IP Addressing and Subnetting, Including IPv6

With over 1,000,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we have come to know many of yo...

Author: J. D. Wegner

314 downloads 1871 Views 55MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

With over 1,000,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we have come to know many of you personally. By listening, we've learned what you like and dislike about typical computer books. The most requested item has been a web-based service that keeps you current on the topic of the book and related technologies. In response, we have created s o l u t i o n s @s y n .q r e s s . c o m, a service that includes the following features: 9A one-year warranty against content obsolescence that occurs as the result of vendor product upgrades. We will provide regular web updates for affected chapters. 9Monthly mailings that respond to customer FAQs and provide detailed explanations of the most difficult topics, written by content experts exclusively for s o l u t i o n s @ s y n .q r e s s . c o m. 9Regularly updated links to sites that as our editors have determined offer valuable additional information on key topics. 9Access to "Ask the Author ''~ customer query forms that allow readers to post questions to be addressed by our authors and editors. Once you've purchased this book, browse to www. syngress,

c o m l s o lut ions.

To register,you will need to have the book handy to verifyyour purchase. Thank you for giving us the opportunity to serve you.

This Page Intentionally Left Blank

INCLUDING

S

X N G R E S S'

S y n g r e s s Media, Inc., the author(s), a n d any p e r s o n or firm involved in the writing, editing, or p r o d u c t i o n (collectively "Makers") of this book ("the Work") do not g u a r a n t e e or w a r r a n t the r e s u l t s to be obtained from the Work. T h e r e is no g u a r a n t e e of any kind, e x p r e s s e d or implied, regarding the Work or its contents. The Work is sold AS IS a n d WITHOUT WARRANTY. You m a y have other legal rights, which vary from state to state. In no event will M a k e r s be liable to you for damages, including any loss of profits, lost savings, or o t h e r incidental or c o n s e q u e n t i a l d a m a g e s arising out from the Work or its contents. B e c a u s e some s t a t e s do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation m a y not apply to you. You s h o u l d always u s e r e a s o n a b l e case, including b a c k u p a n d other appropriate precautions, w h e n working with c o m p u t e r s , networks, data, a n d files. Syngress Media@ a n d Syngress@ are registered t r a d e m a r k s of Syngress Media, Inc. "Career Advancement T h r o u g h Skill E n h a n c e m e n t TM" is a t r a d e m a r k of Syngress Media, Inc. B r a n d s and product n a m e s mentioned in this book are t r a d e m a r k s or service m a r k s of their respective companies. KEY 001 002 003 004 005 006 007 008 009 010

SERIAL NUMBER JF87NBH615 KFJB876AAZ LK1AN65498 FH766T1NA9 JF786B12BV NN7 FH419AS FF8AF73198 776FNGF67B 7683NG5T99 WE67822VMA

PUBLISHED BY S y n g r e s s Media, Inc. 800 H i n g h a m Street Rockland, MA 0 2 3 7 0 IP ADDRESSING AND SUBNETTING INCLUDING IPv6

Copyright 9 2000 by S y n g r e s s Media, Inc. All rights reserved. Printed in the United States of America. Except as p e r m i t t e d u n d e r the Copyright Act of 1976, no p a r t of this publication m a y be r e p r o d u c e d or distributed in a n y form or by a n y m e a n s , or stored in a d a t a b a s e or retrieval system, w i t h o u t the prior written p e r m i s s i o n of the publisher, with the exception t h a t the p r o g r a m listings m a y be entered, stored, a n d executed in a c o m p u t e r system, b u t they m a y not be r e p r o d u c e d for publication. Printed in the United S t a t e s of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-928994-01-6 Copy Editor: Adrienne Rebello Technical Editor: Mark Blanchet Indexer: Robert Saigh P r o d u c t Line Manager: Eva B a n a s z e k

Proofreader: J i m Melkonian Graphic Artists: Emily E a g a r a n d Vesna Williams Co-Publisher: Richard Kristof, Global Knowledge

We would like to acknowledge the following people for their kindness and support in making this book possible. Richard Kristof, D u n c a n Anderson, Jennifer Gould, Robert Woodruff, Kevin Murray, Dale Leatherwood, Shelley Everett, Laurie Hedrick, Rhonda Harmon, Lisa Lavallee, and Robert Sanregret of Global Knowledge, for their generous access to the IT industry's best courses, instructors and training facilities. Ralph Troupe and the team at Rt. 1 Solutions for their invaluable insight into the challenges of designing, deploying and supporting worldclass enterprise networks. Karen Cross, Kim Wylie, Harry Kirchner, J o h n Hays, Bill Richter, Michael Ruggiero, Kevin Votel, Brittin Clark, S a r a h Schaffer, Luke Kreinberg, Ellen Lafferty and Sarah MacLachlan of Publishers Group West for sharing their incredible marketing experience and expertise. Peter Hoenigsberg, Mary Ging, Caroline Hird, Simon Beale, J u l i a Oldknow, Kelly Burrows, J o n a t h a n Bunkell, Catherine Anderson, Peet Kruger, Pia Rasmussen, Denelise L'Ecluse, R o s a n n a Ramacciotti, Marek Lewinson, Marc Appels, Paul Chrystal, Femi Otesanya, and Tracey Alcock of Harcourt International for making certain t h a t our vision remains worldwide in scope.

From Global Knowledge At Global Knowledge we strive to s u p p o r t the multiplicity of learning styles required by our s t u d e n t s to achieve s u c c e s s as technical professionals. As the world's largest IT training company, Global Knowledge is uniquely positioned to offer these books. The expertise gained each year from providing instructor-led training to h u n d r e d s of t h o u s a n d s of s t u d e n t s worldwide h a s b e e n c a p t u r e d in book form to e n h a n c e your learning experience. We hope t h a t the quality of these books d e m o n s t r a t e s our c o m m i t m e n t to y o u r lifelong learning success. W h e t h e r you choose to learn t h r o u g h the written word, c o m p u t e r b a s e d training, Web delivery, or instructor-led training, Global Knowledge is committed to providing you with the very b e s t in each of these categories. For those of you who know Global Knowledge, or those of you who have j u s t found u s for the first time, our goal is to be y o u r lifelong competency partner. T h a n k y o u r for the opportunity to serve you. We look forward to serving y o u r needs again in the future. W a r m e s t regards,

Duncan Anderson President a n d Chief Executive Officer, Global Knowledge

vi

C a m e r o n B r a n d o n (MCSE, CNE, CNA, MCSE+Internet, A+, Network+) works as a Network E n g i n e e r / A d m i n i s t r a t o r in Portland, Oregon, a n d he specializes in Windows NT with BackOffice Integration. He helped in Intel Corporation's large-scale migration at its Oregon facility to Windows NT. C a m e r o n completed all of his certifications in five m o n t h s , d e m o n s t r a t i n g t h a t d e t e r m i n a t i o n a n d a strong sense of direction are the key to s u c c e s s in one's career.

Ryan Russell (CCNA, CCNP) h a s been employed in the networking field for more t h a n 10 years, including more t h a n five years working with Cisco equipment. He h a s held IT positions ranging from help d e s k s u p p o r t to network design, providing him with a good perspective on the challenges t h a t face a network manager. Recently, Ryan h a s b e e n doing mostly inform a t i o n security work involving network security a n d firewalls. He h a s completed his CCNP a n d holds a Bachelor of Science degree in C o m p u t e r Science. John Pherson (Microsoft MCSE a n d MCT, Novell Master CNE a n d Master CNI, a n d Certified Cisco S y s t e m s Instructor), h a s more t h a n 18 years of technical-consulting a n d t e c h n i c a l - m a n a g e m e n t experience in the c o m p u t er industry, specializing in networking technologies a n d operating systems. He also h a s a B.S. in B u s i n e s s Administration. J o h n h a s been a m e m b e r of several CompTIA (Computer I n d u s t r y Technology Association) committees responsible for the growth a n d direction of the A+ Certification. He is also a contributing a u t h o r to several books, including CCNA S t u d y Guide (Osborne/McGraw-Hill, 1998) a n d the MCSE: Networking Essentials S t u d y Guide (Osborne/McGraw-Hill, 1998). He is a m e m b e r of American Mensa, Ltd. J o h n is currently employed as a n Instructional C o n s u l t a n t at Global Knowledge in Dallas, TX., a n d he also provides i n d e p e n d e n t network consulting services.

vii

J.D. Wegner is a founder a n d director of The E m p o w e r m e n t Group, Inc. He h a s been working with c o m p u t e r s for over 30 years. The last twelve of those, he h a s be e n involved with the design, installation a n d s u p p o r t of d a t a networks. As a n i n s t r u c t o r a n d Course Director for Global Knowledge, he h a s p r e s e n t e d topics ranging from Internetworking with TCP/IP to Web Security to IP Address M a n a g e m e n t to t h o u s a n d s of IT professionals in the U.S. a n d abroad. His clients include m a n y of the Fo rtu n e 500 as well as several g o v e r n m e n t agencies. He lives in Hickory, North Carolina with his wife, Laurie, a n d their two children, David an d Sarah. Robert Rockell h a s been at Sprint I n t e r n e t Services for the p a s t 3 years. He c u r r e n t l y work s in the Operations Engineering d e p a r t m e n t , where he a n d his group are responsible for top-level technical escalation of all I n t e r n e t operation problems. In addition, Rob r u n s an IPv6 n e t w o r k with over 50 c u s t o m e r s attached. If interested, you can join the 6Bone t h r o u g h Rob's n e t w o r k by writing hi m at [email protected].

Technical Editor Marc Blanchet ([email protected]) is a n etwo rk engineer working at Viagenie Inc. as a c o n s u l t a n t in n e t w o r k security, n e t w o r k architect u r e s a n d electronic commerce for companies, organisations a n d governm e n t s . He h a s be e n involved in TCP/IP since 1983. Marc wrote a book in F r e n c h entitled TCP/IP Simpli.fii p u b l i s h e d at Iditions Logiques. At the I n t e r n e t Engineering T a s k Force (IETF), he h a s b een involved in m a n y working groups, especially in IPv6 group, for which he wrote a few stand a rd d o c u m e n t s . One of those is a b o u t IPv6 a d d r e s s a s s i g n m e n t s . Marc is also a n architect of the IPv6 CA*Net n etw o rk a n d the 6tap IPv6 exchange. He is a regular s p e a k e r at conferences an d gives courses a b o u t TCP/IP, Security, IPv6 a n d other related subjects.

viii

contents

PREFACE m y th is Rook is Necessary Content of this Book Editor'sj Acknowledgments CHAPTER ' IP Addr

Ch

xix xx xxi Mi

1 2 3 5 6

7 8

Add

;o 10 10 12

Exa

13

PUrpOSj

13

The Ba Wh Cor

19

19 21 nn

1.5

Decir-,,jl F r v ii:-nlmt Mask Values Crea!.!i< T l a r k 4 for Various Networking Problems Add InleracE ion Res ec2 Addresses Detenninirg tlw f i a n ~ of c Acfdrrsses within Subnets

23 26 27

30 31

x

Contents Determining S u b n e t Addresses Given a Single Address and Mask 32 Interpreting Masks 34 Reserved Addresses 35 Summary 36 FAQs 37

CHAPTER 2 Creating an Addressing Plan for Fixed-Length Mask Networks Introduction Determine Addressing Requirements Review Your Internetwork Design How Many S u b n e t s Do You Need? How Many IP Addresses Are Needed in Each S u b n e t ? What a b o u t Growth? Choose the Proper Mask Consult the Tables Use U n n u m b e r e d Interfaces Ask for a Bigger Block of Addresses Router Tricks Use S u b n e t Zero Obtain IP Addresses From Your Organization's Network Manager From Your ISP From Your Internet Registry Calculate Ranges of IP Addresses for Each S u b n e t Doing It the Hard Way Worksheets S u b n e t Calculators Allocate Addresses to Devices Assigning S u b n e t s Assigning Device Addresses Sequential Allocation Reserved Addresses Grow Towards the Middle D o c u m e n t Your Work Keeping Track of What You've Done Paper

39 40 40 40 41 42 44 45 45 46 47 47 49 50 51 51 52 53 53 55 57 58 58 60 61 61 61 62 62 62

Contents Spreadsheets Databases In Any Case Summary FAQs Exercises S u b n e t t i n g Tables Class A S u b n e t t i n g Table Class B S u b n e t t i n g Table Class C S u b n e t t i n g Table S u b n e t Assignment Worksheet

CHAPTER 3 Private Addressing and Subnetting Large Networks Introduction Strategies to Conserve Addresses CIDR VLSM Private Addresses Addressing Economics An Appeal Public vs Private Address Spaces Can I Pick My Own? RFC 1 9 1 8 ~ P r i v a t e Network Addresses The Three-Address Blocks Considerations Which to Use When Strategy for S u b n e t t i n g a Class A Private Network The Network The Strategy Address A s s i g n m e n t The H e a d q u a r t e r s LANs The WAN Links from H e a d q u a r t e r s to the Distribution Centers The Distribution Center LANs The WAN Links from the DC to the Stores The Store LANs

62 63 63 64 64 65 67 67 73 77 79

87 88 88 89 90 90 91 94 94 95 96 97 98 100 i01 102 103 105 105 105 106 107 107

xi

xii

Contents Results Summary FAQs Exercises

CHAPTER 4 Network Address Translation Introduction Hiding Behind the Router/Firewall What Is NAT?. How Does NAT Work? Network Address Translation (Static) How Does Static NAT Work? Double NAT Problems with Static NAT Configuration Examples Windows NT 2000 Cisco IOS Linux IP Masquerade Network Address Translation (Dynamic) How Does Dynamic NAT Work? Problems with Dynamic NAT Configuration Examples Cisco IOS Port Address Translation (PAT) How Does PAT Work? Problems with PAT Configuration Examples Windows NT 2000 Linux IP Masquerade Cisco IOS What Are the Advantages? What Are the Performance Issues? Proxies and Firewall Capabilities Packet Filters Proxies Stateful Packet Filters Stateful Packet Filter with Rewrite Why a Proxy Server Is Really Not a NAT

108 110 110 111

113 114 114 119 120 120 122 123 126 130 131 135 137 139 141 142 144 144 145 147 152 154 154 156 157 161 162 165 166 168 173 173 174

Contents Shortcomings of SPF Summary FAQs References & Resources RFCs IP Masquerade/Linux Cisco Windows NAT Whitepapers Firewalls

CHAPTER 5 Variable-Length Subnet Masking Introduction Why Are Variable-Length Masks Necessary?. Right-sizing Your Subnets More Addresses or More Useful Addresses? The Importance of Proper Planning Creating and Managing Variable-Length Subnets Analyze Subnet Needs Enumerate Each Subnet and Number of Required Nodes Determine Which Mask to Use in Each Subnet Allocate Addresses Based on Need For Each Subnet Routing Protocols and VI~M Class C VI~M Problem Completing the Class C Problem Template-based Address Assignment Su m m a ry FAQs

CHAPTER 6 Routing Issues Introduction Classless Interdomain Routing From Millions to Th o u sa nds of Networks ISP Address Assignment Using CIDR Addresses Inside Your Network Contiguous Subnets

178 180 183 187 187 187 188 188 189 189

191 192 192 194 196 198 198 199

199 200 201 206 206 210 214 218 220

223 224 225 231 233 235 236

xiii

xiv

Contents IGRP EIGRP EIGRP Concepts RIP- i R e q u i r e m e n t s C o m p a r i s o n with IGRP Routing Update Impact RIP-2 R e q u i r e m e n t s OSPF Configuring OSPF Routing Update Impact OSPF I m p l e m e n t a t i o n R e c o m m e n d a t i o n s BGP R e q u i r e m e n t s IBGP a n d EBGP R e q u i r e m e n t s Loopback Interfaces Summary FAQs

CHAPTER 7 Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives Introduction The Role of Dynamic Address A s s i g n m e n t A Brief History Address M a n a g e m e n t with These Tools The BOOTP Packet Field Descriptions and C o m m e n t s OP HTYPE HLEN HOPS XID SECS FLAG CIADDR YIADDR SIADDR GIADDR CHADDR SNAME

237 242 243 244 247 248 250 251 255 258 265 267 272 275 276 278

281 282 283 284 286 288 288 289 289 290 290 290 291 291 291 291 292 292 292 293

Contents

FILE VEND/OPTION BOOTP Process Details Client BOOTREQUEST Server BOOTREPLY Field Values in the BOOTREPLY p a c k e t The BOOTP Server D a t a b a s e How Does DHCP Work? DHCP Process Overview DHCP Process Details DHCP-Specific Options Interoperation between DHCP a n d BOOTP DHCP Address Scopes Comparing BOOTP a n d DHCP How BOOTP Works BOOTP Process Overview DHCP / BOOTP Options BOOTP Options from RFC 1497 IP Layer P a r a m e t e r s per Host IP Layer P a r a m e t e r s per Interface Link Layer P a r a m e t e r s per Interface TCP P a r a m e t e r s Application a n d Service P a r a m e t e r s BOOTP, DHCP, a n d Routed Networks The BOOTP Relay Agent The Role of the GIADDR Other Fields Involved HOPS CHADDR, YIADDR, HTYPE, HLEN, FLAG SECS UDP Port N u m b e r IP TTL Field ALL Other Fields BOOTP I m p l e m e n t a t i o n Checklist DHCP I m p l e m e n t a t i o n Checklist Summary FAQs

293 293 294 294 295 296 297 298 299 301 304 309 310 311 312 312 313 314 318 320 322 323 323 328 329 330 331 331 332 332 332 333 333 333 334 335 336

xv

xvi

Contents CHAPTER 8 Multicast Addressing What Is Multicast? Mapping IP Multicast to the Link Layer Joining the Group IGMP Multicast Routing Protocols Mbone Multicast Addresses Transient and Permanent Addresses Generic Assignments IANA Assignments Scope of Multicast Addresses Using TTL Administrative Scopes IP Stacks and Multicast Why Multicast? Efficiency of Bandwidth Usage and Scaling Discovering Efficient Channel Industry Summary FAQ References

CHAPTER 9 IPv6 Addressing Introduction IPv6 Addressing Basics IPv6 Addressing Scheme Characteristics Version Traffic Class Flow Label Payload Length Next Header Hop-by-Hop Options Header Destination Options Header I Routing Header Fragment Header Authentication Header Encrypted Security Payload Header

339 340 341 341 342 342 343 344 344 344 345 346 346 347 348 348 349 349 35O 35O 351 351

353 354 354 357 358 358 358 359 360 360 361 361 362 362 363

Contents

Destination Options Header II Hop Limit Source Address Destination Address More Bits! A More Flexible Hierarchical Organization of Addresses FP: Format Prefix TLA ID RES NLA ID SLA ID Interface ID Minimizing the Size of Routing Tables Global Addresses for the Internet and Local Addresses for Intranet IPv6 Benefits Increased IP Address Size Increased Addressing Hierarchy Support Simplified Host Addressing Simpler Autoconfiguration of Addresses Improved Scalability of Multicast Routing The Anycast Address The Need for Further Development The Multihoming Problem The 6Bone Su m m a ry FAQ CHAPTER 10 The IPv6 Header Introduction Expanded Addressing Simplified Header Improved Support for Extension and Option Flow and Flow Labeling Authentication and Privacy IPv6 Header IPv4 Header

363 364 364 364

365

370 372 373 373 374 374 374 376 381

387

388 389 394 396 398 403

406

406 409 410 411

413 414 415 417 417 418 419 420 422

xvii

xviii

Contents

Extension Headers Hop-by-Hop Option Header Routing Header Fragment Header Authentication Header Encapsulating Security Payload Destination Options Header Upper-Layer Protocol Issues Summary FAQs References

APPENDIX A Address Assignment Introduction Registries Provider-Based Assignments Cost of an IP Address How to Find an IPv4 Address Delegation How to Find an IPv6 Address Delegation Internet Governance Summary

INDEX

424 430 433

438 442 445

446 449

449 450

451

453 454 454 455 456 456 458 458 459

461

xx

Preface

Why this Book is Necessary I n t e r n e t Protocol (IP), the n e t w o r k protocol of the Internet, is s e e n as the protocol for the convergence of t e l e p h o n y a n d data. A d d r e s s i n g is a n i m p o r t a n t p a r t of n e t w o r k engineering, either in the t e l e p h o n y world or the I n t e r n e t world. One of the r i c h e s t p a r t s of IP is its a d d r e s s i n g . A d d r e s s i n g h a s b e e n so well designed in IP t h a t the I n t e r n e t h a s grown from t h r e e c o m p u t e r s to h u n d r e d s of millions of c o m p u t e r s , u s e d in d a y - t o - d a y w o r k a n d fun, while r e m a i n i n g efficient. As y o u will see, t h i s b o o k d i s c u s s e s two v e r s i o n s of IP: IPv4 a n d IPv6. The c u r r e n t I n t e r n e t is IPv4 ( I n t e r n e t Protocol v e r s i o n 4), a n d t h e n e w I n t e r n e t b e g i n n i n g to be deployed is b a s e d on IPv6 ( I n t e r n e t Protocol v e r s i o n 6). This b o o k d e s c r i b e s a d d r e s s i n g for both versions. A l t h o u g h m a n y b o o k s cover TCP/IP, no b o o k really goes into as m u c h d e p t h w i t h all i s s u e s related to IP a d d r e s s i n g as this one does. The i n t e n d e d a u d i e n c e of this c o m p r e h e n s i v e , i n t e r m e d i a t e level b o o k is s o m e o n e with a t e c h n i c a l or m a n a g e m e n t b a c k g r o u n d , w h o u n d e r s t a n d s the b a s i c s of T C P / I P a n d w a n t s a complete h a n d b o o k related to a d d r e s s i n g . A d d r e s s i n g is so i m p o r t a n t in a n y n e t w o r k i n g world t h a t a misu n d e r s t a n d i n g c a n have i m p o r t a n t c o n s e q u e n c e s . For example, a poorly designed a d d r e s s i n g a r c h i t e c t u r e for a large n e t w o r k c a n c a u s e the organization to r e n u m b e r the whole network, w h i c h c a n involve a long d o w n - t i m e as well as instability d u r i n g the r e n u m b e r ing p h a s e . This c a n cost a lot of money. But, at the s a m e time, a good a d d r e s s i n g a r c h i t e c t u r e costs no money, j u s t good p l a n n i n g a n d good u n d e r s t a n d i n g of the issues. This is one r e a s o n w h y this b o o k exists.

Preface

Content of this Book C h a p t e r 1, "Addressing a n d S u b n e t t i n g Basics," d i s c u s s e s the IPv4 a d d r e s s i n g architecture, which is the basis of this book. Classes a n d s u b n e t t i n g are key in the IPv4 design. Once you u n d e r s t a n d IP a d d r e s s e s , C h a p t e r 2, "Creating a n Addressing Plan for FixedLength Ma sk Networks," tells you how to m a k e an a d d r e s s plan for y o u r network. If y o u r n e t w o r k is not connected to the Internet, or if you u s e a n y kind of n e t w o r k a d d r e s s t r a n s l a t i o n (NAT) device, you are going to u s e the private a d d r e s s e s reserved for t h a t purpose. Private a d d r e s s e s are detailed in C h a p t e r 3, "Private Addressing a n d S u b n e t t i n g Large Networks." If you us e NAT, or simply w a n t to k n o w a b o u t it, t h e n you s h o u l d read C h a p t e r 4, "Network Address Translation," which is a comprehensive c h a p t e r on this technology. Although m o s t n e t w o r k s can have a good a d d r e s s plan u s i n g s t a n d a r d s u b n e t t i n g techniques, some n e t w o r k s need variablelength s u b n e t m a s k s (VLSM), mostly b e c a u s e they are not b a l a n c e d in the ratio of n u m b e r of ne t w or ks to n u m b e r of hosts. VLSM is covered in C h a p t e r 5, "Variable-Length S u b n e t Masking." IP a d d r e s s i n g is the basis of routing; C h a p t e r 6, "Routing Issues," deals with all the details of routing as they relate to addressing. IP requires more configuration in c o m p a r i s o n with other LAN protocols. These i s s u e s have been resolved by BOOTP a n d DHCP, whi c h are covered in C h a p t e r 7, "Automatic A s s i g n m e n t of IP Addresses with BOOTP a n d DCHP." M u l t i c a s t provides a w a y to have o n e - t o - m a n y or m a n y - t o m a n y p a c k e t s by giving the g r o u p of d e s t i n a t i o n h o s t s a specific a n d special IP a d d r e s s in the class D range. This is a great a n d innovative w a y to u s e IP a d d r e s s i n g , a n d it is covered in C h a p t e r 8, "Multicast Addressing." Since the growth rate of the I n t e r n e t is p h e n o m e n a l , engineers developed a new version of the IP protocol, called IPv6, w h ich brings new s c h e m e s of addressing. With addressing, IPv6 enables

xxi

xxii

Preface

autoconfiguration, renumbering, efficient routing on the backbone, etc. Chapters 9 and 10, "IPv6 Addressing" and '~I'he IPv6 Header," d i s c u s s IPv6 and its h e a d e r and addressing s t r u c t u r e in depth. The entire book covers the technology of IP addressing. In addition, you need to get a range of a d d r e s s e s for your network. The Annex d i s c u s s e s a d d r e s s a s s i g n m e n t s and registration. This book d e m o n s t r a t e s t h a t IP addressing is a very i m p o r t a n t feature of IP, which h a s evolved over time, as the Internet and other organizations needed change. The new version of IP, IPv6, continues to use addressing as an i m p o r t a n t tool for network engineering.

Editor's Acknowledgments I would like to t h a n k Eva B a n a s z e k and Matt Pedersen from Syngress Media for their support; my colleagues of Viag6nie (Florent Parent, R6gis Desmeules, and Annie Morin)with w h o m I always have good discussions on technical issues t h a t enrich my own experience; H61ene Richard, our technical writer, who reviewed my own chapters, and finally my wife, for all her patience. I hope you will enjoy this comprehensive book on IP addressing. ~Marc Blanchet

2

Chapter 1 * Addressing and Subnetting Basics

IP Address Basics IPv4 a d d r e s s i n g is u s e d to a s s i g n a logical a d d r e s s to a p h y s i c a l device. T h a t s o u n d s like a lot to t h i n k a b o u t , b u t a c t u a l l y it is very simple. TWo devices in a n E t h e r n e t n e t w o r k c a n e x c h a n g e i n f o r m a t i o n b e c a u s e e a c h of t h e m h a s a n e t w o r k i n t e r f a c e c a r d w i t h a u n i q u e E t h e r n e t a d d r e s s t h a t exists in t h e p h y s i c a l E t h e r n e t n e t work. If device A w a n t s to s e n d i n f o r m a t i o n to device B, device A will n e e d to k n o w t h e E t h e r n e t a d d r e s s of device B. Protocols like Microsoft NetBIOS r e q u i r e t h a t e a c h device b r o a d c a s t its a d d r e s s so t h a t t h e o t h e r devices m a y l e a r n it. IP u s e s a p r o c e s s called t h e A d d r e s s R e s o l u t i o n Protocol. In e i t h e r case, t h e a d d r e s s e s a r e h a r d w a r e a d d r e s s e s a n d c a n be u s e d on t h e local p h y s i c a l n e t w o r k .

Addressing and Subnetting Basics

9Chapter 1

W h a t h a p p e n s if device B, on a n E t h e r n e t network, w a n t s to s e n d i n f o r m a t i o n to device C on a t o k e n - r i n g n e t w o r k ? T h e y c a n n o t c o m m u n i c a t e directly b e c a u s e t h e y are on different p h y s i c a l networks. To solve the a d d r e s s i n g p r o b l e m s of b o t h device A a n d B, we u s e a h i g h e r layer protocol s u c h as IPv4. IPv4 allows u s to a s s i g n a logical a d d r e s s to a p h y s i c a l device. No m a t t e r w h a t c o m m u n i c a t i o n m e t h o d is in use, we c a n identify a device by a u n i q u e logical a d d r e s s t h a t c a n be t r a n s l a t e d to a p h y s i c a l a d d r e s s for a c t u a l i n f o r m a t i o n transfer.

Classful Addressing-Structure and Size of Each Type The d e s i g n e r s of IPv4 faced a n a d d r e s s i n g dilemma. In t h e early d a y s of I n t e r n e t development, n e t w o r k s were small a n d n e t w o r k i n g devices were big. A n o t h e r i s s u e w a s the future. In the early 1970s, the e n g i n e e r s c r e a t i n g the I n t e r n e t were n o t a w a r e of t h e coming c h a n g e s in c o m p u t e r s a n d c o m m u n i c a t i o n s . The i n v e n t i o n of local a r e a n e t w o r k i n g a n d p e r s o n a l c o m p u t e r s w a s to have a m o m e n t o u s i m p a c t on f u t u r e n e t w o r k s . Developers u n d e r s t o o d t h e i r c u r r e n t e n v i r o n m e n t a n d c r e a t e d a logical a d d r e s s i n g s t r a t e g y b a s e d on t h e i r u n d e r s t a n d i n g of n e t w o r k s at the time. T h e y k n e w t h e y n e e d e d logical a d d r e s s i n g a n d d e t e r m i n e d t h a t a n a d d r e s s c o n t a i n i n g 32 bits w a s sufficient for t h e i r needs. As a m a t t e r of fact, a 32-bit a d d r e s s is large e n o u g h to provide 232 or 4 , 2 9 4 , 9 6 7 , 2 9 6 individual a d d r e s s e s . Since all n e t w o r k s were n o t going to be the s a m e size, the a d d r e s s e s n e e d e d to be g r o u p e d t o g e t h e r for a d m i n i s t r a t i v e p u r p o s e s . S o m e g r o u p s n e e d e d to be large, s o m e of m o d e r a t e size, a n d s o m e small. T h e s e a d m i n i s t r a t i v e g r o u p i n g s were called a d d r e s s classes.

3

4

Chapter 1

9Addressing and Subnetting Basics

IPv4 a d d r e s s e s are e x p r e s s e d in dotted decimal notation. For example, a 32-bit a d d r e s s m a y look like t h i s in binary:

011111101000100000000001 O0101111 To m a k e it easier to read, we t a k e the 32-bit a d d r e s s a n d g r o u p it in blocks of eight bits like this:

01111110 10001000 00000001 00101111


9Chapter 1

Finally, we c o n v e r t e a c h e i g h t - b i t b l o c k to d e c i m a l a n d s e p a r a t e t h e d e c i m a l v a l u e s w i t h p e r i o d s or "dots." T h e c o n v e r t e d IPv4 a d d r e s s , e x p r e s s e d a s a d o t t e d d e c i m a l a d d r e s s , is" 126.136.1.47

It is c e r t a i n l y e a s i e r to r e m e m b e r t h a t y o u r IP a d d r e s s is 1 2 6 . 1 3 6 . 1 . 4 7 i n s t e a d of r e m e m b e r i n g a s t r i n g of b i t s s u c h a s 01111110100010000000000100101111.

W h a t Is a N e t w o r k ? W h e n t a l k i n g a b o u t IP a d d r e s s i n g , it is i m p o r t a n t to u n d e r s t a n d w h a t t h e w o r d "network" m e a n s . A n e t w o r k is a g r o u p of c o m p u t i n g devices c o n n e c t e d t o g e t h e r b y s o m e t e l e c o m m u n i c a t i o n s m e d i u m . It m a y be a s s m a l l a s a w o r k g r o u p in t h e a c c o u n t i n g d e p a r t m e n t or a s large a s all of t h e c o m p u t e r s in a large c o m p a n y , s u c h a s G e n e r a l Motors. F r o m a n a d d r e s s i n g perspective, all c o m p u t e r s in a n e t w o r k c o m e u n d e r t h e a d m i n i s t r a t i o n of t h e s a m e o r g a n i z a t i o n . If y o u w a n t to s e n d i n f o r m a t i o n to a c o m p u t e r , y o u c a n identify t h e c o m p u t e r b y its IP a d d r e s s a n d k n o w t h a t t h e IP a d d r e s s is a s s i g n e d to a c o m p a n y . T h e IP n e t w o r k c a n locate t h e c o m p u t i n g r e s o u r c e s of t h e c o m p a n y b y l o c a t i n g t h e n e t w o r k . T h e n e t w o r k is identified b y a network number. N e t w o r k n u m b e r s a r e a c t u a l l y IP a d d r e s s e s t h a t identify all of t h e IP r e s o u r c e s w i t h i n a n o r g a n i z a t i o n . As y o u c a n see in F i g u r e 1.1, s o m e o r g a n i z a t i o n s will r e q u i r e very large n e t w o r k s w i t h lots of a d d r e s s e s . O t h e r n e t w o r k s will be smaller, a n d still o t h e r n e t w o r k s will n e e d a limited n u m b e r of a d d r e s s e s . T h e d e s i g n of t h e IPv4 a d d r e s s s p a c e t o o k t h i s factor into a c c o u n t .

6

Chapter 1

9Addressing and

Subnetting Basics

Figure 1.1 Networks and the Internet.

Class A The l a r g e s t g r o u p i n g of a d d r e s s e s is t h e class A group. Class A netw o r k a d d r e s s e s c a n be identified by a u n i q u e bit p a t t e r n in t h e 32-bit address.

Onnnnnnn 11111111 11111111 11111111 I n t h e p r e c e d i n g group, y o u will see a 32-bit r e p r e s e n t a t i o n of a class A a d d r e s s . The first 8 bits of a class A a d d r e s s indicate t h e n e t w o r k n u m b e r . The r e m a i n i n g 24 bits c a n be modified by the a d m i n i s t r a t i v e u s e r of t h e n e t w o r k a d d r e s s to r e p r e s e n t a d d r e s s e s f o u n d on their "local" devices. In t h e r e p r e s e n t a t i o n above, t h e "n's" i n d i c a t e the location of t h e n e t w o r k n u m b e r bits in t h e a d d r e s s . The "l's" r e p r e s e n t t h e locally a d m i n i s t e r e d portion of t h e a d d r e s s . As y o u c a n see, t h e first bit of a class A n e t w o r k a d d r e s s is always a zero. With t h e first bit of class A a d d r e s s always zero, t h e class A netw o r k n u m b e r s begin at 1 a n d e n d at 127. With a 2 4 - b i t locally a d m i n i s t e r e d a d d r e s s space, t h e total n u m b e r of a d d r e s s e s in a


9Chapter 1

c l a s s A n e t w o r k is 224 or 1 6 , 7 7 7 , 2 1 6 . E a c h n e t w o r k a d m i n i s t r a t o r w h o receives a c l a s s A n e t w o r k c a n s u p p o r t 16 million h o s t s . B u t r e m e m b e r , t h e r e are only 127 p o s s i b l e c l a s s A a d d r e s s e s in t h e design, so only 127 large n e t w o r k s are possible. Here is a list of c l a s s A n e t w o r k n u m b e r s : 10.0.0.0 44.0.0.0 101.0.0.0 127.0.0.0 Notice t h a t t h e s e n e t w o r k n u m b e r s r a n g e b e t w e e n 1.0.0.0 a n d 127.0.0.0, t h e m i n i m u m a n d m a x i m u m n u m b e r s .

Class B T h e n e x t g r o u p i n g of a d d r e s s e s is t h e c l a s s B g r o u p . C l a s s B netw o r k a d d r e s s e s c a n be identified by a u n i q u e bit p a t t e r n in t h e 32bit a d d r e s s . l O n n n n n n n n n n n n n n 11111111 11111111

In t h e p r e c e d i n g e x a m p l e , y o u will see a 3 2 - b i t r e p r e s e n t a t i o n of a c l a s s B a d d r e s s . T h e first 16 bits of a c l a s s B a d d r e s s i n d i c a t e t h e n e t w o r k n u m b e r . The r e m a i n i n g 16 bits c a n be modified by t h e a d m i n i s t r a t i v e u s e r of t h e n e t w o r k a d d r e s s to r e p r e s e n t a d d r e s s e s f o u n d on t h e i r "local" h o s t s . A c l a s s B a d d r e s s is identified b y t h e 10 in t h e first 2 bits. With t h e first 2 bits of c l a s s B a d d r e s s c o n t a i n i n g 10, t h e c l a s s B n e t w o r k n u m b e r s b e g i n a t 128 a n d e n d a t 191. T h e s e c o n d d o t t e d d e c i m a l in a c l a s s B a d d r e s s is also p a r t of t h e n e t w o r k n u m b e r . A 16-bit locally a d m i n i s t e r e d a d d r e s s s p a c e allows e a c h c l a s s B netw o r k to c o n t a i n 2~6 or 6 5 , 5 3 6 a d d r e s s e s . T h e n u m b e r of c l a s s B n e t w o r k s available for a d m i n i s t r a t i o n is 16,384. Here is a list of c l a s s B n e t w o r k n u m b e r s : 137.55.0.0 129.33.0.0

7

8

Chapter 1 *


190.254.0.0 150.0.0.0 168.30.0.0 Notice t h a t t h e s e n e t w o r k n u m b e r s r a n g e b e t w e e n 128.0.0.0 a n d 1 9 1 . 2 5 5 . 0 . 0 , t h e m i n i m u m a n d m a x i m u m n u m b e r s , respectively. And r e m e m b e r t h a t the first two dotted decimal n u m b e r s are i n c l u d e d in t h e n e t w o r k n u m b e r since t h e n e t w o r k n u m b e r in a class B a d d r e s s is 16 bits long.

Class C The n e x t g r o u p i n g of a d d r e s s e s is t h e class C group. Class C netw o r k a d d r e s s e s c a n be identified by a u n i q u e bit p a t t e r n in t h e 32-bit address. 1 1 0 n n n n n n n n n n n n n n n n n n n n n 11111111

In t h e p r e c e d i n g example, y o u will see a 3 2 - b i t r e p r e s e n t a t i o n of a class C a d d r e s s . The first 24 bits of a class C a d d r e s s indicate t h e n e t w o r k n u m b e r . The r e m a i n i n g 8 bits c a n be modified by t h e a d m i n i s t r a t i v e u s e r of the n e t w o r k a d d r e s s to r e p r e s e n t a d d r e s s e s f o u n d on t h e i r "local" h o s t s . A class C a d d r e s s is identified by t h e 110 in t h e first 3 bits. With t h e first 3 bits of class C a d d r e s s c o n t a i n i n g 110, t h e class C n e t w o r k n u m b e r s begin at 192 a n d e n d at 223. The s e c o n d a n d t h i r d d o t t e d d e c i m a l s in a class C a d d r e s s are also p a r t of t h e netw o r k n u m b e r . An 8-bit locally a d m i n i s t e r e d a d d r e s s s p a c e allows e a c h class C n e t w o r k to c o n t a i n 28 or 256 a d d r e s s e s . The n u m b e r of class C n e t w o r k s available for a d m i n i s t r a t i o n is 2 , 0 9 7 , 1 5 2 . Here is a list of class C n e t w o r k n u m b e r s : 204.238.7.0 192.153.186.0 199.0.44.0 191.0.0.0 222.222.31.0

Addressing and Subnetting Basics 9Chapter 1

Notice t h a t t h e s e n e t w o r k n u m b e r s r a n g e b e t w e e n 1 9 2 . 0 . 0 . 0 a n d

223.255.255.0, t h e m i n i m u m a n d m a x i m u m n u m b e r s , respectively. A n d r e m e m b e r t h a t t h e first t h r e e d o t t e d d e c i m a l n u m b e r s are i n c l u d e d in t h e n e t w o r k n u m b e r s i n c e t h e n e t w o r k n u m b e r in a c l a s s C a d d r e s s is 24 bits long. To s u m m a r i z e , e a c h of t h e t h r e e IP a d d r e s s c l a s s e s h a s t h e c h a r a c t e r i s t i c s s h o w n in Table 1.1.

Table 1.1 Address Class Characteristics

Class

Network Bits

Host Bits

Total Networks

Total Addresses

A B C

8 16 24

24 16 8

127 16,384 2,097,152

16,777,216 65,536 256

9

10

Chapter1 Addressing and Subnetting Basics 9

Add, ress Assignments

One t a s k of a d d r e s s m a n a g e m e n t is a d d r e s s a s s i g n m e n t . As y o u begin t h e p r o c e s s of a d d r e s s allocation, y o u m u s t u n d e r s t a n d h o w the a d d r e s s e s are u s e d in the network. S o m e devices will be a s s i g n e d a single a d d r e s s for a single interface. O t h e r devices will have multiple interfaces, e a c h requiring a single a d d r e s s . Still o t h e r devices will have multiple interfaces a n d s o m e of the interfaces will have multiple a d d r e s s e s .

Single Address per Interface A device c o n n e c t e d to a n e t w o r k m a y have one or m a n y n e t w o r k i n g i n t e r f a c e s t h a t require a n IP a d d r e s s . A w o r d p r o c e s s i n g w o r k s t a t i o n in y o u r n e t w o r k h a s a single E t h e r n e t interface (see Figure 1.2). It n e e d s only one IP a d d r e s s . Figure 1.2 Single address per interface.

Multihomed Devices A r o u t e r is a n e t w o r k i n g device u s e d to t r a n s f e r IP d a t a g r a m s from one p h y s i c a l n e t w o r k to another. The r o u t e r by its very n a t u r e a n d f u n c t i o n will have m o r e t h a n one interface a n d will require a n IP a d d r e s s for e a c h interface. Devices with m o r e t h a n one interface are called multihomed, a n d the p r o c e s s is called multihoming.

Addressing and Subnetting Basics * Chapter 1

In Figure 1.3, t h e r o u t e r h a s two interfaces. One interface is a t t a c h e d to t h e t o k e n - r i n g n e t w o r k a n d t h e o t h e r interface is a t t a c h e d to t h e E t h e r n e t network. This is a m u l t i h o m e d device. Figure

1.3 Multihomed device.

A s s i g n i n g IP a d d r e s s e s to devices is a simple p r o c e s s (see Figure 1.4). A n e w device is installed in the n e t w o r k a n d t h e a d d r e s s a d m i n i s t r a t o r selects a n u n u s e d a d d r e s s of t h e g r o u p of available a d d r e s s e s . The i n f o r m a t i o n is provided to t h e u s e r of t h e device a n d t h e device is configured. The a d d r e s s given to t h e u s e r m u s t be from t h e s a m e a d d r e s s g r o u p as all o t h e r devices on t h e s a m e n e t w o r k or t h e IP d a t a t r a n s m i s s i o n r u l e s will n o t work. The IP d a t a t r a n s m i s sion r u l e s will be d i s c u s s e d in a later chapter. The a c t u a l c o n f i g u r a t i o n p r o c e s s for IP a d d r e s s e s varies from o p e r a t i n g s y s t e m to o p e r a t i n g s y s t e m a n d from device to device, so c o n s u l t y o u r s y s t e m d o c u m e n t a t i o n for i n s t r u c t i o n s . An i m p o r t a n t final step r e q u i r e s t h a t a careful n o t a t i o n a b o u t a s s i g n m e n t of t h e a d d r e s s be m a d e in t h e a d d r e s s a d m i n i s t r a t o r s ' d o c u m e n t a t i o n so t h a t t h e a d d r e s s is n o t a s s i g n e d to a n o t h e r device.

11

12

Chapter 1


Figure 1.4 IP address configuration.

Multinetting--Multiple Addresses per Interface It is a l s o p o s s i b l e t h a t c e r t a i n d e v i c e s will h a v e i n t e r f a c e s w i t h m o r e t h a n o n e IP a d d r e s s a s s i g n e d . H e r e is a n e x a m p l e : A n e w I n t e r n e t site is u n d e r d e v e l o p m e n t for a s m a l l c o r p o r a t i o n . T h e n e t w o r k a d m i n i s t r a t o r k n o w s t h a t t h e site will g r o w in t h e f u t u r e , b u t t o d a y t h e r e is n o n e e d for a c o m p l e x n e t w o r k . A s e r v e r is i n s t a l l e d t h a t will b e u s e d a s a W e b server, ftp server, m a i l server, a n d t h e c o r p o r a t i o n ' s D N S server. Later, w h e n t h e u s e of t h e n e t w o r k s e r v i c e s g r o w s , n e w s e r v e r s will b e u s e d for e a c h of t h e f u n c tions. W h e n t h e t i m e c o m e s to a d d r e s s t h e c u r r e n t server, t h e a d m i n i s t r a t o r h a s a c h o i c e . A s i n g l e IP a d d r e s s c a n b e u s e d o n t h e s e r v e r a n d later, w h e n t h e n e w s e r v e r s a r e n e e d e d , n e w IP a d d r e s s e s c a n b e a s s i g n e d to t h e m . A n o t h e r w a y of a s s i g n i n g a d d r e s s e s c a n b e u s e d . T h e a d m i n i s t r a t o r c a n a s s i g n f o u r IP a d d r e s s e s to t h e server. E a c h IP a d d r e s s will m a t c h t h e IP a d d r e s s to b e u s e d in t h e f u t u r e o n n e w s e r v e r s . T h e a d m i n i s t r a t o r n o w k n o w s w h a t a d d r e s s e s will


9Chapter 1

be u s e d a n d c a n c r e a t e DNS e n t r i e s for t h e n e w devices w i t h t h e c o r r e c t a d d r e s s e s . T h e p r o c e s s of p r o v i d i n g m o r e t h a n one IP a d d r e s s on a n i n t e r f a c e is often called multinetting or secondary

addressing.

Examples A s s i g n i n g s e c o n d a r y a d d r e s s e s on Cisco r o u t e r s is d o n e u s i n g lOS c o n f i g u r a t i o n c o m m a n d s . Here is a n e x a m p l e of h o w to a s s i g n a prim a r y IP a d d r e s s a n d two s e c o n d a r y IP a d d r e s s e s to a n E t h e r n e t interface: interface ethernet 0 ip address 183.55.2.77 255.255.255.0 ip address 204.238.7.22 255.255.255.0 secondary ip address 88.127.6.209 255.255.255.0 secondary

T h e r o u t e r ' s E t h e r n e t 0 i n t e r f a c e n o w h a s a d d r e s s e s in t h e 183.55.0.0 network, the 204.238.7.0 network, and the 88.0.0.0 network.

Purpose of Subnetting W h e n t h e IP protocol w a s d e s i g n e d , t h e n e t w o r k s a n d c o m p u t e r s w e r e very different t h a n t h e y are today. W i t h t h e a d v e n t of local a r e a n e t w o r k s (LANS) a n d p e r s o n a l c o m p u t e r s , t h e a r c h i t e c t u r e of t h e c o m p u t e r n e t w o r k s c h a n g e d . I n s t e a d of h a v i n g big c o m p u t e r s c o m m u n i c a t i n g over low-speed, wide a r e a n e t w o r k s , we h a d s m a l l c o m p u t e r s c o m m u n i c a t i n g over fast, local a r e a n e t w o r k s . To i l l u s t r a t e w h y IP s u b n e t t i n g is n e c e s s a r y , let's t a k e a look a t h o w IP s e n d s d a t a g r a m s . A n d to m a k e it e a s y to u n d e r s t a n d , let's c o m p a r e t h e p r o c e s s to s e n d i n g m a i l a t t h e p o s t office. If y o u h a v e a m e s s a g e to s e n d to a m e m b e r of y o u r local family, y o u c a n deliver it to t h e family m e m b e r b y w r i t i n g it d o w n on a piece of p a p e r a n d giving it directly to h i m or her. IP n e t w o r k s do t h e s a m e thing. If a n IP d a t a g r a m is to be s e n t to a c o m p u t e r on t h e s a m e p h y s i c a l n e t w o r k , t h e two devices c a n c o m m u n i c a t e directly (see F i g u r e 1.5).

13

14


Figure 1.5 IP network with no subnetting.

T h e device 200. I. 1.98 w a n t s to c o m m u n i c a t e w i t h 200. i. 1.3. S i n c e t h e y a r e on t h e s a m e E t h e r n e t n e t w o r k , t h e y c a n c o m m u n i c a t e directly. T h e y a r e also on t h e s a m e IP n e t w o r k , so c o m m u n i c a t i o n c a n t a k e place w i t h o u t t h e h e l p of a n y o t h e r devices. Let's go b a c k to o u r p o s t office analogy. O n e of t h e c h i l d r e n h a s n o w m o v e d o u t of t h e h o u s e a n d h a s g o n e to college. To c o m m u n i c a t e w i t h t h a t child, y o u will n e e d to h a v e s o m e help. You write a letter, p u t it in a n envelope, a n d m a i l it. T h e p o s t office m a k e s s u r e t h a t y o u r l e t t e r r e a c h e s t h e a d d r e s s e e . C o m p u t i n g devices w o r k a c c o r d i n g to t h e s a m e principle. To c o m m u n i c a t e w i t h devices n o t in t h e s a m e p h y s i c a l n e t w o r k , t h e c o m p u t i n g device n e e d s s o m e help. H e r e is h o w it is done: In t h e i l l u s t r a t i o n in F i g u r e 1.6, J a m e s w a n t s to s e n d a m e s s a g e to S a r a h . T h e y a r e all p a r t of t h e s a m e IP n e t w o r k , 1 5 3 . 8 8 . 0 . 0 , b u t n o t a p a r t of t h e s a m e p h y s i c a l n e t w o r k . As a m a t t e r of fact, J a m e s ' c o m p u t e r is on a t o k e n - r i n g n e t w o r k in Los Angeles. S a r a h ' s m a c h i n e is l o c a t e d on a n E t h e r n e t n e t w o r k in P h i l a d e l p h i a . A conn e c t i o n b e t w e e n t h e two n e t w o r k s is r e q u i r e d .


9Chapter 1

Figure 1.6 Two networks, different locations.

J u s t like t h e p o s t office h e l p s to deliver t h e letter to t h e s t u d e n t in college, r o u t e r s help J a m e s to s e n d a m e s s a g e to S a r a h over t h e wide a r e a n e t w o r k f r o m Los Angeles to P h i l a d e l p h i a (see F i g u r e 1.7). T h e IP p r o c e s s m u s t s e n d t h e m e s s a g e f r o m J a m e s to t h e router. T h e r o u t e r will s e n d it to o t h e r r o u t e r s u n t i l t h e m e s s a g e finally r e a c h e s t h e r o u t e r on S a r a h ' s n e t w o r k . T h e n t h e r o u t e r on S a r a h ' s n e t w o r k will s e n d it to S a r a h ' s m a c h i n e . T h e r o u t e r s e n a b l e IP to s e n d i n f o r m a t i o n f r o m one p h y s i c a l n e t w o r k to a n o t h e r . How does IP k n o w t h a t S a r a h ' s m a c h i n e is n o t on t h e s a m e p h y s i c a l n e t w o r k a s J a m e s ' s ? IP m u s t d e t e r m i n e t h a t S a r a h ' s m a c h i n e is on a different p h y s i c a l n e t w o r k b y u s i n g t h e logical IP a d d r e s s i n g s c h e m e . In t h i s i n s t a n c e , t h e a d d r e s s a d m i n i s t r a tor m u s t a s s i s t t h e n e t w o r k m a n a g e r s b y b r e a k i n g t h e 1 5 3 . 8 8 . 0 . 0 n e t w o r k into s m a l l e r c o m p o n e n t s a n d place a b l o c k of a d d r e s s e s on e a c h p h y s i c a l n e t w o r k . E a c h b l o c k of a d d r e s s e s t h a t a p p l y to e a c h p h y s i c a l n e t w o r k is k n o w n a s a s u b n e t .

15

16

Chapter 1 Figure


1.7 Inter/Intranet connectivity.

In F i g u r e 1.8, J a m e s ' m a c h i n e is n o w f o u n d in t h e 1 5 3 . 8 8 . 2 4 0 . 0 s u b n e t . S a r a h ' s is in t h e 1 5 3 . 8 8 . 3 . 0 s u b n e t . W h e n J a m e s s e n d s a m e s s a g e to S a r a h , t h e IP p r o c e s s d e t e r m i n e s t h a t S a r a h is in a diff e r e n t s u b n e t a n d s e n d s t h e m e s s a g e to t h e r o u t e r for f o r w a r d i n g . Let's see h o w s u b n e t s a re d e t e r m i n e d a n d h o w IP devices decide to f o r w a r d d a t a g r a m s to a ro u t er .


9Chapter 1

Figure 1.8 Two locations, subnetted.

Continued

17

18

Chapter 1



9Chapter 1

The Basic Fixed-Length Mask To help t h e IP device u n d e r s t a n d t h e s u b n e t t i n g u s e d in t h e network, IP d e s i g n e r s d e s c r i b e d t h e p r o c e s s of u s i n g a s u b n e t m a s k in RFC950.

What the Mask Does S i m p l y s t a t e d , t h e m a s k is u s e d to i n d i c a t e t h e l o c a t i o n of t h e s u b n e t field in a n IP a d d r e s s . W h a t d o e s t h a t m e a n ? In t h e p r e v i o u s figu r e s , 1 5 3 . 8 8 . 0 . 0 is t h e n e t w o r k a d d r e s s . It is a c l a s s B a d d r e s s , w h i c h m e a n s t h a t t h e first 16 b i t s of t h e a d d r e s s is t h e n e t w o r k n u m b e r . J a m e s ' m a c h i n e is in t h e 1 5 3 . 8 8 . 2 4 0 . 0 s u b n e t . How do we determine that? J a m e s is in t h e 1 5 3 . 8 8 . 0 . 0 n e t w o r k . T h e a d m i n i s t r a t o r r e s e r v e d t h e n e x t 8 b i t s to hold t h e s u b n e t n u m b e r . In t h e p r e c e d i n g e x a m ple, J a m e s is in t h e 2 4 0 s u b n e t . If J a m e s ' IP a d d r e s s w e r e 1 5 3 . 8 8 . 2 4 0 . 2 2 , J a m e s w o u l d be in t h e 1 5 3 . 8 8 . 0 . 0 n e t w o r k , in t h e

19

20

Chapter 1


2 4 0 s u b n e t of t h a t n e t w o r k , a n d w o u l d h a v e a h o s t a d d r e s s of 22 in t h a t s u b n e t . All devices w i t h i n t h e 1 5 3 . 8 8 . 0 . 0 n e t w o r k w i t h a t h i r d octet of 2 4 0 a re a s s u m e d to be on t h e s a m e p h y s i c a l n e t w o r k a n d in the same subnet, the 240 subnet. T h e s u b n e t m a s k is u s e d to i n t e r p r e t a d d r e s s e s to u n d e r s t a n d h o w t h e y a r e s u b n e t t e d . T h e m a s k is m a d e u p of 32 bits, j u s t like t h e IP a d d r e s s . T h e r e a r e c e r t a i n m a s k s t h a t a r e n a t u r a l or d e f a u l t to t h e t h r e e c l a s s e s of a d d r e s s e s . T h e d e f a u l t or n a t u r a l m a s k for t h e c l a s s A a d d r e s s is 2 5 5 . 0 . 0 . 0 . In t h i s case, t h e m a s k i n d i c a t e s t h a t t h e first 8 b i t s r e p r e s e n t t h e n e t w o r k n u m b e r a n d m u s t be u s e d w h e n e v a l u a t i n g a c l a s s A a d d r e s s for s u b n e t t i n g . If a device h a s a c l a s s A a d d r e s s a s s i g n e d a n d h a s a m a s k of 2 5 5 . 0 . 0 . 0 , t h e r e is no s u b n e t t i n g in t h a t netwo rk . If a device h a s a c l a s s A a d d r e s s a n d h a s a m a s k t h a t is n o t 2 5 5 . 0 . 0 . 0 , t h e n e t w o r k h a s b e e n s u b n e t t e d a n d t h e device is in a s u b n e t of t h e c l a s s A n e t w o r k .

No subnetting 88.0.0.0 255.0.0.0 Subnetting 125.0.0.0 255.255.255.0 In t h e p r e c e d i n g e x a m p l e , t h e 1 2 5 . 0 . 0 . 0 n e t w o r k h a s b e e n s u b n e t t e d . T h e m a s k is n o t t h e d e f a u l t m a s k so we k n o w t h a t t h e n e t w o r k h a s b e e n s u b n e t t e d . W h a t d o e s t h e r e s t of t h e m a s k m e a n ? As s t a t e d earlier, t h e m a s k is u s e d to i n d i c a t e t h e location of t h e s u b n e t field in a n IP a d d r e s s . Let's look a t w h a t m a k e s u p a m a s k .


Components of a Mask T h e m a s k is a 3 2 - b i t b i n a r y n u m b e r t h a t is e x p r e s s e d in d o t t e d deci m a l n o t a t i o n . By default, t h e m a s k c o n t a i n s two fields, t h e n e t w o r k field a n d t h e h o s t field. T h e s e c o r r e s p o n d to t h e n e t w o r k n u m b e r a n d t h e locally a d m i n i s t e r e d p a r t of t h e n e t w o r k a d d r e s s . W h e n y o u s u b n e t , y o u a r e a d j u s t i n g t h e w a y y o u view t h e IP a d d r e s s . If y o u a r e w o r k i n g w i t h a c l a s s B n e t w o r k a n d are u s i n g t h e s t a n d a r d m a s k , t h e r e is no s u b n e t t i n g . F o r e x a m p l e , in t h e a d d r e s s a n d m a s k in t h e following e x a m p l e t h e n e t w o r k is i n d i c a t e d b y t h e first two 2 5 5 e n t r i e s a n d t h e h o s t field is i n d i c a t e d b y t h e e n d i n g 0.0. 1 53.88.4.240 255.255.0.0

T h e n e t w o r k n u m b e r is 1 5 3 . 8 8 a n d t h e h o s t n u m b e r is 4 . 2 4 0 . In o t h e r w o r d s , t h e first 16 b i t s a r e t h e n e t w o r k n u m b e r a n d t h e r e m a i n i n g 16 b i t s a r e t h e h o s t n u m b e r . W h e n we s u b n e t a network, we increase the h i e r a r c h y from n e t w o r k a n d h o s t to network, s u b n e t a n d host. If we were to s u b n e t the 153.88.0.0 n e t w o r k with a s u b n e t m a s k of 255.255.255.0, we will be adding a n additional piece of information. O u r view c h a n g e s in t h a t we will be adding a s u b n e t field. As with the previous example, 153.88 is still the n e t w o r k n u m b e r . With a m a s k of 255.255.255.0, the third octet is u s e d to tell u s where the s u b n e t n u m b e r is located. The s u b n e t n u m b e r is .4 and, finally, the h o s t n u m b e r is 240. The locally a d m i n i s t e r e d portion of the n e t w o r k a d d r e s s c a n be subdivided into s u b n e t w o r k s by u s i n g the m a s k to tell u s the location of the s u b n e t field. We allocate a certain n u m b e r of bits to the s u b n e t field a n d the r e m a i n d e r is t h e n the n e w h o s t field. In the following example, we took the 16-bit h o s t field t h a t comes with a class B a d d r e s s a n d broke it down into a n 8-bit s u b n e t field a n d a n 8-bit h o s t field. 255.255.255.0 for a class B network Network

Network

Subnet

Host

255 11111111

255 11111111

255 11111111

0 00000000

21

22

Chapter I


Bina ry Determination of Mask Values How do y o u d e t e r m i n e w h i c h m a s k to u s e ? On the s u r f a c e it is a fairly simple process. You first d e t e r m i n e h o w m a n y s u b n e t s are r e q u i r e d in y o u r network. This m a y r e q u i r e you to do a lot of r e s e a r c h into the n e t w o r k a r c h i t e c t u r e a n d design. Once y o u k n o w h o w m a n y s u b n e t s y o u will need, you c a n decide h o w m a n y s u b n e t bits are n e e d e d to provide y o u with a s u b n e t field big e n o u g h to hold the n u m b e r of s u b n e t s y o u need. W h e n a n e t w o r k is in the design p h a s e , the n e t w o r k a d m i n i s t r a tor d i s c u s s e s the design with the a d d r e s s a d m i n i s t r a t o r . They conclude t h a t t h e r e will be a total of 73 s u b n e t s in the c u r r e n t design a n d t h a t a class B a d d r e s s will be used. To develop the s u b n e t m a s k , we n e e d to k n o w h o w big the s u b n e t field m u s t be. The locally a d m i n i s t e r e d portion of a class B a d d r e s s c o n t a i n s 16 bits. R e m e m b e r t h a t the s u b n e t field is a portion of t h e s e 16 bits. The challenge is to d e t e r m i n e h o w m a n y bits are r e q u i r e d to store the decimal n u m b e r 73. Once we k n o w how m a n y bits are n e e d e d to store t h e decimal n u m b e r 73, we c a n d e t e r m i n e w h a t the m a s k s h o u l d be. The first step is to convert the decimal n u m b e r 73 to binary. The n u m b e r of bits in the b i n a r y n u m b e r is seven.

73 decimal= 1001001 binary So we n e e d to reserve the first 7 bits of the locally a d m i n i s t e r e d portion of the s u b n e t m a s k for the s u b n e t field a n d the r e m a i n d e r will be the h o s t field. In t h e e x a m p l e below, we are reserving the first 7 bits for the s u b n e t field, i n d i c a t e d by the 1 bits, a n d the r e m a i n d e r to the h o s t field, i n d i c a t e d by the 0 bits. 11111110 00000000

If we convert this b i n a r y i n f o r m a t i o n into decimal for the s u b n e t m a s k a n d a d d it to t h e portion of the m a s k for the n e t w o r k n u m b e r , we will have the entire s u b n e t m a s k n e c e s s a r y .

Addressing and Subnetting Basics * Chapter 1

11111110=254 decimal 00000000=0 decimal 255.255.254.0 is the mask

Remember, 255.255.0.0 is the default m a s k for a class B address. We have replaced the locally administered portion of the mask, the .0.0, with the 254.0 t h a t depicts the s u b n e t t i n g scheme. The 254.0 portion tells the software t h a t the first 7 bits of the locally administered portion of the a d d r e s s is the s u b n e t field a n d the r e m a i n d e r is the host field. Of course, if the s u b n e t m a s k n u m b e r s change, the interpretation of the s u b n e t field changes.

Decimal Equivalent Mask Values Tables 1.2, 1.3, and 1.4 show the possible s u b n e t m a s k s t h a t can be u s e d in class A, class B, and class C networks. Table 1.2 Class A Subnet Table

i

I

Subnets 2

6 1 14 i

i

I

3O

|

Mask

4,194,302

255.192.0.0

2,097,150

255.224.0.0

1,048,574

255.240.0.0

524,286

255.248.0.0

i

I

2 3

262,142

255.252.0.0

126

i

131,070 1 65,534

255.254.0.0

254

i

i

6

510

32,766

255.255.0.0

i

4,094

4,094

15 i

10

255.255.224.0 255.255.240.0

16 i

i

8,190

2,046 i

14 i

11 i

.

18 17

9

255.255.192.0

i

19 | i

i

i

16,382

1,022 i

120

8

255.255.128.0

i

21

7

i

i

22

I

5

i

i

i

4 a

'62 !

Hosts

Subnet Host Bits Bits

12

13 i

|

12

Continued

23

24

Chapter 1 ~ Addressing and Subnetting Basics

Subnets

Hosts

Mask

Subnet Bits

Host Bits

8,190

2,046

255.255.248.0

13

11

16,382

1,022

255.255.252.0

14

10

32,766

510

255.255.254.0

15

65,534

254

255.255.255.0

16

131,070

126

255.255.255.128

17

262,142

62

255.255.255.192

18

524,286

30

255.255.255.224

19

1,048,574

14

255.255.255.240

20

2,097,150

255.255.255.248

21

4,194,302

255.255.255.252

22

Hosts

Mask

Subnet Bits

16,382

255.255.192.0

14

8,190

255.255.224.0

13

14

4,094

255.255.240.0

12

30

2,046

255.255.248.0

11

62

1,022

255.255.252.0

10

126

510

255.255.254.0

254

254

255.255.255.0

510

126

255.255.255.128

1022

62

255.255.255.192

10

2046

30

255.255.255.224

11

4094

14

255.255.255.240

12

Table 1.3 Class B Subnet Table

Subnets

Host Bits

Continued


9Chapter 1

Mask


8,190

255.255.255.248

13

16,382

255.255.255.252

14

Hosts

Mask


62

255.255.255.192

30

255.255.255.224

14

255.255.255.240

Subnets

Hosts

Table 1.4 Class C Subnet Table

Subnets

14 30

255.255.255.248

62

255.255.255.252

T h e s e s u b n e t m a s k t a b l e s c a n m a k e it e a s i e r for y o u to determ i n e w h i c h s u b n e t m a s k to u s e for a n y given s i t u a t i o n . Look a t t h e t a b l e s for j u s t a m i n u t e a n d notice w h a t h a p p e n s . As y o u go d o w n t h e table, t h e n u m b e r of s u b n e t s i n c r e a s e s a n d t h e n u m b e r of h o s t s in e a c h s u b n e t t h e n d e c r e a s e s . Why?. Look a t t h e r i g h t - h a n d side of e a c h table. As t h e n u m b e r of s u b n e t bits i n c r e a s e s , t h e n u m b e r of h o s t bits d e c r e a s e s . Since we h a v e a fixed n u m b e r of b i t s to w o r k w i t h in e a c h c l a s s of n e t w o r k a d d r e s s , e a c h bit c a n be u s e d in only one w a y - - s p e c i f i e d b y t h e m a s k . E a c h bit m u s t be e i t h e r a s u b n e t bit or a h o s t bit. An i n c r e a s e in t h e n u m b e r of s u b n e t bits c a u s e s a r e d u c t i o n in t h e n u m b e r of h o s t bits. Notice too t h a t t h e t a b l e s are different sizes for e a c h c l a s s of a d d r e s s . B e c a u s e of t h e 24-bit, 16-bit a n d 8-bit h o s t fields for c l a s s A, B, a n d C n e t w o r k s , respectively, we h a v e t h r e e different tables.

25

26

Chapter 1


Creating Masks for Various Networking Problems The t a b l e s m a k e it e a s y to locate the correct m a s k for y o u r n e t w o r k ing problem. C o n s i d e r the following problems: Bob w a s given a class A n e t w o r k to administer. He n e e d s to s u b n e t the n e t w o r k into 1,045 s u b n e t s with 295 devices in the largest s u b n e t . He looks u p the s u b n e t a n d device n u m b e r s in the class A table a n d finds t h a t the following five entries c a n be u s e d to solve his problem. W h i c h s h o u l d he u s e ?

2,046 4,094 8,190 16,382

8,190 4,094 2,046 1,022

255.255.224.0 255.255.240.0 255.255.248.0 255.255.252.0

11 12 13 14

13 12 11 10

32,766

510

255.255.254.0

15

9

Bob m u s t select one m a s k to use. As he looks at his possible solutions, he also h a s to u n d e r s t a n d a n o t h e r factor involved in his decision: the growth of the network. Will his c o m p a n y a d d m o r e s u b n e t s in the future, or will e a c h s u b n e t get bigger, or b o t h ? If the n u m b e r of s u b n e t s will increase w i t h o u t a n increase in devices in each s u b n e t , Bob could select 2 5 5 . 2 5 5 . 2 5 4 . 0 as his m a s k a n d be comfortable with his decision. If the n u m b e r of devices in e a c h s u b n e t will increase, he could select 255.255.259..0 as his m a s k . Depending on the physical protocol in use, there m a y be practical limits to the n u m b e r of devices in each s u b n e t . In some networks, having more t h a n 100 physical devices in a n e t w o r k s e g m e n t or s u b n e t m a y seriously i m p a c t the usability of the network. Using realistic e s t i m a t e s of devices in each s u b n e t is essential to s u b n e t t i n g success. In a n o t h e r example, S a r a h is in c h a r g e of a small c o r p o r a t e netw o r k w i t h two E t h e r n e t s e g m e n t s a n d t h r e e t o k e n - r i n g s e g m e n t s . They are c o n n e c t e d t o g e t h e r with one router. E a c h s u b n e t will cont a i n no m o r e t h a n 15 devices. S a r a h h a s b e e n a s s i g n e d a class C n e t w o r k a d d r e s s . As S a r a h looks at the class C table, s h e finds t h a t t h e following e n t r y m a y be u s e d to solve the p r o b l e m as described:

16

130

]255.255.224

13

15


9Chapter 1

T h e only e n t r y t h a t allows five s u b n e t s w i t h 15 devices is 255.255.255.224. If y o u h a v e a good i d e a of t h e n u m b e r of s u b n e t s a n d t h e n u m b e r of h o s t s in e a c h s u b n e t , y o u c a n u s e t h e s e t a b l e s to find t h e p r o p e r m a s k . It is a l w a y s i m p o r t a n t to k n o w if t h e n u m b e r of s u b n e t s will g r o w in t h e f u t u r e or if t h e n u m b e r of h o s t s in t h e s u b n e t s will grow. O n c e t h e g r o w t h fa c t o rs h a v e b e e n i n c l u d e d in t h e c u r r e n t n e e d , c h e c k t h e t a b l e s to d e t e r m i n e y o u r m a s k .

Add resses and Mask Interaction Let's review t h e c o n c e p t of IP a d d r e s s e s . An IP a d d r e s s identifies a device on a n e t w o r k . IP a d d r e s s e s a re a s s i g n e d from c l a s s e s t h a t c o n t a i n different g r o u p s of a d d r e s s e s . E a c h IP n e t w o r k h a s a n e t w o r k n u m b e r . E a c h IP s u b n e t h a s t h e n e t w o r k n u m b e r of its p a r e n t n e t w o r k a n d a s u b n e t n u m b e r . T h e s u b n e t n u m b e r c a n be f o u n d b y l o c a t i n g t h e s u b n e t field in t h e s u b n e t m a s k . If y o u h a v e a n IP a d d r e s s of 1 5 3 . 8 8 . 4 . 2 4 0 w i t h a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 , y o u k n o w t h a t y o u h a v e a n a d d r e s s in t h e 1 5 3 . 8 8 . 0 . 0 n e t w o r k . You k n o w y o u a r e in s u b n e t .4 b e c a u s e t h e t h i r d o ctet of t h e m a s k s a y s t h a t all 8 b i t s of t h e a d d r e s s in t h e t h i r d octet m a k e u p t h e s u b n e t n u m b e r . By t h e way, all devices w i t h a 1 5 3 . 8 8 in t h e first two o c t e t s a re in t h e s a m e n e t w o r k a n d all devices w i t h a 4 in t h e t h i r d octet a r e in t h e s a m e s u b n e t . W h y is that? In a c l a s s B n e t w o r k , t h e first 16 b i t s a r e t h e n e t w o r k n u m b e r . If devices h a v e t h e i d e n t i c a l first 16 bits, t h e y a r e in t h e s a m e n e t w o r k w i t h a c l a s s B a d d r e s s . W h e n y o u w a n t to s e n d a d a t a g r a m from t h e s o u r c e a d d r e s s to t h e t a r g e t a d d r e s s , IP h a s to m a k e a r o u t i n g decision. Look a t t h e following example:

Source 1 53.88.4.240 Target 1 53.89.98.254

Network 10011001 10011001

Network 01011000 01011001

Subnet 00000100 01100010

Host 11110000 11111110

27

28

Chapter

1


9

Notice t h a t t h e s e are different networks. They are b o t h class B a d d r e s s e s , b u t the first 16 bits do n o t m a t c h . They are different; therefore, IP " a s s u m e s " t h e y are on different physical n e t w o r k s a n d will s e n d t h e d a t a g r a m to the r o u t e r for forwarding to the t a r g e t device. IP only looks at s u b n e t t i n g w h e n the n e t w o r k n u m b e r s of t h e two a d d r e s s e s are the same. We h a d m e n t i o n e d earlier t h a t the s u b n e t m a s k h e l p s u s locate the s u b n e t n u m b e r . Here is a n o t h e r example:

Source 1 53.88.4.240 Target 153.88.192.254 Mask 255.255.255.0

Network 10011001 1 O011 O01 11111111

Network 01011000 01011000 11111111

Subnet 00000100 11000000 11111111

Host 11110000 11111110 00000000

In t h i s example, you will see t h a t we have modified the t a r g e t a d d r e s s . We have also a d d e d a s u b n e t m a s k t h a t we c a n u s e to d e t e r m i n e s u b n e t t i n g . Notice the m a s k , 255.255.255.0. The first two 2 5 5 s in t h e m a s k p o i n t to the n e t w o r k portion of the a d d r e s s since we are u s i n g a class B a d d r e s s . The t h i r d 255 is the location of the s u b n e t field in the locally a d m i n i s t e r e d portion of the a d d r e s s e s . The o n e s in the m a s k point to the s u b n e t bits. Are t h e s e two devices in t h e s a m e s u b n e t ? Look at t h e bits in the t h i r d octet of e a c h a d d r e s s . The s o u r c e a d d r e s s h a s a b i n a r y s u b n e t field of 0 0 0 0 0 1 0 0 a n d t h e t a r g e t a d d r e s s h a s a b i n a r y s u b n e t field of 1 1 0 0 0 0 0 0 . Since t h e s e two b i n a r y n u m b e r s are n o t the s a m e , t h e s e two devices are in different s u b n e t s a n d the s o u r c e device will s e n d d a t a g r a m s to the r o u t e r for delivery to the t a r g e t device in the t a r g e t network. So far we have b e e n working with the e a s i e s t s u b n e t t i n g , the 2 5 5 . 2 5 5 . 2 5 5 . 0 m a s k . Using a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 allows u s to i n t e r p r e t the a d d r e s s by r e a d i n g the dotted decimal a d d r e s s . For example, a n a d d r e s s of 1 6 5 . 2 2 . 1 2 9 . 6 6 c o n t a i n s the n e t w o r k a d d r e s s 165.22.0.0. The s u b n e t n u m b e r is 129. The h o s t n u m b e r is 66. E a c h portion of t h e dotted decimal a d d r e s s c o n t a i n s a d d r e s s inform a t i o n t h a t is e a s y to interpret. W h a t h a p p e n s w h e n the m a s k is n o t so simple? In the n e x t example, we will w o r k with a class B network, 160.149.0.0. The


s u b n e t m a s k s e l e c t e d by t h e a d m i n i s t r a t o r s is 2 5 5 . 2 5 5 . 2 5 2 . 0 . This gives t h e n e t w o r k 62 s u b n e t s w i t h 1022 devices in e a c h s u b n e t . Let's see w h a t h a p p e n s w h e n we try to d e t e r m i n e t h e s u b n e t i d e n t i t y of two devices:

Source 160.149.115.8 Target 160.149.117.201 Mask 255.255.252.0

Network 10100000

Network 10010101

Subnet 01110011

Host 00001000

10100000

10010101

01110101

11001001

11111111

11111111

11111100

00000000

The n e t w o r k p o r t i o n of t h e two a d d r e s s e s in t h e e x a m p l e above is identical, so t h e y are in t h e s a m e n e t w o r k . The s u b n e t p o r t i o n of t h e m a s k c o n t a i n s 6 bits, so t h e first 6 bits of t h e t h i r d octet cont a i n s t h e s u b n e t n u m b e r . The first 6 bits of t h e t h i r d octet is 0 1 1 1 0 0 for 115 a n d 0 1 1 1 0 1 for 117. T h e s e devices are in different s u b n e t s . D a t a g r a m s s e n t from t h e s o u r c e m a c h i n e w o u l d h a v e to be s e n t to t h e r o u t e r to r e a c h t h e t a r g e t device. W h y a r e t h e s e two devices in different s u b n e t s ? First, t h e y are in t h e s a m e n e t w o r k a n d are c a n d i d a t e s for b e i n g in t h e s a m e s u b n e t . T h e s u b n e t p o r t i o n of t h e m a s k s a y s t h a t t h e first 6 bits of t h e t h i r d octet of e a c h a d d r e s s c o n t a i n s t h e s u b n e t n u m b e r . In c o m p a r i n g t h e s u b n e t p o r t i o n of t h e two a d d r e s s e s , bit p a t t e r n s do n o t m a t c h . T h e y a r e in different s u b n e t s . Here is a n o t h e r example:

Source 160.149.115.8 Target 160.149.114.66 Mask 255.255.252.0

Network 10100000 10100000 11111111

Network 10010101 1 O010101 11111111

Subnet 01110011 0111 O010 11111100

Host 00001000 01000010 00000000

In t h i s e x a m p l e 1 6 0 . 1 4 9 . 1 1 5 . 8 a n d 1 6 0 . 1 4 9 . 1 1 4 . 6 6 are in t h e s a m e n e t w o r k a n d s u b n e t . Look a t t h e t h i r d octet. W h e r e t h e o n e s bit exist in t h e m a s k , t h e bits in b o t h a d d r e s s e s are identical, indic a t i n g t h a t t h e y are in t h e s a m e s u b n e t . E v e n t h o u g h t h e t h i r d octet c o n t a i n s 114 in one a d d r e s s a n d 115 in t h e other, t h e y are in t h e s a m e s u b n e t b e c a u s e t h e s i g n i f i c a n t bits are t h e s a m e in b o t h addresses.

29

30

Chapter 1


Reserved and Restricted Addresses W h e n a s s i g n i n g a d d r e s s e s to devices in n e t w o r k s a n d / o r s u b n e t s , t h e r e a r e s o m e a d d r e s s e s t h a t c a n n o t be u s e d . We r e s e r v e two a d d r e s s e s in a n y n e t w o r k or s u b n e t to u n i q u e l y identify two s p e c i a l f u n c t i o n s . T h e first r e s e r v e d a d d r e s s is t h e n e t w o r k or s u b n e t a d d r e s s . T h e n e t w o r k a d d r e s s is t h e a d d r e s s t h a t i n c l u d e s t h e n e t w o r k n u m b e r a n d a h o s t field filled w i t h b i n a r y zeros. 2 0 0 . 1 . 1 . 0 , 1 5 3 . 8 8 . 0 . 0 , a n d 10.0.0.0 a r e n e t w o r k a d d r e s s e s . T h e s e a d d r e s s e s identify t h e n e t w o r k a n d c a n n o t be a s s i g n e d to a device. A n o t h e r r e s e r v e d a d d r e s s is t h e b r o a d c a s t a d d r e s s . W h e n u s e d , it is m e a n t to a t t r a c t t h e a t t e n t i o n of all devices in t h e n e t w o r k . T h e n e t w o r k b r o a d c a s t a d d r e s s is t h e n e t w o r k n u m b e r followed b y a h o s t field of b i n a r y ones. T h e a d d r e s s e s s h o w n in t h e e x a m p l e b e l o w are network b r o a d c a s t addresses: 200.1.1.255, 153.88.255.255, and 1 0 . 2 5 5 . 2 5 5 . 2 5 5 . Since t h i s a d d r e s s is s u p p o s e d to a t t r a c t t h e a t t e n tion of every device, it c a n n o t be u s e d on a n y single device. We also r e s t r i c t a d d r e s s e s in s u b n e t s . E a c h s u b n e t h a s a s u b n e t a d d r e s s a n d a b r o a d c a s t a d d r e s s . Like t h e n e t w o r k a d d r e s s a n d


b r o a d c a s t a d d r e s s , t h e s e a d d r e s s e s c a n n o t be a s s i g n e d to devices a n d c o n t a i n h o s t fields of all zeros a n d all o n e s for t h e s u b n e t address and subnet broadcast.

Subnet Add. 153.88.4.0 Broadcast 153.88.4.255 Mask 255.255.255.0

Network 10011001 10011001 11111111

Network 01011000 01011000 11111111

Subnet 00000100 00000100 11111111

Host 00000000 11111111 00000000

In t h i s e x a m p l e , t h e s u b n e t a d d r e s s is s h o w n w i t h all z e r os in t h e h o s t field, a n d t h e b r o a d c a s t a d d r e s s is s h o w n w i t h all o n e s in t h e h o s t field. R e g a r d l e s s of t h e size of t h e s u b n e t field or h o s t field, t h e bit s t r u c t u r e of all z e ro s in t h e h o s t field is t h e s u b n e t a d d r e s s , a n d all o n e s in t h e h o s t field is t h e s u b n e t b r o a d c a s t a d d r e s s .

Determining the Range of Addresses within Subnets O n c e y o u h a v e d e t e r m i n e d w h a t m a s k to u s e a n d u n d e r s t a n d t h e special s u b n e t a d d r e s s and s u b n e t b r o a d c a s t address, you can b e g i n t h e p r o c e s s of d e t e r m i n i n g w h a t a d d r e s s e s a r e going to be a s s i g n e d to specific devices. To do t h a t , y o u will n e e d to "calculate" w h i c h a d d r e s s e s a r e in e a c h s u b n e t . E a c h s u b n e t will c o n t a i n a r a n g e of a d d r e s s e s w i t h t h e s a m e n e t w o r k a n d s u b n e t n u m b e r . T h e difference will be in t h e h o s t n u m b e r s . Below is a n e x a m p l e of a se t of a d d r e s s e s in a s u b n e t of a class C network.

Network Address 200.1.1.0 Subnet Mask 255.255.255.248 Subnet 1 Address Mask

11111000 00001000 00001001

200.1.1.8 200.1.1.9

Subnet Address Host 1

31

32

Chapter 1

9Addressing and

00001010 00001011 00001100 00001101 00001110 00001111

Subnetting Basics

200.1.1.10 200.1.1.11 200.1.1.12 200.1.1.13 200.1.1.14 200.1.1.1 5

Host 2 Host 3 Host 4 Host 5 Host 6 Subnet Broadcast

In t h e p r e c e d i n g example, we are u s i n g the 2 0 0 . 1 . 1 . 0 class C network. The s u b n e t m a s k is 2 5 5 . 2 5 5 . 2 5 5 . 2 4 8 . S u b n e t t i n g c a n only o c c u r in the f o u r t h octet in a class C a d d r e s s . E a c h s u b n e t c a n cont a i n six devices u s i n g this m a s k . In creating the a d d r e s s e s for s u b n e t n u m b e r 1, notice t h a t the s u b n e t field of e a c h a d d r e s s is 0 0 0 0 1 . The s u b n e t field is i n d i c a t e d by the 11111 portion of the f o u r t h octet of the m a s k . The s u b n e t field exists in the first five bits of the f o u r t h octet. The r e m a i n i n g 3 bits are u s e d to indicate the h o s t field. The h o s t field for e a c h a d d r e s s i n c r e a s e s from 000 for the s u b n e t a d d r e s s to 111 for the s u b n e t b r o a d c a s t a d d r e s s . The a d d r e s s e s t h a t c a n be a s s i g n e d to specific h o s t s i n c r e a s e from 001 to 110, the b i n a r y e q u i v a l e n t of decimal 1 to decimal 6. So w h y do the a d d r e s s es look the w a y t h e y do? We simply c o m b i n e the s u b n e t n u m b e r , 0 0 0 0 1 , w i t h e a c h h o s t field, 000 t h r o u g h 111, a n d convert e a c h a d d r e s s from b i n a r y to decimal. We begin w i t h 2 0 0 . 1 . 1 . 8 (00001000) a n d e n d with 2 0 0 . 1 . 1 . 1 5 (00001111). In this case, we d o n ' t c h a n g e t h e 200.1.1. p a r t of the a d d r e s s b e c a u s e t h a t is the n e t w o r k n u m ber. More i n f o r m a t i o n a n d the p r o c e s s e s u s e d to develop a n a d d r e s s ing p l a n will be f o u n d in C h a p t e r 2.

Determining Subnet Addresses Given a Single Address and Mask If y o u have a n IP a d d r e s s a n d a s u b n e t m a s k , y o u c a n d e t e r m i n e t h e s u b n e t w h e r e the device is located. The s t e p s are as follows: 0

Convert the locally a d m i n i s t e r e d portion of the a d d r e s s to binary.


9Chapter 1

2.

C o n v e r t t h e locally a d m i n i s t e r e d p o r t i o n of t h e m a s k to binary.

3.

Locate t h e h o s t field in t h e b i n a r y a d d r e s s a n d r e p l a c e w i t h zeros.

4.

C o n v e r t t h e b i n a r y a d d r e s s to d o t t e d d e c i m a l n o t a t i o n . You now have the subnet address.

5.

Locate t h e h o s t field in t h e b i n a r y a d d r e s s a n d r e p l a c e w i t h ones.

6.

C o n v e r t t h e b i n a r y a d d r e s s to d o t t e d d e c i m a l n o t a t i o n . You now have the subnet broadcast address.

E v e r y t h i n g b e t w e e n t h e s e two n u m b e r s r e p r e s e n t s IP a d d r e s s e s t h a t m a y be a s s i g n e d to devices. T h e following is a n e x a m p l e of h o w to u s e t h i s p r o c e s s . T h e a d d r e s s of t h e device is 2 0 4 . 2 3 8 . 7 . 4 5 a n d t h e s u b n e t m a s k is 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 . S i n c e t h i s is a c l a s s C a d d r e s s , s u b n e t t i n g o c c u r s in t h e f o u r t h octet. Address 200.1.1.45 Mask 255.255.255.224

00101101 11100000

Convert host to zeros Conver host to ones

00100000 00111111

.32 Subnet Address .63 Subnet Broadcast

T h e h o s t field is l o c a t e d in t h e l a s t 5 b i t s of t h e a d d r e s s . R e p l a c i n g t h e h o s t field w i t h zeros a n d c o n v e r t i n g t h e b i n a r y n u m b e r to d e c i m a l gives u s t h e s u b n e t a d d r e s s . R e p l a c i n g t h e h o s t field w i t h o n e s r e s u l t s in t h e s u b n e t b r o a d c a s t a d d r e s s . T h e a d d r e s s 2 0 0 . 1 . 1 . 4 5 s u b n e t t e d w i t h a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 is in t h e s u b n e t 2 0 0 . 1 . 1 . 3 2 . T h e a d d r e s s e s t h a t c a n be a s s i g n e d in t h i s s u b net are 200.1.1.33 t h r o u g h 200.1.1.62.

33

34


Interpreting Masks Dec

Binary

0 128 192 224 240 248 252 254 255

00000000 10000000 11000000 11100000 11110000 11111000 11111100 11111110 11111111

E a c h s u b n e t m a s k is m a d e u p of b i n a r y v a l u e s a n d is r e p r e s e n t ed in d o t t e d d e c i m a l n o t a t i o n . T h e allowable d e c i m a l v a l u e s t h a t c a n be u s e d in t h e m a s k a r e s e e n in F i g u r e 1.23. In o r d e r to u s e t h e s e v a l u e s , t h e r e m u s t be a 2 5 5 i m m e d i a t e l y to t h e left. T h e s u b n e t m a s k b i t s m u s t be c o n t i g u o u s . For e x a m p l e , a m a s k of 2 5 5 . 2 5 5 . 0 . 2 2 4 is n o t a p p r o p r i a t e . We a r e s o m e t i m e s a s k e d "How m a n y b i t s a r e in t h e m a s k ? " T h e q u e s t i o n is a n s w e r e d b y e x p r e s s i n g t h e n u m b e r of b i t s in t h e m a s k w i t h r e l a t i o n to t h e c l a s s of a d d r e s s . F o r i n s t a n c e , if a m a s k of 2 5 5 . 2 5 5 . 2 5 4 . 0 is u s e d w i t h a c l a s s B a d d r e s s , t h e r e a r e 7 b i t s in t h e m a s k . It m a y look like t h e r e a r e a total of 23 bits, w h i c h t h e r e are. To clearly e x p r e s s t h e s u b n e t t i n g , however, we m u s t s a y t h a t t h e m a s k is a 7-bit m a s k for a c l a s s B a d d r e s s . Only 7 b i t s of t h e total 23 b i t s a r e u s e d for s u b n e t t i n g . T h e r e m a i n i n g 16 b i t s c o m e with the class B address. T h i s m a y s e e m like a silly little p o i n t b u t it c a n lead to a very b a d m i s c o m m u n i c a t i o n . If I tell y o u I h a v e a 6-bit m a s k , w h a t d o e s t h a t m e a n ? W i t h o u t t h e c l a s s of a d d r e s s , t h e m a s k c o u l d be 2 5 5 . 2 5 2 . 0 . 0 , 2 5 5 . 2 5 5 . 2 5 2 . 0 , or 2 5 5 . 2 5 5 . 2 5 5 . 2 5 2 . E a c h of t h e s e m a s k s is a 6-bit m a s k , b u t t h e y a p p l y to different c l a s s e s of a d d r e s s e s a n d give u s a c o m p l e t e l y different s u b n e t p i c t u r e .


Reserved Addresses E a r l i e r in t h e c h a p t e r we t a l k e d a b o u t c e r t a i n r e s e r v e d a d d r e s s e s . Specifically we s a i d t h a t t h e n e t w o r k a d d r e s s , n e t w o r k b r o a d c a s t address, the subnet address, and the subnet broadcast address c o u l d n o t be a s s i g n e d to a n y device or h o s t . T h i s is to avoid confus i o n on t h e p a r t of t h e IP s o f t w a r e t h a t is r e s p o n s i b l e for t r a n s p o r t ing t h e IP d a t a g r a m s . T h e s e a d d r e s s e s do n o t u n i q u e l y identify a n y p a r t i c u l a r device. IP devices m a y s e n d d a t a g r a m s u s i n g t h e b r o a d c a s t a d d r e s s , b u t t h e b r o a d c a s t a d d r e s s m e a n s everyone. A single device c a n n o t be everyone, it m u s t h a v e a u n i q u e a d d r e s s . We n e e d to r e m o v e t h e r e s e r v e d a d d r e s s e s f r o m o u r a d d r e s s calc u l a t i o n a n d do so b y u s i n g a special f o r m u l a to d e t e r m i n e h o w m a n y h o s t s a r e available in a s u b n e t or n e t w o r k . If y o u k n o w t h e n u m b e r of b i t s in t h e h o s t field of a n a d d r e s s , y o u c a n c a l c u l a t e t h e n u m b e r of devices in t h e n e t w o r k or s u b n e t . T h e f o r m u l a t h a t we u s e is:

2n_2 In t h i s f o r m u l a , n r e p r e s e n t s t h e n u m b e r of b i t s in t h e s u b n e t or h o s t field. We s u b t r a c t two to r e m o v e t h e two r e s e r v e d a d d r e s s e s f r o m t h e c a l c u l a t i o n . In t h e following e x c e r p t of t h e c l a s s C s u b n e t t i n g table, y o u c a n see t h e r e s u l t s of u s i n g t h i s f o r m u l a .

Subnets

Hosts

Mask


14

14

255.255.255.240

4

4

U s i n g a s u b n e t m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 4 0 , we h a v e 4 b i t s in t h e s u b n e t field. T h e n u m b e r of bit p a t t e r n s t h a t exist in 4 b i t s is 24 or 16. T h e y a r e a s follows: 0000 0001 0010 0011

0100 0101 0110 0111

1000 1001 1010 1011

1100 1101 1110 1111

35

36

Chapter 1

9Addressing and

Subnetting Basics

Removing the two r e s e r v e d bit p a t t e r n s , 0 0 0 0 a n d 1111, from t h e possible s u b n e t v a l u e s leaves u s with 14 s u b n e t n u m b e r s to use. This s a m e c a l c u l a t i o n also applies to the bits in t h e h o s t field.

Summary In this chapter, y o u have l e a r n e d a b o u t t h e IPv4 32-bit a d d r e s s s t r u c t u r e . You've s e e n t h e c o m p o n e n t s of a n IPv4 a d d r e s s , l e a r n e d a b o u t the c l a s s e s of a d d r e s s e s , a n d f o u n d o u t exactly h o w m a n y a d d r e s s e s are available in e a c h class. You t h e n l e a r n e d w h y we s u b n e t a n d h o w we s u b n e t . You've discovered t h e c o n t e n t s of t h e s u b n e t m a s k a n d h o w t h e s u b n e t m a s k is created. You were s h o w n t h e p r o c e s s u s e d to convert decimal n u m b e r to b i n a r y a n d b i n a r y n u m b e r s to decimal. The c o n t e n t s of s u b n e t m a s k t a b l e s were m a d e available a n d the p r o c e s s of selecting a s u b n e t m a s k for a n e t w o r k i n g p r o b l e m w a s described.


9Chapter 1

Finally, y o u w e r e s h o w n h o w to d e t e r m i n e if two a d d r e s s e s w e r e in t h e s a m e s u b n e t a n d w h i c h a d d r e s s e s w e r e in a s u b n e t . Additionally, y o u ' v e l e a r n e d w h i c h a d d r e s s e s c o u l d n o t be u s e d on IP devices.

255 11111111

139 10001011

T h i s forces t h e a d d r e s s a d m i n i s t r a t o r to c a l c u l a t e e a c h a d d r e s s individually. T h e r e is also no c o n t i n u o u s r a n g e of a d d r e s s e s in e a c h s u b n e t . It is too c o n f u s i n g a n d too difficult to s u b n e t u s i n g s t r a n g e a n d w o n d e r f u l m a s k s like t h e p r e c e d i n g one. Select y o u r m a s k s f r o m t h e t a b l e s in t h e c h a p t e r .

Q" I c o n f u s e m y a d d r e s s w i t h m y m a s k . How c a n I tell t h e difference? A" T h e m a s k will a l w a y s h a v e 2 5 5 in t h e first octet. T h e a d d r e s s will n e v e r h a v e 2 5 5 in t h e first octet.

Q: How c a n I be s u r e t h a t t h e m a s k I select for m y n e t w o r k is correct? A" It is a l w a y s a good q u e s t i o n . T h e a n s w e r is "You c a n n o t I " E v e n if y o u did t h e c o r r e c t r e s e a r c h a n d c r e a t e d t h e b e s t p o s s i b l e m a s k w i t h c u r r e n t i n f o r m a t i o n , c h a n g e s in n e t w o r k d e s i g n a n d n e t w o r k a d m i n i s t r a t i o n m a y force y o u to modify t h e a d d r e s s i n g

37

38

Chapter 1


structure. That would m e a n t h a t the m a s k you selected m a y not be appropriate. The best suggestion is to m a k e sure there is plenty of room for growth in s u b n e t s and hosts in each s u b n e t w h e n you select your m a s k and create your addressing plan. Q" Why do I need to know the decimal-to-binary conversion?

A: To u n d e r s t a n d fully how s u b n e t t i n g works, it is n e c e s s a r y to u n d e r s t a n d how the bits in the m a s k and the a d d r e s s are related. To see the relationship, it is often n e c e s s a r y to view the a d d r e s s e s in binary along with the binary r e p r e s e n t a t i o n of the mask. Without decimal-to-binary conversion, it is difficult to view the relationship.

40

Chapter 2

9Creating

an Addressing Plan for Fixed-Length Mask Networks

Introduction M a n y organizations, especially smaller ones, u s e f i x e d - m a s k a d d r e s s i n g . F i x e d - m a s k a d d r e s s i n g is easier to u n d e r s t a n d a n d simpler to i m p l e m e n t t h a n v a r i a b l e - m a s k a d d r e s s i n g . In f i x e d - m a s k n e t w o r k s , every device u s e s the s a m e m a s k a n d all s u b n e t s have the s a m e n u m b e r of available a d d r e s s e s ~ t h e y ' r e all the s a m e size. In C h a p t e r 1 we l e a r n e d a b o u t IP a d d r e s s e s a n d the b a s i c s of m a s k o p e r a t i o n a n d s u b n e t t i n g . In this chapter, we'll detail the s t e p s y o u n e e d to take to a s s i g n a p p r o p r i a t e IP a d d r e s s e s to t h o s e devices t h a t n e e d t h e m . We'll also s h o w y o u s o m e effective a n d s u r prisingly simple tools to m a k e the job easier. Your choice of r o u t i n g protocols c a n affect y o u r choice of m a s k . Of the p o p u l a r r o u t i n g protocols, RIP (version 1) a n d IGRP i m p o s e c e r t a i n r e q u i r e m e n t s on a d d r e s s i n g ~ a l l devices on all s u b n e t s m u s t u s e t h e s a m e m a s k . In o t h e r words, y o u are forced into a f i x e d - l e n g t h - m a s k a d d r e s s i n g plan. If y o u u s e RIP (version 2), OSPF, or EIGRP, t h e n y o u c a n still c h o o s e to u s e the s a m e m a s k for e a c h s u b n e t , b u t the protocols do n o t d e m a n d it.

Determine Addressing Requirements W h e n y o u n e e d to develop a n IP a d d r e s s i n g plan, w h e t h e r it is for fixed- or v a r i a b l y - s u b n e t t e d n e t w o r k s , y o u have to s t a r t by determ i n i n g exactly w h a t y o u r n e e d s are. As y o u recall, IP a d d r e s s e s c o n t a i n i n f o r m a t i o n t h a t helps r o u t e r s deliver d a t a g r a m s to the p r o p e r d e s t i n a t i o n n e t w o r k s or s u b n e t s . Since s u c h a close relationship exists b e t w e e n IP a d d r e s s e s a n d their t a r g e t n e t w o r k s e g m e n t s , y o u m u s t be careful to d e t e r m i n e the p r o p e r r a n g e of a d d r e s s e s for e a c h n e t w o r k or s u b n e t .

Review Your Internetwork Design We s t a r t by reviewing o u r n e t w o r k d o c u m e n t a t i o n . If this is a newly d e s i g n e d IP network, you'll n e e d the design specifications. If the

Creating an Addressing Plan for Fixed-Length Mask Networks

9Chapter 2

n e t w o r k h a s b e e n in o p e r a t i o n for s o m e time, y o u c a n u s e t h e "as built" d o c u m e n t a t i o n . T h e s e s p e c i f i c a t i o n s s h o u l d i n c l u d e i n f o r m a tion s u c h as" 9 T h e n u m b e r a n d type of devices on e a c h LAN s e g m e n t 9 An i n d i c a t i o n of w h i c h of t h o s e devices n e e d a n IP a d d r e s s 9 T h e devices c o n n e c t i n g t h e s e g m e n t s , for e x a m p l e : r o u t e r s , bridges, and switches.

How Many Subnets Do You Need? As y o u review y o u r design, identify a n d list e a c h s u b n e t , n o t i n g t h e n u m b e r of IP a d d r e s s e s n e e d e d in each. T a k e a look a t F i g u r e 2.1. Figure

2.1 Sample Network Layout.

41

42

C h a p t e r 2 * Creating an Addressing Plan for Fixed-Length Mask Networks

O n e definition of a r o u t e r is t h a t it is a device t h a t i n t e r c o n n e c t s networks. Routers and layer-3 switches operate by forwarding packets from one n e t w o r k to a n o t h e r so t h a t t h e p a c k e t gets one s t e p closer to its final d e s t i n a t i o n . E a c h i n t e r f a c e on a r o u t e r n e e d s a u n i q u e IP a d d r e s s . F u r t h e r m o r e , e a c h i n t e r f a c e ' s IP a d d r e s s m u s t b e l o n g to a different n e t w o r k or s u b n e t . P u t a n o t h e r way, e a c h r o u t e r i n t e r f a c e defines a n e t w o r k or s u b n e t . This l a s t s t a t e m e n t is t h e c a u s e of m u c h "weepin' a n d wailin'" on t h e p a r t of IP n e t w o r k administrators. Look a g a i n a t F i g u r e 2.1 in light of o u r r o u t e r s ' c o n f i g u r a t i o n n e e d s . R o u t e r l h a s four interfaces---one LAN i n t e r f a c e a n d t h r e e WAN i n t e r f a c e s . T h e r e f o r e R o u t e r l n e e d s four IP a d d r e s s e s , a n d e a c h of t h o s e a d d r e s s e s n e e d s to be in a different n e t w o r k or s u b net. Now look a t R o u t e r 2 . It h a s two i n t e r f a c e s ~ a LAN i n t e r f a c e a n d a WAN interface. Therefore, two a d d r e s s e s are n e e d e d , one in e a c h of two n e t w o r k s or s u b n e t s . T h e s a m e c a n be s a i d for t h e o t h e r two b r a n c h office r o u t e r s . Let's tally w h a t we h a v e so far. T h e H e a d q u a r t e r s r o u t e r n e e d s four a d d r e s s e s a n d e a c h of t h e b r a n c h r o u t e r s n e e d s two, for a total of t e n a d d r e s s e s . Does t h a t m e a n t h a t t h e r e are t e n s u b n e t s ? Look again: R o u t e r 1 a n d R o u t e r 2 are c o n n e c t e d to t h e s a m e s u b n e t (labeled B in F i g u r e 2.1). R o u t e r 1 s h a r e s c o n n e c t i o n s w i t h R o u t e r 3 a n d R o u t e r 4 in t h e s a m e way. So we see a total of s e v e n s u b n e t s : four are LANs a n d t h r e e are WAN c o n n e c t i o n s . Do y o u n e e d to allocate IP a d d r e s s r a n g e s for all of t h e m ? In general, t h e a n s w e r is yes. As w i t h m o s t topics in t h e IT i n d u s t r y , t h e p r e c i s e a n s w e r is m o r e c o m p l i c a t e d t h a n t h a t .

How Many IP Addresses Are Needed in Each Subnet? Now t h a t y o u k n o w h o w m a n y different s u b n e t s ( a d d r e s s ranges) y o u need, it's time to d e t e r m i n e , for e a c h s u b n e t , h o w m a n y devices n e e d a d d r e s s e s . T h e b a s i c guideline h e r e is t h a t e a c h i n t e r f a c e t h a t will b e "talking IP" n e e d s a n IP a d d r e s s . Here are s o m e e x a m p l e s :

Creating an Addressing Plan for Fixed-Length Mask Networks * Chapter 2

9

R o u t e r s : one IP a d d r e s s p e r i n t e r f a c e (see t h e n e x t s e c t i o n for a d i s c u s s i o n on unnumbered interfaces).

9 W o r k s t a t i o n s : g e n e r a l l y one a d d r e s s . 9

Servers: g e n e r a l l y one a d d r e s s u n l e s s t h e s e r v e r is multihomed (has m o r e t h a n one interface).

9

Printers: one a d d r e s s if t h e y are c o m m u n i c a t i n g w i t h a p r i n t s e r v e r via IP, or if t h e y h a v e a n i n t e g r a t e d p r i n t s e r v e r f e a t u r e (like t h e HP JetDirect). If t h e p r i n t e r is a t t a c h e d to t h e serial or parallel p o r t of a n o t h e r device, it d o e s n o t n e e d a n IP a d d r e s s .

9

Bridges: n o r m a l l y b r i d g e s do n o t c o m m u n i c a t e u s i n g IP, so t h e y do n o t n e e d a n a d d r e s s . However, if t h e b r i d g e is managed using an SNMP-based network management s y s t e m , it will n e e d a n a d d r e s s , b e c a u s e t h e d a t a collection a g e n t is a c t i n g a s a n IP host.

9

H u b s : s a m e a s bridges.

9

L a y e r - 2 s w i t c h e s : s a m e a s bridges.

9

L a y e r - 3 switches: s a m e a s r o u t e r s .

In T a b l e 2. I, y o u c a n see t h e n u m b e r of v a r i o u s devices on e a c h LAN of o u r s a m p l e o r g a n i z a t i o n .

Table 2.1 Devices in the Sample Network LAN

Devices

Headquarters

20 workstations, 2 servers, 1 managed hub, 1 network-attached printer, 1 router

Morganton Branch

11 workstations, 2 network-attached printers, 1 router 12 workstations, 1 router 5 workstations, 1 server, 1 router

Lenoir Branch Hickory Branch

Is t h e t a b l e c o m p l e t e ? No. W h a t ' s missing?. R e m e m b e r t h a t e a c h r o u t e r i n t e r f a c e n e e d s a n IP a d d r e s s , too. Also, w h a t a b o u t t h e WAN links?

43

44

Chapter 2

9Creating an Addressing Plan for Fixed-Length Mask Networks

Table 2.2 s u m m a r i z e s o u r a c t u a l needs, on a s u b n e t - b y - s u b n e t basis.

Table 2.2

Number of IP Addresses Needed

Subnet

IP A d d r e s s e s

Headquarters Morganton Lenoir Hickory WAN1 WAN2 WAN3

25 14 13 7 2 2 2

After a d d i n g the WAN links a n d r o u t e r a d d r e s s e s , we c a n say t h a t we n e e d 7 s u b n e t s , with a n y w h e r e from 2 to 25 IP a d d r e s s e s in each.

W h a t a b o u t Growth? D a t a n e t w o r k s s e e m to h a v e a life of their own. It is a r a r e n e t w o r k t h a t does n o t c h a n g e a n d grow. As y o u r u s e r s b e c o m e comfortable w i t h the a p p l i c a t i o n s t h e y u s e via the network, t h e y will s t a r t to a s k for m o r e features. You will p r o b a b l y find t h a t y o u will be a d d i n g u s e r s , applications, servers a n d i n t e r n e t w o r k i n g devices t h r o u g h o u t the life of y o u r network. W h e n y o u design a n a d d r e s s i n g plan, m a k e s u r e y o u allow e n o u g h r o o m for growth b o t h in the n u m b e r of s u b n e t s r e q u i r e d a n d t h e n u m b e r of a d d r e s s e s r e q u i r e d in e a c h s u b n e t . The a m o u n t of growth d e p e n d s a l m o s t entirely on y o u r organization. W h a t k i n d of e x p a n s i o n p l a n s does y o u r organization have? Are you m o r e likely to a d d u s e r s / s e r v e r s , or n e w b r a n c h offices? Are t h e r e a n y merge r s / a c q u i s i t i o n s a n t i c i p a t e d for y o u r f u t u r e ?


9Chapter 2

Choose the Proper Mask T h e n e x t s t e p in c r e a t i n g y o u r a d d r e s s i n g p l a n is c h o o s i n g a m a s k to be u s e d in y o u r n e t w o r k . Going b a c k to h o w a m a s k w o r k s , r e m e m b e r t h a t e a c h bit in t h e m a s k d e t e r m i n e s h o w t h e c o r r e s p o n d i n g bit in t h e IP a d d r e s s is i n t e r p r e t e d . W h e r e t h e r e is a z e r o - b i t in t h e m a s k , t h e c o r r e s p o n d ing bit of t h e IP a d d r e s s is p a r t of t h e i n t e r f a c e (host) identifier. W h e r e t h e r e is a o n e - b i t in t h e m a s k , t h e c o r r e s p o n d i n g bit of t h e IP a d d r e s s is p a r t of t h e n e t w o r k or s u b n e t identifier. So, t h e n u m b e r of z e r o - b i t s in t h e m a s k d e t e r m i n e s t h e n u m b e r of b i t s in t h e h o s t field of a n IP a d d r e s s , a n d t h u s t h e n u m b e r of p o s s i b l e IP a d d r e s s e s for e a c h s u b n e t . R e m e m b e r t h e f o r m u l a 2n-2 (where n is t h e n u m b e r of bits)? W o r k i n g b a c k w a r d s , y o u c a n determ i n e t h e n u m b e r of h o s t b i t s r e q u i r e d in t h e IP a d d r e s s given t h e n u m b e r of a d d r e s s e s n e e d e d . T h e i d e a is to find t h e s m a l l e s t v a l u e for n w h e r e t h e f o r m u l a 2n-2 gives y o u t h e n u m b e r of a d d r e s s e s needed.

For e x a m p l e , if y o u n e e d 25 a d d r e s s e s in a s u b n e t , t h e r e m u s t be a t l e a s t five h o s t b i t s in t h e IP a d d r e s s . T h a t is, t h e r e m u s t be a t l e a s t five z e r o s in t h e m a s k : 24-2 = 14 (not enough); 25-2 = 30 (enough). If y o u n e e d 1500 a d d r e s s e s , t h e r e m u s t be a t l e a s t 11 z e r o s in t h e m a s k (211-2 = 2046).

Consult the Tables If y o u ' v e b e e n given a "classfull" b l o c k of a d d r e s s e s to u s e ~ t h a t is, a n e n t i r e c l a s s A, B, or C n e t w o r k a d d r e s s ~ t h e n y o u c a n refer to t h e c o r r e s p o n d i n g s u b n e t t a b l e s a t t h e e n d of t h e c h a p t e r . T h o s e t a b l e s c a n g u i d e y o u to t h e p r o p e r m a s k to c h o o s e a n d h o w to allocate a d d r e s s r a n g e s . Let's look a t o u r s a m p l e n e t w o r k s h o w n in F i g u r e 2.1. After o u r a n a l y s i s , T a b l e 2.2 s h o w e d t h a t we n e e d to s u p p o r t s e v e n s u b n e t s , a n d t h e m a x i m u m n u m b e r of a d d r e s s e s n e e d e d in a n y s u b n e t is 25. Let's a s s u m e we've b e e n given c l a s s C n e t w o r k 1 9 2 . 1 6 8 . 1 5 3 . 0 to u s e in o u r o r g a n i z a t i o n .

45

46

Chapter 2


Table 2.3 is a t r a d i t i o n a l (RFC 950) class C s u b n e t t i n g table. C o n s u l t i n g this table, we c a n try to find a n a p p r o p r i a t e m a s k .

Table 2.3

# Subnet Bits

Class C Subnet Table # Host # Subnets Bits # Hosts

2

14

Mask

62

255.255.255.192

30

255.255.255.224

14

255.255.255.240

30

255.255.255.248

62

255.255.255.252

C a n y o u locate a m a s k t h a t will s u p p o r t seven s u b n e t s with 25 h o s t s e a c h ? No; a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 gives u s e n o u g h h o s t addresses, but not enough subnets, and 255.255.255.240 supports e n o u g h s u b n e t s , b u t n o t e n o u g h h o s t a d d r e s s e s . Now w h a t ? In t h i s s i t u a t i o n , y o u have four options: I. Use u n n u m b e r e d interfaces. 2. Ask for a bigger block of a d d r e s s e s . 3. Play s o m e tricks w i t h y o u r router. 4. Use " s u b n e t zero."

Use U n n u m b e r e d Interfaces M a n y p o p u l a r r o u t e r s t o d a y provide a f e a t u r e k n o w n as u n n u m bered interfaces or IP u n n u m b e r e d . This f e a t u r e c a n be u s e d w h e n t h e interface c o n n e c t s to a p o i n t - t o - p o i n t network, s u c h as a leased 5 6 k or T1 line. W h e n y o u u s e t h i s feature, the p o i n t - t o - p o i n t netw o r k does n o t n e e d IP a d d r e s s e s a n d c a n be omitted from the total n u m b e r of s u b n e t s . If we took a d v a n t a g e of this f e a t u r e in o u r s a m ple network, we w o u l d n e e d to provide a d d r e s s e s only for the LAN


9Chapter 2

s e g m e n t s . This c a n lead to s u b s t a n t i a l s a v i n g s in t h e n u m b e r of IP a d d r e s s e s n e e d e d . We'll look a t s o m e e x a m p l e s in t h e n e x t section. O n e d i s a d v a n t a g e of u s i n g u n n u m b e r e d i n t e r f a c e s is t h a t y o u c a n n o t directly a c c e s s t h o s e i n t e r f a c e s for t e s t i n g or m a n a g e m e n t p u r p o s e s . So y o u will h a v e to m a k e a choice for m a n a g e a b i l i t y or for a d d r e s s c o n s e r v a t i o n . In m o s t n e t w o r k s , t h e choice will be clear, b a s e d on t h e n e e d s of t h e o r g a n i z a t i o n . In o t h e r n e t w o r k s , y o u m a y j u s t h a v e to m a k e a j u d g e m e n t call. U s i n g u n n u m b e r e d i n t e r f a c e s in o u r e x a m p l e e l i m i n a t e s t h e n e e d for t h r e e s u b n e t s ~ t h e t h r e e WAN c o n n e c t i o n s . Now we n e e d only four s u b n e t s , a n d a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 w o u l d be a p p r o priate.

A s k for a Bigger Block of A d d r e s s e s If y o u h a d two c l a s s C a d d r e s s e s , y o u c o u l d u s e one for t h e H e a d q u a r t e r s LAN, a n d s u b n e t t h e o t h e r for t h e b r a n c h LANs a n d WAN links. For e x a m p l e , if y o u w e r e a l l o c a t e d two c l a s s C a d d r e s s e s ( 1 9 2 . 1 6 8 . 8 . 0 a n d 192.168.9.0), y o u c o u l d u s e 1 9 2 . 1 6 8 . 8 . 0 w i t h t h e m a s k 2 5 5 . 2 5 5 . 2 5 5 . 0 for t h e H e a d q u a r t e r s LAN. For t h e r e m a i n i n g LANs a n d WAN l i n k s we c a n s u b n e t 1 9 2 . 1 6 8 . 9 . 0 w i t h t h e m a s k 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 . This gives u s six s u b n e t s w i t h 30 h o s t a d d r e s s e s e a c h ~ p l e n t y to cover o u r n e e d s .

Router Tricks Most r o u t e r s allow y o u to a s s i g n m o r e t h a n one IP a d d r e s s to a n interface. This f e a t u r e is called multinetting or secondary interfaces. T h u s , y o u c a n a c t u a l l y s u p p o r t m o r e t h a n one s u b n e t on a single r o u t e r interface. In o u r s a m p l e n e t w o r k , y o u c o u l d u s e t h e m a s k 2 5 5 . 2 5 5 . 2 5 5 . 2 4 0 (which gives y o u 14 s u b n e t s a n d 14 h o s t a d d r e s s es), t h e n a s s i g n two a d d r e s s e s on t h e H e a d q u a r t e r s LAN i n t e r f a c e of t h e router.

47

48

Chapter 2 *


Now we have 28 a d d r e s s e s available on the H e a d q u a r t e r s LAN. Pretty h a n d y , right? Yes, b u t at a price. R e m e m b e r t h a t the I n t e r n e t Protocol (IP) d e t e r m i n e s local vs r e m o t e delivery u s i n g the IP a d d r e s s . If y o u r w o r k s t a t i o n is c o m m u n i c a t i n g with a h o s t on a n o t h e r s u b n e t (as d e t e r m i n e d b y y o u r m a s k a n d the target IP address), the d a t a g r a m s will be delivered to y o u r default g a t e w a y (router). T a k e a look at Figure 2.2.

Figure 2.2 Multiple subnets on a LAN segment.


9Chapter 2

W S 1 is on one IP n e t w o r k , a n d W S 2 a n d t h e s e r v e r a r e on a n o t h e r . T h e y (and t h e router) a r e all on a single LAN s e g m e n t (i.e., t h e y a r e all c o n n e c t e d to t h e s a m e E t h e r n e t hub). W h e n W S 2 w a n t s to c o m m u n i c a t e w i t h t h e server, t h e IP softw a r e in W S 2 d e t e r m i n e s t h a t , b a s e d on t h e m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 , t h e s e r v e r is on t h e s a m e IP n e t w o r k / s u b n e t . So, W S 2 will s e n d a p a c k e t directly to t h e server. W h a t h a p p e n s w h e n WS 1 w a n t s to t a l k to t h e s e r v e r ? Are t h e y on t h e s a m e IP n e t w o r k ? T h e y a r e n ' t , so W S 1 will s e n d t h e p a c k e t s to its d e f a u l t g a t e w a y (Router 1). R o u t e r l will t h e n f o r w a r d t h e p a c k ets to t h e p r o p e r n e t w o r k for t h e server. T h u s , e a c h p a c k e t t r a n s m i t t e d b e t w e e n W S 1 a n d t h e s e r v e r will a p p e a r on t h e E t h e r n e t s e g m e n t twice---once f r o m WS 1 to t h e r o u t e r a n d a g a i n f r o m t h e r o u t e r to t h e s e r v e r (and vice-versa).

U s e S u b n e t Zero To h e l p avoid p o t e n t i a l i n t e r o p e r a b i l i t y p r o b l e m s , c o n s e r v a t i v e n e t w o r k m a n a g e r s still follow t h e original s p e c i f i c a t i o n a n d c h o o s e n o t to u s e t h e all zeros a n d all o n e s s u b n e t s . If t h i s is t h e p a t h y o u c h o o s e to follow, t h e n y o u m u s t s u b t r a c t two f r o m t h e n u m b e r of s u b n e t s s h o w n in e a c h r o w of t h e t a b l e s a t t h e e n d of t h e c h a p t e r . In s o m e c a s e s , s u c h a s t h e e x a m p l e w e ' r e w o r k i n g on, it m a y be n e c e s s a r y to go a h e a d a n d u s e t h e a d d i t i o n a l s u b n e t s . In o u r e x a m p l e , y o u c o u l d c h o o s e to u s e 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 a s y o u r m a s k , w h i c h gives y o u e n o u g h h o s t a d d r e s s e s . By u s i n g s u b n e t zero, y o u w o u l d h a v e e n o u g h s u b n e t s to cover y o u r n e e d s .

49

50

Chapter 2


For m o r e practice c h o o s i n g the correct m a s k for y o u r network, please refer to the exercises at the e n d of the chapter.

"Previous versions of this document also noted that subnet numbers must be neither 0 nor-1, and must be at least two bits in length. In a ClDR world, the subnet number is clearly an extension of the network prefix and cannot be interpreted without the remainder of the prefix. This restriction of subnet numbers is therefore meaningless in view of ClDR and may be safely ignored."

Obtain IP Addresses If y o u have a l r e a d y b e e n given a block of a d d r e s s e s to use, a n d t h a t block is sufficient for y o u r needs, y o u m a y proceed to the n e x t step (calculating the a p p r o p r i a t e a d d r e s s r a n g e s for e a c h subnet). If y o u have n o t b e e n given a n y a d d r e s s e s , or if y o u d e t e r m i n e t h a t the a d d r e s s e s you've b e e n given are n o t sufficient, t h e n y o u will n e e d to o b t a i n one or m o r e blocks of a d d r e s s e s . You s h o u l d try t h e s e t h r e e s o u r c e s in order: I. Your organization's n e t w o r k m a n a g e r 2. Your I n t e r n e t Service Provider 3. The I n t e r n e t A d d r e s s Registry


9Chapter 2

From Your Organization's Network Manager In m o s t o r g a n i z a t i o n s of a n y size a t all, t h e r e is, or a t l e a s t t h e r e s h o u l d be, one p e r s o n (or a s m a l l group) r e s p o n s i b l e for a l l o c a t i n g IP a d d r e s s e s to i n d i v i d u a l s a n d g r o u p s . Your first s o u r c e of IP a d d r e s s es w o u l d be s u c h a r e s o u r c e .

From Your ISP If y o u r o r g a n i z a t i o n d o e s n o t h a v e a c e n t r a l a l l o c a t i o n r e s o u r c e , or if y o u are t h a t r e s o u r c e , t h e n y o u m a y h a v e to go o u t s i d e y o u r organiz a t i o n to o b t a i n t h e a d d r e s s e s . If y o u p l a n to c o n n e c t to t h e I n t e r n e t , t h e n y o u m u s t u s e e i t h e r g l o b a l l y - u n i q u e a d d r e s s e s , or p r i v a t e a d d r e s s e s a n d n e t w o r k a d d r e s s t r a n s l a t i o n (refer to C h a p t e r s 3 a n d 4). If y o u do n o t p l a n to c o n n e c t to t h e I n t e r n e t (really?), t h e n t e c h n i c a l l y , y o u c a n u s e a n y a d d r e s s e s y o u w a n t . However, RFC 1918 r e c o m m e n d s t h a t y o u u s e t h e a d d r e s s e s set a s i d e for s u c h p u r p o s e s . Again, refer to C h a p t e r 3 for details. To o b t a i n g l o b a l l y - u n i q u e a d d r e s s e s , y o u s h o u l d c o n t a c t y o u r I n t e r n e t service p r o v i d e r (ISP) a n d p r e s e n t y o u r r e q u e s t . You will be a l l o c a t e d a b l o c k of a d d r e s s e s t h a t is a s u b s e t of t h e b l o c k t h a t y o u r ISP h a s b e e n a s s i g n e d .

51

52

Chapter 2 * Creating an Addressing Plan for Fixed-Length Mask Networks

From Your Internet Registry The ultimate source for IP a d d r e s s e s is the I n t e r n e t Registry t h a t h a s jurisdiction in y o u r country. There are currently three regional registries: 9 ARIN: American Registry of I n t e r n e t N u m b e r s (www.arin.net). ARIN h a s jurisdiction for North America, S o u t h America, s u b - - S a h a r a n Africa, a n d the Caribbean. 9 RIPE NCC (www.ripe.net). E u r o p e a n Registry. 9 APNIC (www.apnic.net). Asia Pacific Registry. RFC 2050 describes in more detail the policies regarding IP a d d r e s s allocation.

Creating an Addressing Plan for Fixed-Length Mask Networks * Chapter 2

Calculate Ranges of IP Addresses for Each Subnet Let's recap. So far we have 9 Determined our addressing requirements 9 Chosen the proper m a s k 9 O b t a i n e d sufficient IP a d d r e s s e s . Now it's time to d e t e r m i n e the a p p r o p r i a t e r a n g e of a d d r e s s e s for each subnet.

Doing It the Hard Way If y o u find y o u r s e l f w i t h o u t a n y tools, y o u c a n always fall b a c k to the m a n u a l m e t h o d . T h e r e are s h o r t c u t s floating a r o u n d "on the grapevine" t h a t w o r k in c e r t a i n c i r c u m s t a n c e s , b u t n o t in others. The following p r o c e d u r e w o r k s with all c l a s s e s of a d d r e s s e s a n d all m a s k s . Let's apply the p r o c e d u r e to o u r s a m p l e network. First, identify the n u m b e r of locally a d m i n i s t e r e d bits in y o u r n e t w o r k a d d r e s s . In o u r example, we've b e e n a s s i g n e d a class C netw o r k (192.168.153.0). Class C n e t w o r k s have 24 n e t w o r k bits a n d 8 local bits. Second, m a k e a place for e a c h of the local bits---eight of t h e m in o u r example:

Next, u s i n g the m a s k , we d e s i g n a t e t h e s u b n e t bits a n d t h e h o s t bits. In o u r example, we c h o s e 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 as o u r m a s k . C o n s u l t i n g Table 2.3, we see t h a t this m a s k specifies t h r e e s u b n e t bits a n d five h o s t bits.

Subnet I

Host

53

54

Chapter 2


Now we c a n s t a r t p l u g g i n g in v a r i o u s c o m b i n a t i o n s of valid bit p a t t e r n s a s we l e a r n e d in C h a p t e r 2. T h r e e bits c a n be c o m b i n e d in 23 (8) c o m b i n a t i o n s a s listed: 000 001 010 011

100 101 110 111

In o u r e x a m p l e , we c h o s e to u s e s u b n e t zero, so we'll s t a r t there. Filling in t h e valid s u b n e t bits into o u r t e m p l a t e , we h a v e Subnet

I

Host

_o o_ o _ I x x x x x R e m e m b e r , for e a c h s u b n e t t h e r e are four m e a n i n g f u l a d d r e s s e s : 9 T h e s u b n e t a d d r e s s (host bits all zero) 9 T h e first a s s i g n a b l e IP a d d r e s s 9 T h e l a s t a s s i g n a b l e IP a d d r e s s 9 T h e b r o a d c a s t a d d r e s s (host bits all ones) So o u r first s u b n e t looks like this" Subnet

I

"'"

I

OOOLO OOOLO

00011 OOOll

Host 0 0 0 0 = 0 (subnetaddress) 0 0 0 1 = 1 ( s u b n e t + 1) 1 1 1 0 = 30 ( b r o a d c a s t - 1) 1 1 1 1 = 31 (broadcast address)

T h e first s u b n e t a d d r e s s is 1 9 2 . 1 6 8 . 1 5 3 . 0 , t h e r a n g e of a d d r e s s es a s s i g n a b l e to v a r i o u s devices is 1 9 2 . 1 6 8 . 1 5 3 . 1 t h r o u g h 1 9 2 . 1 6 8 . 1 5 3 . 3 0 , a n d t h e b r o a d c a s t a d d r e s s for t h e s u b n e t is

192.168.153.31. If we r e p e a t t h e p r o c e s s for t h e o t h e r s u b n e t s , we s i m p l y u s e a different s u b n e t bit p a t t e r n for each. T h e s e c o n d s u b n e t w o u l d be c a l c u l a t e d a s follows:


Subnet 001 OOl

Host 0 0 0 0 0=32(subnetaddress) 0 0 0 0 1 = 3 3 ( s u b n e t + 1)

001 001

111 111

.

.

.

.

.

.

