht.- RIPv1 khng h tr xc thc trong nh tuyn trong khi RIPv2 c h tr xc thc. iu ny dn n nhng nguy c v bo mt khi s dng RIPv1.

Giao thc OSPF (part 1)OSPF Open Shortest Path First, l mt giao thc nh tuyn link state in hnh. y l mt giao thc c s dng rng ri trong cc mng doanh nghip c kch thc ln. Trong chng trnh CCNA, y cng l mt ch chnh c cp nhiu. Do , nm vng nhng nguyn tc hot ng ca OSPF s gip cc bn ang theo hc chng trnh CCNA hon thnh tt k thi ly chng ch quc t CCNA cng nh p ng tt nhu cu cng vic trong thc t.Mt s c im chnh ca giao thc OSPF:1. OSPF l mt giao thc link state in hnh. Mi router khi chy giao thc s gi cc trng thi ng link ca n cho tt c cc router trong vng (area). Sau mt thi gian trao i, cc router s ng nht c bng c s d liu trng thi ng link (Link State Database LSDB) vi nhau, mi router u c c bn mng ca c vng. T mi router s chy gii thut Dijkstra tnh ton ra mt cy ng i ngn nht (Shortest Path Tree) v da vo cy ny xy dng nn bng nh tuyn.2. OSPF c AD = 110.3. Metric ca OSPF cn gi l cost, c tnh theo bandwidth trn cng chy OSPF.4. OSPF chy trc tip trn nn IP, c protocol id l 89.5. OSPF l mt giao thc chun quc t, c nh ngha trong RFC 2328.Ta cng review hot ng ca OSPF thng qua cc bc hot ng nh sau:1. Bu chn Router id.2. Thit lp quan h lng ging (neighbor).3. Trao i LSDB.4. Tnh ton xy dng bng nh tuyn.

Router id:

u tin, khi mt router chy OSPF, n phi ch ra mt gi tr dng nh danh duy nht cho n trong cng ng cc router chy OSPF. Gi tr ny c gi l Router id.Router id trn router chy OSPF c nh dng ca mt a ch IP. Mc nh, tin trnh OSPF trn mi router s t ng bu chn gi tr router id l a ch IP cao nht trong cc interface ang active, u tin cng loopback.Ta cng lm r ny thng qua v d:

Hnh 1 Bu chn router id (1).

Khi cho router R tham gia OSPF (xem hnh 1), router R phi bu chn ra mt nick name nh danh R khi R chy OSPF. V nick name ny c nh dng ca mt a ch IP nn R s ly mt trong cc a ch IP trn n lm Router id. Nh ni trn, ch a ch ca cc interface ang active, tc l trng thi up/up (status up, line protocol up) mi c tham gia bu chn. Ta thy trn hnh , ch c hai cng F0/0 v F0/1 ca R l up/up nn router R s ch xem xt hai a ch trn hai cng ny l 192.168.1.1 v 192.168.2.1. xc nh trong hai a ch ny, a ch no l cao hn, R tin hnh so snh hai a ch ny theo tng octet t tri sang phi, a ch no c octet u tin ln hn c xem l ln hn. Ta thy, vi cch so snh ny, a ch 192.168.2.1 c xem l ln hn a ch 192.168.1.1 nn n s c s dng lm router id. Vy R s tham gia OSPF vi gi tr nick name router id l 192.168.2.1.Ta cng thy trong 03 a ch xut hin trn hnh 1, a ch 203.162.4.1 ca cng serial S0/1/0 trn router R l ln nht nhng v cng ny down nn khng c tham gia bu chn.Cng v d trn nhng ln ny trn router R c thm cc interface loopback:

Hnh 2 Bu chn router id (2).

