CCENT/CCNA ICND1 Official Exam Certification Guide - Chapter 15 potx

C H A P T E R 15 Troubleshooting IP Routing This chapter has two main goals. First, this chapter covers some topics that are not covered elsewhere in this book, namely some troubleshooting commands on both hosts and routers. Second, this chapter reviews the core concepts of addressing and routing, but with a focus on how to approach new problems to analyze and understand how to troubleshoot any problems. Additionally, this chapter includes a troubleshooting scenario that shows how to use some of the tools and concepts from earlier in this chapter, with an opportunity for you to try and discover the problems before the text explains the answers. For those of you following the reading plan using both this book and the CCNA ICND2 Official Exam Certification Guide, note that after this chapter, you should proceed to the ICND2 book and read the chapters in Parts II and III. “Do I Know This Already?” Quiz The “Do I Know This Already?” quiz allows you to assess if you should read the entire chapter. If you miss no more than one of these nine self-assessment questions, you might want to move ahead to the “Exam Preparation Tasks” section. Table 15-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so you can assess your knowledge of these specific areas. The answers to the “Do I Know This Already?” quiz appear in Appendix A. Table 15-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping Foundation Topics Section Questions IP Troubleshooting Tips and Tools 1–6 A Routing Troubleshooting Scenario 7–9 1828xbook.fm Page 471 Thursday, July 26, 2007 3:10 PM 472 Chapter 15: Troubleshooting IP Routing 1. An internetwork diagram shows a router, R1, with the ip subnet-zero command configured. The engineer has typed several configuration commands into a word processor for later pasting into the router’s configuration. Which of the following IP addresses could not be assigned to the router’s Fa0/0 interface? a. 172.16.0.200 255.255.255.128 b. 172.16.0.200 255.255.255.0 c. 225.1.1.1 255.255.255.0 d. 10.43.53.63 255.255.255.192 2. Which of the following is a useful command on some Microsoft OSs for discovering a host’s current IP address and mask? a. tracert b. ipconfig /all c. arp –a d. ipconfig /displaydns 3. Examine the following command output. If the user typed the resume command, what would happen? R1#ss ss hh hh oo oo ww ww ss ss ee ee ss ss ss ss ii ii oo oo nn nn ss ss Conn Host Address Byte Idle Conn Name 1 Fred 10.1.1.1 0 0 Fred * 2 Barney 10.1.2.1 0 0 Barney a. The command would be rejected, and the R1 CLI command prompt would be displayed again. b. The CLI user would be connected to a suspended Telnet connection to the router with IP address 10.1.1.1. c. The CLI user would be connected to a suspended Telnet connection to the router with IP address 10.1.2.1. d. The result cannot be accurately predicted from the information shown. Refer to the following figure for questions 4–9: Default Gateway 10.1.1.1 Default Gateway 172.16.2.4 10.1.13.1/30 10.1.1.1/24 S0/0 10.1.13.3/30 S0/1 172.16.2.4 Fa0/0 R1 R2 PC1 PC2 10.1.1.10/24 172.16.2.7 Fa0/0 1828xbook.fm Page 472 Thursday, July 26, 2007 3:10 PM “Do I Know This Already?” Quiz 473 4. If PC3 were added to the LAN on the left, with IP address 10.1.1.130/25, default gateway 10.1.1.1, which of the following would be true? a. If PC1 issued a ping 10.1.1.130 command, PC1 would use ARP to learn PC3’s MAC address. b. If PC3 issued a ping 10.1.1.10 command, PC3 would ARP trying to learn PC1’s MAC address. c. If PC1 issued a ping 10.1.13.1 command, PC1 would ARP trying to learn the MAC address of 10.1.13.1. d. If R1 issued a ping 10.1.1.130 command, R1 would ARP trying to learn the MAC address of 10.1.1.130. 5. A new network engineer is trying to troubleshoot a problem for the user of PC1. Which of the following tasks and results would most likely point to a Layer 1 or 2 Ethernet problem on the LAN on the left side of the figure? a. A ping 10.1.1.1 command on PC1 did not succeed. b. A ping 10.1.13.3 command from PC1 succeeded, but a ping 172.16.2.4 did not. c. A ping 10.1.1.1 command from PC1 succeeded, but a ping 10.1.13.1 did not. d. A ping 10.1.1.10 command from PC1 succeeded. 