Статья в MikroTik Wiki об OSPF

Вчера практиковался с OSPF в целях подготовки к сдаче BSCI. Так как в моей лаборатории маршрутизаторов Cisco всего 2, то ещё двумя недостающими оказались RouterBOARD. Постепенно выяснилось, что просуммировать внешние маршруты, поступающие в OSPF область с помощью средств RouterOS по аналогии с IOS (например, summary-address 10.0.0.0 255.255.255.0) нельзя, а в MikroTik wiki про это информации почти нет (суммирование делается через route filters). В связи с этим решил написать эту статью.

Русская версия статьи здесь.

OSPF Summarization and redistribution complex example

Материал из MikroTik Wiki.

Перейти к: навигация, поиск

Содержание 1 OSPF routes redistribution, summarization and stub area complex example 1.1 Basic OSPF configuration 1.2 Redistributing static routes and summarization 1.3 Area 1 in stub configuration

Packages required: routing

Let's look at the network topology shown below. We have three routers connected to each other via ethernet. Routers R0 and R1 are MikroTik RouterBOARDs running RouterOS 3.25 and router R2 is Cisco 2611. R2 can be any other router, so cisco is taken just for example. Loopback interface on R0 also is just for example because I do not have ether3 on this router.

Basic OSPF configuration

OSPF areas configuration is introduced below:

Router R1 is Area Border Router. We will make summarization here.

First of all let's configure basic parametrs on our routers.

R0 without external routes summarization

/ip address
add address=192.168.88.2/25 broadcast=192.168.88.127 comment="" disabled=no \
interface=ether1 network=192.168.88.0
add address=192.168.88.129/25 broadcast=192.168.88.255 comment="" disabled=no \
interface=ether2 network=192.168.88.128
add address=192.168.85.1/24 broadcast=192.168.85.255 comment="" disabled=no \
interface=loopback0 network=192.168.85.0

This blackhole route will emulate remote network 192.168.84.0/24, which is reachable via static route:

/ip route
add disabled=no distance=1 dst-address=192.168.84.0/24 type=blackhole

Here we will start OSPF process on router R0 and change default parameters to enable redistribution of connected and static routes. Also we will add 192.168.88.0/24 network to OSPF routing process:

/routing ospf area
set backbone area-id=0.0.0.0 authentication=none disabled=no name=backbone \
type=default
/routing ospf
set distribute-default=never metric-bgp=20 metric-connected=20 \
metric-default=1 metric-rip=20 metric-static=20 mpls-te-area=unspecified \
mpls-te-router-id=unspecified redistribute-bgp=no redistribute-connected=\
as-type-1 redistribute-rip=no redistribute-static=as-type-1 router-id=0.0.0.0
/routing ospf network
add area=backbone disabled=no network=192.168.88.0/24

Lets's look at R0 routing table:

[admin@R0] > /ip route print Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#      DST-ADDRESS        PREF-SRC        GATEWAY-STATE GATEWAY               DISTANCE INTERFACE
1 A SB 192.168.84.0/24                                                        1
2 ADC  192.168.85.0/24    192.168.85.1                                        0        loopback0
3 ADC  192.168.88.0/25    192.168.88.2                                        0        ether1
4 ADC  192.168.88.128/25  192.168.88.129                                      0        ether2
5 ADo  192.168.89.64/26                   reachable     192.168.88.3          110      ether1

R1 without inter-area summarization

/ip address
add address=192.168.88.3/25 broadcast=192.168.88.127 comment="" disabled=no \
interface=ether1 network=192.168.88.0
add address=192.168.89.66/26 broadcast=192.168.89.127 comment="" disabled=no \
interface=ether2 network=192.168.89.64

In the same way we will start OSPF process on router R1 as on R0. Similarly, we will add 192.168.89.64/26 and 192.168.88.0/25 networks to OSPF routing process:

