Tidbit: Hide Routers from Traceroute

Do you have that one guy in desktop support that always blames the network? Does he constantly ask why his trace route is going through device XYZ!? Then I have a solution for you! Hide your network from that sketchy desktop support guy!

In MPLS its easy squeezy (‘no mpls ip propagate-ttl’), but what if you don’t have MPLS? Well here’s a quick way to do it:

ip access-list extended ACL_Traceroute
 permit icmp any any time-exceeded
 permit icmp any any port-unreachable

Firstly just make an extended ACL to match (permit) imcp time-exceeded and port-unreachable. The time-exceeded messages are basically the messages that the TTL is decremented (is decremented even a real word?) in and sent back to the original sender. The port-unreachable is basically what it sounds like — if the gateway does not have a route for the prefix, this message should be sent back to the sender.

So what are we doing with this ACL? Well we match it in a route-map, point it to the bit bucket, and apply it as local policy:

route-map RM_Traceroute perm 10
 match ip add ACL_Traceroute
 set interface null0
 !
 ip local policy route-map RM_Traceroute

The outcome is that the devices configured with this local policy do not show up in a trace route. Below is the initial ‘baseline’ test from an OSX client to an OSX client across three routers:

Carls-MacBook-Pro:~ carl$ traceroute 10.10.200.5
 traceroute to 10.10.200.5 (10.10.200.5), 64 hops max, 52 byte packets
 1 10.10.100.1 (10.10.100.1) 4.144 ms 1.497 ms 2.159 ms <--- Gateway for my first laptop
 2 10.10.1.2 (10.10.1.2) 8.056 ms 6.473 ms 6.217 ms <--- R1
 3 10.10.1.6 (10.10.1.6) 10.247 ms 10.345 ms 10.267 ms <--- R2
 4 10.10.200.5 (10.10.200.5) 12.336 ms 12.538 ms 12.312 ms <--- Final host connected to R3

Now, here is that exact same trace route after adding our local policy:

Carls-MacBook-Pro:~ carl$ traceroute 10.10.200.5
 traceroute to 10.10.200.5 (10.10.200.5), 64 hops max, 52 byte packets
 1 * * *
 2 * * *
 3 * * *
 4 10.10.200.5 (10.10.200.5) 12.807 ms 11.450 ms 12.440 ms

As you can see this doesn’t ‘break’ the trace route, just kind of hides our routers. Note that a trace route TO a router will not complete since there is no message being sent back to the original sender since you are basically dropping the relevant incoming messages. As long as your destination is connected to a router that does NOT have the local policy though your traces will complete as per normal.

My understanding is that there are essentially three different ‘flavors’ of trace route — UNIX trace route (UDP), Windows trace route (tracert) which is strictly ICMP, and TCPTraceroute. So I tested this policy with a Windows host as well with basically the same results.

The baseline test:

C:\Users\Carl>tracert 10.10.200.6
Tracing route to Carl-PC [10.10.200.6]
 over a maximum of 30 hops:
1 3 ms 2 ms 2 ms 10.10.100.1
 2 7 ms 6 ms 6 ms 10.10.1.2
 3 11 ms 11 ms 10 ms 10.10.1.6
 4 12 ms 11 ms 12 ms Carl-PC [10.10.200.6]

And after adding the policy:

C:\Users\Carl>tracert 10.10.200.6
Tracing route to Carl-PC [10.10.200.6]
 over a maximum of 30 hops:
1 * * * Request timed out.
 2 * * * Request timed out.
 3 * * * Request timed out.
 4 12 ms 12 ms 13 ms Carl-PC [10.10.200.6]

So everything worked as planned!

I’m fairly confident that this will work for TCPTraceroutes as well but I didn’t test it out as I’m not 100% how to go about doing that… perhaps thats a post for another time.

Advertisements

Cisco XRv Impressions

I’ve been begging random Cisco folks that I meet for a copy of XRv, XR4U,CML, VIRL for a while now… it hasn’t worked very well… at all. This month Cisco has finally released XRv though, so now I have a new toy to play with! I’m not 100% sure what entitlements are required to be able to download this, but I was able to successfully download it sometime last week.

I won’t bother with talking about how to download it or install it because there are already plenty of posts in forums including a very in-depth post from Fryguy (@FRYGUY_PA) over on his blog about the install. One thing to note is that the ESXi Enterprise license is required in order to setup the Serial over Network feature as described in his post. Since I don’t have that, I had to do a bit of a work around with named pipes and serial ports. Heres some quick screen caps to show the setup:

XRvSide

In the above pic you can see that this serial port is basically configured with a named pipe, that this end, the “near” end, is a server (our XRv device), and the far end of the pipe goes to another virtual machine. The other virtual machine in my case is just a simple Ubuntu box with a serial port that is configured in the reverse of the above. In the Ubuntu VM I used screen to pop onto the TTY: “screen /dev/tty.S0” — I’m sure there are better/different ways to do that, but that worked for me.

