1 Accessing the WAN Chapter 7
2 Objectives 2 Configure DHCP in an Enterprise branch network. DHCP features and benefits Differences between BOOTP and DHCP DHCP operation: and configuring, verifying, and troubleshooting DHCP. Configure NAT on a Cisco router. Key features and operation of NAT and NAT Overload Advantages and disadvantages of NAT Configuring i NAT and NAT Overload to conserve IP address space in a network Configuring port forwarding, and verifying and troubleshooting NAT configurations. Configure new generation RIP (RIPng) to use IPv6. How IPv6 solves any problem of IP address depletion How to assign IPv6 addresses, describing transition i strategies for implementing IPv6 Configuring, verifying and troubleshooting RIPng for IPv6.
3 What is DHCP? Every device that connects to a network needs an IP address. Network administrators assign static (manually) IP addresses to routers, servers, and other devices whose locations are not likely to change. Static addresses enable remote manage of those devices. Desktop clients do not require a static address. Instead, a workstation can use any address within a range (within an IP subnet) of addresses. Other items such as the subnet mask, default gateway, and DNS server are common value inside that subnet. DHCP makes the process of assigning i new IP addresses almost transparent. Assigns IP addresses configuration information dynamically. Extremely useful and timesaving (RFC 2131). 3 Scalable and relatively easy to manage. In a small branch or SOHO location, a Cisco router can be configured to provide DHCP services without the need for a dedicated server. A Cisco IOS feature set called Easy IP offers an optional, full-featured DHCP server.
4 DHCP Operation DHCP includes three different address allocation mechanisms to provide flexibility when assigning IP addresses: Manual Allocation The administrator assigns a pre-allocated IP address to the client and DHCP only communicates the IP address to the device. Automatic Allocation DHCP automatically assigns a static IP address permanently to a device, selecting it from a pool of available addresses. There is no lease and dthe address is permanently assigned dto a device. Dynamic Allocation 4 DHCP automatically dynamically assigns, or leases, an IP address from a pool of addresses for a limited period of time. Or until the client tells to server that it no longer needs the address. We will focus on dynamic allocation.
5 DHCP Operation DHCP works in a client/server mode. When a PC connects to a DHCP server, the server assigns or leases an IP to the PC connects to the network with that leased IP address until expires. The host must contact the DHCP server periodically to extend the lease. This lease mechanism ensures that hosts that move or power off do not hold onto addresses that they do not need. The server returns these addresses to the address pool. 5
6 BOOTP and DHCP 6 The Bootstrap Protocol (BOOTP: RFC 951), is the predecessor of DHCP. BOOTP download address and boot configurations for diskless workstations. Both DHCP and BOOTP are client/server based UDP ports 67 and 68, the BOOTP ports. DHCP and BOOTP have two components. The server allocates, distributes, and manages IP data assignments. Each allocation is stored on the server in a data set called a binding. The client is any device using DHCP as a method for obtaining IP addressing or supporting configuration information. To understand the functional differences between BOOTP and DHCP,, consider the four basic IP parameters needed to join a network: IP address Gateway address Subnet mask DNS server address
7 BOOTP and DHCP Differences 7 There are three primary differences between DHCP and BOOTP: The main difference is that BOOTP asign manual pre-configuration of the host information in a server database, while DHCP allows for dynamic allocation of network addresses and configurations. BOOTP server searches a predefined table for an entry that matches the MAC address for the client. DHCP allows for recovery and reallocation of network addresses through a leasing mechanism. BOOTP does not use leases. Its clients have reserved IP address which cannot be assigned to any other host. BOOTP provides a limited amount of information to a host. DHCP provides additional IP configuration parameters, such as WINS and domain name.
8 DHCP Message Format The developers of DHCP needed to maintain compatibility with BOOTP and consequently used the same BOOTP message format. However, because DHCP has more functionality than BOOTP, the DHCP options field was added. The fields are as follows: 8 Operation Code (OP) - Specifies the general type of message. 1 indicates a request message; 2 is a reply message.