6. The PC2 user issues the tracert 10.1.1.10 command. Which of the following IP addresses could be shown in the command output? a. 10.1.1.10 b. 10.1.1.1 c. 10.1.13.1 d. 10.1.13.3 e. 172.16.2.4 7. All the devices in the figure just booted, and none of the devices has yet sent any data frames. Both PCs use statically configured IP addresses. Then PC1 successfully pings PC2. Which of the following ARP table entries would you expect to see? a. An entry on PC1’s ARP cache for IP address 172.16.2.7 b. An entry on PC1’s ARP cache for IP address 10.1.1.1 c. An entry on R1’s ARP cache for IP address 10.1.1.10 d. An entry on R1’s ARP cache for IP address 172.16.2.7 1828xbook.fm Page 473 Thursday, July 26, 2007 3:10 PM 474 Chapter 15: Troubleshooting IP Routing 8. All the devices in the figure just booted, and none of the devices has yet sent any data frames. Both PCs use statically configured IP addresses. Then PC1 successfully pings PC2. Which of the following ARP requests would you expect to occur? a. PC1 would send an ARP broadcast looking for R1’s MAC address of the interface with IP address 10.1.1.1. b. PC2 would send an ARP broadcast looking for R2’s MAC address of the interface with IP address 172.16.2.4. c. R1 would send an ARP broadcast looking for PC1’s MAC address. d. R2 would send an ARP broadcast looking for PC2’s MAC address. e. PC1 would send an ARP broadcast looking for PC2’s MAC address. 9. PC1 is successfully pinging PC2 in the figure. Which of the following is true about the packets? a. The frame going left-to-right, as it crosses the left-side LAN, has a destination MAC address of R1’s MAC address. b. The frame going left-to-right, as it crosses the right-side LAN, has a destination MAC address of R2’s MAC address. c. The frame going left-to-right, as it crosses the serial link, has a destination IP address of PC2’s IP address. d. The frame going right-to-left, as it crosses the left-side LAN, has a source MAC address of PC2’s MAC address. e. The frame going right-to-left, as it crosses the right-side LAN, has a source MAC address of PC2’s MAC address. f. The frame going right-to-left, as it crosses the serial link, has a source MAC address of R2’s MAC address. 1828xbook.fm Page 474 Thursday, July 26, 2007 3:10 PM IP Troubleshooting Tips and Tools 475 Foundation Topics IP Troubleshooting Tips and Tools The primary goal of this chapter is to better prepare you for the more challenging exam problems that involve potential Layer 3 problems. These problems often require the same thought processes and tools that you would use to troubleshoot networking problems in a real job. The first half of this chapter reviews the main types of problems that can occur, mainly related to addressing, host routing, and a router’s routing logic. The second half of the chapter shows a scenario that explains one internetwork that has several problems, giving you a chance to first analyze the problems, and then showing how to solve the problems. IP Addressing This section includes some reminders relating to some of the basic features of IP addressing. More importantly, the text includes some tips on how to apply this basic knowledge to a given exam question, helping you know how to attack a particular type of problem. Avoiding Reserved IP Addresses One of the first things to check in an exam question that includes a larger scenario is whether the IP addresses are reserved and should not be used as unicast IP addresses. These reserved addresses can be categorized into one of three groups: ■ Addresses that are always reserved ■ Two addresses that are reserved in each subnet ■ Addresses in two special subnets of each classful network, namely the zero subnet and broadcast subnet. The first category of reserved addresses includes two Class A networks that are always reserved, plus all Class D (multicast) and Class E (experimental) IP addresses. You can easily recognize these IP addresses based on the value of their first octet, as follows: ■ 0 (because network 0.0.0.0 is always reserved) ■ 127 (because network 127.0.0.0 is always reserved) ■ 224–239 (all Class D multicast IP addresses) ■ 240–255 (all Class E experimental IP addresses) 1828xbook.fm Page 475 Thursday, July 26, 2007 3:10 PM 476 Chapter 15: Troubleshooting IP Routing The second category of reserved IP addresses includes the two reserved addresses inside each subnet. When subnetting, each subnet reserves two numbers—the smallest and largest numbers in the subnet—otherwise known as ■ The subnet number ■ The subnet’s broadcast address So the ability to quickly and confidently determine the subnet number and subnet broadcast address has yet another application, when attempting to confirm that the addresses shown in a question can be legally used. The third category of reserved IP addresses may or may not apply to a particular internetwork or question. For a given classful network, depending on several factors, the following two subnets