EIGRP Route Filtering

Router EIGRP mengetahui semua jalur menuju ip prefix / network beserta metricnya di jaringan melalui update yang dikirimkan oleh router tetangga. Dalam kondisi tertentu kita perlu membatasi route yang dikirimkan dalam update tersebut, contohnya di router cabang A tidak perlu mengetahui semua route di router cabang B. Di EIGRP kita bisa melakukan route filtering dengan beberapa cara, diantaranya Distribute List, Administrative Distance, Route map.

Konfigurasikan routing eigrp pada R1, R2, R3. Loopback 1 - Loopback 4 di R1 tidak perlu diadvertise ke dalam eigrp.

Distribute List                                                                                                          
Sama seperti RIP, distribute list digunakan dengan access-list maupun prefix-list, distribute list yang dikonfigurasikan di router configuration digunakan untuk menentukan apakah sebuah route boleh dikirim / diterima di interface, dengan arah in maupun out.

• Access List

 kita akan coba blok Route 2.2.2.2 agar tidak dipelajari lagi oleh R1

R1#show ip route 2.2.2.2
Routing entry for 2.2.2.2/32
  Known via "eigrp 10", distance 90, metric 2297856, type internal
  Redistributing via eigrp 10
  Last update from 12.12.12.2 on Serial1/0, 00:01:40 ago
  Routing Descriptor Blocks:
  * 12.12.12.2, from 12.12.12.2, 00:01:40 ago, via Serial1/0
      Route metric is 2297856, traffic share count is 1
      Total delay is 25000 microseconds, minimum bandwidth is 1544 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1

route filtering dapat dikonfigurasikan di R2 dengan arah out maupun di R1 dengan arah in.

R1(config)#access-list 1 deny 2.2.2.2  
R1(config)#access-list 1 permit any
R1(config)#router eigrp 10
R1(config-router)#distribute-list 1 in s1/0

*Mar  1 00:35:46.771: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 10: Neighbor 12.12.12.2 (Serial1/0) is resync: route configuration changed

sekarang route 2.2.2.2 sudah tidak ada di dalam routing tabel R1

R1#show ip route 2.2.2.2
% Network not in table

• Prefix List  

Prefix-list digunakan sebagai route filtering, route di filter berdasarkan panjang net prefix nya. 

R1#show ip route eigrp
     3.0.0.0/32 is subnetted, 1 subnets
D       3.3.3.3 [90/2323456] via 12.12.12.2, 00:07:12, Serial1/0
     23.0.0.0/24 is subnetted, 1 subnets
D       23.23.23.0 [90/2195456] via 12.12.12.2, 00:07:12, Serial1/0

dengan prefix-list kita akan konfigurasikan di R2 agar network 3.3.3.3 tidak lagi ada di routing tabel R1.

R2(config)#ip prefix-list blok3333 seq 10 deny 3.3.3.3/32
R2(config)#ip prefix-list blok3333 seq 15 permit 0.0.0.0/0 le 32
R2(config)#router eigrp 10
R2(config-router)#distribute-list prefix blok3333 out s1/0

 *Mar  1 00:46:41.799: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 10: Neighbor 12.12.12.1 (Serial1/0) is resync: route configuration changed

sekarang cek di R1 masihkah network 3.3.3.3 ada di routing tabelnya

R1#show ip route 3.3.3.3
% Network not in table

 
Administrative Distance                                                                                          

mengganti nilai AD bisa digunakan untuk keperluan path influence, bisa juga menghilangkan sebuah route dengan mengeset nilai AD menjadi 255

R3#show ip route eigrp
     1.0.0.0/32 is subnetted, 1 subnets
D       1.1.1.1 [90/2323456] via 23.23.23.2, 00:47:40, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
D       2.2.2.2 [90/409600] via 23.23.23.2, 00:42:14, FastEthernet0/0
     12.0.0.0/24 is subnetted, 1 subnets
D       12.12.12.0 [90/2195456] via 23.23.23.2, 00:47:40, FastEthernet0/0

hapus network 1.1.1.1 dari routing tabel R3

R3(config)#access-list 10 permit 1.1.1.1
R3(config)#router eigrp 10
R3(config-router)#distance 255 0.0.0.0 255.255.255.255 10

verifikasi pada routing tabel R3

R3#show ip route 1.1.1.1
% Network not in table

Route Map                                                                                                                 

Route map banyak digunakan untuk modifikasi routing update, selain itu juga digunakan pada redistribution dari dan ke berbagai routing protokol. Route map ini bisa  dikonfigurasikan dengan access-list dan prefix-list untuk keperluan matching route. tapi route map sendiri lebih flexible digunakan dibandingan dengan acl, ketentuan-ketentuan yang dikonfigurasikan pada route map di eksekusi berdasarkan nomor  urutan, jadi lebih mudah ketika kita akan menambahkan rule baru. selain itu route map bisa memverifikasi sebuah route berdasarkan jenis route internal / external dan memiliki route tagging.

misal loopback 1 - loopback 4 R1 di advertise ke ospf, kemudian di redistribute ke dalam eigrp dengan route map.