9 DHCP Message Format 9 Hardware Type - Identifies the type of hardware used in the network. 1 is Ethernet, 15 is Frame Relay, and 20 is a serial line. These are the same codes used in ARP messages. Hardware Address length - 8 bits to specify the length of the address. Hops - Set to 0 by a client before transmitting a request and used by relay agents to control the forwarding of DHCP messages. Transaction Identifier - 32-bit identification generated by the client to allow it to match up the request with replies from DHCP servers. Seconds time elapsed since a client began attempting to acquire or renew a lease. Used by a busy DHCP servers to prioritize replies. Flags - Only one of the 16 bits is used, which is the broadcast flag. A client that does not know its IP address when it sends a request, sets the flag to 1.
10 DHCP Message Format 10 Client IP Address -The client puts its own IP address if and only if it has a valid IP address while in the bound state; otherwise, it sets the field to 0. Your IP Address - IP address that the server assigns to the client. Server IP Address - Address of the server that the client should use for the next step in the bootstrap process. Gateway IP Address - Routes DHCP messages when DHCP relay agents are involved (when client and a server are on different subnets). Client Hardware Address - Specifies the Physical layer of the client. Server Name - The server sending a DHCPOFFER or DHCPACK message may optionally put its name in this field. Boot Filename - Optionally used by a client to request a particular type of boot file in a DHCPDISCOVER message. Used by a server in a DHCPOFFER to fully specify a boot file directory and filename. Options - Holds DHCP options, including several parameters required for basic DHCP operation. This field is variable in length. Both client and server may use this field.
11 DHCP Discover Because the client has no way of knowing the subnet to which it belongs, the DHCPDISCOVER is an IP broadcast (destination IP address ). The client does not have a configured IP address, so the source IP address of is used. 11
12 DHCP Offer This message contains initial configuration information for the client, including the MAC address of the client, followed by the IP address that the server is offering, the subnet mask,, the lease duration, and the IP address of the DHCP server making the offer. The DHCPOFFER message can be configured to include other information, such as the lease renewal time,, domain name server,, and NetBIOS Name Service (Microsoft Windows Internet Name Service [Microsoft WINS]). 12
13 Configuring a DHCP Server Cisco routers provide full support for a router to act as a DHCP server. The Cisco IOS DHCP server assigns and manages IP addresses from specified address pools within the router to DHCP clients. Steps to configure a router as a DHCP server: 1. Define a range of addresses that DHCP is not to allocate. These are usually static addresses reserved dfor the router interface, switch management IP address, servers, and local network printers. 2. Create the DHCP pool using the ip dhcp pool command. 3. Configure the specifics of the pool. A best practice is to configure excluded addresses in global configuration mode before creating the DHCP pool. 13 This ensures that DHCP does not assign reserved addresses accidentally.
14 Configuring a DHCP Server Configuring a DHCP server involves defining a pool of addresses to assign. The ip dhcp pool command creates a pool with the specified name and puts the router in DHCP configuration mode ((dhcp-config)# config)# prompt). 14 You must configure the available addresses and specify the subnet network number and mask of the DHCP address pool. Use the network statement to dfi define the range of available addresses. You should also define the default gateway or router for the clients to use with the default-router command. The next DHCP pool commands are considered optional. Configure the IP address of the DNS server available to a DHCP client using the dns-server command.
15 Configuring a DHCP Server 15 The DHCP service is enabled by default. To disable the service, use the no service dhcp command. Use the service dhcp global configuration command to re-enable. Enabling the service has no effect if the parameters are not configured.
16 DHCP Configuration Example Router R1 has been configured with the following commands: ip dhcp excluded-address ip dhcp excluded-address ip dhcp pool LAN-POOL-1 network default-router domain-name span.com 16 To verify the operation of DHCP, use the show ip dhcp binding command. This command displays a list of all IP address to MAC address bindings that have been provided by the DHCP service. To verify that messages are being received or sent by the router, use the show ip dhcp server statistics i command. This command displays count information regarding the number of DHCP messages that have been sent and received.
