Routing

ㅇ Default Routing

ㅁ RIT에 Packet의 Destination IP에 대해 해당하는 경로가 없을 경우 특정 경로(주로 외부(인터넷))로 나가도록 설정

ㅁ RIT 수동 관리

    > Ex) 잘 모르겠으면 무조건 외부로 나가라

ㅁ ip route 0.0.0.0 0.0.0.0 [Next Hop Interface]

R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254
R1(config)#

 

ㅇ Static Routing
ㅁ RIT 경로 정보를 강제 Mapping시키는 방식으로 수동 관리
ㅁ administrative distance
    > 관리자가 설정한 관리 거리
        - 선택 옵션이며 안 쓸 경우 Default=1로 자동 설정
ㅁ 장점
    > 단일 경로에 적합
        - Network 변경이 적을 경우 유리
    > 가장 안전
        - Protocol도 없어 RIT 변조 위험 없어 높은 안전성
ㅁ 단점
    > Network 변화 자동 대응 불가
    > Router 추가/변경, 회선 장애 발생 시 운영 요원이 직접 Routing 작업 수행
ㅁ ip route [Destination IP/NetID] [Destination IP/NetID의 Subnet Mask] [Next Hop Interface] (distance)

R1(config)#ip route 172.16.0.0 255.255.0.0 123.123.123.123
R1(config)#

ㅇ Dynamic Routing
ㅁ RIT 경로 정보를 Routing Protocol이 Update하는 식으로 자동 관리
ㅁ 대역폭 정보를 주는 방법
    > Interface 주소에 대역폭 정보가 포함돼 있으므로 대역폭 정보를 뿌림 = LSA 메시지 뿌림 = Interface 주소를 뿌림으로 활성시킬수 있다.
ㅁ 장점
    > 경로 재설정 가능
        - Network 경로 변화에 자동 대응
    > 다중 경로에 적합
        - Network 변경이 많을 경우 유리
ㅁ 단점
    > Router Overhead: 최적 경로 계산 Dijkstra`s Link State 알고리즘을 사용해 대역폭 정보(=LSA)를 포함시켜 Rip V2의 Hop Count 방식의 단점을 해결하나, 상대 Router가 LSA를 받아 Topology DB에서 SPF 알고리즘을 돌려 Cost 비용 경로 값 산출한 후 RIT를 건드므로 Router 시스템 부하 증가

ㅇ Routing Protocol
ㅁ Routing Protocol을 올린 Router 간 경로 정보 교환 가능 및 RIT 주소 설정 시 P/W Check 등의 인증 사용 등
    > Ex) Rip V2, OSPF 등

ㅇ Router Protocol 동작 범위 별 분류
ㅁ AS
    > 1개의 관리 도메인이 운영하는 Router와 통신망 집합체
ㅁ IGP (=Interior Gateway Protocol)
    > AS 내 운영되는 RIT 경로 정보 교환 Routing Protocol
        - Ex) RIP, OSPF 등
ㅁ EGP (=Exterior Gateway Protocol)
    > AS 간 Routing RIT 경로 정보 교환 Routing Protocol
        - Ex) BGP 등

ㅇ IGRP (=Interior Gateway Routing Protocol)
ㅁ CISCO에서 개발되어 하나의 Metric 값 사용하며 다섯 가지 Network Parameter로 Distance-Vector 계산
ㅁ 자동 경로 재설정 및 Network 변화에 자동 대응

ㅇ IGRP (=Interior Gateway Routing Protocol) - IGRP Metric 계산 요소
ㅁ 대역폭 (=Bandwidth)
    > 회선 속도는 1200bps ~ 10Gbps까지 표시 가능
ㅁ 지연 (=Delay)
    > 전송 시간은 매체 지연 시간을 포함하며 1/10^6초 단위로 1 ~ 2^24까지 표시 가능
ㅁ 신뢰도 (=Reliability)
    > Router가 동적으로 측정하며 1~ 255까지 설정 가능
ㅁ 부하 (=Load)
    > 부하는 1 ~ 255까지 설정 가능하며 255는 100% 이용률을 의미
ㅁ MTU
    > L3에서 회선이 처리 가능한 최대 Packet Size

ㅇ EIGRP(=Enhanced Interior Gateway Routing Protocol)
ㅁ 적은 Bandwidth로 부분 갱신 지원
ㅁ 수렴 속도
    > 빠름
ㅁ VLSM
    > 지원
ㅁ Network 구성 변화 발생 시
    > DUAL 알고리즘으로 Packet 손실 없이 Routing

ㅇ DUAL(=Diffusing-Update Algorithm)
ㅁ 전체 경로 계산 시 루프-방지 (=Loop-Free) 기능을 제공하는 EIGRP의 수렴 알고리즘

