Twicking EIGRP metrics
September 2, 2008 at 5:35 pm | In EIGRP, Routing | Leave a CommentWhat if I want to prefer one EIGRP path over the other? Changing metrics of course ;-)
R1 —- R3 —- R2
Both R1 and R2 advertized 100.0.0.0/8 toward R3, but R1 advertises a better metrics, hence a prefered path. I want to make R3 to chose path via R2 instead.
We can change bandwidth or delay on R3 interface. Note that EIGRP uses the minimum bandwidth of the path as one of the metrics (BW). So bumping up the BW for interface connecting to R3 might not actually doing me any good. If we check the show ip ei topo for the route, we might still see minimum bandwidth metric the unchanged for the path via Serial1/3. Instead
- We can decrease bandwidth of Serial1/2 to let say 56K.
- Alternatively, you can give Serial1/3 a very high delay.
- Another option is to use offset-list
Here’s metric before the change
R3#sh ip ei topology 100.0.0.0/8 IP-EIGRP (AS 100): Topology entry for 100.0.0.0/8 State is Passive, Query origin flag is 1, 1 Successor(s), FD is 2244096 Routing Descriptor Blocks: 13.0.0.1 (Serial1/2), from 13.0.0.1, Send flag is 0x0 Composite metric is (2244096/1732096), Route is External Vector metric: Minimum bandwidth is 1500 Kbit Total delay is 21000 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 External data: Originating router is 13.0.0.1 AS number of route is 0 External protocol is Static, external metric is 0 Administrator tag is 0 (0x00000000) 23.0.0.2 (Serial1/3), from 23.0.0.2, Send flag is 0x0 Composite metric is (5537536/5025536), Route is External Vector metric: Minimum bandwidth is 512 Kbit Total delay is 21000 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 External data: Originating router is 23.0.0.2 AS number of route is 0 External protocol is Static, external metric is 0 Administrator tag is 0 (0x00000000) R3#sh ip route ei D EX 100.0.0.0/8 [170/2244096] via 13.0.0.1, 00:02:55, Serial1/2
Offset-list configuration
access-list 99 permit 100.0.0.0 0.255.255.255 router eigrp 100 offset-list 99 in 5000000 Serial1/2
R3#sh ip eigrp topology 100.0.0.0/8 IP-EIGRP (AS 100): Topology entry for 100.0.0.0/8 State is Passive, Query origin flag is 1, 1 Successor(s), FD is 5537536 Routing Descriptor Blocks: 23.0.0.2 (Serial1/3), from 23.0.0.2, Send flag is 0x0 Composite metric is (5537536/5025536), Route is External Vector metric: Minimum bandwidth is 512 Kbit Total delay is 21000 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 External data: Originating router is 23.0.0.2 AS number of route is 0 External protocol is Static, external metric is 0 Administrator tag is 0 (0x00000000) 13.0.0.1 (Serial1/2), from 13.0.0.1, Send flag is 0x0 Composite metric is (7244096/6732096), Route is External Vector metric: Minimum bandwidth is 1500 Kbit Total delay is 216312 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 External data: Originating router is 13.0.0.1 AS number of route is 0 External protocol is Static, external metric is 0 Administrator tag is 0 (0x00000000) R3#sh ip route ei D EX 100.0.0.0/8 [170/5537536] via 23.0.0.2, 00:01:21, Serial1/3
Active FTP vs Passive FTP
September 2, 2008 at 1:39 pm | In IOS services | 2 CommentsResource: Active FTP vs. Passive FTP, a Definitive Explanation
Active FTP
In active mode FTP the client connects from a random unprivileged port (N > 1023) to the FTP server’s command port, port 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client’s specified data port from its local data port, which is port 20.
From the server-side firewall’s standpoint, to support active mode FTP the following communication channels need to be opened:
- FTP server’s port 21 from anywhere (Client initiates connection)
- FTP server’s port 21 to ports > 1023 (Server responds to client’s control port)
- FTP server’s port 20 to ports > 1023 (Server initiates data connection to client’s data port)
- FTP server’s port 20 from ports > 1023 (Client sends ACKs to server’s data port)
This has a problem from a firewall perspective, because the server actively open a connection to port N+1. Also this cannot work with PAT where a NAT table have to be generated from inside, for the return traffic to come in.
Passive FTP
In order to resolve the issue of the server initiating the connection to the client a different method for FTP connections was developed. This was known as passive mode, or PASV, after the command used by the client to tell the server it is in passive mode.
In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends the PORT P command back to the client. The client then initiates the connection from port N+1 to port P on the server to transfer data.
From the server-side firewall’s standpoint, to support passive mode FTP the following communication channels need to be opened:
- FTP server’s port 21 from anywhere (Client initiates connection)
- FTP server’s port 21 to ports > 1023 (Server responds to client’s control port)
- FTP server’s ports > 1023 from anywhere (Client initiates data connection to random port specified by server)
- FTP server’s ports > 1023 to remote ports > 1023 (Server sends ACKs (and data) to client’s data port)
As a FTP client, by default, routers work in passive mode. To enable active mode, we need to config:
R5(config)#no ip ftp passive R5(config)#do sh run | in ftp no ip ftp passive R5(config)#do copy ftp://150.1.4.1/test.txt null:
Ftp server feature is no longer supported in newer IOS due to security reasons. In old IOS, we can enable FTP server using the following config.
R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#ip http server R1(config)#ftp-server enable R1(config)#ftp-server topdir flash:
Bellow are ACL to allow Active and Passive FTP traffic
ip access-list extended FROM_OUTSIDE ! Active FTP permit tcp any host 150.1.4.1 range ftp-data ftp ! Passive FTP permit tcp any host 150.1.4.1 eq ftp permit tcp any host 150.1.4.1 range 1023 65535
Blog at WordPress.com. | Theme: Pool by Borja Fernandez.
Entries and comments feeds.