/routing ospf area
set backbone area-id=0.0.0.0 authentication=none disabled=no name=backbone \
type=default
add area-id=0.0.0.1 authentication=none default-cost=1 disabled=no \
inject-summary-lsa=no name=area1 type=default
/routing ospf
set distribute-default=never metric-bgp=20 metric-connected=20 \
metric-default=1 metric-rip=20 metric-static=20 mpls-te-area=unspecified \
mpls-te-router-id=unspecified redistribute-bgp=no redistribute-connected=\
no redistribute-rip=no redistribute-static=no router-id=0.0.0.0
/routing ospf network
add area=area1 disabled=no network=192.168.89.64/26
add area=backbone disabled=no network=192.168.88.0/25

Lets's look at R1 routing table:

Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#      DST-ADDRESS        PREF-SRC        GATEWAY-STATE GATEWAY               DISTANCE INTERFACE
0 ADo  192.168.84.0/24                    reachable     192.168.88.2          110      ether1
1 ADo  192.168.85.0/24                    reachable     192.168.88.2          110      ether1
2 ADC  192.168.88.0/25    192.168.88.3                                        0        ether1
3 ADo  192.168.88.128/25                  reachable     192.168.88.2          110      ether1
4 ADC  192.168.89.64/26   192.168.89.66                                       0        ether2

R2 configuration

R2 configuration is very simple even if you don't know the syntax of Cisco IOS configuration:

interface Ethernet0/0
ip address 192.168.89.65 255.255.255.192
!
interface Ethernet0/1
ip address 192.168.89.1 255.255.255.192
!
router ospf 1
network 192.168.89.64 0.0.0.63 area 1
!

0.0.0.63 is wildcard mask for network mask 255.255.255.192. Corresponding RouterOS configuration should look like this:

/routing ospf network
add area=area1 disabled=no network=192.168.89.64/26

Lets's look at R2 routing table (output omitted):

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
ia - IS-IS inter area, * - candidate default, U - per-user static route
...
192.168.89.0/26 is subnetted, 2 subnets
C       192.168.89.0 is directly connected, Ethernet0/1
C       192.168.89.64 is directly connected, Ethernet0/0
192.168.88.0/25 is subnetted, 2 subnets
O IA    192.168.88.0 [110/20] via 192.168.89.66, 00:10:10, Ethernet0/0
O IA    192.168.88.128 [110/30] via 192.168.89.66, 00:10:14, Ethernet0/0
O E1 192.168.85.0/24 [110/40] via 192.168.89.66, 00:09:28, Ethernet0/0
O E1 192.168.84.0/24 [110/40] via 192.168.89.66, 00:09:57, Ethernet0/0

Redistributing static routes and summarization

It's time to start inter-area routes and external routes summarization.

R0

Let's add blackhole summary route for static route 192.168.84.0/24 and connected route 192.168.85.0/24:

/ip route
add comment="" disabled=no distance=254 dst-address=192.168.84.0/23 type=\
blackhole

With help of routing filter we will allow only summary route advertisement:

/routing filter
add action=accept chain=ospf-out comment="" disabled=no invert-match=no \
prefix=192.168.84.0/23
add action=discard chain=ospf-out comment="" disabled=no invert-match=no

Let's look at the routing table of R0 again:

[admin@R0] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#      DST-ADDRESS        PREF-SRC        GATEWAY-STATE GATEWAY               DISTANCE INTERFACE
0 A SB 192.168.84.0/23                                                        254
1 A SB 192.168.84.0/24                                                        1
2 ADC  192.168.85.0/24    192.168.85.1                                        0        loopback0
3 ADC  192.168.88.0/25    192.168.88.2                                        0        ether1
4 ADC  192.168.88.128/25  192.168.88.129                                      0        ether2
5 ADo  192.168.89.0/24                   reachable     192.168.88.3          110      ether1

Notice that route number 0 was added.