9Chapter 2

1 0 = 62 (broadcast- 1) 1 1 = 63 (broadcast address)

C o n t i n u i n g t h r o u g h all eight possible s u b n e t s , we c a n r i z e in Table 2.4.

summa-

Table 2.4 Summary of Addresses for the Example Network

Subnet Address

First Assignable

Last Assignable

Broadcast Address

192.168.153.0

192.168.153.1

192.168.153.30

192.168.153.31

192.168.153.32

192.168.153.33

192.168.153.62

192.168.153.63

192.168.153.64

192.168.153.65

192.168.153.94

192.168.153.95

192.168.153.96

192.168.153.97

192.168.153.126

192.168.153.127

192.168.153.128

192.168.153.129

192.168.153.158

192.168.153.159

192.168.153.160

192.168.153.161

192.168.153.190

192.168.153.191

192.168.153.192

192.168.153.193

192.168.153.222

192.168.153.223

192.168.153.224

192.168.153.225

192.168.153.254

192.168.153.255

Table 2.4, along with all o t h e r possibilities for a n y n e t w o r k / m a s k c o m b i n a t i o n , c a n also be f o u n d at the e n d of this chapter.

Worksheets "Doing it the h a r d way" c a n be intellectually satisfying. However, w h e n y o u w a n t to get real w o r k done, s o m e simple tools c a n often save y o u a lot of time. For example, a series of t a b u l a r w o r k s h e e t s c a n serve the d u a l p u r p o s e of helping y o u calculate a d d r e s s r a n g e s

55

56

Chapter

2 *


a n d t r a c k i n g the a s s i g n m e n t of a d d r e s s e s to devices on y o u r network. Table 2.5 is the b e g i n n i n g few rows of a s u b n e t a s s i g n m e n t w o r k s h e e t . The full w o r k s h e e t (with a d d r e s s e s from zero to 255) is located at the end of the chapter.

Table 2.5 Subnet Assignment Worksheet

The w o r k s h e e t provides a visual reference to the a d d r e s s e s t h a t are valid for e a c h s u b n e t , r e g a r d l e s s of the m a s k used. For example, if we h a d c h o s e n a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 4 8 , the r a n g e of a d d r e s s e s available in the first s u b n e t w o u l d be 1 9 2 . 1 6 8 . 1 5 3 . 1 t h r o u g h 1 9 2 . 1 6 8 . 1 5 3 . 6 . The s e c o n d s u b n e t w o u l d c o n t a i n


9Chapter 2

1 9 2 . 1 6 8 . 1 5 3 . 9 t h r o u g h 1 9 2 . 1 6 8 . 1 5 3 . 1 4 . T h i s is t h e s a m e r e s u l t t h a t we w o u l d h a v e o b t a i n e d b y doing t h e c a l c u l a t i o n s "the h a r d way" or b y u s i n g t h e s u b n e t t i n g tables. T h e s e c o n d b e n e f i t of a w o r k s h e e t like t h i s is t h a t it is s e l f - d o c u m e n t i n g . As y o u a s s i g n s u b n e t s , y o u c a n write in t h e c o l u m n ( u n d e r t h e a p p r o p r i a t e m a s k ) descriptive i n f o r m a t i o n a b o u t t h e s u b n e t ~ w h e r e it is located, t e c h n i c a l c o n t a c t , etc. You c a n also t r a c k indiv i d u a l a d d r e s s a s s i g n m e n t s b y filling in i n f o r m a t i o n in t h e A s s i g n e d To c o l u m n . T h e w o r k s h e e t is also scaleable. E a c h w o r k s h e e t c a n d o c u m e n t a single c l a s s C n e t w o r k . If y o u h a v e to t r a c k a l l o c a t i o n s for a c l a s s B n e t w o r k , y o u c a n u s e one w o r k s h e e t to d o c u m e n t e a c h g r o u p of 2 5 6 a d d r e s s e s , t h e n one m o r e w o r k s h e e t to s h o w a s u m m a r y of t h e groups.

Subnet Calculators P r o b a b l y t h e e a s i e s t w a y to c a l c u l a t e a d d r e s s r a n g e s is to u s e a s u b n e t calculator. T h e r e a r e m a n y s u c h c a l c u l a t o r s available on t h e I n t e r n e t a s f r e e w a r e or s h a r e w a r e . (See t h e FAQs for s o u r c e s . ) U s i n g t h e IP S u b n e t C a l c u l a t o r from Net3 G r o u p ( w w w . n e t 3 g r o u p . c o m ) , we c a n c a l c u l a t e t h e a d d r e s s r a n g e s for t h e s u b n e t s in o u r s a m p l e n e t work. First, we tell t h e c a l c u l a t o r t h a t we a r e u s i n g n e t w o r k 1 9 2 . 1 6 8 . 1 5 3 . 0 (a c l a s s C a d d r e s s ) , a n d a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 a s s h o w n in F i g u r e 2.3. T h e n , we s i m p l y click on t h e Subnets/Hosts t a b to reveal t h e u s a b l e a d d r e s s r a n g e s a s s h o w n in F i g u r e 2.4. Again, t h e r e s u l t s s e e n h e r e m a t c h t h o s e o b t a i n e d m a n u a l l y a n d f r o m w o r k s h e e t s . By clicking t h e b u t t o n above t h e CIDR tab, t h e c a l c u l a t o r will copy t h e t a b l e s h o w n to t h e W i n d o w s clipboard. You c a n t h e n p a s t e t h e t a b l e into a s p r e a d s h e e t or o t h e r tools for f u r t h e r manipulation.

57

58

Chapter 2 * Creating an Addressing Plan for Fixed-Length Mask Networks

Figure 2.3 IP Subnet Calculator.

Allocate Addresses to Devices We've finally arrived at t h e goal of the e x e r c i s e ~ t o allocate individu a l a d d r e s s e s to the IP devices in o u r network.

Assigning Subnets The first step is to a s s i g n s u b n e t s to a p p r o p r i a t e n e t w o r k s e g m e n t s . Revisiting o u r n e t w o r k s e g m e n t s (from Table 2.2) we c a n n o w a d d a t h i r d c o l u m n for the s u b n e t s a s s i g n e d to e a c h s e g m e n t , as s h o w n in Table 2.6.


9Chapter 2

Figure 2.4 Assignable address ranges.

Is t h i s t h e only w a y to a s s i g n the s u b n e t s ? Absolutely not: Pick a n y of t h e eight s u b n e t s a n d a s s i g n t h e m to a n y of t h e seven netw o r k s e g m e n t s . Technically, it m a k e s no difference at all w h i c h s u b n e t is a s s i g n e d to w h i c h s e g m e n t . The only factor to c o n s i d e r h e r e is e a s e of u s e a n d d o c u m e n t a t i o n . Notice t h a t s u b n e t zero w a s allocated to one of t h e WAN links. Since we c a n ' t be totally conservative h e r e ~ w e m u s t u s e s u b n e t zero, we'll allocate it to a n e t w o r k s e g m e n t t h a t is l e a s t likely to have i n t e r o p e r a b i l i t y p r o b l e m s . The idea h e r e is t h a t m o s t r o u t e r s p u r c h a s e d in t h e l a s t few y e a r s do s u p p o r t t h e s u b n e t zero f e a t u r e without any problems.

59

60

Chapter 2


Table 2.6 Subnet Assignment Subnet

IP Addresses

Subnet(s)

Headquarters

25

192.168.153.32

Morganton

14

192.168.153.64

Lenoir

13

192.168.153.96

Hickory

192.168.153.128

WAN1

192.168.153.160

WAN2

192.168.153.192

WAN3

192.168.153.0

Assigning Device Addresses Once you've assigned s u b n e t s to the various n e t w o r k segments, it's time to assign individual a d d r e s s e s to devices t h a t need them. Here again is where the w o r k s h e e t s come in handy. Let's assign a d d r e s s es for the Hickory s u b n e t in our sample network. Table 2.7 contains a n o t h e r excerpt from the a d d r e s s a s s i g n m e n t worksheet.

Table 2.7 Subnet Assignment Worksheet~Hickory


9Chapter 2

Again, t h e r e is no o n e correct w a y to do t h e s e a s s i g n m e n t s ~ i t ' s u p to you. T h e r e are basically t h r e e schools of t h o u g h t on the m a t ter: s e q u e n t i a l allocation, reserved a d d r e s s e s , a n d "grow t o w a r d s the middle."

Sequential Allocation In Table 2.7, we s i m p l y a s s i g n e d the n e x t available IP a d d r e s s to e a c h device w i t h o u t too m u c h r e g a r d to the type or f u n c t i o n of the device. The a d v a n t a g e s to this a p p r o a c h are flexibility, a n d no w a s t ed a d d r e s s e s . The d i s a d v a n t a g e s include no order or s c h e m e of a s s i g n m e n t , a n d no w a y to d e t e r m i n e the f u n c t i o n of the device b a s e d on its a d d r e s s .

Reserved Addresses The s e c o n d a p p r o a c h c o n s i s t s of reserving a r a n g e of a d d r e s s e s in e a c h s u b n e t for v a r i o u s functions. For example,

Routers: Servers: Misc: Workstations:

first three addresses next five addresses next five addresses (printer, smart hubs, etc.) all remaining addresses.

The a d v a n t a g e h e r e is t h a t y o u (and y o u r s u p p o r t stafI) c a n readily d e t e r m i n e the k i n d of device b a s e d on its a d d r e s s . Conversely, given a device, you c a n d e t e r m i n e its a d d r e s s . The m a i n d i s a d v a n t a g e is t h a t the reserved a d d r e s s e s c a n go u n u s e d , while t h e r e m a y be a n e e d for m o r e a d d r e s s e s in o t h e r f u n c t i o n a l groups.

Grow Towards the Middle The t h i r d t e c h n i q u e is to a s s i g n the m a i n s u b n e t r o u t e r the first available a d d r e s s on the s u b n e t , t h e n a s s i g n the n e x t h i g h e r a d d r e s s e s in s e q u e n c e to o t h e r i n t e r n e t w o r k i n g a n d s u p p o r t devices. W o r k s t a t i o n s are a s s i g n e d a d d r e s s e s from the top of t h e a d d r e s s r a n g e down, as needed.

61

62

Chapter 2


This t e c h n i q u e allows all available a d d r e s s e s to be used, while p r e s e r v i n g s o m e kind of f u n c t i o n a l consistency. Use the t e c h n i q u e with w h i c h y o u are m o s t comfortable. M a n y a d m i n i s t r a t o r s u s e a c o m b i n a t i o n of the t h r e e t e c h n i q u e s .

Document Your Work C o n g r a t u l a t i o n s ! You've completed the a s s i g n m e n t of IP a d d r e s s e s to all the n e t w o r k e d devices t h a t n e e d t h e m . Time to r e l a x ~ a l m o s t .

Keeping Track of What You've Done You've s p e n t quite a bit of time so far working out the details of this project. A small additional i n v e s t m e n t of time c a n yield big dividends down the road. Yes, we're talking a b o u t d o c u m e n t a t i o n ~ a g a i n . If you've u s e d the w o r k s h e e t m e t h o d of allocation a d d r e s s e s , t h e n y o u r w o r k is done. If y o u u s e d a n IP c a l c u l a t o r or the b a c k of a n a p k i n , y o u s h o u l d p r o b a b l y t r a n s f e r y o u r w o r k to s o m e t h i n g m o r e permanent.

Paper At t h e very least, write d o w n w h a t y o u have done: 9 A d d r e s s Blocks o b t a i n e d 9 Mask chosen 9 Subnets assigned 9 IP a d d r e s s e s a s s i g n e d (and to whom) Keep y o u r n o t e s w h e r e t h e y c a n be u p d a t e d w h e n t h i n g s change.

Spreadsheets With a little work, y o u c a n create a significant s o u r c e of i n f o r m a t i o n b y p u t t i n g y o u r a s s i g n m e n t d a t a into a s p r e a d s h e e t . Create c o l u m n s for:


9Chapter 2

9 IP a d d r e s s 9 Date a s s i g n e d 9 A s s i g n e d to 9 C o n t a c t i n f o r m a t i o n (phone, fax, e-mail) 9 Device type M a n y s p r e a d s h e e t a p p l i c a t i o n s provide for a simple d a t a e n t r y form to a s s i s t in loading the information. T h r o u g h o u t t h e life of y o u r n e t w o r k y o u c a n query, sort, a n d r e p o r t on i n f o r m a t i o n in the s p r e a d s h e e t to give y o u a s s i g n m e n t s by n a m e , by a d d r e s s , by type, by date, a n d so on. W h e n the time c o m e s for a n u p g r a d e , w o u l d n ' t it be nice to have a w a y to identify quickly the a d d r e s s e s a n d locations of all y o u r r o u t e r s ?

Databases J u s t a b o u t a n y t h i n g y o u c a n do with a s p r e a d s h e e t , y o u c a n do with a d a t a b a s e application as well. Most d a t a b a s e software will allow y o u to create i n p u t forms with d a t a validation to help keep errors out, a n d m o s t provide r e p o r t - w r i t i n g capability to p r o d u c e s t a n d a r d a n d a d hoc reports. The IP a d d r e s s allocation d a t a b a s e does n o t have to be very s o p h i s t i c a t e d to be effective. A simple o n e - t a b l e d a t a b a s e in Microsoft Access, for example, c a n provide a p p r o p r i a t e i n f o r m a t i o n for a very large organization. M a n y n e w Network M a n a g e m e n t a p p l i c a t i o n s n o w on the m a r k e t provide a s s e t m a n a g e m e n t f u n c t i o n s w h e r e n e t w o r k e d devices are tracked. Use t h e s e facilities to record allocation a n d c o n t a c t inform a t i o n as listed earlier.

In Any Case No n e t w o r k is static. U s e r s come a n d go; a p p l i c a t i o n s j u s t s e e m to keep coming. T e c h n o l o g y c h a n g e s . M a n y n e t w o r k d e s i g n e r s are replacing r o u t e r s with l a y e r - 2 a n d l a y e r - 3 switches. Keep y o u r docu m e n t a t i o n u p to date! O u t of date i n f o r m a t i o n is, in s o m e ways, w o r s e t h a n no i n f o r m a t i o n at all.

63

64

Chapter 2


Summary In this chapter, we have p r e s e n t e d the steps required to develop an effective IP addressing plan for networks with fixed m a s k s . First, we determined the n u m b e r of IP a d d r e s s e s and s u b n e t s actually needed, with some hints for squeezing the m o s t out of the a d d r e s s e s you've been given. Using s u b n e t t i n g tables, we determined the proper m a s k to use. Next came the calculation of appropriate a d d r e s s ranges using m a n u a l techniques, worksheets, or s u b n e t calculators. We t h e n assigned IP a d d r e s s e s to those devices t h a t needed them. Finally, we d i s c u s s e d the importance of properly d o c u m e n t i n g our work.


9Chapter 2

Q: W h e r e c a n I get a s u b n e t c a l c u l a t o r ?

A: URLs:

http: //www. net3group, com/download, asp

Downloadable stand-alone application that runs under W i n 95/98/NT.

http ://www. cisco, com/techtools / ip_addr .html

Online calculator. http: //www. ccci. com/subcalc/download.htm

J a v a - b a s e d calculator. http ://www. ajw. com/ipcalc .htm

C a l c u l a t o r for t h e P a l m Pilot.

Exercises 1. You've b e e n a s s i g n e d a " / 2 3 " CIDR block. How m a n y t r a d i t i o n a l class C n e t w o r k s does t h a t r e p r e s e n t ? W h a t is t h e e q u i v a l e n t n e t m a s k ? How m a n y total h o s t a d d r e s s e s does t h e block cover? 2. W h a t m a s k w o u l d y o u u s e if y o u n e e d e d to divide a class B n e t w o r k into 2 0 0 s u b n e t s with 100 a d d r e s s e s n e e d e d in e a c h ? 3. Two r o u t e r s are c o n n e c t e d via a leased T1 line. Do t h e s e r o u t e r i n t e r f a c e s n e e d a n IP a d d r e s s ? W h y or w h y n o t ? 4. U n d e r w h a t c i r c u m s t a n c e s w o u l d y o u u s e a f i x e d - l e n g t h subnetting scheme? 5. Using a n y m e t h o d y o u prefer, c a l c u l a t e t h e a d d r e s s r a n g e s for all the s u b n e t s c r e a t e d in a class B n e t w o r k u s i n g t h e m a s k 2 5 5 . 2 5 5 . 2 5 4 . 0 . Use t h e all-zeros a n d a l l - o n e s s u b n e t s . 6. W h a t size CIDR block w o u l d y o u a s k for if y o u n e e d e d 4 2 0 s u b n e t s with 170 h o s t a d d r e s s e s e a c h ? 7. W h y c a n ' t y o u u s e a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 5 4 ? 8. W h y s h o u l d y o u b o t h e r d o c u m e n t i n g y o u r a d d r e s s a s s i g n m e n t s ?

65

66

Chapter 2

*


1. 2 class C's; 2 5 5 . 2 5 5 . 2 5 4 . 0 ; 512 a d d r e s s e s 0

There are two possible masks: 255.255.255.0 and 255.255.255.128. Since we were not given any information about growth, we need to pick the one most likely to meet our future needs. The most c o m m o n choice would probably be 255.255.255.0 since it is easy to use and allows some growth in the n u m b e r of s u b n e t s and significant growth in the size of each subnet.

3. In general, the a n s w e r is yes. However, if the r o u t e r s s u p p o r t t h e "IP u n n u m b e r e d " feature, t h e y do not. 4. You m u s t use a fixed-length subnetting scheme if you are using a routing protocol t h a t does not support variable--length subnetting. Of the c o m m o n IP routing protocols in use today, RIP (v. 1) and Cisco's IGRP require fixed-length subnetting. RIP2, EIGRP, and OSPF s u p p o r t variable-length subnetting. When using those protocols, you st///may w a n t to choose fixed-length subnetting for simplicity. 5.

128 s u b n e t s as f o l l o w s : N . N . 0 . 0 - N.N. 1.255 N.N.2.0 - N.N.3.255 N.N.4.0-

N.N.5.255

, I ~

N.N.254.0 - N.N.255.255 0

B a s e d on the 1 7 0 - a d d r e s s r e q u i r e m e n t , y o u w o u l d choose a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 . In o t h e r words, y o u n e e d eight bits to cover t h e h o s t a d d r e s s e s . You n e e d a n o t h e r nine bits to cover the n u m b e r of s u b n e t s for a total need of 17 bits. Since a n IP a d d r e s s is 32 bits long, a n d y o u n e e d 17 for y o u own use, y o u w o u l d a s k for a (32 - 17) or 15-bit block ( / 1 5 in CIDR notation).

7. The h o s t field n e e d s to be at least two bits long. A h o s t field of all zeros d e n o t e s the s u b n e t a d d r e s s , a n d a h o s t field of all ones is the b r o a d c a s t a d d r e s s for t h a t s u b n e t . 8. To help with f u t u r e a s s i g n m e n t s , to a s s i s t with t r o u b l e s h o o t i n g activities, to help with u p g r a d e s , to p r e v e n t duplicate a d d r e s s assignments.

C r e a t i n g a n A d d r e s s i n g Plan f o r F i x e d - L e n g t h M a s k N e t w o r k s

9C h a p t e r 2

Subnetting Tables Note t h a t these tables comply with RFC.

Class A Subnetting Table # Subnet Bits 1

2 3

8,388,608

255.128.0.0

4 t 8

22 21

'4,194,302 2,097,150

255.192.0.0 255.224.0.0

2

9

Mask

,

16

20

1,048,574

255.240.0.0

5

32

19

524,286

255.248.0.0

6

64

18

262,142

255.252.0.0

7

128

17

131,070

255.254.0.0

8

256

16

65,534

255.255.0.0

9

512

15

32,766

255.255.128.0

10

1,024

14

16,382

255.255.192.0

11

2,048

13

8,190

255.255.224.0

12

4,096

12

4,094

255.255.240.0

13

8,192

11

2,046

255.255.248.0

14

16,384

10

1,022

255.255.252.0

15

32,768

9

510

255.255.254.0

65,536

8

254

255.255.255.0

131,072

7

126

18

1262,144

6

62

19

524,288

5

30

255.255.255.224

2O

] ,048,576

4

14

255.255.255.240

6

255.255.255.248

2

255.255.255.252

17

9

23

# Subnets

4

16

|

!

# Host Bits # Hosts 9 ,

21 22

,

2,097,152 4,194,304

3 2

i

|

9

255.255.255.128 255.255.255.192

9

|

67

68

Chapter 2 ~ Creating an Addressing Plan for Fixed-Length Mask Networks

Subnet

First Host

Last Host

Subnet Broadcast

1 Bit (255.128.0.0) N.0.0.1 N.0.0.0 N. 128.0.1 N.128.0.0

N.127.255.254 N.255.255.254

2 Bits (255.192.0.0) N.0.0.0 N.0.0.1 N.64.0.0 N.64.0.1 N.128.0.0 N.128.0.1 N.192.0.0 N.192.0.1

N.63.255.254 N.127.255.254 N.191.255.254 N.255.255.254

N.63.255.255 N.127.255.255 N.191.255.255 N.255.255.255

3 Bits (255.224.0.0) N.0.0.0 N.0.0.1 N.32.0.0 N.32.0.1

N.31.255.254 N.63.255.254

N.31.255.255 N.63.255.255

N.192.0.0 N.224.0.0

N.223.255.254 N.255.255.254

N.223.255.255 N.255.255.255

N.15.255.254 N.31.255.254

N.15.255.255 N.31.255.255

N.239.255.254 N.255.255.254

N.239.255.255 N.255.255.255

5 Bits (255.248.0.0) N.0.0.0 N.0.0.1 N.8.0.0 N.8.0.1

N.7.255.254 N.15.255.254

N.7.255.255 N.15.255.255

N.240.0.0 N.248.0.0

N.247.255.254 N.255.255.254

N.247. 255.255 N.255.255.255

N.3.255.254 N.7.255.254

N.3.255.255 N.7.255.255

N.192.0.1 N.224.0.1

4 Bits (255.240.0.0) N.0.0.0 N.0.0.1 N.16.0.0 N.16.0.1 9

~

N.127.255.255 N.255.255.255

,

N.224.0.0 N.240.0.0

N.224.0.1 N.240.0.1

N.240.0.1 N.248.0.1

6 Bits (255.252.0.0) N.0.0.0 N.0.0.1 N.4.0.0 N.4.0.1


N.248.0.0 N.252.0.0

N.248.0.1 N.252.0.1

9Chapter 2

N.251.255.254 N.255.255.254

N.251.255.255 N.255.255.255

N.0.0.1 N.2.0.1

N.1.255.254 N.3.255.254

N.1.255.255 N.3.255.255

N.252.0.1 N.254.0.1

N.253.255.254 N.255.255.254

N.253.255.255 N.255.255.255

8 Bits (255.255.0.0) N.0.0.0 N.0.0.1 N.1.0.0 N.1.0.1

N.0.255.254 N.1.255.254

N.0.255.255 N.1.255.255

N.254.0.0 N.255.0.0

N.254.255.254 N.255.255.254

N.254.255.255 N.255.255.255

7 Bits (255.254.0.0) N.0.0.0 N.2.0.0 9

,

~

N.252.0.0 N.254.0.0

N.254.0.1 N.255.0.1

9 Bits (255.255.128.0) N.0.0.0 N.0.128.0 N.1.0.0 N.1.128.0

N.0.0.1 N.0.128.1 N.1.0.1 N.1.128.1

N.0.127.254 N.0.255.254 N.1.127.254 N.1.255.254

N.0.127.255 N.0.255.255 N.1.127.255 N.1.255.255

N.255.0.0 N.255.128.0

N.255.0.1 N.255.128.1

N.255.127.254 N.255.255.254

N.255.127.255 N.255.255.255

N.0.63.254 N.0.127.254 N.0.191.254 N.0.255.254 N.1.63.254 N.1.127.254

N.0.63.255 N.0.127.255 N.0.191.255 N.0.255.255 N.1.63.255 N.1.127.255

10 Bits (255.255.192.0) N.0.0.0 N.0.64.0 N.0.128.0 N.0.192.0 N.1.0.0 N.1.64.0

N.0.0.1 N.0.64.1 N.0.128.1 N.0.192.1 N.1.0.1 N.1.64.1

69

70

Chapter 2


N.255.128.0 N.255.192.0

N.255.191.254 N.255.255.254

N.255.191.255 N.255.255.255

N.0.0.1 N.0.32.1 N.0.64.1

N.0.31.254 N.0.63.254 N.0.127.254

N.0.31.255 N.0.63.255 N.0.127.255

N.255.192.1 N.255.224.1

N.255.223.254 N.255.255.254

N.255.223.255 N.255.255.255

N.0.0.1 N.0.16.1 N.0.32.1

N.0.1 5.254 N.0.31.254 N.0.47.254

N.0.1 5.255 N.0.31.255 N.0.47.255

N.255.224.1 N.255.240.1

N.255.239.254 N.255.255.254

N.255.239.255 N.255.255.255

N.0.0.1 N.0.8.1 N.0.16.1

N.0.7.254 N.0.1 5.254 N.0.23.254

N.0.7.255 N.0.1 5.255 N.0.23.255

N.255.240.1 N.255.248.1

N.255.247.254 N.255.255.254

N.255.247.255 N.255.255.255

N.0.0.1 N.0.4.1 N.0.8.1

N.0.3.254 N.0.7.254 N.0.11.254

N.0.3.255 N.0.7.255 N.0.11.255

N.255.248.1 N.255.252.1

N.255.251.254 N.255.255.254

N.255.251.255 N.255.255.255

N.255.128.1 N.255.192.1

11 Bits (255.255.224.0) N.0.0.0 N.0.32.0 N.0.64.0 9

,

~

N.255.192.0 N.255.224.0

12 Bits (255.255.240.0) N.0.0.0 N.0.16.0 N.0.32.0 9

9

~

N.255.224.0 N.255.240.0

13 Bits (255.255.248.0) N.0.0.0 N.0.8.0 N.0.16.0 9

~

~

N.255.240.0 N.255.248.0

14 Bits (255.255.252.0) N.0.0.0 N.0.4.0 N.0.8.0 9

,

~

N.255.248.0 N.255.252.0


1 5 Bits (255.255.254.0) N.O.O.0 N.O.O.l N.O.2.0 N.0.2.1 N.0.4.0 N.0.4.1

Chapter 2

N.0.1.254 N.0.3.2 54 N.O. 5.2 54

N.0.1.255 N.0.3.255 N.0.5.255

N.255.253.254 N.255.255.254

N.255.253.255 N.255.255.255

N.0.0.254 N.0.1.254 N.0.2.254

N.0.0.255 N.0.1.255 N.0.2.255

N.255.254.254 N.255.255.254

N.2 5 5.2 54.2 55 N.255.255.255

N.0.0.126 N.O.O .2 54 N.O.l . I 2 6 N.0.1.254

N.0.0.127 N.0.0.255 N.O.l . I 27 N.0.1.255

N.255.255.126 N.2 55.255.254

N.255.255.127 N.255.255.255

N.0.0.62 N.0.0.126 N.0.0.190 N.0.0.254 N.0.1.62

N.0.0.63 N.0.0.127 N.0.1.191 N.0.1.255 N.0.1.63

N.255.255.190 N.255.255.254

N.255.255.191 N.255.255.255

... N.255.252.0 N.2 5 5.2 54.0

N.255.252.1 N.255.254.1

16 Bits (255.255.255.0) N.O.O.0 N.O.O.l N.O.l .O N.O.l.l N.0.2.0 N.0.2.1

... N.255.2 54.0 N.255.255.0

N.2 55.254.1 N.255.255.1

17 Bits (255.255.255.1 28) N.O.O.0 N.O.O.l N.0.0.128 N.0.0.129 N.O.l .O N.O.l .I N.O.l . I 2 8 N.0.1.129

... N.255.255.0 N.255.255.128

N.255.255.1 N.255.255.129

1 8 Bits (255.255.255.1 92) N.O.O.0 N.O.O.l N.O .O .64 N.0.0.65 N.0.0.128 N.0.0.129 N.0.0.192 N.0.0.193 N.O.l .I N.O.l .O

... N.255.255.128 N.255.255.192

N.255.255.129 N.255.255.193

71

72

Chapter 2


19 Bits (255.255.255.224) N.0.0.0 N.0.0.32 N.0.0.64 N.0.0.96

N.0.0.1 N.0.0.33 N.0.0.65 N.0.0.97

N.0.0.30 N.0.0.62 N.0.0.94 N.0.0.126

N.0.0.31 N.0.0.63 N.0.0.95 N.0.0.127

N.255.255.192 N.255.255.224

N.255.255.193 N.255.255.225

N.255.255.222 N.255.255.254

N.255.255.223 N.255.255.255

N.0.0.1 N.0.0.16 N.0.0.33

N.0.0.14 N.0.0.30 N.0.0.46

N.0.0.15 N.0.0.31 N.0.0.47

N.255.255.225 N.255.255.241

N.255.255.238 N.255.255.254

N.255.255.239 N.255.255.255

N.0.0.1 N.0.0.9 N.0.0.17

N.0.0.6 N.0.0.14 N.0.0.22

N.0.0.7 N.0.0.15 N.0.0.23

N.255.255.241 N.255.255.249

N.255.255.246 N.255.255.254

N.255.255.247 N.255.255.255

N.0.0.3 N.0.0.7 N.0.0.11

20 Bits (255.255.255.240) N.0.0.0 N.0.0.16 N.0.0.32 ~

N.255.255.224 N.255.255.240

21 Bits (255.255.255.248) N.0.0.0 N.0.0.8 N.0.0.16 ~

N.255.255.240 N.255.255.248

22 Bits (255.255.255.252) N.0.0.0 N.0.0.4 N.0.0.8

N.0.0.1 N.0.0.5 N.0.0.9

N.0.0.2 N.0.0.6 N.0.0.10

N.255.255.248 N.255.255.252

N.255.255.249 N.255.255.253

N.255.255.250 N.255.255.254

N.255.255.251 N.255.255.255


9Chapter 2

Class B Subnetting Table # Subnet Bits

# Subnets

# Host Bits # Hosts

Mask

1

2

15

32,766

255.255.128.0

2

4

14

16,382

255.255.192.0

3

8

13

8,190

255.255.224.0

4

16

12

4,094

255.255.240.0

5

32

11

2,046

255.255.248.0

6

64

10

1,022

255.255.252.0

7

128

9

510

255.255.254.0

8

256

8

254

255.255.255.0

9

512

7

126

255.255.255.128

10

1,024

6

62

255.255.255.192

11

2,048

5

30

255.255.255.224

12

4,096

4

14

255.255.255.240

13

8,192

3

6

255.255.255.248

14

16,384

2

2

255.255.255.252

Subnet

First Host

Last Host

Subnet Broadcast

1 Bit (255.255.128.0) N.N.0.0 N.N.0.1 N.N.128.0 N.N.128.1

N.N.127.254 N.N.191.254

N.N.127.255 N.N.191.255

2 Bits (255.255.192.0) N.N.0.0 N.N.0.1 N.N.64.0 N.N.64.1 N.N. 128.0 N.N. 128.1 N.N. 192.0 N.N. 1 9 2 . 1

N.N.63.254 N.N.127.254 N.N. 191.254 N.N.255.254

N.N.63.255 N.N.127.255 N.N. 191.255 N.N.255.255

73

74

Chapter 2


3 Bits (255.255.224.0) N.N.0.0 N.N.0.1 N.N 32.0 N.N.32.1

N.N.64.0 9

,

N.N.64.1

N.N.31.254 N.N.63.254 N.N.95.254

N.N.31.255 N.N.63.255 N.N.95.255

N.N. 1 9 2 . 1 N.N.224.1

N.N.223.254 N.N.255.254

N.N.223.255 N.N.255.255

N.N.16.1 N.N.32.1

N.N.1 5.254 N.N.31.254 N.N.47.254

N.N.1 5.255 N.N.31.255 N.N.47.255

N.N.224.1 N.N.240.1

N.N.239.254 N.N.255.254

N.N.239.255 N.N.255.255

N.N.7.254 N.N.1 5.254 N.N.23.254

N.N.7.255 N.N.1 5.255 N.N.23.255

N.N.247.254 N.N.255.254

N.N.247.255 N.N.255.255

N.N.8.1

N.N.3.254 N.N.7.254 N.N.11.254

N.N.3.255 N.N.7.255 N.N.11.255

N.N.248.1 N.N.252.1

N.N.251.254 N.N.255.254

N.N.251.255 N.N.255.255

,

N.N. 192.0 N.N.224.0

4 Bits ( 2 5 5 . 2 5 5 . 2 4 0 . 0 ) N.N.0.0 N.N.0.1

N.N 16.0 N.N.32.0 9

~

,

N.N.224.0 N.N.240.0

5 Bits ( 2 5 5 . 2 5 5 . 2 4 8 . 0 ) N.N.0.0 N.N.0.1 N.N 8.0 N.N.8.1 N.N. 16.0 N.N. 1 6 . 1 9

,

,

N.N.240.0 N.N.248.0

N.N.240.1 N.N.248.1

6 Bits ( 2 5 5 . 2 5 5 . 2 5 2 . 0 ) N.N.0.0 N.N.0.1 N.N 4.0 N.N.4.1

N.N.8.0 9

~

i

N.N.248.0 N.N.252.0


7 Bits (255.255.254.0) N.N.O.0 N.N.O.l N.N 2.0 N.N.2.1 N.N.4.0 N.N.4.1

Chapter 2

N.N.1.254 N.N.3.254 N.N. 5.254

N.N.1.255 N.N.3.255 N.N.5.255

N.N.2 53.2 54 N .N.255.254

N.N.2 53.255 N.N.255.255

N.N .0.254 N.N.1.254 N.N.2.254

N.N.0.255 N.N.1.255 N.N.2.255

N.N.2 54.254 N.N.255.254

N.N.254.255 N.N.255.255

N.N.0.126 N.N.0.2 54 N.N.1.126 N.N.1.254

N.N.0.127 N.N.0.255 N.N.1.127 N.N.1.255

N.N.255.126 N.N.255.254

N.N.255.127 N.N.255.255

N.N.0.62 N.N.0.126 N.N.0.190 N.N.0.254 N.N.1.62

N.N.0.63 N.N.0.127 N.N.O.191 N.N.0.255 N.N.1.63

N.N.255.190 N.N.2 5 5.254

N.N.255.191 N.N.255.255

... N.N.252.0 N. N.254.0

N.N.252.1 N.N.254.1

8 Bits (255.255.255.0) N.N.O.0 N.N.O.l N.N 1.0 N.N.l.l N.N.2.0 N.N.2.1

... N. N.2 54.0 N.N.255.0

N .N.2 54.1 N.N.255.1

9 Bits (255.255.255.1 28) N.N.O.0 N.N.O.l N.N 0.128 N.N.0.129 N.N.l.l N.N.l .O N.N.1.128 N.N.1.129

... N.N.255.0 N.N.255.128

N.N.255.1 N.N.255.129

10 Bits (255.255.255.192) N.N.O.0 N.N.O.l N.N 0.64 N.N.0.65 N.N 0.128 N.N.0.129 N.N.0.192 N.N.0.193 N.N.l .O N.N.l.l

... N.N.255.128 N.N.255.192

N.N.255.129 N.N.255.193

75

76

Chapter 2


11 Bits (255.255.255.224) N.N.0.0 N.N 0.32 N.N 0.64

N.N.0.1 N.N.0.33 N.N.0.65

N.N.0.30 N.N.0.62 N.N.0.94

N.N.0.31 N.N.0.63 N.N.0.95

N.N.255.192 N.N.255.224

N.N.255.192 N.N.255.225

N.N.255.222 N.N.255.254

N.N.255.223 N.N.255.255

N.N.0.1 N.N.0.17 N.N.0.33

N.N.0.14 N.N.0.30 N.N.0.46

N.N.0.15 N.N.0.31 N.N.0.47

N.N.255.225 N.N.255.241

N.N.255.238 N.N.255.254

N.N.255.239 N.N.255.255

N.N.0.1 N.N.0.9 N.N.0.17

N.N.0.6 N.N.0.14 N.N.0.22

N.N.0.7 N.N.0.1 5 N.N.0.23

N.N.255.241 N.N.255.249

N.N.255.246 N.N.255.254

N.N.255.247 N.N.255.255

12 Bits (255.255.255.240) N.N.0.0 N.N 0.16 N.N 0.32 9

,

~

N.N.255.224 N.N.255.240

13 Bits (255.255.255.248) N.N.0.0 N.N 0.8 N.N 0.16 9

~

~

N.N.255.240 N.N.255.248

14 Bits (255.255.255.252) N.N.0.0 N.N 0.4 N.N 0.8

N.N.0.1 N.N.0.5 N.N.0.9

N.N.0.2 N.N.0.6 N.N.0.10

N.N.0.3 N.N.0.7 N.N.0.11

N.N.255.248 N.N.255.252

N.N.255.249 N.N.255.253

N.N.255.250 N.N.255.254

N.N.255.251 N.N.255.255

,


9Chapter 2

Class C Subnetting Table # Subnet

Bits

# Host

Bits

# Hosts

Mask

1

126

255.255.255.128

2

62

255.255.255.192

3

30

255.255.255.224

Subnet

# Subnets

16

4

14

255.255.255.240

32

3

6

255.255.255.248

64

2

2

255.255.255.252

First Host

Last Host

Broadcast

1 Bit (255.255.255.128) N.N.N.0

N.N.N.1

N.N.N.128

N.N.N.129

Subnet

N.N.N.126 N.N.N.254

N.N.N.127 N.N.N.255

N.N.N.62 N.N.N. 126 N.N.N. 190 N.N.N.254

N.N.N.63 N.N.N. 127 N.N.N. 191 N.N.N.255

2 Bits (255.255.255.192) N.N.N.0 N. N.N.64 N. N. N. 128 N.N.N. 1 92

N.N.N.1 N.N.N.65 N.N.N. 129 N.N.N. 1 93

3 Bits (255.255.255.224) N.N.N.0 N.N.N.32 N.N.N.64

N.N.N.1 N.N.N.33 N.N.N.65

N.N.N.30 N.N.N.62 N.N.N.94

N.N.N.31 N.N.N.63 N.N.N.95

N. N.N.96 N.N.N. 128 N.N.N. 160

N.N.N.97 N.N.N. 129 N.N.N. 161

N.N.N. 126 N.N.N. 1 58 N.N.N. 190

N.N.N. 127 N.N.N. 1 59 N.N.N. 191

N.N.N. 192

N.N.N. 193

N.N.N.222

N.N.N.223

N.N.N.224

N.N.N.225

N.N.N.254

N.N.N.255

77

78

Chapter 2


4 Bits (255.255.255.240) N.N.N.0 N.N.N.l N.N.N.16 N.N.N.17 N.N.N.32 N.N.N.33

N.N.N.14 N.N.N.30 N.N.N.46

N.N.N.15 N.N.N.31 N. N. N.47

N.N.N.238 N.N.N.254

N.N.N.239 N.N.N.255

N.N.N.6 N.N.N.14 N.N.N.22

N.N.N.7 N.N.N.15 N.N.N.23

N. N.N.246 N.N.N .254

N.N.N .247 N.N.N.255

N.N.N.2 N.N.N.6 N.N.N.10

N.N.N.3 N.N.N.7 N.N.N.11

N.N.N.250 N.N.N .254

N.N.N.251 N.N.N.255

... N.N.N.224 N.N.N.240

N.N.N.225 N.N.N.241

5 Bits (255.255.255.248) N.N.N.0 N.N.N.l N.N.N.8 N.N.N.9 N.N.N.16 N.N.N.17

... N.N.N.240 N.N.N.248

N.N .N.241 N.N .N .249

6 Bits (255.255.255.252) N.N.N.0 N.N.N.l N.N.N .4 N.N.N.5 N.N.N.8 N.N.N.9

... N.N .N.248 N.N .N.2 52

N .N.N.249 N.N.N.253


9Chapter 2

Subnet Assignment Worksheet

Continued

79

80

Chapter 2


Continued


9Chapter 2

Continued

81

82

Chapter 2


Continued


9Chapter 2

Continued

83

84

Chapter 2


Continued


9Chapter 2

Continued

85

86

Chapter 2


88

Chapter 3 *

Private Addressing and Subnetting Large Networks

Introduction You've h e a r d it said: "We're r u n n i n g o u t of IP addresses!" Really?. In the IP (version 4) a r c h i t e c t u r e , we u s e 32-bit a d d r e s s fields. With 32-bits in o u r a d d r e s s e s , t h e r e are 232 u n i q u e a d d r e s s e s available. T h a t ' s over four billion a d d r e s s e s ! We k n o w t h a t the I n t e r n e t h a s experienced e x p o n e n t i a l g r o w t h over the last few years, b u t even with c o n t i n u e d growth, it's unlikely t h a t we'll see a n y w h e r e n e a r four billion m a c h i n e s on the I n t e r n e t a n y time soon. So w h e r e ' s the p r o b l e m ? The p r o b l e m exists in the g r a n u l a r i t y of a d d r e s s allocation. Prior to Classless I n t e r - D o m a i n Routing (CIDR), a d d r e s s e s were allocated in classful blocks. T h a t is, if y o u n e e d e d m o r e a d d r e s s e s t h a n a class C n e t w o r k provided, y o u got a class B n e t w o r k a d d r e s s ; if y o u n e e d e d m o r e t h a n a class B provided, y o u got a class A n e t w o r k a d d r e s s . T h o s e were the only t h r e e choices. (Not m a n y o r g a n i z a t i o n s a c t u a l l y got class A a d d r e s s e s , of course.) A l t h o u g h t h e r e are indeed over 4 billion u n i q u e IP a d d r e s s e s available with the c u r r e n t version of IP, the n u m b e r of u n i q u e netw o r k n u m b e r s is m u c h less. In fact, t h e r e are only 126 class A netw o r k s , a b o u t 16,000 class B n e t w o r k s , a n d a b o u t 2 million class C n e t w o r k s . This design h a s led to w i d e s p r e a d w a s t e of globallyu n i q u e IP a d d r e s s e s .

Strategies to Conserve Addresses In the 1970s, the a r c h i t e c t s of the I n t e r n e t envisioned a n i n t e r n e t w o r k with d o z e n s of n e t w o r k s a n d h u n d r e d s of nodes. They developed a design w h e r e a n y n o d e on the i n t e r n e t w o r k w a s r e a c h a b l e by a n y o t h e r node. B a c k then, no one could have g u e s s e d the effect n e w a p p l i c a t i o n s like t h e World Wide Web a n d vastly i n c r e a s e d b a n d w i d t h w o u l d have on the n u m b e r of people i n t e r e s t e d in participating in "the Net." On t h e I n t e r n e t today, t h e r e are t e n s of t h o u s a n d s of n e t w o r k s a n d millions of nodes. Unfortunately, the original


9Chapter 3

design h a s n o t scaled well. The i n c r e a s e d n u m b e r of n e t w o r k s joining t h e I n t e r n e t h a s s t r a i n e d r o u t e r technology, a n d the s h e e r n u m b e r of p a r t i c i p a n t s h a s s t r a i n e d the limits of IP a d d r e s s i n g as it w a s originally designed. S o m e c o m p r o m i s e s h a d to be m a d e to allow the I n t e r n e t to c o n t i n u e its growth. Several strategies have b e e n developed a n d i m p l e m e n t e d to help the I n t e r n e t c o m m u n i t y cope with its growing pains. T h e y help r e d u c e the load on the I n t e r n e t r o u t e r s a n d help u s u s e globallyu n i q u e IP a d d r e s s e s m o r e efficiently. T h e s e strategies include: 9 CIDR 9 Variable-Length S u b n e t M a s k i n g (VLSM) 9 Private A d d r e s s i n g

CIDR Classless I n t e r - D o m a i n R o u t i n g (CIDR), specified in RFCs 1517, 1518, a n d 1519, w a s i n t r o d u c e d in S e p t e m b e r 1993 as a w a y to r e d u c e r o u t e r table growth. As a side effect, it h a s h e l p e d r e d u c e the w a s t e of IP a d d r e s s e s by r e d u c i n g the g r a n u l a r i t y of allocation. Now, i n s t e a d of full class A, B, or C n e t w o r k s , o r g a n i z a t i o n s c a n be allocated a n y n u m b e r of a d d r e s s e s . (Normally, a d d r e s s e s are allocated in even p o w e r s of two to allow CIDR to realize its m a x i m u m benefit, b u t in reality, a n y n u m b e r of a d d r e s s e s c a n be allocated.) For example, if y o u n e e d e d 3 , 0 0 0 a d d r e s s e s for y o u r n e t w o r k , a single class C n e t w o r k (256 a d d r e s s e s ) w o u l d be insufficient. If, however, y o u were a s s i g n e d a class B n e t w o r k (65,536 addresses), t h e r e w o u l d be over 6 2 , 0 0 0 a d d r e s s e s wasted! With CIDR, y o u c a n be allocated a block of 4 , 0 9 6 a d d r e s s e s - - e q u i v a l e n t to 16 class C n e t w o r k s ( a / 2 0 in CIDR notation). This block of a d d r e s s e s will cover y o u r a d d r e s s i n g n e e d s now, allow r o o m for growth, a n d u s e global a d d r e s s e s efficiently. CIDR is covered in C h a p t e r 6.

89

90

Chapter 3 *


VLSM Variable-Length S u b n e t M a s k (VLSM) is a t e c h n i q u e u s e d to conserve IP a d d r e s s e s by tailoring the m a s k to e a c h s u b n e t . S u b n e t s t h a t n e e d m a n y a d d r e s s e s will u s e a m a s k t h a t provides m a n y a d d r e s s e s . T h o s e t h a t n e e d fewer a d d r e s s e s will u s e a different m a s k . The idea is to a s s i g n "just the right a m o u n t " of a d d r e s s e s to each subnet. M a n y o r g a n i z a t i o n s have p o i n t - t o - p o i n t WAN links. Normally, t h e s e links c o m p r i s e a s u b n e t with only two a d d r e s s e s required. O u r s u b n e t t i n g tables given in C h a p t e r 2 tell u s t h a t 2 5 5 . 2 5 5 . 2 5 5 . 2 5 2 is the a p p r o p r i a t e m a s k to u s e for t h o s e s u b n e t s . B u t t h a t m a s k w o u l d never do for a typical LAN w h e r e t h e r e are d o z e n s (if n o t h u n d r e d s ) of h o s t s in a s u b n e t . By u s i n g a r o u t i n g protocol t h a t s u p p o r t s V I ~ M , we c a n u s e a block of a d d r e s s e s m u c h m o r e efficiently. V I ~ M is explained in m o r e detail in C h a p t e r 5.

Private Addresses By far, t h e m o s t effective s t r a t e g y for conserving globaUy-unique (public) IP a d d r e s s e s involves n o t u s i n g a n y at all! If y o u r e n t e r p r i s e n e t w o r k will be u s i n g T C P / I P protocols, b u t will n o t be c o m m u n i c a t ing with h o s t s on the global Internet, y o u d o n ' t n e e d to u s e public IP a d d r e s s e s . The I n t e r n e t Protocol simply r e q u i r e s t h a t all h o s t s in the i n t e r c o n n e c t e d n e t w o r k have u n i q u e a d d r e s s e s . If the i n t e r n e t w o r k is limited to y o u r organization, t h e n the IP a d d r e s s e s n e e d only be u n i q u e w i t h i n y o u r organization. Today, m a n y (if n o t most) o r g a n i z a t i o n s w a n t to have at least s o m e ability to c o m m u n i c a t e over the Internet. Does t h a t m e a n t h e s e o r g a n i z a t i o n s m u s t u s e public a d d r e s s e s ? Yes it d o e s ~ b u t it does n o t m e a n t h a t all of the devices in t h a t n e t w o r k m u s t have public a d d r e s s e s . S u c h n e t w o r k s c a n still u s e private a d d r e s s e s a n d a t e c h n i q u e called Network A d d r e s s T r a n s l a t i o n (NAT) to convert t h o s e private (inside) a d d r e s s e s to public (outside) a d d r e s s e s . NAT is d i s c u s s e d in C h a p t e r 4.


9Chapter 3

Addressing Economics IPv6 is fixing the problem of the limited address space of IPv4. Until IPv6 is fully deployed, we m u s t make use of the IP addressing system we have. Sometimes, the networks we m u s t support are not IPaddress friendly. For example, consider the sample network in Figure 3.1.

Figure 3.1 A sample network.

In the n e t w o r k s h o w n in Figure 3.1, we have multiple I2kNs at the h e a d q u a r t e r s location a n d several b r a n c h offices t h a t e a c h have one LAN. The h e a d q u a r t e r s r o u t e r is acting as a "collapsed b a c k bone," c o n n e c t i n g all the h e a d q u a r t e r s LANs and, via leased lines, the b r a n c h office routers. The organization h a s b e e n a s s i g n e d class B a d d r e s s 172.16.0.0, w h i c h provides 6 5 , 5 3 6 u n i q u e a d d r e s s e s .

91

92

Chapter 3

9Private Addressing and

Subnetting Large Networks

As we m e n t i o n e d in C h a p t e r 2, the serial links c o n n e c t i n g r o u t e r s n e e d their own IP a d d r e s s e s . In a p o i n t - t o - p o i n t n e t w o r k s u c h as the dedicated leased lines s h o w n in Figure 3.1, e a c h of t h e links is a n individual s u b n e t .

Table 3.1 lists the v a r i o u s s u b n e t s a n d the a d d r e s s i n g requirem e n t s for each.

Table 3.1 Sample Network Addressing Needs

1

# Hosts 50 110 190 150

1

150

Branches

60

30

WAN Links

60

2

Location

# Subnets

Headquarters

1 1 1

In this example, the n e t w o r k is u s i n g RIP (version I) as the routing protocol, so e a c h s u b n e t m u s t u s e the s a m e m a s k . Using guidelines d i s c u s s e d in C h a p t e r 2, we identify the largest s u b n e t in o u r n e t w o r k . One of the s u b n e t s at the H e a d q u a r t e r s location n e e d s 190 a d d r e s s e s . C o n s u l t i n g t h e tables in C h a p t e r 2, we see t h a t


9Chapter 3

2 5 5 . 2 5 5 . 2 5 5 . 0 is t h e m o s t a p p r o p r i a t e m a s k to u s e b e c a u s e it provides 2 5 4 u n i q u e a d d r e s s e s in e a c h s u b n e t . T a b l e 3.2 s h o w s j u s t h o w inefficient it c a n be to u s e a single, fixed m a s k for all s u b n e t s .

Table 3.2 Sample Network Address Analysis

Location

# Subnets

Interfaces

Subnet Unused

Total Unused

Headquarters

1

50

204

204

1

110

144

144

1

190

64

64

150

104

104

150

104

104

1

Branches

60

30

224

13,440

WAN Lin ks

60

2

252

15,120

The H e a d q u a r t e r s s u b n e t s are sized appropriately, even allowing for some growth. The b r a n c h office s u b n e t s provide m a n y more a d d r e s s e s t h a n will actually be used. The biggest w a s t e occurs in the WAN links. Since the sample network is u s i n g point-to-point links between headq u a r t e r s a n d the b r a n c h e s , we will never need more t h a n two a d d r e s s e s in each subnet. If you add u p the n u m b e r s , there are a total of 2,570 a d d r e s s e s needed, b u t we are allocating 125 s u b n e t s with 254 a d d r e s s e s each for a total of 31,750 addresses. As you c a n see, we're not u s i n g our class B network a d d r e s s very efficiently. The situation is even worse t h a n it first appears. We see there are over 29,000 u n u s e d a d d r e s s e s in the s u b n e t s we are using; we're only u s i n g 125 of the possible 256 subnets available. If you include the other 131 s u b n e t s with 254 possible a d d r e s s e s each, we have a g r a n d total of 62,454 u n u s e d addresses. In other words, we're u s i n g j u s t u n d e r 4 percent of the total a d d r e s s e s provided by o u r class B network number. This inefficient u s e of a d d r e s s e s is one of the m a i n c a u s e s of IP a d d r e s s exhaustion. If we c o u l d u s e V I ~ M , t h e s u b n e t s w o u l d be sized m o r e a p p r o priately, b u t t h e l a r g e r p r o b l e m r e m a i n s . We w o u l d still be u s i n g only a b o u t 4 p e r c e n t of o u r total c l a s s B space.

93

94

Chapter 3



An Appeal RFC 1917, p u b l i s h e d in F e b r u a r y 1996, is titled "An Appeal to the I n t e r n e t C o m m u n i t y to R e t u r n U n u s e d IP Networks to the IANA." It cites the growing problem of IP a d d r e s s e x h a u s t i o n a n d a s k s ad min istrators to be good "netizens" a n d r e t u r n blocks of IP a d d r e s s e s to the I n t e r n e t Assigned N u m b e r s Authority for reallocation. It suggests three alternatives: Q

Q

0

If you a r e n' t going to connect to the public Internet, you don't need globally-addresses. Use private a d d r e s s e s instead. If you have a portable block of addresses, r e t u r n the block to the IANA a n d us e a d d r e s s e s supplied by y o u r u p s t r e a m I n t e r n e t Service Provider. If you have a large block of public addresses, b u t only need a small portion of them, r e t u r n the large block to IANA a n d r e q u e s t a smaller block of addresses. This would be the appropriate action for our example n e t w o r k considered earlier.

Public vs Private Address Spaces The I n t e r n e t Protocol requires t h a t each interface on a n e t w o r k h a s a u n i q u e address. If the scope of y o u r n e t w o r k is global, t h e n the a d d r e s s e s m u s t be globally-unique. S u c h is the case with the Internet. Since global u n i q u e n e s s m u s t be a s s u r e d , a centralized a u t h o r i t y m u s t be responsible for m a k i n g s u re IP a d d r e s s assignm e n t s are m a d e correctly a n d fairly. For the last few years, this h a s been the function of the IANA. The I n t e r n e t h a s be e n rapidly expanding in b o t h n u m b e r of connected n e t w o r k s a n d n u m b e r of new applications. The 1990s have seen b o t h the commercialization a n d the internationalization of the Internet. To meet the d e m a n d s of a growing I n t e r n e t co mmu n ity , the IANA is being replaced by the I n t e r n e t Corporation for Assigned Names a n d N u m b e r s {ICANN).


9Chapter 3

If a n o r g a n i z a t i o n w a n t s to u s e IP protocols a n d a p p l i c a t i o n s in its network, b u t h a s no i n t e n t i o n of c o n n e c t i n g its n e t w o r k to t h e global I n t e r n e t , t h e IP a d d r e s s e s it u s e s n e e d n o t be globally-unique. A n e t w o r k of this type is called a private network, a n d t h e a d d r e s s e s u s e d are called private a d d r e s s e s .

Can I Pick My Own? If y o u are deploying IP on a private network, y o u c a n u s e a n y IP a d d r e s s e s y o u wish, as long as y o u a d h e r e to t h e n o r m a l IP a d d r e s s i n g rules. Before y o u go crazy a n d u s e a n entire class A a d d r e s s for e a c h s u b n e t , c o n s i d e r t h e following possibilities: 1.

Most o r g a n i z a t i o n s will e v e n t u a l l y choose to i m p l e m e n t s o m e k i n d of c o n n e c t i o n to t h e I n t e r n e t ~ i f for no o t h e r r e a s o n t h a n to e x c h a n g e e-mail.

2.

T h e r e m a y be a m e r g e r or a c q u i s i t i o n in y o u r f u t u r e t h a t m i g h t r e q u i r e j o i n i n g y o u r n e t w o r k to one or m o r e o t h e r networks.

As a n example, s u p p o s e y o u n e e d e d a class C a d d r e s s for a s m a l l n e t w o r k t h a t will n o t be c o n n e c t e d to t h e I n t e r n e t (see F i g u r e 3.2). You c h o s e to u s e 2 0 7 . 4 6 . 1 3 0 . 0 as y o u r n e t w o r k a d d r e s s a n d configured all y o u r devices accordingly. As soon as y o u finish getting e v e r y t h i n g set up, y o u r b o s s decides to i m p l e m e n t I n t e r n e t email. You c o n s u l t y o u r friendly n e i g h b o r h o o d ISP w h o tells y o u n o t to worry. T h e y c a n u s e a trick called Network A d d r e s s T r a n s l a t i o n (see C h a p t e r 4) t h a t will allow y o u to keep u s i n g y o u r a d d r e s s e s a n d give y o u a c c e s s to t h e I n t e r n e t . Great! E v e r y t h i n g w o r k s j u s t fine except for one t h i n g ~ y o u c a n ' t a c c e s s www. microsoft, com.

95

96

Chapter

3



Figure 3.2 The danger of picking your own addresses. 1ou

If Your ISP (using NAT)

Microsoft www.microsoft.com

The class C a d d r e s s 2 0 7 . 4 6 . 1 3 0 . 0 h a s b e e n officially a s s i g n e d to Microsoft, w h i c h u s e s it in its Web server farm. W h e n y o u try to a c c e s s t h e Microsoft Web site, t h e DNS (Domain N a m e System) resolves t h e n a m e to IP a d d r e s s 2 0 7 . 4 6 . 1 3 0 . 1 4 . W h e n y o u r b r o w s e r s e n d s a n HTTP r e q u e s t to t h e t a r g e t a d d r e s s , the IP software t h i n k s (rightly so) t h a t the a d d r e s s is inside y o u r n e t w o r k a n d does n o t forw a r d it to t h e router. The l e s s o n h e r e is t h a t t h e r e is a r i s k in d r e a m i n g u p y o u r own IP a d d r e s s e s - - e v e n if y o u never i n t e n d to c o n n e c t to t h e global Internet.

RFC 1918

Private Network Addresses

In t h e m i d s t of t h e explosive I n t e r n e t g r o w t h in t h e early 1990s, RFC 1597 s u g g e s t e d a w a y to help conserve g l o b a l l y - u n i q u e IP a d d r e s s e s . The idea w a s to set aside t h r e e blocks of a d d r e s s e s t h a t


9Chapter 3

w o u l d n e v e r be officially allocated to a n y organization. T h e s e blocks could t h e n be u s e d in a n y a n d every private n e t w o r k w i t h o u t fear of d u p l i c a t i n g a n y officially a s s i g n e d IP a d d r e s s e s in o t h e r organizations.

In F e b r u a r y 1996, RFC 1597 w a s u p d a t e d a n d m a d e obsolete by RFC 1918, a n d w a s a s s i g n e d the "Best C u r r e n t Practice" s t a t u s .

The Three-Address Blocks RFC 1918 d e s i g n a t e s t h r e e r a n g e s of IP a d d r e s s e s as private: 9

10.0.0.0-10.255.255.255

9

172.16.0.0-172.31.255.255

9

192.168.0.0-192.168.255.255

The first of t h e s e a d d r e s s blocks is e q u i v a l e n t to a t r a d i t i o n a l class A a d d r e s s . In CIDR n o t a t i o n , it w o u l d be 1 0 . 0 . 0 . 0 / 8 . RFC 1918 calls it a 2 4 - b i t block of a d d r e s s e s b e c a u s e only 8 of the 32 bits is fixed; the o t h e r 24 bits are available for local a d m i n i s t r a t i o n . E i t h e r way, the r a n g e c o n t a i n s 1 6 , 7 7 7 , 2 1 6 u n i q u e a d d r e s s e s ~ e n o u g h to s u p p l y even the largest n e t w o r k s . The s e c o n d block is called a 2 0 - b i t block a n d is e q u i v a l e n t to 16 t r a d i t i o n a l class B n e t w o r k s , or a / 1 2 block in CIDR terminology. This block c o n t a i n s 1 , 0 4 8 , 5 7 6 a d d r e s s e s .

97

98

Chapter

3


9

Finally, the third block is k n o w n as a 16-bit block a n d is equivalent to 2 5 6 class C n e t w o r k s . This 16-bit prefix s u p p l i e s 6 5 , 5 3 6 different IP a d d r e s s e s . Table 3.3 s u m m a r i z e s the private a d d r e s s blocks defined by RFC 1918.

Table 3.3 Private IP Address Blocks

Address Block

Classful Equivalent

Prefix Length /8

Number of Addresses

10.0.0.010.255.255.255

1 class A 256 class B 65,536 class C

172.16.0.0172.31.255.255

16 class B 4,096 class C

/12

1,048,576

192.168.0.0192.168.255.255

1 class B 256 class C

/16

65,536

16,777,216

Considerations A n y o n e c a n u s e a n y of t h e a d d r e s s blocks in Table 3.3 in a n y netw o r k at a n y time. The m a i n t h i n g to r e m e m b e r is t h a t devices u s i n g t h e s e a d d r e s s e s will n o t be able to c o m m u n i c a t e with o t h e r h o s t s on t h e I n t e r n e t w i t h o u t s o m e k i n d of a d d r e s s t r a n s l a t i o n . Here are s o m e t h i n g s to t h i n k a b o u t w h e n deciding to u s e private a d d r e s s i n g in y o u r network:

N u m b e r of a d d r e s s e s . One of the m a i n benefits of u s i n g private a d d r e s s e s is t h a t y o u have plenty to w o r k with. Since y o u are n o t u s i n g globally-unique a d d r e s s e s (a scare resource), y o u d o n ' t n e e d to be conservative. In the e x a m p l e n e t w o r k s h o w n in Figure 3.1, y o u could u s e a n entire class B equivalent a d d r e s s block w i t h o u t feeling guilty. Even t h o u g h y o u w o u l d be u s i n g only 4 p e r c e n t of t h e available a d d r e s s e s , y o u are n o t h o a r d i n g a valuable commodity.


9Chapter 3

Security. Using private a d d r e s s e s c a n also e n h a n c e the s e c u r i t y of y o u r n e t w o r k . Even if p a r t of y o u r n e t w o r k is c o n n e c t e d to t h e Internet, no one o u t s i d e y o u r n e t w o r k will be able to r e a c h y o u r devices. Likewise, no one from inside y o u r n e t w o r k will be able to r e a c h h o s t s on the Internet. RFC 1918 specifies that: "...routing i n f o r m a t i o n a b o u t private n e t w o r k s shall n o t be p r o p a g a t e d on i n t e r - e n t e r p r i s e links, a n d p a c k e t s with private s o u r c e or d e s t i n a t i o n a d d r e s s e s s h o u l d n o t be f o r w a r d e d a c r o s s s u c h links. R o u t e r s in n e t w o r k s n o t u s i n g private a d d r e s s space, especially t h o s e of I n t e r n e t service providers, are expected to be configured to reject (filter out) r o u t i n g i n f o r m a t i o n a b o u t private n e t w o r k s . "

Limited scope. The r e a s o n y o u have all t h e s e a d d r e s s e s available is t h a t y o u r n e t w o r k will n o t be c o n n e c t e d to t h e global Internet. If, later, y o u w i s h to c o m m u n i c a t e over the Internet, y o u m u s t o b t a i n official (globally-unique a n d routable) a d d r e s s e s a n d either r e n u m b e r y o u r devices or u s e NAT.

Renumbering. Anytime y o u switch to or from private a d d r e s s i n g , y o u will n e e d all y o u r IP devices. M a n y w o r k s t a t i o n s to o b t a i n IP up rather than assigning

to r e n u m b e r (change the IP a d d r e s s of) o r g a n i z a t i o n s are setting u p their u s e r a d d r e s s e s a u t o m a t i c a l l y w h e n booting a fixed IP a d d r e s s to the w o r k s t a t i o n s .

99

100

Chapter 3

9Private Addressing and Subnetting Large Networks

This facility requires t h a t at least one Dynamic Host Configuration Protocol (DHCP) server be set u p for the organization. DHCP is described in RFC 2131 a n d d i s c u s s e d in more detail in C h a p t e r 7.

Joining Networks. If you join y o u r n e t w o r k with a n o t h e r t h a t h a s u s e d private addressing, you m a y find t h a t some devices have conflicting addresses. For example, let's say you chose to u s e the 24-bit block of private a d d r e s s e s (network 10). You assigned the a d d r e s s 10.0.0.1 to the first r o u t e r on the first subnet. Now you merge with a n o t h e r organization a n d m u s t join y o u r networks. Unfortunately, the a d m i n i s t r a t o r of the other n e t w o r k chose to assign a d d r e s s 10.0.0.1 to one of its routers. According to IP a d d r e s s i n g rules, b o t h devices c a n n o t u s e the s a m e address. Further, the two r o u t e r s are probably on different s u b n e t s , so not only do you have to assign a different a d d r e s s to the router, you m u s t assign different s u b n e t a d d r e s s e s as well. Again, the solutions include r e n u m b e r i n g a n d NAT.

Which to Use When According to RFC 1918: "If a suitable s u b n e t t i n g s c h e m e can be designed a n d is s u p p o r t e d by the e q u i p m e n t concerned, it is advisable to u s e the 24-bit block (class A network) of private a d d r e s s space a n d m a k e a n a d d r e s s i n g plan with a good growth path. If s u b n e t t i n g is a problem, the 16-bit block (class C networks), or the 20-bit block (class B networks) of private a d d r e s s space can be used." The concept of s u b n e t t i n g w as i n t r o d u c e d into the IP world in A u g u s t 1985 (RFC 950). Since m o s t IP software m o d u l e s in u s e today were developed after t h a t time, they do u n d e r s t a n d how to do subnetting. So go a h e a d a n d use the 10 n e t w o r k for private a d d r e s s i n g u n l e s s you have good r e a s o n s to do otherwise. By u s i n g the 24-bit block, you have 24 bits to play with w h e n designing a private a d d r e s s i n g scheme.


*

Chapter 3

Strategy for Subnetting a Class A Private Network W h e n it c o m e s to developing a n a d d r e s s i n g p l a n for a private network, the r u l e s are exactly the s a m e as for a n y o t h e r IP network. O u r goals for the a d d r e s s i n g p l a n are as follows: S i m p l i c i t y . We w a n t the p l a n to be as simple as possible so t h a t as m a n y people as possible c a n u n d e r s t a n d it. W h e n we look at the IP a d d r e s s of a p a r t i c u l a r device, we s h o u l d be able to easily d e d u c e w h a t k i n d of device it is a n d w h e r e it is in o u r n e t w o r k w i t h o u t h a v i n g to refer to v o l u m e s of d o c u m e n t a t i o n . E a s e of A d m i n i s t r a t i o n . We w a n t the p l a n to be e a s y to i m p l e m e n t a n d m a i n t a i n . The p l a n s h o u l d allow r o o m for a n t i c i p a t e d growth and, if possible, m a k e r o o m for u n a n t i c i p a t e d growth or o t h e r c h a n g e s . E f f i c i e n c y . As nice as it is for the p l a n to be u n d e r s t a n d a b l e by the h u m a n s t h a t have to m a i n t a i n it, the r o u t e r s have to live with the p l a n every time a p a c k e t n e e d s to be forwarded to a n o t h e r s u b n e t . Therefore, the p l a n s h o u l d n o t place a h e a v y b u r d e n on the r e s o u r c e s of o u r r o u t e r s . Ideally, the p l a n s h o u l d b u i l d in a d d r e s s i n g h i e r a r c h i e s t h a t allow the r o u t i n g t a b l e s to be k e p t at a relatively small size. Router

D o c u m e n t a t i o n . We w a n t to be able to describe the p l a n in a few s h o r t s t a t e m e n t s w i t h o u t a lot of e x p l a n a t i o n s . Following the guidelines of C h a p t e r 2, we n o w p r e s e n t a n e x a m ple of a large organization t h a t h a s decided to i m p l e m e n t private IP a d d r e s s i n g in its i n t e r n e t w o r k . The p r o c e d u r e is the s a m e ~ c h o o s e a m a s k , allocate the s u b n e t bits, a n d d e t e r m i n e the r a n g e of a d d r e s s es for e a c h s u b n e t .

101

102

Chapter

3



The Network The n e t w o r k t h a t we'll s t u d y h e r e is relatively stable. There are a b o u t 3 0 0 0 retail stores owned by the c o m p a n y a n d no store h a s m o r e t h a n 12 IP devices in it. Reports from m a n a g e m e n t c o n s u l t a n t s indicate t h a t this n u m b e r s h o u l d suffice for the m e d i u m t e r m . E a c h store is c o n n e c t e d to its regional d i s t r i b u t i o n c e n t e r via a l e a s e d p o i n t - t o - p o i n t line. T h e r e are c u r r e n t l y 18 regional d i s t r i b u t i o n centers, w i t h e a c h c e n t e r s u p p o r t i n g no m o r e t h a n 200 stores. D i s t r i b u t i o n c e n t e r s have two p h y s i c a l n e t w o r k s for a d m i n i s t r a t i o n , a n d one s u p p o r t i n g the w a r e h o u s e . The largest of the a d m i n LANs h a s 80 IP devices on it, a n d t h e w a r e h o u s e LAN n e e d s 120 a d d r e s s e s . E a c h d i s t r i b u t i o n c e n t e r is c o n n e c t e d b a c k to h e a d q u a r t e r s via two parallel T3 links. The h e a d q u a r t e r s c a m p u s h a s 14 LANs c o n n e c t e d by r o u t e r s to t h e c o r p o r a t e b a c k b o n e network. The largest of the h e a d q u a r t e r s LANs h a s 230 IP devices on it. Figure 3.3 s h o w s a high-level overview of the c o r p o r a t e network. We c a n s u m m a r i z e the a d d r e s s i n g n e e d s of the n e t w o r k in Table 3.4.

Table 3.4

Sample Network Addressing Analysis

F r o m the i n f o r m a t i o n in Table 3.4 we c a n o b t a i n the n u m b e r of s u b n e t s n e e d e d (7,305) a n d the n u m b e r of a d d r e s s e s n e e d e d in the l a r g e s t s u b n e t (230).

Private Addressing and Subnetting Large Networks Figure

9Chapter 3

3.3 A large network.

The Strategy There are m a n y correct solutions to this a d d r e s s i n g problem, a n d a r g u m e n t s c a n be m a d e for all of them. Since o u r first goal is simplicity, we'll try to keep the p l a n as simple as possible. Since all the

103

104

Chapter

3 *


software we're u s i n g u n d e r s t a n d s s u b n e t t i n g , we'll follow t h e advice given in RFC 1918 a n d u s e t h e 2 4 - b i t b l o c k ~ t h a t is, n e t w o r k 10. Now t h a t we k n o w we h a v e 24 b i t s to w o r k with, h o w s h a l l we allocate t h e m ? We look for c l u e s in t h e s t r u c t u r e of t h e n e t w o r k we are s t u d y i n g . T h e r e s e e m to be t h r e e levels of h i e r a r c h y : 9

Headquarters

9

Distribution Centers

9

Stores

C a n we s o m e h o w fit t h a t h i e r a r c h y into o u r a d d r e s s i n g s c h e m e ? Before we delve too deeply into this, we n e e d to decide a c o u p l e of t h i n g s . First, will we u s e fixed- or v a r i a b l e - l e n g t h s u b n e t m a s k s ? U s i n g t h e "keep it simple" strategy, let's try u s i n g t h e fixed m a s k a p p r o a c h , s i n c e it is e a s i e r to d e s i g n a n d m a i n t a i n . O u r n e x t s t e p is to decide on a m a s k to use. Looking a t o u r c l a s s A s u b n e t t i n g t a b l e s in C h a p t e r 2, we decide on 2 5 5 . 2 5 5 . 2 5 5 . 0 . C o u l d we h a v e p i c k e d a n o t h e r ? S u r e , b u t m o s t people w o u l d agree t h a t 2 5 5 . 2 5 5 . 2 5 5 . 0 is t h e e a s i e s t m a s k to w o r k with. T h e t a b l e s tell u s we n o w h a v e 6 5 , 5 3 5 s u b n e t s to w o r k with, e a c h s u p p l y i n g 2 5 4 a d d r e s s e s . This s h o u l d w o r k nicely. Now we h a v e o u r IP a d d r e s s s t r u c t u r e laid o u t before us: 9 N e t w o r k ID: 8 b i t s 9

S u b n e t ID: 16 b i t s

9

H o s t ID: 8 bits

S i x t e e n bits is r e p r e s e n t e d in d o t t e d d e c i m a l n o t a t i o n a s two d e c i m a l n u m b e r s . P e r h a p s we c a n r e d u c e t h e c o m p a n y n e t w o r k h i e r a r c h y to two levels: Region a n d Store. We c a n do t h i s if we call t h e h e a d q u a r t e r s "Region 0." U s i n g t h i s a p p r o a c h , we c a n try to m a k e o u r IP a d d r e s s e s look s o m e t h i n g like this:

IO.R.S.H


9Chapter 3

w h e r e R is t h e r e g i o n n u m b e r , S is t h e s t o r e n u m b e r , a n d H is t h e h o s t ID. If we c a n m a k e t h i s work, t h e IP a d d r e s s e s will be a l m o s t s e l f - d o c u m e n t i n g ~ a very d e s i r a b l e f e a t u r e indeed.

Address Assignment Let's get d o w n to b u s i n e s s . In T a b l e 3.3 we identified five different s u b n e t g r o u p s . Looking a t e a c h g r o u p , we m u s t decide on w h a t t h e IP a d d r e s s e s s h o u l d look like.

Table 3.5 Headquarters Subnets Description

Address Range

Backbone

10.0.0.1-10.0.0.254

LAN 1

10.0.1.1-10.0.1.254

LAN 2

10.0.2.1-10.0.2.254

LAN 14

10.0.14.1-10.0.14.254

The Headquarters LANs We s t a t e d t h a t we s h o u l d call t h e h e a d q u a r t e r s "Region 0." T h e r e a r e 15 LANs in t h i s g r o u p . Let's u s e 10.0.L.0 for t h i s g r o u p , w h e r e L is 0 for t h e b a c k b o n e , a n d 1 - 1 4 for t h e a d m i n i s t r a t i v e LANs. T h e LANs a t t h e h e a d q u a r t e r s l o c a t i o n a r e s u m m a r i z e d in T a b l e 3.5.

The WAN Links from Headquarters to the Distribution Centers Again, t h e r e a r e a n u m b e r of w a y s to a s s i g n t h i s g r o u p of a d d r e s s es. Let's u s e 1 0 . 1 0 0 + R . 0 . 0 a n d 1 0 . 2 0 0 + R . 0 . 0 for t h e two WAN l i n k s to e a c h r e g i o n a l d i s t r i b u t i o n center. Here, R is t h e r e g i o n n u m b e r . T a b l e 3.6 s u m m a r i z e s t h e s e a s s i g n m e n t s .

105

106

Chapter 3


Table 3.6 Headquarters WAN Links

Description

Addresses

HQ to Region 1

10.101.0.1 & 10.101.0.2 10.201.0.1 & 10.201.0.2

HQ to Region 2

10.102.0.1 & 10.102.0.2 10.202.0.1 & 10.202.0.2

9

,

.

HQ to Region 18

9

~

,

10.118.0.1 & 10.118.0.2 10.218.0.1 & 10.218.0.2

T h e D i s t r i b u t i o n C e n t e r I.ANs We d o n ' t w a n t to collide with the store LANs here, so we'll s t a r t o u r allocation from the top of the list. The t h r e e DC LANs will be a d d r e s s e d u s i n g the f o r m s 10.R.255.0, 10.R.254.0, a n d 10.R.253.0. T a b l e 3.7 s h o w s the plan.

Table 3.7 Distribution Center Subnets


9Chapter 3

T h e WAN L i n k s from the DC to t h e S t o r e s Following t h e lead of the HQ-DC links, the link from region R to store S will look like 10.100+R.S.0 (Table 3.8).

Table 3.8 Distribution Center WAN Links

T h e Store LANs Finally, we're d o w n to the largest group. Since this is the largest group, we'll m a k e t h e s e a d d r e s s e s as s t r a i g h t f o r w a r d as possible. As we s t a t e d earlier, the LAN in store S in region R will have the a d d r e s s 10.R.S.0. Table 3.9 s h o w s s o m e s a m p l e s of store LAN addresses.

107

108

Chapter 3 *


Table 3.9 Store Subnets Description

Address Range

Region 1, Store 1

10.1.1.1-10.1.1.254

Region 1, Store 2

10.1.2.1-10.1.2.254

Region 1, Store 200

10.1.200.1-1 0.1.200.254

Region 6, Store 107

10.6.107.1-10.6.107.254

Region 18, Store 5

10.18.5.1-10.18.5.254

Results T h e p l a n s e e m s to work. Here a g a i n a r e t h e goals we e s t a b l i s h e d earlier, a n d s o m e d i s c u s s i o n of h o w well o u r p l a n m e e t s t h e goals.

S i m p l i c i t y , ease of a d m i n i s t r a t i o n , and d o c u m e n t a t i o n . We're u s i n g t h e s a m e n e t m a s k ( 2 5 5 . 2 5 5 . 2 5 5 . 0 ) in every s u b n e t . We h a v e a single s t r u c t u r e for e a c h of t h e five t y p e s of s u b n e t s in o u r n e t w o r k . B e c a u s e we a r e u s i n g p r i v a t e a d d r e s s i n g , we h a v e p l e n t y of a d d r e s s i n g s p a c e to w o r k with. We h a v e u s e d t h i s s p a c e to give o u r a d d r e s s e s s o m e intelligence. S o m e n o t e w o r t h y f e a t u r e s of o u r p l a n are: I.

A n y a d d r e s s w i t h a zero in t h e s e c o n d b y t e refers to a device a t t h e h e a d q u a r t e r s location.

2.

Any a d d r e s s w i t h a t h r e e - d i g i t v a l u e in t h e s e c o n d b y t e refers to a WAN l i n k b e t w e e n a d i s t r i b u t i o n c e n t e r a n d e i t h e r a s t o r e (third b y t e > 0) or t h e h e a d q u a r t e r s l o c a t i o n (third b y t e = 0).

3.

All o t h e r a d d r e s s e s refer to devices on LANs e i t h e r in t h e DC or in a store.

Rou ter Efficiency. Will e a c h r o u t e r in t h e c o m p a n y ' s i n t e r n e t w o r k n e e d to list all 7 3 0 5 s u b n e t s ? We s u r e h o p e not! O u r a d d r e s s i n g s c h e m e n e e d s to allow for route s u m m a r i z a t i o n . To t a k e full a d v a n t a g e of r o u t e s u m m a r i z a t i o n a n d k e e p o u r r o u t i n g t a b l e s d o w n to t h e i r a b s o l u t e m i n i m u m size, t h e


9Chapter 3

s t r u c t u r e of o u r a d d r e s s e s n e e d s to follow exactly the a c t u a l h i e r a r c h y of p h y s i c a l c o n n e c t i o n s . U n f o r t u n a t e l y , this is n o t the case with the a d d r e s s i n g p l a n we have j u s t developed. Let's look again at the p l a n in Table 3.10. Table 3.10 Sample Network Address Structure Subnet Group

IP Address Structure

Headquarters LANs

10.0.1.0-10.0.15.0

HQ - DC links

10.100+R.0.0

DC LANs

10.R.253.0-10.R.255.0

DC- Store links

10.100+R.S.0

Store LANs

10.R.S.0

In the ideal case, the c o r p o r a t e r o u t e r w o u l d n e e d to h a v e only 19 entries: one for the c o r p o r a t e b a c k b o n e , a n d one for e a c h of the regions. To m a k e t h a t h a p p e n , all of the a d d r e s s e s a s s o c i a t e d with a region w o u l d have to s h a r e a c o m m o n prefix. T h a t is, t h e y m u s t all have t h e first several bits in c o m m o n . This is not the case in o u r plan. For example, the d i s t r i b u t i o n IdkN in region 5 w o u l d have the a d d r e s s 10.5.255.0. The link from t h a t d i s t r i b u t i o n c e n t e r to store 17 w o u l d be 10.105.17.0. The only prefix t h e s e two a d d r e s s e s have in c o m m o n is the n e t w o r k ID (10) i t s e l f ~ n o t very helpful. Does this m e a n we have to a b a n d o n o u r p l a n ? No, it doesn't. A l t h o u g h o u r p l a n is not ideal for r o u t e s u m m a r i z a t i o n , it well m a y be good e n o u g h . With s o m e careful c o n f i g u r a t i o n of the regional r o u t e r s , we c a n r e p r e s e n t e a c h region with t h r e e e n t r i e s in the corp o r a t e r o u t e r ' s table. One e n t r y w o u l d r e p r e s e n t all of the DC a n d store LANs, a n d t h e r e w o u l d be one e n t r y for e a c h of the WAN links b e t w e e n the c o r p o r a t e r o u t e r a n d the DC. The c e n t r a l r o u t e r w o u l d t h e n h a v e less t h a n a h u n d r e d entries in its r o u t i n g t a b l e ~ a very reasonable number. The r o u t e r s at e a c h d i s t r i b u t i o n c e n t e r w o u l d h a v e a n e n t r y for e a c h of the WAN links, store LANs, a n d DC LANs, totaling a bit over

109

110

Chapter 3


4 0 0 entries. C u r r e n t r o u t e r technology is able to h a n d l e t h a t n u m b e r of entries very easily. Given t h a t the r o u t e r s will not be overwhelmed by the routing table sizes, a n d given t h a t the a d d r e s s i n g plan p r e s e n t e d h a s some desirable features, we will go a h e a d a n d deploy the plan as presented.

Summary The d e s i g n e r s of the I n t e r n e t Protocol never d r e a m e d t h a t t h e r e w o u l d be millions of h o s t s on over 100,000 n e t w o r k s p a r t i c i p a t i n g in the I n t e r n e t . At the time, a fixed 32-bit a d d r e s s looked like it w o u l d be m o r e t h a n e n o u g h to serve the a d d r e s s i n g n e e d s of the I n t e r n e t for y e a r s to come. And it h a s . However, as the I n t e r n e t cont i n u e s to grow, m o r e a n d m o r e p r e s s u r e is being p u t on the u s e r c o m m u n i t y to u s e globally-unique IP a d d r e s s e s efficiently. This p r e s s u r e h a s lead to policy c h a n g e s at the I n t e r n e t Registries a n d to n e w t e c h n i q u e s to conserve a d d r e s s e s . One of t h o s e t e c h n i q u e s is to u s e private a d d r e s s e s , as specified in RFC 1918. There are b o t h benefits a n d d r a w b a c k s to u s i n g private a d d r e s s e s .

Q" C a n I u s e V I ~ M in private n e t w o r k s ?

A: Absolutely! T h e r e ' s no h a r m in u s i n g a d d r e s s e s wisely, even if y o u have a very large supply.


Q: W h y

9Chapter 3

is n e t w o r k 10 i n c l u d e d in the private a d d r e s s r a n g e s ?

A: Class A n e t w o r k 10 w a s the a d d r e s s u s e d by the old ARPANET, the p r e c u r s o r of t o d a y ' s Internet. Network 10 w a s d e c o m m i s s i o n e d in the 1980s a n d we u s e it t o d a y to h o n o r its auspicious beginnings.

Q:

C a n I u s e private a d d r e s s e s a n d public a d d r e s s e s in m y network?

A: Yes. Since the public a n d private a d d r e s s e s u s e different n e t w o r k prefixes, t h e y will n e e d to be on s e p a r a t e p o r t s of a router. In o t h e r words, t h e y w o u l d n e e d to be s e p a r a t e s u b n e t s of y o u r network. The devices with public a d d r e s s e s will be able to c o m m u n i c a t e on the Internet, t h o s e with private a d d r e s s e s will not.

Q:

I've got a n e t w o r k with private a d d r e s s e s . Now I w a n t to c o n n e c t to the I n t e r n e t . C a n I?

A: Yes, y o u have two options. First, y o u c a n o b t a i n public a d d r e s s e s a n d r e n u m b e r y o u r IP devices. Second, y o u (or y o u r ISP) c a n i m p l e m e n t Network A d d r e s s T r a n s l a t i o n (NAT) to t r a n s l a t e y o u r private a d d r e s s e s to public a d d r e s s e s . NAT is covered in C h a p t e r 4.

Exercises 0

In o u r s a m p l e network, we were u n a b l e to m a x i m i z e the benefits of r o u t e s u m m a r i z a t i o n b e c a u s e of the w a y we allocated the a d d r e s s e s . W i t h o u t going to variable m a s k s , design a n a d d r e s s i n g s t r u c t u r e for o u r s a m p l e n e t w o r k t h a t is completely hierarchical.

111

112

Chapter 3 * Private Addressing and Subnetting Large Networks

2. Why should ISPs filter out any references to private address blocks? 3. How does CIDR contribute to a d d r e s s allocation efficiency?.

Answers I

Q

Use five or six of the 16 s u b n e t bits to r e p r e s e n t the regions. These bits will be the first bits in the s u b n e t field. The r e m a i n i n g ten or eleven bits will r e p r e s e n t the s u b n e t s in the region. For example, if we u s e d five bits for the region ID a n d 11 bits for the s u b n e t within the region, we can allocate 32 regions with 2048 s u b n e t s in each region. The a d d r e s s e s would line u p like this:

Headquarters:

10.0.0.0 through 10.7.255.255

Region 1: 10.8.0.0 through 10.15.255.255 Region 2:10.16.0.0 through 10.23.255.255, etc. This plan would be efficient (from the router's point of view), b u t not very intuitive.

0

0

Since private a d d r e s s blocks are not, by definition, globallyunique, there m a y be (and in fact are) m a n y n e t w o r k s u s i n g the s a m e addresses. If routing information a b o u t those n e t w o r k s or p a c k e t s containing those a d d r e s s e s were allowed on the Internet, the I n t e r n e t r o u t e r s would become confused at best, m i s r o u t i n g packets. At worst, they would become hopelessly congested, c a u s i n g massive c o m m u n i c a t i o n failures.

By reducing the g r a n u l a r i t y of a d d r e s s allocation. Prior to CIDR, a n organization w a s allocated 256 a d d r e s s e s (class C), 65,536 a d d r e s s e s (class B), or 16,777,216 a d d r e s s e s (class A). With CIDR, almost a n y n u m b e r of a d d r e s s e s can be allocated, r e d u c i n g the w a s t e associated with the previous scheme.

114

C h a p t e r 4 * Network Address Translation

Introduction This c h a p t e r covers Network Address T r a n s l a t i o n (NAT). In its simplest form, NAT c h a n g e s n e t w o r k layer (layer 3) a d d r e s s e s as they p a s s t h r o u g h some device, s u c h as a r o u t e r or firewall. In theory, other layer 3 protocols can be translated, s u c h as AppleTalk or IPX, as well as other layers (such as layer 2). In practice, it's u s u a l l y done only with IP a d d r e s s e s at layer 3. Becau se this is a TCP/IP book, this c h a p t e r will focus exclusively on IP. We will d e m o n s t r a t e , however, t h a t simply changing the layer 3 a d d r e s s is insufficient, a n d t h a t t r a n s p o r t layer (layer 4), a n d often higher layer, information m u s t also be affected. Therefore, our disc u s s i o n will also include TCP a n d UDP, as well as application layer (layer 7) protocols. We will d i s c u s s not only w h a t NAT is a n d how it works, b u t also w h a t the problems a n d s h o r t c o m i n g s are. This c h a p t e r is not a b o u t n e t w o r k security; however, the i s s u e s s u r r o u n d i n g NAT often intersect with those of security applications. In some cases, p a r t i c u l a r types of NAT m a k e the m o s t sense in the context of a security application. Many of the commercial NAT i m p l e m e n t a t i o n s are p a r t of a security package. Given that, we will be covering some security information as it relates to NAT, t h o u g h NAT by itself is not necessarily security technology.

Hiding Behind the Router/Firewall The ideas b e h i n d NAT b e c a m e popularized in early firewall solutions. These early firewalls were mostly proxy-based. A good example is the FireWall ToolKit (FWTK). A proxy (in the firewall context) is a piece of software t h a t fetches some information on behalf of a client, s u c h as a Web page. The client c o m p u t e r a s k s the proxy for a p a r t i c u l a r Web page (it gives it the URL) a n d awaits reply. The proxy will t h e n fetch the Web page, a n d r e t u r n it to the client. W h a t ' s the point of t h a t ? First, the a d m i n i s t r a t o r of the proxy c a n often p r o g r a m a list of things the client isn't allowed to do. For example, if it's a Web proxy at a company, the proxy a d m i n i s t r a t o r

Network Address Translation * Chapter 4

m a y c h o o s e to block access to www. playboy, com. Second, the proxy m i g h t be able to p e r f o r m some c a c h i n g or o t h e r optimization. If 50 people visit w w w . s y n g r e s s . c o m every day, the proxy could keep a copy of the Web page, a n d w h e n a client a s k s for it, all t h e p r o x y h a s to do is c h e c k if t h e r e have b e e n a n y c h a n g e s . If not, it p a s s e s along t h e copy h a s stored, a n d the client typically gets to see the page m o r e quickly. U s u a l l y in this type of proxy configuration, t h e clients have b e e n blocked from retrieving Web pages from the I n t e r n e t directly, so t h e y are forced to u s e the proxy if t h e y w a n t to view Web pages. This is often done with p a c k e t filtering on the router. Simply stated, the r o u t e r is configured only to allow the proxy to pull Web p a g e s from the Internet, a n d no o t h e r m a c h i n e . T h e r e s u l t of this type of d e s i g n is t h a t i n s i d e clients n o w t a l k only to t h e proxy, a n d no longer t a l k directly to o t h e r h o s t s on t h e I n t e r n e t . T h e p r o x y only n e e d s to a c c e p t r e q u e s t s from t h e "inside" a n d fulfill t h e m . This m e a n s t h a t o t h e r m a c h i n e s on t h e I n t e r n e t no longer n e e d to s p e a k to inside clients directly, even for replies. Therefore, t h e firewall a d m i n i s t r a t o r c a n c o n f i g u r e t h e i r r o u t e r or firewall to b l o c k all c o m m u n i c a t i o n s b e t w e e n t h e inside a n d outside m a c h i n e s . This forces all c o m m u n i c a t i o n s t h r o u g h t h e proxy. Now, t h e only m a c h i n e t h e o u t s i d e c a n t a l k to (if all is c o n f i g u r e d correctly) is t h e proxy. This d r a m a t i c a l l y r e d u c e s t h e n u m b e r of m a c h i n e s t h a t o u t s i d e r s c a n a t t a c k directly. T h e p r o x y a d m i n i s t r a tor t a k e s p a r t i c u l a r care to m a k e s u r e t h e p r o x y m a c h i n e is as s e c u r e as possible, of c o u r s e . Figure 4.1 is a d i a g r a m of w h a t it looks like, logically. This p r o c e s s h a s b e e n highly simplified for p u r p o s e s of d i s c u s sion, b u t the principles are there: a clear division of inside a n d outside, a n d a p o i n t b e t w e e n t h e m . This point b e t w e e n the two is s o m e t i m e s called a choke point. In o u r diagram, the c h o k e point is the proxy a n d filtering r o u t e r together.

115

116

Chapter 4

9Network Address Translation

Figure 4.1 Retrieving a Web page through a proxy.

Network Address Translation

9Chapter 4

T h i s is a simplified firewall a r c h i t e c t u r e . I s s u e s o u t s i d e of t h e s c o p e of t h i s c h a p t e r c o m e into p l a y w h e n d e s i g n i n g a real firewall, s u c h as: 9

Is p r o x y s o f t w a r e available for all n e e d e d p r o t o c o l s ?

9

How is t h e p a c k e t filtering c o n f i g u r e d on t h e r o u t e r ?

9

H o w d o e s t h e Web b r o w s e r s o f t w a r e o n t h e client k n o w to t a l k to t h e proxy?.

9

How d o e s t h e p r o x y k n o w w h i c h m a c h i n e s a r e o n t h e inside, and which are outside?

T h e p o i n t of t h e d i s c u s s i o n in t h i s c h a p t e r is n o t w h a t a p r o x y firewall a r c h i t e c t u r e looks like, b u t r a t h e r , a side effect of it. We a l r e a d y k n o w t h a t all traffic on t h e I n t e r n e t f r o m t h i s n e t w o r k origin a t e s f r o m t h e proxy. T h i s m e a n s t h a t t h e I n t e r n e t only "sees" t h e IP a d d r e s s of t h e p r o x y server. We also k n o w t h a t t h e I n t e r n e t c a n ' t r e a c h t h e client m a c h i n e s on t h e inside. As far a s t h e I n t e r n e t is c o n c e r n e d , t h i s m e a n s t h a t t h i s site n e e d s only one IP a d d r e s s , w h i c h is t h a t of t h e proxy. Recall f r o m C h a p t e r 3 t h a t a d d r e s s s p a c e is c o n s i d e r e d s c a r c e a t p r e s e n t , a n d t h a t c e r t a i n IP a d d r e s s r a n g e s , r e f e r r e d to a s t h e priv a t e IP a d d r e s s r a n g e s , h a v e b e e n set aside. T h e s e r a n g e s a r e c u r r e n t l y listed in t h e d o c u m e n t RFC 1918, available a t http: //www. cis. ohio-state, edu/htbin/rfc/rfcl918 .html

a s well a s a t a n u m b e r of o t h e r Web sites. If y o u h a p p e n to r e a d t h r o u g h t h e RFC, you'll see t h a t it r e n d e r s R F C s 1627 a n d 1597 (an older v e r s i o n of RFC 1918) obsolete. RFC 1627 a t t e m p t s to m a k e a c a s e a g a i n s t p r i v a t e IP a d d r e s s r a n g e s . A p p a r e n t l y , RFC 1627 lost b e c a u s e it h a s b e e n d e c l a r e d obsolete b y one t h a t explicitly allows p r i v a t e a d d r e s s r a n g e s . T h e o t h e r R F C s

117

118

Chapter 4 * Network Address Translation

c a n be r e a c h e d at the p r e v i o u s URL (there are links at the top of t h a t Web page). Following is a quote from RFC 1918, w h i c h defines the private a d d r e s s spaces, a n d w h e n t h e y s h o u l d be used: "For s e c u r i t y r e a s o n s , m a n y e n t e r p r i s e s u s e application layer g a t e w a y s to c o n n e c t their i n t e r n a l n e t w o r k to the I n t e r n e t . The i n t e r n a l n e t w o r k u s u a l l y does n o t have direct a c c e s s to t h e I n t e r n e t , t h u s only one or m o r e g a t e w a y s are visible from the I n t e r n e t . In this case, the i n t e r n a l n e t w o r k c a n u s e n o n - u n i q u e IP n e t w o r k n u m b e r s . " As p a r t of the r e a s o n for h a v i n g private a d d r e s s e s , the RFC recognizes t h a t m a n y c o m p a n i e s a l r e a d y have application layer gatew a y s (proxies) in place. Therefore, it w o u l d be u s e f u l to have a set of a d d r e s s e s t h a t c a n be r e u s e d internally, as long as n o n e of t h o s e m a c h i n e s n e e d s to talk to o t h e r m a c h i n e s directly. The RFC also r e c o m m e n d s t h a t companies who wish to employ s u c h a proxy obtain a d d r e s s space from Internet Service Providers (ISPs). In recent years, m o s t of the a d d r e s s space h a s b e e n allocated to ISPs, r a t h e r t h a n directly to companies, as it u s e d to be. A big p a r t of the r e a s o n for this is to keep routing tables on Internet core routers as small as possible. If a block of a d d r e s s e s is given to a n ISP, t h e n the other ISPs can hold a route to t h a t single block, r a t h e r t h a n having a n entry for each of the separate network ranges in the block, as would be the case ff those a d d r e s s ranges were given to various companies. By today's rules, you pretty m u c h have to be a n ISP to get a d d r e s s space allocated to you permanently. For more information a b o u t how ISPs obtain a n d assign addresses, please see C h a p t e r 6. If you r u n a proxy architecture, it will be fairly easy to get some addresses from your ISP, and you will need relatively few. With this architecture, you are free to use the RFC 1918 addresses inside your network, a n d still have Internet access for your internal client machines.


9Chapter 4

This type of a r c h i t e c t u r e is in very c o m m o n u s e today. M a n y c o m p a n i e s , especially large ones, have s o m e sort of firewall or proxy device t h a t does the direct c o m m u n i c a t i o n on the I n t e r n e t . Even c o m p a n i e s t h a t h a v e b e e n on the I n t e r n e t long e n o u g h to h a v e t h e i r own a d d r e s s s p a c e f r e q u e n t l y u s e this type of a r c h i t e c t u r e , t h o u g h m o s t l y for s e c u r i t y r e a s o n s . Now t h a t we h a v e s o m e idea w h a t proxies are, h o w exactly does t h a t relate to NAT?. Well, a c t u a l l y n o t m u c h ~ p r o x i e s a r e n ' t NAT. T o w a r d s t h e end of the chapter, we explain why. However, t h e disc u s s i o n is i m p o r t a n t , b e c a u s e proxies form p a r t of the h i s t o r y of w h y NAT exists.

What Is NAT? The i d e a b e h i n d NAT is s i m i l a r to one of t h e b e n e f i t s of proxies: h i d i n g y o u r i n t e r n a l a d d r e s s e s . The u s u a l r e a s o n for w a n t i n g to h i d e a d d r e s s e s is t h e one we m e n t i o n e d ~ I n t e r n e t a c c e s s for i n s i d e client m a c h i n e s . At a h i g h level, t h e e n d r e s u l t is t h e s a m e . The I n t e r n e t s e e s a valid I n t e r n e t a d d r e s s (a p u b l i c a d d r e s s ) , p r o b a b l y a s s i g n e d by y o u r ISP, a n d y o u r i n s i d e m a c h i n e s are using private addresses. T h e r e is a t l e a s t one o t h e r r e a s o n y o u m i g h t w a n t to u s e NAT if y o u ' r e u s i n g t h e RFC 1918 a d d r e s s e s : W h a t if y o u r c o m p a n y m e r g e s w i t h a n o t h e r o n e ? U s u a l l y , t h e two c o m p a n i e s will w a n t to l i n k i n t e r n a l n e t w o r k s to facilitate b u s i n e s s c o m m u n i c a t i o n s . However, if b o t h c o m p a n i e s h a d p r e v i o u s l y b e e n u s i n g t h e s a m e RFC 1918 a d d r e s s r a n g e s , a conflict a r i s e s . U l t i m a t e l y , a r e n u m b e r i n g of s o m e s o r t will p r o b a b l y h a v e to be done, b u t a s a s h o r t t e r m m e a s u r e , it's p o s s i b l e to u s e a t y p e of NAT to t r a n s l a t e a d d r e s s e s b e t w e e n t h e two c o m p a n i e s to resolve conflicts. We'll r e t u r n to t h i s e x a m p l e later.

119

120


To u n d e r s t a n d h o w NAT differs f r o m p r o x y i n g , we h a v e to t a k e a d e t a i l e d look at h o w NAT w o r k s .

How Does NAT Work? NAT w o r k s b y m o d i f y i n g i n d i v i d u a l p a c k e t s . It m o d i f i e s (at least) t h e l a y e r 3 h e a d e r s to h a v e a n e w a d d r e s s for t h e s o u r c e a d d r e s s , d e s t i n a t i o n a d d r e s s , or b o t h . We'll also see a n e x a m p l e w h e r e l a y e r 4 h e a d e r s a r e modified, a s well a s t h e d a t a p o r t i o n (layer 7). As we'll see, a few s m a l l v a r i a t i o n s in h o w t h e a d d r e s s e s a r e t r a n s l a t e d c a n r e s u l t in a fairly wide r a n g e of b e h a v i o r a n d feat u r e s . We'll also see t h a t for s o m e p r o t o c o l s , it will t a k e a lot m o r e t h a n s i m p l y c h a n g i n g t h e l a y e r 3 a d d r e s s e s for t h e m to f u n c t i o n w i t h NAT. T h e r e are even p r o t o c o l s t h a t c a n ' t f u n c t i o n w i t h NAT in place. T h e NAT f u n c t i o n is u s u a l l y p e r f o r m e d b y a r o u t e r or firewall. It is t h e o r e t i c a l l y p o s s i b l e for a b r i d g e (layer 2) device to do l a y e r 3 a d d r e s s t r a n s l a t i o n , a n d at l e a s t one firewall p r o d u c t on t h e m a r k e t f u n c t i o n s t h a t way. However, t h e v a s t m a j o r i t y of t h e NAT devices, or s o f t w a r e t h a t i n c l u d e s a NAT f u n c t i o n , d e p e n d s on p l a i n IP r o u t i n g to deliver p a c k e t s to it. M o s t NAT devices h a v e a n u n d e r l y i n g IP r o u t i n g function.

Network Address Translation (Static) We'll s t a r t w i t h t h e s i m p l e s t f o r m of NAT, w h i c h is called s t a t i c , or 1-to-1 t r a n s l a t i o n . T h i s is t h e m o s t i n t u i t i v e k i n d : S i m p l y s t a t e d , in s t a t i c NAT, a p a r t i c u l a r IP a d d r e s s is c h a n g e d to a n o t h e r g o i n g o n e w a y , a n d c h a n g e d b a c k going t h e o t h e r w a y . T h e c h a n g e u s u a l l y is d o n e to t h e s o u r c e a d d r e s s for o u t g o i n g p a c k e t s . F i g u r e 4 . 2 will h e l p clarify t h i s . In t h e figure, t h e a r r o w s i n d i c a t e d i r e c t i o n of p a c k e t flow (where it's b e i n g r o u t ed), S i n d i c a t e s s o u r c e a d d r e s s , a n d D i n d i c a t e s d e s t i n a t i o n address.

N e t w o r k Address Translation

9Chapter 4

Figure 4.2 Static NAT during the first two packets of the TCP handshake.

121

122

Chapter 4


How Does Static NAT Work? Let's a s s u m e for the m o m e n t t h a t t h i s is a really s i m p l e - m i n d e d NAT; t h a t is, all it does is modify the s o u r c e or d e s t i n a t i o n a d d r e s s w h e n a p p r o p r i a t e . W h a t k i n d of w o r k does t h e NAT r o u t e r h a v e to do? First, it h a s to have s o m e idea of w h i c h direction t h e p a c k e t is traveling relative to the NAT configuration. Notice in the e x a m p l e t h a t t h e r o u t e r t r a n s l a t e s the s o u r c e in one direction, a n d the destin a t i o n in t h e other. It c a n decide w h i c h to do b a s e d on p a r t i c u l a r i n t e r f a c e s being m a r k e d as "to" or "from" interfaces. A c o n f i g u r a t i o n example, next, will m a k e t h i n g s m o r e clear. The r o u t e r also h a s to d e c r e m e n t t h e TTL a n d redo a n y c h e c k s u m s needed, b u t r o u t e r s do t h a t anyway. The e x a m p l e is also stateless, m e a n i n g t h a t the r o u t e r d o e s n ' t h a v e to k n o w w h a t w e n t on with previous p a c k e t s , if a n y t h i n g , in o r d e r to modify the c u r r e n t one. All t h e i n f o r m a t i o n it n e e d s to m o d ify t h e p a c k e t is available in the c u r r e n t packet, a n d in its configuration. Also note t h a t this type of NAT h a s no s e c u r i t y f e a t u r e s ~ a U traffic p a s s e s regardless, with j u s t a n a d d r e s s c h a n g e in the process. The idea of s t a t e i n f o r m a t i o n is very i m p o r t a n t for later NAT e x a m p l e s , a n d also for firewalls. Keep t h i s in m i n d for later discussion. This type of NAT is fairly simple to u n d e r s t a n d , b u t it isn't as u s e f u l as it m i g h t be. C o n s i d e r o u r goal of trying to have a few IP a d d r e s s e s r e p r e s e n t a g r o u p of inside m a c h i n e s . O u r e x a m p l e is 1to- 1, m e a n i n g t h e r e is no a d d r e s s savings! E a c h inside IP a d d r e s s h a s to have a m a t c h i n g o u t s i d e a d d r e s s , so t h e r e is no savings of IP a d d r e s s e s . Does this m e a n t h a t it is u s e l e s s ? No, t h e r e are a n u m b e r of s c e n a r i o s w h e r e we c a n u s e a 1-to-1 m a p p i n g of IP a d d r e s s e s . One s c e n a r i o is t h a t you've got a n i n t e r n a l m a c h i n e with a n i n t e r n a l IP a d d r e s s , a n d y o u w a n t to m a k e it r e a c h a b l e by the I n t e r n e t for s o m e r e a s o n . One w a y to do it w i t h o u t having to c h a n g e a n y t h i n g on the inside m a c h i n e is to define a static t r a n s l a t i o n for it, like we did in o u r example. If t h a t ' s done, y o u simply have to p u b l i s h t h e t r a n s l a t e d IP a d d r e s s (perhaps by a s s i g n i n g a DNS n a m e to it).


9Chapter 4

Let's c o n s i d e r a n o t h e r example, w h i c h m a t c h e s t h e one in Figure 4.2, except t h a t the d e s t i n a t i o n a d d r e s s is c h a n g e d on the first p a c k e t i n s t e a d of the s o u r c e a d d r e s s . W h e n w o u l d it be u s e f u l to c h a n g e t h e d e s t i n a t i o n a d d r e s s i n s t e a d of the s o u r c e a d d r e s s ? T h e r e is at l e a s t one type of server you generally h a v e to refer to by IP a d d r e s s : DNS servers. Imagine a s i t u a t i o n w h e r e a DNS server h a s failed, p r o b a b l y only temporarily, a n d y o u w o u l d like to h a v e y o u r inside client m a c h i n e s m a k e DNS r e q u e s t s of a n e w one witho u t h a v i n g to reconfigure t h e m all, a n d t h e n p u t t h e m b a c k w h e n the original DNS server is b a c k up.

Double NAT The l a s t static NAT e x a m p l e we w a n t to look at is often called "double NAT." Simply put, t h i s is c h a n g i n g b o t h the s o u r c e a n d d e s t i n a tion a d d r e s s e s of a packet. M a n y p r o d u c t s t h a t s u p p o r t NAT d o n ' t s u p p o r t t h i s type of configuration, u n l e s s you've got two of t h e m . U n d e r w h a t c i r c u m s t a n c e s w o u l d y o u w a n t to u s e d o u b l e NAT?. One possibility is a c o m b i n a t i o n of the p r e v i o u s two examples: You've got inside m a c h i n e s u s i n g private IP a d d r e s s , a n d y o u n e e d to have t h e m c o n n e c t to a different DNS server w i t h o u t reconfiguring t h e m . T h a t e x a m p l e is a bit contrived, t h o u g h , a n d t h e r e ' s a better one. Recall t h a t one of t h e p r o b l e m s w i t h u s i n g private IP a d d r e s s e s is the possibility of conflict w h e n y o u c o n n e c t to a n o t h e r n e t w o r k t h a t is u s i n g t h e s a m e a d d r e s s e s . Double NAT c a n help in t h i s situation, t h o u g h again, you'll p r o b a b l y w a n t to u s e this only as a temporary measure. Here's a scenario: You n e e d to c o n n e c t y o u r n e t w o r k to t h a t of a n o t h e r c o m p a n y , a n d y o u j u s t f o u n d o u t t h a t y o u b o t h are u s i n g class C 192.168.1. You h a v e to find a w a y to e n a b l e the two netw o r k s to c o m m u n i c a t e u n t i l a r e n u m b e r i n g c a n be completed. This s i t u a t i o n is far from impossible, as several firewall/NAT p r o d u c t s u s e this a d d r e s s r a n g e by default. It t u r n s o u t you've b o t h got r o u t e r s c a p a b l e of doing N A T ~ t h e s a m e r o u t e r s y o u are u s i n g to c o n n e c t to e a c h other. For o u r

123

124

Chapter 4


e x a m p l e we'll focus on two m a c h i n e s , one on each net, t h a t have the s a m e IP a d d r e s s (see Figure 4.3).

Figure 4.3 Two networks with conflicting RFC1918 addresses.

The IP a d d r e s s e s u s e d on the link b e t w e e n the two r o u t e r s a r e n ' t p a r t i c u l a r l y i m p o r t a n t for this example, as long as t h e y d o n ' t create additional conflicts. The trick is to m a k e e a c h m a c h i n e believe t h a t the o t h e r one is at a different IP a d d r e s s . We a c c o m p l i s h this by m a k i n g the m a c h i n e on the left t h i n k t h a t the m a c h i n e on the right is IP a d d r e s s 192.168.2.2, while the m a c h i n e on the right t h i n k s t h a t the m a c h i n e on the left is 192.168.3.2. This is still static NAT: e a c h m a c h i n e h a s a 1-to-1 m a p p i n g to a n o t h e r IP a d d r e s s . However, in this example, since we're going t h r o u g h two NAT r o u t e r s , we're going to t r a n s l a t e twice. The first r o u t e r will c h a n g e the s o u r c e a d d r e s s on the packet, a n d the s e c o n d r o u t e r will c h a n g e t h e d e s t i n a t i o n a d d r e s s on the packet. Double NAT. Let's w a l k t h r o u g h a n e x a m p l e of the m a c h i n e on the left sending a p a c k e t to t h e m a c h i n e on the right (see Figure 4.4). Since t h e m a c h i n e on the left a s s u m e s it's simply c o m m u n i c a t ing w i t h a n o t h e r m a c h i n e at 192.168.2.2, it s e n d s its p a c k e t to t h e local r o u t e r for forwarding, as it n o r m a l l y would. At this point, r o u t e r A is going to c h a n g e the s o u r c e a d d r e s s on the packet, to hide t h e fact t h a t it c a m e from a 192.168.1 n e t (see Figure 4.5).


9Chapter 4

Figure 4.4 Source address is 192.168.1.2, destination address is 192.168.2.2.

The d e s t i n a t i o n a d d r e s s r e m a i n s 1 9 2 . 1 6 8 . 2 . 2 at this point, a n d r o u t e r A u s e s its n o r m a l r o u t i n g tables to determ i n e w h e r e the 192.168.2 n e t w o r k is, a n d f o r w a r d s the packet. In this case, it f o r w a r d s the p a c k e t to r o u t e r B. R o u t e r B is going to p e r f o r m its t r a n s l a t i o n next, a n d it c h a n g e s the d e s t i n a t i o n a d d r e s s from 1 9 2 . 1 6 8 . 2 . 2 to 1 9 2 . 1 6 8 . 1 . 2 (see Figure 4.6). F i g u r e 4.5 Source address is now 192.168.3.2, destination address is still 192.168.2.2.

125

126

Chapter 4


Figure 4.6 Source address is 192.168.3.2, destination address is now 192.168.1.2.

Now the m a c h i n e on the right receives the packet, a n d t h a t m a c h i n e believes it h a s received a p a c k e t from 192.168.3.2. P a c k e t s traveling from the m a c h i n e on the right to the m a c h i n e on the left will go t h r o u g h a similar, b u t reversed process. In this manner, the two machines with the s a m e address, which would normally never be able to communicate with each other, are able to do so. Naturally, to m a k e this type of scenario usable in real life, it will probably require some clever DNS setup as well. The DNS server for the m a c h i n e on the left would be configured so t h a t the n a m e s of the m a c h i n e s on the right resolve to 192.168.3 addresses, and so on.

Problems with Static NAT So far, we've ignored the p r o b l e m s with NAT, a n d t h e y are significant. The b a s i c p r o b l e m is t h a t n o t all n e t w o r k a d d r e s s i n f o r m a t i o n is in the n e t w o r k a d d r e s s h e a d e r s (IP layer). A fair n u m b e r of protocols, for v a r i o u s r e a s o n s , include a d d r e s s i n f o r m a t i o n in the d a t a portion of the p a c k e t s . We'll look at a few examples. One of the m o s t p r o b l e m a t i c protocols for NAT is the File T r a n s f e r Protocol (FTP). However, b e c a u s e FTP is so c o m m o n , m o s t NATs deal w i t h it properly. W h a t ' s difficult a b o u t FTP? First of all, it p a s s e s IP a d d r e s s e s in t h e d a t a s t r e a m , in ASCII. Second, it p a s s e s t h e s e a d d r e s s e s to


9Chapter 4

i n f o r m t h e o t h e r m a c h i n e on w h i c h IP a d d r e s s a n d p o r t it will be l i s t e n i n g for r e v e r s e c o n n e c t i o n s . In t h e d e f a u l t m o d e , w h e n a n FTP client w a n t s to receive a file, it l i s t e n s on a p o r t n u m b e r a s s i g n e d b y t h e o p e r a t i n g s y s t e m , a n d i n f o r m s t h e s e r v e r of t h a t p o r t n u m b e r a n d its IP a d d r e s s . T h e s e r v e r t h e n c o n t a c t s t h e client a n d delivers t h e file. T h i s p r o b l e m g e t s w o r s e w h e n s e c u r i t y or o t h e r t y p e s of NAT a r e c o n s i d e r e d , w h i c h we'll look a t later. T h i s m e a n s t h a t t h e NAT s o f t w a r e h a s to be able to s p o t t h e IP a d d r e s s e s w h e n t h e y a r e b e i n g sent, a n d be able to modify t h e m . FTP also i n t r o d u c e s t h e p r o b l e m of s t a t e . U n f o r t u n a t e l y for t h e NAT s o f t w a r e designer, t h e IP a d d r e s s i n f o r m a t i o n m a y be split a c r o s s m o r e t h a n one p a c k e t . T h i s m e a n s t h a t t h e NAT s o f t w a r e also h a s to k e e p t r a c k of w h a t it w a s d o i n g on t h e l a s t p a c k e t a s well a s t h e c u r r e n t one. T h i s is k n o w n a s m a i n t a i n i n g s t a t e i n f o r m a t i o n ; m o s t NAT devices u s e s t a t e t a b l e s to m a i n t a i n t h i s type of i n f o r m a t i o n . F i g u r e 4.7 c o n t a i n s a p a c k e t c a p t u r e of t h e p r o b l e m in action.

Figure 4.7 Packet containing the FTP PORT command. IP:

IP

Header

IP: IP:

Version

IP:

Type

=

of

4,

header

service

=

length

= 20

bytes

00

IP:

000 . . . . .

IP:

... 0

....

= normal

delay

IP-

....

0...

= normal

throughput

= normal

reliability

IP: IP:

..... Total

0..

length

IP:

Identification

IP:

Flags

= routine

:

66

=

3437 =

bytes

4X

IP:

.1 . . . . . .

= don' t

IP:

. .0 . . . . .

=

IP:

Fragment

IP:

Time

IP-

Protocol

IP:

Header

checksum

IP:

Source

address

to

offset live

=

last

0 bytes

=

128

=

6

=

fragment fragment

seconds/hops (TCP)

410F =

(correct) [208.25.87.11]

Continued

127

128

Chapter 4

9Network

Address Translation

IP:

Destination

IP:

No

address

=

[130.212.2.65]

options

IP" TCP.

header

TCP TCP: TCP:

Source

TCP:

Destination

port

= 4585 port

TCP:

Sequence

TCP:

Next

TCP:

Acknowledgment

TCP:

Data

TCP:

Flags

= 21

number

expected

(FTP)

= 353975087

Seq

number=

number

353975113

= 1947234980

offset

= 20 b y t e s = 18

TCP:

. .0 . . . . .

=

TCP:

... 1

....

= Acknowledgment

TCP:

....

i...

= Push

TCP:

.....

TCP:

......

TCP:

.......

(No u r g e n t

0..

=

(No r e s e t )

0.

=

(No SYN)

0 :

(No FIN)

TCP : Window

= 8030

TCP:

Checksum

: 1377

TCP:

No

TCP:

TCP

pointer)

(correct)

options

[26 B y t e s

of

data]

TCP: FTP:

File

Transfer

Data

Protocol

FTP: FTP:

Line

1:

PORT

2 0 8 , 2 5 , 8 7 , ii, 1 7 , 2 3 4

FTP:

Figure 4 . 7 is a p a c k e t from the m i d d l e of a n FTP s e s s i o n , cont a i n i n g the PORT c o m m a n d . B e h i n d the s c e n e s , FTP is b a s i c a l l y a text protocol, w i t h b i n a r y t r a n s f e r s a d d e d onto it. The c o m m a n d y o u s e e at the b o t t o m on the figure, PORT 2 0 8 , 2 5 , 8 7 , 1 1 , 1 7 , 2 3 4 , is the client i n f o r m i n g the server w h a t port it will be l i s t e n i n g on for receiving data. I h a d j u s t c o n n e c t e d to the server a n d m y client s e n t a n a d d r e s s a n d port n u m b e r to w h i c h the server c o u l d c o n n e c t in order to s e n d its w e l c o m e banner.


9Chapter 4

Let's t a k e a look at the c o m m a n d . The PORT p a r t is fairly evident: it is telling the server w h a t port it c a n c o n n e c t to. The first four n u m b e r s , 2 0 8 , 2 5 , 8 7 , 1 1 , are simply the client's IP a d d r e s s ~ i f y o u look at t h e top of the figure (source address), it is 2 0 8 . 2 5 . 8 7 . 1 1 . The n e x t two n u m b e r s are the port n u m b e r , split into two bytes. Notice t h a t the c u r r e n t s o u r c e port is 4585. The client in this case is a W i n d o w s 98 m a c h i n e , a n d like m o s t o p e r a t i n g s y s t e m s , W i n d o w s allocates p o r t s sequentially. To convert 17,234 into a single n u m b e r , follow this conversion routine: Multiply the first n u m b e r (on the left) by 256, a n d t h e n a d d the s e c o n d n u m b e r ~ i n this case, 1 7 * 2 5 6 + 2 3 4 = 4 5 8 6 . So, o u r client is telling the server to c o n n e c t to 2 0 8 . 2 5 . 8 7 . 1 1 at port 4586. E v e r y t h i n g w o r k e d as expected, a n d the b a n n e r w a s properly displayed on the FTP client. B u t h a d NAT b e e n in use, the NAT softw a r e w o u l d have to recognize the PORT c o m m a n d , a n d modify the n u m b e r for the IP a d d r e s s inside the packet. In this example, all fields were c o n t a i n e d in the s a m e p a c k e t (as t h e y often are). However, t h e y m a y be split a c r o s s m o r e t h a n one packet, so the NAT software m u s t be p r e p a r e d to h a n d l e t h a t possibility. If t h e NAT software is able to modify the PORT c o m m a n d correctly, all still w o r k s well. The h e a d e r s are c h a n g e d , a n d the PORT c o m m a n d ( s ) are c h a n g e d to m a t c h , accordingly. Now FTP c a n w o r k p r o p e r l y a c r o s s static NAT. T h a t ' s only one protocol h a n d l e d as a special c a s e ~ t h e r e are lots more. Real-world NAT i m p l e m e n t a t i o n s m u s t deal with t h e s e in order to be useful to c o n s u m e r s . It's fairly c o m m o n for NAT v e n d o r s to provide a list of protocols for w h i c h t h e y do or do n o t w o r k correctly. The basic p r o b l e m lies with protocols t h a t p a s s a d d r e s s a n d port i n f o r m a t i o n as p a r t of the d a t a portion of the p a c k e t s . W h e n the IP h e a d e r s are c h a n g e d , the d a t a portion m u s t also be c h a n g e d to m a t c h . If this is n o t done, t h e n the protocol m o s t likely will n o t w o r k properly. T h e r e is at least one o t h e r category of protocols t h a t have problems, even with static NAT. C e r t a i n protocols exist t h a t c a n detect w h e n the IP h e a d e r s have b e e n c h a n g e d , a n d will refuse to w o r k

129

130

Chapter 4


w h e n a c h a n g e is detected. Usually, t h e s e are c r y p t o g r a p h i c protocols. A p r i m e e x a m p l e is the IPSec A u t h e n t i c a t e H e a d e r (AH) protocol. W i t h o u t going into too m u c h IPSec detail, t h e idea b e h i n d this protocol is t h a t it is s o m e t i m e s u s e f u l to k n o w for s u r e t h a t the IP a d d r e s s with w h i c h y o u are c o m m u n i c a t i n g is w h o it claims to be. The two IP a d d r e s s e s c o m m u n i c a t i n g u s i n g IPSec AH have s h a r e d c r y p t o g r a p h i c keys with w h i c h to verify c e r t a i n types of information. W h e n one of t h e s e devices p u t s t o g e t h e r a packet, it i n c l u d e s a large n u m b e r with it, w h i c h is a f u n c t i o n of n e a r l y all the i n f o r m a t i o n in t h e packet, as well as t h e c r y p t o g r a p h i c key. W h e n t h e device at the o t h e r e n d sees the packet, it c a n go t h r o u g h a similar process, a n d d e t e r m i n e if t h e p a c k e t h a s b e e n t a m p e r e d with. If it detects a n y t a m p e r i n g , it d i s c a r d s the p a c k e t as invalid. IPSec AH will see NAT as t a m p e r i n g ( u n a u t h o r i z e d modification to t h e headers) a n d drop the p a c k e t s as being invalid. Here is a protocol t h a t c a n n o t w o r k with NAT, b e c a u s e of its design. There are n o t a large n u m b e r of protocols like this, a n d t h e y are u s u a l l y complex e n o u g h t h a t n e t w o r k a n d firewall a d m i n i s t r a t o r s are often involved in their configuration, so t h e y s h o u l d be a w a r e of the i s s u e s , a n d be able to w o r k a r o u n d t h e m . Be aware, t h o u g h , t h a t s o m e ISPs employ NAT on their n e t w o r k s . Also, s o m e Virtual Private N e t w o r k (VPN) p r o d u c t s u s e IPSec, a n d t h e s e p r o d u c t s often will n o t w o r k over a n ISP t h a t does NAT or a n y type of firewalling.

Configuration Examples In this chapter, o u r configuration e x a m p l e s will be u s i n g Cisco's IOS, W i n d o w s NT 2000, a n d Linux. Specifically, we'll be u s i n g Cisco IOS 11.3 or h i g h e r (on the m a i n Cisco r o u t e r line), a n d Red H a t Linux 6.0. Note t h a t s o m e o t h e r Cisco devices, s u c h as the 77x ISDN r o u t e r s , s u p p o r t NAT as well, b u t t h e y u s e a different n u m b e r ing s c h e m e for their software. We u s e W i n d o w s NT 2 0 0 0 b e c a u s e this is the first version of W i n d o w s NT to include built-in NAT capabilities. At the time of this writing, NT2000 is still beta. This f e a t u r e


is expected to be p r e s e n t in the final version, b u t t h e r e is always a possibility it w o n ' t be or t h a t it will be slightly c h a n g e d . The softw a r e p a c k a g e we'll be u s i n g on Linux is called IP M a s q u e r a d e , w h i c h c o m e s with t h e m o s t r e c e n t v e r s i o n s of all the Linux d i s t r i b u tions. The "References a n d Resources" section at the e n d of the c h a p t e r provides URLs for d o c u m e n t s c o n t a i n i n g i n f o r m a t i o n a b o u t NAT, i n c l u d i n g i n f o r m a t i o n a b o u t w h i c h exact v e r s i o n s of the Cisco lOS i n c l u d e NAT f e a t u r e s , a n d w h e r e to o b t a i n IP M a s q u e r a d e if it isn't a l r e a d y i n c l u d e d with y o u r distribution. This c h a p t e r a s s u m e s t h a t t h e a p p r o p r i a t e software is a l r e a d y installed, a n d t h a t y o u have a b a s i c familiarity with the o p e r a t i n g s y s t e m .

W i n d o w s NT 2 0 0 0 Windows NT 2 0 0 0 i n c l u d e s a f e a t u r e called I n t e r n e t C o n n e c t i o n S h a r i n g (ICS). (ICS is also i n c l u d e d in Windows 98 S e c o n d Edition.) ICS is i n t e n d e d to allow d i a l - u p u s e r s to provide I n t e r n e t a c c e s s to o t h e r m a c h i n e s a t t a c h e d via a LAN. It does t h a t well, b u t it's p r e t t y s i n g l e - m i n d e d , so it's n o t very flexible. The o u t s i d e interface m u s t be a d i a l - u p connection; t h a t is, if y o u r I n t e r n e t a c c e s s m e t h o d is via a LAN c o n n e c t i o n (such as a cable m o d e m or m o s t DSL setups) you c a n ' t u s e ICS with it. To a c c o m m o d a t e inside m a c h i n e s on the LAN, t h e NT 2 0 0 0 box configures its LAN interface to be 192.168.0.1, a n d t u r n s itself into a DHCP server a n d DNS proxy. The c o n f i g u r a t i o n of the LAN interface m i g h t very well c a u s e conflicts if t h o s e services a l r e a d y exist, so be careful. We'll a s s u m e t h a t NT 2 0 0 0 is a l r e a d y installed properly, t h a t t h e I2kN interface is functioning properly, a n d t h a t t h e r e is a correctly defined I n t e r n e t dialu p connection. We'll s t a r t with t h e n e t w o r k control panel, s h o w n in Figure 4.8. In Figure 4.8, we c a n see the LAN c o n n e c t i o n a n d t h e I n t e r n e t d i a l - u p connection. The I n t e r n e t c o n n e c t i o n is g r a y e d - o u t to indicate t h a t it's n o t u p at the m o m e n t .

