Cisco IOS access lists: 10 things you should know

If you work with Cisco routers, you're more than likelyfamiliar with Cisco IOS access control lists (ACLs). But that doesn't mean youknow all there is to know about these important gatekeepers. Access lists arean integral part of working with routers, and they're vital to security.

Because ACLs are a fundamental part of router administration,I want to address 10 things you should know about working with these lists. Ifyou're new to working with Cisco routers, this list offers a good foundation toget you started. But even if you've worked with Cisco routers for a while, itnever hurts to review the basics—you might even learn something new.

So, without any further ado, here are 10 things you need toknow about Cisco IOS access lists, beginning with the basic definition of anACL.

What is an access control list?

In the Cisco IOS, an access control list is a record thatidentifies and manages traffic. After identifying that traffic, an administratorcan specify various events that can happen to that traffic.

What's the most common type of ACL?

IP ACLs are the most popular type of access lists because IPis the most common type of traffic. There are two types of IP ACLs: standardand extended. Standard IP ACLs can only control traffic based on the SOURCE IPaddress. Extended IP ACLs are far more powerful; they can identify trafficbased on source IP, source port, destination IP, and destination port.

What are the most common numbers for IP ACLs?

The most common numbers used for IP ACLs are 1 to 99 forstandard lists and 100 to 199 for extended lists. However, many other rangesare also possible.

• Standard IP ACLs: 1 to 99 and 1300 to 1999
• Extended IP ACLs: 100 to 199 and 2000 to 2699

How can you filter traffic using ACLs?

You can use ACLs to filter traffic according to the "threeP's"—per protocol, per interface, and per direction. You can only have oneACL per protocol (e.g., IP or IPX), one ACL per interface (e.g.,FastEthernet0/0), and one ACL per direction (i.e., IN or OUT).

How can an ACL help protect
my network from viruses?

You can use an ACL as a packet sniffer to list packets thatmeet a certain requirement. For example, if there's a virus on your networkthat's sending out traffic over IRC port 194, you could create an extended ACL(such as number 101) to identify that traffic. You could then use the debug ip packet 101 detail command onyour Internet-facing router to list all of the source IP addresses that aresending packets on port 194.

What's the order of operations in an ACL?

Routers process ACLs from top to bottom. When the routerevaluates traffic against the list, it starts at the beginning of the list andmoves down, either permitting or denying traffic as it goes. When it has workedits way through the list, the processing stops.

That means whichever rule comes first takes precedence. Ifthe first part of the ACL denies traffic, but a lower part of the ACL allowsit, the router will still deny the traffic. Let's look at an example:

Access-list 1 permit anyAccess-list 1 deny host 10.1.1.1Access-list 1 deny any

What does this ACL permit? The first line permits anything.Therefore, all traffic meets this requirement, so the router will permit alltraffic, and processing will then stop.

What about traffic you don't specifically address in an ACL?

At the end of an ACL is an implicit deny statement. Whether you see the statement or not, the routerdenies all traffic that doesn't meet a condition in the ACL. Here's an example:

Access-list 1 deny host 10.1.1.1Access-list 1 deny 192.168.1.0 0.0.0.255

What traffic does this ACL permit? None: The router denies alltraffic because of the implicit deny statement.In other words, the ACL really looks like this:

Access-list 1 deny host 10.1.1.1Access-list 1 deny 192.168.1.0 0.0.0.255Access-list 1 deny ANY

Can I name an ACL?

Numbers—who needs numbers? You can also name your ACLs soyou can more easily identify their purpose. You can name both standard andextended ACLs. Here's an example of using a named ACL:

router(config)# ip access-list ?  extended        Extended Access List  log-update      Control access list log updates  logging         Control access list logging  resequence      Resequence Access List  standard        Standard Access Listrouter(config)# ip access-list extended test router(config-ext-nacl)#router(config-ext-nacl)# 10 deny ip any host 192.168.1.1router(config-ext-nacl)# exitrouter(config)# exitrouter# show ip access-listExtended IP access list test
    10 deny ip any host 192.168.1.1

What's a numbering sequence?

