Route Maps and Access-Lists
Sunday, 7 June 2009
I received an email from one of the readers, Joel, who is getting confused as to how access-lists and route-maps work together. I have therefore created this topic to cover the very basics of access-lists and how they link into route-maps. In turn I have expanded the lesson on route-maps to cover a little more of the nuances of route-map theory as well as an aid to other readers.
Access-lists contain very simple logic. Lists 1-99 (standard access-lists) will permit or deny all IP traffic from a particular source whereas access-lists 101-199 (extended access-lists) extend this functionality allowing you to permit/deny with more granularity, for example, specifying both source and destination address, Layer 4 protocols and port number (i.e. TCP/UDP), and Layer 3 protocols other than IP (i.e. ICMP).
The syntax for standard access-lists is as follows:
"I wish to permit all IP traffic from host [host-ip-address]"
"I wish to permit all traffic from [subnet] [wildcard-mask]"
"I wish to deny all IP traffic from host [host-ip-address]"
"I wish to deny all traffic from [subnet] [wildcard-mask]"
An example is you want to allow all IP traffic from 192.168.1.0/24. The access-list is simple:
access-list [1-99] permit 192.168.1.0 0.0.0.255
The syntax for extended access-lists is slightly different:
"I wish to [permit/deny] [type-of-traffic] going from [source-address] [source-wildcard-mask] to [destination-address] [destination-wildcard-mask] [optional port-number]"
Let's say you would like to permit all Telnet traffic going from 192.168.1.0/24 to a device at 192.168.2.1.
Telnet uses TCP port 23 and here is how you would write the extended access-list:
"access-list [101-199] permit tcp 192.168.1.0 0.0.0.255 host 192.168.2.1 eq 23"
In English, this access-list permits TCP from 192.168.1.0/24 to the host whose address is 192.168.2.1 where the TCP port number is 23.
How to apply access-lists to route-maps
Believe me there is nothing tricky about doing this. A route-map is a way of influencing the routing decision made by a routing device. The basic syntax of a route-map is as follows:
route-map [route-map-name] [permit/deny] [sequence-number]
match [condition]
set [what-you-want-to-do-with-the-packet-if-it-matches-the-match-criteria]
As you build up your route-map you simply increase the sequence number for each match you want to do. Once you have created your route-map you must then apply it to a router interface e.g.
int fa0/0
ip policy route-map [route-map-name] [in/out]
Let's step back up to the match criteria. There are a number of things that we can match on but what we will focus on is how we can influence traffic flows through a router. We do this by using the match ip address [access-list-number] command. The extended access-list in my earlier example called for allowing Telnet traffic from 192.168.1.0/24 to be able to reach host 192.168.2.1. Let's take that example a bit further and say that we want to make all Telnet traffic going from 192.168.1.0/24 to host 192.168.2.1 which has entered my router's fa0/0 interface to leave my router's Serial0/0 interface. We could use that access-list and apply it to our route-map (I've called it MYMAP):
access-list 101 permit tcp 192.168.1.0 0.0.0.255 host 192.168.2.1 eq 23
route-map MYMAP permit 10
match ip address 101 <---this line refers to access-list 101
set interface Serial0/0
int fa0/0
ip policy route-map MYMAP in <---applies the MYMAP route-map inbound on fa0/0
How does the router service the route-map?
Actually it is very logical. The router starts at the lowest sequence number until it finds a match.
So let's run through it. A host at 192.168.1.1 tries to Telnet to 192.168.2.1 and the packet is received on fa0/0 of our router. Our router, looking at fa0/0, realises that policy-based routing is required and that it should look at the route-map named MYMAP in order to make a decision on how to forward the traffic. The router starts at the lowest sequence number in the route-map and checks the match criteria. The example above tells the router to check access-list 101. The packet received matches access-list 101 so the router returns to the route-map and checks what the set command tells it to do. The set command tells it to forward this traffic out of Serial0/0
What if there is no match found?
