VPN Introduction

Introduction to VPN

What is a VPN?

A Virtual Private Network (VPN) creates a secure, encrypted tunnel over a public network (like the Internet) to connect private networks or users. It allows organisations with multiple branch offices to share internal resources securely over the cheap but insecure internet.

Why VPN?

• Companies have multiple branch offices that need to share internal resources
• Internet is cheap but insecure — data can be sniffed, modified, or impersonated
• VPN solves all three problems through CIA security goals

Security Goals of VPN — CIA Triad

Without VPN vs With VPN

Without VPN — Plain Text
Branch → Internet → HQ
Username: admin
Password: 12345    ← visible to anyone sniffing

With VPN — Encrypted Tunnel
Branch → [Encrypted Tunnel] → HQ
Encrypted Data: @!rvvr8tv9e435$c3njf32&32)3$

VPN Technologies Covered

• GRE Tunnel — Generic Routing Encapsulation
• IPsec VPN — IP Security with IKEv1/IKEv2
• Site-to-Site VPN — Permanent encrypted tunnels between sites
• DMVPN — Dynamic Multipoint VPN
• FlexVPN — Cisco's IKEv2-based VPN framework

GRE Tunnel

GRE Tunnel

What is GRE?

A GRE (Generic Routing Encapsulation) tunnel encapsulates various network-layer protocols inside a virtual point-to-point link between two routers over an intermediate network like the Internet.

How GRE Works

1. Encapsulation: GRE encapsulates the original IP packet inside a new IP packet with a GRE header
2. Tunneling: The encapsulated packet travels over the intermediate network
3. Decapsulation: Receiving router strips the GRE header and forwards the original packet

GRE Tunnel Configuration

! Prerequisites: ensure physical routing reachability first
! Configure tunnel on R3 (source 200.0.1.2, destination 200.0.4.2)
R3(config)#Interface Tunnel 1
R3(config-if)#tunnel source 200.0.1.2
R3(config-if)#tunnel destination 200.0.4.2
R3(config-if)#ip address 192.168.10.1 255.255.255.0

! Configure tunnel on R8 (reverse)
R8(config)#Interface Tunnel 1
R8(config-if)#tunnel source 200.0.4.2
R8(config-if)#tunnel destination 200.0.1.2
R8(config-if)#ip address 192.168.10.2 255.255.255.0

! Run EIGRP over the tunnel for dynamic routing
R3(config)#router eigrp 1
R3(config-router)#network 192.168.10.0
R3(config-router)#network 10.0.1.0

IPsec over GRE — Full Configuration

Step 1: Configure EIGRP (Physical Underlay)

R1(config)#router eigrp 100
R1(config-router)#no auto-summary
R1(config-router)#network 192.168.10.0 0.0.0.255

Step 2: Create GRE Tunnel

R1(config)#interface tunnel0
R1(config-if)#ip address 172.16.0.1 255.255.255.252
R1(config-if)#tunnel source 192.168.10.1
R1(config-if)#tunnel destination 192.168.12.2

Step 3: Configure ISAKMP Policy (IKEv1)

R1(config)#crypto isakmp policy 10
R1(config-isakmp)#encryption aes
R1(config-isakmp)#hash sha
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#group 2
R1(config-isakmp)#lifetime 86400
R1(config)#crypto isakmp key CISCO address 192.168.12.2

Step 4: Transform Set & ACL

R1(config)#crypto ipsec transform-set GRE-SET esp-aes esp-sha-hmac
R1(cfg-crypto-trans)#mode transport
R1(config)#access-list 101 permit gre host 192.168.10.1 host 192.168.12.2

Step 5: Crypto Map & Apply

R1(config)#crypto map VPN-MAP 10 ipsec-isakmp
R1(config-crypto-map)#set peer 192.168.12.2
R1(config-crypto-map)#set transform-set GRE-SET
R1(config-crypto-map)#match address 101
R1(config)#interface GigabitEthernet0/0
R1(config-if)#crypto map VPN-MAP

Verification

show ip interface brief
show ip route
show crypto isakmp sa
show crypto ipsec sa
show interfaces Tunnel0
ping 172.16.0.2 source 172.16.0.1

BGP Introduction

BGP — Border Gateway Protocol

What is BGP?

