ccna exp4 - chapter07 - ip addressing service

8/3/2019 CCNA Exp4 - Chapter07 - IP Addressing Service

1/87

Chapter 7 - Implementing

IP Addressing Services

CCNA Ex loration 4.0

Please purchase apersonal license.


2/87

Introduction

Hc vin mng Bach Khoa - Website: www.bkacad.com 2


3/87

DHCP



4/87

Introducing DHCP

DHCP assigns IP addresses and other importantnetwork configuration information dynamically.



5/87

DHCP Operation

Manual Allocation: Theadministrator assigns a pre-allocated IP address to theclient and DHCP onlycommunicates the IP addressto the device.

Automatic Allocation: DHCPautomatically assigns a staticIP address permanently to adevice, selecting it from a poolof available addresses. There


is no lease and the address ispermanently assigned to adevice.

Dynamic Allocation: DHCPautomatically dynamicallyassigns, or leases, an IPaddress from a pool of

addresses for a limitedperiod of time chosen by theserver, or until the client tellsthe DHCP server that it nolonger needs the address.


6/87

BOOTP and DHCP

Both DHCP and BOOTP are client/server based anduse UDP ports 67 and 68. Those ports are still known

as BOOTP ports.



7/87

DHCP Message Format



8/87

DHCP Discover



9/87

DHCP Offer



10/87

Configuring a DHCP Server



11/87

Configuring a DHCP Server


Example


12/87

Verifying DHCP

PC1: ipconfig /all



13/87

Verifying DHCP

PC2: ipconfig /all



14/87

Verifying DHCP



15/87

Configuring a DHCP Client



16/87

Configuring a DHCP Client



17/87

DHCP Relay



18/87

DHCP Relay



19/87

DHCP Relay


Helper address configuration that relays broadcasts to all servers onthe segment.RTA(config)#interface e0

RTA(config-if)#ip helper-address 172.24.1.255

But will RTA forward the broadcast?

Broadcast Unicast


20/87

DHCP Relay


Notice that the RTA interface e3, which connects to the server farm, is not configuredwith helper addresses.

However, the output shows that for this interface, directed broadcast forwarding isdisabled. This means that the router will not convert the logical broadcast

172.24.1.255 into a physical broadcast with a Layer 2 address of FF-FF-FF-FF-FF-FF.

To allow all the nodes in the server farm to receive the broadcasts at Layer 2, e3 willneed to be configured to forward directed broadcasts with the following command:

RTA(config)#interface e3

RTA(config-if)#ip directed-broadcast


21/87

DHCP Relay



RTA(config-if)#ip helper-address 172.24.1.255


RTA(config-if)#ip directed-broadcast

L3 Broadcast L2 Broadcast


22/87

Using helper addresses

By default, the ip helper-address command forwards the eight UDPs services.


The Cisco IOS provides the global configuration command ip forward-protocol to allow an administrator to forward any UDP port in addition to thedefault eight.


23/87

Configuring a DHCP Server Using SDM



24/87

Configuring a DHCP Server Using SDM



25/87

Verifying and Troubleshooting DHCP



26/87

Verifying and Troubleshooting DHCP



27/87

Scaling Networks with NAT



28/87

Private and Public IP Addressing



29/87

What is NAT ?



30/87

NAT Terminology


Inside local address - Usually not an IP address assigned by a RIR or service providerand is most likely an RFC 1918 private address.

Inside global address - Valid public address that the inside host is given when it exitsthe NAT router. When traffic from PC1 is destined for the web server at 209.165.201.1, router R2

must translate the address. In this case, IP address 209.165.200.226 is used as theinside global address for PC1.

Outside global address - Reachable IP address assigned to a host on the Internet. For example, the web server is reachable at IP address 209.165.201.1.

Outside local address - The local IP address assigned to a host on the outsidenetwork. In most situations, this address will be identical to the outside global address of

that outside device.