If there is no match then the router will route the packet based on the contents of the routing table. If a host at 192.168.3.1 tried to Telnet to 192.168.2.1 and the packet is received through fa0/0 of our router, the router will look into MYMAP, then at access-list 101, realise that access-list 101 does not match 192.168.3.1 as a source address and will return to the route-map looking for the next highest sequence number. In our example there is not another sequence number so the router will simply forward the traffic based upon the contents of its routing table (i.e. what it would do if there was no route-map applied to the fa0/0 interface).
How could we use route-maps to drop traffic?
Chris, you've just told us that if no match is found then the packet will be forwarded by the contents of the routing table so how can I influence that?
Generally, you would drop traffic on an interface using an access-list applied directly to the interface, however, it can be done using a route-map. Let's say you want to have control over all traffic coming in on fa0/0 of our router and want to drop anything that doesn't match our defined criteria. Let's say I have created access-lists 101-105 which specifies my criteria. My route-map would look as follows:
route-map MYMAP permit 10
match ip address 101 <---this line refers to access-list 101
set interface Serial0/0
route-map MYMAP permit 20
match ip address 102 <---this line refers to access-list 102
set interface Serial0/1
route-map MYMAP permit 30
match ip address 103 <---this line refers to access-list 103
set interface Serial0/2
route-map MYMAP permit 40
match ip address 104 <---this line refers to access-list 104
set interface Serial0/3
route-map MYMAP permit 50
match ip address 105 <---this line refers to access-list 105
set interface Serial0/4
Now I want to deny everything else. Remember the Null0 interface, what I like to call Packet Heaven (as that is where packets that need to be dropped/die go)? Check this route-map statement out:
route-map MYMAP permit 60
set interface Null0
Whoa Chris! What did you do there? Where has the match statement gone? The beauty is you don't need it. Sure, you could configure an access-list (e.g. access-list 106 permit ip any any) and have:
route-map MYMAP permit 60
match ip address 106
set interface Null0
But there really is no need. If the route-map evaluation has got this far we are just saying "drop everything else, send it to Packet Heaven, Null0". By removing the match statement you are in effect creating a catch-all statement. Equally, you may have wanted all traffic not matching access-lists 101-105 to be routed out of Serial0/5 rather than be routed using the routing table or dropped. Your last route-map clause would have been:
route-map MYMAP permit 60
set interface Serial0/5 <-- all traffic not previously matched will go via Serial0/5
Other Key Points About Route-Maps
1. The route map statements can also be marked with a deny. If the statement is marked as a deny, the packets meeting the match criteria are sent back through the normal forwarding channels (in other words, destination-based routing is performed). Only if the statement is marked as permit and the packets meet the match criteria are all the set clauses applied. If the statement is marked as permit and the packets do not meet the match criteria, then those packets are also forwarded through the normal routing channel.
2. There can be multiple match criteria on the same line where only ONE of the criteria has to match. There can be multiple match statements on different lines where ALL match statements must match. I think an example here is in order:
route-map MYMAP permit 10
match ip address 101 102 103 104
match ip address 105
set interface Serial0/0
The logic here works thus:
match ip address 101 OR 102 OR 103 OR 104
AND
match ip address 105
So a packet comes in and matches access-list 104, the router then goes on to check access-list 105. If the received packet also matches access-list 105 then the set command is used. If the packet had failed to match access-list 105 then the next statement in the route-map would be evaluated or the packet would be forwarded normally.
3. There are other match criteria such as packet length but I'll focus on the other set criteria.
set ip next-hop [next-hop-ip-address] - specifies where to send the packet. Preferable to use this rather than exit interface.
set default interface [interface] - If there is no entry in the routing table for the destination of this packet route it through the specified interface
set default ip next-hop [next-hop-ip-address] - if there is no entry in the routing table for the destination of this packet route it via the specified next-hop
Notice the use of the "default". This is only true if there is no corresponding entry in the routing table.