17 DHCP Configuration Example 17 So how does PC2 receive an IP address? : ip dhcp excluded-address ip dhcp excluded-address ip dhcp pool LAN-POOL-2 network default-router domain-name span.com
18 Configuring a DHCP Client Typically, small broadband routers for home use, can be configured to connect to an ISP. In most cases, are set to acquire an IP address automatically. This means that when the router is connected to a cable modem, it is a DHCP client and requests an IP address from the ISP. Sometimes, Cisco routers in SOHO and branch sites have to be configured in a similar manner. The method used depends on the ISP. The Ethernet interface is used to connect to a cable modem. To configure an interface as a DHCP client,theipthe ip address dhcp command must be configured. 18
19 DHCP Relay 19 In a complex hierarchical network, enterprise servers are usually contained in a server farm. These servers may provide DHCP, DNS, FTP services for the clients. The problem is that the network clients typically are not on the same subnet as those servers. Therefore, the clients must locate the servers to receive services and often these services are located using broadcast messages. A solution to this problem could be to add DHCP servers on all the subnets. However, running these services on several computers creates both cost and administrative overhead. A simpler solution is to configure the Cisco IOS ip helper-address feature on intervening i routers and switches. This enables routers to forward DHCP broadcasts to the DHCP servers. When a router forwards address assignment/parameter requests, it is acting as a DHCP relay agent.
20 DHCP Relay DHCP is not the only service that the router can be configured to relay. By default, the ip helper-address command forwards eight UDP services. To specify additional ports, use the ip forward-protocol command to specify exactly which types of broadcast packets to forward. 20
21 21 DHCP Relay
22 22 Configuring a DHCP Server Using SDM
23 Troubleshooting DHCP Configuration 23 DHCP problems can arise for a multitude of reasons, such as software defects in OSs, NIC drivers, or DHCP/BOOTP relay agents, but the most common are configuration fg issues. Because of the number of potentially problematic areas, a systematic approach to troubleshooting is required. Troubleshooting Task 1: Resolve IP Address Conflicts The show ip dhcp conflict command displays all address conflicts recorded by the DHCP server. The server uses the ping command to detect conflicts. If an address conflict is detected, the address is removed from the pool and not assigned until an administrator resolves the conflict. Troubleshooting Task 2: Verify Physical lconnectivity it First, use the show interface interface command to confirm that the router interface acting as the default gateway for the client is operational. If the state of the interface is anything other than up, the port does not pass traffic, including DHCP client requests.
24 Troubleshooting DHCP Configuration 24 Troubleshooting Task 3: Test Network Connectivity by Configuring a Client Workstation with a Static IP Address When troubleshooting any DHCP issue, verify network connectivity by configuring a static IP address on a client workstation. Try to reach network resources, if not, the root cause of the problem is not DHCP. At this point, network connectivity troubleshooting is required. Troubleshooting Task 4: Verify Switch Port Configuration (STP Portfast and Other Commands) If the DHCP client is unable to obtain an IP address from the DHCP server on startup, attempt to obtain an IP address from the DHCP server by manually forcing the client to send a DHCP request. If there is a switch between the client and the DHCP server, verify that the port has STP PortFast enabled and trunking/channeling disabled. The default configuration is PortFast t disabled d and trunking/channeling /h auto, if applicable.
25 Troubleshooting DHCP Configuration Troubleshooting Task 5: Distinguishing Whether DHCP Clients Obtain IP Address on the Same Subnet or VLAN as DHCP Server It is important to distinguish whether DHCP is functioning correctly when the client is on the same subnet or VLAN as the DHCP server. If the DHCP is working correctly, the problem may be the DHCP/BOOTP relay agent. If the problem persists even with testing DHCP on the same subnet or VLAN as the DHCP server, the problem may actually be with the DHCP server. 25
26 Verify Router DHCP Relay Configuration 26 When the DHCP server is located on a separate LAN from the client, the router interface facing the client must be configured to relay DHCP requests. This is accomplished by configuring the IP helper address. If it is not configured properly, client DHCP requests are not forwarded to the DHCP server. Follow these steps to verify the router configuration: 1. Verify that the ip helper-address command is configured on the correct interface. It must be present on the inbound interface of the LAN containing the DHCP client workstations and Must tbe directedd to the correct DHCP server. 2. Verify that the global configuration command no service dhcp has not been configured. This command disables all DHCP server and relay functionality on the router.