31/87

The Forms of NAT

Static NAT Mapping an unregistered IP address to a registered IPaddress on a one-to-one basis. Particularly useful when a deviceneeds to be accessible from outside the network.



32/87

The Forms of NAT

Dynamic NAT Maps an unregistered IP address to a registered IPaddress from a group of registered IP addresses. Dynamic NAT alsoestablishes a one-to-one mapping between unregistered and

registered IP address, but the mapping could vary depending on theregistered address available in the pool, at the time of communication.



33/87

The Forms of NAT

Overloading A form of dynamic NAT that maps multiple unregisteredIP addresses to a single registered IP address (many-to-one) by usingdifferent ports. Known also as PAT (Port Address Translation), single

address NAT or port-level multiplexed NAT.



34/87

NAT Example


Inside local address The IP address assigned to a host on the inside network. Thisaddress is likely to be an RFC 1918 private address.

Inside global address A legitimate (Internet routable or public) IP address assignedthe service provider that represents one or more inside local IP addresses to the outsideworld.

Outside local address The IP address of an outside host as it is known to the hostson the inside network.

Outside global address The IP address assigned to a host on the outside network.The owner of the host assigns this address.


35/87

NAT Example

1 2


128.23.2.2 10.0.0.3 .... Data

DA SA

IP Header

128.23.2.2 179.9.8.80 .... Data

DA SA

IP Header1 2


36/87

NAT overload



37/87

Next Available Port



38/87

Benefits and Drawbacks of Using NAT



39/87

Configure Static NAT on a Cisco Router



40/87

Example



41/87

Configure Dynamic NAT on a Cisco Router


C fi D i NAT Ci R


42/87

Configure Dynamic NAT on a Cisco Router


E l


43/87

Example


Translate to these

outside addresses


44/87

Configuring NAT Overload for a Single Public IP Address


C fi i NAT O l d f Si l P bli IP Add


45/87

Configuring NAT Overload for a Single Public IP Address


C fi i NAT O l d f P l f P bli IP Add


46/87

Configuring NAT Overload for a Pool of Public IP Addresses




47/87



Port Forwarding


48/87

Port Forwarding


Port forwarding (sometimes referred to as tunneling) is the act of forwarding anetwork port from one network node to another.

This technique can allow an external user to reach a port on a private IP

address (inside a LAN) from the outside through a NAT-enabled router.

Port Forwarding


49/87

Port Forwarding

http://portforward.com


Verifying NAT and NAT Overload


50/87





51/87



Troubleshooting NAT and NAT Overload Configuration


52/87

Troubleshooting NAT and NAT Overload Configuration


Step 1. Based on the configuration, clearly define what NAT is supposed toachieve. This may reveal a problem with the configuration.

Step 2. Verify that correct translations exist in the translation table using theshow ip nat translations command. Step 3. Use the clear and debug commands to verify that NAT is operating as

expected. Check to see if dynamic entries are recreated after they are cleared. Step 4. Review in detail what is happening to the packet, and verify that

routers have the correct routing information to move the packet.


53/87


Reason for using IPv6


54/87





55/87



Address space


56/87

Address space


IPv6 Features


57/87


IPv6 Features


58/87


Comparing IPv4 and IPv6 Headers


59/87

p g

Traffic class: ToS

Payload Length

Next Header: Tcp, Udp

Hop Limit: TTL

No Checksum


Flow Label: 20-bit field that allows a particular flow of traffic to be labeled. It

can be used for multilayer switching techniques and faster packet-switchingperformance. Extension Headers: Follows the previous eight fields. The number of

extension headers is not fixed, so the total length of the extension headerchain is variable.

Extension header


60/87


Extension Header

Extension Header

Extension header


61/87


IPv6 Extension Headers


62/87

IPv6 Header: Basic header described in the previous figure. Hop-by-hop options header: When used for the router alert

(Resource Reservation Protocol [RSVP] and Multicast ListenerDiscovery version 1 [MLDv1]) and the jumbogram, this header (value =0) is processed by all hops in the path of a packet.

