Lab Objective:
The focus of this lab is to understand tunneling implementation and configuration in Cisco IOS routers. Additional technologies include OSPFv3 authentication and security.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please bring up the LAN interfaces connected to the routers by issuing the no shutdown command on the connected switches. If you are using a home lab with no interface fastethernet 0/0 Alternately, you can simply connect the interfaces to a hub or switch if you have one available in your own lab. |
Task 1
Configure hostnames, IP addressing on all routers as illustrated in the network topology.
Task 2
Enable EIGRP on all routers as illustrated in the topology. Verify your EIGRP configuration.
Task 3
Configure a static IPv6 tunnel between R1 and R4. Ensure that you can ping across the tunnel. Verify your configuration using the appropriate commands.
Task 4
Configure OSPFv3 across the R1-R4 tunnel. Use OSPF area 0. Advertise the LAN subnets on R1 and R4 as inter-area OSPF routes. Verify that R1 and R4 can ping each other LAN-to-LAN.
Task 5
For security, configure area authentication for the OSPF backbone. Use the following parameters when you are configuring the authentication parameters:
- Use a Security Parameters Index (SPI) of 256
- Use Secure Hash Algorithm (SHA) authentication
- Use a key of 1234567890abcdef1234567890abcdef12345678
Verify your configuration using the appropriate commands.
Lab Validation
Task 1
Please refer to previous labs for basic IPv4, IPv6 addressing and hostname configuration. This will not be included in this section to avoid being redundant.
Task 2
| R1(config)#router eigrp 254 R1(config-router)#no auto-summary R1(config-router)#network 10.0.0.0 R1(config-router)#exit |
| R2(config)#router eigrp 254 R2(config-router)#no auto-summary R2(config-router)#network 10.0.0.0 R2(config-router)#exit |
| R3(config)#router eigrp 254 R3(config-router)#no auto-summary R3(config-router)#network 10.0.0.0 R3(config-router)#exit |
| R4(config)#router eigrp 254 R4(config-router)#no auto-summary R4(config-router)#network 10.0.0.0 R4(config-router)#exit |
Verify your EIGRP configuration using the show ip eigrp neighbors command:
| R1#show ip eigrp neighbors IP-EIGRP neighbors for process 254 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.0.0.2 Se0/0 12 00:01:31 5 200 0 8 |
| R2#show ip eigrp neighbors IP-EIGRP neighbors for process 254 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 1 10.0.0.10 Se0/1 10 00:01:28 9 300 0 3 0 10.0.0.1 Se0/0 12 00:01:34 2 200 0 3 |
| R3#show ip eigrp neighbors IP-EIGRP neighbors for process 254 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 1 10.0.0.14 Se1/2 13 00:01:26 12 1140 0 3 0 10.0.0.9 Se1/1 12 00:01:31 12 1140 0 7 |
| R4#show ip eigrp neighbors IP-EIGRP neighbors for process 254 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.0.0.13 Se0/0 14 00:01:29 14 200 0 7 |
Task 3
When you are configuring static (manual) IPv6 tunnels, you must specify IPv6 as the passenger protocol and IPv4 as both the encapsulation and transport protocol for the manual IPv6 tunnel using the tunnel mode ipv6ip interface configuration command. The requirements of this task are straightforward and are completed as follows:
| R1(config)#interface tunnel 0 R1(config-if)#ipv6 address 2001:abcd:1111:a::1/64 R1(config-if)#tunnel source serial 0/0 R1(config-if)#tunnel destination 10.0.0.14 R1(config-if)#tunnel mode ipv6ip R1(config-if)#exit |
| R4(config)#interface tunnel 0 R4(config-if)#ipv6 address 2001:abcd:1111:a::4/64 R4(config-if)#tunnel source serial 0/0 R4(config-if)#tunnel destination 10.0.0.1 R4(config-if)#tunnel mode ipv6ip R4(config-if)#exit |
Verify your tunnel configuration using the show interfaces command:
| R4#show interfaces tunnel 0 Tunnel0 is up, line protocol is up Hardware is Tunnel MTU 1514 bytes, BW 9 Kbit/sec, DLY 500000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 10.0.0.14 (Serial0/0), destination 10.0.0.1 Tunnel protocol/transport IPv6/IP Tunnel TTL 255 Fast tunneling enabled Tunnel transmit bandwidth 8000 (kbps) Tunnel receive bandwidth 8000 (kbps) Last input never, output 00:00:41, output hang never Last clearing of “show interface” counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 30 packets output, 2860 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out |
Finally, verify that you can ping across the tunnel using a simple ping:
| R4#ping 2001:abcd:1111:a::1 repeat 10 size 1500
Type escape sequence to abort. |
Task 4
The task OSPFv3 configuration requirements are straightforward. To advertise the LAN subnets that are connected as inter-area OSPF routes, you need to assign them to different areas. This task is completed as follows:
