1 1 00:00:00,660 --> 00:00:02,220 Routing Issues. 2 2 00:00:02,220 --> 00:00:04,640 In this video, we're going to discuss routing issues 3 3 00:00:04,640 --> 00:00:06,470 that you may come across in your networks, 4 4 00:00:06,470 --> 00:00:08,070 including multicast flooding, 5 5 00:00:08,070 --> 00:00:10,610 asymmetrical routing and missing routes. 6 6 00:00:10,610 --> 00:00:13,420 Now, first we're going to talk about multicast flooding. 7 7 00:00:13,420 --> 00:00:15,680 If you remember, multicast networks operate 8 8 00:00:15,680 --> 00:00:17,460 by sending out group communications 9 9 00:00:17,460 --> 00:00:18,500 that are addressed to a group 10 10 00:00:18,500 --> 00:00:21,120 of destination computers simultaneously. 11 11 00:00:21,120 --> 00:00:23,410 For this to work, the multicast message is sent 12 12 00:00:23,410 --> 00:00:25,120 to a single multicast address 13 13 00:00:25,120 --> 00:00:28,130 and then the message can be distributed to the entire group. 14 14 00:00:28,130 --> 00:00:29,760 This is great most of the time, 15 15 00:00:29,760 --> 00:00:31,740 but sometimes things can malfunction 16 16 00:00:31,740 --> 00:00:33,950 and a multicast flood can occur. 17 17 00:00:33,950 --> 00:00:36,730 Now, multicast flooding happens when no specific host 18 18 00:00:36,730 --> 00:00:38,750 is associated with the multicast MAC address 19 19 00:00:38,750 --> 00:00:40,910 inside the CAM table of the switch. 20 20 00:00:40,910 --> 00:00:43,490 When this occurs, multitask traffic is going to be flooded 21 21 00:00:43,490 --> 00:00:45,890 throughout the entire local area network or VLAN, 22 22 00:00:45,890 --> 00:00:49,300 creating unnecessary traffic and wasting network resources. 23 23 00:00:49,300 --> 00:00:51,760 To prevent this issue, you need to configure your switch 24 24 00:00:51,760 --> 00:00:54,030 to block unknown multicast packets. 25 25 00:00:54,030 --> 00:00:55,140 Now, for the exam, 26 26 00:00:55,140 --> 00:00:56,810 you don't need to know the specific commands 27 27 00:00:56,810 --> 00:00:59,340 on how to block multicast traffic on a switchboard, 28 28 00:00:59,340 --> 00:01:01,310 but you do need to know that blocking it 29 29 00:01:01,310 --> 00:01:04,040 will solve this type of multicast flood issue. 30 30 00:01:04,040 --> 00:01:06,420 Next, we have asymmetrical routing. 31 31 00:01:06,420 --> 00:01:07,750 Asymmetrical routing occurs 32 32 00:01:07,750 --> 00:01:09,980 when network packets leave via one path 33 33 00:01:09,980 --> 00:01:12,130 and then return via a different path. 34 34 00:01:12,130 --> 00:01:13,770 This can occur when traffic is flowing 35 35 00:01:13,770 --> 00:01:16,590 across two different layer two bridge pair interfaces 36 36 00:01:16,590 --> 00:01:18,140 on a router or a firewall 37 37 00:01:18,140 --> 00:01:20,420 or when there's flows across different routers 38 38 00:01:20,420 --> 00:01:23,280 or firewalls in a high availability cluster. 39 39 00:01:23,280 --> 00:01:25,020 Now, if you're using Load Balancing 40 40 00:01:25,020 --> 00:01:27,250 and using a protocol like HSRP, 41 41 00:01:27,250 --> 00:01:29,040 asymmetric routing can occur 42 42 00:01:29,040 --> 00:01:30,900 and it's something you need to think about. 43 43 00:01:30,900 --> 00:01:32,920 This is a problem if you're using security devices 44 44 00:01:32,920 --> 00:01:35,860 and network appliances to perform deep packet inspection 45 45 00:01:35,860 --> 00:01:37,970 or you're using a stateful firewall, 46 46 00:01:37,970 --> 00:01:39,441 because these devices need to see 47 47 00:01:39,441 --> 00:01:42,530 all the packets associated with a given packet flow, 48 48 00:01:42,530 --> 00:01:44,430 otherwise issues happen. 