BGP (Border Gateway Protocol) is the routing protocol used to exchange routing and reachability information between Autonomous Systems (ASes) on the Internet. It is the protocol that makes the Internet work at a global scale.

Types of BGP

IGP vs EGP Comparison

Key Characteristics of BGP

• Loop Prevention: AS_PATH attribute — if router sees its own AS in the path, it drops the route
• Policy-Based Routing: Weight, Local Preference, AS_PATH, Origin, MED
• Slow Convergence: Intentional — stability over speed to avoid flapping
• Manual Configuration: No auto-discovery; neighbours must be configured explicitly
• Supports CIDR: Classless routing and route summarisation
• Multiple Attributes: Rich set of attributes for fine-grained path control

When to Use BGP

Autonomous Systems & IANA

Autonomous Systems & IANA

What is an Autonomous System (AS)?

An Autonomous System (AS) is a collection of IP networks and routers under the control of a single organisation that presents a common routing policy to the Internet.

Before ASes, the Internet was one huge unmanageable network with millions of routes. EC Rosen proposed (RFC 827) breaking it into smaller, autonomously controlled parts — hence "autonomous system."

Autonomous System Numbers (ASN)

Real example: Airtel (AS 45609) → Tata Comm (AS 9498) → Google (AS 15169). AS_PATH would show: 45609 9498 15169

IANA & RIRs

IANA (Internet Assigned Numbers Authority) is a department of ICANN responsible for global coordination of internet resources. It allocates AS numbers through Regional Internet Registries (RIRs).

Types of ISP

ISP Relationship Types

ISP Connection Types

BGP Neighbourship Types

BGP Neighborship Types

eBGP vs iBGP

eBGP Configuration

! R1 in AS 100, R2 in AS 200
R1(config)#router bgp 100
R1(config-router)#neighbor 10.0.0.2 remote-as 200
R1(config-router)#network 1.1.1.1 mask 255.255.255.255

R2(config)#router bgp 200
R2(config-router)#neighbor 10.0.0.1 remote-as 100
R2(config-router)#network 2.2.2.2 mask 255.255.255.255

eBGP via Loopback (Multi-Hop)

By default, eBGP peers must be directly connected (TTL=1). To use loopbacks for stability and redundancy:

! Static routes to reach loopbacks
R1(config)#ip route 2.2.2.2 255.255.255.255 10.0.0.2
R1(config)#ip route 2.2.2.2 255.255.255.255 10.0.1.2

R1(config)#router bgp 100
R1(config-router)#neighbor 2.2.2.2 remote-as 200
R1(config-router)#neighbor 2.2.2.2 update-source Loopback0
R1(config-router)#neighbor 2.2.2.2 ebgp-multihop 5

iBGP Configuration

! Both R1 and R2 in AS 100
R1(config)#router bgp 100
R1(config-router)#neighbor 2.2.2.2 remote-as 100
R1(config-router)#neighbor 2.2.2.2 update-source Loopback0

Why IGP is Still Needed With iBGP?

• BGP doesn't advertise directly connected interfaces — only what's in the network statement
• BGP needs next-hop reachability — an IGP (OSPF/EIGRP) provides this
• MPLS LDP/RSVP relies on IGP for label distribution
• iBGP full-mesh or Route Reflectors need IGP to reach all loopbacks

BGP Loop Prevention

eBGP Loop Prevention — AS_PATH

When a router receives a route whose AS_PATH contains its own ASN, it rejects the route. This prevents routing loops between ASes.

Example AS_PATH propagation:
ISP1 advertises → AS_PATH: 100
ISP2 receives & re-advertises → AS_PATH: 200 100
ISP3 receives & re-advertises → AS_PATH: 500 200 100
If ISP1 receives AS_PATH: 500 200 100 → it sees its OWN AS (100) → DROPS route

iBGP Loop Prevention — Split-Horizon

A route learned from one iBGP peer must not be advertised to another iBGP peer. Solutions:

BGP Tables

BGP Tables

Three BGP Tables

Reading the BGP Table

show ip bgp

BGP table version is 5, local router ID is 1.1.1.1
Status codes: * valid, > best, i internal

   Network          Next Hop          Metric  LocPrf  Weight  Path
*>  1.1.1.1/32       0.0.0.0                          32768  i
*>  2.2.2.2/32       10.0.0.2               0             0  200 i

Detailed Route Info

show ip bgp 4.4.4.4
! Shows all paths, which was selected as best, and why

BGP States

BGP Message Types

BGP Full Mesh Requirement

In iBGP, every router must form a session with every other router because iBGP does NOT re-advertise routes between iBGP peers (split-horizon). With N routers: n(n-1)/2 sessions needed.