ㅇ 거리-벡터 Routing Protocol (=Distance-Vector, DV)
ㅁ 경로 정보 설정
    > 인접한 이웃으로부터 망 정보 수집 및 최단 거리 Hop Count 방식
    > 이웃 Router와 거리를 더해 비용 계산
ㅁ 경로 정보 교환
    > 주기적 Routing 정보 교환
ㅁ 수렴 시간
    > 느림
ㅁ 모든 RIT 값을 인접한 이웃에게 전달
ㅁ Routing 광고
    > Broadcast 방식으로 인접한 이웃에게 광고
ㅁ 종류
    > RIP, RIP v2, IGRP 등
ㅁ 단점
    > 불필요 Traffic 증가로 인한 Network 부하 중가
    > 느린 수렴 (=Convergence)
        - 모든 Router에 동일 정보의 Topology변화가 전파되는데 RIT 수동 작업 때문에 오랜 수렴 시간이 들어 주기적 Network 경로 정보 변화에 미적합
    > Routing Loop
        - Network 경로 정보 변화 발생 시 즉시 Routing 경로에 반영 불가해 특정 경로에 Looping 발생 가능성
    > 무한 세기 (=Counting to Infinity)
        - 느린 수렴에 관련된 문제 중 하나로, 도착 불가능한 Network에 도착 가능하다고 착각하는 Router 때문에 계속해서 엉뚱한 RIP 메시지 송/수신
    > 작은 무한 값
        - 느린 수렴을 줄이기 위해 무한 값으로 작은 값 사용
    > 최대 Hop Count
        - 15 (16 이상부터는 무한대 (생각 없음)으로 판단)
    > 대규모 Network에 부적합
        - Metric을 Hop 수로 하기 때문에 회선 속도 등의 다른 정보가 Routing에 반영 불가
        - Hop Count 방식이라 대역폭 개무시해서 속도 시망 가능성

ㅇ DV 성능 개선 대책
ㅁ Triggered Update
    > 복구 시간을 줄이기 위해 Hop Count 변경 시 즉시 통보
ㅁ Hold Down
    > Metric이 무한대인 경로에 대해서는 일정 시간 동안 경로 미갱신 하며, 전체 Network 경로가 새로 갱신될 때까지 대기
ㅁ Split Horizon
    > Loop 방지를 위해 B에서 A로 보낸 정보를 다시 재전송을 하지 않음
    > Ex) Router A → B → C 전송 도중, B <-> C 장애 발생 시 A <-> B 간 Looping 가능성
ㅁ Route Poisoning
    > 회선 장애 발생 시 도달 불가능 함을 신속히 알리기 위해 즉시 Metric을 16으로 지정한 후 전체 Network에 방송

 

ㅇ RIP v1 Forwarding Table Ex)

// Router 1
Destination Network: N1
Next Router: -
Cost in Hops: 1

Destination Network: N2
Next Router: R1
Cost in Hops: 1

Destination Network: N3
Next Router: R2
Cost in Hops: 2

Destination Network: N4
Next Router: R3
Cost in Hops: 3

// Router 2
Destination Network: N1
Next Router: R1
Cost in Hops: 2

Destination Network: N2
Next Router: -
Cost in Hops: 1

Destination Network: N3
Next Router: -
Cost in Hops: 1

Destination Network: N4
Next Router: R3
Cost in Hops: 2

// Router 3
Destination Network: N1
Next Router: R2
Cost in Hops: 3

Destination Network: N2
Next Router: R2
Cost in Hops: 2

Destination Network: N3
Next Router: -
Cost in Hops: 1

Destination Network: N4
Next Router: -
Cost in Hops: 1

 

ㅇ RIP v1과 Rip pv2 간 차이점 간단 비교
ㅁ CIDR과 VLSM 지원
    > RIP v1
        - 미지원
    > RIP v2
        - 지원
ㅁ Message 전달 방식
    > RIP v1
        - Broadcast 사용
    > RIP v2
        - Broadcast + Multicast 사용
            ▷ 불필요 Traffic 감소
ㅁ 인증
    > RIP v1
        - 몰라
    > RIP v2
        - Message별 인증
ㅁ 호환성
    > RIP v2가 RIP v1 하위 호환 가능
ㅁ 사용 Class 주소 범위
    > RIP v1
        - Supernetting (=Classfull 주소) 경로 정보만 교환 가능
    > RIP v2
        - Subnetting (=Classless 주소) 경로 정보까지 교환 가능