131

132

Chapter 4


Figure 4.8 Windows 2000 Network connections window.

To configure ICS, right-click on the I n t e r n e t dial-up c o n n e c t i o n a n d select Properties. W h e n the Properties w i n d o w c o m e s up, click on t h e I n t e r n e t C o n n e c t i o n S h a r i n g tab, s h o w n in Figure 4.9. C h e c k i n g on the E n a b l e I n t e r n e t C o n n e c t i o n S h a r i n g box e n a b l e s ICS. Optionally, y o u c a n configure the NT 2 0 0 0 m a c h i n e to dial the I n t e r n e t a u t o m a t i c a l l y w h e n a n inside m a c h i n e tries to a c c e s s the Internet. C h e c k i n g on this option also e n a b l e s the DHCP server, so again be s u r e t h e r e isn't a l r e a d y a DHCP server before y o u c h e c k this on. The s h o r t version of this configuration e x a m p l e is t h a t inside m a c h i n e s will n o w a c t u a l l y be able to access the I n t e r n e t (after y o u

Network Address Translation Figure 4.9

9Chapter 4

Dial-up properties window, ICS tab.

d i a l - u p , of course). However, since we're d i s c u s s i n g s t a t i c NAT, we'll dig a little d e e p e r into w h a t ICS c a n do. Strictly s p e a k i n g , ICS doesn ' t do s t a t i c NAT (we'll d i s c u s s t h a t l a t e r in t h e c h a p t e r ) , b u t it c a n p e r f o r m s o m e of t h e s a m e behavior. Notice t h a t t h e r e is a S e t t i n g s b u t t o n a t t h e b o t t o m of t h e s c r e e n : If y o u click on t h a t , a n d t h e n select t h e Services tab, y o u will see s o m e t h i n g like t h e s c r e e n s h o w n in F i g u r e 4.10. In o u r e x a m p l e , t h e r e is a l r e a d y a service defined, called "telnet." By default, t h i s list is e m p t y . If we click on edit, we will see t h e s c r e e n s h o w n in F i g u r e 4.11. In t h e Service p o r t n u m b e r field, we've got 23 (which is t h e d e f a u l t p o r t for a T e l n e t server}. T h e protocol is TCP, a n d t h e N a m e field is p o r t a b e a s t , w h i c h is j u s t t h e n a m e of a m a c h i n e on o u r example inside network.

133

134

Chapter 4


Figure 4.10 ICS Services tab, Telnet service selected.

Figure 4.11 Definition of Telnet service.


9Chapter 4

Since ICS doesn't do real static NAT, inside m a c h i n e s can get out, but outside m a c h i n e s can't get in. The Services feature lets you explicitly allow certain services to be reachable from the outside. In our case, we've made it possible for the outside to Telnet to portabeast. ICS automatically handles FTP properly.

Cisco IOS Of the t h r e e o p e r a t i n g s y s t e m s we're covering, Cisco's lOS h a s the m o s t flexible NAT software. Using it, we're able to do a t r u e static NAT configuration. This e x a m p l e w a s done on a 2621 router, w h i c h h a s two F a s t E t h e r n e t ports. Here's w h a t the r e l e v a n t portion of the configuration looks like before we start: Using 827 out of 29688 bytes !

version 12.0 service timestamps debug uptime service timestamps log uptime service password-encryption !

hostname NAT !

enable secret 5

enable password 7 !

ip subnet-zero [ [

interface FastEthernet0/0 ip address 192.168.0.1 255.255.255.0 [

no ip directed-broadcast

interface Serial0 / 0 no ip address !


interface FastEthernet0/l

135

136

Chapter 4


ip address 130.214.99.254 255.255.255.0 no ip directed-broadcast ip classless

ip route 0.0.0.0 0.0.0.0 130.214.99.1 no ip http server I I

line con 0 transport input none line aux 0 line vty 0 4

password 7 xxxxxxxxxxx login

no scheduler allocate end

Interface F a s t E t h e r n e t 0 / 0 is our inside interface, w h i c h u s e s the 1 9 2 . 1 6 8 . 0 net. 1 3 0 . 2 1 4 . 9 9 is our o u t s i d e net, r e p r e s e n t i n g the p a t h to the Internet for this example. There is an inside m a c h i n e at 1 9 2 . 1 6 8 . 0 . 2 that we w a n t to be able to get out, so we're going to a s s i g n it an o u t s i d e address: NAT(config)

#interface fastethernet 0/0

NAT(config-if)

#ip nat inside

NAT(config-if)

#int fastethernet 0/i

NAT(config-if)

#ip nat outside

NAT (config-if)

#exit

NAT(config)

#ip nat inside source static 192.168.0.2 130.214.99.250

The first step is to m a r k the inside and o u t s i d e interfaces, w h i c h is d o n e with the ip n a t inside and ip nat o u t s i d e c o m m a n d s . Next, we tell the router to do an IP m a p p i n g . The c o m m a n d (global this time, rather t h a n an interface c o m m a n d ) is again ip nat. We're m a p ping an inside a d d r e s s and t r a n s l a t i n g the s o u r c e a d d r e s s (destination a d d r e s s t r a n s l a t i o n is also p o s s i b l e with IOS). It's a static m a p p i n g , and we're translating 1 9 2 . 1 6 8 . 0 . 2 to 1 3 0 . 2 1 4 . 9 9 . 2 5 0 .


9Chapter 4

This is a true static mapping, and only the one inside m a c h i n e is fully reachable from the outside at the 1 3 0 . 2 1 4 . 9 9 . 2 5 0 address. As mentioned, the 10S supports destinaUon address mapping as well. It can also do double NAT with just one physical router, if you need it.

Linux IP Masquerade Our Linux box (Red Hat 6.0) also h a s two LAN interfaces. IP Masquerade comes standard with Red Hat 6.0, and can be u s e d with other versions and distribuUons of Linux, although you m a y have to install it yourself. InstrucUons are available on how to do so; check the "References and Resources" section at the end of this chapter. Our example begins with the LAN interfaces already configured and working properly. Here is the output from the ffconfig command: eth0

Link encap-Ethernet

HWaddr 00-80:C8-68:C8.44

inet addr:130.214.99.253

Bcast:130.214.99.255

UP BROADCAST RUNNING MULTICAST

MTU-1500

Mask:255.255.255.0

Metric-i

RX packets:547 errors:0 dropped:0 overruns:0 frame:0 TX packets.10 errors-0 dropped:0 overruns-0 carrier-0 collisions:0 txqueuelen:100 Interrupt:ll Base address:0xfc00 ethl

Link encap:Ethernet inet addr-192.168.0.1

HWaddr 00:60:97:8A:9D:30 Bcast-192.168.0.255

UP BROADCAST RUNNING MULTICAST

MTU:I500

Mask:255.255.255.0 Metric:l

RX packets:35 errors:0 dropped:0 overruns:0 frame:0 TX packets:3 errors:0 dropped:0 overruns-0 carrier-0 collisions-0 txqueuelen:100

Interrupt :3 Base address :0x300

io

Link encap- Local Loopback inet addr-127.0.0.1

UP LOOPBACK RUNNING

Mask- 255.0.0.0 MTU:3924

Metric:l

RX packets:48 errors:0 dropped:0 overruns:0 frame:0 TX packets:48 errors:0 dropped:0 overruns:0 carrier:0 collisions-0 txqueuelen-0

137

138

Chapter 4

9


The a d d r e s s i n g s e t u p is very close to t h a t of the router. Interface e t h l is o u r inside network, again 192.168.0, a n d interface e t h 0 is o u r o u t s i d e interface. With IP M a s q u e r a d e , the a d d r e s s to w h i c h t h e inside is t r a n s l a t e d is d e t e r m i n e d by w h i c h direction traffic is routed. It will u s e the IP a d d r e s s of the o u t s i d e interface. Here's t h e r o u t e table ( o u t p u t from t h e n e t s t a t - r n c o m m a n d ) : Kernel IP routing table Destination

Gateway

Genmask

Flag MSS

Window

irtt

Iface

130.214.99.253

0.0.0.0

255.255.255.255

UH

0

0

0

eth0

192.168.0.0

0.0.0.0

255.255.255.0

U

0

0

0

ethl

130.214.99.0

0.0.0.0

255.255.255.0

U

0

0

0

eth0

127.0.0.0

0.0.0.0

255.0.0.0

U

0

0

0

Io

0.0.0.0

130.214.99.1

0.0.0.0

UG

0

0

0

eth0

Since the default r o u t e (0.0.0.0) is t o w a r d s 1 3 0 . 2 1 4 . 9 9 . 1 , w h i c h is r e a c h a b l e via the eth0 interface, all traffic will exit via t h a t interface (unless it's d e s t i n e d for the 1 9 2 . 1 6 8 . 0 net). Therefore, the IP a d d r e s s for the eth0 interface (130.214.99.253) will be u s e d as the translated source address. IP M a s q u e r a d e replies on the OS doing routing, so r o u t i n g m u s t be e n a b l e d (it's disabled by default). To t u r n r o u t i n g on, i s s u e this command: echo

"i">

/proc/sys/net/ipv4/ip_forward

This will t u r n forwarding on, b u t only until the n e x t reboot (or if it's t u r n e d b a c k off m a n u a l l y in a similar m a n n e r ) . To t u r n it on p e r m a n e n t l y in Red Hat, you'll w a n t to edit t h e / e t c / s y s c o n f i g / n e t w o r k file, a n d c h a n g e the line t h a t reads: FORWARD_IPV4=false

to" FORWARD_IPV4:true

T h a t t a k e s care of the forwarding (routing). The n e x t step is to install a m a s q u e r a d e policy t h a t will t r a n s l a t e traffic the w a y we w a n t . IP M a s q u e r a d e h a n d l e s FTP properly; in fact, t h e r e is a special loadable m o d u l e t h a t n e e d s to be installed for FTP. I s s u e this command:


9Chapter 4

/sbin/modprobe ip_masq_ftp

F r o m its n a m e , it's p r e t t y obvious w h a t this m o d u l e is for. T h e r e are several m o d u l e s like this for IP M a s q u e r a d e , a n d we'll t a k e a look at m o r e later in the chapter. Next, we'll set s o m e t i m e o u t values: /sbin/ipchains - M - S

3600 60 180

The first n u m b e r (3600) specifies h o w m a n y s e c o n d s idle TCP c o n n e c t i o n s will stick a r o u n d (in this case, a n hour). The s e c o n d n u m b e r i n d i c a t e s h o w long after the FIN e x c h a n g e the c o n n e c t i o n is t r a c k e d , a n d the l a s t n u m b e r i n d i c a t e s h o w long UDP c o n n e c t i o n s will be k e p t a r o u n d w i t h o u t a n y traffic. Finally, we p u t in the a c t u a l IP M a s q u e r a d e rules: /sbin/ipchains -P forward deny /sbin/ipchains -A forward -s 192.168.0.2/32 -j MASQ

{192.168.0.2 is still o u r inside m a c h i n e for the example.} At t h i s point, o u r inside m a c h i n e will be able to get to the I n t e r n e t . You w o n ' t w a n t to type t h e s e c o m m a n d s in every time you reboot, so typically you'll w a n t to p u t t h e m in a shell script in / e t c / r c . d so t h a t t h e y r u n on s t a r t u p .

Network Address Translation (Dynamic) Static NAT is 1-to-1 NAT. D y n a m i c NAT is m a n y - t o - m a n y NAT. Note t h a t 1 - t o - m a n y NAT is a special case of m a n y - t o - m a n y NAT {a s u b set}, a n d w o n ' t really be d i s c u s s e d as a s e p a r a t e i s s u e here. If y o u c a n do m a n y - t o - m a n y NAT, y o u c a n also do 1 - t o - m a n y NAT. We've s e e n h o w 1-to-1 NAT works, a n d we've also s h o w n t h a t it d o e s n ' t r e d u c e the r e q u i r e d n u m b e r of IP a d d r e s s e s . This is w h e r e d y n a m i c NAT c o m e s in. D y n a m i c NAT w o r k s by t r a n s l a t i n g a n u m b e r of i n t e r n a l IP a d d r e s s to a n u m b e r {usually a s m a l l e r number} of e x t e r n a l IP a d d r e s s e s . It does so by d y n a m i c a l l y c r e a t i n g 1-to-1 NAT m a p p i n g s on the fly, as needed. Then, t h r o u g h traffic m o n i t o r i n g a n d timers, it d e s t r o y s the m a p p i n g s as needed, a n d frees u p

139

140

Chapter 4


o u t s i d e IP a d d r e s s e s for n e w inside clients. You m a y have a l r e a d y s p o t t e d a problem, b u t hold t h a t t h o u g h t for the section on PAT, later in the chapter. Here's o u r e x a m p l e scenario: You've got a n i n t e r n a l network, 10.0.0.x, with a b o u t 50 m a c h i n e s on it. You get a n I n t e r n e t connection, b u t y o u r ISP c a n give y o u only 16 a d d r e s s e s , 1 9 2 . 1 3 8 . 1 4 9 . 0 t h r o u g h 1 9 2 . 1 3 8 . 1 4 9 . 1 5 . B e c a u s e of s t a n d a r d s u b n e t t i n g issues, 0 a n d 15 c a n ' t be used, 1 is u s e d by the ISP's router, a n d 2 is y o u r router, leaving only 3 t h r o u g h 14, or 12 a d d r e s s e s . Naturally, y o u w a n t to provide I n t e r n e t a c c e s s for all y o u r inside m a c h i n e s ; t h a t ' s w h a t y o u got the I n t e r n e t c o n n e c t i o n for. The s e t u p looks like t h a t s h o w n in Figure 4.12. We k n o w from p r e v i o u s d i s c u s s i o n t h a t we could do it with only 1 IP a d d r e s s a n d a proxy server. For this example, to avoid t h e extra theoretical e x p e n s e of a n e w dedicated server, we're going to m a k e u s e of d y n a m i c NAT.

Figure 4.12 Connecting to the Internet through ISP, 16 addresses

assigned.

We've a l r e a d y identified the r a n g e of available IP a d d r e s s e s , 1 9 2 . 1 3 8 . 1 4 9 . 3 t h r o u g h 1 9 2 . 1 3 8 . 1 4 9 . 1 4 . O u r r o u t e r will be prog r a m m e d with t h o s e a d d r e s s e s as a n o u t s i d e pool a n d 10.0.0.x as a n inside pool. The w o r d "pool" in this context simply refers to a r a n g e of IP a d d r e s s e s . To k n o w h o w to do the d y n a m i c NAT, the r o u t e r will n e e d to k n o w for w h i c h IP a d d r e s s e s it is responsible.


9Chapter 4

T h i s is m o r e i n t u i t i v e for t h e o u t s i d e IP a d d r e s s e s , b e c a u s e t h e r o u t e r n e e d s to be i n f o r m e d of h o w m a n y of t h e IP a d d r e s s e s it c a n u s e for NAT. T h e i n s i d e pool is a little less intuitive. W h y n o t j u s t NAT a n y a d d r e s s f r o m t h e i n s i d e ? T h e r e a r e a c o u p l e of r e a s o n s : First, y o u m i g h t w a n t to d e s i g n a t e a c e r t a i n p o r t i o n of y o u r i n s i d e n e t to go to one o u t s i d e pool, a n d a n o t h e r to go to a different o u t side pool. S e c o n d , y o u m i g h t n e e d to do s t a t i c NAT for c e r t a i n m a c h i n e s , s a y a m a i l server, a n d y o u d o n ' t w a n t t h a t p a r t i c u l a r machine being dynamically translated.

How Does Dynamic NAT Work? W h a t does a r o u t e r h a v e to do to i m p l e m e n t d y n a m i c NAT?. We've a l r e a d y d i s c u s s e d briefly all t h e e l e m e n t s a r o u t e r n e e d s in o r d e r to i m p l e m e n t d y n a m i c NAT. It n e e d s a s t a t e table, it n e e d s to h a v e a n i d e a of w h e n a c o n n e c t i o n s t a r t a n d s t o p s , a n d it n e e d s to h a v e a timer. We've a l r e a d y s e e n h o w s t a t i c NAT w o r k s . For t h e d y n a m i c NAT d i s c u s s i o n , we'll a s s u m e t h a t a w o r k i n g s t a t i c NAT w i t h s t a t e t a b l e s a n d protocol specifics is in place, a n d e x p a n d on t h a t . T h e first m a j o r c h a n g e is t h a t t h e s t a t i c NAT m a p p i n g will no l o n g e r be h a r d c o d e d (i.e., m a n u a l l y c o n f i g u r e d b y a n a d m i n i s t r a t o r ) , b u t will be p a r t of a n o t h e r t a b l e t h a t t h e r o u t e r c a n c h a n g e a s n e e d e d . W h e n we s t a r t , t h e t a b l e will be e m p t y , a n d t h e r e will be no 1-to-1 m a p pings. T h e t a b l e will r e m a i n t h i s w a y u n t i l a n i n s i d e m a c h i n e tries to c o n n e c t to t h e I n t e r n e t . Let's t a k e a m o m e n t to p o i n t o u t t h a t t h i s is a slight s e c u r i t y i m p r o v e m e n t over s t a t i c NAT. W i t h s t a t i c NAT, a n y m a c h i n e on t h e I n t e r n e t c a n a t t e m p t to c o n n e c t to t h e o u t s i d e IP a d d r e s s in a s t a t i c NAT m a p p i n g a t a n y time, a n d t h e y will be allowed t h r o u g h to t h e inside. W i t h d y n a m i c NAT, t h e d e f a u l t for t h e o u t s i d e IP a d d r e s s e s is no m a p p i n g . T h u s , w h e n t h e m a p p i n g t a b l e is e m p t y , a n y a t t e m p t s to t h e o u t s i d e IP a d d r e s s e s s h o u l d be futile, a s t h e y m a p to no i n s i d e m a c h i n e s a t t h e time. T h i s is n o t y e t sufficient for s e c u rity p u r p o s e s , b u t it is a n i m p r o v e m e n t .

141

142

Chapter 4


W h e n a n inside m a c h i n e a t t e m p t s to c o n n e c t to t h e I n t e r n e t , t h e r o u t e r will c o n s u l t its table, a n d p i c k a n available u n u s e d o u t s i d e IP a d d r e s s . In o u r e x a m p l e , since t h e t a b l e is c u r r e n t l y e m p t y , it will likely p i c k t h e first one. It will t h e n c r e a t e a n e n t r y in t h e m a p p i n g table, a n d c r e a t e a (temporary) s t a t i c m a p p i n g from t h e i n s i d e m a c h i n e ' s IP a d d r e s s to t h e o u t s i d e IP a d d r e s s it h a s c h o s e n . Note t h a t t h e r o u t e r ' s i d e a of a c o n n e c t i o n a t t e m p t to t h e I n t e r n e t m a y be very simplistic: a s s o o n a s it gets a n y p a c k e t from t h e i n s i d e dest i n e d for t h e o u t s i d e , it m a y c r e a t e a m a p p i n g . T h e r o u t e r will also s t a r t a t i m e r a t t h i s point. As long a s t h e i n s i d e m a c h i n e is s e n d i n g traffic out, or s o m e t h i n g on t h e I n t e r n e t is s e n d i n g traffic in (via t h a t o u t s i d e IP a d d r e s s ) t h e m a p p i n g will r e m a i n . Every t i m e a p a c k e t is p a s s e d t h a t is p a r t of t h a t m a p p i n g , t h e t i m e r is reset. T h e r e are two w a y s t h e m a p p i n g will be r e m o v e d . T h e first is t h a t t h e c o n n e c t i o n is s t o p p e d n o r m a l l y . For e x a m p l e , t h e FTP sess i o n is done, a n d t h e client h a s quit. For t h i s to work, t h e r o u t e r h a s to h a v e a n i d e a of w h a t t h e e n d of a c o n n e c t i o n looks like. F o r TCP c o n n e c t i o n s , t h i s is relatively easy, a s t h e r e are p a r t i c u l a r flags t h a t i n d i c a t e t h e e n d of a c o n n e c t i o n . Of c o u r s e , for t h e r o u t e r to w a t c h for t h e e n d of a c o n n e c t i o n , it w o u l d h a v e h a d to w a t c h for one to s t a r t . We'll t a l k m o r e a b o u t h o w t h i s w o r k s in t h e s e c t i o n on PAT. T h e s e c o n d w a y a m a p p i n g is d e s t r o y e d is t h a t no traffic is s e n t for t h e d u r a t i o n of t h e timer. W h e n t h e t i m e r r u n s out, t h e a s s u m p t i o n is t h a t a n y c o m m u n i c a t i o n s m u s t be finished, a n d t h e m a p p i n g is r e m o v e d . N a t u r a l l y , while t h i s one i n s i d e m a c h i n e is c o m m u n i c a t i n g on t h e I n t e r n e t , o t h e r i n s i d e m a c h i n e s m a y b e g i n to a s well, a n d t h e y w o u l d get t h e i r o w n i n d i v i d u a l m a p p i n g s .

Problems with Dynamic NAT By now, t h e p r o b l e m s w i t h d y n a m i c NAT m a y be evident. If we a s s u m e t h e s i m p l i s t i c model, w h e r e t h e r o u t e r c r e a t e s a m a p p i n g a s s o o n a s a n y p a c k e t goes f r o m a n i n s i d e m a c h i n e to t h e I n t e r n e t , a n d only gets r e l e a s e d w h e n a t i m e r expires, m a p p i n g s a r e going to


9Chapter 4

t e n d to s t i c k a r o u n d . If we've got 50 i n s i d e m a c h i n e s a n d only 14 o u t s i d e a d d r e s s e s , t h e r e a r e going to be p r o b l e m s a t c e r t a i n t i m e s of t h e day, like m o r n i n g s a n d l u n c h t i m e w h e n e v e r y o n e w a n t s to a c c e s s t h e Web. How c a n t h i s p r o b l e m be solved? O n e w a y to h e l p alleviate it is to provide m o r e o u t s i d e IP a d d r e s s e s . In o u r e x a m p l e , t h i s i s n ' t p r a c t i c a l s i n c e we got j u s t so m a n y f r o m t h e ISP. Besides, it s e e m s clear t h a t t h e r e is a possibility t h a t all 50 i n s i d e m a c h i n e s m i g h t w a n t to a c c e s s t h e I n t e r n e t a t t h e s a m e t i m e s o m e d a y , a n d we w o u l d n e e d 50 o u t s i d e a d d r e s s e s . At t h a t point, we m i g h t a s well be b a c k a t s t a t i c NAT, a n d t h e r e w o u l d still be no a d d r e s s savings. A n o t h e r possibility is to try to r e d u c e t h e a m o u n t of t i m e t h a t a m a p p i n g s t i c k s a r o u n d . T h i s will give i n s i d e m a c h i n e s a b e t t e r c h a n c e a t g e t t i n g o u t a t p e a k times. We c o u l d r e d u c e t h e timer, b u t t h a t w o u l d i n c r e a s e t h e c h a n c e s t h a t it m i g h t expire while a n i n s i d e m a c h i n e is a w a i t i n g a r e s p o n s e f r o m a slow s e r v e r on t h e I n t e r n e t . T h i s w o u l d be effectively b r o k e n , a n d c o u l d r e s u l t in p a c k e t s r e a c h ing t h e w r o n g i n t e r n a l client. T h e o t h e r w a y to r e d u c e t h e a m o u n t of t i m e is to i m p r o v e t h e r o u t e r ' s r e c o g n i t i o n of w h e n c o n n e c t i o n s a r e complete. However, t h i s a d d s a fair a m o u n t of complexity. Often, a client will h a v e m u l t i p l e c o n n e c t i o n s o p e n to t h e I n t e r n e t a t a given time. T h i s is especially t r u e for Web s u r f i n g , for e x a m p l e . E a c h different e l e m e n t on a Web p a g e is r e t r i e v e d a s a s e p a r a t e c o n n e c t i o n , a t l e a s t u n d e r HTI'P 1.0. If y o u c o n n e c t to a Web p a g e w i t h 10 p i c t u r e s , t h a t will r e s u l t in at l e a s t 11 c o n n e c t i o n s ~ l for t h e HTML page, a n d 10 for t h e p i c t u r e s . So, a r o u t e r c a n ' t s i m p l y w a t c h for t h e e n d of a n y c o n n e c t i o n , it h a s to w a t c h for t h e e n d of e v e r y c o n n e c t i o n . T h e r o u t e r h a s to k n o w h o w m a n y c o n n e c t i o n s a r e t a k i n g place, w h i c h m e a n s it h a s to w a t c h for t h e b e g i n n i n g s of c o n n e c t i o n s in o r d e r to c o u n t t h e m . T h i s is all h a n d l e d in y e t a n o t h e r table. E a c h t i m e a c o n n e c t i o n s t a r t s , a n e n t r y is c r e a t e d in t h e table. E a c h of t h e s e t a b l e e n t r i e s m a y h a v e t h e i r o w n timer, r a t h e r t h a n u s i n g one global t i m e for t h e w h o l e i n s i d e m a c h i n e . T h i s w o r k s p r e t t y well for c o n n e c t i o n - o r i e n t ed p r o t o c o l s like TCP, w h e r e t h e r e is a c l e a r b e g i n n i n g a n d e n d to

143

144

Chapter 4


c o n n e c t i o n s , b u t it d o e s n ' t w o r k quite as well for c o n n e c t i o n l e s s protocols like UDP a n d ICMP, so for t h o s e we're b a c k to timers. All in all, d y n a m i c NAT (as s t a t e d here) isn't very workable. It s e e m s clear in o u r e x a m p l e t h a t if 14 people on the inside are actively u s i n g the I n t e r n e t at a given m o m e n t , no additional inside people will get to u s e the Internet. Clearly, s o m e t h i n g t h a t c a n g u a r a n t e e fair a c c e s s for a n arbit r a r y n u m b e r of inside m a c h i n e s s i m u l t a n e o u s l y is needed. T h a t ' s w h y d y n a m i c NAT d o e s n ' t w o r k exactly the w a y we said; this is covered in detail in the PAT section.

Configuration Examples U n f o r t u n a t e l y , c o n f i g u r a t i o n e x a m p l e s for m a n y - t o - m a n y d y n a m i c NAT will be p r e t t y sparse. In fact, o u t of o u r t h r e e examples, only Cisco lOS s u p p o r t s m a n y - t o - m a n y NAT.

Cisco IOS We're going to look at a m a n y - t o - m a n y e x a m p l e u s i n g lOS. For this example, we're b a c k to the first config we looked at (no NAT config yet). Here are the c o m m a n d s : NAT(config) #interface fastethernet 0/0 NAT(config-if) #ip nat inside NAT(config-if)#int

fastethernet 0/i

NAT(config-if) #ip nat outside NAT (config-if) #exit

NAT(config)#ip nat pool dynpool 130.214.99.200 130.214.99.250 netmask 255.255.255.0 NAT(config)#ip nat inside source list 1 pool dynpool overload NAT(config)#access-list 1 permit 192.168.0.0 0.0.0.255

The first five lines are the s a m e as before. The n e x t line defines a pool, n a m e d dynpool,, w h i c h is a r a n g e of IP a d d r e s s e s from 1 3 0 . 2 1 4 . 9 9 . 2 0 0 t h r o u g h 1 3 0 . 2 1 4 . 9 9 . 2 5 0 . W h e n the r o u t e r u s e s t h e m , it will u s e t h e m as if t h e y h a d a s u b n e t m a s k of 255.255.255.0.

N e t w o r k Address Translation

9 Chapter 4

Next is the NAT c o m m a n d , w h i c h s t a r t s w i t h ip n a t inside source, like the other. In this case, t h o u g h , we're going to m a t c h a g a i n s t a n a c c e s s list to pick u p o u r s o u r c e a d d r e s s e s . The t r a n s l a t ed a d d r e s s e s will be from a pool n a m e d dynpool. The overload keyword m e a n s t h a t potentially t h e r e will be m o r e inside a d d r e s s e s t h a n t h e r e are a d d r e s s e s in the pool, a n d the r o u t e r is to h a n d l e t h a t s i t u a t i o n in a p a r t i c u l a r w a y (see the n e x t section on PAT). Finally, we define list 1, w h i c h we referenced in the p r e v i o u s comm a n d . List 1 is s i m p l y the inside IP a d d r e s s range. With this configuration, w h e n a n inside m a c h i n e w a n t s to get out, the r o u t e r will a s s i g n it a n IP a d d r e s s from the pool d y n a m i c a l ly. W h e n this configuration w a s tested, IP a d d r e s s .200 w a s assigned.

Port Address Translation (PAT) T h e r e is a w a y to a d d r e s s the p r o b l e m s with static a n d d y n a m i c NAT, to allow m o r e t h a n one inside m a c h i n e to s h a r e one o u t s i d e IP a d d r e s s . It's called Port A d d r e s s T r a n s l a t i o n , or PAT. S o m e folks m a y also t h i n k of PAT as being d y n a m i c NAT since, as we'll see, PAT is really n e c e s s a r y for d y n a m i c NAT to f u n c t i o n properly. In o t h e r cases, v e n d o r s will refer to PAT simply as "NAT" a n d you'll have to look at the listed capabilities of the p r o d u c t to d e t e r m i n e exactly w h a t type it is. In Firewall-1, w h i c h is a very p o p u l a r firewall produ c t from C h e c k p o i n t , PAT is referred to as "hide NAT," m a k i n g reference to the fact t h a t m a n y inside IP a d d r e s s e s c a n "hide" b e h i n d one IP a d d r e s s . The r e a s o n for the n a m i n g c o n f u s i o n is twofold: First, NAT is defined for a given p r o d u c t by the m a r k e t i n g d e p a r t m e n t s of t h a t vendor, so t h e r e is b o u n d to be s o m e confusion. Second, PAT is really the d o m i n a n t form of NAT in u s e t o d a y (though static NAT is s o m e t i m e s a n e c e s s a r y p a r t of the s e c u r i t y architecture). So, m a n y v e n d o r s of PAT-capable p r o d u c t s oversimplify, a n d j u s t call t h e whole collection of f e a t u r e s NAT. As w i t h a n y p r o d u c t evaluation, if y o u ' r e c o n s i d e r i n g p u r c h a s i n g a p r o d u c t , t a k e a look at the technical d o c u m e n t a t i o n to see exactly w h a t the capabilities are.

145

146

Chapter 4


So w h a t ' s t h e p r o b l e m w i t h two i n s i d e m a c h i n e s s h a r i n g t h e s a m e o u t s i d e IP a d d r e s s anyway?. C o l l i s i o n s ~ n o t collisions in t h e E t h e r n e t s e n s e , if you've s t u d i e d E t h e r n e t a t all, b u t r a t h e r colliding p o r t n u m b e r s a n d IP a d d r e s s e s . Let's look a t t h e naive v e r s i o n of s h a r i n g a n o u t s i d e a d d r e s s . TWo m a c h i n e s on t h e i n s i d e t r a n s m i t r e q u e s t s to t h e I n t e r n e t . W h e n t h e replies c o m e b a c k , t h e y b o t h c o m e b a c k to t h e o u t s i d e IP a d d r e s s . How c a n t h e r o u t e r decide w h i c h of t h e two IP a d d r e s s e s on t h e i n s i d e t h e p a c k e t s s h o u l d be s e n t to? Let's look a t a m o r e involved v e r s i o n of a NAT r o u t e r t h a t is trying to u s e one o u t s i d e IP a d d r e s s for m o r e t h a n one i n s i d e m a c h i n e . In t h e s e c t i o n on d y n a m i c NAT, we d i s c u s s e d a r o u t e r t h a t is c a p a ble of t r a c k i n g i n d i v i d u a l c o n n e c t i o n s a s t h e y p a s s t h r o u g h a n d a r e t r a n s l a t e d . A d d i n g t h i s c a p a b i l i t y w o u l d s e e m to c o r r e c t t h e p r o b l e m of t h e r o u t e r n o t k n o w i n g w h i c h IP a d d r e s s to s e n d t h e p a c k e t b a c k to. It c a n s i m p l y s c a n t h r o u g h t h e t a b l e a n d look for a c o n n e c t i o n t h a t t h e c u r r e n t p a c k e t s e e m s to m a t c h . W h e n t h e r o u t e r finds t h e m a t c h , it looks u p t h e i n s i d e IP a d d r e s s t h a t c o n n e c t i o n b e l o n g s to, a n d f o r w a r d s it to t h a t m a c h i n e , after p r o p e r t r a n s l a t i o n , of c o u r s e . Does this w o r k ? Not quite yet. B a c k to the i s s u e of collisions: Imagine t h a t two inside m a c h i n e s , w h i c h s h a r e the s a m e outside IP a d d r e s s , w a n t to m a k e a q u e r y of the ISP's DNS server. Since t h e DNS server is m a i n t a i n e d by the ISP, it's "on the Internet" from the client's point of view. At least, it's on t h e far side of t h e NAT r o u t e r from t h e client, so t h e r e will be a t r a n s l a t i o n on the w a y out. Let's t a k e a look at w h a t k i n d of i n f o r m a t i o n m i g h t be in the c o n n e c t i o n table we've b e e n talking about. Certainly, t h e r e are IP a d d r e s s e s : I n t e r n e t IP a d d r e s s (the server), inside IP a d d r e s s (real inside m a c h i n e address), a n d outside IP a d d r e s s (the a d d r e s s the inside m a c h i n e is t r a n s l a t e d to). A n o t h e r obvious t h i n g to t r a c k is the TCP a n d UDP port n u m b e r s for t h o s e types of connections, b o t h s o u r c e a n d d e s t i n a t i o n ports. For o u r example, let's a s s u m e all of this is tracked. B a c k to t h e clients t a l k i n g to t h e DNS server: T h e y will be s e n d ing p a c k e t s to t h e s a m e s e r v e r IP a d d r e s s , a n d t h e s a m e p o r t n u m b e r (UDP p o r t 53 for client DNS queries). We a l r e a d y k n o w t h e y


9Chapter 4

s h a r e the s a m e o u t s i d e IP a d d r e s s , so in the c o n n e c t i o n table for t h e s e two s e p a r a t e "connections" (in q u o t e s b e c a u s e UDP is c o n n e c tionless), t h e I n t e r n e t IP a d d r e s s is the s a m e , the o u t s i d e IP a d d r e s s is the s a m e , a n d the d e s t i n a t i o n p o r t n u m b e r is the s a m e . The inside IP a d d r e s s e s are different, a n d the s o u r c e p o r t n u m b e r s are p r o b a b l y different. The r e q u e s t s go o u t with no problem. The p r o b l e m is, two r e q u e s t s from two s e p a r a t e inside m a c h i n e s look very similar, a n d p r o b a b l y only differ on the s o u r c e p o r t a n d d a t a p o r t i o n of the packet. W h e n a reply c o m e s b a c k to the o u t s i d e IP a d d r e s s , the only differentiating factor at t h a t time (since the r o u t e r d o e s n ' t k n o w w h i c h inside IP a d d r e s s to s e n d to; t h a t ' s w h a t it's trying to figure out) is the s o u r c e port. More specifically, it looks at w h a t is n o w the destin a t i o n p o r t (source a n d d e s t i n a t i o n p o r t get r e v e r s e d on replies), decides w h i c h of the two inside m a c h i n e s w a s u s i n g t h a t as a s o u r c e port, a n d s e n d s it to t h a t one. T h e r e ' s w h e r e the possibility for collision c o m e s in. Most operating s y s t e m s will s t a r t allocating s o u r c e p o r t s at 1,025, a n d w o r k t h e i r w a y u p sequentially. T h e r e ' s a very good c h a n c e t h a t at s o m e point, the two inside m a c h i n e s will h a p p e n to be u s i n g the s a m e s o u r c e p o r t at the s a m e m o m e n t , trying to talk to the s a m e IP a d d r e s s on the I n t e r n e t , as the s a m e d e s t i n a t i o n port. E v e r y t h i n g m a t c h e s except for the inside IP a d d r e s s , w h i c h is n o t good since t h a t ' s t h e u n k n o w n piece of i n f o r m a t i o n w h e n the p a c k e t arrives at the o u t s i d e IP a d d r e s s on the router. The p r o b l e m lies in the fact t h a t the h e a d e r s in the two r e q u e s t s are the s a m e , b u t t h e d a t a portion differs. The NAT device h a s to d e t e r m i n e w h i c h p a c k e t goes to w h i c h inside m a c h i n e .

How Does PAT Work? Statistically, we've got a s m a l l e r c h a n c e of h a v i n g a conflict t h a n we did with s t r a i g h t d y n a m i c NAT. Still, we'd like to m a k e t h e c h a n c e of conflict negligible. This is w h e r e PAT c o m e s in. If y o u h a d n ' t a l r e a d y g u e s s e d from the n a m e , PAT w o r k s by t r a n s l a t i n g p o r t n u m b e r s

147

148

Chapter 4


a l o n g w i t h IP a d d r e s s e s . Specifically, w h e n it t r a n s l a t e s t h e s o u r c e a d d r e s s on t h e w a y out, it also t r a n s l a t e s t h e s o u r c e port. If t h e r o u t e r is careful n o t to c r e a t e conflicts w h e n it c h o o s e s n e w s o u r c e ports, t h i s s o l u t i o n w o r k s well a n d e l i m i n a t e s conflicts, a t l e a s t for TCP a n d UDP. S o m e e x t r a t r i c k s a r e s o m e t i m e s n e e d e d for ICMP, w h i c h h a d no p o r t n u m b e r s p e r se. Now, t h e r o u t e r h a s a u n i q u e p o r t n u m b e r to r e f e r e n c e w h e n all t h e o t h e r i n f o r m a t i o n m a t c h e s a n o t h e r c o n n e c t i o n . PAT e n a b l e s a very large n u m b e r of i n s i d e m a c h i n e s to s h a r e even j u s t one o u t s i d e IP a d d r e s s . How m a n y exactly?. It's difficult to give a n e x a c t n u m b e r , s i n c e it d e p e n d s on u s a g e p a t t e r n s , so let's m a k e s o m e a s s u m p tions. A s s u m e t h a t t h e limit factor will be m a n y i n s i d e m a c h i n e s c o m m u n i c a t i n g w i t h a single I n t e r n e t IP a d d r e s s at one time. T h e w o r s t c a s e will p r o b a b l y be UDP, s i n c e we're s t u c k u s i n g t i m e r s to e m u l a t e c o n n e c t i o n s (to k n o w w h e n t h e y ' r e done). Let's s a y t h e t i m e r is s e t for two m i n u t e s . T h a t is, after two m i n u t e s of no p a c k ets f r o m e i t h e r side, t h e c o n n e c t i o n is d e c l a r e d over. T h e p o s s i b l e r a n g e of p o r t n u m b e r s is 0 to 6 5 , 5 3 5 , so t h e t h e o r e t i c a l limit is 6 5 , 5 3 6 s i m u l t a n e o u s c o n n e c t i o n s . T h i s a s s u m e s t h a t t h e y a r e all h a p p e n i n g a t t h e s a m e time, e i t h e r b e c a u s e t h e y all s t a r t a t t h e s a m e t i m e a n d h a v e to w a i t two m i n u t e s , or b e c a u s e t h e c o n n e c t i o n s a r e active l o n g e r t h a n t h a t , a n d it b u i l d s u p to t h a t level. T h i s is for one o u t s i d e IP a d d r e s s . If a flavor of d y n a m i c IP is b e i n g u s e d , m u l t i p l y t h a t n u m b e r b y t h e n u m b e r of IP a d d r e s s e s b e i n g u s e d for d y n a m i c NAT w i t h PAT. R e m e m b e r , t h a t a p p l i e s only if all t h e clients w a n t to t a l k to t h e s a m e m a c h i n e on t h e I n t e r n e t . If y o u c o n s i d e r all t h e m a c h i n e s on t h e I n t e r n e t , t h e c h a n c e s for conflict d r o p to n e a r l y zero. C h a n c e s a r e good t h a t in t h e real world, you'll e x h a u s t t h e m e m o r y of y o u r NAT device before y o u s t a r t r e a c h i n g a n y t h e o r e t i c a l limits. W h a t is t h e s e c u r i t y s i t u a t i o n w i t h PAT?. It's s t a r t i n g to look a lot better. An o u t s i d e IP a d d r e s s no l o n g e r c o r r e s p o n d s to a single i n s i d e IP a d d r e s s ; it n o w d e p e n d s on t h e c o n n e c t i o n . T h i s m e a n s t h a t if a n e w c o n n e c t i o n a t t e m p t is m a d e to t h e o u t s i d e a d d r e s s , it will n o t m a t c h a n y t h i n g in t h e c o n n e c t i o n table, a n d will t h e r e f o r e


9Chapter 4

n o t h a v e a n i n t e r n a l IP a d d r e s s to c o n n e c t to. At least, t h a t ' s t h e m o s t c o m m o n b e h a v i o r w h e n a n I n t e r n e t m a c h i n e tries to c o n n e c t to a n o u t s i d e a d d r e s s . It's t h e o r e t i c a l l y p o s s i b l e to d e s i g n t h e PAT so t h a t a p a r t i c u l a r o u t s i d e IP a d d r e s s m a p s to a p a r t i c u l a r i n s i d e a d d r e s s ( c o m b i n e d s t a t i c NAT a n d PAT). F o r a s e c u r i t y a p p l i c a t i o n , y o u w o u l d n o t w a n t t h a t behavior. A n o t h e r "gotcha" to look o u t for is t h a t t h e o u t s i d e IP a d d r e s s i s n ' t t h e IP a d d r e s s of t h e NAT device for t h a t interface. For e x a m p l e , w i t h s o m e r o u t e r s it's p o s s i b l e to u s e t h e r o u t e r ' s o w n o u t s i d e IP a d d r e s s for PAT. In t h a t case, conn e c t i o n a t t e m p t s to t h e o u t s i d e IP a d d r e s s will c o n n e c t to t h e router, w h i c h m a y n o t be desirable. M a n y PAT i m p l e m e n t a t i o n s only allow a p a r t i c u l a r i n s i d e pool to m a p to a single o u t s i d e IP a d d r e s s . P r e s u m a b l y , t h i s is b e c a u s e j u s t a b o u t a n y size i n s i d e n e t w o r k c a n m a p to a single o u t s i d e IP address. Let's t a k e a look a t w h a t t h e s e c o n n e c t i o n t a b l e s we've b e e n disc u s s i n g m i g h t look like. T h e y i n c l u d e i n s i d e s o u r c e IP a d d r e s s , o u t side s o u r c e IP a d d r e s s , d e s t i n a t i o n I n t e r n e t IP a d d r e s s , original s o u r c e port, t r a n s l a t e d s o u r c e port, d e s t i n a t i o n port, t r a n s p o r t protocol, FIN flags, a n d timer. FIN flags w o u l d be a c o u p l e of s i m p l e flags to i n d i c a t e t h a t a FIN e x c h a n g e h a s b e e n d o n e for one of t h e two d i r e c t i o n s . TCP c o n n e c t i o n s , if closed properly, close e a c h direction s e p a r a t e l y , so we n e e d to t r a c k e a c h direction. W h e n b o t h flags a r e set, t h e w h o l e c o n n e c t i o n is done. If a RST o c c u r s i n s t e a d , t h e flags a r e n ' t n e e d e d , a n d t h e c o n n e c t i o n is d o n e i m m e d i a t e l y . F i g u r e 4 . 1 3 c o n t a i n s a d i a g r a m of a p o s s i b l e c o n n e c t i o n , w h i c h we c a n u s e a s a n e x a m p l e . In t h e d i a g r a m , t h e i n s i d e m a c h i n e is 10.0.0.2, t h e r o u t e r ' s o u t s i d e IP a d d r e s s is 1 9 2 . 1 3 8 . 1 4 9 . 1 , a n d t h e s e r v e r w e ' r e c o n t a c t i n g on t h e I n t e r n e t is 2 0 7 . 2 4 4 . 1 1 5 . 1 7 8 . T h e line b e t w e e n t h e Web s e r v e r a n d t h e r o u t e r r e p r e s e n t s t h e I n t e r n e t b e t w e e n t h e two.

149

150

Chapter 4


Figure 4.13 Simple PAT arrangement, using a router's o w n outside IP address.

The inside m a c h i n e s e n d s a SYN p a c k e t to port 80 on the Web server, u s i n g a source port of 1030. Here's w h a t the table entry mi ght look like:

FIN Desti- TransDesti- TransFIN DestiSource nation lated Source nation lated Protocol Source nation Timer Port Port Address Address Address Port

!10.0.0.2 207.244. 192.138. 1030 115.178 149.1

80

5309

TCP

Off

Off

2:00

All of the labels t h a t indicate direction are from the point of view of the first packet, the SYN packet, going from the inside to the outside. Many of the items will be reversed for p a c k e t s going the other way, b u t the r o u t e r will keep t r a c k of t h a t by noting into wh ich interface the p a c k e t arrived. Here's a r o u g h block di a gr a m of the SYN p a c k e t h e a d e r s j u s t leaving the inside machine:

Destination Address

Destination Source Address Port

Source Port

Flags

207.244.115.178

10.0.0.2

1030

SYN

80

Network Address Translation 9Chapter 4 H e r e is t h e s a m e p a c k e t after it p a s s e s t h r o u g h t h e r o u t e r :

Destination Address


Source Port

Flags

207.244.115.178

192.138.149.1

5309

SYN

80

Notice t h a t t h e s o u r c e a d d r e s s a n d s o u r c e p o r t h a v e b o t h b e e n t r a n s l a t e d . H e r e ' s t h e reply p a c k e t from t h e Web server:

Destination Address


Source Port

Flags

192.138.149.1

207.244.115.178

80

SYN-ACK

5309

S o u r c e a n d d e s t i n a t i o n h a v e b e e n r e v e r s e d , a n d t h e flag is n o w SYN-ACK. T h i s is t h e p a c k e t t h a t will arrive a t t h e o u t s i d e of t h e r ou ter. T h e r o u t e r h a s to m a k e its d e c i s i o n w i t h t h e s e m a i n fields. All t h e r o u t e r h a s to do is m a t c h t h e f o u r l e f t m o s t fields to t h e conn e c t i o n table. If t h e r e is a m a t c h , it r o u t e s t h e p a c k e t a n d r e s t o r e s t h e original s o u r c e a d d r e s s a n d s o u r c e p o r t (now d e s t i n a t i o n a d d r e s s a n d port):

Destination Address


Source Port

Flags

10.0.0.2

207.244.11 5.178

80

SYN-ACK

1030

T h e a d d r e s s a n d p o r t t h e r o u t e r n e e d s to t r a n s l a t e t h e p a c k e t b a c k a r e s i m p l y looked u p in t h e c o n n e c t i o n table. T h e c o n n e c t i o n t a b l e e n t r y will r e m a i n u n t i l one of t h r e e c o n d i t i o n s a r e met: []

B o t h s e t s of FIN p a c k e t s a r e received

9 A RST p a c k e t is s e n t b y e i t h e r e n d 9 The timer runs out

151

152

Chapter 4


T h e t i m e r is c h e c k e d periodically to see if t i m e h a s r u n out. In a d d i t i o n , e a c h t i m e a p a c k e t is r o u t e d for t h i s c o n n e c t i o n , t h e t i m e r is r e s e t to two m i n u t e s , or w h a t e v e r o t h e r v a l u e is u s e d . UDP w o r k s m u c h t h e s a m e , e x c e p t t h e r e a r e no FIN or RST p a c k e t s to i n d i c a t e t h e e n d of a c o n n e c t i o n , so only a t i m e r is relied on to e n d UDP c o n n e c t i o n s .

Problems with PAT W h a t k i n d of p r o b l e m s exist w i t h PAT?. PAT h a s all of t h e p r o b l e m s of s t a t i c NAT (i.e., h a v i n g to t r a n s l a t e a d d r e s s e s t h a t a p p e a r in t h e d a t a p o r t i o n of p a c k e t s ) , p l u s a c o u p l e of n e w ones. O u r d i s c u s s i o n of PAT w a s b a s e d a r o u n d t h e i d e a of a fully f u n c t i o n i n g s t a t i c NAT. So a n y p r o t o c o l s t h a t p a s s IP a d d r e s s e s in t h e d a t a p o r t i o n of p a c k ets, like FTP, s h o u l d be h a n d l e d . Well, n o t quite. T h e s h a r i n g of a n o u t s i d e IP a d d r e s s t h a t gives u s t h e a l m o s t - f i r e w a l l effect of n o t allowing m a c h i n e s on t h e I n t e r n e t to c o n n e c t i n s i d e w o r k s a g a i n s t u s here. Again, FTP s e r v e s a s a good e x a m p l e of t h e p r o b l e m . We'll a s s u m e t h e d a t a p o r t i o n of t h e p a c k e t s (the FTP P O R T c o m m a n d ) is g e t t i n g modified properly. So w h a t h a p p e n s w h e n t h e FTP s e r v e r tries to c o n n e c t to t h e o u t s i d e IP a d d r e s s a t t h e p o r t s u p p l i e d ? T h e r e is no e n t r y in t h e c o n n e c t i o n t a b l e to p e r m i t it, a n d it will fail. T h e s o l u t i o n is obvious. While t h e NAT s o f t w a r e modifies t h e P O R T c o m m a n d (and n o w it h a s to c h a n g e t h e p o r t p a s s e d in t h e s a m e m a n n e r a s it does for o t h e r c o n n e c t i o n s ) , it also c r e a t e s a n e n t r y in t h e c o n n e c t i o n table. For t h i s e x a m p l e , refer b a c k to F i g u r e 4.9. T h i s time, t h e protocol will be FTP i n s t e a d of HTrP. After t h e initial c o n n e c t i o n h a s b e e n m a d e , t h e c o n n e c t i o n t a b l e looks like this: DestiTransDestiSource nation lated Source nation Address Address Address Port Port 10.0.0.2 207.244. 192.138. 1042 21 115.178 149.1

Translated FIN Port Protocol Source 6123 TCP Off

FIN Destination Timer Off

2:00


9Chapter 4

At s o m e p o i n t d u r i n g t h e c o n n e c t i o n , t h e FTP client will i s s u e a PORT c o m m a n d . For o u r e x a m p l e , we'll u s e PORT 1 0 , 0 , 0 , 2 , 4 , 1 9 . The p o r t n u m b e r s e c t i o n 4 , 1 9 t r a n s l a t e s to 1043 in decimal, w h i c h is w h a t p o r t t h e OS will h a n d o u t next. T h e r o u t e r will h a v e to t r a n s l a t e t h i s PORT c o m m a n d . If we a s s u m e t h e n e x t t r a n s l a t e d p o r t t h e r o u t e r m a k e s available is 6 1 7 7 , t h e PORT c o m m a n d b e c o m e s PORT 1 9 2 , 1 3 8 , 1 4 9 , 1 , 2 4 , 3 3 . (The PORT c o m m a n d w o r k s in bytes: 2 4 * 2 5 6 + 3 3 = 6177.) In addition, t h e r o u t e r m u s t a d d t h i s n e w p o r t to t h e c o n n e c t i o n table. Now t h e t a b l e looks like this: FIN Desti- TransTransDestiSource nation lated FIN DestiSource nation lated Address Address Address Port Protocol Source nation Timer Port Port 10.0.0.2 207.244. 192.138. 1042 115.178 149.1

21

6123

TCP

Off

Off

2:00

10.0.0.2 207.244. 192.138. 1043 115.178 149.1

20

6177

TCP

Off

Off

2"00

Now, w i t h t h i s addition, PAT p r o p e r l y h a n d l e s FTP. T h e d a t a c o n n e c t i o n will be h a n d l e d a s a s e p a r a t e c o n n e c t i o n , a n d will be r e m o v e d u n d e r t h e s a m e c i r c u m s t a n c e s a s a n y o t h e r TCP c o n n e c tion. We h a v e finally a c h i e v e d o u r goal of IP a d d r e s s s a v i n g s , w h i c h is t h e driving factor for w a n t i n g to u s e NAT in t h e first place.

With t h i s type of s e t u p , PAT w o r k s well. T h e r e is one s m a l l "gotcha" t h a t c o m e s u p on occasion. T h e r e really i s n ' t a n y good reas o n to do so, b u t s o m e s e r v e r s on t h e I n t e r n e t will p a y special a t t e n t i o n to t h e s o u r c e p o r t t h a t is u s e d w h e n t h e y are b e i n g conn e c t e d to. This c o m e s u p m o s t often w i t h DNS. Traditionally, w h e n two DNS s e r v e r s c o m m u n i c a t e u s i n g UDP, t h e y will u s e p o r t 53 a s a

153

154

Chapter 4


d e s t i n a t i o n port, as well as t h e i r s o u r c e port. This is a m a t t e r of c o n v e n t i o n r a t h e r t h a n a h a r d a n d fast rule. If we're t r a n s l a t i n g t h e s o u r c e a d d r e s s , t h o u g h , t h e r e could be a problem. T h e r e are a few sites on t h e I n t e r n e t t h a t have configured their DNS servers to a c c e p t c o n n e c t i o n s only from p o r t 53. This h a s come u p in the p a s t with b o t h a p p l e . c o m a n d intel.com, b u t t h e y a r e n ' t the only ones. It c a n be difficult to get o t h e r s to c h a n g e to s u i t you, so if y o u find y o u r s e l f h a v i n g t r o u b l e w i t h a part i c u l a r DNS server, y o u m a y h a v e to c h a n g e t h e t r a n s l a t i o n for y o u r i n t e r n a l DNS server to static so t h a t t h e s o u r c e port of 53 i s n ' t c h a n g e d on t h e w a y out. This applies only if y o u r u n y o u r own inside DNS servers. If y o u u s e y o u r ISP's DNS servers (which w o u l d be outside), t h e n m o s t likely y o u w o n ' t have a problem.

Configuration Examples In a way, a l m o s t all t h e c o n f i g u r a t i o n e x a m p l e s ( m i n u s t h e Cisco static NAT example) have b e e n PAT examples. At their cores, ICS a n d IP M a s q u e r a d e are PAT p r o d u c t s , even if y o u ' r e only t r a n s l a t i n g one a d d r e s s to another, lOS c a n do it or not, d e p e n d i n g on h o w y o u configure it. Even so, we'll t a k e a n o p p o r t u n i t y to go into a little m o r e d e p t h , a n d look at a few m o r e examples. The r e a s o n for the r u s e so far is that, practically s p e a k i n g , NAT (without PAT) d o e s n ' t a c t u a l l y work. All of t h e p r o b l e m s we've disc u s s e d so far m a k e plain NAT u n u s a b l e .

W i n d o w s NT 2 0 0 0 T h e r e really i s n ' t a lot m o r e to s a y a b o u t ICS from t h e first example. It's a PAT p r o d u c t , a n d all t h e inside IP a d d r e s s e s are forced to 192.168.0, a n d are p o r t - t r a n s l a t e d o u t u s i n g t h e single d i a l - u p a d d r e s s . T h e r e is, however, a n o t h e r option we h a v e n ' t looked at yet. T h e r e w a s a n o t h e r t a b on the w i n d o w b r o u g h t u p by t h e S e t t i n g s b u t t o n , as s h o w n in Figure 4.14.


9Chapter 4

Figure 4.14 ICS reverse connection setup.

M u c h like t h e Services s c r e e n , special a p p l i c a t i o n h a n d l i n g c a n be defined here. T h i s is i n t e n d e d to cover b e h a v i o r like FTP exhibits, w h e r e a r e v e r s e c o n n e c t i o n n e e d s to be m a d e . Unlike t h e FTP h a n dlers we've s e e n t h o u g h , t h i s is a little less flexible. W i t h t h e FTP h a n d l e r s , j u s t t h e one p o r t n e e d e d is o p e n e d long e n o u g h for t h e c o n n e c t i o n to be m a d e . In t h i s case, we're b e i n g invited to leave a r a n g e of p o r t s o p e n b a c k to t h e i n s i d e for a s long a s t h e service is in u s e . T h i s also t e n d s to invite m o r e conflicts, since h a v i n g a p o r t on t h e o u t s i d e o p e n gives u s all t h e p r o b l e m s of m a n y - t o - o n e NAT. E v e n so, u s i n g t h i s m a y m a k e it p o s s i b l e to get a n a p p l i c a t i o n w o r k ing t h a t o t h e r w i s e w o u l d n ' t . It's b e t t e r to h a v e t h e o p t i o n t h a n not. Since t h e p r o d u c t is still b e t a , d o c u m e n t a t i o n is scarce. I k n o w p a s s i v e FTP w o r k s w i t h no special c o n f i g u r a t i o n b e c a u s e I tried it. It's likely t h a t o t h e r p r o t o c o l s a r e h a n d l e d in a special way, too, b u t Microsoft h a s n ' t told u s w h i c h o n e s yet. P r o b a b l y t h e b i g g e s t i s s u e w i t h ICS is t h a t it w o r k s only w i t h d i a l - u p , a n d t h a t it forces D H C P on you. T h i s m e a n s it w o n ' t w o r k w i t h cable m o d e m s , DSL, or a n y t e c h n o l o g y t h a t w a n t s to c o n n e c t via a LAN interface. Microsoft sells a m u c h h i g h e r e n d p r o d u c t called Microsoft Proxy S e r v e r (MSP). It's m u c h m o r e flexible, b u t it r e t a i l s for $ 1 0 0 0 US.

155

156


There are o t h e r c o m m e r c i a l s o l u t i o n s t h a t fill in the price g a p s b e t w e e n free a n d $1000. To find a list of c o m m e r c i a l NAT p r o d u c t s for NT, c o n s u l t the "References a n d Resources" section, later. I've p e r s o n a l l y h a d very good l u c k with Sygate, of w h i c h the m o s t expensive version (unlimited inside users) costs only a b o u t $ 3 0 0 US.

Linux IP Masquerade IP M a s q u e r a d e is also doing PAT, even w h e n w o r k i n g on j u s t one inside IP a d d r e s s . C h a n g i n g o u r static NAT to m a n y - t o - 1 PAT is very simple. C h a n g e the line: /sbin/ipchains

-A forward -s 192.168.0.2/32

-j MASQ

-A f o r w a r d - s

-j MASQ

to" /sbin/ipchains

192.168.0.0/24

w h i c h will t a k e care of the whole inside s u b n e t . T h e r e is a good set of d o c u m e n t s on h o w to u s e IP M a s q u e r a d e ; links to t h e m c a n be f o u n d in the "References a n d Resources" section. If y o u p l a n to deploy IP M a s q u e r a d e in p r o d u c t i o n , y o u owe it to y o u r s e l f to r e a d t h e m . You will also n e e d to r e a d the IP C h a i n s d o c u m e n t a t i o n (notice the i p c h a i n s c o m m a n d we're u s i n g to configu r e IP Masquerade). IP C h a i n s is the built-in firewall for Linux kernel 2 . 2 . x . IP M a s q u e r a d e is n o t sufficient to keep y o u r s y s t e m secure. Let's t a k e a look at s o m e o t h e r a s p e c t s of IP M a s q u e r a d e . We k n o w t h e r e ' s a m o d u l e t h a t specifically h a n d l e s FTP. W h a t o t h e r m o d u l e s are t h e r e ? If y o u recall, the c o m m a n d t h a t installed the FTP h a n d l e r w a s m o d p r o b e . The c o m m a n d m o d p r o b e -I will list all m o d u l e s available for install. In t h a t list, t h e s e stick out: /lib/modules/2.2.5-15 / ipv4 / ip_masq_vdol ive. o /lib/modules/2.2.5-15 / ipv4 / ip_masq_user, o

/lib/modules/2.2.5-15 / ipv4/ip_masq_raudio, o

/lib/modules/2.2.5-15 / ipv4 / ip_masq_quake, o

/lib/modules/2.2.5-15 / ipv4 / ip_masq_portfw, o


9Chapter 4

/lib/modules/2.2.5-15 / ipv4/ip_masq_mfw, o / i ib/modules / 2.2.5-15 / ipv4 / ip_masq_irc, o / i ib/modules / 2.2.5-15 / ipv4 / ip_masq_f tp. o /lib/modules/2.2.5-15 / ipv4/ip_masq_cuseeme, o / lib/modules / 2.2.5-15 / ipv4 / ip_masq_auto fw. o

Our FTP m o d u l e is in the list, a n d j u d g i n g by the n a m e s , there are o b v i o u s l y IP M a s q u e r a d e m o d u l e s . Several of t h o s e are i m m e d i ately r e c o g n i z a b l e , a n d are k n o w n to c a u s e difficulty w h e n u s e d w i t h firewalls or NAT. T h e s e i n c l u d e FTP, Real Audio, Q u a k e , IRC (specifically, DCC send), C U S e e M e , a n d VDOLive. There is a place w h e r e IP M a s q u e r a d e h a n d l e r s c a n be o b t a i n e d , a n d o n e s t h a t don't exist c a n e v e n be r e q u e s t e d . P l e a s e t a k e a look at the "References a n d R e s o u r c e s " s e c t i o n of this c h a p t e r for details.

Cisco IOS We've a l r e a d y s e e n the Cisco PAT, too---that's w h a t the "overload" c o n f i g u r a t i o n w a s . T h i s variation g e t s all i n s i d e m a c h i n e s to go o u t u s i n g the router's o w n IP address" NAT(config)#ip

nat inside source list 1 interface

NAT(config)#access-list 1 permit 192.168.0.0

fastethernet

0/i overload

0.0.0.255

T h i s tells the router to u s e a c c e s s list 1 ( m a t c h all 1 9 2 . 1 6 8 . 0 a d d r e s s e s ) a n d to t r a n s l a t e u s i n g the router's o w n IP a d d r e s s for f a s t e t h e r n e t 0 / 1 as the s o u r c e a d d r e s s . Here's a full w o r k i n g config for this" version 12.0

service timestamps debug uptime

service timestamps

log uptime

service password-encryption !

hostname NAT enable secret 5 xx~oc<xxx

157

158

Chapter 4


enable password 7 xxxxxxxx !

ip subnet-zero

interface FastEthernet0/0 ip address 192.168.0.1

255.255.255.0

no ip directed-broadcast !

ip nat inside

interface Serial0/0 no ip address !


interface FastEthernet0/l ip address 130.214.99.254

255.255.255.0

no ip directed-broadcast ip nat outside I

ip nat inside source list 1 interface fastethernet

0/i overload

ip classless ip route 0.0.0.0

0.0.0.0 130.214.99.1

no ip http server access-list

1 permit 192.168.0.0

0.0.0.255

line con 0 transport input none line aux 0 line vty 0 4 password 7 xxxxxxx login I

no scheduler allocate end

Naturally, if you w a n t to u s e this config, you'll have to correct IP a d d r e s s e s and interface n a m e s . Also, the p a s s w o r d s have b e e n


9

Chapter 4

c r o s s e d out, so p u t t h o s e in m a n u a l l y . It's a l w a y s a good i d e a to s a n i t i z e y o u r r o u t e r c o n f i g u r a t i o n files before y o u let a n y o n e else see them. T h i s type of c o n f i g u r a t i o n (having all i n s i d e m a c h i n e s t r a n s l a t e to 1 o u t s i d e IP) is often u s e f u l w h e n c o n n e c t i n g to a n ISP. T h e Cisco h a s a n o t h e r i n t e r e s t i n g f e a t u r e t h a t we h a v e n ' t looked a t yet. T h e lOS lets y o u e x a m i n e t h e c o n n e c t i o n tables! We looked a t s o m e t h e o r e t i c a l e x a m p l e s before, a n d n o w we c a n look a t s o m e real ones. H e r e ' s a n e x a m p l e f r o m t h e s t a t i c NAT c o n f i g u r a t i o n on lOS: NAT#sho ip nat trans Pro Inside global

Inside local

tcp 130.214.99.250-1055

192.168.0.2-1055

Outside local 130.214.250.9-23

Outside global 130.214.250.9-23

Cisco d o e s n ' t e x p o s e t h e FIN flag or t i m e r s . Also, notice t h a t t h e r e a r e f o u r a d d r e s s : p o r t pairs. T h a t ' s b e c a u s e t h e lOS c a n do d o u b l e NAT i n s i d e one box. In t h i s case, i n s i d e m a c h i n e 1 9 2 . 1 6 8 . 0 . 2 h a d T e l n e t t e d (port 23) to 1 3 0 . 2 1 4 . 2 5 0 . 9 . T h e s o u r c e a d d r e s s w a s t r a n s l a t e d to 1 3 0 . 2 1 4 . 9 9 . 2 5 0 . O n t h e left, y o u c a n see t h a t t h e t r a n s p o r t protocol is TCP. H e r e ' s a n e x a m p l e f r o m t h e d y n a m i c NAT config ( u s i n g a pool of outside addresses): NAT#sho ip nat trans Pro Inside global

Inside local

Outside local

Outside global

udp 130.214.99.200:1063 192.168.0.2:1063

130.214.250.43:53 130.214.250.43:53

tcp 130.214.99.200:1068 192.168.0.2:1068

130.214.250.9:23

130.214.250.9:23

tcp 130.214.99.200:1066 192.168.0.2:1066

130.214.250.9:23

130.214.250.9:23

udp 130.214.99.200:1067 192.168.0.2:1067

130.214.250.43:53 130.214.250.43:53

tcp 130.214.99.200:1064 192.168.0.2:1064

130.214.250.9:23

udp 130.214.99.200:1065 192.168.0.2:1065

130.214.250.43:53 130.214.250.43:53

130.214.250.9:23

T h e a d d r e s s pool s t a r t s a t 1 3 0 . 2 1 4 . 9 9 . 2 0 0 , a n d t h a t a d d r e s s w a s p i c k e d for t h e s a m e m a c h i n e for all c o n n e c t i o n s . Here, we see m o r e T e l n e t c o n n e c t i o n s , a n d a few DNS c o n n e c t i o n s (UDP p o r t 53).

159

160

Chapter 4


Here's the state table d u r i n g our PAT e x a m p l e , w h e n all i n s i d e m a c h i n e s are going o u t as the router's IP address: Pro Inside global

Inside local

Outside local

Outside global

icmp 130.214.99.254:256 192.168.0.2:256

130.214.250.9:256 130.214.250.9:256

udp 130.214.99.254:1069 192.168.0.2:1069

130.214.250.43:53 130.214.250.43:53

tcp 130.214.99.254:1070 192.168.0.2:1070

130.214.250.9:23

130.214.250.9:23

Here, we've got TCP, UDP, a n d ICMP. Notice t h a t the ICMP conn e c t i o n s h a v e w h a t a p p e a r s to be a port n u m b e r n e x t to t h e m . S o m e NAT d e v i c e s will i m p o s e state i n f o r m a t i o n on ICMP in order to be able to d i s t i n g u i s h it. It's u n c l e a r if that's w h a t ' s h a p p e n i n g here, b u t it's p o s s i b l e t h a t the router h a s r e p l a c e d part of the ping s t r e a m w i t h 2 5 6 , or s o m e r e p r e s e n t a t i o n of it, a n d this is h o w it's t r a c k i n g that. Here is w h a t the table l o o k s like d u r i n g a n FTP s e s s i o n , u s i n g the PAT config: NAT#sho ip n a t t r a n s Pro

Inside global

Inside local

Outside local

Outside global

tcp 130.214.99.254:1080 192.168.0.2:1080

192.138.151.73:21 192.138.151.73:21

tcp 130.214.99.254:1081 192.168.0.2:1081

192.138.151.73:20 192.138.151.73:20

NAT#sho ip n a t trans Pro

Inside global

Inside local

Outside local

Outside global

tcp 130.214.99.254:1082 192.168.0.2:1082

192.138.151.73:20 192.138.151.73:20

tcp 130.214.99.254:1080 192.168.0.2:1080

192.138.151.73:21 192.138.151.73:21

The first listing is j u s t after a n ls c o m m a n d w a s i s s u e d in the FTP client. We c a n s e e our c o n n e c t i o n o u t to port 21, a n d the reverse c o n n e c t i o n b a c k from port 20. The s e c o n d list is after a n o t h er ls c o m m a n d . Notice the p r e v i o u s r e v e r s e - c o n n e c t i o n entry is gone. Finally, if n e e d to, it's p o s s i b l e to e m p t y the t r a n s l a t i o n table

manually: NAT#clear ip n a t trans NAT#show ip n a t trans IETF WORK

*


*

Chapter 4

What Are the Advantages? If you've r e a d the previous sections in this chapter, y o u p r o b a b l y a l r e a d y have a p r e t t y good idea of the a d v a n t a g e s of u s i n g NAT. Primarily, it allows y o u to u s e a relatively small n u m b e r of public IP a d d r e s s e s to c o n n e c t a large n u m b e r of inside m a c h i n e s to the Internet. It also b u y s you s o m e flexibility in h o w y o u c o n n e c t to other networks.

161

162

Chapter 4


The goal of u s i n g a small n u m b e r of IP a d d r e s s e s on y o u r NAT device for m a n y inside m a c h i n e s is u s u a l l y the motivating factor b e h i n d w a n t i n g to u s e NAT. This goal is achieved in the real world t h r o u g h a p a r t i c u l a r type of NAT, called PAT. PAT allows m a n y inside m a c h i n e s to u s e a small n u m b e r of IP a d d r e s s e s (often as few as one) to c o n n e c t to the Internet. NAT also gives y o u s o m e flexibility in h o w y o u h a n d l e c h a n g e s or o u t a g e s . S o m e t i m e s a m a c h i n e goes d o w n or moves, a n d r a t h e r t h a n reconfigure m a n y client m a c h i n e s , y o u ' d like to t r a n s l a t e a d d r e s s e s on the r o u t e r to point to the n e w server, or to a n existing server at a n e w a d d r e s s . This c a n also be useful for t e m p o r a r i l y dealing with a d d r e s s conflicts.

What Are the Performance Issues? W h a t is the cost in p e r f o r m a n c e for all of these NAT features? Not m a n y h a r d n u m b e r s are available. For NT's ICS, p e r f o r m a n c e is probably a m o o t point, since it h a s to involve a dial-up interface. Certainly ICS will function fast e n o u g h to m a x o u t a dial-up connection. IP M a s q u e r a d e could have some meaningful testing done to it, b u t I'm n o t aware of a n y p e r f o r m a n c e testing t h a t h a s b e e n done. In addition, Linux is very m u c h a moving target. C h a n g e s come quickly, a n d they m a y include p e r f o r m a n c e e n h a n c e m e n t s . Linux also r u n s on a wide variety of platforms, so ff y o u r u n into a p e r f o r m a n c e bottleneck while u s i n g IP Masquerade, you'll probably be able to scale it u p with better h a r d w a r e . Cisco h a s provided some r o u g h n u m b e r s here: ht tp: //www. c i sco. com/warp/publ ic / 4 5 8 / 4 i. html #Q6

Cisco gives n u m b e r s for t h r e e of their r o u t e r platforms: 4500, 4700, a n d 7500. The 4 5 0 0 is able to r u n at a b o u t 7 . 5 - 8 . 0 M b p s on 10Mb E t h e r n e t for all p a c k e t sizes. The 4 7 0 0 is able to r u n at 10 M b p s on 10Mb E t h e r n e t for all p a c k e t sizes. The 7 5 0 0 t h r o u g h p u t r a n g e s from 24 M b p s for 6 4 - b y t e p a c k e t s , to 96 M b p s for 1500-byte packets on F a s t E t h e r n e t .


Of course, for all t h r e e NAT p a c k a g e s we've b e e n looking at, this d e p e n d s on w h a t else t h e s e p l a t f o r m s are doing. If t h e NT ICS server is r u n n i n g a CPU-intensive g a m e at the time, p e r f o r m a n c e m a y dip. If the Cisco r o u t e r is also p e r f o r m i n g a n e n c r y p t i o n on the traffic, p e r f o r m a n c e will drop there, too. It's n o t s u r p r i s i n g t h a t t h e r e s h o u l d be s o m e delay w h e n performing NAT v e r s u s j u s t plain routing. At a high level, t h e r o u t i n g f u n c t i o n is relatively simple: 1.

Receive the packet.

2.

Verify c h e c k s u m s .

3.

C o n s u l t the r o u t i n g table.

4.

D e c r e m e n t the TI'L field.

5.

Recalculate the c h e c k s u m s .

6.

Transmit.

C o m p a r e this with the f u n c t i o n s n e e d e d for NAT: 1.

Receive the packet.

2.

Verify c h e c k s u m s .

3.

If e n t e r e d o u t s i d e the interface, c h e c k if t h e r e is a m a t c h i n g c o n n e c t i o n table entry.

4.

C o n s u l t the r o u t i n g table.

5.

C h e c k if the o u t b o u n d interface is m a r k e d for NAT.

6.

D e t e r m i n e p o r t i o n s of the p a c k e t to be modified.

7.

If it is the first p a c k e t in a n e w connection, create a table entry.

8.

If it is a PORT c o m m a n d or similar, rewrite t h e d a t a portion a n d create a n e w table entry.

,

If it is a FIN packet, remove t h e table entry.

10.

Modify the p a c k e t as needed.

11.

Recalculate c h e c k s u m s .

12.

Transmit.

163

164

Chapter 4


Even if t h e r e is e n o u g h CPU speed, t h e r e will still have to be a s m a l l l a t e n c y increase, as t h e s e s t e p s will require n u m b e r s m e m o r y l o o k u p a n d writes. The good n e w s is t h a t u n d e r m o s t c i r c u m s t a n c e s , p e r f o r m a n c e w o n ' t be a n issue. Usually NAT will be a problem only w h e n r o u t e r s are a l r e a d y u n d e r a h e a v y load.


9Chapter 4

Proxies and Firewall Capabilities Now t h a t we've covered in d e p t h w h a t NAT is a n d h o w it works, let's d i s c u s s security. So far, we've only covered firewalls indirectly, m e n t i o n i n g t h e m h e r e a n d t h e r e while d i s c u s s i n g NAT. Let's begin with s o m e b a s i c definitions, a n d later get to how firewalls are similar to, a n d different from, NAT p a c k a g e s . W h a t is a firewall? T h a t ' s a bit of a religious issue, as firewall m e a n s different t h i n g s to different people. The original m e a n i n g of firewall w a s a barrier, often in a s t r u c t u r e , d e s i g n e d to t a k e a cert a i n a m o u n t of time to b u r n t h r o u g h d u r i n g a fire. For example, a b u i l d i n g m a y have s o m e walls or p o r t i o n s of walls t h a t are firewalls, d e s i g n e d to c o m p a r t m e n t a l i z e a fire for a c e r t a i n a m o u n t of time, to limit d a m a g e . S o m e people liken firewalls in the electronic s e c u r i t y s e n s e to t h e s e b a r r i e r s , saying t h e y are d e s i g n e d to d e t e r i n t r u d e r s for a period of time, a n d to c o m p a r t m e n t a l i z e p a r t s of the network. So, if t h e r e is a b r e a c h in one portion of a network, the o t h e r s a r e n ' t i n s t a n t l y affected, too. O t h e r folks will a r g u e t h a t a firewall is f e a t u r e s X, Y, a n d Z, with X, Y, a n d Z being w h a t e v e r f e a t u r e s t h e y desire in a firewall. S o m e say t h a t the firewall is the portion of a s e c u r i t y a r c h i t e c t u r e t h a t s t o p s traffic. O t h e r s say it i n c l u d e s the pieces t h a t allow c e r t a i n types of traffic. The folks who p a r t i c i p a t e in t h e s e d i s c u s s i o n s are the philosop h e r s of firewalls. T h e s e d i s c u s s i o n s often t a k e place on mailing lists d e d i c a t e d to firewalls. W h a t ' s a little d i s t u r b i n g is t h a t t h e s e folks, s o m e of w h o m i n v e n t e d firewalls, c a n ' t agree on terminology. Realistically, firewalls are defined by c o m p a n i e s who sell produ c t s called firewalls. It t u r n s o u t t h a t the s i t u a t i o n isn't as b a d as it m i g h t seem, b e c a u s e n e a r l y all of t h e s e p r o d u c t s have a n u m b e r of f e a t u r e s in c o m m o n . We'll be t a k i n g t h a t road, so we'll be d i s c u s s i n g features.

165

166

Chapter 4


Packet Filters Networks, by their n a t u r e , are designed to p a s s as m u c h as possible, as quickly as possible. The original r o u t e r s h a d no n e e d of intentionally blocking things, except p e r h a p s for c o r r u p t packets. T h a t is, c o r r u p t in the s e n s e t h a t the a p p r o p r i a t e c h e c k s u m s d o n ' t m a t c h . S u p p o s e d l y , in the early d a y s of the Internet, s e c u r i t y w a s n ' t m u c h of a concern. I've h e a r d at least a few stories t h a t indicate t h a t people w a n t e d to s t a r t filtering certain k i n d s of traffic d u e to errors. Someone, s o m e w h e r e , m a d e a configuration error, a n d traffic s t a r t s flying t h a t c a u s e s s o m e o n e s o m e w h e r e else some trouble. T h u s were b o r n p a c k e t filters. P a c k e t filters are w h a t t h e y s o u n d like---devices t h a t filter p a c k ets. Very c o m m o n l y t h e y are r o u t e r s , b u t t h e y c a n also be generalp u r p o s e hosts, s u c h as Windows NT or Linux. The earliest p a c k e t filters w o u l d have b e e n able to block p a c k e t s b a s e d on the IP a d d r e s s e s c o n t a i n e d within. Later, t h e y w o u l d be able to block p a c k ets b a s e d on port n u m b e r s . M o d e r n p a c k e t filters c a n filter on a variety of criteria. T h e s e include IP a d d r e s s e s , port n u m b e r s , t r a n s p o r t type, c e r t a i n flags in TCP h e a d e r s , a n d more. T h e s e p a c k e t filters have long b e e n u s e d as p a r t of a traditional p r o x y / s c r e e n i n g r o u t e r firewall a r c h i t e c t u r e (see the "Proxies" section, next). Typically, t h e y will be u s e d to block types of traffic t h a t a r e n ' t allowed by policy. They c a n also be u s e d reactively to block a t t a c k s after t h e y have b e e n detected (i.e., block all traffic from a p a r t i c u l a r a d d r e s s range). Traditional p a c k e t filters (PF) have the c h a r a c t e r i s t i c t h a t t h e y d o n ' t c h a n g e packets, a n d t h e y d o n ' t have state. In o t h e r words, a PF c a n only p a s s or not p a s s a packet, a n d it c a n only m a k e t h a t decision b a s e d on i n f o r m a t i o n in the c u r r e n t packet. In addition, PFs are statically configured, m e a n i n g t h a t t h e y c a n ' t c h a n g e the illter rules b a s e d on traffic. M a n y p a c k e t filters have a w a y to filter on "established," w h i c h w o u l d s e e m to indicate t h a t t h e y are able to t r a c k c o n v e r s a t i o n s in


9Chapter 4

p r o g r e s s . In fact, to a PF, "established" simply m e a n s t h a t t h e ACK bit is set in t h e TCP header. PFs h a v e s o m e s e r i o u s limitations as firewalls. Let's go b a c k to the p r o b l e m of h o w to h a n d l e FTP. Say y o u have a n inside m a c h i n e t h a t y o u w a n t to allow FTP a c c e s s out. The control c h a n n e l c o n n e c tion is easy. The filter rule s a y s inside IP c a n go to a n y IP o u t s i d e at port 21. Next, y o u c a n t u r n on the allowed e s t a b l i s h e d rule to allow e s t a b l i s h e d p a c k e t s from a n y o u t s i d e IP to the inside IP. At this point, the control c o n n e c t i o n will work, a n d y o u ' r e relatively protected. The p r o b l e m b e c o m e s h o w to h a n d l e the reverse c o n n e c t i o n s . The first p a c k e t b a c k h a s only the ACK bit on, so the e s t a b l i s h e d rule will n o t help there. You d o n ' t k n o w w h a t p o r t the inside IP will be w a i t i n g on, only t h a t it's p r o b a b l y above 1023. With a PF, t h o u g h , all y o u c a n do is a d d a rule t h a t s a y s to allow p a c k e t s from a n y IP, TCP port 20, to a n y IP at TCP p o r t > 1023. This o p e n s u p a m a s s i v e s e c u r i t y hole, as m a c h i n e o p e r a t i n g s y s t e m s r u n services at p o r t s above 1023. M a n y of t h e s e services have k n o w n s e c u r i t y holes. A n y o n e who figures o u t t h a t y o u allow a c c e s s to all inside IP a d d r e s s e s at all p o r t s above 1023, if the s o u r c e p o r t h a p p e n s to be 20, c a n a t t a c k you. For t h e clever attacker, t h e firewall m i g h t as well n o t be there. FTP is s i m p l y a familiar example. If y o u t a k e a look at the h a n dlers t h a t are available for IP M a s q u e r a d e , you'll see m a n y m o r e e x a m p l e s of protocols t h a t would have to be h a n d l e d in t h e s a m e way. However, if y o u h a d a special m a c h i n e t h a t d i d n ' t h a v e a n y vuln e r a b l e services r u n n i n g above 1023, a n d h a d o t h e r w i s e b e e n specially s e c u r e d a n d locked down, it w o u l d p r o b a b l y be a c c e p t a b l e to configure the PF to allow traffic only to it in this m a n n e r , d e p e n d i n g on the local s e c u r i t y policy. S u c h a m a c h i n e is often called a bastion host. The p r o b l e m is, t h e s e m a c h i n e s t e n d to be less u s e f u l to everyd a y u s e r s , so t h e y really c a n ' t be p u t on everyone's d e s k to a c t as t h e i r m a i n p r o d u c t i v i t y m a c h i n e . So, w h a t c a n the m a c h i n e be u s e d for? It c a n act as a proxy.

167

168

Chapter 4


Proxies Proxies were d i s c u s s e d s o m e w h a t at the b e g i n n i n g of this chapter. A proxy is a m a c h i n e , often a b a s t i o n host, t h a t is configured to fulfill r e q u e s t s on b e h a l f of o t h e r m a c h i n e s , u s u a l l y inside m a c h i n e s . We'll get into the details of h o w the proxy a c t u a l l y w o r k s in a m o m e n t . Imagine n o w t h a t we've configured o u r PF to allow traffic only from the I n t e r n e t to the proxy. Since we've configured it well, the fact t h a t the I n t e r n e t c a n get to p o r t s above 1023 is n o t a m a j o r c o n c e r n . Additionally, a n o t h e r PF b e t w e e n the proxy a n d the inside w o u l d be u s e f u l to help keep m a l i c i o u s inside u s e r s from a t t a c k i n g the proxy. O u r a r c h i t e c t u r e looks like t h a t s h o w n in Figure 4.15.

Figure 4.15 Protected proxy server.

It's i m p o r t a n t to note t h a t Figure 4.15 is m o r e a logical d i a g r a m t h a n a p h y s i c a l one. A l t h o u g h we could i m p l e m e n t all of the pieces s h o w n to achieve the desired effect, it m a y n o t be n e c e s s a r y . For example, the d i a g r a m w o u l d s e e m to indicate t h a t the proxy h a s two i n t e r f a c e s ~ i t could, b u t u s u a l l y doesn't. Traffic m a y e n t e r a n d leave the s a m e interface w i t h o u t c a u s i n g difficulty if a d d r e s s e s are m a n aged properly on the filtering r o u t e r s . Also, with a flexible e n o u g h r o u t e r acting as PF, this design c a n be done with one 3-interface r o u t e r r a t h e r t h a n two 2-interface r o u t e r s . However, this d i a g r a m m a k e s it m u c h easier to visualize d a t a flow. The inside PF h a s a n o t h e r f u n c t i o n b e s i d e s protecting the proxy from inside u s e r s . S h o u l d the proxy be c o m p r o m i s e d in s o m e way, it m a y help p r o t e c t the inside a g a i n s t the proxy itself. This c o n c e p t is i m p o r t a n t , a n d it's called a DMZ (Demilitarized Zone). The t e r m


9Chapter 4

DMZ h a s a c o u p l e of different m e a n i n g s to t h e firewaU p h i l o s o p h e r s a s well. S o m e p u r i s t s call it t h e n e t w o r k j u s t o u t s i d e t h e o u t s i d e i n t e r f a c e of a firewall (or in o u r case, o u t s i d e t h e o u t s i d e PF). T h e definition we'll be u s i n g is "a n e t w o r k s e g m e n t t h a t t r u s t s n e i t h e r t h e i n s i d e n o r t h e o u t s i d e , a n d is n o t t r u s t e d b y t h e inside." T h e w o r d t r u s t in t h i s c a s e implies u n f e t t e r e d n e t w o r k a c c e s s . F o r e x a m p l e , t h e I n t e r n e t at large t r u s t s everyone, a s e v e r y o n e g e t s a c c e s s . T h e i n s i d e n e t w o r k t r u s t s no one, a n d no one g e t s d i r e c t a c c e s s to t h e inside. P r a c t i c a l l y s p e a k i n g , m o s t folks c o n s i d e r a DMZ to be a t h i r d i n t e r f a c e on t h e firewall (the first a n d s e c o n d i n t e r f a c e s b e i n g t h e i n s i d e a n d outside). So h o w exactly does a p r o x y w o r k ? We'll s t a r t w i t h t r a d i t i o n a l proxies. Basically, t h e p r o x y a c t s a s a s e r v e r to i n s i d e m a c h i n e s , a n d a s a client to t h e I n t e r n e t . I n s i d e m a c h i n e s h a v e to u s e e i t h e r modified software, or a p r o c e d u r a l c h a n g e to m a k e u s e of t h e proxy. T r a d i t i o n a l p r o x i e s a r e n o t r o u t e r s , a n d in fact t h e r o u t i n g code s h o u l d be t u r n e d off or c o m p i l e d o u t of a b a s t i o n h o s t t h a t is to be a t r a d i t i o n a l proxy. If y o u s e n d a p a c k e t t o w a r d s a proxy, a n d its d e s t i n a t i o n IP a d d r e s s i s n ' t t h e p r o x y ' s a d d r e s s , t h e p r o x y will j u s t t h r o w t h e p a c k e t away. In all of o u r NAT e x a m p l e s , t h e d e s t i n a t i o n a d d r e s s of p a c k e t s a l w a y s r e m a i n e d (except for t h e d o u b l e NAT e x a m p l e s ) t h a t of its u l t i m a t e d e s t i n a t i o n , s o m e h o s t on t h e I n t e r n e t . Proxies w o r k differently, a n d clients h a v e to c h a n g e t h e i r b e h a v i o r accordingly. T h e first r e q u i r e m e n t is t h a t t h e d e s t i n a t i o n IP a d d r e s s m u s t be t h a t of t h e p r o x y server, n o t t h e s e r v e r t h e u s e r a c t u a l l y w a n t s on t h e I n t e r n e t . Let's look a t a s i m p l e (contrived) e x a m p l e : Telnet. W i t h a NAT-type solution, y o u w o u l d s i m p l y T e l n e t to t h e n a m e or a d d r e s s y o u w a n t e d . Let's d e s i g n a n i m a g i n a r y p r o x y to h a n d l e Telnet. First, we write o u r p r o g r a m to l i s t e n for n e t w o r k c o n n e c tions, a n d p i c k a p o r t on t h e p r o x y on w h i c h to r u n it. T h e p o r t c o u l d be 23, r e p l a c i n g t h e r e g u l a r T e l n e t m e c h a n i s m (if any) on t h e p r o x y m a c h i n e , or we c o u l d r u n it on its o w n port. F o r o u r e x a m p l e , we'll p i c k p o r t 2 0 0 0 . O u r p r o g r a m will a c c e p t TCP c o n n e c t i o n s , a n d t h e n p r o m p t for a n a m e or IP a d d r e s s . O n c e it gets t h e n a m e , it

169

170

Chapter 4


a t t e m p t s to c o n n e c t to t h a t n a m e at p o r t 23. Once the c o n n e c t i o n is m a d e a n d o u t p u t from p o r t 23 on the o u t s i d e m a c h i n e is s e n t to the inside m a c h i n e , a n y s u b s e q u e n t o u t p u t from the inside m a c h i n e (i.e., the u s e r typing) is s e n t to the o u t s i d e m a c h i n e . So, a n inside u s e r who w a n t s to Telnet o u t m u s t n o w Telnet to the proxy at p o r t 2000, a n d e n t e r the n a m e of the m a c h i n e to w h i c h t h e y really w a n t to Telnet. If it c o n n e c t s , t h e y will see the o u t p u t from it, a n d will be able to type i n p u t for it. Of c o u r s e in the real world, the Telnet protocol isn't t h a t simple, a n d o u r e x a m p l e isn't quite sufficient. However, it i l l u s t r a t e s the b a s i c idea: have the inside client inform the proxy of w h a t it w a n t s . The proxy m a k e s the c o n n e c t i o n on b e h a l f of the client, retrieves s o m e data, a n d p a s s e s it b a c k to the client. P a s s a n y i n p u t from t h e client to t h e server. How is FTP looking?. The p r o b l e m r e m a i n s the same: the reverse c o n n e c t i o n s . The proxy does the s a m e trick as a PAT device, b u t in a slightly different m a n n e r . The control c h a n n e l c o n n e c t i o n (to p o r t 21) w o r k s m o r e or less like the Telnet proxy e x a m p l e j u s t given, u n t i l t h e PORT c o m m a n d . U p o n identifying the PORT c o m m a n d in t h e d a t a s t r e a m , it c h a n g e s it in the s a m e m a n n e r t h a t a PAT device would, a n d s u b s t i t u t e s its own a d d r e s s . The proxy also a s k s the OS for a n available port, b e g i n s listening on t h a t port, a n d s e n d s t h a t p o r t n u m b e r . It h a s to keep a copy of the original PORT c o m m a n d for later reference. W h e n the o u t s i d e server c o n n e c t s b a c k to t h e proxy, the proxy o p e n s a c o n n e c t i o n to the inside m a c h i n e in the original PORT c o m m a n d a n d s e n d s the data. So w h a t does a u s e r on t h e inside who w a n t s to u s e FTP have to do differently?. T h a t p r e s e n t s a problem. With o u r Telnet example, it's p r e t t y e a s y to see h o w to get extra i n p u t from the user. The 0 p r o b l e m with FTP is t h a t t h e r e are m a n y , m a n y different t y p e s of FTP client p r o g r a m s . T h e s e r a n g e from c o m m a n d - l i n e text clients w h e r e u s e r s have lots of o p p o r t u n i t y to e n t e r i n p u t , to fully GUI FTP clients, w h e r e n e a r l y everything is point-and-click. One s t r a t e g y is to have t h e inside u s e r p u t in a special u s e r n a m e . For example, i n s t e a d of e n t e r i n g a n o n y m o u s , t h e y w o u l d


9Chapter 4

e n t e r a n o n y m o u s @ f t p , example, com. This would i n s t r u c t the proxy to u s e t h e u s e r n a m e a n o n y m o u s , a n d c o n n e c t to t h e FTP server ftp. example, com. The p a s s w o r d w o u l d be s u p p l i e d u n c h a n g e d . This w o r k s for a n y FTP client w h e r e the u s e r is p r o m p t e d for a u s e r n a m e a n d p a s s w o r d . Problem is, w h e n Web b r o w s e r s follow a n FTP link, t h e y a u t o m a t i c a l l y u s e a n o n y m o u s a n d w h a t e v e r e-mail a d d r e s s you've got p r o g r a m m e d into y o u r browser. They d o n ' t stop to p r o m p t . Web b r o w s e r s are a p r o b l e m in general. How is the u s e r u s i n g a b r o w s e r s u p p o s e d to get the b r o w s e r to c o n n e c t to t h e proxy, a n d h o w are t h e y to s u p p l y the URL of the real site to the proxy?. T h e r e are tricks t h a t c a n be tried, s u c h as p u t t i n g in special URLs a n d t r e a t i n g the proxy as a Web server. T h e s e w o r k theoretically, t h o u g h with p r o b l e m s , b u t t h e s e m e c h a n i s m s a r e n ' t very practical. U s e r s will tire of t h e m quickly a n d complain. T h e r e is a s e p a r a t e tactic t h a t c a n be u s e d for proxy access: special client software. Basically, this m e a n s t h a t the client software is modified to a c c e s s a proxy server, so t h a t the u s e r does the s a m e t h i n g as t h e y m i g h t if t h e y were directly c o n n e c t e d to the I n t e r n e t , a n d the software t a k e s care of u s i n g the proxy. So, w h e n t h e u s e r r u n s the special Telnet p r o g r a m , it h a n d l e s c o n t a c t i n g the proxy a n d i n f o r m i n g the proxy a b o u t w h i c h server is desired, t r a n s p a r e n t ly. All the u s e r h a s to do is Telnet to the server t h e y w a n t , u s i n g the special Telnet client. Theoretically, this c a n be done to a n y client p r o g r a m , so t h a t u s e r s d o n ' t have to be b o t h e r e d with the details. The p r o b l e m is, t h e r e are m a n y , m a n y client p r o g r a m s , m o s t of w h i c h d o n ' t have publicly available s o u r c e code for modification. Also, t h e r e are potentially m a n y , m a n y proxy protocols, if e a c h site c r e a t e d t h e i r own proxy software. Obviously, s o m e s t a n d a r d s w o u l d be useful. The c u r r e n t l y u s e d proxy protocol s t a n d a r d s are SOCKS a n d CERN proxy, b u t we w o n ' t get into the details. The CERN proxy protocol grew o u t of a proxy f e a t u r e of the CERN H T r P server, a n d as y o u m i g h t g u e s s it's a n H'FrP proxy. It w a s i m p o r t a n t b e c a u s e t h e r e w a s s u p p o r t for t h e protocol s t a r t i n g w i t h t h e early Web b r o w s e r s .

171

172

Chapter 4


SOCKS enjoyed similar early b r o w s e r s u p p o r t , with the a d v a n t a g e t h a t it c a n proxy a r b i t r a r y p o r t n u m b e r s . Of course, y o u r SOCKS proxy server m u s t still be able to h a n d l e the protocol t h a t m a t c h e s the p o r t n u m b e r . SOCKS also c a m e with a few r e w r i t t e n client p r o g r a m s , like rteln e t a n d rftp. T h e s e were "SOCKSified" v e r s i o n s of the Telnet a n d FTP p r o g r a m s . They are UNIX s o u r c e code, so c h a n c e s are y o u could compile v e r s i o n s for m o s t UNIX platforms. Later, t h i r d - p a r t y W i n d o w s a p p l i c a t i o n s s t a r t i n g a p p e a r i n g with SOCKS s u p p o r t . Nowadays, if a client p r o g r a m s u p p o r t s t h e u s e of a proxy, it u s u a l l y h a s SOCKS s u p p o r t . More i n f o r m a t i o n a b o u t SOCKS c a n be f o u n d in t h e section "References a n d Resources." The idea of SOCKS being able to s u p p o r t a r b i t r a r y p o r t s begs t h e question: Is t h e r e s u c h a t h i n g as a generic proxy?. Indeed, t h e r e is. It's p o s s i b l e to proxy a s t r e a m of d a t a a s s u m i n g t h a t t h e r e are no reverse c o n n e c t i o n s , a n d so forth. T h a t is, a s s u m e it looks r a t h e r like a Telnet connection. S u c h a proxy is often called a circuit-level proxy, or a plug gateway (after t h e plug-gw f e a t u r e in G a u n t l e t , a p o p u l a r p r o x y - b a s e d c o m m e r c i a l firewaU). SOCKS proxies typically c a n s u p p o r t s u c h a n a r r a n g e m e n t , if desired. Yet a n o t h e r w a y to h a n d l e getting the client r e q u e s t to the proxy is to modify the IP s t a c k on the client to do so. This software is typically called a shim. The Microsoft Proxy Server w o r k s this way; it s u p p l i e s a s h i m for Microsoft W i n d o w s clients. MSP also s u p p o r t s the SOCKS protocol, for n o n - W i n d o w s clients. In this m a n n e r , MSP is able to s u p p o r t a r b i t r a r y client p r o g r a m s on the W i n d o w s platform, as long as the protocols are simple, or a h a n d l e r h a s a l r e a d y b e e n designed. Finally, before we leave the topic of proxies, s o m e proxies n o w have a t r a n s p a r e n c y option, w h i c h c h a n g e s the model of h o w proxies u s e d to work. As d i s c u s s e d , t r a d i t i o n a l proxies require the clients to b e h a v e differently. T r a n s p a r e n t proxies c a n act as r o u t e r s a n d proxy c o n n e c t i o n s automatically, m u c h like a PAT device. T h e s e proxies have the i m p o r t a n t a d v a n t a g e t h a t t h e y do n o t require a n y


9Chapter 4

special software or configuration of the client. So w h a t ' s the difference b e t w e e n PAT a n d a t r a n s p a r e n t proxy?. This is d i s c u s s e d in detail later in this chapter, in "Why a Proxy Server Is Really Not a NAT."

Stateful Packet Filters D u r i n g the time t h a t proxies were evolving, so were PFs. The ability to keep simple state i n f o r m a t i o n w a s a d d e d to PFs, a n d t h u s were b o r n Stateful P a c k e t Filters (SPFs). An SPF could, for example, w a t c h a PORT c o m m a n d go by, a n d only allow b a c k the port t h a t w a s m e n t i o n e d , r a t h e r t h a n h a v i n g to let t h r o u g h everything above 1023. R a t h e r t h a n j u s t let in every TCP p a c k e t t h a t h a d the ACK bit set, it could let in j u s t t h e ones t h a t c o r r e s p o n d e d to o u t g o i n g packets. The small a d d i t i o n of being able to t r a c k w h a t w e n t on before a d d s a n a m a z i n g a m o u n t of power to the simple PF. Very few plain SPFs a c t u a l l y exist. T h a t ' s b e c a u s e t h e y a l m o s t all a d d yet a n o t h e r ability, w h i c h will be d i s c u s s e d shortly. An e x a m p l e of a n SPF as described is a Cisco r o u t e r u s i n g reflexive a c c e s s lists. T h e s e a c c e s s lists have the ability to modify t h e m s e l v e s s o m e w h a t , b a s e d on o t h e r a c c e s s list lines being m a t c h e d .

Stateful Packet Filter with Rewrite The p r e c e d i n g definition of SPF is n o t a widely a c c e p t e d one. Despite its u s e of the w o r d filter in the middle, w h e n m o s t people d i s c u s s SPFs, t h e y m e a n a device t h a t c a n also modify p a c k e t s as t h e y p a s s t h r o u g h . Adding this capability theoretically gives the SPF complete control over p a c k e t s . The p a c k e t rewrite also p u t s one f e a t u r e into the SPF engine in p a r t i c u l a r ~ N A T . Recall t h a t the r e q u i r e m e n t s for NAT are: t h e ability to rewrite p a c k e t s , a n d the ability to t r a c k t h a t i n f o r m a t i o n . As it t u r n s out, the c o n n e c t i o n tables n e e d e d to do PAT are basically t h e s a m e as t h o s e n e e d e d to do SPF. So, if y o u c a n do SPF, it's p r e t t y e a s y to a d d PAT, a n d vice versa.

173

174

Chapter 4


T h e r e are m a n y c o m m e r c i a l e x a m p l e s of S P F - b a s e d firewalls, even if t h e y u s e a different t e r m for the u n d e r l y i n g technology. The m a r k e t - s h a r e leader, C h e c k p o i n t ' s Firewall-1, is b a s e d on SPF, w h i c h t h e y call Stateful Multi-Layer I n s p e c t i o n (SMLI). A n o t h e r popu l a r e x a m p l e is Cisco's PIX firewall. We w o n ' t go into a lot of detail a b o u t how SPF w o r k s ~ i f y o u u n d e r s t a n d the details b e h i n d PAT, y o u u n d e r s t a n d SPF. The t a b l e s t h a t n e e d to be m a i n t a i n e d to p e r f o r m a n SPF f u n c t i o n are the s a m e as t h o s e n e e d e d to do PAT. An SPF firewall n e e d s to do at l e a s t the s a m e a m o u n t of w o r k as a PAT device, a n d s h o u l d ideally a d d on a fair a m o u n t more, to allow for b e t t e r d a t a validation a n d c o n t e n t filtering.

Why a Proxy Server Is Really Not a NAT At this point, it's a p p r o p r i a t e to d i s c u s s the differences b e t w e e n proxies a n d NAT. For p u r p o s e s of this d i s c u s s i o n , all flavors of NAT, PFs, a n d SPFs are equivalent. T r a n s p a r e n t proxies are a little bit of a special case, b u t t h e y will be t r e a t e d as t r a d i t i o n a l proxies for this discussion. At a very high level, proxies a n d NAT a p p e a r to be the same; t h e y b o t h let y o u hide m a n y m a c h i n e s b e h i n d a n IP a d d r e s s . They b o t h modify the d a t a s t r e a m as it goes by to a c c o u n t for the c h a n g e of a d d r e s s . They b o t h keep s t a t e a b o u t m o r e c o m p l i c a t e d protocols, in o r d e r to h a n d l e t h e m correctly. It t u r n s o u t t h a t the e n d s m i g h t be the s a m e , b u t the m e a n s are very different. At a low level, the i n t e r n a l s of the device (a proxy or NAT device) h a n d l e the p a c k e t in completely different ways. The b a s i c difference boils down to this: For NAT, the b a s i c u n i t being w o r k e d on is the packet; for a proxy, all of its w o r k is done on a d a t a s t r e a m . Let's d i s c u s s w h a t t h a t m e a n s , s t a r t i n g with the proxy. W h e n a p a c k e t is received by a server, the server first d e t e r m i n e s if t h e p a c k e t is i n t e n d e d for it (i.e., if the d e s t i n a t i o n a d d r e s s is one of its a d d r e s s e s ) . In the case of a t r a d i t i o n a l proxy, it will be. The p a c k e t t h e n u n d e r g o e s a p r o c e s s of being p a s s e d u p the IP s t a c k of the server. If the p a c k e t belongs to a n existing connection, the d a t a


9Chapter 4

p o r t i o n of t h e p a c k e t is extracted, a n d placed into a buffer for the proxy p r o g r a m to read. If it's a n e w connection, a n e w buffer is created a n d t h e proxy p r o g r a m is notified t h a t t h e r e is a n e w connection to service, b u t t h e p r o c e s s is otherwise t h e s a m e . W h e n the proxy n e e d s to s e n d s o m e t h i n g , a reverse p r o c e s s h a p pens. The i n f o r m a t i o n t h e proxy n e e d s to s e n d is placed into a n o u t p u t buffer. The T C P / I P software on the server will t h e n pull i n f o r m a t i o n o u t of t h e buffer, p u t it into p a c k e t s , a n d s e n d it. U n d e r t h e IP protocol, p a c k e t s c a n be a wide r a n g e of sizes. Large p a c k e t s m a y be split u p into f r a g m e n t s in o r d e r to cross netw o r k s t h a t c a n h a n d l e only f r a m e s u p to a p a r t i c u l a r size. For example, a 2 0 0 0 - b y t e p a c k e t w o u l d have to be split into at least two p a r t s to cross a n E t h e r n e t s e g m e n t with a n MTU of 1500 bytes. On a proxy server, the IP s t a c k will p u t the f r a g m e n t s t o g e t h e r before it places t h e d a t a into the buffer. Ideally, f r a g m e n t s w o n ' t h a p p e n . W h e n possible, h o s t s will n o t t r a n s m i t p a c k e t s t h a t will have to be f r a g m e n t e d . A h o s t d o e s n ' t always have a w a y to d e t e r m i n e w h e t h e r or n o t a f r a g m e n t will n e e d to be m a d e along the w a y a c r o s s a network, so often the b e s t the h o s t c a n do is to n o t t r a n s m i t p a c k e t s bigger t h a n its local network. The goal of t h e f r a g m e n t d i s c u s s i o n is to i l l u s t r a t e a point: The n u m b e r of p a c k e t s t h a t e n t e r a proxy server d o n ' t n e c e s s a r i l y e q u a l t h e n u m b e r of p a c k e t s t h a t come out. For a n overly simplified e x a m ple, a proxy server m a y receive a single p a c k e t t h a t c o n t a i n s "Hello World!" However, w h e n it t r a n s m i t s it b a c k out, it m a y be as two p a c k e t s : "Hello" a n d "World!" The reverse m a y h a p p e n as well. In fact, the proxy i n p u t s only the s t r i n g of c h a r a c t e r s , a n d o u t p u t s t h e m to a different buffer, possibly m a k i n g c h a n g e s to t h e m . It doesn't c o n c e r n itself with h o w the p a c k e t gets divided. W h e n it sees a n FTP PORT c o m m a n d , it r e a d s it in, decides on h o w it s h o u l d be c h a n g e d , a n d o u t p u t s t h e c h a n g e d version. It d o e s n ' t n e e d to do a n y t h i n g special if the c o m m a n d e n d s u p being longer or shorter. C o n t r a s t this with a NAT device. W h e n the IP s t a c k of a NAT device gets a p a c k e t t h a t is n o t a d d r e s s e d to it, w h i c h is n o r m a l l y w h a t will h a p p e n , it will try to r o u t e t h e packet. D u r i n g t h e r o u t i n g p r o c e s s is w h e n t h e NAT device h a s a n o p p o r t u n i t y to o p e r a t e on

175

176

Chapter 4


t h e packet. Except for f r a g m e n t s a n d a couple of special cases, NAT is one p a c k e t in, one p a c k e t out. The p a c k e t will be basically the s a m e size as well. W h e n a PORT c o m m a n d s t a r t s t h r o u g h , t h e NAT device h a s to keep the p a c k e t s as i n t a c t as possible. This m e a n s t h e r e m a y have to be a special piece of code to e x p a n d or s h r i n k a p a c k e t to a c c o m m o d a t e a longer or s h o r t e r a d d r e s s . W h e n fragm e n t s arrive, the NAT device typically will have to p e r f o r m r e a s s e m bly as well. A l t h o u g h f r a g m e n t s are p a c k e t s in their own right, t h e y are also pieces of a larger packet. T a k e n as a whole piece, t h e p a c k ets in a n d p a c k e t s o u t c o u n t still holds. W h a t are the s e c u r i t y implications for the two m e t h o d s ? T h e r e are pros a n d cons for each. There exist types of a t t a c k s t h a t rely on the exact s t r u c t u r e of a packet. With a proxy, since the p a c k e t s are t o r n apart, t h e r e is little c h a n c e of this type of a t t a c k s u c c e e d i n g a g a i n s t inside hosts. However, since t h e proxy h a s to p r o c e s s the p a c k e t itself, it m a y fall prey to the a t t a c k r a t h e r t h a n the inside host. A NAT device w o u l d likely n o t fall victim to the s a m e type of a t t a c k , b u t it m i g h t p a s s it along to the inside host, a n d have it succeed there. F o r t u n a t e l y , t h e s e types of a t t a c k s are a l m o s t always Denial of Service (DOS) a t t a c k s , w h i c h m e a n t h e y t e n d to c r a s h things, b u t d o n ' t r e s u l t in a violation of i n f o r m a t i o n integrity. In one case, the firewaU c r a s h e s . In a n o t h e r case, t h e firewall s t a y s functional, b u t the inside h o s t goes down. Neither is a n a b s o l u t e l y b e t t e r choice, a n d it d e p e n d s on the preference of the firewall a d m i n i s t r a tor. No one w a n t s their firewall going down, b u t on the o t h e r h a n d , its job is to p r o t e c t the inside. The o t h e r big difference b e t w e e n NAT a n d proxy is d a t a validation a n d modification. There are a n u m b e r of proxy p a c k a g e s o u t t h e r e t h a t t a k e a m o r e conservative s e c u r i t y stance. T h a t is, t h e y c o n t a i n proxies for protocols t h a t the d e s i g n e r s were r e a s o n a b l y s u r e t h e y could validate well. T h e y h a d a n idea of w h a t allowable v a l u e s are, a n d designed their proxy to w a t c h for those, a n d m a k e corrections if needed. In s o m e cases, if it looks like a protocol h a s s o m e i n h e r e n t p r o b l e m s , t h e y w o u l d n o t p r o d u c e a proxy for it, t h e r e b y d i s c o u r a g i n g c u s t o m e r s from u s i n g t h a t protocol.


9Chapter 4

M a n y NAT p a c k a g e s s e e m to t a k e a different tact. They will do the b a r e m i n i m u m n e c e s s a r y to get a protocol to p a s s , a n d t h e y often try to p a s s as m a n y protocols as possible. They also t e n d to be more open by default; t h a t is, if a c o n n e c t i o n a t t e m p t is m a d e from the inside a n d the protocol is u n k n o w n , it will try to p a s s it anyway. Now, this isn't a fair c o m p a r i s o n . I've c o m p a r e d the b e s t proxies a g a i n s t the w o r s t NAT i m p l e m e n t a t i o n s . Naturally, t h e r e are produ c t s from b o t h c a m p s t h a t m e e t in the middle, a n d a good firewall a d m i n i s t r a t o r c a n m a k e a NAT/SPF secure, a n d a b a d one c a n misconfigure a good proxy. Still, the t e n d e n c i e s are there: NAT devices typically only go above layer 4 w h e n it's n e e d e d to m a k e the protocol w o r k (like the FTP example). Proxies always w o r k above layer 4, a n d even the s i m p l e s t ones (circuit-level proxies) operate at layer 5. The a s s u m p t i o n is, of course, t h a t the h i g h e r u p the s t a c k t h e y go, the m o r e secure. All of this is a religious a r g u m e n t t h o u g h , b e c a u s e y o u d o n ' t b u y a c o n c e p t u a l firewall, y o u b u y a n a c t u a l p r o d u c t . E a c h p r o d u c t m u s t be e v a l u a t e d on its own merit. The o t h e r point t h a t m a k e s a lot of the a r g u i n g pointless is t h a t the lines b e t w e e n SPF a n d proxy are blurring. The latest v e r s i o n s of m o s t of the c o m m e r c i a l firewalls include f e a t u r e s b o t h from the proxy world a n d the SPF world, r e g a r d l e s s of w h i c h b a c k g r o u n d t h e y c a m e from. For example, in Firewall-1, t h e r e are a n u m b e r of "security servers" i n c l u d e d t h a t optionally c a n be activated in place of a NAT-style p a c k e t passing. T h e s e typically include extra capabilities, s u c h as extra a u t h e n t i c a t i o n , s t r i p p i n g o u t of u n d e s i r a b l e cont e n t (such as J a v a or ActiveX) a n d blocking of p a r t i c u l a r sites by n a m e or URL. M a n y of the proxy firewalls have gone t r a n s p a r e n t . In order for a proxy to be t r a n s p a r e n t , it h a s to c h a n g e its b e h a v i o r s o m e w h a t . The s h o r t e x p l a n a t i o n is t h a t t h e y have to p e r f o r m a SPF-type f u n c t i o n to deliver the p a c k e t s to the proxy software, w h e n t h e y w e r e n ' t a d d r e s s e d to the proxy in the first place.

177

178

Chapter 4

9


Shortcomings of SPF There are plenty of SPF shortcomings to discuss, b u t only in a security context. In t e r m s of functionality, all the p r o d u c t s work well. There are performance differences and administration differences, b u t if the p r o d u c t claims to p a s s a particular protocol, it u s u a l l y does. Proxies are generally slower, simply b e c a u s e they do more to the information as it goes through. They strip h e a d e r s off, p u t t h e m on, allocate sockets, and do a lot of buffering and copying of data. SPFs skip a lot of this work. For protocols without a lot of work to do, this is an advantage. For protocols t h a t should be handled carefully, this is bad. There seems to be a c o n s e n s u s t h a t handling complicated protocols is easier with proxy-style software t h a n with NAT style. It seems t h a t the idea of being able to toss the unit of the packet m a k e s the process easier, at least for TCP protocols. Being able to pick between the two in a single package is one advantage to having the lines between SPF and proxy blur. The firewall designer can pick the best tool for the protocol. The t r a n s p a r e n c y option for proxies is a very good feature. Not having to change the software on all the inside machines, and not having to s u p p o r t those changes, can be a huge advantage. A subtle bit of information is lost with this option, though. With traditional proxies, especially with a r c h i t e c t u r e s where there is a separate program for each protocol, there is never any question a b o u t which protocol was desired. For example, if the u s e r contacted the Telnet proxy, you could be sure they w a n t e d to use the Telnet protocol. If they contacted the HTTP proxy, clearly they w a n t HTTP. If you've s p e n t any time surfing the Web, you've probably noticed t h a t some URLs specify a different port number. For example, instead of: h t t p ://www. example, com

y o u see: h t t p ://www. example, com: 8080


9Chapter 4

In t h i s case, r a t h e r t h a n c o n t a c t i n g t h e Web s e r v e r a t p o r t 80 (which is t h e d e f a u l t for HTTP), we've explicitly told it to c o n t a c t a Web s e r v e r via p o r t 8 0 8 0 . For a t r a d i t i o n a l proxy, t h i s is n o t a p r o b lem. It k n o w s y o u w a n t HTTP, a n d it k n o w s y o u w a n t to do it over port 8080. T h i s w o r k s b e c a u s e t h e p r o x y is forcing t h e client to specify b o t h protocol a n d p o r t explicitly. Let's look a t t h e s a m e s i t u a t i o n w i t h a t r a n s p a r e n t proxy. T h e client i s n ' t c o n f i g u r e d in a n y s p e c i a l way. T h e u s e r m i g h t n o t even realize t h e r e is a firewall t h e r e . Now, t h e client i s n ' t specifying t h e protocol to t h e proxy, b e c a u s e it d o e s n ' t k n o w a p r o x y is there. So, w h e n it c o n t a c t s p o r t 80, t h e p r o x y h a s to m a k e a n a s s u m p t i o n - - i t will a s s u m e ( a l m o s t a l w a y s correctly) t h a t t h i s is HTI'P, a n d will h a n d l e it a s s u c h . W h a t a b o u t w h e n t h e b r o w s e r specifies p o r t 8 0 8 0 ? T h e p r o x y h a s to m a k e a n o t h e r a s s u m p t i o n . Port 8 0 8 0 is p r e t t y c o m m o n l y u s e d a s a n o n s t a n d a r d HTI'P port, b u t n o t always. T h e p r o x y m u s t e i t h e r p i c k HTTP or a circuit-level proxy. T h i s is c o m m o n l y configurable. W h a t h a p p e n s in t h i s s i t u a t i o n ? h t t p ://www. example, corn: 21

S o m e j o k e r on t h e I n t e r n e t h a s r u n h i s Web s e r v e r on p o r t 21, a n d y o u r u s e r h a s clicked on a link to it. T h e p r o x y h a s to m a k e a n a s s u m p t i o n ~ i t ' s going to a s s u m e t h i s is t h e FTP protocol. C h a n c e s are, t h i s c o n n e c t i o n w o n ' t w o r k v e r y well. So, we've lost s o m e i n f o r m a t i o n b y going t r a n s p a r e n t . We've forced t r a n s p a r e n t p r o x i e s to m a k e a s s u m p t i o n s a b o u t p r o t o c o l s b a s e d on p o r t n u m b e r s . T h i s will w o r k well m o s t of t h e time, b u t t h e r e is a l w a y s a w e i r d e x c e p t i o n s o m e w h e r e . S P F s suffer f r o m t h e s a m e p r o b l e m a s well. S o m e folks h a v e a r g u e d t h a t a n S P F - t y p e a r c h i t e c t u r e m a k e s it too e a s y for a firewall a d m i n i s t r a t o r to do s o m e t h i n g risky. In o t h e r w o r d s , S P F s m a y be m o r e flexible in t h e r a n g e of t h i n g s t h e y c a n be m a d e to allow, a n d t h a t m a y be too t e m p t i n g . T h i s is largely u n t r u e n o w a n y w a y , s i n c e m o s t p r o x i e s i n c l u d e s i m i l a r capabilities.

179

180

Chapter 4


Most firewalls come with s o m e sort of GUI for configuring t h e r u l e s of w h a t is allowed a n d w h a t isn't. T h e s e c a n be very convenient for m a i n t a i n i n g large rule sets. S o m e m o r e - e x p e r i e n c e d firewall a d m i n i s t r a t o r s have c o m p l a i n e d t h a t this c a n be a h i n d r a n c e to u n d e r s t a n d i n g exactly w h a t t h e firewall is u p to. T h e y c o m p l a i n t h a t by p u t t i n g simplicity on top of a complex p r o d u c t , it gives the illusion to t h e novice a d m i n i s t r a t o r t h a t t h e y c o m p r e h e n d everything t h a t is going on. In o t h e r words, it provides a false s e n s e of security.

Summary Network A d d r e s s T r a n s l a t i o n (NAT} c h a n g e s a p a c k e t ' s layer 3 a d d r e s s as it p a s s e s t h r o u g h a NAT device. O t h e r protocols like IPX could also be t r a n s l a t e d , b u t t h e v a s t majority of the c o m m e r c i a l NAT i m p l e m e n t a t i o n s p e r f o r m NAT on IP a d d r e s s e s . Often, simply c h a n g i n g layer 3 protocols is insufficient, a n d h i g h e r layer i n f o r m a tion m u s t be modified as well. NAT a n d s e c u r i t y are often u s e d together. The ideas b e h i n d NAT p r o b a b l y c a m e from early p r o x y - b a s e d firewall solutions. Proxy servers allow a d m i n i s t r a t o r s to filter traffic for content, a n d to m a k e it a p p e a r to o u t s i d e n e t w o r k s t h a t everyt h i n g is c o m i n g from one IP a d d r e s s . The proxy a d m i n i s t r a t o r u s u a l l y configures a filtering r o u t e r (i.e., a p a c k e t filter) to block direct a c c e s s from inside-out, a n d outsidein. The c o n f i g u r a t i o n allows only inside m a c h i n e s to c o m m u n i c a t e directly with the proxy. This forces inside clients to u s e t h e p r o x y if t h e y w a n t a c c e s s to the o u t s i d e net. This single point in the n e t w o r k w h e r e all traffic is forced to p a s s t h r o u g h (on the w a y to the Internet, at least) is called a c h o k e point. Care is t a k e n to configure t h e proxy server to be as s e c u r e as possible. A side-effect of a proxy firewall is t h a t t h e o u t s i d e n e e d s to see only one IP a d d r e s s . This c a n r e d u c e t h e n e e d e d publicly r o u t a b l e IP a d d r e s s e s to one. RFC 1918 recognizes this, a n d m a k e s a n u m b e r of IP a d d r e s s r a n g e s available for private use, b e h i n d proxy servers or NAT firewalls. A NAT device u s u a l l y acts as a router.


9Chapter 4

T h e r e a r e s e v e r a l t y p e s of NAT. T h e first type is s t a t i c NAT, a 1to- 1 m a p p i n g b e t w e e n two IP a d d r e s s e s . In one direction, e i t h e r t h e s o u r c e or d e s t i n a t i o n a d d r e s s is t r a n s l a t e d ; in t h e o t h e r direction, t h e r e v e r s e h a p p e n s . Typically, t h e s o u r c e a d d r e s s is t h e one t h a t is t r a n s l a t e d , b u t t h e r e a r e u s e s for t r a n s l a t i n g t h e d e s t i n a t i o n a d d r e s s a s well. O n e p o s s i b l e u s e for t r a n s l a t i n g t h e d e s t i n a t i o n a d d r e s s is r e d i r e c t i n g client m a c h i n e s to a different s e r v e r w i t h o u t h a v i n g to r e c o n f i g u r e t h e m . A NAT r o u t e r h a s to differentiate b e t w e e n i n t e r f a c e s , typically b y m a r k i n g one "inside" a n d t h e o t h e r "outside" in o r d e r to k n o w w h e n to t r a n s l a t e , a n d w h e t h e r to t r a n s l a t e s o u r c e or d e s t i n a t i o n a d d r e s s es. B e c a u s e of t h e 1-to-1 m a p p i n g , s t a t i c NAT s a v e s no a d d r e s s space. A n o t h e r i n t e r e s t i n g v a r i a t i o n of s t a t i c NAT is called d o u b l e NAT, which changes both the source and destination addresses at the s a m e time. T h i s c a n be u s e f u l for c o n n e c t i n g two n e t w o r k s t h a t u s e the same addresses. A s t a t i c NAT i m p l e m e n t a t i o n t h a t s i m p l y t r a n s l a t e s l a y e r 3 a d d r e s s e s a n d d o e s n ' t c h a n g e t h e d a t a s t r e a m a t all m a y h a v e p r o b l e m s w i t h c e r t a i n protocols. A classic e x a m p l e of a protocol t h a t p a s s e s IP a d d r e s s e s in t h e d a t a s t r e a m is t h e FTP protocol. In o r d e r for a s t a t i c NAT (or a n y NAT for t h a t m a t t e r ) i m p l e m e n t a t i o n to w o r k w i t h FTP, it m u s t modify t h e FTP P O R T c o m m a n d a s it goes by. T h i s m u s t also w o r k if t h e P O R T c o m m a n d is split a c r o s s m o r e t h a n one packet. A n o t h e r flavor of NAT is d y n a m i c NAT. D y n a m i c NAT is s i m i l a r to s t a t i c NAT, e x c e p t t h a t it is m a n y - t o - m a n y , or m a n y - t o - 1 , a n d t h e s t a t i c m a p p i n g s a r e d o n e on t h e fly o u t of a pool of a d d r e s s e s . P r o b l e m s for a d d r e s s c o n t e n t i o n m a y arise, however, if t h e r e a r e m o r e i n s i d e a d d r e s s e s t h a n o u t s i d e a d d r e s s e s . To h e l p w i t h t h i s p r o b l e m , t h e NAT device will a t t e m p t to d e t e c t w h e n a m a p p i n g is no l o n g e r n e e d e d . S t r a t e g i e s for t h i s m a y i n c l u d e t i m e r s , a n d w a t c h ing for p a c k e t s t h a t i n d i c a t e t h e e n d of c o n n e c t i o n s . To t r a c k t h e s e i t e m s , d y n a m i c NAT m u s t m a i n t a i n a c o n n e c t i o n t a b l e to t r a c k IP a d d r e s s e s , p o r t n u m b e r , FIN bits, a n d t i m e r s . E v e n w i t h t h e s e m e c h a n i s m s , d y n a m i c NAT c a n still easily r e s u l t in

181

182

Chapter 4


r e s o u r c e contention, a n d in inside m a c h i n e s n o t being able to get out. A f u r t h e r r e f i n e m e n t is needed. Port A d d r e s s T r a n s l a t i o n is a type of NAT t h a t allows m o r e t h a n one inside m a c h i n e to s h a r e a single o u t s i d e IP a d d r e s s s i m u l t a n e ously. This is a c c o m p l i s h e d by t r a n s l a t i n g p o r t s as well as IP a d d r e s s e s . W h e n a n inside m a c h i n e m a k e s a c o n n e c t i o n out, its s o u r c e p o r t a n d a d d r e s s m a y be t r a n s l a t e d . The NAT r o u t e r will t r a c k w h i c h s o u r c e p o r t s are in use, a n d will avoid conflicts w h e n picking n e w s o u r c e ports. PAT finally achieves the a d d r e s s savings desired, a n d also achieves s o m e level of security. PAT k e e p s a c o n n e c t i o n table similar to t h a t of d y n a m i c NAT. In addition, PAT h a s to d y n a m i c a l l y o p e n p o r t s as n e e d e d to h a n d l e protocols with reverse c o n n e c t i o n s , like FTP. Most existing NAT s o l u t i o n s are PAT-based, a n d have the ability to do static NAT as needed. NAT's m a j o r f e a t u r e is a d d r e s s savings. In addition, it c a n be u s e d to t e m p o r a r i l y w o r k a r o u n d c e r t a i n types of n e t w o r k p r o b l e m s . NAT typically carries s o m e small p e r f o r m a n c e cost, b u t it's u s u a l l y negligible except u n d e r the h e a v i e s t n e t w o r k loads. Proxies a n d firewalls have a s o m e w h a t different m i s s i o n t h a n NAT, t h o u g h t h e y often are u s e d together. Firewalls are a b o u t secur i t y ~ s e c u r i t y in this context m e a n s controlling n e t w o r k connections. Historically, t h e r e are several types of firewalls: Proxies, P a c k e t Filters (PFs), a n d Static P a c k e t Filters (SPFs). Proxies w o r k by h a v i n g clients c o n n e c t to t h e m i n s t e a d of to the final i n t e n d e d server. The proxy will t h e n retrieve the desired content, a n d r e t u r n it to the inside client. Like NAT, proxies m u s t u n d e r s t a n d s o m e of the protocols t h e y p a s s in order to h a n d l e t h e m properly. PFs are often u s e d in c o n j u n c t i o n with proxies to achieve the p r o t e c t i o n needed, a n d to create the choke point to force all traffic t h r o u g h the proxy. P a c k e t filters d o n ' t m a i n t a i n state, a n d m u s t often leave large port r a n g e s o p e n to a c c o m m o d a t e protocols like FTP. Like NAT, PFs are u s u a l l y r o u t e r s . SPFs are PFs with state. In addition, a l m o s t all SPFs c a n rewrite p a c k e t s as needed. If a n SPF is able to rewrite p a c k e t s , it


9Chapter 4

c a n t h e o r e t i c a l l y do a n y t h i n g to p a c k e t s a s n e e d e d , i n c l u d i n g implem e n t i n g NAT if desired. T h e c o n n e c t i o n t a b l e s n e e d e d for PAT a r e a b o u t t h e s a m e a s t h o s e n e e d e d for SPF. NAT (and SPF) differs s u b s t a n t i a l l y f r o m a p r o x y in t e r m s of h o w it i m p l e m e n t s its f e a t u r e s . For NAT, t h e b a s i c u n i t w o r k e d on is a w h o l e p a c k e t . F o r a proxy, it's a d a t a s t r e a m . T h e m a j o r p r a c t i c a l difference is t h a t a p r o x y will t e a r a p a c k e t all t h e w a y a p a r t , a n d m a y r e a s s e m b l e it a s m o r e or fewer p a c k e t s . A NAT device will a l w a y s k e e p t h e s a m e n u m b e r of p a c k e t s in a n d out. M o s t firewalls on t h e m a r k e t a t p r e s e n t a r e a h y b r i d of p r o x y a n d S P F technology. T h e m a i n a d v a n t a g e to t h i s is t h a t t h e y a r e able to be t r a n s p a r e n t , r e q u i r i n g no special s o f t w a r e or c o n f i g u r a tion on t h e i n s i d e client m a c h i n e s .