27 27 Verify that the Router is Receiving DHCP Requests q On routers configured as DHCP servers, the DHCP process fails if the router is not receiving requests from the client. As a troubleshooting task, verify that the router is receiving the DHCP request from the client. Configure an ACL for debugging output. The debug ACL is not intrusive to the router. access-list 100 permit ip host host Start debugging by using ACL 100 as the defining parameter. debug ip packet detail 100 A useful command for troubleshooting DHCP operation is the debug ip dhcp server events command. This command reports server events, like address assignments and database updates.
28 Verify that the Router is Receiving DHCP Requests q The source IP address is because the client does not yet have an IP address. The destination is because the DHCP discovery message from the client is a broadcast. The UDP source and destination ports, 68 and 67, for DHCP. 28
30 Private and Public Addressing All public Internet addresses must be registered with a Regional Internet Registry (RIR). Organizations can lease public addresses from an ISP. There are reserved private Internet addresses, for internal network use only. Are referred to as non-routable addresses. RFC 1918 provides details. Unlike public IP addresses, private IP addresses are a reserved dblock of numbers that can be used by anyone. Because you cannot route private addresses over the Internet, and there are not enough public addresses, networks need a mechanism to translate private addresses to public addresses at the edge of their network. Network Address Translation (NAT) provides this mechanism. 30
31 31 Private and Public Addressing
32 What is NAT? 32 NAT-enabled routers retain one or many valid Internet IP addresses outside of the network. When the client sends packets out of the network, NAT translates the internal IP address of the client to an external address. To outside users, all traffic coming to and going from the network has the same IP address or is from the same pool of addresses. NAT has many uses, but its key use is to save IP addresses by allowing networks to use private IP addresses. NAT translates non-routable, private addresses into routable, public ones. NAT has an added benefit of adding a degree of privacy and security to a network because it hides internal IP addresses from outside networks. A NAT-enabled device typically operates at tthe border of a stub network. In NAT terminology: The inside network is the set of networks that are subject to translation. The outside network refers to all other addresses.
33 33 What is NAT?
34 NAT Terminology Inside local address The IP address assigned to a host on the inside network. Usually not an IP address assigned by the (NIC) or service provider. This address are private address. Inside global address A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world. Outside local address The IP address of an outside host as it known to the hosts in the inside network. Outside global address The IP address assigned to a host on the outside network. The owner of the host assigns this address. 34
35 35 How NAT Works?
36 Dynamic and Static Mapping 36 There are two types of NAT translation: dynamic and static. Dynamic NAT uses a pool of public addresses and assigns them on a first-come come, first-served served basis. When a host requests access to the Internet, dynamic NAT chooses an IP address from the pool that is not already in use by another host. Static NAT uses a one-to-one mapping of local and global addresses, and these mappings remain constant. Is particularly useful for web servers or hosts that must have a consistent address that is accessible from the Internet. These internal hosts may be enterprise servers or networking devices. Both static and dynamic NAT require that enough public addresses are available to satisfy the total number of simultaneous user sessions.
37 NAT Overload 37 NAT overloading (Port Address Translation or PAT) maps multiple private IP addresses to a single public IP address or a few addresses. Multiple addresses can be mapped to one or to a few addresses because each private address is also tracked by a port number. When a client opens a TCP/IP session, the NAT router assigns a port number to its source address. NAT overload ensures that clients use a different TCP port number for each client session with a server on the Internet. It also validates that the incoming packets were requested, thus adding a degree of security to the session. The port number is encoded in 16 bits ( 65,536 ports per IP address). Practically, ports per single IP address is around 4,000. PAT will attempt to preserve the original source port. If this source port is already used, PAT will assign the first available port number. When there are no more portsavailable, PAT moves to thenextt IP address to try to allocate the original source port again, until saturate.
38 38 NAT Overload
39 NAT Benefits and NAT Drawbacks 39 NAT Benefits Conserves the legally registered addressing scheme Increases the flexibility of connections to the public network Provides consistency for internal network addressing schemes. Provides network security However, NAT does not replace firewalls. NAT Drawbacks Performance is degraded End-to-end functionality is degraded End-to-end IP traceability is lost Tunneling is more complicated Initiating TCP connections can be disrupted Services that require the initiation of TCP connections from the outside tid network, or stateless ttl protocols such as those using UDP. Architectures need to be rebuilt to accommodate changes
40 40 Configuring Static NAT
41 41 Configuring Static NAT
42 42 Configuring Dynamic NAT
43 43 Configuring Dynamic NAT
44 Configuring NAT Overload for a Pool of Public IP Addresses 44 The primary difference between this configuration and the configuration for dynamic,, one-to-one NAT is that the overload keyword is used. Remember that the overload keyword enables port address translation.