R1#show run | section ospf
router ospf 1
 log-adjacency-changes
 network 10.0.1.0 0.0.0.255 area 0
 network 10.0.2.0 0.0.0.255 area 0
 network 10.0.3.0 0.0.0.255 area 0
 network 10.0.4.0 0.0.0.255 area 0

R1(config)#router eigrp 10
R1(config-router)#redistribute ospf 1 route-map ospfeigrp
R1(config-router)#default-metric 10000 1000 255 1 1500

rulenya seperti ini :
- network 10.0.1.0/24 dan 10.0.2.0/24 tidak boleh diredistribute ke dalam eigrp
- network 10.0.3.0/24 dan 10.0.4.0/24 diredistribute dan ditandai

R1(config)#route-map ospfeigrp deny 1
bisa dikombinasikan dengan acl maupun prefix-list, konfigurasi prefix-list noeigrp ada dibawah
R1(config-route-map)#match ip address prefix-list noeigrp
R1(config)#route-map ospfeigrp permit 10
R1(config-route-map)#set tag 11

R1(config)#ip prefix-list noeigrp seq 10 permit 10.0.1.0/24
R1(config)#ip prefix-list noeigrp seq 11 permit 10.0.2.0/24

verifikasi

R2#show ip route eigrp
     1.0.0.0/32 is subnetted, 1 subnets
D       1.1.1.1 [90/2297856] via 12.12.12.1, 03:57:19, Serial1/0
     3.0.0.0/32 is subnetted, 1 subnets
D       3.3.3.3 [90/409600] via 23.23.23.3, 01:51:53, FastEthernet0/0
     10.0.0.0/24 is subnetted, 2 subnets
D EX    10.0.3.0 [170/2425856] via 12.12.12.1, 00:04:57, Serial1/0
D EX    10.0.4.0 [170/2425856] via 12.12.12.1, 00:04:57, Serial1/0

R3#show ip route eigrp
     2.0.0.0/32 is subnetted, 1 subnets
D       2.2.2.2 [90/409600] via 23.23.23.2, 01:53:05, FastEthernet0/0
     10.0.0.0/24 is subnetted, 2 subnets
D EX    10.0.3.0 [170/2451456] via 23.23.23.2, 00:06:09, FastEthernet0/0
D EX    10.0.4.0 [170/2451456] via 23.23.23.2, 00:06:09, FastEthernet0/0
     12.0.0.0/24 is subnetted, 1 subnets
D       12.12.12.0 [90/2195456] via 23.23.23.2, 01:53:05, FastEthernet0/0

belum berhenti disini, sekarang kita blok route 10.0.3.0/24 dan 10.0.4.0/24 agar tidak di install lagi di routing tabel R3. route tersebut ditandai sebagai eigrp external, jadi perlu menggunakan distribute-list dengan route-map untuk memfilter route tersebut.

R3(config)#router eigrp 10
R3(config-router)#distribute-list route-map nor3 in f0/0
R3(config)#route-map nor3 deny 10
R3(config-route-map)#match tag 11
R3(config)#route-map nor3 permit 20

verifikasi route yang ada dirouting tabel R3

R3#show ip route eigrp
     2.0.0.0/32 is subnetted, 1 subnets
D       2.2.2.2 [90/409600] via 23.23.23.2, 00:00:24, FastEthernet0/0
     12.0.0.0/24 is subnetted, 1 subnets
D       12.12.12.0 [90/2195456] via 23.23.23.2, 00:00:24, FastEthernet0/0

Read more

Perhitungan EIGRP Metric

Seperti yang kita tahu EIGRP memiliki 3 tabel, yaitu neighbor, topology , dan ip routing. tabel neighbor digunakan untuk menyimpan informasi router eigrp lain, sedangkan topology tabel digunakan untuk menyimpan informasi route network secara keseluruhan yang didapat dari update eigrp router lain, dari informasi tabel topologi ini router menghitung jalur terbaik dan menyimpannya di tabel ip routing.

Terus bagaimana EIGRP memilih jalur terbaiknya ?

EIGRP Metric = 256 * [(K1*Bw) + (K2*Bw) / (256-Load) + K3*Delay] * (K5 / (Reliability + K4))

K disini adalah konstanta yang nilainya 0 - 255. fungsinya hanya sebagai pengali dalam perhitungan metric EIGRP.
default nilai K adalah : K1=1, K2=0, K3=1, K4=0, K5=0.
bisa dirubah dengan subcommand metric weights tos k1 k2 k3 k4 k5 , yang perlu diingat adalah nilai type of service (tos) harus 0 dan nilai K yang dikonfigurasikan harus sama di kedua Router.

apabila kita gunakan nilai K defaultnya, maka perhitungan metric-nya bisa jadi lebih sederhana :

EIGRP Metric = 256 * (Bw + Delay) 

dimana :
Bw = (10^7 / bandwidth terkecil sepanjang route Kbps) ,
Delay =  total delay sepanjang route dibagi 10 dalam microsecond.