R1

R1 is Area Border Router. Here we can make inter-area summarization. Inter-area summarization was made with help of area ranges. Networks 192.168.88.0/25 and 192.168.88.128/25 are combined in 192.168.88.0/24. Network 192.168.89.64/26 is summarized in 192.168.89.0/24 (f.e. for future use):

/routing ospf area range
add advertise=yes area=backbone cost=default disabled=no range=192.168.88.0/24
add advertise=yes area=area1 cost=default disabled=no range=192.168.89.0/24

Let's look at the routing table after aggregation and summarization:

Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#      DST-ADDRESS        PREF-SRC        GATEWAY-STATE GATEWAY               DISTANCE INTERFACE
0 ADo  192.168.84.0/23                    reachable     192.168.88.2          110      ether1
1 ADC  192.168.88.0/25    192.168.88.3                                        0        ether1
2 ADo  192.168.88.128/25                  reachable     192.168.88.2          110      ether1
3 ADoU 192.168.89.0/24                                                        110
4 ADC  192.168.89.64/26   192.168.89.66                                       0        ether2

Notice that route number 3 for 192.168.89.0/24 is presented as unreachable.
This route is created automatically by routing process because it can't announce network until it have not any route to it (this is similarly to cisco ios behavior which creates automatic route to Null0 interface for such purpose).

R2

New routing table on router R2 will look as follows:

    192.168.89.0/26 is subnetted, 2 subnets
C       192.168.89.0 is directly connected, Ethernet0/1
C       192.168.89.64 is directly connected, Ethernet0/0
O IA 192.168.88.0/24 [110/30] via 192.168.89.66, 00:00:02, Ethernet0/0
O E1 192.168.84.0/23 [110/40] via 192.168.89.66, 00:00:02, Ethernet0/0

Area 1 in stub configuration

Finally let's configure area1 as a stub area. For this purpose we will configure area type as stub on both R1 and R2. In other case routers will not agree the Stub Area Flag and will not form the adjacency (like then authentication parameters did not match).

R1

/routing ospf area
add area-id=0.0.0.1 authentication=none disabled=no name=area1 type=stub

R2

router ospf 1
area 1 stub
network 192.168.89.64 0.0.0.63 area 1

Routing from the stub area is made via default route:

     192.168.89.0/26 is subnetted, 2 subnets
C       192.168.89.0 is directly connected, Ethernet0/1
C       192.168.89.64 is directly connected, Ethernet0/0
O*IA 0.0.0.0/0 [110/11] via 192.168.89.66, 00:06:33, Ethernet0/0

Борьба со спамом в Mikrotik RouterOS

Все достаточно просто. Первая конфигурация предназначена для ограничения одновременных подключений на 25й tcp порт. Добавляет в address-list "spammer" на 12 часов заданный ip-адрес. Не допускается более 30 одновременных соединений. Грубо, но эффективно. Однако, соответствует политике защищенной сети.

#Конфигурация для борьбы со спамом 1
/ip firewall filter
add action=drop chain=forward comment="bloack spam" disabled=no dst-port=25 protocol=tcp \
src-address-list=spammer
add action=add-src-to-address-list address-list=spammer address-list-timeout=\
1d chain=forward comment="detect spam" connection-limit=30,32 disabled=no \
dst-port=25 protocol=tcp

Вторая конфигурация более изящна и предназначенна для борьбы со спам ботами и рассчитана на то, что бот при попытке соединиться с заданным smtp-сервером 1 раз при недоступности оного прекратит повторные попытки. IP-адрес первый раз попадает в address-list first-smtp, при повторной поптыке - в approved-smtp. Первое содинение всегда отбрасывается, при этом генерируется icmp сообщение network-unreachable. Новые соединения маркируются в /ip firewall mangle c меткой smtp.


#Конфигурация для борьбы со спамом 2
/ ip firewall mangle
add chain=prerouting connection-state=new protocol=tcp src-port=1024-65535 dst-port=25 action=mark-connection new-connection-mark=smtp passthrough=no

/ ip firewall filter
add action=jump chain=forward comment="anti-spam policy" connection-mark=smtp \
disabled=no jump-target=smtp-first-drop
add action=add-src-to-address-list address-list=approved-smtp \
address-list-timeout=1d chain=smtp-first-drop comment="" disabled=no \
src-address-list=first-smtp
add action=return chain=smtp-first-drop comment="" disabled=no \
src-address-list=approved-smtp
add action=add-src-to-address-list address-list=first-smtp \
address-list-timeout=1d chain=smtp-first-drop comment="" disabled=no
add action=reject chain=smtp-first-drop comment="" disabled=no reject-with=\
icmp-network-unreachable

