...
To fix this we need to add a route that tells the router what is the next device in the network to reach the destination. In our example next hop is Router2, so we need to add a route with the gateway that points to the Routers Router's 2 connected address. This type of route is known as a static route:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[admin@MikroTik] > /ip route add dst-address=192.168.2.0/24 gateway=172.16.1.2
[admin@MikroTik] > /ip/route> print
Flags: D - dynamic; X - disabled, I - inactive, A - active; C - connect, S - static, r - ri
p, b - bgp, o - ospf, d - dhcp, v - vpn
Columns: DST-ADDRESS, GATEWAY, Distance
DST-ADDRESS GATEWAY D
DAC 10.1.1.0/24 ether1 0
DAC 172.16.1.0/30 ether2 0
DAC 192.168.1.0/24 bridge1 0
0 AS 192.168.2.0/24 172.16.1.2 |
...
Routing Information Base is a database that lists entries for particular network destinations and their gateways (address of the next device along the path or simply next-hop). One such entry in the routing table is called a route.
A hop occurs when a packet is passed from one network segment to another.
...
Its purpose is not just to store routes, but also to filter routing information to calculate the best route for each destination prefix, to build and update the Forwarding Information Base, and to distribute routes between different routing protocols.
...
- address part of the dst-address of the connected route is equal to a network of IP address item.
- netmask part of dst-address of the connected route is equal to the netmask part of the address of the IP address item.
- gateway of the connected route is equal to the actual-interface of the IP address item (same as an interface, except for bridge interface ports) and represents an interface where directly connected hosts from the articular particular Layer3 network can be reached.
...
A default route is used when the destination cannot be resolved by any other route in the routing table. In RouterOS dst-address of of the default route is 0.0.0.0/0 (for IPv4) and ::/0 (for IPv6) routes. If the routing table contains an active default route, then the routing table lookup in this table will never fail.
Typically home router routing table contains only connected networks and one default route to forward all outgoing traffic to the ISP's gateway:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[admin@TempTest] /ip/route> print Flags: D - dynamic; X - disabled, I - inactive, A - active; C - connect, S - static, r - ri p, b - bgp, o - ospf, d - dhcp, v - vpn Columns: DST-ADDRESS, GATEWAY, Distance # DST-ADDRESS GATEWAY D DAd 0.0.0.0/0 10.155.125.1 1 DAC 10.155.125.0/24 ether12 0 DAC 192.168.1.0/24 vlan2 0 |
Multipath (ECMP) routes
To implement some setups, such as load balancing, it might be necessary to use more than one path to a given destination.
Hardware Offloaded Route
Devices withLayer 3 Hardware Offloading (L3HW, otherwise known as IP switching or HW routing) allow offloading packet routing onto the switch chip. When L3HW is enabled, such routes will display H-flag:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[admin@MikroTik] > /ip/route print where static
Flags: A - ACTIVE; s - STATIC, y - COPY; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY D
0 AsH 0.0.0.0/0 172.16.2.1 1
1 AsH 10.0.0.0/8 10.155.121.254 1
2 AsH 192.168.3.0/24 172.16.2.1 1 |
By default, all the routes are participating to be hardware candidate routes. To further fine-tune which traffic to offload, there is an option for each IP or IPv6 static route to disable/enable suppress-hw-offload.
For example, if we know that the majority of traffic flows to the network where servers are located, we can enable offloading only to that specific destination:
| Code Block | ||
|---|---|---|
| ||
/ip route set [find where static && dst-address!="192.168.3.0/24"] suppress-hw-offload=yes |
Now only the route to 192.168.3.0/24 has an H-flag, indicating that it will be the only one eligible to be selected for HW offloading:
| Code Block | ||||
|---|---|---|---|---|
| ||||
[admin@MikroTik] > /ip/route print where static
Flags: A - ACTIVE; s - STATIC, y - COPY; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY D
0 As 0.0.0.0/0 172.16.2.1 1
1 As 10.0.0.0/8 10.155.121.254 1
2 AsH 192.168.3.0/24 172.16.2.1 1 |
| Warning |
|---|
H-flag does not indicate that the route is actually HW offloaded, it indicates only that route can be selected to be HW offloaded. |
Multipath (ECMP) routes
To implement some setups, such as load balancing, it might be necessary to use more than one path to a given destination.