! Example: R1, R2, R3, R4 all in AS 200 — Full Mesh
R1(config)#router bgp 200
R1(config-router)#neighbor 10.0.0.2 remote-as 200  ! R2
R1(config-router)#neighbor 10.0.1.2 remote-as 200  ! R3
R1(config-router)#neighbor 10.0.3.2 remote-as 200  ! R4
! Also need OSPF for reachability between non-direct iBGP peers

BGP Next-Hop Self

BGP Next-Hop Self

The Problem

By default:

• eBGP → Changes next-hop to itself automatically ✓
• iBGP → Does NOT change next-hop ✗ (can cause unreachability)

Example Scenario

AS 100: R1
AS 200: R2, R3, R4 (R3-R4 are iBGP)

R1 (AS100) ←eBGP→ R2 ←iBGP→ R3 ←iBGP→ R4

When R1 advertises 1.1.1.1/32 to R2:
  R2 sets next-hop = R1's IP (10.0.0.1) ✓ (eBGP works fine)

When R3 advertises route from R4 to R2 via iBGP:
  R3 does NOT change next-hop
  R2 sees next-hop = R4's loopback (4.4.4.4)
  R2 CANNOT reach 4.4.4.4 → route unusable!

Solution: next-hop-self

! On R3 — tells R3 to replace the next-hop with its own IP
R3(config-router)#neighbor 2.2.2.2 next-hop-self

Now R2 receives: 4.4.4.4/32 via next-hop 10.0.1.2 (R3's IP)
R2 CAN reach R3 → route is usable ✓

Full Lab Configuration with next-hop-self

! R2 tells R1 about internal routes using its own IP as next-hop
R2(config)#router bgp 200
R2(config-router)#neighbor 10.0.0.1 remote-as 100
R2(config-router)#neighbor 10.0.0.1 next-hop-self
R2(config-router)#neighbor 10.0.1.2 remote-as 200   ! iBGP to R3
R2(config-router)#network 2.2.2.2 mask 255.255.255.255

BGP Attributes & Path Selection

BGP Attributes & Path Selection

BGP Attribute Categories

BGP Best Path Selection (In Order)

Key Attributes — Detailed

1. Weight (Cisco-only)

R1(config-router)#neighbor 10.0.0.2 weight 500
! Route with weight 500 preferred over default weight 0

2. Local Preference

R1(config)#route-map SET_LOCALPREF permit 10
R1(config-route-map)#set local-preference 200
R1(config-router)#neighbor 10.0.0.2 route-map SET_LOCALPREF in
! Higher = preferred. Propagated throughout AS via iBGP.

3. MED (Multi-Exit Discriminator)

R1(config)#route-map SET_MED permit 10
R1(config-route-map)#set metric 50
R1(config-router)#neighbor 10.0.0.2 route-map SET_MED out
! Lower MED = preferred. Tells external AS which path to use to enter your AS.

Origin Types

Route Reflector & Confederation

Route Reflector & Confederation

Route Reflector (RR)

Without Route Reflectors, iBGP requires full mesh (every router peers with every other). This is O(n²) sessions — not scalable. A Route Reflector breaks this requirement.

