Static Routes With Next Hop As An Exit Interface Or An IP Address

Document

Nov 3, 2012 2:04 PM
Nov 3rd, 2012

1. Introduction:

This document describes the difference between implementation of static routes with next hop as an exit interface or an IP address.
 

!-- Pointing to next hop address

ip route 0.0.0.0 0.0.0.0 10.1.1.2

!-- Pointing to the interface

ip route 0.0.0.0 0.0.0.0 fa0/0

 

2. Basic Overview:

For forwarding packet to the destination, the router must determine the exit interface and rewrite the L2 frame before putting the packet on the wire. In order for a router to write the L2 frame it must resolve the IP address to its corresponding L2 address and reconstruct the frame before sending to the next hop. The function of address resolution can be done dynamically using protocols like ARP in Ethernet or Statically/Dynamically learned DLCI in frame-relay.

 

There are two points need to be understand, when you configure static route on router.


1) If you configured static route pointed to next hop IP address, for every destination forwarding router requires only L2 address of next hop IP address to rewrite the L2 frame.
Example: ip route 2.2.2.0 255.255.255.0 10.1.1.2
For routing packet to destination address 2.2.2.2, router requires L2 mac address of 10.1.1.2.

2) If you configured static route point to outgoing interface, forwarding router assume destination address is directly connected to that interface and router will try to find the L2 address of the destination by sending ARP request out of the interface to the destination address in case of Ethernet or looking for a static/dynamic map entry in the mapping table in case of frame-relay.
Example: ip route 2.2.2.0 255.255.255.0 fa0/0
For routing packet to the destination address 2.2.2.2, router assumes host 2.2.2.2 is directly connected to the interface fa0/0 and it requires L2 mac address for 2.2.2.2.

In general, interfaces can be point to point or multi-point. The above mentioned conditions work differently in scenarios of  Point to point and multipoint interface.

In point to point interface, by definition two devices are directly connected, so in case if  you configure static route pointing to outgoing interface or next hop IP address does not make a difference, router uses L2 address of next hop IP address of interface for routing packet to every destination address.

In multipoint interface, by definition interface can have multiple devices connected to it. So as mention above in point number two, if you configure static route point to next-hop, router need L3 to L2 resolution for each destination prefixes. Ethernet is an example of multi-point interfaces whereas Frame-relay and ATM can be multi-point interface or point to point depending on the configuration.

Configuration overview:

The topology and initial configurations are shown below:

3. Topology diagram:

Ipv4stat.jpg

 

Initial configuration:

R1R2R3
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 20.1.1.1 255.255.255.0
duplex auto
speed auto
!
ip route 2.2.2.2 255.255.255.255 10.1.1.1
ip route 3.3.3.3 255.255.255.255 20.1.1.2
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.252
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface FastEthernet0/0
ip address 20.1.1.2 255.255.255.252
duplex auto
speed auto
!
ip route 0.0.0.0  0.0.0.0 20.1.1.1

 

Case1: Configured static route on R2 point to the next hop address of neighboring router R1. As discussed above, for forwarding every packet to destination prefix R2 will use destination mac address of R1 in L2 frame.

Verifying connectivity from R2 to R1 and R3 loopback addresses:

R2#ping 1.1.1.1 so 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:

Packet sent with a source address of 2.2.2.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/40 ms

R2#ping 3.3.3.3 so 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

Packet sent with a source address of 2.2.2.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/35/60 ms

 

R2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.1.1.1                -   c000.3148.0000  ARPA   FastEthernet0/0

Internet  10.1.1.2                0   c001.3148.0000  ARPA   FastEthernet0/0

 

Case2: Configured a static route on R2 point to the outgoing interface. As  discussed above, for forwarding every packet R2 assume destination  address is directly connected to that interface and will try to find the  L2 mac address of the every destination by sending ARP request out of  the interface to the destination address.

R2(config)#no ip route 0.0.0.0 0.0.0.0 10.1.1.2

R2(config)#ip route 0.0.0.0 0.0.0.0 fa0/0

 

Connectivity  verification from R2 to R1 and R3 loopback addresses. Also IP packet  debug turned on R2 to get closer packet level view.

 

R2#debug ip packet detail

IP packet debugging is on (detailed)

 

R2#ping 3.3.3.3 so 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

Packet sent with a source address of 2.2.2.2

 

IP: tableid=0, s=2.2.2.2 (local), d=3.3.3.3 (FastEthernet0/0), routed via RIB

IP: s=2.2.2.2 (local), d=3.3.3.3 (FastEthernet0/0), len 100, sending

    ICMP type=8, code=0

IP: s=2.2.2.2 (local), d=3.3.3.3 (FastEthernet0/0), len 100, encapsulation failed

    ICMP type=8, code=0.