In the "old days," you couldn't edit an ACL—youcould only copy it to a text editor (such as Notepad), remove it, edit it innotepad, and then re-create it. In fact, this is still a good way to edit someCisco configurations.

However, this approach can also create a security risk.During the time you've removed the ACL to modify it, the router isn'tcontrolling traffic as needed. But it's possible to edit a numbered ACL withcommands. Here's an example:

router(config)# access-list 75 permit host 10.1.1.1router(config)#^Zrouter# conf tEnter configuration commands, one per line.  End with CNTL/Z.
router(config)# ip access-list standard 75
router(config-std-nacl)# 20 permit any router(config-std-nacl)# no 10 permit 10.1.1.1router(config-std-nacl)#^Z
router# show ip access-lists 75Standard IP access list 75
    20 permit anyrouter#

How else can I use an ACL?

ACLs aren't just for filtering traffic. You can also usethem for a variety of operations. Let's look at some of their possible otheruses:

• To control debug output: You can use the debug list X command to control debug output. By using this command before another debug command, the command only applies to what you've defined in the list.
• To control route access: You can use a routing distribute-list ACL to only permit or deny certain routes either into or out of your routing protocol.
• As a BGP AS-path ACL: You can use regular expressions to permit or deny BGP routes.
• For router management: You can use an ACL to control which workstation or network manages your router with an ACL and an access-class statement to your VTY lines.
• For encryption: You can use ACLs to determine how to encrypt traffic. When encrypting traffic between two routers or a router and a firewall, you must tell the router what traffic to encrypt, what traffic to send unencrypted, and what traffic to drop.

To wrap up this review, I'll leave you with one last tip: Don'tforget to use remark statements inyour ACLs. They'll come in handy when you have to troubleshoot something later.

Want to learn moreabout router and switch management? Automaticallysign up for our free Cisco Routers and Switches newsletter, delivered eachFriday!

David Davis has workedin the IT industry for 12 years and holds several certifications, includingCCIE, MCSE+I, CISSP, CCNA, CCDA, and CCNP. He currently manages a group ofsystems/network administrators for a privately owned retail company andperforms networking/systems consulting on a part-time basis.

Scaling IP Addresses with NAT (Network Address Translation) and PAT (Port Address Translation)

• By Stelios Antoniou
• September 13, 2007

A decade ago not too many people thought of having more than one PC at home. But today, having two or more personal computers is almost a necessity for many people. Back then, there was also only a small portion of home computer users subscribing to ADSL or Internet over cable. Currently, more and more people are subscribing to these broadband services.

The IP addressing scheme was not implemented with the extreme growth of the internet and the services related to it in mind. At the beginning, the problem of running out of IP addresses was just a theoretical one that could possibly happen in the far away future. But the future is here! The problem is not theoretical anymore — it is occurring this very moment. More and more users started to require permanent public IP addresses, adding to the problem, and a fast solution was needed.

This solution came with NAT: Network Address Translation and PAT: Port Address Translation. However, NAT does not provide a long-term solution. A more reliable and efficient solution has to do with a completely new addressing scheme called IPv6 which uses 128 bit addresses instead of the 32 used in IPV4.

NAT and PAT

The concept of NAT is based on the fact that every computer sending traffic outside its LAN to the Internet must be assigned a routable IP address. To conserve IP addresses, LAN users make use of a range of private IP addresses for routing local traffic. When a company, for example needs to send traffic to the Internet, via the ISP of course, an address translation takes place. Therefore the range of private IP addresses used by the company is translated to a single (or a small number) IP address.

The ranges of private IP addresses that can be used in the Local network and cannot be routed to the Internet include:

• 10.0.0.0 – 10.255.255.255/8
• 172.16.0.0 – 172.31.255.255/12
• 192.168.0.0 – 192.168.255.255/16

These IP addresses, in NAT terminology, are called “inside networks”. In other words, traffic originated from these networks and is destined for any other network outside private scope needs to be translated to a routable network, known as “outside network”.

Here are the NAT terms defined by Cisco:

• Inside local address: Is simply the private IP address assigned to the computer on the inside network.