4. Like match statements, you can have multiple set statements too. Again, an example will help illustrate this.
route-map MYMAP permit 10
match ip address 101
set interface Serial0/0 Serial0/1
By default any matches to access-list 101 will exit Serial0/0 but if that fails Serial0/1 will be used as the exit interface.
Conclusion
Like everything, route-maps are easy once you understand how the syntax works. Any questions or feedback please feel free to leave comments and/or email me using the Contact Me tab at the top of the screen. Good luck to you all in your studies!
Posted byChris Bloomfield at 18:07 16 comments
Labels: access, access-lists, Cisco, extended, network, Route Summarization, route-map, route-maps, standard
Complex Route Summarization
Thursday, 17 April 2008
I've already posted about route summarization but I found this interesting technique for calculating complex route summaries at http://www.sadikhov.com/forum from member MarkinManchester. Thanks Mark!
Sometimes you are asked to filter a complex set of routes using as few lines as possible. Here we will examine a way to calculate the subnet and wildcard for such a scenario. With some practice, you should be able to calculate any set in 5 minutes or less. It is also recommend to test your results in a lab setting, using loopbacks and distribute-lists.
For example, say we are asked to filter the following routes using a one-line filter:
102.17.63.0
126.22.61.0
111.22.57.0
125.33.101.0
First, make a table as shown:
Then, enter the decimal digits from the first octet in the left-hand column. Convert each number to binary. You can use Windows Calculator set to Scientific Mode to do the conversion if you so wish.
In the binary area, first check the octet then column by column, apply the following rules:
- If the entire octet is 0, the subnet is 0 for that octet, and the mask is 255 for that octet.
- Else If the column is all 0’s, the subnet is 0, and the mask is 0
- Else If the column is all 1’s, the subnet is 1, and the mask is 0
- Else the column is a mixture of 1’s and 0’s, the subnet is 0, and the mask is 1.
For the first octet the table should look like:
Convert the binary Subnet and Wildcard Mask to decimal to complete the table:
So far, our filter looks like: 100.xxx.xxx.xxx 27.xxx.xxx.xxx
For the second octet the completed table should look like:
Our summary address now looks like: 100.0.xxx.xxx 27.55.xxx.xxx
For the third octet the completed table should look like:
Our summary address now looks like: 100.0.33.xxx 27.55.94.xxx
Now the last octet for all addresses is zero so the subnet address must be 0 in the last octet and the wilcard mask must be 255 in the last octet.
Our completed summary address looks like: 100.0.33.0 27.55.94.255
Apply this technique as you wish, for example:
access-list 1 permit 100.0.33.0 27.55.94.255
This is a great technique for reducing something complex into easier computation so hats off to Mark again for turning me on to this.
Posted byChris Bloomfield at 19:47 5 comments
Labels: complex, Route Summarization, Summarisation, summary routes, Supernetting, wildcard
Route Summarization
Friday, 23 November 2007
Some people get really confused when it comes to route summarization, probably more so with the different names given to it:
Route Summarization
Supernetting
Aggregate Address
Summary Address
Actually, I get more confused typing out this thing as being English I want to replace the z in "summarization" with an s, but as it's Cisco I best keep the z in, lol. I also get this with "neighbor" versus "neighbour".
Anyway, I digress. The above terms all mean the same thing.
What is summarization?
The process of taking a range of IP addresses and advertising them in one address block. The most well-known summarization/supernet is the RFC1918 Class B Range. More commonly we know the range to be 172.16.0.0 - 172.31.255.255, however the supernet is 172.16.0.0/12. You see what has happened there? We've taken a range of addresses and squashed it into one advertisement.
What are the benefits of summarization?
Quite clearly, if we have just one address instead of lots of individual addresses then the routing table is going to be smaller. This in turn means that memory requirements are reduced.
The less obvious benefit is that summarization means you're tracking whether or not you're connected to some subnets of a summary, not the up/down state of every link. Thus when the link goes up or down, you don't have a flurry of traffic announcing the state change.*
How to summarize/supernet?