Destination options header (when the routing header is used) Routing header: Used for source routing and mobile IPv6 (value =

43).


ragmen ea er: se w en a source mus ragmen a pac e a s

larger than the MTU for the path between itself and a destinationdevice. Authentication Header and Encapsulating Security Payload

header: Used within IPsec to provide authentication, integrity, andconfidentiality of a packet. The Authentication Header (value = 51) The ESP header (value = 50)

Upper-layer header: Typical headers used inside a packet to transportthe data. The two main transport protocols are TCP (value = 6) andUDP (value = 17).

Defining Address Representation


63/87


Leading zeros in a field are optional, so 09C0 = 9C0 and 0000 = 0. Successive fields of zeros can be represented as :: only once in an address. An unspecified address is written as :: because it contains only zeros.

IPv6 Address Types


64/87


1. Unicast address Link local (FE80::/10): Scope is configured to single link. The address is unique only on this

link, and it is not routable off the link. (similar to 169.254.x.x private address) Site local (FEC0::/10): similar to private address. Global: Globally unique, so it can be routed globally with no modification. A global address

has an unlimited scope on the worldwide Internet. Packets with global source and destinationaddresses are routed to their target destination by the routers on the Internet.2. Multicast address (FF00::/8): IPv6 does not have broadcast addresses. The range of multicast

addresses in IPv6 is larger than in IPv4. For the foreseeable future, allocation of multicast groups isnot being limited.

3. Anycast address: An anycast address identifies a list of devices or nodes; therefore, an anycastaddress identifies multiple interfaces. A packet sent to an anycast address is delivered to the closestinterface, as defined by the routing protocols in use.

Special Address


65/87


IPv6 Global Unicast and Anycast address


66/87


, ,interface ID. The current global unicast address assignment by the Internet Assigned

Numbers Authority (IANA) uses the range of addresses that start with binary value 001(2000::/3), which is 1/8 of the total IPv6 address space and is the largest block ofassigned block addresses.

The IANA is allocating the IPv6 address space in the ranges of 2001::/16 to the five RIRregistries (ARIN, RIPE, APNIC, LACNIC, and AfriNIC).

Addresses with a prefix of 2000::/3 (001) through E000::/3 (111), with the exception ofthe FF00::/8 (1111 1111) multicast addresses, are required to have 64-bit interfaceidentifiers in the Extended Universal Identifier (EUI)-64 format.

When a unicast address is assigned to more than one interface, thus turning it into ananycast address, the nodes to which the address is assigned must be explicitlyconfigured to use and recognize the anycast address.

Assign IPv6 address


67/87


Stateless Autoconfiguration


68/87


1. Phase 1: MAC 00-0C-29-C2-52-FF -> 02-0C-29-FF-FE-C2-52-FF2. Phase 2: well-known link-local prefix fe80::/64 is added ->

fe80::20c:29ff:fec2:52ff

3. Phase 3: Verify the addresss uniqueness on the link, called duplicateaddress detection (DAD). Send ICMPv6.

4. Phase 4: Assigned

IPv6 to IPv4 Transition Mechanism


69/87


IPv6 to IPv4 Transition Mechanism


70/87


The 2 most common techniques to transition from IPv4 to IPv6 are asfollows:

1. Dual stack2. IPv6-over-IPv4 (6to4) tunnels

For communication between IPv4 and IPv6 networks, IPv4 addressescan be encapsulated in IPv6 addresses.

Cisco IOS Dual Stack


71/87


Dual stacking is an integration method in which a node has implementationand connectivity to both an IPv4 and IPv6 network. This is the recommendedoption and involves running IPv4 and IPv6 at the same time.