• Inside global address: Is the IP address that is provided as a result of the translation process on the router and it represents the inside local or the range of inside local addresses.

• Outside local address: While packets traverse through the Internet to their final destination, they may encounter another translation. The IP address prior to the translation is called outside local since it belongs to an outside network and it’s the one known locally to the inside network.

• Outside global address: Is the IP address assigned to a host on the outside network by the host owner as a result of translation and comes from a globally routable address range.

NAT comes in three flavors:

• Static NAT: Provides one-to-one mapping between local and global addresses, consequently, every computer on the network must be allocated a single dedicated routable IP address.

• Dynamic NAT: A pool of routable IP addresses is configured on the router and dynamically the router assigns addresses from this pool to every machine that requires sending traffic to the “outside world”. This type of NAT needs good planning from the beginning so that the pool of IP addresses is enough to cover the traffic needs of the peak hour traffic to the Internet.

• PAT: Port address translation is another variation of NAT and the most popular one. It is also called NAT Overloading because it is designed to map many private IP addresses to just a single registered IP address (overloaded address) by applying different port addresses in the TCP or UDP header.

Inside Local Source Address Translation

Figure 1: NAT Example

The diagram above shows a router translating an inside source IP address to a source IP address for the outside network. Translation process follows these steps:

1. User at host 10.0.0.3 begins to send traffic to the router, destined for host at 212.31.80.2.
2. Upon receiving the first packet, the router checks its NAT table.
   1. If dynamic NAT is configured, the router picks up a free global address from its dynamic address pool (in the above example 179.2.2.80) and creates a translation entry into its NAT table.
   2. If static NAT is configured, the router automatically translates the inside local address: 10.0.0.3 with its equivalent global IP address: 179.2.2.80, and forwards the packet.
3. User at 212.31.80.2 replies to host 10.0.0.3 using the inside global destination address 179.2.2.80 (Destination address=179.2.2.80).
4. When the router receives the replied packet, it checks its NAT table again to find an entry for the inside global address 179.2.2.80. If a match is found, then the router translates the address back to its respective local address 10.0.0.3 and forwards it to the user.
5. The router continues to perform all the above steps for each packet it receives.

Static NAT Configuration

To configure static inside source address translation for the example shown in Figure 1, the following need to be performed on the router:

• Specify the inside interface:
  • Router(config)#interface ethernet0
  • Router(config-if)# ip nat inside
• Specify the outside interface:
  • Router(config)#interface serial0
  • Router(config-if)# ip nat outside
• Enter static translation entry ¹:
  • Router(config)# ip nat inside source static 10.0.0.3 179.2.2.80

Dynamic NAT Configuration

To configure dynamic inside source address translation for the example shown in figure 1, the following need to be performed:

• Specify the inside interface:
  • Router(config)#interface ethernet0
  • Router(config-if)# ip nat inside
  
  
• Specify the outside interface:
  • Router(config)#interface serial0
  • Router(config-if)# ip nat outside
  
  
• Define an Access List to permit the inside local addresses to be translated ²:
  • Router(config)#access-list 1 permit 10.0.0.0 0.0.0.255
  
  
• Define a pool of global addresses ³:
  • Router(config)# ip nat pool figure1 179.2.2.65 179.2.2.90 netmask 255.255.255.224
  
  
• Enter dynamic translation entry ⁴:
  • Router(config)# ip nat inside source list 1 pool figure1
  
  

Inside Global Address Overloading

Figure 2: NAT Overloading

From the above image, it can be seen that NAT overloading conserves register inside global IP addresses on the router. Inside local IP addresses are translated to a common global IP address and are distinguished between them by the use of different port numbers. Outside hosts do not see this translation; they believe they are talking to the same host with IP address 179.2.2.80, though they are actually talking to two different hosts.