49 49 00:01:44,430 --> 00:01:46,990 Now, while modern routers will attempt to forward packets 50 50 00:01:46,990 --> 00:01:49,750 in a consistent next hop for each packet in the flow, 51 51 00:01:49,750 --> 00:01:51,790 this only applies in one direction 52 52 00:01:51,790 --> 00:01:53,110 when they do their forwarding. 53 53 00:01:53,110 --> 00:01:55,980 Our routers will make no attempt in directing return traffic 54 54 00:01:55,980 --> 00:01:58,410 to the originating router, because they only want to ensure 55 55 00:01:58,410 --> 00:02:01,470 the fastest and most efficient delivery of those packets. 56 56 00:02:01,470 --> 00:02:04,070 Now, this behavior presents problems for our firewalls 57 57 00:02:04,070 --> 00:02:05,800 and our security appliance clusters, 58 58 00:02:05,800 --> 00:02:08,060 because they don't support asymmetric routing, 59 59 00:02:08,060 --> 00:02:09,730 because of the set of cluster nodes 60 60 00:02:09,730 --> 00:02:12,410 all provide a path to the same networks. 61 61 00:02:12,410 --> 00:02:14,750 So routers forwarding packets to networks 62 62 00:02:14,750 --> 00:02:16,708 through the cluster can choose any of the cluster nodes 63 63 00:02:16,708 --> 00:02:18,290 as their next hop. 64 64 00:02:18,290 --> 00:02:20,620 And this causes asymmetric routing to occur 65 65 00:02:20,620 --> 00:02:22,360 and the flow of packets in one direction 66 66 00:02:22,360 --> 00:02:24,034 goes out a different node than what comes back 67 67 00:02:24,034 --> 00:02:25,710 in the return path. 68 68 00:02:25,710 --> 00:02:27,650 Because of this difference in packet flow, 69 69 00:02:27,650 --> 00:02:29,280 network traffic can be dropped by one 70 70 00:02:29,280 --> 00:02:31,010 or both of the firewalls in the cluster, 71 71 00:02:31,010 --> 00:02:32,810 because they aren't seeing all the traffic 72 72 00:02:32,810 --> 00:02:34,040 from the packet flow. 73 73 00:02:34,040 --> 00:02:36,020 So how do we solve this problem? 74 74 00:02:36,020 --> 00:02:38,300 Well, the solution to this is to adjust the placement 75 75 00:02:38,300 --> 00:02:40,340 of your firewalls and internal routing 76 76 00:02:40,340 --> 00:02:42,550 so that the traffic will flow in both directions 77 77 00:02:42,550 --> 00:02:45,430 to the same firewall, even if the incoming traffic 78 78 00:02:45,430 --> 00:02:47,430 is entering the network through a different router 79 79 00:02:47,430 --> 00:02:50,190 than the router that handled the matching outgoing traffic. 80 80 00:02:50,190 --> 00:02:52,590 Essentially, we need to put all our firewalls 81 81 00:02:52,590 --> 00:02:54,590 closer to the systems they are protecting 82 82 00:02:54,590 --> 00:02:56,220 instead of at the edge of the network 83 83 00:02:56,220 --> 00:02:58,850 and this will avoid asymmetric routing problems. 84 84 00:02:58,850 --> 00:03:00,550 Remember, asymmetric routing 85 85 00:03:00,550 --> 00:03:02,890 doesn't cause any routing issues necessarily, 86 86 00:03:02,890 --> 00:03:05,170 but they do cause issues with dropped packet flows, 87 87 00:03:05,170 --> 00:03:07,210 because our security devices like firewalls 88 88 00:03:07,210 --> 00:03:08,920 and unified threat management systems 89 89 00:03:08,920 --> 00:03:11,070 need to be able to see the entire flow. 90 90 00:03:11,070 --> 00:03:12,900 So you need to consider the design 91 91 00:03:12,900 --> 00:03:14,150 of your network architecture 92 92 00:03:14,150 --> 00:03:15,990 to prevent this issue from occurring. 