Khi ta bt OSPF trn router R, R xc tin vic bu chn router id. V ln ny c cc interface loopback nn R s b qua, khng xem xt cc a ch ca cc interface vt l. Hai a ch ca hai interface loopback 1 v 2 s c so snh chn ra router id cho router R, v ta thy r rng 2.2.2.2 > 1.1.1.1 nn router R s chn 2.2.2.2 lm router id khi tham gia OSPF. T hnh 2, ta thy, 2.2.2.2 khng phi l a ch IP cao nht nhng v tin trnh u tin cng loopback nn cc a ch trn cc cng loopback s c xem xt trc. iu ny c gii thch l s em li s n nh cho tin trnh OSPF v interface loopback l loi interface lun l khng bao gi down tr khi ngi qun tr shutdown interface ny.Thc cht, vic up/down ca cc interface khng nh hng nhiu lm n router id ca cc router chy OSPF. Tht vy, gi s trong v d trn, router R chn xong router id l 192.168.2.1 l IP ca cng F0/1 (xt trng hp cha c cc interface loopback) v tham gia vo OSPF vi router id 192.168.2.1. Lc ny, nu ta c b sung thm cc interface loopback trn router th router cng s khng i li router id thnh IP ca cc interface loopback. Hn na, cho d lc ny cng F0/1 c down, th router vn gi gi tr router id m n chn. C ngha l, router id n thun ch l mt ci tn. Khi tn c chn th tin trnh OSPF s lm vic vi ci tn ny v khng thay i li na. Cng c IP c trch xut lm tn ca router lc ny c up/down cng khng nh hng g c. Vy nu chng ta mun i li router id ca tin trnh th sao? Ta phi thc hin khi ng li router hoc g b tin trnh OSPF ri cu hnh li, khi tin trnh bu chn router id s c thc hin li vi cc interface ang hin hu trn router.V nh vy, ta thy vic u tin s dng IP trn loopback mang nhiu ngha v mt qun tr hn l tnh n nh ca tin trnh. N cho php ngi qun tr kim sot hiu qu hn cc router id ca cc router.C mt cch khc thit lp li gi tr router id cho router m khng cn phi khi ng li router hoc cu hnh li OSPF l s dng cu lnh router-id thit lp bng tay gi tr ny trn router:

Router(config)#router ospf 1Router(config-router)#router-id A.B.C.D

Lc ny gi tr ca router id c th khng cn phi l mt a ch IP c sn trn router. Bn cnh , nu tin trnh OSPF chy v router id c thit lp trc , ta phi khi ng li tin trnh OSPF th mi p dng c gi tr router id mi c ch ra trong cu lnh router id. Cu lnh khi ng li tin trnh OSPF:

Router#clear ip ospf processReset ALL OSPF processes? [no]: yes cost = 10.Fast Ethernet (BW = 100Mbps) -> cost = 1.Serial (BW = 1.544Mbps) -> cost = 64 (cht b phn thp phn trong php chia).Ta cng xem xt mt v d kho st cch tnh ton path cost cho mt ng i:

Hnh 9 S v d tnh path cost.

Yu cu t ra vi s hnh 9 l tnh path cost (metric) cho ng i t R1 n mng 192.168.3.0/24 ca R3.Ta thy mt cch d dng: t R1 i n mng 192.168.3.0/24 ca R3 s i qua cc ng link Fast Ethernet c cost = 1, serial c cost l 64 v link Fast Ethernet c cost bng 1. Vy tng cost tch ly s l 1 + 64 + 1 l 66. Metric t R1 n mng 192.168.3.0/24 l 66.Tuy nhin vic tnh ton s tr nn phc tp hn nu hai cng router hai u link khng ng nht v gi tr cost. V d, ta vo cng F0/0 ca R2 i li gi tr cost thnh 64 bng cch nh lnh sau y trn cng F0/0 ca R2:R2(config)#interface f0/0R2(config-if)#ip ospf cost 64Vy cu hi t ra l vi link Fast Ethernet ni gia R1 v R2 ta chn cost ca link ny l 1 hay 64? Nu chn l 1, tng cost ton tuyn vn gi gi tr nh c l 66, nhng nu chn l 64, tng cost ton tuyn s l 64 + 64 + 1 l 129, hai gi tr rt khc nhau!

Hnh 10 Tng path cost l 66 hay 129?

Giao thc OSPF (part 2)

tr li c cu hi ny, ta cn nm nguyn tc sau u trong vic tnh tng cost vi OSPF: tnh tng cost t mt router n mt mng ch theo mt ng (path) no , ta thc hin ln ngc t ch ln v v cng dn cost theo quy tc i vo th cng, i ra th khng cng.p dng quy tc ny cho v d hnh 10: tnh tng cost t R1 n mng 192.168.3.0/24, ta i ngc t mng 192.168.3.0/24 i v. Khi i v ta i vo cng F0/0 ca R3, cng gi tr cng ny (tng cost lc ny l 1); i ra khi cng S2/0 ca R3, b qua khng cng (tng cost vn l 1); i tip vo cng S2/0 ca R2, cng gi tr cng ny (lc ny tng cost l 1 + 64 = 65); i ra khi cng F0/0 ca R2, b qua khng cng (tng cost vn l 65); i tip vo cng F0/0 ca R1, cng gi tr cng ny (tng cost l 65 + 1 = 66), kt thc hnh trnh. Vy tng cost vn l 66, vic thay i gi tr cost trn cng F0/0 ca R2 khng nh hng g n path cost t R1 i n 192.168.3.0/24.

