Octet

Make routed access switches EIGRP stubs and summarize the block at distribution

Cisco IOSWorking

Tasks

  1. Run EIGRP AS 100 on all four switches with precise network statements.
  2. Make the access SVIs passive and allow neighbors only on the routed uplinks.
  3. Configure ASW1 and ASW2 as stubs that advertise connected and summary routes.
  4. Summarize 10.20.0.0/24 to 10.20.3.0/24 as 10.20.0.0/22 from DSW1 toward CORE1.
  5. Confirm CORE1 sees only the summary and DSW1 no longer queries the access switches.

Solution

  1. 1Access switch ASW1ASW1
    ASW1 on Cisco IOS
    ip routing
!
interface GigabitEthernet1/0/1
 description to DSW1
 no switchport
 ip address 10.0.1.2 255.255.255.252
interface Vlan10
 ip address 10.20.0.1 255.255.255.0
interface Vlan11
 ip address 10.20.1.1 255.255.255.0
!
router eigrp 100
 network 10.0.1.0 0.0.0.3
 network 10.20.0.0 0.0.1.255
 passive-interface default
 no passive-interface GigabitEthernet1/0/1
 eigrp stub connected summary
 eigrp router-id 10.255.0.11

    0.0.1.255 covers 10.20.0.0 to 10.20.1.255, both SVIs. An SVI only comes up when its VLAN exists and has at least one active port in it.

  2. 2Access switch ASW2ASW2
    ASW2 on Cisco IOS
    ip routing
!
interface GigabitEthernet1/0/1
 description to DSW1
 no switchport
 ip address 10.0.1.6 255.255.255.252
interface Vlan20
 ip address 10.20.2.1 255.255.255.0
interface Vlan21
 ip address 10.20.3.1 255.255.255.0
!
router eigrp 100
 network 10.0.1.4 0.0.0.3
 network 10.20.2.0 0.0.1.255
 passive-interface default
 no passive-interface GigabitEthernet1/0/1
 eigrp stub connected summary
 eigrp router-id 10.255.0.12
  3. 3Distribution switch DSW1 with the summary toward the coreDSW1
    DSW1 on Cisco IOS
    ip routing
!
interface GigabitEthernet1/0/1
 description to CORE1
 no switchport
 ip address 10.0.0.2 255.255.255.252
 ip summary-address eigrp 100 10.20.0.0 255.255.252.0
interface GigabitEthernet1/0/2
 description to ASW1
 no switchport
 ip address 10.0.1.1 255.255.255.252
interface GigabitEthernet1/0/3
 description to ASW2
 no switchport
 ip address 10.0.1.5 255.255.255.252
!
router eigrp 100
 network 10.0.0.0 0.0.0.3
 network 10.0.1.0 0.0.0.7
 eigrp router-id 10.255.0.2

    The summary goes on the uplink toward the routers that should see only the /22, never on the downlinks.

  4. 4Core switch CORE1CORE1
    CORE1 on Cisco IOS
    ip routing
!
interface GigabitEthernet1/0/1
 description to DSW1
 no switchport
 ip address 10.0.0.1 255.255.255.252
!
router eigrp 100
 network 10.0.0.0 0.0.0.3
 eigrp router-id 10.255.0.1

Verify

DSW1 output
DSW1# show ip eigrp neighbors detail | include Stub|Suppressing
Stub Peer Advertising (CONNECTED SUMMARY ) Routes
Suppressing queries
Stub Peer Advertising (CONNECTED SUMMARY ) Routes
Suppressing queries

Two stub peers, ASW1 and ASW2. DSW1 will not send them queries. CORE1 is not a stub, so it has no such lines.

DSW1 output
DSW1# show ip route eigrp | include 10.20
D        10.20.0.0/22 is a summary, 00:03:52, Null0
D        10.20.0.0/24 [90/3072] via 10.0.1.2, 00:03:52, GigabitEthernet1/0/2
D        10.20.1.0/24 [90/3072] via 10.0.1.2, 00:03:52, GigabitEthernet1/0/2
D        10.20.2.0/24 [90/3072] via 10.0.1.6, 00:03:50, GigabitEthernet1/0/3
D        10.20.3.0/24 [90/3072] via 10.0.1.6, 00:03:50, GigabitEthernet1/0/3

DSW1 keeps every /24 (2816 on the access switch plus one gigabit hop: 256 x (10 + 2) = 3072) and has the Null0 discard route for the /22 with AD 5.

CORE1 output
CORE1# show ip route eigrp | begin Gateway
Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
D        10.0.1.0/30 [90/3072] via 10.0.0.2, 00:03:40, GigabitEthernet1/0/1
D        10.0.1.4/30 [90/3072] via 10.0.0.2, 00:03:40, GigabitEthernet1/0/1
D        10.20.0.0/22 [90/3328] via 10.0.0.2, 00:03:40, GigabitEthernet1/0/1

One /22 instead of four /24s. Its metric is the best component on DSW1 (3072) plus CORE1's own gigabit link: 256 x (10 + 3) = 3328.

ASW1 output
ASW1# show ip route eigrp | include 10.20.2.0
D        10.20.2.0/24 [90/3328] via 10.0.1.1, 00:03:45, GigabitEthernet1/0/1

Stubs still receive everything DSW1 sends. ASW1 reaches ASW2's VLAN 20 through DSW1: 256 x (10 + 3) = 3328.

Mistakes people make

  • Configuring ip summary-address on the downlinks instead of the uplink. The core still receives every /24, so nothing is gained.
  • Using eigrp stub receive-only on an access switch. It then advertises nothing, and its VLANs disappear from the network.
  • Forgetting the stub on one access switch. DSW1 still queries that one, and if it is dual-homed it can become a transit path between distribution switches.
  • A summary that covers space used elsewhere. The Null0 route on DSW1 will black-hole traffic for any part of the /22 that is not behind it.

On other platforms

The same design in named mode. The summary moves under the af-interface and the stub under the address family.

Cisco IOS
! DSW1
router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  af-interface GigabitEthernet1/0/1
   summary-address 10.20.0.0 255.255.252.0
  exit-af-interface
  network 10.0.0.0 0.0.0.3
  network 10.0.1.0 0.0.0.7
  eigrp router-id 10.255.0.2
 exit-address-family
!
! ASW1
router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  af-interface default
   passive-interface
  exit-af-interface
  af-interface GigabitEthernet1/0/1
   no passive-interface
  exit-af-interface
  network 10.0.1.0 0.0.0.3
  network 10.20.0.0 0.0.1.255
  eigrp router-id 10.255.0.11
  eigrp stub connected summary
 exit-address-family

Say it in the interview

"Access switches are stubs, so the distribution switch never queries them and they can never become transit. The distribution switch summarizes the block to the core as one /22, so a VLAN flapping in the access layer changes nothing the core can see, and a query from DSW1 is answered by the core at once. The summary installs a Null0 route on DSW1 with AD 5, which is what stops loops for unused space."

Book 3.4 Routing