no ip redirects, several question

[Brandon Marr]

I've come across this "no ip redirects" command while labbing, this came up while learning how to configure HSRP.  The Cisco page on HSRP speciifies this command as part of their config.  Iv been doing to research on this and I think I have the basic concept down that icmp redirects are when a packet get routed back out the same interface it was received on and tell the end host ot use the better gateway to reach the destination for the packet.  Iv been unable to find answers to the followign questions though.

1. Why have redirects anyway...when the packet hits the gateway and the packet gets redirected back out that same interface why not just send that packet where it belongs instead of telling the host to send it out another gatway?

2. will turning off redirects on all interfaces have any impact on the network, if so what?

3. when and why would it be necessary to turn off redirects?

Thanks

Brandon

[M02@rt37]

Hello @Brandon Marr,

As concerned the third point:

There are a few scenarios where it might be necessary to turn off ICMP redirects.

ICMP redirects can be exploited in certain attacks, such as redirecting traffic to a malicious router. Disabling redirects can mitigate these risks by preventing hosts from accepting redirection messages.

Also in some cases, network administrators prefer to have strict control over the routing decisions on hosts. By disabling redirects, they ensure that all traffic follows a predefined path determined by static routes or routing protocols. Furthermore, in troubleshooting scenarios, it may be necessary to temporarily disable ICMP redirects to isolate and diagnose routing issues. This allows you to observe the behavior without any "interference" from redirection messages.

[Joseph W. Doherty · Accepted solution]

#1 Why have redirects?  So to avoid the inefficiency of sending packets to a gateway which doesn't need to be used.  I.e. you might needlessly saturate the gateway's interface (and possibly impact its CPU) with traffic that can be sent directly to another gateway available to the host.

#2 Yup, see answer to #1.

#3 When for some reason(s) you don't want hosts to directly use another gateway.  (NB: There is a good reason for disabling redirects using original HSRP, which can be mitigated in later versions of HSRP.  Did your research explain why earlier versions of HSRP turn redirects off?)

[Richard Burts]

Brandon

I agree with Joseph that the reason for ip redirect is efficiency of the network. What if from a host device there are 2 paths that get to the destination, and one of the paths is more efficient/more direct that the other? And what if the less efficient path is the path that uses the default gateway? The original packet is forwarded by the gateway (less efficient path) and the gateway sends a redirect to the host so that for following packets they can use the more efficient path.

You can choose to disable redirect and it assures that all packet forwarding follows the routing logic that you have set up.

[Brandon Marr]

I will research why earlier versions of HSRP turn redirects off, this will likely help with some understanding on of the command.  These answers really did help with understanding though and I appreciate the time you took to reply. 

[Joseph W. Doherty]

"I will research why earlier versions of HSRP turn redirects off, this will likely help with some understanding on of the command."

Yes, I'm hoping finding that answer will enhance your understanding of redirects and HSRP too.  If you get stuck on finding that answer or find it confusing, let us know.

[MHM Cisco World]

Good design no need ip redirect, 

Suboptimal design need IP redirect. 

I prefer keep redirect not disable it. 

[Richard Burts]

"Good design no need ip redirect" is overly simplistic. While it is true that poor design might increase the need for redirect, it is not good to assume that good design eliminates the need for redirect. Let us think about a small well designed network. In this network there are 3 routers connected on an Ethernet. Perhaps routerA has 3 IPs 172.16.1.1 is FA0/0 and connects to the other routers, 192.168.1.1 is FA0/1 and provides connectivity to some users in the network, 11.11.11.11 is FA0/2 and is the connection to outside. Perhaps routerB has 2 IPs, 172.16.1.2 is FA0/0 and connects to the other routers, 192.168.2.0 is FA0/1 and provides connectivity to some users in the network.  Perhaps routerC has 2 IPs, 172.16.1.3 is FA0/0 and connects to the other routers, 192.168.3.0 is FA0/1 and provides connectivity to some users in the network. In this well designed network both routerB and routerC have a default route with routerA as the next hop. Now think what happens if a user connected to routerB (perhaps this user has IP 192.168.2.22) wants to communicate with a device (perhaps 192.168.3.33). routerB will forward the packet to the gateway routerA. routerA say "I can get there but I am not the optimum path" and sends a redirect to routerB. All further traffic from 192.168.2.22 to 192.168.3.33 will be forwarded directly to routerC. This well designed network benefits from ip redirect.

[MHM Cisco World]

I really dont get you example if you can draw it. 
for my point, good or suboptimal 
Now here is case that redirect need (not disable),
the host have GW point to R2 but the R2-R3 is down OR the path R2-R3 is more costly than R2-R1-R3 
how I can make my design good 
1- using Cost to make direct connect is more prefer than the interconnect 
2- using HSRP track to change the GW when the direct connect is down

[Joseph W. Doherty]

Possibly, what Rick and I have in mind is local gateway routers don't have similar upstream connections to all the same destinations.  I.e. some destinations are better reached via one router than the other router.  I.e. whichever router is being used as the gateway isn't optimal to transit to all destinations.

You may argue that such is not an optimal design, and most often would be correct, but in the real world design is often impacted by cost.

Laugh, if you own an automobile, perhaps it's not the best because of cost too.  ;  )

[MHM Cisco World]

You laugh alot 

Cost of link.

@Brandon Marr  dont disable redirect and config your network perfectly.

[Joseph W. Doherty]

It's HSRP that disables or filters (which is HSRP version dependent [this edit made to make this reply "totally correct"]) redirect (for good reason).

[MHM Cisco World]

that totally not correct 
First Hop Redundancy Protocols Configuration Guide, Cisco IOS Release 15SY - HSRP Support for ICMP Redirects [Cisco IOS 15.1SY] - Cisco

the HSRP modify the redirect not disable it.

[Joseph W. Doherty]

Ah, you touched upon what I alluded to earlier (in my responses to @Brandon Marr ), i.e. later variants of HSRP (12.1[3]T and later) can send redirects to hosts, but, it also requires additional HSRP setup.

The "totally correct" answer is:  it depends (on HSRP variant and/or HSRP configuration).

The default of the later HSRP varients is similar to original HSRP, hosts do not get a redirect.

To @Brandon Marr , the reference @MHM Cisco World provided does provide the kind of information I suggested you try to find yourself, i.e. why HSRP doesn't (usually) send hosts redirects.

[Brandon Marr]

Ok so reading through some of this is appears that older versions did not allow redirects because the redirect package would end up using the actual IP of the active router in the HSRP group.  This ends up loosing redundancy because now if that active router goes down the host that received the redirect paxk now has that routers IP address in its route table and will od course be unable to send traffic because that router is down.  Later versions of HSRP allow redirects but the redirect is compared to HSRP groups and if the destination is determined to be using HSRP then the packet is modified with the VIP before being sent to the host.   

If this is correct and I'm understanding correctly.  A question I have would be why does it appear to be standard practice to turn off redirects if using HSRP v2 if the issues is solved by modification to the redirect packet adding the VIP over the active routers IP.

My apologies in advance for bad Grammer or typos I responded using my phone. 

Thanks

Brandon