Routing and Remote Access

Using the Routing and Remote Access Microsoft Management Console (MMC) on a Windows Server 2003 system, you can manually add a static route by expanding the server in the left pane that will host the static route.

Under IP Routing, right-click Status Routes to create a new static route entry (see Figure 4.2).

Figure 4.2. Adding a static route to the host system through the Routing and Remote Access MMC.

If you need to delete this static route later, simply right-click it in the right pane of the Routing and Remote Access MMC, and choose Delete from the shortcut menu.

With Windows 2000 and 2003 servers, you can enable the Routing and Remote Access Service and configure the server with routing protocols that can dynamically update routing information so that static entries do not have to be manually maintained . If a route changes for any reason ”a temporary hardware failure, the removal or addition of another routing device, and so on ”and static route entries are being performed, a network administrator must manually update the routing information wherever static records are stored.

To choose a new routing protocol, such as Open Shortest Path First (OSPF) or Routing Information Protocol (RIPv2), go to the Routing and Remote Access MMC and expand the server in the left pane that will function as the dynamic router. Under IP Routing, right-click General, and choose New Routing Protocol. You can then add a new protocol in the New Routing Protocol dialog box (see Figure 4.3).

Figure 4.3. Adding a dynamic routing protocol in the Routing and Remote Access MMC.

Dynamic routing protocols, such as RIP versions 1 and 2 and OSPF, exchange information about their networks with other routers using the same dynamic routing protocols. RIP versions 1 and 2 are best used on medium- sized networks with about 50 routers maximum, and the maximum number of routers (hops) that any IP packet must cross is less than 16. Destination addresses that are 16 or more hops away are unreachable from RIP routers.

Routing update announcements generated by RIP routers can cause unacceptable levels of network traffic when more than 50 RIP routers are in use. RIP routers maintain a routing table and periodically send updates to other RIP routers on the network with their routing information. RIPv1 uses IP broadcast packets for its announcements, and RIPv2 uses IP multicast packets for its announcements.

OSPF is a link-state protocol based on an algorithm that determines the shortest path between source and destination nodes on a routed network. OSPF routers maintain the routed network information in a link state database. As updates to information in the database and routing table are made, they are synchronized between other OSPF routers.

OSPF protocol is a better choice than either version of RIP when the network is designed with redundant paths between locales or when the number of subnets in the overall design is more than 50 routers. With Windows Server 2003, both RIPv2 and OSPF can be installed on a server running RRAS.

Routing Protocols and RRAS

With RRAS under Window 2000 Server, administrators could install RIPv1 outright . If you take a look at the available routing protocols to install in Figure 4.3, you will see that RIPv1 is absent; however, it is still available in the Incoming Packet Protocol list box shown in Figure 4.4.

Figure 4.4. You can add RIPv1 in the RIP Properties dialog box.

RIPv1 is difficult to deploy in larger environments because it supports the main classes of IP addresses only and cannot use Classless Inter-Domain Routing (CIDR) or Variable Length Subnet Masks (VLSM).

RIPv1 is limited in security measures as well. Routers that exchange routing information using RIPv1 do not authenticate with each other, which could allow a Denial of Service (DoS) attack in which a hacker corrupts routing tables.

Also, because of the lack of proper security, RIP listeners can be placed on a network using RIPv1. This could allow someone to find out about the available networks in your enterprise.

On RIPv2 networks, routers broadcast their routing tables to other RIPv2 routers at predefined intervals via broadcast or multicast. RIPv2 supports simple password authentication, multicast announcements, CIDR, and VLSM. To configure RIPv1 or 2, set the outgoing packet protocol on the General tab to one of these options, depending on your design:

• RIP version 1 broadcast

• RIP version 2 broadcast

• RIP version 2 multicast

• Silent RIP

To complete the configuration, set the incoming packet protocol on the General tab to one of these, depending on your needs:

• Ignore incoming packets

• RIP version 1 and 2

• RIP version 1 only

• RIP version 2 only

If you need to enable authentication for your routers, select the Activate Authentication check box, and enter a password in the Password text box. All routers using RIPv2 to update each other must be configured in this way with the same password; otherwise , the route updates fail.

You can also configure additional security for RIP routers by setting the appropriate filters in the Security tab of the router's Properties dialog box. Select the appropriate radio button to accept all routes, to accept all routes from a given range of IP addresses that have been entered, or to ignore all routes from a given range of IP addresses that have been entered for incoming routes.

For outgoing routes, you can configure RIPv2 to announce all routes, to announce all routes from a given range of IP addresses that have been entered, or to not announce routes from a given range of IP addresses that have been entered (see Figure 4.5).

Figure 4.5. You can select actions to take for routing in the Security tab of the RIP Properties dialog box.

You can configure how this router responds to neighboring routers in the Neighbors tab of the RIP Properties dialog box. You can configure it to function by using broadcast and multicast only, using specific neighbors (notated by entering their IP addresses) in addition to broadcast and multicast, or by using only neighboring routers via the entered IP addresses.