Once you are “consoled” into the XRv device, you can assign an IP address to the management port (the first adapter you assigned by ESXi is the management port). I put this management port onto my normal home network. At this point things are “ping-able” and that’s pretty exciting (assuming you are lazy like me and have a “flat” network at your house), but telnet/SSH won’t work at this point. Via your console session, you can enable telnet as follows:

telnet ipv4 server max-servers 5

Note that the ‘5’ can be 1-100, I just used five for kicks. If your training has taught you to loathe telnet and not want to configure that you can easily setup SSH like this:

ssh server v2
 ssh server vrf default
 domain name home.lab
 crypto key generate rsa general-keys SSH

In the above snippet, obviously enter whatever domain name you would like, the final line there is an exec level config — ‘SSH’ is just a name for the key pair.
If you are not used to IOS-XR — you will have to remember to ‘commit’ changes that you make, luckily for you IOS-XR will do a pretty good job of barking at you to telling you that you forgot to do so!

Last piece here — if you are NOT lazy like me and have multiple subnets and would like to be able to reach your XRv device from any of them, you can set up a simple static default into your home network simply:

router static
  address-family ipv4 unicast
   0.0.0.0/0 [NEXT HOP]

So now that I’ve got this nifty XRv device humming along whats the deal. To answer that lest back up from the technical stuff for a bit. So whats the point of XRv? For me, the best part is that I can now lab some seriously cool and complex stuff that you just can’t do in GNS3. I’m sure that’s a nice plus for Cisco too, but that doesn’t make them much/any money (perhaps they will do a “study” license in future releases or more likely they will just do that with CML as has been discussed), and doesn’t really and any value/benefits for their customers.

I think more importantly (to Cisco at least) than the training/CML use case is the ability to use this as a virtual route reflector. Consider that in many scenarios route-reflectors are usually nothing more than a device with a bunch of memory to handle big routing tables and occasionally send them out when a client router goes offline and comes back up. That router isn’t actually in the transit path for any customer traffic at all, it’s just there to keep the tables and hand them out as needed. There is basically zero good reason to have that on an expensive ‘five nines’ physical router. Why not use XRv to leverage existing virtual environments, I’m assuming (not 100% sure but don’t see why not) it can be vMotion’d to allow for maintenance of the physical hosts; that’s surely a lot cheaper than buying two physical routers for redundancy, or loading up routers with multiple RPs etc. I really like this idea, and in fact have a customer right now that could really benefit from this type of flexibility.

Anyway, enough with that, lets see what I’ve found that works and doesn’t work so far.

Things I’ve gotten to work just like the real deal:
OSFP; haven’t done a bunch yet, but everything I’ve poked seems to work so I don’t see why there would be anything not working here.
EIGRP; same story.
Static; ditto.
Obviously it can be bridged into physical networks no problem. There was a thread somewhere that said that ESXi only supports up to 10 vNICs per host but XRv supports up to … some very high number. I’m not sure about either of those facts, but they sound legit! Though I think that’s mostly irrelevant for the ‘real world’ potential use case of route-reflection, and also probably not that big of a deal for lab too.
RSVP; its configurable without screaming at me… seems like a good start.
Multicast-routing; ditto RSVP.
Explicit path configs.

Things not working for sure:
BFD, don’t get any sessions to come up in OSPF… can try more later.

Things I’m 99% will work and will hopefully test soon:
L3 VPN — since it looks like everything required to do this work, can’t imagine it won’t work.
MPLS TE (sans fast reroute because of BFD)

Things I’m 99% sure will NOT work and will hopefully test soon:
L2VPN; it seems to want to accept configs for this, but I’m skeptical it will work…. we shall see

Misc:
CDP to physical stuff; network in ESXi is in promiscuous and all that fun stuff… CDP in GNS3 works in this fashion so this may warrant a bit more exploration. CDP between two XRv instances doesn’t appear to be working either. I would have thought this would work, but that may be due to the ESXi config stuff.

 

That’s all I’ve got for now. Bottom line is that XRv is pretty slick and I’m glad to finally have my hands on it. At this point I don’t think its a viable replacement for rack rentals/physical gear for CCIE SP lab use, but it certainly won’t hurt. I plan to try and write some more about XRv at some point hopefully soonish (but I’ve planned to write more about the DMVPN/BGP post too…. see how that’s working for me).