Статья про IPSec в MikroTik Wiki от меня

Вчера написал статью для Wiki от производителя нашего оборудования Mikrotik. Скорее всего будет интересна не только для пользователей их ОС RouterOS, но и для тех, кто имеет в своём арсенале PIX Firewall или маршрутизатор Cisco и желает объеденить несколько офисов в одну сеть. Собственно, статья:

MikroTik router to CISCO PIX Firewall IPSEC

• Содержание1 How to interconnect two networks with IPSec between Mikrotik ROS and Cisco PIX
  1.1 Configuration of router running Mikrotik RouterOS
  1.2 Cisco PIX Firewall configuration
  1.3 Corresponding Cisco Router configuration

How to interconnect two networks with IPSec between Mikrotik ROS and Cisco PIX

This example shows how to interconnect remote offices uses IPSec VPN between Mikrotik RouterOS device and Cisco PIX Firewall or Cisco Router, running Cisco IOS. Also I show you how to provide Internet access for network using masquerade/PAT on Mikrotik RouterOS, Cisco PIX Firewall and Cisco Router, running Cisco IOS. Network topology is shown below. We would like to interconnect networks 172.22.1.1/24 and 172.22.2.1/24 using corresponding public addresses 1.0.0.2 and 2.0.0.2. Assume 1.0.0.1 is default gateway for router, running Mikrotik RouterOS and 2.0.0.1 is default gateway for router running Cisco IOS or Cisco PIX Firewall, running Cisco PIX OS. This configuration tested and works well with Mikrotik RouterOS 3.20, Cisco IOS 12.4(21) and 12.3(26) advanced security features set with encryption and PIX OS 6.3(5).

Configuration of router running Mikrotik RouterOS

This configuration is simple and very similar to official 3.0 ipsec manual page
Mikrotik Router
Add addresses on interfaces

   [admin@Mikrotik] > ip address
add address=1.0.0.2/30 broadcast=1.0.0.3 comment="" disabled=no interface=\
public network=1.0.0.0
[admin@Mikrotik] > ip address
add address=172.22.1.1/24 broadcast=172.22.1.255 comment="" disabled=no \
interface=inside network=172.22.1.0

Add ip routes

   [admin@Mikrotik] > ip route
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=1.0.0.1 \
scope=30 target-scope=10

Add accept and masquerading rules in SRC-NAT

    [admin@Mikrotik] > ip firewall nat add chain=srcnat src-address=172.22.1.0/24 \
\... dst-address=172.22.2.0/24 action=accept
[admin@Mikrotik] > ip firewall nat add chain=srcnat out-interface=public \
\... action=masquerade

Add peer (with phase1 configuration parameters), DES and SHA1 will be used to protect IKE traffic for MikroTik router

    [admin@MikroTik] > ip ipsec peer add address=2.0.0.2 \
\... secret="gvejimezyfopmekun" enc-algorithm=des

Set encryption proposal (phase2 proposal - settings that will be used to encrypt actual data) to use DES to encrypt data for MikroTik router

    [admin@MikroTik] > ip ipsec proposal set default enc-algorithms=des

Add policy rule that matches traffic between subnets and requires encryption with ESP in tunnel mode for MikroTik router

    [admin@MikroTik] > ip ipsec policy add \
\... src-address=172.22.1.0/24 dst-address=172.22.2.0/24 action=encrypt \
\... tunnel=yes sa-src=1.0.0.2 sa-dst=2.0.0.2

---

Cisco PIX Firewall configuration

I think this configuration is quiet clear because of detailed comments.
Cisco PIX Firewall