45 45 Configuring NAT Overload for a Pool of Public IP Addresses
46 Configuring NAT Overload for a Single Public IP Address 46 The configuration is similar to dynamic NAT, except that instead of a pool of addresses, the interface keyword is used to identify the outside IP address. Therefore, no NAT pool is defined. The overload keyword enables the addition of the port number to the translation.
47 47 Configuring NAT Overload for a Single Public IP Address
48 Port Forwarding 48 Port forwarding (tunneling) is the act of forwarding a network port from one network node to another. This technique can allow an external user to reach a port on a private IP address (inside a LAN) from the outside through a NAT-enabled router. Typically, peer-to-peer file-sharing programs and key operations, such as web serving and outgoing FTP, require that router ports be forwarded or opened to allow these applications to work. Because NAT hides internal addresses, peer-to-peer only works from the inside out where NAT can map register outgoing requests against incoming replies. The problem is that NAT does not allow requests initiated from the outside. This situation can be resolved with manual intervention. Port forwarding allows you to identify specific ports that can be forwarded to inside hosts. Different applications use different ports. (Telnet=23, FTP=20 and 21, etc.). This makes it predictable for applications and routers to identify network services.
49 49 Port Forwarding
50 50 Verifying NAT and NAT Overload
51 Clearing NAT Translations It is sometimes useful to clear the dynamic entries sooner than the default. This is especially true when testing the NAT. You can be very specific about which translation to clear, or you can clear all translations from the table using the clear ip nat translation * global command. Only the dynamic translations are cleared from the table. Static translations cannot be cleared from the translation table. 51
52 Troubleshooting NAT and NAT Overload Configuration g When you have IP connectivity problems in a NAT environment, it is often difficult to determine the cause of the problem. The first step in solving your problem is to rule out NAT as the cause Follow these steps to verify that NAT is operating as expected: Step 1. Based on the configuration, clearly define what NAT is supposed to achieve. This may reveal a problem with the configuration. Step 2. Verify that correct translations exist in the translation table using the show ip nat translations command. Step 3. Use the clear and debug commands to verify that t NAT is operating as expected. Check to see if dynamic entries are recreated after they are cleared. 52 Step 4. Review in detail what is happening to the packet, and verify that routers have the correct routing information to move the packet.
53 Troubleshooting NAT and NAT Overload Configuration g Use the debug ip nat command to verify the operation of the NAT by displaying information about every packet that is translated by the router. The debug ip nat detailed command generates a description of each packet considered for translation. This command also outputs information about certain errors or exception conditions, such as the failure to allocate a global address. 53
55 Reasons for Using IPv6 Why We Need More Address Space To comprehend the IP addressing issues today, consider that the IPv4 address space provides 4,294,967,296 unique addresses. Of these, only 3.7 billion addresses are assignable because the IPv4 addressing system separates the addresses into classes and Reservesaddressesfor multicasting, testing, and other specific uses. January 2007: about 2.4 billion of the available IPv4 addresses are already assigned to end users or ISPs, 1.3 billion addresses still available. Despite this seemingly large number, IPv4 address space is running out. 55
56 Reasons for Using IPv6 56 The pool of numbers is shrinking for the following reasons: Population growth 2005 Internet population: approximately 973 million users. This number has doubled since then. In addition, users stay on longer, reserving IP addresses for longer periods and are contacting more and more peers daily. Mobile users - Industry has delivered more than one billion mobile phones. More than 20 million IP-enabled mobile devices, including PDAs, pen tablets, notepads, and barcode readers, have been delivered. Transportation - There will be more than one billion automobiles by Newer models are IP-enabled to allow remote monitoring to provide timely maintenance and support. Lufthansa already provides Internet connectivity on their flights. More carriers, including ships at sea, will provide similar services. Consumer electronics - The newest home appliances allow remote monitoring i using IP technology. DVRs: download and update program guides from the Internet.