Hnh 11 Cc cng tham gia vo tin trnh tnh ton path cost vi OSPF.

Nh vy vi OSPF, nh gi ng c cost ca ng i v c th hiu chnh cost trn cng b ng i ca gi tin theo mun, ta cn phi cn thn trong vic xc nh xem cng no trn ng i s tham gia vo tnh ton hiu chnh ng cng v hiu chnh khng ng cng s khng mang li bt k thay i g.Trn y, chng ta cng nhau review mt s nt chnh trong hot ng ca OSPF n vng thng qua cc bc hot ng ca tin trnh OSPF: chn Router id, thit lp quan h lng ging, trao i LSDB v tnh ton xy dng bng nh tuyn.

Giao thc EIGRPTrong cc bi vit trc chng ta review cc k thut nh tuyn c cp trong chng trnh CCNA. Ln ny chng ta cng review giao thc EIGRP mt trong 03 giao thc nh tuyn ca chng trnh.Nh thng l, u tin chng ta cng nhc li mt s c im chnh ca giao thc:1) EIGRP l mt giao thc nh tuyn do Cisco pht trin, ch chy trn cc sn phm ca Cisco. y l im khc bit ca EIGRP so vi cc giao thc c cp trc y. Cc giao thc RIP v OSPF l cc giao thc chun, c th chy trn cc router ca nhiu hng khc nhau.

2) EIGRP l mt giao thc dng Distance vector c ci tin (Advanced Distance vector). EIGRP khng s dng thut ton truyn thng cho Distance vector l thut ton Bellman Ford m s dng mt thut ton ring c pht trin bi J.J. Garcia Luna Aceves thut ton DUAL. Cch thc hot ng ca EIGRP cng khc bit so vi RIP v vay mn mt s cu trc v khi nim ca hin thc OSPF nh: xy dng quan h lng ging, s dng b 3 bng d liu (bng neighbor, bng topology v bng nh tuyn). Chnh v iu ny m EIGRP thng c gi l dng giao thc lai ghp (hybrid). Tuy nhin, v bn cht th EIGRP thun ty hot ng theo kiu Distance vector: gi thng tin nh tuyn l cc route cho lng ging (ch gi cho lng ging) v tin tng tuyt i vo thng tin nhn c t lng ging.

3) Mt c im ni bt trong vic ci tin hot ng ca EIGRP l khng gi cp nht theo nh k m ch gi ton b bng nh tuyn cho lng ging cho ln u tin thit lp quan h lng ging, sau ch gi cp nht khi c s thay i. iu ny tit kim rt nhiu ti nguyn mng.

4) Vic s dng bng topology v thut ton DUAL khin cho EIGRP c tc hi t rt nhanh.

5) EIGRP s dng mt cng thc tnh metric rt phc tp da trn nhiu thng s: Bandwidth, delay, load v reliability.

6) Ch s AD ca EIGRP l 90 cho cc route internal v 170 cho cc route external.

7) EIGRP chy trc tip trn nn IP v c s protocol id l 88.

Tip theo, chng ta s cng im li mt s im chnh trong hot ng ca EIGRP:

Thit lp quan h lng ging

Ging OSPF, ngay khi bt EIGRP trn mt cng, router s gi cc gi tin hello ra khi cng thit lp quan h lng ging vi router kt ni trc tip vi mnh. im khc bit l cc gi tin hello c gi n a ch multicast dnh ring cho EIGRP l 224.0.0.10 vi gi tr hello timer (khong thi gian nh k gi gi hello) l 5s.

Hnh 1- Cc router gi gi tin hello.

V cng ging nh OSPF, khng phi cp router no kt ni trc tip vi nhau cng xy dng c quan h lng ging. quan h lng ging thit lp c gia hai router, chng phi khp vi nhau mt s thng s c trao i qua cc gi tin hello, cc thng s ny bao gm:1) Gi tr AS c cu hnh trn mi router.2) Cc a ch u ni gia hai router phi cng subnet.3) Tha mn cc iu kin xc thc.4) Cng b tham s K.