    PIX Version 6.3(5)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
!
!--- Create access list that matches traffic that should be encrypted (traffic to RouterOS device)
access-list myacl permit ip 172.22.2.0 255.255.255.0 172.22.2.0 255.255.255.0
!
!---  Create access list that matches traffic that should not be NATed (traffic to RouterOS device)
access-list nonat permit ip 172.22.2.0 255.255.255.0 172.22.1.0 255.255.255.0
!
!--- Configuring NAT
ip address outside 2.0.0.2 255.255.255.252
ip address inside 172.22.2.1 255.255.255.0
!
global (outside) 1 2.0.0.2
!
!--- Do not make NAT for traffic to RouterOS device
nat (inside) 0 access-list nonat
nat (inside) 1 172.22.2.0 255.255.255.0 0 0
!
route outside 0.0.0.0 0.0.0.0 2.0.0.1 1
!
sysopt connection permit-ipsec
!
!--- Create IPsec transform set - transformations that should be applied to
!--- traffic - ESP encryption with DES and ESP authentication with SHA1
!--- This must match "/ip ipsec proposal"
crypto ipsec transform-set myset esp-des esp-sha-hmac
crypto ipsec security-association lifetime seconds 1800
!
!--- Create crypto map that will use transform set "myset", use peer 1.0.0.2
!--- to establish SAs and encapsulate traffic and use access-list myacl to
!--- match traffic that should be encrypted
crypto map mymap 21 ipsec-isakmp
crypto map mymap 21 match address myacl
crypto map mymap 21 set peer 1.0.0.2
crypto map mymap 21 set transform-set myset
crypto map mymap interface outside
!
!--- Configure ISAKMP policy (phase1 config, must match configuration
!--- of "/ip ipsec peer" on RouterOS).
isakmp enable outside
!--- Add preshared key to be used when talking to RouterOS
isakmp key gvejimezyfopmekun address 1.0.0.2 netmask 255.255.255.255
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
: end

---

Corresponding Cisco Router configuration

This configuration is just for example. You can use Cisco router instead Cisco PIX Firewall.
Cisco Router

    !--- Configure ISAKMP policy (phase1 config, must match configuration
!--- of "/ip ipsec peer" on RouterOS). Note that DES is default
!--- encryption algorithm on Cisco. SHA1 is default authentication
!--- algorithm
crypto isakmp policy 20
authentication pre-share
hash md5
exit
!
!--- Add preshared key to be used when talking to RouterOS
crypto isakmp key gvejimezyfopmekun address 1.0.0.2
!
! Create IPsec transform set - transformations that should be applied to
! traffic - ESP encryption with DES and ESP authentication with SHA1
! This must match "/ip ipsec proposal"
crypto ipsec transform-set myset esp-des esp-sha-hmac
mode tunnel                       
exit
!
!
!--- Create crypto map that will use transform set "myset", use peer 1.0.0.2
!--- to establish SAs and encapsulate traffic and use access-list 101 to
!--- match traffic that should be encrypted
crypto map mymap 21 ipsec-isakmp
set peer 1.0.0.2
set transform-set myset
set pfs group2
match address 101
exit
!
!
!--- And finally apply crypto map to outside interface
interface Ethernet0
ip address 2.0.0.2 255.255.255.252
no ip directed-broadcast
ip nat outside
crypto map mymap
!
interface Ethernet1
ip address 172.22.2.1 255.255.255.0
no ip directed-broadcast
ip nat inside
!
!
!--- Create NAT pool
ip nat pool mypool 2.0.0.2 2.0.0.2 netmask 255.255.255.252
!
!--- Do not make NAT for traffic to RouterOS device
ip nat inside source route-map nonat pool mypool overload
ip classless
ip route 0.0.0.0 0.0.0.0 2.0.0.1
!
!---  Create access list that matches traffic that should be encrypted (traffic to RouterOS device)
access-list 101 permit ip 172.22.2.0 0.0.0.255 172.22.1.0 0.0.0.255
!
!---  Create access list that matches traffic that should not be NATed (traffic to RouterOS device):
access-list 102 deny   ip 172.22.2.0 0.0.0.255 172.22.1.0 0.0.0.255
access-list 102 permit ip 172.22.2.0 0.0.0.255 any
!
!--- Create route-map for traffic that should be NATed
route-map nonat permit 10
match ip address 102
!
end

Получено с http://wiki.mikrotik.com/wiki/MikroTik_router_to_CISCO_PIX_Firewall_IPSEC

Категории: VPN Firewall