Contoh:                                                                                                                          

R1 dan R2 terhubung menggunakan fastEthernet, R1 memiliki Loopback 1.1.1.1/32, Routing protokol EIGRP dikonfigurasikan diantara R1 dan R2 dan semua networknya diadvertise kedalamnya.

informasi yang ada di routing tabel R2

R2#show ip route     
Gateway of last resort is not set

     1.0.0.0/32 is subnetted, 1 subnets
D       1.1.1.1 [90/409600] via 12.12.12.1, 00:29:59, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
C       2.2.2.2 is directly connected, Loopback0a
     12.0.0.0/24 is subnetted, 1 subnets
C       12.12.12.0 is directly connected, FastEthernet0/0

Route 1.1.1.1 memiliki metric 409600, kita lihat bagaimana router menghitung metricnya dengan nilai K default

EIGRP Metric = 256 * (Bw + Delay) 

Route 1.1.1.1 tersebut adalah milik interface lo0 R1, didapat melalui f0/0 R1.

• bandwidth dan delay lo0

R1#show int lo0
 MTU 1514 bytes, BW 8000000 Kbit, DLY 5000 usec,
    reliability 255/255, txload 1/255, rxload 1/255 

• bandwidth dan delay f0/0

R1#show int f0/0
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255

Bandwidth yang digunakan dalam perhitungan adalah bandwidth minimum, 10000 Kbit. sedangkan Delay merupakan akumulasi / end-to-end delay, berarti 6000 usec (5000+1000).

Kita buktikan di tabe topologi R2.

R2#show ip eigrp top 1.1.1.1/32
IP-EIGRP (AS 10): Topology entry for 1.1.1.1/32
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 409600
  Routing Descriptor Blocks:
  12.12.12.1 (FastEthernet0/0), from 12.12.12.1, Send flag is 0x0
      Composite metric is (409600/128256), Route is Internal
      Vector metric:
        Minimum bandwidth is 10000 Kbit
        Total delay is 6000 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1

Perhitungan Metric                                                                                                   
EIGRP Metric  = 256 * (10^7/bw min + Delay/10 ) 
                         = 256 * (10^7/10000 + 600 ) 
                         = 409600


Oke, persis dengan metric yang dihitung oleh router.
 

Read more

Mengatasi kesalahan memory di GNS3

GNS3 sudah menjadi teman sehari-hari, software simulasi ini yang tiap hari tok pake untuk ngelab. IOS yang biasa saya pake adalah 2691.
saat digunakan untuk ngelab NAT tadi, ketemu error pas saya konfigurasikan nat di interface-nya.

R1(config-if)#ip nat outside
% NBAR Error : Activation failed due to insufficient dynamic memory
% NBAR Error: Stile could not add protocol node 
%NAT: Error activating CNBAR on the interface FastEthernet1/0
R1(config-if)#
*Mar  1 00:20:55.491: %SYS-2-MALLOCFAIL: Memory allocation of 135188 bytes failed from 0x62983C38, alignment 0
Pool: Processor  Free: 150440  Cause: Memory fragmentation
Alternate Pool: None  Free: 0  Cause: No Alternate pool
 -Process= "Exec", ipl= 0, pid= 3,  -Traceback= 0x61520C14 0x60015CEC 0x6001BAE8 0x6001C0DC 0x6356F3EC 0x62983C40 0x6298602C 0x62986628 0x62960A20 0x62961584 0x62961A18 0x62962268 0x629624E0 0x62996F74 0x629A16C4 0x6298E98C
*Mar  1 00:20:55.495: %NBAR-2-NOMEMORY: No memory available for StILE lmalloc,  -Traceback= 0x61520C14 0x62983C5C 0x6298602C 0x62986628 0x62960A20 0x62961584 0x62961A18 0x62962268 0x629624E0 0x62996F74 0x629A16C4 0x6298E98C 0x629ABAB8 0x629ABE38 0x61CFAB74 0x61CFD25C
*Mar  1 00:20:55.535: %SYS-2-CHUNKEXPANDFAIL: Could not expand chunk pool for regex. No memory available -Process= "Chunk Manager", ipl= 3, pid= 1,  -Traceback= 0x61520C14 0x60027418R1(config-if)#ip nat outside
% NBAR Error : Activation failed due to insufficient dynamic memory
% NBAR Error: Stile could not add protocol node 
%NAT: Error activating CNBAR on the interface FastEthernet1/0
R1(config-if)#
*Mar  1 00:20:55.491: %SYS-2-MALLOCFAIL: Memory allocation of 135188 bytes failed from 0x62983C38, alignment 0
Pool: Processor  Free: 150440  Cause: Memory fragmentation
Alternate Pool: None  Free: 0  Cause: No Alternate pool
 -Process= "Exec", ipl= 0, pid= 3,  -Traceback= 0x61520C14 0x60015CEC 0x6001BAE8 0x6001C0DC 0x6356F3EC 0x62983C40 0x6298602C 0x62986628 0x62960A20 0x62961584 0x62961A18 0x62962268 0x629624E0 0x62996F74 0x629A16C4 0x6298E98C
*Mar  1 00:20:55.495: %NBAR-2-NOMEMORY: No memory available for StILE lmalloc,  -Traceback= 0x61520C14 0x62983C5C 0x6298602C 0x62986628  0x62961584 0x62961A18 0x62962268 0x629624E0 0x62996F74 0x629A16C4 0x6298E98C 0x629ABAB8 0x629ABE38 0x61CFAB74 0x61CFD25C
*Mar  1 00:20:55.535: %SYS-2-CHUNKEXPANDFAIL: Could not expand chunk pool for regex. No memory available -Process= "Chunk Manager", ipl= 3, pid= 1,  -Traceback= 0x61520C14 0x60027418

dari pesan error tersebut kira-kira ni problemnya adalah memory-nya kurang. saya coba googling trus ketemu problem solvingnya disini.

