Configure a Gateway of Last Resort that Uses IP Commands
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Contents
Introduction
This document describes how to configure a default route or gateway of last resort.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
This document is not restricted to specific software and hardware versions. The command outputs shown were taken from a Cisco 3900 Series router with Cisco IOS ® Software Release 15M.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Conventions
For more information on document conventions, see theCisco Technical Tips Conventions.
Background Information
Default routes are used to direct packets addressed to networks not explicitly listed in the routing table. Default routes are invaluable in topologies where it is not desirable to learn all the more specific networks, as in case of stub networks, or not feasible due to limited system resources such as memory and limited resources.
The next IP commands are used and described in more detail:
ip default-gateway
ip default-network
ip route 0.0.0.0 0.0.0.0
Use Command ip default-gateway
Theip default-gatewaycommand differs from the other two commands as it must be used only be used whenip routingis disabled on the Cisco router. For instance, if the router is a host in the IP world, you can use this command to define a default gateway for it. You can also use this command when your low end Cisco router is in boot mode in order to TFTP a Cisco IOS® Software image to the router. In boot mode, the router does not haveip routingenabled. This example defines the router on IP address 172.16.15.4 as the default route:
Use Command ip default-network
Unlike theip default-gatewaycommand, you can useip default-network whenip routingis enabled on the Cisco router. When you configureip default-networkthe router considers routes to that network for installation as the gateway of last resort on the router. For every network configured withip default-network, if a router has a route to that network, that route is flagged as a candidate default route. This network diagram displays the routing table taken from router R1:
Notice that the static route to 192.168.1.0 via 10.44.192.2 and that the gateway of last resort is not set. If you configureip default-network 192.168.1.0, the routing table changes as follows:
The gateway of last resort is now set as 10.44.192.2. This result is independent of any routing protocol, as shown by theshow ip protocolscommand output no routing protocol is configured. You can add another candidate default route with the configuration of another instance ofip default-network:
Note: After theip default-networkcommand was entered you can observe that the network was not flagged as a default network. TheFlag a Default Networksection explains the reason.
Flag a Default Network
Theip default-networkcommand is classful, this means that if the router has a route to the subnet indicated by this command, it installs the route to the major network. At this point neither network has been flagged as the default route. Theip default-networkcommand must be run again, this time with the use of the major network in order to flag the candidate as a default route.
If the original static route had been configured to the major network, the previous step would not have been necessary.
There are still no IP Protocols configured in the router, without any dynamic protocols you can configure your router to choose from a number of candidate default routes based on whether the routing table has routes to networks other than 0.0.0.0/0. Theip default-networkcommand allows you to configure robustness into the selection of a gateway of last resort. Rather than the use of static routes to specific next-hops, you can have the router choose a default route to a particular network based in the routing table information.
If you lose the route to a particular network, the router selects the other candidate default. In that scenario, you can then remove the lost route from the configuration as shown in the next output:
After you remove the static route to the network, the routing table looks like this:
Use Different Routing Protocols
Gateways of last resort selected via theip default-networkcommand are propagated differently based on which routing protocol is used. For EIGRP there are different methods to Configure a Default Route in EIGRP which are preferred. The default route announced with theip default-networkcommand is not propagated by Open Shortest Path First (OSPF) or by Intermediate System-to-Intermediate System (IS-IS). For more detailed information on behavior of default routes with OSPF, refer toHow Does OSPF Generate Default Routes?.
Use Command ip route 0.0.0.0 0.0.0.0
A static route configured with the command ip route 0.0.0.0 0.0.0.0 is another way to set the gateway of last resort on a router. As with theip default-networkcommand, the use of the static route to 0.0.0.0 is not dependent on any routing protocols. However,ip routingmust be enabled on the router.
Note: EIGRP propagates a route to network 0.0.0.0, but the static route must be redistributed into the routing protocol.
In earlier versions of RIP, the default route created through theip route 0.0.0.0 0.0.0.0was automatically advertised by RIP routers. In Cisco IOS Software Release 12 and later, RIP does not advertise the default route if the route is not learned via RIP. It can be necessary to redistribute the route into RIP.
The default routes configured with theip route 0.0.0.0 0.0.0.0command are not propagated by OSPF and IS-IS. Additionally, this default route cannot be redistributed into OSPF or IS-IS through theredistributecommand. Use the default-information originate command to generate a default route into an IS-IS or OSPF routing domain. For more detailed information about the behavior of default routes with OSPF, please refer toHow Does OSPF Generate Default Routes?. The next output is an example on how to configure a gateway of last resort with the use of theip route 0.0.0.0 0.0.0.0command:
Note:If you configure multiple networks as candidate default routes via theip default-networkcommand, the network that has the lowest administrative distance is chosen as the network for the gateway of last resort. If all the networks have the same administrative distance then the network listed first in the routing table is chosen as the network for the gateway of last resort. If you use both theip default-networkandip route 0.0.0.0 0.0.0.0commands to configure candidate default networks theip route 0.0.0.0 0.0.0.0command, takes precedence and is chosen for the gateway of last resort. If you use multipleip route 0.0.0.0 0.0.0.0commands to configure a default route, traffic is load-balanced over the multiple routes.