may not be allowed to be used: ■ The zero subnet ■ The broadcast subnet If an exam question includes an address in the zero subnet or broadcast subnet, you must then consider whether the question allows neither subnet to be used, or both. Table 15-2 summarizes the clues to look for in exam questions to determine whether a question allows the use of both subnets or not. One Subnet, One Mask, for Each LAN The hosts on a single LAN or VLAN (a single broadcast domain) should all be in the same subnet. As a result, each host, each router interface attached to the LAN, and each switch management address in that LAN should also use the same mask. Table 15-2 Determining Whether a Question Allows the Use of the Zero and Broadcast Subnets Clues in the Question Subnets Reserved? Says nothing about it (default for the exam) No Lists the ip subnet-zero configuration command No Uses a classless routing protocol (RIP-2, EIGRP, OSPF) No Lists the no ip subnet-zero configuration command Yes Uses a classful routing protocol (RIP-1) Yes 1828xbook.fm Page 476 Thursday, July 26, 2007 3:10 PM IP Troubleshooting Tips and Tools 477 For the exam, you should check all the details documented in the question to determine the mask used by the various devices on the same LAN. Oftentimes, a question that is intended to test your knowledge will not just list all the information in a nice organized figure. Instead, you might have to look at the configuration and diagrams and use show commands to gather the information, and then apply the subnetting math explained in Chapter 12, “IP Addressing and Subnetting.” Figure 15-1 shows an example of a LAN that could be part of a test question. For convenience, the figure lists several details about IP addresses and masks, but for a given question, you might have to gather some of the facts from a figure, a simulator, and from an exhibit that lists command output. Figure 15-1 One LAN with Three Different Opinions About the Subnet From the information in Figure 15-1, you can quickly tell that the two PCs use different masks (listed in prefix notation). In this case, you would need to know to look in the configuration for the subnet mask in the ip address interface subcommand, and then convert that mask to prefix notation to compare it with the other masks in this example. Table 15-3 lists the three differing opinions about the subnet. In this case, several problem symptoms occur. For example, PC1 thinks 172.16.1.253 (R1) is in the same subnet, and PC1 thinks that it can forward packets to R1 over the LAN. However, R1 does not think that PC1 (172.16.1.1) is in the same subnet, so R1’s connected Table 15-3 Different Opinions About the Subnet in Figure 15-1 R1 Fa0/0 PC1 PC2 Mask 255.255.255.128 255.255.255.0 255.255.255.128 Subnet number 172.16.1.128 172.16.1.0 172.16.1.0 Broadcast address 172.16.1.255 172.16.1.255 172.16.1.127 172.16.1.1/24 GW = 172.16.1.253 172.16.1.2/25 GW = 172.16.1.253 Fa0/1 172.16.2.253 Fa0/0 interface Fa0/0 ip address 172.16.1.253 255.255.255.128 R1 PC1 PC2 1828xbook.fm Page 477 Thursday, July 26, 2007 3:10 PM 478 Chapter 15: Troubleshooting IP Routing route on the LAN interface (172.16.1.128/25) will not provide a route that R1 can use to forward packets back to PC1. For the exam, recognizing the fact that the hosts on the same LAN do not have the same opinion about the subnet should be enough to either answer the question, or to know what to fix in a Sim question. Table 15-4, found a little later in this chapter, summarizes the router commands that can be used to find the information required to analyze such problems. Summary of IP Addressing Tips Generally speaking, keep the following tips and facts in mind when you approach the exam questions that include details about IP addresses: 1. Check the mask used on each device in the same LAN; if different, then the devices cannot have the same view of the range of addresses in the subnet. 2. On point-to-point WAN links, check the IP addresses and masks on both ends of the link, and confirm that the two IP addresses are in the same subnet. 3. When checking to confirm that hosts are in the same subnet, do not just examine the subnet number. Also check the subnet mask, and the implied range of IP addresses. 