jadi penyelesaiannya adalah kita edit file .net topologi yang kita simpan. contoh lab tadi saya simpan dengan nama rip default route, di Ubuntu saya default penyimpanan gns3 ada di /root/.gns3.

root@userq:/home/ayub# cd /root/.gns3
root@userq:~/.gns3# ls
gns3.ini              rip default route.net
ripdefaultroute.gns3  rip default route.net~
root@userq:~/.gns3# gedit rip\ default\ route.net

kemudian tambahkan baris ram seperti berikut ini

[127.0.0.1:7200]
    workingdir = /tmp
    udp = 10000
    [[2691]]
        image = /media/ayub/4E26440B5A14832C/C2691-AD.BIN
        ram = 256
        sparsemem = True
        ghostios = True 

oke saya coba konfig-kan lagi dan ternyata masalah memory error tadi sudah tidak ada

Read more

RIP Default Route Redistribution

Default route / Gateway of last resort digunakan untuk mengarahkan paket yang bertujuan ke network yang tidak ada di routing tabel. biasanya digunakan bersama nat agar user lokal dapat mengakses ke jaringan internet.
ada 3 cara untuk mendistribusikan default route ke dalam RIP , Default-information-origiante, redistribute static default route, dan ip default-network.

skenario lab ini R1 terhubung ke jaringan internet.
baca disini cara menghubungkan gns3 ke internet.
kemudian konfigurasikan dynamic nat Overload pada R1.
Saat mengkonfigurasikan ip nat pada router mungkin anda akan mengalami error memory seperti yang saya alami, lihat disini untuk solusinya.
konfigurasikan ip domain-lookup dan ip name-server 8.8.8.8 pada semua router.


1. Default-information originate

secara otomatis default-information originate akan mengadvertise semua default route ke dalam RIP.

R1(config-router)#do show run | begin rip        
router rip
 version 2
 network 12.0.0.0
 network 13.0.0.0
 no auto-summary
!

tambahkan subcommand default-information originate pada konfigurasi router rip

R1(config)#router rip
R1(config-router)#default-information originate

cek di routing tabel R2 dan R3, secara otomatis default route akan di kirimkan ke semua router rip

R2#show ip route
Gateway of last resort is 12.12.12.1 to network 0.0.0.0

     23.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       23.23.23.0/24 is directly connected, FastEthernet0/1
R       23.0.0.0/8 [120/2] via 12.12.12.1, 00:00:18, FastEthernet0/0
     12.0.0.0/24 is subnetted, 1 subnets
C       12.12.12.0 is directly connected, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
R       13.13.13.0 [120/1] via 12.12.12.1, 00:00:18, FastEthernet0/0
R*   0.0.0.0/0 [120/1] via 12.12.12.1, 00:00:11, FastEthernet0/0


R3#show ip route
Gateway of last resort is 13.13.13.1 to network 0.0.0.0

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
R       12.12.12.0 [120/1] via 13.13.13.1, 00:00:08, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
C       13.13.13.0 is directly connected, FastEthernet0/0
R*   0.0.0.0/0 [120/1] via 13.13.13.1, 00:00:08, FastEthernet0/0

R2(config)#do ping google.com   

Translating "google.com"...domain server (8.8.8.8) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 173.194.126.33, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 116/136/152 ms

R3#ping google.com

Translating "google.com"...domain server (8.8.8.8) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 173.194.126.32, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 160/178/200 ms

2. Redistribute Static

default route konfigurasinya menggunakan routing static dengan destination address dan masknya diset 0.0.0.0 yang artinya routing dengan network tujuan manapun dengan netmask berapapun. konfigurasi default route menggunakan static default route ini secara otomatis hanya mengatur gateway of last resort Router tersebut saja. oleh karena itu perlu di redistribute ke dalam RIP agar bisa diadvertise ke semua router rip.

R1(config-router)#no default-information originate

lihat  routing tabel R2, R3 dan pastikan default route sudah tidak ada

R2#show ip route
Gateway of last resort is not set

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
C       12.12.12.0 is directly connected, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
R       13.13.13.0 [120/1] via 23.23.23.3, 00:00:19, FastEthernet0/1
                   [120/1] via 12.12.12.1, 00:00:11, FastEthernet0/0

R3#show ip route
Gateway of last resort is not set

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
R       12.12.12.0 [120/1] via 23.23.23.2, 00:00:13, FastEthernet0/1
                   [120/1] via 13.13.13.1, 00:00:09, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
C       13.13.13.0 is directly connected, FastEthernet0/0

pertama perlu dikonfigurasikan dulu default routenya pada R1. kemudian redistribute ke RIP.

