-: Routing Issues. 2 2
In this video, we're going to discuss routing issues 3 3
that you may come across in your networks, 4 4
including multicast flooding, 5 5
asymmetrical routing and missing routes. 6 6
Now, first we're going to talk about multicast flooding. 7 7
If you remember, multicast networks operate 8 8
by sending out group communications 9 9
that are addressed to a group 10 10
of destination computers simultaneously. 11 11
For this to work, the multicast message is sent 12 12
to a single multicast address 13 13
and then the message can be distributed to the entire group. 14 14
This is great most of the time, 15 15
but sometimes things can malfunction 16 16
and a multicast flood can occur. 17 17
Now, multicast flooding happens when no specific host 18 18
is associated with the multicast MAC address 19 19
inside the CAM table of the switch. 20 20
When this occurs, multitask traffic is going to be flooded 21 21
throughout the entire local area network or VLAN, 22 22
creating unnecessary traffic and wasting network resources. 23 23
To prevent this issue, you need to configure your switch 24 24
to block unknown multicast packets. 25 25
Now, for the exam, 26 26
you don't need to know the specific commands 27 27
on how to block multicast traffic on a switchboard, 28 28
but you do need to know that blocking it 29 29
will solve this type of multicast flood issue. 30 30
Next, we have asymmetrical routing. 31 31
Asymmetrical routing occurs 32 32
when network packets leave via one path 33 33
and then return via a different path. 34 34
This can occur when traffic is flowing 35 35
across two different layer two bridge pair interfaces 36 36
on a router or a firewall 37 37
or when there's flows across different routers 38 38
or firewalls in a high availability cluster. 39 39
Now, if you're using Load Balancing 40 40
and using a protocol like HSRP, 41 41
asymmetric routing can occur 42 42
and it's something you need to think about. 43 43
This is a problem if you're using security devices 44 44
and network appliances to perform deep packet inspection 45 45
or you're using a stateful firewall, 46 46
because these devices need to see 47 47
all the packets associated with a given packet flow, 48 48
otherwise issues happen. 49 49
Now, while modern routers will attempt to forward packets 50 50
in a consistent next hop for each packet in the flow, 51 51
this only applies in one direction 52 52
when they do their forwarding. 53 53
Our routers will make no attempt in directing return traffic 54 54
to the originating router, because they only want to ensure 55 55
the fastest and most efficient delivery of those packets. 56 56
Now, this behavior presents problems for our firewalls 57 57
and our security appliance clusters, 58 58
because they don't support asymmetric routing, 59 59
because of the set of cluster nodes 60 60
all provide a path to the same networks. 61 61
So routers forwarding packets to networks 62 62
through the cluster can choose any of the cluster nodes 63 63
as their next hop. 64 64
And this causes asymmetric routing to occur 65 65
and the flow of packets in one direction 66 66
goes out a different node than what comes back 67 67
in the return path. 68 68
Because of this difference in packet flow, 69 69
network traffic can be dropped by one 70 70
or both of the firewalls in the cluster, 71 71
because they aren't seeing all the traffic 72 72
from the packet flow. 73 73
So how do we solve this problem? 74 74
Well, the solution to this is to adjust the placement 75 75
of your firewalls and internal routing 76 76
so that the traffic will flow in both directions 77 77
to the same firewall, even if the incoming traffic 78 78
is entering the network through a different router 79 79
than the router that handled the matching outgoing traffic. 80 80
Essentially, we need to put all our firewalls 81 81
closer to the systems they are protecting 82 82
instead of at the edge of the network 83 83
and this will avoid asymmetric routing problems. 84 84
Remember, asymmetric routing 85 85
doesn't cause any routing issues necessarily, 86 86
but they do cause issues with dropped packet flows, 87 87
because our security devices like firewalls 88 88
and unified threat management systems 89 89
need to be able to see the entire flow. 90 90
So you need to consider the design 91 91
of your network architecture 92 92
to prevent this issue from occurring. 93 93
If you don't, then packet flow drops are going to occur 94 94
and your clients can experience 95 95
network intermittent connectivity. 96 96
Finally, we need to talk about missing routes. 97 97
Now, missing routes occur 98 98
when a router cannot reach a destination 99 99
because there's a missing route inside the routing table. 100 100
These missing routes can occur 101 101
for lots of different reasons, 102 102
depending on what routing protocol is being used 103 103
to share that routing information. 104 104
Now, missing routes are commonly found as an issue 105 105
when network administrators are using static routes 106 106
and manually adding them to the routing tables. 107 107
If the administrator mistypes a route or the command, 108 108
the proper route will not get added to the routing table 109 109
and this causes problems. 110 110
So if you suspect you're missing a route, 111 111
you should enter the show IP route command 112 112
from the command line interface of your switch 113 113
and that'll display the routes available to it. 114 114
Now, if you're working on a Windows client or server, 115 115
you can enter the route print command 116 116
to see the routing table for your system. 117 117
If you're using dynamic routing protocols like OSPF or BGP, 118 118
there may also be issues where the routers 119 119
are not properly establishing their neighbor states 120 120
and this can cause the routers to not reach convergence 121 121
across their routing tables. 122 122
To troubleshoot this kind of issue, 123 123
you need to verify the dynamic routing protocols enabled 124 124
and if the two routers can communicate with each other. 125 125
To verify this, you should run the ping command 126 126
from one router to the destination router 127 127
and validate that connectivity exists. 128 128
If you identify that a route is missing, 129 129
you can statically add that route from the command line 130 130
or you can work with a network administrator 131 131
or network engineer 132 132
to troubleshoot the underlying dynamic routing protocols 133 133
that are being used by these routers.