IP: tableid=0, s=2.2.2.2 (local), d=3.3.3.3 (FastEthernet0/0), routed via RIB

IP: s=2.2.2.2 (local), d=3.3.3.3 (FastEthernet0/0), len 100, sending

    ICMP type=8, code=0

IP: s=2.2.2.2 (local), d=3.3.3.3 (FastEthernet0/0), len 100, encapsulation failed

 

R2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  1.1.1.1                 0   Incomplete      ARPA

Internet  3.3.3.3                 0   Incomplete      ARPA

Internet  10.1.1.1                -   c000.3148.0000  ARPA   FastEthernet0/0

Internet  10.1.1.2               16   c001.3148.0000  ARPA   FastEthernet0/0

Internet  10.1.1.5                -   c000.3148.0001  ARPA   FastEthernet0/1

 

As  1.1.1.1 and 3.3.3.3 prefixes are not directly connected to fa0/0, R2 is  not getting L2 mac address of these prefixes hence ARP table entry is  showing incomplete and there is L2 encapsulation failure on R2 is  dropping packets for this destination.

There are two tricky works around are available but these are not solutions just explained for user’s information.

 

1) Enabling proxy ARP on next hop router:
If  you enable proxy ARP on router, Whenever router get address resolution  request it send the proxy ARP of its own interface address to the  requested router, Only if the prefixes are present in its routing table.

 

In  this example R1 sends proxy ARP i.e. L2 mac address of 10.1.1.2 to R2  for prefixes 3.3.3.3 and 2.2.2.2, as both are in its routing table. By  default proxy ARP is enable on the most of the routers.

R1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#int fa0/0

R1(config-if)#ip proxy-arp

R1(config-if)#do sh ip int fa0/0 | in Proxy

             Proxy ARP is enabled

             Local Proxy ARP is enabled

 

Verifying connectivity from R2 to R1 and R3 loopback address:

 

R2#ping  1.1.1.1 so 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:

Packet sent with a source address of 2.2.2.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/40 ms

R2#ping 3.3.3.3 so 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

Packet sent with a source address of 2.2.2.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/35/60 ms

 

Take  closer look at Arp table of R2, it is showing that same mac address  present for 3.3.3.3 and 1.1.1.1 prefixes in address resolution table  because R1 is sending proxy ARP of its own interface address.

R2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  1.1.1.1                 0   c001.3148.0000  ARPA   FastEthernet0/0

Internet  3.3.3.3                 0   c001.3148.0000  ARPA   FastEthernet0/0

Internet   10.1.1.1                -   c000.3148.0000  ARPA   FastEthernet0/0

Internet  10.1.1.2               40   c001.3148.0000  ARPA   FastEthernet0/0

 

Hence  this could result in a large amount of broadcast traffic and a large no  of ARP cache on R2, especially if the static route was a default route  used for internet traffic.

2) Adding manual ARP entries in ARP table:
You can also add manual ARP entries for destination prefixes to build L2 frame as shown below:

 

R2(config)#arp 1.1.1.1 c001.3148.0000 arpa

R2(config)#arp 3.3.3.3 c001.3148.0000 arpa

R2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  1.1.1.1                 -   c001.3148.0000  ARPA

Internet  3.3.3.3                 -   c001.3148.0000  ARPA

Internet  10.1.1.1                -   c000.3148.0000  ARPA   FastEthernet0/0

Internet  10.1.1.2                4   c001.3148.0000  ARPA   FastEthernet0/0

 

To build L2 frame for each destination prefixes you will need to add manual entries in address resolution table.

4. Conclusion:

->For point to point interfaces,  you can use static routes that point to the interface or to the next  hop address. There is only one possible next hop and its L2 address will  be used to build L2 frame.


->For multipoint/Broadcast interfaces,  it is more suitable to use static routes that point to a next hop  address to avoid the need for resolving every destination address to its  L2 address. As you have seen above it is still possible to use static  routes pointing to the interface but not a scalable solution.

 

                                   

Base Initial configuration:

 

Average Rating: 5 (2 ratings)

Comments

Dan_md_86 Tue, 02/05/2013 - 03:17

Good post !!!

Thx

But for : 1) Enabling proxy ARP on next hop router:

will not work because you will receive a message from debug arp like "Worng Cable"..

ashirkar Tue, 02/19/2013 - 23:05 (reply to Dan_md_86)

Hello Dan,

Thanks for your positive feedback

I tried Method 1 on Lab devices it was working fine for me. Generally enabling proxy arp is not best solution to above issue. Proxy ARP is the name given when a node responds to an arp request on behalf of another node. This is commonly used to redirect traffic sent to one IP address to another device, therefore improper use of Proxy ARP allows security vulnerability.


Regards,

Ashish Shirkar

(Technical Community Manager-Network Infrastructure)

marcelfinger Wed, 09/18/2013 - 04:15

Thanks a lot Ashish Shirkar for your great explanation of this topic!

Now I understand what's the difference in defining an IP or an interface in 'ip route' statements.

Tomorrow I have my CCNA exam - in case there is a question on this, I'm sure I will give the correct answer

ashirkar Wed, 09/18/2013 - 07:12 (reply to marcelfinger)

Hello Marcel,

Thanks for your positive feedback, really appreciate. Best of luck for your Exam

Regards,

Ashish Shirkar

(TCM-NI)

Actions

Login or Register to take actions

This Document

Posted November 3, 2012 at 2:04 PM
Stats:
Comments:4 Avg. Rating:5
Views:22151 Contributors:3
Shares:1

Related Content

Documents Leaderboard