NAT Overloading Configuration

To configure NAT Overloading for the example shown in figure 2, the following need to be performed:

• Specify the inside interface:
  • Router(config)#interface ethernet0
  • Router(config-if)# ip nat inside
  
  
• Specify the outside interface:
  • Router(config)#interface serial0
  • Router(config-if)# ip nat outside
  
  
• Define an Access List to permit the inside local addresses to be translated:
  • Router(config)#access-list 1 permit 10.0.0.0 0.0.0.255
  
  
• Enter dynamic translation entry ⁵:
  • Router(config)# ip nat inside source list 1 interface serial0 overload
  
  

Conclusion

NAT’s contribution to the reliability and existence of the Network society as known today has turned out to be extremely valuable. Although it does not provide a stable long-term solution it offers a lot of benefits. Conservation of IP addresses is the primary benefit of NAT through NAT Overloading. Theoretically up to 65000 hosts can be served by a single global IP address by using PAT. Security is another important benefit of NAT. Private networks hide their real identity therefore remain secure without revealing their network topology to the outside world.

Something important to keep in mind is that Cisco’s NAT implementation tries to preserve the original source port all the way through the translation. In the real world, NAT implementation assigns source port numbers dynamically and it’s up to the user’s instructions to allocate specific source port numbers.

---

¹ Router(config)# ip nat inside source static [local IP address] [global IP address]
² Router(config)# access-list [access list number] permit [source address] [source address wildcard]
³ Router(config)# ip nat pool [pool name] [start IP address] [end IP address] netmask [netmask]
⁴ Router(config)# ip nat inside source list [access list number] pool [pool name]
⁵ Router(config)# ip nat inside source list [access list number] interface [interface] overload

IPv6 Address Types from technet

IPv6 Address Types

IPv6 has three types of addresses, which can be categorized by type and scope:

• Unicast addresses. A packet is delivered to one interface.
  
  
• Multicast addresses. A packet is delivered to multiple interfaces.
  
  
• Anycast addresses. A packet is delivered to the nearest of multiple interfaces (in terms of routing distance).
  
  

IPv6 does not use broadcast messages.

Unicast and anycast addresses in IPv6 have the following scopes (for multicast addresses, the scope is built into the address structure):

• Link-local. The scope is the local link (nodes on the same subnet).
  
  
• Site-local. The scope is the organization (private site addressing).
  
  
• Global. The scope is global (IPv6 Internet addresses).
  
  

In addition, IPv6 has special addresses such as the loopback address. The scope of a special address depends on the type of special address.

Much of the IPv6 address space is unassigned.

Unicast IPv6 Addresses

IPv6 has several major unicast address types.

Unicast global addresses

IPv6 unicast global addresses are similar to IPv4 public addresses. Also known as aggregatable global unicast addresses, global addresses are globally routable. The structure of an IPv6 unicast global address creates the three-level topology shown in the following illustration.

Table 1.7 explains each field in a unicast global address.

Table 1.7 Fields in a Unicast Global Address

Field	Description
001	Identifies the address as an IPv6 unicast global address.
Top Level Aggregation Identifier (TLA ID)	Identifies the highest level in the routing hierarchy. TLA IDs are administered by IANA, which allocates them to local Internet registries, which then allocate a given TLA ID to a global ISP.
Res	Reserved for future use (to expand either the TLA ID or the NLA ID).
Next Level Aggregation Identifier (NLA ID)	Identifies a specific customer site.
Site Level Aggregation Identifier (SLA ID)	Enables as many as 65,536 (216) subnets within an individual organization’s site. The SLA ID is assigned within the site; an ISP cannot change this part of the address.
Interface ID	Identifies the interface of a node on a specific subnet.

Unicast site-local addresses

IPv6 unicast site-local addresses are similar to IPv4 private addresses. The scope of a site-local address is the internetwork of an organization’s site. (You can use both global addresses and site-local addresses in your network.) The prefix for site-local addresses is FEC0::/48.

The following illustration shows the structure of a site-local address.

The initial 48 fixed bits are followed by a 16-bit Subnet ID field, which provides as many as 65,536 subnets in a flat subnet structure. Alternatively, you can subdivide the high-order bits of the Subnet ID field to create a hierarchical routing infrastructure. The last field is a 64-bit Interface ID field that identifies the interface of a node on a specific subnet.