Route Reflector Terminology

• RR (Route Reflector): The central router that reflects routes to clients
• Client: iBGP peers configured as RR clients
• Non-Client: Normal iBGP peers (must still be full-mesh among non-clients)

Route Advertisement Rules

Route Reflector Configuration

! R1 = Route Reflector; R2, R3, R4, R5 = Clients
R1(config)#router bgp 100
R1(config-router)#neighbor 10.0.0.2 remote-as 100
R1(config-router)#neighbor 10.0.0.2 route-reflector-client
R1(config-router)#neighbor 10.0.1.2 remote-as 100
R1(config-router)#neighbor 10.0.1.2 route-reflector-client

! Clients only peer with the RR — not each other
R2(config)#router bgp 100
R2(config-router)#neighbor 10.0.0.1 remote-as 100  ! Just the RR
R2(config-router)#network 2.2.2.2 mask 255.255.255.255

! Verification
R1#show ip bgp neighbors 10.0.0.2 | include client
Route-reflector-client: Yes

BGP Confederation

BGP Confederation divides one AS into smaller sub-ASes while appearing as a single AS to the outside world. Each sub-AS is a mini-AS internally.

Why Confederation?

Confederation Configuration

! AS 200 divided into sub-ASes: 65001, 65002, 65003
R2(config)#router bgp 65001
R2(config-router)#bgp router-id 10.0.20.1
R2(config-router)#bgp confederation identifier 200  ! Public AS
R2(config-router)#bgp confederation peers 65002 65003  ! Other sub-ASes
R2(config-router)#neighbor 10.0.0.1 remote-as 100   ! External eBGP
R2(config-router)#neighbor 10.0.1.2 remote-as 65002  ! Confederation peer

! External routers see all of AS 200 as one AS
! AS_PATH from R7's perspective: 200 100 (not sub-AS numbers)

BGP Community & Peer Groups

BGP Community & Peer Groups

BGP Community

A BGP Community is an optional transitive attribute — essentially a "tag" or "sticker" attached to a route. Routers can match community values and apply policies.

Format: ASN:VALUE e.g., 65000:100 (32-bit)

Well-Known Community Values

BGP Community Configuration

! R1 — Tag route 10.1.1.0/24 with community 100:10
R1(config)#ip prefix-list SEND_PREFIX seq 5 permit 10.1.1.0/24
R1(config)#route-map TAG_COMM permit 10
R1(config-route-map)#match ip address prefix-list SEND_PREFIX
R1(config-route-map)#set community 100:10
R1(config)#router bgp 100
R1(config-router)#network 10.1.1.0 mask 255.255.255.0
R1(config-router)#neighbor 10.0.0.2 send-community
R1(config-router)#neighbor 10.0.0.2 route-map TAG_COMM out

! R3 — Block routes with community 100:10
R3(config)#ip community-list standard BLOCK_COMM deny 100:10
R3(config)#ip community-list standard BLOCK_COMM permit other
R3(config)#route-map BLOCK_ROUTE deny 10
R3(config-route-map)#match community BLOCK_COMM
R3(config)#router bgp 200
R3(config-router)#neighbor 10.0.1.1 route-map BLOCK_ROUTE in

BGP Redistribution

Redistribution injects routes from one routing protocol into another. Example: redistribute OSPF internal routes into BGP for advertisement to ISPs.

! Redistribute BGP into OSPF
R2(config)#router ospf 1
R2(config-router)#redistribute bgp 200 subnets

! Redistribute OSPF into BGP
R2(config)#router bgp 200
R2(config-router)#redistribute ospf 1

BGP Peer Groups

When many iBGP neighbours share identical configuration, a peer group applies the config once to a named group.

! R1 with 5 iBGP peers — without peer groups: 5× repeated config
! With peer groups: define once, apply to all
R1(config)#router bgp 100
R1(config-router)#neighbor INTERNAL_PEERS peer-group
R1(config-router)#neighbor INTERNAL_PEERS remote-as 100
R1(config-router)#neighbor INTERNAL_PEERS update-source Loopback0

! Assign neighbours to group
R1(config-router)#neighbor 10.0.20.1 peer-group INTERNAL_PEERS
R1(config-router)#neighbor 10.0.30.1 peer-group INTERNAL_PEERS
R1(config-router)#neighbor 10.0.40.1 peer-group INTERNAL_PEERS

! Benefits: cleaner config, lower CPU (routes processed once per group)

OSPF Introduction

OSPF — Open Shortest Path First

What is OSPF?

