{"id":264,"date":"2020-08-23T17:32:36","date_gmt":"2020-08-23T16:32:36","guid":{"rendered":"http:\/\/www.labtinker.net\/?p=264"},"modified":"2020-08-23T17:32:36","modified_gmt":"2020-08-23T16:32:36","slug":"its-raining-lsas","status":"publish","type":"post","link":"http:\/\/18.135.13.153\/?p=264","title":{"rendered":"It’s raining LSAs."},"content":{"rendered":"\n

I generally work with security devices and my knowledge on routing protocols gets rusty as I don’t do much with them. However, we\u2019re all supposed to be full-spectrum engineers these days which was brought home to me when I went to an interview a couple of years ago and was asked some questions in this arena…and ummed and arred. Anyways, long story short, to refresh my knowledge I did some dabbling with OSPF and BGP and came up with a lab to catch every(ish) type of OSPF LSA . <\/p>\n\n\n\n

Every router that connects to a given OSPF area should learn the same topology from multiple LSAs (Link State Advertisements) which are multicast from other routers. This information is then stored in a LSDB. (Link State Database). The LSAs come in different types roughly summarised as follows:<\/p>\n\n\n\n

LSA Types<\/p>\n\n\n\n

    \n
  1. Router\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/li>\n\n\n\n
  2. Network\u00a0\u00a0\u00a0\u00a0\u00a0<\/li>\n\n\n\n
  3. Net-Summary (ABRs \u2013 defines links and subnets)<\/li>\n\n\n\n
  4. ASBR Summary \u2013 advertises host route to reach ASBR<\/li>\n\n\n\n
  5. AS External<\/li>\n\n\n\n
  6. Group Membership for MOSPF<\/li>\n\n\n\n
  7. NSSA External<\/li>\n\n\n\n
  8. Link LSAs<\/li>\n\n\n\n
  9. Intra-Area prefix<\/li>\n<\/ol>\n\n\n\n

    This is the lab topology (running in GNS3) with mutliple routers running Cisco IOSv image. It was adapted to do other things as well as I recall so it\u2019s bigger (and smaller \u2013 more later) than it needs to be. Also the ‘BGP Areas’ should really be labelled ‘BGP Autonomous Systems’ – I only noticed this mistake after I’d torn the lab down. <\/p>\n\n\n\n

    \"\"
    Figure 1: LSA hunting ground.<\/figcaption><\/figure>\n\n\n\n

    All the routers have loopbacks with ip addresses based on their name: R10 has 1.1.1.1, R20 has 2.2.2.2 etc.<\/p>\n\n\n\n

    The other interfaces are addressed: 192.168.<area>.<loopback last octet>  so R10\u2019s Gi0\/0 interace is addressed 192.68.1.1.<\/p>\n\n\n\n

    LSA Type 1-5<\/p>\n\n\n\n

    An LSA Type 1 is the router advertising itself. Let\u2019s choose a connection between any two routers running OSPF and capture the packets between them using Wireshark. (You can use \u2018show ip ospf database<\/em>\u2019 on the router to get an idea of the LSA\u2019s received but I prefer to see them on the wire.)<\/p>\n\n\n\n

    \"\"
    Figure 2: Out with the Wireshark magnifying glasss.<\/figcaption><\/figure>\n\n\n\n

    At first, I just saw lots of OSPF hellos as this needy little protocol reassures its neighbours that it\u2019s still there:<\/p>\n\n\n\n

    \"\"
    Figure 2: Hello, is it me you’re looking for?<\/figcaption><\/figure>\n\n\n\n

    So we probably need to prod something to trigger some updates…<\/p>\n\n\n\n

    \"\"
    Figure 3: Don’t prod in Prod.<\/figcaption><\/figure>\n\n\n\n

    Doing this generated a lot of interesting new traffic. Wireshark has some display filters which correspond to our LSA types by name,the first being ospf.lsa.router<\/em>.<\/p>\n\n\n\n

    \"\"
    Figure 4: Gotcha!<\/figcaption><\/figure>\n\n\n\n

    We\u2019ve bagged an LSA type 1.<\/p>\n\n\n\n

    \"\"
    Figure 5: LSA Type 1<\/figcaption><\/figure>\n\n\n\n

    I won\u2019t go overboard on detail on what all these LSA\u2019s do because this man has\u2026<\/p>\n\n\n\n

    http:\/\/www.firewall.cx\/networking-topics\/routing\/ospf-routing-protocol\/1178-ospf-lsa-types-explained.html<\/a><\/p>\n\n\n\n

    \u2026but essentially the router is adverting its own interfaces\u2026<\/p>\n\n\n\n

    Onwards and upwards, let’s try ospf.lsa.network<\/em> in the Wireshark filter window…<\/p>\n\n\n\n