Note

• Global addresses and site-local addresses share the same structure after the first 48 bits — the 16-bit SLA ID of a global address and the 16-bit Subnet ID of a site-local address both identify the subnets of an organization’s site. Because of this, you can assign a specific subnet number to identify a subnet that is used for both global and site-local unicast addresses.
  
  

Unicast link-local addresses (FE80::/64)

IPv6 unicast link-local addresses are similar to IPv4 APIPA addresses used by computers running Microsoft Windows. Hosts on the same link (the same subnet) use these automatically configured addresses to communicate with each other. Neighbor Discovery provides address resolution. The prefix for link-local addresses is FE80::/64. The following illustration shows the structure of a link-local address.

Unicast unspecified address

The IPv6 unicast unspecified address is equivalent to the IPv4 unspecified address of 0.0.0.0. The IPv6 unspecified address is 0:0:0:0:0:0:0:0:, or a double colon (::).

Unicast loopback address

The IPv6 unicast loopback address is equivalent to the IPv4 loopback address, 127.0.0.1. The IPv6 loopback address is 0:0:0:0:0:0:0:1, or ::1.

Unicast 6to4 addresses (2002::/16)

IPv6 uses 6to4 addresses to communicate between two IPv6/IPv4 nodes over the IPv4 Internet. A 6to4 address combines the prefix 2002::/16 with the 32 bits of the public IPv4 address of the node to create a 48-bit prefix — 2002:WWXX:YYZZ::/48, where WWXX:YYZZ is the colon-hexadecimal representation of w.x.y.z, a public IPv4 address. Therefore, the IPv4 address 157.60.91.123 translates into a 6to4 address prefix of 2002:9D3C:5B7B::/48.

The following illustration shows the structure of a 6to4 address.

However, this is often written using the hexadecimal prefix: 2002:WWXX:YYZZ:SLA ID:Interface ID.

The following example shows how the WWXX:YYZZ portion of the address is translated from colon-hexadecimal notation to dotted-decimal notation. In this example, 9D3C:5B7B translates to 157.60.91.123, as illustrated in the following example.

Notation Type	Use a calculator to convert each constituent number from one notation type to the other
Colon-hexadecimal	9D 3C 5B 7B
Dotted-decimal	157 60 91 123

For more information about 6to4 tunneling, see "Routing IPv6 Traffic over an IPv4 Infrastructure" later in this chapter.

Unicast ISATAP addresses

IPv6 uses ISATAP addresses to communicate between two IPv6/IPv4 nodes over an IPv4 intranet. An ISATAP address combines a 64-bit unicast link-local, site-local, or global prefix (a global prefix might be a 6 to 4 prefix) with a 64-bit suffix constructed of the ISATAP identifier 0:5EFE, followed by the IPv4 address assigned to an interface of the host. The prefix is known as the subnet prefix. Although a 6to4 address can incorporate only a public IPv4 address, an ISATAP address can incorporate either a public or a private IPv4 address.

The following illustration shows the structure of an ISATAP address.

Table 1.8 shows an example of each type of ISATAP address.

Table 1.8 Examples of ISATAP addresses

Type of ISATAP Address	ISATAP Address
With link-local prefix	FE80::5EFE:131.107.129.8*
With site-local prefix	FEC0::1111:0:5EFE:131.107.129.8*
With global prefix	3FFE:1A05:510:1111:0:5EFE:131.107.129.8*
With global 6to4 prefix	2002:9D36:1:2:0:5EFE:131.107.129.8*

*Alternatively, the IPv4 address (in this example, 131.107.129.8) can be written in hexadecimal (in this example, 836B:8108).

By default, the IPv6 protocol for Windows XP and members of Windows Server 2003 automatically configures the ISATAP address of FE80::5EFE:w.x.y.z for each IPv4 address that is assigned to the node. This link-local ISATAP address allows two hosts to communicate over an IPv4 network by using each other’s ISATAP address.

For more information about ISATAP tunneling, see "Routing IPv6 Traffic over an IPv4 Infrastructure" later in this chapter.

Multicast IPv6 Addresses

IPv6 multicast addresses are similar to IPv4 multicast addresses. Packets addressed to a multicast address are delivered to all interfaces that the address identifies.