OSPF (Open Shortest Path First) is a link-state Interior Gateway Protocol (IGP) used within a single Autonomous System. It builds a complete topology map using LSAs and runs Dijkstra's SPF algorithm to find the best paths.

Router Roles

Router ID Election

1. Manually configured Router ID (highest priority)
2. Highest Loopback interface IP
3. Highest active Physical interface IP

Basic OSPF Configuration

Router(config)#router ospf 1
Router(config-router)#router-id 1.1.1.1
Router(config-router)#network 192.168.1.0 0.0.0.255 area 0
Router(config-router)#network 10.0.0.0 0.0.0.3 area 0
Router(config-router)#passive-interface GigabitEthernet0/1

! Key verification commands
Router#show ip ospf neighbor          ! Neighbour table
Router#show ip ospf database          ! LSDB
Router#show ip ospf interface brief   ! Interface costs
Router#show ip route ospf             ! OSPF routes in routing table

Wildcard Mask Reference

OSPF States

OSPF States

OSPF Neighbour State Machine

OSPF establishes neighbour relationships through a well-defined sequence of states. Three tables are built during this process:

• Neighbour Table: List of all OSPF neighbours and their state
• Link-State Database (LSDB): Complete topology map
• Routing Table: Best paths calculated via SPF from LSDB

DR/BDR Election

On broadcast networks (Ethernet), OSPF elects a DR and BDR to reduce LSA flooding. Without DR/BDR, every router would flood LSAs to every other router = n(n-1)/2 adjacencies. With DR/BDR: only n-1 adjacencies.

Election Process

1. Highest OSPF priority wins (default = 1, range 0–255)
2. Priority 0 = never becomes DR or BDR
3. Tie-breaker: highest Router ID
4. Election is non-preemptive — existing DR keeps role even if a higher-priority router joins

! Change OSPF priority (higher = more likely to become DR)
Router(config)#interface GigabitEthernet0/0
Router(config-if)#ip ospf priority 100

! View DR/BDR election results
Router#show ip ospf neighbor
! Look for DR/BDR/DROTHER in the "State" column

OSPF Areas

OSPF Areas (Deep Dive)

OSPF Area Types

Stub Area

Blocks external routes (Type 5 LSAs). Allows inter-area routes (Type 3). Receives a default route from ABR. Use when no ASBR is present and external routing is not needed.

! Must be configured on ALL routers in the area including ABR
Router(config-router)#area 1 stub

Totally Stubby Area (Cisco)

Blocks BOTH Type 3 and Type 5. Only a default route (0.0.0.0/0) enters the area. Smallest routing table possible. Only ABR needs no-summary.

! ABR only — adds no-summary
Router(config-router)#area 2 stub no-summary
! Internal routers — just stub
Router(config-router)#area 2 stub

NSSA — Not-So-Stubby Area

Allows external routes via Type 7 LSAs (generated by ASBR inside NSSA). Blocks regular Type 5 LSAs from outside. ABR converts Type 7 to Type 5 when leaving NSSA.

Router(config-router)#area 3 nssa

Totally NSSA

Blocks Type 3 and Type 5. Only allows Type 7 (internal ASBR) and a default route from ABR. Most restrictive NSSA variant.

Router(config-router)#area 2 nssa no-summary  ! ABR only

Areas that CANNOT be stub

• Backbone Area 0
• Virtually connected non-backbone areas
• Areas containing an ASBR

OSPF LSA Types

OSPF LSA Types

Link-State Advertisement Types

Key LSA Verification Commands

Router#show ip ospf database              ! Full LSDB
Router#show ip ospf database router       ! Type 1 LSAs
Router#show ip ospf database network      ! Type 2 LSAs
Router#show ip ospf database summary      ! Type 3 LSAs
Router#show ip ospf database asbr-summary ! Type 4 LSAs
Router#show ip ospf database external     ! Type 5 LSAs
Router#show ip ospf database nssa-external! Type 7 LSAs
Router#show ip ospf border-routers         ! ABR/ASBR reachability

OSPF Metric & Path Selection

OSPF Metric & Path Selection

OSPF Cost Formula

OSPF Cost = Reference Bandwidth / Interface Bandwidth
Default Reference Bandwidth = 100 Mbps

Interface costs with DEFAULT reference bandwidth (100 Mbps):
10 Mbps  → 100/10     = 10
100 Mbps → 100/100    = 1
1 Gbps   → 100/1000   = 0.1 → rounds to 1  ← Problem!
10 Gbps  → 100/10000  = 0.01 → rounds to 1 ← Same cost!