ECMP (Equal cost multi-path) routes have multiple gateways (next-hop) values. All reachable next-hops are copied ECMP (Equal cost multi-path) routes have multiple gateways (next-hop) values. All reachable next-hops are copied to FIB and are used to forward packets.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
[admin@TempTest] /ip/route> print
Flags: D - DYNAMIC; I - INACTIVE, A - ACTIVE; C - CONNECT, S - STATIC, m - MODEM; + - ECMP
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY D
0 AS+ 192.168.2.0/24 10.155.125.1 1
1 AS+ 192.168.2.0/24 172.16.1.2 1 |
Route Selection
There can be multiple routes with the same destination received from various routing protocols and from static configurations but only one (best) destination can be used for packet forwarding. To determine the best path, RIB runs a Route Selection algorithm which picks the best route from all candidate routes per destination.
Only routes that meet the following criteria can participate in the route selection process:
- Route is not disabled.
- If the type of route is unicast it must have at least one reachable next-hop. ( if a gateway is from connected network and there is connected route active, the gateway is considered as reachable)
- Route should not be synthetic.
The candidate route with the lowest distance becomes an active route. If there is more than one candidate route with the same distance, the selection of the active route is arbitrary.
Nexthop Lookup
Nexthop lookup is a part of the route selection process. Its main purpose is to find a directly reachable gateway address (next-hop). Only after a valid next-hop is selected router knows which interface to use for packet forwarding.
Nexthop lookup becomes more complicated if routes have a gateway address that is several hops away from this router (e.g. iBGP, multihop eBGP). Such routes are installed in the FIB after the next-hop selection algorithm determines the address of the directly reachable gateway (immediate next-hop).
It is necessary to restrict the set of routes that can be used to look up immediate next-hops. Nexthop values of RIP or OSPF routes, for example, are supposed to be directly reachable and should be looked up only using connected routes. This is achieved using scope and target-scope properties.
Routes with a scope greater than the maximum accepted value are not used for next-hop lookup. Each route specifies the maximum accepted scope value for its nexthop in the target-scope property. The default value of this property allows nexthop lookup only through connected routes, with the exception of iBGP routes that have a larger default value and can lookup nexthop also through IGP and static routes.
There are changes in RouterOS v7 nexthop lookup.
Routes are processed in scope order, and updates to routes with a larger scope cannot affect the state of nexthop lookup for routes with a smaller scope.
.1.2 1 |
| Info |
|---|
By default, ECMP uses Layer3 hash policy |
Route Selection
There can be multiple routes with the same destination received from various routing protocols and from static configurations but only one (best) destination can be used for packet forwarding. To determine the best path, RIB runs a Route Selection algorithm that picks the best route from all candidate routes per destination.
Only routes that meet the following criteria can participate in the route selection process:
- Route is not disabled.
- If the type of route is unicast it must have at least one reachable next-hop. ( if a gateway is from a connected network and there is a connected route active, the gateway is considered as reachable)
- Route should not be synthetic.
The candidate route with the lowest distance becomes an active route. If there is more than one candidate route with the same distance, the selection of the active route is arbitrary.
Nexthop Lookup
Nexthop lookup is a part of the route selection process. Its main purpose is to find a directly reachable gateway address (next-hop). Only after a valid next-hop is selected router knows which interface to use for packet forwarding.
Nexthop lookup becomes more complicated if routes have a gateway address that is several hops away from this router (e.g. iBGP, multihop eBGP). Such routes are installed in the FIB after the next-hop selection algorithm determines the address of the directly reachable gateway (immediate next-hop).
It is necessary to restrict the set of routes that can be used to look up immediate next-hops. Nexthop values of RIP or OSPF routes, for example, are supposed to be directly reachable and should be looked up only using connected routes. This is achieved using scope and target-scope properties.
Routes with a scope greater than the maximum accepted value are not used for next-hop lookup. Each route specifies the maximum accepted scope value for its nexthop in the target-scope property. The default value of this property allows nexthop lookup only through connected routes, with the exception of iBGP routes that have a larger default value and can lookup nexthop also through IGP and static routes.
There are changes in RouterOS v7 nexthop lookup.
Routes are processed in scope order, and updates to routes with a larger scope cannot affect the state of nexthop lookup for routes with a smaller scope.