In the Advanced tab, you can set timers for periodic updates by specifying the announcement interval in seconds (see Figure 4.6). You can also set the time before routes expire and the time before a route is removed by entering numeric values that denote seconds.

Figure 4.6. The settings shown in the Advanced tab of the RIP Properties dialog box are the default values.

Notice that the following options are enabled by default:

• Split-horizon processing ” This route-advertising method prevents advertising routes in the same direction in which they were learned, which avoids routing loop situations.

• Poison-reverse processing ” This option is used with split-horizon processing to improve RIP convergence by advertising all network IDs.

• Triggered updates ” These route advertising methods advertise changes in the network topology as they occur, instead of waiting for the next scheduled interval.

• Clean-up updates ” These updates are set when subnet summarization is being stopped and disabled.

The following options can also be set, if needed:

• Process Host Routes in Received Announcements

• Include Host Routes in Sent Announcements

• Process Default Routes in Received Announcements

• Include Default Routes in Sent Announcements

With OSPF, administrators can create an OSPF area by installing the OSPF protocol and then installing a new interface. To do this, right-click OSPF in the Routing and Remote Access MMC and choose New Interface, which enables OSPF for the selected network connection (see Figure 4.7).

Figure 4.7. The OSPF Properties dialog box for an interface that has been configured. Because an OSPF area has not yet been assigned, the Area ID text box shows 0.0.0.0, which denotes a backbone area, not an actual IP address.

OSPF is not available on Windows XP 64-bit edition and the 64-bit versions of Windows Server 2003. After all available interfaces on a system have been configured for OSPF, you will receive an error message if you attempt to choose New Interface again.

In the General tab, you can set the level of logging for the protocol with one of the following radio buttons :

• Log Errors Only

• Log Errors and Warnings

• Log the Maximum Amount of Information

• Disable Event Logging

To create an OSPF area, right-click OSPF and choose Properties to open the OSPF Properties dialog box. In the Areas tab, click the Add button to add an IP address. (Notice that the Enable Plaintext Password check box is selected by default.) Enter a destination IP address and a network mask in the Ranges text box.

You can enable the OSPF area as a stub area by selecting the corresponding check box in the General tab. You cannot configure the default area ID of 0.0.0.0 as a stub area, and you cannot configure virtual links through stub areas.

To configure OSPF as an autonomous system boundary router that connects this router to another autonomous system or the Internet, select the Enable Autonomous System Boundary Router check box in the General tab of the OSPF Properties dialog box.

After you change this setting, the External Routing tab is enabled. Select the Accept routes from all route sources except those selected radio button or the Ignore routes from all route sources except those selected radio button (see Figure 4.8), depending on your requirements.

Figure 4.8. You can't use the External Routing tab until you have selected the Enable Autonomous System Boundary Router check box in the General tab.

To enable route filters, click the Route Filters button in the External Routing tab. In the OSPF External Route Filters dialog box, select the Ignore Listed Routes radio button or the Accept Listed Routes radio button and enter the appropriate IP addresses in the Destination and Network Mask text boxes.

Notes from the Field

How you set up and configure RRAS and decide which routing protocols to use depend on the types of networking devices in your network, such as hubs, switches, and routers. Some switches operate at the Data Link layer (Layer 2) of the OSI model and form the borders of your collision domains. Bridges also work at Layer 2 and function in the same manner.

Network collisions occur when two hosts attempt to transmit data at the same time. A collision domain is a network segment in which all devices on that segment can "hear" when the collision happens. If a network design includes a switch at one end and a bridge at the other, for example, all hosts between those two network devices would be considered part of a single collision domain. Devices beyond the Layer 2 switch and bridge typically belong to a different collision domain.

Layer 2 switches and bridges do not form a border for broadcast domains , which are network segments in which all devices on those segments can hear broadcast and multicast messages. Broadcast and multicast frames are found at Layer 3 of the OSI model, so devices such as Layer 2 switches and bridges simply pass these packets along.

To create boarders for broadcast domains in an effort to segment which network devices hear broadcast messages, you need to use a Layer 3 switch or a router that operates at the Network layer of the OSI model. Network routing and switching devices can run in Full Duplex mode or Half Duplex mode.

Full Duplex devices allow two hosts on the same transmission medium at the same time. An everyday example of this type of transmission is the telephone: Both parties can speak and hear at the same time. Half Duplex devices allow only a single device to use the medium at a time. An everyday example of this type of transmission is the walkie-talkie: Only one person at a time can speak while the other listens. Whoever has the "speak and send" action at a certain point can be heard on any other walkie-talkie set to that frequency.

If one person presses the "talk" key at the same time as someone else, neither message is received by other units because both people are trying to access the same medium (frequency) at the same time. This is called a "collision," and both units must wait their turn to successfully transmit a message, just as two computers need to when they're on the same wire.