Ta cng phn tch cc tham s ny:

Gi tr AS Autonomous System

Khi cu hnh EIGRP trn cc router, ta phi khai bo mt gi tr dng nh danh cho AS m router ny thuc v. Gi tr ny buc phi khp nhau gia hai router kt ni trc tip vi nhau cc router ny c th thit lp c quan h lng ging vi nhau. V mt cu hnh, gi tr AS ny nm v tr trong cu lnh rt ging vi gi tr process id khi so snh vi cu lnh cu hnh OSPF. Tuy nhin, gi tr process id trong cu hnh OSPF ch c ngha local trn mi router v c th khc nhau gia cc router nhng gi tr AS trong cu hnh EIGRP bt buc phi ging nhau gia cc router thuc cng mt routing domain. Cu lnh i vo mode cu hnh EIGRP:

R(config)#router eigrp s AS FD ca Successor, ng no c AD < FD ca successor, ng s c chn l Feasible Successor v c s dng lm d phng cho Successor.Trong v d trn, ta thy trong 03 ng nu, ng s 1 l ng c FD nh nht trong 03 ng, vy ng s 1 s c bu chn lm Successor. Hai ng cn li u c FD > FD1 (FD2 = 2000, FD3 = 3000). Tuy nhin, ch ng s 3 mi c AD < FD ca successor (AD3 = 800 < FD1 = 1000) nn ch c ng s 3 mi c bu chn lm Feasible Successor. ng s 1 Successor s c a vo bng nh tuyn s dng lm ng i chnh thc ti mng 4.0.0.0/8 v ng s 3 s c s dng lm d phng cho ng i chnh thc ny. Nu ng s 1 down, router sngay lp tca ng s 3 vo s dng.L do ca lut chn Feasible Successor phi c AD < FD ca successor l chng loop. Ngi ta chng mnh c rng trong mt mng chy giao thc kiu Distance vector, nu metric t im A i n mt mng no y < metric i t im B n cng mng y th khng bao gi trn hnh trnh t im A i n mng nu trn li i qua im B. Chnh v vy nu AD ca Feasible Successor < FD Successor th khng bao gi d liu i theo Feasible Successor li i vng tr li router Successor t loop khng th xy ra.Ta cng lu Successor l loi route duy nht va nm trong bng nh tuyn va nm trong bng Topology.

Vy cu hi t ra l nu trong cc ng cn li khng c ng no tha mn iu kin Feasible Successor th sao? Trong trng hp ny, Successor vn c a vo bng nh tuyn s dng lm ng i chnh thc n mng ch nhng n khng c ng backup. Trong trng hp ng chnh ny down, router chy EIGRP s thc hin mt k thut gi l Query: n s pht cc gi tin truy vn n cc lng ging, hot ng truy vn s tip tc c lan truyn cho n khi tm ra c ng i v ch hoc khng cn ng i no c th v ch c na. Hot ng Query ny khng c gii thiu trong chng trnh CCNA m c cp chi tit trong course Route ca chng trnh CCNP.Sau khi trao i thng tin nh tuyn vi lng ging, cp nht bng Topology, rt ra c cc Successor a vo bng nh tuyn, hot ng ca mt router chy EIGRP c bn l hon thnh. Tip theo, chng ta cng tm hiu cch tnh ton metric vi EIGRP.

Tnh ton metric vi EIGRP

Metric ca EIGRP c tnh theo mt cng thc rt phc tp vi u vo l 04 tham s: Bandwidth min trn ton tuyn, Delay tch ly trn ton tuyn (trong cng thc s ghi ngn gn l Delay), Load v Reliabily cng vi s tham gia ca cc trng s K:Metric = [K1*10^7/Bandwidth min + (K2*10^7/Bandwidth min)/(256 Load) + K3* Delay]*256*[K5/(Reliabilty + K4)]

Ta lu v n v s dng cho cc tham s trong cng thc trn:

Bandwidth: n v l Kbps.Delay: n v l 10 micro second.Load v Reliability l cc i lng v hng.

Nu K5 = 0, cng thc tr thnh:

Metric = [K1*10^7/Bandwidth min + (K2*10^7/Bandwidth min)/(256 Load) + K3* Delay]*256

Mc nh b tham s K c thit lp l: K1 = K3 = 1; K2 = K4 = K5 = 0 nn cng thc dng n gin nht mc nh s l:Metric = [10^7/Bandwidth min + Delay]*256

Mt s gi tr mc nh c quy nh cho mt s loi cng thng s dng trn router:

Ethernet: Bandwidth = 10Mbps; Delay = 1000 Micro second.Fast Ethernet: Bandwidth = 100Mbps; Delay = 100 Micro second.Serial: Bandwidth = 1,544Mbps; Delay = 20000 Micro second.

hiu r cch tnh metric, chng ta cng xem xt mt v d:

Hnh 4 V d v tnh ton metric.