Visit t h e Web site for t h e v e n d o r t h a t p r o d u c e s t h e p r o g r a m . Often, t h e y m a i n t a i n a FAQ a b o u t h o w to get t h e i r protocol to c o o p e r a t e w i t h firewalls. In s o m e c a s e s , it m a y be a s i m p l e o p t i o n t h a t is s e t a b l e on t h e client p r o g r a m . In o t h e r c a s e s , t h e r e will be i n s t r u c t i o n on h o w to c o n f i g u r e y o u r firewall to m a k e it work. C h e c k w i t h y o u r firewall v e n d o r to see if t h e r e is a n u p d a t e to h a n d l e t h e protocol. M o s t firewall v e n d o r s m a i n t a i n a Web site w i t h s e a r c h a b l e c o n t e n t , a n d y o u c a n s e a r c h for t h e protocol in q u e s t i o n .

183

184

Chapter 4


C h e c k the firewall logs to see if t h e r e are reverse c o n n e c t i o n s t h a t are coming b a c k a n d being denied. Possibly, y o u m i g h t have to u s e a protocol a n a l y z e r to try to d e t e r m i n e w h a t the protocol is u p to. Don't forget to c o n s i d e r t h a t y o u m a y n o t w a n t to p a s s this protocol. If you're very s e c u r i t y - c o n s c i o u s , y o u m a y realize t h a t t h e r e m a y be b u g s in the n e w p r o g r a m t h a t m a y pose a serious t h r e a t to y o u r network. Client-side holes have b e c o m e very c o m m o n recently. Q: W h y c a n ' t I c o n n e c t to anything?. A: This relates to w h e n y o u are first s e t t i n g u p y o u r NAT/firewall/proxy. There c a n be a large n u m b e r of r e a s o n s w h y y o u c a n ' t connect, a n y one of w h i c h will b r e a k things. Here are s o m e special t h i n g s to p a y a t t e n t i o n to" Make s u r e all of y o u r r o u t i n g is correct. If possible, y o u m i g h t t u r n off a n y NAT or s e c u r i t y f e a t u r e s t e m p o r a r i l y in order to see if p a c k e t s s e e m to flow. If not, y o u m a y have a r o u t i n g issue. If t h e y do, t h e n y o u p r o b a b l y n e e d to c h e c k y o u r s e c u r i t y configuration. Make s u r e you've allowed the traffic y o u ' r e trying to send. This s o u n d s obvious, b u t it h a p p e n s often enough. Probably the e a s i e s t place to see this is the logs. If y o u s h o w u p as haxang b e e n dropped, t h e n you h a v e n ' t allowed the traffic y o u ' r e trying to send. Make s u r e a n y ARP settings needed are in place. For some solutions t h a t require virtual IP addresses, you m a y have to p u b l i s h ARP a d d r e s s e s manually. A quick w a y to check if this is working or not is to look at the ARP table on the router. Make s u r e y o u r client configuration is correct. This applies especially if y o u ' r e u s i n g proxies. Make s u r e the client p r o g r a m is set to u s e the proxy, a n d look for typos or o t h e r m i s c o n f i g u r a t i o n s t h a t m i g h t be e a s y to miss. W h e n all else fails, y o u m a y have to u s e a protocol a n a l y z e r to see w h a t ' s actually h a p p e n i n g on the wire. Unfortunately, y o u m a y have to u s e it in several places to get the full p i c t u r e (inside the firewaU, outside, etc.).


9Chapter 4

Q: How do I verify t h a t m y a d d r e s s is being t r a n s l a t e d properly?.

A: This one is u s u a l l y p r e t t y easy. The s i m p l e s t w a y is to c o n n e c t to s o m e t h i n g t h a t tells y o u w h a t y o u r IP a d d r e s s is. If it's y o u r network, the r o u t e r i m m e d i a t e l y o u t s i d e y o u r NAT device m a y tell you. For example, if you log on to a Cisco r o u t e r a n d i s s u e the "show u s e r s " c o m m a n d , it will tell y o u the DNS n a m e or IP a d d r e s s from w h i c h y o u ' r e connecting.

If y o u ' r e a n e n d - u s e r , a n d y o u s u s p e c t y o u ' r e being t r a n s l a t e d a n d w a n t to find out, it m a y be slightly harder. If you've got a n a c c o u n t on a r o u t e r or UNIX box s o m e w h e r e on the I n t e r n e t , y o u c a n u s u a l l y find o u t t h a t way. A n o t h e r choice is a Web page t h a t i n f o r m s y o u w h a t IP a d d r e s s y o u ' r e coming from. An e x a m p l e of s u c h a page is: http" //www.anonymizer. com/3.0/snoop, cgi

Q: W h a t does a good firewall a r c h i t e c t u r e look like?

A: This is a religious q u e s t i o n (i.e., you'll get m a n y people p r e a c h i n g t h e i r favorite gospel). However, t h e r e are a few generally a c c e p t e d b e s t practices. We'll u s e a m e d i u m - s i z e d c o m p a n y as o u r example. They have a full-time I n t e r n e t link, a n d h a v e t h e i r own Web a n d e-mail servers on the p r e m i s e s . Let's a s s u m e t h e y d i d n ' t previously have a firewall, a n d n o w t h e y w a n t to install one. The Web server a n d e-mail server h a v e to be r e a c h a b l e by t h e I n t e r n e t ~ t h a t ' s their p u r p o s e . They also m u s t be r e a c h a b l e by the inside. They w a n t t h e m to be p r o t e c t e d from the I n t e r n e t as m u c h as possible. The typical s e t u p is a firewall with a DMZ, s o m e t i m e s called a three-legged or 3-interface firewall. The d i a g r a m looks like Figure 4.16.

185

186

Chapter 4 Figure


4.16 Transparent firewall with DMZ.

In this example, the firewall does routing. It c a n be a n SPF firewall, or t r a n s p a r e n t p r o x y - - i t d o e s n ' t really matter. W h e n a n inside u s e r w a n t s to get out, t h e y m u s t traverse the firewall. W h e n either the inside or o u t s i d e w a n t s to get to the public servers, t h e y m u s t t r a v e r s e t h e firewaU. It's n o t depicted on the d i a g r a m , b u t the rules on this type of firewall w o u l d p r e v e n t the I n t e r n e t from c o n n e c t i n g to the inside. Typically, the inside w o u l d be u s i n g RFC 1918 a d d r e s s e s , a n d the firewaU w o u l d be doing PAT for t h e inside m a c h i n e s . Most likely, the rules on the firewall are set u p for at least a few inside m a c h i n e s to have a s o m e w h a t h i g h e r level of a c c e s s to the public servers, for a d m i n i s t r a t i o n p u r p o s e s . An i m p o r t a n t r e s u l t of this type of a r c h i t e c t u r e is t h a t the inside d o e s n ' t fully t r u s t the DMZ. T h a t is, the DMZ m a c h i n e s c a n ' t get b a c k inside, at least n o t for all ports. This m e a n s t h a t if t h e DMZ m a c h i n e s are c o m p r o m i s e d , the inside m a y still be protected.


9Chapter 4

References & Resources It's i m p o s s i b l e to cover every detail of NAT, proxies, a n d firewalls in a chapter, so we h a v e provided a n u m b e r of r e s o u r c e s to w h i c h y o u m a y refer. S o m e of t h e m are general, like the RFCs, a n d s o m e are very specific, s u c h as Web pages at Cisco a b o u t t h e i r NAT software. Most likely, y o u will w a n t to s c a n t h r o u g h the list a n d look for topics t h a t are of i n t e r e s t to you. In addition, if y o u are p l a n n i n g to i m p l e m e n t one of the technologies m e n t i o n e d here, y o u will n e e d to r e a d t h e r e l e v a n t d o c u m e n t a t i o n , also referenced here.

RFCs http: //www. cis. ohio-state, edu/htbin/rfc/rfcl918 .html

RFC 1918 is the c u r r e n t RFC covering private a d d r e s s s p a c e a n d NAT. The official d o c u m e n t a t i o n for the private a d d r e s s r a n g e s (10.x.x.x, 172.16.x.x- 172.31 .x.x, 192.168.x.x) is located here. In addition, the top of t h e d o c u m e n t c o n t a i n s links to r e l a t e d a n d obsolete RFCs. A related RFC t h a t isn't referenced in RFC 1918, http: //www. cis. ohio-state, edu/htbin/rfc/rfc1631 .html

is a i m e d at NAT developers a n d i m p l e m e n t e r s .

IP Masquerade/Linux http: //ipmasq. cjb.net/

This is the m a i n place to s t a r t looking for IP M a s q u e r a d e d o c u m e n tation. On t h i s page, you'll find a changelog, a link to the HOWTO" http" //members. home. net /ipmasq/ipmasq-HOWTO, html

w h i c h links to p a g e s on h o w to join a IP M a s q u e r a d e mailing list, a n d links to locations to get IP M a s q u e r a d e h a n d l e r s . The links on

187

188

Chapter 4

9


t h e page at the time of this writing were b r o k e n (may be fixed by t h e time y o u c h e c k the m a i n page), b u t this one works: http: //www. tsmservices, com/masq/ http: //www. rustcorp, com/linux/ipchains /

This is i n f o r m a t i o n a b o u t IPChains, w h i c h is n e e d e d to w o r k with IP Masquerade.

Cisco Cisco h a s several d o c u m e n t s r e g a r d i n g their NAT i m p l e m e n t a t i o n in t h e i r r o u t e r s . If you p l a n to u s e this, y o u owe it to y o u r s e l f to at l e a s t familiarize y o u r s e l f with t h e m . http: //www. cisco, com/warp/public/458 /41 .html

This is t h e Cisco NAT FAQ. http: //www. cisco, com/warp/public/70l/60 .html

This is Cisco's NAT t e c h n i c a l tips, w h e r e Cisco d o c u m e n t s w h a t protocols are a n d are n o t covered, a m o n g o t h e r things. http: //www. cisco, com/warp/public/cc/sol/mkt/ent/ndsgn/natl_wp.htm

This this tion TCP

is a Cisco NAT white paper. It's at a similar t e c h n i c a l level to chapter, b u t obviously with a Cisco focus. They cover configuraexamples, a n d a few f e a t u r e s t h a t w e r e n ' t t o u c h e d on here, like load b a l a n c i n g .

Windows http: //www. uq. net. au/-z zdmacka/the-nat-page/nat_windows, html

Here is a n excellent list of W i n d o w s - b a s e d NAT p r o d u c t s . In fact, t h e r e are several sections on NAT t h a t are w o r t h c h e c k i n g o u t there.


9

Chapter 4

My favorite low-cost Windows NAT p r o d u c t is SyGate from S y b e r g e n Networks. It's inexpensive, a n d e a s y to set up. You c a n even get a trial v e r s i o n to evaluate. Look for it here: http: //www. sygate, com/

Microsoft Proxy Server w a s m e n t i o n e d a couple of times; inform a t i o n a b o u t it c a n be f o u n d here" http: //www.microsoft. com/proxy/default .asp

If y o u ' r e t h i n k i n g a b o u t r u n n i n g it, y o u have to c h e c k o u t t h e MSProxy FAQ" http: //proxyfaq. networkgods, com/

NAT Wh itepa pers Here are a couple of i n d e p e n d e n t NAT white p a p e r s / r e s o u r c e s : http: //www. alunmi, caltech, edu/-dank/peer-nat .html

This one h a s a focus on p e e r - t o - p e e r n e t w o r k i n g a n d NAT. http ://www. kfu. com/-dwh/nat-wp .html

This one r e i t e r a t e s s o m e of the driving i s s u e s b e h i n d RFC 1918. @Work m a i n t a i n s a NAT FAQ. It's g e a r e d t o w a r d s t h e i r u s e r s , b u t c o n t a i n s s o m e u s e f u l i n f o r m a t i o n a n d definitions: ht tp: //work. home. net/whitepapers/natfaq, html

Firewalls There are several firewaU FAQs" ht tp ://www. clark, net/pub/mj r/pubs / fwfaq/

189

190

Chapter 4


This one is p a r t i c u l a r l y good. It's very complete, a n d covers the b a s i c s well. http: //www. waterw, com/-manowar/vendor, html

This is a good collection of firewall information, in the form of a c o m p a r i s o n sheet. ftp: / /ftp. greatcircle, corn/pub/firewalls/Welcome, html

This c o n t a i n s the firewalls' mailing list a n d archive. http: //www. nfr. net/firewall-wizards/

T h e r e are a few Firewall-1 FAQs: http: //www. phoneboy, com/fwl /

The P h o n e b o y FAQ; D a m e o n k n o w s Firewall-1 well. http: //www. d r e w .

com/bastions/FWl_faq, html

Here's a s e c o n d FW-1 FAQ. You m i g h t like the organization better. http: //www2. checkpoint, com/-joe/

192

Chapter 5

9Variable-Length Subnet Masking

Introduction Variable-length s u b n e t m a s k s (VLSM) allow n e t w o r k a d m i n i s t r a t o r s to "right size" e a c h s u b n e t . With fixed-length s u b n e t m a s k s , however, e a c h s u b n e t in the n e t w o r k is the s a m e size b e c a u s e e a c h device h a s t h e s a m e s u b n e t m a s k , r e g a r d l e s s of the n e e d for a d d r e s s e s in e a c h s u b n e t . If we select a class m a s k of 2 5 5 . 2 5 5 . 2 5 4 . 0 , e a c h s u b n e t is allocated 510 a d d r e s s e s . Most LANs have a n u p p e r limit of less t h a n 150 devices d u e to traffic p a t t e r n s a n d c a p a c i t y of the p h y s i c a l LAN media. In a c t u a l fact, e a c h network, WAN or LAN, h a s a different n u m b e r of devices. With VESM, the a d d r e s s a d m i n i s t r a t o r c a n m o r e closely m a t c h the a d d r e s s i n g n e e d s of e a c h s u b n e t a n d u s e the a d d r e s s s p a c e m o r e efficiently.

Why Are Variable-Length Masks Necessary? Here is a parallel example of w h y VLSM is i m p o r t a n t . W h e n r e s t a u r a n t s sell pie, e a c h piece of the pie is the s a m e size. E a c h r e s t a u r a n t p a t r o n gets the s a m e size pie slice r e g a r d l e s s of "the need" (see Figure 5.1).

Figure 5.1 Uniform pie slices.

Variable-Length Subnet Masking

9Chapter 5

Ah, yes, the pie chart! If these people were s u b n e t s , they would all get the s a m e size s u b n e t regardless of how m a n y a d d r e s s e s they really needed. Let's look at a n o t h e r possibility in Figure 5.2. E a c h p e r s o n h a s a different appetite; they all need a different size slice of the pie.

Figure 5.2 Variable-size pie slices.

193

194

Chapter 5

*


W h e n s u b n e t t i n g , it m a y be n e c e s s a r y to give e a c h s u b n e t a n a p p r o p r i a t e slice of the pie b a s e d on the a c t u a l n u m b e r of a d d r e s s e s needed, r a t h e r t h a n a s s u m e t h a t all s u b n e t s n e e d the s a m e n u m b e r of a d d r e s s e s . V I ~ M is the a n s w e r to t h i s problem.

Right-sizing Your Subnets W h a t do we m e a n by right-sizing s u b n e t s ? Simply put, it is providing the right n u m b e r of a d d r e s s e s for each s u b n e t so t h a t we don't end u p wasting addresses. Figure 5.3 shows a simple network diagram.

Figure 5.3 The 153.90.0.0 network.

In this d i a g r a m t h e r e are t h r e e E t h e r n e t n e t w o r k s , one t o k e n ring network, a n d four p o i n t - t o - p o i n t WAN c o n n e c t i o n s . E a c h of t h e s e is a s u b n e t w i t h i n the total c o r p o r a t e network. The a c t u a l n u m b e r of h o s t a d d r e s s e s for e a c h s u b n e t is in Table 5.1. If we were to a s s i g n a s u b n e t m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 for this class B a d d r e s s e d network, all s u b n e t s w o u l d be allocated 254 h o s t a d d r e s s e s . This r e s u l t s in a lot of u n u s e d a d d r e s s e s , as s h o w n in Table 5.2.


Table 5.1

9Chapter 5

Subnet Needs

Subnet

Hosts

A

150

B

24

C

90

D

53

E

2

F

2

G

!2

H

2

Table 5.2 Addresses Wasted

Subnet

Hosts

Allocated

Unused

A

150

254

104

24

254

230

90

254

164

53

254

201

2

254

252

2

254

252

2

254

252

2

254

252

2032

1707

Total

W h a t if we choose a s u b n e t m a s k for e a c h s u b n e t t h a t allocates a m o r e a p p r o p r i a t e n u m b e r of a d d r e s s e s in e a c h s u b n e t ? Using t h e s u b n e t m a s k i n g t a b l e s from C h a p t e r 1, we d e t e r m i n e t h a t t h e m a s k s in Table 5.3 s h o u l d be u s e d in e a c h of t h e s u b n e t s . How did we d e t e r m i n e w h i c h m a s k to u s e ? In t h e s u b n e t m a s k table for class B n e t w o r k s , we located t h e m a s k t h a t allowed t h e n u m b e r of h o s t s r e q u i r e d for e a c h s u b n e t .

195

196

Chapter5


Table 5.3 Using Needs Appropriate Masks Subnet A

Hosts 150

Mask Assigned 255.255.255.0

B

24

255.255.255.224 30

6

C

90

255.255.255.128 126

36

D

53

255.255.255.192 62

9

E

2

255.255.255.252 2

0

F

2

255.255.255.252 2

0

G

2

255.255.255.252 2

0

H

2

255.255.255.252 2

0

Total

Allocated 254

480

Unused 104

155

S u b n e t A n e e d e d 150 h o s t s . In t h e c l a s s B s u b n e t m a s k t a b l e we f o u n d t h a t 2 5 5 . 2 5 5 . 2 5 5 . 0 a l l o c a t e s 2 5 4 a d d r e s s e s . We looked a t s o m e a l t e r n a t i v e s : T h e m a s k 2 5 5 . 2 5 5 . 2 5 5 . 1 9 2 a l l o c a t e s 62 a d d r e s s es a n d c a n n o t be u s e d b e c a u s e t h e n u m b e r of h o s t s is too small; on t h e o t h e r h a n d , t h e m a s k 2 5 5 . 2 5 5 . 2 5 4 . 0 a l l o c a t e s 5 1 0 h o s t s . T h i s is far too m a n y for o u r n e e d s a n d s h o u l d n o t be u s e d . T h e m a s k 2 5 5 . 2 5 5 . 2 5 5 . 0 w a s s e l e c t e d for t h e b e s t fit. T h e r e s t of t h e s u b n e t s w e r e e v a l u a t e d u s i n g t h e s a m e p r o c e s s . W h e n it c a m e to s u b n e t s E t h r o u g h H, t h e p r o c e s s w a s very simple. T h e s e s u b n e t s a re a c t u a l l y p o i n t - t o - p o i n t WAN links, a n d will h a v e no m o r e t h a n two h o s t a d d r e s s e s . S e l e c t i n g t h e m a s k w a s e a s y b e c a u s e 2 5 5 . 2 5 5 . 2 5 5 . 2 5 2 a l l o c a t e s two a d d r e s s e s to e a c h s u b n e t a n d is a n e x a c t m a t c h for o u r n e e d s .

More Addresses or More Useful Addresses? You h a v e p r o b a b l y n o t i c e d t h a t we h a v e s a v e d a d d r e s s e s in t h e V I ~ M p r o c e s s . T h a t is, we h a v e n o t p l a c e d a d d r e s s e s in s u b n e t s t h a t are n o t b e i n g u s e d . T h a t ' s n o t quite t r u e - - w i t h VLSM we h a v e a


9Chapter 5

m u c h c l o s e r m a t c h in a d d r e s s e s a l l o c a t e d to a d d r e s s e s n e e d e d . We do a s s i g n a d d r e s s e s to s u b n e t s t h a t a r e n o t u s e d , have as many unused

b u t w e do n o t

a d d r e s s e s a s w e do w i t h f i x e d - l e n g t h s u b n e t -

ting. T a b l e 5 . 4 gives t h e r e s u l t s of t h e VLSM p r o c e s s for o u r s i m p l e network.

Table 5.4 Address Savings

Fixed-Length Mask

Allocated 2O32

Variable-Length Masks 480

Allocated 1707 155

Did w e g e t m o r e a d d r e s s e s ? No, w e still h a v e a c l a s s B a d d r e s s . Are w e u s i n g t h e a d d r e s s e s w e h a v e b e t t e r t h a n b e f o r e ? Yes; a s a m a t t e r of fact, b e c a u s e w e u s e t h e a d d r e s s e s m o r e efficiently, VLSM a l l o w s u s to i m p l e m e n t m o r e s u b n e t s w i t h t h e s a m e c l a s s of a d d r e s s . We d i d n ' t g e t m o r e a d d r e s s e s , b u t addresses.

w e do h a v e m o r e u s e f u l

197

198

Chapter 5


The Importance of Proper Planning The process of creating a VI~M s u b n e t t i n g s t r u c t u r e requires a lot of a d v a n c e d planning. A survey of the n etwo rk is required. The survey m u s t include the n u m b e r of required s u b n e t s , the n u m b e r of p l a n n e d b u t not deployed s u b n e t s , the n u m b e r of devices cu rren tly in each s u b n e t a nd the n u m b e r of p l a n n e d b u t not deployed devices in each subnet. T h a t s e e m s like a lot of work b u t is necessary. You w a n t to develop a plan t h a t covers w h a t you currently have a n d w h a t you will probably have in the future. Deciding to convert from fixed-length m a s k s to V I~M requires a large c o m m i t m e n t on the p a r t of the a d d r e s s planner, n e t w o r k m a n agers, a n d users. If a n existing n e t w o r k is c h a n g e d from fixed-length m a s k s to VI~M, the entire n e t w o r k a d d r e s s i n g s t r u c t u r e will be affected. Every s u b n e t will be assigned new a d d r e s s r a n g e s a n d the administrative b u r d e n n e c e s s a r y to complete the process will be immense. E a c h a n d every device in the n etw o rk will probably have to be r e a d d r e s s e d . Do not u n d e r e s t i m a t e the a m o u n t of work required to convert an existing n e t w o r k to VI~M. If you fail to u n d e r s t a n d your network and s u b n e t requirements adequately, you m a y develop a plan t h a t cannot be deployed successfully. For existing networks, you m a y have done a lot of work planning and implementing only to find t h a t your work m u s t be discarded. You or other administrators and u s ers m a y have readdressed t h o u s a n d s of devices only to find t h a t they m u s t be readdressed again due to a ba d address plan. The following steps will help you m a k e sure your address plan is successful the first time.

Creating and Managing Variable-Length Subnets Creating a variable-length s u b n e t m a s k a d d r e s s i n g design requires the completion of four s e p a r a t e phases. E a c h of the p h a s e s m u s t be completed before moving to the next phase.


9Chapter 5

1.

Analyze s u b n e t needs.

2.

E n u m e r a t e e a c h s u b n e t a n d n u m b e r of r e q u i r e d nodes.

3.

D e t e r m i n e w h i c h m a s k to u s e in e a c h s u b n e t .

4.

Allocate a d d r e s s e s b a s e d on n e e d for e a c h s u b n e t .

The details of e a c h p h a s e follow.

Analyze Subnet Needs As we m e n t i o n e d earlier, you n e e d to k n o w exactly w h a t you have t o d a y a n d w h a t y o u will n e e d t o m o r r o w for e a c h s u b n e t . A simple s p r e a d s h e e t or m a t r i x detailing e a c h s u b n e t will help you d e t e r m i n e y o u r needs. R e m e m b e r to locate a n d list all n e t w o r k s .

Enumerate Each Subnet and Number of Required Nodes W h e n the detailed n e e d s s u r v e y is completed, the m a t r i x y o u develop will c o n t a i n all of the LANs a n d WANs with the n u m b e r of h o s t s in e a c h s u b n e t (see Table 5.5). The m a t r i x in Table 5.6 c o n t a i n s the s u r v e y i n f o r m a t i o n b u t h a s b e e n sorted in d e s c e n d i n g s e q u e n c e by the total n u m b e r of h o s t s in e a c h s u b n e t in the future. The p u r p o s e of sorting the m a t r i x is to g r o u p s u b n e t s t o g e t h e r b a s e d on the n u m b e r of h o s t s in the s u b n e t s . S u b n e t s with similar n u m b e r s of h o s t a d d r e s s e s will have the s a m e s u b n e t m a s k .

199

200

Chapter

5

9V a r i a b l e - L e n g t h

Subnet

Masking

Table 5.5 Network Survey

I

Network

Location

Hosts Status Today Operational 131

Type

9

!Accounting 'Building 3,

LANEthernet

IAccounting 'Building

WAN-PPP

Operational 2

LANEthemet

Operational 72

4th floor

Link to

Building 4 Personnel

.

m

LAN100MB Ethernet 'Logistics 'Warehouse LAN-TokenI ring Shipping Warehouse L A N Ethernet "Warehouse "Warehouse "WAN-PPP to Building -Building 4, 4 link 1st floor 9

9

'Loading

m

3-4

Building 4, 1st floor 'Personnel 'Building 4, i Expansion 2nd floor

m

1Hosts Future 140

9

9

9

9

PlannedSpring 2000 Operational 81 9

m

29 |

89

9

Operational 18

!25

"Operational "2

2

2

'Loading

'WAN-PPP

Operational 2

Loading Dock ,

LANEthernet .

Operational 14

Dock to DockWarehouse Warehouse

83

link

Receiving 9

17 )

Determine Which Mask to Use in Each Subnet Using class B subnetting table, we select the s u b n e t m a s k t h a t allocates the necessary a d d r e s s e s for each s u b n e t in Table 5.7. When working with a real networking problem, m a k e sure you leave enough room for growth in each s u b n e t you specify. If you need 150 devices in a subnet, leave room for 200. If you need 40 devices, leave room for 60. Select a m a s k t h a t gives you the allocation you need today and m a y need tomorrow.


Table

5.6 Subnet Address Requirements

9

I

Hosts

!

I

I

I

9Chapter 5

Network

I

Location

Accounting Building 3, 4th floor Logistics

i Personnel

I

I

I

Type

I

!

I

i

I

i

I

Loading Dock

Accounting Building Link to 3-4 Building 4

LANEthernet WAN-PPP

I

! I

I

!

!

Warehouse LAN-Token- Operational 81 ring Building 4, 1st floor

i Hosts Future

Today

Operational !131

Ethernet

LANEthernet ~Personnel Building 4, LANExpansion 2nd floor 100MB Ethernet Shipping Warehouse LANi .Ethernet Receiving

I

I_AN-

Status

Operational 72 PlannedSpring 2OO0

I

140 89 83 29

I

Operational 18

i

25

Operational 14

17

Operational 2

2

i

i!

i

Warehouse Warehouse- WAN-PPP to Building Building 4, 4 link 1st floor

Operational i 2

Loading Loading WAN-PPP Dock to DockWarehouse Warehouse link

Operational 2

2 I

2

Allocate Addresses Based on Need For Each Subnet Now it is time to determine which range of a d d r e s s e s will be assigned in each subnet. With fixed-length subnetting, the ranges of a d d r e s s e s are uniform and easily determined; with variable-length m a s k subnetting, the a d d r e s s ranges are j u s t as i m p o r t a n t b u t more difficult to assign. A tool can be u s e d to help determine which a d d r e s s e s to use.

201

202

Chapter5

*


Table 5.7 Subnet Mask Selection

I

!

I

Network Location iType Account- Building LANing 3, 4th Ethernet floor Logistics WareLANhouse Tokenring Person- Building LANnel 4, 1st Ethernet floor Person- Building LANnel 4, 2nd 100MB Expan- floor Ethernet sion Shipping WareLANhouse Ethernet Receiv- Loading tANing Dock Ethernet Account- Building WANing Link 3-4 PPP to Building 4 WareWareWANhouse to house PPP Building Building 4 link 4, 1st floor Loading ' Loading WANDock to DockPPP WareWarehouse house link I

I

!

!

|

|

I

!

!

I

Max Hosts Hosts Subnet Hosts/ Today Future Mask Subnet' 131 140 255.255. 254 255.0

Status Operational

I

I

Operational

I

Operational

m

I

PlannedSpring 2000

I

Operational

18

25

Operational

14

17

i

9

.

81

72

J

m

I

89 83

Operational

I

,

!255.255. 126 )255.128 ,

I

|

2

I

)

|

2

I

2

~

I

I

l

2

a

~

255.255. 126 255.128 255.255. 62 255.192

|

Operational

,

I

29

Operational

I

I

I

I

J

I

I

I

255.255. 30 255.224 I

255.255. 30 255.224 I

255.255. 2 255.252 I

255.255. 2 255.252

I

255.255. 2 255.252

!

i

For the p u r p o s e s of this example, we will be s u b n e t t i n g the 172.38.0.0 class B network. The actual range of a d d r e s s e s t h a t can


9Chapter 5

203

be a s s i g n e d in this n e t w o r k is 172.38.0.1 t h r o u g h 1 7 2 . 3 8 . 2 5 5 . 2 5 4 . The a d d r e s s e s 1 7 2 . 3 8 . 0 . 0 a n d 1 7 2 . 3 8 . 2 5 5 . 2 5 5 are excluded as the n e t w o r k a d d r e s s a n d the n e t w o r k b r o a d c a s t a d d r e s s . To simplify allocation, divide the n e t w o r k a d d r e s s e s into 256 g r o u p s b a s e d on the t h i r d octet of the a d d r e s s . In this case, the 2 5 6 blocks are given in Table 5.8. T a b l e 5.8 Address Block Matrix i

16 32

48

64

80

196 112 128 144 160 176 192 208 224 240

17 33

49

65

81

197 113 129 145 161 177 193 209 225 241

"18 134

50

66

82

198 114 130 146 162 178 194 210 226 242

'19

35

51

67

83

199 115 131 147 163 179 195 211 227 243

20 36

52

68

84

100 116 132 148 164 180 196 212 228 244

21 L37 s3 69 85

101 117 133 149 165 181 197 213 229 245

5

L38

54

70

86

102 118 134 150 166 182 198 214 230 246

23 L39 "24 40

55

71

87

103 119 135 151 167 183 199 215 231 247

56

72

88

104 120 136 152 168 184 200 216 232 248

41 L 10 .26 L42

57

73

89

105 121 137 153 169 185 201 217 233 249

58

74

90

106 122 138 154 170 186 202 218 234 250"

11 L27 ,43

59

75

91

107 123 139 155 171 187 203 219 235 251

12

60

76

92

108 124 140 156 172 188 204 220 236 252

61

77

93

109 125 141 157 173 189 205 221 237 253j

46

62

78

94

110 126 142 158 174 190 206 222 238 254i

L47

63

79

95

111 127 143 159 175 191 207 223 239 255

6

7

8

22 i

25

9

m

28

44

L29

14 3 0 L

15 L31

,

The third octet contains the n u m b e r of each possible block of 254 addresses t h a t can be assigned if a s u b n e t m a s k of 255.255.255.0 is used. If a s u b n e t requires 300 addresses, you could use 172.38.1.0 and 172.38.2.0 to allocate a total of 510 addresses for the subnet. You would t h e n strike through the two n u m b e r s 1 a n d 2 in Table 5.8 to show t h a t the two complete 254 address blocks have been used and subsequently cannot be subdivided. Prepare a chart similar to this to keep track of the large address blocks t h a t you have used.

|

L L

204

Chapter5

*


For v a r i a b l e - l e n g t h m a s k s w i t h a l l o c a t i o n s less t h a n 2 5 4 a d d r e s s e s , e a c h of t h e s e b l o c k s m a y be s u b d i v i d e d . Here is h o w we will a d d r e s s t h e e x a m p l e p r o b l e m . T h e first s u b n e t we are going to allocate u s e s a s u b n e t m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 . O n e a d d r e s s b l o c k in Table 5.8 will allocate 2 5 4 a d d r e s s e s . This is t h e n u m b e r of h o s t s available in a n a d d r e s s b l o c k w h e n t h e m a s k is 2 5 5 . 2 5 5 . 2 5 5 . 0 . We will u s e 1 7 2 . 3 8 . 1 . 0 for t h e first s u b n e t . The r a n g e of a d d r e s s e s u s e d in t h a t s u b n e t is 1 7 2 . 3 8 . 1 . 0 t h r o u g h 1 7 2 . 3 8 . 1 . 2 5 5 . In c a s e we n e e d a d d i t i o n a l s u b n e t s r e q u i r i n g a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 0 , we are r e s e r v i n g t h e b l o c k s 1 7 2 . 3 8 . 2 . 0 t h r o u g h 1 7 2 . 3 8 . 3 1 . 0 for t h a t p u r p o s e .

T h e s e c o n d a n d t h i r d s u b n e t s u s e a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 1 2 8 . This m a s k allocated o n e - h a l f of a b l o c k of 2 5 6 a d d r e s s e s . T h e r e are 128 a d d r e s s e s in one allocation a n d 128 a d d r e s s e s in t h e other. In Table 5.9 we h a v e allocated o n e - h a l f of t h e 1 7 2 . 3 8 . 3 2 . 0 b l o c k to t h e s e c o n d s u b n e t a n d t h e o t h e r h a l f to t h e s e c o n d s u b n e t . T h e 1 7 2 . 3 8 . 3 2 . 0 b l o c k is fully a l l o c a t e d a n d c a n n o t be u s e d for o t h e r s u b n e t s . In c a s e we n e e d a d d i t i o n a l s u b n e t s r e q u i r i n g a m a s k of


9Chapter 5

2 5 5 . 2 5 5 . 2 5 5 . 1 2 8 , we are reserving blocks 1 7 2 . 3 8 . 3 3 . 0 t h r o u g h 172.38.63.0, w h i c h will allow u s to allocate a n a d d i t i o n a l 62 s u b n e t s of 126 a d d r e s s e s .

Table 5.9 Address Assignments Network

Location

Accounting Building 3, 4th floor

Subnet Mask

Max Hosts/ Addresses Subnet Allocated

255.255.255.0

254

172.38.1.0172.38.1.255

Logistics

Warehouse 255.255.255.128

126

172.38.32.0172.38.32.127

Personnel

Building 4, 1st floor

255.255.255.128

126

172.38.32.128172.38.32.255

Personnel Expansion

Building 4, 2nd floor

255.255.255.192

62

172.38.64.64172.38.64.127

Shipping

Warehouse 255.255.255.224

30

172.38.128.32172.38.128.63

Receiving

Loading Dock

255.255.255.224

30

172.38.128.64172.38.128.95

Accounting Building Link to 3-4 Building 4

255.255.255.252

172.38.254.4172.38.254.7

Warehouse Warehouse- 255.255.255.252 to Building Building 4, 4 link 1st floor

172.38.254.8172.38.254.11

Loading Loading 255.255.255.252 Dock to DockWarehouse Warehouse link

172.38.254.12172.38.254.15

In c o m p l e t i n g this table, we a s s i g n e d a d d r e s s e s from different blocks. To d e t e r m i n e w h i c h a d d r e s s e s to u s e with different m a s k s , u s e the a d d r e s s a s s i g n m e n t t e m p l a t e s f o u n d at the end of this chapter.

205

206

Chapter 5


Routing Protocols and VLSM Before y o u s t a r t a m a j o r VESM i m p l e m e n t a t i o n , t h e r e are a few part i c u l a r s t h a t m u s t be u n d e r s t o o d . First, V I ~ M is difficult to implem e n t . In o u r previous e x a m p l e we looked at a very small n u m b e r of s u b n e t s . C r e a t i n g a p l a n for a large n u m b e r of s u b n e t s is time-cons u m i n g a n d r e q u i r e s a c c u r a t e information. M a k i n g m i s t a k e s in a VLSM p l a n c a n c a u s e a lot of extra a d m i n i s t r a t i v e problems. M a n a g e r s j u s t d o n ' t a p p r e c i a t e r e n u m b e r i n g the n e t w o r k over a n d over again b e c a u s e the a d d r e s s a d m i n i s t r a t o r m a d e a small m i s t a k e or two. The s e c o n d m a j o r i s s u e is t h a t the n e t w o r k r o u t e r s m u s t be u s i n g a r o u t i n g protocol t h a t s u p p o r t s V L S M ~ t h e R o u t i n g I n f o r m a t i o n Protocol Version 2 (RIP2), the O p e n S h o r t e s t P a t h First protocol (OSPF), a n d Ciseos' EIGRP. If y o u r n e t w o r k does n o t u s e t h e s e protocols, d o n ' t u s e VLSM. The protocols s u p p o r t VLSM b e c a u s e t h e y s h a r e s u b n e t m a s k i n f o r m a t i o n a m o n g all of the r o u t e r s so t h e r o u t e r s c a n m a k e p r o p e r r o u t i n g decisions. W i t h o u t the s u b n e t m a s k i n f o r m a t i o n provided by t h e s e protocols, r o u t e r s a s s u m e t h a t all s u b n e t s have the s a m e m a s k . With VLSM t h e y d o n ' t a n d r o u t i n g will fail.

Class C VLSM Problem You m a y also n e e d to u s e V I ~ M to conserve a d d r e s s e s in a class C network. S o m e experts s a y t h a t u s i n g V I ~ M in a class C n e t w o r k is too difficult b e c a u s e of the p r o b l e m s i m p l e m e n t i n g the r e q u i r e d r o u t i n g protocols in a small network. If y o u are r u n n i n g o u t of a d d r e s s e s , y o u m a y n o t have a choice a n d VESM m a y be y o u r only solution. In this example, the o r g a n i z a t i o n h a s four o p e r a t i o n a l locations in t h e g r e a t e r Chicago area. They have received a public class C a d d r e s s a n d w i s h to s u b n e t it u s i n g V I ~ M . Since the n e t w o r k is small, the a d m i n i s t r a t o r s have decided to i m p l e m e n t the RIP2 routing protocol.


9Chapter 5

The choice to u s e VLSM w a s n e c e s s a r y d u e to the mix of s u b n e t s a n d sizes. T h e r e are seven s u b n e t s , a n d the largest s u b n e t will e v e n t u a l l y c o n t a i n 95 devices; u s i n g a n o r m a l fixed-length m a s k will not work. A m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 2 4 will a c c o m m o d a t e 15 s u b n e t s b u t will allow only 14 devices in e a c h s u b n e t . A m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 1 2 8 will allow 126 devices in e a c h s u b n e t b u t will allow only two s u b n e t s . VLSM is a m u s t for this i m p l e m e n t a t i o n .

Table 5.10 Class C VLSM Problem Location Accounting Chicago

Type LANEthernet

Status Operational

Hosts Today 92

95

Logistics

Schaumburg

LANEthernet

Operational

37

45

Personnel

Oak Park

LANEthernet

Operational

11

13

Executive

Oak Brook

LANEthernet

Operational

To Chicago

Schaumburg to Chicago

WAN-PPP

Operational

To Oak Park Schaumburg WAN-PPP to Oak Park To Oak Schaumburg WAN-PPP Brook to Oak Brook

Operational

Network

i

! /

Hosts Future

Operational

After reviewing the n e t w o r k i n g r e q u i r e m e n t s survey, the a d m i n i s t r a t o r s developed Table 5.10. E a c h s u b n e t is d e s c r i b e d a n d the n u m b e r of h o s t s r e q u i r e d is also i n c l u d e d in the table. The n e x t step is to d e t e r m i n e w h i c h m a s k s to u s e for e a c h s u b n e t . Table 5.11 s h o w s the s u b n e t m a s k s t h a t the a d m i n i s t r a t o r s d e t e r m i n e d were r e q u i r e d for e a c h of the s u b n e t s . The n e x t p a r t of the t a s k is to d e t e r m i n e w h i c h a d d r e s s r a n g e s to apply to e a c h s u b net. Unlike the class B problem, w h e r e we selected large blocks of a d d r e s s e s to s u b d i v i d e b a s e d on m a s k sizes, the class C p r o b l e m

207

208


Chapter 5

r e q u i r e s a special t e c h n i q u e . Class C n e t w o r k s c o n t a i n 254 u s a b l e a d d r e s s e s . In the class C s u b n e t t i n g problem, we u s e a d d r e s s e s all from the s a m e 254 a d d r e s s block b u t select r a n g e s b a s e d on t h e m a s k in use.

Table 5.11 Class C VLSM Subnet Masks II

Network Location Type Status LANAccount- Chicago Operai ing Ethernet tional Logistics i Schaum- LAN'Operaburg tional Ethernet ,i

Max Hosts Hosts Subnet Hosts/ Today Future Mask Subnet 92 95 255.255. 126 255.128 37

45

255.255. 62 255.192

11

13

255.255. 14 255.240

LANOperaEthernet tional To S c h a u m -WAN- rOperaChicago burg to PPP !tional Chicago

7

9

255.255. 14 255.240

2

2

255.255. 2 255.252

To Oak Park

Personnel

i

Oak Park LANOperaEthernet tional

Executive Oak Brook

To Oak Brook

L

rSchaum- WAN!burg to PPP ~Oak Park

Operational

2

2

255.255. 2 255.252

Schaum- WANburg to PPP Oak Brook

Operational

2

2

255.255. 2 255.252

The s u b n e t t i n g t a b l e s in Figures 5.4, 5.5, a n d 5.6 s h o w a n e a s y w a y to select a d d r e s s e s for e a c h range. At the top of the t a b l e s y o u will find labels for e a c h of the possible f o u r t h octet of the s u b n e t m a s k . E a c h table h a s b e e n a s s i g n e d a label from A t h r o u g h H for e a c h g r o u p i n g of 32 available a d d r e s s e s . To a s s i g n a d d r e s s e s b a s e d on a given m a s k , select a c o l u m n for the m a s k a n d follow the colu m n d o w n u n t i l the c o l u m n ends. The a d d r e s s e s on the r i g h t - h a n d side table are i n c l u d e d in the range.


Chapter 5

Figure 5.4 VLSM table addresses 0 through 95.

A

B

C

I 28 1 92 224 240 248 252

1 28 I 92 224 240 248 252

128 192 224 240 248 252

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63

I

64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95

209

210

Chapter 5


For example, look at Figure 5.4, table A. To a s s i g n a n a d d r e s s range based on the s u b n e t m a s k 255.255.255.248, find the c o h m m m a r k e d 248. The first range of addresses for the .248 m a s k is from 0 through 7. The second range of addresses for the .248 m a s k is from 8 through 15, etc. The third range of addresses for m a s k .252 is 8 through 11. For each m a s k number, the tables indicate the range of addresses. Referring again to table A of Figure 5.4, look at the bottom of the 128 and 192 cohlmns. You will see a down arrow indicating that you need to go to the same column in the next table to continue the process of locating addresses. As a matter of fact, to assign addresses using t h e . 128 mask, you w ~ need to view tables A, B, and C of Figure 5.4 and table D of Figure 5.5 to determine all of the possible addresses. The end of the 128 segment on table D of Figure 5.5 does not contain an arrow. The address assigtmlent stops w h e n the arrow is missing. To assign t h e . 128 addresses, you will use 0 through 31 from table A, 32 through 63 from table B, 64 through 95 from table C, and 96 through 127 from table D.

Completing the Class C Problem Table 5.12 s h o w s the c o m p l e t e d a d d r e s s a s s i g n m e n t m a t r i x for the class C V I ~ M problem. Here is how the administrator decided on which address to assign. The first location required a m a s k of 255.255.255.128. The administrator looked at the VI~M tables, located the 128 column in table A, and followed the column down until the arrow at the end of the column was missing. Remember, the arrow says look at the next table and at the location associated with address 127, and the arrow was missing (see table D). The range of addresses is 0 through 127. The next location required a m a s k of 255.255.255.192. Since all of the addresses from the first four tables were already assigned, the administrator then t u r n e d to the remaining tables E, F, G, and H. Looking at table E, the admim'strator found the 192 column and followed it down to the bottom of the table, found an arrow, and looked to table F. The end of the 192 cohlmn on table F did not contain an arrow so the admirn'strator knew t h a t the addresses for the second s u b n e t started with 128, the first address in table E, and ended with 191, the last address in table F. The range of addresses for the second s u b n e t is 128 through 191.


9Chapter 5


D

E

128 192 224 240 248 252

F

128 192 224 240 248 252

96 97 98 99 O0 01 O2 03 O4

o5!

!

i i

06' O7 O8 O9 10 1 2 3 4 5 6 7 8 9 20 21 22 23 24 25 26 27

128 192 224 240 248 252

i

28 29 30 31 32 33 34 35 36 37 38 39 4O 41 42 43 44 45 46 47 48 49 5O 51 52 53 154 155 156 157 158 159 i

! i

m

6O 61 62 63 64 165 166 167 168 169 170 171 172 73 74 75 76 77 78 78 8O 81 82 83 84 85 86 87 88 89 9O 91

211

212

Chapter 5



G

H

120 192 224 240 240 252

120 192 224 240 240 252

192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 21 1 21 2 213 214 215 216 217 21 8 21 9 220 221 222 223

224 225 226 227 228 229 230 231 232 233 234 235 236 231 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255


9Chapter 5

Table 5.12 Class C Address Assignments

Network

Location Subnet Mask

Accounting Chicago

255.255.255.128

Max Hosts/ Subnet

Subnet Table Column

Assigned Addresses

126

A,B,C,D

0-127

E,F

128-191

Logistics

Schaum- 255.255.255.192 burg

62

Personnel

Oak Park 255.255.255.240

14

192-207

Executive

Oak Brook

255.255.255.240

14

208-223

To Chicago Schaum- 255.255.255.252 burg to Chicago

252-255

To Oak Park Schaum- 255.255.255.252 burg to Oak Park

248-251

Schaum- 255.255.255.252 burg to Oak Brook

244-247

To Oak Brook

The n e x t two s u b n e t s r e q u i r e d a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 4 0 . Since all of the a d d r e s s e s h a d b e e n a s s i g n e d from t a b l e s A, B, C, D, E, a n d F, t h e a d m i n i s t r a t o r s t a r t e d w i t h table G. In table G, t h e a d m i n i s t r a t o r located the 240 c o l u m n . The first s u b n e t w a s a s s i g n e d t h e r a n g e from 192 to 207, the first g r o u p i n g in the 240 c o l u m n , a n d the s e c o n d s u b n e t w a s a s s i g n e d the r a n g e from 208 to 223, the s e c o n d g r o u p i n g in the 2 4 0 c o l u m n . The l a s t t h r e e s u b n e t s r e q u i r e d a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 5 2 . The only a s s i g n a b l e a d d r e s s e s are f o u n d in table H, so looking to the 252 c o l u m n in table H, the a d m i n i s t r a t o r a s s i g n e d t h e t h r e e s u b n e t s r a n g e s 2 5 2 - 2 5 5 , 2 4 8 - 2 5 1 , a n d 2 4 4 - 2 4 7 . The a d m i n i s t r a t o r s t a r t e d at the b o t t o m of the allocation to leave r o o m in case a larger allocation is n e e d e d from the top of c o l u m n H at a later time.

213

214

Chapter 5


Using the s u b n e t tables f o u n d in Figures 5.4, 5.5, a n d 5.6 simplifies the p r o c e d u r e s for VESM. You m i g h t w a n t to m a k e copies of t h e s e p a g e s or create a similar s p r e a d s h e e t or form to keep t r a c k of a d d r e s s y o u have assigned. It is simple to cross o u t a d d r e s s e s as y o u a s s i g n t h e m to v a r i o u s s u b n e t s . You have a h a r d c o p y record of w h a t y o u have a s s i g n e d as well as a g r a p h i c r e p r e s e n t a t i o n of the a d d r e s s y o u have u s e d a n d the a d d r e s s e s y o u have available.

Template-based Address Assignment The following t e m p l a t e s c a n be u s e d in v a r i a b l e - l e n g t h s u b n e t t i n g w h e n the last octet of the m a s k c o n t a i n s the given value. For example, with a m a s k of 2 5 5 . 2 5 5 . 2 5 5 . 2 5 2 , y o u w o u l d look in t h e template labeled . 2 5 2 - 6 4 s u b n e t s . In t h a t template, select a r a n g e of a d d r e s s e s for u s e in the s u b n e t y o u w i s h to allocate. Once the r a n g e of a d d r e s s e s h a s b e e n allocated from a block of a d d r e s s e s , it c a n n o t be a s s i g n e d to a n o t h e r s u b n e t . E a c h of t h e s e t e m p l a t e s r e p r e s e n t s a w a y to s u b n e t the f o u r t h octet of a n y n e t w o r k a d d r e s s . 192 8 - 2 s u b n e t s

199 2 - 4 s u b n e t s

.224-8 subnets

.0

.127

.128

.255

.0

.63

.64

.127

.128

.191

.192

.255

.0

.31

.32

.63

.64

.95

.96

.127

.128

.159

.160

.191

.192

.223

.224

.255

Variable-Length Subnet Masking .240-16 subnets

.248-32 subnets

.0

.15

.16

.31

.32

.47

.48

.63

.64

.79

.80

.95

.96

.111

.112

.127

.128

.143

.144

.159

.160

.175

.176

.191

.192

.207

.208

.223

.224

.239

.240

.255

.0

.7

.8

.15

.16

.23

.24

.31

.32

.39

.40

.47

.48

.55

.56

.63

.64

.71

.72

.79

.80

.87

.88

.95

.96

.103

.104

.111

9Chapter 5

Continued

215

216

Chapter 5


.248-32 subnets (continued)

.252-64 subnets

.112

.119

.120

.127

.128

.135

.136

.143

.144

.151

.152

.159

.160

.167

.168

.175

.176

.183

.184

.191

.192

.199

.200

.207

.208

.215

.216

.223

.224

.231

.232

.239

.240

.247

.248

.255

.0

.3

.4

.7

.8

.11

.12

.15

.16

.19

.20

.23

.24

.27

.28

.31

.32

.35

.36

.39

.40

.43

.44

.47 Continued


I.252-64 subnets (continued)

I .48

I .51

I .56

I .59

.64 .68 .72 .76 .80 .84 .88 I .92 .96 .I 00 .I 04 .I 08 .I 12 .I 16 .I 20 .I 24 .128

.67 .71 .75 .79 .83 .87 .91 I .95 .99 .I 03 .I 07 .I 1 1 .I 15 .I 19 .I 23 .I 27 .131

1.132 1.136 1.140 .I 44 .I 48

I.I 35

1.152 1.156 1.160 I .I 64 1.168

I .I 55

I .60

I .63

1.139 I .I43 .I 47 .I 51 1.159 1.163 1.167 .171

Chapter 5

217

i

1 1 1

1 1 1 1

218

Chapter 5


.252-64 subnets (continued)

.172

j

.176

|

|

|

|

|

.180 .184 .188 .192

.175 .179

|

.183

|

.187

|

.191

|

.195

|

.196

.199

.200 m

|

'

|

|

|

|

.204 .208 .212 .216 .220 .224 .228

.203 ~

|

i

|

|

|

|

.232 |

|

|

|

.236 .240 .244 .248

.211 .215 .219 .223 .227 .231

m

|

'

|

|

|

|

.235 l

|

|

|

.239 .243 .247 .251 .251

.248 .252

.207

i

.255

Summary Variable-length s u b n e t m a s k i n g (VLSM) is often n e c e s s a r y w h e n a d d r e s s e s are scarce a n d you need to u s e the a d d r e s s e s you have effectively. With legacy IP networks, implementing VESM often requires a complete r e n u m b e r i n g of the entire network, so the decision to us e VLSM m u s t be m a d e with full knowledge of the required administrative processes.


9Chapter 5

R e g a r d l e s s of t h e r e a s o n w h y V I ~ M is i m p l e m e n t e d , it r e q u i r e s the u s e of c e r t a i n r o u t i n g protocols to be s u c c e s s f u l . RIP2, OSPF, a n d EIGRP m u s t be u s e d on y o u r n e t w o r k r o u t e r s to e n s u r e t h a t VLSM w o r k s correctly. The p r o c e s s of c r e a t i n g a VLSM a d d r e s s p l a n i n c l u d e s the following steps: 1.

Analyze s u b n e t needs.

2.

E n u m e r a t e e a c h s u b n e t a n d n u m b e r of r e q u i r e d nodes.

3.

D e t e r m i n e w h i c h m a s k to u s e in e a c h s u b n e t .

4.

Allocate a d d r e s s e s b a s e d on n e e d for e a c h s u b n e t .

S u r v e y y o u r n e t w o r k to d e t e r m i n e the n u m b e r of s u b n e t s present. D e t e r m i n e the type of n e t w o r k a n d the c u r r e n t a n d f u t u r e n u m b e r of devices in e a c h s u b n e t . Create a list of the s u b n e t s y o u have, a n d g r o u p s u b n e t s t o g e t h e r by size. With like-size s u b n e t s together, d e t e r m i n e the a p p r o p r i a t e m a s k for e a c h s u b n e t . Use s u b n e t t i n g t a b l e s A t h r o u g h H to help a s s i g n a d d r e s s e s w h e r e the f o u r t h octet of the m a s k c o n t a i n s . 128, . 192, .224, .240, .248, or .252. Once a d d r e s s e s are allocated to a s u b n e t , t h e y c a n n o t be allocated to o t h e r s u b n e t s . You m u s t keep t r a c k of a d d r e s s e s carefully w h e n y o u are c r e a t i n g the VLSM a d d r e s s p l a n to m a k e s u r e t h a t the s u b n e t allocations for one s u b n e t do n o t overlap o t h e r s u b n e t s . This often h a p p e n s w h e n a n a d d r e s s is applied twice b e c a u s e it o c c u r s in one size s u b n e t a n d in a n o t h e r size s u b n e t . No a d d r e s s r a n g e s are allowed to overlap. VLSM does save a d d r e s s , b u t if you have the ability to u s e a private a d d r e s s s p a c e with n e t w o r k or p o r t a d d r e s s t r a n s l a t i o n process, it m a y be j u s t as u s e f u l to i m p l e m e n t a fixed-length s u b n e t m a s k w i t h a private a d d r e s s space. The a d m i n i s t r a t i o n is easier a n d a d d r e s s p l a n n i n g is simpler.

219

220

Chapter 5 *


Q" We are r u n n i n g RIP in o u r n e t w o r k b e c a u s e it is a n e a s y r o u t i n g protocol to a d m i n i s t e r a n d b e c a u s e o u r n e t w o r k is small. C a n we use VI~M? A: RIP version 1 does n o t allow for the i m p l e m e n t a t i o n of VLSM, b u t RIP version 2 does. C h e c k to d e t e r m i n e w h i c h version of RIP y o u are u s i n g before y o u c o m m i t to V I ~ M .

Q" W h y do I have to u n d e r s t a n d all a b o u t m y n e t w o r k to do V I ~ M ? W h e n we did o u r original s u b n e t t i n g we j u s t s t a r t e d a s s i g n i n g o u r a d d r e s s e s u s i n g a m a s k a n d it w a s very simple. A: Using fLxed-length m a s k s to create y o u r a d d r e s s i n g p l a n is m u c h easier t h a n u s i n g V I ~ M . With fixed-length m a s k s , e a c h s u b n e t is the s a m e size a n d the n u m b e r of a d d r e s s e s in e a c h s u b n e t is the s a m e . A very simple p r o c e s s c a n be u s e d to a s s i g n a d d r e s s e s . With V I ~ M , everything is m o r e complex b e c a u s e all s u b n e t s are n o t all the s a m e size a n d t h e r e is no simple p r o c e s s for allocating a d d r e s s e s . Using the tables f o u n d in this c h a p t e r is a b o u t the easiest m a n u a l p r o c e s s available.

Q" W h y s h o u l d I g r o u p s u b n e t s of similar sizes t o g e t h e r before I s t a r t allocating a d d r e s s e s ?

Variable-Length Subnet Masking * Chapter 5

A: So t h a t you assign uni f or m blocks of a d d r e s s e s from similar ranges. If you choose arbitrary r a n g es of a d d r e s s e s , you might create small a d d r e s s blocks in y o u r plan t h a t c a n n o t be u s e d b e c a u s e they are too small for y o u r c u r r e n t r e q u i r e m e n t s . You might actually need some s u b n e t s t h a t have 30 a d d r e s s e s , b u t b e c a u s e you did not plan appropriately, you might be left with lots of 16 a d d r e s s blocks t h a t are not co n tig u o u s a n d c a n n o t be used.

221


224

Chapter 6

9

Routing Issues

Introduction This c h a p t e r will d i s c u s s the p u r p o s e of r o u t i n g a n d the m a n y i s s u e s t h a t arise from r o u t i n g in v a r i o u s n e t w o r k e n v i r o n m e n t s , from s m a l l e r n e t w o r k s to very large, complicated, d y n a m i c n e t w o r k s s u c h as the Internet. We will i n t r o d u c e the m a n y r o u t i n g protocols, s u c h as the Routing I n f o r m a t i o n Protocol (RIP), O p e n S h o r t e s t P a t h First (OSPF), a n d Border G a t e w a y Protocol (BGP), a n d d i s c u s s the c h a r a c t e r i s t i c s a n d i s s u e s involved with each. E a c h r o u t i n g protocol h a s its own set of s t r e n g t h s a n d w e a k n e s s e s t h a t y o u will n e e d to a s s e s s in o r d e r to u n d e r s t a n d h o w to i m p l e m e n t this protocol. You will also see how t h e s e r o u t i n g protocols are a d d r e s s i n g the i s s u e of the e x h a u s t i o n of available IP a d d r e s s e s , the i n t r o d u c t i o n of the IPv6 protocol, a n d the c o n c e r n for growing r o u t i n g t a b l e s on m a j o r r o u t e r s on the Internet. As m o s t people know, t h e r a t e of growth on the I n t e r n e t is phen o m e n a l , a n d u s a g e h a s i n c r e a s e d n e a r l y exponentially. Networks a n d h o s t s are being a d d e d to the I n t e r n e t , w h i c h t h r e a t e n s to eat u p every available IP a d d r e s s u n l e s s s o m e t h i n g is done. Not only is the e x h a u s t i o n of available IP a d d r e s s e s a n i m p o r t a n t issue, we also have to deal with the t r e m e n d o u s a m o u n t of r o u t i n g t h a t t a k e s place on the I n t e r n e t . R o u t e r s are n e t w o r k devices u s e d to r o u t e p a c k e t s to different n e t w o r k s on the Internet. The I n t e r n e t is c o m p o s e d of h u n d r e d s of t h o u s a n d s of different n e t w o r k s . R o u t e r s u s e a routing table, w h i c h is a n i n t e r n a l table t h a t c o n t a i n s r o u t e s to n e t w o r k s a n d o t h e r r o u t e r s . In m o s t r o u t e r s f o u n d on the I n t e r n e t , t h e s e r o u t e s are l e a r n e d d y n a m i c a l l y by the u s e of a d y n a m i c r o u t i n g protocol s u c h as RIP, IGRP, OSPF, a n d BGP, to n a m e a few. R o u t e r s s h a r e i n f o r m a t i o n with e a c h o t h e r c o n c e r n i n g the availability of p a t h s a n d the s h o r t e s t d i s t a n c e to a d e s t i n a t i o n . In the past, the r o u t i n g t a b l e s have b e e n growing as fast as the Internet; however, technology h a s n o t b e e n able to keep pace. The n u m b e r of r o u t e s a d v e r t i s e d h a s d o u b l e d every 10 m o n t h s . It w a s e s t i m a t e d t h a t t h e r e were a r o u n d 2 0 0 0 r o u t e s on the I n t e r n e t in 1990, a n d two y e a r s later t h e r e were 8 5 0 0 routes. In 1995 t h e r e were over 2 9 , 0 0 0 r o u t e s ,

Routing Issues

9Chapter 6

w h i c h r e q u i r e d a r o u n d 10MB of m e m o r y for the router. A r o u t e r r e q u i r e s a significant a m o u n t of RAM a n d CPU in o r d e r to add, modify, delete, a n d advertise t h e s e r o u t i n g tables with o t h e r r o u t e r s . The r o u t i n g tables have b e e n growing at a slower rate, a n d we n o w have a b o u t 6 5 , 0 0 0 routes. With t h e a d v e n t of Classless I n t e r d o m a i n Routing, we have b e e n able to limit significantly the g r o w t h of t h e s e r o u t i n g tables, m a k i n g t h e m m o r e m a n a g e a b l e a n d efficient.

Classless Interdomain Routing Classless I n t e r d o m a i n R o u t i n g (CIDR, p r o n o u n c e d as apple "cider") w a s developed w h e n the world w a s faced with the e x h a u s t i o n of class B a d d r e s s space a n d the explosion of r o u t i n g b e t w e e n t o n s of class C a d d r e s s e s . CIDR allows for a m o r e efficient allocation of IP a d d r e s s e s t h a n the old class A, B, a n d C a d d r e s s s c h e m e . This old s c h e m e is often referred to as "classful" a d d r e s s i n g , w h e r e a s CIDR is referred to as "classless" a d d r e s s i n g , as i l l u s t r a t e d in Figure 6.1. Figure

6.1 The prefix length of a classless address.

A n o t h e r t e r m for CIDR s u p e r n e t t i n g is prefix-based addressing. As y o u c a n see in Figure 6.1, it looks very similar to c u s t o m s u b n e t m a s k i n g , w h e r e the b o u n d a r y b e t w e e n the n e t w o r k ID a n d h o s t ID is n o t fixed. You will l e a r n later in this section j u s t h o w this s u p e r n e t t i n g is possible. If y o u are familiar with T C P / I P s u b n e t m a s k i n g , y o u will have no p r o b l e m s u n d e r s t a n d i n g the c o n c e p t of s u p e r n e t t i n g a n d classless a d d r e s s i n g . Both c o n c e p t s involve "masking" a portion of

225

226

Chapter 6

9Routing Issues

the IP a d d r e s s to reveal a n e t w o r k a d d r e s s . CIDR e x t e n d e d the successful ideas of T C P / I P s u b n e t t i n g . Some s a y t h a t if it w e r e n ' t for the a d v e n t of CIDR, the I n t e r n e t w o u l d not be functioning today. T h a t is a t e s t a m e n t to the power of CIDR, a n d the n e e d of CIDR for n e t w o r k i n g s u p e r n e t t i n g . CIDR is the b e s t hope we have for s m o o t h i n g the t r a n s i t i o n from IPv4 to IPv6. The IETF wrote the s t a n d a r d for CIDR in the early 1990s, a n d it is d e s c r i b e d in RFC 1517 t h r o u g h RFC 1520. CIDR h a s a p r i m a r y r e q u i r e m e n t for u s i n g a r o u t i n g protocol, s u c h as RIP version 2, OSPF version 2, a n d BGP version 4. CIDR h e l p s the I n t e r n e t r e d u c e the r o u t i n g overload by minimizing r o u t i n g tables a n d m a k i n g s u r e the m o s t i m p o r t a n t r o u t e s are carried b y m o s t routers, m a k i n g the p a t h to sites m u c h quicker. T h e s e r o u t i n g tables are global, a n d c o n t a i n i n f o r m a t i o n for r o u t e s a c r o s s the planet, so y o u c a n begin to see h o w large t h e s e r o u t i n g tables c a n get. The r o u t i n g tables are d a n g e r o u s l y close to a level w h e r e c u r r e n t software, h a r d w a r e , a n d people c a n no longer effectively m a n a g e them. CIDR is very similar to s u b n e t t i n g , b u t actually is a m o r e a d v a n c e d m e t h o d of s u b n e t t i n g t h a t c a n c o m b i n e n e t w o r k s into supernets; s u b n e t t i n g , on the other h a n d , involves b r e a k i n g netw o r k s into smaller, m o r e m a n a g e a b l e subnets. This is a c c o m p l i s h e d t h r o u g h the u s e of the s u b n e t m a s k , w h i c h m a s k s a portion of the IP a d d r e s s to differentiate the n e t w o r k ID from the h o s t ID. With CIDR, y o u basically eliminate the c o n c e p t of class a, b, a n d c networks, a n d replace t h e m with a generalized IP prefix consisting of a n IP a d d r e s s a n d the m a s k length. For example, a single class C a d d r e s s w o u l d a p p e a r as 1 9 5 . 1 2 9 . 1 . 0 / 2 4 , in w h i c h / 2 4 refers to the n u m b e r of bits of the n e t w o r k portion of the IP a d d r e s s . With the traditional class A, B, a n d C a d d r e s s i n g scheme, the a d d r e s s e s were identified by converting the first eight bits of the a d d r e s s to their decimal equivalent. Table 6.1 s h o w s the b r e a k d o w n of the t h r e e a d d r e s s classes, a n d h o w m a n y bits a p p e a r in the h o s t ID a n d the n e t w o r k ID.

Routing Issues

9Chapter 6

Table 6.1 The Familiar Delineations of the IP Address Classes Address Class Class A

# Network Bits 8 bits

# Hosts Bits 24 bits

Decimal Address Range 1-126

Class B

16 bits

16 bits

128-191

Class C

24 bits

8 bits

192-223

Using the old class A, B, a n d C a d d r e s s i n g s c h e m e , the I n t e r n e t could s u p p o r t the following: 126 class A n e t w o r k s t h a t could i n c l u d e u p to 1 6 , 7 7 7 , 2 1 4 hosts each 6 5 , 0 0 0 class B n e t w o r k s t h a t could include u p to 6 5 , 5 3 4 hosts each Over 2 million class C n e t w o r k s t h a t could i n c l u d e u p to 254 h o s t s e a c h As y o u c a n see, t h e r e are only t h r e e classes; every c o m p a n y or organization will have to choose the class t h a t b e s t s u p p o r t s t h e i r needs. Since it is n e a r l y i m p o s s i b l e to receive a class A or B a d d r e s s , y o u w o u l d be s t u c k with a class C a d d r e s s , w h i c h m a y or m a y n o t be s u i t a b l e for y o u r needs. If you were a s s i g n e d one class C a d d r e s s , a n d y o u only n e e d e d 10 a d d r e s s e s , y o u w o u l d be w a s t i n g 2 4 4 a d d r e s s e s . This r e s u l t s in w h a t a p p e a r s to be a condition of r u n n i n g o u t of a d d r e s s e s ; however, the p r o b l e m s t e m s m o r e from the inefficient u s e of the a d d r e s s e s . CIDR w a s developed to be a m u c h m o r e efficient m e t h o d of a s s i g n i n g a d d r e s s e s . A CIDR s u p e r n e t c o n s i s t s of n u m e r o u s c o n t i g u o u s IP a d d r e s s e s . An ISP c a n a s s i g n their c u s t o m e r s blocks of c o n t i g u o u s a d d r e s s e s to define the s u p e r n e t s . E a c h s u p e r n e t h a s a u n i q u e s u p e r n e t a d d r e s s t h a t c o n s i s t s of the u p p e r bits t h a t are s h a r e d b e t w e e n all IP a d d r e s s e s in the s u p e r n e t . For example, the following g r o u p of a d d r e s s e s are all c o n t i g u o u s ( 1 9 8 . 1 1 3 . 0 . 0 t h r o u g h 1 9 8 . 1 1 3 . 7 . 0 in decimal notation).

227

228

Chapter 6

*

Routing Issues

11000110 01110001 11000110 01110001 1100011001110001 11000110 01110001 11000110 01110001 1100011001110001 11000110 01110001

00000 00000 00000 00000 00000 00000 00000

000 00000000 O01 00000000 01000000000 011 00000000 I O0 00000000 I01 00000000 111 00000000

The s u p e m e t address for the block is I i0001 I0 011 I0001 00000 (the 21 u p p e r bits) because every address in the s u p e m e t h a s this in common. The complete supernet address consists of the address and the mask. 9 The a d d r e s s is the first 32-bit a d d r e s s in the contiguous a d d r e s s block. In o u r case this would be 11000110 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 (198.113.0.0 in decimal notation). 9 The m a s k is a 32-bit string, similar to the s u b n e t m a s k , w h i c h c o n t a i n s a set bit in the s u p e r n e t portion of the a d d r e s s . In o u r case this w o u l d be 11111111 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 ( 2 5 5 . 2 5 5 . 2 4 8 . 0 in decimal notation). The m a s k e d portion, however, c o n t a i n s the n u m b e r of bits t h a t are in the on position; in o u r case this w o u l d be 21. The complete s u p e r n e t a d d r e s s w o u l d be 1 9 8 . 1 1 3 . 0 . 0 / 2 i. The / 2 1 i n d i c a t e s t h a t the first 21 bits are u s e d to identify the u n i q u e n e t w o r k , leaving the r e m a i n i n g bits to identify the specific host. You can compare this to a n office phone system where every phone n u m b e r starts with a prefix such as 288 and ends with a unique fourdigit combination. For example, your phone n u m b e r is 288-1301, and Doug Fortune, the H u m a n Resources supervisor, h a s a phone n u m b e r of 288-2904. Most companies are set up so t h a t you can dial the unique portion of the user's phone n u m b e r as a m e a n s of internal dialing. To contact Doug, you would j u s t dial 2904, which is the unique portion of his full phone number. Continuing the example, 288, the prefix of the phone number, would be the s u p e r n e t address. Isn't it m u c h easier to dial the person's four-digit extension rather t h a n the entire seven-digit extension? Imagine if you h a d to dial the area code every time you made a local call. Also continuing the comparison, the area code resembles a s u p e r n e t address for a n area.

Routing Issues

9Chapter 6

CIDR c a n t h e n be u s e d to employ a s u p e r n e t a d d r e s s to r e p r e s e n t multiple IP destinations. Rather t h a n advertise a s e p a r a t e route for each of the m e m b e r s of the contiguous a d d r e s s space, the r o u t e r c a n now advertise the s u p e r n e t a d d r e s s as a single route, called a n aggregate route. This aggregate route will r e p r e s e n t all the destinations within the s u p e r n e t address, thereby reducing the a m o u n t of information t h a t n e e d s to be contained in the routing tables of the routers. This m a y not s e e m like m u c h of a reduction in the routing table, b u t multiply this by h u n d r e d s of r o u t e r s on the Internet, a n d you can see the effect CIDR c a n have on the n u m b e r of entries in the routing tables. Table 6.2 s h o w s h o w t h e CIDR block prefix is u s e d to i n c r e a s e t h e n u m b e r of g r o u p s of a d d r e s s e s t h a t c a n be u s e d , t h e r e b y offering a m o r e efficient u s e of a d d r e s s i n g t h a n the class A, B, or C m e t h o d .

Table 6.2 Characteristics of Each CIDR Block Prefix ClDR Block Prefix /27

# Equivalent Class C 1/8th of a Class C

# of Host Addresses 32 hosts

/26

1/4th of a Class C

64 hosts

/25

1/2 of a Class C

128 hosts

/24

1 Class C

256 hosts

/23

2 Class C

512 hosts

/22

4 Class C

1,024 hosts

/21

8 Class C

2,048 hosts

/20

16 Class C

4,096 hosts

/19

32 Class C

8,192 hosts

/18

64 Class C

16,384 hosts

/17

128 Class C

32,768 hosts

/16

256 Class C

65,536 hosts

(= 1 Class B) /15

512 Class C

131,072 hosts

/14

1,024 Class C

262,144 hosts

/13

2,048 Class C

524,288 hosts

229

230

Chapter 6

9Routing Issues

Routing Issues

9Chapter 6

At this time, the Internet is not completely CIDR-capable. Some older routers and other network devices m u s t be upgraded to support CIDR, and compatible protocols m u s t also be used. Non-CIDR-capable portions of the Internet can still fimction fine, b u t m a y be required to default towards the CIDR-capable parts of the Internet for routes that have been aggregated for nonnetwork boundaries. CIDR-capable forwarding is described as the ability of a router to maintain its forwarding table and to perform correct forwarding of IP packets without making any a s s u m p tions about the class of IP addresses. The CIDR Applicability S t a t e m e n t c o m p o s e d in S e p t e m b e r of 1993 r e q u i r e d I n t e r n e t d o m a i n s providing b a c k b o n e a n d / o r t r a n s i t service to fully i m p l e m e n t CIDR in order to e n s u r e t h a t the g r o w t h of the r e s o u r c e s r e q u i r e d by r o u t e r s will provide I n t e r n e t - w i d e connectivity. The Applicability S t a t e m e n t also r e c o m m e n d e d t h a t all o t h e r n o n b a c k b o n e a n d / o r t r a n s i t I n t e r n e t d o m a i n s also i m p l e m e n t CIDR b e c a u s e it will r e d u c e the a m o u n t of r o u t i n g b e t w e e n t h e s e d o m a i n s . At this time, individual d o m a i n s are n o t r e q u i r e d to implem e n t CIDR. Individual d o m a i n s are also n o t p r o h i b i t e d from u s i n g a n a d d r e s s i n g s c h e m e t h a t is n o t c o m p l i a n t with CIDR. It is very i m p o r t a n t to note t h a t CIDR does n o t a t t e m p t to solve the p r o b l e m of e v e n t u a l e x h a u s t i o n of the 32-bit IP a d d r e s s space. CIDR c a n a d d r e s s the short- to m i d t e r m difficulties to allow the I n t e r n e t time to c o n t i n u e f u n c t i o n i n g effectively while p r o g r e s s is m a d e on the longer t e r m solution of IP a d d r e s s e x h a u s t i o n . With the d e v e l o p m e n t of CIDR a r o u n d 1993, it w a s given at least t h r e e y e a r s as a viable solution until the d e p l o y m e n t of the l o n g - t e r m solution, IPv6 (otherwise k n o w n as IPng). The next g e n e r a t i o n of IP is a little b e h i n d schedule, b u t v e n d o r s are n o w m a k i n g their devices compliant, a n d the buzz is s t a r t i n g to s p r e a d in the I n t e r n e t c o m m u n i t y .

From Millions to Thousands of Networks For engineers, the biggest p u s h on the I n t e r n e t t o d a y is to devise a p l a n to limit the h u g e g r o w t h in available n e t w o r k s on the Internet. We have l e a r n e d in the previous section t h a t the addition of so m a n y n e t w o r k s on the I n t e r n e t h a s severely h i n d e r e d the ability to

231

232

Chapter 6 *

Routing Issues

m a i n t a i n effective r o u t i n g tables for all the n e w n e t w o r k s t h a t have b e e n added. It w a s b e c o m i n g m o r e difficult to r o u t e p a c k e t s to their d e s t i n a t i o n s b e c a u s e the r o u t e to t h e d e s t i n a t i o n w a s s o m e t i m e s n o t i n c l u d e d in the large r o u t i n g tables m a i n t a i n e d by t h e s e r o u t i n g d o m a i n s . This t h r e a t , m u c h like a t o r n a d o w a r n i n g , w a s d u e to t o u c h d o w n on the I n t e r n e t before the d r e a d e d e x h a u s t i o n of IP addresses. Now t h a t CIDR h a s come to the rescue, the p r o b l e m is to implem e n t CIDR fast enough to consolidate these networks to minimize the n u m b e r of entries in the routing tables. From the millions of networks out there, CIDR is able to consolidate contiguous IP addresses, k n o w n as s u t ~ m e t t i n g , into fewer n u m b e r s of networks t h a t contain more hosts. The only caveat with CIDR is t h a t these m u s t be contiguous class C addresses. The authority for assigning IP addresses h a s assigned large contiguous blocks of IP addresses to large Internet Service Providers. These large ISPs assign a smaller subset of contiguous addresses from their block to other ISPs or large network customers, as illustrated in Figure 6.2. The bottom line is t h a t the large ISP maintains a large block of contiguous addresses t h a t it can report to a higher authority for CIDR address aggregation. With CIDR, the large ISP does not have to report every class C address t h a t it owns; it h a s to report the prefix t h a t every class C address h a s in common. These addresses are aggregated into a single supernetted address for routing purposes. In our example, the prefix is 198.113.201, which is w h a t all IP addresses have in common. Instead of advertising six routes, we are advertising only one. That is a decrease of 83 percent. Imagine if every ISP were able to decrease the routes they advertise by this much. This can literally bring the n u m b e r of networks from millions down to thousands. Not only does this decrease the n u m b e r of networks, b u t it is a significant reduction in the n u m b e r of routing table entries. By March of 1998, the n u m b e r of global routing table entries was a r o u n d 50,000. Without CIDR, it is speculated t h a t the n u m b e r of global routes would have been nearly twice t h a t number. You can always count on the s t a n d a r d s committees behind the scenes of the Internet to deliver effective solutions w h e n adversity stares t h e m in the face.

Routing Issues

9Chapter 6

Figure 6.2 Maintaining contiguous CIDR blocks while assigning addresses.

--~ Large ISP

j Customer

Assigned6 ClassC IP Addresses: 198.113.21)1.30 198.113.201.36 198.113.201.31 198.113.201.34 198.113.201.32 198.113.201.35

Small ISP ~_,,,,. ~,

Assigned3 ClassC IP Addresses: 198.113.201.34 198.113.201.35 198.113.201.36

Assigned I ClassC IP Addresses: 198.113.21)1.36

ISP Address Assignment In the n e a r future, o r g a n i z a t i o n s are likely to u n d e r g o c h a n g e s t h a t will affect their IP a d d r e s s e s . This c a n r e s u l t from a variety of reasons, s u c h as a c h a n g e in I n t e r n e t Service Provider, s t r u c t u r a l reorganization, physically moving e q u i p m e n t , a n d n e w strategic r e l a t i o n s h i p s . An IP a d d r e s s r e n u m b e r i n g p l a n c a n r e s u l t in easier f u t u r e IP a d d r e s s m a n a g e m e n t . W h e n moving from one ISP to another, a n d CIDR is being used, it will be r e q u i r e d to r e t u r n the a d d r e s s e s t h a t were allocated to the o r g a n i z a t i o n from the ISP's original CIDR block. T h e s e a d d r e s s e s belong to a single large block of a d d r e s s s p a c e allocated to their curr e n t ISP, w h i c h acts like a n a g g r e g a t o r for t h e s e a d d r e s s e s . If y o u r a d d r e s s is a g g r e g a t e d into y o u r ISP's larger a d d r e s s block, y o u c a n t h e n be r o u t e d u n d e r their n e t w o r k a d d r e s s .

233

234

Chapter 6

9Routing Issues

W h a t if y o u leave I n t e r n e t Service Providers a n d choose to t a k e y o u r IP a d d r e s s e s with y o u ? This is a p r e d i c a m e n t for t h e original ISP w h o c a n no longer advertise t h e a d d r e s s e s as p a r t of a n aggregated CIDR block, b e c a u s e t h e r e is n o w a hole in t h e CIDR block (resulting from the loss of the IP a d d r e s s e s y o u took with you). CIDR c a n a d d r e s s this i s s u e b y requiring r o u t e r s to accept multiple m a t c h e s . W h e n a duplicate r o u t i n g m a t c h is found, the r o u t e r will s e a r c h for the r o u t e with t h e longest m a s k , w h i c h s h o u l d be t h e m o s t r e c e n t route. This is referred to as a n exception to a CIDR block, a n d is u s e d w h e n a block of c o n t i g u o u s a d d r e s s e s c a n n o t be u s e d , like t h e e x a m p l e in w h i c h we defected from one ISP to a n o t h e r a n d took o u r a d d r e s s e s with us. To c o n t a i n the g r o w t h of this r o u t i n g information, a n organization s h o u l d c h a n g e t h e s e a d d r e s s e s , w h i c h involves r e n u m b e r i n g their s u b n e t s a n d hosts. If t h e o r g a n i z a t i o n does n o t r e n u m b e r , the c o n s e q u e n c e s m a y include limited I n t e r n e t - w i d e IP connectivity i s s u e s . ISPs s o m e t i m e s have to c h a n g e to a n e w a n d larger block of a d d r e s s e s , a n d this m a y affect the o r g a n i z a t i o n t h a t c u r r e n t l y h a s a d d r e s s e s t h a t were allocated to t h e m from the original CIDR block. The e a s i e s t form of r e n u m b e r i n g is with t h e u s e of d y n a m i c a d d r e s s i n g , s u c h as D y n a m i c Host Configuration Protocol (DHCP). However, m a n y servers a n d n e t w o r k devices s u c h as r o u t e r s have static a d d r e s s e s , w h i c h will h a m p e r t h e r e n u m b e r i n g process. The m o s t i m p o r t a n t a s p e c t of the r e n u m b e r i n g p l a n is c e n t e r e d a r o u n d routing. R o u t i n g i s s u e s have b e c o m e very i m p o r t a n t , d u e to the large g r o w t h of the I n t e r n e t a n d the m a i n t e n a n c e of large r o u t ing tables t h a t a c c o m p a n y this growth. Since r o u t e r s are a key comp o n e n t to connectivity, t h e y are a large focus of the r e n u m b e r i n g plan. If y o u are n o t aggregated into y o u r ISP's larger a d d r e s s block, a n d y o u are a smaller organization, y o u are risking being d r o p p e d from the global r o u t i n g tables. T h e r e is no governing force t h a t h a s control over w h a t a d d r e s s e s are a d d e d to the global r o u t i n g tables; a n y ISP c a n m a n a g e their r o u t i n g tables as t h e y see fit. If y o u are a s m a l l e r n e t w o r k , y o u c a n still be i n c l u d e d in global r o u t i n g tables if y o u r a d d r e s s is p a r t of a larger CIDR a d d r e s s block.

Routing Issues

9Chapter 6

Using CIDR Addresses Inside Your Network The interior (intradomain) r o u t i n g protocols t h a t s u p p o r t CIDR are OSPF, RIP II, I n t e g r a t e d IS-IS, a n d EIGRP. If y o u are r u n n i n g one of t h e s e r o u t i n g protocols in y o u r i n t e r n a l network, y o u h a v e the ability to u s e CIDR a d d r e s s e s inside y o u r network. Most c o m p a n i e s a n d o r g a n i z a t i o n s do n o t have i n t e r n a l n e t w o r k s large e n o u g h to r e q u i r e CIDR a d d r e s s i n g . However, CIDR does provide m o r e t h a n j u s t efficient a d d r e s s i n g . W h e n i m p l e m e n t i n g CIDR a d d r e s s i n g in y o u r i n t e r n a l network, you have the ability to create smaller s u b n e t s t h a n those available with the c u r r e n t classful s u b n e t t i n g schemes. For example, in order to s u b n e t y o u r n e t w o r k u s i n g TCP/IP s u b n e t with a c u s t o m s u b n e t m a s k , the s m a l l e s t s u b n e t you have would still have 254 available hosts. With CIDR you c a n i m p l e m e n t fractional aggregates, the ability to take a class C a d d r e s s a n d assign fractions of it to c u s t o m e r s or y o u r i n t e r n a l s u b n e t s on y o u r own network. ISPs are now u s i n g this technology to assign 64 a n d 32 block a d d r e s s e s to c u s t o m e r s with small networks. This m a k e s efficient u s e of available class C a d d r e s s es, b e c a u s e w i t h o u t CIDR, you would be w a s t i n g the r e m a i n i n g IP a d d r e s s in the class C a d d r e s s t h a t w a s not used. This is how you c a n c o m b a t IP a d d r e s s e x h a u s t i o n within y o u r own network, j u s t like m a n y people are trying to do on the Internet. Table 6.3 shows the fractional aggregates of a single class C address.

Table 6.3 Fractions of a Class C Address Made Possible by CIDR CIDR Block Prefix

# Equivalent Class C

127

# of Host Addresses

1/8th of a Class C

32 hosts

126

1/4th of a Class C

64 hosts

125

1/2 of a Class C

128 hosts

124

1 Class C

256 hosts

With CIDR we n o w h a v e the ability n o t only to u s e a full Class C a d d r e s s , b u t also to a s s i g n fractions of the Class C, s u c h as ?th, ?th, or 1 / 8 th the n u m b e r of available a d d r e s s e s .

235

236

Chapter

6

Routing Issues

9

As we m e n t i o n e d earlier, y o u c a n also u s e this fractional class C a d d r e s s for y o u r i n t e r n a l network. The a d v a n t a g e s of this are s u b n e t t i n g n e t w o r k s into logical g r o u p i n g s of c o m p u t e r s a n d devices, isolating traffic, a n d therefore i n c r e a s i n g n e t w o r k p e r f o r m ance. You will have to u s e a CIDR-capable r o u t i n g protocol, s u c h as OSPF or RIP-2 on y o u r network. This will m a k e y o u r n e t w o r k m o r e complex a n d difficult to m a n a g e , b u t it will help y o u r e a p t h e benefits of s u b n e t t i n g t h a t we described earlier.

Contiguous Subnets The m o s t i m p o r t a n t rule to r e m e m b e r with CIDR classless a d d r e s s ing is t h a t s u b n e t s m u s t be c o n t i g u o u s . A r o u t e r c a n n o t p r o c e s s s u b n e t r o u t e s for n e t w o r k s to w h i c h it is n o t directly connected. The e x a m p l e in Figure 6.3 i l l u s t r a t e s this rule m o r e clearly. If a router is to take part in the same classful network in order to interpret the prefix length, it m u s t be connected directly to the network. In Figure 6.3, the r o u t e r is n o t a p a r t of t h e c o n t i g u o u s network, so it h a s no w a y of k n o w i n g the prefix length t h a t is being u s e d . More specifically, R o u t e r l a n d R o u t e r 2 c a n n o t advertise their r o u t e s to R o u t e r 3 b e c a u s e R o u t e r 3 is n o t a p a r t of the 2 0 1 . 3 5 . 8 8 network. The only r o u t e t h a t c a n be advertised to R o u t e r 3 is 2 0 1 . 3 5 . 8 8 . This p o s e s a p r o b l e m b e c a u s e R o u t e r 3 h a s no indication of w h i c h direction to s e n d a p a c k e t with the prefix of 2 0 1 . 3 5 . 8 8 ; it will u n d o u b t edly s e n d p a c k e t s to the w r o n g network. The p r o b l e m with t h e n e t w o r k configuration s h o w n in Figure 6.3 is t h a t the 1 9 8 . 1 1 3 . 2 0 1 n e t w o r k s are n o t c o n t i g u o u s . If we configu r e d a direction c o n n e c t i o n b e t w e e n R o u t e r l a n d Router2, we

Routing Issues

9Chapter 6

would have a contiguous network, and could benefit from CIDR addressing. The addition of Router3 injects a n o t h e r classful network between the 198.113.201 networks, t h u s m a k i n g it discontiguous.

Figure 6.3 An illegal CIDR configuration with disconnected networks.

IGRP The networking community began to realize the limitations of the RIP protocol {which we will see later in the chapter), and something had to be done. Many years ago, the Internet Engineering Task Force ( I ~ ) had not yet formalized the specifications for OSPF, so Cisco had the option of waiting for the specifications, or continuing to develop their own protocol. They chose to implement their own protocol, which turned out to be Interior Gateway Routing Protocol (IGRP). IGRP is a protocol t h a t is designed to coordinate routing between a n u m b e r of routers. There are a n u m b e r of routing goals with Cisco's IGRP protocol:

237

238

Chapter 6

9Routing Issues

9 Stable routing, even in a very large or complex n e t w o r k 9 No r o u t i n g loops s h o u l d o c c u r 9 F a s t r e s p o n s e to c h a n g i n g n e t w o r k topology 9 Low overhead, m e a n i n g IGRP s h o u l d n o t u s e m o r e b a n d w i d t h t h a n it n e e d s for its own u s e 9 Splitting traffic a m o n g parallel r o u t e s w h e n t h e y are of equal desirability 9 T a k i n g into a c c o u n t error r a t e s a n d levels of traffic on different p a t h s 9 The ability to h a n d l e multiple "types of services" with a single set of information. IGRP is i n t e n d e d for u s e within i n t e r n a l n e t w o r k s , u n d e r the m a n a g e m e n t of one organization. IGRP is also c o m m o n l y referred to as IGP (Interior G a t e w a y Protocol). IGRP is i n t e n d e d for m a i n t a i n i n g a very a c c u r a t e r e p r e s e n t a t i o n of the i n t e r n a l n e t w o r k topology. Convergence is very i m p o r t a n t w i t h i n i n t e r n a l n e t w o r k s , b e c a u s e t h e p a t h s to n e t w o r k s m u s t be quickly r e r o u t e d in the event a netw o r k link were to go down. This is n o t as i m p o r t a n t as e x t e r n a l netw o r k s , b e c a u s e m o s t c h a n g e in n e t w o r k topology o c c u r s w i t h i n n e t w o r k s , s u c h as the addition or removal of a b r o k e n link. E x t e r n a l n e t w o r k links m u s t be stable a n d c o n s i s t e n t to avoid m a j o r d i s t u r b a n c e s from m i s c o n f i g u r e d or d o w n links. EGRP (Exterior G a t e w a y R o u t i n g Protocol) is m o r e i m p o r t a n t for providing r e a s o n a b l e r o u t e s , r a t h e r t h a n optimal routes. However, IGRP is very c o n c e r n e d with providing the optimal r o u t e w h e n p a c k e t s are being routed. IGRP is a d i s t a n c e - v e c t o r protocol in w h i c h r o u t e r s (often called gateways) e x c h a n g e r o u t i n g i n f o r m a t i o n only with a d j a c e n t r o u t e r s . W h e n the a d j a c e n t r o u t e r receives the u p d a t e , it will c o m p a r e the i n f o r m a t i o n with its own r o u t i n g table. Any n e w p a t h s or d e s t i n a tions will be added. P a t h s in the a d j a c e n t r o u t e r ' s u p d a t e will also be c o m p a r e d with existing p a t h s to d e t e r m i n e if the n e w r o u t e is m o r e efficient t h a n the r o u t e t h a t c u r r e n t l y exists in the r o u t i n g table. If the n e w p a t h is better, it will replace the existing one. This is the general p r o c e d u r e u s e d in all d i s t a n c e - v e c t o r protocols.

Routing Issues

9Chapter 6

The a l t e r n a t i v e to d i s t a n c e - v e c t o r r o u t i n g is S h o r t e s t P a t h F i r s t (SPF) routing, w h i c h we will d i s c u s s in g r e a t detail in t h e section on O p e n S h o r t e s t P a t h First (OSPF). This is a l i n k - s t a t e t e c h n o l o g y in w h i c h e a c h r o u t e r c o n t a i n s a n identical d a t a b a s e . The r o u t i n g i n f o r m a t i o n e x c h a n g e c o n t a i n s a s u m m a r y of inform a t i o n c o n c e r n i n g t h e r e s t of t h e network. A collection of r o u t e r s u s i n g IGRP c o m p l e t e s t h e entire n e t w o r k topology, r e s u l t i n g in a d i s t r i b u t e d a l g o r i t h m in w h i c h e a c h r o u t e r solves only a p o r t i o n of t h e routing. Working t o g e t h e r a n d e x c h a n g i n g r o u t i n g i n f o r m a t i o n with only t h e i r a d j a c e n t r o u t e r s , t h e s e r o u t e r s c a n d e t e r m i n e t h e b e s t r o u t e a p a c k e t c a n take. In o t h e r words, no one r o u t e r n e e d s to m a i n t a i n t h e i n f o r m a t i o n for the entire network. IGRP goes b e y o n d RIP w h e n it c o m e s to metrics. The a d d e d i n f o r m a t i o n in IGRP allows the r o u t e r to m a k e m o r e intelligent choices with r e g a r d s to t h e m e t r i c cost of one r o u t e over another. RIP h a d no w a y of c h o o s i n g the r o u t e with the h i g h e s t b a n d w i d t h w h e n b o t h r o u t e s h a d t h e s a m e m e t r i c h o p count. The n e w m e t r i c s i n t r o d u c e d with IGRP include:

Topological delay t i m e . The a m o u n t of time it would take a packet to reach its destination if the network was not busy. You can incur additional delays if there is network traffic on the network.

Bandwidth of the narrowest bandwidth s e g m e n t of the path. The b a n d w i d t h in bits per second.

Channel o c c u p a n c y of the path. I n d i c a t e s h o w m u c h of t h e b a n d w i d t h is c u r r e n t l y in use. This n u m b e r will c h a n g e often as t h e n e t w o r k traffic i n c r e a s e s a n d d e c r e a s e s . Reliability of the path. Indicates the reliability of the p a t h b a s e d on the n u m b e r of packets t h a t actually arrive at the destination, based on the n u m b e r of packets t h a t were originally sent. IGRP calculates these factors with a complicated algorithm and determines the best route to take, indicated by the smallest metric value.

239

240

Chapter 6 *

Routing Issues

IGRP also h a s s u b s t a n t i a l stability features, s u c h as Holddowns, Split horizons, a n d Poison-reverse u p d a t e s , w h i c h are d e s c r i b e d as follows:

Hold-downs. Used to p r e v e n t a r e g u l a r u p d a t e m e s s a g e from r e i n s t a t i n g a r o u t e t h a t m a y have gone b a d in the past. W h e n a n e t w o r k link goes down, the n e i g h b o r i n g r o u t e r s will detect the lack of regularly s c h e d u l e d u p d a t e s , a n d d e t e r m i n e t h a t this link is not functioning. U p d a t e m e s s a g e s will t h e n begin to p e r m e a t e the n e t w o r k r e g a r d i n g the fact this r o u t e r is not functioning. If this convergence t a k e s too long, it is possible t h a t a n o t h e r r o u t e r on the n e t w o r k will advertise t h a t this r o u t e r is still f u n c t i o n i n g normally. This device potentially is advertising incorrect r o u t i n g information. A h o l d - d o w n will tell the r o u t e r s on the n e t w o r k to hold d o w n a n y of the c h a n g e s t h a t m a y affect the r o u t e s for a period of time. The h o l d - d o w n period is calculated to be j u s t slightly greater t h a n the period of time n e c e s s a r y to u p d a t e the entire n e t w o r k with a r o u t i n g change.

Split horizons. Used to avoid r o u t i n g loops b e t w e e n two routers. It is never useful to s e n d i n f o r m a t i o n a b o u t the r o u t e b a c k in the direction from w h i c h the p a c k e t w a s sent. In Figure 6.4, R o u t e r 1 will advertise a r o u t e to Network A, w h i c h it is directly connected. Router2 s h o u l d never advertise this r o u t e b a c k to R o u t e r l b e c a u s e R o u t e r l is closer to Network A. This will p r e v e n t r o u t i n g loops b e t w e e n the two routers. For example, if the interface to Network A w e n t down, Router2 m a y c o n t i n u e to inform R o u t e r 1 t h a t it c a n r e a c h Network A t h r o u g h R o u t e r l (which is itself). R o u t e r l m a y be fooled into believing this r o u t e is correct, a n d a r o u t i n g loop w o u l d t h e n occur. ( R e m e m b e r t h a t split horizons avoid only loops b e t w e e n two routers.)

Poison-reverse updates. Used to minimize loops b e t w e e n m o r e t h a n two routers. W h e n the metric is i n c r e a s i n g significantly, this m a y indicate a r o u t i n g loop. A poison-reverse u p d a t e is t h e n s e n t to the r o u t e r to place it into hold-down.

Routing Issues

9Chapter 6

Figure 6.4 Avoiding routing loops with split horizons.

A n o t h e r f e a t u r e of IGRP stability is the u s e of t i m e r s a n d variables t h a t c o n t a i n time intervals. The t i m e r s include a n u p d a t e timer, a n invalid timer, a hold-time period, a flush timer, a n d a sleep timer. 9 The u p d a t e t i m e r will specify h o w frequently the u p d a t e m e s s a g e s will be sent. The IGRP u p d a t e timer default is every 90 s e c o n d s . 9 The invalid t i m e r will specify h o w long a r o u t e r will wait if it is n o t receiving r o u t i n g u p d a t e m e s s a g e s before the r o u t e will be declared invalid. The IGRP invalid t i m e r default is t h r e e times the u p d a t e timer. 9 The h o l d - t i m e period (sometimes referred to as t h e holdd o w n period) will specify the a m o u n t of time for t h e holdd o w n period. The IGRP h o l d - t i m e default is t h r e e times the u p d a t e t i m e r p l u s ten s e c o n d s . 9 The flush t i m e r will specify h o w m u c h time s h o u l d p a s s before a r o u t e is f l u s h e d from a r o u t i n g table. The IGRP flush timer default is seven times the u p d a t e period. 9 The sleep t i m e r is the a m o u n t of time t h a t u p d a t e m e s s a g e s will be p o s t p o n e d . The sleep value s h o u l d be less t h a n the u p d a t e t i m e r b e c a u s e the r o u t i n g tables will never be s y n c h r o n i z e d if the sleep value is h i g h e r t h a n the u p d a t e timer.

241

242

Chapter 6 *

Routing Issues

EIGRP EIGRP is an e n h a n c e d version of the IGRP routing protocol, and is continually evolving. EIGRP u s e s the s a m e distance-vector-based routing t h a t IGRP uses. W h a t h a s improved is the convergence and operating efficiency. The m a i n e n h a n c e m e n t with EIGRP is the sophisticated Diffusing Update Algorithm (DUAL). This algorithm is significantly more advanced t h a n the distance-vector algorithm u s e d by RIP and previous versions of IGRP. The new algorithm was e n h a n c e d to decrease routing loops drastically. Convergence is improved by implementing a new algorithm t h a t enables all routers involved in a topology change to synchronize their internal routing tables at the same time. EIGRP is now Network Layer protocol-independent, which m e a n s it can s u p p o r t other protocol suites. One of the downfalls of EIGRP is the fact t h a t it is seen as a competitor to OSPF. EIGRP can be implemented seamlessly within a network or IGRP routers. This m a k e s it possible to benefit from the features of both protocols simultaneously, also providing an upgrade p a t h for continual migration from IGRP to EIGRP. Another benefit of this coexistence is t h a t you can strategically implement EIGRP in specific portions of your network. Cisco defines the four basic c o m p o n e n t s of EIGRP as follows:

Neighbor Discovery/Recovery. The process of dynamically learning the s t a t u s of other routers on their directly a t t a c h e d networks. Routers m u s t also continually poll their neighbors to determine if they are still functioning or reachable. This is achieved by sending Hello packets on a regular basis. Once these Hello packets are received, the routers can t h e n continue to exchange route information. Reliable Transport Protocol. Responsible for the g u a r a n t e e d delivery of packets in the correct order. For efficiency, reliability is only provided w h e n needed. This is accomplished by sending a m u l t i c a s t Hello packet to the neighbors t h a t states the packet does not have to be acknowledged. As you know, the process of

Routing Issues

9Chapter 6

r e s p o n d i n g to a c k n o w l e d g m e n t r e q u e s t s is w h a t c o n s u m e s v a l u a b l e b a n d w i d t h on a network, especially on a n E t h e r n e t n e t w o r k with a very b r o a d c a s t - i n t e n s i v e protocol. Every p a c k e t m u s t be c a p t u r e d a n d analyzed by the n e t w o r k a d a p t e r s to d e t e r m i n e if the p a c k e t is d e s t i n e d for t h e m . This c a n be very CPU-intensive as well. DUAL F i n i t e S t a t e M a c h i n e . The decision p r o c e s s for r o u t e c o m p u t a t i o n s . It is r e s p o n s i b l e for t r a c k i n g r o u t e s t h a t are advertised by all neighbors. The metric h o p c o u n t is the d i s t a n c e i n f o r m a t i o n u s e d to create loop-free p a t h s . The r o u t e s are selected b a s e d on feasible s u c c e s s o r s . A feasible s u c c e s s o r will be d i s c u s s e d later in this section.

Protocol Dependent M o d u l e s . R e s p o n s i b l e for s e n d i n g a n d receiving EIGRP p a c k e t s t h a t are e n c a p s u l a t e d in a protocol, s u c h as IP. This m o d u l e h a s s u p p o r t for m o r e protocols.

EIGRP Concepts This section describes the concepts for Cisco's EIGRP implementation. N e i g h b o r t a b l e . A table in w h i c h e a c h r o u t e r k e e p s t r a c k of n e i g h b o r i n g (adjacent) r o u t e r s . W h e n a n e w n e i g h b o r is learned, the a d d r e s s a n d interface is r e c o r d e d into the r o u t i n g d a t a b a s e . T o p o l o g y table. A table t h a t is p o p u l a t e d with protocold e p e n d a n t m o d u l e s c o n t a i n i n g all d e s t i n a t i o n s a d v e r t i s e d by the n e i g h b o r i n g r o u t e r s . E a c h e n t r y also c o n t a i n s the d e s t i n a t i o n a d d r e s s a n d list of n e i g h b o r s t h a t have advertised this p a r t i c u l a r d e s t i n a t i o n . The table also c o n t a i n s the metric a s s o c i a t e d with this d e s t i n a t i o n . This is the b e s t metric the r o u t e r u s e s a n d places in the r o u t i n g table, w h i c h is t h e n u s e d for r o u t i n g a n d for advertising this r o u t e to o t h e r r o u t e r s . F e a s i b l e s u c c e s s o r s . An e n t r y t h a t is moved from the topology table to the n e i g h b o r table w h e n t h e r e is a feasible successor. The n e i g h b o r s t h a t have a n advertised metric r o u t e t h a t is less t h a n the c u r r e n t r o u t i n g table metric are c o n s i d e r e d feasible s u c c e s s o r s . Feasible s u c c e s s o r s are r o u t e r s t h a t are d o w n s t r e a m

243

244

Chapter 6 * Routing Issues

n e i g h b o r s to the n e i g h b o r i n g router, n o t this p a r t i c u l a r router. It is the n e i g h b o r ' s neighbor. W h e n a n e i g h b o r h a s c h a n g e d its metric, or a topology c h a n g e o c c u r s on the network, t h e list of feasible s u c c e s s o r s will have to be r e c o m p u t e d . R o u t e s t a t e s . The r o u t e c a n be only one of two states: passive

or active. A r o u t e is c o n s i d e r e d passive w h e n the r o u t e r is n o t p e r f o r m i n g a r o u t e r e c o m p u t a t i o n . The r o u t e is c o n s i d e r e d active w h e n a r o u t e r is p e r f o r m i n g r o u t e c o m p u t a t i o n .

RIP-1 Requirements R o u t i n g I n f o r m a t i o n Protocol (RIP), the d i s t a n c e - v e c t o r Interior G a t e w a y R o u t i n g Protocol t h a t we d i s c u s s e d in the previous section, is u s e d by r o u t e r s to r o u t e p a c k e t s to r e m o t e n e t w o r k s . There are a few differences b e t w e e n RIP a n d IGRP t h a t we will d i s c u s s later in this section. The RIP protocol is a n interior r o u t i n g protocol, a n d the m o s t p o p u l a r of the interior r o u t i n g protocols. The RIP protocol is b a s e d on a 1970s design, a n d e m e r g e d for T C P / I P in the early 1980s. With the rapid a d v a n c e m e n t s in technology, y o u c a n see h o w technology h a s exceeded the capabilities of the RIP protocol. RIP h a s c h a n g e d very little since its emergence, a n d therefore h a s s o m e limitations in larger, m o r e complex n e t w o r k s . S o m e of t h e s e limitations have b e e n a d d r e s s e d by the n e w e r RIP-2 protocol specification. Limitations of RIP-1 include the following: 9 RIP c a n n o t s u p p o r t a n i n t e r n a l n e t w o r k with m o r e t h a n 15 h o p s w i t h i n the s a m e network. A r o u t e r c o u n t s the h o p s a p a c k e t m a k e s as it c r o s s e s o t h e r r o u t e r s on the w a y to its destination. 9 RIP c a n n o t s u p p o r t v a r i a b l e - l e n g t h s u b n e t m a s k i n g . S u b n e t t i n g is very p o p u l a r in T C P / I P - b a s e d n e t w o r k s , a n d the RIP protocol is s u b j e c t to restrictions in this type of network. A n o t h e r t e r m for this is Variable-Length S u b n e t M a s k s (VLSM), w h i c h RIP does n o t s u p p o r t .

Routing Issues

9Chapter 6

9 RIP will b r o a d c a s t u p d a t e s a b o u t every 30 seconds. B a n d w i d t h c a n be c o n s u m e d if the r o u t e r h a s a large r o u t i n g table, or t h e n e t w o r k is very large with slow links. 9 RIP h a s limited security. It is possible to o b t a i n a n u n a u t h o r i z e d list of r o u t e s from o t h e r n e i g h b o r i n g r o u t e r s , a n d it m a y be possible for a h a c k e r to inject false r o u t e s on the network. 9 Routing p r o b l e m s are difficult to d i a g n o s e in RIP. 9 RIP h a s a slower convergence time t h a n OSPF. RIP r o u t e r s have a period of hold-down, g a r b a g e collection, a n d will slowly t i m e - o u t i n f o r m a t i o n d u r i n g the convergence process. This is n o t a c c e p t a b l e in s o m e large n e t w o r k s a n d could possibly c a u s e r o u t i n g i n c o n s i s t e n c i e s . 9 RIP h a s no c o n c e p t of slow links or n e t w o r k delays. Routing decisions are only m a d e by m e t r i c s hop c o u n t s . The p a t h with the lowest hop c o u n t is the m o s t efficient, w h i c h m a y n o t be the b e s t m e t h o d b e c a u s e this does n o t t a k e into a c c o u n t the s p e e d of s o m e of t h e s e n e t w o r k links. 9 RIP n e t w o r k s are n o t hierarchical, a n d have no c o n c e p t of areas, domains, and a u t o n o m o u s systems. 9 RIP does n o t s u p p o r t c l a s s l e s s routing, w h i c h h a s b e c o m e i n c r e a s i n g l y p o p u l a r a n d n e c e s s a r y on large n e t w o r k s a n d on the I n t e r n e t . R o u t e r s periodically will e x c h a n g e r o u t i n g t a b l e s w i t h n e i g h b o r ing r o u t e r s . R o u t e r s u s i n g the RIP protocol e x c h a n g e t h e i r entire r o u t i n g table, w h i c h c a n be inefficient. For this r e a s o n , r o u t e r s are u s i n g m o r e efficient r o u t i n g protocols s u c h as O p e n S h o r t e s t P a t h First (OSPF). Figure 6.5 is a n e x a m p l e of a typical r o u t i n g table. Not everything a b o u t the RIP protocol is negative. Since it is one of the m o s t w i d e s p r e a d interior r o u t i n g protocols, RIP c a n be s u p p o r t e d a l m o s t a n y w h e r e . As m a n y n e t w o r k t e c h n i c i a n s a n d engin e e r s know, a n y protocol t h a t is a l m o s t u n i v e r s a l is a welcome a d d i t i o n b e c a u s e of the compatibility. Also, RIP is very e a s y to configure, w h i c h m a k e s it very attractive b e c a u s e of the m i n i m a l a m o u n t of configuration required.

245

246

Chapter 6

9Routing Issues

Figure 6.5 A sample RIP routing table.

Destination

Next Hop

Distance Timers

Flags

NetworkA

Routerl

5

11,12,13

x,y

NetworkB

Router2

3

11,12,13

x,y

NetworkC

Routerl

2

11,12,13

x,y

RIP classifies r o u t e r s a s p a s s i v e a n d active. An active r o u t e r will a d v e r t i s e its r o u t e s to o t h e r r o u t e r s . P a s s i v e r o u t e r s will receive t h e s e r o u t e s , b u t t h e y do n o t h a v e t h e ability to a d v e r t i s e t h e i r own r o u t e s . Typically, a r o u t e r will r u n in active mode, a n d h o s t s will r u n in p a s s i v e mode. The u p d a t e will c o n s i s t of a n IP n e t w o r k a d d r e s s a n d t h e i n t e g e r d i s t a n c e to t h a t n e t w o r k . RIP u s e s a h o p c o u n t , w h i c h , a s we d e s c r i b e d earlier, is t h e n u m b e r of r o u t e r s t h e p a c k e t will h a v e to c r o s s to r e a c h t h e d e s t i n a t i o n n e t w o r k . E a c h p a s s over a r o u t e r i n c r e a s e s t h e h o p c o u n t by one hop. RIP h a s a m a x i m u m of 15 h o p s w h e n r o u t i n g p a c k e t s to a r e m o t e n e t w o r k . T h e s e m e t r i c c o u n t s of h o p s to t h e d e s t i n a t i o n d e t e r m i n e t h e m o s t efficient route; t h a t is, t h e q u i c k e s t p a t h to t h e d e s t i n a t i o n n e t w o r k . In o t h e r w o r d s , a r o u t e w i t h 5 h o p s is m o r e efficient t h a n a r o u t e w i t h 8 h o p s . However, t h e r o u t e w i t h t h e l e a s t n u m b e r of h o p s m a y n o t be t h e f a s t e s t r o u t e to a d e s t i n a t i o n . T h e h o p s do n o t t a k e into a c c o u n t t h e s p e e d of t h e route. For example, a r o u t e w i t h 5 h o p s m a y c r o s s slower serial links in o r d e r to r e a c h a d e s t i n a t i o n , r a t h e r t h a n another route with 7 hops that crosses an Ethernet network. For t h i s r e a s o n , a r o u t e r c a n a d v e r t i s e a h i g h e r h o p c o u n t for a slow link to c o m p e n s a t e for t h e slower link. This will d e t e r t h e u s e of t h i s slower link.

Routing Issues

9Chapter 6

Comparison with IGRP T h e c o m p a r i s o n b e t w e e n RIP a n d IGRP is u s e f u l b e c a u s e RIP is u s e d for p u r p o s e s t h a t a r e s i m i l a r to IGRP. However, RIP w a s d e s i g n e d w i t h s m a l l e r n e t w o r k s in m i n d , a n d w a s n e v e r m e a n t to be u s e d in large, c o m p l e x n e t w o r k s . T h e m o s t b a s i c difference b e t w e e n t h e two p r o t o c o l s is t h e u s e of m e t r i c s . RIP u s e s a s i m p l e h o p c o u n t , w h i c h we d i s c u s s e d in t h e p r e v i o u s section. RIP h a s a h o p c o u n t of 15 w h e n r o u t i n g p a c k e t s to a r e m o t e n e t w o r k . T h e h o p c o u n t , e x p r e s s e d in a d e c i m a l f r o m 1 to 15, d e s c r i b e s t h e n u m b e r of r o u t e r s t h e p a c k e t will h a v e to p a s s before a r r i v i n g a t its d e s t i n a t i o n . S i n c e t h e m a x i m u m h o p c o u n t is 15, it m a y be difficult to r e a c h a slower n e t w o r k r e p r e s e n t e d w i t h a large h o p c o u n t . To a c c o m m o d a t e t h e full r a n g e of n e t w o r k links, s u c h a s serial a n d a s y n c h r o n o u s WAN links, t h e m e t r i c s h o u l d be i n c r e a s e d to a h i g h e r n u m b e r , s u c h a s 24. T h i s 2 4 - b i t m e t r i c c o u l d allow for m o s t reliable r o u t i n g on large, c o m p l e x n e t w o r k s , or n e t w o r k s w i t h v a r i o u s slow links. S o m e n e t w o r k s t o d a y a r e so large t h a t RIP c a n n o t p a s s p a c k e t s f r o m one e n d of t h e n e t w o r k to t h e o t h e r w i t h o u t e x h a u s t i n g t h e m a x i m u m of 15 h o p s . RIP is j u s t n o t p o s s i b l e on t h e s e large n e t w o r k s . S i n c e y o u c a n n o t j u s t i n c r e a s e t h e h o p c o u n t w i t h RIP, y o u m u s t find a n a l t e r n a t i v e . IGRP n o t only p r o v i d e s a l a r g e r m e t r i c h o p c o u n t , b u t also i n c l u d e s a few m o r e f e a t u r e s t h a t m a k e it m o r e r o b u s t t h a n RIP. IGRP c a n e x p r e s s t h e m e t r i c h o p c o u n t to i n c l u d e f a c t o r s s u c h a s delay, b a n d w i d t h , a n d reliability. RIP c a n e x p r e s s two different r o u t e s a s t h e s a m e h o p c o u n t , b u t c a n n o t t a k e into a c c o u n t t h e fact t h a t t h e s e r o u t e s m a y travel slower r o u t e s , or cons u m e m o r e b a n d w i d t h t h a n desired. IGRP c a n also split traffic a m o n g several e q u a l r o u t e s , w h i c h is n o t very e a s y to i m p l e m e n t w i t h RIP. I n s t e a d of i m p l e m e n t i n g a conf i g u r a t i o n w h e r e RIP s u p p o r t s traffic splitting, it m a y be m o r e effective to u p d a t e t h e n e t w o r k to u s e a r o u t i n g protocol o t h e r t h a n RIP. RIP u p d a t e s also c o n t a i n little i n f o r m a t i o n , s u c h a s t h e d e s t i n a t i o n s a n d t h e h o p c o u n t s (metric values). IGRP c a n s u p p o r t a n A u t o n o m o u s S y s t e m N u m b e r (ASN), w h i c h is a n u m b e r u s e d to

247

248

Chapter 6

9Routing Issues

d e s c r i b e a n area, or d o m a i n . We will l e a r n m o r e a b o u t t h e ASN in t h e s e c t i o n on B o r d e r G a t e w a y Protocol (BGP). A n d finally, RIP u s e s t h e c o n c e p t of a "default route," a r o u t e t h a t will get a p a c k e t to a d e s t i n a t i o n t h a t is n o t specified in t h e r o u t e r ' s i n t e r n a l r o u t i n g table. This c a n be c o m p a r e d to t h e d e f a u l t r o u t e r in TCP/IP, w h i c h is u s e d to s e n d a p a c k e t t h a t is d e s t i n e d for a r e m o t e n e t w o r k t h a t t h i s h o s t is u n a b l e to find. The p h r a s e , "I d o n ' t k n o w w h e r e t h i s p a c k e t is d e s t i n e d for, so y o u do s o m e t h i n g w i t h it." is u s e d to d e s c r i b e t h e c o n c e p t of t h e d e f a u l t gateway. RIP a n d s o m e o t h e r r o u t i n g p r o t o c o l s d i s t r i b u t e t h e d e f a u l t r o u t e a s if it were a p a t h to a real n e t w o r k , w h i c h in m o s t c a s e s it is not. IGRP u s e s a different a p p r o a c h to t h e d e f a u l t route. R a t h e r t h a n distribu t e t h e d e f a u l t r o u t e a s a fake route, IGRP c a n flag real n e t w o r k s (more t h a n one) a s c a n d i d a t e s for t h e d e f a u l t route. IGRP c a n s c a n all of t h e d e f a u l t r o u t e s to d e t e r m i n e w h i c h r o u t e is t h e b e s t c a n d i d a t e w i t h t h e lowest metric. This c a n d i d a t e c a n t h e n b e c o m e t h e a c t u a l d e f a u l t route.

Routing Update Impact As we d i s c u s s e d earlier, one of t h e d i s a d v a n t a g e s of RIP r o u t i n g is t h e e x t e n s i v e u s e of b r o a d c a s t s . A r o u t e r u p d a t e s its own r o u t i n g t a b l e w i t h i n f o r m a t i o n received from n e i g h b o r i n g r o u t e r s . W h e n a r o u t e r t h a t is c o n f i g u r e d to r e s p o n d h e a r s t h i s r e q u e s t , it will r e s p o n d w i t h a p a c k e t t h a t c o n t a i n s i n f o r m a t i o n on r o u t e s from its very own r o u t i n g d a t a b a s e . This r e s p o n s e p a c k e t c o n t a i n s d e s t i n a tion n e t w o r k i n f o r m a t i o n a n d m e t r i c s (hops) for r e a c h i n g t h e s e dest i n a t i o n n e t w o r k s . W h e n t h e h o s t or r o u t e r receives t h i s r o u t i n g i n f o r m a t i o n it will r e b u i l d its d a t a b a s e by a d d i n g n e w r o u t e s a n d modifying existing r o u t e s . To modify a n existing route, t h e h o s t or r o u t e r will d e t e r m i n e if t h e n e w r o u t e h a s a b e t t e r p a t h to t h e destin a t i o n , w h i c h is a lower h o p c o u n t . RIP will also delete a r o u t e t h a t c o n t a i n s m o r e t h a n 15 h o p s to t h e d e s t i n a t i o n . R o u t e s will also be r e m o v e d from t h e r o u t e r ' s d a t a b a s e if no u p d a t e s are received within a c e r t a i n period of time. This is a d y n a m i c m e a n s of p u r g i n g r o u t e s in t h e d a t a b a s e t h a t h a v e n o t b e e n u s e d recently. As we h a v e

Routing Issues

9Chapter 6

a l r e a d y d i s c u s s e d , r o u t e s are u s u a l l y b r o a d c a s t every 30 s e c o n d s , a n d r o u t e s are deleted from the r o u t e d a t a b a s e if t h e y are n o t u p d a t e d w i t h i n 180 s e c o n d s . To u n d e r s t a n d t h e cost of r o u t e s , e x a m i n e F i g u r e 6.6.

Figure 6.6 An illustration of hop count with RIR

h.

L.

~-

Network A is c o n n e c t e d to Network D t h r o u g h Network B a n d Network C. Once Network E is u p a n d r u n n i n g , p a c k e t s from Network A d e s t i n e d for Network D c a n n o w be s e n t t h r o u g h Network E, at a h o p c o u n t of 1. This hop c o u n t is less, a n d will therefore be the r o u t e of choice w h e n Network A n e e d s to c o m m u n i c a t e with Network D. If Network E were to go down, Network A w o u l d have to k n o w a b o u t it. Since RIP r e q u i r e s a r o u t e r to s e n d u p d a t e s every 30 s e c o n d s , a b r o k e n link will be l e a r n e d quickly by t h e r e s t of t h e r o u t e r s on t h e network. R e m e m b e r , if RIP does n o t receive a n u p d a t e from a n o t h e r r o u t e r in 180 s e c o n d s , t h a t r o u t e is r e m o v e d from t h e r o u t i n g d a t a b a s e b e c a u s e t h e r o u t e r believes this r o u t e is no longer available.

249

250


RIP r o u t i n g u p d a t e s are very d y n a m i c , a n d c h a n g e s to the netw o r k c a n be u p d a t e d very quickly a n d accurately. For example, a c h a n g e in n e t w o r k topology c a n easily be reflected in the u p d a t e d RIP r o u t i n g u p d a t e s . T h e s e will u p d a t e the c u r r e n t entries in a r o u t e r ' s r o u t i n g table (if t h e y are present). If the r o u t e s are n o t in t h e r o u t i n g d a t a b a s e , t h e y will be added. If a r o u t e r detects a failure for a n o t h e r r o u t e r on the network, the r o u t e r c a n recalculate its r o u t e s a n d s e n d the u p d a t e d i n f o r m a t i o n to o t h e r n e i g h b o r i n g r o u t e r s , informing t h e m of the n e w route. E a c h r o u t e r t h a t receives this r o u t e u p d a t e c a n n o w u p d a t e its own d a t a b a s e a n d p r o p a g a t e the c h a n g e s to the r e m a i n i n g r o u t e r s on the network.

RIP-2 Requirements RIP version 2 w a s developed to address some of the limitations with the original version of RIP. The purpose of RIP-2 is to increase the a m o u n t of information in the packet itself, a n d to increase security, which w a s lacking in RIP version 1. Since RIP is still in widespread use, it w a s decided to increase the capabilities of RIP so organizations would not have to implement a b r a n d new routing protocol. RIP is also easier to implement compared to the rest of the interior gateway protocols. The following is a list of f e a t u r e s with the n e w RIP-2 protocol: Optional authentication. password authentication.

Most i m p l e m e n t a t i o n s u s e a simple

R o u t i n g D o m a i n field. E n a b l e s y o u to ignore logical d o m a i n s on the s a m e physical network. The default r o u t i n g d o m a i n is a s s i g n e d the value 0.

Route Tag field. Exists to s u p p o r t Exterior G a t e w a y Protocols (EGP). This field will c a r r y a u t o n o m o u s s y s t e m n u m b e r s for EGP a n d B o r d e r G a t e w a y Protocol (BGP). The I n t e r n e t is divided into d o m a i n s , or a u t o n o m o u s s y s t e m s . Interior G a t e w a y Protocols (IGPs) are the protocols u s e d w i t h i n a d o m a i n for the e x c h a n g e of r o u t i n g information. Basically, this r o u t e tag will s e p a r a t e i n t e r n a l RIP r o u t e s from e x t e r n a l ones.

Routing Issues

9Chapter 6

Subnet Mask field. C o n t a i n s a s u b n e t m a s k t h a t is applied to the IP a d d r e s s to d e t e r m i n e the h o s t n e t w o r k on w h i c h the d e s t i n a t i o n is located. N e x t Hop. F o r w a r d s p a c k e t s to the i m m e d i a t e n e x t hop. This is u s e f u l in n e t w o r k s w h e r e the r o u t e r s c a n be u s i n g r o u t i n g protocols o t h e r t h a n RIP.