The following illustration shows the structure of an IPv6 multicast address.

Table 1.9 explains each field in an IP multicast address. The prefix for multicast addresses is FF00::/8.

Table 1.9 Fields in a Multicast Address

Field	Description
1111 1111	Identifies the address as an IP multicast address.
Flags	Currently, the only defined flag is the Transient (T) flag. Set to zero, the T flag identifies the address as a permanently assigned multicast address. Set to 1, it identifies a transient address.
Scope	Indicates the scope of the multicast traffic, such as interface-local, link-local, site-local, organization-local, or global scope.
Group ID	identifies the multicast group.

Multicast solicited node address

The IPv6 multicast solicited node address is used for efficient address resolution. The IPv4 ARP Request frame is sent to the MAC-level broadcast, which disturbs all nodes on the network segment. The multicast solicited node address combines the prefix FF02::1:FF00:0/104 with the last 24 bits of the IPv6 address being resolved. IPv6 uses the solicited node multicast address for the Neighbor Solicitation message (the IPv6 equivalent to the ARP Request frame) that resolves an IPv6 address to its link-layer address, disturbing few nodes during the address resolution process.

Anycast IPv6 Addresses

Anycast IPv6 addresses are similar to but more efficient than the anycast addresses in IPv4, which are used primarily by large ISPs. Anycast addresses use the unicast address space but function differently from other unicast addresses. IPv6 uses anycast addresses to identify multiple interfaces. IPv6 delivers packets addressed to an anycast address to the nearest interface that the address identifies. In contrast to a multicast address, where delivery is from one to many, an anycast address delivery is from one to one-of-many. Currently, anycast addresses are assigned only to routers and are used only as destination addresses.

http://technet.microsoft.com/en-us/library/cc757359%28WS.10%29.aspx

Why IPv6: What CCNA Candidates Need to Know About IPv6

• By Tracey Wilson
• February 10, 2010

One of the components of the current CCNA Exam (640-802) is a basic understanding of the new IPv6 protocol and some transition steps to utilize IPv6 in existing IPv4 network implementations.

But before you begin to study the formats and functionality of IPv6 for your CCNA exam, you should have a firm grasp of why this new protocol is needed and its role in the future of networking.

In this article, we will walk the history of this protocol, investigate some of the issues driving IPv6 to the forefront, and finally look at who is using IPv6 today and what can be expected in the future.

A Brief History of IPv6

As early as 1990, experts began to predict the current IPv4 address space with its current rate of growth would soon run out.

The unicast available IP Classes at the time were A, B, and C. In 1992, Classless Internet Domain Routing, or CIDR, was introduced to summarize IPv4 blocks more efficiently and slow the exponential growth pattern of the global Internet routing table.

Later in 1993, the Internet Engineering Task Force (IETF) recognized the need for a new protocol to address many of the current IPv4 shortcomings and started a working group designated IP Next Generation (IPng) to organize its development.

In 1994, many of the Internet standards committees approved this new protocol and it was assigned version number 6.

As part of early deployments, IPv6 test beds were created to generate exposure to the new protocol starting with the first IPv6 backbone, 6bone, which was created in 1996. The first IPv6 exchange point, 6TAP, was developed one year later at the Chicago STARTAP exchange point.

In 1999, the regional Internet registries (RIRs), the organizations responsible for assigning IP address space, began assigning the first block of global IPv6 prefixes for widespread use. As early as 1996 operating system providers were developing specialized patches to support the new protocol, but most mainline releases were not available with some basic IPv6 capability until 1999.

In 2001, the IPng working group officially changed its name to IPv6.

A Look at the IPv6 Issues

Now that we’re aware of the brief history of this new protocol, let us look more in depth at some of the reasons for why it was needed.

In this article, we will focus on three of the primary issues:

• IPv4 address exhaustion,
• growth of the global Internet routing table,
• and the disparity in regional allocation of addresses.

IPv4 Address Exhaustion

As I mentioned before, the IPv4s address space was seen to be limited and with the development of the World Wide Web, exhaustion of those addresses became more and more apparent.