ㅇ 거리-벡터 Routing Protocol (=Distance Vector, DV) - RIP v2
ㅁ 520/udp
ㅁ IPv6의 RIP인 RIPng의 경우 521/udp 사용
ㅁ AS 영역 내 사용
    > 가능
ㅁ 경로 정보(Interface 주소 정보, Network 광고 정보 등) 교환 주기
    > 상대 Rouet가 RIT를 올려 경로 정보 교환이 이루어 질 시 30s마다 Update
ㅁ L3 Protocol이지만 Application처럼 메시지 전송
ㅁ Routing 광고
    > Multicast 주소 사용
        - 224.0.0.9

 

ㅇ RIPv2 상세 설정 Mode 진입
ㅁ router rip

R1(config)#router rip
R1(config-router)#

 

ㅇ RIP Subnetting 활성화 (Version 2 적용)
ㅁ no auto-summary

R1(config-router)#no auto-summary
R1(config-router)#

 

ㅇ RIP 광고 할 Interface 설정
ㅁ network [Interface의 CIDR 주소]

R1(config-router)#network 172.16.0.1
R1(config-router)#

 

ㅇ RIP 내부망 Interface로의 광고 차단
ㅁ passive-interface [Interface명]

R1(config-router)#passive-interface fa1/0
R1(config-router)#

 

ㅇ 링크-상태 Routing Protocol (=Link State)
ㅁ 경로 정보 설정
    > 모든 Router로부터 망 정보 수집 및 최소 Cost 비용 방식
    > 최단 거리 알고리즘으로 Routing. 모든 Router에 대한 비용 직접 계산
ㅁ LSDB (=Link State DB)
    > RIT 자동 동기용 전체 Network Topology 정보 집합
    > 매우 큰 AS 영역에서 OSPF 사용 시 Router 그룹을 묶어 계층형 Topology 생성 가능
ㅁ 경로 정보 교환
    > 인접한 Router마다 Link State 변화 시에만 Routing 정보 자동 교환
    > OSPF를 올린 Router에서 2s마다 RIT Update용 HELLO Packet 전송
    > 그래서 RIP 간 무조건 광고 정보 올리는 RIP랑 다르제
ㅁ 자신에게 직접 연결된 망 정보만 전달
ㅁ 수렴 시간
    > 빠름
ㅁ 인증
    > Class less는 물론 Wild Card Mask도 사용 가능
ㅁ Network 부하 감소
    > 상태 변화 정보만 광고하므로 불필요 Traffic 감소
ㅁ Routing 광고
    > Multicast 주소 사용
    > Single Area
        - 224.0.0.5
    > Multi Area
        - 224.0.0.6
ㅁ 종류
    > OSPF, IS-IS 등
ㅁ 단점
    > Router Overhead 발생 (최적 경로 계산 Dijkstra`s Link State 알고리즘을 사용해 대역폭 정보(=LSA)를 포함시켜 Rip V2의 Hop Count 방식의 단점을 해결하나, 상대 Router가 LSA를 받아 Topology DB에서 SPF? 알고리즘을 돌려 Cost 비용 경로 값 산출한 후 RIT를 건드므로 Router 자체 부하 증가

 

ㅇ SPF 계층 구조
ㅁ 큰 AS의 계층 구조
    > 지역적 제어 가능
ㅁ 큰 AS내 작은 AS
    > 연결된 Router와 Network를 Area로 묶고 다른 Area와 논리적 Backbone을 통해 연결
ㅁ Router의 Broadcast는 Area 내로 제한되어 외부 Area로의 전송은 Area 경계 Router를 통해서만 가능

                    ㅇ                       // 경계 Router (=Boundary Router)
  ㅇ     ㅇ     ㅇ     ㅇ     ㅇ     ㅇ      // 백본 Router (=Backbone Router)
ㅇㅇㅇ ㅇㅇㅇ ㅇㅇㅇ ㅇㅇㅇ ㅇㅇㅇ ㅇㅇㅇ    // 영역 경계 Router (=Area Broder Router)

 

ㅇ OSPF 상세 설정 모드 진입
ㅁ router ospf [Area 영역 번호]

R1(config)#router ospf 1
R1(config-router)#

 

ㅇ OSPF 광고할 Interface 설정
ㅁ network [Classless IP] [Subnet Mask] (Wildcard Mask,검사 영역, Classless용) area [Area 영역 번호]

R1(config-router)#network 172.16.0.20 255.255.0.0 area 1
R1(config-router)#

 

ㅇ OSPF 내부 LAN 쪽 Interface로의 광고 차단
ㅁ passive-interface [Interface명]

R1(config-router)#passive-interface fa1/0
R1(config-router)#

 

ㅇ OSPF 적용 여부 확인
ㅁ sh ip ospf int ???/ sh ip ospf neighbor / sh ip route / sh ip protocols    // 실습 미흡

