Cisco Module 5: Network Layer - IPv4 and IPv6

Module 5: Network Layer Introduction to Networks v7.0 (ITN) Network Layer Characteristics © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 Network Layer Characteristics The Network Layer Provides services to allow end devices to exchange da...

Module 5: Network Layer Introduction to Networks v7.0 (ITN) Network Layer Characteristics © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 Network Layer Characteristics The Network Layer Provides services to allow end devices to exchange data IP version 4 (IPv4) and IP version 6 (IPv6) are the principle network layer communication protocols. The network layer performs four basic operations: Addressing end devices Encapsulation Routing De-encapsulation © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Network Layer Characteristics IP Encapsulation IP encapsulates the transport layer segment. IP can use either an IPv4 or IPv6 packet and not impact the layer 4 segment. IP packet will be examined by all layer 3 devices as it traverses the network. The IP addressing does not change from source to destination. Note: NAT will change addressing, but will be discussed in a later module. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 Network Layer Characteristics Characteristics of IP IP is meant to have low overhead and may be described as: Connectionless Best Effort Media Independent © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 Network Layer Characteristics Connectionless IP is Connectionless IP does not establish a connection with the destination before sending the packet. There is no control information needed (synchronizations, acknowledgments, etc.). The destination will receive the packet when it arrives, but no pre-notifications are sent by IP. If there is a need for connection-oriented traffic, then another protocol will handle this (typically TCP at the transport layer). © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 Network Layer Characteristics Best Effort IP is Best Effort IP will not guarantee delivery of the packet. IP has reduced overhead since there is no mechanism to resend data that is not received. IP does not expect acknowledgments. IP does not know if the other device is operational or if it received the packet. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Network Layer Characteristics Media Independent IP is unreliable: It cannot manage or fix undelivered or corrupt packets. IP cannot retransmit after an error. IP cannot realign out of sequence packets. IP must rely on other protocols for these functions. IP is media Independent: IP does not concern itself with the type of frame required at the data link layer or the media type at the physical layer. IP can be sent over any media type: copper, fiber, or wireless. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 Network Layer Characteristics Media Independent (Contd.) The network layer will establish the Maximum Transmission Unit (MTU). Network layer receives this from control information sent by the data link layer. The network then establishes the MTU size. Fragmentation is when Layer 3 splits the IPv4 packet into smaller units. Fragmenting causes latency. IPv6 does not fragment packets. Example: Router goes from Ethernet to a slow WAN with a smaller MTU © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9 IPv4 Packet © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10 IPv4 Packet IPv4 Packet Header IPv4 is the primary communication protocol for the network layer. The network header has many purposes: It ensures the packet is sent in the correct direction (to the destination). It contains information for network layer processing in various fields. The information in the header is used by all layer 3 devices that handle the packet © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11 IPv4 Packet IPv4 Packet Header Fields The IPv4 network header characteristics: It is in binary. Contains several fields of information Diagram is read from left to right, 4 bytes per line The two most important fields are the source and destination. Protocols may have one or more functions. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 IPv4 Packet IPv4 Packet Header Fields Significant fields in the IPv4 header: Function Description Version This will be for v4, as opposed to v6, a 4 bit field= 0100 Differentiated Services Used for QoS: DiffServ – DS field or the older IntServ – ToS or Type of Service Header Checksum Detect corruption in the IPv4 header Time to Live (TTL) Layer 3 hop count. When it becomes zero the router will discard the packet. Protocol I.D.s next level protocol: ICMP, TCP, UDP, etc. Source IPv4 Address 32 bit source address Destination IPV4 Address 32 bit destination address © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 IPv6 Packets © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14 IPv6 Packets Limitations of IPv4 IPv4 has three major limitations: IPv4 address depletion – We have basically run out of IPv4 addressing. Lack of end-to-end connectivity – To make IPv4 survive this long, private addressing and NAT were created. This ended direct communications with public addressing. Increased network complexity – NAT was meant as temporary solution and creates issues on the network as a side effect of manipulating the network headers addressing. NAT causes latency and troubleshooting issues. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15 IPv6 Packets IPv6 Overview IPv6 was developed by Internet Engineering Task Force (IETF). IPv6 overcomes the limitations of IPv4. Improvements that IPv6 provides: Increased address space – based on 128 bit address, not 32 bits Improved packet handling – simplified header with fewer fields Eliminates the need for NAT – since there is a huge amount of addressing, there is no need to use private addressing internally and be mapped to a shared public address © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 IPv6 Packets IPv4 Packet Header Fields in the IPv6 Packet Header The IPv6 header is simplified, but not smaller. The header is fixed at 40 Bytes or octets long. Several IPv4 fields were removed to improve performance. Some IPv4 fields were removed to improve performance: Flag Fragment Offset Header Checksum © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 IPv6 Packets IPv6 Packet Header Significant fields in the IPv6 header: Function Description Version This will be for v6, as opposed to v4, a 4 bit field= 0110 Traffic Class Used for QoS: Equivalent to DiffServ – DS field Flow Label Informs device to handle identical flow labels the same way, 20 bit field Payload Length This 16-bit field indicates the length of the data portion or payload of the IPv6 packet Next Header I.D.s next level protocol: ICMP, TCP, UDP, etc. Hop Limit Replaces TTL field Layer 3 hop count Source IPv4 Address 128 bit source address Destination IPV4 Address 128 bit destination address © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18 How a Host Routes © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19 How a Host Routes Host Forwarding Decision Packets are always created at the source. Each host devices creates their own routing table. A host can send packets to the following: Itself – 127.0.0.1 (IPv4), ::1 (IPv6) Local Hosts – destination is on the same LAN Remote Hosts – devices are not on the same LAN © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20 How a Host Routes Host Forwarding Decision (Cont.) The Source device determines whether the destination is local or remote Method of determination: IPv4 – Source uses its own IP address and Subnet mask, along with the destination IP address IPv6 – Source uses the network address and prefix advertised by the local router Local traffic is dumped out the host interface to be handled by an intermediary device. Remote traffic is forwarded directly to the default gateway on the LAN. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21 How a Host Routes Default Gateway A router or layer 3 switch can be a default-gateway. Features of a default gateway (DGW): It must have an IP address in the same range as the rest of the LAN. It can accept data from the LAN and is capable of forwarding traffic off of the LAN. It can route to other networks. If a device has no default gateway or a bad default gateway, its traffic will not be able to leave the LAN. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22 How a Host Routes A Host Routes to the Default Gateway The host will know the default gateway (DGW) either statically or through DHCP in IPv4. IPv6 sends the DGW through a router solicitation (RS) or can be configured manually. A DGW is static route which will be a last resort route in the routing table. All device on the LAN will need the DGW of the router if they intend to send traffic remotely. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23 How a Host Routes Host Routing Tables On Windows, route print or netstat -r to display the PC routing table Three sections displayed by these two commands: Interface List – all potential interfaces and MAC addressing IPv4 Routing Table IPv6 Routing Table © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 Introduction to Routing © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25 Introduction to Routing Router Packet Forwarding Decision What happens when the router receives the frame from the host device? © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26 Introduction to Routing IP Router Routing Table There three types of routes in a router’s routing table: Directly Connected – These routes are automatically added by the router, provided the interface is active and has addressing. Remote – These are the routes the router does not have a direct connection and may be learned: Manually – with a static route Dynamically – by using a routing protocol to have the routers share their information with each other Default Route – this forwards all traffic to a specific direction when there is not a match in the routing table © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27 Introduction to Routing Static Routing Static Route Characteristics: Must be configured manually Must be adjusted manually by the administrator when there is a change in the topology Good for small non-redundant networks Often used in conjunction with a dynamic routing protocol for configuring a default route © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28 Introduction to Routing Dynamic Routing Dynamic Routes Automatically: Discover remote networks Maintain up-to-date information Choose the best path to the destination Find new best paths when there is a topology change Dynamic routing can also share static default routes with the other routers. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29 Introduction to Routing Introduction to an IPv4 Routing Table The show ip route command shows the following route sources: L - Directly connected local interface IP address C – Directly connected network S – Static route was manually configured by an administrator O – OSPF D – EIGRP This command shows types of routes: Directly Connected – C and L Remote Routes – O, D, etc. Default Routes – S* © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30 MAC and IP © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31 MAC and IP Destination on Same Network There are two primary addresses assigned to a device on an Ethernet LAN: Layer 2 physical address (the MAC address) – Used for NIC to NIC communications on the same Ethernet network. Layer 3 logical address (the IP address) – Used to send the packet from the source device to the destination device. Layer 2 addresses are used to deliver frames from one NIC to another NIC on the same network. If a destination IP address is on the same network, the destination MAC address will be that of the destination device. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32 MAC and IP Destination on Remote Network When the destination IP address is on a remote network, the destination MAC address is that of the default gateway. ARP is used by IPv4 to associate the IPv4 address of a device with the MAC address of the device NIC. ICMPv6 is used by IPv6 to associate the IPv6 address of a device with the MAC address of the device NIC. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33 ARP © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34 ARP ARP Overview A device uses ARP to determine the destination MAC address of a local device when it knows its IPv4 address. ARP provides two basic functions: Resolving IPv4 addresses to MAC addresses Maintaining an ARP table of IPv4 to MAC address mappings © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35 ARP ARP Functions To send a frame, a device will search its ARP table for a destination IPv4 address and a corresponding MAC address. If the packet’s destination IPv4 address is on the same network, the device will search the ARP table for the destination IPv4 address. If the destination IPv4 address is on a different network, the device will search the ARP table for the IPv4 address of the default gateway. If the device locates the IPv4 address, its corresponding MAC address is used as the destination MAC address in the frame. If there is no ARP table entry is found, then the device sends an ARP request. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36 ARP ARP Operation Step 1 52 Step Step Step 43 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37 ARP Removing Entries from an ARP Table Entries in the ARP table are not permanent and are removed when an ARP cache timer expires after a specified period of time. The duration of the ARP cache timer differs depending on the operating system. ARP table entries can also be removed manually by the administrator. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38 ARP ARP Tables on Networking Devices The show ip arp command displays the ARP table on a Cisco router. The arp –a command displays the ARP table on a Windows 10 PC. R1# show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.10.1 - a0e0.af0d.e140 ARPA GigabitEthernet0/0/0 C:\Users\PC> arp -a Interface: 192.168.1.124 --- 0x10 Internet Address Physical Address Type 192.168.1.1 c8-d7-19-cc-a0-86 dynamic 192.168.1.101 08-3e-0c-f5-f7-77 dynamic © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39 ARP ARP Issues – ARP Broadcasting and ARP Spoofing ARP requests are received and processed by every device on the local network. Excessive ARP broadcasts can cause some reduction in performance. ARP replies can be spoofed by a threat actor to perform an ARP poisoning attack. Enterprise level switches include mitigation techniques to protect against ARP attacks. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 40