R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.42.129 
R1(config-router)#redistribute static

R2#show ip route
Gateway of last resort is 12.12.12.1 to network 0.0.0.0

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
C       12.12.12.0 is directly connected, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
R       13.13.13.0 [120/1] via 23.23.23.3, 00:00:21, FastEthernet0/1
                   [120/1] via 12.12.12.1, 00:00:15, FastEthernet0/0
R*   0.0.0.0/0 [120/1] via 12.12.12.1, 00:00:15, FastEthernet0/0

R3#show ip route
Gateway of last resort is 13.13.13.1 to network 0.0.0.0

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
R       12.12.12.0 [120/1] via 23.23.23.2, 00:00:02, FastEthernet0/1
                   [120/1] via 13.13.13.1, 00:00:01, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
C       13.13.13.0 is directly connected, FastEthernet0/0
R*   0.0.0.0/0 [120/1] via 13.13.13.1, 00:00:01, FastEthernet0/0

R2#ping sfprimary.com

Translating "sfprimary.com"...domain server (8.8.8.8) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.31.186.20, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 300/313/360 ms

R3#ping sfprimary.com

Translating "sfprimary.com"...domain server (8.8.8.8) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.31.186.20, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 288/493/1084 ms

3. ip default-network

jika ip default-gateway digunakan di router yang ip routingnya didisabled. ip default-network digunakan pada router yang aktif melakukan routing seperti R1 dan secara otomatis gateway yang dikonfigurasikan akan di advertise ke RIP. network yang dikonfigurasikan sebagai gateway of last resort di ip default-network haruslah classful network.
pertama hapus dulu default routing dan redistribute static pada R1.

R1(config)#ip default-network 192.168.42.0

R2#show ip route
Gateway of last resort is 12.12.12.1 to network 0.0.0.0

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
C       12.12.12.0 is directly connected, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
R       13.13.13.0 [120/1] via 23.23.23.3, 00:00:18, FastEthernet0/1
                   [120/1] via 12.12.12.1, 00:00:07, FastEthernet0/0
R*   0.0.0.0/0 [120/1] via 12.12.12.1, 00:00:07, FastEthernet0/0


R3#show ip route
Gateway of last resort is 13.13.13.1 to network 0.0.0.0

     23.0.0.0/24 is subnetted, 1 subnets
C       23.23.23.0 is directly connected, FastEthernet0/1
     12.0.0.0/24 is subnetted, 1 subnets
R       12.12.12.0 [120/1] via 23.23.23.2, 00:00:16, FastEthernet0/1
                   [120/1] via 13.13.13.1, 00:00:14, FastEthernet0/0
     13.0.0.0/24 is subnetted, 1 subnets
C       13.13.13.0 is directly connected, FastEthernet0/0
R*   0.0.0.0/0 [120/1] via 13.13.13.1, 00:00:14, FastEthernet0/0

Read more

RIP Route Filtering

untuk memfilter route pada RIP ada beberapa cara yang bisa digunakan, pertama menggunakan Distribute List, kedua menggunakan Administrative Distance dan Terakhir menggunakan Offset List

Pertama konfig semua Interface pada R1, R2, dan R3.
kemudian konfigurasikan RIP

R1,R2,R3(config-if)#router rip
R1,R2,R3(config-router)#v 2
R1,R2,R3(config-router)#network 0.0.0.0
R1,R2,R3(config-router)#no auto-summary

kemudian pastikan routing tabelnya lengkap.


1. Distribute List

digunakan untuk memfilter route mana yang akan diadvertise dan yang akan diproses oleh router, bisa diterapkan jalur inbound dan outbound.
distribute list bisa digunakan dengan access-list maupun prefix-list.

Access-list                                                                                                               
R1 dalam routing tabelnya tentu memiliki semua route dari R3.

 R1#show ip route rip
     20.0.0.0/16 is subnetted, 4 subnets
R       20.4.0.0 [120/2] via 12.12.12.2, 00:00:11, FastEthernet0/0
R       20.1.0.0 [120/2] via 12.12.12.2, 00:00:11, FastEthernet0/0
R       20.2.0.0 [120/2] via 12.12.12.2, 00:00:11, FastEthernet0/0
R       20.3.0.0 [120/2] via 12.12.12.2, 00:00:11, FastEthernet0/0
     23.0.0.0/24 is subnetted, 1 subnets
R       23.23.23.0 [120/1] via 12.12.12.2, 00:00:11, FastEthernet0/0

Sekarang filter pada R2 menggunakan access-list agar yang masuk ke R3 adalah route yang oktet ke-2 nya genap.

biar commandnya cukup satu baris, permit saja oktet genapnya
R2(config)#access-list 1 permit 20.0.0.0 0.254.255.255
distribute-list bisa dikonfigurasikan saat masuk interface maupun keluar, karena yang perlu diblok adalah yang masuk R3 maka dikonfigurasikan di f0/0 arah out.
R2(config)#router rip
R2(config-router)#distribute-list 1 out f0/0 