Fix: Adjust Reference Bandwidth

! Set reference to 10 Gbps (recommended for modern networks)
R1(config)#router ospf 1
R1(config-router)#auto-cost reference-bandwidth 10000

New costs with 10000 Mbps reference:
10 Mbps  → 10000/10    = 1000
100 Mbps → 10000/100   = 100
1 Gbps   → 10000/1000  = 10
10 Gbps  → 10000/10000 = 1

! Must be configured consistently on ALL routers in OSPF domain!

Manually Set Cost

R1(config)#interface GigabitEthernet0/0
R1(config-if)#ip ospf cost 5
! Overrides calculated cost. Useful for traffic engineering.

Path Selection Example

Verification

R1#show ip ospf interface          ! Shows cost per interface
R1#show ip ospf interface brief   ! Summary of costs
R1#show ip route ospf             ! OSPF routes installed

OSPF Network Types

OSPF Network Types

Network Type Configuration

! Broadcast (default on Ethernet)
R1(config-if)#ip ospf network broadcast

! Non-Broadcast — requires manual neighbor config
R1(config-if)#ip ospf network non-broadcast
R1(config-router)#neighbor 192.168.1.2

! Point-to-Point
R1(config-if)#ip ospf network point-to-point

! Point-to-Multipoint
R1(config-if)#ip ospf network point-to-multipoint

OSPF Authentication

Plaintext (Type 1) — Lab/Test only

R1(config-if)#ip ospf authentication
R1(config-if)#ip ospf authentication-key cisco123

MD5 (Type 2) — Production

R1(config-if)#ip ospf authentication message-digest
R1(config-if)#ip ospf message-digest-key 1 md5 TechwithRavish123
! Key ID and password must match on both sides
! Verify: show ip ospf interface g0/0

OSPF Advanced Features

OSPF Advanced Features

Route Summarisation

Inter-Area Summarisation (ABR — Type 3 LSAs)

! Summarise 10.1.0.0/24 and 10.1.1.0/24 → 10.1.0.0/23
R1(config-router)#area 1 range 10.1.0.0 255.255.254.0

External Summarisation (ASBR — Type 5 LSAs)

R1(config-router)#summary-address 192.168.0.0 255.255.252.0

OSPF Default Route

By default, OSPF does not advertise a default route. Use default-information originate on the router that has the default route.

! R2 has a static default route pointing to the Internet
R2(config)#ip route 0.0.0.0 0.0.0.0 <next-hop>
R2(config-router)#default-information originate

! Force advertisement even without a local default route
R2(config-router)#default-information originate always

! Other routers will see: O*E2 0.0.0.0/0 [110/1] via R2

OSPF Virtual Links

Connects a non-backbone area that cannot directly connect to Area 0. The virtual link runs through a transit area (must be a standard area — not stub).

! Area 2 disconnected from Area 0 via Area 1
! R1 in Area 0, R3 in Area 1 (also connects to Area 2)
! Virtual Link uses Router IDs, not interface IPs

R1(config-router)#area 1 virtual-link 3.3.3.3  ! R3's Router ID
R3(config-router)#area 1 virtual-link 1.1.1.1  ! R1's Router ID

R1#show ip ospf virtual-links  ! Verify virtual link status

OSPF Passive Interface

! Stops Hello packets on interface but still advertises the network
R1(config-router)#passive-interface FastEthernet0/1

! Best practice: make all passive, then allow specific ones
R1(config-router)#passive-interface default
R1(config-router)#no passive-interface GigabitEthernet0/0

OSPF Route Filtering

! ABR: Block 10.10.1.0/24 from Area 1 entering Area 0
R1(config)#ip prefix-list BLOCK_AREA1 seq 5 deny 10.10.1.0/24
R1(config)#ip prefix-list BLOCK_AREA1 seq 10 permit 0.0.0.0/0 le 32
R1(config-router)#area 1 filter-list prefix BLOCK_AREA1 in

