Mastering CCIE Enterprise Infrastructure
Complex Routing Architectures
Choosing the Right Tool
In a small network, getting a packet from A to B is straightforward. But in a large enterprise, with thousands of routes and multiple connections, it's not just about finding a path—it's about finding the best path based on policy, speed, and reliability. This is where choosing the right routing protocol becomes critical.
You're already familiar with Interior Gateway Protocols (IGPs) like OSPF and EIGRP, which operate within a single autonomous system (AS). We'll also explore the Border Gateway Protocol (BGP), an Exterior Gateway Protocol (EGP) designed to connect different autonomous systems. While they all solve the problem of routing, their design philosophies and scalability are fundamentally different.
| Feature | OSPF (Open Shortest Path First) | EIGRP (Enhanced Interior Gateway Routing Protocol) | BGP (Border Gateway Protocol) |
|---|---|---|---|
| Type | Link-State (IGP) | Advanced Distance-Vector (IGP) | Path-Vector (EGP) |
| Standard | Open Standard (IETF) | Originally Cisco-proprietary, now open | Open Standard (IETF) |
| Algorithm | Dijkstra SPF | DUAL | Path Selection |
| Best Use | Large, scalable enterprise networks | Cisco-centric enterprise networks | Internet, Service Providers, Large Enterprises |
| Key Strength | Hierarchical design via areas | Fast convergence, simple config | Granular policy control via path attributes |
Advanced OSPF Tuning
A single-area OSPF network is simple, but it doesn't scale well. As the network grows, every router must maintain a complete map of the entire topology. Any change, like a link flapping, forces every router to rerun the Shortest Path First (SPF) algorithm, consuming CPU and causing instability. This is known as a large single failure domain.
To solve this, OSPF uses a hierarchical design with areas. The backbone, Area 0, connects all other areas. By segmenting the network, we can control the propagation of Link-State Advertisements (LSAs), which are the building blocks of OSPF's topology database. This reduces the size of routing tables and limits the impact of topology changes to the specific area where they occur.
Different area types provide granular control over LSA filtering:
- Stub Area: These areas don't accept LSA Type 5 advertisements, which carry information about routes external to the OSPF domain (e.g., routes learned from EIGRP or BGP). Instead, routers in a stub area use a single default route to reach external destinations.
- Totally Stubby Area: This is even more restrictive. It blocks both external LSAs (Type 5) and inter-area summary LSAs (Type 3). Routers inside only know about routes within their own area and use a default route for everything else.
- Not-So-Stubby Area (NSSA): An NSSA is a compromise. It blocks Type 5 LSAs from other areas like a stub area, but it allows an Autonomous System Boundary Router (ASBR) within the NSSA to inject its own external routes into the OSPF domain using a special LSA (Type 7).
Modern EIGRP and BGP
EIGRP has also evolved. The classic configuration method required separate processes for IPv4 and IPv6. EIGRP Named Mode simplifies this by placing both IPv4 and IPv6 configurations under a single, unified process. This makes administration cleaner and less error-prone.
Furthermore, classic EIGRP metrics were designed for links up to 1 Gbps. With 10 Gbps and faster links becoming common, the original metric calculations couldn't differentiate between them effectively. Wide Metrics expand the metric calculation to 64 bits, providing the granularity needed to support modern high-speed networks.
! Classic EIGRP
router eigrp 10
network 10.1.1.0 0.0.0.255
!
ipv6 router eigrp 10
exit
! EIGRP Named Mode (Unified)
router eigrp MY_EIGRP_AS
! Address family for IPv4
address-family ipv4 unicast autonomous-system 10
network 10.1.1.0 0.0.0.255
exit-address-family
!
! Address family for IPv6
address-family ipv6 unicast autonomous-system 10
network 2001:DB8::/64
exit-address-family
While IGPs are masters of finding the shortest path within your network, BGP is designed for policy. It's the protocol of the internet, connecting different organizations. Inside a large enterprise, you might use BGP to manage connections between multiple sites or to influence traffic flow to and from service providers.
BGP doesn't use simple metrics like cost or bandwidth. Instead, it uses a rich set of path attributes to make decisions. By manipulating attributes like LOCAL_PREF (local preference), AS_PATH (the list of autonomous systems a route has traversed), and MED (multi-exit discriminator), you can engineer traffic paths with surgical precision.
IGPs find the shortest path. BGP finds the best path based on policy.
Virtualizing the Network
In multi-tenant environments, you often need to support separate, isolated routing domains on the same physical hardware. A classic example is a service provider hosting multiple customers. Each customer needs its own routing table, completely independent of the others. This is achieved through Virtual Routing and Forwarding (VRF).
VRF-Lite is a version of this technology that can be used within an enterprise without needing MPLS. It allows a single router to maintain multiple independent routing tables. Each interface is assigned to a specific VRF, and traffic from that interface can only be routed using the corresponding VRF's table. This is perfect for segmenting traffic, for instance, separating guest wireless traffic from secure corporate traffic.
To make VRFs work, your routing protocols must be VRF-aware. OSPF, EIGRP, and BGP can all be configured to run separate instances for each VRF, maintaining the logical separation across the network.
Managing the exchange of routes between these different protocols and VRFs is a delicate process called route redistribution. Without careful planning, redistribution can create routing loops or suboptimal paths. To prevent this, administrators use route maps and distribute lists to filter which routes are shared and route tagging to mark routes as they move between protocols, helping to identify their origin and prevent them from being advertised back into their source protocol.
Finally, in a complex network, speed of convergence is everything. Waiting for a routing protocol's timers to expire after a link failure can take seconds, which is an eternity for real-time applications. Bidirectional Forwarding Detection (BFD) is a lightweight protocol that works with routing protocols to detect link failures in milliseconds. BFD peers establish a session over a link and send rapid keepalive messages. If they stop hearing from each other, BFD immediately informs the routing protocol, which can then converge around the failure almost instantly.
What is the primary reason for implementing a multi-area OSPF design in a large network?
A network administrator needs to support multiple independent routing tables on a single router to logically separate traffic for different departments without using MPLS. Which technology should be used?
Mastering these advanced concepts is what separates a network administrator from a network architect. It's about moving from simply connecting devices to designing resilient, scalable, and policy-driven networks.