 R1#show ip route rip
     20.0.0.0/16 is subnetted, 2 subnets
R       20.4.0.0 [120/2] via 12.12.12.2, 00:00:12, FastEthernet0/0
R       20.2.0.0 [120/2] via 12.12.12.2, 00:00:12, FastEthernet0/0

Prefix-list                                                                                                                     
Prefix list merupakan route filter yang digunakan untuk memfilter route berdasarkan panjang prefix. berbeda dengan access-list, prefix-list tidak bisa digunakan untuk memfilter route genap/ganjil saja. namun prefix list digunakan untuk memilih route yang berurutan dari prefix sekian sampai prefix sekian yang bisa kita tentukan.
contohnya :

Router(config)#ip prefix-list contoh1 permit 123.0.0.0/8 ge 24 le 32
prefix list akan mencocokan route dengan 8 bit / oktet pertama 123.x.x.x dengan subnet mask 255.255.255.0 sampai 255.255.255.255

R3 pasti memiliki semua route dari R1

R3#show ip route rip
     1.0.0.0/32 is subnetted, 1 subnets
R       1.1.1.1 [120/2] via 23.23.23.2, 00:00:05, FastEthernet0/0
     10.0.0.0/16 is subnetted, 2 subnets
R       10.2.0.0 [120/2] via 23.23.23.2, 00:00:05, FastEthernet0/0
R       10.1.0.0 [120/2] via 23.23.23.2, 00:00:05, FastEthernet0/0
     11.0.0.0/16 is subnetted, 2 subnets
R       11.2.0.0 [120/2] via 23.23.23.2, 00:00:05, FastEthernet0/0
R       11.1.0.0 [120/2] via 23.23.23.2, 00:00:05, FastEthernet0/0
     12.0.0.0/24 is subnetted, 1 subnets
R       12.12.12.0 [120/1] via 23.23.23.2, 00:00:05, FastEthernet0/0

Blok ruote 10.x.0.0/16 dan 11.x.0.0/16 dari R1 pada R2 agar nantinya route tersebut hilang dari routing tabel R3.

prefix list dieksekusi berdasarkan nomor sequence-nya. seq 5 melakukan fungsi seperti access list permit ip any any.
R2(config)#ip prefix-list blokr1 seq 1 deny 10.0.0.0/8 le 16
R2(config)#ip prefix-list blokr1 seq 2 deny 11.0.0.0/8 le 16
R2(config)#ip prefix-list blokr1 seq 5 permit 0.0.0.0/0 le 32 
R2(config-router)#distribute-list prefix blokr1 out f0/1

R3#show ip route 10.0.0.0 longer-prefixes | begin Gate  
Gateway of last resort is not set

R3#show ip route 11.0.0.0 longer-prefixes | begin Gate
Gateway of last resort is not set

R3#show ip route rip                                 
     1.0.0.0/32 is subnetted, 1 subnets
R       1.1.1.1 [120/2] via 23.23.23.2, 00:00:02, FastEthernet0/0
     12.0.0.0/24 is subnetted, 1 subnets
R       12.12.12.0 [120/1] via 23.23.23.2, 00:00:02, FastEthernet0/0

2. Administrative Distance

sebuah route bisa difilter dengan cara administrative distance nya dimanipulasi menjadi sangat besar.

R2#show ip route 1.1.1.1
Routing entry for 1.1.1.1/32
  Known via "rip", distance 120, metric 1
  Redistributing via rip
  Last update from 12.12.12.1 on FastEthernet0/0, 00:00:05 ago
  Routing Descriptor Blocks:
  * 12.12.12.1, from 12.12.12.1, 00:00:05 ago, via FastEthernet0/0
      Route metric is 1, traffic share count is 1

dengan membuat nilai AD menjadi 255 kita akan buat agar route tersebut dibuang di routing tabel R2

R2(config-router)#distance 255 0.0.0.0 255.255.255.255 2
R2#show ip route 1.1.1.1
% Network not in table

3. Offset List

dengan offset list ini metric dari sebuah route bisa dimanipulasi, jika pada rip maka sebuah route bisa dibuang dari routing tabel dengan hop countnya dibuat menjadi 16 inaccessible. Offset list hanya bisa digunakan pada distance vektor routing protokol, RIP dan EIGRP. RIP hanya bertukar informasi routing dengan directly connected router, namun darimana tetangganya mendapatkan route tersebut router tersebut tidak tahu oleh karena itu RIP sering disebut "routing by rumour"

R1#show ip route 20.2.0 metric, of a.1
Routing entry for 20.2.0.0/16
  Known via "rip", distance 120, metric 2
  Redistributing via rip
  Last update from 12.12.12.2 on FastEthernet0/0, 00:00:22 ago
  Routing Descriptor Blocks:
  * 12.12.12.2, from 12.12.12.2, 00:00:22 ago, via FastEthernet0/0
      Route metric is 2, traffic share count is 1

offset list dikonfigurasikan inbound, untuk memfilter route yang router terima.
R1(config-router)#offset-list 3 in 16 f0/0

Read more

RIP Split Horizon di Frame Relay

Split Horizon merupakan fitur distance vektor routing protokol yaitu RIP dan EIGRP yang digunakan untuk mencegah terjadinya routing loop dengan tidak memperbolehkan sebuah route diadvertise ke interface route tersebut berasal.
Split Horizon menjadi masalah pada jaringan frame relay khususnya frame relay hub and spoke yang menggunakan sub-interface, karena pada serial physical interface ip split horizon defaultnya adalah disabled sementara pada sub-interface enabled.