This is what you really want to know isn't it? Well it's dead simple.
The first method shows you the long way.
1. Starting from the left of the IP address, identify the first octet that has a change of address in it. For example, the Class B RFC1918 range, the IP address first changes in the second octet (i.e. 172.16.x.x - 172.31.x.x).
2. Write out the binary equivalent of the address up to and including the changing octet. So for example the range above is:
10101100.00010000 = 172.16
10101100.00010001 = 172.17
10101100.00010010 = 172.18
10101100.00010011 = 172.19
10101100.00010100 = 172.20
10101100.00010101 = 172.21
10101100.00010110 = 172.22
10101100.00010111 = 172.23
10101100.00011000 = 172.24
10101100.00011001 = 172.25
10101100.00011010 = 172.26
10101100.00011011 = 172.27
10101100.00011100 = 172.28
10101100.00011101 = 172.29
10101100.00011110 = 172.30
10101100.00011111 = 172.31
3. From this list, count from the left how many bits are the same in each address. If we look at it we see that the first 12 bits for each address is the same so that gives us our mask in slash notation. We therefore start at our first address 172.16.0.0 and append our mask so the summary address is 172.16.0.0/12.
Well that was quite simple. But can we be quicker? Yes we can is the good news, after all, you don't want to eat up time in the exam by writing out addresses in binary. So here goes:
1. How many subnets are in the range? The RFC1918 Class B range is 16 subnets.
2. What power of 2 equals our range? 16 subnets = 24 so the answer is four.
3. Subtract the figure from step 2 from the default mask of our address range. In this example our default mask is 16 so the mask after subtracting 4 is /12.
4. Add this mask to the first address in the range - 172.16.0.0/12 in this example
Quick, eh? This is how it works in my head, "mmmm, 16 addresses, 2 to the 4 is 16, mask is 16, minus 4 is 12, so summary address must be first address with /12 mask."
One last example:
Summarise the following:
192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
There are 4 subnets. 2 to the power of 2 gives us 4 so default mask of 24, minus 2, gives us /22. Address is therefore 192.168.0.0/22.
More difficult supernetting question
There are, however, a few pitfalls with supernetting/summarization. Sometimes you may not be able to get all of the addresses into a supernet without wasting addresses. Experience with supernetting questions will help you to identify this. An example below shows you how this could happen:
You need to summarize the following range:
10.16.31.0/24
10.16.32.0/24
10.16.33.0/24
10.16.34.0/24
10.16.35.0/24
10.16.36.0/24
10.16.37.0/24
10.16.38.0/24
10.16.39.0/24
10.16.40.0/24
What summary address should you use? Well there's 10 subnets. 2 to the power of 3 only gives us 8 subnets which is too small so we need to look at 2 to the power of 4 which is 16. The problem is that if we count in 16s our addresses straddle two subnets: 10.16.16.0 to 10.16.31.255 and 10.16.32.0 to 10.16.47.255. We have the same problem if we use the power of 5 giving us a range of 32 addresses (10.16.31.0 is in a different subnet than the other addresses in the range). We therefore have to go out to 2 to the power of 6 = 64 in order to get all of our addresses in the range (i.e. 10.16.0.0 to 10.16.63.255). What a waste of address space!!
The best answer is the following:
Break the space down into three ranges. We can summarize 10.16.32.0 to 10.16.39.255 with 3 bits (i.e. there are 8 subnets and 2 to the power of 3 is 8). We simply leave the other two address as they are. We have therefore avoided any wasted address space.
If you are unsure that you have the correct answers why not download a subnet calculator to double-check your answers? There is a great one by 3Com and can be downloaded from here.
I hope this has helped you with route summarization.
Chris
*http://www.netcraftsmen.net/welcher/papers/ospf2.htm
Posted byChris Bloomfield at 09:43 80 comments
Labels: Aggregate, Route Summarization, Summarisation, Supernetting, VLSM