OSPFv3 for IPv6

R1(config)#ipv6 unicast-routing
R1(config)#ipv6 router ospf 1
R1(config-rtr)#router-id 1.1.1.1  ! Must be configured manually
R1(config)#interface GigabitEthernet0/0
R1(config-if)#ipv6 ospf 1 area 0  ! Activate per interface

R1#show ipv6 ospf neighbor
R1#show ipv6 route ospf

OSPF Troubleshooting Guide

OSPF BGP Redistribution

! Redistribute BGP into OSPF
Router(config-router)#redistribute bgp 150 subnets

! Redistribute OSPF into BGP
Router(config)#router bgp 150
Router(config-router)#redistribute ospf 1

EIGRP Introduction

EIGRP — Enhanced IGRP

What is EIGRP?

EIGRP (Enhanced Interior Gateway Routing Protocol) is a Cisco-developed advanced distance-vector routing protocol that uses the DUAL algorithm for 100% loop-free, fast-converging routing.

Key Features

• Hybrid Protocol: Combines distance-vector and link-state characteristics
• DUAL Algorithm: Guarantees loop-free paths at all times, even during topology changes
• Incremental Updates: Only sends updates when topology changes — not periodic full updates like RIP
• Unequal-Cost Load Balancing: Uses variance to load balance across different-cost paths
• Multi-Protocol: Supports IPv4, IPv6, IPX, AppleTalk
• VLSM and CIDR: Classless routing supported
• MD5 Authentication: Protects routing updates
• SIA (Stuck-In-Active) Timer: 180 seconds — detects hung query states

Routing Codes

• D — Internal EIGRP route
• D EX — External EIGRP route (redistributed)

EIGRP Packet Types

EIGRP Configuration (IPv4)

! Classic mode
Router(config)#router eigrp 100        ! AS number = 100
Router(config-router)#no auto-summary  ! ALWAYS disable in modern networks
Router(config-router)#network 192.168.1.0 0.0.0.255
Router(config-router)#network 10.0.1.1 0.0.0.0  ! Exact host mask for loopback

! Verification
Router#show ip eigrp neighbors   ! Neighbour table
Router#show ip eigrp topology    ! Topology table (all paths)
Router#show ip route eigrp      ! Routing table (best paths only)

EIGRP for IPv6

! IPv6 EIGRP uses per-interface activation (no network command)
R1(config)#ipv6 unicast-routing
R1(config)#ipv6 router eigrp 100
R1(config-rtr)#eigrp router-id 1.1.1.1
R1(config-rtr)#no shutdown
R1(config)#interface GigabitEthernet0/0
R1(config-if)#ipv6 eigrp 100  ! Activate on interface

EIGRP DUAL & Tables

EIGRP DUAL Algorithm & Tables

Three EIGRP Tables

DUAL Terminology

! Example topology table output
R1#show ip eigrp topology

EIGRP Topology Table for AS(100)/ID(1.1.1.1)

P = Passive (stable), A = Active (calculating)
P 10.0.3.0/24, 1 successors, FD is 158720
        via 192.168.12.2 (158720/156160), GigabitEthernet0/0
                   ^-- FD    ^-- RD (Reported Distance)
        via 192.168.13.2 (161280/158720), GigabitEthernet0/1
                   ^-- This is a Feasible Successor if RD (158720) < Successor FD (158720)? No, equal = not FS

EIGRP Metric Formula

Composite Metric = 256 × [(10^7 / Min_BW_kbps) + (Sum_Delay_us / 10)]

K Values (default: K1=1, K2=0, K3=1, K4=0, K5=0)
Only Bandwidth and Delay are used by default

Example: 100 Mbps link, total delay 5200 μs
BW component  = 10^7 / 100000 = 100
Delay component = 5200 / 10  = 520
Metric        = 256 × (100 + 520) = 256 × 620 = 158720

Manipulating Metric for Path Control

! Change bandwidth to make a path less preferred
Router(config)#interface FastEthernet0/0
Router(config-if)#bandwidth 10000  ! Sets BW to 10 Mbps for EIGRP metric only
! This increases metric → makes this path less preferred

EIGRP Advanced

EIGRP Advanced Features

Load Balancing

Equal-Cost Load Balancing (ECMP)

When two or more paths have identical metrics, EIGRP installs all of them. Default max = 4 paths.