Using IPv6 on a Cisco IOS router requires that you use the global configurationcommand ipv6 unicast-routing. This command enables the forwarding ofIPv6 datagrams.

IPv6 Tunneling


72/87


Tunneling is an integration method where an IPv6 packet is encapsulated within another protocol,such as IPv4. This method enables the connection of IPv6 islands without needing to convert the

intermediary networks to IPv6. When IPv4 is used to encapsulate the IPv6 packet, a protocol type of 41 is specified in the IPv4header, and the packet includes a 20-byte IPv4 header with no options and an IPv6 header andpayload. It also requires dual-stack routers.

Tunneling presents these issues: The MTU is decreased by 20 octets (if the IPv4 header does not contain any optional field). Difficult to troubleshoot.

IPv6 Tunneling


73/87


Routing consideration with IPv6


74/87


Like IPv4 classless interdomain routing (CIDR), IPv6 uses longestprefix match routing.

IPv6 uses modified versions of most of the common routing protocolsto handle longer IPv6 addresses and different header structures.

Routing consideration with IPv6


75/87


1. The control plane handles the interaction of the router with the other networkelements, providing the information needed to make decisions and control the overallrouter operation. This plane runs processes such as routing protocols and networkmanagement. These functions are generally complex.

2. The data plane handles packet forwarding from one physical or logical interface toanother. It involves different switching mechanisms such as process switching andCisco Express Forwarding (CEF) on Cisco IOS software routers.

3. Enhanced services include advanced features applied when forwarding data, such aspacket filtering, quality of service (QoS), encryption, translation, and accounting.

RIPNg routing protocol


76/87


Based on IPv4 RIP version 2 (RIPv2) and similar to RIPv2 , distance vector, splithorizon, max hop 15, poison reverse

Uses IPv6 for transport

IPv6 prefix, next-hop IPv6 address Uses the multicast group FF02::9, the all-RIP-routers multicast group, as the destination

address for RIP updates Updates sent on UDP port 521 Is supported by Cisco IOS Release 12.2(2)T and later

Enabling IPv6 on Cisco Routers


77/87


There are two basic steps to activate IPv6 on a router. First, you must activate IPv6 traffic-forwarding on the router,

and then you must configure each interface that requires IPv6.

By default, IPv6 traffic-forwarding is disabled on a Cisco router. Toactivate it between interfaces, you must configure the global commandipv6 unicast-routing.

IPv6 Address Configuration Example


78/87


Cisco IOS IPv6 Name Resolution


79/87


Configure RIPng with IPv6


80/87


To enable RIPng routing on the router, use the ipv6 router rip nameglobalconfiguration command. The nameparameter identifies the RIP process. This process name is used later when configuring RIPng on participating interfaces.

For RIPng, instead of using the networkcommand to identify which interfaces shouldrun RIPng, you use the command ipv6 rip nameenable in interface configuration modeto enable RIPng on an interface. The nameparameter must match the nameparameterin the ipv6 router rip command.

Configure RIPng with IPv6


81/87


Troubleshooting


82/87


Troubleshooting


83/87


LAB IPv6 RIP


84/87

ipv6 unicast-routing

ipv6 router rip bkacad

interface lo0

i v6 address 2003::1/64

R1 R2S1/0S1/1F0/0

L0 L0

2004::1/64 2004::2/642003::1/64 2005::2/64

2fff::1/64 ipv6 unicast-routingipv6 router rip bkacad

ipv6 route ::/0 lo0


ipv6 rip bkacad enable

interface f0/0ipv6 address 2fff::1/64


interface s1/0

ipv6 address 2004::1/64


:: ipv6 address 2005::2/64


interface s1/1

ipv6 address 2004::2/64


ipv6 router rip bkacad

redistribute static

ipv6 install

netsh interface ipv6 add address "Local Area Connection" 2fff::2

Labs


85/87


Summary


86/87



87/87


ccna exp4 - chapter07 - ip addressing service

Documents