4. Be ready to use the commands summarized in Table 15-4 to quickly find the IP addresses, masks, and subnet numbers. The next section, in addition to reviewing a host’s routing logic, introduces some commands on Microsoft operating systems that list the host’s IP address and mask. Host Networking Commands Chapter 5, “Fundamentals of IP Addressing and Routing,” explained the simple two-step logic a host uses when forwarding packets, in addition to how a host typically uses DHCP, DNS, ARP, and ICMP. These details can be summarized as follows: Routing: If the packet’s destination is on the same subnet, send the packet directly; if not, send the packet to the default gateway. Address assignment: Before sending any packets, the host may use DHCP client services to learn its IP address, mask, default gateway, and DNS IP addresses. The host could also be statically configured with these same details. Name resolution: When the user directly or indirectly references a host name, the host typically uses DNS name resolution requests to ask a DNS to identify that host’s IP address unless the host already has that information in its name cache. IP-to-MAC resolution: The host uses ARP requests to find the other host’s MAC address, or the default gateway’s IP address, unless the information is already in the host’s ARP cache. 1828xbook.fm Page 478 Thursday, July 26, 2007 3:10 PM IP Troubleshooting Tips and Tools 479 Of these four items, note that only the routing (forwarding) process happens for each packet. The address assignment function usually happens once, soon after booting. Name resolution and ARPs occur as needed, typically in reaction to something done by the user. To analyze how well a host has accomplished these tasks, to troubleshoot problems, and to do the equivalent for exam questions, it is helpful to know a few networking commands on a host. Table 15-4 lists several of the commands on Microsoft Windows XP, but other similar commands exist for other operating systems. Example 15-1 following the table shows the output from some of these commands. Example 15-1 shows an example of the ping www.cisco.com command on a host running Windows XP, just after the ARP cache and hostname cache have been deleted (flushed). The example first shows the DHCP-learned addressing and DNS details, and then shows the flushing of the two caches. At that point, the example shows the ping www.cisco.com command, which forces the host to use DNS to learn the IP address of the Cisco web server, and then ARP to learn the MAC address of the default gateway, before sending an ICMP echo request to the Cisco web server. Table 15-4 Microsoft Windows XP Network Command Reference Command Function ipconfig /all Displays detailed IP configuration information for all interfaces, including IP address, mask, default gateway, and DNS IP addresses ipconfig /release Releases any DHCP-leased IP addresses ipconfig /renew Acquires an IP address and related information using DHCP nslookup name Sends a DNS request for the listed name arp –a Lists the host’s ARP cache ipconfig /displaydns Lists the host’s name cache ipconfig /flushdns Removes all DNS-found name cache entries arp -d Flushes (empties) the host’s ARP cache netstat -rn Displays a host’s routing table NOTE The ping fails in this example, probably due to ACLs on routers or firewalls in the Internet. However, the ping command still drives the DNS and ARP processes as shown in the example. Also, the text is from a DOS window in Windows XP. 1828xbook.fm Page 479 Thursday, July 26, 2007 3:10 PM 480 Chapter 15: Troubleshooting IP Routing Example 15-1 Example Use of Host Networking Commands C:\>ii ii pp pp cc cc oo oo nn nn ff ff ii ii gg gg // // aa aa ll ll ll ll ! Some lines omitted for brevity Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : cinci.rr.com Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Cont roller Physical Address. . . . . . . . . : 00-11-11-96-B5-13 Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 192.168.1.102 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 65.24.7.3 65.24.7.6 Lease Obtained. . . . . . . . . . : Thursday, March 29, 2007 6:32:59 AM Lease Expires . . . . . . . . . . : Friday, March 30, 2007 6:32:59 AM ! Next, the ARP and name cache are flushed. C:\>aa aa rr rr pp pp dd dd C:\>ii ii pp pp cc cc oo oo nn nn ff ff ii ii gg gg // // ff ff ll ll uu uu ss ss hh hh dd dd nn nn ss ss Windows IP Configuration Successfully flushed the DNS Resolver Cache. ! The pp pp ii ii nn nn gg gg command lists the IP address (198.133.219.25), meaning that the DNS request worked. ! However, the ping does not complete, probably due to ACLs filtering ICMP traffic. C:\>pp pp ii ii nn nn gg gg ww ww ww ww ww ww cc cc ii ii ss ss cc cc oo oo cc cc oo oo mm mm Pinging www.cisco.com [198.133.219.25] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 192.133.219.25: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), ! Next, the ARP cache lists an entry for the default gateway. C:\>aa aa rr rr pp pp aa aa Interface: 192.168.1.102 0x2 Internet Address Physical Address Type 192.168.1.1 00-13-10-d4-de-08 dynamic ! Next, the local name cache lists the name used in the pp pp ii ii nn nn gg gg command and the IP address continues 1828xbook.fm Page 480 Thursday, July 26, 2007 3:10 PM [...]