To illustrate this issue, let us look at the current IP address allocation (Figure 1) computed from data recorded for the Internet Assigned Numbers Authority (IANA) as of January 2010. The IANA is the organization responsible for coordinating the DNS root domain, allocating IP addresses to the RIRs, and managing various Internet protocol number assignments.

As you can see from the chart, the unassigned portion of the IPv4 space is now only 10% and other addresses are either private or are not usable as they have been designated for multicast or still slotted for testing or further use (Class D and E addresses).

In 2002, this unassigned portion of addresses was at 28%. Various experts on IP allocation and address exhaustion continue to debate the timeframe when the addressing space will run out. Dates vary from late 2011 to early 2015, but the majority of them believe that 2013 is the most likely target.

The IPv4 address structure is comprised of 32 bits for a total of 232 or 4,294,967,296 addresses. With all the subtractions for network numbers, broadcast addresses, and private or unusable address blocks, the number of usable addresses is much less. IPv6 has a 128 bit structure which supports a total of 2128 or 3.4 x1038 addresses, seemingly enough to provide addresses for the next few decades.

A colleague of mine, who has served on IETF working groups, once told me, “There are enough IPv6 addresses for every blade of grass on the planet.” I believe he might be right.

The Growth of the Global Internet Routing Table

Another issue that has promoted the need for a new IP layer protocol is the rapid growth of the global Internet routing table.

Ever since 1992, the Internet routing table has been on an exponential growth curve. CIDR with its route summarization and the addition of route aggregates have slowed the growth, but the table today does not have a well defined hierarchy and as the size continues to grow, efficient routing will become more difficult.

IPv6 was designed to have a much more hierarchical structure to support aggregate routes for more efficient and scalable routing. To provide a better understanding of the growth issue, Figure 2 shows the growth pattern of the routing table over the past two decades.

Figure 2: Global Internet Routing Table Growth from www.cidr-report.org.

The Disparity in Regional Allocation of Addresses

The last issue we will cover today is the regional assignment of the current IPv4 address space. As I mentioned before, the five RIRs are responsible for assigning IP addresses. Each RIR covers a specific region as shown below:

1. ARIN – North America and parts of the Caribbean and North Atlantic Islands
2. AfriNIC – Africa and parts of the Indian Ocean
3. APNIC – Portions of Asia and the Pacific Ocean
4. LACNIC – Latin American and part of the Caribbean
5. RIPE NCC – Europe, the Middle East, and central Asia

Due to the fast growth of the Internet in the North American region, nearly 75% of the IPv4 address space has been allocated in that region. Many countries like India, China, and other densely populated areas were left with minimal allocations.

In response to this issue, the IPv6 protocol was designed with a Global Prefix structure that includes plenty of addresses to support balanced allocations across the world.

Who is Using IPv6 Today and What Might We Expect?

Today, IPv6 is deployed in various countries around the world. IPv6 can be deployed as a native IP protocol or “dual-stacked” with IPv4 running on the same interfaces.

China has deployed two of the world’s largest native IPv6 networks and over 50% of South Korean homes utilize broadband connections with IPv6. Japan has developed a nationwide dual-stacked network and European countries are rolling out IPv6 for commercial and government use.

In the United States, the use of this protocol has not been as pronounced. Much of the commercial world has not embraced the need at this time due to the availability of IPv4 addresses in the region. However, the United States Government Office of Management and Budget issued a directive requiring all federal agencies to be IPv6 compliant by June 30, 2008.

IPv6 was not intended to be running on all agencies networks, but all hardware and software must support the new protocol and plans must be in place for a smooth transition to a dual-stacked or native implementation.

This implementation plan and the ever approaching exhaustion of IPv4 addresses will eventually move the North American commercial world to utilize IPv6 mainstream, but only time will tell.

Cool Subnetting Tricks with Variable Length Subnet Mask

• By Stelios Antoniou
• April 8, 2008

A few months back, I showed you how to organize your network into smaller subnets. My post covered the details of the concept of subnetting. So if you missed that article, I would suggest taking a look at it to make sure you understand VLSM and this article in its entirety. For now, I will assume that you are already familiar with subnetting and know how to divide a network into smaller subnets.