Multicasting. S e n d s b r o a d c a s t p a c k e t s o u t on the network. The RIP-2 m u l t i c a s t a d d r e s s is 224.0.0.9. The m o s t i m p o r t a n t a s p e c t of RIP-2 is t h a t it is completely b a c k w a r d s - c o m p a t i b l e w i t h RIP-1, a n d c a n also r u n in RIP-1 e m u l a t i o n m o d e or RIP-1 c o m p a t i b l e mode, in addition to full RIP-2 mode. RIP-2 also k e e p s the f e a t u r e s t h a t m a d e RIP-1 so popular, s u c h as its s m a l l size, e a s y i m p l e m e n t a t i o n , a n d the ability to r u n on e m b e d d e d s y s t e m s t h a t c a n n o t afford the m e m o r y s p a c e c o n s u m e d by m o r e efficient r o u t i n g protocols. RIP h a s also b e e n redefined to s u p p o r t IPv6, w h i c h is very similar to RIP-2. Basically all t h a t h a s c h a n g e d is the h e a d e r i n f o r m a t i o n c o n t a i n e d w i t h i n the RIP packet. This m a k e s RIP easier to i m p l e m e n t in IPv6 networks; however, RIP is still n o t the m o s t ideal choice for m o d e r n n e t w o r k s . Newer r o u t i n g protocols s u c h as OSPF a n d IS-IS are h o p i n g to m a k e RIP obsolete, b u t RIP still is i m p l e m e n t e d in m o r e n e t w o r k s t h a n OSPF a n d IS-IS combined; therefore, the p u s h by s o m e to m a k e RIP-2 s u c c e s s f u l is very s t r o n g in the n e t w o r k i n g c o m m u n i t y .

251

252

Chapter 6 *

Routing Issues

OSPF w a s specifically designed for the Internet, w h i c h u s e s the IP protocol, a n d is designed with the following features: 9 A u t h e n t i c a t i o n of r o u t i n g u p d a t e s 9

TOS-based routing

9 Tagging of externaUy-derived r o u t e s 9 F a s t r e s p o n s e to topology c h a n g e s with low overhead 9 Load s h a r i n g over m e s h e d links. OSPF will a t t e m p t to o p e n the s h o r t e s t p a t h to a d e s t i n a t i o n first. This l i n k - s t a t e technology is called S h o r t e s t P a t h First (SPF), in w h i c h e a c h r o u t e r c o n t a i n s a n identical d a t a b a s e . Inside this r o u t ing d a t a b a s e is a description of a p a r t i c u l a r r o u t e r a n d its c u r r e n t state, w h i c h also i n c l u d e s the state of interfaces t h a t this r o u t e r is connecting. This is m u c h different from RIP r o u t e r s , w h i c h c a n e a c h have differing entries in their r o u t i n g d a t a b a s e s . S P F - b a s e d r o u t e r s c o n t a i n t h e d a t a b a s e for the A u t o n o m o u s S y s t e m (AS) topology. As y o u l e a r n e d earlier, the I n t e r n e t is divided into d o m a i n s , or a u t o n o m o u s systems.

A n o t h e r feature of OSPF t h a t is n o t available with RIP-i is the ability to s u p p o r t s u b n e t m a s k i n g . E a c h r o u t e t h a t is d i s t r i b u t e d b y OSPF h a s a d e s t i n a t i o n a d d r e s s a n d a s u b n e t m a s k . W h e n p a c k e t s are being routed, the r o u t e s with the longest m a t c h are given a h i g h e r priority t h a n r o u t e s with a s h o r t e r s u b n e t m a s k .

Routing Issues

9Chapter 6

O S P F is also c a p a b l e of s u p p o r t i n g four t y p e s of p h y s i c a l networks: p o i n t - t o - p o i n t , b r o a d c a s t , n o n b r o a d c a s t , a n d p o i n t - t o - m u l t i point.

P o i n t - t o - p o i n t networks. C o n s i s t of two r o u t e r s in w h i c h t h e p o i n t - t o - p o i n t i n t e r f a c e s c a n be set u p a s n u m b e r e d or u n n u m b e r e d i n t e r f a c e s . A n e t w o r k of s y n c h r o n o u s lines is a n e x a m p l e of a p o i n t - t o - p o i n t n e t w o r k .

Broadcast networks. For n e t w o r k s w i t h p o t e n t i a l l y m o r e t h a n two r o u t e r s , b u t t h e O S P F h a s t h e ability to s e n d t h e s a m e b r o a d c a s t to all of t h e r o u t e r s . An E t h e r n e t n e t w o r k is a n e x a m p l e of a b r o a d c a s t - b a s e d n e t w o r k .

Nonbroadcast networks. N e t w o r k s also w i t h p o t e n t i a l l y m o r e t h a n two r o u t e r s ; however, O S P F does n o t h a v e t h e ability to s e n d a b r o a d c a s t to all of t h e r o u t e r s . An e x a m p l e of t h i s type of n e t w o r k is X.25 or ATM.

P o i n t - t o - m u l t i p o i n t networks. R e s e m b l e a bicycle wheel, w i t h t h e m a i n r o u t e r a s t h e h u b a n d t h e o t h e r r o u t e r s b r a n c h i n g off in s p o k e s from t h e c e n t r a l h u b . This a p p e a r s very s i m i l a r in t h e o r y to t h e E t h e r n e t s t a r topology. O n e c o n c e p t of O S P F t h a t is very different from RIP is t h a t netw o r k s c a n be split into m a n y a r e a s . T h e s e a r e a s a r e d e s c r i b e d a s entirely w i t h i n a n a r e a ( i n t r a - a r e a routing) or in a n o t h e r a r e a (intera r e a routing). To r e m e m b e r t h e differences, t h i n k of t h e i n t e r - a r e a a s t h e I n t e r n e t a s o p p o s e d to a n i n t e r n a l i n t r a n e t for a n o r g a n i z a tion. W h e n O S P F n e e d s to link t o g e t h e r a r e a s , t h e y u s e t h e c o n c e p t of a b a c k b o n e , w h i c h is s i m i l a r to t h e u s e of a b a c k b o n e in a n E t h e r n e t n e t w o r k . This b a c k b o n e is m a d e u p of r o u t e r s a n d netw o r k s t h a t link t o g e t h e r different a r e a s . This b a c k b o n e m u s t be c o n t i g u o u s , w h i c h is also s i m i l a r to t h e b a c k b o n e of a n E t h e r n e t b u s n e t w o r k . I n t e r f a c e s c a n e x t e n d from t h i s b a c k b o n e to o t h e r netw o r k s . This type of r o u t i n g is called e x t e r n a l r o u t i n g b e c a u s e t h e s o u r c e a n d d e s t i n a t i o n are l o c a t e d on different n e t w o r k s .

253

254


Since a n a r e a c a n be defined in s u c h a w a y t h a t t h e b a c k b o n e is n o t c o n t i g u o u s , t h e r e n e e d s to be a w a y to c o n t i n u e t h e b a c k b o n e connectivity. This is m a d e p o s s i b l e b y a virtual link. This v i r t u a l link is c o n f i g u r e d b e t w e e n a n y b a c k b o n e r o u t e r s t h a t s h a r e a link to t h i s n o n b a c k b o n e a r e a a n d f u n c t i o n a s if t h e y were direct links to t h e b a c k b o n e . A v i r t u a l link also e n a b l e s u s to p a t c h in t h e b a c k b o n e in c a s e d i s c o n t i n u i t y o c c u r s , s u c h a s w h e n a link is down. W h e n p a c k e t s n e e d to be s e n t from one a r e a to a n o t h e r , t h e y will be s e n t a l o n g t h i s b a c k b o n e . This m a k e s u s e of a n A r e a B o r d e r R o u t e r (ABR), a r o u t e r t h a t is c o n n e c t e d to t h e o r i g i n a t i n g a r e a a n d t h e n c o n n e c t e d to t h e b a c k b o n e area. The p a c k e t is t h e n s e n t a c r o s s t h e b a c k b o n e w h e r e it is received by a n o t h e r router, w h i c h is also a n o t h e r a r e a b o r d e r router. This r o u t e r t h e n s e n d s t h e p a c k e t on to its d e s t i n a t i o n . T h e r e are four t y p e s of r o u t e r s a s s o c i a t e d w i t h OSPF: I n t e r n a l routers, Area Border routers, Backbone routers, and A u t o n o m o u s S y s t e m (AS) b o u n d a r y r o u t e r s .

I n t e r n a l routers. R e s p o n s i b l e for r o u t i n g p a c k e t s w i t h i n a single area. T h e y flood t h e i n t e r n a l a r e a w i t h r o u t i n g i n f o r m a t i o n t h a t o c c u r s w i t h i n its specific area. This i n t e r n a l r o u t e r c a n also be a b a c k b o n e r o u t e r if it h a s no p h y s i c a l i n t e r f a c e s to a n o t h e r area.

Area Border routers. Are r e s p o n s i b l e for r o u t i n g p a c k e t s b e t w e e n m u l t i p l e a r e a s on w h i c h t h i s r o u t e r h a s i n t e r f a c e s .

B a c k b o n e routers. Have a p h y s i c a l i n t e r f a c e to t h e b a c k b o n e . T h e s e are often called b o r d e r r o u t e r s .

A u t o n o m o u s S y s t e m (AS) b o u n d a r y routers. E x c h a n g e i n f o r m a t i o n w i t h o t h e r a u t o n o m o u s s y s t e m s u s i n g EGP p r o t o c o l s like BGP. B a c k b o n e r o u t e r s , s o m e t i m e s referred to a s b o r d e r r o u t e r s , c a n t r e a t c e r t a i n a r e a s a s s t u b s . This m e a n s t h e b o r d e r r o u t e r s will n o t f o r w a r d a n y i n f o r m a t i o n a b o u t e x t e r n a l r o u t e s to t h e s e s t u b a r e a s . T h e s e b o r d e r r o u t e r s c a n also be c o n f i g u r e d n o t to forward a n y i n t e r n a l i n f o r m a t i o n a b o u t i n t e r n a l OSPF r o u t e s .

Routing Issues

9

Chapter 6

T h e s e f o u r t y p e s of r o u t e r s m a k e it p o s s i b l e for O S P F to divide a n a u t o n o m o u s s y s t e m into a r e a s .

Configuring OSPF To c o n f i g u r e O S P F on y o u r Cisco router, y o u n e e d to e n t e r t h e r o u t e r in config m o d e a n d e n t e r t h e following i n f o r m a t i o n . First, enable the OSPF process: router ospf <process-id>

T h e n y o u m u s t a s s i g n a r e a s to t h e i n t e r f a c e s : network <mask> <area-id>

T h e following is a n e x a m p l e of b o t h c o m p l e t e d steps: router ospf 5 network 203.11.87.156 255.255.255.0 i00

T h e n e t w o r k c o m m a n d in t h e s e c o n d s t e p is h o w we a s s i g n a r o u t e r to a n area. We m u s t specify t h e n e t w o r k or IP a d d r e s s to t h i s router, w h i c h i n c l u d e s t h e s u b n e t m a s k , in o r d e r to u s e T C P / I P to c o n n e c t to t h i s router. T h e area-id m u s t c o r r e s p o n d w i t h t h e a r e a in w h i c h t h i s r o u t e r will be placed. If y o u recall, a n a r e a is a n o t h e r n a m e for a n a u t o n o m o u s s y s t e m (AS). To u s e p a s s w o r d s w i t h O S P F r o u t e r s , w h i c h is one f e a t u r e we w e r e n o t able to t a k e a d v a n t a g e of w i t h RIPv I r o u t e r s , y o u m u s t also e n t e r t h e r o u t e r in config m o d e . T h e p a s s w o r d s s h o u l d be configured t h e s a m e for every O S P F r o u t e r in y o u r a r e a . To e n a b l e p a s s w o r d a u t h e n t i c a t i o n , e n t e r config m o d e on t h e r o u t e r a n d e n t e r t h e following i n f o r m a t i o n : IP ospf authentication-key

(this goes under the specific interface

portion) area <area-id> authentication portion)

(this goes under "router ospf <process-id>"

255

256

Chapter 6

9Routing Issues

The following is an example of both completed portions: interface Ethernetl IP address 197.13.55.110 255.255.255.0 IP ospf authentication-key february router ospf i00 network 45.113.22.188 255.0.0.0 area 200 area

200 authentication

From the preceding example you can see that our p a s s w o r d is february. Unfortunately, a n y o n e with a link analyzer can obtain this p a s s w o r d as it p a s s e s over the network. To i m p l e m e n t a more secure m e a n s of authentication, we can u s e OSPF M e s s a g e Digest Authentication. You m u s t configure the k e y (password) and a k e y - i d for each OSPF router that will participate in p a s s w o r d authentication. A link analyzer c a n n o t obtain the p a s s w o r d b e c a u s e the p a s s w o r d (key) is not p a s s e d over the network. To enable Message Digest Authentication, enter config m o d e on the router and enter the following information: IP ospf message-digest-key md5

(this goes under the specific

interface portion) area

<area-id> authentication message-digest

(this goes under "router ospf

<process-id>" portion)

The following is an example of both completed portions: interface Ethernetl IP address 197.13.55.110 255.255.255.0 IP ospf message-digest-key i0 md5 february router ospf i00 network 45.113.22.188 255.0.0.0 area 200 area

200 authentication m e s s a g e - d i g e s t

From the preceding example you can see that our p a s s w o r d is still february. Our m e s s a g e - d i g e s t - k e y is 10 and our area is still 200.

Routing Issues

9Chapter 6

We h a v e l e a r n e d a b o u t t h e b a c k b o n e , w h i c h is a c o n t i g u o u s a r e a of p h y s i c a l l i n k s . T h i s b a c k b o n e is c a l l e d " a r e a 0" a n d h a s to b e t h e c e n t e r of all o t h e r a r e a s . We c a n u s e a v i r t u a l l i n k to p r o v i d e a logical c o n n e c t i o n to t h e b a c k b o n e f r o m a n a r e a t h a t is d i s c o n n e c t e d , a s i l l u s t r a t e d in F i g u r e 6.7.

Figure 6.7 Creating a virtual link between two noncontiguous sites.

In F i g u r e 6.7, A r e a 1 d o e s n o t h a v e a p h y s i c a l , c o n t i g u o u s c o n n e c t i o n to A r e a 3. A v i r t u a l l i n k h a s b e e n c r e a t e d b e t w e e n R o u t e r l a n d R o u t e r 2 . A r e a 2 is n o w a t r a n s i t a r e a a n d R o u t e r 2 is n o w t h e e n t r y p o i n t i n t o A r e a 3. In o r d e r for t h i s v i r t u a l l i n k to w o r k , w e n e e d to e n t e r t h e O S P F r o u t e r in config m o d e a n d e n t e r s o m e i n f o r m a t i o n c o n c e r n i n g t h e link: area < a r e a - i d >

virtual-link

T h e following is a n e x a m p l e of t h e c o m p l e t e d p o r t i o n s o n b o t h routers:

257

258

Chapter 6

9Routing

Router

i#

router

ospf

area

2#

router

ospf

area

i00

2 virtual-link

Router

Issues

2.2.2.2

i00

2 virtual-link

i.i.i.i

The area-id in the p r e c e d i n g example is the t r a n s i t area, w h i c h we d e t e r m i n e d w a s Area 2. The RID is the r o u t e r ID, in w h i c h we e n t e r e d t h e IP a d d r e s s of the router.

Routing Update Impact The RIP protocol is m o r e s u i t e d to s m a l l e r n e t w o r k s b e c a u s e of the large a m o u n t of b r o a d c a s t s u s e d to u p d a t e r o u t e r s a b o u t p a t h s to r e m o t e n e t w o r k s . The OSPF protocol is well-suited to larger, d y n a m ic, m o r e c o m p l i c a t e d n e t w o r k s . RIP u p d a t e s o c c u r every 30 seconds, w h e r e a s OSPF u p d a t e s o c c u r every 30 m i n u t e s . RIP r o u t e r s s e n d the entire r o u t i n g table to n e i g h b o r i n g r o u t e r s , w h e r e a s OSPF s e n d s very small u p d a t e files to r o u t e r s w h e n e v e r t h e y detect a c h a n g e in the network, s u c h as a failed link or n e w link. W h e n r o u t e r s e x c h a n g e information, it is called convergence, w h e r e the r o u t e r s "converge" on the n e w r e p r e s e n t a t i o n of the n e t w o r k very quickly. A n e t w o r k of OSPF a n d RIP r o u t e r s c a n possibly coexist. OSPF is slowly replacing RIP as the interior g a t e w a y r o u t i n g protocol of choice. T h e s e OSPF r o u t e r s c a n s i m u l t a n e o u s l y RIP for r o u t e r - t o e n d s t a t i o n c o m m u n i c a t i o n s , a n d OSPF for r o u t e r - t o - r o u t e r c o m m u nications. For example, you c a n configure a Windows NT c o m p u t e r to p a r t i c i p a t e as a RIP r o u t e r in a RIP-routing e n v i r o n m e n t , b u t y o u c a n n o t configure this s a m e Windows NT c o m p u t e r to p a r t i c i p a t e as a n OSPF r o u t e r in a n O S P F - r o u t i n g e n v i r o n m e n t . This coexistance b e t w e e n RIP a n d OSPF m a k e s g r a d u a l m i g r a t i o n s from RIP to OSPF feasible. In fact, RIP a n d OSPF r o u t e r s c a n n o t only coexist in the s a m e network, t h e y c a n a c t u a l l y s h a r e r o u t i n g information. Figure 6.8 s h o w s the e n a b l i n g of RIP r o u t i n g on Windows NT.

Routing Issues

9Chapter 6

F i g u r e 6.8 Configuring a Windows NT computer as a RIP router.

To configure y o u r Windows NT c o m p u t e r to participate in s h aring routing u p d a t e s with other c o m p u t e r s on the network, you need to enable IP forwarding. This is done in the Network applet of the Control Panel, by selecting the TCP/IP protocol a n d viewing the properties. The Routing tab is illustrated in Figure 6.8. You also need to enable RIP in the Services applet in the Control Panel. In OSPF, a neighbor is a n o t h e r r o u t e r r u n n i n g OSPF t h a t h a s a n interface on the s a m e network. W he n discovering a n d configuring OSPF neighbors, the r o u t e r will u s e the Hello protocol to discover their neighbors a n d m a i n t a i n this relationship. On two of the types of OSPF networks, point-to-point a n d b ro ad cast, the Hello protocol will dynamically discover the neighbors. On a n o n b r o a d c a s t network, you will have to configure the neighbors manually, b e c a u s e OSPF will not have a m e a n s of contacting a n d establishing relationships with its neighbors. This Hello protocol e n s u r e s t h a t the relationships between the r o u t e r s are bidirectional. This will g u a r a n t e e t h a t every OSPF r o u t e r

259

260

Chapter 6

9Routing Issues

will s e n d as well as receive u p d a t e d r o u t e i n f o r m a t i o n to a n d from e a c h of its neighbors. The c o m m u n i c a t i o n is bidirectional w h e n the r o u t e r sees itself in the Hello p a c k e t from a n o t h e r router. I n c l u d e d in t h e Hello protocol p a c k e t is the following: 9 The r o u t e r ' s priority 9 The r o u t e r ' s Hello t i m e r a n d Dead t i m e r value 9 A list of r o u t e r s t h a t h a s s e n t the r o u t e r Hello p a c k e t s on this interface 9 This r o u t e r ' s choice of d e s i g n a t e d r o u t e r a n d b a c k u p d e s i g n a t e d router. However, this does n o t m e a n OSPF is a perfect r o u t i n g protocol as far as r o u t i n g u p d a t e s are c o n c e r n e d . In really large n e t w o r k configurations, OSPF c a n p r o d u c e a large n u m b e r of r o u t e r u p d a t e s t h a t flow b e t w e e n r o u t e r s . If a n e t w o r k c o n s i s t s of h u n d r e d s of r o u t e r s in a n e t w o r k topology t h a t is designed to be fault tolerant, the n u m b e r of l i n k - s t a t e m e s s a g e s t h a t t r a v e r s e the n e t w o r k c a n be in the t h o u s a n d s . T h e s e t h o u s a n d s of l i n k - s t a t e m e s s a g e s c a n be p r o p a g a t e d from r o u t e r to r o u t e r a c r o s s the network, c o n s u m i n g v a l u a b l e b a n d w i d t h , especially on slower WAN links. The r o u t e r s t h e n have to recalculate their r o u t i n g tables, w h i c h c a n c o n s u m e v a l u a b l e RAM a n d CPU cycles if t h e s e r o u t i n g tables are a signific a n t size. F o r t u n a t e l y for OSPF, no r o u t i n g protocol available t o d a y is c a p a b l e of minimizing r o u t i n g u p d a t e s in a very large n e t w o r k with m a n y r o u t e r s . OSPF is, however, m u c h m o r e c a p a b l e t h a n RIP at minimizing t h e s e b a n d w i d t h intensive r o u t i n g u p d a t e s . By the way, b y "link-state" we m e a n the state, or condition of a link t h a t is a d e s c r i p t i o n of the r o u t e r ' s r e l a t i o n s h i p to its n e i g h b o r i n g r o u t e r s . We t h i n k of the link as being a n interface on the router. An interface, for example, w o u l d be the IP a d d r e s s of the p h y s i c a l interface, the s u b n e t m a s k , the type of n e t w o r k to w h i c h it is connected, or the r o u t e r s c o n n e c t e d to the network. The collection of all t h e s e link-states would comprise a link-state database. The link-state algorithm states (in m u c h more complex t e r m s t h a n described here) a few steps of building a n d calculating these paths:

Routing Issues

9Chapter 6

9

U p o n initialization or u p o n a c h a n g e in r o u t i n g i n f o r m a t i o n , a r o u t e r will g e n e r a t e a l i n k - s t a t e a d v e r t i s e m e n t t h a t will r e p r e s e n t t h e collection of all t h e l i n k - s t a t e s c u r r e n t l y on t h e router.

9

In a n e v e n t called flooding, all r o u t e r s will e x c h a n g e t h i s l i n k - s t a t e i n f o r m a t i o n . T h i s flood of r o u t i n g i n f o r m a t i o n will be p r o p a g a t e d to all r o u t e r s in t h e area.

9 After e a c h r o u t e r h a s f i n i s h e d c o m p i l i n g t h e l i n k - s t a t e i n f o r m a t i o n , t h e y will b e g i n to c a l c u l a t e a S h o r t e s t P a t h T r e e to all d e s t i n a t i o n s . T h i s is very C P U - i n t e n s i v e , a s t h e r e c a n be h u n d r e d s of p a t h s t h a t n e e d to be p r o c e s s e d . T h e s e p a t h s will i n c l u d e t h e a s s o c i a t e d c o s t a n d n e x t h o p i n f o r m a t i o n to r e a c h t h o s e d e s t i n a t i o n s . If t h e r e a r e no c h a n g e s in t h e n e t w o r k topology, O S P F will n o t be very active. O S P F will n o t n e e d to e x c h a n g e l i n k - s t a t e i n f o r m a t i o n , a n d t h e r o u t e r s will t h e r e f o r e n o t n e e d to c a l c u l a t e S h o r t e s t P a t h Trees, b e c a u s e t h e y will a l r e a d y have the information processed. T h e r e a r e also different t y p e s of l i n k - s t a t e p a c k e t s , a s follows"

Router l i n k s . D e s c r i b e t h e s t a t e a n d c o s t of t h e r o u t e r ' s l i n k s to t h e area. T h e s e r o u t e r l i n k s a r e t h e i n d i c a t i o n of t h e i n t e r f a c e s on a r o u t e r b e l o n g i n g to a c e r t a i n area.

Network l i n k s . D e s c r i b e all r o u t e r s t h a t a r e a t t a c h e d to a specific s e g m e n t . T h e s e are g e n e r a t e d b y t h e D e s i g n a t e d R o u t e r (DR).

S u m m a r y l i n k s . D e s c r i b e n e t w o r k s in t h e a u t o n o m o u s s y s t e m (AS), b u t o u t s i d e of a n area. T h e s e s u m m a r y l i n k s also d e s c r i b e t h e l o c a t i o n of t h e ABSR. T h e y a r e also g e n e r a t e d b y t h e ABRs.

External l i n k s . D e s c r i b e d e s t i n a t i o n s t h a t a r e e x t e r n a l to t h e AS, or a d e f a u l t r o u t e from o u t s i d e t h e AS. T h e A S B R is r e s p o n s i b l e for i n j e c t i n g t h e e x t e r n a l link i n f o r m a t i o n into t h e autonomous system. A n o t h e r f e a t u r e of O S P F is t h a t r o u t i n g u p d a t e s a r e n o t p a s s e d a c r o s s a r e a s . R e m e m b e r t h a t a r e a s a r e s e p a r a t e d b y t h e t y p e s of

261

262

Chapter 6 *

Routing Issues

r o u t e r s t h a t we listed before, s u c h as a r e a b o r d e r r o u t e r s . If a netw o r k link were to fail, only t h e r o u t e r s inside t h a t a r e a w o u l d e x c h a n g e r o u t i n g u p d a t e information. Area b o r d e r r o u t e r s filter t h e r o u t i n g u p d a t e s from s e p a r a t e a r e a s a n d t h e b a c k b o n e . Area b o r d e r r o u t e r s c a n c o m m u n i c a t e with e a c h o t h e r a n d e x c h a n g e r o u t i n g u p d a t e information, b u t t h e y u s e special l i n k - s t a t e m e s s a g e s t h a t are a brief s u m m a r i z a t i o n of the LAN or WAN topology for t h e i r areas. Figure 6.9 i l l u s t r a t e s t h e u s e of dividing a r e a s t h a t r e p r e s e n t p h y s i c a l regions with a r e a b o r d e r r o u t e r s a t t a c h e d to the b a c k b o n e .

Figure 6.9 Dividing physical regions into areas separated by area

border routers.

Routing Issues

9Chapter 6

E a c h city does n o t w a n t to receive t h e r o u t i n g u p d a t e s from t h e o t h e r cities; therefore, t h e s e a r e a s are s e p a r a t e d by a r e a b o r d e r r o u t e r s , w h i c h c a n a n d do e x c h a n g e i n f o r m a t i o n b e t w e e n e a c h other, b u t in a s m a l l e r l i n k - s t a t e u p d a t e . You c a n also f i n e - t u n e OSPF r o u t e r s to m i n i m i z e t h e a m o u n t of u p d a t e s t h a t are u n l e a s h e d on the network, a n d therefore m i n i m i z e the r e d u c t i o n in n e t w o r k b a n d w i d t h . You c a n also f i n e - t u n e t h e r a t e of convergence, w h i c h is t h e time b e t w e e n t h e r o u t e r s receiving t h e n e w r o u t i n g i n f o r m a t i o n a n d the time t h e n e t w o r k r o u t e r s have m a d e the n e c e s s a r y a d j u s t m e n t s in t h e i r r o u t i n g tables. Table 6.4 i l l u s t r a t e s a n e x a m p l e of t h e OSPF d a t a b a s e . This outp u t is from the following c o m m a n d : show IP ospf database

OSPF R o u t e r with ID (211.231.15.67) (Process ID 10)

Table 6.4 The Complete OSPF Database Taken from an Area Border Router (ABR)

Link ID

Router Link States (Area 1 ) ADV Router

Link Count

211.231.15.67

211.231.15.67

2

211.231.16.130

211.231.16.130

2

Summary Net Link States (Area 1) Link ID

ADV Router

211.231.13.41

211.231.15.67

211.231.15.64

211.231.15.67

211.231.15.192

211.231.15.67 Router Link States (Area 0)

Link ID

ADV Router

Link Count

211.231.13.41

211.231.13.41

3

211.231.15.67

211.231.15.67

1 Continued

263

264

Chapter

6

Routing Issues

9

Net Link States (Area 0) Link ID

ADV Router

211.231.15.68

211.231.13.41 Summary Net Link States (Area 0)

Link ID

ADV Router

211.231.15.0

211.231.15.67 Summary ASB Link States (Area 0)

Link ID

ADV Router

211.231.16.130

211.231.15.67 AS External Link States

Link ID

ADV Router

Tag

0.0.0.0

211.231.16.130

10

211.231.16.128

211.231.16.130

0

We c a n begin analyzing the r e s u l t s , first s t a r t i n g with the R o u t e r Link S t a t e s section of Area 1, s h o w n in Table 6.5.

Table 6.5 The Router Link States Section of Area 1 in the OSPF Database Link ID

ADV Router

Link Count

211.231.15.67

211.231.15.67

2

211.231.16.130

211.231.16.130

2

The two entries r e p r e s e n t two r o u t e r s in this area. Both r o u t e r s have two links to Area 1, as r e p r e s e n t e d by the Link C o u n t c o l u m n . We c o n t i n u e , skipping p a s t the S u m m a r y Net Link S t a t e s section, a n d on to the n e x t R o u t e r Link S t a t e s section, w h i c h is for Area 0, s h o w n in Table 6.6.

Routing Issues

9Chapter 6

Table 6.6 he Router Link States Section of Area 0 in the OSPF Database Link ID

ADV Router

Age

Link Count

211.231.13.41 211.231.15.67

211.231.13.41 211.231.15.67

179 675

3 1

O n c e again, t h e r e a r e two r o u t e r s in t h i s area. T h e first r o u t e r h a s t h r e e l i n k s to A r e a 0, a n d t h e s e c o n d r o u t e r h a s one link to A r e a 0. T h e S u m m a r y ASB Link S t a t e s of A r e a 1 a r e listed in T a b l e 6.7.

Table 6.7 The Summary ASB Link States of Area 1 in the OSPF Database Link ID

ADV Router

Age

211.231.16.130

211.231.15.67

468

T h i s gives y o u a n i n d i c a t i o n of w h o t h e A S B R for t h e a r e a is. T h e A S B R is a r o u t e r w i t h t h e a d d r e s s of 2 1 1 . 2 3 1 . 1 6 . 1 3 0 . T h e AS E x t e r n a l Link S t a t e s i n f o r m a t i o n c o n t a i n s i n f o r m a t i o n a b o u t d e s t i n a t i o n s o u t s i d e of o u r area, s h o w n in T a b l e 6.8.

Table 6.8 The AS External Link States in the OSPF Database Link ID

ADV Router

Age

Tag

0.0.0.0

211.231.16.130

1683

10

211.231.16.128

211.231.16.130

65

0

B o t h of t h e two e x t e r n a l l i n k s t h a t a r e listed h a v e b e e n i n j e c t e d into o u r a r e a f r o m t h e OSPF.

OSPF Implementation Recommendations Consider the following list of suggestions from Nortel Networks w h e n implementing OSPF on your network (see http://support.baynetworks.com).

265

266


[]

Keep t h e s a m e p a s s w o r d w i t h i n a n area, if possible.

9 Use t h e d e f a u l t timers. []

Use t h e a d d r e s s r a n g e if y o u r n e t w o r k is a s u b n e t t e d network.

9

Keep all s u b n e t s w i t h i n one area.

9 M a k e s u r e t h e AS B o r d e r R o u t e r p a r a m e t e r is e n a b l e d if t h e r o u t e r h a s a n y n o n - O S P F i n t e r f a c e s , a n d if y o u w a n t t h a t information propagated. []

Configure v i r t u a l l i n k s for e a c h a r e a b o r d e r r o u t e r t h a t d o e s n o t r e s i d e w i t h i n or directly i n t e r f a c e t h e b a c k b o n e . Every b o r d e r r o u t e r m u s t h a v e a c o n f i g u r e d p a t h to t h e b a c k b o n e .

9

If y o u h a v e a p r e f e r r e d p a t h to a d e s t i n a t i o n , edit t h e Metric C o s t p a r a m e t e r of y o u r interface. O S P F will t h e n c h o o s e t h e p a t h w i t h t h e lowest cost.

9

Configure y o u r r o u t e r s t h a t are r u n n i n g OSPF w i t h t h e s a m e t i m e r v a l u e s t h a t coincide w i t h t h e t i m e r s in y o u r o t h e r devices.

9

If t h e r e is a topology c h a n g e , s u c h a s a c h a n g e to a n a r e a or moving routers, you m u s t reconfigure the appropriate OSPF e l e m e n t s , s u c h a s t h e i n t e r f a c e s , v i r t u a l links, a n d so on.

Continued

Routing Issues

9C h a p t e r 6

BGP Requirements Border Gateway Protocol (BGP) is the de-facto s t a n d a r d for routing between A u t o n o m o u s Systems on the Internet. BGP was developed to a d d r e s s the limitations with Exterior Gateway Protocol (EGP), which was not the strongest routing protocol, although it was widely

267

268

9Routing

Chapter 6

Issues

u s e d . BGP c a n be t h o u g h t of a s t h e n e x t g e n e r a t i o n of EGP. All c o m m u n i c a t i o n s b e t w e e n I n t e r n e t Service P r o v i d e r s (ISP) is h a n d l e d via BGP-4, w h i c h is required for CIDR. B G P - 4 differs f r o m B G P - 3 j u s t a s RIP-2 differs f r o m RIP-1. B G P - 4 is also k n o w n a s B G P 4 w i t h out the hyphen. BGP allows t h e u s e of a n n o u n c e m e n t s of c l a s s l e s s r o u t e s , r o u t e s t h a t a r e n o t strictly on c l a s s A, c l a s s B, or c l a s s C n e t w o r k s . T h e s e c l a s s l e s s r o u t e s c a n be s u b n e t s or s u p e r n e t s . For m o r e i n f o r m a t i o n on s u p e r n e t s , refer to t h e s e c t i o n on CIDR. T h e p r i m a r y p u r p o s e of BGP is to a d v e r t i s e r o u t e s to o t h e r n e t w o r k s , w h i c h a r e called A u t o n o m o u s S y s t e m s (AS). BGP is also u s e ful for a d v e r t i s i n g r o u t e s to u p s t r e a m p r o v i d e r s a b o u t w h a t r o u t e s a r e available i n s i d e y o u r n e t w o r k . W h e n y o u are c o m m u n i c a t i n g w i t h a n o t h e r ISP over t h e I n t e r n e t , y o u are c o m m u n i c a t i n g w i t h t h e i r n e t w o r k , or a u t o n o m o u s s y s t e m , w h i c h is t h e m o r e a p p r o p r i ate w o r d i n g w h e n s p e a k i n g of r o u t i n g w i t h BGP. T h e b o r d e r r o u t e r s s e p a r a t e y o u r AS f r o m t h e i r AS. Every r o u t e r in y o u r AS s h o u l d k n o w t h e r o u t e to t h a t d e s t i n a t i o n AS. All AS r o u t e r s in y o u r a r e a s h o u l d c o n t a i n t h e s a m e r o u t i n g i n f o r m a t i o n , a n d y o u s h o u l d be a d v e r t i s i n g only r o u t e s t h a t y o u k n o w h o w to get to. T h e sin of BGP r o u t i n g is a d v e r t i s i n g r o u t e s t h a t y o u do n o t k n o w h o w to r e a c h . T h e r e a r e t h r e e t y p e s of c o n f i g u r a t i o n s in a n e t w o r k : Stub

a r e a s . Always e n d points. T h i s is u s u a l l y a single,

s t a t i c a l l y - r o u t e d c o n n e c t i o n f r o m a c e n t r a l site, s u c h a s a n ISP, to a r e m o t e location, s u c h a s a h o m e or office. BGP is n o t n e e d e d in s t u b a r e a c o n f i g u r a t i o n s . C e n t r a l sites w i t h a t l e a s t two staticallydefined or d y n a m i c a l l y - r o u t e d c o n n e c t i o n s to r e m o t e locations. D a t a will only flow to a n d f r o m t h e r e m o t e locations. BGP is also n o t n e e d e d in t h i s m u l t i h o m e d c o n f i g u r a t i o n .

Multihomed

areas.

C e n t r a l sites w i t h at l e a s t two c o n n e c t i o n s to r e m o t e locations. O n e c o n n e c t i o n is to a r e m o t e l o c a t i o n w i t h a n I n t e r n e t c o n n e c t i o n , a n d a n o t h e r c o n n e c t i o n is to a n a d d i t i o n a l I n t e r n e t c o n n e c t i o n . E a c h of t h e s e l o c a t i o n s is a n a u t o n o m o u s s y s t e m (AS). BGP is r e q u i r e d in t h i s c o n f i g u r a t i o n .

Transit

areas.

Routing Issues

9Chapter 6

BGP is n e e d e d in t h e c o n f i g u r a t i o n if t h e c u s t o m e r h a s multiple locations with multiple r o u t e r s , b u t he or s h e does n o t w a n t e a c h location's r o u t i n g tables to affect the others. Defining t h e s e a u t o n o m o u s s y s t e m s m a k e s its possible to u s e t h e s e t r u s t e d p a t h s b e t w e e n locations. This is the s t r a t e g y t h a t is u s e d on the I n t e r n e t to e n s u r e b e t t e r reliability a n d h i g h e r p e r f o r m a n c e . Figure 6.10 s h o u l d clearly illustrate the p u r p o s e of BGP singleh o m e d c o n n e c t i o n s to a n u p s t r e a m provider.

Figure 6.10 Routing BGP in single-homed connections.

You c a n see h o w the default r o u t e for the AS is r o u t e d t h r o u g h the default route. This default r o u t e m a k e s perfect s e n s e on a sing u l a r l y - h o m e d network, with only one c o n n e c t i o n to a n u p s t r e a m provider. F r o m the u p s t r e a m provider, it is also m u c h easier, b e c a u s e y o u r AS does n o t have a m u l t i h o m e d link to m o r e t h a n one u p s t r e a m provider. This u p s t r e a m provider c a n configure a static

269

270

Chapter 6

9Routing

Issues

route to y o u r AS. It would m a k e no sense to configure this connection be tw e e n the two ASs with a d y n amic routing protocol, b e c a u s e this link between the ASs will rarely change. If this IP a d d r e s s to y o u r AS were to change, you would simply have the u p s t r e a m provider change the static routing a d d r e s s to y o u r AS. You have be e n he a r i ng a b o u t the a u t o n o m o u s s y s t e m - - n o w , we need to describe the a u t o n o m o u s s y s t e m n u m b e r , w h ich is u s e d to r e p r e s e n t the a u t o n o m o u s s y s t e m to the Internet. Most n e t w o r k s will have only one a u t o n o m o u s s y s t e m n u mb er. W h e n you are exchanging r out e s with a n o t h e r r o u t e r speaking BGP (called a peering session), it will s t a r t out like the following: router BGP 14290 neighbor

This c o m m u n i c a t i o n s t a r t s out by saying, "I would like to connect to ASN ( a u t o n o m o u s s y s t e m number) 14290 u s i n g BGP." The list of c o m m a n d s t h a t would initiate the routing table t r a n s f e r is omitted. If a node wishes to c onne c t with BGP peer node, the node will open a connection on TCP port 179, which is the default port. A significant a m o u n t of information is transferred, s u c h as the identification n u m b e r s , a u t h e n t i c a t i o n information, a n d protocol version n u m b e r s before the BGP u p d a t e of the routing tables can take place. The u p d a t e will not take place if the a u t h e n t i c a t i o n h a s not b e e n successful. If the u p d a t e is successful, the c h a n g e s will t h e n be p r o p a g a t e d to neighboring BGP routers. W h e n you c o m m u n i c a t e to other h o s t s a n d r o u t e r s u s in g BGP, you can m a k e semi-intelligent routing decisions, which include the b e s t p a t h to r e a c h a destination. This route contains more t h a n j u s t the first r out e r to route the p a c k e t to; it can include the complete route to the destination. You can also advertise y o u r ro u tes to neighboring routers, a n d have those r o u t e r s in t u r n advertise y o u r r o u t e s to their neighboring routers.

Routing Issues

9Chapter 6

BGP selects only one p a t h as the b e s t p a t h to a d e s t i n a t i o n . This p a t h is n o w p r o p a g a t e d to the n e i g h b o r i n g BGP r o u t e r s . Unlike s o m e r o u t i n g protocols, BGP does n o t n e e d a periodic r o u t i n g table refresh. The initial e x c h a n g e b e t w e e n two BGP r o u t e r s is the full r o u t i n g table, b u t from t h e n on, only t h e optimal p a t h s are advertised in u p d a t e m e s s a g e s to the n e i g h b o r i n g BGP r o u t e r s . This m a k e s long r u n n i n g s e s s i o n s b e t w e e n BGP r o u t e r s m o r e efficient t h a n s h o r t s e s s i o n s , b e c a u s e the a m o u n t of times the full r o u t i n g table is e x c h a n g e d on initial c o n t a c t is less. T h e r e are a c t u a l l y two types of BGP t h a t differ in t e r m s of advertising r o u t i n g information. The first is EBGP, basically referred to as BGP, w h i c h is w h a t we have b e e n d i s c u s s i n g t h u s far. This is u s e d to advertise r o u t e s to different a u t o n o m o u s s y s t e m s , w h e r e a s IBGP is u s e d to advertise r o u t e s within the s a m e a u t o n o m o u s s y s t e m .

Figure 6.11 Differentiating between interior and exterior routing with IBGP and EBGR

~

l

m

~

, fiN i l ~

Figure 6.1 1 d e m o n s t r a t e s the u s e of b o t h types of BGP protocols and the a u t o n o m o u s system. In the n e t w o r k e x a m p l e s h o w n in Figure 6.1 1, BGP first m a k e s s u r e t h a t n e t w o r k s w i t h i n the interior AS are r e a c h a b l e . Then,

271

272

Chapter 6 *

Routing Issues

b o r d e r r o u t e r s c a n e x c h a n g e r o u t i n g i n f o r m a t i o n with e a c h o t h e r r e g a r d i n g t h e s t a t u s of n e t w o r k s w i t h i n their a u t o n o m o u s s y s t e m s . EBGP is u s e d to c o m m u n i c a t e with b o r d e r r o u t e r s , a n d IBGP is u s e d w i t h i n t h e AS. J u s t like RIP, IBGP is a n interior r o u t i n g protocol t h a t c a n be u s e d for active r o u t i n g w i t h i n y o u r network. IBGP does n o t distribu t e r o u t e s as m u c h as EBGP. E a c h r o u t e r in a n IBGP c o n f i g u r a t i o n m u s t be configured to ~peer into every o t h e r r o u t e r to e x c h a n g e this i n f o r m a t i o n , w h e r e a s this is n o t n e e d e d with s t r a i g h t BGP. However, IBGP is m o r e flexible a n d provides a m o r e efficient m e a n s of controlling a n d e x c h a n g i n g t h e r o u t i n g i n f o r m a t i o n from w i t h i n a n AS.

IBGP and EBGP Requirements BGP requires a combination of hardware and software to support. The m o s t commonly u s e d implementaUons of BGP are with Cisco routers, Nortel routers, UNIX variants, BSD, a n d Linux. Nortel a n d Cisco routers are by far the m o s t c o m m o n types of routers currently supporUng BGP. We will n o w d i s c u s s t h e s t e p s r e q u i r e d to e n a b l e a n d configure BGP. First, we will a s s u m e t h a t we w a n t two r o u t e r s to c o m m u n i cate u s i n g BGP. T h e s e r o u t e r s will be called R o u t e r l a n d Router2. T h e s e r o u t e r s belong in two u n i q u e a u t o n o m o u s s y s t e m s , called AS 1 a n d AS 2, as i l l u s t r a t e d in Figure 6.12.

Figure 6.12 An example of routing between two separate autonomous systems.

134.201.56.12

134.201.56.13

Routing Issues

9

Chapter 6

We n o w n e e d to e n a b l e B G P o n t h e r o u t e r s o n e a t a time, s t a r t ing w i t h R o u t e r I: router bgp 1

a n d now the s a m e step on Router2: router bgp 2

T h e s e s t a t e m e n t s e n a b l e B G P o n t h e r o u t e r for t h e AS in w h i c h t h e y b e l o n g . We will n o w define t h e n e i g h b o r s t h a t w e w i s h to c o m m u n i c a t e w i t h via BGP. E s t a b l i s h i n g a c o n n e c t i o n b e t w e e n two n e i g h b o r s , or p e e r s , via B G P is m a d e p o s s i b l e b y t h e T C P protocol. T h e T C P c o n n e c t i o n is e s s e n t i a l for t h e B G P r o u t e r s to e s t a b l i s h a connection and exchange routing updates. The neighbor c o m m a n d is u s e d to e s t a b l i s h a T C P c o n n e c t i o n : router bgp 1 neighbor 134.201.56.13

remote-as 2

router bgp 2 neighbor 134.201.56.12

remote-as

1

T h e s e s t a t e m e n t s u s e t h e T C P / I P a d d r e s s of t h e d i r e c t l y c o n n e c t e d r o u t e r s for t h e E B G P c o n n e c t i o n . Note t h a t E B G P will b e u s e d b e c a u s e we are c o m m u n i c a t i n g with an external a u t o n o m o u s system. If we w e r e to m a k e t h e c o n f i g u r a t i o n m o r e difficult, w e c o u l d a d d a n o t h e r r o u t e r called R o u t e r 3 within o u r AS 1, a n d c r e a t e a n o t h e r AS called AS 3, a s i l l u s t r a t e d in F i g u r e 6 . 1 3 . We n e e d to m o d i f y t h e s t a t e m e n t s o n t h e r o u t e r s a s follows: Routerl# router bgp 1 neighbor 134.201.56.13

remote-as 2

neighbor 134.201.56.14

remote-as

3

273

274

Chapter 6

9

Routing Issues

Router2# router bgp 2 neighbor 134.201.56.12

remote-as

1

remote-as

1

Router4# router bgp 3 neighbor 134.201.56.12

In the p r e c e d i n g example, R o u t e r l, Router2, a n d R o u t e r 4 are r u n n i n g EBGP. Router1 a n d R o u t e r 3 are r u n n i n g IBGP. The difference b e t w e e n r u n n i n g IBGP a n d EBGP is t h a t the r e m o t e - a s n u m b e r is pointing to a n e x t e r n a l or i n t e r n a l AS. Notice also t h a t Router1 a n d R o u t e r 3 are n o t directly c o n n e c t e d , w h i c h is the case for r o u t e r i being directly c o n n e c t e d to R o u t e r 2 a n d Router4. This is a c c e p t a b l e b e c a u s e t h e r o u t e r is w i t h i n y o u r AS. As long as t h e r e is s o m e IGP r u n n i n g to c o n n e c t i n g the neighb o r i n g r o u t e r s w i t h i n the s a m e AS, this is acceptable.

Figure 6.13 Exampleof routing among three autonomous systems.

AS! ~/ Ig~llm Router3 128.201.33.117

~

L EBGP

Roulerl

AS2

\ Router2

134.201.56.13

134.201.56.12 Router4

~lg~lll

134.201.56.14 ('

A~.~

~'~ /

Routing Issues

9Chapter 6

Loopback Interfaces A n o t h e r f e a t u r e of IBGP is the u s e of l o o p b a c k interfaces, w h i c h eliminate a d e p e n d e n c y t h a t o c c u r s w h e n y o u u s e t h e IP a d d r e s s of a r o u t e r (the p h y s i c a l interface to the route). Figure 6.14 i l l u s t r a t e s the u s e of a l o o p b a c k interface specified on Router2. Figure

6.14 Specifying the Ioopback interface for reliable routing.

In Figure 6.14, R o u t e r l a n d R o u t e r 2 are b o t h r u n n i n g IBGP in AS 1. If R o u t e r l were to c o m m u n i c a t e with R o u t e r 2 by specifying the IP a d d r e s s of the E t h e r n e t interface 0, 1, 2, or 3 (as s h o w n in the figure as "E" for E t h e r n e t ~ E 0 , E 1, E2, a n d E3), a n d if the specified interface is n o t available, a TCP c o n n e c t i o n w a s n o t possible. T h e s e two r o u t e r s could n o t c o m m u n i c a t e . To p r e v e n t this from h a p p e n i n g , R o u t e r 1 w o u l d specify the l o o p b a c k interface t h a t is defined by Router2. W h e n this l o o p b a c k interface is u s e d , BGP does n o t have to rely on the p h y s i c a l interface availability w h e n m a k i n g TCP c o n n e c t i o n s . The following c o m m a n d s on b o t h of the r o u t e r s i l l u s t r a t e the u s e of specifying a l o o p b a c k interface:

275

276

Chapter 6

9Routing

Issues

Routerl# router bgp 1 neighbor 201.13.145.88 remote-as 1 Router2# loopback interface 0 IP address 201.13.145.88 255.255.255.0 router bgp 1 neighbor 180.121.33.67 remote-as 1 neighbor 180.121.33.67 update-source loopback 0

Router l will specify the a d d r e s s of the loopback interface (201.13.145.88) of Router2 in the neighbor remote-as configuration c o m m a n d . The use of this loopback interface requires t h a t Router2 also includes the neighbor update-source router configuration comm a n d in its own configuration. W h e n this neighbor update-source l o o p b a c k c o m m a n d is used, the source of the BGP TCP connections for this specified neighbor is the IP a d d r e s s of the loopback interface, a n d not the IP a d d r e s s of the physical interface.

Summary In this c h a p t e r we d i s c u s s e d the need for routing protocols a n d the m a n y types of routing protocols available. As networks vary in size a n d complexity, it is i m p o r t a n t to i m p l e m e n t the correct routing protocol to h a n d l e the network requirements. We learned t h a t smaller networks have different needs t h a n larger, more complex networks. With this in mind, a protocol designed for smaller networks c a n n o t a d d r e s s the needs of the larger network, a n d any a t t e m p t s to do so will impose restrictions a n d inhibit growth. This is evident with the Routing Information Protocol (RIP), which is a very p o p u l a r routing protocol t h a t works beautifully in smaller, less complex networks, b u t is incapable of performing on a complex network s u c h as the Internet.

Routing Issues * Chapter 6

We also d i s c u s s e d the t h r e a t of IP a d d r e s s e x h a u s t i o n on t h e I n t e r n e t a n d the c o n c e r n for large global r o u t i n g t a b l e s w i t h t h e influx of n e w n e t w o r k s on the I n t e r n e t . One of the protocols r e s p o n sible for a d d r e s s i n g t h e s e i s s u e s is C l a s s l e s s I n t e r d o m a i n R o u t i n g (CIDR). CIDR c a n also i m p l e m e n t s u p e r n e t t i n g to aggregate IP a d d r e s s e s into a large block t h a t global r o u t e r s c a n u s e i n s t e a d of a d v e r t i s i n g e a c h individual a d d r e s s . We also l e a r n e d t h a t i n t e r n a l n e t w o r k s have different r o u t i n g n e e d s w h e n m a i n t a i n i n g r o u t e r s inside a specific area. T h e s e r o u t e r s u s e a r o u t i n g protocol, s u c h as t h e d i s t a n c e - v e c t o r - b a s e d Interior G a t e w a y Routing Protocol (IGRP), to keep a n a c c u r a t e a s s e s s m e n t of the n e t w o r k topology. R o u t e r s u p d a t e t h e i r r o u t i n g t a b l e s with n e i g h b o r i n g r o u t e r s a n d a s s i g n costs to n e t w o r k links t h a t m a k e one r o u t e m o r e efficient t h a n another. E n h a n c e d Interior G a t e w a y Routing Protocol (EIGRP) h a s i m p r o v e d on IGRP in m a n y areas, s u c h as convergence, w h i c h i m p l e m e n t s a n e w a l g o r i t h m t h a t e n a b l e s all r o u t e r s involved in a topology c h a n g e to s y n c h r o n i z e t h e i r i n t e r n a l r o u t i n g t a b l e s at the s a m e time. Routing I n f o r m a t i o n Protocol (RIP) version 2 h a s also i m p r o v e d on its p r e d e c e s s o r , RIP. A l t h o u g h the first version of RIP w a s limited for large n e t w o r k use, RIP-2 h a s a d d r e s s e d s o m e of t h e s e i s s u e s , s u c h as the a d d i t i o n of a u t h e n t i c a t i o n , s u p p o r t for the s u b n e t m a s k , a n d m a i n t a i n i n g its small size a n d ease of i m p l e m e n t a t i o n . O p e n S h o r t e s t P a t h First (OSPF), like RIP, is a n o t h e r Interior G a t e w a y Protocol (IGP). We l e a r n e d t h a t OSPF is m u c h m o r e r o b u s t t h a n RIP, a l t h o u g h RIP still is very effective in s o m e i m p l e m e n t a tions. OSPF u s e s a l i n k - s t a t e technology a n d S h o r t e s t P a t h First a l g o r i t h m t h a t c a n d e t e r m i n e the m o s t efficient r o u t e m u c h b e t t e r t h a n RIP, b e c a u s e OSPF c a n also d e t e r m i n e the s p e e d of t h e link. OSPF also m a k e s u s e of a r e a s , w h i c h are u s e d to g r o u p h o s t s into logical g r o u p i n g s , m u c h like a d o m a i n . OSPF c a n r o u t e to s o m e of t h e s e a r e a s , b u t will r e q u i r e a n Exterior G a t e w a y Protocol (EGP) to c o m m u n i c a t e with o t h e r areas.

277

278

Chapter 6

9Routing Issues

Finally, in this c h a p t e r we l e a r n e d how i n f o r m a t i o n is r o u t e d o u t s i d e of a n a r e a by u s e of a protocol s u c h as Border G a t e w a y Protocol (BGP). This protocol p a s s e s i n f o r m a t i o n t h r o u g h the netw o r k b a c k b o n e to the a u t o n o m o u s s y s t e m s . C o m m u n i c a t i o n b e t w e e n I n t e r n e t Service Providers is done t h r o u g h BGP. B o r d e r G a t e w a y Protocol a d d r e s s e s the limitations of EGP, a n d is the r o u t ing protocol of choice w h e n it c o m e s to exterior routing.

Q: W h e n do I n o t n e e d to i m p l e m e n t BGP? A: W h e n y o u are s i n g u l a r l y - h o m e d , w h i c h m e a n s y o u only have one c o n n e c t i o n to the I n t e r n e t . You also do n o t n e e d BGP if y o u are n o t providing d o w n s t r e a m routing. Use a default r o u t e instead.

Q: W h e n do I have to r e n u m b e r if I a m u s i n g CIDR? A: If y o u move y o u r site from one ISP to a n o t h e r a n d y o u have b e e n u s i n g a n allocated set of a d d r e s s e s from y o u r original ISP's CIDR block, y o u will h a v e to r e t u r n t h o s e a d d r e s s e s to y o u r ISP.

Q: I a m d e t e r m i n i n g w h e t h e r to configure m y n e w n e t w o r k with RIP or OSPF. W h y s h o u l d I choose one over the other?

Routing Issues * Chapter 6

A: If y o u are i m p l e m e n t i n g a n e w network, y o u n e e d to e x a m i n e b o t h protocols to d e t e r m i n e the correct protocol for y o u r e n v i r o n m e n t . You s h o u l d u s e OSPF if y o u have a larger, c o m p l i c a t e d network. RIP w o r k s w o n d e r f u l l y for smaller, less complex n e t w o r k s a n d is still very c o m m o n in i n t e r n a l n e t w o r k s .

Q: W h y w o u l d I w a n t to i m p l e m e n t CIDR w i t h i n m y n e t w o r k ? A: B e c a u s e y o u c a n create s m a l l e r s u b n e t s t h a n are available with a s t a n d a r d class C a d d r e s s . You c a n create s u b n e t s w i t h 128, 64, or 32 h o s t s .

279


282

Chapter 7

9Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives

Introduction This section starts with a general overview of dynamic addressing, along with a short history of the development of dynamic addressing protocols.

Continued

Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives

9Chapter 7

The Role of Dynamic Address Assignment Over the l a s t two d e c a d e s we have w i t n e s s e d a t r e m e n d o u s growth in t h e size of n e t w o r k s . This growth h a s o c c u r r e d in the geographic s p r e a d of the network, as well as in the n u m b e r of n o d e s per network. J u s t w i t h i n the l a s t two decades, the c h a n g e from a h o s t b a s e d c o m p u t i n g model u s i n g t e r m i n a l s , to a c l i e n t / s e r v e r model with u s e r w o r k s t a t i o n s , h a s c a u s e d a n e x p o n e n t i a l growth in the average n u m b e r of n o d e s per network.

283

284

Chapter 7


T h e s e p h e n o m e n a have driven the n e e d for d i s t r i b u t e d m a n a g e m e n t tools, w h e r e t h o s e c h a r g e d with a d m i n i s t e r i n g the n e t w o r k c a n r e m o t e l y configure a n d m a n a g e n e t w o r k n o d e s from a central location. One of t h e s e tools is dynamic address assignment, a p r o c e s s of u s i n g a d a t a b a s e as a s o u r c e of IP a d d r e s s e s a n d related p a r a m e ters. The i n f o r m a t i o n in this d a t a b a s e is provided b y a server to clients n e e d i n g a d d r e s s configuration. T h e s e servers m a t c h a client with their a d d r e s s r e c o r d s in the d a t a b a s e a n d r e t u r n the i n f o r m a tion stored t h e r e to the client. The client t h e n sets its IP configuration u s i n g the p a r a m e t e r v a l u e s r e t u r n e d . D y n a m i c a d d r e s s a s s i g n m e n t provides several benefits to the a d m i n i s t r a t o r . It greatly r e d u c e s the time s p e n t in configuring clients, since the p r o c e s s o c c u r s a u t o m a t i c a l l y a c r o s s the n e t w o r k r a t h e r t h a n h a v i n g to visit e a c h w o r k s t a t i o n . Instead, a d m i n i s t r a t o r s s p e n d their time configuring the d a t a b a s e . It c a n also help p r e v e n t c o n f i g u r a t i o n p r o b l e m s s u c h as duplicate a d d r e s s a s s i g n m e n t s or i n p u t errors. It m a y even provide a m e c h a n i s m for recovering a n d r e u s i n g a s s i g n e d a d d r e s s e s t h a t are no longer being used. A key f e a t u r e of d y n a m i c a d d r e s s a s s i g n m e n t c o n c e r n s the protocols t h a t are u s e d b e t w e e n the r e q u e s t i n g client a n d the server w h o provides a d d r e s s information. T h e s e protocols define the p r o c e s s of o b t a i n i n g configuration information. They specify the form a t of the p a c k e t s u s e d to convey i n f o r m a t i o n b e t w e e n client a n d server, a n d m a y define the r a n g e of i n f o r m a t i o n t h a t c a n be distribu t e d to the client. The r e s t of this c h a p t e r will focus on t h e s e protocols.

A Br ief History It's ironic to note t h a t the original i m p e t u s for m u c h of the developm e n t of d y n a m i c a d d r e s s i n g protocols w a s n o t fueled directly b y the desire for r e m o t e IP a d d r e s s configuration. Rather, it w a s b a s e d on t h e n e e d to define a protocol t h a t could be u s e d to boot a diskless h o s t a c r o s s the network. The focus on diskless booting w a s a produ c t of the times, since d u r i n g the 1980s, w h e n the original BOOTP


9Chapter 7

RFC w a s released, t h e r e w a s a flirtation with the d i s k l e s s w o r k s t a tion a r c h i t e c t u r e n o t u n l i k e the c u r r e n t i n t e r e s t in t e r m i n a l servers a n d " n e t w o r k c o m p u t e r s . " Diskless w o r k s t a t i o n s u s e d centralized d i s k storage, w h i c h could r e d u c e the total costs of m a s s storage d u r i n g a n era w h e n t h e s e costs were very high. They also held the p r o m i s e of g r e a t e r control over the data, centralized b a c k u p a n d a d m i n i s t r a t i o n , a n d file sharing. The c e n t r a l challenge p o s e d by the diskless w o r k s t a t i o n w a s h o w to get it booted, w h e n it h a d no drives to boot from. The s o l u t i o n involved t h e u s e of the n e t w o r k interface card, with a p r o g r a m m a b l e ROM chip t h a t c o n t a i n e d e n o u g h code to figure o u t its IP a d d r e s s , locate a server to t r a n s f e r down a boot file, a n d t h e n execute the boot file to get the r e s t of its i n s t r u c t i o n s . To e n a b l e this PROM to c o m m u n i c a t e with the servers providing a d d r e s s e s a n d boot files, several m e t h o d s were devised. Early a t t e m p t s at doing this involved the u s e of RARP (Reverse A d d r e s s Resolution Protocol). RARP is a protocol t h a t a client c a n u s e to r e q u e s t a n a d d r e s s from a RARP server, u s i n g its MAC a d d r e s s as its identifier. U n f o r t u n a t e l y , RARP w a s d e s i g n e d to o p e r a t e directly on top of the d a t a - l i n k layer, a n d t h u s does n o t u s e n e t w o r k - l a y e r (IP) a d d r e s s e s . It's therefore n o t r o u t a b l e , a n d c a n ' t be u s e d in s u b n e t t e d e n v i r o n m e n t s . The BOOTP protocol w a s defined in RFC951, r e l e a s e d in S e p t e m b e r 1985. It d e s c r i b e d a protocol t h a t w o u l d u s e a UDP d a t a gram, on top of IP, to e x c h a n g e a d d r e s s a n d booting information. The BOOTP p a c k e t c o n t a i n e d fields for the a s s i g n e d a d d r e s s , a d d r e s s of the boot file server, a n d n a m e of the boot file, a n d also provided a "vendor e x t e n s i o n s or options" field, w h i c h could convey n u m e r o u s o t h e r p a r a m e t e r s . BOOTP also w a s designed specifically to be c a p a b l e of o p e r a t i n g a c r o s s a s u b n e t t e d network, u s i n g a

BOOTP Relay agent. The DHCP protocol, first defined in RFC 1541 in October 1993, w a s d e s i g n e d to be a r e f i n e m e n t a n d e x t e n s i o n of the BOOTP protocol. It u s e d the s a m e p a c k e t s t r u c t u r e as BOOTP, b u t m a d e extensive u s e of the v e n d o r field (now called the options field) to convey DHCP-specific information. E n h a n c e m e n t s provided by DHCP i n c l u d e d the ability to define r a n g e s of a d d r e s s e s to be given out,

285

286

Chapter 7

9 Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives

r a t h e r t h a n h a v i n g to provide i n d i v i d u a l e n t r i e s in a d a t a b a s e for e a c h client. It also p r o v i d e d t h e ability to l e a s e a n a d d r e s s for a finite t i m e period, a n d recover a d d r e s s e s t h a t w e r e no l o n g e r b e i n g used. S o m e of t h e m o r e r e c e n t d e v e l o p m e n t s in t h i s a r e a i n c l u d e t h e t y i n g t o g e t h e r of D H C P s e r v e r s a n d DNS servers, so t h a t d y n a m i c a d d r e s s a s s i g n m e n t s c a n be c o m m u n i c a t e d to t h e DNS server. T h e DNS s e r v e r t h e n u p d a t e s its h o s t - n a m e - t o - a d d r e s s - r e s o l u t i o n d a t a base with the proper addresses.

Address Management with These Tools T h e following s e c t i o n will e x p l a i n in detail b o t h t h e BOOTP a n d D H C P p r o c e s s e s , a n d will offer s o m e c o m p a r i s o n s b e t w e e n BOOTP a n d DHCP.

Continued


9Chapter 7

287

288

Chapter 7


The BOOTP P a c k e t T h e BOOTP p a c k e t (see F i g u r e 7.1) is a s p e c i a l - p u r p o s e UDP d a t a g r a m , w h i c h is c a r r i e d i n s i d e a s t a n d a r d IP d a t a g r a m , on a v a r i e t y of d a t a - l i n k f r a m e s . T h e s o u r c e IP a d d r e s s for t h i s p a c k e t will be t h e client's IP a d d r e s s if t h e client k n o w s it, or 0 . 0 . 0 . 0 if it d o e s n ' t . T h e d e s t i n a t i o n IP a d d r e s s will be set to t h e s e r v e r a d d r e s s if k n o w n , or will be t h e local b r o a d c a s t a d d r e s s , 2 5 5 . 2 5 5 . 2 5 5 . 2 5 5 , if t h e s e r v e r a d d r e s s is u n k n o w n . T h e UDP h e a d e r will c o n t a i n BOOTP-specific s o u r c e a n d d e s t i n a tion p o r t n u m b e r s . T h e s e n u m b e r s are 68 for t h e client, a n d 67 for t h e BOOTP server. T h e client s e n d s r e q u e s t s u s i n g 67 (BOOTP server) a s t h e d e s t i n a t i o n p o r t a n d t h e s e r v e r replies u s i n g 68 (BOOTP client) a s d e s t i n a t i o n port. F i g u r e 7.1

BOOTP packet structure.

T a b l e 7.1 r e p r e s e n t s t h e field definitions w i t h i n t h e d a t a field of t h e UDP d a t a g r a m t h a t m a k e u p t h e BOOTP p a c k e t s t r u c t u r e . T h e fields a r e o r d e r e d a c c o r d i n g to t h e i r p o s i t i o n in t h e table, r e a d i n g f r o m left to right, one r o w at a time.

Field Descriptions and Comments T h i s s e c t i o n e x p l a i n s e a c h one of t h e field n a m e s listed in T a b l e 7.1. It will e x p l a i n t h e p u r p o s e of t h e field, a s well a s t h e p o s s i b l e v a l u e s t h a t t h e field c a n c o n t a i n .


9Chapter 7

289

Table 7.1 Fields and Field Lengths for the BOOTP Packet 1st O c t e t

OP (1 byte)

2nd O c t e t

3rd O c t e t

4th Octet

HTYPE (1 byte) HLEN (1 byte)

|

HOPS (1 byte)

|

i

•

(4 bytes) |

SEeS (2 bytes)

FLAG (2 bytes) m

i

|

|

ClADDR (4 bytes)

YIADDR (4 bytes) SIADDR (4 bytes) GIADDR (4 bytes) CHADDR (16 bytes)

i

i |

Continues for 12 more bytes Continues for 60 more bytes Continues for 124 more bytes Continues for 60 more bytes

SNAME (64 bytes) FILE (128 bytes ) VEND (64 bytes) or OPTIONS (variable)

OP This field is set to one of two v a l u e s a s follows: 1

=

BO~QUEST,

2

:

BO~PLY

The B O O T R E Q U E S T op code is set b y t h e client w h e n t h e y w i s h to r e q u e s t services from t h e BOOTP Server. T h e BOOTREPLY op code is set by t h e s e r v e r w h e n it replies to a client r e q u e s t . T h e s e c o d e s a r e also u s e d t h e s a m e w a y w i t h DHCP.

HTYPE This is t h e h a r d w a r e a d d r e s s type. This field will c o n t a i n one of t h e v a l u e s listed in Table 7.2. T h e m o s t c o m m o n v a l u e s t o d a y w o u l d be 1 for 10MB E t h e r n e t a n d 6 for T o k e n Ring.

|

290

C h a p t e r 7 * Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives

Table 7.2 Hardware Address Type Codes Name

Number

Ethernet

1

Ethernet3

2

Ether

1

Ether3

2

leee803

6

Tr

6

Token Ring

6

Pronet

4

Chaos

5

Arcnet

7

Ax.25

3

HLEN This is the length of the h a r d w a r e a d d r e s s , e x p r e s s e d in bytes. For a n E t h e r n e t interface with the s t a n d a r d MAC a d d r e s s of 48 bytes, this field w o u l d c o n t a i n 6.

HOPS This field is u s e d to indicate the n u m b e r of r o u t e r s or g a t e w a y s t h r o u g h w h i c h the BOOTP p a c k e t h a s p a s s e d . It is set to zero by the client a n d t h e n i n c r e m e n t e d as it p a s s e s t h r o u g h a router.

XID This field is a t r a n s a c t i o n identifier. It is a r a n d o m n u m b e r g e n e r a t ed by the client w h e n it s e n d s a BOOTREQUEST m e s s a g e . It will be r e t u r n e d in the server's BOOTREPLY m e s s a g e , so t h a t the client c a n m a t c h its r e q u e s t with the a p p r o p r i a t e reply.


9Chapter 7

SECS This field is filled in by t h e client to indicate the e l a p s e d time since it first s e n t a BOOTREQUEST m e s s a g e . T h u s , the first m e s s a g e will have a v a l u e of zero in this field, a n d it will be i n c r e m e n t e d if t h e client h a s to s e n d several r e q u e s t s before it gets a reply. Historically, t h e r e h a s b e e n s o m e i n c o n s i s t e n c y in the u s e of this field by different i m p l e m e n t a t i o n s , b u t it w a s i n t e n d e d to be u s e d as a m e a n s of identifying p a c k e t s t h a t s h o u l d be h a n d l e d on a priority b a s i s by a forwarding agent.

FLAG In the original definition of the p a c k e t s t r u c t u r e in RFC951 ( S e p t e m b e r 1985), this field w a s labeled as u n u s e d , a n d w a s r e s e r v e d for f u t u r e e n h a n c e m e n t s . By the time t h a t RFC 1542 (October 1993) w a s written, the w o r k i n g g r o u p w a s struggling with the p r o b l e m of r e t u r n i n g boot replies to a r e q u e s t i n g client. Since the client w o u l d n o t k n o w his IP a d d r e s s until AFTER receiving the packet, it w a s often n e c e s s a r y to b r o a d c a s t the reply b a c k to the client. With this in mind, RFC 1542 r e n a m e d this field a n d specified t h a t the h i g h e s t - o r d e r bit w o u l d be set by the client to indicate t h a t a BROADCAST reply w a s required. The r e s t of the bits were r e s e r v e d for f u t u r e use, with a default setting of zero if u n u s e d .

CIADDR This client u s e s this field to indicate its c u r r e n t l y a s s i g n e d IP a d d r e s s , if the client k n o w s it. If not, it sets this field to 0.0.0.0. Since this protocol w a s designed for r e m o t e booting, BOOTP c a n be u s e d for bootfile retrieval by a client t h a t a l r e a d y k n o w s its a d d r e s s .

YIADDR The BOOTP server u s e s this field to indicate to the client the IP a d d r e s s it is being assigned. In those cases where the server u n i c a s t s a reply to the client, this a d d r e s s will be u s e d as the destination.

291

292

Chapter 7


SIADDR T h i s IP a d d r e s s is r e t u r n e d b y t h e BOOTP server, w h i c h i n d i c a t e s t h e s e r v e r t h a t will be a c c e s s e d to load t h e b o o t file u s e d in t h e seco n d s t e p of t h e b o o t p r o c e s s .

GIADDR T h o u g h t h i s field is called t h e g a t e w a y IP a d d r e s s , t h i s is a little m i s l e a d i n g , in t h a t it really refers to t h e a d d r e s s of a BOOTP r e l a y a g e n t . It is u s e d to facilitate t h e t r a n s f e r of BOOTP m e s s a g e s b e t w e e n a client a n d s e r v e r l o c a t e d on different IP s u b n e t s . T h i s a g e n t will be a n o d e on t h e client's n e t w o r k , a n d w h e n t h e a g e n t f o r w a r d s a B O O T R E Q U E S T , it c h a n g e s t h i s field from 0 . 0 . 0 . 0 to its o w n a d d r e s s . T h e n t h e BOOTP s e r v e r c a n u n i c a s t its reply to t h i s a d d r e s s on t h e client's s u b n e t . T h i s field h a s b e e n s u b j e c t to s o m e m i s i n t e r p r e t a t i o n , in t h a t it is s o m e t i m e s c o n f u s e d w i t h a r o u t e r g a t e w a y a d d r e s s for t h e client. T h i s i n t e r p r e t a t i o n h a s b e e n fueled b y t h e fact t h a t a r o u t e r c a n a c t a s a r e l a y a g e n t , in w h i c h c a s e t h e GIADDR m a y be a r o u t e r interface. To alleviate t h i s c o n f u s i o n , a n o p t i o n w a s defined in t h e VEND (options) field t h a t explicitly defines a r o u t e r (gateway) a d d r e s s . T h e client c a n u s e t h i s w h e n r e q u e s t i n g its b o o t file, in t h e s e c o n d s t a g e of t h e BOOTP p r o c e s s .

CHADDR T h i s is t h e client's h a r d w a r e a d d r e s s . It is i n t e r p r e t e d in c o n j u n c t i o n w i t h t h e HTYPE ( h a r d w a r e a d d r e s s type) field a n d t h e HLEN (hardw a r e a d d r e s s length). It is p r o v i d e d b y t h e client in a BOOTREQ U E S T m e s s a g e , a n d is u s e d b y t h e s e r v e r to identify t h e e n t r i e s in t h e BOOTP d a t a b a s e a s s o c i a t e d w i t h t h i s client. It w a s also d e s i g n e d to provide a s e r v e r w i t h a MAC a d d r e s s for t h e client, w h i c h it could s t o r e in its ARP c a c h e to avoid h a v i n g to u s e a n allo n e s b r o a d c a s t in a BOOTREPLY.


9Chapter 7

SNAME T h e c l i e n t c a n u s e t h i s field to specify a p a r t i c u l a r s e r v e r f r o m w h i c h it w i s h e s to o b t a i n a b o o t file. In t h i s c a s e t h e n a m e w o u l d b e a d o m a i n n a m e t h a t c o u l d b e r e s o l v e d u s i n g a D N S s e r v e r or a H O S T S file. If t h i s is left b l a n k , t h e s e r v e r will r e t u r n a n a d d r e s s in t h e S I A D D R field t h a t specifies t h e b o o t file s e r v e r a d d r e s s for t h e client.

FILE T h i s field is u s e d to i n d i c a t e t h e n a m e of t h e b o o t file to b e d o w n l o a d e d b y t h e client in t h e s e c o n d p h a s e of t h e B O O T P p r o c e s s . T h e client c a n u s e t h i s field to r e q u e s t a p a r t i c u l a r b o o t f i l e n a m e , or t h e s e r v e r c a n u s e t h i s field to identify t h e b o o t f i l e n a m e in a B O O T R E PLY m e s s a g e , b a s e d o n a c l i e n t ' s e n t r y in t h e B O O T P d a t a b a s e .

VEND/OPTION T h i s field originally w a s d e f i n e d a s a v e n d o r - e x t e n s i o n s field, w i t h a fixed l e n g t h of 6 4 b y t e s . Later, it w a s d e f i n e d m o r e g e n e r i c a l l y a s a n OPTION field, w i t h a v a r i a b l e l e n g t h . It w a s i n t e n d e d to c o n v e y a d d i t i o n a l i n f o r m a t i o n to t h e client. U s i n g t h i s field, t h e client c o u l d specify its i n t e r e s t in a d d i t i o n a l p a r a m e t e r s , a n d t h e s e r v e r c o u l d supply parameters matching this request, provided that the requested i n f o r m a t i o n e x i s t e d in t h e B O O T P d a t a b a s e . To facilitate t h e i n t e r p r e t a t i o n of t h i s field, t h e first f o u r o c t e t s of t h e field d e s c r i b e a magic cookie, w h i c h is a v a l u e t h a t identifies t h e f o r m a t for t h e r e s t of t h e field. A v e n d o r c o u l d u s e a specific s e t of o c t e t v a l u e s to define t h e field f o r m a t , or a g e n e r i c cookie c o u l d b e u s e d to i n d i c a t e t h e s t a n d a r d o p t i o n f o r m a t , w h i c h will b e d e s c r i b e d l a t e r in t h i s c h a p t e r . T h e v a l u e s u s e d for a s t a n d a r d f o r m a t a r e 9 9 . 1 3 0 . 8 3 . 9 9 in t h e first f o u r octets.

293

294

Chapter 7


BOOTP Process Details T h e following s e c t i o n will o u t l i n e in d e t a i l t h e p r o c e s s b e t w e e n t h e c l i e n t a n d server. It i n c l u d e s a d e s c r i p t i o n of t h e p a c k e t c o n t e n t s in each direction.

Client BOOTREQUEST T h e c l i e n t will c r e a t e a p a c k e t w i t h t h e following s e t t i n g s : 9

T h e IP d e s t i n a t i o n a d d r e s s = 2 5 5 . 2 5 5 . 2 5 5 . 2 5 5 .

9 T h e IP s o u r c e a d d r e s s a n d C I A D D R = 0 . 0 . 0 . 0 , if u n k n o w n , or c l i e n t ' s a d d r e s s , if k n o w n . 9 T h e U D P h e a d e r l e n g t h field is s e t to t h e l e n g t h of t h e p a c k e t in b y t e s . 9

T h e U D P s o u r c e p o r t = 6 8 (BOOTP Client).

9 T h e U D P d e s t i n a t i o n p o r t = 6 7 (BOOTP Server). 9 T h e OP field is s e t to 1 ( B O O T R E Q U E S T ) . 9 T h e HTYPE field is s e t to t h e h a r d w a r e a d d r e s s t y p e . 9 T h e H L E N field is s e t to t h e l e n g t h of t h e h a r d w a r e a d d r e s s . 9 T h e XID field is s e t to a r a n d o m v a l u e r e p r e s e n t i n g t h e t r a n s a c t i o n identifier. 9 T h e S E C S field is s e t to z e r o if t h i s is t h e first b o o t r e q u e s t , o t h e r w i s e it is s e t to t h e t i m e s i n c e t h e first b o o t r e q u e s t . 9

T h e FLAGS field h a s t h e h i g h - o r d e r b i t s e t to o n e if t h e c l i e n t c a n o n l y r e c e i v e a b r o a d c a s t BOOTREPLY; all o t h e r b i t s a r e s e t to zero.

9 T h e G I A D D R will b e s e t to 0 . 0 . 0 . 0 . 9

T h e C H A D D R is s e t to t h e MAC a d d r e s s of t h e client.

9 T h e S N A M E field m a y b e filled in w i t h t h e n a m e of a s e r v e r f r o m w h i c h t h e c l i e n t w i s h e s to b o o t . 9 T h e FILE field m a y b e filled w i t h t h e n a m e of t h e b o o t file f r o m w h i c h t h e c l i e n t w i s h e s to b o o t . 9 T h e V E N D field m a y b e filled w i t h a list of o p t i o n a l p a r a m e t e r s t h e c l i e n t is r e q u e s t i n g .


9

Chapter 7

If t h e client d o e s n o t receive a reply to a B O O T R E Q U E S T after a c e r t a i n time period, t h e client will r e t r a n s m i t t h e p a c k e t w i t h a n u p d a t e d S E C S field, s h o w i n g t h e e l a p s e d time s i n c e t h e first BOOTP request.

Server BOOTREPLY W h e n a s e r v e r receives a B O O T R E Q U E S T m e s s a g e , it will p e r f o r m t h e following c h e c k s : 9 T h e SNAME field is c h e c k e d , to see if t h e client r e q u e s t e d a specific server. If it did, a n d t h e s e r v e r d o e s n o t m a t c h t h e c u r r e n t server, t h e p a c k e t m a y be f o r w a r d e d u s i n g a BOOTP Relay a g e n t f u n c t i o n , a n d t h e GIADDR will be u p d a t e d w i t h t h e s e r v e r ' s a d d r e s s , if it is n o t a l r e a d y filled in. Alternatively, it m a y be j u s t d i s c a r d e d , d e p e n d i n g on t h e server. 9 The CIADDR field will be c h e c k e d . If it is zero, t h e s e r v e r will c h e c k t h e HTYPE, HLEN, a n d CHADDR fields a n d will u s e t h e m to identify a r e c o r d for t h i s client in t h e d a t a b a s e . If it finds a record, it p u t s t h e client's a s s i g n e d a d d r e s s in t h e YIADDR field. If no r e c o r d is f o u n d in t h e BOOTP s e r v e r ' s d a t a b a s e , t h e p a c k e t is d i s c a r d e d . 9 The s e r v e r will n o w c h e c k t h e FILE field. If a f i l e n a m e is specified, t h e s e r v e r will c h e c k it a g a i n s t its d a t a b a s e . If a m a t c h is found, t h e s e r v e r will p u t t h e c o m p l e t e p a t h to t h e filename in t h i s field. If t h e f i l e n a m e d o e s n ' t m a t c h t h e d a t a b a s e , t h e serve a s s u m e s t h e client is a s k i n g for a file t h i s s e r v e r d o e s n o t k n o w a b o u t , a n d it d r o p s t h e p a c k e t . 9 The VEND field is n o w c h e c k e d for a n y special i n f o r m a t i o n or i n s t r u c t i o n s t h a t t h e client w i s h e s to convey to t h e server. The list of v e n d o r o p t i o n s will be covered l a t e r in t h i s chapter. The s e r v e r t h e n c r e a t e s its reply p a c k e t w i t h t h e following settings: T h e IP d e s t i n a t i o n a d d r e s s = See T a b l e 7.3 to d e t e r m i n e t h e IP d e s t i n a t i o n a d d r e s s .

295

296

C h a p t e r 7 * Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives

Table 7.3 o u t l i n e s t h e b e h a v i o r of t h e server in p a s s i n g b a c k t h e BOOTREPLY packet, b a s e d on t h e field c o n t e n t s of t h e BOOTREQ U E S T p a c k e t from t h e client.

Table 7.3 Values in Client Fields and Corresponding Addressing S t r a t e g y for Server

BOOTREQUEST PACKET

BOOTREPLY PACKET

ClADDR

GIADDR Broadcast Flag

UDP IP Data-Link Destination Destination Destination

nonzero

0.0.0.0

X

BOOTPC (68)

CIADDR

Client MAC address

0.0.0.0

nonzero

X

BOOTPS (67)

GIADDR

Client MAC address

0.0.0.0

0.0.0.0

BOOTPC (68)

YIADDR

CHADDR

0.0.0.0

0.0.0.0

BOOTPC (68)

255.255.255 Broadcast .255

Field Values in the BOOTREPLY p a c k e t The server will create t h e BOOTREPLY p a c k e t with t h e following field values" 9 The IP s o u r c e a d d r e s s = the a d d r e s s of t h e server. 9 The UDP h e a d e r l e n g t h field is set to t h e l e n g t h of t h e p a c k e t in bytes. 9 The UDP d e s t i n a t i o n p o r t = 68 (BOOTP Client) normally, u n l e s s r e t u r n i n g to a BOOTP Relay Agent (see Table 7.3). 9 The UDP s o u r c e port = 67 (BOOTP Server). 9 The OP field is set to 2 (BOOTREPLY). 9 The HTYPE field is u n c h a n g e d . 9 The HLEN field is u n c h a n g e d . 9 The XID field is left u n c h a n g e d , to m a t c h this reply w i t h t h e client's original r e q u e s t . 9 The S E C S field is left u n c h a n g e d .


9Chapter 7

9 T h e FLAGS field is left u n c h a n g e d if t h e b r o a d c a s t bit is set. If zero, t h e s e r v e r m a y set t h e BROADCAST flag if it k n o w s t h e client c a n only receive b r o a d c a s t e d replies. 9 T h e CIADDR is left u n c h a n g e d . 9 T h e YIADDR is s e t to t h e client's a s s i g n e d IP a d d r e s s f r o m the server's database. 9 T H E SIADDR is filled in w i t h t h e s e r v e r ' s o w n IP a d d r e s s , p r o v i d i n g it will h a n d l e t h e n e x t p h a s e of t h e b o o t p r o c e s s , w h i c h involves s e r v i n g t h e b o o t file. 9 T h e GIADDR is left u n c h a n g e d . 9 T h e C H A D D R is left u n c h a n g e d . 9 T h e SNAME field is left u n c h a n g e d . 9 T h e FILE field m a y be filled w i t h t h e full p a t h a n d f i l e n a m e of t h e b o o t file for t h i s client, b a s e d on t h e d a t a b a s e record. 9 T h e VEND field m a y be filled w i t h t h e list of o p t i o n a l p a r a m e t e r s f r o m t h e d a t a b a s e record. W h e n t h e client receives t h e BOOTREPLY r e c o r d f r o m t h e server, it c h e c k s t h e fields in t h e p a c k e t to e n s u r e t h a t t h e reply is for it a n d n o t s o m e o t h e r client. It looks for a m a t c h in t h e CIADDR, CHADDR, a n d XlD fields.

The BOOTP Server Database RFC 951 i n c l u d e s a s e c t i o n t h a t o u t l i n e s a s u g g e s t e d f o r m a t for t h e BOOTP d a t a b a s e . T h i s d a t a b a s e w a s e n v i s i o n e d a s a fiat t e x t file d a t a b a s e c o m p o s e d of two s e c t i o n s , s e p a r a t e d b y a line b e g i n n i n g w i t h a p e r c e n t (%) sign. T h e first s e c t i o n c o n t a i n s a series of m a p p i n g s f r o m a g e n e r i c (short alias) n a m e to a c o m p l e t e p a t h n a m e for a b o o t file. If t h e client d o e s n o t specify a filename, a n d t h e d a t a b a s e d o e s n o t cont a i n a different f i l e n a m e for t h i s client, t h e s e r v e r will u s e t h e first n a m e listed in t h i s s e c t i o n a s t h e b o o t f i l e n a m e r e t u r n e d . T h e s e c o n d s e c t i o n c o n t a i n s listings for e a c h client, a l o n g w i t h t h e i r a s s i g n e d p a r a m e t e r s . T h e client's h a r d w a r e a d d r e s s type

297

298

Chapter 7


(HTYPE) a n d h a r d w a r e a d d r e s s (CHADDR) fields are u s e d a s t h e i n d e x to m a t c h a r e c o r d w i t h t h e r e q u e s t i n g client. B e s i d e s t h e h a r d w a r e a d d r e s s type a n d t h e a c t u a l h a r d w a r e a d d r e s s , e a c h r e c o r d c o n t a i n s t h e h o s t n a m e , t h e a s s i g n e d IP a d d r e s s , a n d a reference to t h e generic f i l e n a m e f r o m s e c t i o n one, w h i c h m a p s to a full p a t h to t h e b o o t file. It m a y also i n c l u d e a n o p t i o n a l suffix, w h i c h will be a p p e n d e d to t h e bootfile p a t h to i n d i c a t e a u n i q u e file, a s in " f i l e n a m e . c l i e n t l , filename.client2", etc. C o m m e n t lines c a n be indic a t e d b y b e g i n n i n g t h e line w i t h a # symbol. Following is a generic e x a m p l e of a BOOTP d a t a b a s e file, a s d e s c r i b e d in t h e RFC. T h e r e a r e v a r i a t i o n s to t h i s file f o r m a t b e t w e e n different BOOTP servers, b u t t h i s offers a g e n e r a l idea.

# Sample Database Format # Section one: generic name to path mappings bootfilel usr\bootfiles\boot bootfile2 alt\bin\startup % Section one ends, Section two begins host-one HTYPE1 CHADDR1 IPaddressl bootfilel suffix1 host-two HTYPE2 CHADDR2 IPaddress2 bootfile2 suffix2 T h i s s e r v e r will m a t c h t h e HTYPE a n d CHADDR of a BOOTP r e q u e s t to a r e c o r d in t h e d a t a b a s e . For e x a m p l e , if t h e s e m a t c h t h e r e c o r d for h o s t - o n e , t h e s e r v e r will r e t u r n I P a d d r e s s 1 to t h e client. It will also look a t t h e generic n a m e bootfile 1 a n d t r a n s l a t e it to t h e full p a t h n a m e u s i n g s e c t i o n one of t h e d a t a b a s e file. It will t h e n a p p e n d t h e s u f f i x l to t h e f i l e n a m e a n d r e t u r n it a s t h e full p a t h n a m e in t h e FILE field of t h e BOOTREPLY p a c k e t . T h i s full p a t h w o u l d be u s r \ b o o t f i l e s \ b o o t . s u f f i x l .

How Does DHCP Work? T h i s s e c t i o n b e g i n s w i t h a n overview of t h e D H C P p r o c e s s . It is followed b y a d e t a i l e d d e s c r i p t i o n of t h e p r o c e s s , w h i c h i n c l u d e s explan a t i o n s of t h e D H C P m e s s a g e types, a s well a s DHCP-specific o p t i o n codes. It will also a d d r e s s t h e i s s u e of BOOTP a n d D H C P i n t e r o p e r ability, a n d will c o n c l u d e w i t h a d i s c u s s i o n of D H C P a d d r e s s pools.


9Chapter 7

DHCP Process Overview DHCP w a s d e s i g n e d to be a n e x t e n s i o n of, a n d r e p l a c e m e n t for, t h e BOOTP protocol. It u s e s the s a m e p a c k e t s t r u c t u r e , m a n y of the s a m e p r o c e s s e s , a n d w a s d e s i g n e d for b a c k w a r d compatibility with BOOTP. It also h a s t h e ability to u s e BOOTP Relay A g e n t s to e n a b l e c l i e n t / s e r v e r c o m m u n i c a t i o n a c r o s s s u b n e t b o u n d a r i e s . It differs from BOOTP in t h a t it provides a n u m b e r of d y n a m i c a d d r e s s i n g m e t h o d s n o t s u p p o r t e d by the earlier protocol. DHCP s u p p o r t s t h r e e a d d r e s s a s s i g n m e n t m e t h o d s . The first of t h e s e is called manual address assignment. This is r o u g h l y equivalent to the BOOTP process, w h e r e a n a d m i n i s t r a t o r m u s t m a n u a l l y configure e n t r i e s in a d a t a b a s e for e a c h client, a n d t h e client t h e n gets t h e s e p a r a m e t e r s a s s i g n e d t h r o u g h the B O O T P / D H C P process. The s e c o n d a n d t h i r d a s s i g n m e n t m e t h o d s involve t h e u s e of a DHCP-specific f e a t u r e called a n address pool or scope. In t h e s e cases, t h e a d m i n i s t r a t o r d o e s n ' t build a table c o r r e l a t i n g e a c h client w i t h a d a t a b a s e record. Instead, a pool of a d d r e s s e s is defined. The a d d r e s s e s are h a n d e d o u t on a n a s - r e q u e s t e d basis. T h e r e m a y also be a set of optional p a r a m e t e r s defined for this a d d r e s s pool t h a t are r e t u r n e d to e a c h client along with a n a d d r e s s . This alleviates the n e e d to configure e a c h client individually, b u t also m a k e s it s o m e w h a t u n p r e d i c t a b l e w h i c h a d d r e s s a given client will receive. One w a y a d d r e s s e s c a n be a s s i g n e d from the a d d r e s s pool is to provide t h e m to t h e client for a finite period of time, called a lease. This is referred to as dynamic address assignment. With a lease, a client is p a s s e d a p a r a m e t e r with t h e a d d r e s s t h a t i n d i c a t e s the m a x i m u m time it c a n hold the a d d r e s s w i t h o u t r e n e w i n g t h e lease. E a c h time t h e client reboots, it will r e n e w the lease. If it s t a y s booted for a long period of time, it will r e a c h a p o i n t called the T1 time, w h e n it will a t t e m p t to r e n e w its a d d r e s s from t h e server it w a s originally a c q u i r e d from. If it fails in this a t t e m p t , it will r e a c h a s e c o n d t h r e s h o l d called the T2 time, w h e n it will a t t e m p t to r e n e w its a d d r e s s by b r o a d c a s t i n g to a n y available server, j u s t as it did the first time it w a s a s s i g n e d a n a d d r e s s . The DHCP server k e e p s t r a c k of the a d d r e s s e s it h a n d s o u t a n d the lease periods a s s o c i a t e d with

299

300

Chapter 7


t h e m . If a client fails to r e n e w its lease, t h e D H C P s e r v e r will r e c l a i m t h e a d d r e s s a n d r e u s e it w i t h a different client. T h i s f e a t u r e is p a r t i c u l a r l y u s e f u l for e n v i r o n m e n t s w h e r e a d d r e s s e s a r e s c a r c e , or w h e r e t h e clients c o n n e c t to t h e n e t w o r k on a t e m p o r a r y b a s i s . It m a y be p o s s i b l e to u s e a lease reservation to r e s e r v e a specific a d d r e s s f r o m t h e pool for a p a r t i c u l a r client. T h e t h i r d a s s i g n m e n t m e t h o d , called automatic address assignment, u s e s t h e a d d r e s s pool, b u t i n s t e a d of u s i n g a finite lease period, t h e a d d r e s s e s a r e s i m p l y h a n d e d o u t to t h e client indefinitely. S i n c e BOOTP clients h a v e no c o n c e p t of a lease, a n d no l e a s e r e n e w a l capability, t h i s m e t h o d w o u l d allow t h e m to u s e t h e a d d r e s s pool f e a t u r e of DHCP, b u t n o t t h e l e a s i n g feature. O n e of t h e c h a l l e n g e s for t h e D H C P s e r v e r is to e n s u r e t h a t it d o e s n o t h a n d o u t a d d r e s s e s t h a t are a l r e a d y in u s e . T h e r e a r e a n u m b e r of m e c h a n i s m s t h a t h e l p achieve this. First, t h e s e r v e r a n d / o r client m a y p e r f o r m a c h e c k b y p i n g i n g t h e n e t w o r k for t h e a d d r e s s before it h a n d s it out. If it gets a r e s p o n s e , it k n o w s t h e a d d r e s s is in use. For a d d r e s s e s t h a t t h e D H C P s e r v e r provides, it k e e p s a d a t a b a s e of w h a t a d d r e s s e s h a v e b e e n a s s i g n e d to w h i c h clients, a n d t h e i r l e a s e periods. Lastly, a D H C P s e r v e r c a n specifically e x c l u d e f r o m its a d d r e s s pool t h o s e a d d r e s s e s , or a d d r e s s r a n g e s , t h a t h a v e b e e n p r e v i o u s l y a s s i g n e d to h o s t s t h r o u g h o t h e r means. B o t h t h e D H C P s e r v e r a n d t h e client m a i n t a i n a p e r s i s t e n t r e c o r d of t h e i r a d d r e s s a s s i g n m e n t s . T h i s m e a n s t h a t if t h e s e r v e r goes down, it will still r e m e m b e r all of its a d d r e s s a s s i g n m e n t s w h e n it r e b o o t s . T h e client also m a i n t a i n s a r e c o r d of its a s s i g n e d a d d r e s s a n d o t h e r p a r a m e t e r s , so t h a t if it r e s t a r t s it will be able to r e n e w its e x i s t i n g a s s i g n m e n t s w i t h t h e D H C P server, r a t h e r t h a n looking like a n e w client. T h e p r o c e s s of a s s i g n i n g a set of p a r a m e t e r s to a client is r e f e r r e d to a s binding. A client r e m a i n s b o u n d to its p a r a m e t e r s u n t i l e i t h e r its lease period expires, or it r e l i n q u i s h e s its assignments with a DHCPRELEASE message.


9Chapter 7

DHCP Process Details DHCP u s e s the BOOTP p a c k e t format, with a few modifications, a n d also m a k e s u s e of the p a c k e t e x c h a n g e p r o c e s s b e t w e e n client a n d server. For example, the UDP p o r t s for DHCP a n d BOOTP are the s a m e . The OP codes u s e d by BOOTP to indicate a client BOOTREQUEST a n d a server BOOTREPLY are also u s e d by DHCP. DHCP differs in the extensive u s e of the VEND field. In DHCP, the VEND (vendor extensions) field is r e n a m e d the OPTIONS field, a n d c h a n g e d from a fixed length of 64 b y t e s to a variable l e n g t h field. E a c h DHCP m e s s a g e will c o n t a i n a DHCP Message Type option in this field, w h i c h identifies the p a c k e t ' s role in the DHCP process. In a d d i t i o n to the m e s s a g e types, DHCP also u s e s options to p a s s DHCP-specific p a r a m e t e r s s u c h as the lease period, as well as p a r a m e t e r s c o m m o n to DHCP a n d BOOTP, s u c h as the s u b n e t m a s k . E a c h m e s s a g e s e n t from a DHCP client will have a n OP code of 1 (BOOTREQUEST) a n d a d e s t i n a t i o n UDP p o r t of 67 (BOOTP Server). It m a y have different DHCP m e s s a g e types however, d e p e n d i n g on w h e t h e r it is r e q u e s t i n g a n e w a d d r e s s , r e n e w i n g a lease, or releasing a n a s s i g n m e n t . Similarly, e a c h server m e s s a g e will have a n OP code of 2 (BOOTREPLY) a n d a UDP p o r t d e s t i n a t i o n of 68 (BOOTP client) u n l e s s going t h r o u g h a BOOTP Relay agent. E a c h DHCP packet, w h e t h e r from server or client, will c o n t a i n i n f o r m a t i o n in the OPTIONS field. The first four octets will c o n t a i n the generic magic cookie, 9 9 . 1 3 0 . 8 3 . 9 9 , d i s c u s s e d earlier. It will t h e n c o n t a i n a series of option p a r a m e t e r s , of the following form:

ITAG (option code)

I SIZE

I PARAMETER VALUE

Each option takes up one byte for the TAG code, one byte for the size, and t h e n some n u m b e r of bytes, as stated in the SIZE byte, for PARAMETER VALUE. Each DHCP packet m u s t contain one of the DHCP Message type options, in addition to any other options defined. Unlike the two-step process used by BOOTP, in which a client m a k e s a BOOTREQUES; and the server responds with a BOOTREPLY, the

I

301

302

Chapter 7 9Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives DHCP process normally requires four steps for a new client. In this process, the client b r o a d c a s t s a BOOTREQUEST packet with a DHCP m e s s a g e type, DHCPDISCOVER. This m e a n s it is looking for a DHCP server. The server r e s p o n d s with a BOOTREPLY m e s s a g e using the DHCP m e s s a g e type, DHCPOFFER. This m e a n s the server is offering a set of p a r a m e t e r s to the client. The client will t h e n issue a n o t h e r BOOTREQUEST packet with the DHCP m e s s a g e type, DCHPREQUEST. This informs the server t h a t the client accepts the offered p a r a m e t e r s . The server t h e n issues a final BOOTREPLY packet contaJning the DHCPACK m e s s a g e type, indicating a n acknowledgement of the client's acceptance. This process is outlined in Figure 7.2.

Figure 7.2 Normal DHCP transaction.

I-'

! I.I

I~ ~

1. DHCPDISCOVER 2. DHCPOFFER 3. DHCPREQUEST r

DHCP Client

4. DHCPACK DHCP Server

T h e r e is a g r e a t deal of flexibility, a n d t h e r e f o r e a g r e a t deal of v a r i a t i o n , in t h e DHCP p r o c e s s . For e x a m p l e , a client m a y r e q u e s t c e r t a i n p a r a m e t e r s in its D H C P D I S C O V E R or D H C P R E Q U E S T p a c k e t s . T h e client m a y also be doing a lease r e n e w a l , r a t h e r t h a n a n initial discovery, in w h i c h c a s e t h e p r o c e s s will only i n c l u d e a D H C P R E Q U E S T from t h e client, followed b y a DHCPACK from t h e server. To preserve b a c k w a r d s compatibility with BOOTP, the server will r e t u r n the a s s i g n e d IP a d d r e s s in the YIADDR field of the BOOTP packet. It m a y also include v a r i o u s configured options in its reply, conveyed w i t h i n the OPTION (VEND) field of the packet.


9Chapter 7

One w a y of discovering the flexibility of the DHCP p r o c e s s is to look at the v a r i o u s DHCP Message Types a n d t h e i r p u r p o s e , outlined in Table 7.4.

Table 7.4 DHCP Message Types DHCP Message Type Message Name

Explanation

DHCPDISCOVER

Client broadcast to locate available servers.

DHCPOFFER

Server to client in response to DHCPDISCOVER with offer of configuration parameters.

DHCPREQUEST

Client message to servers either (a) requesting offered parameters from one server and implicitly declining offers from all others (b) confirming correctness of previously allocated address after system reboot or (c) extending lease.

DHCPDECLINE

Client to server indicating network address is already in use; implies that the client is checking for duplicates.

DHCPACK

Server to client with configuration parameters, including committed network address.

DHCPNAK

Server-to-client network address is incorrect or client's lease has expired.

DHCPRELEASE

Client to server relinquishing network address and canceling remaining lease.

DHCPINFORM

Client to server asking only for local configuration parameters. Client already has externally configured network address.

303

304

Chapter 7

*


DHCP-SpecificOptions In a d d i t i o n to t h e DHCP M e s s a g e Type opUons, t h e r e are a n u m b e r of o t h e r DHCP-specific options t h a t convey i n f o r m a t i o n u s e f u l to t h e DHCP process. This section lists t h e option types t h a t c a n be listed in t h e V E N D / O F r l O N S field. In s o m e cases, t h e option codes are u s e d p r i m a r i l y by t h e server; in others, t h e y c a n be u s e d b y either t h e client or t h e server. T h e r e m a i n d e r of the options, w h i c h are c o m m o n to b o t h DHCP a n d BOOTP, will be listed later in this chapter.

R e q u e s t e d Address

Option Code

Length (Bytes)

Parameter Value

50

4

Requested IP address

T h e client c a n u s e t h i s o p t i o n d u r i n g a D H C P D I S C O V E R to r e q u e s t a p a r t i c u l a r IP a d d r e s s .

Lease T i m e

Option Code

Length (Bytes)

Parameter Value

51

4

Lease time (secs)

T h i s o p t i o n is u s e d in a client's D H C P D I S C O V E R or D H C P R E Q U E S T p a c k e t to r e q u e s t a specific lease t i m e for a n a d d r e s s . It is also u s e d b y t h e s e r v e r in its D H C P O F F E R p a c k e t to specify t h e lease t i m e to t h e client.

Field Overload

Option Code 52

Length (Bytes) 1

Parameter Value Field overload (1-3)

T h i s is a n i n t e r e s t i n g field. It is u s e d in t h o s e s i t u a t i o n s w h e r e t h e client a n d s e r v e r h a v e defined a m a x i m u m p a c k e t size, a n d t h e n h a v e r u n o u t of r o o m for o p t i o n s in t h e OPTIONS field. In t h i s case,

Automatic Assignment of IP Addresseswith BOOTPand DHCP Objectives 9Chapter 7 it is p o s s i b l e to u s e t h e FILE field a n d / o r t h e SNAME field to hold a d d i t i o n a l options. This field i n d i c a t e s t h e i n t e n t i o n to u s e t h o s e fields a c c o r d i n g to T a b l e 7.5.

Table 7.5 Field Overload Codes Parameter Value

Fields Being Used

1

FILE field

2

SNAME field

3

Both Fields

TFTP Server N a m e Option Code

Length (Bytes)

Parameter Value

66

Variable

Alternative TFTP server field

If we h a v e c h o s e n to u s e t h e SNAME field to hold a d d i t i o n a l options, t h i s o p t i o n c a n be specified a s a n a l t e r n a t i v e w a y to indicate t h e s e r v e r h o l d i n g t h e d e s i r e d b o o t file for a r e m o t e boot.

Bootfile N a m e Option Code

Length (Bytes)

Parameter Value

67

Variable

Alternative file field

If we h a v e c h o s e n to u s e t h e FILE field to hold options, t h i s o p t i o n p r o v i d e s a n a l t e r n a t i v e w a y of c o n v e y i n g t h e n a m e of t h e d e s i r e d b o o t file.

DHCP M e s s a g e Type Option Code

Length (Bytes)

Parameter Value

53

1

DHCP message number (1-8)

305

306

Chapter 7 Automatic 9 Assignment of IP Addresseswith BOOTPand DHCP Objectives T h i s o p t i o n is u s e d to convey t h e type of t h e D H C P m e s s a g e , a s d e s c r i b e d in t h e p r e c e d i n g section. T a b l e 7.6 o u t l i n e s t h e m e s s a g e n u m b e r s a n d a s s o c i a t e d definitions.

Table 7.6 DHCP Message Option Codes DHCP Message Number

Message Type

1

DHCPDISCOVER

2

DHCPOFFER

3

DHCPREQUEST

4

DHCPDECLINE

5

DHCPACK

6

DHCPNAK

7

DHCPRELEASE

8

DHCPINFORM

Server Identifier Option Code

Length (Bytes)

Parameter Value DHCP server address

54

Servers m a y include this in D H C P O F F E R m e s s a g e s a n d m a y also i n c l u d e it in DHCPACK a n d DHCPNAK m e s s a g e s . This allows t h e client to k n o w w h a t DHCP server provided t h e offer, a n d t h e client will store this i n f o r m a t i o n for u s e w h e n it r e n e w s its a d d r e s s with a D H C P R E Q U E S T packet. DHCP clients c a n also include this in a D H C P R E Q U E S T p a c k e t to indicate w h i c h offer it is accepting, w h e n it h a s received offers from m o r e t h a n one DHCP server. This option w a s d e s i g n e d to allow t h e DHCP server to identify itself in a reply, while reserving t h e SIADDR field in t h e BOOTP p a c k e t for t h e a d d r e s s of t h e TFTP server serving t h e boot fries for t h e r e m o t e boot process.

Parameter Request List Option Code

Length (Bytes)

Parameter Value

55

Variable

List of parameters (options codes)


9Chapter 7

T h e client c a n u s e t h i s o p t i o n to specify a list of p a r a m e t e r s it w i s h e s to o b t a i n from t h e D H C P server. T h i s list c o n s i s t s of a s e r i e s of valid o p t i o n codes, e a c h t a k i n g u p one byte.

Error M e s s a g e Option Code

Length (Bytes)

56

Variable

If a cannot CLINE, convey

Parameter Value Error Message-Used with

DHCPNACK or by a client in a DHCPDECLINE

s e r v e r r e t u r n s a DHCPNACK to a client, i n d i c a t i n g t h a t it fulfill t h e client's r e q u e s t , or t h e client i s s u e s a D H C P D E r e f u s i n g t h e offer from a server, t h i s field c a n be u s e d to additional information.

M a x i m u m DHCP M e s s a g e Size Option Code

Length (Bytes)

Parameter Value

57

2

Max. DHCP message size

T h e client u s e d t h i s option, in a D H C P D I S C O V E R Y or D H C P R E Q U E S T m e s s a g e , to i n d i c a t e t h e m a x i m u m m e s s a g e size it is willing to a c c e p t .

TI R e n e w a l T i m e Option Code

Length (Bytes)

Parameter Value

58

4

T1 renewal time value (secs)

T h e s e r v e r u s e s t h i s o p t i o n to define t h e time a t w h i c h t h e client s h o u l d b e g i n to a t t e m p t r e n e w a l of its lease. A typical v a l u e for t h i s p a r a m e t e r is 50 p e r c e n t of t h e l e a s e time.

T2 R e b i n d i n g T i m e Option Code Length (Bytes)

Parameter Value

59

T2 rebinding time value (secs)

4

307

308

Chapter 7

*


The server u s e s this option to define the time at w h i c h the client s h o u l d give u p trying to r e n e w a lease with the original server a n d i n s t e a d , s t a r t trying to r e b i n d to a n e w DHCP server. The default time is 87.5 p e r c e n t of the lease time.

V e n d o r C l a s s ID

Option Code

Length (Bytes)

Parameter Value

60

Variable

Vendor class ID

The original BOOTP p a c k e t definition provided the VEND field, n o w called the OPTION field, to convey vendor-specific information. The m e c h a n i s m for doing this i n c l u d e d u s i n g the first four octets of the VEND field to d e n o t e a vendor-specific magic cookie. If the field w a s being u s e d generically, it w o u l d have the v a l u e s 9 9 . 1 3 0 . 8 3 . 9 9 in t h e s e four octets. With the DHCP e x t e n s i o n to BOOTP, every p a c k e t n o w u s e s this generic cookie value. Therefore, a n o t h e r m e t h o d h a d to be provided with DHCP, to denote vendor-specific information. This option w a s d e s i g n e d to fulfill t h a t p u r p o s e . A client will include this option in a DHCPDISCOVER m e s s a g e w h e n it w i s h e s to receive vendor-specific p a r a m e t e r s . If the DHCP server c a n ' t r e s p o n d to t h e s e vendor-specific r e q u e s t s , it ignores t h e m . If it c a n r e s p o n d , it r e t u r n s the vendor-specific p a r a m e t e r s in the OPTION field u s i n g a n option code of 43 along with the r e q u e s t e d parameters.

Client Identifier

Option Code 61

Length (Bytes) Variable

Parameter Value Client identifier

This option is u s e d by DHCP clients to specify a u n i q u e identifier. This identifier will be u s e d by the DHCP server to m a t c h a specific d a t a b a s e record to a client, in the s a m e f a s h i o n as a BOOTP server. This field c a n u s e the HTYPE a n d CHADDR v a l u e s ( h a r d w a r e a d d r e s s type a n d the h a r d w a r e a d d r e s s itself) j u s t like a BOOTP


9Chapter 7

server, or it c a n u s e a n a l t e r n a t i v e identifier, s u c h a s a s y s t e m ' s d o m a i n n a m e . T h e i d e n t i f i e r is r e q u i r e d to b e u n i q u e , in o r d e r to m a t c h t h e d a t a b a s e r e c o r d a n d t h e client p r o p e r l y .

Interoperation between DHCP and BOOTP B e c a u s e D H C P w a s d e s i g n e d to a r e often m e c h a n i s m s b u i l t into backward compatibility between A DHCP server provides this

be a r e p l a c e m e n t for BOOTP, t h e r e a DHCP server that preserve the a B O O T P client a n d a D H C P server. compatibility by accommodating

b o t h D H C P D I S C O V E R r e q u e s t s , a s well a s a B O O T R E Q U E S T f r o m a B O O T P client. T h e s e r v e r c a n d i s t i n g u i s h b e t w e e n t h e two b e c a u s e a D H C P client is r e q u i r e d to i n c l u d e a D H C P M e s s a g e T y p e option, b u t a B O O T P client is not. A DHCP server may maintain both a BOOTP-type database mapp i n g i n d i v i d u a l c l i e n t s to a s e t of specific p a r a m e t e r s , a n d a n a d d r e s s pool, w i t h a c o m m o n s e t of p a r a m e t e r s t h a t a r e r o u t i n e l y h a n d e d o u t w i t h t h e a d d r e s s e s . T h e s e r v e r m a y also r e s e r v e p o r t i o n s of its a d d r e s s pool for specific clients, a n d e x c l u d e r a n g e s of a d d r e s s e s w i t h i n t h e pool t h a t a r e k n o w n to b e p r e a s s i g n e d . W h e n r e c e i v i n g a client r e q u e s t , t h e s e r v e r m a y c h e c k its d a t a b a s e to see if a specific r e c o r d for t h a t client exists. If so, it r e t u r n s t h e p a r a m e t e r s in t h e d a t a b a s e r e c o r d . If not, it c a n a s s i g n p a r a m e t e r s b a s e d o n t h e c o n f i g u r a t i o n of its a d d r e s s pool. In t h i s w a y , a B O O T P c l i e n t c a n b e a s s i g n e d a n a d d r e s s f r o m a D H C P a d d r e s s pool. T h e r e a r e s o m e c o n s i d e r a t i o n s to b e a r in m i n d w h e n a B O O T P c l i e n t g e t s a n a d d r e s s f r o m a D H C P s e r v e r a d d r e s s pool. First, t h e c l i e n t h a s n o c o n c e p t of l e a s e s , so t h e a d d r e s s m u s t b e given o u t w i t h a n infinite l e a s e period. Also, t h e r e is no ability for t h e client to r e n e w a n e x i s t i n g lease, so if t h e client r e b o o t s , it will m a k e a n e w B O O T R E Q U E S T , w h i c h will r e s u l t in it b e i n g a s s i g n e d a n e w a d d r e s s f r o m t h e pool. M e a n w h i l e , t h e D H C P s e r v e r h a s s t o r e d t h e c l i e n t ' s o r i g i n a l a d d r e s s a s a n infinite lease, a n d c a n n o t r e c o v e r it for r e u s e . T h e client will also n o t e n g a g e in t h e D I S C O V E R - O F F E R R E Q U E S T - A C K N O W E D G E M E N T p r o c e s s , so t h e s e r v e r m u s t s t o r e

309

310

Chapter 7


t h e a d d r e s s a s s i g n m e n t a s s o o n a s it s e n d s t h e BOOTREPLY, r a t h e r t h a n w a i t i n g for a client r e q u e s t , in r e s p o n s e to its offer. It is also p o s s i b l e t h a t a D H C P client m a y be able to o b t a i n a d d r e s s i n f o r m a t i o n f r o m a BOOTP server. S i n c e t h e a d d r e s s inform a t i o n in e a c h c a s e is r e t u r n e d in t h e YIADDR field of t h e p a c k e t , a n d a n y o p t i o n s a r e r e t u r n e d in t h e O P T I O N S / V E N D field, t h e r e is a h i g h d e g r e e of c r o s s - c o m p a t i b i l i t y . A D H C P client in t h i s c a s e w o u l d c h e c k t h e OPTIONS field to d e t e r m i n e if t h e BOOTREPLY f r o m t h e s e r v e r i n c l u d e d a D H C P m e s s a g e type, a n d if not, it w o u l d a s s u m e it w a s t a l k i n g to a BOOTP server. In c a s e s w h e r e b o t h a D H C P a n d BOOTP s e r v e r r e s p o n d , t h e D H C P client s h o u l d a l w a y s c h o o s e t h e D H C P server.

DHCP Address Scopes In t h e p r e v i o u s s e c t i o n on BOOTP, we d i s c u s s e d t h e f o r m a t of t h e BOOTP d a t a b a s e file. D H C P s e r v e r s c a n also provide t h i s f u n c t i o n a l ity, w h i c h m a p s a specific client identifier to a set of p a r a m e t e r s r e c o r d e d in t h e d a t a b a s e for t h a t p a r t i c u l a r client. In a d d i t i o n , D H C P p r o v i d e s t h e ability to define a r a n g e of a d d r e s s e s , called a n address pool or scope. An a d d r e s s s c o p e is s i m p l y a r a n g e of a d d r e s s e s t h a t c a n be u s e d in r e s p o n s e to client r e q u e s t s . T h e r e is no o n e - t o - o n e m a p p i n g of clients to p a r a m e t e r s , b u t r a t h e r it is a f i r s t - c o m e - f i r s t - s e r v e d a p p r o a c h to a d d r e s s a s s i g n m e n t s . As t h e s e r v e r gives o u t t h e a d d r e s s e s , it r e c o r d s t h e client w h o received t h e a d d r e s s , a n d flags t h e a d d r e s s a s h a v i n g b e e n a s s i g n e d , so it d o e s n ' t u s e t h e a d d r e s s again. In a d d i t i o n to a d d r e s s e s , a n a d d r e s s scope m a y be c o n f i g u r e d w i t h a s e t of o p t i o n s t h a t will be r e t u r n e d to e a c h client w i t h t h e i r a d d r e s s a s s i g n m e n t s . T h e s e c a n be defined a t a scope level, so t h a t r a t h e r t h a n c o n f i g u r i n g e a c h client r e c o r d in a d a t a b a s e , t h e s e p a r a m e t e r s a r e s h a r e d w i t h all clients. Typical p a r a m e t e r s m i g h t be t h e s u b n e t m a s k , d e f a u l t g a t e w a y , DNS servers, etc. A D H C P s c o p e h a s t h e ability to e x c l u d e s o m e a d d r e s s e s w i t h i n its r a n g e , to avoid d u p l i c a t e a s s i g n m e n t of a d d r e s s e s a l r e a d y in u s e


9Chapter 7

by statically configured h o s t s , or t h o s e getting a d d r e s s e s via s o m e other means. A DHCP server c a n also m a i n t a i n m u l t i p l e scopes, w i t h e a c h scope a n d its a s s o c i a t e d options b e i n g defined for a given s u b n e t . T h r o u g h the u s e of BOOTP Relay a g e n t s , a DHCP server m a y service clients on m u l t i p l e s u b n e t s . It c a n u s e t h e GIADDR field in the B O O T R E Q U E S T p a c k e t to d e t e r m i n e w h i c h s u b n e t t h e r e q u e s t is c o m i n g from, a n d will r e s p o n d with i n f o r m a t i o n from t h e a p p r o p r i ate scope for t h a t s u b n e t . To r e d u c e t h e r a n d o m n e s s of the a d d r e s s a s s i g n m e n t s from the a d d r e s s pool, a n a d d r e s s w i t h i n the pool m a y be set aside for a specific h o s t t h r o u g h a r e s e r v a t i o n process. This allows u s to p r e d i c t w h i c h a d d r e s s will be a s s i g n e d to t h a t client, while p r e s e r v i n g its ability to o b t a i n c o m m o n p a r a m e t e r s from the s c o p e - d e f i n e d options.

Comparing BOOTP and DHCP B o t h BOOTP a n d DHCP u s e a server to provide a u t o m a t i c IP a d d r e s s c o n f i g u r a t i o n to clients. T h e y also u s e t h e s a m e p a c k e t form a t , w h i c h w a s d e s i g n e d originally for BOOTP a n d a d o p t e d later, with modifications, for DHCP. Both protocols provide t h e m e a n s to i s s u e a n IP a d d r e s s to a client. T h e y also provide a w a y to i n d i c a t e a server a n d filename on t h a t server, w h i c h c a n be d o w n l o a d e d a n d u s e d to boot the client. T h e y b o t h also i n c l u d e t h e ability to convey o t h e r c o n f i g u r a t i o n p a r a m e t e r s as well, s u c h as t h e g a t e w a y a d d r e s s , or the a d d r e s s of DNS servers. DHCP a n d BOOTP c a n b o t h u s e d a t a b a s e s t h a t are i n d e x e d u s i n g a client identifier s u c h as t h e h a r d w a r e a d d r e s s . By m a t c h i n g this client identifier to a record in the d a t a b a s e , the server c a n locate t h e i n f o r m a t i o n r e q u e s t e d by the client, a n d t r a n s m i t it b a c k in a reply m e s s a g e . B o t h DHCP a n d BOOTP c a n m a k e u s e of BOOTP Relay Agents, w h i c h allow a client a n d server on different s u b n e t s to e x c h a n g e B O O T R E Q U E S T a n d BOOTREPLY m e s s a g e s . DHCP protocol is a n e x t e n s i o n of t h e BOOTP protocol a n d is i n t e n d e d to be a r e p l a c e m e n t for t h a t earlier protocol. DHCP m a k e s

311

312

Chapter 7


e x t e n s i v e u s e of t h e VEND field (later called t h e OPTIONS field) in t h e original BOOTP p a c k e t to convey a d d i t i o n a l i n f o r m a t i o n b e t w e e n t h e client a n d server. In a d d i t i o n to BOOTP's ability to t r a n s m i t a d d r e s s e s a n d i n f o r m a t i o n b a s e d on o n e - t o - o n e e n t r i e s in a d a t a b a s e , DHCP c a n also a s s i g n a d d r e s s e s b a s e d on a s t a t e d r a n g e of a d d r e s s e s , s o m e t i m e s called t h e address pool or scope. It also differs from BOOTP in t h a t BOOTP a s s i g n s a d d r e s s e s p e r m a n e n t l y , w h e r e a s DHCP c a n be c o n f i g u r e d to lease a d d r e s s e s for a finite period of time. It will recover t h e s e a d d r e s s e s a n d r e u s e t h e m if t h e client d o e s n o t r e n e w its lease on t h e a d d r e s s .

How BOOTP Works T h e following s e c t i o n will provide a n overview of t h e BOOTP p r o c e s s . This will be followed b y a detailed d e s c r i p t i o n of t h e BOOTP p a c k e t s t r u c t u r e . We will t h e n t a k e a m o r e detailed look a t t h e client a n d s e r v e r p r o c e s s e s t h a t o c c u r d u r i n g a BOOTP e x c h a n g e . Lastly, we will look a t a n e x a m p l e of a BOOTP d a t a b a s e file.

BOOTP P r o c e s s Overview T h e BOOTP p r o c e s s c o n s i s t s of two p h a s e s . The first p h a s e is t h e a d d r e s s a n d p a r a m e t e r a c q u i s i t i o n p h a s e , w h i c h is t h e focus of o u r i n t e r e s t . The s e c o n d p h a s e involves a c c e s s i n g a file server, typically a TFTP server, a n d d o w n l o a d i n g a file t h a t c a n be u s e d to b o o t t h e client. T h e BOOTP client f u n c t i o n a l i t y w a s d e s i g n e d to r e s i d e on a PROM t h a t is g e n e r a l l y located on t h e client's n e t w o r k i n t e r f a c e card. B o t h t h e client a n d t h e s e r v e r c o m m u n i c a t e u s i n g a s t a n d a r d p a c k e t format, w h i c h is referred to a s a BOOTP p a c k e t . A client m a k e s a B O O T R E Q U E S T a n d t h e s e r v e r r e s p o n d s w i t h a BOOTREPLY. A client m a y u s e p a c k e t fields to i n d i c a t e pieces of i n f o r m a t i o n it a l r e a d y k n o w s , s u c h a s its IP a d d r e s s , or t h e b o o t filename it w i s h e s to retrieve, or it m a y leave t h o s e fields b l a n k w h e n it w a n t s to l e a r n t h e v a l u e s from t h e server.

Automatic Assignment of IP Addresses with BOOTP and DHCP Objectives 9Chapter 7

The BOOTP p r o c e s s also provides for a forwarding function, to be p e r f o r m e d by a BOOTP Relay Agent. This a g e n t is a n o d e on the s a m e s u b n e t as a client, w h i c h is configured to p a s s r e q u e s t a n d reply m e s s a g e s b e t w e e n clients a n d servers w h e n t h e y reside on different s u b n e t s .

DHCP / BOOTP Options The last field in the original BOOTP p a c k e t specification w a s a field called the VEND field, u s e d to convey i n f o r m a t i o n called v e n d o r e x t e n s i o n s . Later RFCs modified n o t only the n a m e of this field, c h a n g i n g it to OPTIONS, b u t also c h a n g e d it from a 6 4 - b y t e fixed length to a variable length. Similarly, the i n f o r m a t i o n conveyed in t h e s e fields were r e n a m e d simply, options. E a c h option h a s b e e n t h r o u g h a review p r o c e s s by the IANA (Internet Assigned N u m b e r Authority) a n d h a s a code, s o m e t i m e s called a tag, a s s i g n e d by them. New options c a n be p r o p o s e d by r e q u e s t i n g a n e w tag code a n d t h e n s u b m i t t i n g a d e s c r i p t i o n of the option for approval. E a c h option is e x p r e s s e d as a series of bytes t h a t u s e u p s p a c e in the BOOTP p a c k e t ' s V E N D / O P T I O N field. The f o r m a t of e a c h option is as follows: First Byte

Second Byte

Succeeding Bytes

Tag or Option Code

Length of data portion

Data portion

All the options originally defined as BOOTP v e n d o r - e x t e n s i o n s have b e e n i n c o r p o r a t e d as options by DHCP. In addition, t h e r e are a series of DHCP-specific options t h a t are n o t recognized by BOOTP. T h e s e options were d i s c u s s e d in the p r e v i o u s section dealing with the DHCP process, a n d will n o t be r e p e a t e d here. For the s a k e of organization, t h e s e will be g r o u p e d into sections t h a t s h a r e a similar function. D u e to the n u m b e r of options available, it is n o t possible to explain the f u n c t i o n of e a c h one. S o m e will be familiar, w h e r e a s s o m e o t h e r s m a y be extremely o b s c u r e , h a v i n g b e c o m e obsolete, or

313

314

Chapter7 9Automatic Assignment of IP Addresseswith BOOTPand DHCPObjectives else i n t e n d e d for specific e n v i r o n m e n t s t h a t existed at the time the option w a s f o r m u l a t e d . T h e y are listed here for the s a k e of completeness.

BOOTP Options from RFC 1497 The s o u r c e u s e d for the following options list is R F C 2 1 3 2 , p u b l i s h e d in M a r c h of 1997, w h i c h i n c o r p o r a t e d option i n f o r m a t i o n from a n u m b e r of earlier RFCs, i n c l u d i n g RFCs 1497 a n d 1533. This first section i n c l u d e s t h o s e options defined in RFC 1497. The o r g a n i z a t i o n of the r e s t of this section will also follow the f o r m a t of R F C 2 1 3 2 , since it p r e s e n t s the option codes r o u g h l y in a s c e n d i n g n u m e r i c a l order. Pad

Option Code

Length (Bytes)

Parameter Value

0

1

Align on word boundaries (no data)

This option is u s e d as a filler to e x t e n d the option fields to 32-bit w o r d b o u n d a r i e s or to p a d o u t the VEND field after a n END option. End

Option Code

Length (Bytes)

255

Parameter Value End of data in field (no data)

This code indicates the end of i n f o r m a t i o n in the v e n d o r / o p t i o n field. Subnet

Mask

Option Code

Length (Bytes)

Parameter Value Client subnet mask

This code specifies the client's s u b n e t m a s k .

Automatic Assignment of IP Addresses w i t h BOOTP and DHCP Objectives

9Chapter 7

Time Offset Option Code

Length (Bytes)

Parameter Value Time offset from GMT

T h i s code c a n be u s e d to define t h e client's t i m e zone relative to G r e e n w i c h M e a n Time.