... Routing Example 1 5-2 show ip route Command with Overlapping Routes s R1#show ip route rip Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia -. .. figure ■ Suggest solutions to any problems you find Examples 1 5-6 through 1 5-8 list command output from routers R1, R2, and R3 in Figure 1 5-5 Example 1 5-9 lists commands as typed into a text editor, which were later pasted into R4’s configuration mode 491 1828xbook.fm Page 492 Thursday, July 26, 2007 3:10 PM 492 Chapter 15: Troubleshooting IP Routing Figure 1 5-5 Scenario 3: Incomplete Network Diagram 10.10.23.11... addresses of the routers in the route For example, consider Figure 1 5-3 and Example 1 5-4 The figure shows an internetwork with three routers, with the traceroute 172.16.2.7 command being used on router R1 The arrowed lines show the three IP addresses identified by the command output, which is shown in Example 1 5-4 Figure 1 5-3 Internetwork Used in traceroute Example Default Gateway 10.1.1.1 traceroute... Chapter 15: Troubleshooting IP Routing Figure 1 5-7 Scenario Part B: Answer to Question 1 PC12 ARP Table: IP Address MAC Address 10.10 .15. 1 R1-Fa0/1-MAC R2 ARP Table: IP Address MAC Address 192.168.4.21 PC21-MAC 10.10.10.12 /21 Def Gw 10.10 .15. 1 192.168.4.21 /28 Def Gw = 192.168.4.29 12 192.168.1.1 /30 S0/0/1 Fa0/1 10.10 .15. 1 /21 21 192.168.1.2 /30 S0/0/1 R1 Fa0/0 R2 1 192.168.4.29 3 D_MAC=R1-Fa0/1-MAC... the example, the user is concurrently telnetted into all three routers, with the ability to switch between the connections with just a few keystrokes Example 1 5-5 shows example output, with annotations to the side 487 1828xbook.fm Page 488 Thursday, July 26, 2007 3:10 PM 488 Chapter 15: Troubleshooting IP Routing Figure 1 5-4 Telnet Suspension Bench Cincy Frame Relay Milwaukee New York Uecker Example 1 5-5 ... PC12 Figure 1 5-1 1 summarizes the frame contents for both this question and the next Figure 1 5-1 1 Required ARP Table Entries: Questions 6 and 7 10.10.10.12/21 Def Gw 10.10 .15. 1 192.168.4.21/28 Def Gw = 192.168.4.29 12 10.10 .15. 1/21 21 192.168.1.1/30 S0/0/1 Fa0/1 R1 192.168.1.2/30 S0/0/1 Fa0/0 R2 192.168.4.29 3 1 D_MAC=PC12-MAC D_IP=10.10.10.12 S_ MAC=R1-Fa0/1-MAC S_IP=192.168.4.21 D_MAC=R2-Fa0/0-MAC S_... command in Example 1 5-1 1 1828xbook.fm Page 505 Thursday, July 26, 2007 3:10 PM Review All the Key Topics Exam Preparation Tasks Review All the Key Topics Review the most important topics from inside the chapter, noted with the key topics icon in the outer margin of the page Table 1 5-6 lists a reference of these key topics and the page numbers on which each is found Table 1 5-6 Key Topics for Chapter 15 Page... 192.168.1.0 network 192.168.4.0 493 1828xbook.fm Page 494 Thursday, July 26, 2007 3:10 PM 494 Chapter 15: Troubleshooting IP Routing Scenario Part A: Answers Examples 1 5-6 , 1 5-7 , and 1 5-8 list the IP addresses of each interface on routers R1, R2, and R3, respectively However, some of the commands used in the examples do not provide mask information In particular, the show ip interface brief command—a... NewYork> (Note: User pressed Ctrl-Shift-6 and then x) d Cincy#disconnect 2 Closing connection to NewYork [confirm] Cincy# (Done with New York, terminate Telnet) (Just press Enter to confirm) 489 1828xbook.fm Page 490 Thursday, July 26, 2007 3:10 PM 490 Chapter 15: Troubleshooting IP Routing The play-by-play notes in the example explain most of the details Example 1 5-5 begins with the Cincy command... contents of a router’s ARP cache Example 1 5-3 lists sample output from this command, taken from router R1 in Figure 1 5-1 , after the router and hosts were changed to all use a /24 mask Example 1 5-3 Sample show ip arp Command Output s R1#show ip arp Protocol Address Hardware Addr Type Interface Internet 172.16.1.1 Age (min) 8 0013.197b.2f58 ARPA FastEthernet0/0 Internet 172.16.1.251 - 0013.197b.5004 ARPA FastEthernet0/0 . external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded. R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 -. address assigned to the router—for example, R1’s Fa0/0 interface in Figure 1 5-1 is shown as 172.16.1.251, which is the second entry in Example 1 5-3 . Example 1 5-3 Sample show ip arp Command Output R1#ss ss hh hh oo oo ww ww