In today’s article, we’ll subnet an already subnetted network into multiple subnets with variable subnet masks and then allocate them within our sample network.

Variable Length Subnet Mask (VLSM) is a key technology on large scalable networks. Mastering the concept of VLSM is not an easy task, but it’s well worth it. The importance of VLSM and its beneficial contribution to networking design is unquestionable. At the end of this article you will be able to understand the benefits of VLSM and describe the process of calculating VLSMs. I will use a real world example to help you understand the whole process and its beneficial effects.

Benefits of VLSM

VLSM provides the ability to subnet an already subnetted network address. The benefits that arise from this behavior include:

Efficient use of IP addresses: IP addresses are allocated according to the host space requirement of each subnet.

IP addresses are not wasted; for example, a Class C network of 192.168.10.0 and a mask of 255.255.255.224 (/27) allows you to have eight subnets, each with 32 IP addresses (30 of which could be assigned to devices). What if we had a few WAN links in our network (WAN links need only one IP address on each side, hence a total of two IP addresses per WAN link are needed).

Without VLSM that would be impossible. With VLSM we can subnet one of the subnets, 192.168.10.32, into smaller subnets with a mask of 255.255.255.252 (/30). This way we end up with eight subnets with only two available hosts each that we could use on the WAN links.

The /30 subnets created are: 192.168.10.32/30, 192.168.10.36/30, 192.168.10.40/30, 192.168.10.44/30, 192.168.10.48/30, 192.168.10.52/30, 192.168.10.56/30 192.168.10.60/30.

Support for better route summarization: VLSM supports hierarchical addressing design therefore, it can effectively support route aggregation, also called route summarization.

The latter can successfully reduce the number of routes in a routing table by representing a range of network subnets in a single summary address. For example subnets 192.168.10.0/24, 192.168.11.0/24 and 192.168.12.0/24 could all be summarized into 192.168.8.0/21.

Address Waste Without VLSM

The following diagram shows a sample internetwork which uses a network C address 192.168.10.0 (/24) subnetted into 8 equal size subnets (32 available IP addresses each) to be allocated to the various portions of the network.

This specific network consists of 3 WAN links that are allocated a subnet address range each from the pool of available subnets. Obviously 30 IP address are wasted (28 host addresses) since they are never going to be used on the WAN links.

Implementing VLSM

In order to be able to implement VLSMs in a quick and efficient way, you need to understand and memorize the IP address blocks and available hosts for various subnet masks.

Create a small table with all of this information and use it to create your VLSM network. The following table shows the block sizes used for subnetting a Class C subnet.

Having this table in front of you is very helpful. For example, if you have a subnet with 28 hosts then you can easily see from the table that you will need a block size of 32. For a subnet of 40 hosts you will need a block size of 64.

Example: Create a VLSM Network

Let us use the sample network provided above to implement VLSM. According to the number of hosts in each subnet, identify the addressing blocks required. You should end up with the following VLSM table for this Class C network 192.168.10.0/24.

Take a deep breath … we’re almost done. We have identified the necessary block sizes for our sample network.

The final step is to allocate the actual subnets to our design and construct our VLSM network. We will take into account that subnet-zero can be used in our network design, therefore the following solution will really allow us to save unnecessary addressing waste:

With VLSM we have occupied 140 addresses. Nearly half of the address space of the Class C network is saved. The address space that remains unused is available for any future expansion.

Isn’t that amazing? We have reserved a great amount of addresses for future use. Our sample network diagram is finalized as shown on the following diagram:

Final Thoughts

Variable Length Subnet Mask is an extremely important chapter in Network Design. Honestly, if you want to design and implement scalable and efficient networks, you should definitely learn how to design and implement VLSM.

It’s not that difficult once you understand the process of block sizes and the way to allocate them within your design. Don’t forget that VLSM relates directly to the subnetting process, therefore mastering the subnetting process is a prerequisite for effectively implementing VLSM. And feel free to go through my subnetting articles a couple of times to get a hang of the whole process.