    \"\"
    Figure 6: R30 sending out an OSPF LS Update<\/figcaption><\/figure>\n\n\n\n

    Got one. In fact, this LS Update contains multiple LSA Types. It has a LSA Type-1 and also…<\/p>\n\n\n\n

    \"\"
    Figure 7: Two down.<\/figcaption><\/figure>\n\n\n\n

    …which is generated by the designated router for the Area (R30 – OSPF id 3.3.3.3)<\/p>\n\n\n\n

    \"\"
    Figure 8: R30 is the DR<\/figcaption><\/figure>\n\n\n\n

    …and also tucked away in there is…. <\/p>\n\n\n\n

    \"\"
    Figure 9: The LS Update that keeps on giving.<\/figcaption><\/figure>\n\n\n\n

    LSA Type 3s are generated by ABRs which straddle two OSPF areas and as R30 straddles Area 1 and Area 0 that makes sense. But we’re not finished yet…<\/p>\n\n\n\n

    \"\"
    Figure 10: Type 4<\/figcaption><\/figure>\n\n\n\n

    LSA Type 4s advertise the presence of as ASBR (Autonomous System Border Router) which covers R50 and R60 as they’re re-distributing BGP. And is there more…<\/p>\n\n\n\n

    \"\"
    Figure 11: Type 5<\/figcaption><\/figure>\n\n\n\n

    Again from the ASBRs advertising externally re-disributed routes. (Seriously, read the link above as I know my explanations are sketchy)<\/p>\n\n\n\n

    OK let\u2019s excuse ourselves from looking for Type 6s as these are for multicast OSPF, not widely used, nor apparently supported by Cisco. Which just leaves us Type 7s (there are more types but they’re for more abstruse purposes and beyond the scope of this post)<\/p>\n\n\n\n

    LSA Type 7s<\/p>\n\n\n\n

    Now these are a rarer beast \u2013 and the lab will need a little jerry-rigging to catch one<\/p>\n\n\n\n

    LSA Type 7s are created by ASBRs to inject into an NSSA (Not-So Stubby Areas). Our current ASBRs are on the edge of Area 0 \u2013 and as Area 0 rules and connects to all other areas it cannot be an NSSA. So we\u2019re going to have to latch a new area on.<\/p>\n\n\n\n

    Now as I was doing this it occurred to me I was also a little shaky on the difference between stubby and NSSA. One google search took me here:<\/p>\n\n\n\n

    https:\/\/community.cisco.com\/t5\/switching\/difference-between-ospf-stub-and-nssa-area\/td-p\/945048<\/a><\/p>\n\n\n\n

    Essentially, it’s a a stub as far as OSPF is concerned but is allowed to connect to the outside world. <\/p>\n\n\n\n

    \"\"
    Figure 12: OSPF NSSA Area 3<\/figcaption><\/figure>\n\n\n\n

    I updated the OPSF config as follows on R60. <\/p>\n\n\n\n

    router-id 6.6.6.6
    area 3 nssa default-information-originate<\/strong>
    network 6.6.6.0 0.0.0.255 area 0
    network 192.168.0.0 0.0.0.255 area 0
    network 192.168.3.0 0.0.0.255 area 3<\/strong>
    default-information originate<\/em><\/p>\n\n\n\n

    And on R90 it was all new<\/p>\n\n\n\n

    router ospf 1
    router-id 9.9.9.9
    area 3 nssa
    network 9.9.9.0 0.0.0.255 area 3
    network 192.168.3.0 0.0.0.255 area 3<\/em><\/p>\n\n\n\n

    And then re-setting the ospf process as above…<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Here are the configs if you’re interested. Apologies, my WordPress console won’t allow zips:<\/p>\n\n\n\n

    R10<\/a>Download<\/a><\/div>\n\n\n\n
    R20<\/a>Download<\/a><\/div>\n\n\n\n
    R30<\/a>Download<\/a><\/div>\n\n\n\n
    R40<\/a>Download<\/a><\/div>\n\n\n\n
    R50<\/a>Download<\/a><\/div>\n\n\n\n
    R60<\/a>Download<\/a><\/div>\n\n\n\n
    R70<\/a>Download<\/a><\/div>\n\n\n\n
    R80<\/a>Download<\/a><\/div>\n\n\n\n
    R90<\/a>Download<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

    I generally work with security devices and my knowledge on routing protocols gets rusty as I don’t do much with them. However, we\u2019re all supposed to be full-spectrum engineers these days which was brought home to me when I went to an interview a couple of years ago and was asked some questions in this […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-264","post","type-post","status-publish","format-standard","hentry","category-networking"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=264"}],"version-history":[{"count":0,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/264\/revisions"}],"wp:attachment":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=264"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}