93 93 00:03:15,990 --> 00:03:18,890 If you don't, then packet flow drops are going to occur 94 94 00:03:18,890 --> 00:03:20,120 and your clients can experience 95 95 00:03:20,120 --> 00:03:22,270 network intermittent connectivity. 96 96 00:03:22,270 --> 00:03:24,920 Finally, we need to talk about missing routes. 97 97 00:03:24,920 --> 00:03:25,840 Now, missing routes occur 98 98 00:03:25,840 --> 00:03:28,130 when a router cannot reach a destination 99 99 00:03:28,130 --> 00:03:30,900 because there's a missing route inside the routing table. 100 100 00:03:30,900 --> 00:03:32,200 These missing routes can occur 101 101 00:03:32,200 --> 00:03:33,680 for lots of different reasons, 102 102 00:03:33,680 --> 00:03:35,720 depending on what routing protocol is being used 103 103 00:03:35,720 --> 00:03:37,640 to share that routing information. 104 104 00:03:37,640 --> 00:03:39,797 Now, missing routes are commonly found as an issue 105 105 00:03:39,797 --> 00:03:42,430 when network administrators are using static routes 106 106 00:03:42,430 --> 00:03:44,880 and manually adding them to the routing tables. 107 107 00:03:44,880 --> 00:03:47,470 If the administrator mistypes a route or the command, 108 108 00:03:47,470 --> 00:03:49,880 the proper route will not get added to the routing table 109 109 00:03:49,880 --> 00:03:51,360 and this causes problems. 110 110 00:03:51,360 --> 00:03:53,710 So if you suspect you're missing a route, 111 111 00:03:53,710 --> 00:03:56,170 you should enter the show IP route command 112 112 00:03:56,170 --> 00:03:58,030 from the command line interface of your switch 113 113 00:03:58,030 --> 00:04:00,600 and that'll display the routes available to it. 114 114 00:04:00,600 --> 00:04:03,300 Now, if you're working on a Windows client or server, 115 115 00:04:03,300 --> 00:04:05,050 you can enter the route print command 116 116 00:04:05,050 --> 00:04:07,200 to see the routing table for your system. 117 117 00:04:07,200 --> 00:04:10,740 If you're using dynamic routing protocols like OSPF or BGP, 118 118 00:04:10,740 --> 00:04:12,380 there may also be issues where the routers 119 119 00:04:12,380 --> 00:04:14,670 are not properly establishing their neighbor states 120 120 00:04:14,670 --> 00:04:16,984 and this can cause the routers to not reach convergence 121 121 00:04:16,984 --> 00:04:19,050 across their routing tables. 122 122 00:04:19,050 --> 00:04:20,710 To troubleshoot this kind of issue, 123 123 00:04:20,710 --> 00:04:23,360 you need to verify the dynamic routing protocols enabled 124 124 00:04:23,360 --> 00:04:25,880 and if the two routers can communicate with each other. 125 125 00:04:25,880 --> 00:04:28,200 To verify this, you should run the ping command 126 126 00:04:28,200 --> 00:04:30,220 from one router to the destination router 127 127 00:04:30,220 --> 00:04:32,470 and validate that connectivity exists. 128 128 00:04:32,470 --> 00:04:34,400 If you identify that a route is missing, 129 129 00:04:34,400 --> 00:04:36,850 you can statically add that route from the command line 130 130 00:04:36,850 --> 00:04:38,810 or you can work with a network administrator 131 131 00:04:38,810 --> 00:04:39,910 or network engineer 132 132 00:04:39,910 --> 00:04:42,460 to troubleshoot the underlying dynamic routing protocols 133 133 00:04:42,460 --> 00:04:44,310 that are being used by these routers.