R1(config)#do sh ip ospf
%OSPF: Router process 1 is not running, please configure a router-id
R1(config)#do sh ip ospf neighbor
%OSPF: Router process 1 is not running, please configure a router-id
R1(config)#do sh ip protocols
Routing Protocol is "rip"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Sending updates every 30 seconds, next due in 0 seconds
  Invalid after 180 seconds, hold down 180, flushed after 240
  Redistributing: rip
  Default version control: send version 1, receive any version
  Automatic network summarization is not in effect
  Maximum path: 4
  Routing for Networks:
    172.16.0.0
  Passive Interface(s):
    FastEthernet1/0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 120)

Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 0.0.0.0
  Number of areas in this router is 0. 0 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    172.16.0.0 0.0.255.255 area 1
 Reference bandwidth unit is 100 mbps
  Passive Interface(s):
    FastEthernet1/0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 110)

R1(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

R1(config)#

 

ㅇ RIP vs OSPF
ㅁ 작고 간단한 소규모 Network에는 RIP가 적합
    > 곧, Distance Vector가 적합
ㅁ 크기가 크거나 성능이 뛰어난 AS에는 OSPF가 적합
    > 곧, Link State가 적합

ㅇ IS-IS (=Intermediate System to Intermediate System)
ㅁ Router별 독립적 Network Topology DB 구성 Link State Protocol
ㅁ OSPF와 유사한 Traffic 이동 최적 경로 계산

ㅇ Hybrid 방식의 Routing
ㅁ Distance Vector + Link State의 혼합형
ㅁ 종류
    > EIGRP

ㅇ 경로-벡터 Routing (=Path Vector, PV)
ㅁ 최소 비용이 아닌 고유 규칙 적용하며 도중 경로 이상 시 최선의 경로 선택
ㅁ 종류
    > BGP 등

ㅇ BGP4 (=Border Gateway Protocol Version 4) - Ex) 4개의 AS를 갖는 인터넷
ㅁ 현재 인터넷에서 사용중인 유일한 Inter Domain Routing Protocol
ㅁ 경로-벡터 알고리즘 기반이지만 인터넷에서 Network 접근성에 대한 정보 제공에 알맞음
ㅁ 거리-벡터에 기초한 알고리즘이지만 패스-벡터 알고리즘에서는 흡수 대신 AS 번호를 Metric으로 사용

ㅇ IP Source Route
ㅁ CISCO에서는 IP Source Route를 PBR (=Policy Based Routing)이라는 말로 대신 씀
ㅁ Route의 RIT나 Host의 RIT에 설정된 경로 정보를 이용하지 않고 ICMP 옵션 Header를 통해 출발지에서 직접 경로 정보를 지정해 특정 조건으로 원하는 Area에 Packet 전송
ㅁ 종류
    > 대략적 경로 지정 Loose Source and Record Route, 정확한 Strict Source and Record Route

ㅇ PBR ACL 생성
ㅁ R1(config)# access-list [ACL 번호] permit [NetID] (WildCard Mask)

ㅇ RBR route-map 생성
ㅁ R1(config)# route-map [route-map명] permit [route-map 순서]

ㅇ PBR ACL Match 활성화
ㅁ R1(config-route-map)# match ip add [ACL 번호]

ㅇ Packet 출발지 설정
ㅁ R1(config-route-map)# set ip net-hop [route-list]

ㅇ Interface 지정
ㅁ R1(config-route-map)# do int [적용할 Packet Inbound Interface]

ㅇ Interface에 route-map 설치
ㅁ R1(config)# do ip policy route-map [route-map명]

ㅇ Null Routing (=Blackhole Filtering)
ㅁ 특정 IP/NetID의 통신 차단을 위해 가상 쓰레기 Interface인 Null0에 Packet 유도
ㅁ Default=Source IP에 ICMP Unreachable 응답이며 하는 Packet이 많을 경우 no ip unreachable 설정 필요
    > Destination/Port Unreachable 응답 메시지 허용/차단 시의 장/단점을 생각해보고 설정 (이 경우 DDoS 대비 별도의 응답 폐기 필요)
ㅁ 장점
    > 구조 간단
ㅁ 단점
    > DDoS 등의 공격 대응 시 ACL로 제어하는 것보다 부하 감소
ㅁ int Null0
ㅁ no ip unreachables
ㅁ ip route [차단코자 하는 Destination IP/NetID] (Subnet Mask) null0

R1(config)#int null0
R1(config-if)#no ip unreachables
R1(config-if)#ip route 20.20.20.0 255.255.255.0 null0
R1(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     20.0.0.0/24 is subnetted, 1 subnets
S       20.20.20.0 is directly connected, Null0
R1(config)#