R o u t e r List Option Code

Length (Bytes) Multiples of 4

Parameter Value List of router addresses

T h i s specifies a list of r o u t e r s available to t h e client, listed in o r d e r of p r e f e r e n c e .

T i m e S e r v e r List

Option Code 4


Parameter Value List of time server addresses

T h i s specifies a list of t i m e s e r v e r s available to t h e client, in o r d e r of p r e f e r e n c e .

N a m e S e r v e r List

Option Code 5


Parameter Value List of name server addresses

T h i s specifies a list of IEN 1 16 N a m e S e r v e r s available to t h e client, in o r d e r of p r e f e r e n c e .

DNS S e r v e r List

Option Code

Length (Bytes)

Parameter Value

6

Multiples of 4

List of DNS server addresses

T h i s specifies a list of DNS S e r v e r s available to t h e client, in o r d e r of p r e f e r e n c e .

315

316

Chapter 7

9


Log S e r v e r List

Option Code

Length(Bytes)

Parameter Value

7

Multiples of 4

List of log server addresses

This specifies a list of MIT-LCS UDP log servers available to the client, in order of preference.

C o o k i e S e r v e r List

Option Code

Length(Bytes)

Parameter Value

8

Multiples of 4

List of cookie server addresses

This specifies a list of R F C 8 6 5 - c o m p l i a n t cookie servers available to the client, in order of preference.

LPR S e r v e r List

Option Code

Length (Bytes)

Parameter Value

9

Multiples of 4

List of LPR server addresses

This specifies a list of Line Printer Remote (LPR) Servers available to the client, in order of preference.

I m p r e s s S e r v e r List

Option Code

Length (Bytes)

Parameter Value

10

Multiples of 4

List of impress server addresses

This specifies a list of I m a g e n I m p r e s s servers available to t h e client, in order of preference.

R e s o u r c e L o c a t i o n S e r v e r List

Option Code

Length(Bytes)

Parameter Value

11

Multiples of 4

List of resource location servers

This specifies a list of R F C 8 8 7 R e s o u r c e Location servers available to the client, in order of preference.

Automatic Assignmentof IP Addresseswith BOOTPand DHCPObjectives 9 Chapter 7 Host Name

Option Code

Length (Bytes)

Parameter Value

12

Variable

Host name of client

T h i s o p t i o n specifies client's n a m e , w h i c h m a y or m a y n o t include the domain name.

Boot File Size

Option Code

Length (Bytes)

Parameter Value Boot file length (512KB blocks)

13

T h i s o p t i o n specifies t h e size of t h e client's d e f a u l t b o o t file.

Merit Dump File

Option Code

Length (Bytes)

Parameter Value

14

Variable

Merit dump file name

T h i s o p t i o n is u s e d to define t h e p a t h a n d f i l e n a m e for t h e file to be u s e d a s a core d u m p repository, if t h e client s h o u l d c r a s h .

Domain

Name

Option Code

Length (Bytes)

Parameter Value

15

Variable

Client's Internet domain name

T h i s o p t i o n lists t h e DNS d o m a i n n a m e t h a t t h e client s h o u l d use.

Swap S e r v e r Option Code 16

Length (Bytes)

Parameter Value Swap server's IP address

T h i s o p t i o n lists t h e a d d r e s s of t h e client's s w a p server.

317

318

Chapter 7


Root Path Option Code

Length (Bytes)

Parameter Value

17

Variable

Pathname to client's root disk

This option is u s e d to define a p a t h d e s i g n a t e d as the root drive for this client.

E x t e n s i o n s Path Option Code 18

Length (Bytes)

Parameter Value

Variable

File name of extensions file

This option c a n be u s e d to define the filename of a file t h a t c a n be u s e d as a n e x t e n s i o n to the VEND/OPTIONS field. It u s e s exactly t h e s a m e f o r m a t for listing options, a n d is d e s i g n e d to be retrieved u s i n g TFTP.

IP Layer Parameters per Host O p t i o n s in the following section are c o n c e r n e d with IP n e t w o r k - l a y e r p a r a m e t e r s , as t h e y relate to the h o s t globally, r a t h e r t h a n to a part i c u l a r interface configuration.

IP Forwarding Enable/Disable Option Code

Length (Bytes)

Parameter Value

19

1

IP forwarding (enable= 1)

This option specifies w h e t h e r the client s h o u l d configure its IP layer for p a c k e t forwarding. A value of 0 m e a n s disable IP forwarding, a n d a value of 1 m e a n s enable IP forwarding.

Nonlocal Source Routing Enable/Disable Option Code 20

Length (Bytes)

Parameter Value Source route forwarding (enable= 1)


~

Chapter 7

This option configures the client b e h a v i o r in r e g a r d to w h e t h e r or n o t it will forward p a c k e t s with s o u r c e - r o u t i n g i n f o r m a t i o n .

Policy Filter Option Option Code

Length (Bytes)

Parameter Value

21

Multiples of 8

Allowed source routing destination IP address/mask pairs

This option c o n t a i n s a list of IP a d d r e s s a n d m a s k pairs u s e d to specify a list of s o u r c e - r o u t i n g n e x t - h o p a d d r e s s e s u s e d for filtering. Any s o u r c e - r o u t e d d a t a g r a m w h o s e n e x t - h o p a d d r e s s does n o t m a t c h one of the filters s h o u l d be d i s c a r d e d by the client.

Maximum Datagram Reassembly Size Option Code

Length (Bytes)

22

Parameter Value Maximum datagram reassembly size in bytes

This option is u s e d to define a m a x i m u m allowable size for t h e r e a s s e m b l y of a n IP d a t a g r a m t h a t h a s b e e n f r a g m e n t e d d u r i n g t r a n s m i s s i o n a c r o s s the network.

Default IP Time-to-Live Option Code

Length(Bytes)

Parameter Value

23

1

Default IP TTI (1-255)

The value of this option will be u s e d as the default value for TTL in the IP h e a d e r of o u t b o u n d d a t a g r a m s .

Path MTU Aging Timeout Option Option Code

Length(Bytes)

Parameter Value

24

4

MTU aging timeout (secs)

The MTU ( M a x i m u m T r a n s m i s s i o n Unit) is the m a x i m u m p a c k e t size allowed on a given n e t w o r k s e g m e n t . It is periodically t e s t e d

319

320

Chapter7 Automatic 9 Assignment of IP Addresseswith BOOTPand DHCPObjectives u s i n g a polling m e c h a n i s m called P a t h MTU Discovery. This option c a n set the polling interval.

P a t h MTU P l a t e a u Table Option Code

Length (Bytes)

Parameter Value

25

Multiples of 2

List of MTU sizes to check

The P a t h MTU Discovery p r o c e s s w o r k s by cycling t h r o u g h a set of p o t e n t i a l MTU values, to find the m a x i m u m s u i t a b l e value. This option c o n t a i n s a list of MTU sizes, a r r a n g e d from s m a l l e s t to largest, t h a t this polling p r o c e s s c a n try.

IP Layer Parameters per Interface O p t i o n s in this section are i n t e n d e d to apply to a p a r t i c u l a r interface on a client. If multiple i n t e r f a c e s n e e d to be configured, the client s h o u l d i s s u e individual r e q u e s t s for e a c h interface.

I n t e r f a c e MTU O p t i o n Option Code

Length (Bytes)

Parameter Value

26

2

MTU value for interface (bytes)

This option a s s i g n s a n MTU value for a specific interface.

All S u b n e t s Are Local O p t i o n Option Code

Length (Bytes)

Parameter Value All subnet MTUs are the same (1 =yes)

27

This option tells the client w h e t h e r or n o t all s u b n e t s the client is c o n n e c t e d to s h a r e the s a m e MTU value. A value of zero i n d i c a t e s t h a t s o m e s u b n e t s m a y have s m a l l e r MTUs.

Broadcast Address Option Code 28

Length (Bytes)

Parameter Value Subnet broadcast address


9

Chapter 7

This option specifies the a d d r e s s u s e d for s u b n e t b r o a d c a s t s on the interface subnet.

Perform Mask D i s c o v e r y Option Code 29

Length (Bytes) 1

Parameter Value Enable subnet mask discovery (1 =yes)

This option d e t e r m i n e s w h e t h e r or not the client will perform ICMP m a s k discovery.

Mask Supplier Option Code 30

Length (Bytes) 1

Parameter Value Respond to subnet mask ICMP request (1 =yes)

The ICMP m a s k discovery process relies on a h o s t to r e s p o n d to the m a s k requests. This option enables the h o s t to reply to m a s k discovery requests.

Perform Router D i s c o v e r y Option Code 31

Length (Bytes) 1

Parameter Value Perform router discovery (yes= 1)

This option d e t e r m i n e s w h e t h e r or not the client s h o u l d perform r o u t e r discovery (RFC 1236).

Router S o l i c i t a t i o n Address Option Code Length (Bytes) 4 32

Parameter Value Address of server for router discovery requests

This option provides the a d d r e s s of the node servicing r o u t e r discovery requests.

321

322

Chapter7 9Automatic Assignment of IP Addresseswith BOOTPand DHCPObjectives

Static Route List Option Code

Length (Bytes)

Parameter Value

33

Multiples of 8

Static routes listing destination address, next-hop router address

This option provides a list of static routes. E a c h e n t r y i n c l u d e s the d e s t i n a t i o n n e t w o r k a n d the n e x t - h o p r o u t e r a d d r e s s for t h a t destination.

Link Layer Parameters per Interface O p t i o n s in this section apply to a p a r t i c u l a r interface, a n d c o n t a i n p a r a m e t e r s related to the d a t a - l i n k layer.

Trailer Encapsulation Option Code

Length (Bytes)

Parameter Value

34

1

Use trailers with ARP (yes= 1)

This option d e t e r m i n e s w h e t h e r or n o t the client will negotiate t h e u s e of trailers with the ARP protocol as specified in RFC 893.

ARP Cache Timeout Option Code

Length (Bytes) Parameter Value

Timeout value for ARP cache entries (secs)

35

This option specifies a m a x i m u m age for ARP cache entries.

Ethernet Encapsulation Option Code


36

1

Encapsulation type (Ethernet I1=0, 802.3=I)

This option is u s e d to specify the E t h e r n e t e n c a p s u l a t i o n type. Valid v a l u e s are E t h e r n e t II or 8 0 2 . 3 E t h e r n e t .

Automatic Assignment of IP Addresseswith BOOTPand DHCPObjectives 9Chapter 7

TCP P a r a m e t e r s This section c o n t a i n s p e r - i n t e r f a c e p a r a m e t e r s dealing with TCP.

TCP Default TTL Option Code


37

1

TCP default TTL (1-255)

O u t b o u n d TCP p a c k e t s will have the value defined in this option e n t e r e d into the IP-level TTL field.

TCP K e e p a l i v e Interval Option Code


38

4

Keepalive interval (secs)

This option defines a n interval b e t w e e n keepalive m e s s a g e s on the TCP connection. A value of 0 disables periodic keepalive m e s sages.

TCP K e e p a l i v e Garbage Option Code


39

Send garbage octet (yes= 1)

This option is u s e d to preserve compatibility, w i t h o u t older TCP i m p l e m e n t a t i o n s t h a t require a n octet of r a n d o m c h a r a c t e r s as p a r t of the keepalive m e s s a g e .

Application and Service Parameters O p t i o n s in this section deal with m i s c e l l a n e o u s p a r a m e t e r s related to services or applications.

Network I n f o r m a t i o n S e r v i c e D o m a i n Option Code


40

Variable

Name of client's NIS domain

323

324

Chapter 7 Automatic 9 Assignment of IP Addresseswith BOOTPand DHCPObjectives This option specifies the client's Network I n f o r m a t i o n Service (NIS) D o m a i n .

N e t w o r k I n f o r m a t i o n S e r v e r List Option Code


41

Multiples of 4

List of NIS server addresses

This option specifies a list of NIS server a d d r e s s e s available to the client, in order of preference.

N e t w o r k T i m e P r o t o c o l S e r v e r List Option Code


42

Multiples of 4

List of NTP server addresses

This option specifies a list of Network Time Protocol (NTP) server a d d r e s s e s available to the client, in order of preference.

Vendor-Specific Information Option Code 43

Length (Bytes) Parameter Value Variable Vendor-specific information

This option is u s e d in c o n j u n c t i o n with option code 60, The Vendor Class Identifier, to p a s s vendor-specific p a r a m e t e r s . T h e s e p a r a m e t e r s will u s e the s a m e T a g - L e n g t h - P a r a m e t e r a r r a n g e m e n t as a s t a n d a r d option code.

NetBIOS o v e r T C P / I P N a m e S e r v e r List Option Code


44

Multiples of 4

List of NBNS server addresses

This option c o n t a i n s a list of NetBIOS n a m e servers t h a t c a n p e r f o r m NetBIOS n a m e - t o - a d d r e s s t r a n s l a t i o n for the client.


9Chapter 7

NetBIOS o v e r T C P / I P D a t a g r a m D i s t r i b u t i o n S e r v e r List

Option Code


45

Multiples of 4

List of NBDD server addresses

This o p t i o n specifies a list of NBDD s e r v e r a d d r e s s e s available to t h e client, in o r d e r of preference.

NetBIOS o v e r T C P / I P Node T y p e

Option Code


46

1

NetBIOS Node type code

T h i s o p t i o n defines t h e NBT Node type of t h e client. T h i s n o d e type defines w h a t m e t h o d s t h e client will u s e to do NetBIOS n a m e r e s o l u t i o n . The v a l u e s a n d m e a n i n g s are listed in T a b l e 7.7.

Table 7.7 NetBIOS over TCP/IP Node Type Codes Hex Value

Node T y p e

Behavior

0xl

B-node

Broadcast

0x2

P-node

Use name server

0x4

M-node

Broadcast, then use name server

0x8

H-node

Use name server, then broadcast

NetBIOS o v e r T C P / I P S c o p e

Option Code Length (Bytes) Parameter Value 47

Variable

NetBIOS scope name

This o p t i o n defines t h e client a s a m e m b e r of a NetBIOS scope.

X W i n d o w S y s t e m F o n t S e r v e r List

Option Code


48

Multiples of 4

List of X Windows Font server addresses

325

326

Chapter 7


This option specifies a list of X-Windows Font server a d d r e s s e s available to the client, in order of preference.

X Window S y s t e m Display Manager List Option Code 49

Length (Bytes) Parameter Value Multiples of 4 Address list of systems running X Windows Display Manager

This option specifies a list of s y s t e m s available to the client t h a t are r u n n i n g the X Window S y s t e m Display Manager.

Network I n f o r m a t i o n Service+ D o m a i n Option Code Length (Bytes) Parameter Value Name of client's NIS+ domain Variable 64 This option lists the client's NIS +(Network I n f o r m a t i o n Service Plus) domain.

Network I n f o r m a t i o n Service+ Servers List Option Code 65

Length (Bytes) Parameter Value Multiples of 4 List of NIS+ server addresses

This option provides a list of the NIS+ Servers available to the client, in order of preference.

Mobile IP H o m e A g e n t Option Code 68

Length (Bytes) Parameter Value Multiples of 4, List of Mobile IP Home Agent addresses usually 4 or 0

This option provides a list of the Mobile IP Home Agents available to the client, in order of preference. Usually t h e r e is either one of these, or none.


9

Chapter 7

S i m p l e Mail Transport Protocol (SMTP) Server List Option Code Length (Bytes) Parameter Value 69

Multiples of 4

List of SMTP server addresses

This option provides a list of the SMTP Mail Servers available to the client, listed in order of preference.

Post Office Protocol (POP3) Server List Option Code Length (Bytes) Parameter Value 70

Multiples of 4

List of POP3 server addresses

This option provides a list of the POP3 Mail Servers available to the client, in order of preference.

Network News Transport Protocol (NNTP) Server List Option Code Length (Bytes) Parameter Value 71

Multiples of 4

List of NNTP server addresses

This option provides a list of the NNTP News Servers available to the client, in order of preference.

Default World Wide Web (WWW) Server List Option Code Length (Bytes) Parameter Value 72

Multiples of 4

List of WWW server addresses

This option provides a list of the Web Servers available to the client, in order of preference.

Default Finger Server List Option Code Length (Bytes) Parameter Value 73

Multiples of 4

List of Finger server addresses

This option provides a list of the Finger Servers available to the client, in order of preference.

327

328

Chapter 7

9


Default I n t e r n e t Relay Chat (IRC) Server List

Option Code Length (Bytes) Parameter Value 74

Multiples of 4

List of Finger server addresses

This option provides a list of the IRC C h a t Servers available to the client, in order of preference.

S t r e e t T a l k Server List

Option Code Length (Bytes) Parameter Value 75 Multiples of 4 List of StreetTalk server addresses This option provides a list of the S t r e e t T a l k Servers available to the client, in o r d e r of preference.

StreetTalk Directory Assistance (STDA) Server List Option Code Length (Bytes) Parameter Value 76

Multiples of 4

List of STDA server addresses

This option provides a list of the STDA Servers available to the client, listed in order of preference. R F C 2 1 3 2 c o m p l e t e s this list with the DHCP-specific option codes t h a t were covered in the DHCP section of the chapter, a n d t h e n a section on h o w to p r o p o s e n e w option codes.

BOOTP, DHCP, and Routed Networks F r o m the first definitions of the BOOTP protocol, a m e c h a n i s m w a s specified t h a t could allow a BOOTP client a n d server on different s u b n e t s to e x c h a n g e BOOTP information. This m e c h a n i s m w a s first called a BOOTP F o r w a r d i n g Agent, b u t the n a m e w a s later c h a n g e d to avoid c o n f u s i o n with a r o u t e r t h a t provides r o u t i n e p a c k e t forwarding. It's n o w referred to as a BOOTP Relay Agent. Since DHCP w a s d e s i g n e d to be a n e x t e n s i o n of BOOTP, it w a s also d e s i g n e d to u s e BOOTP Relay Agents. F r o m the s t a n d p o i n t of


9Chapter 7

t h e a g e n t , it d o e s n o t c a r e if t h e p a c k e t is a s t a n d a r d BOOTP p a c k et, or a BOOTP p a c k e t w i t h DHCP M e s s a g e type o p t i o n s in t h e V E N D / O P T I O N S field. E i t h e r way, t h e p r o c e s s is t h e s a m e .

The BOOTP Relay Agent W h e n a BOOTP client i s s u e s a B O O T R E Q U E S T p a c k e t , typically it does n o t k n o w t h e a d d r e s s of t h e BOOTP s e r v e r t h a t is going to reply. It t h e r e f o r e s e n d s t h i s p a c k e t o u t a s a local b r o a d c a s t w i t h a d e s t i n a t i o n a d d r e s s of 2 5 5 . 2 5 5 . 2 5 5 . 2 5 5 . Since local b r o a d c a s t s a r e n o t f o r w a r d e d b e t w e e n s u b n e t s b y a router, t h i s m e s s a g e will n e v e r r e a c h t h e s e r v e r if it is n o t on t h e s a m e s u b n e t a s t h e client. To allow t h i s p a c k e t to be forwarded, a BOOTP Relay A g e n t m u s t exist on t h e s a m e s u b n e t w i t h t h e client. T h e Relay A g e n t r e c o g n i z e s t h a t t h i s b r o a d c a s t is a B O O T R E Q U E S T b a s e d on t h e d e s t i n a t i o n UDP p o r t n u m b e r of 67, w h i c h is t h e BOOTP S e r v e r port. T h e a g e n t will t h e n f o r w a r d t h i s p a c k e t a s a u n i c a s t , w i t h t h e d e s t i n a t i o n s e t to t h e IP a d d r e s s of t h e BOOTP Server. It k n o w s w h a t a d d r e s s ( e s ) to u s e in f o r w a r d i n g t h e s e p a c k e t s b e c a u s e t h e a d d r e s s e s a r e p a r t of t h e a g e n t c o n f i g u r a t i o n . It will also receive a BOOTREPLY u n i c a s t m e s s a g e b a c k from t h e server, a n d t h e n s e n d it b a c k to t h e client on t h e local s u b n e t , typically a s a local b r o a d c a s t . The definition of t h e BOOTP Relay a g e n t did n o t specify w h e t h e r t h i s f u n c t i o n s h o u l d be i n c o r p o r a t e d into a r o u t e r (gateway) or w h e t h e r it c o u l d be a n o t h e r h o s t on t h e s a m e s u b n e t a s t h e client. E i t h e r i m p l e m e n t a t i o n is a c c e p t a b l e s i n c e t h e m a i n r e q u i r e m e n t s are t h a t : 9 T h e A g e n t h a s to be a n o d e on t h e s a m e s u b n e t a s t h e client. 9

It h a s to recognize a n d f o r w a r d t h e client r e q u e s t a s a u n i c a s t m e s s a g e to t h e server.

9

It h a s to a c c e p t u n i c a s t m e s s a g e s b a c k from t h e s e r v e r t h a t it t h e n r e s e n d s o u t on its local s u b n e t to t h e r e q u e s t i n g client.

329

330

Chapter 7


In spite of the fact t h a t either a h o s t or a r o u t e r could p e r f o r m the relay a g e n t function, it w a s s u g g e s t e d in several RFC d i s c u s sions t h a t a r o u t e r provided a logical place to i m p l e m e n t this functionality. Therefore, it is c o m m o n to h e a r references to a n RFC 1 5 4 2 - c o m p l i a n t router, w h i c h implies BOOTP Relay Agent's capability in the r o u t e r (see Figure 7.3). A l t h o u g h it w a s a valid point, it c o n t r i b u t e d to the c o n f u s i o n b e t w e e n forwarding a g e n t s a n d relay agents, a n d also c o n t r i b u t e d to a related c o n f u s i o n in the m e a n i n g of the GIADDR field in the BOOTP packet. Figure 7.3

The BOOTP Relay

Agent Process

The Role of the GIADDR The GIADDR field in the BOOTP p a c k e t plays a significant role in the f u n c t i o n i n g of BOOTP a n d DHCP a c r o s s a r o u t e d network. We have l e a r n e d t h a t the GIADDR is set to 0.0.0.0 by the client w h e n it t r a n s m i t s a BOOTREQUEST. If the B O O T P / D H C P server gets a BOOTREQUEST with the GIADDR set to all zeros, it k n o w s the client is on the local s u b n e t , a n d will r e s p o n d directly to it, u s i n g UDP d e s t i n a t i o n port 68 (BOOTP Client).


9Chapter 7

If t h e s e r v e r is n o t local to t h e client, a BOOTP Relay A g e n t m u s t exist on t h e client's s u b n e t to f o r w a r d t h e p a c k e t . If t h i s is t h e case, t h e a g e n t will e x a m i n e t h e GIADDR field of t h e r e q u e s t , a n d if t h e field is all zeroes, it will place its o w n a d d r e s s in t h i s field. T h i s provides a u n i c a s t r e t u r n a d d r e s s for t h e s e r v e r to u s e in r e t u r n i n g its BOOTREPLY m e s s a g e to t h e client's s u b n e t . If t h e GIADDR is n o t zero, t h e a g e n t a s s u m e s t h e e x i s t i n g v a l u e r e p r e s e n t s a n o d e on t h e client's h o m e s u b n e t , a n d does n o t modify it. W h e n a B O O T P / D H C P s e r v e r receives a B O O T R E Q U E S T p a c k e t w i t h a n o n z e r o GIADDR, it r e c o g n i z e s t h a t t h e p a c k e t w a s f o r w a r d e d f r o m a BOOTP Relay Agent. In t h i s c a s e it modifies its r e s p o n s e in t h e BOOTREPLY p a c k e t , s e n d i n g it to t h e GIADDR a s t h e d e s t i n a tion a d d r e s s , a n d s e n d i n g it to p o r t 67 (BOOTP Server) i n s t e a d of p o r t 68 (BOOTP Client). T h i s is n e c e s s a r y b e c a u s e t h e a g e n t only r e s p o n d s to t h e s e r v e r p o r t n u m b e r , w h e t h e r t h e m e s s a g e is a client r e q u e s t or a s e r v e r r e s p o n s e . A n o t h e r u s e of t h e GIADDR is DHCP-specific: T h e D H C P s e r v e r u s e s t h e a d d r e s s listed in t h e GIADDR field to a s c e r t a i n t h e client's subnet. Using this information, the server can determine which s c o p e of a d d r e s s e s , if it h a s m u l t i p l e a d d r e s s scopes, to u s e in r e s p o n d i n g b a c k to t h e client.

Other Fields Involved In a d d i t i o n to t h e GIADDR field, t h e r e a r e a n u m b e r of o t h e r fields in t h e BOOTP p a c k e t t h a t m a y be modified b y t h e BOOTP Relay a g e n t , o u t l i n e d here.

HOPS T h e H O P S field in a B O O T R E Q U E S T f r o m a client is initially s e t to zero. E a c h t i m e t h e r e q u e s t p a c k e t c r o s s e s a n o t h e r r o u t e r b o u n d ary, t h i s field s h o u l d be i n c r e m e n t e d b y one. T h e r e is s o m e a m b i g u ity in t h e R F C s a s to w h e t h e r t h i s s h o u l d h a p p e n only if t h e a g e n t is a router, or if t h e a g e n t s h o u l d do t h i s r e g a r d l e s s of role. It s e e m s m o r e a p p r o p r i a t e to a router, since a p r o p e r l y c o n f i g u r e d r e l a y a g e n t

331

332

Chapter 7


a n d server will directly u n i c a s t b e t w e e n themselves, w i t h o u t the n e e d for a n y i n t e r m e d i a r y agents. The HOPS field w a s also i n t e n d e d to tell h o w far a w a y a client w a s from a server, allowing a t h r e s h o l d to be set b e y o n d w h i c h t h e p a c k e t will no longer be forwarded.

CHADDR, YIADDR, HTYPE, HLEN, FI AG T h e s e fields all have a role to play in helping the server a n d a g e n t d e t e r m i n e h o w t h e y s h o u l d s e n d b a c k a BOOTREPLY to the client. A p r e v i o u s section of this c h a p t e r outlined the v a r i o u s options the BOOTP Server m i g h t u s e to reply to the client b a s e d on w h e t h e r the client c a n a c c e p t u n i c a s t s or b r o a d c a s t s . Since the BOOTP Relay Agent is acting on b e h a l f of the BOOTP server, it will do the s a m e e v a l u a t i o n of t h e s e fields to d e t e r m i n e the a p p r o p r i a t e m e t h o d , unic a s t or b r o a d c a s t , to r e t u r n a reply to the client.

SECS This field allows the client to c o m m u n i c a t e h o w long it h a s b e e n trying to boot. If t h e client is forced to r e t r a n s m i t its BOOTREQUEST, this value will be nonzero, a n d c a n be u s e d to initiate priority h a n dling on the p a r t of the a g e n t a n d / o r the server.

UDP Port Number Normally, t h e client always u s e s UDP p o r t 67 (BOOTP Server) as a d e s t i n a t i o n port, a n d the server u s e s UDP port 68 (BOOTP Client) as its d e s t i n a t i o n port in a BOOTREPLY. However, a BOOTP Relay a g e n t r e s p o n d s only to p a c k e t s with the UDP port set to 67. This m e a n s if the server is s e n d i n g a BOOTREPLY m e s s a g e b a c k t h r o u g h a relay agent, it m u s t a d d r e s s this BOOTREPLY m e s s a g e to the a g e n t ' s a d d r e s s (GIADDR) with a UDP d e s t i n a t i o n port of 67 r a t h e r t h a n 68. The relay a g e n t will c h a n g e the d e s t i n a t i o n UDP port n u m b e r to 68 before it f o r w a r d s t h e p a c k e t b a c k to the client.


9Chapter 7

IP T r L Field A relay a g e n t either will set the TI'L field in the IP D a t a g r a m h e a d e r to a configured default value, or it will t a k e the existing v a l u e it received, a n d d e c r e m e n t it by one. This s e e m s to be a n o t h e r specification in the RFC t h a t is m o r e s u i t a b l e to a r o u t e r - b a s e d relay agent, r a t h e r t h a n s o m e o t h e r h o s t p e r f o r m i n g a relay function.

ALL O t h e r Fields All o t h e r fields in the BOOTP p a c k e t s h o u l d be p a s s e d b e t w e e n server a n d client w i t h o u t a n y modification.

BOOTP Implementation Checklist Use the following list as a r o u g h guideline to the s t e p s you s h o u l d t a k e in i m p l e m e n t i n g BOOTP Servers: 1.

First d e t e r m i n e if you really n e e d to u s e BOOTP. If y o u are i m p l e m e n t i n g d y n a m i c a d d r e s s i n g it is very possible t h a t DHCP w o u l d be a b e t t e r choice, since DHCP server i m p l e m e n t a t i o n s c a n often a c c o m m o d a t e older BOOTP clients, as well as DHCP clients.

2.

D e t e r m i n e the r a n g e of a d d r e s s e s y o u will be issuing, as well as a n y BOOTP options t h a t y o u w i s h to convey along with the a d d r e s s a s s i g n m e n t .

3.

G a t h e r a list of the h a r d w a r e a d d r e s s e s a n d a d d r e s s types for e a c h of the BOOTP clients.

4.

D e t e r m i n e if y o u will be u s i n g the r e m o t e boot f e a t u r e s of BOOTP, or j u s t the a d d r e s s a s s i g n m e n t p h a s e . If y o u are doing r e m o t e booting, p r e p a r e the a p p r o p r i a t e boot files a n d d e t e r m i n e the directory p a t h s for t h e s e files.

5.

Create the BOOTP d a t a b a s e file, u s i n g all the i n f o r m a t i o n y o u have g a t h e r e d .

6.

Install a n d configure the BOOTP server.

7.

Configure the clients to act as BOOTP clients.

333

334

Chapter 7

*


So

Test t h e functionality of the BOOTP server.

9.

C o n s i d e r the n e e d s for c r o s s - s u b n e t c o m m u n i c a t i o n b e t w e e n clients a n d servers, a n d configure a n d t e s t BOOTP Relay a g e n t s w h e r e a p p r o p r i a t e .

DHCP Implementation Checklist Use the following list as a r o u g h guideline to the s t e p s y o u s h o u l d t a k e in i m p l e m e n t i n g DHCP Servers: 1.

D e t e r m i n e the r a n g e of clients t h a t will u s e DHCP. Also d e t e r m i n e w h i c h h o s t s on the n e t w o r k will have static or reserved a d d r e s s a s s i g n m e n t s . C o n s i d e r w h e t h e r a n y BOOTP clients exist, a n d the s t r a t e g y t h a t will be u s e d by DHCP to a s s i g n their a d d r e s s e s .

2.

If n e c e s s a r y , configure a BOOTP d a t a b a s e file for u s e by the DHCP server in servicing BOOTP clients. E n s u r e t h a t a n y a d d r e s s e s i n c l u d e d in this file are n o t p a r t of a n y DHCP a d d r e s s pool.

3.

D e t e r m i n e the r a n g e of a d d r e s s e s t h a t will c o n s t i t u t e the a d d r e s s pool. If the DHCP server will service multiple s u b n e t s , d e t e r m i n e the a p p r o p r i a t e a d d r e s s scopes for e a c h s u b n e t a n d t h e a s s o c i a t e d p a r a m e t e r options t h a t y o u m a y w i s h to convey along with the a d d r e s s .

4.

Install and configure the DHCP server or servers based on the address ranges, exclusions, reserved addresses, and options t h a t will be associated with each address scope. Also decide on a n d configure an appropriate lease duration for the addresses.

5.

If multiple servers are used, c o n s i d e r p a r t i t i o n i n g e a c h a d d r e s s pool b e t w e e n two servers, to e n h a n c e reliability by providing s o m e r e d u n d a n c y .

6.

If clients a n d servers n e e d to c o m m u n i c a t e a c r o s s s u b n e t b o u n d a r i e s , configure BOOTP Relay Agents in a p p r o p r i a t e locations.

7.

Configure clients to u s e DHCP.

8.

T e s t the functionality of the DHCP server a n d Relay Agents.


9Chapter 7

Summary In this c h a p t e r we d i s c u s s e d the d y n a m i c a s s i g n m e n t of IP a d d r e s s es u s i n g t h e BOOTP a n d DHCP protocols. We covered the r e a s o n s for, a n d the h i s t o r y b e h i n d , the d e v e l o p m e n t of t h e s e protocols a n d l e a r n e d in detail h o w t h e y work. BOOTP a n d DHCP are closely related protocols. Both m a k e u s e of a specially defined p a c k e t t h a t u s e s a UDP d a t a g r a m a d d r e s s e d to specific UDP ports, n a m e l y port 68 (BOOTP client) a n d p o r t 67 (BOOTP server). This p a c k e t h a s a p a y l o a d c o n s i s t i n g of fields t h a t allow it to convey a d d r e s s a s s i g n m e n t s a n d o t h e r p a r a m e t e r s , as well as the i n f o r m a t i o n a client m a y n e e d to affect a r e m o t e boot a c r o s s the network. Clients initiate this p r o c e s s with a BOOTREQUEST p a c k e t to a server, a n d the server r e s p o n d s with a BOOTREPLY packet. The BOOTP p a c k e t c o n t a i n s a Vendor e x t e n s i o n s or Options field t h a t is u s e d to p a s s a d d i t i o n a l p a r a m e t e r s to t h e client. BOOTP i s s u e s a d d r e s s a s s i g n m e n t s a n d o t h e r p a r a m e t e r s b a s e d on a fiat-file d a t a b a s e t h a t m a t c h e s a client identifier, u s u a l l y its h a r d w a r e a d d r e s s , with the set of p a r a m e t e r s listed for t h a t client. Configuration of this file is a m a n u a l a d m i n i s t r a t i v e task. DHCP w a s designed to be a n e x t e n s i o n of BOOTP. It u s e s t h e s a m e p a c k e t definition, s a m e UDP ports, a n d the s a m e BOOTREQUEST a n d BOOTREPLY m e s s a g e s , b u t it relies very heavily on the Vendor e x t e n s i o n s field, w h i c h is n o w called simply the O p t i o n s field. E a c h DHCP m e s s a g e u s e s a DHCP m e s s a g e type option code, to define a p a r t of the DHCP process, as well as o t h e r option codes to p a s s DHCP-specific, as well as generic client c o n f i g u r a t i o n parameters. DHCP provides m o r e options in t e r m s of a d d r e s s a s s i g n m e n t s . It c a n h a n d o u t a d d r e s s e s from a BOOTP-like d a t a b a s e file, or it c a n h a n d a d d r e s s e s o u t on a first-come, first-served b a s i s from a n e s t a b l i s h e d a d d r e s s pool, s o m e t i m e s called a scope. DHCP configur a t i o n c a n be m u c h s i m p l e r t h a n BOOTP, since it is n o t n e c e s s a r y to m a t c h e a c h client m a n u a l l y to a n individual a d d r e s s a s s i g n m e n t . An a d d r e s s scope c a n be defined with a set of p a r a m e t e r s , s u c h as m a s k , default gateway, default DNS servers, etc., t h a t c a n be

335

336

Chapter 7


d i s t r i b u t e d to all D H C P clients in t h a t scope. D H C P c a n also a c c o m m o d a t e m u l t i p l e s c o p e s for different s u b n e t s , e a c h w i t h its o w n s e t of p a r a m e t e r options. Unlike BOOTP, D H C P c a n also be c o n f i g u r e d to a s s i g n a d d r e s s e s for a finite t i m e period, called a lease. D H C P clients are r e q u i r e d to r e n e w t h e i r lease on a n a d d r e s s periodically, or it will be r e c l a i m e d b y t h e s e r v e r once t h e l e a s e period expires, a n d will be r e a s s i g n e d to a n e w client. T h i s is a very u s e f u l f e a t u r e w h e n clients c o n n e c t t e m p o r a r i l y to a n e t w o r k , or w h e r e t h e r e is a s h o r t a g e of IP a d d r e s s e s available. D H C P s e r v e r s m a i n t a i n a d a t a b a s e of all t h e a d d r e s s e s t h e y h a v e a s s i g n e d , to w h o m t h e y w e r e a s s i g n e d , a n d h o w long t h e l e a s e p e r i o d is. T h i s p r e v e n t s t h e s e r v e r f r o m h a n d i n g o u t d u p l i c a t e addresses. To a c c o m m o d a t e client r e q u e s t s t h a t c r o s s s u b n e t b o u n d a r i e s , t h e BOOTP specification i n c l u d e s t h e definition of a BOOTP Relay a g e n t , w h i c h l i s t e n s for client r e q u e s t s on its local s u b n e t , a n d forw a r d s t h e m a s u n i c a s t m e s s a g e s a c r o s s r o u t e r b o u n d a r i e s to t h e server. It p e r f o r m s t h e r e v e r s e f u n c t i o n for t h e s e r v e r a s well. B o t h BOOTP a n d D H C P c a n m a k e u s e of BOOTP Relay a g e n t s .


9Chapter 7

Q: W h e n w o u l d I u s e BOOTP i n s t e a d of DHCP?

A: In m o s t c a s e s it is b e t t e r to u s e DHCP i n s t e a d of BOOTP, if t h e clients s u p p o r t it. This is b e c a u s e DHCP will do e v e r y t h i n g t h a t BOOTP will do a n d more. T h e c o n f i g u r a t i o n p r o c e s s w i t h BOOTP is entirely m a n u a l , a n d c a n be a f o r m i d a b l e t a s k for a large n e t w o r k . By c o n t r a s t , DHCP c a n be relatively e a s y to configure, even for large n e t w o r k s , since y o u only n e e d to define a n a d d r e s s r a n g e a n d a c o m m o n set of p a r a m e t e r s for e a c h a d d r e s s pool to service a large n u m b e r of clients.

Q. W h a t is a n RFC 1 5 4 2 - c o m p l i a n t r o u t e r ?

A: This t e r m is often f o u n d in d o c u m e n t a t i o n d e a l i n g w i t h t h e i m p l e m e n t a t i o n of DHCP a n d BOOTP. It refers to t h e definition of a BOOTP Relay A g e n t a n d t h e f u n c t i o n s of t h a t agent. S i m p l y put, a n RFC 1 5 4 2 - c o m p l i a n t r o u t e r is one t h a t c a n be c o n f i g u r e d to a c t a s a BOOTP Relay Agent. R e m e m b e r t h a t t h e relay a g e n t d o e s n o t h a v e to be a router, b u t c a n be i m p l e m e n t e d on a h o s t s y s t e m t h a t r e s i d e s on t h e s a m e s u b n e t a s t h e clients.

Q: If I c o n f i g u r e m u l t i p l e s c o p e s on a DHCP server, h o w d o e s t h e s e r v e r k n o w w h i c h s c o p e to u s e for a given client? A: T h e w a y t h a t a DHCP s e r v e r d e c i d e s on w h i c h s c o p e is to be u s e d for a given client d e p e n d s on t h e s u b n e t to w h i c h t h e client is c o n n e c t e d . This s u b n e t i n f o r m a t i o n c o m e s to t h e s e r v e r b y m e a n s of t h e GIADDR field in t h e BOOTP p a c k e t . This field is e m p t y w h e n a client is on t h e s a m e s u b n e t a s t h e server, a n d c o n t a i n s t h e a d d r e s s of t h e BOOTP Relay A g e n t otherwise. This a g e n t a d d r e s s is on t h e s a m e s u b n e t a s t h e client, so t h e s e r v e r c a n r e a d t h i s a d d r e s s to d e t e r m i n e t h e client's c o n n e c t e d subnet.

337

338

Chapter

7

9Automatic

Assignment of IP Addresses with BOOTP and DHCP Objectives

Q: How does DNS w o r k w i t h DHCP? A: T h e s h o r t a n s w e r is, "Not very well." T h e p r o b l e m is t h a t u n l e s s e a c h client is a s s i g n e d a specific a d d r e s s r e s e r v a t i o n , it is n o t possible, u n t i l after t h e fact, to d e t e r m i n e w h i c h IP a d d r e s s w a s a s s i g n e d to a client. Since t r a d i t i o n a l DNS s e r v e r implementations use a statically-configured database, this can p o s e s o m e p r o b l e m s . T h e r e are several w o r k a r o u n d s to this. T h e r e are p r o d u c t s c o m m e r c i a l l y available t h a t will link DHCP s e r v e r s a n d DNS servers, so t h a t w h e n a n a d d r e s s a s s i g n m e n t is m a d e , t h e DNS s e r v e r d a t a b a s e is u p d a t e d . In Microsoft e n v i r o n m e n t s , t h i s p r o b l e m h a s b e e n h a n d l e d u s i n g a WINS (Windows I n t e r n e t N a m e Service) server. WINS clients r e g i s t e r t h e m s e l v e s d y n a m i c a l l y w i t h t h e WINS s e r v e r after t h e y h a v e received a DHCP a d d r e s s a s s i g n m e n t . The n a m e r e s o l u t i o n p r o c e s s c h e c k s b o t h DNS a n d WINS s e r v e r s to o b t a i n a n a m e r e s o l u t i o n . As long a s t h e s a m e n a m e is b e i n g u s e d for t h e NetBIOS n a m e a n d t h e I n t e r n e t h o s t n a m e , t h i s p r o c e s s will r e s u l t in a n a m e - t o - a d d r e s s t r a n s l a t i o n for e i t h e r n a m e type.

340

Chapter 8 * Multicast

Addressing

What Is Multicast? M u l t i c a s t is a t e c h n o l o g y u s e d to a d d r e s s m u l t i p l e h o s t s a s a g r o u p . A h o s t m u l t i c a s t s to a g r o u p of h o s t s b y s e n d i n g a n IP p a c k e t to a special IP a d d r e s s t h a t identifies t h e g r o u p . An IP a d d r e s s is u s e d to d e s i g n a t e a g r o u p of h o s t s . T h e IP a d d r e s s t h a t defines a m u l t i c a s t g r o u p is in t h e r a n g e of 2 2 4 . 0 . 0 . 0 to 2 3 9 . 2 5 5 . 2 5 5 . 2 5 5 , defined a s C l a s s D a d d r e s s e s . E a c h g r o u p h a s its specific IP a d d r e s s in t h a t r a n g e , so m a n y g r o u p s c a n be defined a t t h e s a m e t i m e b y u s i n g a different IP a d d r e s s . T h e m e m b e r s h i p in a g r o u p is d y n a m i c b e c a u s e h o s t s c a n j o i n a n d leave t h e g r o u p a s t h e y w a n t . T h e m u l t i c a s t s t a n d a r d is d e s c r i b e d in RFC 1112. M u l t i c a s t is s i m i l a r to b r o a d c a s t since only one p a c k e t is s e n t to all h o s t s , w h e r e a s u n i c a s t m e a n s t h a t one p a c k e t is s e n t to one h o s t . However, m u l t i c a s t differs f r o m b r o a d c a s t b e c a u s e b r o a d c a s t ing involves s e n d i n g a p a c k e t to all h o s t s , w i t h o u t exception, on t h e specified n e t w o r k , w h e r e a s m u l t i c a s t s e n d s a p a c k e t to t h e g r o u p of h o s t s . T h o s e h o s t s t h a t a r e n o t p a r t of t h e g r o u p will n o t p r o c e s s t h e m u l t i c a s t p a c k e t s i n c e it is n o t a d d r e s s e d to t h e m . O n e typical e x a m p l e of m u l t i c a s t i n g is to l i s t e n to a videoconfere n c e u s i n g a 2 M b i t s / s e c c h a n n e l on a n e t w o r k . Not all u s e r s of a n e t w o r k m a y w a n t to l i s t e n to t h e v i d e o c o n f e r e n c e , so t h e i d e a is to j o i n t h e g r o u p , or t h e v i d e o c o n f e r e n c e in t h i s case. F u r t h e r m o r e , if 10 u s e r s of t h e s a m e p h y s i c a l n e t w o r k w a n t to l i s t e n to t h i s videoconference, then using u n i c a s t technology m e a n s using 2 M b i t s / s e c * 10 u s e r s = 20 M b i t s / s e c s u s t a i n e d for t h o s e u s e r s . More u s e r s m e a n s m o r e b a n d w i d t h u s e d . By u s i n g m u l t i c a s t , only one c h a n n e l of 2 M b i t s / s e c is u s e d , i n d e p e n d e n t l y of t h e n u m b e r of u s e r s : even 1000 u s e r s will still u s e only 2 M b i t s / s e c .

Multicast Addressing

9Chapter 8

Mapping IP Multicast to the Link Layer Like a n y o t h e r IP p a c k e t s , IP m u l t i c a s t p a c k e t s have to be m a p p e d to the link layer a d d r e s s e s . M u l t i c a s t h a s b e e n defined for the link layers of E t h e r n e t , T o k e n Ring, a n d others, like ATM. On E t h e r n e t , the low-order 23 bits of the IP m u l t i c a s t a d d r e s s is placed in the lower p a r t of t h e E t h e r n e t m u l t i c a s t a d d r e s s 0 1 - 0 0 - 5 E - 0 0 - 0 0 - 0 0 . RFC 1469 d e s c r i b e s m u l t i c a s t over T o k e n Ring a n d R F C 2 0 2 2 d e s c r i b e s ATM n e t w o r k s .

Joining the Group To join a m u l t i c a s t g r o u p either by a u s e r who w a n t s to listen to a m u l t i m e d i a c h a n n e l or by a specific application, it is a c t u a l l y very simple: the k e r n e l h a s to be configured to p r o c e s s t h e IP m u l t i c a s t a d d r e s s of the g r o u p or c h a n n e l . Then, all p a c k e t s w i t h a n IP destin a t i o n a d d r e s s as the g r o u p IP m u l t i c a s t a d d r e s s will be p r o c e s s e d by the h o s t a n d s e n t to the u p p e r layer applications. But, if the m u l t i c a s t c h a n n e l c o m e s from far a w a y ( m e a n i n g t h a t it c o m e s from a n o t h e r network), it is possible t h a t t h i s c h a n n e l is n o t c u r r e n t l y m u l t i c a s t e d on the local n e t w o r k of the host. In this case, the h o s t will have to tell its n e i g h b o r r o u t e r t h a t it w a n t s to listen to t h i s m u l t i c a s t c h a n n e l . This is done u s i n g the I n t e r n e t G r o u p M a n a g e m e n t Protocol (IGMP), d o c u m e n t e d in RFC2236. T h e n this r o u t e r will try to get t h a t c h a n n e l from its s o u r c e a n d s e n d the

341

342

Chapter 8 * Multicast Addressing

m u l t i c a s t p a c k e t s of t h a t c h a n n e l to the local network. This entire process involves routing m u l t i c a s t over the larger network.

IGMP W h e n a h o s t joins a m u l t i c a s t group, it s e n d s a report to the allh o s t s group (224.0.0.1) on its local network. Routers can t h e n learn who is joining which group. W h e n a h o s t is leaving a m u l t i c a s t group, it s e n d s a report to the all-routers group (224.0.0.2) on its local network. Routers also send queries periodically to a n all-hosts group a d d r e s s to r e q u e s t reports of group m e m b e r s h i p to all h o s t s on each m u l t i c a s t n e t w o r k to w hi c h it connects. In this way, a m u l t i c a s t r o u t e r k n o w s the m e m b e r s h i p of all g r o u p s for all m u l t i c a s t hosts. RFC2236 describes in detail all the state d i a g r a m s a n d transitions of IGMP for h o s t s a n d routers.

Multicast Routing Protocols Since m u l t i c a s t ne e ds special processing for routers, the IETF defines m u l t i c a s t routing protocols to help r o u t e r s control the routing of those m u l t i c a s t c h a n n e l s over the networks. The first one w a s Distance Vector Multicast Routing Protocol (DVMRP), w h ich h a s b e e n u s e d a lot; however, the RFC (RFC 1075) now h a s experimental s t a t u s , w hi c h m e a n s t h a t its i m p l e m e n t a t i o n is not r e c o m m e n d e d . This m u l t i c a s t routing protocol w a s b a s e d on the Routing Information Protocol (RIP), a n d inherits its simplicity. Other protocols have be e n developed for m u l t i c a s t routing, like the Protocol I n d e p e n d e n t Multicast (PIM) protocol a n d Multicast extensions to OSPF (MOSPF). Within the IETF, there h a s b e e n work on e n h a n c i n g the multicast routing a n d other related issues, mostly u n d e r the mboned, idmr, pim, a n d malloc working groups.


9Chapter 8

Mbone It is often really i m p o r t a n t to t e s t s t a n d a r d s on a real n e t w o r k w i t h real u s e r s . T h e M b o n e (Multicast b a c k b o n e ) is a n initiative of v o l u n t e e r s w h o t e s t m u l t i c a s t t e c h n o l o g y over t h e I n t e r n e t . It is still u s e d f r e q u e n t l y d u r i n g m u l t i c a s t e v e n t s a n d to t e s t n e w p r o t o c o l s or applications. B e c a u s e n o t all t h e ISPs s u p p o r t m u l t i c a s t n a t i v e l y in t h e i r infras t r u c t u r e a n d r o u t e r s , t h e M b o n e w a s c r e a t e d b y u s i n g a m i x of t u n n e l s a n d n a t i v e m u l t i c a s t links.

343

344

Chapter

8 *


Multicast Addresses M u l t i c a s t a d d r e s s e s are in t h e 2 2 4 . 0 . 0 . 0 to 2 3 9 . 2 5 5 . 2 5 5 . 2 5 5 r a n g e , or in b i n a r y h a v e t h e four h i g h - o r d e r b i t s a s 1110. T h i s is defined a s C l a s s D a d d r e s s e s . C l a s s E a d d r e s s e s , w h i c h cover t h e 2 4 0 . 0 . 0 . 0 to 2 5 5 . 2 5 5 . 2 5 5 . 2 5 5 r a n g e , h a v e b e e n r e s e r v e d for f u t u r e a d d r e s s i n g modes.

Transient and Permanent Addresses Two t y p e s of m u l t i c a s t a d d r e s s e s c a n be defined: t h e p e r m a n e n t a n d t h e t r a n s i e n t . T h e p e r m a n e n t a d d r e s s e s are defined in t h e protocol itself, a s t h e a l l - h o s t s a n d a l l - r o u t e r s d e s c r i b e d in t h e n e x t section. P e r m a n e n t a d d r e s s e s c a n also be a s s i g n e d b y t h e IANA for o t h e r p r o t o c o l s or o t h e r u s e s . T r a n s i e n t a d d r e s s e s a r e u s e d for s o m e period of time. F o r e x a m ple, a t r a n s i e n t a d d r e s s will be u s e d to m u l t i c a s t a v i d e o c o n f e r e n c e of a n event. After t h e e v e n t is finished, t h e t r a n s i e n t a d d r e s s c a n be r e u s e d . In t h i s way, t h e r e s h o u l d be c o o r d i n a t i o n of t r a n s i e n t a d d r e s s e s u s e d to be s u r e t h a t two people or o r g a n i z a t i o n s will n o t u s e t h e s a m e t r a n s i e n t a d d r e s s for different n e e d s . B a c k in t h e old d a y s of t h e Mbone, y o u e i t h e r p r e a n n o u n c e it on a specific M b o n e c h a n n e l or on a Web page. C u r r e n t l y , IETF w o r k i n g g r o u p s a r e defining a m o r e p r o t o c o l - b a s e d a p p r o a c h .

Generic Assignments In t h e protocol definition, s o m e a d d r e s s e s have already b e e n reserved. The a d d r e s s 2 2 4 . 0 . 0 . 0 is reserved a n d g u a r a n t e e d n o t to be a s s i g n e d to a n y group. The a d d r e s s 224.0.0.1 is a s s i g n e d to all IP h o s t s on t h e directly c o n n e c t e d network. In o t h e r words, it is a link-local a d d r e s s . Any hosts, including routers, p r i n t e r s a n d the like, are m e m b e r s of this group. So as soon as a n IP device is configured for m u l t i c a s t , it is a u t o m a t i c a l l y a n d statically a m e m b e r of this group. The a d d r e s s 2 2 4 . 0 . 0 . 2 is a s s i g n e d to all IP r o u t e r s on t h e directly c o n n e c t e d network. Only r o u t e r s are m e m b e r s of this group.


9Chapter 8

IANA Assignments RFC 1112 didn't define p e r m a n e n t addresses other than the allhosts address. But the task of assigning p e r m a n e n t multicast addresses has been done by the Internet Assigned Numbers Authority (IANA). IANA assigns addresses in the 2 2 4 . 0 . 0 . 0 to 2 2 4 . 0 . 0 . 2 5 5 range "for the u s e of routing protocols and other low-level topology discovery or m a i n t e n a n c e protocols, s u c h as gateway discovery and group membership reporting. Multicast routers should not forward any multicast datagram with destination addresses in this range, regardless of its TI'L." For example, in that range, multicast addresses have been assigned for the u s e of some protocols: 224.0.0.4

DVMRP

Routers

224.0.0.5

OSPFIGP

OSPFIGP All Routers

224.0.0.6

OSPFIGP

OSPFIGP Designated Routers

224.0.0.9

RIP2 Routers

224.0.0.12

DHCP Server

224.0.0.13

All PIM Routers

/ Relay Agent

224.0.0.18 VRRP 224.0.0.22

IGMP

In the 2 2 4 . 0 . 1 . 0 + range, multicast addresses are defined for protocols but can be forwarded by routers like: 224.0. i. 1

NTP

Network Time Protocol

224.0. i. 3

Rwhod

SUN NIS+

Information

224.0.1.22

SVRLOC Service Location Protocol

224.0.1.75

SIP Session

Service Initiation

Protocol

Or, addresses are assigned to "permanent" conferencing, like the IETF events: 224.0. i. i0 IETF-I-LOW-AUDIO 224.0. i. Ii IETF-I-AUDI0 224.0. i. 12 IETF-I-VIDEO

345

346

Chapter

8


9

224.0. i. 13 IETF-2-LOW-AUDIO 224.0. i. 14 IETF-2-AUDIO 224.0. I. 15 IETF-2-VIDEO

For IPv6, the first a s s i g n m e n t s are defined in RFC2375. O t h e r s are h a n d l e d by IANA. The c u r r e n t list of a s s i g n m e n t s is available at: ftp" / / ftp. iana. o r g / i n - n o t e s / i a n a / a s s i g n m e n t s / m u l t i c a s t - a d d r e s s e s .

Scope of Multicast Addresses Using TTL W h e n holding a n i n t e r n a l videoconference inside the c o m p a n y , we w o u l d like to e n s u r e t h a t this conference will n o t be received or s e e n on the I n t e r n e t or o u t s i d e the c o m p a n y . Even w i t h i n the c o m p a n y network, we also m i g h t w a n t to r e s t r i c t the conference to one s u b net. Scoping h a s b e e n realized by u s i n g the TTL field in the IP h e a d er. By u s i n g T r L = 1, this tells a n y IP r o u t e r n o t to forward t h i s p a c k e t to a n o t h e r network, since e a c h r o u t e r m u s t d e c r e a s e by 1 the TTL field, a n d if the TI'L = 0, t h e n the p a c k e t s h o u l d n o t be forw a r d e d . TI'L w a s t h e r e to detect r o u t i n g loops, as d e s c r i b e d in previous chapters. In m u l t i c a s t , scoping of m u l t i c a s t a d d r e s s e s w a s b a s e d on the TTL v a l u e of the IP packet, a n d so is controlled by the s o u r c e host. By defining specific t h r e s h o l d s a n d by configuring a p p r o p r i a t e l y the m u l t i c a s t r o u t e r s , Mbone people were able to scope m a n y b u t n o t all of the s i t u a t i o n s . Scoping u s i n g the TTL w o r k s h a s s o m e limitations, b e c a u s e it is b a s e d on the n u m b e r of r o u t e r s in the n e t w o r k topology, n o t on the a d m i n i s t r a t i v e b o u n d a r i e s . Also it conflicts with s o m e r o u t i n g functions, like p r u n i n g .

Administrative Scopes A n e w scoping a p p r o a c h b a s e d on special m u l t i c a s t a d d r e s s e s in the r a n g e 2 3 9 . 0 . 0 . 0 to 2 3 9 . 2 5 5 . 2 5 5 . 2 5 5 h a s b e e n defined in RFC2365. It is b a s e d on a n a d m i n i s t r a t i v e scope i n s t e a d of a n e t w o r k topology


9Chapter 8

scope. So t h e n e t w o r k m a n a g e r c a n c o n f i g u r e t h e a d m i n i s t r a t i v e s c o p e a s n e e d e d , w i t h o u t t a k i n g c a r e of t h e n e t w o r k topology. T h e following s c o p e s a r e defined: 9 T h e IPv4 Local Scope, defined a s 2 3 9 . 2 5 5 . 0 . 0 / 1 6 , is for a n y local m u l t i c a s t c h a n n e l s . T h e locality is s i t e - d e p e n d e n t , b u t we c a n define local scope to h a v e one site in a city b y c o n f i g u r i n g its site b o u n d a r y r o u t e r s n o t to f o r w a r d local scope multicast packets. 9 T h e IPv4 O r g a n i z a t i o n Local Scope, defined a s 2 3 9 . 1 9 2 . 0 . 0 / 1 4 , is for a n o r g a n i z a t i o n s c o p e t h a t c a n i n c l u d e m a n y sites. 9

Link-local scope, defined a s 2 2 4 . 0 . 0 . 0 / 2 4 .

9 T h e global s c o p e ( m e a n i n g t h e full I n t e r n e t ) is defined a s 224.0.1.0-238.255.255.255.

IP Stacks and Multicast M o s t c u r r e n t IP s t a c k s s u p p o r t m u l t i c a s t , e i t h e r i n s t a l l e d b y d e f a u l t or c o n f i g u r e d to do so. It is n o t e a s y to find w h e t h e r t h e k e r n e l of a c o m p u t e r s u p p o r t s m u l t i c a s t . T h e b a s i c w a y is to find if t h e h o s t h a s t h e a l l - h o s t s a d d r e s s (224.0.0.1) configured, since, b y definition, if a h o s t is m u l t i c a s t - e n a b l e d , t h i s a d d r e s s is configured. A n o t h e r (harder) w a y is to s e n d a n a l l - h o s t s (224.0.0.1) p a c k e t on t h e local n e t w o r k a n d h a v e a n e t w o r k sniffer see w h o r e s p o n d s to it. A n o t h e r w a y is to u s e c o m m a n d s t h a t s h o w t h e 2 2 4 . 0 . 0 . 1 a d d r e s s . O n Unix a n d NT, u s i n g n e t s t a t - r n c a n s h o w a r o u t e to t h e m u l t i c a s t g r o u p

347

348

Chapter 8


9

2 2 4 . 0 . 0 . 1 . F i g u r e 8.1 s h o w s a n e x a m p l e of a n e t s t a t c o m m a n d on a S u n Solaris 2.6 c o m p u t e r .

Figure 8.1 Netstat command on Solaris. Sun Microsystems hostl% netstat

Inc.

SunOS 5.6

Generic August 1997

-rn

Rout ing Table : Destination

Gateway

Flags

Ref

Use

Interface

198.202.48.128

198.202.48.134

U

3

9310

hme0

224.0.0.0

198.202.48.134

U

3

0

hme0

default

198.202.48.131

UG

0

153900

127.0.0.1

127.0.0.1

UH

0

0

io0

T h e s e c o n d line in t h e r o u t i n g table s h o w s t h a t 2 2 4 . 0 . 0 . 0 n e t w o r k is available, w h i c h m e a n s t h a t m u l t i c a s t is e n a b l e d on t h a t c o m p u t e r .

Why Multicast? T h e first a n d m o s t w e l l - k n o w n u s e of m u l t i c a s t is to save b a n d w i d t h w h e n c a s t i n g a v i d e o c o n f e r e n c e to a n u m b e r of u s e r s . B u t m u l t i c a s t c a n do more.

Efficiency of Bandw dth Usage and Scaling As d i s c u s s e d in t h i s c h a p t e r , m u l t i c a s t h a s b e e n u s e d s i n c e t h e b e g i n n i n g to save b a n d w i d t h , especially for a n y c o n t e n t t h a t is for m a n y u s e r s , for e x a m p l e , a u d i o a n d video. O t h e r e x a m p l e s a r e netn e w s s e n t to m a n y s e r v e r s a n d software u p g r a d e s for a w h o l e netw o r k s e n t to all h o s t s . All t h e s e e x a m p l e s save b a n d w i d t h b y s e n d i n g only one copy of t h e c o n t e n t w h a t e v e r t h e n u m b e r of clients, i n s t e a d of one copy p e r client in t h e s t a n d a r d u n i c a s t way.


9Chapter 8

Discovering M a n y d i s c u s s i o n s on IP are related to m a k i n g it easier a n d a u t o c o n figurable, a n d e n a b l i n g devices to discover "automatically" servers, services, a n d t h e like. E x a m p l e s of this are wireless a n d s m a l l devices t h a t do n o t h a v e p e r m a n e n t m e m o r y , a n d h a v e to discover w h e r e t h e y are, who t h e y are, a n d w h i c h services are available. A n o t h e r e x a m p l e is the f a m o u s "dentist office," m e a n i n g t h a t IP s h o u l d be able to be m o r e p l u g - a n d - p l a y , so a d e n t i s t c a n deploy a n IP n e t w o r k of m a n y devices w i t h o u t a n e t w o r k a d m i n i s t r a t o r . A l t h o u g h IPv6 h e l p s a lot in this a n d is the key technology for t h a t p u r p o s e , m u l t i c a s t is very interesting, b e c a u s e h o s t s t h a t n e e d to discover t h i n g s c a n m u l t i c a s t their r e q u e s t on specific c h a n n e l s in o r d e r to get m o r e i n f o r m a t i o n from listening servers. This is a c t u a l l y being i m p l e m e n t e d in the Service Location Protocol (SLP), d e s c r i b e d in RFC2608. IPv6 u s e s m u l t i c a s t to get t h i s a u t o c o n f i g u r a t i o n working. Even more, IPv6 u s e s m u l t i c a s t for r e n u m b e r i n g a whole network, w h e n the organization c h a n g e s its ISP a n d n e e d s to r e n u m b e r . In c o m p a r i s o n , in IPv4, r e n u m b e r i n g is a complex a n d very difficult task. C h a p t e r s 9 a n d 10 cover IPv6.

Efficient Channel W i t h o u t m u l t i c a s t , the only w a y to s e n d a p a c k e t to c o m p u t e r s t h a t have t h e s a m e c h a r a c t e r i s t i c s (like r u n n i n g a specific protocol) or are r o u t e r s , w a s either to k n o w the a d d r e s s e s of t h e m , w h i c h is a very difficult t a s k w h e n the n u m b e r is i m p o r t a n t , or to u s e b r o a d cast. If b r o a d c a s t s were u s e d for all t h o s e p u r p o s e s , t h e n all comp u t e r s w o u l d have to p r o c e s s t h o s e p a c k e t s , even if the p a c k e t is n o t for t h e m . Not only that, b u t b r o a d c a s t is limited to the linklocal, w h e r e m u l t i c a s t c a n be u s e d over m u l t i p l e n e t w o r k s . So m u l t i c a s t is a n e a s y w a y to s e n d i n f o r m a t i o n to u n k n o w n p a r t i e s t h a t s h a r e t h e s a m e c h a r a c t e r i s t i c s w i t h o u t d i s t u r b i n g others.

349

350

Chapter

8


9

Industry The h i s t o r y of m u l t i c a s t s h o w s t h a t i n d u s t r y w a s n o t very s u p p o r t ive. B u t now, a n i n d u s t r y c o n s o r t i u m h a s b e e n formed on IP multic a s t by S t a r d u s t Inc. This will help m u l t i c a s t to be u s e d a n d deployed, a n d to deliver p r o d u c t s to the m a r k e t . I n f o r m a t i o n is available at h t t p : / / w w w . i p m u l t i c a s t . c o m . They provide very good i n f o r m a t i o n on everything related to IP m u l t i c a s t a n d also organize events a n d meetings. Excellent t e c h n i c a l white p a p e r s a n d refere n c e s are available at this site.

Summary M u l t i c a s t is a g r e a t technology t h a t e n a b l e s a g r o u p of c o m p u t e r s s h a r i n g a m u l t i c a s t a d d r e s s to c o m m u n i c a t e together. The IP a d d r e s s e s u s e d in m u l t i c a s t are from 2 2 4 . 0 . 0 . 0 to 239.255.255.255, defined as Class D a d d r e s s e s . Class E a d d r e s s e s are reserved for f u t u r e a d d r e s s i n g needs. With IGMP a n d m u l t i c a s t r o u t i n g protocols, a n e t w o r k with s u b n e t s as well as the I n t e r n e t by the Mbone, c a n be configured to u s e a n d forward m u l t i c a s t p a c k e t s . Hosts c a n r e p o r t t h e y are joining or leaving a g r o u p u s i n g IGMP. A l t h o u g h a few a d d r e s s e s , like 224.0.0.1 as a l l - h o s t s a n d 2 2 4 . 0 . 0 . 2 as aU-routers, on the local n e t w o r k are defined in the protocol, IANA is the a u t h o r i t y t h a t a s s i g n s o t h e r m u l t i c a s t a d d r e s s e s . Scoping is a n i m p o r t a n t i s s u e of m u l t i c a s t . The t r a d i t i o n a l w a y u s e s the TTL IP h e a d e r field to m a n a g e the scope, b u t it h a s s o m e l i m i t a t i o n s d e p e n d i n g on the need. A n e w r a n g e of m u l t i c a s t a d d r e s s e s have b e e n a s s i g n e d a n d defined as Local Scope a n d O r g a n i z a t i o n a l Local Scope to help o r g a n i z a t i o n s m a n a g e the scope of the m u l t i c a s t traffic. M u l t i c a s t c a n be u s e d for effective b a n d w i d t h usage, discovery, a n d efficient c h a n n e l s . IPv6 u s e s m u l t i c a s t in its core f u n c t i o n s a n d i n d u s t r y is s u p p o r t i n g it. You are invited to join the Mbone if y o u w a n t s to l e a r n by practice.


Q: Which

9Chapter 8

IP multicast addresses have been allocated?

A: Allocation of IP multicast addresses is done by IANA (http://www.iana.org). The current list of assignments can be found at f t p : / / f t p . i a n a . o r g / i n - n o t e s / i a n a / a s s i g n m e n t s / multic ast - ad dresses.

Q: Who

is working on multicast protocols and s t a n d a r d s ?

A: Many IETF working groups are working on multicast. Please refer to the IETF working group pages to get the most current work (http: //www.ietf.org).

References [RFC 1075] "Distance Vector Multicast Routing Protocol." D. Waitzman, C. Partridge, S.E. Deering. Nov-01-1988. (Status: Experimental) [RFCI 112] "Host Extensions for IP Multicasting." S.E. Deering. Aug-0 i- 1989. Obsoletes RFC0988, RFC 1054; updated by RFC2236 and STD0005. (Status: Standard) [RFC 1469] "IP Multicast over Token-Ring Local Area Networks. T. Pusater. J u n e , 1993. (Status: Proposed Standard)

351

352

Chapter

8


9

[RFC2022] "Support for Multicast over UNI 3.0/3.1 based ATM Networks." G. Armitage. November, 1996. (Status: Proposed Standard) [RFC2236] "Internet Group Management Protocol, version 2." W. Fenner. November, 1997. Updates RFC 1112. (Status: Proposed Standard) [RFC2608] "Service Location Protocol, version 2." E. Guttman, C. Perkins, J. Veizades, M. Day. June, 1999. Updates RFC2165. (Status: Proposed Standard)

354

Chapter 9

9IPv6 Addressing

Introduction First, in order to u n d e r s t a n d h o w IP version 6 (IPv6) c a n solve s o m e of t h e c u r r e n t a n d f u t u r e p r o b l e m s e n c o u n t e r e d with IP version 4 (IPv4), we m u s t u n d e r s t a n d the m o t i v a t i o n for its inception. This c h a p t e r will give a s h o r t i n t r o d u c t i o n to the h i s t o r y a n d developm e n t of the IPv6 protocol, t h r o u g h its c u r r e n t a c c e p t e d form. Second, we will look at s o m e of the key a s p e c t s of IPv6 t h a t sepa r a t e the protocol from IPv4, a n d look into the benefits t h a t we c a n gain by utilizing IPv6 a n d its a d d r e s s i n g s c h e m a s to build a m o r e scalable network. F r o m there, we c a n begin to build real-world e x a m p l e s of h o w this a d d r e s s i n g c a n be deployed in I n t e r n e t - c o n n e c t e d n e t w o r k s to come. Finally, we will look into s o m e of IPv6's o u t s t a n d i n g i s s u e s a n d its a d d r e s s i n g s c h e m e s , a n d s o m e of the p r o p o s e d s o l u t i o n s to cope with t h e s e yet u n s o l v e d issues. Also in this section, we will give a brief i n t r o d u c t i o n to the IPv6 t e s t network, the 6Bone.

IPv6 Addressing Basics By the early 1990s, it w a s clear t h a t the I n t e r n e t w a s going to t a k e off. The average p e r s o n w a s b e c o m i n g a w a r e of its existence, a n d t h e k i l l e r - a p p s of t o d a y (Web browsers) were coming into t h e i r own. This d r a m a t i c i n c r e a s e in u s a g e of the I n t e r n e t , w h i c h s t e m m e d from o u t s i d e the r e s e a r c h c o m m u n i t y , w a s clearly n o t going to go away. A d d r e s s s p a c e delegations i n c r e a s e d at a n a l a r m i n g rate, a n d it w a s clear t h a t the I n t e r n e t Protocol version 4 h a d a foreseeable u p p e r limit in t e r m s of the n u m b e r of entities it could c o n n e c t to t h e e v e r - i n c r e a s i n g worldwide I n t e r n e t . The I n t e r n e t E n g i n e e r i n g T a s k Force (IETF), the s t a n d a r d s g r o u p from w h i c h a large portion of I n t e r n e t technologies emerge, w a s b e g i n n i n g to see this as a n i s s u e t h a t n e e d e d to be tackled earlier r a t h e r t h a n later. At p r e s e n t , for

IPv6 Addressing

9Chapter 9

example, regional n u m b e r i n g a u t h o r i t i e s (such as ARIN, RIPE, APNIC, etc.) are delegating n u m b e r s from w i t h i n the 2 1 6 / 8 n e t w o r k block. In 1996, by c o n t r a s t , ARIN w a s only delegating in the 2 0 8 / 8 range. This w o u l d m e a n t h a t j u s t over 150 million h o s t s were a d d e d to the I n t e r n e t in this t h r e e - y e a r s p a n (if delegations a n d a d d r e s s a s s i g n m e n t s were m a d e efficiently). We calculate this by raising 2 to the power of 24 (for e a c h / 8 ) a n d multiplying by 9. A l t h o u g h the I n t e r n e t / s growing at a n a l a r m i n g rate, a n d slowly w o r k i n g its w a y into o u r d a y - t o - d a y lives, it is clear t h a t 150 million h o s t s were n o t added. There w a s a m a j o r p r o b l e m with a d d r e s s allocation, even after the efforts of CIDR (Classless I n t e r - D o m a i n Routing) were i m p l e m e n t e d . A d d r e s s space w a s being w a s t e d . F u r t h e r m o r e , we k n o w t h a t 2 2 4 / 8 - 2 3 9 / 8 is set aside for m u l t i c a s t , a n d t h a t 2 4 0 / 8 - 2 5 5 / 8 is reserved. F r o m this, we c a n see t h a t we are n e a r i n g o u r end (although s o m e of the a d d r e s s e s in the middle, from 6 4 / 8 - 1 2 8 / 8 , are j u s t n o w being delegated, so it will b u y a little m o r e time t h a n expected). Now we see t h a t n o t only w a s t h e r e n o t e n o u g h s p a c e to t a k e u s far b e y o n d the m i l l e n n i u m , b u t also m u c h of the c u r r e n t l y delegated a d d r e s s s p a c e w a s being w a s t e d . Additionally, a g r e a t e r n e e d for e n h a n c e d Network-Layer (Layer 3 on the OSI stack) f e a t u r e s w a s b e g i n n i n g to emerge, for example, e n d - t o - e n d encryption, a u t h e n t i cation of p a c k e t s , s o u r c e - r o u t i n g , a n d Quality of Service. For all of t h e s e r e a s o n s , it w a s b e c o m i n g a p p a r e n t t h a t a n e w I n t e r n e t Protocol, or IP, w a s going to have to be conceived a n d a d o p t e d for the f u t u r e of the Internet. This is w h e r e the fun began. As people b e g a n to see t h e s e factors as a reality, m a n y p r o p o s a l s for a n e w I n t e r n e t Protocol emerged. The first draft t h a t gained w i d e s p r e a d notice w a s loosely b a s e d on the CLNP (Connection-Less Network Protocol), w h i c h w a s b a s e d u p o n a n o t h e r protocol suite, the OSI stack. This s t a c k originally r a n on the early Internet, b u t w a s quickly replaced by IPv4 w h e n the I n t e r n e t b e g a n to t a k e on

355

356

Chapter 9 *

IPv6 Addressing

size a n d popularity. The proposal w a s coined TUBA (TCP/UDP over Bigger Addresses). CLNP does provide for a m u c h larger a d d r e s s range t h a n the c u r r e n t IPv4. Its Network Service Access Point (NSAP) a d d r e s s consisted of 20 octets, a n d would provide a d e q u a t e a d d r e s s i n g r a nge s for the Internet's foreseeable future. However, this proposal w a s rejected b e c a u s e CLNP lacked some of the v a l u e - a d d e d features t h a t were already installed into the c u r r e n t IP (Quality of Service, multicast, etc.), a n d these were d e t e r m i n e d to be i m p o r t a n t to the Internet's future growth. There w a s a proposal t h a t a t t e m p t e d to create a p a c k e t format compatible with c u r r e n t IP, CLNP, a n d IPX. Yet a n o t h e r proposal, k n o w n as SIPP (Simple IP Plus), simply advocated increasing the c u r r e n t IP a d d r e s s i n g format to 64 bits, a n d fine-tuning some of the feature sets of IPv4, as well as establishing better routing strategies. SIPP t u r n e d out to be the closest m a t c h for w h a t the I n t e r n e t needed, after some modifications. The a d d r e s s i n g range w a s c h a n g e d from 64 to 128 bits, a n d the n a m e w as c h a n g e d to IP version 6, or IPv6 (IPv5 w a s already delegated to a n o t h e r protocol). This would be the protocol to solve the I n t e r n e t scalability problems, a n d p u t u s into the next m i l l e n n i u m (and the foreseeable future). In this chapter, we will learn more a b o u t the specifics of IPv6. We will begin by looking at IPv6 a d d r e s s i n g schemes, a n d d i s c u s s how they c an improve routing stability a n d efficiency. T h en we will look at how the protocol design will aid in n u m b e r i n g a n d r e n u m b e r i n g networks. Finally, we will d i s c u s s some of the v a l u e - a d d e d services t h a t come with IPv6, a n d how they can benefit b o th residential u s e r s a n d big b u s i n e s s e s on the Internet. We will also go into some details a b o u t the 6Bone, the IPv6 proving ground, where deployment a n d t ra ns i t i on strategies are developed a n d tested.

IPv6 Addressing

9Chapter 9

IPv6 Addressing Scheme Characteristics Now t h a t we h a v e looked at s o m e of t h e h i s t o r y of IPv6, as well as s o m e of p r o p o s a l s t h a t c o m p e t e d w i t h IPv6 as t h e n e w I n t e r n e t s t a n d a r d , let u s t a k e a look at s o m e of t h e generic c h a r a c t e r i s t i c s of IP v e r s i o n 6. A full d i s c u s s i o n of IPv6 c a n be f o u n d at w w w . i e t f . o r g / r f c / r f c 2 4 6 0 . t ~ . Figure 9.1 is t h e IPv6 p a c k e t h e a d e r , t a k e n f r o m this RFC.

Figure 9.1 IPv6 header format. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ IVersion [ Traffic C l a s s I

Flow Label

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

P~load ~ngth

I Ne~ Header

I

Hop Mmit

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I +

I Source Address

+ +

I +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

I

+

+

I +

I Destination Address

+

I

I

+

+

I

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Let's look at t h e s e fields in a little detail (the n e x t c h a p t e r will provide a m o r e i n t e n s e s t u d y of t h e specifics of t h e IPv6 protocol).

357

358

Chapter 9

9IPv6 Addressing

Version The version field in the IPv6 h e a d e r is p r e s e n t so t h a t I n t e r n e t m e c h a n i s m s t h a t k n o w h o w to route, or even s p e a k r o u t i n g protocols, will k n o w w h a t type of r o u t i n g protocol t h e y are a b o u t to deal with. Notice t h e similarities to IPv4. In the case of IPv6, the version field is a 4-bit integer, with the value of 6 (0110 in binary), to design a t e this p a c k e t as a n IP version 6 packet.

Traffic Class The Traffic Class field is a n 8-bit field in w h i c h s o m e sort of traffic differentiation identifier c a n be placed. Currently, in the IETF, m a n y w o r k i n g g r o u p s are d e d i c a t e d to coming u p with t h e b e s t w a y to utilize this type of differentiation m e c h a n i s m (though t h e y m o s t l y conc e n t r a t e on IPv4 today). One e x a m p l e of s u c h a g r o u p is t h e DiffServ (Differentiated Services). The m e m b e r s of DiffServ are trying to come u p with a w a y to give m o r e i m p o r t a n t traffic a h i g h e r priority for r o u t i n g on t h e I n t e r n e t today. This field w a s designed for t h i n g s s u c h as IP P r e c e d e n c e bits (giving certain v a l u e s of this field h i g h e r priority, a n d t h e n u s i n g differentiated q u e u i n g strategies in the r o u t e r to tell "who goes first"). You c a n l e a r n m o r e a b o u t DiffServ on t h e Web at w w w . i e t f . o r g / h t m l . c h a r t e r s / d i f f s e r v - c h a r t e r . h t m l . A n u m b e r of drafts a n d RFCs have b e e n w r i t t e n with ideas as to h o w to i m p l e m e n t s u c h a policy. The list of c u r r e n t o p e n drafts (they are only good for six m o n t h s after writing, at w h i c h time t h e y n e e d to be r e s u b m i t t e d , j u s t to keep t h i n g s current) a n d RFCs is at the b o t t o m of t h e a f o r e m e n t i o n e d URL.

Flow Label This is a 20-bit field u s e d w h e n special h a n d l i n g of a p a c k e t is needed. C o m m o n i n t e r p r e t a t i o n of this field at the time of this writing is t h a t the field will a s s i g n flow labels in order to engineer differe n t traffic p a t t e r n s in a n IPv6 network. The m a j o r player in this (though for m o s t l y IPv4 at this time} is the MPLS (Multi-Protocol

IPv6 Addressing

9Chapter 9

Label Switching) w o r k i n g group. To see the g r o u p ' s charter, please see w w w . i e t f . o r g / h t m l . c h a r t e r s / m p l s - c h a r t e r . h t m l . This g r o u p ' s m a i n i n t e n t i o n is to come u p with a n efficient w a y to a s s i g n labels to flows, a n d to come u p with a n efficient a n d scalable w a y to r o u t e b a s e d on t h e s e flows. A flow c a n be defined as a n y class of traffic going from one point to anther, w h e t h e r p o i n t - t o - p o i n t traffic, or a TCP flow from one e n d - s t a t i o n at a given port to a d e s t i n a t i o n ends t a t i o n at a given port. The possibility of a s s i g n i n g flows o p e n s u p m a n y i n t e r e s t i n g options for deployment. P e r h a p s Quality of Service (quite a b u z z w o r d in the field today!) c a n be deployed with scalability this way. M a n y I n t e r n e t providers are k e e p i n g their eyes wide open as this w o r k i n g g r o u p develops, since a d v a n c e d services t h a t the MPLS w o r k i n g g r o u p sees as feasible could lead to g r o u n d b r e a k i n g n e w d e v e l o p m e n t s in the I n t e r n e t i n d u s t r y as a whole.

Payload Length This 16-bit integer is u s e d to d e s i g n a t e the length of the p a y l o a d (the data) in the IPv6 packet, in octets. Notice this field is 16 bits long (2 raised to the power 16), w h i c h gives u s over 6 4 , 0 0 0 different possibilities, allowing IPv6 to have fairly big p a c k e t s (over 6 4 , 0 0 0 octets). To have the ability to m a k e big p a c k e t s c a n i n c r e a s e the efficiency of the I n t e r n e t as a whole. W h e n y o u r p a c k e t s are bigger, the n u m b e r of p a c k e t s n e e d e d to s e n d a given a m o u n t of d a t a b e c o m e s s m a l l e r for a given flow. W h e n t h e r e are fewer p a c k e t s to route, t h e n a r o u t e r h a s m o r e time to r o u t e o t h e r p a c k e t s , or p e r f o r m o t h e r t a s k s (routing table m a i n t e n a n c e , c a c h e aging, etc.). You c a n see h o w this c a n help to i n c r e a s e I n t e r n e t efficiency altogether. Note t h a t a n y e x t e n s i o n h e a d e r s (see later) o u t s i d e of this h e a d e r are i n c l u d e d in the total p a c k e t length in this case. C o m p a r e this with the IPv4 case (RFC791) w h e r e the total length field includes the IPv4 m a i n header.

359

360

Chapter 9 * IPv6

Addressing

Next Header This field is d e s i g n a t e d to tell r o u t e r s if t h e r e are a n y o t h e r h e a d e r s t h a t n e e d be looked at for the p a c k e t to r o u t e according to i n s t r u c tion. This differs drastically with the IPv4 case, w h e r e t h e r e is only one h e a d e r with a fixed length. The IPv6 m a i n h e a d e r is fixed length as well (allowing r o u t e r s to k n o w b e f o r e h a n d h o w m u c h of the p a c k et t h e y n e e d to read), b u t h a s built-in functionality to s t a c k o t h e r h e a d e r s t h a t provide o t h e r v a l u e - a d d e d services, on top of the m a i n header. This field is 8 bits in length, allowing for u p to 255 types of n e x t - h e a d e r s . Currently, only a finite a m o u n t of n e x t - h e a d e r s are developed. Here is a list of the ones c u r r e n t l y on the plate: .

Hop-by-Hop Options H e a d e r

2.

D e s t i n a t i o n Options H e a d e r I

3.

Routing H e a d e r

4.

Fragment Header

5.

Authentication Header

6.

E n c a p s u l a t i n g S e c u r i t y Payload H e a d e r

7.

D e s t i n a t i o n Options H e a d e r II

The p r e c e d i n g list s h o w s the selection of Next H e a d e r fields t h a t c a n o c c u r in a n IPv6 packet. T h e s e h e a d e r s are listed in order of the a p p e a r a n c e t h e y w o u l d m a k e in a n IPv6 p a c k e t utilizing this extra functionality. All of t h e s e h e a d e r s will be d i s c u s s e d in detail in the n e x t chapter, b u t for now, we c a n give a brief e x p l a n a t i o n of e a c h one, a n d w h y t h e y are in a p a r t i c u l a r order.

Hop-by-Hop Options Header This h e a d e r d e s i g n a t e s properties t h a t are to be e x a m i n e d by e a c h IPv6 s p e a k i n g node in the path.

IPv6 Addressing

9

Chapter9

Destination Options Header I This h e a d e r is reserved for options to be performed by the destination concerning handling of the packet. Notice this h e a d e r is the first of two with the s a m e name. In the case of IPv6 packets, with the Hop-by-Hop h e a d e r in use, the destination can be the next hop on the router. This is the motivation for putting the Destination Options h e a d e r right behind the Hop-by-Hop header. For a full description of this h e a d e r a n d its options, read on, a n d see RFC2460, the protocol specification.

Routing Header The r o u t i n g h e a d e r d e s i g n a t e s a list of i n t e r m e d i a t e n o d e s t h a t a p a c k e t m u s t t r a v e r s e prior to arrival at the final p a c k e t d e s t i n a t i o n . This is a n a l o g o u s to the f u n c t i o n a l i t y in IPv4 k n o w n as Loose S o u r c e Route a n d Record. This allows y o u to designate, at the very least, a set of r o u t i n g devices t h a t a p a c k e t m u s t travel t h r o u g h on the w a y to its d e s t i n a t i o n .

For IT Professionals

361

362

Chapter 9

9IPv6 Addressing

Fragment Header This h e a d e r is u s e d by the s o u r c e to s e n d p a c k e t s t h a t are bigger t h a n t h e defined M a x i m u m T r a n s m i s s i o n Unit, or MTU of the p a t h . Normally, in IPv4, i n t e r m e d i a t e n o d e s m a y f r a g m e n t p a c k e t s in order to fit the s t a n d a r d s of given m e d i a t h a t the p a c k e t m a y traverse. E a c h media, be it E t h e r n e t , FDDI, or other, is designed with a specific MTU in m i n d for optimal p e r f o r m a n c e of the given media. In c o n t r a s t , IPv6 does n o t allow for f r a g m e n t a t i o n of a p a c k e t at a n i n t e r m e d i a t e point t h r o u g h the path. Instead, the IPv6 s p e a k i n g device will u n d e r g o MTU Discovery. In this, IPv6 will u s e ICMPv6 (Internet Control a n d Message Protocol version 6) to s e n d p a c k e t s h o p - b y - h o p t h r o u g h the p a t h from s o u r c e to destination, e a c h time r e p o r t i n g the MTU for t h a t p a r t i c u l a r link b e t w e e n hops. The lowest value for MTU is u s e d as the m a x i m u m size p a c k e t t h a t the s o u r c e will s e n d (again, this c a n i n c r e a s e r o u t i n g stability a n d efficiency, since r o u t i n g entities n o w d o n ' t have to s p e n d time a n d CPU fragm e n t i n g p a c k e t s , b u t c a n c o n c e n t r a t e on simply r o u t i n g them). This h e a d e r is u s e d w h e n the s o u r c e w a n t s or n e e d s to s e n d a bigger p a c k e t t h a n the largest MTU t h a t w a s discovered.

Authentication Header This h e a d e r is u s e d if the n e e d for e n d - t o - e n d a u t h e n t i c a t i o n exists. It c o n t a i n s a m e t h o d of a u t h e n t i c a t i o n so t h a t a d e s t i n a t i o n c a n be s u r e t h a t a given p a c k e t is, in fact, from the s o u r c e t h a t it s a y s it is. Please note the order of this h e a d e r in the line. We allow for the preceding h e a d e r s to come first for good r e a s o n s . For i n s t a n c e , if a s o u r c e a n d d e s t i n a t i o n are u s i n g complex a u t h e n t i c a t i o n , b u t we still w a n t to utilize the H o p - b y - H o p header, no a u t h e n t i c a t i o n inform a t i o n n e e d s to be r e a d or t a m p e r e d with along the p a t h . T h i n k of the extra CPU time if all r o u t e r s h a d to a u t h e n t i c a t e p a c k e t s prior to r o u t i n g them! We c a n still u s e the H o p - b y - H o p or D e s t i n a t i o n O p t i o n s I (the h o p - b y - h o p destination) w i t h o u t h a v i n g to c h e c k or t a m p e r with the a u t h e n t i c a t i o n .

IPv6 Addressing

9Chapter 9

Encrypted Security Payload Header Now t h a t we h a v e m e t h o d s to e n s u r e t h a t p a c k e t s c o m e from t h e s o u r c e t h a t t h e y s a y t h e y do, we n e e d s o m e w a y to e n s u r e t h a t no one c a n r e a d t h e p a y l o a d of t h e p a c k e t along t h e way. T h e E n c r y p t e d S e c u r i t y P a y l o a d (ESP) h e a d e r allows for encl3rption of b o t h t h e d a t a in t h e p a c k e t , a n d all h e a d e r s b e h i n d it, in o r d e r to e n s u r e s e c u r i t y of t h e d a t a in t h e p a c k e t . Details of t h i s h e a d e r c a n be f o u n d later in t h e n e x t c h a p t e r , or in t h e RFC archives. T h e c o m b i n a t i o n of t h i s h e a d e r a n d t h e A u t h e n t i c a t i o n h e a d e r m a k e s u p IPSec (IP Security). This is c u r r e n t l y b e i n g i m p l e m e n t e d w i t h IPv4, b u t since it is n o t i n h e r e n t in t h e protocol, t h e IETF is c h a l l e n g e d to m a k e t h i s w o r k in a w a y t h a t is n o t severely p e r f o r m a n c e - e n h a n c i n g . This is one of t h e benefits of IPv6: It is a l r e a d y b u i l t into t h e protocol, so m i n i m a l perf o r m a n c e h i t s are r e q u i r e d to e n a b l e t h i s functionality.

Destination Options Header II T h i s is s i m i l a r to t h e D e s t i n a t i o n O p t i o n s h e a d e r I, e x c e p t t h i s h e a d e r is d e s i g n a t e d for o p t i o n s d e s t i n e d for t h e final d e s t i n a t i o n only. Note t h a t t h e E S P a n d A u t h e n t i c a t i o n h e a d e r s c o m e p r i o r to t h i s h e a d e r in order. T h i s will allow s e c u r e O p t i o n s to be p a s s e d without worrying about someone learning something valuable about t h e d e s t i n a t i o n while t h e p a c k e t is in t r a n s i t a c r o s s t h e I n t e r n e t . So a s we c a n see, t h e n e x t h e a d e r field is of v a s t i m p o r t a n c e to s e c u r i t y a n d v a l u e - a d d e d services a s s o c i a t e d w i t h IPv6. Also of note, Service P r o v i d e r s m a y n o t a l w a y s h a v e t h e i r B a c k b o n e s l i s t e n to c e r t a i n n e x t h e a d e r s , a s t h e y c a n c a u s e r o u t i n g inefficiency. Notice t h e VPN s o l u t i o n s t h a t c a n r e s u l t f r o m t h e A u t h e n t i c a t i o n a n d E S P h e a d e r s alone. Does t h i s m e a n t h a t I n t e r n e t d a t a will n o w be s e c u r e ? At t h e t i m e of t h i s writing, it definitely looks like a good a t t e m p t at d a t a s e c u r i t y over t h e I n t e r n e t . R a m i f i c a t i o n s of IPv6 d e p l o y m e n t w i t h full f u n c t i o n a l i t y could i n c l u d e t h e collapse of t h e " I n t r a n e t " ("secure" Internet), w h i c h u s e s p h y s i c a l l y s e p a r a t e b a c k h a u l facilities in o r d e r to p r e v e n t d a t a or m a c h i n e s f r o m g e t t i n g a t t a c k e d or s t o l e n b y m e a n I n t e r n e t u s e r s .

363

364

Chapter 9

9IPv6

Addressing

Hop Limit This is similar in function to the TI'L field in IPv4. It specifies the n u m ber of Layer 3 (Network Layer) h o p s t h a t a given packet can traverse before a routing s y s t e m will discard the packet. Having a limit s u c h as this is of vital importance. If a routing loop occurs on the Internet, as they s o m e t i m e s do even today, packets have the potential to circle a r o u n d a n d a r o u n d to infinity. If a u s e r gets tired of waiting, a n d s e n d s more packets, you can see how quickly this can bring certain a r e a s where a loop exists to its knees. To fix this, the T I ~ field is u s e d in IPv4. This originally w a s m e a n t as a Time To Live (in seconds) parameter, by which a packet will be discarded if it exists on a network for a specified a m o u n t of time. It was quickly determined t h a t this w a s not the b e s t approach, so the concept of Hop Limit came into being. Every time a r o u t e r receives a packet, the TI'L field is decreased by 1. W h e n a p a c k e t is received with a T r L of zero, the packet is discarded. This helps to e n s u r e t h a t packets do not exist forever on the Internet, taking u p valuable CPU cycles a n d bandwidth. In IPv6, the Hop Limit field is 8 bits long, giving a m a x i m u m of 255 routed h o p s between source a n d destination. Although we would be extremely dissatisfied if we h a d to traverse even 100 h o p s from a source to a destination today, this field is given a high available m a x i m u m value to e n s u r e t h a t future routing r e q u i r e m e n t s are met. Who knows how m a n y h o p s y o u r h o m e refrigerator will be from y o u r office?

Source Address This is t h e IPv6 a d d r e s s of the m a c h i n e t h a t originates the packet. This is d i s c u s s e d in detail later in the section.

Destination Address This is the 128-bit IPv6 a d d r e s s of the d e s t i n a t i o n for the p a c k e t (note t h a t b a s e d on the Next H e a d e r field d i s c u s s e d earlier, this c a n be the final d e s t i n a t i o n , or a n i n t e r m e d i a r y d e s t i n a t i o n , d e p e n d i n g on w h i c h n e x t h e a d e r s are used).

IPv6 Addressing

9Chapter 9

More Bits! I n t e r n e t Protocol version 6 w a s developed to r e s c u e the I n t e r n e t from c u r r e n t p r o b l e m s d i s c u s s e d in the I n t r o d u c t i o n section of this chapter. First a n d foremost of these p r o b l e m s is the a d d r e s s scalability p r o b l e m t h a t the I n t e r n e t faces today. The c u r r e n t I n t e r n e t Protocol a d d r e s s field, being only 32 bits in length (see IPv4 Figure 9.2), c a n be s h o w n to have scaling p r o b l e m s given c u r r e n t I n t e r n e t growth. It is b e c o m i n g clear t h a t the n u m b e r of Internetc o n n e c t e d entities will only increase as time passes. Eventually, everyone will be connected, a n d given p o p u l a t i o n e x p a n s i o n alone, we can see scaling p r o b l e m s already (a 32-bit a d d r e s s field provided for roughly 4.2 billion addresses). W h e n you take into a c c o u n t other devices t h a t either already are, or m a y be, c o n n e c t e d to the I n t e r n e t in years to come (phones, television, routers, radios, diagnostic e q u i p m e n t , Web servers, refrigerators!), we c a n see this p r o b l e m only getting worse. If you t h e n factor in the legacy p r o b l e m s with IP w a s t i n g (owning more IP a d d r e s s e s t h a n you have a s s i g n e d to I n t e r n e t entities), it is clear t h a t a n o t h e r solution is needed.

Figure 9.2 IPv4 packet header format. 0 1234567890

1234567890

1234567890

1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

[Version I IHL IType of Service I

Total Length

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

Identification

I Flags I

F r a g m e n t Offset

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I Time to Live I

Protocol

I

Header Checksum

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+_+_+_+_+_+_+_+_+_+_+

]

Source A d d r e s s

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

Destination A d d r e s s

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

Options

I

Padding

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

365

366

Chapter 9 * IPv6

Addressing

IPv6 does a good job at h a n d l i n g this problem. R a t h e r t h a n the 32-bit a d d r e s s field of IPv4, IPv6 w a s designed with four times as m a n y bits for a d d r e s s i n g . With 128 bits for a d d r e s s i n g (see IPv6 Figure 9.3), we are left with e n o u g h a d d r e s s s p a c e to a c c o m m o d a t e f u t u r e growth as predicted within the IETF (128 bits is r o u g h l y e n o u g h for 4.2 E37 (4.2 * 10 to the power of 37) I n t e r n e t - c o n n e c t e d entities. This is r o u g h l y equivalent to having 8 . 2 7 E + 0 1 6 u n i c a s t I n t e r n e t a d d r e s s e s for e a c h s q u a r e millimeter of the E a r t h ' s surface! As we c a n see, this a p p e a r s to scale to f u t u r e growth for w h a t hopefully will be a long time.

Figure 9.3 IPv6 packet header format. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IVersion

I

Traffic Class

I

Flow Label

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

l

Payload Length

I Next H e a d e r

I

Hop Limit

I I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

I

+

+

I +

I Source Address

+

I

I

+

+

I

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

I

I

+

+

I +

I Destination Address

+

I

I

+

+

I

I

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IPv6 Addressing

9Chapter 9

Before we dive into t h e a d d r e s s i n g s c h e m e s i n h e r e n t to IPv6, let u s first look a t t h e n e w c o n v e n t i o n for e x p r e s s i n g IPv6 a d d r e s s e s . C o n t r a r y to IPv4, w h i c h u s e s d o t t e d d e c i m a l n o t a t i o n , w i t h one n u m b e r p e r octet of its 3 2 - b i t a d d r e s s , IPv6 utilizes h e x n o t a t i o n for d e s c r i b i n g its a d d r e s s e s . A l t h o u g h d o t t e d d e c i m a l n o t a t i o n is well s u i t e d for t h e relatively s h o r t IPv4 h o s t a d d r e s s , it d o e s n o t scale well to t h e 1 2 8 - b i t IPv6 h o s t a d d r e s s (with d o t t e d d e c i m a l n o t a t i o n , we w o u l d n e e d 16 n u m b e r s to d e s i g n a t e e a c h host). W i t h h e x n o t a tion, e a c h digit signifies 4 b i t s of a d d r e s s s p a c e , c u t t i n g a d d r e s s length, w h e n w r i t t e n , s u b s t a n t i a l l y . Table 9.1 s u m m a r i z e s h o w h e x n o t a t i o n differs f r o m d o t t e d d e c i m a l n o t a t i o n . Notice t h a t h e x n o t a tion h a s 16 v a l u e s , i n s t e a d of t h e c l a s s i c a l 10 v a l u e s of d e c i m a l n o t a t i o n . T h i s allows a b y t e of d a t a to be s u m m a r i z e d b y two digits. Therefore, a n a d d r e s s in IPv6 will look a little different f r o m w h a t y o u a r e u s e d to. However, w i t h a little practice, h e x n o t a t i o n b e c o m e s e a s y to u s e . For i n s t a n c e , t h e IPv4 a d d r e s s 2 4 . 1 7 2 . 9 6 . 2 4 0 c a n be w r i t t e n in h e x (with d o t s in t h e s a m e place) a s 18.AC.60.F0.

Hex n o t a t i o n is u s e f u l for c o n d e n s i n g large n u m e r i c a l e x p r e s sions. E a c h digit e x p r e s s e s 4 b i t s of t h e a d d r e s s . T h e n e x t c o n v e n tion to k n o w a b o u t t h a t differs f r o m IPv4 is t h a t a d d r e s s e s a r e g r o u p e d t o g e t h e r in g r o u p s of 16 bits. For i n s t a n c e , a s a m p l e IPv6 a d d r e s s m a y be 3 F F E : 2 9 0 0 : B 0 0 2 : C A 9 6 : 8 5 D l : 1 0 9 D : 0 0 0 2 : 0 0 A D . T h e

367

368

Chapter 9

9IPv6 Addressing

colon (:) is u s e d a s a d e l i m i t e r in IPv6 a d d r e s s e s . M o s t i m p l e m e n t a t i o n s will s u p p o r t d o t t e d d e c i m a l n o t a t i o n a s well, to aid in a s m o o t h t r a n s i t i o n in t h e n e t w o r k i n g c o m m u n i t y (old h a b i t s a r e h a r d to b r e a k , y o u know), b u t t h e a g r e e d u p o n c o n v e n t i o n will be h e x w i t h colon delimiters. Now t h a t we see h o w IPv6 a d d r e s s e s ar e formed, we c a n u s e a c o u p l e of a d d i t i o n a l c o n v e n t i o n s to aid in I P v 6 - a d d r e s s h e x e x p r e s sions. T h e c o n v e n t i o n c a r r i e s over from IPv4: All z e r o e s t h a t a r e to t h e left of a given 16-bit e x p r e s s i o n m a y be left out. For i n s t a n c e , t h e IPv6 a d d r e s s 3 F F E : 2 9 0 0 : C 0 0 5 : 0 0 1 A : 0 0 0 0 : 0 0 0 0 : 0 A D 0 : 0 0 0 1 c a n be r e d u c e d to 3 F F E : 2 9 0 0 : C 0 0 5 : 1 A : 0 : 0 : A D 0 1 : 1 , w h i c h s a v e s s u b s t a n t i a l time. T h i s is a n a l o g o u s to t h e w r i t i n g of t h e a d d r e s s s (for example) in IPv4 of 1 9 9 . 0 0 0 . 0 5 5 . 0 8 5 a s 1 9 9 . 0 . 5 5 . 8 5 . T h e seco n d c o n v e n t i o n h e l p s even more. It s t a t e s t h a t if t h e r e is m o r e t h a n one s t r i n g of 16 b i n a r y zeroes in a row, t h e y c a n be omitted. In place of t h e zero s t r i n g s , we s i m p l y u s e t h e d o u b l e - c o l o n (::). F r o m t h e p r e c e d i n g a d d r e s s , we c a n e x p r e s s t h i s a d d r e s s as 3 F F E : 2 9 0 0 : C 0 0 5 : 1 A : : A D 0 : 1 , w h i c h s h o r t e n s t h e e x p r e s s i o n even f u r t h e r . Please n o t e t h a t t h e d o u b l e colon c a n only be u s e d once in a n a d d r e s s . S i n c e t h e l e n g t h of t h e zero s t r i n g is u n k n o w n , a n y IPv6 n o d e i n t e r p r e t i n g t h e e x p r e s s i o n w o u l d n o t k n o w h o w m a n y 16-bit zero s t r i n g s to p a d t h e a d d r e s s with, if t h i s s h o r t c u t w e r e to be u s e d m o r e t h a n once. For i n s t a n c e , 3 F F E : 2 9 0 0 : 1 : : 1::2 c o u l d be 3 F F E : 2 9 0 0 : 1 : 0 : 1 : 0 : 0 : 2 or 3 F F E : 2 9 0 0 : 1 : 0 : 0 : 1 : 0 : 2 . W h e n we look at b o t h of t h e se s h o r t c u t s in full use, we c a n see t h a t a d d r e s s e s c a n b e c o m e especially easy to express. For instance, the IPv6 6Bone a d d r e s s 3 F F E : 2 9 0 0 : 0 0 0 0 : 0 0 0 0 : 0 0 0 0 : 0 0 0 0 : 0 0 0 0 : 0 0 0 1 c a n be written as 3FFE:2900:: 1. This dramatically r e d u c e s b o t h the time to write IPv6 a d d r e s s e s , a n d the t h i n k i n g associated with m a k i n g s u r e t h a t you get all 128 bits into y o u r expression. Now t h a t we have all of t h e s e rules down, we c a n begin to look at the protocol a d d r e s s i n g s c h e m e in more detail. Familiarize yourself with Table 9.1 prior to moving into the next sections of this book, as hex will be the n o r m a l m e t h o d for expressing IPv6 a d d r e s s e s from here on out.

IPv6 Addressing

9Chapter 9

Table 9.1 Hex-to-Decimal Translation Cheat Chart

Value

Hex Notation

Decimal Notation

Binary

0

00000000

1

00000001 00000010

3

3

3

00000011

4

4

4

000001 O0

5

5

5

00000101

6

6

6

00000110

7

7

7

00000111

8

8

8

OOO010O0

9

9

9

00001001

10

a

10

00001010

11

b

11

00001011

12

C

12

000011 O0

13

d

13

00001101

14

e

14

00001110

15

f

15

0000111

Now t h a t we h a v e m o r e b i t s from w h i c h to a d d r e s s I n t e r n e t entities, we n e e d to m a k e s u r e t h a t we h a v e sufficient m e a n s for all of t h e s e m a c h i n e s to t a l k w i t h one a n o t h e r . In o t h e r w o r d s , we m u s t also i n c o r p o r a t e into t h e n e w I n t e r n e t Protocol w a y s for r o u t i n g to m a i n t a i n a n efficient state. J u s t i m a g i n e t h e p r o c e s s i n g p o w e r I n t e r n e t B a c k b o n e r o u t e r s w o u l d n e e d to h a v e in o r d e r to r e t a i n a n d p r o c e s s a g a i n s t a list of every h o s t in IPv6! At t h e time of t h i s writing, t h e r e a r e b e t w e e n 6 2 , 0 0 0 a n d 6 5 , 0 0 0 c l a s s l e s s r o u t i n g e n t r i e s in t h e I n t e r n e t default-free B a c k b o n e r o u t i n g tables. T h i s n u m b e r is i n c r e a s i n g , b u t a t a m u c h slower r a t e t h a n a d d r e s s a l l o c a t i o n s (providers are d e l e g a t i n g a d d r e s s s p a c e t h a t c a n be a g g r e g a t e d into s u p e r n e t s ; t h i s k e e p s global r o u t i n g table g r o w t h less t h a n t h a t of I n t e r n e t - c o n n e c t e d e n t i t y growth). We n e e d to e n s u r e t h a t t h e u p p e r

369

370

Chapter 9

9IPv6 Addressing

limit of r o u t i n g entries w i t h IPv6 is still w i t h i n foreseeable limits of w h a t B a c k b o n e r o u t e r s c a n hold, a n d p r o c e s s u p o n , quickly. In the following sections, we will first look at h o w IPv6 a d d r e s s i n g works, a n d t h e n look at how this a d d r e s s i n g s c h e m e e n s u r e s t h a t t h e s e c o n c e r n s are sufficiently a d d r e s s e d .

A More Flexible Hierarchical Organization of Addresses As s t a t e d earlier, a n y protocol t h a t r e p l a c e s the c u r r e n t IP will n e e d to n o t only provide for m o r e I n t e r n e t - r o u t a b l e a d d r e s s e s , b u t it will also have to c o n t a i n i n h e r e n t m e c h a n i s m s to e n s u r e a stable a n d efficient B a c k b o n e r o u t i n g system. If we were to a d o p t a n I n t e r n e t Protocol w i t h o u t a d d r e s s i n g this issue, we m a y solve a n a d d r e s s s p a c e problem, b u t getting from one p o i n t in the I n t e r n e t to a n o t h e r will b e c o m e c u m b e r s o m e for B a c k b o n e r o u t i n g e q u i p m e n t a n d could lead to a less stable I n t e r n e t as a whole. M a n y I n t e r n e t g u r u s t o d a y envision the I n t e r n e t replacing all prior m e a n s of c o m m u n i c a t i o n , be it phone, television, radio, etc., so the r o u t i n g stability i s s u e h a s to be held in high priority for this d r e a m to b e c o m e reality. In this section, we will look at one of the m a i n i m p r o v e m e n t s IPv6 a t t e m p t s to m a k e over IPv4, a n d s t u d y the effects this c a n have on B a c k b o n e r o u t i n g tables. A l t h o u g h IPv4 first r o u t e d b a s e d on classful entries (Class A, B, C blocks), it w a s a p p a r e n t t h a t this w a s n o t sufficient for wide-scale d e p l o y m e n t . Then, the c o n c e p t for C l a s s l e s s I n t e r - D o m a i n Routing w a s developed. With CIDR, the c o n c e p t of c l a s s e s w e n t away, allowing the ability to aggregate s m a l l e r n e t w o r k s into s u p e r n e t s , or to b r e a k u p big blocks into s u b n e t s . This i n c r e a s e d the efficiency of n e t w o r k a d d r e s s i n g , b e c a u s e we could n o w a d d r e s s a n e t w o r k with the a p p r o p r i a t e l y - s i z e d n e t w o r k block, r e g a r d l e s s of w h a t class the a d d r e s s fell into. With this n e w development, IPv4 a d d r e s s e s were n o w u s e d m o r e efficiently, b u t t h e r e w a s a side effect on the B a c k b o n e r o u t i n g t a b l e s of the Internet. I n s t e a d of carrying the first 128 blocks of n e t w o r k s p a c e with 128 entries, t h e s e n e t w o r k s could

IPv6 Addressing

9Chapter 9

n o w be s p r e a d o u t over large n o n c o n t i g u o u s g e o g r a p h i c a r e a s . T h i s c a u s e d r o u t i n g t a b l e size to g r o w at a n i n c r e a s e d rate. Let u s p e r f o r m a m e n t a l exercise to h e l p d e m o n s t r a t e t h i s point. S u p p o s e t h a t I n t e r n e t - c o n n e c t e d N e t w o r k I h a s two I n t e r n e t Providers, A a n d B. N e t w o r k I h a s b e e n d e l e g a t e d a s u b n e t f r o m Provider A f r o m w h i c h to a d d r e s s t h e i r I n t e r n e t - c o n n e c t e d m a c h i n e s , to provide for I n t e r n e t routability. W h e n t h i s p r o v i d e r r u n s BGP, it a n n o u n c e s t h i s s u b n e t u p to b o t h p r o v i d e r s . T h i s is w h e r e t h e p r o b l e m s occur. If Provider A d e c i d e s to a n n o u n c e to its p e e r s only t h e a g g r e g a t e of t h e A d d r e s s b l o c k f r o m w h i c h N e t w o r k I w a s given a s u b n e t , only traffic o r i g i n a t i n g on Provider A's n e t w o r k (and s o m e t i m e s n o t even that) w o u l d u s e t h e c o n n e c t i o n f r o m Provider A to N e t w o r k I to get to N e t w o r k I. Since Provider B receives, a n d p a s s e s on, t h e s u b n e t t h a t N e t w o r k I a n n o u n c e s , all I n t e r n e t traffic will u s e Provider B's c o n n e c t i v i t y to N e t w o r k I for its b e s t p a t h (via t h e l o n g e s t m a t c h r o u t i n g rule). We c a n see t h a t t h i s limits a d o w n s t r e a m n e t w o r k ' s ability to l o a d - b a l a n c e b e t w e e n m u l tiple p r o v i d e r links. T h e only s o l u t i o n t h a t w o u l d allow N e t w o r k I to c o n t r o l its traffic load on e i t h e r c o n n e c t i o n w o u l d h a v e to i n c l u d e t h e e x t e r n a l a n n o u n c e m e n t of b o t h t h e a g g r e g a t e a n d t h e s u b n e t f r o m Provider A to its peers.

371

372

Chapter 9 *

IPv6 Addressing

So as we can see, the inception of CIDR provided for more efficient use of Internet-routable addresses, b u t in turn, it also reduced the efficiency of Internet routing tables. When this example is expanded to the global Internet, we can see t h a t this is a problem. IPv6 m a k e s some good modifications in policy to rid the Internet of both problems. The IPv6 a d d r e s s consists of 128 bits. One advantage t h a t IPv6 h a s over CIDR is a built-in, well-defined set of b o u n d a r i e s from which to define sets of a d d r e s s space to delegate d o w n s t r e a m to other people who get Internet connectivity from you.

Figure 9.4 Globally-routable IPv6 addressing architecture. 13l +---+

13 1 8 l .......

+ .....

24]

16

+ ~ - +

liD ......

I -4- .....

64 bits

4

4

IFPl TLA IRESI NLA]

I

]

ID

4

] t

SLA ] ID ]

Interface ID

t

Notice in Figure 9.4 t h a t the IPv6 globally-routable u n i c a s t prefix is divided into six different sections. Let u s look at each section in detail.

FP: F o r m a t Prefix The F o r m a t Prefix for globally-routable u n i c a s t prefixes will always have the s a m e three bits (in the initial deployment of IPv6). These first three bits will always be set to 001, and are there to designate (to any routing entity on the Internet) t h a t this a d d r e s s is a globallyroutable u n i c a s t address. For each type of IPv6 a d d r e s s t h a t we discuss, the FP will be u n i q u e to t h a t type of address, t h u s m a k i n g it easier for routing entities to discern packet types, and process t h e m according to the rules t h a t apply to the respective packet type. For instance, m u l t i c a s t packets and u n i c a s t packets are routed in very different ways. Unicast packet routing is 1-to-1 (a packet with an IPv6 Globally-Routable Unicast destination originates from one host,

IPv6 Addressing

9Chapter 9

a n d is delivered to one host), a n d m u l t i c a s t p a c k e t s are 1-to-N (one m u l t i c a s t p a c k e t m a y be delivered to N i n t e r e s t e d d e s t i n a t i o n hosts), or N-to-N (N s o u r c e s delivering p a c k e t s to N destinations), so t h e s e p a c k e t s are h a n d l e d in vastly different w a y s on a n I n t e r n e t b a c k b o n e . The FP serves as a delimiter, so a r o u t i n g device c a n m a k e a q u i c k decision as to h o w to h a n d l e the i n c o m i n g packet, a n d e n s u r e t h a t it is h a n d l e d correctly. Note t h a t u s i n g the first few bits of a n a d d r e s s to d e s i g n a t e type of a d d r e s s is m o r e efficient t h a n p u t t i n g it into the packet, b e c a u s e n o w we c a n utilize m o r e of the p a c k e t for o t h e r v a l u a b l e features, d i s c u s s e d earlier.

TI A ID This is the Top Level Aggregator Identifier, 13 bits u s e d to signify to w h i c h Top Level Aggregator the a d d r e s s belongs. A Top Level Aggregator is a Network Provider t h a t sits at the top level of aggregation of I n t e r n e t traffic. In u n i c a s t t e r m s , Top Level Aggregators are s o m e t i m e s referred to as '~rier-1 Providers." T h e s e are I n t e r n e t Providers w h o m a k e u p the core of the I n t e r n e t B a c k b o n e . They u s u a l l y have equal p a r t peering (they d o n ' t p a y the o t h e r provider to receive the o t h e r provider's routes) r e l a t i o n s h i p s with o t h e r TLAs (nonpaid connectivity to o t h e r TLAs), e n c o m p a s s a large a r e a of the globe with coverage of I n t e r n e t core routing, a n d provide the highspeed t r a n s p o r t t h a t moves p a c k e t s from one p a r t of the globe to another. Their B a c k b o n e s are c o m p o s e d of highly s o p h i s t i c a t e d , f a s t - r o u t i n g devices, a n d their cores c a r r y full I n t e r n e t routes. C u r r e n t e x a m p l e s of Top Level Aggregators include S p r i n t a n d WorldCom. In IPv6, providers of this caliber are given blocks of IPv6 Globally R o u t a b l e U n i c a s t a d d r e s s e s (a TLA a s s i g n m e n t ) , a n d they, in t u r n , delegate pieces of this block d o w n to their c u s t o m e r s .

RES T h e s e bits are reserved for now. It h a s n o t b e e n d e t e r m i n e d by the IETF w h a t c o u r s e of action s h o u l d be u s e d for t h e s e bits. At this stage, it is a p p r o p r i a t e for TLAs to s u b n e t their a s s i g n m e n t u s i n g

373

374

Chapter 9 *

IPv6 Addressing

t h e s e 8 bits to i n c r e a s e t h e a m o u n t of Globally R o u t a b l e U n i c a s t a d d r e s s s p a c e t h a t a TLA c a n u s e to delegate to their c u s t o m e r s , or u s e on t h e i r B a c k b o n e .

NLA ID These 24 bits depict the Next Level Aggregator Identifier. A Next Level Aggregator c a n be t h o u g h t of today as a Tier-2 Network Service Provider or ISP. An NLA c a n range from a small organization with one TLA connection, to a large, regional Provider with m a n y u p s t r e a m TLA connections, a n d complex Backbones. An NLA will receive a n NLA ID from their u p s t r e a m TLA, a n d in t u r n , will b r e a k their NLA ID into c h u n k s , w h i c h will be delegated to their c u s t o m e r s .

SLA ID A Site Level Aggregator Identifier d e s c r i b e s a n entity t h a t h a s no d o w n s t r e a m c u s t o m e r s w h o are n e t w o r k service providers. A SLA could be a small to large b u s i n e s s , or a small Service Provider who does n o t delegate a d d r e s s s p a c e to its providers (for i n s t a n c e , t o d a y ' s c a b l e - m o d e m providers could fit into a SLA a r r a n g e m e n t ) .

Interface ID The final 64 bits of t h e globally r o u t a b l e IPv6 u n i c a s t a d d r e s s is r e s e r v e d for t h e Interface Identifier. In IPv4 t e r m s , this is k n o w n as t h e h o s t id. T h e s e 64 bits will be d e s i g n a t e d to d i s t i n g u i s h one h o s t from a n o t h e r on a given n e t w o r k s e g m e n t . E a c h Interface ID on a given n e t w o r k s e g m e n t m u s t be u n i q u e . We will see t h a t IPv6 b u i l d s in a clever w a y to e n s u r e this is so.

Aggregation Realized Now t h a t we k n o w h o w t h e IPv6 Globally R o u t a b l e U n i c a s t a d d r e s s f o r m a t is split up, we c a n begin to see h o w a g g r e g a t i o n b a s e d on this f o r m a t is possible. Figure 9.5 depicts a TLA t h a t h a s a variety of c u s t o m e r s for w h i c h t h e y provide t r a n s i t I n t e r n e t connectivity. By

IPv6 Addressing * Chapter 9

delegating a s u b s e t of their a d d r e s s s p a c e (TLA ID) to e a c h customer, d e p e n d i n g on t h a t c u s t o m e r ' s p u r p o s e , t h e y are e n s u r e d t h a t all a d d r e s s s p a c e t h a t is advertised to t h e m from their d o w n s t r e a m c u s t o m e r s is a s u b s e t of their a d d r e s s space. This b r i n g s u p a good point r e g a r d i n g the political c h a n g e s s u r r o u n d i n g IPv6. With IPv6, small to regional Network Service Providers as well as e n d - u s e r s will no longer have the ability to o b t a i n a d d r e s s s p a c e directly from registries. I n s t e a d , Top Level Aggregators will be a s s i g n e d a d d r e s s blocks, w h i c h t h e y will in t u r n be in c h a r g e of m a n a g i n g a n d delegating to their d o w n s t r e a m c o n n e c t i o n s (NLAs a n d SLAs). This shift in a d d r e s s m a n a g e m e n t is t h o u g h t to be m u c h m o r e efficient t h a n the c u r r e n t a d d r e s s m a n a g e m e n t policies of today. If a small-tomidsize I S P / N S P c a n no longer get a d d r e s s s p a c e from registries, a n d therefore p u t s a b u r d e n on B a c k b o n e TLA core providers to carry t h e s e r o u t e s as transit, t h e n the possibility of aggregation b e y o n d w h a t IPv4 c a n do t o d a y b e c o m e s a reality. In the n e x t section, we will look at h o w this aggregation works, a n d w h y it will i n c r e a s e the stability of the I n t e r n e t as a whole.

Figure 9.5 A generic IPv6 Internet.

375

376

Chapter

9

IPv6 Addressing

9

Minimizing the Size of Routing Tables As we have discovered, IPv6 will allow a m p l e a d d r e s s s p a c e for the f u t u r e of the Internet. With 128 bits of a d d r e s s spacing, t h e r e s h o u l d be a d e q u a t e a d d r e s s e s for I n t e r n e t - c o n n e c t e d entities to grow in n u m b e r a n d complexity. With a well-defined f o r m a t for IPv6 a d d r e s s i n g , we c a n see t h a t a d d r e s s i n g b e c o m e s m o r e organized t h a n classical IPv4. F r o m this, we will n o w look at how the a d d r e s s ing s c h e m e for IPv6 helps to minimize the n u m b e r or I n t e r n e t Core r o u t i n g entries t h a t n e e d to be carried, t h u s limiting the scope of f u t u r e I n t e r n e t r o u t i n g complexity. In Figure 9.6, we see two TLAs, w i t h v a r i o u s c o n n e c t e d c u s t o m e r s of b o t h the NLA a n d SLA variety. Let u s look at the r o u t i n g a n n o u n c e m e n t s n e c e s s a r y for this scenario to f u n c t i o n with stability a n d efficiency.

Figure 9.6 Generic addressed IPv6 Internet. 3FFE:2900::/24

3FFE:4200::/24 BGP4+

BGP4+

I

SLA III 3FFE:29

0:2::/48

3FFE:2900:1:10::/63 3FFE:2900:2:20::/63

3FFE:4200:D:E::/63

IPv6 Addressing

9Chapter 9

In F i g u r e 9.6, we h a v e two TLAs (Tier 1 N e t w o r k Service Providers) a n d a v a r i e t y of NLAs a n d SLAs in v a r i o u s c o n f i g u r a t i o n s . TLA I is in a b i l a t e r a l p e e r i n g a r r a n g e m e n t for TLA II, a n d b o t h e x c h a n g e r o u t e s via BGP (there are c h a n g e s to BGP t h a t a r e c u r r e n t l y in IETF w o r k i n g g r o u p s to s u p p o r t different t y p e s of NLRI (Network-Layer R e a c h a b i l i t y I n f o r m a t i o n ) , so B G P 4 very well m a y n o t be t h e s t a n d a r d BGP b y t h e t i m e IPv6 is deployed; for t h e p u r p o s e s of t h i s e x a m p l e , B G P 4 will serve a d e q u a t e l y ) . TLA I o w n s a Top Level A g g r e g a t o r Block. In t h i s e x a m p l e , we d e s i g n a t e TLA I w i t h 3 F F E : 2 9 0 0 : : / 2 4 a s its TLA delegation, a n d TLA II w i t h 3 F F E : 4 2 0 0 : : / 2 4 a s its TLA delegation. So we k n o w t h a t TLA I a n d TLA II m u s t s u p p l y e a c h o t h e r w i t h t h e s e r o u t e s a t a m i n i m u m for r o u t i n g to o p e r a t e p r o p e r l y b e t w e e n TLA I a n d TLA II B a c k b o n e s . TLA I will s u b d e l e g a t e b l o c k s of a d d r e s s s p a c e to its NLA a n d SLA c u s t o m e r s . In t h i s case, let u s a s s i g n NLA I w i t h 3 F F E : 2 9 0 0 : 1 : : / 4 8 , a n d NLA II w i t h 3 F F E : 2 9 0 0 : 2 : : / 4 8 . F u r t h e r m o r e , t h e s e NLAs m u s t d e l e g a t e b l o c k s d o w n to t h e i r c u s t o m e r s o u t of t h i s block. Let u s a s s u m e SLA I will be given 3 F F E : 2 9 0 0 : l : 1 0 : : / 6 3 , SLA II 3 F F E : 2 9 0 0 : 2 : 2 0 : : / 6 3 , a n d SLA III 3 F F E : 4 2 0 0 : D : E : : / 6 3 . S t a r t i n g a t t h e b o t t o m a g g r e g a t o r s , SLA I m u s t a n n o u n c e its b l o c k 3 F F E : 2 9 0 0 : l : 1 0 : : / 6 3 u p to NLA I. B e c a u s e t h i s is a s u b s e t of NLA I's s p a c e , NLA I is n o t r e q u i r e d to a n n o u n c e t h i s SLA (from SLA I) u p to TLA I. A s i m i l a r s i t u a t i o n exists w i t h NLA II. TLA I only n e e d s to h e a r t h e NLA a g g r e g a t i o n s t h a t it d e l e g a t e d d o w n to t h e s e two NLAs, r e g a r d l e s s of h o w t h a t NLA h a s s u b d e l e g a t e d its space. So f r o m this, we c a n see t h a t a t t h i s point, TLA I h a s to c a r r y only t h r e e a n n o u n c e m e n t s for n o n b a c k b o n e space:

3FFE'2900"1 ":/48 (from NLA I) 3FFE'2900"2":/48 (from NLA II) 3FFE'4200":/24 (from TLA II) E v e n f u r t h e r , we notice t h a t t h e first two of t h e s e a n n o u n c e m e n t s a r e s i m p l y s u b s e t s of t h e b l o c k a s s i g n e d to TLA I. Therefore, in t h e b i l a t e r a l p e e r i n g b e t w e e n TLA I a n d TLA II, we c a n see t h a t only one r o u t e n e e d s to be e x c h a n g e d b e t w e e n t h e s e peers.

377

378

Chapter 9

9IPv6

Addressing

A l t h o u g h this is a limited example, we c a n see the r o u t i n g simplicity t h a t h a s come to p a s s as a r e s u l t of this aggregation. The b e a u t y of this c o m e s from two facts.

Figure 9.7 Routing advertisements along aggregation paths.

~

3FFE:2900::/24.~~ ~-3FFE:4200::/24

,'

3FFE:2900::/24' 3FFE:2900:l::/48 -" ~ "- 3FEE:2900:2::/18

4-

3FFE:4200::/24

A ! I /.,.,

1

..

3FFE:2900::/24 3FFE:2900:1::/48

!

,' '

~'~ ~

"--1 3FFE:2900::/24 3FFE:2900:2::/48

3FFE:4200:D:E::/63.....