Consider an example from v6:
| Code Block | ||
|---|---|---|
| ||
/ip route add dst-address=10.0.1.0/24 gateway=10.0.0.1
scope=50 target-scope=30 comment=A
/ip route add dst-address=10.0.2.0/24 gateway=10.0.0.1
scope=30 target-scope=20 comment=B
/ip route add dst-address=10.0.0.0/24 scope=20 gateway=WHATEVER
comment=C |
Gateway 10.0.0.1 is recursively resolved through C using the smallest referring scope (scope 20 from route B), both routes are active. Now we change both A and B at the same timeConsider an example from v6:
| Code Block | ||
|---|---|---|
| ||
/ip route add dst-address=10.0.1.0/24 gateway=10.0.0.1 scope=50 set A target-scope=30 comment=A /ip route add dst-address=10.0.2.0/24 gateway=10.0.0.1 scope=30 target-scope=20 comment=B /ip route add dst-address=10.0.0.0/24 scope=20 gateway=WHATEVER comment=C |
Gateway 10.0.0.1 is recursively resolved through C using the smallest referring scope (scope 20 from route B), both routes are active. Now we change both A and B at the same time:
| Code Block | ||
|---|---|---|
| ||
/ip route set A target-scope=10 |
Suddenly, applying an update to route A makes the gateway of route B inactive. This is because in v6 there is only one gateway object per address.
v7 keeps multiple gateway objects per address, one for each combination of scope and gateway-check.
10 |
Suddenly, applying an update to route A makes the gateway of route B inactive. This is because in v6 there is only one gateway object per address.
v7 keeps multiple gateway objects per address, one for each combination of scope and gateway check.
When target-scope or gateway check of a route is changed, ROS v7 will not affect other routes, as it does in v6. In v7 target-scope and gateway check are properties that are internally attached to the gateway, not to the route.
Gateway check can be extended by setting check-gateway parameter. Gateway reachability can be checked by sending ARP probes, or ICMP messages or by checking active BFD sessions. The router periodically (every 10 seconds) checks the gateway by sending either an ICMP echo request (ping) or an ARP request (arp). If no response from the gateway is received for 10 seconds, the request times out. After two timeouts gateway is considered unreachable. After receiving a reply from the gateway it is considered reachable and the timeout counter is resetChanging target-scope or gateway-check of a route in v7 will not affect other routes, as it does in v6. In v7 target-scope and gateway-check are properties that are internally attached to the gateway, not to the route.
Route Storage
Routing information is stored to take as little memory as possible in a common case. These optimizations have non-obvious worst - cases and impact on performance.
...
Dst [4]/0 1/0+4 18 <-- number of prefixes
^ ^ ^ ^ ^
| | | | |
| | | | \- bytes taken by Route distinguisher or Interface Id
| | | \--- vrf/routing table
| | \----- AFI
| \------- netmask length of prefix
\---------- bytes taken by prefix value
[stuff subject to change without notice]
...
- private -- what is received from the peer, before passing in-filters.
- updated -- what is the result of applying in-filters.
- current -- what are the attributes currently used by the route.
...
Periodically (when needed), update attributes are calculated from private attributes. This happens when route update is received, or when in-filter is updated.
...
- L1 Data - all flags, list of extra properties, as-path;
- L2 Data - nexthops, RIP, OSPF, BGP metrics, route tags, originators, etc.
- L3 Data - distance, scope, kernel type, MPLS stuff
- extra properties - communities, originator, aggregator-id, cluster-list, unknown
...
Each route has dst-address property, that specifies all destination addresses this route can be used for. If there are several routes that apply to a particular IP address, the most specific one (with the largest netmask) is used. This operation (finding the most specific route that matches the given address) is called ''routing table lookup''.
Only one Best route can be used for packet forwarding. In cases where the routing table contains several routes with the same dst-address, all equally best routes are combined into one ECMP route. The best route is installed into FIB and marked as ''active''.
When forwarding decision uses additional information, such as the source address of the packet, it is called policy routing. Policy routing is implemented as a list of policy routing rules, that select different routing tables based on the destination address, source address, source interface, and routing mark (which can be changed by firewall mangle rules) of the packet.
...
Run routing decision:
- check that the packet has to be locally delivered (the destination address is the address of the router)
- process implicit policy routing rules
- process policy routing rules added by a user
- process implicit catch-all rule that looks up the destination in the ''main'' routing table
- the returned result is "network unreachable"
...
- drop or unreachable, then it is returned as a result of the routing decision process.
- lookup then the destination address of the packet is looked up in the routing table that is specified in the rule. If the lookup fails (there is no route that matches the destination address of the packet), then FIB proceeds to the next rule.
- lookup-only is similar to lookup except that lookup fails if none of the routes in the table matches the packet.
...
- if the type of the route is blackhole, prohibit, or unreachable, then return this action as the routing decision result;
- if this is a connected route or route with an interface as the gateway value, then return this interface and the destination address of the packet as the routing decision result;
- if this route has an IP address as the value of the gateway, then return this address and associated interface as the routing decision result;
- if this route has multiple values of nexthop, then pick one of them in a round-robin fashion.
Show Routes
...