R2(config)#interface s1/0
R2(config-if)#encapsulation frame-relay
R2(config-if)#ip add 10.10.10.2 255.255.255.0
R2(config-if)#frame-relay map ip 10.10.10.1 201 broadcast
R2(config-if)#frame-relay map ip 10.10.10.3 201         
R2(config-if)#no shut
R2(config-if)#interface lo0
R2(config-if)#ip add 2.2.2.2 255.255.255.255
R2(config-if)#router rip
R2(config-router)#v 2
R2(config-router)#network 0.0.0.0
R2(config-router)#no auto-summary


R3(config)#interface s1/0
R3(config-if)#encapsulation frame-relay 
R3(config-if)#ip add 10.10.10.3 255.255.255.0
R3(config-if)#frame-relay map ip 10.10.10.1 301 broadcast
R3(config-if)#frame-relay map ip 10.10.10.2 301
R3(config-if)#no shut
R3(config-if)#interface lo0
R3(config-if)#ip add 3.3.3.3 255.255.255.255
R3(config-if)#router rip
R3(config-router)#v 2
R3(config-router)#network 0.0.0.0
R3(config-router)#no auto-summary

R1(config)#interface s1/0
R1(config-if)#encapsulation frame-relay
R1(config-if)#no shut   
R1(config)#interface s1/0.1 multipoint
R1(config-subif)#ip add 10.10.10.1 255.255.255.0
R1(config-subif)#frame-relay map ip 10.10.10.2 102 broadcast
R1(config-subif)#frame-relay map ip 10.10.10.3 103 broadcast 
R1(config)#router rip
R1(config-router)#v 2     
R1(config-router)#network 0.0.0.0
R1(config-router)#no auto-summary

pada routing tabel R2 hanya ada RIP dari loopback R1
R2#show ip route

R    1.0.0.0/8 [120/1] via 10.10.10.1, 00:00:25, Serial1/0
     2.0.0.0/32 is subnetted, 1 subnets
C       2.2.2.2 is directly connected, Loopback0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.10.10.0 is directly connected, Serial1/0

informasi routing di R1 lengkap, namun R1 tidak akan mengirimkan update dari R2 ke R3 melalui s1/0.1 maupun sebaliknya.
R1#show ip route

     1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
R       1.0.0.0/8 [120/1] via 10.10.10.3, 00:00:23, Serial1/0.1
                  [120/1] via 10.10.10.2, 00:00:07, Serial1/0.1
R    2.0.0.0/8 [120/1] via 10.10.10.2, 00:00:07, Serial1/0.1
R    3.0.0.0/8 [120/1] via 10.10.10.3, 00:00:23, Serial1/0.1
     10.0.0.0/24 is subnetted, 1 subnets
C       10.10.10.0 is directly connected, Serial1/0.1

R1#show ip interface s1/0.1
Serial1/0.1 is up, line protocol is up
  Internet address is 10.10.10.1/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Multicast reserved groups joined: 224.0.0.9
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is enabled
  IP Flow switching is disabled
  IP CEF switching is enabled
  IP CEF Fast switching turbo vector
  IP multicast fast switching is enabled
 --More--  

R1(config)#interface s1/0.1
R1(config-subif)#no ip split-horizon  

cek ladi di routing tabel R2 dan R3. Pastikan bisa ping ke loopback masing-masing.

R2#show ip route

     1.0.0.0/32 is subnetted, 1 subnets
R       1.1.1.1 [120/1] via 10.10.10.1, 00:00:27, Serial1/0
     2.0.0.0/32 is subnetted, 1 subnets
C       2.2.2.2 is directly connected, Loopback0
     3.0.0.0/32 is subnetted, 1 subnets
R       3.3.3.3 [120/2] via 10.10.10.3, 00:00:27, Serial1/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.10.10.0 is directly connected, Serial1/0

R2#ping 3.3.3.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/24/44 ms

Read more

RIP Authentication

RIP memiliki dua mode authentikasi untuk routing updatenya, clear text dan MD5. perbedaanya adalah mode clear text Router tidak menyembunyikan passwordnya sedangkan MD5 Router mengirimkan message diggest keyed sehingga apabila dijaringan ada yang mencapture trafik maka password tidak akan terlihat.

pertama buat key chain , key id dan key string di kedua sisi harus sama, begitu juga dengan mode authentikasinya. kemudian apply key chain ke interface.