3FFE:2900:1:10::/63- -' '- -- 3FFE:2900:2:20::/63 The first is t h a t no a d d r e s s b l o c k s a r e p o r t a b l e . Today, a large p a r t of IP s p a c e is k n o w n as portable. A portable a d d r e s s block is a block t h a t c a n be t a k e n with y o u w h e n you leave a c e r t a i n service provider's j u r i s d i c t i o n , a n d go to a n o t h e r provider. This leads to m a n y e x t r a n e o u s a n n o u n c e m e n t s in the core of the I n t e r n e t B a c k b o n e , as Network Service Providers lose the ability to aggregate a n n o u n c e m e n t s properly. For example, if a service provider is given the c l a s s l e s s block 7 1 . 1 6 . 0 . 0 / 1 6 , a n d loses one p a r t of this, s a y 7 1 . 1 6 . 2 4 1 . 0 / 2 4 , from its p o s s e s s i o n (a c u s t o m e r t a k e s it with t h e m

IPv6 Addressing

9Chapter 9

w h e n t h e y leave), we are left with a s u b o p t i m a l r o u t i n g scenario. Now, 0

0

The Service Provider h a s to a n n o u n c e this block one / 1 6 to peers a n d c u s t o m e r s as m a n y different s u b n e t s ~ i n this case, eight a n n o u n c e m e n t s ( 7 1 . 1 6 . 0 . 0 / 1 7 , 7 1 . 1 6 . 1 2 8 . 0 / 1 8 , 71.16.224.0/19, 71.16.240.0/24, 71.16.242.0/23, 71.16.244.0/22, 71.16.248.0/21). The Service Provider h a s to u p d a t e its filters to peers to allow this lost block to be h e a r d via BPG from peers. Normally, this block w o u l d be denied, to p r e v e n t r o u t i n g loops (see the note r e g a r d i n g BGP in a p r e v i o u s section of this chapter; the BGP4 provider helps a little d u e to the originating ASN). Not only is this a m a n a g e m e n t n i g h t m a r e for Network Service Providers, it is also extremely inefficient for the I n t e r n e t core.

So by r e m o v i n g portability, we have greatly i n c r e a s e d t h e longt e r m efficiency of the I n t e r n e t B a c k b o n e r o u t i n g tables. S o m e m a y ask, "Why d o n ' t we eliminate this in IPv4?" This h a s b e e n done, for the m o s t part; however, legacy portability h a s t a k e n its toll on the Internet. Second, p r e s s u r e still r e m a i n s from d o w n s t r e a m I n t e r n e t entities. The a r g u m e n t is t h a t n o t allowing IP blocks to be p o r t a b l e p u t s the c u s t o m e r u n d e r p r e s s u r e n o t to c h a n g e providers, b e c a u s e a big n e t w o r k is c u m b e r s o m e to r e n u m b e r with n e w IP s p a c e (DNS entries, as well as h o s t r e c o n f i g u r a t i o n is required). T h e r e is no w a y for IPv4 to provide a s m o o t h t r a n s i t i o n from one Provider-delegated block of IPv4 a d d r e s s e s to another. IPv6 will n e e d s o m e m e c h a n i s m to allow for s m o o t h m i g r a t i o n from one provider's a d d r e s s s p a c e to another. We will see t h a t this is the case. The u s e of a n y c a s t a d d r e s s i n g , as well as a u t o - c o n f i g u r a t i o n of interfaces, aids in the p a i n of r e n u m b e r i n g u p o n switching providers, or r e n u m b e r i n g for a n y o t h e r r e a s o n . B u t let's p u t this aside for the m o m e n t to complete o u r s t u d y of r o u t i n g tables. We will d i s c u s s strategies for r e n u m b e r i n g in the n e x t section. The s e c o n d r e a s o n is t h a t only TLAs will be a s s i g n e d a d d r e s s space from the N u m b e r i n g Authorities. Today, IANA (the I n t e r n e t

379

380

Chapter 9

9IPv6

Addressing

Assigned N u m b e r s Authority) is the responsible party for n u m b e r ing, which in t u r n delegates n u m b e r s to Regional Registries, s u c h as ARIN, RIPE, and APNIC. These regional n u m b e r s authorities in t u r n assign IPv4 a d d r e s s space to Internet providers, or b u s i n e s s e s and organizations t h a t can d e m o n s t r a t e sufficient need for their own IP blocks. Notice how this leads to more small blocks being carried in the core Internet table. This all goes b a c k to r e n u m b e r i n g problems. If r e n u m b e r i n g were simple, t h e n getting IP space directly from our u p s t r e a m providers of connectivity would not be a big deal. If we are dissatisfied with service, we can simply get a n o t h e r provider, and t h e n renumber. Many b u s i n e s s e s today feel restricted in doing this, as r e n u m b e r i n g in IPv4 is sufficiently complex to sway people away from going somewhere else w h e n their provider is not satisfactorily providing service. By e n s u r i n g t h a t only TLAs get a d d r e s s space, the Internet is a s s u r e d t h a t only big blocks of space are delegated, which will m a k e sure t h a t aggregation can always occur.

IPv6 Addressing

9Chapter 9

Global Addresses for the Internet and Local Addresses for Intranet Now t h a t we c a n see how the I n t e r n e t core c a n benefit from IPv6, a n d we have t o u c h e d on some of the nice things it provides to e n d - u s e r networks, let u s look at how a typical LAN will be a d d r e s s e d , a n d how its routing allows for r o b u s t a n d easily m a n a g e d connectivity. So far, we have l e a r n e d t h a t Globally-Routable U n i c a s t IPv6 a d d r e s s e s follow a strict aggregation s c h e m e . B u t does every m a c h i n e n e e d to have a Globally R o u t a b l e U n i c a s t a d d r e s s ? Most c o m p a n i e s t o d a y t h a t are c o n n e c t e d to the I n t e r n e t have s o m e s u b set of s y s t e m s t h a t r o u t e a n d s p e a k IPv4, b u t do n o t n e c e s s a r i l y n e e d to be r o u t e d a c r o s s the I n t e r n e t , n o r do t h e y n e e d to have t h e i r very own Globally R o u t a b l e U n i c a s t a d d r e s s . C e r t a i n s y s t e m s , s u c h as i n t e r n a l - o n l y servers, p r i n t e r s , a n d o t h e r s y s t e m s n e e d be able to r o u t e on a c o m p a n y network, b u t do n o t n e e d to be globally r o u t e d a c r o s s the I n t e r n e t . F u r t h e r m o r e , m a n y c o m p a n i e s w i s h t h e r e were a w a y to e n s u r e t h a t t h e s e s y s t e m s could n o t be s e e n from the o u t s i d e world. Today, this is r e m e d i e d t h r o u g h s e c u r i t y p r e c a u t i o n s : the firewall a n d the p a c k e t filter are the b e s t w a y s to e n s u r e (or h o p e to ensure) t h a t s o m e s e c r e t or i m p o r t a n t m a c h i n e s are n o t accessible from the outside. A l t h o u g h s e c u r i t y is i m p o r t a n t , a n d will n o t go a w a y with the i n v e n t i o n of IPv6, t h e r e are o t h e r possibilities. IPv6 i n c o r p o r a t e s the idea of scoped a d d r e s s i n g into its protocol stack. Scoped a d d r e s s i n g , in a d d i t i o n to providing o t h e r functionality, provides for this problem. A d d r e s s e s are said to be scoped w h e n the a d d r e s s in q u e s t i o n h a s a well-defined b o u n d a r y in w h i c h it will route. F u r t h e r m o r e , the s c o p e d a d d r e s s does n o t r o u t e o u t s i d e of this b o u n d a r y , n o r does it have a r o u t i n g e n t r y a s s o c i a t e d with it t h a t leaves this b o u n d a r y . To b e t t e r u n d e r s t a n d , let u s look at a d i a g r a m of a simple IPv6 network, a n d a generic e x a m p l e of h o w scoping c a n be u s e d to e n s u r e t h a t m a c h i n e s o p e r a t e only w i t h i n t h e i r j u r i s d i c t i o n . Refer to Figure 9.8 to p i c t u r e this type of scenario.

381

382

Chapter 9

9IPv6

Addressing

Figure 9.8 A scoped IPv6 network.

T h e m a c h i n e labeled "secure" s e r v e r c a n n o t r o u t e o u t s i d e of t h e b o u n d a r y of its n e t w o r k , b e c a u s e it does n o t k n o w a b o u t t h e r e s t of t h e w o r l d (it h a s no d e f a u l t route). T h e r e s t of t h e world does n o t k n o w a b o u t it e i t h e r (no r o u t i n g e n t r y is a d v e r t i s e d to o t h e r r o u t e r s a b o u t t h e e x i s t e n c e of t h e link-local network.) In t h i s n e t w o r k , we h a v e s o m e people w h o m a y be in a n o t h e r side of t h e building, w h o n e e d to a c c e s s M a c h i n e A. Also, M a c h i n e A c a n t a l k to o t h e r p a r t s of t h e building. We still h a v e t h e ability to u s e filters a n d firewalls (or s o m e s o r t of s e c u r i t y m e a s u r e s ) to e n s u r e t h i s m a c h i n e is invisible f r o m t h e o u t s i d e . However, classically, t h i s c a n be d a n g e r o u s , a s m o s t o p e r a t o r s , no m a t t e r h o w good a n d careful, c a n m a k e m i s t a k e s . A d d r e s s e s t h a t a r e n o t s u p p o s e d to

IPv6 Addressing

9Chapter 9

get a n n o u n c e d to t h e r e s t of t h e world e v e n t u a l l y will get a n n o u n c e d , even if b y a c c i d e n t a n d for a s h o r t p e r i o d of time, w h e n a m i s t a k e g e t s m a d e . RFC 1918 d e s i g n a t e s r e s e r v e d a d d r e s s s p a c e for IPv4 (RFC 1918: A d d r e s s Allocation for Private I n t e r n e t s , w w w . i e f f . o r g / r f c / r f c l 9 1 8 . t ~ ). Note t h a t in IPv4, it is left to t h e c o m p e t e n c e of t h e N e t w o r k O p e r a t o r to e n s u r e t h a t r e s e r v e d a d d r e s s s p a c e is n o t a n n o u n c e d globally. In IPv6, it is c o n c e i v a b l e t h a t a r o u t i n g s y s t e m will a u t o m a t i c a l l y k n o w n o t to r o u t e link-local or site-local s p a c e b e t w e e n ASs. As y o u h a v e p r o b a b l y g u e s s e d b y now, IPv6 a d d r e s s e s t h i s p r o b lem, a n d d o e s w h a t m a n y feel IPv4 h a s tried to do too late. IPv6 h a s a set of a d d r e s s s p a c e t h a t is s c o p e d for different t y p e s of a p p l i c a tions. T a b l e 9.2 s u m m a r i z e s d e l e g a t i o n of IP s p a c e s . Table 9.2 s u m m a r i z e s h o w t h e first few b i t s of t h e IPv6 a d d r e s s will tell u s w h a t type of a d d r e s s it is. Notice t h a t in t h r e e bits, we c a n see w h e t h e r or n o t a given a d d r e s s is a Globally R o u t a b l e U n i c a s t a d d r e s s or n o t (001; w h i c h leaves a s hex, e i t h e r 0 0 1 0 (2) or 0 0 1 1 (3)). As a side note, t h i s is p r e t t y nice for r o u t i n g s y s t e m s ! So we c a n see t h a t t h e r e are two levels of u n i c a s t s c o p e d a d d r e s s e s . T h e first type of s c o p e d a d d r e s s for IPv6 is t h e Link Local U n i c a s t a d d r e s s , w h i c h exists only on t h e m e d i a t h a t c o n n e c t s two or m o r e m a c h i n e s together. For i n s t a n c e , on a PPP l i n k (or HDLC, F r a m e - R e l a y , E t h e r n e t , T o k e n Ring) t h e r e will be a specific s e t of a d d r e s s s p a c e especially d e s i g n e d for t h a t link. T h e m o t i v a t i o n for t h i s w a s to allow IPv6 s p e a k i n g m a c h i n e s to h a v e a s e t of a d d r e s s e s f r o m w h i c h to link g r o u p s of m a c h i n e s t o g e t h e r in o r d e r to c o m m u n i c a t e f u n c t i o n s t h a t a r e specific to t h a t link. For i n s t a n c e , Link Local a d d r e s s e s c a n be u s e d for t h i n g s like N e i g h b o r Discovery, or A u t o - C o n f i g u r a t i o n ( d i s c u s s e d later). T h i s allows all m a c h i n e s to h a v e a n a d d r e s s t h a t allows t h e m to t a l k to o t h e r directly c o n n e c t e d m a c h i n e s (directly c o n n e c t e d a t Layer 1 or 2 in t h i s case; c o n s i d e r two m a c h i n e s t h a t a r e on t h e s a m e E t h e r n e t s u b n e t a s b e i n g directly c o n n e c t e d ) . Notice t h a t in itself, t h i s relieves s o m e of t h e b u r d e n of r e n u m b e r i n g . A l t h o u g h a n a d m i n i s t r a t o r r e n u m b e r s a n e t w o r k , for w h a t e v e r r e a s o n , at l e a s t m a c h i n e s t h a t n e e d to t a l k to e a c h

383

384

Chapter 9 * IPv6 Addressing

o t h e r c a n still do so o u t s i d e of the Globally R o u t a b l e U n i c a s t a d d r e s s . Link Local a d d r e s s e s are to be r o u t e d only on t h a t link, a n d are n o t to be s e n t into a n y IGP (Interior G a t e w a y Protocol) or EGP (Exterior G a t e w a y Protocol; to o t h e r r o u t i n g domains), for obvio u s r e a s o n s . They are Link Local after all! Most r o u t i n g s y s t e m s for IPv6 t o d a y have this functionality built into their o p e r a t i n g s y s t e m s (it is u n c l e a r w h e t h e r r o u t i n g s y s t e m s will n e e d to have this a u t o matically built in at this time, b u t it s e e m s to m a k e the b e s t s e n s e t h a t t h e y do). Table 9.2 IPv6 Address First-Bits Standards Allocation

Prefix (binary)

Fraction of Address Space

Reserved Unassigned Reserved for NSAP Allocation Reserved for IPX Allocation Unassigned Unassigned Unassigned Aggregatable Global Unicast Addresses Unassigned Unassigned Unassigned Unassigned

0000 0000 0000 0001 0000 001

1/256 1/256 1/128

0000 010

1/128

0000 011

1/128 1/32 1/16 1/8

Unassigned Unassigned Unassigned Unassigned

110

Unassigned Unassigned

0000 1 0001 001

1/8 1/8 1/8 1/8

010 011 100 101

1110 1111 1111 1111 1111

0 10 110 1110 0

1/8 1/16 1/32 1/64 1/128 1/512 Continued

IPv6 Addressing 9Chapter 9 Allocation

Prefix (binary)

Fraction of Address Space

Link-Local Unicast Addresses

1111 1110 10

1/1024

Site-Local Unicast Addresses

1111 1110 11

1/1024

Multicast Addresses

1111 1111

1/256

The s e c o n d type of s c o p e d a d d r e s s is t h e site-local a d d r e s s . This a d d r e s s d e s i g n a t e s a r o u t i n g d o m a i n , or s u b s e t of a r o u t i n g d o m a i n . M a c h i n e s t h a t are a d d r e s s e d site-locally will be able to c o m m u n i cate w i t h o t h e r d e s i g n a t e d s u b n e t s t h r o u g h t h i s a d d r e s s i n g s c h e m e , b u t will n o t r o u t e globally on t h e I n t e r n e t . This c a n benefit u s in s o m e w a y s a s well. P e r h a p s t h e r e is a n e e d for a m a c h i n e to s p e a k w i t h o t h e r i n t e r n a l m a c h i n e s a t a n office, b u t t h e a d m i n i s t r a t o r w a n t s to m a k e s u r e t h a t t h a t p a r t i c u l a r m a c h i n e ( p e r h a p s a n a c c o u n t i n g m a c h i n e for a c o m p a n y , for example) c a n n o t r o u t e t h r o u g h t h e I n t e r n e t . T h r o u g h t h e u s e of Site Local a d d r e s s i n g , we c a n a c c o m p l i s h this, w i t h o u t t h e i n t e r v e n t i o n of c o m p l e x s e c u r i t y s c h e m e s to e n s u r e t h a t a m a c h i n e is invisible to t h e b a d g u y s o u t t h e r e w h o w a n t to c a u s e t r o u b l e (this does n o t s u b s t i t u t e for a netw o r k security, b u t does e n s u r e t h a t p a c k e t s c o m i n g from t h i s h o s t do n o t r e a c h t h e global internet). The b a s i c r o u t i n g p r i n c i p l e s a s s o ciated w i t h Site Local a d d r e s s e s are c o m m o n s e n s e . A Site Local a d d r e s s m a y be r o u t e d t h r o u g h a n IGP, b u t s h o u l d n e v e r p a s s into a n EGP. Again, m o s t of t h e time, a n intelligent r o u t i n g s y s t e m will h a v e t h e ability to d i s c e r n t h e s e r o u t e s by t h e i r u n i q u e a d d r e s s i n g , a n d m a k e s u r e t h a t t h e y are n o t l e a k e d to t h e I n t e r n e t . So a s we c a n see, IPv6 m a k e s a n a t t e m p t (and a p r e t t y good one a t that) for s e p a r a t i n g o u t a d d r e s s e s t h a t are i n t e r n a l to a r o u t i n g d o m a i n , or i n t e r n a l to a given n e t w o r k or link, a n d m a k e s s u r e t h a t t h e I n t e r n e t r o u t i n g table integrity is m a i n t a i n e d . Now t h a t we h a v e a n i d e a of w h a t t y p e s of local a d d r e s s i n g IPv6 h a s for us, let u s look a t s o m e of t h e b e n e f i t s of scoping. F i g u r e 9.9 s h o w s a d d r e s s e s t h a t h a v e b e e n a s s i g n e d to h o s t s in t h e Site Local, Link Local, a n d Globally R o u t a b l e U n i c a s t space.

385

386

Chapter 9

9IPv6 Addressing

F i g u r e 9.9 Scoped addresses on a LAN.

Now t h a t we h a v e m a c h i n e s t h a t c a n s p e a k to e a c h o t h e r on a LAN or link w i t h w e l l - k n o w n a d d r e s s e s t h a t are a l w a y s in t h e s a m e r a n g e , we c a n look a t s o m e of t h e b e n e f i t s a s s o c i a t e d w i t h t h i s scenario. Earlier in t h e c h a p t e r , we m e n t i o n e d t h e p r o b l e m s a s s o c i a t e d w i t h r e n u m b e r i n g t o d a y in IPv4. R e n u m b e r i n g a n e t w o r k is r a t h e r c o m p l e x w i t h IPv4, b e c a u s e n o t only w o u l d y o u h a v e to sit a t every m a c h i n e {or DHCP s e r v e r a t t h e least) for every n e t w o r k a n d r e c o n figure t h e LAN to u s e n e w IPv4 a d d r e s s e s , b u t also t h e r e w o u l d be c o n s i d e r a b l e d o w n t i m e w i t h t h i s a p p r o a c h . F u r t h e r m o r e , services s u c h a s D o m a i n N a m e Service p o t e n t i a l l y could be d r a s t i c a l l y

IPv6 Addressing

9Chapter 9

i m p a c t e d b y t h i s u n d e r t a k i n g , in t h a t zone files w o u l d n e e d to be c h a n g e d to reflect n e w f o r w a r d a n d r e v e r s e DNS e n t r i e s for m a c h i n e s . If y o u a r e in t h e I n t e r n e t b u s i n e s s , p r o v i d i n g a c c e s s to services or i n f o r m a t i o n t h a t n e e d s to be r e a c h a b l e to c o n s u m e r s a t a n y time, y o u c a n see h o w t h i s c a n c o s t b u s i n e s s e s m o n e y . Today, d o w n t i m e is b e c o m i n g m o r e a n d m o r e pricey a s people b e g i n to rely m o r e a n d m o r e u p o n I n t e r n e t availability for b u s i n e s s - c r i t i c a l applic a t i o n s a n d i n f o r m a t i o n . We will see in t h e following s e c t i o n s h o w IP v e r s i o n 6 will help u s to m i n i m i z e d o w n t i m e , while also h e l p i n g a d m i n i s t r a t o r s (those p o o r fellows) to k e e p u p w i t h n e t w o r k c h a n g e s s u c h a s r e n u m b e r i n g , m o r e efficiently.

IPv6 Benefits Now t h a t we h a v e looked into t h e p r o m i s e t h a t IPv6 gives to t h e I n t e r n e t of t h e f u t u r e , let u s d i s c u s s s o m e of t h e b e n e f i t s of IPv6 in m o r e detail, in o r d e r to see h o w t h i s protocol a t t e m p t s to deal w i t h t h e I n t e r n e t a n d b u s i n e s s n e t w o r k p r o b l e m s of today. We will look a t t h e two m a i n p r o b l e m s t h a t IPv6 s o l v e s ~ a d d r e s s d e p l e t i o n a n d r o u t i n g s c a l a b i l i t y ~ i n m o r e detail, a n d t h e n look a t s o m e of t h e a d d e d b e n e f i t s t h a t IPv6 gives to n e t w o r k d e s i g n e r s a n d a d m i n i s t r a tors.

387

388

Chapter 9

9IPv6 Addressing

Increased IP Address Size We n o w u n d e r s t a n d t h a t IPv6 h a s 128 bits for reserving. Let u s look at t h i s closer a n d a p p r e c i a t e the v a s t n e s s of this degree of a d d r e s s space. 128 bits of a d d r e s s s p a c e m e a n s t h a t t h e r e are 2~28 different a d d r e s s e s available. B e c a u s e we a l r e a d y k n o w t h a t the first t h r e e bits of 001 are reserved for Globally R o u t a b l e U n i c a s t a d d r e s s e s , we n o w have 125 bits left to play with (128-3= 125). So n o w we h a v e 2125 a d d r e s s e s available before Globally R o u t a b l e U n i c a s t a d d r e s s s p a c e is depleted, roughly, 4.25 E + 0 3 7 a d d r e s s e s . To p u t this into perspective, let u s c o m p a r e this to IPv4. In IPv4, we u s e all a d d r e s s s p a c e b e t w e e n 0.0.0.0 a n d 2 2 3 . 2 5 5 . 2 5 5 . 2 5 5 for u n i c a s t r o u t i n g (we will n o t t a k e into a c c o u n t t h e a d d r e s s e s delegated as n o n r o u t a b l e r e s e r v e d a d d r e s s e s as defined by RFC 1918), w h i c h is a p p r o x i m a t e l y 2 . 1 5 E + 0 9 a d d r e s s e s (3 t i m e s 229, as t h e r e are t h r e e legal possibilities for t h e first t h r e e bits, 000, 100, 110, a n d 101). This m e a n s t h a t t h e r e 23~ m o r e a d d r e s s e s t h a n IPv4l Clearly, 128 bits provides e n o u g h a d d r e s s s p a c e to t a k e c u r r e n t I n t e r n e t t r e n d s well into t h e future. We could even a r g u e t h a t this is a s e e m i n g l y i n e x h a u s t i b l e a m o u n t of a d d r e s s space. A l t h o u g h this n u m b e r is big, we will see, w h e n we get into t h e details of LAN a n d WAN configuration, t h a t t h i s is n o t quite t h e case, b u t t h e r e is still m a n y t i m e s t h e a d d r e s s s p a c e of IPv4. One t h i n g to get u s e d to t h i n k i n g of in order to a p p r e c i a t e IPv6 is t h e n u m b e r of n e t w o r k s t h a t IPv6 c a n s u p p o r t . F r o m t h e a d d r e s s f o r m a t d i s c u s s e d previously, we k n o w t h a t , in a n IPv6 a d d r e s s , t h e l a s t 64 bits d e s c r i b e s t h e h o s t ID for a s y s t e m on a network. Did this s e e m fishy w h e n y o u r e a d it? It p r o b a b l y s h o u l d have. IPv6 a c t u a l l y u s e s t h e last 64 bits of t h e a d d r e s s to d i s t i n g u i s h h o s t s from one another. W h e t h e r u s i n g t h e Link Local, Site Local, or Globally R o u t a b l e U n i c a s t a d d r e s s format, the l a s t 64 bits on a m a c h i n e will r e m a i n t h e same. This is b e c a u s e IPv6 u s e s t h e Layer 2 MAC a d d r e s s (the a d d r e s s t h a t is b u r n e d into all Layer 2 h a r d ware; for example, E t h e r n e t c a r d s or o t h e r Network Interface Cards) as t h e h o s t ID for a m a c h i n e . This does, in fact, limit the n u m b e r of a d d r e s s e s t h a t are o u t there, b e c a u s e t h e r e will rarely be 264

IPv6 Addressing

9Chapter 9

a d d r e s s e s in u s e on a typical E t h e r n e t LAN (we c o u l d a r g u e t h a t t h e r e will n e v e r be 264 m a c h i n e s on a LAN; especially on 10 or 100 Meg E t h e r n e t ! ) . S o m e a d d r e s s s p a c e definitely gets w a s t e d . However, if y o u r e m o v e t h e 64 b i t s u s e d for h o s t id, a n d t h e first t h r e e b i t s of a d d r e s s s p a c e to d e s i g n a t e Globally R o u t a b l e U n i c a s t a d d r e s s e s , y o u get 26~ p o s s i b l e (2.31E+018) n e t w o r k s , c o m p a r e d to 1 . 0 7 E + 0 9 t h a t IPv4 p r o v i d e s ( a s s u m i n g t h a t e v e r y n e t w o r k in IPv4 is a / 2 8 , of w h i c h m o s t a r e not; t h i s n u m b e r is derived by m u l t i P l y i n g 4 t i m e s t h e first 28 bits of a d d r e s s space). Notice t h a t t h i s is still 2.1 billion t i m e s a s m a n y n e t w o r k s a s IPv4 allows, a n d IPv6 d o e s n o t h a v e t h e n e t w o r k r e s t r i c t i o n t h a t we a s s u m e h e r e for IPv4 (the n u m b e r of IPv4 n e t w o r k s u s e d h e r e is for t h e n u m b e r of LANs if all IPv4 n e t w o r k s w e r e s u b n e t t e d d o w n t o / 2 8 s ; 13 h o s t s , one d e f a u l t router, one r e s e r v e d , a n d one b r o a d c a s t for t h e network). So we see t h a t we h a v e 2.1 billion t i m e s a s m a n y n e t w o r k s a s this, a n d t h e IPv6 n e t w o r k s h e r e c a n h a v e u p to 1.8E+ 19 h o s t s on e a c h n e t w o r k ( m i n u s one for t h e d e f a u l t router). So even w i t h o u t u s i n g all of t h e a d d r e s s es t h a t IPv6 c a n u s e , we h a v e t h e s c a l i n g ability to t a k e u s well b e y o n d t h e f u t u r e of IPv4, a n d in all likelihood, t h e s c a l i n g ability to t a k e all of u s t h r o u g h all of o u r c a r e e r s in t h e IT field (or a n y o t h e r field). Clearly, IPv6 frees u p t h e ability to u s e A d d r e s s i n g efficiently, w i t h o u t h a v i n g to w o r r y a b o u t r u n n i n g out. P l e a s e k e e p in m i n d t h a t I do n o t m e a n to s a y t h a t a d d r e s s s p a c e s h o u l d be u s e d in a carefree m a n n e r . T h i s is h o w IPv4 c a m e into t h e p r e d i c a m e n t t h a t it is in so early in its life cycle!

Increased Addressing Hierarchy Support As we l e a r n e d earlier in t h e c h a p t e r , IPv6 a d d r e s s i n g h a s r e s t r u c t u r e d t h e m e a n s b y w h i c h a d d r e s s b l o c k s a r e delegated. A l t h o u g h IPv4 first u s e d t h e c l a s s f u l IP a s s i g n m e n t rules, a n d t h e n b e g a n to a s s i g n b a s e d on t h e p r i n c i P l e s of CIDR, IPv6 c o r r e c t s t h e d e a g g r e g a tion p r o b l e m s a s s o c i a t e d w i t h e a c h b y s p l i t t i n g t h e IPv6 a d d r e s s into a s e t of definite scopes, or b o u n d a r i e s , b y w h i c h IPv6 a d d r e s s e s a r e delegated.

389

390

Chapter 9

9IPv6 Addressing

The F o r m a t Prefix is u s e d to s h o w t h a t a n a d d r e s s is Globally R o u t a b l e Unicast, or a n o t h e r type of a d d r e s s , a n d is always set to t h e s a m e value. This allows a r o u t i n g s y s t e m to d i s c e r n quickly w h e t h e r or n o t a p a c k e t is Globally Routable Unicast, or another. By k n o w i n g t h i s quickly, the r o u t i n g device c a n m o r e efficiently p a s s the p a c k e t off to r o u t i n g s u b s y s t e m s for p r o p e r handling. The Top Level Aggregator ID is u s e d for two p u r p o s e s . First, it is u s e d to d e s i g n a t e a big block of a d d r e s s e s from w h i c h s m a l l e r blocks of a d d r e s s e s are carved, in order to give d o w n s t r e a m connectivity to t h o s e who n e e d to get to the Internet. Second, it is u s e d to d i s t i n g u i s h w h e r e a r o u t e h a s come from. If big blocks of a d d r e s s s p a c e are given o u t to Providers only, a n d t h e n in t u r n delegated d o w n to c u s t o m e r s , it b e c o m e s easier to see w h i c h t r a n s i t n e t w o r k a r o u t e h a s traversed, or from w h i c h t r a n s i t n e t w o r k the r o u t e first originated. With IPv4, in which, historically, m a n y a d d r e s s e s were portable, a n d the n u m b e r s a u t h o r i t i e s were delegating blocks d o w n to small b u s i n e s s e s , it b e c a m e impossible to k n o w w h e r e a r o u t e c a m e from w i t h o u t t r a c e r o u t i n g b a c k t o w a r d s the s o u r c e of the packet. Now, with IPv6, the possibilities for d e t e r m i n i n g the s o u r c e of a r o u t e are m o r e feasible. Imagine a n I n t e r n e t c o n s i s t i n g of 500 Tier 1 providers. If this were the case (which is m o s t likely n o t too far off from today, t h o u g h w h a t m a k e s a provider a Tier 1 provider is very a m b i g u o u s ) t h e n at the very least a q u i c k s e a r c h t h r o u g h a text file could tell y o u w h e r e a r o u t e originated, b a s e d on the TLA ID of t h e longest m a t c h route. It's even possible to c o n t a i n software t h a t h a s this functionality b u i l t into it (though I k n o w of n o n e curr e n t l y in existence, a n d this software w o u l d m o s t likely b e c o m e outd a t e d quickly, as n e w delegations were assigned). Let u s look at the size of the T I ~ in more detail. We d i s c u s s e d in prior sections how the a d d r e s s space would be given only to providers, or those who needed their own IPv6 space (the t e r m needed is u s e d cautiously here, as it is a m b i g u o u s as well--there are currently no set b o u n d a r i e s or r e q u i r e m e n t s with respect to w h a t need means). This way, we are able to sufficiently aggregate prefixes into big blocks at the I n t e m e t core, a n d p a s s fewer routes between r o u t i n g d o m a i n s , as well as internally, w h i c h will i n c r e a s e the efficiency of the I n t e r n e t core.

IPv6 Addressing

9Chapter 9

For tim, let u s a s s u m e t h a t we have the delegation 3D00::B234::/24. Let us fiJrther a s s u m e t h a t all of our customers have sufficient need for a / 4 8 delegation for their networks. This leaves u s with 24 bits of addressing to delegate out! This is quite a lot of address space. The n u m b e r of n e t w o r k s we can support with this scheme is equivalent to the n u m b e r of hosts t h a t we could support with a classfial Class A IPv4 address block! You can see t h a t there will be m u c h more p r e s s u r e on Tier 1 Service Providers to efficiently track the delegation of address space t h a t they make. Today, a Tier 1 Service provider gets addresses in blocks of perhaps / 1 6 or less. If we a s s u m e t h a t a Service Provider today only delegates addresses up t o / 2 4 , t h a t leaves only 256 delegations (8 bits) t h a t the Service Provider can m a k e prior to applying for more address space. Most Tier-1 Service Providers today are required to subnet delegations down to at l e a s t / 2 8 in order to qualify for more address space, so this example m a y not be entirely realistic, b u t we can still grasp the size of a TI.A as being m o n u m e n t a l compared to t h a t of the a s s i g n m e n t s t h a t h a p p e n today.

As we c a n see from the previous example, Tier 1 Service Providers will have a n e x t r e m e l y big set of a d d r e s s s p a c e to deal with. This will n o t only eliminate m u c h of the politics s u r r o u n d i n g a d d r e s s delegation a n d o b t a i n i n g m o r e a d d r e s s blocks, b u t will also provide m o t i v a t i o n for m a j o r s u p p o r t a n d a u t o m a t i o n i n f r a s t r u c t u r e

391

392

Chapter 9

9IPv6 Addressing

u p g r a d e s w i t h i n a n organization. M a n y Service Providers t o d a y h a v e difficulty in u p g r a d i n g s u p p o r t s t r u c t u r e d u e to the e n g r a i n e d functionality a n d i n t e r d e p e n d e n c i e s of m a n y s u p p o r t p l a t f o r m s i n t e g r a t ed together. IPv6 provides for g r e a t challenges a n d o p p o r t u n i t i e s n o t only in n e t w o r k engineering a n d a r c h i t e c t u r e , b u t also in IT developm e n t a n d integration. The trick will be m a k i n g a move from the old to the n e w world look like a fresh start, r a t h e r t h a n a w o r k a r o u n d for s u p p o r t . The Next Level Aggregator a d d r e s s block is a block of a d d r e s s e s t h a t are a s s i g n e d to a d o w n s t r e a m o u t of a TLA block. We k n o w t h a t t h e s e a d d r e s s e s are to be aggregated as m u c h as possible into bigger TLA blocks, w h e n t h e y are e x c h a n g e d b e t w e e n providers, in the I n t e r n e t core. Let u s look at the benefits of this type of a d d r e s s i n g s t r u c t u r e from the NLA perspective. There are two m a i n v a l u e s in getting a d d r e s s s p a c e from a provider. The first a d v a n t a g e or value h a s to do with individual B a c k b o n e r o u t i n g stability. If we are a NLA a n d w i s h to provide d o w n s t r e a m service to o u r c u s t o m e r s , we will m o s t likely w i s h to provide the fullest, m o s t r o b u s t service we c a n to o u r client b a s e in o r d e r to r e t a i n c u r r e n t clients, a n d to gain m a r k e t s h a r e . P e r h a p s we w i s h to allow c u s t o m e r to c o n n e c t to u s at multiple locations, as we are fairly geographically diverse for a given region, a n d have rich connectivity u p s t r e a m to I n t e r n e t Tier-1 (the core) providers. F u r t h e r m o r e , we w a n t to allow o u r c u s t o m e r s to receive a full r o u t ing table s h o u l d t h e y desire one, if t h e y w a n t to u s e explicit r o u t e s to form t h e i r r o u t i n g policy. P e r h a p s t h e y w i s h to l o a d - b a l a n c e b e t w e e n two c o n n e c t i o n s , u s i n g s o m e d e s t i n a t i o n s preferred t h r o u g h one connection, a n d the r e s t preferred t h r o u g h the o t h e r c o n n e c t i o n to us. To do this, we have to c a r r y full r o u t e s in o u r B a c k b o n e , so we m a y p a s s t h e m d o w n to o u r c u s t o m e r s . T h o u g h a n I n t e r n e t core is u s u a l l y c o m p o s e d of very m o d e r n , r o b u s t r o u t i n g e q u i p m e n t , a Tier-2 provider m a y n o t be able to afford to u p g r a d e t h e i r B a c k b o n e s c o n s t a n t l y in order to keep u p with n e w technology, as well as i n c r e a s e d r o u t i n g table size. Luckily, p r o c e s s i n g power is n o t as big of a worry as it could be with IPv6. B e c a u s e the

IPv6 Addressing

9Chapter 9

I n t e r n e t core is f u n d a m e n t a l l y aggregated efficiently, we n o w have a m u c h s m a l l e r r o u t i n g table to m a i n t a i n . We c a n provide full r o u t e s to a c u s t o m e r , a n d t h a t set of r o u t e s m a y not be too big for u s to handle. So by everyone "playing nice" a n d following a g g r e g a t i o n s strategies, we are able to r e a p the benefits of the core's m i n i m i z e d r o u t i n g table size in o u r own B a c k b o n e . The s e c o n d benefit to NLA aggregation h a s to do w i t h a c t u a l r o u t e stability of o u r r o u t e s a c r o s s the I n t e r n e t core globally. A little b a c k g r o u n d is n e e d e d in o r d e r to fully a p p r e c i a t e this point. In the b e g i n n i n g of the I n t e r n e t explosion in size, t h e r e were t i m e s w h e n the I n t e r n e t w a s n o t very stable. BGP s p e a k e r s w o u l d lose r o u t e s , d u e to B a c k b o n e links failing, i m m a t u r e software, a n d the like. B e c a u s e of this, r o u t e s were c o n s t a n t l y being advertised, a n d t h e n w i t h d r a w n (when the r o u t e b e c a m e u n r e a c h a b l e ) , c a u s i n g considerably m o r e p r o c e s s i n g to t a k e place on core r o u t e r s , w h i c h are r e q u i r e d to keep a n u p - t o - d a t e set of full I n t e r n e t r o u t e s at all times. To c o m b a t this BGP instability, the c o n c e p t of route dampening c a m e into being. Essentially, r o u t e d a m p e n i n g w o r k s in the following way: Every time a r o u t e is w i t h d r a w n a n d readvertised, it is a s s i g n e d a penalty, w h i c h is r e c o r d e d at the place of instability (usually a n EBGP session). The m o r e the r o u t e flaps, the h i g h e r the p e n a l t y a s s o c i a t e d with t h a t r o u t e gets. W h e n the p e n a l t y a s s o c i a t e d with t h a t r o u t e r e a c h e s a c e r t a i n level, the r o u t e is w i t h d r a w n , a n d not a c c e p t e d for a d v e r t i s e m e n t for a given period of time. W h e n this h a p p e n s , the r o u t e is k n o w n as dampened. The d a m p e n e d r o u t e m u s t u n d e r g o s o m e period of wait time, w i t h o u t flapping m o r e (or the p e n a l t y gets even higher) before it c a n be r e - i n t r o d u c e d into a r o u t e r ' s BGP table. W h e n the r o u t e goes for a long e n o u g h period of time w i t h o u t flapping (the p e n a l t y d e c r e a s e s with time) t h e n the r o u t e is a g a i n allowed, a n d it is i n s e r t e d b a c k into the r o u t e r ' s BGP table, a n d t r e a t e d like o t h e r routes. This r o u t e d a m p e n i n g allowed a w a y for the I n t e r n e t core to deal with instabilities in a m a n n e r t h a t m i n i m i z e d the cost of o t h e r crucial processing. Now t h a t we u n d e r s t a n d r o u t e d a m p e n i n g , we c a n a p p r e c i a t e the s e c o n d benefit of aggregation. W h e n o u r u p s t r e a m provider

393

394

Chapter 9 *

IPv6 Addressing

aggregates this r o u t e for us, a n d only a n n o u n c e s the aggregate to t h e i r peers, this aggregate will in all likelihood r e m a i n stable, witho u t r e s p e c t to the stability of o u r own network. B e c a u s e of this, we are virtually c e r t a i n t h a t a n o t h e r provider will never d a m p e n o u r r o u t e s s o m e w h e r e else in the Internet. None of the m o r e specific r o u t e s t h a t we u s e n e e d be s p r e a d a c r o s s the I n t e r n e t core, o u t s i d e of o u r own u p s t r e a m provider. This improved r o u t i n g stability is a m a j o r benefit to aggregation as a whole, b o t h in IPv4, a n d in IPv6. The good p a r t is t h a t it is r e q u i r e d in IPv6, i n s t e a d of only being reco m m e n d e d . So now, the only place t h a t we m a y n e e d to w o r r y a b o u t being d a m p e n e d is w i t h i n o u r own u p s t r e a m provider's network. F o r t u n a t e l y , b e c a u s e in m o s t cases, we are paying for o u r u p s t r e a m connectivity, it is s u b s t a n t i a l l y easier to get o u r own u p s t r e a m provider to help u s to remove the p e n a l t i e s on d a m p e n e d r o u t e s t h a n it is with a n o t h e r provider, to w h o m we have no financial obligation. So as we c a n see, with the exception of m o r e a d d r e s s e s a n d s m a l l e r r o u t i n g table sizes, t h e r e are m o r e r a m i f i c a t i o n s of IPv6 aggregation s c h e m e s t h a n first m e e t the eye. The Site Level Aggregator enjoys m o s t of the benefits t h a t a n NLA does, except for its size. The Site Level Aggregator is u s u a l l y a netw o r k or n e t w o r k provider with a m u c h s m a l l e r network. B e c a u s e of this, a s m a l l e r delegation of a d d r e s s s p a c e is needed. It r e t a i n s t h e v a l u e s of aggregations, in t h a t its r o u t i n g t a b l e s are k e p t smaller, even w h e n receiving a full I n t e r n e t r o u t i n g table from its u p s t r e a m provider. It also enjoys t h e benefits of global r o u t e stability, in t h a t its u p s t r e a m providers, w h e t h e r a n NLA or a TLA, aggregate according to the principles of the IPv6 aggregations model.

Simplified Host Addressing As we h a v e s t u d i e d earlier, the IPv6 model defines 128 bits of a d d r e s s space. The first 64 bits are u s e d for n e t w o r k n u m b e r i n g , a n d the l a s t 64 bits are u s e d for h o s t n u m b e r i n g . We also r e m e m b e r t h a t the l a s t 64 bits of the h o s t ID are o b t a i n e d from the MAC a d d r e s s of the h o s t ' s Network Interface. You m a y w o n d e r h o w the

IPv6 Addressing

9Chapter 9

6 4 - b i t a d d r e s s is derived from a MAC a d d r e s s , w h i c h is classically only 48 bits. In this section we will look into h o w a d d r e s s is derived, a n d w h a t d e v e l o p m e n t s we m a y see in t h e f u t u r e as a r e s u l t of the IPv6's a d d r e s s i n g s c h e m e . W h e n a s s i g n i n g a h o s t in IPv4, by convention, one will b r e a k u p the s u b n e t given, a n d a s s i g n h o s t a d d r e s s e s b a s e d u p o n t h e a d d r e s s e s t h a t are available. Normally, a g a i n by convention, t h e first a d d r e s s is given to t h e d e s i g n a t e d router, a n d the r e s t of t h e a d d r e s s e s get a s s i g n e d to h o s t s on t h a t s u b n e t , r e s e r v i n g t h e last a d d r e s s in t h e s u b n e t for t h e b r o a d c a s t a d d r e s s e s for t h a t s u b n e t . In IPv6, the s i t u a t i o n c h a n g e s s o m e w h a t . With IPv6, we k n o w t h a t the h o s t ID is a 6 4 - b i t a d d r e s s t h a t is o b t a i n e d from t h e MAC a d d r e s s . A l t h o u g h t h e MAC a d d r e s s e s of t o d a y are classically 48 bits, we n e e d a w a y to get t h e h o s t ID to come o u t to 64 bits. The a n s w e r to this p r o b l e m is to p a d t h e MAC a d d r e s s with s o m e well-defined set of bits t h a t will be k n o w n by r o u t i n g s y s t e m s on t h a t s u b n e t . Today, we u s e the s t r i n g 0XFF a n d 0 x F E (:FF:FE: in IPv6 terms) to p a d t h e MAC a d d r e s s b e t w e e n the c o m p a n y ID a n d the v e n d o r - s u p p l i e d ID of the MAC a d d r e s s (MAC a d d r e s s e s are delegated in m u c h t h e s a m e w a y as IP a d d r e s s e s today, except c o m p a nies w h o m a k e NIC c a r d s are given a piece of MAC space, r a t h e r t h a n providers b e i n g given IPv4 space). This way, every h o s t will have a 6 4 - b i t h o s t ID t h a t is related to their MAC a d d r e s s in the s a m e way. F u r t h e r m o r e , we k n o w t h a t the 64-bit MAC a d d r e s s will be u n i q u e on a given network, b e c a u s e every NIC c a r d will have a u n i q u e MAC a d d r e s s . By u s i n g this well-defined p a d d i n g , it n o w b e c o m e s possible to l e a r n IPv6 a d d r e s s e s (or at least h o s t IDs) of o t h e r m a c h i n e s on the s u b n e t , simply by l e a r n i n g the Layer 2 MAC information. One i n t e r e s t i n g d e b a t e is w h e t h e r or n o t MAC a d d r e s s e s will n e e d to b e c o m e 64 bits in l e n g t h prior to the w i d e s p r e a d deploym e n t of IPv6. If t h e r e is a n e e d for MAC a d d r e s s e s to b e c o m e longer (if all MAC a d d r e s s e s are used) t h e n 64 bits will m o s t likely be the n e x t option for length, as this will s u p p l y over 1.8E019 m o r e MAC a d d r e s s e s to u s e (264-248). Moreover, if this b e c o m e s the case, we

395

396

Chapter 9

9IPv6 Addressing

m a y s i m p l y s t o p t h e p a d d i n g of t h e MAC a d d r e s s , a n d u s e t h e full 64 b i t s of t h e MAC a d d r e s s for t h e H o s t ID. Now t h a t we see w h e r e t h e H o s t ID c o m e s from, let u s n o w look into one of a n a d m i n i s t r a t o r ' s favorite a s p e c t s of IPv6. Not only is H o s t ID a l r e a d y d e t e r m i n e d p r i o r to c o n f i g u r i n g a n I P v 6 - s p e a k i n g m a c h i n e , b u t t h e n e t w o r k on w h i c h it r e s i d e s c a n be d e d u c e d a s well.

Simpler Autoconfiguration of Addresses Now t h a t we u n d e r s t a n d w h e r e t h e H o s t ID c o m e s from, let u s look a t one of t h e n e w e s t i n v e n t i o n s of IPv6, its ability to a u t o c o n f i g u r e . Before we go into detail a b o u t a u t o c o n f i g u r a t i o n , a n e w type of a d d r e s s will h a v e to be b r o u g h t into o u r repertoire, t h e m u l t i c a s t address. A m u l t i c a s t a d d r e s s c a n be a s s i g n e d to m o r e t h a n one m a c h i n e s i m u l t a n e o u s l y . It differs f r o m a n a n y c a s t a d d r e s s : a n y c a s t p a c k e t s a r e r o u t e d to t h e d e s t i n a t i o n (one of t h e s e t of m a c h i n e s w i t h t h e s a m e a d d r e s s ) t h a t is closest, b u t m u l t i c a s t p a c k e t s a r e r o u t e d to all m a c h i n e s t h a t are a s s i g n e d t h i s a d d r e s s . T h i s is f u n d a m e n t a l l y different t h a n a Globally R o u t a b l e U n i c a s t a d d r e s s , b e c a u s e m o r e t h a n one h o s t c a n be n u m b e r e d w i t h t h e s a m e a d d r e s s , so t h e a d d r e s s t h a t a given h o s t is a s s i g n e d n e e d n o t n e c e s s a r i l y be u n i q u e for t h e given scope on w h i c h t h e m u l t i c a s t a d d r e s s is acting. All m a c h i n e s a s s i g n e d t h i s m u l t i c a s t a d d r e s s are s a i d to be in a m u l t i c a s t g r o u p , w h o s e a d d r e s s is t h e m u l t i c a s t a d d r e s s t h e y u s e . M u l t i c a s t - s p e a k i n g m a c h i n e s s e n d a n d receive d a t a f r o m m o r e t h a n one h o s t (every m e m b e r in t h a t group). T h i s type of a d d r e s s i n g a n d r o u t i n g classically h a s b e e n u s e d for 1 to N, or M to N type I n t e r n e t t r a n s a c t i o n s (when one or m o r e people n e e d to get i d e n t i c a l inform a t i o n to m o r e t h a n one d e s t i n a t i o n ) . M u l t i c a s t p r o v i d e s t h e effic i e n t m e a n s to do so. Now t h a t we u n d e r s t a n d the idea of multicast, if we unite this idea with the idea of Host ID coming from the h a r d w a r e on a given machine, we c a n see how autoconfiguration is possible. W h e n a m a c h i n e first powers u p onto a network, a n d realizes t h a t it is connected a n d is

IPv6 Addressing

9Chapter 9

s u p p o s e d to s p e a k IPv6, it will send a m u l t i c a s t p a c k e t - t h a t is well k n o w n a n d defined by s t a n d a r d - o u t onto the LAN s e g m e n t to which it is attached. This p a c k e t will be destined towards a locally-scoped (see earlier) m u l t i c a s t address, k n o w n as the Solicited Node Multicast address. W h e n the r o u t e r sees this p a c k e t come in, it c a n t h e n reply with the network a d d r e s s from which the m a c h i n e s h o u l d be n u m b e r e d , in the payload of the reply packet. The m a c h i n e receives the packet, a n d in t u r n r e a d s the n e t w o r k n u m b e r t h a t the r o u t e r h a s sent. It t h e n assigns itself a n IPv6 a d d r e s s t h a t consists of t h a t n e t w o r k n u m b e r , a p p e n d i n g its Host ID (obtained from its MAC a d d r e s s of the interface t h a t it connected to t h a t subnet) to the network n u m b e r , a n d it n o w h a s a n IPv6 address. Not only does this not involve m a n u a l intervention by the a d m i n i s t r a t o r to configure this m a c h i n e (though it m a y or m a y not involve m a n u a l configuration of the r o u t e r on t h a t subnet), b u t it also does not require a n y worry a b o u t the a d d r e s s being n o n u n i q u e . The m a c h i n e is g u a r a n teed to have a u n i q u e a d d r e s s b e c a u s e the n e t w o r k n u m b e r is assigned uniquely by the r o u t e r on t h a t network. The Host ID is u n i q u e b e c a u s e the MAC a d d r e s s of the interface by which t h a t m a c h i n e is a t t a c h e d is provided by the vendor a n d is unique. F u r t h e r m o r e , it c a n learn the default route t h a t it n e e d s in order to get off of t h a t subnet, n o w t h a t it h a s a routable address. Notice the ease of configuration t h a t we now have w h e n we move from one network to another. Not only do we no longer have to reconfigu r e a n end-station m a n u a l l y (and t h e n reboot in m o s t cases), we also no longer have to take time out of our network administrator's b u s y day for h i m to delegate a n a d d r e s s in order to e n s u r e its u n i q u e n e s s . Also, the a d m i n i s t r a t o r no longer h a s to keep t r a c k of the a d d r e s s e s t h a t he h a s assigned, a n d which ones are free at a n y given time! Certainly, this c a n be seen to save a n e t w o r k a d m i n i s t r a t o r m u c h time, b o t h in p a p e r w o r k associated with keeping t r a c k of a d d r e s s e s used, a n d in reconfiguration t h a t m u s t occur for a network to be r e n u m b e r e d . T h i n k of the things a n a d m i n i s t r a t o r could be doing ff he or she isn't constantly being h o u n d e d for IP a d d r e s s e s or network n u m b e r s ! We will get into the concept of the m u l t i c a s t address, a n d its possible uses, in more detail in a later section. See Figure 9.10 for a graphical r e p r e s e n t a t i o n of autoconfiguration.

397

398

Chapter 9

9IPv6

Addressing

Figure 9.10 LAN discovery mechanism.

Improved Scalability of Multicast Routing Now t h a t we have s t u d i e d u n i c a s t a d d r e s s i n g , looked at the p r i m a r y m e r i t s of m u l t i c a s t a d d r e s s i n g , a n d discovered the potential of r o u t ing table size scalability on the I n t e r n e t with IPv6, let u s t a k e a m o m e n t to d i s c u s s the m u l t i c a s t a d d r e s s in a little m o r e detail. M u l t i c a s t servers are p e r h a p s the m o s t m i s u n d e r s t o o d technology of today. Let's look into the c o n c e p t of m u l t i c a s t i n g in general. In the beginning, the I n t e r n e t w a s p r i m a r i l y a r e s e a r c h n e t w o r k u p o n w h i c h r e s e a r c h d a t a flowed from one u n i v e r s i t y to another. This w a s n o t big b u s i n e s s , so congestion p r o b l e m s were

IPv6 Addressing

9Chapter 9

t o l e r a t e d , a n d t h e d a t a t h a t people w e r e s e n d i n g w a s n o t d a t e d ( b e c a u s e d a t a d i d n ' t n e e d to be received in real-time). Today, b y c o n t r a s t , b u s i n e s s e s a n d c o n s u m e r s a r e u s i n g t h e I n t e r n e t for a v a s t a r r a y of a p p l i c a t i o n s . More a n d mor e , we a r e s e e i n g different t y p e s of m e d i a going over t h e I n t e r n e t , w h e t h e r it is s t o c k q u o t e s , p h o n e calls, or even o u r favorite TV c h a n n e l . We see t h e n e e d for m e d i a to n o t only arrive quickly, b u t also to be s e n t to a n i n c r e a s e d audience. Even things s u c h as n e w s g r o u p s are getting information o u t to millions of people e a c h day. T h i s 1 to N t r a n s m i s s i o n t r e n d is b r i n g i n g a b o u t a n e e d for a n e w type of traffic s e n d i n g , in w h i c h one p e r s o n c a n s e n d a piece of d a t a to m a n y people. In t h e p a s t , if we w a n t e d to s e n d a piece of d a t a to 10 friends, we w o u l d s i m p l y m a k e 10 copies of t h a t d a t a , a n d s e n d t h e m to e a c h p e r s o n one a t a time. However, a s t h i s type of t r a n s m i s s i o n g a i n s p o p u l a r i t y , a s c a l i n g p r o b l e m t a k e s place. For i n s t a n c e , p e r h a p s we h a v e a video or a r a d i o s h o w t h a t we w i s h to s e n d o u t over t h e I n t e r n e t . If we w a n t to s e n d t h i s m e d i a to 1 0 , 0 0 0 people w h o all w a n t to see t h i s s h o w in a f a s h i o n a s close to realtime a s possible, we r u n into a p r o b l e m . Now in o r d e r to do so, we h a v e to m a k e s u r e t h a t o u r u p s t r e a m b a n d w i d t h is sufficient to h a n d l e u p to 1 0 , 0 0 0 t i m e s t h e d a t a r a t e of one t r a n s m i s s i o n . We n o w m u s t s p e n d m u c h m o r e m o n e y in o r d e r to p u r c h a s e t h i s u p s t r e a m b a n d w i d t h a n d satisfy o u r client b a s e (our v i e w e r s or listeners). F o r t u n a t e l y , t h e c o n c e p t of m u l t i c a s t w a s c o n c e i v e d s o m e time ago, a n d h a s b e e n in a t e s t i n g p h a s e for quite s o m e time. T h e c o n c e p t of t a k i n g one piece of d a t a , a n d s e n d i n g it to m a n y i n t e r e s t ed p a r t i e s at once, efficiently, b e c o m e s quite a c o m p l e x r o u t i n g p r o b l e m , especially if we b e c o m e c a u g h t in t h e u n i c a s t p a r a d i g m we ar e all u s e d to. T h e c o n c e p t of m u l t i c a s t a d d r e s s e s t h i s p r o b l e m . In a m u l t i c a s t s i t u a t i o n , we h a v e a 1 to N (or M to N) r e l a t i o n s h i p b e t w e e n t h e s o u r c e a n d t h e d e s t i n a t i o n . I n s t e a d of u s i n g a u n i c a s t a d d r e s s to d e s i g n a t e t h a t we a re i n t e r e s t e d in receiving a given m u l t i c a s t feed, t h e c o n c e p t of a m u l t i c a s t a d d r e s s is u s e d . A m u l t i c a s t a d d r e s s , in IPv4, is u s u a l l y r e f e r r e d to a s a g r o u p a d d r e s s . T h i s g r o u p a d d r e s s , w h e n a p p l i e d to a m a c h i n e , or to a n a p p l i c a t i o n on t h a t m a c h i n e , signifies t h a t we a re i n t e r e s t e d in l i s t e n i n g to a n y

399

400

Chapter 9

9IPv6 Addressing

d a t a t h a t is s e n t to t h a t address. In IPv4, the a d d r e s s range from 224.0.0.0 t h r o u g h 2 3 9 . 2 5 5 . 2 5 5 . 2 5 5 is u s e d to designate m u l t i c a s t group addresses. W h e n someone w a n t s to receive m u l t i c a s t feeds, they (temporarily or permanently, depending on the situation) a d d r e s s themselves with t h a t address, a n d effectively listen for packets coming along t h a t have t h a t m u l t i c a s t a d d r e s s listed as a destination The r o u t i n g for m u l t i c a s t b e c o m e s r a t h e r complex, a n d is o u t of the scope of this book, b u t y o u are e n c o u r a g e d to r e a d m o r e a b o u t this. Good i n f o r m a t i o n c a n be f o u n d either in the M u l t i c a s t F o r u m h o m e page at h t t p : / / w w w . i p m u l t i c a s t . c o m , or in the IETF w o r k i n g g r o u p s r e g a r d i n g m u l t i c a s t . S o m e of the working g r o u p s y o u m a y w i s h to c h e c k o u t include the Mbone D e p l o y m e n t Working G r o u p ( w w w . i e t f . o r g / h t m l . c h a r t e r s / m b o n e d - c h a r t e r . h t m l ) or the InterD o m a i n M u l t i c a s t Routing Working G r o u p ( w w w . i e t f . o r g / h t m l . c h a r t e r s / i d m r - c h a r t e r . h t m l ) . There are also a n u m b e r of protocol-specific working g r o u p s c u r r e n t l y active w i t h i n the IETF, i n c l u d i n g the M u l t i c a s t S o u r c e Discovery Protocol Working G r o u p (MSDP) a n d the Protocol I n d e p e n d e n t M u l t i c a s t Working G r o u p (PIM). I leave it u p to you to l e a r n as m u c h as y o u w i s h a b o u t the c u r r e n t u p d a t e s to m u l t i c a s t r o u t i n g in general. For the p u r p o s e s of this book, let u s a s s u m e t h a t m u l t i c a s t works, a n d will help save u s b a n d w i d t h , since n o w we only n e e d to s e n d one s t r e a m o u t of o u r I n t e r n e t connection, a n d the B a c k b o n e will r e p r o d u c e it as s e e n fit to m a k e s u r e it gets to all the i n t e r e s t e d d e s t i n a t i o n s . IPv6 c o n t a i n s the c o n c e p t of a m u l t i c a s t scoping. One of the nice u s e s of m u l t i c a s t c a n be in a c o r p o r a t e network. P e r h a p s a m e m o n e e d s to be s e n t to all employees' w o r k s t a t i o n s at once, or a live videoconference from the CEO n e e d s to be s e n t over the c o r p o r a t e n e t w o r k to all employees. In a c o r p o r a t e network, we w a n t to save as m u c h m o n e y as possible on b a n d w i d t h , while m a i n t a i n i n g a n efficient r o u t i n g s t r u c t u r e . M u l t i c a s t b u y s u s j u s t that. However, in m o s t cases, we only w a n t m u l t i c a s t i n f o r m a t i o n (streams) to get to t h e places t h a t are s u p p o s e d to see t h e m . We do n o t w a n t the whole I n t e r n e t to h e a r o u r CEO talk a b o u t o u r n e w e s t secret initiative to t a k e over o u r competition! For this, IPv6 h a s b u i l t in the c o n c e p t of

IPv6 Addressing

9Chapter 9

m u l t i c a s t scoping. With IPv6, we c a n d e s i g n a t e c e r t a i n m u l t i c a s t s t r e a m s to be r o u t e d only w i t h i n a c e r t a i n area, a n d n e v e r to allow p a c k e t s to get o u t of t h a t area, for fear of who m a y see t h e m . This scoping will be well k n o w n a n d u n d e r s t o o d by all r o u t i n g entities, in o r d e r to e n s u r e , t h r o u g h m i n i m a l configuration, t h a t m u l t i c a s t d a t a a n d m u l t i c a s t r o u t e s do n o t get o u t s i d e the edges of the r o u t i n g d o m a i n for w h i c h t h e y are m e a n t to exist. Figure 9.11 p r e s e n t s m u l t i c a s t a d d r e s s i n g f o r m a t in a little detail.

Figure 9.11 I

8

IPv6 multicast address format.

I 4 I F .....

Illlllllllflgs f

F .....

4 I

+ ......

I

+

Iseopl + ......

1 12 bits g r o u p ID

+ . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . .

] 4.

So as we c a n see, the m u l t i c a s t a d d r e s s i n g a r c h i t e c t u r e is a little different t h a n t h a t of the Globally R o u t a b l e U n i c a s t a d d r e s s i n g form a t . Notice the first eight bits are all set to 1, w h i c h will allow a r o u t i n g device to k n o w i m m e d i a t e l y t h a t the p a c k e t is m u l t i c a s t in n a t u r e , a n d s u b j e c t to special h a n d l i n g a s s o c i a t e d with this p a c k e t type. The n e x t four bits are u s e d for flags. C u r r e n t l y , the first t h r e e bits in the figs field are reserved, a n d u n d e f i n e d , so t h e y s h o u l d always be set to 0 (though y o u will find s o m e i m p l e m e n t e r s of protocols will u s e t h e s e bits fallaciously for s o m e sort of p r o p r i e t a r y signaling. This is fine, u n t i l the bits get s t a n d a r d i z e d to s o m e t h i n g in the future, at w h i c h time incompatibilities arise). The f o u r t h bit is k n o w n as the T bit (see RFC2460), a n d is u s e d to decide w h e t h e r the m u l t i c a s t a d d r e s s is a p e r m a n e n t l y a s s i g n e d a d d r e s s (also k n o w n as well-known) or a t e m p o r a r y a s s i g n m e n t (also k n o w n as transient). So this field will tell u s if the m u l t i c a s t a d d r e s s being u s e d is one t h a t is s t a n d a r d ( p e r h a p s a g r o u p a d d r e s s u s e d to cont a c t all n o d e s w i t h i n a given r o u t i n g d o m a i n , for example) or a t e m porarily a s s i g n e d a d d r e s s ( p e r h a p s the M o n d a y n i g h t football g a m e b r o a d c a s t over the Internet). The n e x t field is the one we are interested in here. The scope field will d e t e r m i n e h o w far the m u l t i c a s t

401

402

Chapter 9

9IPv6 Addressing

p a c k e t c a n go, in w h a t a r e a s of a r o u t i n g d o m a i n t h e p a c k e t c a n travel, a n d t h e g r o u p a d d r e s s t h a t c a n be a d v e r t i s e d . T h e s c o p e field v a l u e s are in Table 9.3.

Table 9.3 Scope Definitions 0 1

2 3 4

5 6 7 8

9 A B

C D E F

reserved node-local scope link-local scope (unassigned) (unassigned) site-local scope (unassigned) unassigned) organization-local scope (unassigned) (unassigned) (unassigned) (unassigned) (unassigned) global scope reserved

D e p e n d i n g on h o w we a s s i g n o u r m u l t i c a s t a d d r e s s , we c a n control h o w far t h e m u l t i c a s t p a c k e t s will travel, a n d h o w far t h e r o u t ing a n n o u n c e m e n t s a s s o c i a t e d w i t h t h a t m u l t i c a s t g r o u p will get a d v e r t i s e d . For i n s t a n c e , if y o u w o u l d like to a d v e r t i s e a m u l t i c a s t s e s s i o n of y o u r fish t a n k in y o u r office, a n d y o u w o u l d like t h e w h o l e world to see it, y o u w o u l d a s s i g n a s c o p e of E (1110 in binary). However, if y o u w a n t to set u p a m u l t i c a s t g r o u p so y o u a n d y o u r c o w o r k e r s c a n h a v e a video c o n f e r e n c e over t h e c o r p o r a t e n e t w o r k , y o u w o u l d w a n t to m a k e s u r e to give t h e a d d r e s s u s e d a s c o p e of 5 (0101 in binary), or 2 if everyone involved is on t h e s a m e LAN a s y o u (0010 in binary). See h o w t h i s m a k e s life a little e a s i e r

IPv6 Addressing

9Chapter 9

for controlling h o w far i n f o r m a t i o n gets p r o p a g a t e d . Now, i n s t e a d of relying on a Network A d m i n i s t r a t o r to apply filters at the b o r d e r s of e a c h r o u t i n g d o m a i n , we c a n rely on software (which generally is not s u s c e p t i b l e to the s a m e sort of r a n d o m c h a n g e s t h a t n e t w o r k s are) to keep o u r traffic inside of the scope we want. This allows for privacy at a m u c h e a s i e r level to i m p l e m e n t . This is a n o t h e r benefit of IPv6. Not only are m u l t i c a s t b o u n d a r i e s well defined, t h e y are also e a s y to m a i n t a i n .

The Anycast Address IPv6 defines a n e w type of a d d r e s s , k n o w n as the a n y c a s t a d d r e s s . A l t h o u g h this form of a d d r e s s is deployed in a limited f a s h i o n in IPv4, IPv6 i n t e g r a t e s this a d d r e s s type into its o p e r a t i o n s , w h i c h i m p r o v e s r o u t i n g efficiency. In this section we will explore s o m e of the c h a r a c t e r i s t i c s of the a n y c a s t a d d r e s s in detail, a n d d i s c u s s s o m e of the i n t e r e s t i n g a p p l i c a t i o n s of the a n y c a s t a d d r e s s in the IPv6 I n t e r n e t of the future. An a n y c a s t a d d r e s s is a n IPv6 a d d r e s s w h i c h is a s s i g n e d to a g r o u p of one or m o r e h o s t s t h a t serve a c o m m o n p u r p o s e or function. W h e n p a c k e t s are s e n t to the IPv6 a n y c a s t a d d r e s s , r o u t i n g will dictate w h i c h m e m b e r of the g r o u p receives the packet, via the closest m a c h i n e to the source, as decided by the IGP (Interior G a t e w a y Protocol: the r o u t i n g protocol y o u u s e in y o u r r o u t i n g d o m a i n ; e.g., RIP, EIGRP, IS-IS) of the n e t w o r k in question. In this way, it b e c o m e s possible to d i s p e r s e f u n c t i o n a l i t y geographically a c r o s s y o u r n e t w o r k in a w a y t h a t h e l p s efficiency in two ways. This differs f u n d a m e n t a l l y with the m u l t i c a s t a d d r e s s . A l t h o u g h b o t h the a n y c a s t a n d the m u l t i c a s t a d d r e s s are a s s i g n e d to m o r e t h a n one host, the a n y c a s t a d d r e s s serves for d a t a t r a n s m i s s i o n s t h a t are 1 to 1, w h e r e a s m u l t i c a s t a d d r e s s i n g is u s e d w h e n a d a t a t r a n s m i s sion to multiple d e s t i n a t i o n s is required. Let u s look at the two m a i n benefits of the a n y c a s t a d d r e s s i n g s c h e m e . First, if y o u are going to the closest m a c h i n e in a group, a n d it is irrelevant w h i c h g r o u p m e m b e r y o u e x c h a n g e i n f o r m a t i o n with in the a n y c a s t group, y o u are u s u a l l y saving time by c o m m u n i c a t i n g

403

404

Chapter 9

9IPv6

Addressing

w i t h t h e c l o s e s t (IGP-wise) g r o u p m e m b e r . S e c o n d , w h e n y o u are going to t h e c l o s e s t a n y c a s t g r o u p m e m b e r , y o u are s a v i n g b a n d w i d t h , b e c a u s e t h e a m o u n t of d i s t a n c e a p a c k e t h a s to travel is in m o s t c a s e s m i n i m i z e d b y t h i s a p p r o a c h . So n o t only do y o u save time w i t h a n y c a s t , b u t y o u also save m o n e y ( b a n d w i d t h IS m o n e y t h e s e days) w i t h t h i s a p p r o a c h . T h e a n y c a s t a d d r e s s does n o t h a v e its own s e t of bits to define it, however; i n s t e a d , a n y c a s t a d d r e s s i n g is derived from e i t h e r s c o p e d or Globally R o u t a b l e U n i c a s t a d d r e s s e s . F r o m t h e p o i n t of a n IPv6s p e a k i n g m a c h i n e , t h e a n y c a s t a d d r e s s is no different t h a n a u n i c a s t a d d r e s s . The only difference is t h a t t h e r e m a y be o t h e r m a c h i n e s t h a t are also n u m b e r e d w i t h t h e s a m e s c o p e of u n i c a s t a d d r e s s , w i t h i n t h e s a m e region for w h i c h t h a t s c o p e is defined (for i n s t a n c e , y o u m a y h a v e m o r e t h a n one m a c h i n e w i t h a Site Local a n y c a s t a d d r e s s w i t h i n a given site). Now t h a t we u n d e r s t a n d t h e differences b e t w e e n a n y c a s t a n d m u l t i c a s t a d d r e s s e s , let u s look into s o m e p o s s i b l e u s e s of t h e a n y c a s t a d d r e s s . One nice a p p l i c a t i o n t h a t a n y c a s t c a n help w i t h is DNS ( D o m a i n N a m e Service). If we were to offer DNS to m a n y people or c u s t o m e r s , a s in t h e c a s e of m o s t Tier-1 Service Providers today, we w o u l d n e e d to b u i l d o u r DNS in a w a y t h a t c a n h a n d l e a large n u m b e r of q u e r i e s from all p a r t i e s for w h i c h we provide t h i s service. B e c a u s e of this, it is m o r e efficient to deploy m u l t i p l e DNS servers, a n d s p r e a d t h e m o u t geographically. This will allow for fail-over, if one DNS s e r v e r b e c o m e s u n r e a c h a b l e d u e to n e t w o r k failures, a n d will also allow u s to s p r e a d t h e load of o u r DNS service b e t w e e n t h e s e servers. However, we do n o t w a n t to m a k e o u r c u s t o m e r s a s s i g n too m a n y different IP a d d r e s s e s of DNS servers, a s m o s t people only u s e one or two. Also, we w a n t s o m e w a y for one or two IP a d d r e s s e s to be u s e d for all of o u r service geographically, for t h e fail-over r e a s o n j u s t s t a t e d . O n e w a y to do t h i s w o u l d be to a s s i g n e a c h DNS s e r v e r t h a t h a s i d e n t i c a l c o n f i g u r a t i o n a n d a u t h o r i t a t i v e i n f o r m a t i o n t h e SAME IP a d d r e s s . If we t h e n inject r o u t e s to e a c h of t h e s e DNS s e r v e r s into o u r B a c k b o n e r o u t i n g table, w h e n s o m e o n e w a n t s to q u e r y o u r

IPv6 Addressing

9Chapter 9

DNS, t h e r e q u e s t will be s e n t to the geographically closest DNS server. This will allow u s n o t only to split u p the load b e t w e e n multiple DNS servers, b u t also will avoid b a c k h a u l i n g DNS q u e r i e s a c r o s s o u r B a c k b o n e too m u c h . So by this m e t h o d of deployment, we are saving b o t h time for o u r c u s t o m e r s (DNS servers are close, so t h e y t h e d a t a t r a n s m i s s i o n t a k e s less time), a n d m o n e y for ourselves ( b a n d w i d t h = m o n e y for Service Providers). B e c a u s e DNS is U D P - b a s e d , r a t h e r t h a n TCP-based, t r a n s a c t i o n s b e t w e e n DNS servers a n d e n d - s t a t i o n s are quick, short, a n d n o t t r a c k e d with s e q u e n c i n g , error checking, etc. W h e n we w a n t to resolve a h o s t n a m e , a p a c k e t is s e n t to t h e DNS server r e q u e s t i n g t h e a d d r e s s a s s o c i a t e d with a given I n t e r n e t D o m a i n Name, a n d a r e s p o n s e is s e n t b a c k with the answer. This m a k e s t h e a n y c a s t - a d d r e s s i n g model viable for this type of application. For m o r e i n f o r m a t i o n on this specific type of deployment, y o u can read draft-catalone-rockell-hadns.00.t~.

405

406

Chapter 9

9IPv6 Addressing

The Need for Further Development A l t h o u g h IPv6 does in fact p r e s e n t m a n y n e w a n d u s e f u l ideas a i m e d at i n c r e a s e d efficiency a n d ease of r o u t i n g a n d configuration, the w o r k t h a t is n e e d e d prior to IPv6 d e p l o y m e n t natively on t h e I n t e r n e t is n o t done. In this section, we will look at one c u r r e n t i s s u e t h a t is gaining i n c r e a s e d a t t e n t i o n by the IETF w o r k i n g g r o u p IPNGWG (Internet Protocol, N e x t - G e n e r a t i o n Working Group; please see h t t p : / / w w w . i e t f . o r g / h t m l . c h a r t e r s / I P n g w g - c h a r t e r . h t m l for m o r e the w o r k i n g g r o u p ' s c h a r t e r a n d the c u r r e n t s t a t u s on their goals a n d h o w close t h e y are to r e a c h i n g them).

The Multihoming Problem Now t h a t we have basic familiarity with h o w IPv6 a d d r e s s i n g a n d r o u t i n g works, let u s look at one of the potential p r o b l e m s associated with IPv6 routing. We k n o w from earlier in this c h a p t e r t h a t Tier 1 Service Providers will be given large c h u n k s of a d d r e s s space, from w h i c h t h e y will delegate smaller bits of t h a t space to their customers, to n u m b e r their own n e t w o r k s . We also k n o w t h a t f u n d a m e n t a l to IPv6 is the c o n c e p t of firm r o u t e aggregation, by w h i c h t h a t Tier 1 Service Provider will n e e d to a n n o u n c e the aggregate of their space only to o t h e r Tier 1 peers. This will keep the r o u t i n g table size small, c o m p a r e d to w h a t it could be w i t h o u t aggregation, a n d r o u t e stability maximized, as c h a n g e s in small a r e a s of one's n e t w o r k n e e d n o t w i t h d r a w r o u t e s globally. This c a u s e s r o u t e d a m p e n i n g to affect r e a c h a b i l i t y once a n e t w o r k failure o c c u r s a n d is corrected. However, w h a t do we do w h e n a smaller network, s u c h as a n ISP or a b u s i n e s s , is b u y i n g I n t e r n e t connectivity t h r o u g h multiple providers? Classically, in IPv4, the w a y to do this is to r u n BGP from t h a t ISP or b u s i n e s s to its u p s t r e a m s , a n n o u n c i n g the IP s p a c e t h a t y o u o b t a i n e d from one of y o u r providers to b o t h of y o u r u p s t r e a m providers. T h e s e a n n o u n c e m e n t s in t u r n will n e e d to be a n n o u n c e d everywhere, in order for the Network A d m i n i s t r a t o r s of this small ISP or b u s i n e s s to r e t a i n the ability to l o a d - s h a r e over

IPv6 Addressing

9Chapter 9

b o t h of t h e s e I n t e r n e t c o n n e c t i o n s i n b o u n d . So the s u b n e t t h a t is delegated n o w h a s to be a c c e p t e d into the global r o u t e table. With IPv6, this violates f u n d a m e n t a l principles r e g a r d i n g aggregation. If we look at the IPv4 s c e n a r i o listed earlier in the chapter, a n d s u b s t i t u t e IPv6 a d d r e s s e s , we are left with the identical p r o b l e m s . Not only will the Service Provider (the one t h a t delegates the c u s t o m e r the a d d r e s s block) n e e d to allow the s m a l l e r block a n n o u n c e d from its c u s t o m e r , a n d h e a r d t h r o u g h its peer (the one t h r o u g h w h i c h the c u s t o m e r also b u y s connectivity), b u t it will have to export the m o r e specific r o u t e to all of its peers as well, so t h e y a u t o m a t i c a l l y do n o t choose the o t h e r provider (from w h o m the a d d r e s s block w a s n o t delegated) as the m o r e specific r o u t e a d v e r t i s e m e n t , a n d therefore the b e s t p a t h to the c u s t o m e r . Both the IPNGWG a n d the NGTRANSWG (Next-Generation TRANSition Working Group) are looking into this problem. At the time of this writing, t h e r e are a couple of prop o s e d s o l u t i o n s to this problem, b u t e a c h of t h e m p r e s e n t s o t h e r i n t e r e s t i n g d i l e m m a s as well. The first p r o p o s e d solution to this p r o b l e m is n o w w r i t t e n as a n RFC (RFC2260). This a p p r o a c h , s u m m e d up, is to follow the aggregation principles as outlined previously in the chapter, until s u c h time as a n e t w o r k failure occurs. W h e n everything is working, the b o r d e r r o u t e r to u p s t r e a m 1 s e n d s only the prefix t h a t w a s delegated by u p s t r e a m 1 to u p s t r e a m 1, a n d conversely, t h e b o r d e r r o u t e r t h a t c o n n e c t s to u p s t r e a m 2 a n n o u n c e s only the prefix t h a t u p s t r e a m 2 h a s delegated, u p to u p s t r e a m 2. W h e n a failure occurs, however, the b o r d e r r o u t e r t h a t does n o t have a failure will a n n o u n c e b o t h prefixes u p to the u p s t r e a m t h a t is still working. W h e n the connectivity failure is fixed, the illegal prefix is w i t h d r a w n , a n d the s i t u a t i o n r e t u r n s to n o r m a l . A l t h o u g h this p r o p o s a l h a s merits, since it allows for fail-over for a d o w n s t r e a m t h a t is multih o m e d a n d a s s i g n s a d d r e s s e s in its n e t w o r k from b o t h providers, it does p r e s e n t s o m e m a n a g e m e n t p r o b l e m s for the u p s t r e a m provider. If the u p s t r e a m provider h a s a n efficient r o u t i n g policy t o w a r d s its d o w n s t r e a m c u s t o m e r s , this u s u a l l y i n c l u d e s a filter on the BGP s e s s i o n to t h a t d o w n s t r e a m t h a t allows only r o u t e s t h a t the u p s t r e a m expects to h e a r from its d o w n s t r e a m c u s t o m e r . Now the

407

408

Chapter 9

9IPv6 Addressing

u p s t r e a m w o u l d have to allow b o t h the r o u t e it h a s delegated, a n d the r o u t e t h a t the o t h e r u p s t r e a m provider h a s delegated to its customer. F u r t h e r m o r e , the u p s t r e a m provider w h o receives b o t h prefixes h a s no w a y of k n o w i n g w h e n or even if a n e t w o r k failure h a s o c c u r r e d b e t w e e n its d o w n s t r e a m c u s t o m e r , a n d the o t h e r provider. Also, the u p s t r e a m provider h a s no w a y of d e t e r m i n i n g w h e n the d o w n s t r e a m c u s t o m e r ' s o t h e r provider c o n n e c t i o n h a s b e e n fixed, a n d t h e r o u t e s h o u l d be w i t h d r a w n . The only w a y to k n o w w o u l d be to rely on the d o w n s t r e a m c u s t o m e r to have their configuration done correctly to avoid a n n o u n c i n g b o t h r o u t e s w h e n everything works, a n d to have a software i m p l e m e n t a t i o n t h a t h a s the capability of a u t o m a t i c a l l y w i t h d r a w i n g the illegal r o u t e w h e n the p r o b l e m is fixed. A d o w n s t r e a m c u s t o m e r in this case could easily misconfigu r e their o u t b o u n d policy to a n n o u n c e b o t h r o u t e s illegally, even w h e n t h e r e is no failure. So in s u m m a t i o n , a l t h o u g h this p r o p o s a l does have merits, the i m p l e m e n t a t i o n specifics are n o t n e a r l y as controllable as a n u p s t r e a m provider w o u l d like. The s e c o n d proposal, w h i c h is c u r r e n t l y in u s e in the 6Bone IPv6 test network, is to a s s i g n e a c h m u l t i h o m e d h o s t a n a d d r e s s for e a c h u p s t r e a m connection, a n d therefore IPv6 delegation, t h a t the downs t r e a m c u s t o m e r has. For i n s t a n c e , if y o u are delegated two prefixes, one from Provider A, a n d one from Provider B, t h e n each m a c h i n e t h a t w i s h e s to u s e the benefits of m u l t i h o m i n g w o u l d n e e d to be a s s i g n e d a prefix from e a c h of the delegations received from Provider A a n d Provider B (let u s call t h e s e delegations Prefix A a n d Prefix B). So e a c h h o s t n o w h a s two Globally R o u t a b l e U n i c a s t a d d r e s s e s , one from Prefix A a n d one from Prefix B. Then, e a c h border r o u t e r t h a t s p e a k s with the u p s t r e a m providers c a n a n n o u n c e only the prefix delegated from t h a t provider, a n d the r o u t i n g is stable. In theory, if t h e r e is a n e t w o r k failure, a n d one provider b e c o m e s u n r e a c h a b l e , t h e n m a c h i n e s t h a t were u s i n g the a d d r e s s a s s o c i a t e d with t h a t provider c a n switch over to the a d d r e s s associated with the o t h e r provider, a n d connectivity is established. This solution c o m e s with its own h o s t of problems. First, this a p p r o a c h is n o t t h a t optimal w h e n it comes to efficient delegation of IPv6 a d d r e s s space. Now e a c h n e t w o r k with N u p s t r e a m providers

IPv6 Addressing

9Chapter 9

will have N a d d r e s s e s assigned to them. F u r t h e r m o r e , a n d p e r h a p s more important, is t h a t currently, TCP does not allow for a d d r e s s changing in the middle of a TCP session. The only solution is to a d j u s t TCP to allow for this, which in itself s e e m s easy, b u t the ramifications are far more t h a n m e e t the eye. Most TCP applications are built in s u c h a way t h a t modifications of TCP would require modifications of the application. This could m e a n drastic reworking of c u r r e n t network software. Also, c u r r e n t operating s y s t e m s themselves m a y need overhauling in order to switch source a d d r e s s e s dynamically w h e n a network becomes u n r e a c h a b l e . How does a source k n o w t h a t a network failure h a s OCCUlTed in the right place? W h a t if the destination h a d a problem? How would the source know if switching IPv6 source a d d r e s s e s would fix the problem? All of these factors lead u s to believe t h a t this is not a viable long-term solution either. So as y o u c a n see, m u l t i h o m i n g with IPv6 still h a s s o m e work. It is c u r r e n t l y of top priority in the IETF w o r k i n g g r o u p IPNGWG. Hopefully, t h e i r w o r k will p r o d u c e a solution t h a t is b o t h scalable, a n d able to a c c o m m o d a t e the p r o b l e m s a s s o c i a t e d with either of the p r e v i o u s p r o p o s a l s . S t a y t u n e d to this one!

The 6Bone Now t h a t we have the b a s i s for u n d e r s t a n d i n g e l e m e n t a r y IPv6 a d d r e s s i n g a n d routing, let u s look into c u r r e n t IPv6 d e p l o y m e n t , a n d its s u c c e s s e s a n d s h o r t c o m i n g s . The p r i m a r y e x a m p l e of IPv6 d e p l o y m e n t is the IETF N e x t - G e n e r a t i o n T r a n s i t i o n Working G r o u p (NGTRANSWG) 6Bone. The 6Bone is a n e t w o r k of I P v 6 - s p e a k i n g entities i n t e r c o n n e c t e d over the classical IPv4 I n t e r n e t . It c o n s i s t s of b o t h native n e t w o r k s (where IPv6 is r u n n i n g w i t h o u t being t u n n e l e d t h r o u g h a n o t h e r Layer 3 protocol) a n d IPv4 t u n n e l s b e t w e e n differe n t IPv6 s p e a k i n g entities. The p u r p o s e of this n e t w o r k is twofold. The first r e a s o n for the 6Bone is to provide i m p l e m e n t e r s a m e a n s to t e s t t h e i r IPv6 i m p l e m e n t a t i o n s in a large n e t w o r k w h e r e o t h e r v e n d o r s have deployed their own v e r s i o n of IPv6 i m p l e m e n t a t i o n s . By allowing this, we c a n e n s u r e t h a t IPv6 i m p l e m e n t a t i o n s are i n t e r o p e r a b l e . This way, protocol developers c a n m a k e s u r e t h a t the

409

410

Chapter 9

9IPv6 Addressing

protocol specifications are specific e n o u g h to allow for i m p l e m e n t e r s to develop I P v 6 - s p e a k i n g m a c h i n e s w i t h o u t ambiguity. The s e c o n d r e a s o n for the 6Bone is to give n e t w o r k o p e r a t o r s a c h a n c e to design n e t w o r k s a n d get their feet wet with the n e w protocol. Also, it allows o p e r a t o r s to u n c o v e r a n y p r o b l e m s with the IPv6 protocol (such as the p r e v i o u s m u l t i h o m i n g problems) t h a t m a y have b e e n m i s s e d or u n d e r a p p r e c i a t e d d u r i n g the p r o t o c o r s conception. A l t h o u g h the f a t h e r s of the IPv6 protocol were extremely m e t i c u lous in t h e p r o t o c o r s design, it never h u r t s to get the n e w technology r u n n i n g on a live n e t w o r k s o m e w h e r e prior to i m p l e m e n t a t i o n on a g r a n d scale. The 6Bone helps to w o r k all of the details out, a n d test n e w features, prior to deployment, in a cooperative, m u l t i n a tional fashion. It follows all r o u t i n g practices as defined by t h e IETF. For the m o s t c u r r e n t IPv6 r o u t i n g practices on the 6Bone, see www.ietf, o r g / i n t e r n e t - d r a f t s / d r a f t - i e t f - n g t r a n s - h a r d e n - 0 2 , t ~ . (Note: This is a n I n t e r n e t draft. At the time of this writing it is in the lastcall stage for RFC.) For m o r e i n f o r m a t i o n on the 6Bone, please see http: / / w w w . 6bone. net.

Summary We c a n see t h a t IPv6 provides for m a n y of the p r e s e n t l y n e e d e d i m p r o v e m e n t s in the Internet. Not only does it solve the a d d r e s s depletion p r o b l e m s of t o d a y ' s IPv4, b u t it also m a k e s for a m o r e scalable I n t e r n e t core, w h i c h c a n help improve r o u t i n g efficiency of the I n t e r n e t as a whole. By allowing for 128 bits of a d d r e s s e s , we c a n see t h a t t h e r e is a d e q u a t e a d d r e s s space for the future. By t h e n aggregating this a d d r e s s space in a n efficient m a n n e r , we m a y e s t a b l i s h a firm u p p e r limit on r o u t i n g table size in the I n t e r n e t core. This, in t u r n , c a n help u s to build a n I n t e r n e t to t a k e u s into the future. A l t h o u g h the two p r i m a r y p r o b l e m s of the I n t e r n e t c a n be solved with IPv6, the protocol i m p r o v e m e n t s do n o t stop there. Also built into the IPv6 protocol are m e a n s for h o p - b y - h o p routing, a u t h e n t i cation of p a c k e t s , e n c r y p t e d p a c k e t s , tag switching, Quality of

IPv6 Addressing

9Chapter 9

Service, a n d o t h e r t h i n g s to m a k e the protocol m o r e versatile t h a n its g r a n d f a t h e r , IPv4. F u r t h e r m o r e , IPv6 h a s b u i l t into it the ability to u s e m u l t i c a s t a n d u n i c a s t r o u t i n g in a m a n n e r s u c h t h a t b o u n d aries easily c a n be scoped to e n s u r e t h a t d a t a does n o t get to places w h e r e it is n o t allowed. IPv6 also i n t r o d u c e s the u s e of a n a n y c a s t a d d r e s s , for a p p l i c a t i o n s t h a t m a y be serviced by m u l t i p l e m a c h i n e s , b u t the n e e d for d i s t r i b u t i o n of t h e s e services in a scalable m a n n e r is required. We c a n also see t h a t IPv6 is a l r e a d y in testing, a n d is s t a r t i n g into p r o d u c t i o n in s o m e areas, c o n n e c t e d via the 6Bone. This virtual b a c k b o n e will provide for testing of b o t h IPv6 i m p l e m e n t a t i o n s a n d the protocol itself. Clearly, we c a n see t h a t IPv6 is getting m o r e a n d m o r e a t t e n t i o n , a n d is looking like a p r o m i s i n g a s p e c t for the f u t u r e of the Internet.

Q" W h e r e do I get a n IPv6 a d d r e s s ?

A: IPv6 a d d r e s s e s are delegated o u t by the Providers who h a v e t h e m . W h e n y o u join the 6Bone or a n y o t h e r IPv6 network, y o u r u p s t r e a m Provider is r e s p o n s i b l e for providing y o u w i t h a d e q u a t e IPv6 a d d r e s s s p a c e to t a k e care of y o u r needs.

411

412

Chapter 9

9IPv6

Addressing

Q" W h e r e do I get the IPv6 protocol specifications for m o r e details? A: All protocol specifications are in the form of IETF RFCs (Requests for Comments). These c a n be f o u n d at www.ietf.org; t h e r e is a s e a r c h engine w h e r e y o u c a n pull u p all c u r r e n t IPv6 RFC a n d I n t e r n e t drafts.

414

Chapter 10

9

The IPv6 Header

Introduction The IPv4 h a s served u s well in the past; however, some design decisions m a d e a couple of decades ago have m a n y s h o r t c o m i n g s for s u p p o r t i n g c u r r e n t a n d future networking. The IPv6 is the new IP protocol t h a t is designed to meet the r e q u i r e m e n t s for s u p p o r t i n g future generation networking, while interoperating with the c u r r e n t IPv4. With the growing popularity of internetworking, it h a s become a p p a r e n t t h a t the n u m b e r of nodes in the In tern et will outgrow the 32-bit a d d r e s s space u s e d in IPv4. Further, as the n u m b e r of a d d r e s s a b l e nodes increases, the size of the routing table is likely to grow. The larger routing table degrades the p e r f o r m a n c e of the IP network; this, a n d the shortage of a d d r e s s space, are the p r i m a r y c o n c e r n s for c ont i nue d us e of IPv4. These c o n c e r n s raised the need for a new IP protocol, IPv6. In addition to solving these problems, several other features have been incorporated in the design of IPv6 to e n h a n c e the IP network. The a dva nc e s in h a r d w a r e technology have resulted in the develo p m e n t of new applications, which m a y need special provisioning w h e n deployed over the network. However, the connectionless, ond e m a n d n a t u r e of IPv4 does not lend itself well for p e r - c o n n e c t i o n b a s e d support. The design of IPv6 includes flow labeling for providing p e r - c o n n e c t i o n - b a s e d support. For c o n t i n u e d s u c c e s s of IP internetworking, the u s e of the IP n e t w o r k s houl d be plug-and-play, similar to the use of a telephone system. To achieve the p l u g - a n d - p l a y concept in the IP network, configuration of a n IP node should be simple, if not automatic. Even with the c o n t i n u e d autoconfiguration effort s u c h as Dynamic Host Configuration Protocol, configuration of an IPv4 node h a s b een nontrivial so far. The IPv6 h a s be e n designed to better s u p p o r t autoconfiguration of IPv6 nodes. In recent years, the us e of the I n t e r n e t for m a n y b u s i n e s s e s h a s be e n increased drastically, a n d e-commerce h a s also gained popularity. It is n e c e s s a r y to i m p l e m e n t security features in internet-

The IPv6 Header

9Chapter 10

working. The security features are m a n d a t o r y in IPv6, m a k i n g an IPv6 n e t w o r k more suitable for meeting security r e q u i r e m e n t s . Most importantly, the design of IPv6 h a s provided for the transition from IPv4 to IPv6. This transition cannot occur overnight; therefore, the IPv6 ha s been designed with the a s s u m p t i o n th at the IPv4 network will coexist with the IPv6 network for a long time, if not indefinitely. Many design decisions are in place for interoperability with IPv4 nodes. A lot of investment h a s been made in the current infrastructure of IPv4 networks. Without the ability to communicate with the existing network, no new protocol is likely to replace the current intemetworking infrastructure successfully, regardless of its benefits. The design of IPv6 h a s s t e m m e d from limitations of w h a t IPv4 offers, a n d from lessons learned in IPv4. First, this c h a p t e r covers the c h a n g e s from IPv4 to IPv6. E x p a n d e d addressing, simplified header, improved extension a n d option support, flow labeling capability, a n d a u t h e n t i c a t i o n a n d privacy capability s u m m a r i z e these changes. The first three c h a n g e s are due to modifications to b a s e s of IPv4 technology s u c h as u s i n g 128-bit a d d r e s s size in s tead of 32bit, not allowing i n t e r m e d i a t e r o u t e r s to perform fragmentation, or e m b e d d i n g optional information in extension h e a d e r s i n s t e a d of including it in the IP header. The latter two c h a n g e s include additional functionality incorporated into the design of IPv6 to satisfy the n e t w o r k s u p p o r t c u r r e n t a n d n e a r - f u t u r e applications d e m a n d . This chapter also covers the format of the IPv6 h ead er an d extension header. The fields in the IPv6 header are discussed an d compared to those in the IPv4 header. The formats of extension headers are provided, along with an example usage of each extension header. Finally, u p p e r - l a y e r protocol i s s u e s imposed u p o n the u se of IPv6 are covered.

Expanded Addressing IPv4 u s e s 32-bit a d d r e s s e s , which potentially can a d d r e s s u p to 232 nodes. However, the c om bi na t i on of n e t w o r k a n d local a d d r e s s hiera r c h y a n d reserved a d d r e s s space for special handling, s u c h as

415

416

Chapter 10 * The IPv6 Header

loopback and broadcast, reduces the n u m b e r of a d d r e s s a b l e nodes. At the s a m e time, the exponential growth of c o m p u t e r networks in recent years indicates the outgrowth of addressable node using 32bit addresses. F u r t h e r m o r e , the network and local a d d r e s s hierarchy in IPv4 a d d r e s s architecture leads to inefficient use of a d d r e s s spaces. For instance, an organization t h a t needs far fewer t h a n 2~6 hosts, b u t more t h a n 28 hosts, m a y waste m u c h usable a d d r e s s space w h e n using a 2-octet network a d d r e s s and a 2-octet local address. Despite the inefficiency of the network a d d r e s s hierarchy, a fiat network a d d r e s s (e.g., a sequential a d d r e s s assignment) is not realistic, since network operations s u c h as routing would be impossible. When using a sequential a d d r e s s assignment, the size of routing tables would be u n m a n a g e a b l e and routing would become a slow process b e c a u s e of the a m o u n t of d a t a t h a t needs to be scanned. The IPv6 a d d r e s s size h a s been increased to 128 bits. The advantages of this increase are, one, more addressable nodes, and two, the ability to s u p p o r t more levels of addressing hierarchy. Better addressing hierarchy leads to more efficient network operations and network scaling. As more networks are added, the size of the routing table increases, and the routing process takes longer. A careful planning of addressing hierarchy can limit the growth of the size of the routing table, while routing packets efficiently. An organizational change often m e a n s configuration changes at each node t h a t is affected. For instance, w h e n an organization obtains a new Internet Service Provider (most often network a d d r e s s change), each node in this organization m u s t be reconfigured to reflect this. However, despite c o n t i n u o u s efforts of developing autoconfiguration m e c h a n i s m s s u c h as Dynamic Host Configuration Protocol, the reconfiguration process often needs to be done manually. The larger a d d r e s s space can s u p p o r t autoconfiguration better. In addition to increased a d d r e s s size, IPv6 h a s eliminated broadc a s t a d d r e s s and added the notion of a n y c a s t address, which can be u s e d to send a packet to any one of a group of nodes.

The IPv6 Header

9

Chapter 10

Simplified Header IPv6 h a s evolved from the IPv4 technology; experiences l e a r n e d from the IPv4 are reflected in the design of IPv6. The length of the IPv4 h e a d e r varies b e t w e e n 20 a n d 60 bytes, a n d t h e r e are 11 fields within the first 20 b y t e s of the IPv4 header. The complexity of IPv4 c a n lead to inefficient r o u t e r operations. By employing a s i m p l e r header, 8 fields in 40 bytes a n d fixed length of the header, IPv6 c a n e n h a n c e the p e r f o r m a n c e of r o u t e r s . A couple of fields in the IPv4 h e a d e r have b e e n either r e m o v e d or e m b e d d e d in e x t e n s i o n h e a d e r s . Since options are e m b e d d e d in e x t e n s i o n h e a d e r s , the length of the IPv6 h e a d e r is no longer variable, t h u s eliminating the n e e d for the H e a d e r Length field in the IPv6 header. In IPv6, only s o u r c e node c a n p e r f o r m f r a g m e n t a t i o n ; therefore, the i n f o r m a t i o n n e c e s s a r y for f r a g m e n t a t i o n a n d r e a s s e m bly is r e m o v e d from the IP header. Since the u p p e r - l a y e r protocol, s u c h as TCP a n d UDP, c a l c u l a t e s the c h e c k s u m for the entire packet, the C h e c k s u m field also c a n be r e m o v e d from the IP header.

Improved Support for Extension and Option Since the total length of the IPv4 h e a d e r is variable, the H e a d e r Length field is u s e d to indicate its length. The n u m b e r of bits in this field, 4 bits, d e t e r m i n e s the m a x i m u m length of the IPv4 header. In particular, 60 b y t e s is the largest size of the IPv4 header, for this field specifies the h e a d e r length in 4-octet units. Since the fixed portion of the IPv4 h e a d e r is 20 b y t e s long, it places a s t r i n g e n t r e q u i r e m e n t on the length of options.

417

418

Chapter 10

9The IPv6 Header

Flow and Flow Labeling IPv4 wa s designed to be connectionless (or stateless); in other words, each p a c k e t belonging to the s a m e session is routed independently, a n d two p a c k e t s from the s a m e session m a y arrive at the destination via different paths. This a p p r o a c h works well u n d e r erro r-p ro n e networks, s u c h as the time w h e n IPv4 w a s being developed. There is a cost associated with this, h o w e v e r ~ p r o c e s s i n g each p a c k e t at every hop a d d s to the delay, a n d it is not trivial to provide special services for a c o m m u n i cation between selected source a n d destination. With technological a d v a n c e s in networking, n e t w o r k failures, especially h a r d w a r e failures, have been drastically r e d u c e d in recent

The IPv6 Header

9Chapter 10

years. Also, n e w a p p l i c a t i o n s are m o r e t o l e r a n t to errors, b u t m o r e sensitive to f l u c t u a t i o n s in delay. It is inevitable t h a t n e t w o r k s s u p port s u c h applications. In the design of IPv6, the n o t i o n of a flow h a s b e e n i n c o r p o r a t e d in order to facilitate special h a n d l i n g of d a t a belonging to a n a p p l i c a t i o n with special r e q u i r e m e n t s . RFC 1883 defines a flow as a s e q u e n c e of p a c k e t s s e n t from a p a r t i c u l a r s o u r c e to a p a r t i c u l a r d e s t i n a t i o n for w h i c h the s o u r c e desires special h a n d l i n g by the i n t e r v e n i n g r o u t e r s . IPv6 provides a f r a m e w o r k for a n easier per-flow handling. A video application, w h i c h m a y have strict r e q u i r e m e n t s on the m a x i m u m delay difference, m a y t a k e a d v a n t a g e of flow a n d flow labeling in IPv6. The a p p l i c a t i o n m a r k s e a c h p a c k e t with a flow label, a n d r o u t e r s on the p a t h r e m e m b e r the s t a t e of p a c k e t t r a n s m i s s i o n s on this flow. This s t a t e i n f o r m a t i o n will help a r o u t e r to d e t e r m i n e w h i c h p a c k e t to service next. A r o u t e r m a y service a p a c k e t t h a t h a s the largest e l a p s e d time since its previous p a c k e t in the flow, for i n s t a n c e .

Authentication and Privacy No real s e c u r i t y f e a t u r e s have b e e n i n c o r p o r a t e d into the design of IPv4. However, the wide u s e of IP n e t w o r k s by the general public h a s led to the u s e of c o m p u t e r n e t w o r k s as a m e a n s of c o n d u c t i n g v a r i o u s k i n d s of b u s i n e s s e s . T h u s , it is n a t u r a l for the design of IPv6 to provide n e c e s s a r y s e c u r i t y m e a s u r e s . RFC2401 defines the s e c u r i t y a r c h i t e c t u r e for the IP network, a n d IPv6 u s e s the A u t h e n t i c a t i o n H e a d e r a n d E n c a p s u l a t i n g S e c u r i t y Payload extension h e a d e r s to i m p l e m e n t s u c h features. Both A u t h e n t i c a t i o n H e a d e r a n d E n c a p s u l a t i n g S e c u r i t y Payload h e a d e r c a n be u s e d alone, or as a c o m b i n a t i o n of s o u r c e a n d destin a t i o n or two s e c u r i t y gateways. The f o r m e r m o d e of o p e r a t i o n is called T r a n s p o r t Mode a n d the latter is referred to as T u n n e l i n g Mode operation. W h e n u s e d in t r a n s p o r t mode, the s o u r c e a n d d e s t i n a t i o n of a p a c k e t is the s e n d e r a n d receiver of the A u t h e n t i c a t i o n Header, respectively. W h e n u s e d in t u n n e l i n g mode, however, the s e c u r i t y

419

420

Chapter 10

9The IPv6 Header

g a t e w a y at the s o u r c e of a p a c k e t w o u l d be the s e n d e r of the A u t h e n t i c a t i o n Header, a n d the s e c u r i t y gateway at the d e s t i n a t i o n of this p a c k e t w o u l d be the receiver of the A u t h e n t i c a t i o n Header. The s e n d e r c a l c u l a t e s s e c u r e a n d reliable c h e c k s u m (message digest) c a l c u l a t i o n over p a c k e t s a n d places it in the A u t h e n t i c a t i o n Header. The receiver r e c a l c u l a t e s it a n d c o m p a r e s it to the v a l u e provided in A u t h e n t i c a t i o n Header. W h e n t h e s e v a l u e s differ, a p a c k e t is a s s u m e d to be d a m a g e d d u r i n g t r a n s m i s s i o n . Using E n c a p s u l a t i n g S e c u r i t y Payload, a p a y l o a d of a p a c k e t m a y be e n c r y p t e d , or the entire IP p a c k e t m a y be e n c r y p t e d in t u n nel m o d e via s e c u r i t y gateways. W h e n e n c r y p t e d in t u n n e l mode, real s o u r c e a n d d e s t i n a t i o n a n d s o m e IP h e a d e r i n f o r m a t i o n c a n be h i d d e n , t h u s m a k i n g it m o r e secure.

IPv6 Header The IPv6 h e a d e r is fixed in length a n d aligned at 8-octet b o u n d a r y , u n l i k e the IPv4 header, w h i c h is v a r i a b l e - l e n g t h a n d aligned at 4octet b o u n d a r y . Most m o d e r n c o m p u t e r a r c h i t e c t u r e s are optimized to r e a d 8 octets at a time. T h u s , the length of the IPv6 h e a d e r or e x t e n s i o n h e a d e r s is designed to be a multiple of 8-octets for 8-octet a l i g n m e n t . With a fixed IPv6 header, a r o u t e r c a n efficiently p r o c e s s a packet. For i n s t a n c e , a r o u t e r m u s t decide if t h e r e are a n y options in a n IPv4 p a c k e t by r e a d i n g the H e a d e r Length field. P r o c e s s i n g a v a r i a b l e - l e n g t h h e a d e r leads to inefficient r o u t e r i m p l e m e n t a t i o n . The c h a n g e s from the IPv4 h e a d e r a n d IPv6 h e a d e r will be covered in the s u b s e q u e n t section. In this section, e a c h field in the IPv6 h e a d e r a n d its i n t e n d e d role is described. Figure 10.1 s h o w s the form a t of a n IPv6 header. The IPv6 h e a d e r s t o r e s the i n f o r m a t i o n n e c e s s a r y to r o u t e a n d deliver p a c k e t s to their d e s t i n a t i o n . The h e a d e r s are p r o c e s s e d by e a c h n o d e along the p a t h . The first 4-bit field, version, i n d i c a t e s the v e r s i o n of the I n t e r n e t Protocol being u s e d , a n d its value is 6 for IPv6. This field is n e c e s s a r y b e c a u s e it allows b o t h protocols to coexist on the s a m e s e g m e n t w i t h o u t conflicts. The n e x t two fields,

The IPv6 Header

9Chapter 10

traffic class a n d flow label, are u s e d to provide differentiated services a n d s u p p o r t a p p l i c a t i o n s r e q u i r i n g special h a n d l i n g per-flow. The 8-bit traffic class field c a n be u s e d to provide differentiated services b a s e d on the n a t u r e of d a t a being t r a n s m i t t e d . This field is similar to the i n t e n d e d u s e of the type of service field in the IPv4 header. For i n s t a n c e , a n o r g a n i z a t i o n m a y set u p its n e t w o r k to prioritize n e t w o r k traffic b a s e d on applications, s o u r c e a n d d e s t i n a t i o n inform a t i o n , etc., a n d h o s t s a n d / o r r o u t e r s u s e the traffic class field to differentiate the priority. The v a l u e s a n d the exact u s e of this field are yet to be d e t e r m i n e d . The flow label, in c o m b i n a t i o n with s o u r c e a n d d e s t i n a t i o n a d d r e s s e s , c a n u n i q u e l y identify a flow t h a t r e q u i r e s special h a n d l i n g by i n t e r m e d i a t e r o u t e r s . W h e n a r o u t e r identifies a flow the first time, it r e m e m b e r s the flow a n d a n y special h a n d l i n g this flow requires. Once per-flow h a n d l i n g h a s b e e n set up, the processing of s u b s e q u e n t p a c k e t s belonging to this flow c a n be s h o r t e r t h a n p r o c e s s i n g individual p a c k e t s . The 16-bit p a y l o a d length field, similar to the total length field in t h e IPv4 header, i n d i c a t e s the length of t h e packet, n o t i n c l u d i n g the length of t h e IPv6 header. The 8-bit n e x t h e a d e r field is u s e d to indicate t h e n e x t h e a d e r following the IPv6 header. The i n t e n d e d u s e of this field is identical to the u s e of the protocol field in the IPv4 header. The h o p limit c a n be u s e d to limit the n u m b e r of i n t e r m e d i a t e h o p s a p a c k e t is allowed to visit, w h i c h c a n p r e v e n t p a c k e t s from being circularly r o u t e d in a network. In IPv4, the time to live field h a s b e e n u s e d to p r e v e n t p a c k e t s from being r o u t e d circularly. The n a m e of this field h a s b e e n c h o s e n to reflect a c c u r a t e l y the p u r p o s e of this field. As in IPv4 h e a d e r s , IPv6 h e a d e r s c o n t a i n s o u r c e a n d d e s t i n a t i o n IP a d d r e s s e s . Unlike IPv4 nodes, IPv6 n o d e s u s e 128-bit a d d r e s s e s .

421

422

C h a p t e r 10

9The IPv6 Header

Figure 10.1 IPv6 header. Version

Traffic Class Payload Length

Flow Label Next Header

Hop Limit

SourceIP Address

DestinationIP Address

IPv4 Header Figure 10.2 illustrates the f o r m a t of a n IPv4 header. The first 4-bit version field in the IPv4 h e a d e r is u s e d to indicate t h e c u r r e n t version of the I n t e r n e t Protocol (IP) being used. The s a m e field is u s e d in the IPv6 h e a d e r a n d is n e c e s s a r y in order to m a k e IPv6 b a c k w a r d - c o m p a t i b l e . The 4-bit h e a d e r length field is n e c e s s a r y for the IPv4 h e a d e r to indicate t h e length of the h e a d e r since the total length of the IPv4 h e a d e r is a variable length b e t w e e n 20 a n d 64 bytes, d e p e n d i n g on t h e p r e s e n c e a n d the length of options in the option field. However, this field is n o t n e c e s s a r y in a n IPv6 header, b e c a u s e a n IPv6 h e a d er is a fixed length of 40 bytes. The i n t e n t of this type of service field in IPv4 is similar to the traffic class field in the IPv6 header. Nevertheless, this field h a s n o t b e e n widely a c c e p t e d a n d u s e d in IPv4 i m p l e m e n t a t i o n s . Next, two fields in the IPv4 header, flags a n d f r a g m e n t a t i o n offset, are all related to the h a n d l i n g of f r a g m e n t a t i o n a n d the r e a s s e m b l y of p a c k e t s in IPv4. In IPv4, a n i n t e r m e d i a t e h o p m a y

The IPv6 Header

9Chapter 10

f u r t h e r f r a g m e n t a p a c k e t w h e n the m a x i m u m t r a n s f e r u n i t (MTU) on the outgoing link is s m a l l e r t h a n the size of the p a c k e t t h a t is to be t r a n s m i t t e d on t h a t link. Unlike IPv4, in IPv6, f r a g m e n t a t i o n processing t a k e s place only at the s o u r c e node, u s i n g a p a t h MTU. Further, i n f o r m a t i o n related to f r a g m e n t a t i o n is e n c o d e d in the F r a g m e n t a t i o n h e a d e r as a n e x t e n s i o n h e a d e r in a IPv6 packet. Therefore, identification, flags, a n d f r a g m e n t a t i o n offset fields are n o t n e c e s s a r y in the IPv6 header. Figure

10.2 IPv4 header.

In the original design of IPv4, the time to live field is u s e d to indicate the n u m b e r of s e c o n d s to live in a network, t h u s p r e v e n t i n g p a c k e t s from being circularly routed, if a circular r o u t e exists in a network. However, in i m p l e m e n t a t i o n s , this field is u s e d to limit the n u m b e r of h o p s the p a c k e t is allowed to visit. At e a c h hop, a r o u t e r d e c r e m e n t s this field, a n d w h e n this field r e a c h e s 0, the p a c k e t is r e m o v e d from the network. In IPv6, this field is r e n a m e d to h o p limit, a m o r e a c c u r a t e description of the i m p l e m e n t a t i o n . The protocol field, w h i c h is u s e d to indicate the next protocol (header) following this IPv4 header, is similar to the Next H e a d e r field in the IPv6 header.

423

424

Chapter 10

9The IPv6 Header

The h e a d e r c h e c k s u m field is u s e d to m a i n t a i n t h e integrity of the IPv4 header. However, the h i g h e r layer calculates t h e c h e c k s u m again for the entire packet, t h u s m a k i n g this field r e d u n d a n t . Therefore, this field is n o t u s e d in IPv6 header. If a p p l i c a t i o n s require a h i g h e r degree of integrity, t h e y c a n achieve it t h r o u g h a p p r o p r i a t e u s e of A u t h e n t i c a t i o n H e a d e r a n d E n c a p s u l a t i n g S e c u r i t y Payload e x t e n s i o n h e a d e r s . The s o u r c e a n d d e s t i n a t i o n fields in the IPv4 h e a d e r r e m a i n the s a m e in t h e IPv6, except t h a t the IPv4 n o d e a d d r e s s e s are 32 bits, a n d the IPv6 n o d e a d d r e s s e s are 128 bits. The u s e of options in IPv4 implies t h a t e a c h i n t e r m e d i a t e n o d e in the p a t h n e e d s to e x a m i n e t h e option field in the IPv4 header, a l t h o u g h t h e options m a y be p e r t i n e n t only to the d e s t i n a t i o n node. This leads to inefficient r o u t e r p e r f o r m a n c e w h e n options are used. In IPv6, optional i n f o r m a t i o n is e n c o d e d in e x t e n s i o n h e a d e r s .

Extension Headers Extension headers, placed between the IPv6 h e a d e r a n d the u p p e r layer protocol header, s u c h as a TCP-header, are u s e d to carry optional Internet-layer information in a packet. An IPv6 p a c k e t m a y carry zero, one, or more extension headers. The Next Header field in the IPv6 h e a d e r a n d extension h e a d e r s is u s e d to indicate w h i c h extension h e a d e r or u p p e r - l a y e r protocol h e a d e r follows the c u r r e n t header.

The IPv6 Header Table 10.1

Chapter 10

Next Value Headers

Next Header Value

Next Header

0

Hop-by-Hop Options header Internet Protocol

4

9

6 17

Transmission Control Protocol

43

Routing header

44

Fragment header

45

Inter-Domain Routing Protocol

46

Resource Reservation Protocol

50

Encapsulating Security Payload

51

Authentication header

58

Internet Control Message Protocol

59

No next header

60

Destination Options header

User Datagram Protocol

W h e n a TCP h e a d e r immediately follows an IPv6 h e a d e r w i t h o u t an extension header, the value of the Next Header field in the IPv6 h e a d e r indicates t h a t the following h e a d e r is a TCP header. W h e n a p a c k e t u s i n g TCP as its u p p e r - l a y e r protocol carries one extension header, Routing header, this extension h e a d e r is placed b etween the IPv6 h e a d e r a n d the TCP header. The Next Header field in the IPv6 h e a d e r indicates t h a t the Routing h e a d e r follows the IPv6 h e a d e r a n d the Next Header field in the Routing h e a d e r indicates t h a t the TCP h e a d e r immediately follows the Routing header. The Next Header value of 59 indicates t h a t there is no extension or u p p e r layer protocol h e a d e r following the c u r r e n t header. A full i m p l e m e n t a t i o n of IPv6 includes the following extension headers: Hop-by-Hop Options, Routing (Type 0), Fragment, Destination Options, Authentication, a n d E n c a p s u l a t i n g Security Payload. The r e c o m m e n d e d ordering of extension headers, w h e n multiple extension h e a d e r s are p r e s e n t in a packet, is as follows:

425

426

Chapter 10

9The IPv6 Header

9 IPv6 h e a d e r 9 Hop-by-Hop Options h e a d e r []

Destination Options h e a d e r (to be processed by all destination nodes a ppe arin g in the routing header)

9 Routing h e a d e r 9 Fragment header m Authentication h e a d e r 9 E n c a p s u l a t i n g Security Payload h e a d e r []

Destination Options h e a d e r (to be processed only by the final destination of the packet) u p p e r - l a y e r header.

Except for the Destination Options header, each extension header shoul d a p p e a r at m o s t once in a packet. The Destination Options h e a d e r c ont a i ns information to be processed by the final destination node. W h e n the Routing h e a d e r is present, an additional Destination Options h e a d e r m a y be u s e d for options to be processed by all nodes listed in the Routing header; in this case, there will be at m o s t two oc c ur r e nc e s of Destination Options h e a d e r s in an IPv6 packet. W h e n a n IPv4 p a c k e t carries an option t h a t is applicable only to its destination node, all intermediate nodes m u s t examine a n d process the p a c k e t before forwarding, t h u s impacting the performance of the forwarding nodes.

The IPv6 Header

9Chapter 10

E x c e p t for the H o p - b y - H o p O p t i o n s header, e x t e n s i o n h e a d e r s are e x a m i n e d or p r o c e s s e d only by the d e s t i n a t i o n n o d e (or nodes, in the case of multicast) of the packet. T h u s , a n IPv6 p a c k e t m a y carry optional i n f o r m a t i o n applicable only to its d e s t i n a t i o n node, w i t h o u t i m p a c t i n g the p e r f o r m a n c e of all i n t e r m e d i a t e nodes. The H o p - b y - H o p O p t i o n s h e a d e r c a n be u s e d to c a r r y optional i n f o r m a tion t h a t n e e d s to be e x a m i n e d or p r o c e s s e d at all i n t e r m e d i a t e nodes. The value of the Next H e a d e r field in the c u r r e n t h e a d e r determ i n e s the n e x t action to be t a k e n , a n d the s e m a n t i c s of c u r r e n t e x t e n s i o n h e a d e r d e t e r m i n e s w h e t h e r to c o n t i n u e p r o c e s s i n g the next header. T h u s , e x t e n s i o n h e a d e r s m u s t be e x a m i n e d in the order t h e y a p p e a r in a packet. A n o d e d i s c a r d s a p a c k e t a n d s e n d s a n ICMP P a r a m e t e r Problem m e s s a g e to the s o u r c e of the packet, with a n ICMP Code value of one, u n r e c o g n i z e d Next H e a d e r type e n c o u n t e r e d , w h e n it receives u n r e c o g n i z e d Next H e a d e r value in a packet. B e c a u s e the H o p - b y - H o p O p t i o n s h e a d e r m u s t i m m e d i a t e l y follow the IPv6 header, the Next H e a d e r value of zero in a n y h e a d e r o t h e r t h a n IPv6 h e a d e r is t r e a t e d as a p a c k e t with u n r e c o g n i z e d Next H e a d e r value. Currently, the H o p - b y - H o p O p t i o n s h e a d e r a n d the D e s t i n a t i o n O p t i o n s h e a d e r c a r r y a variable n u m b e r of options, e n c o d e d in Type-Length-Value (TLV) format, as seen in Figure 10.3. The Option Type identifiers are e n c o d e d in s u c h a w a y t h a t the h i g h e s t - o r d e r two bits specify the action to be t a k e n w h e n the processing n o d e does n o t recognize the Option Type, a n d the thirdh i g h e s t bit specifies w h e t h e r or n o t the Option D a t a of t h a t option c a n c h a n g e en r o u t e to the p a c k e t ' s final d e s t i n a t i o n . For i n s t a n c e , w h e n a n o d e e n c o u n t e r s a n u n k n o w n option type value of 130 (1000 0010), the h i g h e s t - o r d e r two bits indicate t h a t the n o d e m u s t d i s c a r d the p a c k e t a n d s e n d a n ICMP P a r a m e t e r Problem, Code 2, m e s s a g e to the s o u r c e of the packet. Table 10.2 d e s c r i b e s the e n c o d i n g of Option Type a n d its m e a n i n g for h a n d l i n g u n r e c o g n i z e d Option Type.

427

428

Chapter 10

9The IPv6 Header

Figure 10.3 TLV-encoded option format.

I OptionType I Opt Data Len I Option Type Opt Data Len Option Data

Table

Option Data

8-bit identifier of the type of option 8-bit unsignedinteger. Lengthof the option Data field of this option, in octets. Variable-length field. Option-Type-specificdata.

10.2 Option Type Encoding

Highest-order two

bits

Action to be taken

00

Skip over this option and continue processing the header.

01

Discard the packet.

10

Discard the packet and, regardless of whether or not the packet's Destination Address was not a multicast address, send an ICMP Parameter Problem, Code 2, message to the packet's Source Address, pointing to the unrecognized Option Type. Discard the packet, and only if the packet's Destination Address was not a multicast address, send an ICMP Parameter Problem, Code 2, message to the packet's Source Address, pointing to the unrecognized Option Type.

il

Some Option Type values m a y change as the packet progresses t h r o u g h the route to its destination. The third highest-order bit of the Option Type is u s e d to indicate if its d a t a value can be changed en-route or not. The third highest-order bit is 0 w h e n Option Data does not change en-route and 1 w h e n it m a y change. When the

The IPv6 Header

9Chapter 10

A u t h e n t i c a t i o n h e a d e r is used, the s o u r c e of the p a c k e t c o m p u t e s the a u t h e n t i c a t i n g value over the p a c k e t a n d places in t h e A u t h e n t i c a t i o n header. For Option Type w h o s e Option D a t a m a y c h a n g e en route, t h e Option D a t a is t r e a t e d as zero-valued octets w h e n c o m p u t i n g t h e p a c k e t ' s a u t h e n t i c a t i n g value. As s t a t e d before, e x t e n s i o n h e a d e r s are d e s i g n e d to be a multiple of 8-octets in length. To e n s u r e t h a t the end of the Option D a t a field is aligned with the 8-octet b o u n d a r y , specific Option Types m a y be a s s o c i a t e d with a l i g n m e n t r e q u i r e m e n t s in the form of xn+y, indicating t h a t the Option Type m u s t a p p e a r at a n integer multiple of x octets from the s t a r t of the header, p l u s y octets. For i n s t a n c e , a 4n+2 a l i g n m e n t r e q u i r e m e n t indicates t h a t the Option Type m u s t s t a r t at a n y 4-octet offset from the s t a r t of t h e header, p l u s 2 octets, s u c h as 2, 6, 10, 14, etc. TWo p a d d i n g options, Pad l option a n d PadN option, m a y be u s e d to m a k e h e a d e r s c o n t a i n i n g options to be m u l t i p l e s of 8 octets in length. The Pad l option, one zero-valued octet, is u s e d to i n s e r t one octet of p a d d i n g , a n d the PadN option is u s e d to i n s e r t m o r e t h a n one octet of padding. The f o r m a t of the PadN option is s h o w n in Figure 10.4. To i n s e r t 2 octets of padding, Pad2, one octet with the value of 1 a n d one octet (Option D a t a Length field) with the value of 0 c a n be used. The Pad2 option is a special case in t h a t t h e r e is no Option Data, or Option D a t a of 0 length is used.

Figure 10.4 PadN Option format.

I Opt Data Len I Opt Data Len OptionData

Option Data

For N octetsof padding,N-2 For N octetsof padding,N-2 zero-valuedoctets.

429

430

Chapter 10

9The IPv6 Header

Hop-by-Hop Option Header The Hop-by-Hop Options header, identified by a Next Header value of zero in the Ipv6 header, carries optional information that m u s t be processed by every node along a packet's delivery path. For instance, it may be necessary for a router to examine and process a packet containing control messages for new protocols, such as RSVP. The use of the Hop-by-Hop Options header allows routers to examine selectively packets for special handling, if necessary. The format of the Hop-by-Hop Option header is shown in Figure 10.5. Note that the Header Extension Length field is the length of the Hop-by-Hop Options header, in 8-octet units, not including the first 8 octets. In other words, when the length of TLV encoded option(s) is less t h a n or equal to 6 octets, the Header Extension Length field is zero. Examples of Hop-by-Hop Options include Router Alert Option and J u m b o Payload Option.

Figure 10.5 Hop-by-Hop Options header. Next Header I Hdr Ext Len [ Options

Next Header Hdr Ext Len Options

8-bit selector.Identifiesthe type of header immediately following the Hop-by-Hop Optionsheader. Usesthe same values as the IPv4 Protocolfield [RFC1700]. 8-bit unsignedinteger. Lengthof the Hop-by-HopOptionsheader in 8-octet units, not includingthe first 8 octets. Variable-length field, of length suchthat the complete Hop-by-Hop Optionsheader is an integer multiple of 8 octetslong. Containsone or more TLV-encodedoptions.

The IPv6 Header

9Chapter 10

A call set-up control message using RSVP protocol needs special provisioning at each router along the path of the connection. Using the Router Alert Hop-by-Hop option, routers can provide special handling. Processing of a Hop-by-Hop option may result in processing of an upper-layer protocol such as RSVP. The Option Type of the Router Alert option is 5 (00000101), indicating that nodes not recognizing this option should skip it and continue processing the header, and Option Data m u s t not change its value en route. The Option Length of Router Alert option is 2; thus, the valid range of Option Data is between 0 and 65,535. Currently, only 0, 1, and 2 have been defined to indicate a packet containing ICMPv6 Group Membership message, RSVP message, and Active Network message, respectively. No alignment requirement h a s been associated with this option. Figure 10.6(a) illustrates a packet containing a Router Alert Hopby-Hop Option. The value of the Next Header field in IPv6 header is 0, indicating that Hop-by-Hop Options header follows. All nodes in the path of this packet are to examine and process this packet. The Next Header field of the Hop-by-Hop Options header indicates the next header following this Hop-by-Hop h e a d e r ~ T C P header in this example packet. The Extension Header Length field is 0 since there is only one option, Router Alter option, and the total length of TLV encoding of this option is 4 octets. Since there is no alignment requirement associated with this option, its TLV encoded option is placed first and Pad2 Option is used to make the length of this Hopby-Hop Options header to be exactly 8 octets. The IPv6 header uses the 16-bit Payload Length field, which limits the m a x i m u m length of a packet to 65,536. However, the advances in hardware enabled the transmission of a jumbogram, a packet with payload larger t h a n 65,536 octets. This option supports j u m b o g r a m s up to 4,294,967,296 octets. When path MTU can support payloads larger t h a n 65,535, this option may be used to transmit jumbograms. The Option Type of J u m b o Payload Option is 192 (1100 0010), indicating that nodes not recognizing this option type m u s t discard this packet and send an ICMP, Parameter Problem, Code 2, message

431

432

Chapter 10

9

The IPv6 Header

to its sender only if the destination is not a multicast, and Option Data m u s t not change en route. The Option Length field of this option is 4 octets, and the Option Data is the length of the IPv6 j u m b o g r a m , not including the IPv6 header. When this option is used, the Payload Length field in IPv6 is set to 0. This option h a s an alignment r e q u i r e m e n t of 4n+2. Figure 10.6{b) illustrates a packet with J u m b o Payload Hop-by-Hop option. The Next Header field in the IPv6 header indicates that the Hopby-Hop Options header follows. Note that the Payload Length field in IPv6 header is set to 0 in this sample packet. The Next Header field in this Hop-by-Hop options header indicates that the next header is TCP header. The Extension Header field is 0 because the total length of TLV encoded J u m b o Payload option is 6 octets. The value in Option Data of this packet indicates that the payload of this packet is 2,818,048 octets (0x002A FFFF). Since the end of Option Data is aligned with 8-octet boundary, no padding option is necessary in this sample packet. Processing of a J u m b o Payload option m u s t detect several format errors and send an appropriate ICMP P a r a m e t e r Problem message. These format errors include the absence of the J u m b o Payload option w h e n the IPv6 Payload is 0 and the IPv6 Next Header is 0, the use of the J u m b o Payload option w h e n the IPv6 Payload is not 0, use of the J u m b o Payload option w h e n actual payload is less t h a n 65,535, and the use of the J u m b o Payload option w h e n the

The IPv6 Header

9Chapter 10

Figure 10.6 Packets with the Hop-by-Hop Options header.