Unequal-Cost Load Balancing (Variance)

EIGRP's unique feature. Uses variance multiplier to include higher-cost Feasible Successors in load balancing.

! Example: Best path metric = 100, secondary = 150
! Without variance: only best path used
! With variance 2: paths up to 2×100=200 are used
! Since 150 ≤ 200 AND it's a Feasible Successor → both paths used

R1(config)#router eigrp 100
R1(config-router)#variance 2

! Routing table will show both paths:
D  10.0.4.0/24 [90/100] via 192.168.12.2
               [90/150] via 192.168.13.3

Auto-Summary and VLSM Issues

By default (old IOS), EIGRP summarises routes at classful boundaries when crossing major network boundaries. This can cause routing black holes with VLSM.

! Problem: R3 has 10.0.11.0/24, R4 has 10.0.12.0/24
! With auto-summary, both advertise as 10.0.0.0/8 → conflict!

! FIX: Always disable auto-summary in modern networks
R1(config-router)#no auto-summary

EIGRP Passive Interface

! Prevents EIGRP Hello packets on interface
! Network still advertised but no neighbour forms
R1(config-router)#passive-interface Loopback0

! Best practice: all passive, open only needed
R1(config-router)#passive-interface default
R1(config-router)#no passive-interface GigabitEthernet0/0

EIGRP Authentication (MD5)

! Step 1: Create key chain
R1(config)#key chain EIGRP_KEYS
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string CISCO123  ! Must match on peer

! Step 2: Apply to interface
R1(config-if)#ip authentication mode eigrp 100 md5
R1(config-if)#ip authentication key-chain eigrp 100 EIGRP_KEYS

! Verify
R1#show ip eigrp interfaces detail  ! Shows "Authentication mode is MD5"

EIGRP Stub Routing

In hub-and-spoke designs, spoke (stub) routers are configured as stubs to prevent unnecessary EIGRP queries traversing WAN links.

! Stub types:
! connected — only advertise directly connected
! summary   — only advertise summaries
! static    — only advertise static routes
! receive-only — advertise nothing (passive)

R1(config-router)#eigrp stub connected summary  ! Default stub
! Hub router must NOT be configured as stub

! Verify
R1#show ip protocols  ! Shows stub type

EIGRP Route Filtering

! Method 1: ACL-based distribute-list
R2(config)#access-list 10 deny 10.1.1.0 0.0.0.255
R2(config)#access-list 10 permit any
R2(config-router)#distribute-list 10 out FastEthernet0/1

! Method 2: Prefix-list based
R3(config)#ip prefix-list BLOCK_R1 seq 5 deny 1.1.1.1/32
R3(config)#ip prefix-list BLOCK_R1 seq 10 permit 0.0.0.0/0 le 32
R3(config-router)#distribute-list prefix BLOCK_R1 out GigabitEthernet0/1

! Method 3: Route-map based (advanced)
R3(config)#route-map FILTER deny 10
R3(config-route-map)#match ip address prefix-list BLOCK_R1
R3(config)#route-map FILTER permit 20
R3(config-router)#distribute-list route-map FILTER out GigabitEthernet0/1

EIGRP Redistribution

EIGRP ↔ OSPF

! On border router R2 running both EIGRP and OSPF
! Redistribute OSPF into EIGRP (metric required!)
R2(config-router)#redistribute ospf 1 metric 10000 100 255 1 1500
!                                             ^BW ^DLY ^Rel ^Load ^MTU

! Redistribute EIGRP into OSPF (subnets keyword required)
R2(config)#router ospf 1
R2(config-router)#redistribute eigrp 100 subnets

EIGRP ↔ BGP

! Redistribute EIGRP into BGP
R2(config)#router bgp 100
R2(config-router)#redistribute eigrp 100

! Redistribute BGP into EIGRP (metric required)
R2(config)#router eigrp 100
R2(config-router)#redistribute bgp 100 metric 10000 100 255 1 1500