R1(config)#key chain sfprimary
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string cisco
R1(config)#interface f0/0
R1(config-if)#ip add 12.12.12.1 255.255.255.0
R1(config-if)#ip rip authentication mode text
R1(config-if)#ip rip authentication key-chain sfprimary
R1(config-if)#no shut
R1(config-if)#interface lo0
R1(config-if)#ip add 1.1.1.1 255.255.255.255
R1(config-keychain-key)#router rip
R1(config-router)#v 2           
R1(config-router)#network 0.0.0.0

R2(config)#key chain sfprimary
R2(config-keychain)#key 1
R2(config-keychain-key)#key-string cisco
R2(config)#interface f0/0
R2(config-if)#ip add 12.12.12.2 255.255.255.0
R2(config-if)#ip rip authentication mode text
R2(config-if)#ip rip authentication key-chain sfprimary
R2(config-if)#no shut
link ke R3 menggunakan autentikasi MD5
R2(config-if)#interface f0/1
R2(config-if)#ip add 23.23.23.2 255.255.255.0
R2(config-if)#ip rip authentication mode md5
R2(config-if)#ip rip authentication key-chain sfprimary
R2(config-if)#no shut
R2(config-if)#interface lo0
R2(config-if)#ip add 2.2.2.2 255.255.255.255
R2(config-if)#router rip
R2(config-router)#v 2
R2(config-router)#network 0.0.0.0 


R3 menggunakan key id berbeda, sebenarnya key id bisa saja berbeda. namun aturanya key id yang lebih kecil tidak dapat menerima update dari key id yang lebih besar sementara key id yang besar bisa menerima update dari id kecil
R3(config)#key chain sfprimary
R3(config-keychain)#key 2
R3(config-keychain-key)#key-string cisco
R3(config-keychain-key)#interface f0/0
R3(config-if)#ip add 23.23.23.3 255.255.255.0
R3(config-if)#ip rip authentication mode md5
R3(config-if)#ip rip authentication key-chain sfprimary
R3(config-if)#no shut    
R3(config-if)#interface lo0
R3(config-if)#ip add 3.3.3.3 255.255.255.255
R3(config-if)#router rip
R3(config-router)#v 2
R3(config-router)#network 0.0.0.0

Gunakan command show ip protocol untuk melihat pada interface mana saja key chain di aplikasikan dan key chainya.

 R2#show ip protocol
Routing Protocol is "rip"
    Sending updates every 30 seconds, next due in 26 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Redistributing: rip
  Default version control: send version 2, receive version 2
    Interface             Send  Recv  Triggered RIP  Key-chain
    FastEthernet0/0       2     2           sfprimary      
    FastEthernet0/1       2     2          sfprimary      
    Loopback0             2     2                                   
 

R2#debug ip rip
RIP protocol debugging is on
R2#
*Mar  1 00:47:41.335: RIP: sending v2 update to 224.0.0.9 via FastEthernet0/0 (12.12.12.2)
*Mar  1 00:47:41.335: RIP: build update entries
*Mar  1 00:47:41.335:     2.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:41.339:     23.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:45.391: RIP: sending v2 update to 224.0.0.9 via Loopback0 (2.2.2.2)
*Mar  1 00:47:45.391: RIP: build update entries
*Mar  1 00:47:45.391:     1.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:45.391:     12.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:45.391:     23.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:50.523: RIP: received packet with text authentication cisco
*Mar  1 00:47:50.523: RIP: received v2 update from 12.12.12.1 on FastEthernet0/0
*Mar  1 00:47:50.527:      1.0.0.0/8 via 0.0.0.0 in 1 hops
*Mar  1 00:47:50.563: RIP: sending v2 update to 224.0.0.9 via FastEthernet0/1 (23.23.23.2)
*Mar  1 00:47:50.563: RIP: build update entries
*Mar  1 00:47:50.563:     1.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:50.567:     2.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:50.567:     12.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:47:54.671: RIP: received packet with MD5 authentication
R2 memiliki key id 1 sedangkan R3 Memiliki key id 2, jadi R2 tidak akan mengabaikan route yang diterima dari R3
*Mar  1 00:47:54.671: RIP: ignored v2 packet from 23.23.23.3 (invalid authentication)

R3#debug ip rip
RIP protocol debugging is on
R3#
*Mar  1 00:51:10.147: RIP: sending v2 update to 224.0.0.9 via FastEthernet0/0 (23.23.23.3)
*Mar  1 00:51:10.147: RIP: build update entries
*Mar  1 00:51:10.151:     3.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:51:29.007: RIP: sending v2 update to 224.0.0.9 via Loopback0 (3.3.3.3)
*Mar  1 00:51:29.007: RIP: build update entries
*Mar  1 00:51:29.007:     1.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:51:29.011:     2.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:51:29.011:     12.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:51:29.011:     23.0.0.0/8 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:51:29.019: RIP: ignored v2 packet from 3.3.3.3 (sourced from one of our addresses)
*Mar  1 00:51:30.259: RIP: received packet with MD5 authentication
*Mar  1 00:51:30.259: RIP: received v2 update from 23.23.23.2 on FastEthernet0/0
 

Read more