Summary
Use theip default-gatewaycommand whenip routingis disabled on a Cisco router. Use theip default-networkorip route 0.0.0.0 0.0.0.0commands to set the gateway of last resort on Cisco routers that haveip routingenabled. The way in which routing protocols propagate the default route information varies for each protocol.
Краткие заметки по Cisco CCNA (часть ICND1)
В этом посте я структурировал заметки, созданные вместе со слушателями на курсах в процессе повторения пройденного материала. Изначально все это делалось в блокноте. В посте нет детальных описаний и т.д. Добавил немного графиков и оформил по порядку. В общем, рассматривайте информацию, как краткие шпаргалки, которые можно почитать вечером перед сдачей экзамена, чтобы быстро все освежить в памяти. Если будет интересно, то можно выложить ICND2, да и много чего еще есть в таком же духе.
Маршруты и маршрутизация на оборудовании Cisco
Read the article ROUTES AND ROUTING EXPLAINED in 
English
Как добавить маршрут
Изначально любой маршрутизатор или межсетевой экран знает о существовании только тех сетей, которые подключены к нему напрямую. Это касается как оборудования Cisco, так и любых других производителей. Если у устройства 2 интерфейса, на которых заданы ip адреса из разных сетей, то оно способно передать пакет от одного подключенного к нему хоста к другому – маршрутизировать трафик. Конечно же, если на хостах не забыть указать это самое устройство в качестве шлюза.
Предыдущий пример очень простой и немного оторван от жизни. Рассмотрим чуть более сложный вариант. Есть 2 офиса фирмы, в каждом офисе локальная сеть подключена к своему маршрутизатору, и между площадками проложен канал связи.
В этом случае по умолчанию каждый маршрутизатор знает о собственной локальной сети и о канале связи, но не знает, куда направить пакеты, чтобы они попали в сеть соседнего офиса. Если использовать Ping, то для каждого из маршрутизаторов будет доступен внешний адрес другого маршрутизатора, но недоступен ни один из адресов соседней локальной сети.
Для того, чтобы связь между хостами А и Б была возможна, необходимо добавить в конфигурацию обоих маршрутизаторов строки маршрутов для удаленных сетей.
Синтаксис следующий:
Ip route x.x.x.x x.x.x.x y.y.y.y
x.x.x.x x.x.x.x – адрес и маска для удаленной сети
y.y.y.y – Шлюз. Это — ближайший адрес соседнего маршрутизатора, через который будет доступна удаленная сеть.
Строки маршрутов в конфигурации будут следующими:
Для маршрутизатора 1 (левый)
R-DELTACONFIG-1(config)#
ip route 192.168.20.0 255.255.255.0 10.0.0.2
Для маршрутизатора 2 (правый)
R-DELTACONFIG-2(config)#
ip route 192.168.10.0 255.255.255.0 10.0.0.1
Важно!
Если добавить маршрут только на одном маршрутизаторе, то пакет от хоста А до хоста Б пройдет весь путь в одну сторону, но, не найдя обратного маршрута, будет отброшен. Каждое устройство в сети, передающее ip пакет, должно знать о маршруте как до источника, так и до назначения, независимо от количества устройств в сети.
Суммаризация маршрутов, шлюз по умолчанию (default gateway) и приоритеты
Маршруты можно указывать не только до сетей, но и делать их более конкретными вплоть до маршрутов до отдельных хостов.
Например, маршрут из предыдущего примера до хоста Б будет выглядеть так:
ip route 192.168.20.2 255.255.255.255 10.0.0.2
Также можно объединять несколько маршрутов до разных сетей, но через один и тот же шлюз под одним – суммаризировать.
Для примера маршруты до четырех сетей, доступных через один и тот же шлюз можно записать в виде маршрута до одной более широкой сети, изменив маску.
Следующие маршруты
ip route 192.168.20.0 255.255. 255 .0 10.0.0.2
ip route 192.168.21.0 255.255. 255 .0 10.0.0.2
ip route 192.168.22.0 255.255. 255 .0 10.0.0.2
ip route 192.168.23.0 255.255. 255 .0 10.0.0.2
Можно записать как маршрут до одной сети
ip route 10.168.20.0 255.255. 252 .0 10.0.0.2
Я сознательно не буду поднимать вопрос подсчета ip адресов сетей и их масок. Это достаточно обширная тема, которой обычно посвящаются не отдельные статьи, а даже целые главы книг. Надеюсь, что у моего читателя уже есть определенный запас этих самых теоретических знаний.
Важно!
Всегда маршрут до конкретной сети имеет приоритет над суммаризированным маршрутом, независимо от размера сетей.
Частным случаем суммаризированных маршрутов является шлюз по умолчанию (default gateway). Это маршрут до сети 0.0.0.0 с маской 0.0.0.0 через заданный шлюз.
ip route 0.0.0.0 0.0.0.0 х.х.х.х
где х.х.х.х – адрес шлюза
Такая строка в конфигурации говорит устройству отправлять все ip пакеты, для которых нет конкретных маршрутов, на заданный шлюз. Обычно такие маршруты используются при подключении к Интернет. В качестве шлюза указывается ближайший адрес на оборудовании провайдера связи.