Trong v d ny, chng ta s tnh metric i t R1 n mng 192.168.3.0/24 kt ni trc tip trn cng F0/0 ca router R3. Cng thc tnh metric trn mi router c t ch default (K1 = K3 = 1, K2 = K4 = K5 = 0).u tin, chng ta cn xc nh xem trong s trn cc cng no trn cc router s tham gia vo tin trnh tnh ton metric vi EIGRP. xc nh iu ny, chng ta thc hin i ngc t ch 192.168.3.0/24 v router ang xt l router R1 v xc nh cc cng tham gia theo quy tc: i vo th tham gia, i ra th khng tham gia (xem hnh 5).

Hnh 5 Xc nh cc cng tham gia tnh ton metric vi EIGRP.

T trn hnh 5 ta thy cc cng trn cc router s tham gia vo tin trnh tnh ton ny bao gm: cng F0/0 ca R1, cng S2/0 ca R2 v cng F0/0 ca R3. Cc cng ny c cc tham s Bandwidth (BW) v Delay nh sau:1) Cng F0/0 ca R1: BW = 100Mbps = 100000Kbps; Delay = 100 Microsecond = 10.10 Microsecond.2) Cng S2/0 ca R2 c : BW = 1,544 Mbps = 1544 Kbps; Delay = 20000 Micro second = 2000.10 Microsecond.3) Cng F0/0 ca R3: BW = 100Mbps = 100000Kbps; Delay = 100 Microsecond = 10.10 Microsecond.

T cc thng s trn ta xc nh c: Bandwidth min = 1544Kbps (nh nht trong s 3 cng tham gia); Tng Delay = 100 + 20000 + 100 = 20200 Microsecond = 2020.10 Microsecond. Ta rp cc thng s ny vo cng thc tnh metric default nu trn v tnh ra kt qu:Metric = (10^7/BWmin + Delay)*256 = (10^7/1544 + 2020)*256 = 2174976. y ta lu : vi cc php chia c l, ta cht b phn thp phn trong kt qu chia.Vic xc nh ng cc cng tham gia rt quan trng, n cho php chng ta hiu chnh chnh xc cc gi tr tham s trn cc cng thch hp hiu chnh c metric nhm phc v cho vic b ng trong EIGRP.

Cn bng ti trn nhng ng khng u nhau (Unequal Cost Load balancing)

Mt c im ni tri ca EIGRP l giao thc ny cho php cn bng ti ngay c trn nhng ng khng u nhau. iu ny gip tn dng tt hn cc ng truyn ni n router. hiu c k thut ny chng ta cng kho st li v d trong hnh 2.Nh phn tch trong 03 ng i t router R n mng 4.0.0.0/8 hnh 2, ng s 1 l ng c metric tt nht (FD nh nht), ng ny c chn lm Successor v a vo bng nh tuyn s dng. Nu bnh thng khng cu hnh g thm, router R s lun chn ng 1 l ng i n mng 4.0.0.0/8. Nh vy, hai ng s 2 v s 3 s b b ph khng bao gi c s dng. khc phc vn ny, chng ta c th hiu chnh cc tham s trn cc cng thch hp metric i theo cc ng l ging nhau, khi c 3 ng s u c a vo bng nh tuyn s dng. Tuy nhin, nh chng ta thy, trong cng thc tnh ton metric ca EIGRP c nhiu tham s, c php chia l thp phn v kt qu tnh ra thng rt ln v c phn gii c th n mt phn triu nn vic hiu chnh c cho cc ng chnh xc bng nhau khng phi l mt iu d dng (Vd: mt ng c metric 2174976 v m ng c metric 2174977 c th coi l tt nh nhau nhng EIGRP khng ng nh vy, vi EIGRP ng 2174976 vn tt hn 2174977 d hai ng ny metric ch chnh lch nhau c 1 phn triu!).Vi EIGRP, ta c th chn mt gii php cn bng ti n gin hn: cho php cn bng ti trn c nhng ng khng c metric bng nhau. thc hin iu , ta thc hin chnh mt tham s c tn l variance trn router bng cu lnh:R(config)#router eigrp AS numberR(config-router)#variance gi tr variance

Sau khi hiu chnh xong, gi tr variance ny s c nhn vi gi tr FD ca Successor. Kt qu nhn c nu ln hn metric ca ng no th router s cn bng ti lun qua c ng . Vi v d trn, gi s ta chnh variance = 4:

R(config-router)#variance 4

Khi , gi tr 4 s c nhn vi FD Successor : 4 * 1000 = 4000. Ta thy 4000 > 3000 l metric khi i theo ng s 3 nn router s thc hin cn bng ti qua c ng ny. Ta lu rng d ng s 2 c metric 2000