61

(a)

Iol

61

0

(b)

Iol

Source Destination 6]0 5 2 1 0 Upper-layer ProtocolHeader

61o119214

Data

Data

Router Alert Option

Jumbo Payload Option

Source Destination

OxOO2AFFFF Upper-layer ProtocolHeader

Routing Header The Routing Header, identified by a Next H e a d e r value of 43 in the i m m e d i a t e l y p r o c e e d i n g header, allows a n IPv6 s o u r c e to d e t e r m i n e r o u t e s to r e a c h its d e s t i n a t i o n by listing one or m o r e i n t e r m e d i a t e n o d e s to be visited (very similar to IPv4's Loose S o u r c e a n d Record Route option). The f o r m a t of the Routing H e a d e r is s h o w n in Figure 10.7. W h e n a n o d e e n c o u n t e r s a n u n r e c o g n i z e d Routing Type, a n d S e g m e n t Left is zero, it ignores the RouUng h e a d e r a n d c o n t i n u e s to p r o c e s s the n e x t header. However, if S e g m e n t Left is nonzero, a node d i s c a r d s the p a c k e t a n d s e n d s a n ICMP P a r a m e t e r Problem, Code 0, m e s s a g e to the p a c k e t ' s S o u r c e Address. Currently, only Type 0 h a s b e e n defined, a n d Figure 10.8 s h o w s the f o r m a t of Type 0 Routing header.

433

434

Chapter 10

9The IPv6 Header

Figure 10.7 Routing header. Next Header

Hdr Ext Len

RoutingType SegmentsLeft

Type-SpecificData Next Header Hdr Ext Len RoutingType Segments Left Type-Specific Data

8-bit selector. Identifies the type of header immediately following the Routing header. Usesthe same values as the IPv4 Protocol field [RFC1700]. 8-bit unsigned integer. Length of the Routing header in 8-octet units, not including the first 8 octets. 8-bit identifier of a particular Routing header variant. 8-bit unsigned integer. Number of route segments remaining, i.e., number of explicitly listed intermediate nodes still to be visited before reaching the final destination. Variable-length field, of format determined by the Routing Type, and of length such that the complete Routing header is an integer multiple of 8 octets long.

An example of Type 0 Routing h e a d e r use is in s u p p o r t i n g new protocols, s u c h as RSVP. In RSVP, a connection p a t h m a y be established, a n d all packets belonging to the connection follow the s a m e p a t h to r e a c h the destination. T h e n the source of this connection m a y u s e a Type 0 Routing h e a d e r to specify the p a t h to its destination. A n o t h e r u s e of a Routing h e a d e r is to c o m m u n i c a t e w i t h a mobile n o d e a w a y from its h o m e n e t w o r k w i t h o u t triangle routing. W i t h o u t Route Optimization, w h i c h m a y or m a y n o t be s u p p o r t e d , p a c k e t s m a y have to be s e n t to the mobile n o d e ' s h o m e n e t w o r k a n d be f o r w a r d e d by the h o m e agent, creating triangle routing, w h e n a mobile n o d e is a w a y from its h o m e network. The s o u r c e of s u c h a c o n n e c t i o n c a n specify the p a t h u s i n g a Type 0 Routing h e a d e r to allow the s o u r c e of a c o n n e c t i o n to specify its p a t h a n d avoid t r i a n gle routing.

The IPv6 Header

9Chapter 10

Figure 10.8 Type 0 Routing header.

Next Header

Hdr Ext Len RoutingType=O I SegmentsLeft Reserved Address [1]

Address [n]

Next Header Hdr Ext Len

RoutingType Segments Left Reserved Address[1...n]

8-bit selector. Identifies the type of header immediately following the Routing header. Usesthe same values as the IPv4 Protocol field [RFC1700]. 8-bit unsigned integer. Length of the Routing header in 8-octet units, not including the first 8 octets. For the Type 0 Routing header, Hdr Ext Length is equal to two times the number of addressesin the header. 0 8-bit unsigned integer. Number of route segments remaining, i.e., number of explicitly listed intermediate nodes still to be visited before reaching the final destination. 32-bit reserved field. Initialized to zero for transmission; ignored on reception. Vector of 128-bit addresses,numbered 1 to n.

For t h e c o n n e c t i o n b e t w e e n s o u r c e n o d e s a n d d e s t i n a t i o n n o d e d via r o u t e r s r l a n d r2, s o u r c e n o d e s c r e a t e s a n IPv6 p a c k e t w i t h t h e r o u t i n g h e a d e r , a s s h o w n in F i g u r e 10.9(a). Notice t h a t t h e dest i n a t i o n field is r l, t h e first r o u t e r in t h e p a t h , i n s t e a d of t h e final d e s t i n a t i o n n o d e d. Recall t h a t e x c e p t for t h e H o p - b y - H o p O p t i o n s h e a d e r , all o t h e r e x t e n s i o n h e a d e r s a r e e x a m i n e d only b y t h e p a c k et's d e s t i n a t i o n node. S i n c e r o u t e r r 1 is t h e d e s t i n a t i o n of t h i s

435

436

C h a p t e r 10

9The IPv6 Header

packet, after e x a m i n i n g the IPv6 header, it c o n t i n u e s to p r o c e s s the n e x t h e a d e r as indicated by the Next H e a d e r field in the IPv6 h e a d er. In this case, the Routing h e a d e r will be p r o c e s s e d by r o u t e r r 1. The E x t e n s i o n H e a d e r Length field is 4, indicating t h a t the length of the Routing h e a d e r is four 8-octets, not c o u n t i n g the first eight octets. The value 4 is also twice the n u m b e r of a d d r e s s e s (2 as i n d i c a t e d in the S e g m e n t s Left field) in this Routing header. The first a d d r e s s in the Routing h e a d e r is the next r o u t e r in the p a t h , r2, followed b y the final d e s t i n a t i o n node d. R o u t e r r l d e c r e m e n t s the S e g m e n t s Left field a n d s w a p s the valu e s in the d e s t i n a t i o n field in the IPv6 h e a d e r a n d the first a d d r e s s in the Routing header. Figure 10.9(b) s h o w s the p a c k e t s e n t from r o u t e r r l to r o u t e r r2. Similarly, after e x a m i n i n g the IPv6 header, r o u t e r r2 c o n t i n u e s to p r o c e s s the Routing header, since the destin a t i o n field of the IPv6 is r2. Again, r o u t e r r2 d e c r e m e n t s the S e g m e n t Left field a n d s w a p s the values in the d e s t i n a t i o n field in the IPv6 h e a d e r a n d the s e c o n d a d d r e s s in the Routing header. W h e n p r o c e s s i n g the Routing header, the index of the a d d r e s s to visit c a n be c o m p u t e d u s i n g the H e a d e r E x t e n s i o n Length a n d the S e g m e n t Left fields (the H e a d e r E x t e n s i o n L e n g t h / 2 - the S e g m e n t Left + 1). W h e n the S e g m e n t Left is 0, the node h a n d l i n g this Routing h e a d e r p r o c e e d s to p r o c e s s the n e x t h e a d e r in the packet, w h o s e type is identified in the Next H e a d e r field in the Routing header. W h e n p r o c e s s i n g the Type 0 Routing header, f o r m a t c h e c k i n g is performed. Recall t h a t the H e a d e r E x t e n s i o n length is two times the n u m b e r of a d d r e s s e s in the Routing header. T h u s , the H e a d e r E x t e n s i o n length m u s t n o t be a n odd length. A node p r o c e s s i n g this p a c k e t d i s c a r d s the p a c k e t a n d s e n d s a n ICMP P a r a m e t e r Problem, Code 0, m e s s a g e to the s o u r c e node. Since the H e a d e r E x t e n s i o n length is two times the n u m b e r of a d d r e s s e s in the Routing header, the largest value in the S e g m e n t Left field is at m o s t h a l f of the H e a d e r E x t e n s i o n length. If the S e g m e n t Left is larger t h a n the h a l f of the H e a d e r E x t e n s i o n length, the node h a n d l i n g the p a c k e t also d i s c a r d s this p a c k e t a n d s e n d s a n ICMP P a r a m e t e r Problem, Code 0, m e s s a g e to the source.

The IPv6 Header

Figure 10.9 Packets with a Routing header.

9Chapter 10

437

438

Chapter 10

9The IPv6 Header

Fragment Header The 16-bit Total Length field in the IPv4 h e a d e r limits the m a x i m u m size of a p a c k e t to be 6 4 k bytes. However, d e p e n d i n g on the link t e c h n o l o g y used, the a c t u a l size of a p a c k e t m a y be f u r t h e r limited. In IPv4 p a c k e t t r a n s m i s s i o n , e a c h IP-layer is r e s p o n s i b l e for fragm e n t i n g p a c k e t s if n e c e s s a r y to e n s u r e t h a t the p a c k e t size w o u l d n o t exceed the M a x i m u m T r a n s f e r Unit (MTU). T h u s , the u s e r d a t a s e n t in a single p a c k e t from a s o u r c e n o d e m a y arrive at the destin a t i o n n o d e in multiple p a c k e t s if t h e r e is a link w h o s e MTU is s m a l l e r t h a n the link MTU at the s o u r c e node. This a p p r o a c h , however, m a y n o t be the m o s t optimal solution for the path.

The IPv6 Header

9Chapter 10

In IPv6, only source nodes perform fragmentation. A source node first finds the path MTU and then segments the fragmentable part of the original packet so that the length of each fragmented packet does not exceed the path MTU. The original packet before fragmentation consists of two parts: the unfragmentable part and fragmentable part. The IPv6 header and any extension headers that need to be processed at each hop on the way to the destination are unfragmentable, and extension headers processed only by the final destination node (or nodes in the case of multicast) are considered to be fragmentable. When Hop-by-Hop Options header is present, b u t not the Routing header, the unfragmentable part of the original packet includes the IPv6 header and the Hop-by-Hop Options header. When the Routing header is present, the unfragmentable part includes the IPv6 header, the Hop-by-Hop Options header, the Destination Options header, and the Routing header, if the Hop-by-Hop Options header and Destination Options header are present. The Fragmentation header is identified by the Next Header value of 44 in the immediately preceding header. Figure 10.10 shows the format of the Fragmentation header. The source node generates a unique 32-bit identifier for every fragmented packet sent to the same destination. Except for the last fragmented packet, the fragmentable part of the original packet is divided so that each fragmented part is of length integer multiples of 8 octets long. The Fragment Offset field is used to indicate the offset of the data following this Fragmentation header, relative to the start of the Fragmentable part of the original packet. Consider the packet shown in Figure 10.1 l(a). This packet needs to be further fragmented by the source node since its path MTU is 1514 bytes. The unfragmentable part of the original packet in the example includes the IPv6 header and the Routing header (the Next Header of the IPv6 is 43). The original packet is broken into three parts. Since the Ethernet header is 14 bytes, the IPv6 packet including the IPv6 header cannot be longer t h a n 1500 bytes. Since

439

440


the Routing h e a d e r is p a r t of the u n f r a g m e n t e d part, each fragment includes the Routing header. Further, the F r a g m e n t a t i o n h e a d e r (8 octets) is added, leaving 1412 bytes for u s e r data. However, the F r a g m e n t a t i o n Offset field in the F r a g m e n t a t i o n h e a d e r is in an 8octet unit. Therefore, the m a x i m u m size of the fragmentable p a r t of the original packet is limited to 1408. This explains 1456 in the Payload length field in the IPv6 of the first fragmentation as s h o w n in Figure 10.1 l(b).

Figure 10.10

Fragmentation

Next Header

header.

Reserved FragmentOffset Identification

I Res[ M

8-bit selector. Identifies the initial header type of the Fragmentabh Part of the original packet. Uses the same values as the IPv4 Protocolfield [RFC1700]. 8-bit reserved field. Initialized to zero for transmission; Reserved ignored on reception. Fragment Offset 13-bit unsigned integer. The offset, in 8-octet units, of the data following this header, relative to the start of the Fragmentable Part of the original packet. 2-bit reserved field. Initialized to zero for transmission; Res ignored on reception. 1-more fragments; O-last fragment. M flag 32-bit identifier. Identification

Next Header

The Next Header fields in the Routing h e a d e r in all three fragm e n t s (Figure 10.1 l(b), (c), a n d (d)) are 44, indicating t h a t the next h e a d e r following this Routing h e a d e r is the F r a g m e n t a t i o n header. The Next Header field in the first fragment is 6, indicating t h a t the u p p e r - l a y e r protocol h e a d e r follows this F r a g m e n t a t i o n header. However, the Next Header fields in the other two fragments are 59, indicating t h a t there are no more h e a d e r s following this

The IPv6 Header

9Chapter 10

F r a g m e n t a t i o n header. In this example, the hexadecimal of 0 x 1 2 3 4 5 6 7 8 is u s e d to indicate t h a t the s a m e identifier is u s e d for all fragments. The F r a g m e n t a t i o n Offset field is u s e d to indicate the offset, in 8-octet units, of the d a t a following the F r a g m e n t a t i o n header, relative to the s t a r t of the fragmentable p a r t of the original packet. Thus, the F r a g m e n t a t i o n offset in Figure 10.11 (c) indicates t h a t the d a t a following this F r a g m e n t a t i o n h e a d e r s h o u l d be positioned in the 176x8 th byte in the fragmentable p a r t w h e n r e a s s e m bled at the destination node.

Figure 10.11

Example of fragmentation.

(a)

(b)

(c)

(d)

61 J 2902 r431

611 1456 1431

61 1456 1431

611 94 1431

Source

Source

Source rl

Source rl

44141ol2 44141012 r2 Destination Upper-layer ProtocolHeader

r2 Destination

6 Iolololl

0x12345678

Upper-layer ProtocolHeader

Data

Original Packet

0 r2

0

Destination

Destination

0x12345678

0x12345678

591 o 11761oL1 59L o 521olo Data

Data

Data First Fragment Packet

Second Fragment Packet

Third Fragment Packet

441

442

Chapter 10

9The IPv6 Header

Authentication Header In a n IP n e t w o r k (both IPv4 a n d IPv6), the A u t h e n t i c a t i o n h e a d e r is u s e d to provide integrity a n d d a t a origin a u t h e n U c a U o n for IP p a c k e t s a n d to protect against replays. However, in this section, all t e r m s are provided b a s e d on the IPv6 network. The AuthenUcaUon Header provides a u t h e n t i c a U o n for the IPv6 h e a d e r a n d extension h e a d e r s fields t h a t m a y not change en route. For instance, the DestinaUon Address field in the IPv6 h e a d e r c h a n g e s at every hop w h e n the Type 0 Routing Header is used. In this case, the AuthenUcaUon Header c a n n o t provide the a u t h e n U c a U o n of the DestinaUon Address field. Figure 10.12 shows the f o r m a t of the AuthenUcaUon Header.

Figure 10.12 Authentication Next Header

header.

Payload Len Reserved Security Parameters Index (SPI) Sequence Number Field Authentication Data (Variable)

8-bit selector. Identifies the type of header immediately following the Authentication header. 8-bit unsigned integer. Length of the Authentication header Payload Len in 4-octet units, not including the first 8 octets. 16-bit reserved field. Initialized to zero for transmission; Reserved ignored on reception. Security Parameter 32-bit unsigned integer. Combination of this field, destination address, and security protocol. Identifies the Security Index Association for this packet. Sequence Number 32-bit unsigned integer. Monotonically increasing countervalue. Variable-length field containing the Integrity CheckValue (ICV) Authentication for this packet. This field must be an integral multiple of Data 8-octet units in length. Next Header

The IPv6 Header

9Chapter 10

Note t h a t the Payload Length field is in a 4-octet u n i t (32-bit word), not including the first eight octets (or 2 u n i t s of 4-octet). Thus, with 96-bit A u t h e n t i c a t i o n Data value, the Payload Length will be 4. For debugging pur pos e s , the Null a u t h e n t i c a t i o n algorithm m a y be used. In this case, the Payload Length field will be 2. The Se quenc e N u m b e r field is u s e d to provide protection a g a i n s t anti-replay. W h e n a Security Association is established between source a n d de s t i na t i on nodes, c o u n t e r s at s e n d e r a n d receiver are b ot h initialized to 0. It is m a n d a t o r y for the s e n d e r to i n c r e m e n t this field for every t r a n s m i s s i o n ; however, the receiver m a y elect not to process. This service is effective only if the receiver processes this field. The A u t h e n t i c a t i o n D a t a field contains the Integrity Check Value (ICV) for this packet. The a u t h e n t i c a t i o n algorithm, selected w h e n the Security Association is established between the s e n d e r a n d the receiver, specifies the length of the ICV, the c o m p a r i s o n rules, a n d the processing steps necessary. This is the value c o m p u t e d over the p a c k e t by the source node a n d verified by the d es tin atio n node by c o m p a r i n g this value to the value r e c o m p u t e d at the destination node. The A u t h e n t i c a t i o n h e a d e r m a y be applied in t r a n s p o r t or t u n n e l mode. The t r a n s p o r t mode A u t h e n t i c a t i o n header, i m p l e m e n t e d in hosts, provides protection for the u p p e r - l a y e r protocol h e a d e r a n d a n y fields in the IPv6 header, a n d extension h e a d e r s t h a t do not change in transit. The t u n n e l mode A u t h e n t i c a t i o n h e a d e r is applied to the original IPv6 packet, e n c a p s u l a t i n g the original p a c k e t by c o n s t r u c t i n g a new IPv6 p a c k e t u s i n g a distinct IPv6 a d d r e s s e s , s u c h as security gateway. In t r a n s p o r t mode, the A u t h e n t i c a t i o n header, viewed as an endto-end payload, is placed after the IPv6 h e a d e r a n d Hop-by-Hop, Routing, a n d F r a g m e n t a t i o n extension headers. Recall t h a t the Destination Options h e a d e r m a y a p p e a r once before the Routing header, the options in the Destination Options h e a d e r are applicable to i n t e r m e d i a t e nodes specified in the Routing header. In this case, the A u t h e n t i c a t i o n h e a d e r comes after the Destination Options h e a d e r as s h o w n in Figure 10.13.

443

444

Chapter 10

9The IPv6 Header

Figure 10.13 Header order with Authentication header in transport mode. Extension Upper-Layer IPv6 Header Headers, Protocol Header Data if any

~ ApplyAuthenticationHeader Upper-Layer I New Extension Authentication Destination Protocol Data OptionsHeader IPv6 Header Headers* Header Header *Hop-by-HopOptions,DestinationOptions,Routing,and FragmentHeaders In tunnel mode, the AuthenUcation Header is applied to the original ItM3 packet using distinct IPv6 addresses as communication end points (e.g., addresses of security gateways). A new IPv6 header is constructed with addresses of security gateways as source and destination addresses. FragmentaUon processing may be necessary after applying the AuthenUcaUon header. Thus, a newly constructed IPv6 packet may undergo further processing if necessary. Figure 10.14 shows the order of headers after applying AuthenticaUon header in tunnel mode.

Figure 10.14 Header order with Authentication header in tunnel mode. Extension Upper- .ayer IPv6 Header Headers, Protocol Header Data if any

~ ApplyAuthenticationHeader ExtensionAuthentication Origina! Extension Upper-Layer Protocol Data Header IPv6 Header Headers, IPv6 Header Headers, if any if any Header New

The IPv6 Header

9Chapter 10

Encapsulating Security Payload The Encapsulating Security Payload header, used in t r a n s p o r t mode or in tunnel mode, also provides security services in both IPv4 and IPv6 networks. The security services provided through the Encapsulating Security Payload include confidentiality, authentication (data origin authentication and connectionless integrity), an antireplay service, and limited traffic flow confidentiality. Implementation and options chosen at the time of Security Association establishment determine the security services provided. As in the case of the anti-replay service provided by the Authentication header, the source increments the Sequence Number; however, the destination node m u s t check this field to enable the anti-replay service. To provide traffic flow confidentiality service, true source and destination information should be hidden. Thus, this service requires that the Encapsulating Security Payload header be used in a tunnel mode. Figure 10.15 shows the format of the Encapsulating Security Payload header. The Next Header value of 50 in the immediately preceding header indicates that the Encapsulating Security Payload header processing is necessary. The m a n d a t o r y Payload Data field contains encrypted data described by the Next Header field. The enc13rption algorithm used specifies the length and the location of the structure of the data within the Payload Data field. To fulfill the encryption algorithm requirement of the length of the plain text or the 4-octet b o u n d a r y alignment of the Payload Data field, the use of padding may be necessary. Figures 10.16 and 10.17 illustrate the sequence of an IPv6 packet with its encrypted portion when Encapsulating Security Payload headers are used in transport mode and tunnel mode, respectively.

445

446

Chapter 10

9The IPv6 Header

Figure 10.15 Encapsulating Security Payload header. Security Parameters Index (SPI) SequenceNumber

Payload Data (Variable) Padding (0-255 bytes) Pad Length Next Header

/~~

AuthenticationData (Variable)

Security Parameters 32-bit unsignedinteger. Combinationof this field, destination Index address, and Security Protocol (ESP)identifies the SecurityAssociation for this packet. SequenceNumber 32-bit unsigned integer. Monotonicallyincreasing countervalue. Payload Data Variable-lengthfield containing data describedby the Next Header field. Padding Variable-lengthfield containing 0 to 255 of 8-bit padding. Pad Length 8-bit unsignedinteger. Indicatesthe number of pad bytes immediately preceding it. Next Header 8-bit selector. Identifies the type of data contained in the Payload Data. Authentication Variable-lengthfield containing an Integrity CheckValue (ICV) Data computed over the ESPpacket minus the Authentication Data.

Destination Options Header A source node m a y need to convey optional information t h a t needs to be processed by a destination node. For instance, w h e n a mobile node is away from its home network, a home agent (i.e., a router at the home network) m a y be a proxy forwarding packets to the mobile node. A mobile node away from its home network needs to send control messages to its home agent so t h a t the home agent could set up the proxy service and forwarding packets destined for the mobile node at its current address. An IPv4 network, a packet w h e n containing options in the IPv4 header, will be subject to an examination at every hop on the path.

The IPv6 Header

9Chapter 10

Figure 10.16 Header order with Encapsulating Security Payload in

transport mode.

Extension Upper-Layer IPv6 Header Headers, Protocol Header Data if any

ApplyAuthenticationHeader New Extension ESP Destination Upper-Layer D IESP ESP IPv6 Header Headers* Header OptionsHeader ProtocolHeader atalTrailer Authentication q q

Encrypted

b

Authenticated

*Hop-by-HopOptions,DestinationOptions,Routing,and FragmentHeaders

Figure 10.17 Header order with encapsulating security payload in

tunnel mode.

Extension I Upper-Layer. IPv6 Header Headers, if anyIProtocolHeader Data J, ApplyAuthenticationHeader New Original Upper-Layer ESP Original ESP ESP IPv6 Extension Extension Protocol Data Trailer IPv6 Header Headers Header Authentication Header Headers Header New

Encrypted

k

Authenticated In a n IPv6 network, s u c h optional m e s s a g e s can be h a n d l e d efficiently either us i ng a n extension h e a d e r dedicated for h a n d l i n g specific optional information or us i ng the Destination Options header. Packet f r a g m e n t a t i o n or a u t h e n t i c a t i o n information is h a n d l e d as an extension h e a d e r as s h o w n previously. The IPv6 Mobility S u p p o r t

447

448


Internet-Draft proposes four Destination Options to s u p p o r t Mobile IPv6. The optional information m a y be encoded either in a s e p a r a t e extension h e a d e r or in the Destination Options header, b a s e d on the desired action to be t a k e n at the destination node, w h e n the node does not recognize the option. Optional information t h a t requires a few octets whose desired action is to send an ICMP Unrecognized Type m e s s a g e to the s e n d e r only if the destination node is not a m u l t i c a s t address, m a y be encoded in a s e p a r a t e extension header. The Destination Options header, identified by a Next Header value of 60 in the immediately preceding header, carries optional information t h a t needs to be examined a n d processed only by a pa c ke t 's destination node (nodes, in multicast). The format is s h o w n in Figure 10.18.

Figure 10.18 Destination Options header. Next Header

I

Hdr Ext Len Options

Next Header Hdr Ext Len Options

8-bit selector. Identifies the type of header immediately following the Hop-by-Hop Options header. Usesthe same values as the IPv4 Protocol field [RFC1700]. 8-bit unsigned integer. Length of the Hop-by-Hop Options header in 8-octet units, not including the first 8 octets. Variable-length field, of lenght such that the complete Destination Options header is an integer multiple of 8 octets long. Containsone or more TLV-encodedoptions.

The IPv6 Header

*

Chapter 10

Upper-Layer Protocol Issues The layered architecture in general shields the u p p e r layer protocols from changes in the network layers. However, a couple of i s s u e s need to be addressed. For instance, u p p e r - l a y e r protocols t h a t compute c h e c k s u m s over packets m u s t a c c o u n t for c h a n g e s in IPv6 including use of 128-bit a d d r e s s e s and final destination, not intermediate destinations w h e n the Routing h e a d e r is used, and so forth. It h a s been d i s c u s s e d t h a t the time-to-live field, which behaves differently t h a n its original definition, h a s been r e n a m e d to hop limit. Any u p p e r - l a y e r protocol t h a t relies on the original m e a n i n g of the time-to-live m a y have to m a k e n e c e s s a r y a d j u s t m e n t s . The maxi m u m u p p e r layer payload size also needs to be adjusted to reflect t h a t the length of the IPv6 h e a d e r is 40 bytes long.

Summary In all aspects of IPv6 design, the limitations imposed u p o n the design of IPv4 have been resolved or improved, the inefficiency in IPv4 h a s been eliminated, and the additional capabilities have been added to m a k e IPv6 suitable for next-generation IPs. IPv6 u s e s 128-bit addresses, providing a greater n u m b e r of a d d r e s s a b l e nodes, better s u p p o r t for stateless autoconfiguration, and a better a d d r e s s hierarchy, which in t u r n leads to better routing. Embedding optional information in extension h e a d s allows efficient r o u t e r i m p l e m e n t a t i o n s while being able to handle optional information directed to routers. The use of extension h e a d e r s to carry optional information fixed the IPv6 h e a d e r length. Combining with the F r a g m e n t a t i o n At Source Only policy simplified the IPv6 header, t h u s increasing the efficiency of routers. The limit on options h a s been relaxed, and it is m u c h easier to add new options using extension headers.

449

450

C h a p t e r 10

9The IPv6 Header

Further, the design of IPv6 incorporated the concept of flow, and flow labeling along with the source and the final destination information helps routers maintain the state information of the flow for special handling, ff necessary. The security and privacy features are built into the design of IPv6.

Q. Where are good resources for obtaining more information on IPv6? A: There are m a n y sites on the Net. However, these two sites can be a good starting point: http: //www. ieff. org/html, charters / ipngwg-charter, html http: / / p l a y g r o u n d . s u n . c o m / p u b / i p n g / h t m l / i p n g - m a i n . h t m l Q" What is the core set of RFCs specifying IPv6 header and extension headers? A: Most of information in this chapter is based on the following RFCs. Newer RFCs may render these RFCs obsolete: RFC2460~IPv6, Hop-by-Hop Options, Routing, Fragment, and Destination Options R F C 2 4 0 2 ~ I P Authentication Header RFC2406---IP Encapsulating Security Payload Header Q" What is the implementation status? A: It is being developed for m a n y host systems and routers, including 3Com, Cisco Systems, Digital, IBM. The h t t p : / / p l a y g r o u n d . s u n . c o m / p u b / i p n g / h t m l / i p n g - m a i n . h t m l site also has information and links providing the details.

The IPv6 Header

9Chapter 10

References [RFC2462} "IPv6 Stateless Address Autoconfiguration." S. T h o m p s o n a n d T. Narten. December, 1998. [RFC2401] "Security Architecture for the I n t e r n e t Protocol." S. Kent a n d R. Atl~nson. "Route Optimization in Mobile IP." C. Perkins a n d D. J o h n s o n . I n t e r n e t draft, draft-ieft-mobileip-optim-07.t~, November, 1997. Work in progress. [RFC2402] "IP A u t h e n t i c a t i o n Header." S. Kent a n d R. Atkinson.

451


454

Appendix A* Address Assignment

Introduction E a c h h o s t c o n n e c t e d to a n IP n e t w o r k m u s t have a n IP a d d r e s s . For connectivity on the Internet, the a d d r e s s space m u s t be m a n a g e d to e n s u r e the u n i q u e n e s s of e a c h a d d r e s s . In the past, J o n Postel w a s giving IP a d d r e s s e s to universities c o n n e c t e d to the I n t e r n e t (well, the A r p a n e t at t h a t time). Then, Internic, a n u m b r e l l a c r e a t e d b y the US g o v e r n m e n t , gave IP a d d r e s s e s to a n y r e q u e s t i n g organization. At t h a t time, J o n Postel w a s still m a n a g i n g the whole a d d r e s s space, giving r a n g e s of a d d r e s s e s to Internic.

Registries Now, the I n t e r n e t Assigned N u m b e r s A u t h o r i t y (IANA) is m a n a g i n g the whole IPv4 a d d r e s s space a n d the IPv6 a d d r e s s space. IANA gives r a n g e s of a d d r e s s e s to regional registries; t h o s e registries give a d d r e s s e s r a n g e s to I n t e r n e t Service Providers (ISPs) who t h e n give a d d r e s s e s to c o r p o r a t i o n s (or to smaller ISPs). E a c h level of delegation h a s to prove to the u p p e r level t h a t it h a s c o n s u m e d m o s t of its a d d r e s s space before r e q u e s t i n g a n o t h e r r a n g e of a d d r e s s e s . The t h r e e regional registries are: 9 A m e r i c a n Registry for I n t e r n e t N u m b e r s (ARIN): http: / / w w w . a r i n . n e t 9 R 6 s e a u x IP E u r o p 6 e n s - N e t w o r k Coordination C e n t e r (RIPENCC): h t t p : / / w w w . r i p e . n e t 9 Asia-Pacific Network I n f o r m a t i o n C e n t e r (APNIC): http: / / w w w . a p n i c . n e t ARIN covers North America, S o u t h America, the Caribbean, a n d s u b - S a h a r a n Africa. RIPE-NCC covers Europe, the Middle East, a n d p a r t s of Africa. APNIC covers Asia a n d the Pacific. If y o u are n o t c o n n e c t e d to the I n t e r n e t a n d d o n ' t w a n t to be, t h e n t h e r e is a n IP a d d r e s s space reserved for t h a t situation. It is

Address Assignment

9Appendix A

called the private a d d r e s s s p a c e a n d is described in RFC 1918 a n d d i s c u s s e d in the NAT c h a p t e r in this book. On the o t h e r h a n d , if y o u n e e d a d d r e s s e s for y o u r n e t w o r k , y o u s h o u l d a s k y o u r u p s t r e a m I n t e r n e t provider to give y o u a r a n g e of a d d r e s s e s for y o u r own use. As soon as y o u move to a n o t h e r provider, y o u will need to remove the previous r a n g e of a d d r e s s e s a n d r e n u m b e r to the n e w r a n g e of a d d r e s s .

Provider-Based Assignments A r o u n d 1996, to minimize the r o u t i n g table explosion, the technical c o m m u n i t y agreed to enforce Classless I n t e r - D o m a i n R o u t i n g by a s k i n g c o r p o r a t i o n s to get their r a n g e of IP a d d r e s s e s only from their u p s t r e a m provider. By doing so, the n u m b e r of entries in the global r o u t i n g table will grow at a m u c h lower rate t h a n the n u m b e r of n e t w o r k s c o n n e c t i n g to it, b e c a u s e ISPs aggregate the a d d r e s s e s of their c u s t o m e r s . B u t t h e r e are s o m e exceptions to this rule, m a i n l y w h e n y o u are m u l t i h o m e d . In IPv6, the a d d r e s s i n g a r c h i t e c t u r e is b a s e d on p r o v i d e r - b a s e d a d d r e s s e s , w h i c h m e a n s t h a t IPv6 enforces this CIDR at the beginning. As d i s c u s s e d in the IPv6 chapter, IPv6 clearly will be m o r e scalable by this optimized r o u t i n g a n d by the a d d r e s s s p a c e it has. The d r a w b a c k of r e n u m b e r i n g w h e n u s i n g p r o v i d e r - b a s e d a d d r e s s e s h a s b e e n a d d r e s s e d in IPv6 by a specific protocol.

455

456

Appendix A

9Address Assignment

Cost of an IP Address In theory, a n IP a d d r e s s costs nothing. The registries are not-forprofit organizations. T h e y charge a fee to their clients (ISPs) for the r e g i s t r a t i o n service, n o t for the IP a d d r e s s themselves. In s o m e ways, ISPs will include this cost in the prices of their service to their clients, so the effective cost of IP a d d r e s s e s is h i d d e n s o m e w h e r e .

How to Find an IPv4 Address Delegation E a c h regional registry m a i n t a i n s a d a t a b a s e of its a d d r e s s assignm e n t s . ISPs are m a n d a t e d to provide the i n f o r m a t i o n a b o u t their own a s s i g n m e n t s to c u s t o m e r s . All this i n f o r m a t i o n is available by u s i n g a simple q u e r y protocol called whois. F r o m the early days, w h o i s h a s b e e n available in Unix as a c o m m a n d , b u t h a s n o t b e e n available in the o t h e r e n v i r o n m e n t s . Now, all registries have a Web interface to the whois d a t a b a s e , w h i c h m a k e s it accessible to u s e r s . The following URI~ point to the Web w h o i s interface for all registries" 9 ARIN: h t t p : / / w w w . a r i n . n e t / w h o i s / i n d e x . h t m l 9 RIPE: h t t p : / / w w w . r i p e . n e t / d b / w h o i s . h t m l 9 APNIC: h t t p : / / w w w . a p n i c . n e t / a p n i c - b i n / w h o i s . p l 9 Network S o l u t i o n s (Internic): http: / / w w w . n e t w o r k s o l u t i o n s , corn / c g i - b i n / w h o i s / w h o i s 9 US D e p a r t m e n t of Defense: h t t p : / / n i c . m i l / c g i - b i n / w h o i s The w h o i s d a t a b a s e i n c l u d e s n o t only IP a d d r e s s e s , b u t o t h e r data, s u c h as the m a i n t e n a n c e of t h o s e IP a d d r e s s e s , the A u t o n o m o u s S y s t e m (AS) n u m b e r s , etc. Here is a n example: I w a n t to k n o w w h o is r e s p o n s i b l e for the 2 0 6 . 1 2 3 . 3 1 . 0 a d d r e s s space. I choose to go to the ARIN w h o i s Web interface ( h t t p : / / w w w . a r i n . n e t / w h o i s / i n d e x . h t m l l a n d a s k for the a d d r e s s in Figure A. 1.

Address Assignment

9Appendix A

Figure A.1 ARIN whois web interface.

The a n s w e r given by the ARIN w h o i s d a t a b a s e is s h o w n in Figure A.2.

Figure A.2 ARIN whois answer to 206.123.31.0. Canadian Registry (NETBLK-CA-RISQ3) CA-REGISTRY3 ViaGenie Inc. (NET-VIAGENIE) VIAGENIE

206. 123.0.0 - 206. 123.255.0 206.123.31.0

The a n s w e r in Figure A.2 s a y s that the 2 0 6 . 1 2 3 . X . X range h a s b e e n given by ARIN to the C a n a d i a n Registry, and the C a n a d i a n registry gives the 2 0 6 . 1 2 3 . 3 1 . 0 / 2 4 range to Viag6nie Inc. Then, if I click on NET-VIAGENIE to k n o w more a b o u t it, it will s h o w m e the i n f o r m a t i o n in Figure A.3.

Figure A.3 ARIN whois answer to NET-VIAGENIE. ViaGenie Inc. ( N E T - V I A G E N I E ) 3107 des hotels S t e - F o y , Q u e b e c G I W 4~15 CA

Netname: VIAGENIE Netnumber" 206. 1 2 3 . 3 1.0 Coordinator : Blancher, Marc 418-656-9254

Domain

System

JAZZ.VIAGENIE.

(MB84 I-ARIN)

inverse

mapping

QC. C A

Record

last

updated

last

provided

by"

206.123,3i.2

S O C R A T E .RIQ. QC. C A

Database

Marc. B lanchet@VIAGENIE.

199,84,128, i

on

updated

23-Jan-1996.

on

8-Nov-1999

03"49"ii

EDT.

QC. C A

457

458

Appendix A

9Address Assignment

This a n s w e r tells m e w h e r e Viag6nie Inc. is located, who is r e s p o n s i b l e for it, a n d w h a t DNS servers are a n s w e r i n g for the inverse m a p p i n g of t h o s e a d d r e s s e s . The whois d a t a b a s e s are all defined with objects (like the NETVIAGENIE object) t h a t have a m a i n t a i n e r a s s o c i a t e d with it. In this example, the m a i n t a i n e r ID of the NET-VIAGENIE object is MB841ARIN. This is the w a y to keep t r a c k of who is r e s p o n s i b l e for w h i c h object. It is the s a m e w i t h the d o m a i n n a m e s registries.

How to Find an IPv6 Address Delegation To t e s t IPv6, a t e s t n e t w o r k called 6Bone w a s b u i l t in J u l y 1996. It is still r u n n i n g a n d alive. E a c h site h a s a prefix (address range) delegated from a t e s t prefix allocated by IANA: 3ffe::/16. A registry with a whois interface h a s b e e n set u p to h a n d l e the registrations, a n d is available t h r o u g h the 6Bone Web site: h t t p : / / w w w . 6 b o n e . n e t . The official IPv6 a d d r e s s e s are available from the previous registries (ARIN, RIPE, a n d APNIC) a n d t h e s e registries have the s a m e Web interface for b o t h the IPv6 a n d IPv4 a d d r e s s e s .

Internet Governance For a few years, w o r k h a s b e e n done in the global c o m m u n i t y for I n t e r n e t g o v e r n a n c e , w h i c h covers m a n y d o m a i n s a n d i s s u e s . The c u r r e n t o r i e n t a t i o n for IP a d d r e s s e s a s s i g n m e n t s is to move the IANA f u n c t i o n s to the I n t e r n e t C o r p o r a t i o n of Assigned N a m e s a n d N u m b e r s (ICANN: h t t p : : / / w w w . i c a n n . o r g ) . B u t at the time of this writing, m a n y d i s c u s s i o n s are still pending.

Address Assignment

9Appendix A

Summary Address a s s i g n m e n t s are controlled at the higher level by IANA. It assigns rmlges of a d d r e s s e s to regional registries as needed, a n d those registries assign ranges of a d d r e s s e s to ISPs, which t h e n assign to t h e m to corporations. This enables CIDR, which m a k e s I n t e r n e t routing efficient. This process is for both IPv4 a n d IPv6. You can see the a s s i g n m e n t s by looking at the whois d a t a b a s e s at the various registries. I m p o r t a n t d i s c u s s i o n s are c u r r e n t l y being held on I n t e r n e t governance, mostly a r o u n d ICANN.

459


462

Index

options, length. S e e Internet Protocol version 4 (IPv4). plan, 100, 109 creation, 45. S e e also Fixed length mask. design, 44 problems, 103 requirements, 53 determination, 40-44 scheme. S e e Internet Protocol. strategy, 3. S e e also Class A. Addressing plan. S e e Variable-Length Subnet Mask. Administrative (Admin) LANs, 102, 105 Administrative scopes, 346-347 usage, 347 Administrative user, 6 Aggregate route, 229 Aggregates. S e e Fractional aggregates. Aggregation, realization, 374-375 Aggregator, 233 All-hosts address, 347 AU-routers group, 342 All Subnets Are Local Option (option), 320 Allocations depiction, 380 granularity, 89 American Registry of Internet Numbers (ARIN), 52, 354, 380 Anycast address, 403-405 applications, usage, 405 APNIC, 52, 354, 380 Applications. S e e TCP; TCP-based applications. parameters, 323-328 protocols, 4 usage. S e e Anycast.

Architecture. S e e Internet Protocol version 4; Security. Area Border Router (ABR), 254, 262 ARIN. S e e American Registry of Internet Numbers. ARP. S e e Address Resolution Protocol. ARP Cache Timeout (option), 322 ARP settings, 184 AS. S e e Autonomous System. As built documentation, 41 ASB, 265 ASCII, 127 Asia Pacific Registry, 52 ASN. See Autonomous System Number. Assignable IP address, 54 Assigned IP addresses, 97 Assignments. S e e Generic assignments; Internet Assigned Numbers Authority. Asynchronous WAN links, 247 ATM, 253, 341 Authentication, 419--420, 425. S e e also Optional authentication; Routing. capability, 415 header, 362, 419, 420, 426, 429, 442-444 Autoconfiguration, 383 mechanisms, 416 simplification, 396--398 Autonomous System (AS), 255, 261, 267-275, 383 AS Border Router, 266 boundary routers, 254 defining, 269 topology, 252 Autonomous System Number (ASN), 247, 379

Index

B Backbone, 257, 262, 393, 400. S e e also Collapsed backbone; Multicast. engineer. S e e Internet. network. S e e Corporate backbone. routers, 254, 370 routing tables. S e e Internet. Bandwidth, 239, 243 saving, 348 usage/scaling, efficiency, 348 Bastion host, 167 BGP. S e e Border Gateway Protocol. Binary address, 33 Binary numbering systems, 17-18 Binary numbers, 36 Binary representation, 20, 38 Binary subnet field, 28 ID, 50 Bits. S e e Highest-order bit; Networks. amount, 365-370 ordering problems. S e e Token Ring. Blocks, 62. S e e also Addresses; Class C; Classless Inter-Domain Routing; Private addresses. addresses, 235 diagrams, 150 Boot File Size (option), 317 Bootfile Name, 305 BOOTP. S e e Bootstrap Protocol. BOOTREPLY. S e e Bootstrap Reply. BOOTREQUEST. S e e Bootstrap Request; Client BOOTREQUEST. Bootstrap Protocol (BOOTP) clients, 333 functionality, 312 database, 293, 297

file, 334 Dynamic Host Configuration Protocol, comparison, 311-312 function, explanation, 312-313 implementation checklist, 333-334 interoperation. S e e Dynamic Host Configuration Protocol. messages, 292, 295 networks, 328-333 objectives, usage. S e e Internet Protocol addresses. options, RFC 1497 influence, 314-318 packet, 288, 333 process details, 294-297 protocol, 299 relay agent, 285, 328-330, 334 servers, 292, 301,332, 334 database, 297-298 usage, 286-287 vendor-extensions, 313 Bootstrap Reply (BOOTREPLY), 283. S e e also Server BOOTREPLY. packet, 298 field values, 296-297 unicast message, 329 Bootstrap Request (BOOTREQUEST) message, 290, 291 packet, 296, 3 1 1 , 3 2 9 Border Gateway Protocol (BGP), 224, 248, 250, 277, 371,377, 406 functionality, 371 instability, 393 protocols, 254 requirements, 267-272 routers, 270, 271 speakers, 393 update, 270 version 4, 226

463

464

Index

Border routers, 271 Branch offices, 44, 91 routers, 42, 91 Bridges, 41, 43 Broadcast Address (option), 320-321 Broadcast-intensive protocol, 243 Broadcasts, 332 addresses, 30, 31, 35, 54. S e e also Subnets. networks, 253, 259. S e e also Nonbroadcast networks. packets, 251 BSD, 272

C Cache aging, 359 Call set-up control message, 431 CERN HTI'P server, 171 CERN proxy, 171 CHADDR, 297 (code), 292 (field), 294, 295, 298, 332 values, 308 Channels. S e e Multicast. occupancy, 239 Checkpoint, 174 Checksums, 163, 166, 420, 424 Choke point, 115 CIADDR, 294, 297 (code), 291 CIDR. S e e Classless Inter-Domain Routing. Circuit-level proxy, 172 Cisco, 154, 188, 206, 237 devices, 130 lOS, 130, 131, 135-137, 144-145, 157-160 configuration commands, 13

PAT, 157 routers, 13, 164, 173, 255, 272 lines, 130 Class A addresses, 6-7, 88, 95, 97, 227 blocks, 370, 391 networks, 23, 25, 26, 89, 100, 268 address, 45, 88 private network, 102-103 address assignment, 105-108 addressing strategies, 103-105 administration, ease, 101, 108 documentation, 101, 108 results, 108-110 simplicity, 101, 108 subnetting strategy, 101-110 subnetting tables, 67-72 Class B, 88 addresses, 7-8, 19, 34, 9 1 , 2 2 0 , 227 block, 98 blocks, 370 networks, 23, 25, 28, 65, 88, 89, 93, 97, 100, 202, 268 address, 45 problem, 207 subnetting tables, 73-76 Class C addresses, 8-9, 33, 57, 95, 96, 227, 235, 279 blocks, 236, 370 networks, 23, 25, 31, 32, 45, 53, 57, 88, 89, 98, 208, 268 address, 26, 45 prefixes, 64 problem, 207 subnetting problem, 208 tables, 35, 76-78

Index

VLSM, problem, 206-210 completion, 210-214 Class D addresses, 344 Class E addresses, 344 Class masks, 192 Classful addressing, 3-9 Classless addressing, 225. S e e also Classless Inter-Domain Routing. Classless Inter-Domain Routing (CIDR), 50, 88, 89, 225-236, 277, 355, 370, 390 addresses, 88, 232 usage. S e e Networks. addressing, 237 block, 65, 234 prefix, 229 capability, 231 CIDR-capable routing protocol, 236 classless addressing, 236 contribution, 112 inception, 372 notation, 66, 89, 97 tab, 57 terminology, 97 Classless routing, 245 Client BOOTREQUEST, 294-295 Client functionality. S e e Bootstrap Protocol. Client Identifier, 308-309 Client/server model, 283 CLNP. S e e Connection-Less Network Protocol. Collapsed backbone, 91 Collisions, 146 Computing devices, 14 Configuration. S e e Internet Connection Sharing. errors, 166 examples. S e e Network Address Translation.

files. S e e Routers. Connection-Less Network Protocol (CLNP), 355, 356 Connection-oriented protocols, 143 Connection tables, 159 Contiguous IP addresses, 227 Contiguous network, 237 Contiguous subnets, 236-237 Control channel connection, 170 Convergence, 258 time, 245. S e e also Routing Information Protocol. Cookie Server List (option), 316 Corporate backbone, 109 network, 102 Corporate network, 402 CPU cycles, 364 CUSeeMe, 157

D Data flow, 168 Data-link frames, 288 Data networks, growth, 44 Databases, 63, 239. S e e also One-table database; Routes; Routing. software, 63 Datagrams, 27, 28, 35, 48. S e e also Internet Protocol. forwarding, 16 DC LANs, 106, 109 DCC send, 157 Decimal address, 5 Decimal numbering systems, 17-18 Decision making, management. S e e Information Systems department. Dedicated leased lines, 92 Default Finger Server List (option), 327 Default Internet Relay Chat (IRC) Server List (option), 328

465

466

Index

Default IP Time-to-Live (option), 319 Default mask, 20, 23 Default timer, 266 Default World Wide Web (WWW) Server List (option), 327 Delay time. S e e Topological delay time. Demilitarized Zone (DMZ), 168, 169, 185 Denial of Service (DOS), 176 Deployed subnets, 198 Designated Router (DR), 261 Destination address, 120, 125, 252, 364, 444 field, 442 IP address, 149 network, 246 node, 435, 4 4 1 , 4 4 8 options, 425, 426, 439, 448 header, 443, 446-448 header I, 361 header II, 363 port number, 288 UPD port number, 329 Devices. S e e Internet Protocol; Internetworking devices; Local devices; Multihomed devices; Physical devices; Source device; Target device. addresses allocation, 58-62 assignation, 60--62 DHCP. S e e Dynamic Host Configuration Protocol. Dial-up interface, 162 Differentiated Service (DiffServ), 358 DfffServ. S e e Differentiated Service. Diffusing Update Algorithm (DUAL) finite state machine, 243 DISCOVER-OFFER-REQUESTACKNOWLEDGEMENT process, 309

Discovering, 349 Distance-vector-based routing, 242 Distance Vector Multicast Routing Protocol (DVMRP), 342 Distance-vector protocol, 238 Distribution centers, 104. S e e also Regional distribution centers. LANs, 106 WAN links, 105-106 Distribution LAN, 109 DMZ. S e e Demilitarized Zone. DNS. S e e Domain Name System. Documentation, 59. S e e also A s built documentation; Class A; Networks. Domain Name (option), 317 Domain Name System (DNS), 12, 96, 287, 404 connections, 159 DNS Server List (option), 315 domain name, 317 entries, 13, 379. S e e also Forward DNS entries; Reverse DNS entries. proxy, 131 queries, 146 servers, 12, 123, 126, 154, 286, 293, 310, 3 1 1 , 4 0 4 , 405 address pool, 309 setup, 126 Domains. S e e Internet. DoS. S e e Denial of Service. Dotted decimal notation, 33, 34, 367, 368 Double NAT, 123-126 Downstream connectivity, 389 DR. S e e Designated Router. DSL, 161 setups, 131 DUAL. S e e Diffusing Update Algorithm.

Index

DVMRP. S e e Distance Vector Multicast

Routing Protocol. Dynamic address assignment, 299 role, 283-284 Dynamic addressing protocols, history, 284-286 Dynamic Host Configuration Protocol (DHCP), 100, 155, 234, 416 address assignments, 286 scopes, 310-311 BOOTP, interoperation, 309-310 comparison. S e e Bootstrap Protocol. configuration, 414 DCHPREQUEST, 302 DHCP Message Type, 305-306 DHCP-specffic option codes, 328 DHCP-specific options, 304-309 DHCPACK, 302, 307 message, 306 DHCPDISCOVER, 302 requests, 309 DHCPNAK message, 306 DHCPOFFER, 304 DHCPRELEASE message, 300 DHCPREQUEST, 306 extension, 308 function, explanation, 298-303 implementation checklist, 334 interoperability, 298 message, 306 size. S e e Maximum DHCP Message size. types, 302-304, 310 networks, 328-333 objectives, usage. S e e Internet Protocol addresses. options, 313-328 process

details, 301-303 overview, 299-300 servers, 131, 132, 287, 299, 300, 307, 3 3 1 , 3 8 6 usage, 286-287 Dynamic NAT, 139-141, 147, 148, 159 function, explanation, 141-142 problems, 142-144

E E-mail, 95 EBGP, 2 7 1 , 3 9 3 requirements, 272-276 EGP. S e e Exterior Gateway Protocol. EGRP, 238 EIGRP. S e e Enhanced Interior Gateway Routing Protocol. Encapsulating Security Payload (ESP), 425 extension headers, 419 header, 363, 426, 445-446 Encrypted security payload header, 363 Encryption algorithm, 445 End (code), 314 End points, 268 Enhanced Interior Gateway Routing Protocol (EIGRP), 40, 66, 206, 235, 242-244, 403 concepts, 243-244 Error Message, 307 Error rates, 238 ESP. S e e Encapsulating Security Payload. eth0 interface, 138 Ethernet, 146, 162, 341, 383. S e e also 802.3 Ethernet. 0 interface, 13

467

468

Index

address, 2 cards, 388 encapsulation type, 322 header, 439 hub, 49 II, 322 interface, 10 network, 2, 3, 11, 14, 243, 246 ports. S e e Fast Ethernet ports. segments, 26, 49 star topology, 253 Ethernet Encapsulation (option), 322 European Registry, 52 Extension headers, 415, 424-448. S e e also Encapsulating Security Payload. field, 432 Extensions Path (option), 318 Exterior Gateway Protocol (EGP), 250, 267 protocols, 254 External links, 2 6 1 , 2 6 5 information, 261 External routes, 254 External routing, 253 Externally derived routes, tagging, 252

F Fast Ethernet, 162 ports, 135 Fastethernet 0 / i , 157 Feal Audio, 157 Field Overload, 304--305 Fields descriptions/comments, 288-293 involvement, 331-333 values. S e e Bootstrap Reply.

FILE (code), 293 (field), 294, 295, 297, 305 File Transfer Protocol (FTP), 126, 138, 152, 155, 167 client, 160, 171 programs, 170 difficulty, 127 handler, 156 module, 157 protocol, 179 server, 12 session, 128, 142 Filtering routers, 168 Filters, 382. S e e also Packet filters; Stateful packet filters. FIN exchange, 139, 149 FIN flags, 149, 159 FIN packets, 151, 152, 163 Finger Servers, 327 FireWall ToolKit (FWTK), 114 Firewalls, 114--119, 169, 189-190, 382. S e e also Proxies; Threeinterface firewall. administrators, 115, 179 capabilities, 165-180 definition, 165 effect, 152 products, 120, 123, 145 Fixed length mask, 19-36 networks addressing plan creation, 39, 40 exercises, 65-66 FAQs, 64-65 Fixed-length-mask addressing plan, 40 Fixed-length subnet masks, 104, 192 Fixed-length subnetting, 66, 201 Fixed m a s k addressing, 40 approach, 104

Index

Fixed-subnetted networks, 40 FLAGS (code), 291 (field), 294, 297, 332 Flags, 422 Flooding, 261 Flow, 418-419 Flow label, 358-359 Flow labeling, 418-419 Flush timer, 241 Format Pref~r (FP), 372-373 Forward DNS entries, 387 FP. S e e Format Prefix. Fractional aggregates, 235 Fragment, 425 header, 362, 426, 438-441 Fragmentation header, 440, 441 offset, 422 processing, 444 Frame-Relay, 383 Frame relay network, usage, 92 FTP. S e e File Transfer Protocol. Full-time access, 64 FWTK. S e e FireWall ToolKit.

G Garbage collection, 245 Gateway addresses, 292 Gateways. S e e Local gateways. Generic assignments, 344 GIADDR, 294, 297, 332 (code), 292 (field), 3 1 1 , 3 3 0 , 337 role, 330-331 Global addresses. S e e Internet. Global routing tables, 234

Globally Routable Unicast addresses, 373, 3 8 1 , 3 8 4 , 388, 390, 396, 404, 408 addressing, 401 prefixes, 372 Globally unique addresses, 51, 94, 98, 99 Globally unique IP addresses, 96, 110 Grow Towards the Middle technique, 61-62 GUI, 180 GUI FTP clients, 170

H Hackers, 245 Hardware failure, 418 HDLC, 383 Header Extension Length field, 430, 436 Headers. S e e Authentication header; Destination; Encrypted security payload header; Extension headers; Fragment header; Hop by hop options header; Internet Protocol version 6; Next header; Routing. correspondence, 424 fixed length, 417 length field, 422 simplification, 417 Headquarters, 102, 104 LANs, 47, 48, 91, 102, 105 interfaces, 47 location, 92, 108 router, 42 subnets, 93 WAN links, 105-106 Hexadecimal system, 17 Hide NAT, 145

469

470

Index

Hierarchy, levels, 104 Highest-order bit, 428 HLEN (code), 290 (field), 294-296, 332 Hold-downs, 240, 2425 Hold-time period, 241 Home network, 434 Hop by Hop header, 361 Hop-by-hop option, 425, 439 header, 426, 427, 430-433 Hop by hop options header, 360 Hop count, 247, 249. S e e also Metric hop count. Hop limit, 364, 423 HOPS (code), 290 (field), 331-332 Horizons. S e e Split horizons. Host Name (option), 317 Host-name-to-address-resolution database, 286 Host-to-host protocol, 4 Hosts, 234, 390. S e e also Bastion host; Local hosts. addresses, 30, 46, 47 addressing, simplification, 394--396 bits, 45, 53 definition, 30 fields, 21, 22, 25, 32, 35 ID, 104, 105, 388, 396, 397 networks, 251 HOSTS file, 293 HP JetDirect, 43 HQ-DC links, 107 HTrP, 152, 179 1.0, 143 proxy, 178 request, 96 server. S e e CERN HTTP server.

HTYPE (code), 289-290 (field), 294-296, 298, 308, 332 Hubs, 43, 253

IANA. S e e Internet Assigned Numbers

Authority. IBGP requirements, 272-276 ICANN. S e e Internet Corporation for Assigned Names and Numbers. ICMP. S e e Internet Control and Message Protocol. ICS. S e e Internet Connection Sharing. ICV. S e e Integrity Check Value. IEN 116 Name Servers, 315 IETF. S e e Internet Engineering Task Force. ffconfig (command), 137 IGMP. S e e Internet Group Management Protocol. IGP. S e e Interior Gateway Protocol. IGRP. S e e Interior Gateway Routing Protocol. Impress Server List (option), 316 Industry support. S e e Multicast. Information Systems department, decision making management, 266--267 Information Technology (IT) industry, 42 profession, network usage, 230 Integer distance, 246 Integrated IS-IS, 235 Integrity Check Value (ICV), 443 Inter-area routing, 253 Inter-enterprise links, 99 Interal network, 118 Interconnected network, 90

Index

Interface MTU Option (option), 320 Interfaces, 42, 122. S e e also Ethernet; Headquarters; Local Area Networks; Physical interfaces; Secondary interfaces; Wide Area Network. commands, 136 ID, 374-375 names, 158 usage. S e e Unnumbered interfaces. Interior Gateway Protocol (IGP), 238, 250, 2 5 1 , 2 7 4 , 277, 384, 385, 403 Interior Gateway Routing Protocol (IGRP), 40, 66, 237-241, 251, 258 RIP-2, comparison, 247-248 stability, 241 Interior routing protocols, 235 Internal dialing, 228 Internal IP address, 149 Internal network, 235, 244 topology, 238 Internal OSPF routes, 254 Internal routers, 254 Internet, 88, 96 access, 118, 140 addresses, 4. S e e also Unicast. mapping, 9 architecture, 97 backbones, 3 7 1 , 3 7 3 engineer, 361 routers, 369 community, 94 connectivity options, 161 default-free backbone routing tables, 369 domains, 231 global addresses, 381-387

networks, 19 non-CIDR-capable portions, 231 routing complexity, 376 table integrity, 385 scalability problems, 356 site, 12 Internet Address Registry, 50 Internet Assigned Numbers, 94 Internet Assigned Numbers Authority (IANA), 94, 313, 344, 351, 379-380 assignments, 345-346 Internet Connection Sharing (ICS), 131-135, 154, 163, 164 configuration, 132 issues, 155 Internet Control and Message Protocol (ICMP), 144, 160, 431 m a s k discovery, 321 parameter problem, 427, 432, 433, 436 Unrecognized Type message, 448 version 6 (ICMPv6), 362 Internet Corporation for Assigned Names and Numbers (ICANN), 94, 95 Internet Engineering Task Force (IETF), 226, 237, 342-344, 358, 366, 400, 406, 410 Internet Group Management Protocol (IGMP), 341, 342, 350 Internet Protocol (IP), 15, 28, 43, 243 addressing, 89, 90, 224. S e e also Private IP addressing. plan, 40, 64 rules, 95, 100 scheme, 15 calculator, 62

471

472

Index

Chains, 156, 188 data transmission rules, i I datagrams, i0, 13, 35 destinations. S e e Multiple IP destinations. address, 295 devices, 16, 35, 58 forwarding, 318 header, 420, 438 IP Datagram header, 333 IP Forwarding Enable/Disable (option), 318 IP-level TTL field, 323 layer, 438 layer parameters per host, 318-320 per interface, 320-322 mapping, 136 masquerade, 162, 167. S e e also Linux. Linux, 187-188 multicast, 350 mapping, 341 networks, 5, 14, 49, 101 Precedence bits, 358 process, 30 protocols, 95 resources, 5 routers, 344 routing protocols, 66 software, 35, 36, 96 modules, 100 space, 378 stacks, 347-348 subnets, 27 subnetting, 13, 37 TTL field, 333 unnumbered, 46, 66 Internet Protocol tiP) addresses, 19,

20, 27, 30, 32, 33, 40, 45, 48, 90, 95, 98, 117, 123, 270, 365, 404. S e e also Assignable IP address; Assigned IP addresses; Contiguous IP addresses; Destination; Internal IP address; Public IP addresses; Source; Virtual IP addresses. allocation, 51 amount, need, 161 assignment, 62, 94 automatic assignment BOOTP/DHCP objectives usage, 281 FAQs, 336-338 introduction, 282-286 availability, 61 basics, 2-13 bits, 45 blocks, 232 configuration, 284 mapping, 9 need, determination. S e e Subnets. range, 41, 42 calculation. S e e Subnets. retrieval, 50-53 size, increase, 388--390 specification, 255 tracking, 62 usage, 95-96. S e e Networks. work documentation, 62--63 Internet Protocol (IP) Subnet Calculator, 57 Internet Protocol Next-Generation Working Group (IPNGWG), 406, 407, 409 Internet Protocol version 4 (IPv4), 3, 9 1 , 3 4 9 , 354 addresses, 4, 5, 36, 386 addressing, 2 options, length, 418

Index

architecture, 88 headers, 422-424 networks, options usage, 426 Internet Protocol version 6 (IPv6), 91, 231,251 benefits, 387-405 development, 406-410 enabling, amount determination, 361 Mobility Support Internet-Draft, 447-448 packet, 360 header, 357 Internet Protocol version 6 (IPv6) addressing, 353 basics, 354-356 FAQs, 411-412 introduction, 354 scheme characteristics, 357-387 version, 358 Internet Protocol version 6 (IPv6) headers, 413, 420-422, 426 extension/option, improved support, 417 FAQs, 450 introduction, 414-415 references, 451 Internet Registry, usage, 52 Internet Relay Chat (IRC), 157 Internet Service Provider (ISP), 50, 64, 94, 95, 112, 118, 227, 232, 268, 278, 343, 374, 406. S e e also Major ISP; Minor ISP. address assignment, 233-234 change, 349 routers, 140 usage, 51-52 Internet-wide connectivity, 231 Internet-wide IP connectivity, 234 Internetwork, 101 design, review, 40-41

Internetworking devices, 44 Interoperability, 415 problems, 49, 59 Intra-area routing, 253 Intradomain routing protocols, 235 Intranet, local addresses, 381-387 Invalid timer, 241 lOS. S e e Cisco. IP. S e e Internet Protocol. IPng, 231 IPNGWG. S e e Internet Protocol NextGeneration Working Group. IPSec, 130 IPv4. S e e Internet Protocol version 4. IPv6. S e e Internet Protocol version 6. IPX, 356 IRC. S e e Internet Relay Chat. Server List. S e e Default Internet Relay Chat Server List. IS-IS, 2 5 1 , 4 0 3 . S e e also Integrated ISIS. ISDN, 161 ISP. S e e Internet Service Provider. IT. S e e Information Technology.

Java, 177 J u m b o Payload Option, 430, 432

L LAN. S e e Local Area Network.

Layer-2 switches, 43, 63 Layer 3 address translation, 120 headers, 120 Layer-3 switches, 42, 43, 63

473

474

Index

Layer 4 headers, 120 Layer parameters per host. S e e Internet Protocol. per interface. S e e Internet Protocol; Link layer parameters per interface. Layer protocol, 3 Lease Time, 304 Leased lines. S e e Dedicated leased lines. Leased point-to-point line, 102 Leased T1 lines, 65 Legacy problems, 365 Length field, 417. S e e also Headers. Link analyzer, 256 Link layer, 341 parameters per interface, 322 Link Local, 384, 385, 388 Link-local address, 344 Link-local network, 382 Link-local scope, 347 Link-state advertisement, 261 Link-state algorithm, 260 Link-state database, 260 Link-state information, 261 Link-state messages, 260, 262 Link-state technology, 239, 252 Link-state update, 263 Links. S e e Distribution centers; External links; Headquarters; HQ-DC links; Networks; Physical links; Point-to-point links; Pointto-point WAN links; Routers; Summary links; Virtual link; Wide Area Network. Linux, 130, 272 IP masquerade, 137-139, 156-157 kernel, 156 Load sharing, 252

Local addresses. S e e Intranet. hierarchy, 415 Local Area Network (LAN), 13, 90, 9 I, 102, 105, 108, 164, 192, 199, 386, 390. S e e also Admin 12kNs; Administrative LANs; DC LANs; Distribution centers; Distribution 12kN; Headquarters; Store LANs; Warehouse LANs. addresses, 107 configuration, 388 connections, 42, 131 interfaces, 42, 131, 137, 155 segment, 397 segments, 41, 46-47, 49 topology, 262 Local devices, 6 Local gateways, 4 Local hosts, 7 Local net, 4 addresses, 4 mapping, 9 Log Server List (option), 316 Loop-free paths, 243 Loopback interfaces, 275-276 Loose Source Route and Record, 361, 433 Low overhead topology changes, response, 252 LPR Server List (option), 316

M MAC address, 285, 290, 292, 394, 395, 397 Mail server, 12 Major ISP, 52 Management consultant reports, 102 Manual address assignment, 299

Index

Many-to-many NAT, 138, 144 Many-to-one NAT, 155 Many-to-one PAT, 156 Mask Supplier (option), 321 Masking, 225 Masks. S e e Class masks; Default mask; Fixed length mask; Fixedlength subnet masks; Natural mask; Subnets; Variable-Length Subnet Mask. addressing. S e e Fixed mask. choice, 45-50, 53, 56, 62 cohesiveness, 204 components, 21 creation. S e e Networking problems. function, 19-20 interaction. S e e Addresses. interpretation, 34 necessity. S e e Variable length masks. number, 210 usage, 37 determination, 200-201 values binary determination, 22-23 decimal equivalent, 23-25 Matrix, 199 Maximum Datagram Reassembly Size (option), 319 Maximum DHCP Message size, 307 Maximum Transmission Unit (MTU), 319, 362, 423, 438, 439. S e e also Path MTU. value, 320 Mbone. S e e Multicast. Memory space, 251 Mergers/acquisitions, 44, 95 Merit Dump File (option), 317 Meshed links, 252 Message Digest Authentication, 256

Messages. S e e Update messages. Metric Cost, 239 parameter, 266 Metric hop count, 243, 245-248 Metrics, 243, 244, 246-248 Microsoft Proxy Server (MPS), 155, 172 Migrations, 258 Minor ISP, 52 MIT-LCS UDP log servers, 316 Mobile IP Home Agent (option), 326 MOSPF. S e e Multicast. MPLS. S e e Multi-Protocol Label Switching. MPS. S e e Microsoft Proxy Server. MSDP. S e e Multicast Source Discovery Protocol. MTU. S e e Maximum Transmission Unit. Multi-Protocol Label Switching (MPLS), 358-359 Multicast, 439. S e e also Internet Protocol. addresses, 344-347 scope, TI'L usage, 346 backbone (Mbone), 343, 344, 346, 400 channels, 349 definition, 340-343 experience, 343 group, joining, 341-342 industry support, 350 management, administrative scopes usage, 347 mapping. S e e Internet Protocol. nodes, 448 OSPF (MOSPF), 342 routing, 343 protocols, 342-343 scalability improvement, 398-403

475

476

Index

session, 402 usage, reason, 348-350 Multicast addressing, 339 FAQs, 351 references, 351-352 Multicast Source Discovery Protocol (MSDP), 400 Multicast-speaking machines, 396 Multicasting, 2 5 1 , 3 4 0 Multihomed devices, 10-12 Multihomed link, 269 Multihoming, 9, 10 problem, 406-409 Multinetting, 12-13, 47 Multiple addresses per interface, 12-13 Multiple IP destinations, 229

N Name Server List (option), 315 NAT. S e e Network Address Translation. Natural mask, 20 NBDD server addresses, 325 NBT node type, 325 Neighbor discovery, 242, 383 recovery, 242 table, 243 Net3 Group, 57 NetBIOS, 2 NetBIOS over TCP/IP Datagram Distribution Server List (option), 325 Name Server List (option), 324 Node Type (option), 325 Scope (option), 325 Netizens, 94

Network Address Translation (NAT), 90, 95, 99, i00, i i i , i13. S e e also Double NAT; Dynamic NAT; Hide NAT; Many-to-many NAT; Many-to-one NAT; One-to-one NAT; Static NAT. advantages, 161-162 command, 145 configuration, 122 examples, 130-139, 144-145, 154-160

devices, 147, 162, 176 explanation, 119-120 FAQs, 183-186 function, explanation, 120-160 introduction, 114 packages, 163, 165 performance issues, 162-164 products, 123, 156, 188 proxy server, comparison, 174--177 references/resources, 187-190 routers, 124 usage, 161 whitepapers, 189 network (command), 255 Network Information Server List (option), 324 Network Information Service+ Domain (option), 326 Servers list (option), 326 Network Information Service (NIS) Domain (option), 323-324 server, 324 Network-layer addresses, 285 Network-Layer Reachability Information (NLRI), 377 Network Management applications, 63 Network/mask combination, 55 Network News Transport Protocol (NNTP) Server List, 327

Index

Network Service Provider, 375, 378. S e e also Tier-2 Network Service Provider. Network/subnet, 49 Network Time Protocol Server List (option), 324 Networking device, 10 problems, m a s k creation, 26-27 Networks. S e e Class C; Corporate backbone; Ethernet; Fixed length mask; Internal network; Internet; Internet Protocol; Point-to-point networks; Private networks; Routing Information Protocol. addresses, 6, 8, 25, 30, 214. S e e also Class A; Class B; Class C; Private network addresses. headers, 126 hierarchy, 416 translations, 51 administrators, 7, 403 architecture, 22 bandwidth, 263 broadcast address, 30, 203 CIDR addresses, usage, 235-236 computers, 285 control panel, 131 definition, 5-6 design specifications, 41 designers, 63, 387 diagram, 194 documentation, 40 failure, 406, 418 field, 21 growth. S e e Data networks. hierarchy, 415 ID, 104, 109, 226 IP address usage, 197

joining, 100 layer, 242 links, 261 management system. S e e SNMPbased network management system. managers, 347 usage, 51 numbers, 4, 7-9, 21, 27, 88, 389 bits, 6 prefix, 50 quantity, 231-233 restriction, 390 routing protocol upgrades, 230 segments, 58, 60 specification, 255 subnetting, 87 exercises, 111-112 FAQs, 110-111 topology, 239, 261 traffic, 421 usability, 26 usage. S e e Information Technology. Next-generation IPs, 449 Next-Generation TRANSition Working Group (NGTRANSWG), 407, 409 Next Header, 360 fields, 360, 364, 424, 427, 440, 445 values, 424 Ne~.vt Hop, 251 Next-hop address, 319 Next-hop router address, 322 Next Level Aggregator Identifier (NLA ID), 374 Next Level Aggregator (NLA), 375-377, 380, 392, 394 aggregation, 393 NGTRANSWG. S e e Next-Generation TRANSition Working Group.

477

478

Index

NIS. S e e Network Information Service. NLA. S e e Next Level Aggregator. ID. S e e Next Level Aggregator Identifier. NLRI. S e e Network-Layer Reachability Information. NNTP. S e e Network News Transport Protocol. Node servicing router discovery requests, 321 Nodes, quantity requirement, 199-200 Non-OSPF interfaces, 266 Nonbroadcast networks, 253 Nonlocal Source Routing Enable/Disable (option), 318-319 Nortel Networks, 265 Nortel routers, 2 7 2 NSAP addresses, 356 Numbering systems. S e e Binary numbering systems; Decimal numbering systems.

0 One-table database, 63 One-to-one mapping, 122, 3 i0 One-to-one NAT, 139 OP (code), 289 (field), 294, 296 Open Shortest Path First (OSPF), 40, 66, 206, 224, 235, 239, 245, 251-267 configuration, 255-258 database, 263 implementation recommendations, 265-266 network, 258 OSPF-routing environment, 258 protocol, 258

routers, 256, 263 routes. S e e Internal OSPF routes. specifications, 237 version 2, 226 Operating systems, 135, 147, 164, 167 Option Data Length field, 429 Option Type, 427-429 Optional authentication, 250 OSI stack, 355 OSPF. S e e Open Shortest Path First.

P Packet capture, 127 fragmentation overhead, 438 routing. S e e Unicast. Packet Filter (PF), 166-- 168 Pad (code), 314 Parallel port, 43 Parallel routes, 238 Parameter Request List, 306--307 Passive routers, 246 Passwords, 255, 256 PAT. S e e Port Address Translation. Path, reliability, 239 Path MTU, 4 3 1 , 4 3 9 Path MTU Aging Timeout Option (option), 319-320 Path MTU Discovery, 320 Path MTU Plateau Table (option), 320 Payload length, 359 Peer review, 97 Per-flow handling, 421 Perform Mask Discovery (option), 321 Perform Router Discovery (option), 321 Performance, issues. S e e Network Address Translation.

Index

Permanent addresses, 344 PF. S e e Packet Filter. Physical address, 3 Physical devices, 26 Physical interface, 275 Physical interfaces, 9 Physical links, 257 Physical network, 13-15 Physical router, 137 PIM. S e e Protocol Independent Multicast. Plug and play, 349, 414 Plug gateway, 172 Point-to-multlPoint networks, 253 Point-to-point line. S e e Leased pointto-point line. Point-to-point links, 93 Point-to-point networks, 46, 92, 253, 259 Point-to-point traffic, 359 Point-to-point WAN connections, 194 links, 90, 196 Poison-reverse updates, 240 Policy Filter Option (option), 319 POP3. S e e Post Office Protocol. Port Address Translation (PAT), 142, 1 4 5 - 1 4 7 , 173. S e e also Cisco; Many-to-one PAT. configuration, 160 device, 172 function, explanation, 147-152 problems, 152-154 process, 219 PORT commands, 128, 129, 152, 153, 163, 170, 173, 175 modification, 181 starting, 176 Port number. S e e Destination; UDP.

Post Office Protocol (POP3) Server List (option), 327 PPP link, 383 Prefix-based addressing, 225 Printers, 43 Privacy, 419-420 capability, 415 Private addresses, 51, 90, 99, 193 blocks, 100 spaces, 100 comparison. S e e also Public addresses. usage, 111 Private addressing, 87, 89, 108 exercises, 111-112 FAQs, 110-111 Private IP addressing, 101 Private network addresses, 96-100 considerations, 98-100 renumbering, 99-100 scope, 99 security, 99 Private networks, 95, 110. S e e also Class A. addressing, 99 Protocol addressing scheme, 368 Protocol dependent modules, 243 Protocol Independent Multicast (PIM), 342, 400 Proxies, 168-173. S e e also CERN proxy; Domain Name System; SOCKS proxy; Telnet. architecture, 118-119 capabilities, 165-180 firewalls, 177 forwarding packets, 446 servers, 169, 189 comparison. S e e Network Address Translation.

479

480

Index

Public addresses, 90, 119 spaces, private address spaces comparison, 94--95 usage, 111 Public comment process, 97 Public IP addresses, 90

Q QoS. S e e Quality of Service. Quake, 157 Quality of Service (QoS), 355, 359

R RARP. S e e Reverse Address Resolution

Protocol. Region ID, 112 Regional distribution centers, 102, 105 Registry, usage. S e e Internet. Relay agent. S e e Bootstrap Protocol. Reliable tranport protocol, 242-243 Renumbering. S e e Private network addresses. Report-writing capability, 63 Request For Comment (RFC), 2, 30, 67, 357, 412 791, 2, 4, 9, 359 887 Resource Location servers, 316 893, 322 940, 19 950, 19, 36, 46, 50, 100 9 5 1 , 2 8 2 , 285, 2 9 1 , 2 9 7 1075, 342 1112, 340 1236, 321 1469, 341 1497, influence. S e e Bootstrap Protocol.

1517,89,226 1518,89,226 1519,89,226 1520,226 1532,282 1533,314 1541,283,285 1542, 291 1542-compliant router, 337 1597, 96, 97, 117 1627, 97, 117 1812, 50 1883, 419 1917, 94 1918, 51, 96-100, 104, 117-119, 186, 187, 189, 383, 388 2022, 341 2131, 100, 283 2236, 3 4 1 , 3 4 2 2260, 407 2365, 346 2402, 450 2406, 450 2460, 401, 450 2608, 349 discussion, 330 understanding, 282-283 Requested Address, 304 RES, 373-374 Reserved addresses, 30-31, 35--36, 61 Resource Location Server List (option), 316 Rest field, 4 Restricted addresses, 30-31 Reverse Address Resolution Protocol (RARP), 285 Reverse-connection entry, 160 Reverse connections, 167 Reverse DNS entries, 387

Index

Rewrite, usage. S e e Stateful Packet Filters. RFC. S e e Request For Comment. RIP. S e e Routing Information Protocol. RIP II. S e e Routing Information Protocol. RIPE, 354, 380 RIPE NCC, 52 Root Path (option), 318 Routable addresses, 99, 397 Route states, 244 Route summarization, 108, 109 Route Tag field, 250 Routed networks, 328-333 Router Alert Hop-by-Hop option, 431 Option, 430 Router List (option), 315 Router Solicitation Address (option), 321 Router-to-end station communications, 258 Router-to-router communications, 258 Routers, 10, 41-43, 114-119, 224. S e e also Area Border routers; Branch offices; Cisco; Filtering routers; Headquarters; Internal routers; Internet Service Provider; Network Address Translation; Physical router; Subnets. addresses, 44, 292 carriage, 226 configuration files, 159 efficiency, 101, 108-110 links, 261 number, 247 types, 254 update, 238, 258, 260 usage, 47-49, 229

Routes. S e e Aggregate route; Externally derived routes. computation/recomputation, 244 dampening, 393 database, 249 tags, 250 Routing. S e e Classless interdomain routing; Classless routing; Unicasts. complexity. S e e Internet. database, 249 decisions, 27, 270 device, 373 domain field, 250 FAQs, 278-279 headers, 3 6 1 , 4 2 6 , 433-437. S e e also Type 0 routing header. introduction, 224-225 issues, 223 loops, 242 option, 418 packets, 246 policy, 392 protocols, 40, 206, 230, 235, 248, 251, 2 6 1 , 2 7 6 . S e e also Interior routing protocols; Internet Protocol; Intradomain routing protocols; Multicast. upgrading. S e e Networks. stability, 393 tables, 109, 163, 225, 232, 250, 261, 263, 379. S e e also Global routing tables; Internet. maintenance, 359 size, minimization, 376-380 Type, 433 Type 0, 425 update authentication, 252

481

482

Index

impact, 248--250, 258-265 information, 262 Routing Information Protocol (RIP), 220, 224, 230, 239, 272, 342, 403 convergence time, 245 networks, 245 delays, 245 protocol, 237, 244, 245 RIP-1 comparison. S e e Interior Gateway Routing Protocol. requirements, 244-250 RIP-2 requirements, 250-251 RIP II, 235 routing, 258 updates, 250 security, 245 slow links, 245 support, 244 update broadcast, 245 version 1 (RIP1), 40, 92 routers, 255 version 2 (RIP2), 66, 206, 226, 277 RST, 149 packet, 151, 152 RSVP, 430, 434 usage, 431

S Scope-defined options, 311 Secondary addresses, 13 Secondary addressing, 13 Secondary interfaces, 47 SECS (code), 291 (field), 294, 296, 332 Security. See Private network addresses.

architecture, 145, 165 breaches, 99 gateways, 444 package, 114 Segment Left field, 436 Sequence Number field, 443 Sequential allocation, 61 Serial links, 246 Serial port, 43 Server BOOTREPLY, 295-296 Server Identifier, 306 Servers, 43. S e e also Dynamic Host Configuration Protocol; Telnet; Users/servers. database. S e e Bootstrap Protocol. Service Location Protocol (SLP), 349 Service parameters, 323-328 Services applet, 259 Shim, 172 Shortest Path First (SPF), 239, 252 algorithm, 277 SPF-based routers, 252 Shortest Path Trees, 261 SIADDR, 297 (code), 292 (field), 293, 306 Simple IP Plus (SIPP), 356 Simple Mail Transport Protocol (SMTP) Server List (option), 327 Single address per interface, 10 SIPP. S e e Simple IP Plus. Site Level Aggregator Identifier (SLA ID), 374 Site Level Aggregator (SLA), 375-377, 394 Site Local, 385, 388 SixBone (6Bone), 409-411 SLA. S e e Site Level Aggregator. ID. S e e Site Level Aggregator Identifier.

Index

Sleep timer, 241 SLP. S e e Service Location Protocol. SMLI. S e e Stateful Multi-Layer Inspection. SMTP. S e e Simple Mail Transport Protocol. SNAME, 294 (code), 293 (field), 295, 297, 305 SNMP-based network m a n a g e m e n t system, 43 SOCKS proxy, 171, 172 Solicited Node Multicast address, 397 Source address, 120, 124, 151, 159, 364, 433 device, 28 information, 421 IP address, 149, 288 machine, 29 node, 435 port, 147, 149, 151, 153 Source-routing information, 319 SPF. S e e Shortest Path First. SPFs. S e e Stateful Packet Filters. Split horizons, 240 Spreadsheets, 57, 62-63, 199, 214 assignments, 63 Stateful Multi-Layer Inspection (SMLI), 174 Stateful Packet Filters (SPFs), 173, 177, 183 Rewrite, usage, 173-174 shortcomings, 178-180 SPF-type architecture, 179 Static NAT, 120-121, 135, 152 configuration, 159 function, explanation, 122-123 mapping, 141

problems, 126-- 130 Static Router List (option), 322 STDA. S e e StreetTalk Directory Assistance. Store LANs, 106-109 Stores, 104 Strategic relationships, 233 Streaming media protocol, 183 StreetTalk Directory Assistance (STDA) Server List (option), 328 StreetTalk Server List (option), 328 Structural reorganization, 233 Stubs, 254 Subnet All Ones, 36 Subnet-by-subnet basis, 44 Subnet Mask, 19-23, 25, 28, 29, 32, 33-35, 144, 226, 252. S e e also Fixed-length subnet masks; Variable-Length Subnet Masks. (code), 314 field, 251 inclusion, 255 Subnet Zero, 36, 46, 54, 59 usage, 49-50 Subnets, 15, 16, 19, 44, 46-48, 92, 93, 213, 226, 234, 268. S e e also Contiguous subnets; Deployed subnets; Headquarters; Internet Protocol. addresses, 30, 31, 33, 35, 54, 66 determination, single a d d r e s s / m a s k inclusion, 32-33 assignation, 58-60 assignment, 56, 62 worksheet, 79-86 bits, 25, 53, 54, 101 broadcast address, 33 calculators, 57-58 creation. See Variable length subnets. enumeration, 199-200

483

484

Index

field, 21, 22, 32. S e e also Binary subnet field. changes, 23 groups, 105 ID, 104. S e e also Binary subnet ID. identifier, 45 IP addresses number determination, 42-44 range calculation, 53-58 management. S e e Variable length subnets. masking, 225. S e e also TCP/IP. tables, 195 need, 201-205, 219 analysis, 199 number, 19, 21, 26, 27, 29, 31, 35, 36, 50, 102 determination, 41-42 portion, 29 resizing, 194--196 routers, 61--62 routes, 236 tables, consultation, 45-50 types, 108 usage. S e e Addresses. utility, 19 Subnetted network, 285 Subnetting, 19, 28, 34, 367. S e e also Fixed-length subnetting; Internet Protocol; Networks; TCP/IP; Variable-length subnetting. basics, 1 FAQs, 37-38 purpose, 13-18 schemes, 23 choice, 100 standard, 19, 50 strategy. S e e Class A. tables, 57, 67-78, 90. S e e also Class A; Class B; Class C.

Successors, 243-244 Summary links, 261 Sun Solaris 2.6 computer, 348 Supernets, 226, 227, 268 addresses, 228 Supernetting, 225, 232 Swap Server (option), 317 Switches, 41. S e e also Layer-2 switches; Layer-3 switches. SyGate, 189 SYN packet, 150 System documentation, 11

T T I line, 46, 64, 65. S e e also Leased T I lines. TI Renewal Time, 307 T2 Rebinding Time, 307-308 Table entry, 163 Tabular worksheets, 55 Tag-Length-Parameter arrangement, 324 Tags, 313 Talking IP, 42 Target device, 28, 29 Target network, 28, 29 TCP, 114, 143, 160, 405 applications, 409 conflicts, 148 connections, 142, 153, 169, 273, 275, 276, 323 flow, 359 headers, 166, 167, 424, 425, 432 packet, 173 parameters, 323 ports, 167 numbers, 146 protocol, 133, 178

Index

TCP-based applications, 405 TCP Default TTL (option), 323 TCP/IP, 244, 255 address, 273 protocols, 90, 259 router, 248 software, 175 subnet, 235 masking, 225 subnetting, 226 TCP/IP0-based networks, 244 TCP Keepalive Garbage (option), 323 TCP Keepalive Interval (option), 323 TCP/UDP over Bigger Addresses (TUBA), 355 Telecommunications medium, 5 Telnet, 169 program, 171 protocol, 170 proxy, 178 server, 133 Template-based address assignment, 214-218 TFTP server, 306 TFTP Server Name, 305 Three-interface firewall, 185 Tier 1 peers, 406 Tier 1 providers, 389, 392 Tier-1 Service Providers, 3 9 1 , 4 0 4 , 406 Tier-2 Network Service Provider, 374 Time Offset (option), 315 Time-out information, 245 Time Server List (option), 315 Time-to-live field, 449 Timer, 149, 151, 159, 266. S e e also Default timer; Flush timer; Invalid timer; Sleep timer; Update timer. TLA. S e e Top Level Aggregator.

ID. S e e Top Level Aggregator Identifier. TLV. S e e Type-Length-Value. Token Ring, 383 bit-ordering problems, 282 Token-ring network, 3, 11, 14 Token-ring segments, 26 Top Level Aggregator Identifier (TLA ID), 373, 389 Top Level Aggregator (TLA), 375-377, 380, 391, 394 blocks, 392 Topological delay time, 239 Topology change, 266 changes, reponse. S e e Low overhead topology changes. table, 243 Topology change, 242 TOS-based routing, 252 Traffic. S e e Point-to-point traffic. class, 358 patterns, 192 splitting, 238, 247 Trailer Encapsulation (option), 322 Transaction identifier, 290 Transient addresses, 344 Transit area, 257 Translated IP address, 122 Transport mode, 419 Transport protocol, 149 TTL, 345 default value, 319 field, 163, 346, 347, 363. S e e also Internet Protocol. usage. S e e Multicast. TUBA. S e e TCP/UDP over Bigger Addresses. Tunnel mode, 444

485

486

Index

Tunneling mode, 419 Type 0 routing, 442 header, 437 Type-Length-Value (TLV) encoded option, 431 format, 427

U UDP, 114, 144, 152, 159, 160, 405 conflicts, 148 connections, 139, 147 header, 288, 294, 296 ports, 301 numbers, 146, 332 Unicast, 332 addressing, 398 Internet addresses, 366 packet routing, 372 prefixes. S e e Globally Routable Unicast. UNIX, 347 variants, 272 Unnumbered interfaces, usage, 46-47 Update messages, 240, 271 Update timer, 241 Updates. S e e Poison-reverse updates. Upper-layer header, 426 Upper-layer protocols, issues, 449 Upstream providers, 269, 408 Users/servers, 44

V Value-added services, 360 Variable length masks, necessity, 192-197

Variable-Length Subnet Mask (VLSM), 89, 90, 104, 19 i, 192, 196, 206, 244 addressing plan, 193, 219 FAQs, 220-221 introduction, 192 planning, 198 problem. S e e Class C. procedures, simplification, 214 process, 197 tables, 210 usage, 93, 110 Variable-length subnet masking, 244 Variable length subnets creation, 198--218 management, 198-218 Variable-length subnetting, 66 Variably-subnetted networks, 40 VDOLive, 157 VEND (field), 294, 297, 301 VEND/OPTION (code), 293 (field), 304, 313, 318 Vendor Class ID, 308 Vendor Class Identifier, 324 Vendor options, 295 Vendor-Specific Information (option), 324 Vendor-specific parameters, 308 Vendor-supplied ID, 395 Videoconference, 340, 344, 402 Virtual IP addresses, 184 Virtual link, 254, 257 Virtual Private Network (VPN), 130 solutions, 363 V I ~ M . S e e Variable-Length Subnet Mask. VPN. S e e Virtual Private Network.

Index

W

WS1, 49 WS2, 49

WAN. S e e Wide Area Network.

W W W . S e e World Wide Web.

Warehouse LANs, 102 Wide Area Network (WAN), 192, 199 configuration, 388 connections, 42, 47. S e e also Pointto-point WAN. interfaces, 42 links, 43, 44, 47, 59, 93, 107-109, 260. S e e also A s y n c h r o n o u s WAN links; Distribution centers; H e a d q u a r t e r s ; Point-to-point WAN. technology, 92 Windows, 188-189 clipboard, 57 Windows NT 2000, 131-135, 154-156 WINS server, 338 Worksheets, 55-57, 60. S e e also Subnets; T a b u l a r worksheets. scalability, 57 Workstations, 43, 61, 99, 283 World Wide Web (WWW / Web), 88 page, 115, 143, 187 server, 12, 150, 171, 179 farm, 96 surfing, 178

Server list. S e e Default World Wide Web Server List.

X X Window S y s t e m Display Manager List {option), 326 X Window S y s t e m Font Server List (option), 325--326 X.25, 253 XID (code), 290 (field), 296, 297

Y YIADDR (code), 291 (field), 295, 297, 310, 332

487


Bonus Coverage

9"Windows 2000 Server System Administration Handbook"

Introduction to Administering Active Directory As o r g a n i z a t i o n s grow a n d r e q u i r e m o r e applications, services, a n d r e s o u r c e s , a d d i t i o n a l m a n a g e m e n t a n d a d m i n i s t r a t i o n b e c o m e necessary. Even the s m a l l e s t c o m p a n i e s now s e e m to r e q u i r e c o m p u t e r n e t w o r k s a n d their services, i n c l u d i n g the a s s i s t a n c e of a n IT professional, as either a full-time employee, a contractor, or a t h i r d party. Fulfilling t h e s e n e e d s c a n b e c o m e expensive very quickly, so it is n e c e s s a r y to find the m o s t effective a n d efficient m e t h o d s of r e d u c i n g total cost of o w n e r s h i p (TCO). The IT i n d u s t r y h a s developed m a n y options to ease this b u r d e n , i n c l u d i n g t h e c o n c e p t of directory service, w h i c h h a s b e e n u s e d for y e a r s to define m a n y different services from one end of the s p e c t r u m to the other. For example, Microsoft h a s called its u s e r a c c o u n t s d a t a b a s e NTDS (NT Directory Service) for s o m e time. O t h e r v e n d o r s u s e o t h e r f o r m s of directory services to p e r f o r m similar functions. Microsoft h a s i n c o r p o r a t e d m a n y of the c u r r e n t a n d n e w technologies into its n e w o p e r a t i n g system, Windows 2000. Microsoft h a s also u p d a t e d a n d r e d e s i g n e d its previous NTDS into a n e w form, Active Directory. A l t h o u g h Active Directory is fairly new, m a n y of the c o n c e p t s u p o n w h i c h it is b a s e d have long b e e n in u s e t h r o u g h o u t the comp u t e r i n d u s t r y . The Active Directory n a m e s p a c e is b a s e d on c u r r e n t DNS s t a n d a r d s t h a t have b e e n in p l a c e for years. O t h e r f e a t u r e s have b e e n a d d e d t h a t are fairly n e w to Windows; for example, the E n c r y p t i n g File S y s t e m (EFS), Kerberos a u t h e n t i c a t i o n for c o m m u nications, a n d Certificate Authorities have b e e n a d d e d to provide a m o r e scalable a n d s e c u r e e n v i r o n m e n t . With t h e s e f e a t u r e s c o m e s a r e q u i r e m e n t for a r o b u s t directory service to s u p p o r t t h e m . This is w h e r e Active Directory c o m e s in. To u s e a n d m a n a g e Active Directory, you n e e d a good u n d e r s t a n d i n g of the c o m p o n e n t s a n d objects u s e d w i t h i n it, a n d y o u m u s t u n d e r s t a n d the m a n a g e m e n t interfaces a n d how to u s e t h e m . O t h e r f e a t u r e s i n c l u d e d with Active Directory, s u c h as the s e a r c h

Bonus Coverage


m e c h a n i s m s and security subsystems, have been enhanced. These c a n be u s e d to provide a d v a n c e d a d m i n i s t r a t i o n a n d a solution t h a t c a n m e e t the n e e d s of m o s t organizations.

Active Directory Concepts You m u s t u n d e r s t a n d several c o n c e p t s a n d c o m p o n e n t s in o r d e r to u s e the services t h a t are available in Active Directory. T h e s e concepts define its l a y o u t as well as the o p e r a t i o n a l factors t h a t m u s t be considered. E a c h c o m p o n e n t of Active Directory is i m p o r t a n t in m a k i n g this n e w directory service w o r k for you. The c o m p o n e n t s a n d c o n c e p t s t h a t m a k e u p Active Directory help to form the directory i n f r a s t r u c t u r e , a n d e a c h m u s t be properly d e s i g n e d a n d / o r m a i n t a i n e d to provide a reliable a n d stable Windows 2 0 0 0 e n v i r o n m e n t .

Directory The directory i n c l u d e d with Windows 2 0 0 0 h o u s e s the i n f o r m a t i o n r e q u i r e d to p e r f o r m m a n y a d m i n i s t r a t i v e t a s k s s u c h as u s e r m a n agement, printer management, and security information mainten a n c e . M a n y of the tools i n c l u d e d u s e this directory to i n t e g r a t e t h e i r services in order to provide a m o r e c o m p r e h e n s i v e a n d cohesive n e t w o r k i n g e n v i r o n m e n t . The directory i n f o r m a t i o n is stored w i t h i n a d a t a store t h a t is replicated a m o n g d o m a i n controllers (DC), w h i c h are c o m p u t e r s t h a t provide services s u c h as a u t h e n t i c a tion, directory replication, a n d r e s o u r c e location. In o t h e r words, if a n a d m i n i s t r a t o r m a k e s a c h a n g e to the directory on one d o m a i n controller, the c h a n g e will be copied to all o t h e r servers m a i n t a i n i n g replicas of the directory. In addition, a d m i n i s t r a t o r s a n d u s e r s c a n p u b l i s h r e s o u r c e s w i t h i n Active Directory. The directory is s t o r e d on d o m a i n controllers m u c h as it w a s in earlier v e r s i o n s of Windows NT. Only one d o m a i n controller is r e q u i r e d for a d o m a i n , a n d y o u c a n have a n y w h e r e from one to t h o u s a n d s if n e c e s s a r y . E a c h d o m a i n controller m a i n t a i n s a replica of the directory. T h e s e c o m p u t e r s are u s e d to provide scalability,

Bonus Coverage


r e d u n d a n c y , a n d efficient r e s o u r c e location by providing u s e r s with multiple copies of the directory. The d a t a t h a t is stored within the Active Directory c a n be divided into two areas: private a n d public. The i n f o r m a t i o n is stored in a file located on the d o m a i n controllers n a m e d NTDS.dit a n d is stored in < s y s t e m r o o t > \ N T D S by default. The location of the d a t a b a s e c a n be specified d u r i n g the d o m a i n controller p r o m o t i o n process. Private d a t a is secured, while public d a t a is freely replicated a m o n g d o m a i n controllers in a s h a r e d s y s t e m volume. T h r e e forms of public d a t a are replicated. 9 C o n f i g u r a t i o n i n f o r m a t i o n describes the topology or l a y o u t of the directory. I n f o r m a t i o n m a y include d o m a i n s , trees, d o m a i n controllers, a n d global catalog servers. 9 D o m a i n i n f o r m a t i o n c o n t a i n s i n f o r m a t i o n a b o u t the objects located in the directory. This i n c l u d e s the i n f o r m a t i o n c o n t a i n e d w i t h i n objects s u c h as u s e r a t t r i b u t e s or c o m p u t e r properties. 9 S c h e m a i n f o r m a t i o n defines the a t t r i b u t e s a n d objects t h a t are available w i t h i n the directory. For example, the s c h e m a defines a u s e r object a n d its available a t t r i b u t e s .

Namespace Active Directory u s e s n a m e s p a c e s to define its b o u n d a r i e s . A n a m e space is primarily a b o u n d a r y t h a t is u s e d to define a n d resolve n a m e s c o n t a i n e d in it. B a s e d on the DNS n a m e s p a c e s t a n d a r d s specified in R e q u e s t for C o m m e n t s (RFC) 1034 a n d 1035, the Active Directory n a m e s p a c e is i n t e r o p e r a b l e with the I n t e r n e t a n d with a n y o t h e r s t a n d a r d T C P / I P network. T h e s e s t a n d a r d s are key to the ability of W i n d o w s 2 0 0 0 a n d Active Directory to provide T C P / I P n e t w o r k services (see Figure 12.1).

Bonus Coverage

Figure 12.1


This is an e x a m p l e o f a c o n t i g u o u s n a m e s p a c e .

Serverl.d Server2.dev.xyz.com

Two types of n a m e s p a c e s c a n be used: c o n t i g u o u s a n d disjointed. T h e s e also reflect the difference b e t w e e n a W i n d o w s 2 0 0 0 tree a n d forest. A tree is a c o n t i g u o u s n a m e s p a c e , w h i c h c o n s i s t s of a h i e r a r c h y of p a r e n t a n d related c h i l d r e n d o m a i n s . A child d o m a i n h a s a direct r e l a t i o n s h i p to its p a r e n t . For example, dev.xyz.com is a child d o m a i n of xyz.com. C o n t i g u o u s n a m e s p a c e s define trees in W i n d o w s 2000. A forest in W i n d o w s 2 0 0 0 is a disjointed n a m e s p a c e , w h i c h is a series of d o m a i n s t h a t are n o t directly related. For e x a m ple, dev.xyz.com is n o t directly r e l a t e d to abc.com. T h e s e two d o m a i n s are s e p a r a t e , a n d a forest m u s t be f o r m e d in o r d e r to conn e c t t h e s e two t o g e t h e r by s e t t i n g u p bidirectional t r u s t relationships. A l t h o u g h m o s t l y a methodology, this c o n c e p t is one of the m o s t critical c o n c e p t s in u n d e r s t a n d i n g a n d d e s i g n i n g a W i n d o w s 2 0 0 0 Active Directory i n f r a s t r u c t u r e (see Figure 12.2).

Bonus Coverage

Figure 12.2

9

"Windows 2000 Server System Administration Handbook"

This is an example of a disjointed namespace.

Naming Conventions W i t h i n W i n d o w s 2 0 0 0 , every object is identified by a n a m e . N a m i n g c o n v e n t i o n s h a v e b e e n c r e a t e d to provide a u n i f o r m m e t h o d of identifying a r e s o u r c e . In addition, d e p e n d i n g u p o n t h e object or its role, a p a r t i c u l a r item m a y h a v e m o r e t h a n one n a m e . For e x a m p l e , J o h n Doe m a y also be k n o w n a s J o h n D . This m a y be b e c a u s e his full n a m e is J o h n Doe, b u t his n e t w o r k logon n a m e is J o h n D . Several different n a m i n g c o n v e n t i o n s are u s e d w i t h i n W i n d o w s 2 0 0 0 a n d Active Directory. To u n d e r s t a n d e a c h object a n d h o w it p e r t a i n s to o t h e r r e s o u r c e s , y o u m u s t u n d e r s t a n d t h e s e n a m i n g s c h e m e s . The n a m i n g s c h e m e s are: 9

Distinguished Name

9

Relative D i s t i n g u i s h e d N a m e

9

Globally U n i q u e Identifier (GUID)

9

U s e r Principal N a m e

D i s t i n g u i s h e d N a m e s (DN) is a u n i q u e identifier for a n object w i t h i n Active Directory, s u c h a s a u s e r or printer. The d i s t i n g u i s h e d n a m e p r o v i d e s t h e i n f o r m a t i o n r e q u i r e d to allow a client to r e q u e s t r e s o u r c e s . T h e s e n a m e s i n c l u d e t h e c o m p l e t e p a t h t h r o u g h Active Directory, i n c l u d i n g t h e d o m a i n n a m e . D i s t i n g u i s h e d n a m e s m u s t all be u n i q u e a s well. B e c a u s e Active Directory u s e s t h e s e n a m e s to locate r e s o u r c e s w i t h i n t h e d i r e c t o r y service, no two n a m e s c a n be i d e n t i c a l (see Table 12.1).

Bonus Coverage

Table 12.1


Attributes Used in Distinguished Names

Attri bute

Desc ri pti on

CN

Common Name

DC

Domain Component

OU

Organizational Unit

Here is a n e x a m p l e of d i s t i n g u i s h e d n a m e for J o h n Doe located in the sales OU in the xyz.com d o m a i n . CN=John Doe,OU=sales,DC=xyz,DC=com

The Relative Distinguished Name (RDN) is u s e d to locate r e s o u r c e s b a s e d on a p a r t i c u l a r attribute. For example, you m a y w a n t to k n o w only w h e t h e r a J o h n D u s e r id exists. This gives you the ability to s e a r c h t h r o u g h o u t the directory for informaUon w h e n the DN is u n k n o w n or h a s b e e n modified. Also, you c a n have duplicate Relative Unique Identifiers, b u t only if they do not reside within the s a m e organizational unit. In other words, two J o h n D u s e r s c a n exist, b u t not within the s a m e OU, b e c a u s e if this object is placed within a separate OU, the DN will be different for each object (see Figure 12.3).

Figure 12.3

This illustrates the difference between DN and RDN.

DistinguishedName (DN) ,~RDN

1

JohnDoeI UsersI salesI xyz I com DN:CN-JohnDoe OU=Sales DC=xyz DC=com

RDN:JohnDoe

Bonus Coverage


T h e r e are two o t h e r n a m e types. T h e first is t h e Globally U n i q u e Identifier (GUID), w h i c h is a 128-bit identifier t h a t is u s e d to identify a n object w i t h i n Active Directory. T h e GUID is a s s i g n e d once t h e object is c r e a t e d a n d will r e m a i n t h e s a m e if t h e object is m o v e d or r e n a m e d . T h i s allows services to find a n object even if its n a m e or a t t r i b u t e s a r e modified. T h e s e c o n d type is t h e U s e r P r i n c i p a l N a m e (UPN), w h i c h is a u s e r - f r i e n d l y n a m e for a n object u s i n g t h e DNS n a m e c o n v e n t i o n , w h i c h is s i m i l a r to a n e-mail a d d r e s s . T h i s m a k e s it e a s i e r to find a n object l o c a t e d w i t h i n Active Directory. For e x a m ple, J o h n Doe m a y h a v e a UPN of J o h n D @ x y z . c o m .

Schema W i t h i n a d i r e c t o r y service, r u l e s m u s t be u s e d to define t h e objects t h a t a r e available, t h e a t t r i b u t e s of t h o s e objects, a n d h o w t h e y a r e applied. T h i s is t h e j o b of t h e s c h e m a w i t h i n Active Directory. T h e s c h e m a c o n t a i n s definitions of t h e c l a s s e s , a t t r i b u t e s , a n d t h e i r p r o p e r t i e s , s u c h a s t h e u s e r object w i t h t h e d e s c r i p t i o n a t t r i b u t e . W h e n Active D i r e c t o r y is first installed, a d e f a u l t s c h e m a is u s e d . E x a m p l e s of s c h e m a objects i n c l u d e d are u s e r s , c o m p u t e r s , a n d g r o u p s . T h e r e are two t y p e s of s c h e m a objects: a t t r i b u t e s a n d c l a s s es. E a c h is u s e d a n d defined differently w i t h i n Active Directory. An a t t r i b u t e is a field t h a t c a n c o n t a i n i n f o r m a t i o n a b o u t a n object s u c h a s g r o u p n a m e or u s e r e - m a i l a d d r e s s . T h e s e fields c a n also be a p p l i e d to m u l t i p l e c l a s s e s while b e i n g defined only once. Object c l a s s e s define t h e objects t h a t c a n be c r e a t e d w i t h Active Directory. F o r e x a m p l e , a u s e r a c c o u n t or g r o u p a c c o u n t is a c l a s s of object. Every object t h a t is c r e a t e d w i t h i n Active D i r e c t o r y is k n o w n a s a n i n s t a n c e . T h e a t t r i b u t e s for a n object a r e u s e d to define i n f o r m a t i o n a b o u t t h e m s u c h a s n a m e , location, or p h o n e n u m b e r . Therefore, a c l a s s is a collection of m u l t i p l e a t t r i b u t e s . To a p p l y t h e s e t e r m s , a u s e r a c c o u n t n a m e d J o e S is a single i n s t a n c e of t h e object c l a s s U s e r w i t h a t t r i b u t e s i n c l u d i n g t h e n a m e J o e S . T h e d o m a i n controller, a c t i n g a s t h e s c h e m a m a s t e r , c o n t r o l s t h e s c h e m a c o n t e n t . By default, t h i s is t h e first W i n d o w s 2 0 0 0 d o m a i n

Bonus Coverage


controller installed. A copy of the s c h e m a is replicated to all o t h e r d o m a i n controllers w i t h i n t h e forest to m a i n t a i n c o n s i s t e n c y . The s c h e m a c a n be modified, b u t this s h o u l d only be done after extensive testing. For example, a n e w class object or a t t r i b u t e for a n existing class object c a n be added. A l t h o u g h Active Directory does n o t s u p p o r t deleting s c h e m a extensions, objects c a n be m a r k e d as deactivated. E x t e n d i n g the s c h e m a c a n have d i s a s t r o u s affects on the Active Directory, as this will modify the r u l e s by w h i c h it works. Be s u r e to p e r f o r m extensive t e s t i n g before modifying the s c h e m a in a n y way. Microsoft provides a n a p p l i c a t i o n - p r o g r a m m i n g interface (API) k n o w n as Active Directory Services Interface (ADSI). This tool set is d e s i g n e d to provide a n interface with Active Directory t h a t developers c a n i m p l e m e n t w i t h o u t n e e d i d n g to u n d e r s t a n d h o w the interface w o r k s technically.

Global Catalog With a n y directory, a fast a n d efficient w a y to locate r e s o u r c e s is required. For example, u s e r s who are looking for a p r i n t e r p r o b a b l y will n o t w a n t to t r u d g e t h r o u g h the entire n e t w o r k or wait a long time to find w h a t t h e y are looking for. Active Directory u s e s a global catalog server to provide the ability to index i t e m s located w i t h i n the network. The global catalog is designed to provide i n f o r m a t i o n a b o u t r e s o u r c e s located w i t h i n the directory as efficiently as possible, w h i c h s p e e d s the service to the end u s e r r e q u e s t i n g n e t w o r k services. In addition, since a global catalog server m a i n t a i n s i n f o r m a t i o n a b o u t all d o m a i n s i n c l u d e d w i t h i n a forest, a server w i t h i n the d o m a i n from w h i c h a r e q u e s t originates c a n a n s w e r a query. For example, a u s e r located in d o m a i n l c a n provide i n f o r m a t i o n a b o u t a r e s o u r c e located in d o m a i n 2 w i t h o u t h a v i n g to c r o s s d o m a i n b o u n d aries. Any d o m a i n controller c a n be configured as a global catalog server to fulfill y o u r o r g a n i z a t i o n ' s r e q u i r e m e n t s . By default, the first d o m a i n controller installed in a forest is configured as a global catalog server. The global catalog is c r e a t e d a n d m a i n t a i n s i n f o r m a t i o n on all objects located w i t h i n its d o m a i n a n d a

Bonus Coverage


partial set of i n f o r m a t i o n on objects in all o t h e r d o m a i n s . This allows quick a n d efficient q u e r y r e s u l t s for c r o s s - d o m a i n lookups. The global catalog is u s e d to provide two m a i n roles: 9 Gives the ability to locate objects a n y w h e r e w i t h i n the forest. 9 Provides u n i v e r s a l g r o u p m e m b e r s h i p to d o m a i n controllers for a logon request. W h e n the logon a u t h e n t i c a t i o n p r o c e s s begins, the global catalog server provides u n i v e r s a l g r o u p m e m b e r s h i p to the d o m a i n controller being used, so u s e r a u t h e n t i c a t i o n c a n occur a n y w h e r e within the forest. If a global catalog server is unavailable, u s e r s will not be allowed access to n e t w o r k resources, b u t will be allowed to log on only locally. The role of global catalog server c a n be s h a r e d with a n y d o m a i n controller, w h i c h h a p p e n s w h e n only one d o m a i n controller exists within a domain.

This is h o w the global catalog server role is a d d e d or removed on a d o m a i n controller: 1. Select S t a r t i P r o g r a m s i Administrative Tools I Active Directory Sites a n d Services. 2. E x p a n d the site n a m e followed by the Servers c o n t a i n e r a n d t h e n the server n a m e to configure. 3. Highlight the NTDS d o m a i n controller properties, right-click the object, a n d select Properties.

Bonus Coverage 9"Windows 2000 Server System Administration Handbook" 0

Figure 12.4 displays the available options. Select or deselect the c h e c k box for Global Catalog to d e t e r m i n e t h e d o m a i n controller's role.

Figure 1 2.4

Select this check box to provide a n o t h e r global catalog server.

5. Select OK or Apply to approve the modification.

Replication To enable u s e r s to u s e services s u c h as the directory a n d global catalog, t h e directory i n f o r m a t i o n m u s t r e m a i n c o n s i s t e n t t h r o u g h o u t all servers t h a t store this data. To a c c o m p l i s h this c o n s i s t e n c y , a replication s t r a t e g y h a s b e e n defined to m a i n t a i n c o n s i s t e n t replicas of directory services d a t a s u c h as the directory store a n d global catalog. This allows a n y o n e to r e q u e s t a directory r e s o u r c e from anyw h e r e w i t h i n the n e t w o r k of d o m a i n s a n d forests. For example, if User A a d d s the ability for User B to a c c e s s a r e s o u r c e , this inform a t i o n m u s t be replicated to the d o m a i n controller r e s p o n d i n g to

Bonus Coverage


User B. Otherwise, User B w o u l d n o t have the ability to a c c e s s this r e s o u r c e w i t h o u t m a k i n g the c h a n g e on b o t h c o m p u t e r s . A l t h o u g h this i n f o r m a t i o n m u s t r e m a i n c o n s i s t e n t , the a m o u n t of n e t w o r k traffic r e q u i r e d m u s t be m o n i t o r e d as well. If u p d a t e s o c c u r c o n s t a n t l y , a n entire n e t w o r k c a n be c o n s u m e d quickly. Replication s h o u l d be m o n i t o r e d closely to control t h e a m o u n t of traffic t h a t is being c a u s e d . W i n d o w s 2 0 0 0 u s e s several t e c h n i q u e s to optimize replication traffic. For example, Active Directory evaluates t h e n e t w o r k c o n n e c t i o n s t h a t are u s e d a n d selects the m o s t efficient. Also, a n y available multiple r o u t e s are u s e d to provide fault tolerance a n d r e d u n d a n c y . One of the m o s t effective optimization t e c h n i q u e s is the replication of Delta information; in o t h e r words, only the c h a n g e s to a n object are replicated. For example, if J o e S c h a n g e s his p a s s w o r d , only t h a t c h a n g e d a t t r i b u t e is replicated a n d n o t the entire object. This c a n m a k e a d r a m a t i c difference for y o u r local a n d w i d e - a r e a network. Two types of site replication c a n occur. Intrasite c o m m u n i c a t i o n o c c u r s a m o n g all d o m a i n controllers located w i t h i n the s a m e site, a n d intersite c o m m u n i c a t i o n o c c u r s b e t w e e n two sites configured with a site link. Two c o m m u n i c a t i o n m e t h o d s , IP a n d SMTP, are available for site links. Intrasite links are a u t o m a t i c a l l y g e n e r a t e d a n d m a i n t a i n e d , b u t intersite links m u s t be m a n u a l l y created. Intrasite links are m a i n t a i n e d by Active Directory to optimize replication. By default, two links to every d o m a i n controller are c r e a t e d to eliminate a single link failure. This replication s t r a t e g y is c o n t i n u ally m o n i t o r e d a n d u p d a t e d . For example, w h e n a n e w d o m a i n controller is installed in a site, the replication topology is r e c a l c u l a t e d to provide t h e m o s t efficient n e t w o r k replication.

The Global Knowledge Advantage Global Knowledge has a global delivery system for its products and services. The company has 28 subsidiaries. and offers its programs through a total of 60+ locations. No other vendor can provide consistent services across a geographic area this large. Global Knowledge is the largest independent information technolo@ erlilcatlion provider, offering programs on a variety of platforms. This enables our multi-platform and multi-national customers to obtain all of their programs from a single vendor. The company has developed the unique CompetusTM Framework software tool and methodolorn which can quickly reconfigure courseware to the proficiency level of a student on an interactive basis. Combined with self-paced and on-line programs. this technolo@ can reduce the time required for training by prescribing content in only the deficient skills areas. The company has fully automated every aspect of the education process, from registration and follow-up, to ‘]ust-in-tirne” production of courseware. Global Knowledge through its Enterprise Services Consultancy, can customize programs and products to suit the needs of an individual customer.

Global Knowledge Classroom Education Programs The backbone of our delively options is classroom-based education. Our modern, well-equipped facilities staffed with the finest instructors offer programs in a wide variety of information technology topics, many of which lead to professional certiflcations.

Custom Learning Solutions This delivery option has been created for companies and governments that value customized learning solutions. For them, our consultancy-based approach of developing targeted education solutions is most effective at helping them meet specific objectives.

Self-Paced and Multimedia Products This delivery option offers self-paced program titles in interactive CD-ROM, videotape and audio tape programs. In addition, w e offer custom development of interactive multimedia courseware to customers and partners. Call us at 1-888427-4228.

Electronic Delivery of Training Our network-based training service delivers efficient competency-based, interactive training via the World Wide Web and organizational intranets. This leadingedge delivery option provides a custom learning path and ”just-in-time”training for maximum convenience to students.

Global Knowledge Courses Available Microsoft 9 9 9 9 9 9 9 9 9 9 9 9 9

Windows 2000 Deployment Strategies I n t r o d u c t i o n to Directory Services W i n d o w s 2 0 0 0 Client A d m i n i s t r a t i o n W i n d o w s 2 0 0 0 Server Windows 2000 Update MCSE Bootcamp Microsoft N e t w o r k i n g E s s e n t i a l s W i n d o w s NT 4.0 W o r k s t a t i o n W i n d o w s NT 4.0 Server W i n d o w s NT T r o u b l e s h o o t i n g W i n d o w s NT 4.0 S e c u r i t y Windows 2000 Security I n t r o d u c t i o n to Microsoft Web Tools

Management Skills 9 Project M a n a g e m e n t for IT P r o f e s s i o n a l s 9 Microsoft Project W o r k s h o p 9 M a n a g e m e n t Skills for IT P r o f e s s i o n a l s

Network Fundamentals 9 9 9 9 9 9 9

Understanding Computer Networks Telecommunications Fundamentals I T e l e c o m m u n i c a t i o n s F u n d a m e n t a l s II Understanding Nehvorking F u n d a m e n t a l s U p g r a d i n g a n d R e p a i r i n g PCs D O S / W i n d o w s A+ P r e p a r a t i o n N e t w o r k Cabling S y s t e m s

WAN Networking and Telephony 9 9 9 9 9

Building B r o a d b a n d N e t w o r k s F r a m e Relay Internetvcorking C o n v e r g i n g Voice a n d D a t a N e t w o r k s I n t r o d u c t i o n to Voice Over IP U n d e r s t a n d i n g Digital S u b s c r i b e r Line {xDSL}

Internetworking 9 9 9 9 9 9 9 9 9 9 9 9 9 9

ATM E s s e n t i a l s ATM I n t e r n e t w o r k i n g ATM T r o u b l e s h o o t i n g U n d e r s t a n d i n g N e t w o r k i n g Protocols Internetworking Routers and Switches Network Troubleshooting Internetworking with TCP/IP Troubleshooting TCP/IP Networks Network Management Network Security Administration Virtual Private N e t w o r k s Storage Area Networks Cisco O S P F Design a n d C o n f i g u r a t i o n Cisco B o r d e r G a t e w a y Protocol (BGP) Configuration

Web Site Management and Development 9 9 9 9 9 9

A d v a n c e d Web Site Design I n t r o d u c t i o n to XML Building a Web Site I n t r o d u c t i o n to J a v a S c r i p t Web D e v e l o p m e n t F u n d a m e n t a l s I n t r o d u c t i o n to Web D a t a b a s e s

PERL, UNIX, and Linux 9 9 9 9 9 9

PERL Scripting PERL w i t h CGI for t h e Web UNIX Level I UNIX Level II I n t r o d u c t i o n to Linux for New U s e r s Linux Installation, Configuration, a n d Maintenance

Authorized Vendor Training Red Hat 9 I n t r o d u c t i o n to Red H a t L i n u x 9 Red H a t L i n u x S y s t e m s A d m i n i s t r a t i o n 9 Red H a t Linux N e t w o r k a n d S e c u r i t y Administration 9 RHCE Rapid T r a c k Certification

Cisco Systems 9 I n t e r c o n n e c t i n g Cisco N e t w o r k Devices 9 A d v a n c e d Cisco R o u t e r C o n f i g u r a t i o n 9 I n s t a l l a t i o n a n d M a i n t e n a n c e of Cisco Routers 9 Cisco I n t e r n e t w o r k T r o u b l e s h o o t i n g 9 D e s i g n i n g Cisco N e t w o r k s 9 Cisco I n t e r n e t w o r k Design 9 Configuring Cisco C a t a l y s t S w i t c h e s 9 Cisco C a m p u s ATM S o l u t i o n s 9 Cisco Voice Over F r a m e Relay, ATM, a n d IP 9 Configuring for S e l s i u s IP P h o n e s 9 Building Cisco R e m o t e Access N e t w o r k s 9 M a n a g i n g Cisco N e t w o r k S e c u r i t y 9 Cisco E n t e r p r i s e M a n a g e m e n t S o l u t i o n s

Nortel Networks 9 Nortel N e t w o r k s A c c e l e r a t e d R o u t e r Configuration 9 Nortel N e t w o r k s A d v a n c e d IP R o u t i n g 9 Nortel N e t w o r k s WAN Protocols 9 Nortel N e t w o r k s F r a m e S w i t c h i n g 9 Nortel N e t w o r k s Accelar 1000 9 Comprehensive Configuration 9 Nortel N e t w o r k s Centillion S w i t c h i n g 9 Netnvork M a n a g e m e n t w i t h Optivity for Windows

Oracle Training 9 I n t r o d u c t i o n to Oracle8 a n d P L / S Q L 9 Oracle8 D a t a b a s e A d m i n i s t r a t i o n

Custom Corporate Network Training Train on Cutting; ‘Edge Technology We can bring the best in skill-based training to your facility to create a real-world hands-on training experience. Global Knowledge has invested millions of dollars in network hardware and software to train our students on the same equipment they will work with on the job. Our relationships with vendors allow us to incorporate the latest equipment and platforms into your on-site labs.

Maximize Your Training Budget Global Knowledge provides experienced instructors, comprehensive course materials, and all the networking equipment needed to deliver high quality training. You provide the students: we provide the knowledge.

Avoid Travel Expenses On-site courses allow you to schedule technical training at your convenience. saving time, expense, and the opportunity cost of travel away from the workplace.

Discuss Confidentia I Topics Private on-site training permits the open discussion of sensitive issues such as security, access, and network design. We can work with your existing network’s proprietary files while demonstrating the latest technologies.

Customize Course Content Global Knowledge can tailor your courses to include the technoIogies and the topics which have the greatest impact on your business. We can complement your internal training efforts or provide a total solution to your training needs.

Corporate Pass The Corporate Pass Discount Program rewards our best network training customers with preferred pricing on public courses, discounts on multimedia training packages, and an m a y of career planning services.

Global Knowledge Training Lifecycle Supporting the Dynamic and Specialized Training Requirements of Information TechnoIogy Professionals Define Profile Assess Skills rn Design Training I Deliver

Training Test Knowledge rn Update Profile U s e New Skills

Global Knowledge Global Knowledge programs are developed and presented by i n d u s t r y professionals with "real-world" experience. Designed to help professionals meet today's interconnectivity and interoperability challenges, most of our programs feature h a n d s - o n labs t h a t incorporate state-of-the-art c o m m u n i c a t i o n c o m p o n e n t s and equipment.

ON-SITE TEAM TRAINING Bring Global Knowledge's powerful training programs to your company. At Global Knowledge, we will c u s t o m design courses to meet your specific network requirements. Call (919)-461-8686 for more information.

YOUR GUARANTEE Global Knowledge believes its courses offer the best possible training in th~,~ ~ i . If during the first day you are not satisfied and wish to w i t h d r a w from the course, simply notify the instructor, r e t u r n all course materials and receive a 100% refund.

REGISTRATION INFORMATION In the US: call: {888) 7 6 2 - 4 4 4 2 fax: (919) 4 6 9 - 7 0 7 0 visit our website: www.globalknowledge.com

The premier online information source for IT professionals You've g a i n e d a c c e s s to a Global Knowledge i n f o r m a t i o n p o r t a l d e s i g n e d to inform, e d u c a t e a n d u p d a t e visitors on i s s u e s r e g a r d i n g IT a n d IT e d u cation. Get w h a t y o u w a n t w h e n y o u w a n t it at t h e access..q t o b a t k n o w L e d g e site:

Choose personalized technology articles related to your interests. Access a new article, review, or t u t o r i a l regularly t h r o u g h o u t the week customized to w h a t you w a n t to see. Keep learning in between Global courses by taking advantage of chat sessions w i t h other users or instructors. Get the tips, tricks and advice t h a t you need today! Make your point in the Access.Globalknowledge c o m m u n i t y w i t h t h r e a d e d d i s c u s s i o n g r o u p s r e l a t e d to t e c h n o l o g i e s a n d certification. Get instant course information at y o u r fingertips. Customized

course calendars showing you the courses you w a n t w h e n and where you w a n t them.

Get the resources you need w i t h online tools, trivia, skills assess-

ment and more!

All t h i s a n d m o r e is available n o w on t h e web a t access, g loba l knowledge. VISIT TODAYI

ccess " global knowledge

http://access.globalknowledge.com

IP Addressing and Subnetting, Including IPv6

IP Addressing and Subnetting, Including IPv6

IP Addressing and Subnetting, Including IPv6

IP Addressing Fundamentals

The ABCs of IP Addressing

The ABCs of IP Addressing

IP: Architcture, Protocols, and Implementation With IPv6 and IP Security

The ABCs of IP Addressing

TCP IP: Architecture, Protocols and Implementation with IPv6 and IP Security

Cisco - OSS Addressing OSS Issues for IP Netwk Mgmnt

Understanding IPv6

Understanding IPv6

IPv6 Essentials

Technik der IP-Netze: TCP IP incl. IPv6 – Funktionsweise, Protokolle und Dienste, 2. Auflage

Running IPv6

IPv6 essentials

IPv6 Essentials

Running IPv6

IP

IP

IP

IP

IP

TCP IP Architecture Protocols and Implementation With IPv6 and IP Security--McGraw Hill Series On Computer Communications

IP

IP

ip

DNS and BIND on IPv6

Mobile IPv6; Protocols and Implementation

IPv6. Theory, Protocol and Practice

IP Addressing and Subnetting, Including IPv6