Для лучшего понимания рассмотрим третий пример, наиболее приближенный к реальности. Все в тех же двух офисах есть не только выделенный канал между ними, но и каналы в Интернет. 1.1.1.1 и 2.2.2.2 – адреса оборудования провайдера, выступающие в качестве шлюзов.
Строки в конфигурации
Для маршрутизатора 1 (левый)
R-DELTACONFIG-1(config)#
ip route 192.168.20.0 255.255.255.0 10.0.0.2
ip route 0.0.0.0 0.0.0.0 1.1.1.1
Для маршрутизатора 2 (правый)
R-DELTACONFIG-2(config)#
ip route 192.168.10.0 255.255.255.0 10.0.0.1
ip route 0.0.0.0 0.0.0.0 2.2.2.2
С такими маршрутами каждый из двух маршрутизаторов будет знать о локальной сети соседнего офиса, а все пакеты в неизвестные ему сети (Интернет) перенаправлять на шлюз провайдера.
Важно!
Еще раз напомню, что последовательность строк маршрутов в конфигурации не имеет значения. Приоритет выдается всегда наиболее точному и конкретному маршруту. Если устройство не найдет конкретных записей в своей таблице маршрутизации, то только тогда будет использоваться шлюз по умолчанию (default gateway).
Meaning of the ip default-gateway L2 switch
What is meaning of the ip default-gateway command on a Cisco L2 switch? I read something about it on the Internet, but there was written that it allows you to Telnet to the switch. I am little bit confused. When I want to Telnet to the switch, I set the IP address of the VLAN 1 interface, and it works.
3 Answers 3
tl;dr
The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session.
Long explanation:
The default gateway on a switch has the same function as any gateway configured on a host PC. Without a default gateway, the switch management address (on VLAN 1 in your case, but it could be on any VLAN configured on the switch) cannot send traffic off its network to another network.
When a host (including the switch management), wants to send a packet to another host, it needs to resolve the layer-3 address (IP, etc.) to the other host’s layer-2 address (MAC, etc.) in order to build a layer-2 frame.
The host (including the switch management) sends an ARP (Address Resolution Protocol) request via a broadcast to do the resolution. Broadcasts do not cross layer-3 boundaries (routers). The host (including the switch management) can tell if the destination layer-3 address is outside its network because it has its own layer-3 address, the destination layer-3 address, and the network mask of its network. If the destination is on a different layer-3 network, the host (including the switch management) will send the frame to the gateway’s layer-2 address.
IPv6 does basically the same thing, but IPv6 doesn’t have broadcasts, so it uses a special multicast group based on the last 24 bits of the IPv6 address. This doesn’t interrupt every host on the LAN, and it, in all probability, with only hit the host for which it wants to resolve the layer-2 address. Multicast doesn’t cross layer-3 boundaries, either, unless a router is configured to route multicast (off by default).
The short answer here is that the default gateway is the local router that gets traffic to other networks. It is the default way to get off of your network.
Remember, routers connect networks and switches create networks. If you are off on another (non-Vlan1) network, you must route the traffic. For instance, your home LAN (x.x.x.x) and your ISP network (y.y.y.y) have a router to connect them (commonly called a cable modem).
When I want to Telnet to the switch, I set the IP address of the VLAN 1 interface, and it works.
I was also puzzled to know that even though I did not configure a default gateway (using the ip default-gateway command) on my Catalyst 2960 L2 Switch. I could ping/telnet to it not only from a host on the same subnet, but also from hosts on remote subnets.
Hosts send packets to its default gateway when the packet’s destination IP Address is in a different subnet, and if no default gateway has been configured they simply can’t communication outside its local subnet. So, the question is how come the Switch’s VLAN 1 Interface is a able to send data to the local router/gateway if it hasn’t been configured with such?
Well, turns out that although the Switch’s VLAN 1 Interface doesn’t know the IP Address of its Default Gateway, it issues an ARP Broadcast to learn the MAC Address of packet’s destination Host (just like it would if the packet’s destination IP Address was in the same subnet) and once the router’s LAN Interface receives the ARP Broadcast message it tries to match the Target IP Address to any of its routes, if a match is found (meaning that the router knows how to get to the subnet the Target IP Address resides in), then it replies with the MAC Address of the interface in which the ARP Message was received.
Here’s a diagram explaining the whole process:
Notice that without a configured default gateway the Switch needs to issue an ARP Broadcast for every new non-local IP Address it wants to communicate with, meaning that the Switch’s ARP Table will list an entry for every non-local IP Address pointing to the same MAC Address (the local router’s interface MAC Address). On the other hand, if you configure the Switch with a Default Gateway, the Switch needs to issue only one ARP Broadcast to learn the MAC Address of its configured default gateway.
Update: As pointed out by @RonMaupin, Routers will only reply to ARP Requests for non-local IP Addresses if proxy arp is enabled on the gateway’s Interface