57 Reasons for Using IPv6 The pool of numbers is shrinking for the following reasons: 57
58 Reasons for Using IPv6 58 Movement to change from IPv4 to IPv6 has already begun, particularly in Europe, Japan, and the Asia-Pacific region. These areas are exhausting their allotted IPv4 addresses, which makes IPv6 all the more attractive and necessary. The ability to scale networks for future demands requires a limitless supply of IP addresses and improved mobility that DHCP and NAT can meet. IPv6 satisfies the increasingly complex requirements of hierarchical addressing that IPv4 does not provide. Given the huge installed base of IPv4 in the world, it is not difficult to appreciate that transitioning to IPv6 from IPv4 deployments is a challenge. There are, however, a variety of techniques, including an auto-configuration fg option, to make the transition easier. The transition mechanism you use depends on the needs of your network. An IPv6 address is a 128-bit binary value, which can be displayed as 32 hexadecimal digits.
59 Reasons for Using IPv6 IPv6 should provide sufficient addresses for future Internet growth needs for many years to come. There are enough IPv6 addresses to allocate more than the entire IPv4 Internet address space to everyone on the planet. 59
60 Reasons for Using IPv6 60 Enhanced IP addressing: Global reachability and flexibility Aggregation Multihoming Autoconfiguration Plug-and-play End-to-end without NAT Renumbering Mobility and security: Mobile IP RFC-compliant IPsec mandatory (or native) for IPv6 Simple header: Routing efficiency Performance and forwarding rate scalability No broadcasts No checksums Extension headers Flow labels Transition richness: Dual-stack 6to4 and manual tunnels Translation
61 IPv6 Address Representation bit IPv6 addresses need a different representation because of their size. IPv6 addresses use colons to separate entries in a series of 16-bit hexadecimal. Consider the address 2031:0000:130F:0000:0000:09C0:876A:130B. IPv6 does not require explicit address string notation. To shorten the address by applying the following guidelines: Leading zeros in a field are optional. For example, the field 09C0 equals 9C0, and the field 0000 equals :0000:130F:0000:0000:09C0:876A:130B can be written as 2031:0:130F:0000:0000:9C0:876A:130B. Successive fields of zeros can be represented as two colons "::". However, this shorthand method can only be used once in an address. For example 2031:0:130F:0000:0000:9C0:876A:130B can be written as 2031:0:130F::9C0:876A:130B. Cannot be represented as 2031::130f::9c0:876a:130b
62 IPv6 Address Representation An unspecified address is written as "::" because it contains only zeros. Using the "::" notation greatly reduces the size of most addresses as shown. An address parser identifies the number of missing zeros by separating any two parts of an address and entering 0s until the 128 bits are complete. FF01:0000:0000:0000:0000:0000:0000:0001 becomes FF01:0:0:0:0:0:0:1 becomes FF01::1 0:0:0:0:0:0:0:1 becomes ::1 0:0:0:0:0:0:0:0 becomes :: 62 E3D7:0000:0000:0000:51F4:00C8:C0A8:6420 becomes E3D7::51F4:C8:C0A8:6420 3FFE:0501:0008:0000:0260:97FF:FE40:EFAB becomes 3FFE:501:8:0:260:97FF:FE40:EFAB becomes 3FFE:501:8::260:97FF:FE40:EFAB
63 IPv6 Global Unicast Address IPv6 has a format that enables aggregation upward eventually to the ISP. Global unicast addresses typically consists of a 48-bit global routing prefix and a 16-bit subnet ID. Individual organizations can use a 16-bit subnet field to create their own local addressing hierarchy. This field allows an organization to use up to 65, individual subnets. RFC 3587, IPv6 Global l Unicast Address Format Additional hierarchy can be added to the 48-bit global routing prefix with 63 the registry prefix, ISP Prefix, and site prefix. The current global unicast address that is assigned by the IANA uses the range of addresses that start with binary value 001 (2000::/3), which is 1/8 of the total IPv6 address space and is the largest block of assigned addresses. The IANA is allocating the IPv6 address space in the ranges of 2001::/16 to the five RIR registries (ARIN, RIPE, APNIC, LACNIC, and AfriNIC).