| R1(config)#ipv6 router ospf 1 R1(config-rtr)#router-id 1.1.1.1 R1(config-rtr)#exit R1(config)#interface tunnel 0 R1(config-if)#ipv6 ospf 1 area 0 R1(config-if)#exit R1(config)#interface fastethernet 0/0 R1(config-if)#ipv6 ospf 1 area 1 R1(config-if)#exit |
| R4(config)#ipv6 router ospf 4 R4(config-rtr)#router-id 4.4.4.4 R4(config-rtr)#exit R4(config)#interface tunnel 0 R4(config-if)#ipv6 ospf 4 area 0 R4(config-if)#exit R4(config)#interface fastethernet 0/0 R4(config-if)#ipv6 ospf 4 area 4 R4(config-if)#exit |
Verify your configuration using the show ipv6 ospf neighbor command on R1 and R4:
| R1#show ipv6 ospf neighbor
Neighbor ID Pri State Dead Time Interface ID Interface |
| R4#show ipv6 ospf neighbor
Neighbor ID Pri State Dead Time Interface ID Interface |
Following this, verify that the prefixes are advertised and received as required:
| R1#show ipv6 route ospf IPv6 Routing Table – 7 entries Codes: C – Connected, L – Local, S – Static, R – RIP, B – BGP U – Per-user Static route I1 – ISIS L1, I2 – ISIS L2, IA – ISIS interarea, IS – ISIS summary O – OSPF intra, OI – OSPF inter, OE1 – OSPF ext 1, OE2 – OSPF ext 2 ON1 – OSPF NSSA ext 1, ON2 – OSPF NSSA ext 2 OI 3FFE:ABCD:1111:4::/64 [110/11112] via FE80::A00:E, Tunnel0 |
| R4#show ipv6 route ospf IPv6 Routing Table – 7 entries Codes: C – Connected, L – Local, S – Static, R – RIP, B – BGP U – Per-user Static route I1 – ISIS L1, I2 – ISIS L2, IA – ISIS interarea, IS – ISIS summary O – OSPF intra, OI – OSPF inter, OE1 – OSPF ext 1, OE2 – OSPF ext 2 ON1 – OSPF NSSA ext 1, ON2 – OSPF NSSA ext 2 OI 3FFE:ABCD:1111:1::/64 [110/11112] via FE80::A00:1, Tunnel0 |
Finally, verify that R1 and R4 can ping each other LAN-to-LAN:
| R1#ping 3FFE:ABCD:1111:4::4 source fastethernet 0/0 repeat 10
Type escape sequence to abort. |
| R4#ping 3FFE:ABCD:1111:1::1 source fastethernet 0/0 repeat 10
Type escape sequence to abort. |
Task 5
OSPFv3 supports both authentication and encryption for security. To configure OSPFv3 area authentication, you need to use the area <area> authentication ipsec spi <size> [md5|sha1] <key> OSPFv3 configuration command. This task is completed as follows:
| R1(config)#ipv6 router ospf 1 R1(config-rtr)#$ ipsec spi 256 sha1 1234567890abcdef1234567890abcdef12345678 R1(config-rtr)#exit |
| R4(config)#ipv6 router ospf 4 R4(config-rtr)#$ ipsec spi 256 sha1 1234567890abcdef1234567890abcdef12345678 R4(config-rtr)#exit |
Verify OSPFv3 area authentication using the show ipv6 ospf command
| R4#show ipv6 ospf Routing Process “ospfv3 4” with ID 4.4.4.4 It is an area border router SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs LSA group pacing timer 240 secs Interface flood pacing timer 33 msecs Retransmission pacing timer 66 msecs Number of external LSA 0. Checksum Sum 0x000000 Number of areas in this router is 2. 2 normal 0 stub 0 nssa Reference bandwidth unit is 100 mbps Area BACKBONE(0) Number of interfaces in this area is 1 SHA-1 Authentication, SPI 256 SPF algorithm executed 3 times Number of LSA 8. Checksum Sum 0x0462B5 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 Area 4 Number of interfaces in this area is 1 SPF algorithm executed 2 times Number of LSA 5. Checksum Sum 0x016A26 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 |
By default, because IPv6 uses built-in IPsec functions, Cisco IOS software automatically creates IPsec policies for the configured authentication. The policy can be viewed using the show crypto ipsec sa [interface <name>] command on the router(s). Authentication Header (AH) is used. If you configure encryption, then Encapsulating Security Payload (ESP) will be used instead. Check the relevant SA states based on your configuration:
| R4#show crypto ipsec sa interface tunnel 0
interface: Tunnel0 IPsecv6 policy name: OSPFv3-4-256 protected vrf: (none) local crypto endpt.: FE80::A00:E, remote crypto endpt.: :: inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: |
Additionally, you can also view the configuration parameters for the applied policy using the show crypto ipsec policy command on the router. The policy name, by default, will be OSPFv3-<process ID>-<SPI>. For example, on R1, the applied policy name will be OSPFv3-4-256. This is validated and illustrated in the following output:
| R4#show crypto ipsec policy Crypto IPsec client security policy data Policy name: OSPFv3-4-256 |
Final Router Configurations
R1
|
R1#term len 0 Current configuration : 1245 bytes R1# |
R2
|
R2#term len 0 Current configuration : 847 bytes R2# |
R3
|
R3#term len 0 Current configuration : 1188 bytes R3# |
R4
|
R4#term len 0 Current configuration : 1225 bytes R4# |